53 files changed, 703 insertions, 282 deletions

diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 9bf0b737aa51..b2e07f0dd298 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -43,6 +43,7 @@
 #include <net/9p/transport.h>
 #include <linux/scatterlist.h>
 #include <linux/virtio.h>
+#include <linux/virtio_ids.h>
 #include <linux/virtio_9p.h>
 
 #define VIRTQUEUE_NUM   128
@@ -200,7 +201,7 @@ p9_virtio_request(struct p9_client *client, struct p9_req_t *req)
 
         req->status = REQ_STATUS_SENT;
 
-        if (chan->vq->vq_ops->add_buf(chan->vq, chan->sg, out, in, req->tc)) {
+        if (chan->vq->vq_ops->add_buf(chan->vq, chan->sg, out, in, req->tc) < 0) {
                 P9_DPRINTK(P9_DEBUG_TRANS,
                         "9p debug: virtio rpc add_buf returned failure");
                 return -EIO;
@@ -334,8 +335,6 @@ static void p9_virtio_remove(struct virtio_device *vdev)
         }
 }
 
-#define VIRTIO_ID_9P 9
-
 static struct virtio_device_id id_table[] = {
         { VIRTIO_ID_9P, VIRTIO_DEV_ANY_ID },
         { 0 },
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 95f7a7a544b4..7f939ce29801 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -68,7 +68,7 @@ static struct attribute_group bt_link_group = {
         .attrs = bt_link_attrs,
 };
 
-static struct attribute_group *bt_link_groups[] = {
+static const struct attribute_group *bt_link_groups[] = {
         &bt_link_group,
         NULL
 };
@@ -392,7 +392,7 @@ static struct attribute_group bt_host_group = {
         .attrs = bt_host_attrs,
 };
 
-static struct attribute_group *bt_host_groups[] = {
+static const struct attribute_group *bt_host_groups[] = {
         &bt_host_group,
         NULL
 };
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 09bedeb5579c..49d8495d69be 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -577,11 +577,6 @@ static int hidp_session(void *arg)
         }
 
         if (session->hid) {
-                if (session->hid->claimed & HID_CLAIMED_INPUT)
-                        hidinput_disconnect(session->hid);
-                if (session->hid->claimed & HID_CLAIMED_HIDRAW)
-                        hidraw_disconnect(session->hid);
-
                 hid_destroy_device(session->hid);
                 session->hid = NULL;
         }
@@ -747,8 +742,6 @@ static void hidp_stop(struct hid_device *hid)
         skb_queue_purge(&session->ctrl_transmit);
         skb_queue_purge(&session->intr_transmit);
 
-        if (hid->claimed & HID_CLAIMED_INPUT)
-                hidinput_disconnect(hid);
         hid->claimed = 0;
 }
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 907a82e9023d..a16a2342f6bf 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -965,12 +965,12 @@ static struct nf_hook_ops br_nf_ops[] __read_mostly = {
 
 #ifdef CONFIG_SYSCTL
 static
-int brnf_sysctl_call_tables(ctl_table * ctl, int write, struct file *filp,
+int brnf_sysctl_call_tables(ctl_table * ctl, int write,
                             void __user * buffer, size_t * lenp, loff_t * ppos)
 {
         int ret;
 
-        ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write && *(int *)(ctl->data))
                 *(int *)(ctl->data) = 1;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index ad91e9e5f475..7d4c57523b09 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -493,7 +493,7 @@ void netdev_unregister_kobject(struct net_device * net)
 int netdev_register_kobject(struct net_device *net)
 {
         struct device *dev = &(net->dev);
-        struct attribute_group **groups = net->sysfs_groups;
+        const struct attribute_group **groups = net->sysfs_groups;
 
         dev->class = &net_class;
         dev->platform_data = net;
diff --git a/net/core/sock.c b/net/core/sock.c
index 30d5446512f9..524712a7b154 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1206,12 +1206,12 @@ EXPORT_SYMBOL_GPL(sk_setup_caps);
 
 void __init sk_init(void)
 {
-        if (num_physpages <= 4096) {
+        if (totalram_pages <= 4096) {
                 sysctl_wmem_max = 32767;
                 sysctl_rmem_max = 32767;
                 sysctl_wmem_default = 32767;
                 sysctl_rmem_default = 32767;
-        } else if (num_physpages >= 131072) {
+        } else if (totalram_pages >= 131072) {
                 sysctl_wmem_max = 131071;
                 sysctl_rmem_max = 131071;
         }
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 923db06c7e55..bc4467082a00 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1049,10 +1049,10 @@ static int __init dccp_init(void)
          *
          * The methodology is similar to that of the buffer cache.
          */
-        if (num_physpages >= (128 * 1024))
-                goal = num_physpages >> (21 - PAGE_SHIFT);
+        if (totalram_pages >= (128 * 1024))
+                goal = totalram_pages >> (21 - PAGE_SHIFT);
         else
-                goal = num_physpages >> (23 - PAGE_SHIFT);
+                goal = totalram_pages >> (23 - PAGE_SHIFT);
 
         if (thash_entries)
                 goal = (thash_entries *
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index 1c6a5bb6f0c8..6e1f085db06a 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -164,7 +164,7 @@ static int max_t3[] = { 8191 }; /* Must fit in 16 bits when multiplied by BCT3MU
 static int min_priority[1];
 static int max_priority[] = { 127 }; /* From DECnet spec */
 
-static int dn_forwarding_proc(ctl_table *, int, struct file *,
+static int dn_forwarding_proc(ctl_table *, int,
                         void __user *, size_t *, loff_t *);
 static int dn_forwarding_sysctl(ctl_table *table,
                         void __user *oldval, size_t __user *oldlenp,
@@ -274,7 +274,6 @@ static void dn_dev_sysctl_unregister(struct dn_dev_parms *parms)
 }
 
 static int dn_forwarding_proc(ctl_table *table, int write,
-                                struct file *filep,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
 {
@@ -290,7 +289,7 @@ static int dn_forwarding_proc(ctl_table *table, int write,
         dn_db = dev->dn_ptr;
         old = dn_db->parms.forwarding;
 
-        err = proc_dointvec(table, write, filep, buffer, lenp, ppos);
+        err = proc_dointvec(table, write, buffer, lenp, ppos);
 
         if ((err >= 0) && write) {
                 if (dn_db->parms.forwarding < 0)
diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c
index 9383d3e5a1ab..57662cabaf9b 100644
--- a/net/decnet/dn_route.c
+++ b/net/decnet/dn_route.c
@@ -1750,7 +1750,7 @@ void __init dn_route_init(void)
         dn_route_timer.expires = jiffies + decnet_dst_gc_interval * HZ;
         add_timer(&dn_route_timer);
 
-        goal = num_physpages >> (26 - PAGE_SHIFT);
+        goal = totalram_pages >> (26 - PAGE_SHIFT);
 
         for(order = 0; (1UL << order) < goal; order++)
                 /* NOTHING */;
diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
index 5bcd592ae6dd..26b0ab1e9f56 100644
--- a/net/decnet/sysctl_net_decnet.c
+++ b/net/decnet/sysctl_net_decnet.c
@@ -165,7 +165,6 @@ static int dn_node_address_strategy(ctl_table *table,
 }
 
 static int dn_node_address_handler(ctl_table *table, int write,
-                                struct file *filp,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
 {
@@ -276,7 +275,6 @@ static int dn_def_dev_strategy(ctl_table *table,
 
 
 static int dn_def_dev_handler(ctl_table *table, int write,
-                                struct file * filp,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
 {
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 07336c6201f0..e92f1fd28aa5 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1270,10 +1270,10 @@ static void inet_forward_change(struct net *net)
 }
 
 static int devinet_conf_proc(ctl_table *ctl, int write,
-                             struct file *filp, void __user *buffer,
+                             void __user *buffer,
                              size_t *lenp, loff_t *ppos)
 {
-        int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write) {
                 struct ipv4_devconf *cnf = ctl->extra1;
@@ -1342,12 +1342,12 @@ static int devinet_conf_sysctl(ctl_table *table,
 }
 
 static int devinet_sysctl_forward(ctl_table *ctl, int write,
-                                  struct file *filp, void __user *buffer,
+                                  void __user *buffer,
                                   size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
         int val = *valp;
-        int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write && *valp != val) {
                 struct net *net = ctl->extra2;
@@ -1372,12 +1372,12 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
 }
 
 int ipv4_doint_and_flush(ctl_table *ctl, int write,
-                         struct file *filp, void __user *buffer,
+                         void __user *buffer,
                          size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
         int val = *valp;
-        int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
         struct net *net = ctl->extra2;
 
         if (write && *valp != val)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 91867d3e6328..bb4199252026 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3036,7 +3036,7 @@ void ip_rt_multicast_event(struct in_device *in_dev)
 
 #ifdef CONFIG_SYSCTL
 static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
-                                        struct file *filp, void __user *buffer,
+                                        void __user *buffer,
                                         size_t *lenp, loff_t *ppos)
 {
         if (write) {
@@ -3046,7 +3046,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
 
                 memcpy(&ctl, __ctl, sizeof(ctl));
                 ctl.data = &flush_delay;
-                proc_dointvec(&ctl, write, filp, buffer, lenp, ppos);
+                proc_dointvec(&ctl, write, buffer, lenp, ppos);
 
                 net = (struct net *)__ctl->extra1;
                 rt_cache_flush(net, flush_delay);
@@ -3106,12 +3106,11 @@ static void rt_secret_reschedule(int old)
 }
 
 static int ipv4_sysctl_rt_secret_interval(ctl_table *ctl, int write,
-                                          struct file *filp,
                                           void __user *buffer, size_t *lenp,
                                           loff_t *ppos)
 {
         int old = ip_rt_secret_interval;
-        int ret = proc_dointvec_jiffies(ctl, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
 
         rt_secret_reschedule(old);
 
@@ -3414,7 +3413,7 @@ int __init ip_rt_init(void)
                 alloc_large_system_hash("IP route cache",
                                         sizeof(struct rt_hash_bucket),
                                         rhash_entries,
-                                        (num_physpages >= 128 * 1024) ?
+                                        (totalram_pages >= 128 * 1024) ?
                                         15 : 17,
                                         0,
                                         &rt_hash_log,
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index cd2b97f1b6e1..a6e0e077ac33 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -37,12 +37,13 @@ __initcall(init_syncookies);
 #define COOKIEBITS 24   /* Upper bits store count */
 #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
 
-static DEFINE_PER_CPU(__u32, cookie_scratch)[16 + 5 + SHA_WORKSPACE_WORDS];
+static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS],
+                      ipv4_cookie_scratch);
 
 static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
                        u32 count, int c)
 {
-        __u32 *tmp = __get_cpu_var(cookie_scratch);
+        __u32 *tmp = __get_cpu_var(ipv4_cookie_scratch);
 
         memcpy(tmp + 4, syncookie_secret[c], sizeof(syncookie_secret[c]));
         tmp[0] = (__force u32)saddr;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 4710d219f06a..2dcf04d9b005 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -36,7 +36,7 @@ static void set_local_port_range(int range[2])
 }
 
 /* Validate changes from /proc interface. */
-static int ipv4_local_port_range(ctl_table *table, int write, struct file *filp,
+static int ipv4_local_port_range(ctl_table *table, int write,
                                  void __user *buffer,
                                  size_t *lenp, loff_t *ppos)
 {
@@ -51,7 +51,7 @@ static int ipv4_local_port_range(ctl_table *table, int write, struct file *filp,
         };
 
         inet_get_local_port_range(range, range + 1);
-        ret = proc_dointvec_minmax(&tmp, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
 
         if (write && ret == 0) {
                 if (range[1] < range[0])
@@ -91,7 +91,7 @@ static int ipv4_sysctl_local_port_range(ctl_table *table,
 }
 
 
-static int proc_tcp_congestion_control(ctl_table *ctl, int write, struct file * filp,
+static int proc_tcp_congestion_control(ctl_table *ctl, int write,
                                        void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char val[TCP_CA_NAME_MAX];
@@ -103,7 +103,7 @@ static int proc_tcp_congestion_control(ctl_table *ctl, int write, struct file *
 
         tcp_get_default_congestion_control(val);
 
-        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
         if (write && ret == 0)
                 ret = tcp_set_default_congestion_control(val);
         return ret;
@@ -129,7 +129,7 @@ static int sysctl_tcp_congestion_control(ctl_table *table,
 }
 
 static int proc_tcp_available_congestion_control(ctl_table *ctl,
-                                                 int write, struct file * filp,
+                                                 int write,
                                                  void __user *buffer, size_t *lenp,
                                                  loff_t *ppos)
 {
@@ -140,13 +140,13 @@ static int proc_tcp_available_congestion_control(ctl_table *ctl,
         if (!tbl.data)
                 return -ENOMEM;
         tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX);
-        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
         kfree(tbl.data);
         return ret;
 }
 
 static int proc_allowed_congestion_control(ctl_table *ctl,
-                                           int write, struct file * filp,
+                                           int write,
                                            void __user *buffer, size_t *lenp,
                                            loff_t *ppos)
 {
@@ -158,7 +158,7 @@ static int proc_allowed_congestion_control(ctl_table *ctl,
                 return -ENOMEM;
 
         tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen);
-        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
         if (write && ret == 0)
                 ret = tcp_set_allowed_congestion_control(tbl.data);
         kfree(tbl.data);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 19a0612b8a20..21387ebabf00 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2862,7 +2862,7 @@ void __init tcp_init(void)
                 alloc_large_system_hash("TCP established",
                                         sizeof(struct inet_ehash_bucket),
                                         thash_entries,
-                                        (num_physpages >= 128 * 1024) ?
+                                        (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
                                         &tcp_hashinfo.ehash_size,
@@ -2879,7 +2879,7 @@ void __init tcp_init(void)
                 alloc_large_system_hash("TCP bind",
                                         sizeof(struct inet_bind_hashbucket),
                                         tcp_hashinfo.ehash_size,
-                                        (num_physpages >= 128 * 1024) ?
+                                        (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
                                         &tcp_hashinfo.bhash_size,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 55f486d89c88..1fd0a3d775d2 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3986,14 +3986,14 @@ static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 #ifdef CONFIG_SYSCTL
 
 static
-int addrconf_sysctl_forward(ctl_table *ctl, int write, struct file * filp,
+int addrconf_sysctl_forward(ctl_table *ctl, int write,
                            void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
         int val = *valp;
         int ret;
 
-        ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_fixup_forwarding(ctl, valp, val);
@@ -4090,14 +4090,14 @@ static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
 }
 
 static
-int addrconf_sysctl_disable(ctl_table *ctl, int write, struct file * filp,
+int addrconf_sysctl_disable(ctl_table *ctl, int write,
                             void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
         int val = *valp;
         int ret;
 
-        ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_disable_ipv6(ctl, valp, val);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 3907510c2ce3..090675e269ee 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -324,7 +324,7 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct seq_operations ipmr_mfc_seq_ops = {
+static const struct seq_operations ipmr_mfc_seq_ops = {
         .start = ipmr_mfc_seq_start,
         .next  = ipmr_mfc_seq_next,
         .stop  = ipmr_mfc_seq_stop,
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 7015478797f6..498b9b0b0fad 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1735,7 +1735,7 @@ static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
         }
 }
 
-int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, struct file * filp, void __user *buffer, size_t *lenp, loff_t *ppos)
+int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         struct net_device *dev = ctl->extra1;
         struct inet6_dev *idev;
@@ -1746,16 +1746,16 @@ int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, struct file * f
                 ndisc_warn_deprecated_sysctl(ctl, "syscall", dev ? dev->name : "default");
 
         if (strcmp(ctl->procname, "retrans_time") == 0)
-                ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+                ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         else if (strcmp(ctl->procname, "base_reachable_time") == 0)
                 ret = proc_dointvec_jiffies(ctl, write,
-                                            filp, buffer, lenp, ppos);
+                                            buffer, lenp, ppos);
 
         else if ((strcmp(ctl->procname, "retrans_time_ms") == 0) ||
                  (strcmp(ctl->procname, "base_reachable_time_ms") == 0))
                 ret = proc_dointvec_ms_jiffies(ctl, write,
-                                               filp, buffer, lenp, ppos);
+                                               buffer, lenp, ppos);
         else
                 ret = -1;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 77aecbe8ff6c..d6fe7646a8ff 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2524,13 +2524,13 @@ static const struct file_operations rt6_stats_seq_fops = {
 #ifdef CONFIG_SYSCTL
 
 static
-int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write, struct file * filp,
+int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write,
                               void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         struct net *net = current->nsproxy->net_ns;
         int delay = net->ipv6.sysctl.flush_delay;
         if (write) {
-                proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+                proc_dointvec(ctl, write, buffer, lenp, ppos);
                 fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
                 return 0;
         } else
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 8c2513982b61..6b6ae913b5d4 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -74,12 +74,13 @@ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
         return child;
 }
 
-static DEFINE_PER_CPU(__u32, cookie_scratch)[16 + 5 + SHA_WORKSPACE_WORDS];
+static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS],
+                      ipv6_cookie_scratch);
 
 static u32 cookie_hash(struct in6_addr *saddr, struct in6_addr *daddr,
                        __be16 sport, __be16 dport, u32 count, int c)
 {
-        __u32 *tmp = __get_cpu_var(cookie_scratch);
+        __u32 *tmp = __get_cpu_var(ipv6_cookie_scratch);
 
         /*
          * we have 320 bits of information to hash, copy in the remaining
diff --git a/net/irda/irsysctl.c b/net/irda/irsysctl.c
index 57f8817c3979..5c86567e5a78 100644
--- a/net/irda/irsysctl.c
+++ b/net/irda/irsysctl.c
@@ -73,12 +73,12 @@ static int min_lap_keepalive_time = 100;	/* 100us */
 /* For other sysctl, I've no idea of the range. Maybe Dag could help
  * us on that - Jean II */
 
-static int do_devname(ctl_table *table, int write, struct file *filp,
+static int do_devname(ctl_table *table, int write,
                       void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int ret;
 
-        ret = proc_dostring(table, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(table, write, buffer, lenp, ppos);
         if (ret == 0 && write) {
                 struct ias_value *val;
 
@@ -90,12 +90,12 @@ static int do_devname(ctl_table *table, int write, struct file *filp,
 }
 
 
-static int do_discovery(ctl_table *table, int write, struct file *filp,
+static int do_discovery(ctl_table *table, int write,
                     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        int ret;
 
-       ret = proc_dointvec(table, write, filp, buffer, lenp, ppos);
+       ret = proc_dointvec(table, write, buffer, lenp, ppos);
        if (ret)
                return ret;
 
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index fba2892b99e1..446e9bd4b4bc 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1496,14 +1496,14 @@ static int ip_vs_zero_all(void)
 
 
 static int
-proc_do_defense_mode(ctl_table *table, int write, struct file * filp,
+proc_do_defense_mode(ctl_table *table, int write,
                      void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int *valp = table->data;
         int val = *valp;
         int rc;
 
-        rc = proc_dointvec(table, write, filp, buffer, lenp, ppos);
+        rc = proc_dointvec(table, write, buffer, lenp, ppos);
         if (write && (*valp != val)) {
                 if ((*valp < 0) || (*valp > 3)) {
                         /* Restore the correct value */
@@ -1517,7 +1517,7 @@ proc_do_defense_mode(ctl_table *table, int write, struct file * filp,
 
 
 static int
-proc_do_sync_threshold(ctl_table *table, int write, struct file *filp,
+proc_do_sync_threshold(ctl_table *table, int write,
                        void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         int *valp = table->data;
@@ -1527,7 +1527,7 @@ proc_do_sync_threshold(ctl_table *table, int write, struct file *filp,
         /* backup the value first */
         memcpy(val, valp, sizeof(val));
 
-        rc = proc_dointvec(table, write, filp, buffer, lenp, ppos);
+        rc = proc_dointvec(table, write, buffer, lenp, ppos);
         if (write && (valp[0] < 0 || valp[1] < 0 || valp[0] >= valp[1])) {
                 /* Restore the correct value */
                 memcpy(valp, val, sizeof(val));
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index b37109817a98..7c9ec3dee96e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1245,9 +1245,9 @@ static int nf_conntrack_init_init_net(void)
          * machine has 512 buckets. >= 1GB machines have 16384 buckets. */
         if (!nf_conntrack_htable_size) {
                 nf_conntrack_htable_size
-                        = (((num_physpages << PAGE_SHIFT) / 16384)
+                        = (((totalram_pages << PAGE_SHIFT) / 16384)
                            / sizeof(struct hlist_head));
-                if (num_physpages > (1024 * 1024 * 1024 / PAGE_SIZE))
+                if (totalram_pages > (1024 * 1024 * 1024 / PAGE_SIZE))
                         nf_conntrack_htable_size = 16384;
                 if (nf_conntrack_htable_size < 32)
                         nf_conntrack_htable_size = 32;
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 4e620305f28c..c93494fef8ef 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -226,7 +226,7 @@ static char nf_log_sysctl_fnames[NFPROTO_NUMPROTO-NFPROTO_UNSPEC][3];
 static struct ctl_table nf_log_sysctl_table[NFPROTO_NUMPROTO+1];
 static struct ctl_table_header *nf_log_dir_header;
 
-static int nf_log_proc_dostring(ctl_table *table, int write, struct file *filp,
+static int nf_log_proc_dostring(ctl_table *table, int write,
                          void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         const struct nf_logger *logger;
@@ -260,7 +260,7 @@ static int nf_log_proc_dostring(ctl_table *table, int write, struct file *filp,
                         table->data = "NONE";
                 else
                         table->data = logger->name;
-                r = proc_dostring(table, write, filp, buffer, lenp, ppos);
+                r = proc_dostring(table, write, buffer, lenp, ppos);
                 mutex_unlock(&nf_log_mutex);
         }
 
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index a6ac83a93348..f01955cce314 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -617,7 +617,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
         int cpu;
 
         /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
-        if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > num_physpages)
+        if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
                 return NULL;
 
         newinfo = kzalloc(XT_TABLE_INFO_SZ, GFP_KERNEL);
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 219dcdbe388c..dd16e404424f 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -194,9 +194,9 @@ static int htable_create_v0(struct xt_hashlimit_info *minfo, u_int8_t family)
         if (minfo->cfg.size)
                 size = minfo->cfg.size;
         else {
-                size = ((num_physpages << PAGE_SHIFT) / 16384) /
+                size = ((totalram_pages << PAGE_SHIFT) / 16384) /
                        sizeof(struct list_head);
-                if (num_physpages > (1024 * 1024 * 1024 / PAGE_SIZE))
+                if (totalram_pages > (1024 * 1024 * 1024 / PAGE_SIZE))
                         size = 8192;
                 if (size < 16)
                         size = 16;
@@ -266,9 +266,9 @@ static int htable_create(struct xt_hashlimit_mtinfo1 *minfo, u_int8_t family)
         if (minfo->cfg.size) {
                 size = minfo->cfg.size;
         } else {
-                size = (num_physpages << PAGE_SHIFT) / 16384 /
+                size = (totalram_pages << PAGE_SHIFT) / 16384 /
                        sizeof(struct list_head);
-                if (num_physpages > 1024 * 1024 * 1024 / PAGE_SIZE)
+                if (totalram_pages > 1024 * 1024 * 1024 / PAGE_SIZE)
                         size = 8192;
                 if (size < 16)
                         size = 16;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index c5aab6a368ce..55180b99562a 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2091,10 +2091,10 @@ static int __init netlink_proto_init(void)
         if (!nl_table)
                 goto panic;
 
-        if (num_physpages >= (128 * 1024))
-                limit = num_physpages >> (21 - PAGE_SHIFT);
+        if (totalram_pages >= (128 * 1024))
+                limit = totalram_pages >> (21 - PAGE_SHIFT);
         else
-                limit = num_physpages >> (23 - PAGE_SHIFT);
+                limit = totalram_pages >> (23 - PAGE_SHIFT);
 
         order = get_bitmask_order(limit) - 1 + PAGE_SHIFT;
         limit = (1UL << order) / sizeof(struct hlist_head);
diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
index 7b5749ee2765..2220f3322326 100644
--- a/net/phonet/sysctl.c
+++ b/net/phonet/sysctl.c
@@ -56,7 +56,7 @@ void phonet_get_local_port_range(int *min, int *max)
         } while (read_seqretry(&local_port_range_lock, seq));
 }
 
-static int proc_local_port_range(ctl_table *table, int write, struct file *filp,
+static int proc_local_port_range(ctl_table *table, int write,
                                 void __user *buffer,
                                 size_t *lenp, loff_t *ppos)
 {
@@ -70,7 +70,7 @@ static int proc_local_port_range(ctl_table *table, int write, struct file *filp,
                 .extra2 = &local_port_range_max,
         };
 
-        ret = proc_dointvec_minmax(&tmp, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
 
         if (write && ret == 0) {
                 if (range[1] < range[0])
diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
index 8d8488306fe4..d2c904dd6fbc 100644
--- a/net/rds/ib_stats.c
+++ b/net/rds/ib_stats.c
@@ -37,7 +37,7 @@
 #include "rds.h"
 #include "ib.h"
 
-DEFINE_PER_CPU(struct rds_ib_statistics, rds_ib_stats) ____cacheline_aligned;
+DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats);
 
 static const char *const rds_ib_stat_names[] = {
         "ib_connect_raced",
diff --git a/net/rds/iw_stats.c b/net/rds/iw_stats.c
index d33ea790484e..5fe67f6a1d80 100644
--- a/net/rds/iw_stats.c
+++ b/net/rds/iw_stats.c
@@ -37,7 +37,7 @@
 #include "rds.h"
 #include "iw.h"
 
-DEFINE_PER_CPU(struct rds_iw_statistics, rds_iw_stats) ____cacheline_aligned;
+DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_iw_statistics, rds_iw_stats);
 
 static const char *const rds_iw_stat_names[] = {
         "iw_connect_raced",
diff --git a/net/rds/page.c b/net/rds/page.c
index 55c21efdb62e..36790122dfd4 100644
--- a/net/rds/page.c
+++ b/net/rds/page.c
@@ -39,7 +39,7 @@ struct rds_page_remainder {
         unsigned long   r_offset;
 };
 
-DEFINE_PER_CPU(struct rds_page_remainder, rds_page_remainders) ____cacheline_aligned;
+DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_page_remainder, rds_page_remainders);
 
 /*
  * returns 0 on success or -errno on failure.
diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
index d9231245a79a..bc0019f704fe 100644
--- a/net/rxrpc/ar-call.c
+++ b/net/rxrpc/ar-call.c
@@ -96,7 +96,7 @@ static struct rxrpc_call *rxrpc_alloc_call(gfp_t gfp)
 }
 
 /*
- * allocate a new client call and attempt to to get a connection slot for it
+ * allocate a new client call and attempt to get a connection slot for it
  */
 static struct rxrpc_call *rxrpc_alloc_client_call(
         struct rxrpc_sock *rx,
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 375d64cb1a3d..2c5c76be18f8 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -77,7 +77,7 @@
  *   The service curve parameters are converted to the internal
  *   representation. The slope values are scaled to avoid overflow.
  *   the inverse slope values as well as the y-projection of the 1st
- *   segment are kept in order to to avoid 64-bit divide operations
+ *   segment are kept in order to avoid 64-bit divide operations
  *   that are expensive on 32-bit architectures.
  */
 
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index c557f1fb1c66..612dc878e05c 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -1184,10 +1184,10 @@ SCTP_STATIC __init int sctp_init(void)
         /* Size and allocate the association hash table.
          * The methodology is similar to that of the tcp hash tables.
          */
-        if (num_physpages >= (128 * 1024))
-                goal = num_physpages >> (22 - PAGE_SHIFT);
+        if (totalram_pages >= (128 * 1024))
+                goal = totalram_pages >> (22 - PAGE_SHIFT);
         else
-                goal = num_physpages >> (24 - PAGE_SHIFT);
+                goal = totalram_pages >> (24 - PAGE_SHIFT);
 
         for (order = 0; (1UL << order) < goal; order++)
                 ;
diff --git a/net/socket.c b/net/socket.c
index 2a022c00d85c..49917a1cac7d 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -86,6 +86,7 @@
 #include <linux/audit.h>
 #include <linux/wireless.h>
 #include <linux/nsproxy.h>
+#include <linux/magic.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -235,8 +236,6 @@ int move_addr_to_user(struct sockaddr *kaddr, int klen, void __user *uaddr,
         return __put_user(klen, ulen);
 }
 
-#define SOCKFS_MAGIC 0x534F434B
-
 static struct kmem_cache *sock_inode_cachep __read_mostly;
 
 static struct inode *sock_alloc_inode(struct super_block *sb)
@@ -285,7 +284,7 @@ static int init_inodecache(void)
         return 0;
 }
 
-static struct super_operations sockfs_ops = {
+static const struct super_operations sockfs_ops = {
         .alloc_inode =  sock_alloc_inode,
         .destroy_inode =sock_destroy_inode,
         .statfs =       simple_statfs,
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 0c431c277af5..54a4e042f104 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -385,7 +385,7 @@ rpcauth_init_cred(struct rpc_cred *cred, const struct auth_cred *acred,
 EXPORT_SYMBOL_GPL(rpcauth_init_cred);
 
 void
-rpcauth_generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred)
+rpcauth_generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred, int lookupflags)
 {
         task->tk_msg.rpc_cred = get_rpccred(cred);
         dprintk("RPC: %5u holding %s cred %p\n", task->tk_pid,
@@ -394,7 +394,7 @@ rpcauth_generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred)
 EXPORT_SYMBOL_GPL(rpcauth_generic_bind_cred);
 
 static void
-rpcauth_bind_root_cred(struct rpc_task *task)
+rpcauth_bind_root_cred(struct rpc_task *task, int lookupflags)
 {
         struct rpc_auth *auth = task->tk_client->cl_auth;
         struct auth_cred acred = {
@@ -405,7 +405,7 @@ rpcauth_bind_root_cred(struct rpc_task *task)
 
         dprintk("RPC: %5u looking up %s cred\n",
                 task->tk_pid, task->tk_client->cl_auth->au_ops->au_name);
-        ret = auth->au_ops->lookup_cred(auth, &acred, 0);
+        ret = auth->au_ops->lookup_cred(auth, &acred, lookupflags);
         if (!IS_ERR(ret))
                 task->tk_msg.rpc_cred = ret;
         else
@@ -413,14 +413,14 @@ rpcauth_bind_root_cred(struct rpc_task *task)
 }
 
 static void
-rpcauth_bind_new_cred(struct rpc_task *task)
+rpcauth_bind_new_cred(struct rpc_task *task, int lookupflags)
 {
         struct rpc_auth *auth = task->tk_client->cl_auth;
         struct rpc_cred *ret;
 
         dprintk("RPC: %5u looking up %s cred\n",
                 task->tk_pid, auth->au_ops->au_name);
-        ret = rpcauth_lookupcred(auth, 0);
+        ret = rpcauth_lookupcred(auth, lookupflags);
         if (!IS_ERR(ret))
                 task->tk_msg.rpc_cred = ret;
         else
@@ -430,12 +430,16 @@ rpcauth_bind_new_cred(struct rpc_task *task)
 void
 rpcauth_bindcred(struct rpc_task *task, struct rpc_cred *cred, int flags)
 {
+        int lookupflags = 0;
+
+        if (flags & RPC_TASK_ASYNC)
+                lookupflags |= RPCAUTH_LOOKUP_NEW;
         if (cred != NULL)
-                cred->cr_ops->crbind(task, cred);
+                cred->cr_ops->crbind(task, cred, lookupflags);
         else if (flags & RPC_TASK_ROOTCREDS)
-                rpcauth_bind_root_cred(task);
+                rpcauth_bind_root_cred(task, lookupflags);
         else
-                rpcauth_bind_new_cred(task);
+                rpcauth_bind_new_cred(task, lookupflags);
 }
 
 void
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 4028502f0528..bf88bf8e9365 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -55,13 +55,13 @@ struct rpc_cred *rpc_lookup_machine_cred(void)
 EXPORT_SYMBOL_GPL(rpc_lookup_machine_cred);
 
 static void
-generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred)
+generic_bind_cred(struct rpc_task *task, struct rpc_cred *cred, int lookupflags)
 {
         struct rpc_auth *auth = task->tk_client->cl_auth;
         struct auth_cred *acred = &container_of(cred, struct generic_cred, gc_base)->acred;
         struct rpc_cred *ret;
 
-        ret = auth->au_ops->lookup_cred(auth, acred, 0);
+        ret = auth->au_ops->lookup_cred(auth, acred, lookupflags);
         if (!IS_ERR(ret))
                 task->tk_msg.rpc_cred = ret;
         else
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 2e6a148d277c..f6c51e562a02 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1374,8 +1374,10 @@ svcauth_gss_release(struct svc_rqst *rqstp)
                 if (stat)
                         goto out_err;
                 break;
-        default:
-                goto out_err;
+        /*
+         * For any other gc_svc value, svcauth_gss_accept() already set
+         * the auth_error appropriately; just fall through:
+         */
         }
 
 out:
diff --git a/net/sunrpc/auth_null.c b/net/sunrpc/auth_null.c
index c70dd7f5258e..1db618f56ecb 100644
--- a/net/sunrpc/auth_null.c
+++ b/net/sunrpc/auth_null.c
@@ -8,7 +8,6 @@
 
 #include <linux/types.h>
 #include <linux/module.h>
-#include <linux/utsname.h>
 #include <linux/sunrpc/clnt.h>
 
 #ifdef RPC_DEBUG
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 45cdaff9b361..d6eee291a0e2 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -103,23 +103,21 @@ struct cache_head *sunrpc_cache_lookup(struct cache_detail *detail,
 EXPORT_SYMBOL_GPL(sunrpc_cache_lookup);
 
 
-static void queue_loose(struct cache_detail *detail, struct cache_head *ch);
+static void cache_dequeue(struct cache_detail *detail, struct cache_head *ch);
 
-static int cache_fresh_locked(struct cache_head *head, time_t expiry)
+static void cache_fresh_locked(struct cache_head *head, time_t expiry)
 {
         head->expiry_time = expiry;
         head->last_refresh = get_seconds();
-        return !test_and_set_bit(CACHE_VALID, &head->flags);
+        set_bit(CACHE_VALID, &head->flags);
 }
 
 static void cache_fresh_unlocked(struct cache_head *head,
-                        struct cache_detail *detail, int new)
+                                 struct cache_detail *detail)
 {
-        if (new)
-                cache_revisit_request(head);
         if (test_and_clear_bit(CACHE_PENDING, &head->flags)) {
                 cache_revisit_request(head);
-                queue_loose(detail, head);
+                cache_dequeue(detail, head);
         }
 }
 
@@ -132,7 +130,6 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
          */
         struct cache_head **head;
         struct cache_head *tmp;
-        int is_new;
 
         if (!test_bit(CACHE_VALID, &old->flags)) {
                 write_lock(&detail->hash_lock);
@@ -141,9 +138,9 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
                                 set_bit(CACHE_NEGATIVE, &old->flags);
                         else
                                 detail->update(old, new);
-                        is_new = cache_fresh_locked(old, new->expiry_time);
+                        cache_fresh_locked(old, new->expiry_time);
                         write_unlock(&detail->hash_lock);
-                        cache_fresh_unlocked(old, detail, is_new);
+                        cache_fresh_unlocked(old, detail);
                         return old;
                 }
                 write_unlock(&detail->hash_lock);
@@ -167,11 +164,11 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
         *head = tmp;
         detail->entries++;
         cache_get(tmp);
-        is_new = cache_fresh_locked(tmp, new->expiry_time);
+        cache_fresh_locked(tmp, new->expiry_time);
         cache_fresh_locked(old, 0);
         write_unlock(&detail->hash_lock);
-        cache_fresh_unlocked(tmp, detail, is_new);
-        cache_fresh_unlocked(old, detail, 0);
+        cache_fresh_unlocked(tmp, detail);
+        cache_fresh_unlocked(old, detail);
         cache_put(old, detail);
         return tmp;
 }
@@ -184,6 +181,22 @@ static int cache_make_upcall(struct cache_detail *cd, struct cache_head *h)
         return cd->cache_upcall(cd, h);
 }
 
+static inline int cache_is_valid(struct cache_detail *detail, struct cache_head *h)
+{
+        if (!test_bit(CACHE_VALID, &h->flags) ||
+            h->expiry_time < get_seconds())
+                return -EAGAIN;
+        else if (detail->flush_time > h->last_refresh)
+                return -EAGAIN;
+        else {
+                /* entry is valid */
+                if (test_bit(CACHE_NEGATIVE, &h->flags))
+                        return -ENOENT;
+                else
+                        return 0;
+        }
+}
+
 /*
  * This is the generic cache management routine for all
  * the authentication caches.
@@ -192,8 +205,10 @@ static int cache_make_upcall(struct cache_detail *cd, struct cache_head *h)
  *
  *
  * Returns 0 if the cache_head can be used, or cache_puts it and returns
- * -EAGAIN if upcall is pending,
- * -ETIMEDOUT if upcall failed and should be retried,
+ * -EAGAIN if upcall is pending and request has been queued
+ * -ETIMEDOUT if upcall failed or request could not be queue or
+ *           upcall completed but item is still invalid (implying that
+ *           the cache item has been replaced with a newer one).
  * -ENOENT if cache entry was negative
  */
 int cache_check(struct cache_detail *detail,
@@ -203,17 +218,7 @@ int cache_check(struct cache_detail *detail,
         long refresh_age, age;
 
         /* First decide return status as best we can */
-        if (!test_bit(CACHE_VALID, &h->flags) ||
-            h->expiry_time < get_seconds())
-                rv = -EAGAIN;
-        else if (detail->flush_time > h->last_refresh)
-                rv = -EAGAIN;
-        else {
-                /* entry is valid */
-                if (test_bit(CACHE_NEGATIVE, &h->flags))
-                        rv = -ENOENT;
-                else rv = 0;
-        }
+        rv = cache_is_valid(detail, h);
 
         /* now see if we want to start an upcall */
         refresh_age = (h->expiry_time - h->last_refresh);
@@ -229,10 +234,11 @@ int cache_check(struct cache_detail *detail,
                         switch (cache_make_upcall(detail, h)) {
                         case -EINVAL:
                                 clear_bit(CACHE_PENDING, &h->flags);
+                                cache_revisit_request(h);
                                 if (rv == -EAGAIN) {
                                         set_bit(CACHE_NEGATIVE, &h->flags);
-                                        cache_fresh_unlocked(h, detail,
-                                             cache_fresh_locked(h, get_seconds()+CACHE_NEW_EXPIRY));
+                                        cache_fresh_locked(h, get_seconds()+CACHE_NEW_EXPIRY);
+                                        cache_fresh_unlocked(h, detail);
                                         rv = -ENOENT;
                                 }
                                 break;
@@ -245,10 +251,14 @@ int cache_check(struct cache_detail *detail,
                 }
         }
 
-        if (rv == -EAGAIN)
-                if (cache_defer_req(rqstp, h) != 0)
-                        rv = -ETIMEDOUT;
-
+        if (rv == -EAGAIN) {
+                if (cache_defer_req(rqstp, h) < 0) {
+                        /* Request is not deferred */
+                        rv = cache_is_valid(detail, h);
+                        if (rv == -EAGAIN)
+                                rv = -ETIMEDOUT;
+                }
+        }
         if (rv)
                 cache_put(h, detail);
         return rv;
@@ -396,7 +406,7 @@ static int cache_clean(void)
                                 )
                                 continue;
                         if (test_and_clear_bit(CACHE_PENDING, &ch->flags))
-                                queue_loose(current_detail, ch);
+                                cache_dequeue(current_detail, ch);
 
                         if (atomic_read(&ch->ref.refcount) == 1)
                                 break;
@@ -412,8 +422,10 @@ static int cache_clean(void)
                 if (!ch)
                         current_index ++;
                 spin_unlock(&cache_list_lock);
-                if (ch)
+                if (ch) {
+                        cache_revisit_request(ch);
                         cache_put(ch, d);
+                }
         } else
                 spin_unlock(&cache_list_lock);
 
@@ -488,7 +500,7 @@ static int cache_defer_cnt;
 
 static int cache_defer_req(struct cache_req *req, struct cache_head *item)
 {
-        struct cache_deferred_req *dreq;
+        struct cache_deferred_req *dreq, *discard;
         int hash = DFR_HASH(item);
 
         if (cache_defer_cnt >= DFR_MAX) {
@@ -496,11 +508,11 @@ static int cache_defer_req(struct cache_req *req, struct cache_head *item)
                  * or continue and drop the oldest below
                  */
                 if (net_random()&1)
-                        return -ETIMEDOUT;
+                        return -ENOMEM;
         }
         dreq = req->defer(req);
         if (dreq == NULL)
-                return -ETIMEDOUT;
+                return -ENOMEM;
 
         dreq->item = item;
 
@@ -513,23 +525,24 @@ static int cache_defer_req(struct cache_req *req, struct cache_head *item)
         list_add(&dreq->hash, &cache_defer_hash[hash]);
 
         /* it is in, now maybe clean up */
-        dreq = NULL;
+        discard = NULL;
         if (++cache_defer_cnt > DFR_MAX) {
-                dreq = list_entry(cache_defer_list.prev,
-                                  struct cache_deferred_req, recent);
-                list_del(&dreq->recent);
-                list_del(&dreq->hash);
+                discard = list_entry(cache_defer_list.prev,
+                                     struct cache_deferred_req, recent);
+                list_del_init(&discard->recent);
+                list_del_init(&discard->hash);
                 cache_defer_cnt--;
         }
         spin_unlock(&cache_defer_lock);
 
-        if (dreq) {
+        if (discard)
                 /* there was one too many */
-                dreq->revisit(dreq, 1);
-        }
+                discard->revisit(discard, 1);
+
         if (!test_bit(CACHE_PENDING, &item->flags)) {
                 /* must have just been validated... */
                 cache_revisit_request(item);
+                return -EAGAIN;
         }
         return 0;
 }
@@ -551,7 +564,7 @@ static void cache_revisit_request(struct cache_head *item)
                         dreq = list_entry(lp, struct cache_deferred_req, hash);
                         lp = lp->next;
                         if (dreq->item == item) {
-                                list_del(&dreq->hash);
+                                list_del_init(&dreq->hash);
                                 list_move(&dreq->recent, &pending);
                                 cache_defer_cnt--;
                         }
@@ -577,7 +590,7 @@ void cache_clean_deferred(void *owner)
 
         list_for_each_entry_safe(dreq, tmp, &cache_defer_list, recent) {
                 if (dreq->owner == owner) {
-                        list_del(&dreq->hash);
+                        list_del_init(&dreq->hash);
                         list_move(&dreq->recent, &pending);
                         cache_defer_cnt--;
                 }
@@ -887,7 +900,7 @@ static int cache_release(struct inode *inode, struct file *filp,
 
 
 
-static void queue_loose(struct cache_detail *detail, struct cache_head *ch)
+static void cache_dequeue(struct cache_detail *detail, struct cache_head *ch)
 {
         struct cache_queue *cq;
         spin_lock(&queue_lock);
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index fac0ca93f06b..a417d5ab5dd7 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -288,6 +288,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
                 .srcaddr = args->saddress,
                 .dstaddr = args->address,
                 .addrlen = args->addrsize,
+                .bc_xprt = args->bc_xprt,
         };
         char servername[48];
 
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 7f676bdf70d3..49278f830367 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -860,7 +860,8 @@ static void rpc_clntdir_depopulate(struct dentry *dentry)
 
 /**
  * rpc_create_client_dir - Create a new rpc_client directory in rpc_pipefs
- * @path: path from the rpc_pipefs root to the new directory
+ * @dentry: dentry from the rpc_pipefs root to the new directory
+ * @name: &struct qstr for the name
  * @rpc_client: rpc client to associate with this directory
  *
  * This creates a directory at the given @path associated with
@@ -930,7 +931,7 @@ void rpc_remove_cache_dir(struct dentry *dentry)
 /*
  * populate the filesystem
  */
-static struct super_operations s_ops = {
+static const struct super_operations s_ops = {
         .alloc_inode    = rpc_alloc_inode,
         .destroy_inode  = rpc_destroy_inode,
         .statfs         = simple_statfs,
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 8f459abe97cf..cef74ba0666c 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -21,6 +21,8 @@
 
 #include <linux/sunrpc/clnt.h>
 
+#include "sunrpc.h"
+
 #ifdef RPC_DEBUG
 #define RPCDBG_FACILITY         RPCDBG_SCHED
 #define RPC_TASK_MAGIC_ID       0xf00baa
@@ -711,11 +713,6 @@ static void rpc_async_schedule(struct work_struct *work)
         __rpc_execute(container_of(work, struct rpc_task, u.tk_work));
 }
 
-struct rpc_buffer {
-        size_t  len;
-        char    data[];
-};
-
 /**
  * rpc_malloc - allocate an RPC buffer
  * @task: RPC task that will use this buffer
diff --git a/net/sunrpc/sunrpc.h b/net/sunrpc/sunrpc.h
index 5d9dd742264b..90c292e2738b 100644
--- a/net/sunrpc/sunrpc.h
+++ b/net/sunrpc/sunrpc.h
@@ -27,11 +27,25 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 #ifndef _NET_SUNRPC_SUNRPC_H
 #define _NET_SUNRPC_SUNRPC_H
 
+#include <linux/net.h>
+
+/*
+ * Header for dynamically allocated rpc buffers.
+ */
+struct rpc_buffer {
+        size_t  len;
+        char    data[];
+};
+
 static inline int rpc_reply_expected(struct rpc_task *task)
 {
         return (task->tk_msg.rpc_proc != NULL) &&
                 (task->tk_msg.rpc_proc->p_decode != NULL);
 }
 
+int svc_send_common(struct socket *sock, struct xdr_buf *xdr,
+                    struct page *headpage, unsigned long headoffset,
+                    struct page *tailpage, unsigned long tailoffset);
+
 #endif /* _NET_SUNRPC_SUNRPC_H */
 
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 27d44332f017..df124f78ee48 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -160,6 +160,7 @@ void svc_xprt_init(struct svc_xprt_class *xcl, struct svc_xprt *xprt,
         mutex_init(&xprt->xpt_mutex);
         spin_lock_init(&xprt->xpt_lock);
         set_bit(XPT_BUSY, &xprt->xpt_flags);
+        rpc_init_wait_queue(&xprt->xpt_bc_pending, "xpt_bc_pending");
 }
 EXPORT_SYMBOL_GPL(svc_xprt_init);
 
@@ -710,10 +711,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
         spin_unlock_bh(&pool->sp_lock);
 
         len = 0;
-        if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
-                dprintk("svc_recv: found XPT_CLOSE\n");
-                svc_delete_xprt(xprt);
-        } else if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
+        if (test_bit(XPT_LISTENER, &xprt->xpt_flags)) {
                 struct svc_xprt *newxpt;
                 newxpt = xprt->xpt_ops->xpo_accept(xprt);
                 if (newxpt) {
@@ -739,7 +737,7 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                         svc_xprt_received(newxpt);
                 }
                 svc_xprt_received(xprt);
-        } else {
+        } else if (!test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
                 dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n",
                         rqstp, pool->sp_id, xprt,
                         atomic_read(&xprt->xpt_ref.refcount));
@@ -752,6 +750,11 @@ int svc_recv(struct svc_rqst *rqstp, long timeout)
                 dprintk("svc: got len=%d\n", len);
         }
 
+        if (test_bit(XPT_CLOSE, &xprt->xpt_flags)) {
+                dprintk("svc_recv: found XPT_CLOSE\n");
+                svc_delete_xprt(xprt);
+        }
+
         /* No data, incomplete (TCP) read, or accept() */
         if (len == 0 || len == -EAGAIN) {
                 rqstp->rq_res.len = 0;
@@ -808,6 +811,7 @@ int svc_send(struct svc_rqst *rqstp)
         else
                 len = xprt->xpt_ops->xpo_sendto(rqstp);
         mutex_unlock(&xprt->xpt_mutex);
+        rpc_wake_up(&xprt->xpt_bc_pending);
         svc_xprt_release(rqstp);
 
         if (len == -ECONNREFUSED || len == -ENOTCONN || len == -EAGAIN)
@@ -1166,11 +1170,6 @@ static void *svc_pool_stats_start(struct seq_file *m, loff_t *pos)
 
         dprintk("svc_pool_stats_start, *pidx=%u\n", pidx);
 
-        lock_kernel();
-        /* bump up the pseudo refcount while traversing */
-        svc_get(serv);
-        unlock_kernel();
-
         if (!pidx)
                 return SEQ_START_TOKEN;
         return (pidx > serv->sv_nrpools ? NULL : &serv->sv_pools[pidx-1]);
@@ -1198,12 +1197,6 @@ static void *svc_pool_stats_next(struct seq_file *m, void *p, loff_t *pos)
 
 static void svc_pool_stats_stop(struct seq_file *m, void *p)
 {
-        struct svc_serv *serv = m->private;
-
-        lock_kernel();
-        /* this function really, really should have been called svc_put() */
-        svc_destroy(serv);
-        unlock_kernel();
 }
 
 static int svc_pool_stats_show(struct seq_file *m, void *p)
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 6caffa34ac01..117f68a8aa40 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -668,6 +668,7 @@ static int unix_gid_find(uid_t uid, struct group_info **gip,
         case 0:
                 *gip = ug->gi;
                 get_group_info(*gip);
+                cache_put(&ug->h, &unix_gid_cache);
                 return 0;
         default:
                 return -EAGAIN;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 23128ee191ae..ccc5e83cae5d 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -49,6 +49,7 @@
 #include <linux/sunrpc/msg_prot.h>
 #include <linux/sunrpc/svcsock.h>
 #include <linux/sunrpc/stats.h>
+#include <linux/sunrpc/xprt.h>
 
 #define RPCDBG_FACILITY RPCDBG_SVCXPRT
 
@@ -153,49 +154,27 @@ static void svc_set_cmsg_data(struct svc_rqst *rqstp, struct cmsghdr *cmh)
 }
 
 /*
- * Generic sendto routine
+ * send routine intended to be shared by the fore- and back-channel
  */
-static int svc_sendto(struct svc_rqst *rqstp, struct xdr_buf *xdr)
+int svc_send_common(struct socket *sock, struct xdr_buf *xdr,
+                    struct page *headpage, unsigned long headoffset,
+                    struct page *tailpage, unsigned long tailoffset)
 {
-        struct svc_sock *svsk =
-                container_of(rqstp->rq_xprt, struct svc_sock, sk_xprt);
-        struct socket   *sock = svsk->sk_sock;
-        int             slen;
-        union {
-                struct cmsghdr  hdr;
-                long            all[SVC_PKTINFO_SPACE / sizeof(long)];
-        } buffer;
-        struct cmsghdr *cmh = &buffer.hdr;
-        int             len = 0;
         int             result;
         int             size;
         struct page     **ppage = xdr->pages;
         size_t          base = xdr->page_base;
         unsigned int    pglen = xdr->page_len;
         unsigned int    flags = MSG_MORE;
-        RPC_IFDEBUG(char buf[RPC_MAX_ADDRBUFLEN]);
+        int             slen;
+        int             len = 0;
 
         slen = xdr->len;
 
-        if (rqstp->rq_prot == IPPROTO_UDP) {
-                struct msghdr msg = {
-                        .msg_name       = &rqstp->rq_addr,
-                        .msg_namelen    = rqstp->rq_addrlen,
-                        .msg_control    = cmh,
-                        .msg_controllen = sizeof(buffer),
-                        .msg_flags      = MSG_MORE,
-                };
-
-                svc_set_cmsg_data(rqstp, cmh);
-
-                if (sock_sendmsg(sock, &msg, 0) < 0)
-                        goto out;
-        }
-
         /* send head */
         if (slen == xdr->head[0].iov_len)
                 flags = 0;
-        len = kernel_sendpage(sock, rqstp->rq_respages[0], 0,
+        len = kernel_sendpage(sock, headpage, headoffset,
                                   xdr->head[0].iov_len, flags);
         if (len != xdr->head[0].iov_len)
                 goto out;
@@ -219,16 +198,58 @@ static int svc_sendto(struct svc_rqst *rqstp, struct xdr_buf *xdr)
                 base = 0;
                 ppage++;
         }
+
         /* send tail */
         if (xdr->tail[0].iov_len) {
-                result = kernel_sendpage(sock, rqstp->rq_respages[0],
-                                             ((unsigned long)xdr->tail[0].iov_base)
-                                                & (PAGE_SIZE-1),
-                                             xdr->tail[0].iov_len, 0);
-
+                result = kernel_sendpage(sock, tailpage, tailoffset,
+                                   xdr->tail[0].iov_len, 0);
                 if (result > 0)
                         len += result;
         }
+
+out:
+        return len;
+}
+
+
+/*
+ * Generic sendto routine
+ */
+static int svc_sendto(struct svc_rqst *rqstp, struct xdr_buf *xdr)
+{
+        struct svc_sock *svsk =
+                container_of(rqstp->rq_xprt, struct svc_sock, sk_xprt);
+        struct socket   *sock = svsk->sk_sock;
+        union {
+                struct cmsghdr  hdr;
+                long            all[SVC_PKTINFO_SPACE / sizeof(long)];
+        } buffer;
+        struct cmsghdr *cmh = &buffer.hdr;
+        int             len = 0;
+        unsigned long tailoff;
+        unsigned long headoff;
+        RPC_IFDEBUG(char buf[RPC_MAX_ADDRBUFLEN]);
+
+        if (rqstp->rq_prot == IPPROTO_UDP) {
+                struct msghdr msg = {
+                        .msg_name       = &rqstp->rq_addr,
+                        .msg_namelen    = rqstp->rq_addrlen,
+                        .msg_control    = cmh,
+                        .msg_controllen = sizeof(buffer),
+                        .msg_flags      = MSG_MORE,
+                };
+
+                svc_set_cmsg_data(rqstp, cmh);
+
+                if (sock_sendmsg(sock, &msg, 0) < 0)
+                        goto out;
+        }
+
+        tailoff = ((unsigned long)xdr->tail[0].iov_base) & (PAGE_SIZE-1);
+        headoff = 0;
+        len = svc_send_common(sock, xdr, rqstp->rq_respages[0], headoff,
+                               rqstp->rq_respages[0], tailoff);
+
 out:
         dprintk("svc: socket %p sendto([%p %Zu... ], %d) = %d (addr %s)\n",
                 svsk, xdr->head[0].iov_base, xdr->head[0].iov_len,
@@ -432,29 +453,49 @@ static void svc_tcp_write_space(struct sock *sk)
 }
 
 /*
+ * See net/ipv6/ip_sockglue.c : ip_cmsg_recv_pktinfo
+ */
+static int svc_udp_get_dest_address4(struct svc_rqst *rqstp,
+                                     struct cmsghdr *cmh)
+{
+        struct in_pktinfo *pki = CMSG_DATA(cmh);
+        if (cmh->cmsg_type != IP_PKTINFO)
+                return 0;
+        rqstp->rq_daddr.addr.s_addr = pki->ipi_spec_dst.s_addr;
+        return 1;
+}
+
+/*
+ * See net/ipv6/datagram.c : datagram_recv_ctl
+ */
+static int svc_udp_get_dest_address6(struct svc_rqst *rqstp,
+                                     struct cmsghdr *cmh)
+{
+        struct in6_pktinfo *pki = CMSG_DATA(cmh);
+        if (cmh->cmsg_type != IPV6_PKTINFO)
+                return 0;
+        ipv6_addr_copy(&rqstp->rq_daddr.addr6, &pki->ipi6_addr);
+        return 1;
+}
+
+/*
  * Copy the UDP datagram's destination address to the rqstp structure.
  * The 'destination' address in this case is the address to which the
  * peer sent the datagram, i.e. our local address. For multihomed
  * hosts, this can change from msg to msg. Note that only the IP
  * address changes, the port number should remain the same.
  */
-static void svc_udp_get_dest_address(struct svc_rqst *rqstp,
-                                     struct cmsghdr *cmh)
+static int svc_udp_get_dest_address(struct svc_rqst *rqstp,
+                                    struct cmsghdr *cmh)
 {
-        struct svc_sock *svsk =
-                container_of(rqstp->rq_xprt, struct svc_sock, sk_xprt);
-        switch (svsk->sk_sk->sk_family) {
-        case AF_INET: {
-                struct in_pktinfo *pki = CMSG_DATA(cmh);
-                rqstp->rq_daddr.addr.s_addr = pki->ipi_spec_dst.s_addr;
-                break;
-                }
-        case AF_INET6: {
-                struct in6_pktinfo *pki = CMSG_DATA(cmh);
-                ipv6_addr_copy(&rqstp->rq_daddr.addr6, &pki->ipi6_addr);
-                break;
-                }
+        switch (cmh->cmsg_level) {
+        case SOL_IP:
+                return svc_udp_get_dest_address4(rqstp, cmh);
+        case SOL_IPV6:
+                return svc_udp_get_dest_address6(rqstp, cmh);
         }
+
+        return 0;
 }
 
 /*
@@ -531,16 +572,15 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
 
         rqstp->rq_prot = IPPROTO_UDP;
 
-        if (cmh->cmsg_level != IPPROTO_IP ||
-            cmh->cmsg_type != IP_PKTINFO) {
+        if (!svc_udp_get_dest_address(rqstp, cmh)) {
                 if (net_ratelimit())
-                        printk("rpcsvc: received unknown control message:"
-                               "%d/%d\n",
-                               cmh->cmsg_level, cmh->cmsg_type);
+                        printk(KERN_WARNING
+                                "svc: received unknown control message %d/%d; "
+                                "dropping RPC reply datagram\n",
+                                        cmh->cmsg_level, cmh->cmsg_type);
                 skb_free_datagram(svsk->sk_sk, skb);
                 return 0;
         }
-        svc_udp_get_dest_address(rqstp, cmh);
 
         if (skb_is_nonlinear(skb)) {
                 /* we have to copy */
@@ -651,8 +691,7 @@ static struct svc_xprt_class svc_udp_class = {
 
 static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv)
 {
-        int one = 1;
-        mm_segment_t oldfs;
+        int err, level, optname, one = 1;
 
         svc_xprt_init(&svc_udp_class, &svsk->sk_xprt, serv);
         clear_bit(XPT_CACHE_AUTH, &svsk->sk_xprt.xpt_flags);
@@ -671,12 +710,22 @@ static void svc_udp_init(struct svc_sock *svsk, struct svc_serv *serv)
         set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
         set_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags);
 
-        oldfs = get_fs();
-        set_fs(KERNEL_DS);
         /* make sure we get destination address info */
-        svsk->sk_sock->ops->setsockopt(svsk->sk_sock, IPPROTO_IP, IP_PKTINFO,
-                                       (char __user *)&one, sizeof(one));
-        set_fs(oldfs);
+        switch (svsk->sk_sk->sk_family) {
+        case AF_INET:
+                level = SOL_IP;
+                optname = IP_PKTINFO;
+                break;
+        case AF_INET6:
+                level = SOL_IPV6;
+                optname = IPV6_RECVPKTINFO;
+                break;
+        default:
+                BUG();
+        }
+        err = kernel_setsockopt(svsk->sk_sock, level, optname,
+                                        (char *)&one, sizeof(one));
+        dprintk("svc: kernel_setsockopt returned %d\n", err);
 }
 
 /*
@@ -826,21 +875,15 @@ failed:
 }
 
 /*
- * Receive data from a TCP socket.
+ * Receive data.
+ * If we haven't gotten the record length yet, get the next four bytes.
+ * Otherwise try to gobble up as much as possible up to the complete
+ * record length.
  */
-static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
+static int svc_tcp_recv_record(struct svc_sock *svsk, struct svc_rqst *rqstp)
 {
-        struct svc_sock *svsk =
-                container_of(rqstp->rq_xprt, struct svc_sock, sk_xprt);
         struct svc_serv *serv = svsk->sk_xprt.xpt_server;
-        int             len;
-        struct kvec *vec;
-        int pnum, vlen;
-
-        dprintk("svc: tcp_recv %p data %d conn %d close %d\n",
-                svsk, test_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags),
-                test_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags),
-                test_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags));
+        int len;
 
         if (test_and_clear_bit(XPT_CHNGBUF, &svsk->sk_xprt.xpt_flags))
                 /* sndbuf needs to have room for one request
@@ -861,10 +904,6 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
 
         clear_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
 
-        /* Receive data. If we haven't got the record length yet, get
-         * the next four bytes. Otherwise try to gobble up as much as
-         * possible up to the complete record length.
-         */
         if (svsk->sk_tcplen < sizeof(rpc_fraghdr)) {
                 int             want = sizeof(rpc_fraghdr) - svsk->sk_tcplen;
                 struct kvec     iov;
@@ -879,7 +918,7 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                         dprintk("svc: short recvfrom while reading record "
                                 "length (%d of %d)\n", len, want);
                         svc_xprt_received(&svsk->sk_xprt);
-                        return -EAGAIN; /* record header not complete */
+                        goto err_again; /* record header not complete */
                 }
 
                 svsk->sk_reclen = ntohl(svsk->sk_reclen);
@@ -894,6 +933,7 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                                         "per record not supported\n");
                         goto err_delete;
                 }
+
                 svsk->sk_reclen &= RPC_FRAGMENT_SIZE_MASK;
                 dprintk("svc: TCP record, %d bytes\n", svsk->sk_reclen);
                 if (svsk->sk_reclen > serv->sv_max_mesg) {
@@ -914,17 +954,121 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
                 dprintk("svc: incomplete TCP record (%d of %d)\n",
                         len, svsk->sk_reclen);
                 svc_xprt_received(&svsk->sk_xprt);
-                return -EAGAIN; /* record not complete */
+                goto err_again; /* record not complete */
         }
         len = svsk->sk_reclen;
         set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
 
+        return len;
+ error:
+        if (len == -EAGAIN) {
+                dprintk("RPC: TCP recv_record got EAGAIN\n");
+                svc_xprt_received(&svsk->sk_xprt);
+        }
+        return len;
+ err_delete:
+        set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
+ err_again:
+        return -EAGAIN;
+}
+
+static int svc_process_calldir(struct svc_sock *svsk, struct svc_rqst *rqstp,
+                               struct rpc_rqst **reqpp, struct kvec *vec)
+{
+        struct rpc_rqst *req = NULL;
+        u32 *p;
+        u32 xid;
+        u32 calldir;
+        int len;
+
+        len = svc_recvfrom(rqstp, vec, 1, 8);
+        if (len < 0)
+                goto error;
+
+        p = (u32 *)rqstp->rq_arg.head[0].iov_base;
+        xid = *p++;
+        calldir = *p;
+
+        if (calldir == 0) {
+                /* REQUEST is the most common case */
+                vec[0] = rqstp->rq_arg.head[0];
+        } else {
+                /* REPLY */
+                if (svsk->sk_bc_xprt)
+                        req = xprt_lookup_rqst(svsk->sk_bc_xprt, xid);
+
+                if (!req) {
+                        printk(KERN_NOTICE
+                                "%s: Got unrecognized reply: "
+                                "calldir 0x%x sk_bc_xprt %p xid %08x\n",
+                                __func__, ntohl(calldir),
+                                svsk->sk_bc_xprt, xid);
+                        vec[0] = rqstp->rq_arg.head[0];
+                        goto out;
+                }
+
+                memcpy(&req->rq_private_buf, &req->rq_rcv_buf,
+                       sizeof(struct xdr_buf));
+                /* copy the xid and call direction */
+                memcpy(req->rq_private_buf.head[0].iov_base,
+                       rqstp->rq_arg.head[0].iov_base, 8);
+                vec[0] = req->rq_private_buf.head[0];
+        }
+ out:
+        vec[0].iov_base += 8;
+        vec[0].iov_len -= 8;
+        len = svsk->sk_reclen - 8;
+ error:
+        *reqpp = req;
+        return len;
+}
+
+/*
+ * Receive data from a TCP socket.
+ */
+static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
+{
+        struct svc_sock *svsk =
+                container_of(rqstp->rq_xprt, struct svc_sock, sk_xprt);
+        struct svc_serv *serv = svsk->sk_xprt.xpt_server;
+        int             len;
+        struct kvec *vec;
+        int pnum, vlen;
+        struct rpc_rqst *req = NULL;
+
+        dprintk("svc: tcp_recv %p data %d conn %d close %d\n",
+                svsk, test_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags),
+                test_bit(XPT_CONN, &svsk->sk_xprt.xpt_flags),
+                test_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags));
+
+        len = svc_tcp_recv_record(svsk, rqstp);
+        if (len < 0)
+                goto error;
+
         vec = rqstp->rq_vec;
         vec[0] = rqstp->rq_arg.head[0];
         vlen = PAGE_SIZE;
+
+        /*
+         * We have enough data for the whole tcp record. Let's try and read the
+         * first 8 bytes to get the xid and the call direction. We can use this
+         * to figure out if this is a call or a reply to a callback. If
+         * sk_reclen is < 8 (xid and calldir), then this is a malformed packet.
+         * In that case, don't bother with the calldir and just read the data.
+         * It will be rejected in svc_process.
+         */
+        if (len >= 8) {
+                len = svc_process_calldir(svsk, rqstp, &req, vec);
+                if (len < 0)
+                        goto err_again;
+                vlen -= 8;
+        }
+
         pnum = 1;
         while (vlen < len) {
-                vec[pnum].iov_base = page_address(rqstp->rq_pages[pnum]);
+                vec[pnum].iov_base = (req) ?
+                        page_address(req->rq_private_buf.pages[pnum - 1]) :
+                        page_address(rqstp->rq_pages[pnum]);
                 vec[pnum].iov_len = PAGE_SIZE;
                 pnum++;
                 vlen += PAGE_SIZE;
@@ -934,8 +1078,18 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
         /* Now receive data */
         len = svc_recvfrom(rqstp, vec, pnum, len);
         if (len < 0)
-                goto error;
+                goto err_again;
 
+        /*
+         * Account for the 8 bytes we read earlier
+         */
+        len += 8;
+
+        if (req) {
+                xprt_complete_rqst(req->rq_task, len);
+                len = 0;
+                goto out;
+        }
         dprintk("svc: TCP complete record (%d bytes)\n", len);
         rqstp->rq_arg.len = len;
         rqstp->rq_arg.page_base = 0;
@@ -949,6 +1103,7 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
         rqstp->rq_xprt_ctxt   = NULL;
         rqstp->rq_prot        = IPPROTO_TCP;
 
+out:
         /* Reset TCP read info */
         svsk->sk_reclen = 0;
         svsk->sk_tcplen = 0;
@@ -960,21 +1115,19 @@ static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
 
         return len;
 
- err_delete:
-        set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
-        return -EAGAIN;
-
- error:
+err_again:
         if (len == -EAGAIN) {
                 dprintk("RPC: TCP recvfrom got EAGAIN\n");
                 svc_xprt_received(&svsk->sk_xprt);
-        } else {
+                return len;
+        }
+error:
+        if (len != -EAGAIN) {
                 printk(KERN_NOTICE "%s: recvfrom returned errno %d\n",
                        svsk->sk_xprt.xpt_server->sv_name, -len);
-                goto err_delete;
+                set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
         }
-
-        return len;
+        return -EAGAIN;
 }
 
 /*
diff --git a/net/sunrpc/sysctl.c b/net/sunrpc/sysctl.c
index 5231f7aaac0e..42f9748ae093 100644
--- a/net/sunrpc/sysctl.c
+++ b/net/sunrpc/sysctl.c
@@ -56,7 +56,7 @@ rpc_unregister_sysctl(void)
         }
 }
 
-static int proc_do_xprt(ctl_table *table, int write, struct file *file,
+static int proc_do_xprt(ctl_table *table, int write,
                         void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char tmpbuf[256];
@@ -71,7 +71,7 @@ static int proc_do_xprt(ctl_table *table, int write, struct file *file,
 }
 
 static int
-proc_dodebug(ctl_table *table, int write, struct file *file,
+proc_dodebug(ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char            tmpbuf[20], c, *s;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index f412a852bc73..fd46d42afa89 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -832,6 +832,11 @@ static void xprt_timer(struct rpc_task *task)
         spin_unlock_bh(&xprt->transport_lock);
 }
 
+static inline int xprt_has_timer(struct rpc_xprt *xprt)
+{
+        return xprt->idle_timeout != 0;
+}
+
 /**
  * xprt_prepare_transmit - reserve the transport before sending a request
  * @task: RPC task about to send a request
@@ -1013,7 +1018,7 @@ void xprt_release(struct rpc_task *task)
         if (!list_empty(&req->rq_list))
                 list_del(&req->rq_list);
         xprt->last_used = jiffies;
-        if (list_empty(&xprt->recv))
+        if (list_empty(&xprt->recv) && xprt_has_timer(xprt))
                 mod_timer(&xprt->timer,
                                 xprt->last_used + xprt->idle_timeout);
         spin_unlock_bh(&xprt->transport_lock);
@@ -1082,8 +1087,11 @@ found:
 #endif /* CONFIG_NFS_V4_1 */
 
         INIT_WORK(&xprt->task_cleanup, xprt_autoclose);
-        setup_timer(&xprt->timer, xprt_init_autodisconnect,
-                        (unsigned long)xprt);
+        if (xprt_has_timer(xprt))
+                setup_timer(&xprt->timer, xprt_init_autodisconnect,
+                            (unsigned long)xprt);
+        else
+                init_timer(&xprt->timer);
         xprt->last_used = jiffies;
         xprt->cwnd = RPC_INITCWND;
         xprt->bind_index = 0;
@@ -1102,7 +1110,6 @@ found:
 
         dprintk("RPC:       created transport %p with %u slots\n", xprt,
                         xprt->max_reqs);
-
         return xprt;
 }
 
diff --git a/net/sunrpc/xprtrdma/svc_rdma.c b/net/sunrpc/xprtrdma/svc_rdma.c
index 87101177825b..35fb68b9c8ec 100644
--- a/net/sunrpc/xprtrdma/svc_rdma.c
+++ b/net/sunrpc/xprtrdma/svc_rdma.c
@@ -80,7 +80,7 @@ struct kmem_cache *svc_rdma_ctxt_cachep;
  * current value.
  */
 static int read_reset_stat(ctl_table *table, int write,
-                           struct file *filp, void __user *buffer, size_t *lenp,
+                           void __user *buffer, size_t *lenp,
                            loff_t *ppos)
 {
         atomic_t *stat = (atomic_t *)table->data;
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index 5151f9f6c573..0cf5e8c27a10 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -730,12 +730,12 @@ static struct svc_rdma_fastreg_mr *rdma_alloc_frmr(struct svcxprt_rdma *xprt)
                 goto err;
 
         mr = ib_alloc_fast_reg_mr(xprt->sc_pd, RPCSVC_MAXPAGES);
-        if (!mr)
+        if (IS_ERR(mr))
                 goto err_free_frmr;
 
         pl = ib_alloc_fast_reg_page_list(xprt->sc_cm_id->device,
                                          RPCSVC_MAXPAGES);
-        if (!pl)
+        if (IS_ERR(pl))
                 goto err_free_mr;
 
         frmr->mr = mr;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 62438f3a914d..37c5475ba258 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -32,6 +32,7 @@
 #include <linux/tcp.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/sched.h>
+#include <linux/sunrpc/svcsock.h>
 #include <linux/sunrpc/xprtsock.h>
 #include <linux/file.h>
 #ifdef CONFIG_NFS_V4_1
@@ -43,6 +44,7 @@
 #include <net/udp.h>
 #include <net/tcp.h>
 
+#include "sunrpc.h"
 /*
  * xprtsock tunables
  */
@@ -771,6 +773,7 @@ static void xs_close(struct rpc_xprt *xprt)
         dprintk("RPC:       xs_close xprt %p\n", xprt);
 
         xs_reset_transport(transport);
+        xprt->reestablish_timeout = 0;
 
         smp_mb__before_clear_bit();
         clear_bit(XPRT_CONNECTION_ABORT, &xprt->state);
@@ -1262,6 +1265,12 @@ static void xs_tcp_data_ready(struct sock *sk, int bytes)
         if (xprt->shutdown)
                 goto out;
 
+        /* Any data means we had a useful conversation, so
+         * the we don't need to delay the next reconnect
+         */
+        if (xprt->reestablish_timeout)
+                xprt->reestablish_timeout = 0;
+
         /* We use rd_desc to pass struct xprt to xs_tcp_data_recv */
         rd_desc.arg.data = xprt;
         do {
@@ -2032,6 +2041,8 @@ static void xs_connect(struct rpc_task *task)
                                    &transport->connect_worker,
                                    xprt->reestablish_timeout);
                 xprt->reestablish_timeout <<= 1;
+                if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
+                        xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
                 if (xprt->reestablish_timeout > XS_TCP_MAX_REEST_TO)
                         xprt->reestablish_timeout = XS_TCP_MAX_REEST_TO;
         } else {
@@ -2098,6 +2109,134 @@ static void xs_tcp_print_stats(struct rpc_xprt *xprt, struct seq_file *seq)
                         xprt->stat.bklog_u);
 }
 
+/*
+ * Allocate a bunch of pages for a scratch buffer for the rpc code. The reason
+ * we allocate pages instead doing a kmalloc like rpc_malloc is because we want
+ * to use the server side send routines.
+ */
+void *bc_malloc(struct rpc_task *task, size_t size)
+{
+        struct page *page;
+        struct rpc_buffer *buf;
+
+        BUG_ON(size > PAGE_SIZE - sizeof(struct rpc_buffer));
+        page = alloc_page(GFP_KERNEL);
+
+        if (!page)
+                return NULL;
+
+        buf = page_address(page);
+        buf->len = PAGE_SIZE;
+
+        return buf->data;
+}
+
+/*
+ * Free the space allocated in the bc_alloc routine
+ */
+void bc_free(void *buffer)
+{
+        struct rpc_buffer *buf;
+
+        if (!buffer)
+                return;
+
+        buf = container_of(buffer, struct rpc_buffer, data);
+        free_page((unsigned long)buf);
+}
+
+/*
+ * Use the svc_sock to send the callback. Must be called with svsk->sk_mutex
+ * held. Borrows heavily from svc_tcp_sendto and xs_tcp_send_request.
+ */
+static int bc_sendto(struct rpc_rqst *req)
+{
+        int len;
+        struct xdr_buf *xbufp = &req->rq_snd_buf;
+        struct rpc_xprt *xprt = req->rq_xprt;
+        struct sock_xprt *transport =
+                                container_of(xprt, struct sock_xprt, xprt);
+        struct socket *sock = transport->sock;
+        unsigned long headoff;
+        unsigned long tailoff;
+
+        /*
+         * Set up the rpc header and record marker stuff
+         */
+        xs_encode_tcp_record_marker(xbufp);
+
+        tailoff = (unsigned long)xbufp->tail[0].iov_base & ~PAGE_MASK;
+        headoff = (unsigned long)xbufp->head[0].iov_base & ~PAGE_MASK;
+        len = svc_send_common(sock, xbufp,
+                              virt_to_page(xbufp->head[0].iov_base), headoff,
+                              xbufp->tail[0].iov_base, tailoff);
+
+        if (len != xbufp->len) {
+                printk(KERN_NOTICE "Error sending entire callback!\n");
+                len = -EAGAIN;
+        }
+
+        return len;
+}
+
+/*
+ * The send routine. Borrows from svc_send
+ */
+static int bc_send_request(struct rpc_task *task)
+{
+        struct rpc_rqst *req = task->tk_rqstp;
+        struct svc_xprt *xprt;
+        struct svc_sock         *svsk;
+        u32                     len;
+
+        dprintk("sending request with xid: %08x\n", ntohl(req->rq_xid));
+        /*
+         * Get the server socket associated with this callback xprt
+         */
+        xprt = req->rq_xprt->bc_xprt;
+        svsk = container_of(xprt, struct svc_sock, sk_xprt);
+
+        /*
+         * Grab the mutex to serialize data as the connection is shared
+         * with the fore channel
+         */
+        if (!mutex_trylock(&xprt->xpt_mutex)) {
+                rpc_sleep_on(&xprt->xpt_bc_pending, task, NULL);
+                if (!mutex_trylock(&xprt->xpt_mutex))
+                        return -EAGAIN;
+                rpc_wake_up_queued_task(&xprt->xpt_bc_pending, task);
+        }
+        if (test_bit(XPT_DEAD, &xprt->xpt_flags))
+                len = -ENOTCONN;
+        else
+                len = bc_sendto(req);
+        mutex_unlock(&xprt->xpt_mutex);
+
+        if (len > 0)
+                len = 0;
+
+        return len;
+}
+
+/*
+ * The close routine. Since this is client initiated, we do nothing
+ */
+
+static void bc_close(struct rpc_xprt *xprt)
+{
+        return;
+}
+
+/*
+ * The xprt destroy routine. Again, because this connection is client
+ * initiated, we do nothing
+ */
+
+static void bc_destroy(struct rpc_xprt *xprt)
+{
+        return;
+}
+
 static struct rpc_xprt_ops xs_udp_ops = {
         .set_buffer_size        = xs_udp_set_buffer_size,
         .reserve_xprt           = xprt_reserve_xprt_cong,
@@ -2134,6 +2273,22 @@ static struct rpc_xprt_ops xs_tcp_ops = {
         .print_stats            = xs_tcp_print_stats,
 };
 
+/*
+ * The rpc_xprt_ops for the server backchannel
+ */
+
+static struct rpc_xprt_ops bc_tcp_ops = {
+        .reserve_xprt           = xprt_reserve_xprt,
+        .release_xprt           = xprt_release_xprt,
+        .buf_alloc              = bc_malloc,
+        .buf_free               = bc_free,
+        .send_request           = bc_send_request,
+        .set_retrans_timeout    = xprt_set_retrans_timeout_def,
+        .close                  = bc_close,
+        .destroy                = bc_destroy,
+        .print_stats            = xs_tcp_print_stats,
+};
+
 static struct rpc_xprt *xs_setup_xprt(struct xprt_create *args,
                                       unsigned int slot_table_size)
 {
@@ -2322,11 +2477,93 @@ static struct rpc_xprt *xs_setup_tcp(struct xprt_create *args)
         return ERR_PTR(-EINVAL);
 }
 
+/**
+ * xs_setup_bc_tcp - Set up transport to use a TCP backchannel socket
+ * @args: rpc transport creation arguments
+ *
+ */
+static struct rpc_xprt *xs_setup_bc_tcp(struct xprt_create *args)
+{
+        struct sockaddr *addr = args->dstaddr;
+        struct rpc_xprt *xprt;
+        struct sock_xprt *transport;
+        struct svc_sock *bc_sock;
+
+        if (!args->bc_xprt)
+                ERR_PTR(-EINVAL);
+
+        xprt = xs_setup_xprt(args, xprt_tcp_slot_table_entries);
+        if (IS_ERR(xprt))
+                return xprt;
+        transport = container_of(xprt, struct sock_xprt, xprt);
+
+        xprt->prot = IPPROTO_TCP;
+        xprt->tsh_size = sizeof(rpc_fraghdr) / sizeof(u32);
+        xprt->max_payload = RPC_MAX_FRAGMENT_SIZE;
+        xprt->timeout = &xs_tcp_default_timeout;
+
+        /* backchannel */
+        xprt_set_bound(xprt);
+        xprt->bind_timeout = 0;
+        xprt->connect_timeout = 0;
+        xprt->reestablish_timeout = 0;
+        xprt->idle_timeout = 0;
+
+        /*
+         * The backchannel uses the same socket connection as the
+         * forechannel
+         */
+        xprt->bc_xprt = args->bc_xprt;
+        bc_sock = container_of(args->bc_xprt, struct svc_sock, sk_xprt);
+        bc_sock->sk_bc_xprt = xprt;
+        transport->sock = bc_sock->sk_sock;
+        transport->inet = bc_sock->sk_sk;
+
+        xprt->ops = &bc_tcp_ops;
+
+        switch (addr->sa_family) {
+        case AF_INET:
+                xs_format_peer_addresses(xprt, "tcp",
+                                         RPCBIND_NETID_TCP);
+                break;
+        case AF_INET6:
+                xs_format_peer_addresses(xprt, "tcp",
+                                   RPCBIND_NETID_TCP6);
+                break;
+        default:
+                kfree(xprt);
+                return ERR_PTR(-EAFNOSUPPORT);
+        }
+
+        if (xprt_bound(xprt))
+                dprintk("RPC:       set up xprt to %s (port %s) via %s\n",
+                                xprt->address_strings[RPC_DISPLAY_ADDR],
+                                xprt->address_strings[RPC_DISPLAY_PORT],
+                                xprt->address_strings[RPC_DISPLAY_PROTO]);
+        else
+                dprintk("RPC:       set up xprt to %s (autobind) via %s\n",
+                                xprt->address_strings[RPC_DISPLAY_ADDR],
+                                xprt->address_strings[RPC_DISPLAY_PROTO]);
+
+        /*
+         * Since we don't want connections for the backchannel, we set
+         * the xprt status to connected
+         */
+        xprt_set_connected(xprt);
+
+
+        if (try_module_get(THIS_MODULE))
+                return xprt;
+        kfree(xprt->slot);
+        kfree(xprt);
+        return ERR_PTR(-EINVAL);
+}
+
 static struct xprt_class        xs_udp_transport = {
         .list           = LIST_HEAD_INIT(xs_udp_transport.list),
         .name           = "udp",
         .owner          = THIS_MODULE,
-        .ident          = IPPROTO_UDP,
+        .ident          = XPRT_TRANSPORT_UDP,
         .setup          = xs_setup_udp,
 };
 
@@ -2334,10 +2571,18 @@ static struct xprt_class	xs_tcp_transport = {
         .list           = LIST_HEAD_INIT(xs_tcp_transport.list),
         .name           = "tcp",
         .owner          = THIS_MODULE,
-        .ident          = IPPROTO_TCP,
+        .ident          = XPRT_TRANSPORT_TCP,
         .setup          = xs_setup_tcp,
 };
 
+static struct xprt_class        xs_bc_tcp_transport = {
+        .list           = LIST_HEAD_INIT(xs_bc_tcp_transport.list),
+        .name           = "tcp NFSv4.1 backchannel",
+        .owner          = THIS_MODULE,
+        .ident          = XPRT_TRANSPORT_BC_TCP,
+        .setup          = xs_setup_bc_tcp,
+};
+
 /**
  * init_socket_xprt - set up xprtsock's sysctls, register with RPC client
  *
@@ -2351,6 +2596,7 @@ int init_socket_xprt(void)
 
         xprt_register_transport(&xs_udp_transport);
         xprt_register_transport(&xs_tcp_transport);
+        xprt_register_transport(&xs_bc_tcp_transport);
 
         return 0;
 }
@@ -2370,6 +2616,7 @@ void cleanup_socket_xprt(void)
 
         xprt_unregister_transport(&xs_udp_transport);
         xprt_unregister_transport(&xs_tcp_transport);
+        xprt_unregister_transport(&xs_bc_tcp_transport);
 }
 
 static int param_set_uint_minmax(const char *val, struct kernel_param *kp,
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 429dd06a4ecc..561a45cf2a6a 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -834,7 +834,7 @@ int cfg80211_wext_siwtxpower(struct net_device *dev,
                 return 0;
         }
 
-        return rdev->ops->set_tx_power(wdev->wiphy, type, dbm);;
+        return rdev->ops->set_tx_power(wdev->wiphy, type, dbm);
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwtxpower);