154 files changed, 11640 insertions, 614 deletions

diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 01ddb0472f86..0eb96f7e44be 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -24,8 +24,11 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
 
         if (vlan_dev)
                 skb->dev = vlan_dev;
-        else if (vlan_id)
-                goto drop;
+        else if (vlan_id) {
+                if (!(skb->dev->flags & IFF_PROMISC))
+                        goto drop;
+                skb->pkt_type = PACKET_OTHERHOST;
+        }
 
         return (polling ? netif_receive_skb(skb) : netif_rx(skb));
 
@@ -102,8 +105,11 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
 
         if (vlan_dev)
                 skb->dev = vlan_dev;
-        else if (vlan_id)
-                goto drop;
+        else if (vlan_id) {
+                if (!(skb->dev->flags & IFF_PROMISC))
+                        goto drop;
+                skb->pkt_type = PACKET_OTHERHOST;
+        }
 
         for (p = napi->gro_list; p; p = p->next) {
                 NAPI_GRO_CB(p)->same_flow =
diff --git a/net/9p/client.c b/net/9p/client.c
index dc6f2f26d023..9eb72505308f 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -331,8 +331,10 @@ static void p9_tag_cleanup(struct p9_client *c)
                 }
         }
 
-        if (c->tagpool)
+        if (c->tagpool) {
+                p9_idpool_put(0, c->tagpool); /* free reserved tag 0 */
                 p9_idpool_destroy(c->tagpool);
+        }
 
         /* free requests associated with tags */
         for (row = 0; row < (c->max_tag/P9_ROW_MAXTAG); row++) {
@@ -944,6 +946,7 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
         int16_t nwqids, count;
 
         err = 0;
+        wqids = NULL;
         clnt = oldfid->clnt;
         if (clone) {
                 fid = p9_fid_create(clnt);
@@ -994,9 +997,11 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
         else
                 fid->qid = oldfid->qid;
 
+        kfree(wqids);
         return fid;
 
 clunk_fid:
+        kfree(wqids);
         p9_client_clunk(fid);
         fid = NULL;
 
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 0ea20c30466c..17c5ba7551a5 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -426,8 +426,10 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
 
         /* Allocate an fcall for the reply */
         rpl_context = kmalloc(sizeof *rpl_context, GFP_KERNEL);
-        if (!rpl_context)
+        if (!rpl_context) {
+                err = -ENOMEM;
                 goto err_close;
+        }
 
         /*
          * If the request has a buffer, steal it, otherwise
@@ -445,8 +447,8 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
         }
         rpl_context->rc = req->rc;
         if (!rpl_context->rc) {
-                kfree(rpl_context);
-                goto err_close;
+                err = -ENOMEM;
+                goto err_free2;
         }
 
         /*
@@ -458,11 +460,8 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
          */
         if (atomic_inc_return(&rdma->rq_count) <= rdma->rq_depth) {
                 err = post_recv(client, rpl_context);
-                if (err) {
-                        kfree(rpl_context->rc);
-                        kfree(rpl_context);
-                        goto err_close;
-                }
+                if (err)
+                        goto err_free1;
         } else
                 atomic_dec(&rdma->rq_count);
 
@@ -471,8 +470,10 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
 
         /* Post the request */
         c = kmalloc(sizeof *c, GFP_KERNEL);
-        if (!c)
-                goto err_close;
+        if (!c) {
+                err = -ENOMEM;
+                goto err_free1;
+        }
         c->req = req;
 
         c->busa = ib_dma_map_single(rdma->cm_id->device,
@@ -499,9 +500,15 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
         return ib_post_send(rdma->qp, &wr, &bad_wr);
 
  error:
+        kfree(c);
+        kfree(rpl_context->rc);
+        kfree(rpl_context);
         P9_DPRINTK(P9_DEBUG_ERROR, "EIO\n");
         return -EIO;
-
+ err_free1:
+        kfree(rpl_context->rc);
+ err_free2:
+        kfree(rpl_context);
  err_close:
         spin_lock_irqsave(&rdma->req_lock, flags);
         if (rdma->state < P9_RDMA_CLOSING) {
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index dcfbe99ff81c..b88515936e4b 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -329,7 +329,8 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
 
         mutex_lock(&virtio_9p_lock);
         list_for_each_entry(chan, &virtio_chan_list, chan_list) {
-                if (!strncmp(devname, chan->tag, chan->tag_len)) {
+                if (!strncmp(devname, chan->tag, chan->tag_len) &&
+                    strlen(devname) == chan->tag_len) {
                         if (!chan->inuse) {
                                 chan->inuse = true;
                                 found = 1;
diff --git a/net/Kconfig b/net/Kconfig
index e330594d3709..55fd82e9ffd9 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -217,7 +217,7 @@ source "net/dns_resolver/Kconfig"
 
 config RPS
         boolean
-        depends on SMP && SYSFS
+        depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
         default y
 
 menu "Network testing"
@@ -293,6 +293,7 @@ source "net/wimax/Kconfig"
 source "net/rfkill/Kconfig"
 source "net/9p/Kconfig"
 source "net/caif/Kconfig"
+source "net/ceph/Kconfig"
 
 
 endif   # if NET
diff --git a/net/Makefile b/net/Makefile
index ea60fbce9b1b..6b7bfd7f1416 100644
--- a/net/Makefile
+++ b/net/Makefile
@@ -68,3 +68,4 @@ obj-$(CONFIG_SYSCTL)		+= sysctl_net.o
 endif
 obj-$(CONFIG_WIMAX)             += wimax/
 obj-$(CONFIG_DNS_RESOLVER)      += dns_resolver/
+obj-$(CONFIG_CEPH_LIB)          += ceph/
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 651babdfab38..ad2b232a2055 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -399,12 +399,6 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
                         unregister_netdev(net_dev);
                         free_netdev(net_dev);
                 }
-                read_lock_irq(&devs_lock);
-                if (list_empty(&br2684_devs)) {
-                        /* last br2684 device */
-                        unregister_atmdevice_notifier(&atm_dev_notifier);
-                }
-                read_unlock_irq(&devs_lock);
                 return;
         }
 
@@ -675,7 +669,6 @@ static int br2684_create(void __user *arg)
 
         if (list_empty(&br2684_devs)) {
                 /* 1st br2684 device */
-                register_atmdevice_notifier(&atm_dev_notifier);
                 brdev->number = 1;
         } else
                 brdev->number = BRPRIV(list_entry_brdev(br2684_devs.prev))->number + 1;
@@ -815,6 +808,7 @@ static int __init br2684_init(void)
                 return -ENOMEM;
 #endif
         register_atm_ioctl(&br2684_ioctl_ops);
+        register_atmdevice_notifier(&atm_dev_notifier);
         return 0;
 }
 
@@ -830,9 +824,7 @@ static void __exit br2684_exit(void)
 #endif
 
 
-        /* if not already empty */
-        if (!list_empty(&br2684_devs))
-                unregister_atmdevice_notifier(&atm_dev_notifier);
+        unregister_atmdevice_notifier(&atm_dev_notifier);
 
         while (!list_empty(&br2684_devs)) {
                 net_dev = list_entry_brdev(br2684_devs.next);
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 622b471e14e0..74bcc662c3dd 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
         eg->packets_rcvd++;
         mpc->eg_ops->put(eg);
 
-        memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
+        memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data));
         netif_rx(new_skb);
 }
 
diff --git a/net/atm/proc.c b/net/atm/proc.c
index 6262aeae398e..f85da0779e5e 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -38,6 +38,7 @@ static ssize_t proc_dev_atm_read(struct file *file, char __user *buf,
 static const struct file_operations proc_atm_dev_ops = {
         .owner =        THIS_MODULE,
         .read =         proc_dev_atm_read,
+        .llseek =       noop_llseek,
 };
 
 static void add_stats(struct seq_file *seq, const char *aal,
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index fadf26b4ed7c..0b54b7dd8401 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1441,33 +1441,23 @@ static inline void l2cap_do_send(struct sock *sk, struct sk_buff *skb)
 
 static void l2cap_streaming_send(struct sock *sk)
 {
-        struct sk_buff *skb, *tx_skb;
+        struct sk_buff *skb;
         struct l2cap_pinfo *pi = l2cap_pi(sk);
         u16 control, fcs;
 
-        while ((skb = sk->sk_send_head)) {
-                tx_skb = skb_clone(skb, GFP_ATOMIC);
-
-                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
+        while ((skb = skb_dequeue(TX_QUEUE(sk)))) {
+                control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE);
                 control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
-                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
+                put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE);
 
                 if (pi->fcs == L2CAP_FCS_CRC16) {
-                        fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
-                        put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
+                        fcs = crc16(0, (u8 *)skb->data, skb->len - 2);
+                        put_unaligned_le16(fcs, skb->data + skb->len - 2);
                 }
 
-                l2cap_do_send(sk, tx_skb);
+                l2cap_do_send(sk, skb);
 
                 pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
-
-                if (skb_queue_is_last(TX_QUEUE(sk), skb))
-                        sk->sk_send_head = NULL;
-                else
-                        sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
-
-                skb = skb_dequeue(TX_QUEUE(sk));
-                kfree_skb(skb);
         }
 }
 
@@ -1960,6 +1950,11 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
 
         switch (optname) {
         case L2CAP_OPTIONS:
+                if (sk->sk_state == BT_CONNECTED) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 opts.imtu     = l2cap_pi(sk)->imtu;
                 opts.omtu     = l2cap_pi(sk)->omtu;
                 opts.flush_to = l2cap_pi(sk)->flush_to;
@@ -2771,10 +2766,10 @@ static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data,
                 case L2CAP_CONF_MTU:
                         if (val < L2CAP_DEFAULT_MIN_MTU) {
                                 *result = L2CAP_CONF_UNACCEPT;
-                                pi->omtu = L2CAP_DEFAULT_MIN_MTU;
+                                pi->imtu = L2CAP_DEFAULT_MIN_MTU;
                         } else
-                                pi->omtu = val;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+                                pi->imtu = val;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
                         break;
 
                 case L2CAP_CONF_FLUSH_TO:
@@ -3071,6 +3066,17 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
         return 0;
 }
 
+static inline void set_default_fcs(struct l2cap_pinfo *pi)
+{
+        /* FCS is enabled only in ERTM or streaming mode, if one or both
+         * sides request it.
+         */
+        if (pi->mode != L2CAP_MODE_ERTM && pi->mode != L2CAP_MODE_STREAMING)
+                pi->fcs = L2CAP_FCS_NONE;
+        else if (!(pi->conf_state & L2CAP_CONF_NO_FCS_RECV))
+                pi->fcs = L2CAP_FCS_CRC16;
+}
+
 static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 {
         struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
@@ -3088,14 +3094,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (!sk)
                 return -ENOENT;
 
-        if (sk->sk_state != BT_CONFIG) {
-                struct l2cap_cmd_rej rej;
-
-                rej.reason = cpu_to_le16(0x0002);
-                l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
-                                sizeof(rej), &rej);
+        if (sk->sk_state == BT_DISCONN)
                 goto unlock;
-        }
 
         /* Reject if config buffer is too small. */
         len = cmd_len - sizeof(*req);
@@ -3135,9 +3135,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 goto unlock;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
-                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
-                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
+                set_default_fcs(l2cap_pi(sk));
 
                 sk->sk_state = BT_CONNECTED;
 
@@ -3225,9 +3223,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
-                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
-                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
+                set_default_fcs(l2cap_pi(sk));
 
                 sk->sk_state = BT_CONNECTED;
                 l2cap_pi(sk)->next_tx_seq = 0;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 44a623275951..194b3a04cfd3 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -82,11 +82,14 @@ static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
 {
         struct sock *sk = d->owner, *parent;
+        unsigned long flags;
+
         if (!sk)
                 return;
 
         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
 
+        local_irq_save(flags);
         bh_lock_sock(sk);
 
         if (err)
@@ -108,6 +111,7 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
         }
 
         bh_unlock_sock(sk);
+        local_irq_restore(flags);
 
         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
                 /* We have to drop DLC lock here, otherwise
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index befc3a52aa04..84c2a4d013c6 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -844,10 +844,6 @@ static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned
                 BT_DBG("TIOCMIWAIT");
                 break;
 
-        case TIOCGICOUNT:
-                BT_DBG("TIOCGICOUNT");
-                break;
-
         case TIOCGSERIAL:
                 BT_ERR("TIOCGSERIAL is not supported");
                 return -ENOIOCTLCMD;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 5ed00bd7009f..137f23259a93 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -761,9 +761,11 @@ static int br_nf_dev_queue_xmit(struct sk_buff *skb)
 {
         if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) &&
             skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu &&
-            !skb_is_gso(skb))
+            !skb_is_gso(skb)) {
+                /* BUG: Should really parse the IP options here. */
+                memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                 return ip_fragment(skb, br_dev_queue_push_xmit);
-        else
+        } else
                 return br_dev_queue_push_xmit(skb);
 }
 #else
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 8ce904786116..4bf28f25f368 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -827,6 +827,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
         long timeo;
         int err;
         int ifindex, headroom, tailroom;
+        unsigned int mtu;
         struct net_device *dev;
 
         lock_sock(sk);
@@ -896,15 +897,23 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
                 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
                 goto out;
         }
-        dev = dev_get_by_index(sock_net(sk), ifindex);
+
+        err = -ENODEV;
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(sock_net(sk), ifindex);
+        if (!dev) {
+                rcu_read_unlock();
+                goto out;
+        }
         cf_sk->headroom = LL_RESERVED_SPACE_EXTRA(dev, headroom);
+        mtu = dev->mtu;
+        rcu_read_unlock();
+
         cf_sk->tailroom = tailroom;
-        cf_sk->maxframe = dev->mtu - (headroom + tailroom);
-        dev_put(dev);
+        cf_sk->maxframe = mtu - (headroom + tailroom);
         if (cf_sk->maxframe < 1) {
-                pr_warning("CAIF: %s(): CAIF Interface MTU too small (%d)\n",
-                        __func__, dev->mtu);
-                err = -ENODEV;
+                pr_warning("CAIF: %s(): CAIF Interface MTU too small (%u)\n",
+                           __func__, mtu);
                 goto out;
         }
 
diff --git a/net/ceph/Kconfig b/net/ceph/Kconfig
new file mode 100644
index 000000000000..ad424049b0cf
--- /dev/null
+++ b/net/ceph/Kconfig
@@ -0,0 +1,28 @@
+config CEPH_LIB
+        tristate "Ceph core library (EXPERIMENTAL)"
+        depends on INET && EXPERIMENTAL
+        select LIBCRC32C
+        select CRYPTO_AES
+        select CRYPTO
+        default n
+        help
+          Choose Y or M here to include cephlib, which provides the
+          common functionality to both the Ceph filesystem and
+          to the rados block device (rbd).
+
+          More information at http://ceph.newdream.net/.
+
+          If unsure, say N.
+
+config CEPH_LIB_PRETTYDEBUG
+        bool "Include file:line in ceph debug output"
+        depends on CEPH_LIB
+        default n
+        help
+          If you say Y here, debug output will include a filename and
+          line to aid debugging.  This increases kernel size and slows
+          execution slightly when debug call sites are enabled (e.g.,
+          via CONFIG_DYNAMIC_DEBUG).
+
+          If unsure, say N.
+
diff --git a/net/ceph/Makefile b/net/ceph/Makefile
new file mode 100644
index 000000000000..aab1cabb8035
--- /dev/null
+++ b/net/ceph/Makefile
@@ -0,0 +1,37 @@
+#
+# Makefile for CEPH filesystem.
+#
+
+ifneq ($(KERNELRELEASE),)
+
+obj-$(CONFIG_CEPH_LIB) += libceph.o
+
+libceph-objs := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \
+        mon_client.o \
+        osd_client.o osdmap.o crush/crush.o crush/mapper.o crush/hash.o \
+        debugfs.o \
+        auth.o auth_none.o \
+        crypto.o armor.o \
+        auth_x.o \
+        ceph_fs.o ceph_strings.o ceph_hash.o \
+        pagevec.o
+
+else
+#Otherwise we were called directly from the command
+# line; invoke the kernel build system.
+
+KERNELDIR ?= /lib/modules/$(shell uname -r)/build
+PWD := $(shell pwd)
+
+default: all
+
+all:
+        $(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_LIB=m modules
+
+modules_install:
+        $(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_LIB=m modules_install
+
+clean:
+        $(MAKE) -C $(KERNELDIR) M=$(PWD) clean
+
+endif
diff --git a/net/ceph/armor.c b/net/ceph/armor.c
new file mode 100644
index 000000000000..eb2a666b0be7
--- /dev/null
+++ b/net/ceph/armor.c
@@ -0,0 +1,103 @@
+
+#include <linux/errno.h>
+
+int ceph_armor(char *dst, const char *src, const char *end);
+int ceph_unarmor(char *dst, const char *src, const char *end);
+
+/*
+ * base64 encode/decode.
+ */
+
+static const char *pem_key =
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+static int encode_bits(int c)
+{
+        return pem_key[c];
+}
+
+static int decode_bits(char c)
+{
+        if (c >= 'A' && c <= 'Z')
+                return c - 'A';
+        if (c >= 'a' && c <= 'z')
+                return c - 'a' + 26;
+        if (c >= '0' && c <= '9')
+                return c - '0' + 52;
+        if (c == '+')
+                return 62;
+        if (c == '/')
+                return 63;
+        if (c == '=')
+                return 0; /* just non-negative, please */
+        return -EINVAL;
+}
+
+int ceph_armor(char *dst, const char *src, const char *end)
+{
+        int olen = 0;
+        int line = 0;
+
+        while (src < end) {
+                unsigned char a, b, c;
+
+                a = *src++;
+                *dst++ = encode_bits(a >> 2);
+                if (src < end) {
+                        b = *src++;
+                        *dst++ = encode_bits(((a & 3) << 4) | (b >> 4));
+                        if (src < end) {
+                                c = *src++;
+                                *dst++ = encode_bits(((b & 15) << 2) |
+                                                     (c >> 6));
+                                *dst++ = encode_bits(c & 63);
+                        } else {
+                                *dst++ = encode_bits((b & 15) << 2);
+                                *dst++ = '=';
+                        }
+                } else {
+                        *dst++ = encode_bits(((a & 3) << 4));
+                        *dst++ = '=';
+                        *dst++ = '=';
+                }
+                olen += 4;
+                line += 4;
+                if (line == 64) {
+                        line = 0;
+                        *(dst++) = '\n';
+                        olen++;
+                }
+        }
+        return olen;
+}
+
+int ceph_unarmor(char *dst, const char *src, const char *end)
+{
+        int olen = 0;
+
+        while (src < end) {
+                int a, b, c, d;
+
+                if (src < end && src[0] == '\n')
+                        src++;
+                if (src + 4 > end)
+                        return -EINVAL;
+                a = decode_bits(src[0]);
+                b = decode_bits(src[1]);
+                c = decode_bits(src[2]);
+                d = decode_bits(src[3]);
+                if (a < 0 || b < 0 || c < 0 || d < 0)
+                        return -EINVAL;
+
+                *dst++ = (a << 2) | (b >> 4);
+                if (src[2] == '=')
+                        return olen + 1;
+                *dst++ = ((b & 15) << 4) | (c >> 2);
+                if (src[3] == '=')
+                        return olen + 2;
+                *dst++ = ((c & 3) << 6) | d;
+                olen += 3;
+                src += 4;
+        }
+        return olen;
+}
diff --git a/net/ceph/auth.c b/net/ceph/auth.c
new file mode 100644
index 000000000000..549c1f43e1d5
--- /dev/null
+++ b/net/ceph/auth.c
@@ -0,0 +1,259 @@
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/slab.h>
+
+#include <linux/ceph/types.h>
+#include <linux/ceph/decode.h>
+#include <linux/ceph/libceph.h>
+#include <linux/ceph/messenger.h>
+#include "auth_none.h"
+#include "auth_x.h"
+
+
+/*
+ * get protocol handler
+ */
+static u32 supported_protocols[] = {
+        CEPH_AUTH_NONE,
+        CEPH_AUTH_CEPHX
+};
+
+static int ceph_auth_init_protocol(struct ceph_auth_client *ac, int protocol)
+{
+        switch (protocol) {
+        case CEPH_AUTH_NONE:
+                return ceph_auth_none_init(ac);
+        case CEPH_AUTH_CEPHX:
+                return ceph_x_init(ac);
+        default:
+                return -ENOENT;
+        }
+}
+
+/*
+ * setup, teardown.
+ */
+struct ceph_auth_client *ceph_auth_init(const char *name, const char *secret)
+{
+        struct ceph_auth_client *ac;
+        int ret;
+
+        dout("auth_init name '%s' secret '%s'\n", name, secret);
+
+        ret = -ENOMEM;
+        ac = kzalloc(sizeof(*ac), GFP_NOFS);
+        if (!ac)
+                goto out;
+
+        ac->negotiating = true;
+        if (name)
+                ac->name = name;
+        else
+                ac->name = CEPH_AUTH_NAME_DEFAULT;
+        dout("auth_init name %s secret %s\n", ac->name, secret);
+        ac->secret = secret;
+        return ac;
+
+out:
+        return ERR_PTR(ret);
+}
+
+void ceph_auth_destroy(struct ceph_auth_client *ac)
+{
+        dout("auth_destroy %p\n", ac);
+        if (ac->ops)
+                ac->ops->destroy(ac);
+        kfree(ac);
+}
+
+/*
+ * Reset occurs when reconnecting to the monitor.
+ */
+void ceph_auth_reset(struct ceph_auth_client *ac)
+{
+        dout("auth_reset %p\n", ac);
+        if (ac->ops && !ac->negotiating)
+                ac->ops->reset(ac);
+        ac->negotiating = true;
+}
+
+int ceph_entity_name_encode(const char *name, void **p, void *end)
+{
+        int len = strlen(name);
+
+        if (*p + 2*sizeof(u32) + len > end)
+                return -ERANGE;
+        ceph_encode_32(p, CEPH_ENTITY_TYPE_CLIENT);
+        ceph_encode_32(p, len);
+        ceph_encode_copy(p, name, len);
+        return 0;
+}
+
+/*
+ * Initiate protocol negotiation with monitor.  Include entity name
+ * and list supported protocols.
+ */
+int ceph_auth_build_hello(struct ceph_auth_client *ac, void *buf, size_t len)
+{
+        struct ceph_mon_request_header *monhdr = buf;
+        void *p = monhdr + 1, *end = buf + len, *lenp;
+        int i, num;
+        int ret;
+
+        dout("auth_build_hello\n");
+        monhdr->have_version = 0;
+        monhdr->session_mon = cpu_to_le16(-1);
+        monhdr->session_mon_tid = 0;
+
+        ceph_encode_32(&p, 0);  /* no protocol, yet */
+
+        lenp = p;
+        p += sizeof(u32);
+
+        ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
+        ceph_encode_8(&p, 1);
+        num = ARRAY_SIZE(supported_protocols);
+        ceph_encode_32(&p, num);
+        ceph_decode_need(&p, end, num * sizeof(u32), bad);
+        for (i = 0; i < num; i++)
+                ceph_encode_32(&p, supported_protocols[i]);
+
+        ret = ceph_entity_name_encode(ac->name, &p, end);
+        if (ret < 0)
+                return ret;
+        ceph_decode_need(&p, end, sizeof(u64), bad);
+        ceph_encode_64(&p, ac->global_id);
+
+        ceph_encode_32(&lenp, p - lenp - sizeof(u32));
+        return p - buf;
+
+bad:
+        return -ERANGE;
+}
+
+static int ceph_build_auth_request(struct ceph_auth_client *ac,
+                                   void *msg_buf, size_t msg_len)
+{
+        struct ceph_mon_request_header *monhdr = msg_buf;
+        void *p = monhdr + 1;
+        void *end = msg_buf + msg_len;
+        int ret;
+
+        monhdr->have_version = 0;
+        monhdr->session_mon = cpu_to_le16(-1);
+        monhdr->session_mon_tid = 0;
+
+        ceph_encode_32(&p, ac->protocol);
+
+        ret = ac->ops->build_request(ac, p + sizeof(u32), end);
+        if (ret < 0) {
+                pr_err("error %d building auth method %s request\n", ret,
+                       ac->ops->name);
+                return ret;
+        }
+        dout(" built request %d bytes\n", ret);
+        ceph_encode_32(&p, ret);
+        return p + ret - msg_buf;
+}
+
+/*
+ * Handle auth message from monitor.
+ */
+int ceph_handle_auth_reply(struct ceph_auth_client *ac,
+                           void *buf, size_t len,
+                           void *reply_buf, size_t reply_len)
+{
+        void *p = buf;
+        void *end = buf + len;
+        int protocol;
+        s32 result;
+        u64 global_id;
+        void *payload, *payload_end;
+        int payload_len;
+        char *result_msg;
+        int result_msg_len;
+        int ret = -EINVAL;
+
+        dout("handle_auth_reply %p %p\n", p, end);
+        ceph_decode_need(&p, end, sizeof(u32) * 3 + sizeof(u64), bad);
+        protocol = ceph_decode_32(&p);
+        result = ceph_decode_32(&p);
+        global_id = ceph_decode_64(&p);
+        payload_len = ceph_decode_32(&p);
+        payload = p;
+        p += payload_len;
+        ceph_decode_need(&p, end, sizeof(u32), bad);
+        result_msg_len = ceph_decode_32(&p);
+        result_msg = p;
+        p += result_msg_len;
+        if (p != end)
+                goto bad;
+
+        dout(" result %d '%.*s' gid %llu len %d\n", result, result_msg_len,
+             result_msg, global_id, payload_len);
+
+        payload_end = payload + payload_len;
+
+        if (global_id && ac->global_id != global_id) {
+                dout(" set global_id %lld -> %lld\n", ac->global_id, global_id);
+                ac->global_id = global_id;
+        }
+
+        if (ac->negotiating) {
+                /* server does not support our protocols? */
+                if (!protocol && result < 0) {
+                        ret = result;
+                        goto out;
+                }
+                /* set up (new) protocol handler? */
+                if (ac->protocol && ac->protocol != protocol) {
+                        ac->ops->destroy(ac);
+                        ac->protocol = 0;
+                        ac->ops = NULL;
+                }
+                if (ac->protocol != protocol) {
+                        ret = ceph_auth_init_protocol(ac, protocol);
+                        if (ret) {
+                                pr_err("error %d on auth protocol %d init\n",
+                                       ret, protocol);
+                                goto out;
+                        }
+                }
+
+                ac->negotiating = false;
+        }
+
+        ret = ac->ops->handle_reply(ac, result, payload, payload_end);
+        if (ret == -EAGAIN) {
+                return ceph_build_auth_request(ac, reply_buf, reply_len);
+        } else if (ret) {
+                pr_err("auth method '%s' error %d\n", ac->ops->name, ret);
+                return ret;
+        }
+        return 0;
+
+bad:
+        pr_err("failed to decode auth msg\n");
+out:
+        return ret;
+}
+
+int ceph_build_auth(struct ceph_auth_client *ac,
+                    void *msg_buf, size_t msg_len)
+{
+        if (!ac->protocol)
+                return ceph_auth_build_hello(ac, msg_buf, msg_len);
+        BUG_ON(!ac->ops);
+        if (ac->ops->should_authenticate(ac))
+                return ceph_build_auth_request(ac, msg_buf, msg_len);
+        return 0;
+}
+
+int ceph_auth_is_authenticated(struct ceph_auth_client *ac)
+{
+        if (!ac->ops)
+                return 0;
+        return ac->ops->is_authenticated(ac);
+}
diff --git a/net/ceph/auth_none.c b/net/ceph/auth_none.c
new file mode 100644
index 000000000000..214c2bb43d62
--- /dev/null
+++ b/net/ceph/auth_none.c
@@ -0,0 +1,132 @@
+
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+
+#include <linux/ceph/decode.h>
+#include <linux/ceph/auth.h>
+
+#include "auth_none.h"
+
+static void reset(struct ceph_auth_client *ac)
+{
+        struct ceph_auth_none_info *xi = ac->private;
+
+        xi->starting = true;
+        xi->built_authorizer = false;
+}
+
+static void destroy(struct ceph_auth_client *ac)
+{
+        kfree(ac->private);
+        ac->private = NULL;
+}
+
+static int is_authenticated(struct ceph_auth_client *ac)
+{
+        struct ceph_auth_none_info *xi = ac->private;
+
+        return !xi->starting;
+}
+
+static int should_authenticate(struct ceph_auth_client *ac)
+{
+        struct ceph_auth_none_info *xi = ac->private;
+
+        return xi->starting;
+}
+
+/*
+ * the generic auth code decode the global_id, and we carry no actual
+ * authenticate state, so nothing happens here.
+ */
+static int handle_reply(struct ceph_auth_client *ac, int result,
+                        void *buf, void *end)
+{
+        struct ceph_auth_none_info *xi = ac->private;
+
+        xi->starting = false;
+        return result;
+}
+
+/*
+ * build an 'authorizer' with our entity_name and global_id.  we can
+ * reuse a single static copy since it is identical for all services
+ * we connect to.
+ */
+static int ceph_auth_none_create_authorizer(
+        struct ceph_auth_client *ac, int peer_type,
+        struct ceph_authorizer **a,
+        void **buf, size_t *len,
+        void **reply_buf, size_t *reply_len)
+{
+        struct ceph_auth_none_info *ai = ac->private;
+        struct ceph_none_authorizer *au = &ai->au;
+        void *p, *end;
+        int ret;
+
+        if (!ai->built_authorizer) {
+                p = au->buf;
+                end = p + sizeof(au->buf);
+                ceph_encode_8(&p, 1);
+                ret = ceph_entity_name_encode(ac->name, &p, end - 8);
+                if (ret < 0)
+                        goto bad;
+                ceph_decode_need(&p, end, sizeof(u64), bad2);
+                ceph_encode_64(&p, ac->global_id);
+                au->buf_len = p - (void *)au->buf;
+                ai->built_authorizer = true;
+                dout("built authorizer len %d\n", au->buf_len);
+        }
+
+        *a = (struct ceph_authorizer *)au;
+        *buf = au->buf;
+        *len = au->buf_len;
+        *reply_buf = au->reply_buf;
+        *reply_len = sizeof(au->reply_buf);
+        return 0;
+
+bad2:
+        ret = -ERANGE;
+bad:
+        return ret;
+}
+
+static void ceph_auth_none_destroy_authorizer(struct ceph_auth_client *ac,
+                                      struct ceph_authorizer *a)
+{
+        /* nothing to do */
+}
+
+static const struct ceph_auth_client_ops ceph_auth_none_ops = {
+        .name = "none",
+        .reset = reset,
+        .destroy = destroy,
+        .is_authenticated = is_authenticated,
+        .should_authenticate = should_authenticate,
+        .handle_reply = handle_reply,
+        .create_authorizer = ceph_auth_none_create_authorizer,
+        .destroy_authorizer = ceph_auth_none_destroy_authorizer,
+};
+
+int ceph_auth_none_init(struct ceph_auth_client *ac)
+{
+        struct ceph_auth_none_info *xi;
+
+        dout("ceph_auth_none_init %p\n", ac);
+        xi = kzalloc(sizeof(*xi), GFP_NOFS);
+        if (!xi)
+                return -ENOMEM;
+
+        xi->starting = true;
+        xi->built_authorizer = false;
+
+        ac->protocol = CEPH_AUTH_NONE;
+        ac->private = xi;
+        ac->ops = &ceph_auth_none_ops;
+        return 0;
+}
+
diff --git a/net/ceph/auth_none.h b/net/ceph/auth_none.h
new file mode 100644
index 000000000000..ed7d088b1bc9
--- /dev/null
+++ b/net/ceph/auth_none.h
@@ -0,0 +1,29 @@
+#ifndef _FS_CEPH_AUTH_NONE_H
+#define _FS_CEPH_AUTH_NONE_H
+
+#include <linux/slab.h>
+#include <linux/ceph/auth.h>
+
+/*
+ * null security mode.
+ *
+ * we use a single static authorizer that simply encodes our entity name
+ * and global id.
+ */
+
+struct ceph_none_authorizer {
+        char buf[128];
+        int buf_len;
+        char reply_buf[0];
+};
+
+struct ceph_auth_none_info {
+        bool starting;
+        bool built_authorizer;
+        struct ceph_none_authorizer au;   /* we only need one; it's static */
+};
+
+extern int ceph_auth_none_init(struct ceph_auth_client *ac);
+
+#endif
+
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
new file mode 100644
index 000000000000..7fd5dfcf6e18
--- /dev/null
+++ b/net/ceph/auth_x.c
@@ -0,0 +1,688 @@
+
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/err.h>
+#include <linux/module.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+
+#include <linux/ceph/decode.h>
+#include <linux/ceph/auth.h>
+
+#include "crypto.h"
+#include "auth_x.h"
+#include "auth_x_protocol.h"
+
+#define TEMP_TICKET_BUF_LEN     256
+
+static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
+
+static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
+{
+        struct ceph_x_info *xi = ac->private;
+        int need;
+
+        ceph_x_validate_tickets(ac, &need);
+        dout("ceph_x_is_authenticated want=%d need=%d have=%d\n",
+             ac->want_keys, need, xi->have_keys);
+        return (ac->want_keys & xi->have_keys) == ac->want_keys;
+}
+
+static int ceph_x_should_authenticate(struct ceph_auth_client *ac)
+{
+        struct ceph_x_info *xi = ac->private;
+        int need;
+
+        ceph_x_validate_tickets(ac, &need);
+        dout("ceph_x_should_authenticate want=%d need=%d have=%d\n",
+             ac->want_keys, need, xi->have_keys);
+        return need != 0;
+}
+
+static int ceph_x_encrypt_buflen(int ilen)
+{
+        return sizeof(struct ceph_x_encrypt_header) + ilen + 16 +
+                sizeof(u32);
+}
+
+static int ceph_x_encrypt(struct ceph_crypto_key *secret,
+                          void *ibuf, int ilen, void *obuf, size_t olen)
+{
+        struct ceph_x_encrypt_header head = {
+                .struct_v = 1,
+                .magic = cpu_to_le64(CEPHX_ENC_MAGIC)
+        };
+        size_t len = olen - sizeof(u32);
+        int ret;
+
+        ret = ceph_encrypt2(secret, obuf + sizeof(u32), &len,
+                            &head, sizeof(head), ibuf, ilen);
+        if (ret)
+                return ret;
+        ceph_encode_32(&obuf, len);
+        return len + sizeof(u32);
+}
+
+static int ceph_x_decrypt(struct ceph_crypto_key *secret,
+                          void **p, void *end, void *obuf, size_t olen)
+{
+        struct ceph_x_encrypt_header head;
+        size_t head_len = sizeof(head);
+        int len, ret;
+
+        len = ceph_decode_32(p);
+        if (*p + len > end)
+                return -EINVAL;
+
+        dout("ceph_x_decrypt len %d\n", len);
+        ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen,
+                            *p, len);
+        if (ret)
+                return ret;
+        if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
+                return -EPERM;
+        *p += len;
+        return olen;
+}
+
+/*
+ * get existing (or insert new) ticket handler
+ */
+static struct ceph_x_ticket_handler *
+get_ticket_handler(struct ceph_auth_client *ac, int service)
+{
+        struct ceph_x_ticket_handler *th;
+        struct ceph_x_info *xi = ac->private;
+        struct rb_node *parent = NULL, **p = &xi->ticket_handlers.rb_node;
+
+        while (*p) {
+                parent = *p;
+                th = rb_entry(parent, struct ceph_x_ticket_handler, node);
+                if (service < th->service)
+                        p = &(*p)->rb_left;
+                else if (service > th->service)
+                        p = &(*p)->rb_right;
+                else
+                        return th;
+        }
+
+        /* add it */
+        th = kzalloc(sizeof(*th), GFP_NOFS);
+        if (!th)
+                return ERR_PTR(-ENOMEM);
+        th->service = service;
+        rb_link_node(&th->node, parent, p);
+        rb_insert_color(&th->node, &xi->ticket_handlers);
+        return th;
+}
+
+static void remove_ticket_handler(struct ceph_auth_client *ac,
+                                  struct ceph_x_ticket_handler *th)
+{
+        struct ceph_x_info *xi = ac->private;
+
+        dout("remove_ticket_handler %p %d\n", th, th->service);
+        rb_erase(&th->node, &xi->ticket_handlers);
+        ceph_crypto_key_destroy(&th->session_key);
+        if (th->ticket_blob)
+                ceph_buffer_put(th->ticket_blob);
+        kfree(th);
+}
+
+static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
+                                    struct ceph_crypto_key *secret,
+                                    void *buf, void *end)
+{
+        struct ceph_x_info *xi = ac->private;
+        int num;
+        void *p = buf;
+        int ret;
+        char *dbuf;
+        char *ticket_buf;
+        u8 reply_struct_v;
+
+        dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+        if (!dbuf)
+                return -ENOMEM;
+
+        ret = -ENOMEM;
+        ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+        if (!ticket_buf)
+                goto out_dbuf;
+
+        ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
+        reply_struct_v = ceph_decode_8(&p);
+        if (reply_struct_v != 1)
+                goto bad;
+        num = ceph_decode_32(&p);
+        dout("%d tickets\n", num);
+        while (num--) {
+                int type;
+                u8 tkt_struct_v, blob_struct_v;
+                struct ceph_x_ticket_handler *th;
+                void *dp, *dend;
+                int dlen;
+                char is_enc;
+                struct timespec validity;
+                struct ceph_crypto_key old_key;
+                void *tp, *tpend;
+                struct ceph_timespec new_validity;
+                struct ceph_crypto_key new_session_key;
+                struct ceph_buffer *new_ticket_blob;
+                unsigned long new_expires, new_renew_after;
+                u64 new_secret_id;
+
+                ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
+
+                type = ceph_decode_32(&p);
+                dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+
+                tkt_struct_v = ceph_decode_8(&p);
+                if (tkt_struct_v != 1)
+                        goto bad;
+
+                th = get_ticket_handler(ac, type);
+                if (IS_ERR(th)) {
+                        ret = PTR_ERR(th);
+                        goto out;
+                }
+
+                /* blob for me */
+                dlen = ceph_x_decrypt(secret, &p, end, dbuf,
+                                      TEMP_TICKET_BUF_LEN);
+                if (dlen <= 0) {
+                        ret = dlen;
+                        goto out;
+                }
+                dout(" decrypted %d bytes\n", dlen);
+                dend = dbuf + dlen;
+                dp = dbuf;
+
+                tkt_struct_v = ceph_decode_8(&dp);
+                if (tkt_struct_v != 1)
+                        goto bad;
+
+                memcpy(&old_key, &th->session_key, sizeof(old_key));
+                ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
+                if (ret)
+                        goto out;
+
+                ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
+                ceph_decode_timespec(&validity, &new_validity);
+                new_expires = get_seconds() + validity.tv_sec;
+                new_renew_after = new_expires - (validity.tv_sec / 4);
+                dout(" expires=%lu renew_after=%lu\n", new_expires,
+                     new_renew_after);
+
+                /* ticket blob for service */
+                ceph_decode_8_safe(&p, end, is_enc, bad);
+                tp = ticket_buf;
+                if (is_enc) {
+                        /* encrypted */
+                        dout(" encrypted ticket\n");
+                        dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf,
+                                              TEMP_TICKET_BUF_LEN);
+                        if (dlen < 0) {
+                                ret = dlen;
+                                goto out;
+                        }
+                        dlen = ceph_decode_32(&tp);
+                } else {
+                        /* unencrypted */
+                        ceph_decode_32_safe(&p, end, dlen, bad);
+                        ceph_decode_need(&p, end, dlen, bad);
+                        ceph_decode_copy(&p, ticket_buf, dlen);
+                }
+                tpend = tp + dlen;
+                dout(" ticket blob is %d bytes\n", dlen);
+                ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
+                blob_struct_v = ceph_decode_8(&tp);
+                new_secret_id = ceph_decode_64(&tp);
+                ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+                if (ret)
+                        goto out;
+
+                /* all is well, update our ticket */
+                ceph_crypto_key_destroy(&th->session_key);
+                if (th->ticket_blob)
+                        ceph_buffer_put(th->ticket_blob);
+                th->session_key = new_session_key;
+                th->ticket_blob = new_ticket_blob;
+                th->validity = new_validity;
+                th->secret_id = new_secret_id;
+                th->expires = new_expires;
+                th->renew_after = new_renew_after;
+                dout(" got ticket service %d (%s) secret_id %lld len %d\n",
+                     type, ceph_entity_type_name(type), th->secret_id,
+                     (int)th->ticket_blob->vec.iov_len);
+                xi->have_keys |= th->service;
+        }
+
+        ret = 0;
+out:
+        kfree(ticket_buf);
+out_dbuf:
+        kfree(dbuf);
+        return ret;
+
+bad:
+        ret = -EINVAL;
+        goto out;
+}
+
+static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
+                                   struct ceph_x_ticket_handler *th,
+                                   struct ceph_x_authorizer *au)
+{
+        int maxlen;
+        struct ceph_x_authorize_a *msg_a;
+        struct ceph_x_authorize_b msg_b;
+        void *p, *end;
+        int ret;
+        int ticket_blob_len =
+                (th->ticket_blob ? th->ticket_blob->vec.iov_len : 0);
+
+        dout("build_authorizer for %s %p\n",
+             ceph_entity_type_name(th->service), au);
+
+        maxlen = sizeof(*msg_a) + sizeof(msg_b) +
+                ceph_x_encrypt_buflen(ticket_blob_len);
+        dout("  need len %d\n", maxlen);
+        if (au->buf && au->buf->alloc_len < maxlen) {
+                ceph_buffer_put(au->buf);
+                au->buf = NULL;
+        }
+        if (!au->buf) {
+                au->buf = ceph_buffer_new(maxlen, GFP_NOFS);
+                if (!au->buf)
+                        return -ENOMEM;
+        }
+        au->service = th->service;
+
+        msg_a = au->buf->vec.iov_base;
+        msg_a->struct_v = 1;
+        msg_a->global_id = cpu_to_le64(ac->global_id);
+        msg_a->service_id = cpu_to_le32(th->service);
+        msg_a->ticket_blob.struct_v = 1;
+        msg_a->ticket_blob.secret_id = cpu_to_le64(th->secret_id);
+        msg_a->ticket_blob.blob_len = cpu_to_le32(ticket_blob_len);
+        if (ticket_blob_len) {
+                memcpy(msg_a->ticket_blob.blob, th->ticket_blob->vec.iov_base,
+                       th->ticket_blob->vec.iov_len);
+        }
+        dout(" th %p secret_id %lld %lld\n", th, th->secret_id,
+             le64_to_cpu(msg_a->ticket_blob.secret_id));
+
+        p = msg_a + 1;
+        p += ticket_blob_len;
+        end = au->buf->vec.iov_base + au->buf->vec.iov_len;
+
+        get_random_bytes(&au->nonce, sizeof(au->nonce));
+        msg_b.struct_v = 1;
+        msg_b.nonce = cpu_to_le64(au->nonce);
+        ret = ceph_x_encrypt(&th->session_key, &msg_b, sizeof(msg_b),
+                             p, end - p);
+        if (ret < 0)
+                goto out_buf;
+        p += ret;
+        au->buf->vec.iov_len = p - au->buf->vec.iov_base;
+        dout(" built authorizer nonce %llx len %d\n", au->nonce,
+             (int)au->buf->vec.iov_len);
+        BUG_ON(au->buf->vec.iov_len > maxlen);
+        return 0;
+
+out_buf:
+        ceph_buffer_put(au->buf);
+        au->buf = NULL;
+        return ret;
+}
+
+static int ceph_x_encode_ticket(struct ceph_x_ticket_handler *th,
+                                void **p, void *end)
+{
+        ceph_decode_need(p, end, 1 + sizeof(u64), bad);
+        ceph_encode_8(p, 1);
+        ceph_encode_64(p, th->secret_id);
+        if (th->ticket_blob) {
+                const char *buf = th->ticket_blob->vec.iov_base;
+                u32 len = th->ticket_blob->vec.iov_len;
+
+                ceph_encode_32_safe(p, end, len, bad);
+                ceph_encode_copy_safe(p, end, buf, len, bad);
+        } else {
+                ceph_encode_32_safe(p, end, 0, bad);
+        }
+
+        return 0;
+bad:
+        return -ERANGE;
+}
+
+static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed)
+{
+        int want = ac->want_keys;
+        struct ceph_x_info *xi = ac->private;
+        int service;
+
+        *pneed = ac->want_keys & ~(xi->have_keys);
+
+        for (service = 1; service <= want; service <<= 1) {
+                struct ceph_x_ticket_handler *th;
+
+                if (!(ac->want_keys & service))
+                        continue;
+
+                if (*pneed & service)
+                        continue;
+
+                th = get_ticket_handler(ac, service);
+
+                if (IS_ERR(th)) {
+                        *pneed |= service;
+                        continue;
+                }
+
+                if (get_seconds() >= th->renew_after)
+                        *pneed |= service;
+                if (get_seconds() >= th->expires)
+                        xi->have_keys &= ~service;
+        }
+}
+
+
+static int ceph_x_build_request(struct ceph_auth_client *ac,
+                                void *buf, void *end)
+{
+        struct ceph_x_info *xi = ac->private;
+        int need;
+        struct ceph_x_request_header *head = buf;
+        int ret;
+        struct ceph_x_ticket_handler *th =
+                get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH);
+
+        if (IS_ERR(th))
+                return PTR_ERR(th);
+
+        ceph_x_validate_tickets(ac, &need);
+
+        dout("build_request want %x have %x need %x\n",
+             ac->want_keys, xi->have_keys, need);
+
+        if (need & CEPH_ENTITY_TYPE_AUTH) {
+                struct ceph_x_authenticate *auth = (void *)(head + 1);
+                void *p = auth + 1;
+                struct ceph_x_challenge_blob tmp;
+                char tmp_enc[40];
+                u64 *u;
+
+                if (p > end)
+                        return -ERANGE;
+
+                dout(" get_auth_session_key\n");
+                head->op = cpu_to_le16(CEPHX_GET_AUTH_SESSION_KEY);
+
+                /* encrypt and hash */
+                get_random_bytes(&auth->client_challenge, sizeof(u64));
+                tmp.client_challenge = auth->client_challenge;
+                tmp.server_challenge = cpu_to_le64(xi->server_challenge);
+                ret = ceph_x_encrypt(&xi->secret, &tmp, sizeof(tmp),
+                                     tmp_enc, sizeof(tmp_enc));
+                if (ret < 0)
+                        return ret;
+
+                auth->struct_v = 1;
+                auth->key = 0;
+                for (u = (u64 *)tmp_enc; u + 1 <= (u64 *)(tmp_enc + ret); u++)
+                        auth->key ^= *(__le64 *)u;
+                dout(" server_challenge %llx client_challenge %llx key %llx\n",
+                     xi->server_challenge, le64_to_cpu(auth->client_challenge),
+                     le64_to_cpu(auth->key));
+
+                /* now encode the old ticket if exists */
+                ret = ceph_x_encode_ticket(th, &p, end);
+                if (ret < 0)
+                        return ret;
+
+                return p - buf;
+        }
+
+        if (need) {
+                void *p = head + 1;
+                struct ceph_x_service_ticket_request *req;
+
+                if (p > end)
+                        return -ERANGE;
+                head->op = cpu_to_le16(CEPHX_GET_PRINCIPAL_SESSION_KEY);
+
+                ret = ceph_x_build_authorizer(ac, th, &xi->auth_authorizer);
+                if (ret)
+                        return ret;
+                ceph_encode_copy(&p, xi->auth_authorizer.buf->vec.iov_base,
+                                 xi->auth_authorizer.buf->vec.iov_len);
+
+                req = p;
+                req->keys = cpu_to_le32(need);
+                p += sizeof(*req);
+                return p - buf;
+        }
+
+        return 0;
+}
+
+static int ceph_x_handle_reply(struct ceph_auth_client *ac, int result,
+                               void *buf, void *end)
+{
+        struct ceph_x_info *xi = ac->private;
+        struct ceph_x_reply_header *head = buf;
+        struct ceph_x_ticket_handler *th;
+        int len = end - buf;
+        int op;
+        int ret;
+
+        if (result)
+                return result;  /* XXX hmm? */
+
+        if (xi->starting) {
+                /* it's a hello */
+                struct ceph_x_server_challenge *sc = buf;
+
+                if (len != sizeof(*sc))
+                        return -EINVAL;
+                xi->server_challenge = le64_to_cpu(sc->server_challenge);
+                dout("handle_reply got server challenge %llx\n",
+                     xi->server_challenge);
+                xi->starting = false;
+                xi->have_keys &= ~CEPH_ENTITY_TYPE_AUTH;
+                return -EAGAIN;
+        }
+
+        op = le16_to_cpu(head->op);
+        result = le32_to_cpu(head->result);
+        dout("handle_reply op %d result %d\n", op, result);
+        switch (op) {
+        case CEPHX_GET_AUTH_SESSION_KEY:
+                /* verify auth key */
+                ret = ceph_x_proc_ticket_reply(ac, &xi->secret,
+                                               buf + sizeof(*head), end);
+                break;
+
+        case CEPHX_GET_PRINCIPAL_SESSION_KEY:
+                th = get_ticket_handler(ac, CEPH_ENTITY_TYPE_AUTH);
+                if (IS_ERR(th))
+                        return PTR_ERR(th);
+                ret = ceph_x_proc_ticket_reply(ac, &th->session_key,
+                                               buf + sizeof(*head), end);
+                break;
+
+        default:
+                return -EINVAL;
+        }
+        if (ret)
+                return ret;
+        if (ac->want_keys == xi->have_keys)
+                return 0;
+        return -EAGAIN;
+}
+
+static int ceph_x_create_authorizer(
+        struct ceph_auth_client *ac, int peer_type,
+        struct ceph_authorizer **a,
+        void **buf, size_t *len,
+        void **reply_buf, size_t *reply_len)
+{
+        struct ceph_x_authorizer *au;
+        struct ceph_x_ticket_handler *th;
+        int ret;
+
+        th = get_ticket_handler(ac, peer_type);
+        if (IS_ERR(th))
+                return PTR_ERR(th);
+
+        au = kzalloc(sizeof(*au), GFP_NOFS);
+        if (!au)
+                return -ENOMEM;
+
+        ret = ceph_x_build_authorizer(ac, th, au);
+        if (ret) {
+                kfree(au);
+                return ret;
+        }
+
+        *a = (struct ceph_authorizer *)au;
+        *buf = au->buf->vec.iov_base;
+        *len = au->buf->vec.iov_len;
+        *reply_buf = au->reply_buf;
+        *reply_len = sizeof(au->reply_buf);
+        return 0;
+}
+
+static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
+                                          struct ceph_authorizer *a, size_t len)
+{
+        struct ceph_x_authorizer *au = (void *)a;
+        struct ceph_x_ticket_handler *th;
+        int ret = 0;
+        struct ceph_x_authorize_reply reply;
+        void *p = au->reply_buf;
+        void *end = p + sizeof(au->reply_buf);
+
+        th = get_ticket_handler(ac, au->service);
+        if (IS_ERR(th))
+                return PTR_ERR(th);
+        ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply));
+        if (ret < 0)
+                return ret;
+        if (ret != sizeof(reply))
+                return -EPERM;
+
+        if (au->nonce + 1 != le64_to_cpu(reply.nonce_plus_one))
+                ret = -EPERM;
+        else
+                ret = 0;
+        dout("verify_authorizer_reply nonce %llx got %llx ret %d\n",
+             au->nonce, le64_to_cpu(reply.nonce_plus_one), ret);
+        return ret;
+}
+
+static void ceph_x_destroy_authorizer(struct ceph_auth_client *ac,
+                                      struct ceph_authorizer *a)
+{
+        struct ceph_x_authorizer *au = (void *)a;
+
+        ceph_buffer_put(au->buf);
+        kfree(au);
+}
+
+
+static void ceph_x_reset(struct ceph_auth_client *ac)
+{
+        struct ceph_x_info *xi = ac->private;
+
+        dout("reset\n");
+        xi->starting = true;
+        xi->server_challenge = 0;
+}
+
+static void ceph_x_destroy(struct ceph_auth_client *ac)
+{
+        struct ceph_x_info *xi = ac->private;
+        struct rb_node *p;
+
+        dout("ceph_x_destroy %p\n", ac);
+        ceph_crypto_key_destroy(&xi->secret);
+
+        while ((p = rb_first(&xi->ticket_handlers)) != NULL) {
+                struct ceph_x_ticket_handler *th =
+                        rb_entry(p, struct ceph_x_ticket_handler, node);
+                remove_ticket_handler(ac, th);
+        }
+
+        if (xi->auth_authorizer.buf)
+                ceph_buffer_put(xi->auth_authorizer.buf);
+
+        kfree(ac->private);
+        ac->private = NULL;
+}
+
+static void ceph_x_invalidate_authorizer(struct ceph_auth_client *ac,
+                                   int peer_type)
+{
+        struct ceph_x_ticket_handler *th;
+
+        th = get_ticket_handler(ac, peer_type);
+        if (!IS_ERR(th))
+                remove_ticket_handler(ac, th);
+}
+
+
+static const struct ceph_auth_client_ops ceph_x_ops = {
+        .name = "x",
+        .is_authenticated = ceph_x_is_authenticated,
+        .should_authenticate = ceph_x_should_authenticate,
+        .build_request = ceph_x_build_request,
+        .handle_reply = ceph_x_handle_reply,
+        .create_authorizer = ceph_x_create_authorizer,
+        .verify_authorizer_reply = ceph_x_verify_authorizer_reply,
+        .destroy_authorizer = ceph_x_destroy_authorizer,
+        .invalidate_authorizer = ceph_x_invalidate_authorizer,
+        .reset =  ceph_x_reset,
+        .destroy = ceph_x_destroy,
+};
+
+
+int ceph_x_init(struct ceph_auth_client *ac)
+{
+        struct ceph_x_info *xi;
+        int ret;
+
+        dout("ceph_x_init %p\n", ac);
+        ret = -ENOMEM;
+        xi = kzalloc(sizeof(*xi), GFP_NOFS);
+        if (!xi)
+                goto out;
+
+        ret = -EINVAL;
+        if (!ac->secret) {
+                pr_err("no secret set (for auth_x protocol)\n");
+                goto out_nomem;
+        }
+
+        ret = ceph_crypto_key_unarmor(&xi->secret, ac->secret);
+        if (ret)
+                goto out_nomem;
+
+        xi->starting = true;
+        xi->ticket_handlers = RB_ROOT;
+
+        ac->protocol = CEPH_AUTH_CEPHX;
+        ac->private = xi;
+        ac->ops = &ceph_x_ops;
+        return 0;
+
+out_nomem:
+        kfree(xi);
+out:
+        return ret;
+}
+
+
diff --git a/net/ceph/auth_x.h b/net/ceph/auth_x.h
new file mode 100644
index 000000000000..e02da7a5c5a1
--- /dev/null
+++ b/net/ceph/auth_x.h
@@ -0,0 +1,50 @@
+#ifndef _FS_CEPH_AUTH_X_H
+#define _FS_CEPH_AUTH_X_H
+
+#include <linux/rbtree.h>
+
+#include <linux/ceph/auth.h>
+
+#include "crypto.h"
+#include "auth_x_protocol.h"
+
+/*
+ * Handle ticket for a single service.
+ */
+struct ceph_x_ticket_handler {
+        struct rb_node node;
+        unsigned service;
+
+        struct ceph_crypto_key session_key;
+        struct ceph_timespec validity;
+
+        u64 secret_id;
+        struct ceph_buffer *ticket_blob;
+
+        unsigned long renew_after, expires;
+};
+
+
+struct ceph_x_authorizer {
+        struct ceph_buffer *buf;
+        unsigned service;
+        u64 nonce;
+        char reply_buf[128];  /* big enough for encrypted blob */
+};
+
+struct ceph_x_info {
+        struct ceph_crypto_key secret;
+
+        bool starting;
+        u64 server_challenge;
+
+        unsigned have_keys;
+        struct rb_root ticket_handlers;
+
+        struct ceph_x_authorizer auth_authorizer;
+};
+
+extern int ceph_x_init(struct ceph_auth_client *ac);
+
+#endif
+
diff --git a/net/ceph/auth_x_protocol.h b/net/ceph/auth_x_protocol.h
new file mode 100644
index 000000000000..671d30576c4f
--- /dev/null
+++ b/net/ceph/auth_x_protocol.h
@@ -0,0 +1,90 @@
+#ifndef __FS_CEPH_AUTH_X_PROTOCOL
+#define __FS_CEPH_AUTH_X_PROTOCOL
+
+#define CEPHX_GET_AUTH_SESSION_KEY      0x0100
+#define CEPHX_GET_PRINCIPAL_SESSION_KEY 0x0200
+#define CEPHX_GET_ROTATING_KEY          0x0400
+
+/* common bits */
+struct ceph_x_ticket_blob {
+        __u8 struct_v;
+        __le64 secret_id;
+        __le32 blob_len;
+        char blob[];
+} __attribute__ ((packed));
+
+
+/* common request/reply headers */
+struct ceph_x_request_header {
+        __le16 op;
+} __attribute__ ((packed));
+
+struct ceph_x_reply_header {
+        __le16 op;
+        __le32 result;
+} __attribute__ ((packed));
+
+
+/* authenticate handshake */
+
+/* initial hello (no reply header) */
+struct ceph_x_server_challenge {
+        __u8 struct_v;
+        __le64 server_challenge;
+} __attribute__ ((packed));
+
+struct ceph_x_authenticate {
+        __u8 struct_v;
+        __le64 client_challenge;
+        __le64 key;
+        /* ticket blob */
+} __attribute__ ((packed));
+
+struct ceph_x_service_ticket_request {
+        __u8 struct_v;
+        __le32 keys;
+} __attribute__ ((packed));
+
+struct ceph_x_challenge_blob {
+        __le64 server_challenge;
+        __le64 client_challenge;
+} __attribute__ ((packed));
+
+
+
+/* authorize handshake */
+
+/*
+ * The authorizer consists of two pieces:
+ *  a - service id, ticket blob
+ *  b - encrypted with session key
+ */
+struct ceph_x_authorize_a {
+        __u8 struct_v;
+        __le64 global_id;
+        __le32 service_id;
+        struct ceph_x_ticket_blob ticket_blob;
+} __attribute__ ((packed));
+
+struct ceph_x_authorize_b {
+        __u8 struct_v;
+        __le64 nonce;
+} __attribute__ ((packed));
+
+struct ceph_x_authorize_reply {
+        __u8 struct_v;
+        __le64 nonce_plus_one;
+} __attribute__ ((packed));
+
+
+/*
+ * encyption bundle
+ */
+#define CEPHX_ENC_MAGIC 0xff009cad8826aa55ull
+
+struct ceph_x_encrypt_header {
+        __u8 struct_v;
+        __le64 magic;
+} __attribute__ ((packed));
+
+#endif
diff --git a/net/ceph/buffer.c b/net/ceph/buffer.c
new file mode 100644
index 000000000000..53d8abfa25d5
--- /dev/null
+++ b/net/ceph/buffer.c
@@ -0,0 +1,68 @@
+
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/module.h>
+#include <linux/slab.h>
+
+#include <linux/ceph/buffer.h>
+#include <linux/ceph/decode.h>
+
+struct ceph_buffer *ceph_buffer_new(size_t len, gfp_t gfp)
+{
+        struct ceph_buffer *b;
+
+        b = kmalloc(sizeof(*b), gfp);
+        if (!b)
+                return NULL;
+
+        b->vec.iov_base = kmalloc(len, gfp | __GFP_NOWARN);
+        if (b->vec.iov_base) {
+                b->is_vmalloc = false;
+        } else {
+                b->vec.iov_base = __vmalloc(len, gfp, PAGE_KERNEL);
+                if (!b->vec.iov_base) {
+                        kfree(b);
+                        return NULL;
+                }
+                b->is_vmalloc = true;
+        }
+
+        kref_init(&b->kref);
+        b->alloc_len = len;
+        b->vec.iov_len = len;
+        dout("buffer_new %p\n", b);
+        return b;
+}
+EXPORT_SYMBOL(ceph_buffer_new);
+
+void ceph_buffer_release(struct kref *kref)
+{
+        struct ceph_buffer *b = container_of(kref, struct ceph_buffer, kref);
+
+        dout("buffer_release %p\n", b);
+        if (b->vec.iov_base) {
+                if (b->is_vmalloc)
+                        vfree(b->vec.iov_base);
+                else
+                        kfree(b->vec.iov_base);
+        }
+        kfree(b);
+}
+EXPORT_SYMBOL(ceph_buffer_release);
+
+int ceph_decode_buffer(struct ceph_buffer **b, void **p, void *end)
+{
+        size_t len;
+
+        ceph_decode_need(p, end, sizeof(u32), bad);
+        len = ceph_decode_32(p);
+        dout("decode_buffer len %d\n", (int)len);
+        ceph_decode_need(p, end, len, bad);
+        *b = ceph_buffer_new(len, GFP_NOFS);
+        if (!*b)
+                return -ENOMEM;
+        ceph_decode_copy(p, (*b)->vec.iov_base, len);
+        return 0;
+bad:
+        return -EINVAL;
+}
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
new file mode 100644
index 000000000000..f3e4a13fea0c
--- /dev/null
+++ b/net/ceph/ceph_common.c
@@ -0,0 +1,529 @@
+
+#include <linux/ceph/ceph_debug.h>
+#include <linux/backing-dev.h>
+#include <linux/ctype.h>
+#include <linux/fs.h>
+#include <linux/inet.h>
+#include <linux/in6.h>
+#include <linux/module.h>
+#include <linux/mount.h>
+#include <linux/parser.h>
+#include <linux/sched.h>
+#include <linux/seq_file.h>
+#include <linux/slab.h>
+#include <linux/statfs.h>
+#include <linux/string.h>
+
+
+#include <linux/ceph/libceph.h>
+#include <linux/ceph/debugfs.h>
+#include <linux/ceph/decode.h>
+#include <linux/ceph/mon_client.h>
+#include <linux/ceph/auth.h>
+
+
+
+/*
+ * find filename portion of a path (/foo/bar/baz -> baz)
+ */
+const char *ceph_file_part(const char *s, int len)
+{
+        const char *e = s + len;
+
+        while (e != s && *(e-1) != '/')
+                e--;
+        return e;
+}
+EXPORT_SYMBOL(ceph_file_part);
+
+const char *ceph_msg_type_name(int type)
+{
+        switch (type) {
+        case CEPH_MSG_SHUTDOWN: return "shutdown";
+        case CEPH_MSG_PING: return "ping";
+        case CEPH_MSG_AUTH: return "auth";
+        case CEPH_MSG_AUTH_REPLY: return "auth_reply";
+        case CEPH_MSG_MON_MAP: return "mon_map";
+        case CEPH_MSG_MON_GET_MAP: return "mon_get_map";
+        case CEPH_MSG_MON_SUBSCRIBE: return "mon_subscribe";
+        case CEPH_MSG_MON_SUBSCRIBE_ACK: return "mon_subscribe_ack";
+        case CEPH_MSG_STATFS: return "statfs";
+        case CEPH_MSG_STATFS_REPLY: return "statfs_reply";
+        case CEPH_MSG_MDS_MAP: return "mds_map";
+        case CEPH_MSG_CLIENT_SESSION: return "client_session";
+        case CEPH_MSG_CLIENT_RECONNECT: return "client_reconnect";
+        case CEPH_MSG_CLIENT_REQUEST: return "client_request";
+        case CEPH_MSG_CLIENT_REQUEST_FORWARD: return "client_request_forward";
+        case CEPH_MSG_CLIENT_REPLY: return "client_reply";
+        case CEPH_MSG_CLIENT_CAPS: return "client_caps";
+        case CEPH_MSG_CLIENT_CAPRELEASE: return "client_cap_release";
+        case CEPH_MSG_CLIENT_SNAP: return "client_snap";
+        case CEPH_MSG_CLIENT_LEASE: return "client_lease";
+        case CEPH_MSG_OSD_MAP: return "osd_map";
+        case CEPH_MSG_OSD_OP: return "osd_op";
+        case CEPH_MSG_OSD_OPREPLY: return "osd_opreply";
+        default: return "unknown";
+        }
+}
+EXPORT_SYMBOL(ceph_msg_type_name);
+
+/*
+ * Initially learn our fsid, or verify an fsid matches.
+ */
+int ceph_check_fsid(struct ceph_client *client, struct ceph_fsid *fsid)
+{
+        if (client->have_fsid) {
+                if (ceph_fsid_compare(&client->fsid, fsid)) {
+                        pr_err("bad fsid, had %pU got %pU",
+                               &client->fsid, fsid);
+                        return -1;
+                }
+        } else {
+                pr_info("client%lld fsid %pU\n", ceph_client_id(client), fsid);
+                memcpy(&client->fsid, fsid, sizeof(*fsid));
+                ceph_debugfs_client_init(client);
+                client->have_fsid = true;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(ceph_check_fsid);
+
+static int strcmp_null(const char *s1, const char *s2)
+{
+        if (!s1 && !s2)
+                return 0;
+        if (s1 && !s2)
+                return -1;
+        if (!s1 && s2)
+                return 1;
+        return strcmp(s1, s2);
+}
+
+int ceph_compare_options(struct ceph_options *new_opt,
+                         struct ceph_client *client)
+{
+        struct ceph_options *opt1 = new_opt;
+        struct ceph_options *opt2 = client->options;
+        int ofs = offsetof(struct ceph_options, mon_addr);
+        int i;
+        int ret;
+
+        ret = memcmp(opt1, opt2, ofs);
+        if (ret)
+                return ret;
+
+        ret = strcmp_null(opt1->name, opt2->name);
+        if (ret)
+                return ret;
+
+        ret = strcmp_null(opt1->secret, opt2->secret);
+        if (ret)
+                return ret;
+
+        /* any matching mon ip implies a match */
+        for (i = 0; i < opt1->num_mon; i++) {
+                if (ceph_monmap_contains(client->monc.monmap,
+                                 &opt1->mon_addr[i]))
+                        return 0;
+        }
+        return -1;
+}
+EXPORT_SYMBOL(ceph_compare_options);
+
+
+static int parse_fsid(const char *str, struct ceph_fsid *fsid)
+{
+        int i = 0;
+        char tmp[3];
+        int err = -EINVAL;
+        int d;
+
+        dout("parse_fsid '%s'\n", str);
+        tmp[2] = 0;
+        while (*str && i < 16) {
+                if (ispunct(*str)) {
+                        str++;
+                        continue;
+                }
+                if (!isxdigit(str[0]) || !isxdigit(str[1]))
+                        break;
+                tmp[0] = str[0];
+                tmp[1] = str[1];
+                if (sscanf(tmp, "%x", &d) < 1)
+                        break;
+                fsid->fsid[i] = d & 0xff;
+                i++;
+                str += 2;
+        }
+
+        if (i == 16)
+                err = 0;
+        dout("parse_fsid ret %d got fsid %pU", err, fsid);
+        return err;
+}
+
+/*
+ * ceph options
+ */
+enum {
+        Opt_osdtimeout,
+        Opt_osdkeepalivetimeout,
+        Opt_mount_timeout,
+        Opt_osd_idle_ttl,
+        Opt_last_int,
+        /* int args above */
+        Opt_fsid,
+        Opt_name,
+        Opt_secret,
+        Opt_ip,
+        Opt_last_string,
+        /* string args above */
+        Opt_noshare,
+        Opt_nocrc,
+};
+
+static match_table_t opt_tokens = {
+        {Opt_osdtimeout, "osdtimeout=%d"},
+        {Opt_osdkeepalivetimeout, "osdkeepalive=%d"},
+        {Opt_mount_timeout, "mount_timeout=%d"},
+        {Opt_osd_idle_ttl, "osd_idle_ttl=%d"},
+        /* int args above */
+        {Opt_fsid, "fsid=%s"},
+        {Opt_name, "name=%s"},
+        {Opt_secret, "secret=%s"},
+        {Opt_ip, "ip=%s"},
+        /* string args above */
+        {Opt_noshare, "noshare"},
+        {Opt_nocrc, "nocrc"},
+        {-1, NULL}
+};
+
+void ceph_destroy_options(struct ceph_options *opt)
+{
+        dout("destroy_options %p\n", opt);
+        kfree(opt->name);
+        kfree(opt->secret);
+        kfree(opt);
+}
+EXPORT_SYMBOL(ceph_destroy_options);
+
+int ceph_parse_options(struct ceph_options **popt, char *options,
+                       const char *dev_name, const char *dev_name_end,
+                       int (*parse_extra_token)(char *c, void *private),
+                       void *private)
+{
+        struct ceph_options *opt;
+        const char *c;
+        int err = -ENOMEM;
+        substring_t argstr[MAX_OPT_ARGS];
+
+        opt = kzalloc(sizeof(*opt), GFP_KERNEL);
+        if (!opt)
+                return err;
+        opt->mon_addr = kcalloc(CEPH_MAX_MON, sizeof(*opt->mon_addr),
+                                GFP_KERNEL);
+        if (!opt->mon_addr)
+                goto out;
+
+        dout("parse_options %p options '%s' dev_name '%s'\n", opt, options,
+             dev_name);
+
+        /* start with defaults */
+        opt->flags = CEPH_OPT_DEFAULT;
+        opt->osd_timeout = CEPH_OSD_TIMEOUT_DEFAULT;
+        opt->osd_keepalive_timeout = CEPH_OSD_KEEPALIVE_DEFAULT;
+        opt->mount_timeout = CEPH_MOUNT_TIMEOUT_DEFAULT; /* seconds */
+        opt->osd_idle_ttl = CEPH_OSD_IDLE_TTL_DEFAULT;   /* seconds */
+
+        /* get mon ip(s) */
+        /* ip1[:port1][,ip2[:port2]...] */
+        err = ceph_parse_ips(dev_name, dev_name_end, opt->mon_addr,
+                             CEPH_MAX_MON, &opt->num_mon);
+        if (err < 0)
+                goto out;
+
+        /* parse mount options */
+        while ((c = strsep(&options, ",")) != NULL) {
+                int token, intval, ret;
+                if (!*c)
+                        continue;
+                err = -EINVAL;
+                token = match_token((char *)c, opt_tokens, argstr);
+                if (token < 0 && parse_extra_token) {
+                        /* extra? */
+                        err = parse_extra_token((char *)c, private);
+                        if (err < 0) {
+                                pr_err("bad option at '%s'\n", c);
+                                goto out;
+                        }
+                        continue;
+                }
+                if (token < Opt_last_int) {
+                        ret = match_int(&argstr[0], &intval);
+                        if (ret < 0) {
+                                pr_err("bad mount option arg (not int) "
+                                       "at '%s'\n", c);
+                                continue;
+                        }
+                        dout("got int token %d val %d\n", token, intval);
+                } else if (token > Opt_last_int && token < Opt_last_string) {
+                        dout("got string token %d val %s\n", token,
+                             argstr[0].from);
+                } else {
+                        dout("got token %d\n", token);
+                }
+                switch (token) {
+                case Opt_ip:
+                        err = ceph_parse_ips(argstr[0].from,
+                                             argstr[0].to,
+                                             &opt->my_addr,
+                                             1, NULL);
+                        if (err < 0)
+                                goto out;
+                        opt->flags |= CEPH_OPT_MYIP;
+                        break;
+
+                case Opt_fsid:
+                        err = parse_fsid(argstr[0].from, &opt->fsid);
+                        if (err == 0)
+                                opt->flags |= CEPH_OPT_FSID;
+                        break;
+                case Opt_name:
+                        opt->name = kstrndup(argstr[0].from,
+                                              argstr[0].to-argstr[0].from,
+                                              GFP_KERNEL);
+                        break;
+                case Opt_secret:
+                        opt->secret = kstrndup(argstr[0].from,
+                                                argstr[0].to-argstr[0].from,
+                                                GFP_KERNEL);
+                        break;
+
+                        /* misc */
+                case Opt_osdtimeout:
+                        opt->osd_timeout = intval;
+                        break;
+                case Opt_osdkeepalivetimeout:
+                        opt->osd_keepalive_timeout = intval;
+                        break;
+                case Opt_osd_idle_ttl:
+                        opt->osd_idle_ttl = intval;
+                        break;
+                case Opt_mount_timeout:
+                        opt->mount_timeout = intval;
+                        break;
+
+                case Opt_noshare:
+                        opt->flags |= CEPH_OPT_NOSHARE;
+                        break;
+
+                case Opt_nocrc:
+                        opt->flags |= CEPH_OPT_NOCRC;
+                        break;
+
+                default:
+                        BUG_ON(token);
+                }
+        }
+
+        /* success */
+        *popt = opt;
+        return 0;
+
+out:
+        ceph_destroy_options(opt);
+        return err;
+}
+EXPORT_SYMBOL(ceph_parse_options);
+
+u64 ceph_client_id(struct ceph_client *client)
+{
+        return client->monc.auth->global_id;
+}
+EXPORT_SYMBOL(ceph_client_id);
+
+/*
+ * create a fresh client instance
+ */
+struct ceph_client *ceph_create_client(struct ceph_options *opt, void *private)
+{
+        struct ceph_client *client;
+        int err = -ENOMEM;
+
+        client = kzalloc(sizeof(*client), GFP_KERNEL);
+        if (client == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        client->private = private;
+        client->options = opt;
+
+        mutex_init(&client->mount_mutex);
+        init_waitqueue_head(&client->auth_wq);
+        client->auth_err = 0;
+
+        client->extra_mon_dispatch = NULL;
+        client->supported_features = CEPH_FEATURE_SUPPORTED_DEFAULT;
+        client->required_features = CEPH_FEATURE_REQUIRED_DEFAULT;
+
+        client->msgr = NULL;
+
+        /* subsystems */
+        err = ceph_monc_init(&client->monc, client);
+        if (err < 0)
+                goto fail;
+        err = ceph_osdc_init(&client->osdc, client);
+        if (err < 0)
+                goto fail_monc;
+
+        return client;
+
+fail_monc:
+        ceph_monc_stop(&client->monc);
+fail:
+        kfree(client);
+        return ERR_PTR(err);
+}
+EXPORT_SYMBOL(ceph_create_client);
+
+void ceph_destroy_client(struct ceph_client *client)
+{
+        dout("destroy_client %p\n", client);
+
+        /* unmount */
+        ceph_osdc_stop(&client->osdc);
+
+        /*
+         * make sure mds and osd connections close out before destroying
+         * the auth module, which is needed to free those connections'
+         * ceph_authorizers.
+         */
+        ceph_msgr_flush();
+
+        ceph_monc_stop(&client->monc);
+
+        ceph_debugfs_client_cleanup(client);
+
+        if (client->msgr)
+                ceph_messenger_destroy(client->msgr);
+
+        ceph_destroy_options(client->options);
+
+        kfree(client);
+        dout("destroy_client %p done\n", client);
+}
+EXPORT_SYMBOL(ceph_destroy_client);
+
+/*
+ * true if we have the mon map (and have thus joined the cluster)
+ */
+static int have_mon_and_osd_map(struct ceph_client *client)
+{
+        return client->monc.monmap && client->monc.monmap->epoch &&
+               client->osdc.osdmap && client->osdc.osdmap->epoch;
+}
+
+/*
+ * mount: join the ceph cluster, and open root directory.
+ */
+int __ceph_open_session(struct ceph_client *client, unsigned long started)
+{
+        struct ceph_entity_addr *myaddr = NULL;
+        int err;
+        unsigned long timeout = client->options->mount_timeout * HZ;
+
+        /* initialize the messenger */
+        if (client->msgr == NULL) {
+                if (ceph_test_opt(client, MYIP))
+                        myaddr = &client->options->my_addr;
+                client->msgr = ceph_messenger_create(myaddr,
+                                        client->supported_features,
+                                        client->required_features);
+                if (IS_ERR(client->msgr)) {
+                        client->msgr = NULL;
+                        return PTR_ERR(client->msgr);
+                }
+                client->msgr->nocrc = ceph_test_opt(client, NOCRC);
+        }
+
+        /* open session, and wait for mon and osd maps */
+        err = ceph_monc_open_session(&client->monc);
+        if (err < 0)
+                return err;
+
+        while (!have_mon_and_osd_map(client)) {
+                err = -EIO;
+                if (timeout && time_after_eq(jiffies, started + timeout))
+                        return err;
+
+                /* wait */
+                dout("mount waiting for mon_map\n");
+                err = wait_event_interruptible_timeout(client->auth_wq,
+                        have_mon_and_osd_map(client) || (client->auth_err < 0),
+                        timeout);
+                if (err == -EINTR || err == -ERESTARTSYS)
+                        return err;
+                if (client->auth_err < 0)
+                        return client->auth_err;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(__ceph_open_session);
+
+
+int ceph_open_session(struct ceph_client *client)
+{
+        int ret;
+        unsigned long started = jiffies;  /* note the start time */
+
+        dout("open_session start\n");
+        mutex_lock(&client->mount_mutex);
+
+        ret = __ceph_open_session(client, started);
+
+        mutex_unlock(&client->mount_mutex);
+        return ret;
+}
+EXPORT_SYMBOL(ceph_open_session);
+
+
+static int __init init_ceph_lib(void)
+{
+        int ret = 0;
+
+        ret = ceph_debugfs_init();
+        if (ret < 0)
+                goto out;
+
+        ret = ceph_msgr_init();
+        if (ret < 0)
+                goto out_debugfs;
+
+        pr_info("loaded (mon/osd proto %d/%d, osdmap %d/%d %d/%d)\n",
+                CEPH_MONC_PROTOCOL, CEPH_OSDC_PROTOCOL,
+                CEPH_OSDMAP_VERSION, CEPH_OSDMAP_VERSION_EXT,
+                CEPH_OSDMAP_INC_VERSION, CEPH_OSDMAP_INC_VERSION_EXT);
+
+        return 0;
+
+out_debugfs:
+        ceph_debugfs_cleanup();
+out:
+        return ret;
+}
+
+static void __exit exit_ceph_lib(void)
+{
+        dout("exit_ceph_lib\n");
+        ceph_msgr_exit();
+        ceph_debugfs_cleanup();
+}
+
+module_init(init_ceph_lib);
+module_exit(exit_ceph_lib);
+
+MODULE_AUTHOR("Sage Weil <sage@newdream.net>");
+MODULE_AUTHOR("Yehuda Sadeh <yehuda@hq.newdream.net>");
+MODULE_AUTHOR("Patience Warnick <patience@newdream.net>");
+MODULE_DESCRIPTION("Ceph filesystem for Linux");
+MODULE_LICENSE("GPL");
diff --git a/net/ceph/ceph_fs.c b/net/ceph/ceph_fs.c
new file mode 100644
index 000000000000..a3a3a31d3c37
--- /dev/null
+++ b/net/ceph/ceph_fs.c
@@ -0,0 +1,75 @@
+/*
+ * Some non-inline ceph helpers
+ */
+#include <linux/module.h>
+#include <linux/ceph/types.h>
+
+/*
+ * return true if @layout appears to be valid
+ */
+int ceph_file_layout_is_valid(const struct ceph_file_layout *layout)
+{
+        __u32 su = le32_to_cpu(layout->fl_stripe_unit);
+        __u32 sc = le32_to_cpu(layout->fl_stripe_count);
+        __u32 os = le32_to_cpu(layout->fl_object_size);
+
+        /* stripe unit, object size must be non-zero, 64k increment */
+        if (!su || (su & (CEPH_MIN_STRIPE_UNIT-1)))
+                return 0;
+        if (!os || (os & (CEPH_MIN_STRIPE_UNIT-1)))
+                return 0;
+        /* object size must be a multiple of stripe unit */
+        if (os < su || os % su)
+                return 0;
+        /* stripe count must be non-zero */
+        if (!sc)
+                return 0;
+        return 1;
+}
+
+
+int ceph_flags_to_mode(int flags)
+{
+        int mode;
+
+#ifdef O_DIRECTORY  /* fixme */
+        if ((flags & O_DIRECTORY) == O_DIRECTORY)
+                return CEPH_FILE_MODE_PIN;
+#endif
+        if ((flags & O_APPEND) == O_APPEND)
+                flags |= O_WRONLY;
+
+        if ((flags & O_ACCMODE) == O_RDWR)
+                mode = CEPH_FILE_MODE_RDWR;
+        else if ((flags & O_ACCMODE) == O_WRONLY)
+                mode = CEPH_FILE_MODE_WR;
+        else
+                mode = CEPH_FILE_MODE_RD;
+
+#ifdef O_LAZY
+        if (flags & O_LAZY)
+                mode |= CEPH_FILE_MODE_LAZY;
+#endif
+
+        return mode;
+}
+EXPORT_SYMBOL(ceph_flags_to_mode);
+
+int ceph_caps_for_mode(int mode)
+{
+        int caps = CEPH_CAP_PIN;
+
+        if (mode & CEPH_FILE_MODE_RD)
+                caps |= CEPH_CAP_FILE_SHARED |
+                        CEPH_CAP_FILE_RD | CEPH_CAP_FILE_CACHE;
+        if (mode & CEPH_FILE_MODE_WR)
+                caps |= CEPH_CAP_FILE_EXCL |
+                        CEPH_CAP_FILE_WR | CEPH_CAP_FILE_BUFFER |
+                        CEPH_CAP_AUTH_SHARED | CEPH_CAP_AUTH_EXCL |
+                        CEPH_CAP_XATTR_SHARED | CEPH_CAP_XATTR_EXCL;
+        if (mode & CEPH_FILE_MODE_LAZY)
+                caps |= CEPH_CAP_FILE_LAZYIO;
+
+        return caps;
+}
+EXPORT_SYMBOL(ceph_caps_for_mode);
diff --git a/net/ceph/ceph_hash.c b/net/ceph/ceph_hash.c
new file mode 100644
index 000000000000..815ef8826796
--- /dev/null
+++ b/net/ceph/ceph_hash.c
@@ -0,0 +1,118 @@
+
+#include <linux/ceph/types.h>
+
+/*
+ * Robert Jenkin's hash function.
+ * http://burtleburtle.net/bob/hash/evahash.html
+ * This is in the public domain.
+ */
+#define mix(a, b, c)                                            \
+        do {                                                    \
+                a = a - b;  a = a - c;  a = a ^ (c >> 13);      \
+                b = b - c;  b = b - a;  b = b ^ (a << 8);       \
+                c = c - a;  c = c - b;  c = c ^ (b >> 13);      \
+                a = a - b;  a = a - c;  a = a ^ (c >> 12);      \
+                b = b - c;  b = b - a;  b = b ^ (a << 16);      \
+                c = c - a;  c = c - b;  c = c ^ (b >> 5);       \
+                a = a - b;  a = a - c;  a = a ^ (c >> 3);       \
+                b = b - c;  b = b - a;  b = b ^ (a << 10);      \
+                c = c - a;  c = c - b;  c = c ^ (b >> 15);      \
+        } while (0)
+
+unsigned ceph_str_hash_rjenkins(const char *str, unsigned length)
+{
+        const unsigned char *k = (const unsigned char *)str;
+        __u32 a, b, c;  /* the internal state */
+        __u32 len;      /* how many key bytes still need mixing */
+
+        /* Set up the internal state */
+        len = length;
+        a = 0x9e3779b9;      /* the golden ratio; an arbitrary value */
+        b = a;
+        c = 0;               /* variable initialization of internal state */
+
+        /* handle most of the key */
+        while (len >= 12) {
+                a = a + (k[0] + ((__u32)k[1] << 8) + ((__u32)k[2] << 16) +
+                         ((__u32)k[3] << 24));
+                b = b + (k[4] + ((__u32)k[5] << 8) + ((__u32)k[6] << 16) +
+                         ((__u32)k[7] << 24));
+                c = c + (k[8] + ((__u32)k[9] << 8) + ((__u32)k[10] << 16) +
+                         ((__u32)k[11] << 24));
+                mix(a, b, c);
+                k = k + 12;
+                len = len - 12;
+        }
+
+        /* handle the last 11 bytes */
+        c = c + length;
+        switch (len) {            /* all the case statements fall through */
+        case 11:
+                c = c + ((__u32)k[10] << 24);
+        case 10:
+                c = c + ((__u32)k[9] << 16);
+        case 9:
+                c = c + ((__u32)k[8] << 8);
+                /* the first byte of c is reserved for the length */
+        case 8:
+                b = b + ((__u32)k[7] << 24);
+        case 7:
+                b = b + ((__u32)k[6] << 16);
+        case 6:
+                b = b + ((__u32)k[5] << 8);
+        case 5:
+                b = b + k[4];
+        case 4:
+                a = a + ((__u32)k[3] << 24);
+        case 3:
+                a = a + ((__u32)k[2] << 16);
+        case 2:
+                a = a + ((__u32)k[1] << 8);
+        case 1:
+                a = a + k[0];
+                /* case 0: nothing left to add */
+        }
+        mix(a, b, c);
+
+        return c;
+}
+
+/*
+ * linux dcache hash
+ */
+unsigned ceph_str_hash_linux(const char *str, unsigned length)
+{
+        unsigned long hash = 0;
+        unsigned char c;
+
+        while (length--) {
+                c = *str++;
+                hash = (hash + (c << 4) + (c >> 4)) * 11;
+        }
+        return hash;
+}
+
+
+unsigned ceph_str_hash(int type, const char *s, unsigned len)
+{
+        switch (type) {
+        case CEPH_STR_HASH_LINUX:
+                return ceph_str_hash_linux(s, len);
+        case CEPH_STR_HASH_RJENKINS:
+                return ceph_str_hash_rjenkins(s, len);
+        default:
+                return -1;
+        }
+}
+
+const char *ceph_str_hash_name(int type)
+{
+        switch (type) {
+        case CEPH_STR_HASH_LINUX:
+                return "linux";
+        case CEPH_STR_HASH_RJENKINS:
+                return "rjenkins";
+        default:
+                return "unknown";
+        }
+}
diff --git a/net/ceph/ceph_strings.c b/net/ceph/ceph_strings.c
new file mode 100644
index 000000000000..3fbda04de29c
--- /dev/null
+++ b/net/ceph/ceph_strings.c
@@ -0,0 +1,84 @@
+/*
+ * Ceph string constants
+ */
+#include <linux/module.h>
+#include <linux/ceph/types.h>
+
+const char *ceph_entity_type_name(int type)
+{
+        switch (type) {
+        case CEPH_ENTITY_TYPE_MDS: return "mds";
+        case CEPH_ENTITY_TYPE_OSD: return "osd";
+        case CEPH_ENTITY_TYPE_MON: return "mon";
+        case CEPH_ENTITY_TYPE_CLIENT: return "client";
+        case CEPH_ENTITY_TYPE_AUTH: return "auth";
+        default: return "unknown";
+        }
+}
+
+const char *ceph_osd_op_name(int op)
+{
+        switch (op) {
+        case CEPH_OSD_OP_READ: return "read";
+        case CEPH_OSD_OP_STAT: return "stat";
+
+        case CEPH_OSD_OP_MASKTRUNC: return "masktrunc";
+
+        case CEPH_OSD_OP_WRITE: return "write";
+        case CEPH_OSD_OP_DELETE: return "delete";
+        case CEPH_OSD_OP_TRUNCATE: return "truncate";
+        case CEPH_OSD_OP_ZERO: return "zero";
+        case CEPH_OSD_OP_WRITEFULL: return "writefull";
+        case CEPH_OSD_OP_ROLLBACK: return "rollback";
+
+        case CEPH_OSD_OP_APPEND: return "append";
+        case CEPH_OSD_OP_STARTSYNC: return "startsync";
+        case CEPH_OSD_OP_SETTRUNC: return "settrunc";
+        case CEPH_OSD_OP_TRIMTRUNC: return "trimtrunc";
+
+        case CEPH_OSD_OP_TMAPUP: return "tmapup";
+        case CEPH_OSD_OP_TMAPGET: return "tmapget";
+        case CEPH_OSD_OP_TMAPPUT: return "tmapput";
+
+        case CEPH_OSD_OP_GETXATTR: return "getxattr";
+        case CEPH_OSD_OP_GETXATTRS: return "getxattrs";
+        case CEPH_OSD_OP_SETXATTR: return "setxattr";
+        case CEPH_OSD_OP_SETXATTRS: return "setxattrs";
+        case CEPH_OSD_OP_RESETXATTRS: return "resetxattrs";
+        case CEPH_OSD_OP_RMXATTR: return "rmxattr";
+        case CEPH_OSD_OP_CMPXATTR: return "cmpxattr";
+
+        case CEPH_OSD_OP_PULL: return "pull";
+        case CEPH_OSD_OP_PUSH: return "push";
+        case CEPH_OSD_OP_BALANCEREADS: return "balance-reads";
+        case CEPH_OSD_OP_UNBALANCEREADS: return "unbalance-reads";
+        case CEPH_OSD_OP_SCRUB: return "scrub";
+
+        case CEPH_OSD_OP_WRLOCK: return "wrlock";
+        case CEPH_OSD_OP_WRUNLOCK: return "wrunlock";
+        case CEPH_OSD_OP_RDLOCK: return "rdlock";
+        case CEPH_OSD_OP_RDUNLOCK: return "rdunlock";
+        case CEPH_OSD_OP_UPLOCK: return "uplock";
+        case CEPH_OSD_OP_DNLOCK: return "dnlock";
+
+        case CEPH_OSD_OP_CALL: return "call";
+
+        case CEPH_OSD_OP_PGLS: return "pgls";
+        }
+        return "???";
+}
+
+
+const char *ceph_pool_op_name(int op)
+{
+        switch (op) {
+        case POOL_OP_CREATE: return "create";
+        case POOL_OP_DELETE: return "delete";
+        case POOL_OP_AUID_CHANGE: return "auid change";
+        case POOL_OP_CREATE_SNAP: return "create snap";
+        case POOL_OP_DELETE_SNAP: return "delete snap";
+        case POOL_OP_CREATE_UNMANAGED_SNAP: return "create unmanaged snap";
+        case POOL_OP_DELETE_UNMANAGED_SNAP: return "delete unmanaged snap";
+        }
+        return "???";
+}
diff --git a/net/ceph/crush/crush.c b/net/ceph/crush/crush.c
new file mode 100644
index 000000000000..d6ebb13a18a4
--- /dev/null
+++ b/net/ceph/crush/crush.c
@@ -0,0 +1,151 @@
+
+#ifdef __KERNEL__
+# include <linux/slab.h>
+#else
+# include <stdlib.h>
+# include <assert.h>
+# define kfree(x) do { if (x) free(x); } while (0)
+# define BUG_ON(x) assert(!(x))
+#endif
+
+#include <linux/crush/crush.h>
+
+const char *crush_bucket_alg_name(int alg)
+{
+        switch (alg) {
+        case CRUSH_BUCKET_UNIFORM: return "uniform";
+        case CRUSH_BUCKET_LIST: return "list";
+        case CRUSH_BUCKET_TREE: return "tree";
+        case CRUSH_BUCKET_STRAW: return "straw";
+        default: return "unknown";
+        }
+}
+
+/**
+ * crush_get_bucket_item_weight - Get weight of an item in given bucket
+ * @b: bucket pointer
+ * @p: item index in bucket
+ */
+int crush_get_bucket_item_weight(struct crush_bucket *b, int p)
+{
+        if (p >= b->size)
+                return 0;
+
+        switch (b->alg) {
+        case CRUSH_BUCKET_UNIFORM:
+                return ((struct crush_bucket_uniform *)b)->item_weight;
+        case CRUSH_BUCKET_LIST:
+                return ((struct crush_bucket_list *)b)->item_weights[p];
+        case CRUSH_BUCKET_TREE:
+                if (p & 1)
+                        return ((struct crush_bucket_tree *)b)->node_weights[p];
+                return 0;
+        case CRUSH_BUCKET_STRAW:
+                return ((struct crush_bucket_straw *)b)->item_weights[p];
+        }
+        return 0;
+}
+
+/**
+ * crush_calc_parents - Calculate parent vectors for the given crush map.
+ * @map: crush_map pointer
+ */
+void crush_calc_parents(struct crush_map *map)
+{
+        int i, b, c;
+
+        for (b = 0; b < map->max_buckets; b++) {
+                if (map->buckets[b] == NULL)
+                        continue;
+                for (i = 0; i < map->buckets[b]->size; i++) {
+                        c = map->buckets[b]->items[i];
+                        BUG_ON(c >= map->max_devices ||
+                               c < -map->max_buckets);
+                        if (c >= 0)
+                                map->device_parents[c] = map->buckets[b]->id;
+                        else
+                                map->bucket_parents[-1-c] = map->buckets[b]->id;
+                }
+        }
+}
+
+void crush_destroy_bucket_uniform(struct crush_bucket_uniform *b)
+{
+        kfree(b->h.perm);
+        kfree(b->h.items);
+        kfree(b);
+}
+
+void crush_destroy_bucket_list(struct crush_bucket_list *b)
+{
+        kfree(b->item_weights);
+        kfree(b->sum_weights);
+        kfree(b->h.perm);
+        kfree(b->h.items);
+        kfree(b);
+}
+
+void crush_destroy_bucket_tree(struct crush_bucket_tree *b)
+{
+        kfree(b->node_weights);
+        kfree(b);
+}
+
+void crush_destroy_bucket_straw(struct crush_bucket_straw *b)
+{
+        kfree(b->straws);
+        kfree(b->item_weights);
+        kfree(b->h.perm);
+        kfree(b->h.items);
+        kfree(b);
+}
+
+void crush_destroy_bucket(struct crush_bucket *b)
+{
+        switch (b->alg) {
+        case CRUSH_BUCKET_UNIFORM:
+                crush_destroy_bucket_uniform((struct crush_bucket_uniform *)b);
+                break;
+        case CRUSH_BUCKET_LIST:
+                crush_destroy_bucket_list((struct crush_bucket_list *)b);
+                break;
+        case CRUSH_BUCKET_TREE:
+                crush_destroy_bucket_tree((struct crush_bucket_tree *)b);
+                break;
+        case CRUSH_BUCKET_STRAW:
+                crush_destroy_bucket_straw((struct crush_bucket_straw *)b);
+                break;
+        }
+}
+
+/**
+ * crush_destroy - Destroy a crush_map
+ * @map: crush_map pointer
+ */
+void crush_destroy(struct crush_map *map)
+{
+        int b;
+
+        /* buckets */
+        if (map->buckets) {
+                for (b = 0; b < map->max_buckets; b++) {
+                        if (map->buckets[b] == NULL)
+                                continue;
+                        crush_destroy_bucket(map->buckets[b]);
+                }
+                kfree(map->buckets);
+        }
+
+        /* rules */
+        if (map->rules) {
+                for (b = 0; b < map->max_rules; b++)
+                        kfree(map->rules[b]);
+                kfree(map->rules);
+        }
+
+        kfree(map->bucket_parents);
+        kfree(map->device_parents);
+        kfree(map);
+}
+
+
diff --git a/net/ceph/crush/hash.c b/net/ceph/crush/hash.c
new file mode 100644
index 000000000000..5bb63e37a8a1
--- /dev/null
+++ b/net/ceph/crush/hash.c
@@ -0,0 +1,149 @@
+
+#include <linux/types.h>
+#include <linux/crush/hash.h>
+
+/*
+ * Robert Jenkins' function for mixing 32-bit values
+ * http://burtleburtle.net/bob/hash/evahash.html
+ * a, b = random bits, c = input and output
+ */
+#define crush_hashmix(a, b, c) do {                     \
+                a = a-b;  a = a-c;  a = a^(c>>13);      \
+                b = b-c;  b = b-a;  b = b^(a<<8);       \
+                c = c-a;  c = c-b;  c = c^(b>>13);      \
+                a = a-b;  a = a-c;  a = a^(c>>12);      \
+                b = b-c;  b = b-a;  b = b^(a<<16);      \
+                c = c-a;  c = c-b;  c = c^(b>>5);       \
+                a = a-b;  a = a-c;  a = a^(c>>3);       \
+                b = b-c;  b = b-a;  b = b^(a<<10);      \
+                c = c-a;  c = c-b;  c = c^(b>>15);      \
+        } while (0)
+
+#define crush_hash_seed 1315423911
+
+static __u32 crush_hash32_rjenkins1(__u32 a)
+{
+        __u32 hash = crush_hash_seed ^ a;
+        __u32 b = a;
+        __u32 x = 231232;
+        __u32 y = 1232;
+        crush_hashmix(b, x, hash);
+        crush_hashmix(y, a, hash);
+        return hash;
+}
+
+static __u32 crush_hash32_rjenkins1_2(__u32 a, __u32 b)
+{
+        __u32 hash = crush_hash_seed ^ a ^ b;
+        __u32 x = 231232;
+        __u32 y = 1232;
+        crush_hashmix(a, b, hash);
+        crush_hashmix(x, a, hash);
+        crush_hashmix(b, y, hash);
+        return hash;
+}
+
+static __u32 crush_hash32_rjenkins1_3(__u32 a, __u32 b, __u32 c)
+{
+        __u32 hash = crush_hash_seed ^ a ^ b ^ c;
+        __u32 x = 231232;
+        __u32 y = 1232;
+        crush_hashmix(a, b, hash);
+        crush_hashmix(c, x, hash);
+        crush_hashmix(y, a, hash);
+        crush_hashmix(b, x, hash);
+        crush_hashmix(y, c, hash);
+        return hash;
+}
+
+static __u32 crush_hash32_rjenkins1_4(__u32 a, __u32 b, __u32 c, __u32 d)
+{
+        __u32 hash = crush_hash_seed ^ a ^ b ^ c ^ d;
+        __u32 x = 231232;
+        __u32 y = 1232;
+        crush_hashmix(a, b, hash);
+        crush_hashmix(c, d, hash);
+        crush_hashmix(a, x, hash);
+        crush_hashmix(y, b, hash);
+        crush_hashmix(c, x, hash);
+        crush_hashmix(y, d, hash);
+        return hash;
+}
+
+static __u32 crush_hash32_rjenkins1_5(__u32 a, __u32 b, __u32 c, __u32 d,
+                                      __u32 e)
+{
+        __u32 hash = crush_hash_seed ^ a ^ b ^ c ^ d ^ e;
+        __u32 x = 231232;
+        __u32 y = 1232;
+        crush_hashmix(a, b, hash);
+        crush_hashmix(c, d, hash);
+        crush_hashmix(e, x, hash);
+        crush_hashmix(y, a, hash);
+        crush_hashmix(b, x, hash);
+        crush_hashmix(y, c, hash);
+        crush_hashmix(d, x, hash);
+        crush_hashmix(y, e, hash);
+        return hash;
+}
+
+
+__u32 crush_hash32(int type, __u32 a)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return crush_hash32_rjenkins1(a);
+        default:
+                return 0;
+        }
+}
+
+__u32 crush_hash32_2(int type, __u32 a, __u32 b)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return crush_hash32_rjenkins1_2(a, b);
+        default:
+                return 0;
+        }
+}
+
+__u32 crush_hash32_3(int type, __u32 a, __u32 b, __u32 c)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return crush_hash32_rjenkins1_3(a, b, c);
+        default:
+                return 0;
+        }
+}
+
+__u32 crush_hash32_4(int type, __u32 a, __u32 b, __u32 c, __u32 d)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return crush_hash32_rjenkins1_4(a, b, c, d);
+        default:
+                return 0;
+        }
+}
+
+__u32 crush_hash32_5(int type, __u32 a, __u32 b, __u32 c, __u32 d, __u32 e)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return crush_hash32_rjenkins1_5(a, b, c, d, e);
+        default:
+                return 0;
+        }
+}
+
+const char *crush_hash_name(int type)
+{
+        switch (type) {
+        case CRUSH_HASH_RJENKINS1:
+                return "rjenkins1";
+        default:
+                return "unknown";
+        }
+}
diff --git a/net/ceph/crush/mapper.c b/net/ceph/crush/mapper.c
new file mode 100644
index 000000000000..42599e31dcad
--- /dev/null
+++ b/net/ceph/crush/mapper.c
@@ -0,0 +1,609 @@
+
+#ifdef __KERNEL__
+# include <linux/string.h>
+# include <linux/slab.h>
+# include <linux/bug.h>
+# include <linux/kernel.h>
+# ifndef dprintk
+#  define dprintk(args...)
+# endif
+#else
+# include <string.h>
+# include <stdio.h>
+# include <stdlib.h>
+# include <assert.h>
+# define BUG_ON(x) assert(!(x))
+# define dprintk(args...) /* printf(args) */
+# define kmalloc(x, f) malloc(x)
+# define kfree(x) free(x)
+#endif
+
+#include <linux/crush/crush.h>
+#include <linux/crush/hash.h>
+
+/*
+ * Implement the core CRUSH mapping algorithm.
+ */
+
+/**
+ * crush_find_rule - find a crush_rule id for a given ruleset, type, and size.
+ * @map: the crush_map
+ * @ruleset: the storage ruleset id (user defined)
+ * @type: storage ruleset type (user defined)
+ * @size: output set size
+ */
+int crush_find_rule(struct crush_map *map, int ruleset, int type, int size)
+{
+        int i;
+
+        for (i = 0; i < map->max_rules; i++) {
+                if (map->rules[i] &&
+                    map->rules[i]->mask.ruleset == ruleset &&
+                    map->rules[i]->mask.type == type &&
+                    map->rules[i]->mask.min_size <= size &&
+                    map->rules[i]->mask.max_size >= size)
+                        return i;
+        }
+        return -1;
+}
+
+
+/*
+ * bucket choose methods
+ *
+ * For each bucket algorithm, we have a "choose" method that, given a
+ * crush input @x and replica position (usually, position in output set) @r,
+ * will produce an item in the bucket.
+ */
+
+/*
+ * Choose based on a random permutation of the bucket.
+ *
+ * We used to use some prime number arithmetic to do this, but it
+ * wasn't very random, and had some other bad behaviors.  Instead, we
+ * calculate an actual random permutation of the bucket members.
+ * Since this is expensive, we optimize for the r=0 case, which
+ * captures the vast majority of calls.
+ */
+static int bucket_perm_choose(struct crush_bucket *bucket,
+                              int x, int r)
+{
+        unsigned pr = r % bucket->size;
+        unsigned i, s;
+
+        /* start a new permutation if @x has changed */
+        if (bucket->perm_x != x || bucket->perm_n == 0) {
+                dprintk("bucket %d new x=%d\n", bucket->id, x);
+                bucket->perm_x = x;
+
+                /* optimize common r=0 case */
+                if (pr == 0) {
+                        s = crush_hash32_3(bucket->hash, x, bucket->id, 0) %
+                                bucket->size;
+                        bucket->perm[0] = s;
+                        bucket->perm_n = 0xffff;   /* magic value, see below */
+                        goto out;
+                }
+
+                for (i = 0; i < bucket->size; i++)
+                        bucket->perm[i] = i;
+                bucket->perm_n = 0;
+        } else if (bucket->perm_n == 0xffff) {
+                /* clean up after the r=0 case above */
+                for (i = 1; i < bucket->size; i++)
+                        bucket->perm[i] = i;
+                bucket->perm[bucket->perm[0]] = 0;
+                bucket->perm_n = 1;
+        }
+
+        /* calculate permutation up to pr */
+        for (i = 0; i < bucket->perm_n; i++)
+                dprintk(" perm_choose have %d: %d\n", i, bucket->perm[i]);
+        while (bucket->perm_n <= pr) {
+                unsigned p = bucket->perm_n;
+                /* no point in swapping the final entry */
+                if (p < bucket->size - 1) {
+                        i = crush_hash32_3(bucket->hash, x, bucket->id, p) %
+                                (bucket->size - p);
+                        if (i) {
+                                unsigned t = bucket->perm[p + i];
+                                bucket->perm[p + i] = bucket->perm[p];
+                                bucket->perm[p] = t;
+                        }
+                        dprintk(" perm_choose swap %d with %d\n", p, p+i);
+                }
+                bucket->perm_n++;
+        }
+        for (i = 0; i < bucket->size; i++)
+                dprintk(" perm_choose  %d: %d\n", i, bucket->perm[i]);
+
+        s = bucket->perm[pr];
+out:
+        dprintk(" perm_choose %d sz=%d x=%d r=%d (%d) s=%d\n", bucket->id,
+                bucket->size, x, r, pr, s);
+        return bucket->items[s];
+}
+
+/* uniform */
+static int bucket_uniform_choose(struct crush_bucket_uniform *bucket,
+                                 int x, int r)
+{
+        return bucket_perm_choose(&bucket->h, x, r);
+}
+
+/* list */
+static int bucket_list_choose(struct crush_bucket_list *bucket,
+                              int x, int r)
+{
+        int i;
+
+        for (i = bucket->h.size-1; i >= 0; i--) {
+                __u64 w = crush_hash32_4(bucket->h.hash,x, bucket->h.items[i],
+                                         r, bucket->h.id);
+                w &= 0xffff;
+                dprintk("list_choose i=%d x=%d r=%d item %d weight %x "
+                        "sw %x rand %llx",
+                        i, x, r, bucket->h.items[i], bucket->item_weights[i],
+                        bucket->sum_weights[i], w);
+                w *= bucket->sum_weights[i];
+                w = w >> 16;
+                /*dprintk(" scaled %llx\n", w);*/
+                if (w < bucket->item_weights[i])
+                        return bucket->h.items[i];
+        }
+
+        BUG_ON(1);
+        return 0;
+}
+
+
+/* (binary) tree */
+static int height(int n)
+{
+        int h = 0;
+        while ((n & 1) == 0) {
+                h++;
+                n = n >> 1;
+        }
+        return h;
+}
+
+static int left(int x)
+{
+        int h = height(x);
+        return x - (1 << (h-1));
+}
+
+static int right(int x)
+{
+        int h = height(x);
+        return x + (1 << (h-1));
+}
+
+static int terminal(int x)
+{
+        return x & 1;
+}
+
+static int bucket_tree_choose(struct crush_bucket_tree *bucket,
+                              int x, int r)
+{
+        int n, l;
+        __u32 w;
+        __u64 t;
+
+        /* start at root */
+        n = bucket->num_nodes >> 1;
+
+        while (!terminal(n)) {
+                /* pick point in [0, w) */
+                w = bucket->node_weights[n];
+                t = (__u64)crush_hash32_4(bucket->h.hash, x, n, r,
+                                          bucket->h.id) * (__u64)w;
+                t = t >> 32;
+
+                /* descend to the left or right? */
+                l = left(n);
+                if (t < bucket->node_weights[l])
+                        n = l;
+                else
+                        n = right(n);
+        }
+
+        return bucket->h.items[n >> 1];
+}
+
+
+/* straw */
+
+static int bucket_straw_choose(struct crush_bucket_straw *bucket,
+                               int x, int r)
+{
+        int i;
+        int high = 0;
+        __u64 high_draw = 0;
+        __u64 draw;
+
+        for (i = 0; i < bucket->h.size; i++) {
+                draw = crush_hash32_3(bucket->h.hash, x, bucket->h.items[i], r);
+                draw &= 0xffff;
+                draw *= bucket->straws[i];
+                if (i == 0 || draw > high_draw) {
+                        high = i;
+                        high_draw = draw;
+                }
+        }
+        return bucket->h.items[high];
+}
+
+static int crush_bucket_choose(struct crush_bucket *in, int x, int r)
+{
+        dprintk(" crush_bucket_choose %d x=%d r=%d\n", in->id, x, r);
+        switch (in->alg) {
+        case CRUSH_BUCKET_UNIFORM:
+                return bucket_uniform_choose((struct crush_bucket_uniform *)in,
+                                          x, r);
+        case CRUSH_BUCKET_LIST:
+                return bucket_list_choose((struct crush_bucket_list *)in,
+                                          x, r);
+        case CRUSH_BUCKET_TREE:
+                return bucket_tree_choose((struct crush_bucket_tree *)in,
+                                          x, r);
+        case CRUSH_BUCKET_STRAW:
+                return bucket_straw_choose((struct crush_bucket_straw *)in,
+                                           x, r);
+        default:
+                BUG_ON(1);
+                return in->items[0];
+        }
+}
+
+/*
+ * true if device is marked "out" (failed, fully offloaded)
+ * of the cluster
+ */
+static int is_out(struct crush_map *map, __u32 *weight, int item, int x)
+{
+        if (weight[item] >= 0x10000)
+                return 0;
+        if (weight[item] == 0)
+                return 1;
+        if ((crush_hash32_2(CRUSH_HASH_RJENKINS1, x, item) & 0xffff)
+            < weight[item])
+                return 0;
+        return 1;
+}
+
+/**
+ * crush_choose - choose numrep distinct items of given type
+ * @map: the crush_map
+ * @bucket: the bucket we are choose an item from
+ * @x: crush input value
+ * @numrep: the number of items to choose
+ * @type: the type of item to choose
+ * @out: pointer to output vector
+ * @outpos: our position in that vector
+ * @firstn: true if choosing "first n" items, false if choosing "indep"
+ * @recurse_to_leaf: true if we want one device under each item of given type
+ * @out2: second output vector for leaf items (if @recurse_to_leaf)
+ */
+static int crush_choose(struct crush_map *map,
+                        struct crush_bucket *bucket,
+                        __u32 *weight,
+                        int x, int numrep, int type,
+                        int *out, int outpos,
+                        int firstn, int recurse_to_leaf,
+                        int *out2)
+{
+        int rep;
+        int ftotal, flocal;
+        int retry_descent, retry_bucket, skip_rep;
+        struct crush_bucket *in = bucket;
+        int r;
+        int i;
+        int item = 0;
+        int itemtype;
+        int collide, reject;
+        const int orig_tries = 5; /* attempts before we fall back to search */
+
+        dprintk("CHOOSE%s bucket %d x %d outpos %d numrep %d\n", recurse_to_leaf ? "_LEAF" : "",
+                bucket->id, x, outpos, numrep);
+
+        for (rep = outpos; rep < numrep; rep++) {
+                /* keep trying until we get a non-out, non-colliding item */
+                ftotal = 0;
+                skip_rep = 0;
+                do {
+                        retry_descent = 0;
+                        in = bucket;               /* initial bucket */
+
+                        /* choose through intervening buckets */
+                        flocal = 0;
+                        do {
+                                collide = 0;
+                                retry_bucket = 0;
+                                r = rep;
+                                if (in->alg == CRUSH_BUCKET_UNIFORM) {
+                                        /* be careful */
+                                        if (firstn || numrep >= in->size)
+                                                /* r' = r + f_total */
+                                                r += ftotal;
+                                        else if (in->size % numrep == 0)
+                                                /* r'=r+(n+1)*f_local */
+                                                r += (numrep+1) *
+                                                        (flocal+ftotal);
+                                        else
+                                                /* r' = r + n*f_local */
+                                                r += numrep * (flocal+ftotal);
+                                } else {
+                                        if (firstn)
+                                                /* r' = r + f_total */
+                                                r += ftotal;
+                                        else
+                                                /* r' = r + n*f_local */
+                                                r += numrep * (flocal+ftotal);
+                                }
+
+                                /* bucket choose */
+                                if (in->size == 0) {
+                                        reject = 1;
+                                        goto reject;
+                                }
+                                if (flocal >= (in->size>>1) &&
+                                    flocal > orig_tries)
+                                        item = bucket_perm_choose(in, x, r);
+                                else
+                                        item = crush_bucket_choose(in, x, r);
+                                BUG_ON(item >= map->max_devices);
+
+                                /* desired type? */
+                                if (item < 0)
+                                        itemtype = map->buckets[-1-item]->type;
+                                else
+                                        itemtype = 0;
+                                dprintk("  item %d type %d\n", item, itemtype);
+
+                                /* keep going? */
+                                if (itemtype != type) {
+                                        BUG_ON(item >= 0 ||
+                                               (-1-item) >= map->max_buckets);
+                                        in = map->buckets[-1-item];
+                                        retry_bucket = 1;
+                                        continue;
+                                }
+
+                                /* collision? */
+                                for (i = 0; i < outpos; i++) {
+                                        if (out[i] == item) {
+                                                collide = 1;
+                                                break;
+                                        }
+                                }
+
+                                reject = 0;
+                                if (recurse_to_leaf) {
+                                        if (item < 0) {
+                                                if (crush_choose(map,
+                                                         map->buckets[-1-item],
+                                                         weight,
+                                                         x, outpos+1, 0,
+                                                         out2, outpos,
+                                                         firstn, 0,
+                                                         NULL) <= outpos)
+                                                        /* didn't get leaf */
+                                                        reject = 1;
+                                        } else {
+                                                /* we already have a leaf! */
+                                                out2[outpos] = item;
+                                        }
+                                }
+
+                                if (!reject) {
+                                        /* out? */
+                                        if (itemtype == 0)
+                                                reject = is_out(map, weight,
+                                                                item, x);
+                                        else
+                                                reject = 0;
+                                }
+
+reject:
+                                if (reject || collide) {
+                                        ftotal++;
+                                        flocal++;
+
+                                        if (collide && flocal < 3)
+                                                /* retry locally a few times */
+                                                retry_bucket = 1;
+                                        else if (flocal < in->size + orig_tries)
+                                                /* exhaustive bucket search */
+                                                retry_bucket = 1;
+                                        else if (ftotal < 20)
+                                                /* then retry descent */
+                                                retry_descent = 1;
+                                        else
+                                                /* else give up */
+                                                skip_rep = 1;
+                                        dprintk("  reject %d  collide %d  "
+                                                "ftotal %d  flocal %d\n",
+                                                reject, collide, ftotal,
+                                                flocal);
+                                }
+                        } while (retry_bucket);
+                } while (retry_descent);
+
+                if (skip_rep) {
+                        dprintk("skip rep\n");
+                        continue;
+                }
+
+                dprintk("CHOOSE got %d\n", item);
+                out[outpos] = item;
+                outpos++;
+        }
+
+        dprintk("CHOOSE returns %d\n", outpos);
+        return outpos;
+}
+
+
+/**
+ * crush_do_rule - calculate a mapping with the given input and rule
+ * @map: the crush_map
+ * @ruleno: the rule id
+ * @x: hash input
+ * @result: pointer to result vector
+ * @result_max: maximum result size
+ * @force: force initial replica choice; -1 for none
+ */
+int crush_do_rule(struct crush_map *map,
+                  int ruleno, int x, int *result, int result_max,
+                  int force, __u32 *weight)
+{
+        int result_len;
+        int force_context[CRUSH_MAX_DEPTH];
+        int force_pos = -1;
+        int a[CRUSH_MAX_SET];
+        int b[CRUSH_MAX_SET];
+        int c[CRUSH_MAX_SET];
+        int recurse_to_leaf;
+        int *w;
+        int wsize = 0;
+        int *o;
+        int osize;
+        int *tmp;
+        struct crush_rule *rule;
+        int step;
+        int i, j;
+        int numrep;
+        int firstn;
+        int rc = -1;
+
+        BUG_ON(ruleno >= map->max_rules);
+
+        rule = map->rules[ruleno];
+        result_len = 0;
+        w = a;
+        o = b;
+
+        /*
+         * determine hierarchical context of force, if any.  note
+         * that this may or may not correspond to the specific types
+         * referenced by the crush rule.
+         */
+        if (force >= 0) {
+                if (force >= map->max_devices ||
+                    map->device_parents[force] == 0) {
+                        /*dprintk("CRUSH: forcefed device dne\n");*/
+                        rc = -1;  /* force fed device dne */
+                        goto out;
+                }
+                if (!is_out(map, weight, force, x)) {
+                        while (1) {
+                                force_context[++force_pos] = force;
+                                if (force >= 0)
+                                        force = map->device_parents[force];
+                                else
+                                        force = map->bucket_parents[-1-force];
+                                if (force == 0)
+                                        break;
+                        }
+                }
+        }
+
+        for (step = 0; step < rule->len; step++) {
+                firstn = 0;
+                switch (rule->steps[step].op) {
+                case CRUSH_RULE_TAKE:
+                        w[0] = rule->steps[step].arg1;
+                        if (force_pos >= 0) {
+                                BUG_ON(force_context[force_pos] != w[0]);
+                                force_pos--;
+                        }
+                        wsize = 1;
+                        break;
+
+                case CRUSH_RULE_CHOOSE_LEAF_FIRSTN:
+                case CRUSH_RULE_CHOOSE_FIRSTN:
+                        firstn = 1;
+                case CRUSH_RULE_CHOOSE_LEAF_INDEP:
+                case CRUSH_RULE_CHOOSE_INDEP:
+                        BUG_ON(wsize == 0);
+
+                        recurse_to_leaf =
+                                rule->steps[step].op ==
+                                 CRUSH_RULE_CHOOSE_LEAF_FIRSTN ||
+                                rule->steps[step].op ==
+                                CRUSH_RULE_CHOOSE_LEAF_INDEP;
+
+                        /* reset output */
+                        osize = 0;
+
+                        for (i = 0; i < wsize; i++) {
+                                /*
+                                 * see CRUSH_N, CRUSH_N_MINUS macros.
+                                 * basically, numrep <= 0 means relative to
+                                 * the provided result_max
+                                 */
+                                numrep = rule->steps[step].arg1;
+                                if (numrep <= 0) {
+                                        numrep += result_max;
+                                        if (numrep <= 0)
+                                                continue;
+                                }
+                                j = 0;
+                                if (osize == 0 && force_pos >= 0) {
+                                        /* skip any intermediate types */
+                                        while (force_pos &&
+                                               force_context[force_pos] < 0 &&
+                                               rule->steps[step].arg2 !=
+                                               map->buckets[-1 -
+                                               force_context[force_pos]]->type)
+                                                force_pos--;
+                                        o[osize] = force_context[force_pos];
+                                        if (recurse_to_leaf)
+                                                c[osize] = force_context[0];
+                                        j++;
+                                        force_pos--;
+                                }
+                                osize += crush_choose(map,
+                                                      map->buckets[-1-w[i]],
+                                                      weight,
+                                                      x, numrep,
+                                                      rule->steps[step].arg2,
+                                                      o+osize, j,
+                                                      firstn,
+                                                      recurse_to_leaf, c+osize);
+                        }
+
+                        if (recurse_to_leaf)
+                                /* copy final _leaf_ values to output set */
+                                memcpy(o, c, osize*sizeof(*o));
+
+                        /* swap t and w arrays */
+                        tmp = o;
+                        o = w;
+                        w = tmp;
+                        wsize = osize;
+                        break;
+
+
+                case CRUSH_RULE_EMIT:
+                        for (i = 0; i < wsize && result_len < result_max; i++) {
+                                result[result_len] = w[i];
+                                result_len++;
+                        }
+                        wsize = 0;
+                        break;
+
+                default:
+                        BUG_ON(1);
+                }
+        }
+        rc = result_len;
+
+out:
+        return rc;
+}
+
+
diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
new file mode 100644
index 000000000000..7b505b0c983f
--- /dev/null
+++ b/net/ceph/crypto.c
@@ -0,0 +1,412 @@
+
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/err.h>
+#include <linux/scatterlist.h>
+#include <linux/slab.h>
+#include <crypto/hash.h>
+
+#include <linux/ceph/decode.h>
+#include "crypto.h"
+
+int ceph_crypto_key_encode(struct ceph_crypto_key *key, void **p, void *end)
+{
+        if (*p + sizeof(u16) + sizeof(key->created) +
+            sizeof(u16) + key->len > end)
+                return -ERANGE;
+        ceph_encode_16(p, key->type);
+        ceph_encode_copy(p, &key->created, sizeof(key->created));
+        ceph_encode_16(p, key->len);
+        ceph_encode_copy(p, key->key, key->len);
+        return 0;
+}
+
+int ceph_crypto_key_decode(struct ceph_crypto_key *key, void **p, void *end)
+{
+        ceph_decode_need(p, end, 2*sizeof(u16) + sizeof(key->created), bad);
+        key->type = ceph_decode_16(p);
+        ceph_decode_copy(p, &key->created, sizeof(key->created));
+        key->len = ceph_decode_16(p);
+        ceph_decode_need(p, end, key->len, bad);
+        key->key = kmalloc(key->len, GFP_NOFS);
+        if (!key->key)
+                return -ENOMEM;
+        ceph_decode_copy(p, key->key, key->len);
+        return 0;
+
+bad:
+        dout("failed to decode crypto key\n");
+        return -EINVAL;
+}
+
+int ceph_crypto_key_unarmor(struct ceph_crypto_key *key, const char *inkey)
+{
+        int inlen = strlen(inkey);
+        int blen = inlen * 3 / 4;
+        void *buf, *p;
+        int ret;
+
+        dout("crypto_key_unarmor %s\n", inkey);
+        buf = kmalloc(blen, GFP_NOFS);
+        if (!buf)
+                return -ENOMEM;
+        blen = ceph_unarmor(buf, inkey, inkey+inlen);
+        if (blen < 0) {
+                kfree(buf);
+                return blen;
+        }
+
+        p = buf;
+        ret = ceph_crypto_key_decode(key, &p, p + blen);
+        kfree(buf);
+        if (ret)
+                return ret;
+        dout("crypto_key_unarmor key %p type %d len %d\n", key,
+             key->type, key->len);
+        return 0;
+}
+
+
+
+#define AES_KEY_SIZE 16
+
+static struct crypto_blkcipher *ceph_crypto_alloc_cipher(void)
+{
+        return crypto_alloc_blkcipher("cbc(aes)", 0, CRYPTO_ALG_ASYNC);
+}
+
+static const u8 *aes_iv = (u8 *)CEPH_AES_IV;
+
+static int ceph_aes_encrypt(const void *key, int key_len,
+                            void *dst, size_t *dst_len,
+                            const void *src, size_t src_len)
+{
+        struct scatterlist sg_in[2], sg_out[1];
+        struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+        struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
+        int ret;
+        void *iv;
+        int ivsize;
+        size_t zero_padding = (0x10 - (src_len & 0x0f));
+        char pad[16];
+
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        memset(pad, zero_padding, zero_padding);
+
+        *dst_len = src_len + zero_padding;
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
+        sg_init_table(sg_in, 2);
+        sg_set_buf(&sg_in[0], src, src_len);
+        sg_set_buf(&sg_in[1], pad, zero_padding);
+        sg_init_table(sg_out, 1);
+        sg_set_buf(sg_out, dst, *dst_len);
+        iv = crypto_blkcipher_crt(tfm)->iv;
+        ivsize = crypto_blkcipher_ivsize(tfm);
+
+        memcpy(iv, aes_iv, ivsize);
+        /*
+        print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1,
+                       key, key_len, 1);
+        print_hex_dump(KERN_ERR, "enc src: ", DUMP_PREFIX_NONE, 16, 1,
+                        src, src_len, 1);
+        print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1,
+                        pad, zero_padding, 1);
+        */
+        ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
+                                     src_len + zero_padding);
+        crypto_free_blkcipher(tfm);
+        if (ret < 0)
+                pr_err("ceph_aes_crypt failed %d\n", ret);
+        /*
+        print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1,
+                       dst, *dst_len, 1);
+        */
+        return 0;
+}
+
+static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
+                             size_t *dst_len,
+                             const void *src1, size_t src1_len,
+                             const void *src2, size_t src2_len)
+{
+        struct scatterlist sg_in[3], sg_out[1];
+        struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+        struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
+        int ret;
+        void *iv;
+        int ivsize;
+        size_t zero_padding = (0x10 - ((src1_len + src2_len) & 0x0f));
+        char pad[16];
+
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        memset(pad, zero_padding, zero_padding);
+
+        *dst_len = src1_len + src2_len + zero_padding;
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
+        sg_init_table(sg_in, 3);
+        sg_set_buf(&sg_in[0], src1, src1_len);
+        sg_set_buf(&sg_in[1], src2, src2_len);
+        sg_set_buf(&sg_in[2], pad, zero_padding);
+        sg_init_table(sg_out, 1);
+        sg_set_buf(sg_out, dst, *dst_len);
+        iv = crypto_blkcipher_crt(tfm)->iv;
+        ivsize = crypto_blkcipher_ivsize(tfm);
+
+        memcpy(iv, aes_iv, ivsize);
+        /*
+        print_hex_dump(KERN_ERR, "enc  key: ", DUMP_PREFIX_NONE, 16, 1,
+                       key, key_len, 1);
+        print_hex_dump(KERN_ERR, "enc src1: ", DUMP_PREFIX_NONE, 16, 1,
+                        src1, src1_len, 1);
+        print_hex_dump(KERN_ERR, "enc src2: ", DUMP_PREFIX_NONE, 16, 1,
+                        src2, src2_len, 1);
+        print_hex_dump(KERN_ERR, "enc  pad: ", DUMP_PREFIX_NONE, 16, 1,
+                        pad, zero_padding, 1);
+        */
+        ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
+                                     src1_len + src2_len + zero_padding);
+        crypto_free_blkcipher(tfm);
+        if (ret < 0)
+                pr_err("ceph_aes_crypt2 failed %d\n", ret);
+        /*
+        print_hex_dump(KERN_ERR, "enc  out: ", DUMP_PREFIX_NONE, 16, 1,
+                       dst, *dst_len, 1);
+        */
+        return 0;
+}
+
+static int ceph_aes_decrypt(const void *key, int key_len,
+                            void *dst, size_t *dst_len,
+                            const void *src, size_t src_len)
+{
+        struct scatterlist sg_in[1], sg_out[2];
+        struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+        struct blkcipher_desc desc = { .tfm = tfm };
+        char pad[16];
+        void *iv;
+        int ivsize;
+        int ret;
+        int last_byte;
+
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
+        sg_init_table(sg_in, 1);
+        sg_init_table(sg_out, 2);
+        sg_set_buf(sg_in, src, src_len);
+        sg_set_buf(&sg_out[0], dst, *dst_len);
+        sg_set_buf(&sg_out[1], pad, sizeof(pad));
+
+        iv = crypto_blkcipher_crt(tfm)->iv;
+        ivsize = crypto_blkcipher_ivsize(tfm);
+
+        memcpy(iv, aes_iv, ivsize);
+
+        /*
+        print_hex_dump(KERN_ERR, "dec key: ", DUMP_PREFIX_NONE, 16, 1,
+                       key, key_len, 1);
+        print_hex_dump(KERN_ERR, "dec  in: ", DUMP_PREFIX_NONE, 16, 1,
+                       src, src_len, 1);
+        */
+
+        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
+        crypto_free_blkcipher(tfm);
+        if (ret < 0) {
+                pr_err("ceph_aes_decrypt failed %d\n", ret);
+                return ret;
+        }
+
+        if (src_len <= *dst_len)
+                last_byte = ((char *)dst)[src_len - 1];
+        else
+                last_byte = pad[src_len - *dst_len - 1];
+        if (last_byte <= 16 && src_len >= last_byte) {
+                *dst_len = src_len - last_byte;
+        } else {
+                pr_err("ceph_aes_decrypt got bad padding %d on src len %d\n",
+                       last_byte, (int)src_len);
+                return -EPERM;  /* bad padding */
+        }
+        /*
+        print_hex_dump(KERN_ERR, "dec out: ", DUMP_PREFIX_NONE, 16, 1,
+                       dst, *dst_len, 1);
+        */
+        return 0;
+}
+
+static int ceph_aes_decrypt2(const void *key, int key_len,
+                             void *dst1, size_t *dst1_len,
+                             void *dst2, size_t *dst2_len,
+                             const void *src, size_t src_len)
+{
+        struct scatterlist sg_in[1], sg_out[3];
+        struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+        struct blkcipher_desc desc = { .tfm = tfm };
+        char pad[16];
+        void *iv;
+        int ivsize;
+        int ret;
+        int last_byte;
+
+        if (IS_ERR(tfm))
+                return PTR_ERR(tfm);
+
+        sg_init_table(sg_in, 1);
+        sg_set_buf(sg_in, src, src_len);
+        sg_init_table(sg_out, 3);
+        sg_set_buf(&sg_out[0], dst1, *dst1_len);
+        sg_set_buf(&sg_out[1], dst2, *dst2_len);
+        sg_set_buf(&sg_out[2], pad, sizeof(pad));
+
+        crypto_blkcipher_setkey((void *)tfm, key, key_len);
+        iv = crypto_blkcipher_crt(tfm)->iv;
+        ivsize = crypto_blkcipher_ivsize(tfm);
+
+        memcpy(iv, aes_iv, ivsize);
+
+        /*
+        print_hex_dump(KERN_ERR, "dec  key: ", DUMP_PREFIX_NONE, 16, 1,
+                       key, key_len, 1);
+        print_hex_dump(KERN_ERR, "dec   in: ", DUMP_PREFIX_NONE, 16, 1,
+                       src, src_len, 1);
+        */
+
+        ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
+        crypto_free_blkcipher(tfm);
+        if (ret < 0) {
+                pr_err("ceph_aes_decrypt failed %d\n", ret);
+                return ret;
+        }
+
+        if (src_len <= *dst1_len)
+                last_byte = ((char *)dst1)[src_len - 1];
+        else if (src_len <= *dst1_len + *dst2_len)
+                last_byte = ((char *)dst2)[src_len - *dst1_len - 1];
+        else
+                last_byte = pad[src_len - *dst1_len - *dst2_len - 1];
+        if (last_byte <= 16 && src_len >= last_byte) {
+                src_len -= last_byte;
+        } else {
+                pr_err("ceph_aes_decrypt got bad padding %d on src len %d\n",
+                       last_byte, (int)src_len);
+                return -EPERM;  /* bad padding */
+        }
+
+        if (src_len < *dst1_len) {
+                *dst1_len = src_len;
+                *dst2_len = 0;
+        } else {
+                *dst2_len = src_len - *dst1_len;
+        }
+        /*
+        print_hex_dump(KERN_ERR, "dec  out1: ", DUMP_PREFIX_NONE, 16, 1,
+                       dst1, *dst1_len, 1);
+        print_hex_dump(KERN_ERR, "dec  out2: ", DUMP_PREFIX_NONE, 16, 1,
+                       dst2, *dst2_len, 1);
+        */
+
+        return 0;
+}
+
+
+int ceph_decrypt(struct ceph_crypto_key *secret, void *dst, size_t *dst_len,
+                 const void *src, size_t src_len)
+{
+        switch (secret->type) {
+        case CEPH_CRYPTO_NONE:
+                if (*dst_len < src_len)
+                        return -ERANGE;
+                memcpy(dst, src, src_len);
+                *dst_len = src_len;
+                return 0;
+
+        case CEPH_CRYPTO_AES:
+                return ceph_aes_decrypt(secret->key, secret->len, dst,
+                                        dst_len, src, src_len);
+
+        default:
+                return -EINVAL;
+        }
+}
+
+int ceph_decrypt2(struct ceph_crypto_key *secret,
+                        void *dst1, size_t *dst1_len,
+                        void *dst2, size_t *dst2_len,
+                        const void *src, size_t src_len)
+{
+        size_t t;
+
+        switch (secret->type) {
+        case CEPH_CRYPTO_NONE:
+                if (*dst1_len + *dst2_len < src_len)
+                        return -ERANGE;
+                t = min(*dst1_len, src_len);
+                memcpy(dst1, src, t);
+                *dst1_len = t;
+                src += t;
+                src_len -= t;
+                if (src_len) {
+                        t = min(*dst2_len, src_len);
+                        memcpy(dst2, src, t);
+                        *dst2_len = t;
+                }
+                return 0;
+
+        case CEPH_CRYPTO_AES:
+                return ceph_aes_decrypt2(secret->key, secret->len,
+                                         dst1, dst1_len, dst2, dst2_len,
+                                         src, src_len);
+
+        default:
+                return -EINVAL;
+        }
+}
+
+int ceph_encrypt(struct ceph_crypto_key *secret, void *dst, size_t *dst_len,
+                 const void *src, size_t src_len)
+{
+        switch (secret->type) {
+        case CEPH_CRYPTO_NONE:
+                if (*dst_len < src_len)
+                        return -ERANGE;
+                memcpy(dst, src, src_len);
+                *dst_len = src_len;
+                return 0;
+
+        case CEPH_CRYPTO_AES:
+                return ceph_aes_encrypt(secret->key, secret->len, dst,
+                                        dst_len, src, src_len);
+
+        default:
+                return -EINVAL;
+        }
+}
+
+int ceph_encrypt2(struct ceph_crypto_key *secret, void *dst, size_t *dst_len,
+                  const void *src1, size_t src1_len,
+                  const void *src2, size_t src2_len)
+{
+        switch (secret->type) {
+        case CEPH_CRYPTO_NONE:
+                if (*dst_len < src1_len + src2_len)
+                        return -ERANGE;
+                memcpy(dst, src1, src1_len);
+                memcpy(dst + src1_len, src2, src2_len);
+                *dst_len = src1_len + src2_len;
+                return 0;
+
+        case CEPH_CRYPTO_AES:
+                return ceph_aes_encrypt2(secret->key, secret->len, dst, dst_len,
+                                         src1, src1_len, src2, src2_len);
+
+        default:
+                return -EINVAL;
+        }
+}
diff --git a/net/ceph/crypto.h b/net/ceph/crypto.h
new file mode 100644
index 000000000000..f9eccace592b
--- /dev/null
+++ b/net/ceph/crypto.h
@@ -0,0 +1,48 @@
+#ifndef _FS_CEPH_CRYPTO_H
+#define _FS_CEPH_CRYPTO_H
+
+#include <linux/ceph/types.h>
+#include <linux/ceph/buffer.h>
+
+/*
+ * cryptographic secret
+ */
+struct ceph_crypto_key {
+        int type;
+        struct ceph_timespec created;
+        int len;
+        void *key;
+};
+
+static inline void ceph_crypto_key_destroy(struct ceph_crypto_key *key)
+{
+        kfree(key->key);
+}
+
+extern int ceph_crypto_key_encode(struct ceph_crypto_key *key,
+                                  void **p, void *end);
+extern int ceph_crypto_key_decode(struct ceph_crypto_key *key,
+                                  void **p, void *end);
+extern int ceph_crypto_key_unarmor(struct ceph_crypto_key *key, const char *in);
+
+/* crypto.c */
+extern int ceph_decrypt(struct ceph_crypto_key *secret,
+                        void *dst, size_t *dst_len,
+                        const void *src, size_t src_len);
+extern int ceph_encrypt(struct ceph_crypto_key *secret,
+                        void *dst, size_t *dst_len,
+                        const void *src, size_t src_len);
+extern int ceph_decrypt2(struct ceph_crypto_key *secret,
+                        void *dst1, size_t *dst1_len,
+                        void *dst2, size_t *dst2_len,
+                        const void *src, size_t src_len);
+extern int ceph_encrypt2(struct ceph_crypto_key *secret,
+                         void *dst, size_t *dst_len,
+                         const void *src1, size_t src1_len,
+                         const void *src2, size_t src2_len);
+
+/* armor.c */
+extern int ceph_armor(char *dst, const char *src, const char *end);
+extern int ceph_unarmor(char *dst, const char *src, const char *end);
+
+#endif
diff --git a/net/ceph/debugfs.c b/net/ceph/debugfs.c
new file mode 100644
index 000000000000..27d4ea315d12
--- /dev/null
+++ b/net/ceph/debugfs.c
@@ -0,0 +1,267 @@
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/ctype.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+
+#include <linux/ceph/libceph.h>
+#include <linux/ceph/mon_client.h>
+#include <linux/ceph/auth.h>
+#include <linux/ceph/debugfs.h>
+
+#ifdef CONFIG_DEBUG_FS
+
+/*
+ * Implement /sys/kernel/debug/ceph fun
+ *
+ * /sys/kernel/debug/ceph/client*  - an instance of the ceph client
+ *      .../osdmap      - current osdmap
+ *      .../monmap      - current monmap
+ *      .../osdc        - active osd requests
+ *      .../monc        - mon client state
+ *      .../dentry_lru  - dump contents of dentry lru
+ *      .../caps        - expose cap (reservation) stats
+ *      .../bdi         - symlink to ../../bdi/something
+ */
+
+static struct dentry *ceph_debugfs_dir;
+
+static int monmap_show(struct seq_file *s, void *p)
+{
+        int i;
+        struct ceph_client *client = s->private;
+
+        if (client->monc.monmap == NULL)
+                return 0;
+
+        seq_printf(s, "epoch %d\n", client->monc.monmap->epoch);
+        for (i = 0; i < client->monc.monmap->num_mon; i++) {
+                struct ceph_entity_inst *inst =
+                        &client->monc.monmap->mon_inst[i];
+
+                seq_printf(s, "\t%s%lld\t%s\n",
+                           ENTITY_NAME(inst->name),
+                           ceph_pr_addr(&inst->addr.in_addr));
+        }
+        return 0;
+}
+
+static int osdmap_show(struct seq_file *s, void *p)
+{
+        int i;
+        struct ceph_client *client = s->private;
+        struct rb_node *n;
+
+        if (client->osdc.osdmap == NULL)
+                return 0;
+        seq_printf(s, "epoch %d\n", client->osdc.osdmap->epoch);
+        seq_printf(s, "flags%s%s\n",
+                   (client->osdc.osdmap->flags & CEPH_OSDMAP_NEARFULL) ?
+                   " NEARFULL" : "",
+                   (client->osdc.osdmap->flags & CEPH_OSDMAP_FULL) ?
+                   " FULL" : "");
+        for (n = rb_first(&client->osdc.osdmap->pg_pools); n; n = rb_next(n)) {
+                struct ceph_pg_pool_info *pool =
+                        rb_entry(n, struct ceph_pg_pool_info, node);
+                seq_printf(s, "pg_pool %d pg_num %d / %d, lpg_num %d / %d\n",
+                           pool->id, pool->v.pg_num, pool->pg_num_mask,
+                           pool->v.lpg_num, pool->lpg_num_mask);
+        }
+        for (i = 0; i < client->osdc.osdmap->max_osd; i++) {
+                struct ceph_entity_addr *addr =
+                        &client->osdc.osdmap->osd_addr[i];
+                int state = client->osdc.osdmap->osd_state[i];
+                char sb[64];
+
+                seq_printf(s, "\tosd%d\t%s\t%3d%%\t(%s)\n",
+                           i, ceph_pr_addr(&addr->in_addr),
+                           ((client->osdc.osdmap->osd_weight[i]*100) >> 16),
+                           ceph_osdmap_state_str(sb, sizeof(sb), state));
+        }
+        return 0;
+}
+
+static int monc_show(struct seq_file *s, void *p)
+{
+        struct ceph_client *client = s->private;
+        struct ceph_mon_generic_request *req;
+        struct ceph_mon_client *monc = &client->monc;
+        struct rb_node *rp;
+
+        mutex_lock(&monc->mutex);
+
+        if (monc->have_mdsmap)
+                seq_printf(s, "have mdsmap %u\n", (unsigned)monc->have_mdsmap);
+        if (monc->have_osdmap)
+                seq_printf(s, "have osdmap %u\n", (unsigned)monc->have_osdmap);
+        if (monc->want_next_osdmap)
+                seq_printf(s, "want next osdmap\n");
+
+        for (rp = rb_first(&monc->generic_request_tree); rp; rp = rb_next(rp)) {
+                __u16 op;
+                req = rb_entry(rp, struct ceph_mon_generic_request, node);
+                op = le16_to_cpu(req->request->hdr.type);
+                if (op == CEPH_MSG_STATFS)
+                        seq_printf(s, "%lld statfs\n", req->tid);
+                else
+                        seq_printf(s, "%lld unknown\n", req->tid);
+        }
+
+        mutex_unlock(&monc->mutex);
+        return 0;
+}
+
+static int osdc_show(struct seq_file *s, void *pp)
+{
+        struct ceph_client *client = s->private;
+        struct ceph_osd_client *osdc = &client->osdc;
+        struct rb_node *p;
+
+        mutex_lock(&osdc->request_mutex);
+        for (p = rb_first(&osdc->requests); p; p = rb_next(p)) {
+                struct ceph_osd_request *req;
+                struct ceph_osd_request_head *head;
+                struct ceph_osd_op *op;
+                int num_ops;
+                int opcode, olen;
+                int i;
+
+                req = rb_entry(p, struct ceph_osd_request, r_node);
+
+                seq_printf(s, "%lld\tosd%d\t%d.%x\t", req->r_tid,
+                           req->r_osd ? req->r_osd->o_osd : -1,
+                           le32_to_cpu(req->r_pgid.pool),
+                           le16_to_cpu(req->r_pgid.ps));
+
+                head = req->r_request->front.iov_base;
+                op = (void *)(head + 1);
+
+                num_ops = le16_to_cpu(head->num_ops);
+                olen = le32_to_cpu(head->object_len);
+                seq_printf(s, "%.*s", olen,
+                           (const char *)(head->ops + num_ops));
+
+                if (req->r_reassert_version.epoch)
+                        seq_printf(s, "\t%u'%llu",
+                           (unsigned)le32_to_cpu(req->r_reassert_version.epoch),
+                           le64_to_cpu(req->r_reassert_version.version));
+                else
+                        seq_printf(s, "\t");
+
+                for (i = 0; i < num_ops; i++) {
+                        opcode = le16_to_cpu(op->op);
+                        seq_printf(s, "\t%s", ceph_osd_op_name(opcode));
+                        op++;
+                }
+
+                seq_printf(s, "\n");
+        }
+        mutex_unlock(&osdc->request_mutex);
+        return 0;
+}
+
+CEPH_DEFINE_SHOW_FUNC(monmap_show)
+CEPH_DEFINE_SHOW_FUNC(osdmap_show)
+CEPH_DEFINE_SHOW_FUNC(monc_show)
+CEPH_DEFINE_SHOW_FUNC(osdc_show)
+
+int ceph_debugfs_init(void)
+{
+        ceph_debugfs_dir = debugfs_create_dir("ceph", NULL);
+        if (!ceph_debugfs_dir)
+                return -ENOMEM;
+        return 0;
+}
+
+void ceph_debugfs_cleanup(void)
+{
+        debugfs_remove(ceph_debugfs_dir);
+}
+
+int ceph_debugfs_client_init(struct ceph_client *client)
+{
+        int ret = -ENOMEM;
+        char name[80];
+
+        snprintf(name, sizeof(name), "%pU.client%lld", &client->fsid,
+                 client->monc.auth->global_id);
+
+        client->debugfs_dir = debugfs_create_dir(name, ceph_debugfs_dir);
+        if (!client->debugfs_dir)
+                goto out;
+
+        client->monc.debugfs_file = debugfs_create_file("monc",
+                                                      0600,
+                                                      client->debugfs_dir,
+                                                      client,
+                                                      &monc_show_fops);
+        if (!client->monc.debugfs_file)
+                goto out;
+
+        client->osdc.debugfs_file = debugfs_create_file("osdc",
+                                                      0600,
+                                                      client->debugfs_dir,
+                                                      client,
+                                                      &osdc_show_fops);
+        if (!client->osdc.debugfs_file)
+                goto out;
+
+        client->debugfs_monmap = debugfs_create_file("monmap",
+                                        0600,
+                                        client->debugfs_dir,
+                                        client,
+                                        &monmap_show_fops);
+        if (!client->debugfs_monmap)
+                goto out;
+
+        client->debugfs_osdmap = debugfs_create_file("osdmap",
+                                        0600,
+                                        client->debugfs_dir,
+                                        client,
+                                        &osdmap_show_fops);
+        if (!client->debugfs_osdmap)
+                goto out;
+
+        return 0;
+
+out:
+        ceph_debugfs_client_cleanup(client);
+        return ret;
+}
+
+void ceph_debugfs_client_cleanup(struct ceph_client *client)
+{
+        debugfs_remove(client->debugfs_osdmap);
+        debugfs_remove(client->debugfs_monmap);
+        debugfs_remove(client->osdc.debugfs_file);
+        debugfs_remove(client->monc.debugfs_file);
+        debugfs_remove(client->debugfs_dir);
+}
+
+#else  /* CONFIG_DEBUG_FS */
+
+int ceph_debugfs_init(void)
+{
+        return 0;
+}
+
+void ceph_debugfs_cleanup(void)
+{
+}
+
+int ceph_debugfs_client_init(struct ceph_client *client)
+{
+        return 0;
+}
+
+void ceph_debugfs_client_cleanup(struct ceph_client *client)
+{
+}
+
+#endif  /* CONFIG_DEBUG_FS */
+
+EXPORT_SYMBOL(ceph_debugfs_init);
+EXPORT_SYMBOL(ceph_debugfs_cleanup);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
new file mode 100644
index 000000000000..0e8157ee5d43
--- /dev/null
+++ b/net/ceph/messenger.c
@@ -0,0 +1,2453 @@
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/crc32c.h>
+#include <linux/ctype.h>
+#include <linux/highmem.h>
+#include <linux/inet.h>
+#include <linux/kthread.h>
+#include <linux/net.h>
+#include <linux/slab.h>
+#include <linux/socket.h>
+#include <linux/string.h>
+#include <linux/bio.h>
+#include <linux/blkdev.h>
+#include <net/tcp.h>
+
+#include <linux/ceph/libceph.h>
+#include <linux/ceph/messenger.h>
+#include <linux/ceph/decode.h>
+#include <linux/ceph/pagelist.h>
+
+/*
+ * Ceph uses the messenger to exchange ceph_msg messages with other
+ * hosts in the system.  The messenger provides ordered and reliable
+ * delivery.  We tolerate TCP disconnects by reconnecting (with
+ * exponential backoff) in the case of a fault (disconnection, bad
+ * crc, protocol error).  Acks allow sent messages to be discarded by
+ * the sender.
+ */
+
+/* static tag bytes (protocol control messages) */
+static char tag_msg = CEPH_MSGR_TAG_MSG;
+static char tag_ack = CEPH_MSGR_TAG_ACK;
+static char tag_keepalive = CEPH_MSGR_TAG_KEEPALIVE;
+
+#ifdef CONFIG_LOCKDEP
+static struct lock_class_key socket_class;
+#endif
+
+
+static void queue_con(struct ceph_connection *con);
+static void con_work(struct work_struct *);
+static void ceph_fault(struct ceph_connection *con);
+
+/*
+ * nicely render a sockaddr as a string.
+ */
+#define MAX_ADDR_STR 20
+#define MAX_ADDR_STR_LEN 60
+static char addr_str[MAX_ADDR_STR][MAX_ADDR_STR_LEN];
+static DEFINE_SPINLOCK(addr_str_lock);
+static int last_addr_str;
+
+const char *ceph_pr_addr(const struct sockaddr_storage *ss)
+{
+        int i;
+        char *s;
+        struct sockaddr_in *in4 = (void *)ss;
+        struct sockaddr_in6 *in6 = (void *)ss;
+
+        spin_lock(&addr_str_lock);
+        i = last_addr_str++;
+        if (last_addr_str == MAX_ADDR_STR)
+                last_addr_str = 0;
+        spin_unlock(&addr_str_lock);
+        s = addr_str[i];
+
+        switch (ss->ss_family) {
+        case AF_INET:
+                snprintf(s, MAX_ADDR_STR_LEN, "%pI4:%u", &in4->sin_addr,
+                         (unsigned int)ntohs(in4->sin_port));
+                break;
+
+        case AF_INET6:
+                snprintf(s, MAX_ADDR_STR_LEN, "[%pI6c]:%u", &in6->sin6_addr,
+                         (unsigned int)ntohs(in6->sin6_port));
+                break;
+
+        default:
+                sprintf(s, "(unknown sockaddr family %d)", (int)ss->ss_family);
+        }
+
+        return s;
+}
+EXPORT_SYMBOL(ceph_pr_addr);
+
+static void encode_my_addr(struct ceph_messenger *msgr)
+{
+        memcpy(&msgr->my_enc_addr, &msgr->inst.addr, sizeof(msgr->my_enc_addr));
+        ceph_encode_addr(&msgr->my_enc_addr);
+}
+
+/*
+ * work queue for all reading and writing to/from the socket.
+ */
+struct workqueue_struct *ceph_msgr_wq;
+
+int ceph_msgr_init(void)
+{
+        ceph_msgr_wq = create_workqueue("ceph-msgr");
+        if (IS_ERR(ceph_msgr_wq)) {
+                int ret = PTR_ERR(ceph_msgr_wq);
+                pr_err("msgr_init failed to create workqueue: %d\n", ret);
+                ceph_msgr_wq = NULL;
+                return ret;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(ceph_msgr_init);
+
+void ceph_msgr_exit(void)
+{
+        destroy_workqueue(ceph_msgr_wq);
+}
+EXPORT_SYMBOL(ceph_msgr_exit);
+
+void ceph_msgr_flush(void)
+{
+        flush_workqueue(ceph_msgr_wq);
+}
+EXPORT_SYMBOL(ceph_msgr_flush);
+
+
+/*
+ * socket callback functions
+ */
+
+/* data available on socket, or listen socket received a connect */
+static void ceph_data_ready(struct sock *sk, int count_unused)
+{
+        struct ceph_connection *con =
+                (struct ceph_connection *)sk->sk_user_data;
+        if (sk->sk_state != TCP_CLOSE_WAIT) {
+                dout("ceph_data_ready on %p state = %lu, queueing work\n",
+                     con, con->state);
+                queue_con(con);
+        }
+}
+
+/* socket has buffer space for writing */
+static void ceph_write_space(struct sock *sk)
+{
+        struct ceph_connection *con =
+                (struct ceph_connection *)sk->sk_user_data;
+
+        /* only queue to workqueue if there is data we want to write. */
+        if (test_bit(WRITE_PENDING, &con->state)) {
+                dout("ceph_write_space %p queueing write work\n", con);
+                queue_con(con);
+        } else {
+                dout("ceph_write_space %p nothing to write\n", con);
+        }
+
+        /* since we have our own write_space, clear the SOCK_NOSPACE flag */
+        clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
+}
+
+/* socket's state has changed */
+static void ceph_state_change(struct sock *sk)
+{
+        struct ceph_connection *con =
+                (struct ceph_connection *)sk->sk_user_data;
+
+        dout("ceph_state_change %p state = %lu sk_state = %u\n",
+             con, con->state, sk->sk_state);
+
+        if (test_bit(CLOSED, &con->state))
+                return;
+
+        switch (sk->sk_state) {
+        case TCP_CLOSE:
+                dout("ceph_state_change TCP_CLOSE\n");
+        case TCP_CLOSE_WAIT:
+                dout("ceph_state_change TCP_CLOSE_WAIT\n");
+                if (test_and_set_bit(SOCK_CLOSED, &con->state) == 0) {
+                        if (test_bit(CONNECTING, &con->state))
+                                con->error_msg = "connection failed";
+                        else
+                                con->error_msg = "socket closed";
+                        queue_con(con);
+                }
+                break;
+        case TCP_ESTABLISHED:
+                dout("ceph_state_change TCP_ESTABLISHED\n");
+                queue_con(con);
+                break;
+        }
+}
+
+/*
+ * set up socket callbacks
+ */
+static void set_sock_callbacks(struct socket *sock,
+                               struct ceph_connection *con)
+{
+        struct sock *sk = sock->sk;
+        sk->sk_user_data = (void *)con;
+        sk->sk_data_ready = ceph_data_ready;
+        sk->sk_write_space = ceph_write_space;
+        sk->sk_state_change = ceph_state_change;
+}
+
+
+/*
+ * socket helpers
+ */
+
+/*
+ * initiate connection to a remote socket.
+ */
+static struct socket *ceph_tcp_connect(struct ceph_connection *con)
+{
+        struct sockaddr_storage *paddr = &con->peer_addr.in_addr;
+        struct socket *sock;
+        int ret;
+
+        BUG_ON(con->sock);
+        ret = sock_create_kern(con->peer_addr.in_addr.ss_family, SOCK_STREAM,
+                               IPPROTO_TCP, &sock);
+        if (ret)
+                return ERR_PTR(ret);
+        con->sock = sock;
+        sock->sk->sk_allocation = GFP_NOFS;
+
+#ifdef CONFIG_LOCKDEP
+        lockdep_set_class(&sock->sk->sk_lock, &socket_class);
+#endif
+
+        set_sock_callbacks(sock, con);
+
+        dout("connect %s\n", ceph_pr_addr(&con->peer_addr.in_addr));
+
+        ret = sock->ops->connect(sock, (struct sockaddr *)paddr, sizeof(*paddr),
+                                 O_NONBLOCK);
+        if (ret == -EINPROGRESS) {
+                dout("connect %s EINPROGRESS sk_state = %u\n",
+                     ceph_pr_addr(&con->peer_addr.in_addr),
+                     sock->sk->sk_state);
+                ret = 0;
+        }
+        if (ret < 0) {
+                pr_err("connect %s error %d\n",
+                       ceph_pr_addr(&con->peer_addr.in_addr), ret);
+                sock_release(sock);
+                con->sock = NULL;
+                con->error_msg = "connect error";
+        }
+
+        if (ret < 0)
+                return ERR_PTR(ret);
+        return sock;
+}
+
+static int ceph_tcp_recvmsg(struct socket *sock, void *buf, size_t len)
+{
+        struct kvec iov = {buf, len};
+        struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL };
+
+        return kernel_recvmsg(sock, &msg, &iov, 1, len, msg.msg_flags);
+}
+
+/*
+ * write something.  @more is true if caller will be sending more data
+ * shortly.
+ */
+static int ceph_tcp_sendmsg(struct socket *sock, struct kvec *iov,
+                     size_t kvlen, size_t len, int more)
+{
+        struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL };
+
+        if (more)
+                msg.msg_flags |= MSG_MORE;
+        else
+                msg.msg_flags |= MSG_EOR;  /* superfluous, but what the hell */
+
+        return kernel_sendmsg(sock, &msg, iov, kvlen, len);
+}
+
+
+/*
+ * Shutdown/close the socket for the given connection.
+ */
+static int con_close_socket(struct ceph_connection *con)
+{
+        int rc;
+
+        dout("con_close_socket on %p sock %p\n", con, con->sock);
+        if (!con->sock)
+                return 0;
+        set_bit(SOCK_CLOSED, &con->state);
+        rc = con->sock->ops->shutdown(con->sock, SHUT_RDWR);
+        sock_release(con->sock);
+        con->sock = NULL;
+        clear_bit(SOCK_CLOSED, &con->state);
+        return rc;
+}
+
+/*
+ * Reset a connection.  Discard all incoming and outgoing messages
+ * and clear *_seq state.
+ */
+static void ceph_msg_remove(struct ceph_msg *msg)
+{
+        list_del_init(&msg->list_head);
+        ceph_msg_put(msg);
+}
+static void ceph_msg_remove_list(struct list_head *head)
+{
+        while (!list_empty(head)) {
+                struct ceph_msg *msg = list_first_entry(head, struct ceph_msg,
+                                                        list_head);
+                ceph_msg_remove(msg);
+        }
+}
+
+static void reset_connection(struct ceph_connection *con)
+{
+        /* reset connection, out_queue, msg_ and connect_seq */
+        /* discard existing out_queue and msg_seq */
+        ceph_msg_remove_list(&con->out_queue);
+        ceph_msg_remove_list(&con->out_sent);
+
+        if (con->in_msg) {
+                ceph_msg_put(con->in_msg);
+                con->in_msg = NULL;
+        }
+
+        con->connect_seq = 0;
+        con->out_seq = 0;
+        if (con->out_msg) {
+                ceph_msg_put(con->out_msg);
+                con->out_msg = NULL;
+        }
+        con->out_keepalive_pending = false;
+        con->in_seq = 0;
+        con->in_seq_acked = 0;
+}
+
+/*
+ * mark a peer down.  drop any open connections.
+ */
+void ceph_con_close(struct ceph_connection *con)
+{
+        dout("con_close %p peer %s\n", con,
+             ceph_pr_addr(&con->peer_addr.in_addr));
+        set_bit(CLOSED, &con->state);  /* in case there's queued work */
+        clear_bit(STANDBY, &con->state);  /* avoid connect_seq bump */
+        clear_bit(LOSSYTX, &con->state);  /* so we retry next connect */
+        clear_bit(KEEPALIVE_PENDING, &con->state);
+        clear_bit(WRITE_PENDING, &con->state);
+        mutex_lock(&con->mutex);
+        reset_connection(con);
+        con->peer_global_seq = 0;
+        cancel_delayed_work(&con->work);
+        mutex_unlock(&con->mutex);
+        queue_con(con);
+}
+EXPORT_SYMBOL(ceph_con_close);
+
+/*
+ * Reopen a closed connection, with a new peer address.
+ */
+void ceph_con_open(struct ceph_connection *con, struct ceph_entity_addr *addr)
+{
+        dout("con_open %p %s\n", con, ceph_pr_addr(&addr->in_addr));
+        set_bit(OPENING, &con->state);
+        clear_bit(CLOSED, &con->state);
+        memcpy(&con->peer_addr, addr, sizeof(*addr));
+        con->delay = 0;      /* reset backoff memory */
+        queue_con(con);
+}
+EXPORT_SYMBOL(ceph_con_open);
+
+/*
+ * return true if this connection ever successfully opened
+ */
+bool ceph_con_opened(struct ceph_connection *con)
+{
+        return con->connect_seq > 0;
+}
+
+/*
+ * generic get/put
+ */
+struct ceph_connection *ceph_con_get(struct ceph_connection *con)
+{
+        dout("con_get %p nref = %d -> %d\n", con,
+             atomic_read(&con->nref), atomic_read(&con->nref) + 1);
+        if (atomic_inc_not_zero(&con->nref))
+                return con;
+        return NULL;
+}
+
+void ceph_con_put(struct ceph_connection *con)
+{
+        dout("con_put %p nref = %d -> %d\n", con,
+             atomic_read(&con->nref), atomic_read(&con->nref) - 1);
+        BUG_ON(atomic_read(&con->nref) == 0);
+        if (atomic_dec_and_test(&con->nref)) {
+                BUG_ON(con->sock);
+                kfree(con);
+        }
+}
+
+/*
+ * initialize a new connection.
+ */
+void ceph_con_init(struct ceph_messenger *msgr, struct ceph_connection *con)
+{
+        dout("con_init %p\n", con);
+        memset(con, 0, sizeof(*con));
+        atomic_set(&con->nref, 1);
+        con->msgr = msgr;
+        mutex_init(&con->mutex);
+        INIT_LIST_HEAD(&con->out_queue);
+        INIT_LIST_HEAD(&con->out_sent);
+        INIT_DELAYED_WORK(&con->work, con_work);
+}
+EXPORT_SYMBOL(ceph_con_init);
+
+
+/*
+ * We maintain a global counter to order connection attempts.  Get
+ * a unique seq greater than @gt.
+ */
+static u32 get_global_seq(struct ceph_messenger *msgr, u32 gt)
+{
+        u32 ret;
+
+        spin_lock(&msgr->global_seq_lock);
+        if (msgr->global_seq < gt)
+                msgr->global_seq = gt;
+        ret = ++msgr->global_seq;
+        spin_unlock(&msgr->global_seq_lock);
+        return ret;
+}
+
+
+/*
+ * Prepare footer for currently outgoing message, and finish things
+ * off.  Assumes out_kvec* are already valid.. we just add on to the end.
+ */
+static void prepare_write_message_footer(struct ceph_connection *con, int v)
+{
+        struct ceph_msg *m = con->out_msg;
+
+        dout("prepare_write_message_footer %p\n", con);
+        con->out_kvec_is_msg = true;
+        con->out_kvec[v].iov_base = &m->footer;
+        con->out_kvec[v].iov_len = sizeof(m->footer);
+        con->out_kvec_bytes += sizeof(m->footer);
+        con->out_kvec_left++;
+        con->out_more = m->more_to_follow;
+        con->out_msg_done = true;
+}
+
+/*
+ * Prepare headers for the next outgoing message.
+ */
+static void prepare_write_message(struct ceph_connection *con)
+{
+        struct ceph_msg *m;
+        int v = 0;
+
+        con->out_kvec_bytes = 0;
+        con->out_kvec_is_msg = true;
+        con->out_msg_done = false;
+
+        /* Sneak an ack in there first?  If we can get it into the same
+         * TCP packet that's a good thing. */
+        if (con->in_seq > con->in_seq_acked) {
+                con->in_seq_acked = con->in_seq;
+                con->out_kvec[v].iov_base = &tag_ack;
+                con->out_kvec[v++].iov_len = 1;
+                con->out_temp_ack = cpu_to_le64(con->in_seq_acked);
+                con->out_kvec[v].iov_base = &con->out_temp_ack;
+                con->out_kvec[v++].iov_len = sizeof(con->out_temp_ack);
+                con->out_kvec_bytes = 1 + sizeof(con->out_temp_ack);
+        }
+
+        m = list_first_entry(&con->out_queue,
+                       struct ceph_msg, list_head);
+        con->out_msg = m;
+        if (test_bit(LOSSYTX, &con->state)) {
+                list_del_init(&m->list_head);
+        } else {
+                /* put message on sent list */
+                ceph_msg_get(m);
+                list_move_tail(&m->list_head, &con->out_sent);
+        }
+
+        /*
+         * only assign outgoing seq # if we haven't sent this message
+         * yet.  if it is requeued, resend with it's original seq.
+         */
+        if (m->needs_out_seq) {
+                m->hdr.seq = cpu_to_le64(++con->out_seq);
+                m->needs_out_seq = false;
+        }
+
+        dout("prepare_write_message %p seq %lld type %d len %d+%d+%d %d pgs\n",
+             m, con->out_seq, le16_to_cpu(m->hdr.type),
+             le32_to_cpu(m->hdr.front_len), le32_to_cpu(m->hdr.middle_len),
+             le32_to_cpu(m->hdr.data_len),
+             m->nr_pages);
+        BUG_ON(le32_to_cpu(m->hdr.front_len) != m->front.iov_len);
+
+        /* tag + hdr + front + middle */
+        con->out_kvec[v].iov_base = &tag_msg;
+        con->out_kvec[v++].iov_len = 1;
+        con->out_kvec[v].iov_base = &m->hdr;
+        con->out_kvec[v++].iov_len = sizeof(m->hdr);
+        con->out_kvec[v++] = m->front;
+        if (m->middle)
+                con->out_kvec[v++] = m->middle->vec;
+        con->out_kvec_left = v;
+        con->out_kvec_bytes += 1 + sizeof(m->hdr) + m->front.iov_len +
+                (m->middle ? m->middle->vec.iov_len : 0);
+        con->out_kvec_cur = con->out_kvec;
+
+        /* fill in crc (except data pages), footer */
+        con->out_msg->hdr.crc =
+                cpu_to_le32(crc32c(0, (void *)&m->hdr,
+                                      sizeof(m->hdr) - sizeof(m->hdr.crc)));
+        con->out_msg->footer.flags = CEPH_MSG_FOOTER_COMPLETE;
+        con->out_msg->footer.front_crc =
+                cpu_to_le32(crc32c(0, m->front.iov_base, m->front.iov_len));
+        if (m->middle)
+                con->out_msg->footer.middle_crc =
+                        cpu_to_le32(crc32c(0, m->middle->vec.iov_base,
+                                           m->middle->vec.iov_len));
+        else
+                con->out_msg->footer.middle_crc = 0;
+        con->out_msg->footer.data_crc = 0;
+        dout("prepare_write_message front_crc %u data_crc %u\n",
+             le32_to_cpu(con->out_msg->footer.front_crc),
+             le32_to_cpu(con->out_msg->footer.middle_crc));
+
+        /* is there a data payload? */
+        if (le32_to_cpu(m->hdr.data_len) > 0) {
+                /* initialize page iterator */
+                con->out_msg_pos.page = 0;
+                if (m->pages)
+                        con->out_msg_pos.page_pos =
+                                le16_to_cpu(m->hdr.data_off) & ~PAGE_MASK;
+                else
+                        con->out_msg_pos.page_pos = 0;
+                con->out_msg_pos.data_pos = 0;
+                con->out_msg_pos.did_page_crc = 0;
+                con->out_more = 1;  /* data + footer will follow */
+        } else {
+                /* no, queue up footer too and be done */
+                prepare_write_message_footer(con, v);
+        }
+
+        set_bit(WRITE_PENDING, &con->state);
+}
+
+/*
+ * Prepare an ack.
+ */
+static void prepare_write_ack(struct ceph_connection *con)
+{
+        dout("prepare_write_ack %p %llu -> %llu\n", con,
+             con->in_seq_acked, con->in_seq);
+        con->in_seq_acked = con->in_seq;
+
+        con->out_kvec[0].iov_base = &tag_ack;
+        con->out_kvec[0].iov_len = 1;
+        con->out_temp_ack = cpu_to_le64(con->in_seq_acked);
+        con->out_kvec[1].iov_base = &con->out_temp_ack;
+        con->out_kvec[1].iov_len = sizeof(con->out_temp_ack);
+        con->out_kvec_left = 2;
+        con->out_kvec_bytes = 1 + sizeof(con->out_temp_ack);
+        con->out_kvec_cur = con->out_kvec;
+        con->out_more = 1;  /* more will follow.. eventually.. */
+        set_bit(WRITE_PENDING, &con->state);
+}
+
+/*
+ * Prepare to write keepalive byte.
+ */
+static void prepare_write_keepalive(struct ceph_connection *con)
+{
+        dout("prepare_write_keepalive %p\n", con);
+        con->out_kvec[0].iov_base = &tag_keepalive;
+        con->out_kvec[0].iov_len = 1;
+        con->out_kvec_left = 1;
+        con->out_kvec_bytes = 1;
+        con->out_kvec_cur = con->out_kvec;
+        set_bit(WRITE_PENDING, &con->state);
+}
+
+/*
+ * Connection negotiation.
+ */
+
+static void prepare_connect_authorizer(struct ceph_connection *con)
+{
+        void *auth_buf;
+        int auth_len = 0;
+        int auth_protocol = 0;
+
+        mutex_unlock(&con->mutex);
+        if (con->ops->get_authorizer)
+                con->ops->get_authorizer(con, &auth_buf, &auth_len,
+                                         &auth_protocol, &con->auth_reply_buf,
+                                         &con->auth_reply_buf_len,
+                                         con->auth_retry);
+        mutex_lock(&con->mutex);
+
+        con->out_connect.authorizer_protocol = cpu_to_le32(auth_protocol);
+        con->out_connect.authorizer_len = cpu_to_le32(auth_len);
+
+        con->out_kvec[con->out_kvec_left].iov_base = auth_buf;
+        con->out_kvec[con->out_kvec_left].iov_len = auth_len;
+        con->out_kvec_left++;
+        con->out_kvec_bytes += auth_len;
+}
+
+/*
+ * We connected to a peer and are saying hello.
+ */
+static void prepare_write_banner(struct ceph_messenger *msgr,
+                                 struct ceph_connection *con)
+{
+        int len = strlen(CEPH_BANNER);
+
+        con->out_kvec[0].iov_base = CEPH_BANNER;
+        con->out_kvec[0].iov_len = len;
+        con->out_kvec[1].iov_base = &msgr->my_enc_addr;
+        con->out_kvec[1].iov_len = sizeof(msgr->my_enc_addr);
+        con->out_kvec_left = 2;
+        con->out_kvec_bytes = len + sizeof(msgr->my_enc_addr);
+        con->out_kvec_cur = con->out_kvec;
+        con->out_more = 0;
+        set_bit(WRITE_PENDING, &con->state);
+}
+
+static void prepare_write_connect(struct ceph_messenger *msgr,
+                                  struct ceph_connection *con,
+                                  int after_banner)
+{
+        unsigned global_seq = get_global_seq(con->msgr, 0);
+        int proto;
+
+        switch (con->peer_name.type) {
+        case CEPH_ENTITY_TYPE_MON:
+                proto = CEPH_MONC_PROTOCOL;
+                break;
+        case CEPH_ENTITY_TYPE_OSD:
+                proto = CEPH_OSDC_PROTOCOL;
+                break;
+        case CEPH_ENTITY_TYPE_MDS:
+                proto = CEPH_MDSC_PROTOCOL;
+                break;
+        default:
+                BUG();
+        }
+
+        dout("prepare_write_connect %p cseq=%d gseq=%d proto=%d\n", con,
+             con->connect_seq, global_seq, proto);
+
+        con->out_connect.features = cpu_to_le64(msgr->supported_features);
+        con->out_connect.host_type = cpu_to_le32(CEPH_ENTITY_TYPE_CLIENT);
+        con->out_connect.connect_seq = cpu_to_le32(con->connect_seq);
+        con->out_connect.global_seq = cpu_to_le32(global_seq);
+        con->out_connect.protocol_version = cpu_to_le32(proto);
+        con->out_connect.flags = 0;
+
+        if (!after_banner) {
+                con->out_kvec_left = 0;
+                con->out_kvec_bytes = 0;
+        }
+        con->out_kvec[con->out_kvec_left].iov_base = &con->out_connect;
+        con->out_kvec[con->out_kvec_left].iov_len = sizeof(con->out_connect);
+        con->out_kvec_left++;
+        con->out_kvec_bytes += sizeof(con->out_connect);
+        con->out_kvec_cur = con->out_kvec;
+        con->out_more = 0;
+        set_bit(WRITE_PENDING, &con->state);
+
+        prepare_connect_authorizer(con);
+}
+
+
+/*
+ * write as much of pending kvecs to the socket as we can.
+ *  1 -> done
+ *  0 -> socket full, but more to do
+ * <0 -> error
+ */
+static int write_partial_kvec(struct ceph_connection *con)
+{
+        int ret;
+
+        dout("write_partial_kvec %p %d left\n", con, con->out_kvec_bytes);
+        while (con->out_kvec_bytes > 0) {
+                ret = ceph_tcp_sendmsg(con->sock, con->out_kvec_cur,
+                                       con->out_kvec_left, con->out_kvec_bytes,
+                                       con->out_more);
+                if (ret <= 0)
+                        goto out;
+                con->out_kvec_bytes -= ret;
+                if (con->out_kvec_bytes == 0)
+                        break;            /* done */
+                while (ret > 0) {
+                        if (ret >= con->out_kvec_cur->iov_len) {
+                                ret -= con->out_kvec_cur->iov_len;
+                                con->out_kvec_cur++;
+                                con->out_kvec_left--;
+                        } else {
+                                con->out_kvec_cur->iov_len -= ret;
+                                con->out_kvec_cur->iov_base += ret;
+                                ret = 0;
+                                break;
+                        }
+                }
+        }
+        con->out_kvec_left = 0;
+        con->out_kvec_is_msg = false;
+        ret = 1;
+out:
+        dout("write_partial_kvec %p %d left in %d kvecs ret = %d\n", con,
+             con->out_kvec_bytes, con->out_kvec_left, ret);
+        return ret;  /* done! */
+}
+
+#ifdef CONFIG_BLOCK
+static void init_bio_iter(struct bio *bio, struct bio **iter, int *seg)
+{
+        if (!bio) {
+                *iter = NULL;
+                *seg = 0;
+                return;
+        }
+        *iter = bio;
+        *seg = bio->bi_idx;
+}
+
+static void iter_bio_next(struct bio **bio_iter, int *seg)
+{
+        if (*bio_iter == NULL)
+                return;
+
+        BUG_ON(*seg >= (*bio_iter)->bi_vcnt);
+
+        (*seg)++;
+        if (*seg == (*bio_iter)->bi_vcnt)
+                init_bio_iter((*bio_iter)->bi_next, bio_iter, seg);
+}
+#endif
+
+/*
+ * Write as much message data payload as we can.  If we finish, queue
+ * up the footer.
+ *  1 -> done, footer is now queued in out_kvec[].
+ *  0 -> socket full, but more to do
+ * <0 -> error
+ */
+static int write_partial_msg_pages(struct ceph_connection *con)
+{
+        struct ceph_msg *msg = con->out_msg;
+        unsigned data_len = le32_to_cpu(msg->hdr.data_len);
+        size_t len;
+        int crc = con->msgr->nocrc;
+        int ret;
+        int total_max_write;
+        int in_trail = 0;
+        size_t trail_len = (msg->trail ? msg->trail->length : 0);
+
+        dout("write_partial_msg_pages %p msg %p page %d/%d offset %d\n",
+             con, con->out_msg, con->out_msg_pos.page, con->out_msg->nr_pages,
+             con->out_msg_pos.page_pos);
+
+#ifdef CONFIG_BLOCK
+        if (msg->bio && !msg->bio_iter)
+                init_bio_iter(msg->bio, &msg->bio_iter, &msg->bio_seg);
+#endif
+
+        while (data_len > con->out_msg_pos.data_pos) {
+                struct page *page = NULL;
+                void *kaddr = NULL;
+                int max_write = PAGE_SIZE;
+                int page_shift = 0;
+
+                total_max_write = data_len - trail_len -
+                        con->out_msg_pos.data_pos;
+
+                /*
+                 * if we are calculating the data crc (the default), we need
+                 * to map the page.  if our pages[] has been revoked, use the
+                 * zero page.
+                 */
+
+                /* have we reached the trail part of the data? */
+                if (con->out_msg_pos.data_pos >= data_len - trail_len) {
+                        in_trail = 1;
+
+                        total_max_write = data_len - con->out_msg_pos.data_pos;
+
+                        page = list_first_entry(&msg->trail->head,
+                                                struct page, lru);
+                        if (crc)
+                                kaddr = kmap(page);
+                        max_write = PAGE_SIZE;
+                } else if (msg->pages) {
+                        page = msg->pages[con->out_msg_pos.page];
+                        if (crc)
+                                kaddr = kmap(page);
+                } else if (msg->pagelist) {
+                        page = list_first_entry(&msg->pagelist->head,
+                                                struct page, lru);
+                        if (crc)
+                                kaddr = kmap(page);
+#ifdef CONFIG_BLOCK
+                } else if (msg->bio) {
+                        struct bio_vec *bv;
+
+                        bv = bio_iovec_idx(msg->bio_iter, msg->bio_seg);
+                        page = bv->bv_page;
+                        page_shift = bv->bv_offset;
+                        if (crc)
+                                kaddr = kmap(page) + page_shift;
+                        max_write = bv->bv_len;
+#endif
+                } else {
+                        page = con->msgr->zero_page;
+                        if (crc)
+                                kaddr = page_address(con->msgr->zero_page);
+                }
+                len = min_t(int, max_write - con->out_msg_pos.page_pos,
+                            total_max_write);
+
+                if (crc && !con->out_msg_pos.did_page_crc) {
+                        void *base = kaddr + con->out_msg_pos.page_pos;
+                        u32 tmpcrc = le32_to_cpu(con->out_msg->footer.data_crc);
+
+                        BUG_ON(kaddr == NULL);
+                        con->out_msg->footer.data_crc =
+                                cpu_to_le32(crc32c(tmpcrc, base, len));
+                        con->out_msg_pos.did_page_crc = 1;
+                }
+                ret = kernel_sendpage(con->sock, page,
+                                      con->out_msg_pos.page_pos + page_shift,
+                                      len,
+                                      MSG_DONTWAIT | MSG_NOSIGNAL |
+                                      MSG_MORE);
+
+                if (crc &&
+                    (msg->pages || msg->pagelist || msg->bio || in_trail))
+                        kunmap(page);
+
+                if (ret <= 0)
+                        goto out;
+
+                con->out_msg_pos.data_pos += ret;
+                con->out_msg_pos.page_pos += ret;
+                if (ret == len) {
+                        con->out_msg_pos.page_pos = 0;
+                        con->out_msg_pos.page++;
+                        con->out_msg_pos.did_page_crc = 0;
+                        if (in_trail)
+                                list_move_tail(&page->lru,
+                                               &msg->trail->head);
+                        else if (msg->pagelist)
+                                list_move_tail(&page->lru,
+                                               &msg->pagelist->head);
+#ifdef CONFIG_BLOCK
+                        else if (msg->bio)
+                                iter_bio_next(&msg->bio_iter, &msg->bio_seg);
+#endif
+                }
+        }
+
+        dout("write_partial_msg_pages %p msg %p done\n", con, msg);
+
+        /* prepare and queue up footer, too */
+        if (!crc)
+                con->out_msg->footer.flags |= CEPH_MSG_FOOTER_NOCRC;
+        con->out_kvec_bytes = 0;
+        con->out_kvec_left = 0;
+        con->out_kvec_cur = con->out_kvec;
+        prepare_write_message_footer(con, 0);
+        ret = 1;
+out:
+        return ret;
+}
+
+/*
+ * write some zeros
+ */
+static int write_partial_skip(struct ceph_connection *con)
+{
+        int ret;
+
+        while (con->out_skip > 0) {
+                struct kvec iov = {
+                        .iov_base = page_address(con->msgr->zero_page),
+                        .iov_len = min(con->out_skip, (int)PAGE_CACHE_SIZE)
+                };
+
+                ret = ceph_tcp_sendmsg(con->sock, &iov, 1, iov.iov_len, 1);
+                if (ret <= 0)
+                        goto out;
+                con->out_skip -= ret;
+        }
+        ret = 1;
+out:
+        return ret;
+}
+
+/*
+ * Prepare to read connection handshake, or an ack.
+ */
+static void prepare_read_banner(struct ceph_connection *con)
+{
+        dout("prepare_read_banner %p\n", con);
+        con->in_base_pos = 0;
+}
+
+static void prepare_read_connect(struct ceph_connection *con)
+{
+        dout("prepare_read_connect %p\n", con);
+        con->in_base_pos = 0;
+}
+
+static void prepare_read_ack(struct ceph_connection *con)
+{
+        dout("prepare_read_ack %p\n", con);
+        con->in_base_pos = 0;
+}
+
+static void prepare_read_tag(struct ceph_connection *con)
+{
+        dout("prepare_read_tag %p\n", con);
+        con->in_base_pos = 0;
+        con->in_tag = CEPH_MSGR_TAG_READY;
+}
+
+/*
+ * Prepare to read a message.
+ */
+static int prepare_read_message(struct ceph_connection *con)
+{
+        dout("prepare_read_message %p\n", con);
+        BUG_ON(con->in_msg != NULL);
+        con->in_base_pos = 0;
+        con->in_front_crc = con->in_middle_crc = con->in_data_crc = 0;
+        return 0;
+}
+
+
+static int read_partial(struct ceph_connection *con,
+                        int *to, int size, void *object)
+{
+        *to += size;
+        while (con->in_base_pos < *to) {
+                int left = *to - con->in_base_pos;
+                int have = size - left;
+                int ret = ceph_tcp_recvmsg(con->sock, object + have, left);
+                if (ret <= 0)
+                        return ret;
+                con->in_base_pos += ret;
+        }
+        return 1;
+}
+
+
+/*
+ * Read all or part of the connect-side handshake on a new connection
+ */
+static int read_partial_banner(struct ceph_connection *con)
+{
+        int ret, to = 0;
+
+        dout("read_partial_banner %p at %d\n", con, con->in_base_pos);
+
+        /* peer's banner */
+        ret = read_partial(con, &to, strlen(CEPH_BANNER), con->in_banner);
+        if (ret <= 0)
+                goto out;
+        ret = read_partial(con, &to, sizeof(con->actual_peer_addr),
+                           &con->actual_peer_addr);
+        if (ret <= 0)
+                goto out;
+        ret = read_partial(con, &to, sizeof(con->peer_addr_for_me),
+                           &con->peer_addr_for_me);
+        if (ret <= 0)
+                goto out;
+out:
+        return ret;
+}
+
+static int read_partial_connect(struct ceph_connection *con)
+{
+        int ret, to = 0;
+
+        dout("read_partial_connect %p at %d\n", con, con->in_base_pos);
+
+        ret = read_partial(con, &to, sizeof(con->in_reply), &con->in_reply);
+        if (ret <= 0)
+                goto out;
+        ret = read_partial(con, &to, le32_to_cpu(con->in_reply.authorizer_len),
+                           con->auth_reply_buf);
+        if (ret <= 0)
+                goto out;
+
+        dout("read_partial_connect %p tag %d, con_seq = %u, g_seq = %u\n",
+             con, (int)con->in_reply.tag,
+             le32_to_cpu(con->in_reply.connect_seq),
+             le32_to_cpu(con->in_reply.global_seq));
+out:
+        return ret;
+
+}
+
+/*
+ * Verify the hello banner looks okay.
+ */
+static int verify_hello(struct ceph_connection *con)
+{
+        if (memcmp(con->in_banner, CEPH_BANNER, strlen(CEPH_BANNER))) {
+                pr_err("connect to %s got bad banner\n",
+                       ceph_pr_addr(&con->peer_addr.in_addr));
+                con->error_msg = "protocol error, bad banner";
+                return -1;
+        }
+        return 0;
+}
+
+static bool addr_is_blank(struct sockaddr_storage *ss)
+{
+        switch (ss->ss_family) {
+        case AF_INET:
+                return ((struct sockaddr_in *)ss)->sin_addr.s_addr == 0;
+        case AF_INET6:
+                return
+                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[0] == 0 &&
+                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[1] == 0 &&
+                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[2] == 0 &&
+                     ((struct sockaddr_in6 *)ss)->sin6_addr.s6_addr32[3] == 0;
+        }
+        return false;
+}
+
+static int addr_port(struct sockaddr_storage *ss)
+{
+        switch (ss->ss_family) {
+        case AF_INET:
+                return ntohs(((struct sockaddr_in *)ss)->sin_port);
+        case AF_INET6:
+                return ntohs(((struct sockaddr_in6 *)ss)->sin6_port);
+        }
+        return 0;
+}
+
+static void addr_set_port(struct sockaddr_storage *ss, int p)
+{
+        switch (ss->ss_family) {
+        case AF_INET:
+                ((struct sockaddr_in *)ss)->sin_port = htons(p);
+        case AF_INET6:
+                ((struct sockaddr_in6 *)ss)->sin6_port = htons(p);
+        }
+}
+
+/*
+ * Parse an ip[:port] list into an addr array.  Use the default
+ * monitor port if a port isn't specified.
+ */
+int ceph_parse_ips(const char *c, const char *end,
+                   struct ceph_entity_addr *addr,
+                   int max_count, int *count)
+{
+        int i;
+        const char *p = c;
+
+        dout("parse_ips on '%.*s'\n", (int)(end-c), c);
+        for (i = 0; i < max_count; i++) {
+                const char *ipend;
+                struct sockaddr_storage *ss = &addr[i].in_addr;
+                struct sockaddr_in *in4 = (void *)ss;
+                struct sockaddr_in6 *in6 = (void *)ss;
+                int port;
+                char delim = ',';
+
+                if (*p == '[') {
+                        delim = ']';
+                        p++;
+                }
+
+                memset(ss, 0, sizeof(*ss));
+                if (in4_pton(p, end - p, (u8 *)&in4->sin_addr.s_addr,
+                             delim, &ipend))
+                        ss->ss_family = AF_INET;
+                else if (in6_pton(p, end - p, (u8 *)&in6->sin6_addr.s6_addr,
+                                  delim, &ipend))
+                        ss->ss_family = AF_INET6;
+                else
+                        goto bad;
+                p = ipend;
+
+                if (delim == ']') {
+                        if (*p != ']') {
+                                dout("missing matching ']'\n");
+                                goto bad;
+                        }
+                        p++;
+                }
+
+                /* port? */
+                if (p < end && *p == ':') {
+                        port = 0;
+                        p++;
+                        while (p < end && *p >= '0' && *p <= '9') {
+                                port = (port * 10) + (*p - '0');
+                                p++;
+                        }
+                        if (port > 65535 || port == 0)
+                                goto bad;
+                } else {
+                        port = CEPH_MON_PORT;
+                }
+
+                addr_set_port(ss, port);
+
+                dout("parse_ips got %s\n", ceph_pr_addr(ss));
+
+                if (p == end)
+                        break;
+                if (*p != ',')
+                        goto bad;
+                p++;
+        }
+
+        if (p != end)
+                goto bad;
+
+        if (count)
+                *count = i + 1;
+        return 0;
+
+bad:
+        pr_err("parse_ips bad ip '%.*s'\n", (int)(end - c), c);
+        return -EINVAL;
+}
+EXPORT_SYMBOL(ceph_parse_ips);
+
+static int process_banner(struct ceph_connection *con)
+{
+        dout("process_banner on %p\n", con);
+
+        if (verify_hello(con) < 0)
+                return -1;
+
+        ceph_decode_addr(&con->actual_peer_addr);
+        ceph_decode_addr(&con->peer_addr_for_me);
+
+        /*
+         * Make sure the other end is who we wanted.  note that the other
+         * end may not yet know their ip address, so if it's 0.0.0.0, give
+         * them the benefit of the doubt.
+         */
+        if (memcmp(&con->peer_addr, &con->actual_peer_addr,
+                   sizeof(con->peer_addr)) != 0 &&
+            !(addr_is_blank(&con->actual_peer_addr.in_addr) &&
+              con->actual_peer_addr.nonce == con->peer_addr.nonce)) {
+                pr_warning("wrong peer, want %s/%d, got %s/%d\n",
+                           ceph_pr_addr(&con->peer_addr.in_addr),
+                           (int)le32_to_cpu(con->peer_addr.nonce),
+                           ceph_pr_addr(&con->actual_peer_addr.in_addr),
+                           (int)le32_to_cpu(con->actual_peer_addr.nonce));
+                con->error_msg = "wrong peer at address";
+                return -1;
+        }
+
+        /*
+         * did we learn our address?
+         */
+        if (addr_is_blank(&con->msgr->inst.addr.in_addr)) {
+                int port = addr_port(&con->msgr->inst.addr.in_addr);
+
+                memcpy(&con->msgr->inst.addr.in_addr,
+                       &con->peer_addr_for_me.in_addr,
+                       sizeof(con->peer_addr_for_me.in_addr));
+                addr_set_port(&con->msgr->inst.addr.in_addr, port);
+                encode_my_addr(con->msgr);
+                dout("process_banner learned my addr is %s\n",
+                     ceph_pr_addr(&con->msgr->inst.addr.in_addr));
+        }
+
+        set_bit(NEGOTIATING, &con->state);
+        prepare_read_connect(con);
+        return 0;
+}
+
+static void fail_protocol(struct ceph_connection *con)
+{
+        reset_connection(con);
+        set_bit(CLOSED, &con->state);  /* in case there's queued work */
+
+        mutex_unlock(&con->mutex);
+        if (con->ops->bad_proto)
+                con->ops->bad_proto(con);
+        mutex_lock(&con->mutex);
+}
+
+static int process_connect(struct ceph_connection *con)
+{
+        u64 sup_feat = con->msgr->supported_features;
+        u64 req_feat = con->msgr->required_features;
+        u64 server_feat = le64_to_cpu(con->in_reply.features);
+
+        dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
+
+        switch (con->in_reply.tag) {
+        case CEPH_MSGR_TAG_FEATURES:
+                pr_err("%s%lld %s feature set mismatch,"
+                       " my %llx < server's %llx, missing %llx\n",
+                       ENTITY_NAME(con->peer_name),
+                       ceph_pr_addr(&con->peer_addr.in_addr),
+                       sup_feat, server_feat, server_feat & ~sup_feat);
+                con->error_msg = "missing required protocol features";
+                fail_protocol(con);
+                return -1;
+
+        case CEPH_MSGR_TAG_BADPROTOVER:
+                pr_err("%s%lld %s protocol version mismatch,"
+                       " my %d != server's %d\n",
+                       ENTITY_NAME(con->peer_name),
+                       ceph_pr_addr(&con->peer_addr.in_addr),
+                       le32_to_cpu(con->out_connect.protocol_version),
+                       le32_to_cpu(con->in_reply.protocol_version));
+                con->error_msg = "protocol version mismatch";
+                fail_protocol(con);
+                return -1;
+
+        case CEPH_MSGR_TAG_BADAUTHORIZER:
+                con->auth_retry++;
+                dout("process_connect %p got BADAUTHORIZER attempt %d\n", con,
+                     con->auth_retry);
+                if (con->auth_retry == 2) {
+                        con->error_msg = "connect authorization failure";
+                        reset_connection(con);
+                        set_bit(CLOSED, &con->state);
+                        return -1;
+                }
+                con->auth_retry = 1;
+                prepare_write_connect(con->msgr, con, 0);
+                prepare_read_connect(con);
+                break;
+
+        case CEPH_MSGR_TAG_RESETSESSION:
+                /*
+                 * If we connected with a large connect_seq but the peer
+                 * has no record of a session with us (no connection, or
+                 * connect_seq == 0), they will send RESETSESION to indicate
+                 * that they must have reset their session, and may have
+                 * dropped messages.
+                 */
+                dout("process_connect got RESET peer seq %u\n",
+                     le32_to_cpu(con->in_connect.connect_seq));
+                pr_err("%s%lld %s connection reset\n",
+                       ENTITY_NAME(con->peer_name),
+                       ceph_pr_addr(&con->peer_addr.in_addr));
+                reset_connection(con);
+                prepare_write_connect(con->msgr, con, 0);
+                prepare_read_connect(con);
+
+                /* Tell ceph about it. */
+                mutex_unlock(&con->mutex);
+                pr_info("reset on %s%lld\n", ENTITY_NAME(con->peer_name));
+                if (con->ops->peer_reset)
+                        con->ops->peer_reset(con);
+                mutex_lock(&con->mutex);
+                break;
+
+        case CEPH_MSGR_TAG_RETRY_SESSION:
+                /*
+                 * If we sent a smaller connect_seq than the peer has, try
+                 * again with a larger value.
+                 */
+                dout("process_connect got RETRY my seq = %u, peer_seq = %u\n",
+                     le32_to_cpu(con->out_connect.connect_seq),
+                     le32_to_cpu(con->in_connect.connect_seq));
+                con->connect_seq = le32_to_cpu(con->in_connect.connect_seq);
+                prepare_write_connect(con->msgr, con, 0);
+                prepare_read_connect(con);
+                break;
+
+        case CEPH_MSGR_TAG_RETRY_GLOBAL:
+                /*
+                 * If we sent a smaller global_seq than the peer has, try
+                 * again with a larger value.
+                 */
+                dout("process_connect got RETRY_GLOBAL my %u peer_gseq %u\n",
+                     con->peer_global_seq,
+                     le32_to_cpu(con->in_connect.global_seq));
+                get_global_seq(con->msgr,
+                               le32_to_cpu(con->in_connect.global_seq));
+                prepare_write_connect(con->msgr, con, 0);
+                prepare_read_connect(con);
+                break;
+
+        case CEPH_MSGR_TAG_READY:
+                if (req_feat & ~server_feat) {
+                        pr_err("%s%lld %s protocol feature mismatch,"
+                               " my required %llx > server's %llx, need %llx\n",
+                               ENTITY_NAME(con->peer_name),
+                               ceph_pr_addr(&con->peer_addr.in_addr),
+                               req_feat, server_feat, req_feat & ~server_feat);
+                        con->error_msg = "missing required protocol features";
+                        fail_protocol(con);
+                        return -1;
+                }
+                clear_bit(CONNECTING, &con->state);
+                con->peer_global_seq = le32_to_cpu(con->in_reply.global_seq);
+                con->connect_seq++;
+                con->peer_features = server_feat;
+                dout("process_connect got READY gseq %d cseq %d (%d)\n",
+                     con->peer_global_seq,
+                     le32_to_cpu(con->in_reply.connect_seq),
+                     con->connect_seq);
+                WARN_ON(con->connect_seq !=
+                        le32_to_cpu(con->in_reply.connect_seq));
+
+                if (con->in_reply.flags & CEPH_MSG_CONNECT_LOSSY)
+                        set_bit(LOSSYTX, &con->state);
+
+                prepare_read_tag(con);
+                break;
+
+        case CEPH_MSGR_TAG_WAIT:
+                /*
+                 * If there is a connection race (we are opening
+                 * connections to each other), one of us may just have
+                 * to WAIT.  This shouldn't happen if we are the
+                 * client.
+                 */
+                pr_err("process_connect peer connecting WAIT\n");
+
+        default:
+                pr_err("connect protocol error, will retry\n");
+                con->error_msg = "protocol error, garbage tag during connect";
+                return -1;
+        }
+        return 0;
+}
+
+
+/*
+ * read (part of) an ack
+ */
+static int read_partial_ack(struct ceph_connection *con)
+{
+        int to = 0;
+
+        return read_partial(con, &to, sizeof(con->in_temp_ack),
+                            &con->in_temp_ack);
+}
+
+
+/*
+ * We can finally discard anything that's been acked.
+ */
+static void process_ack(struct ceph_connection *con)
+{
+        struct ceph_msg *m;
+        u64 ack = le64_to_cpu(con->in_temp_ack);
+        u64 seq;
+
+        while (!list_empty(&con->out_sent)) {
+                m = list_first_entry(&con->out_sent, struct ceph_msg,
+                                     list_head);
+                seq = le64_to_cpu(m->hdr.seq);
+                if (seq > ack)
+                        break;
+                dout("got ack for seq %llu type %d at %p\n", seq,
+                     le16_to_cpu(m->hdr.type), m);
+                ceph_msg_remove(m);
+        }
+        prepare_read_tag(con);
+}
+
+
+
+
+static int read_partial_message_section(struct ceph_connection *con,
+                                        struct kvec *section,
+                                        unsigned int sec_len, u32 *crc)
+{
+        int ret, left;
+
+        BUG_ON(!section);
+
+        while (section->iov_len < sec_len) {
+                BUG_ON(section->iov_base == NULL);
+                left = sec_len - section->iov_len;
+                ret = ceph_tcp_recvmsg(con->sock, (char *)section->iov_base +
+                                       section->iov_len, left);
+                if (ret <= 0)
+                        return ret;
+                section->iov_len += ret;
+                if (section->iov_len == sec_len)
+                        *crc = crc32c(0, section->iov_base,
+                                      section->iov_len);
+        }
+
+        return 1;
+}
+
+static struct ceph_msg *ceph_alloc_msg(struct ceph_connection *con,
+                                struct ceph_msg_header *hdr,
+                                int *skip);
+
+
+static int read_partial_message_pages(struct ceph_connection *con,
+                                      struct page **pages,
+                                      unsigned data_len, int datacrc)
+{
+        void *p;
+        int ret;
+        int left;
+
+        left = min((int)(data_len - con->in_msg_pos.data_pos),
+                   (int)(PAGE_SIZE - con->in_msg_pos.page_pos));
+        /* (page) data */
+        BUG_ON(pages == NULL);
+        p = kmap(pages[con->in_msg_pos.page]);
+        ret = ceph_tcp_recvmsg(con->sock, p + con->in_msg_pos.page_pos,
+                               left);
+        if (ret > 0 && datacrc)
+                con->in_data_crc =
+                        crc32c(con->in_data_crc,
+                                  p + con->in_msg_pos.page_pos, ret);
+        kunmap(pages[con->in_msg_pos.page]);
+        if (ret <= 0)
+                return ret;
+        con->in_msg_pos.data_pos += ret;
+        con->in_msg_pos.page_pos += ret;
+        if (con->in_msg_pos.page_pos == PAGE_SIZE) {
+                con->in_msg_pos.page_pos = 0;
+                con->in_msg_pos.page++;
+        }
+
+        return ret;
+}
+
+#ifdef CONFIG_BLOCK
+static int read_partial_message_bio(struct ceph_connection *con,
+                                    struct bio **bio_iter, int *bio_seg,
+                                    unsigned data_len, int datacrc)
+{
+        struct bio_vec *bv = bio_iovec_idx(*bio_iter, *bio_seg);
+        void *p;
+        int ret, left;
+
+        if (IS_ERR(bv))
+                return PTR_ERR(bv);
+
+        left = min((int)(data_len - con->in_msg_pos.data_pos),
+                   (int)(bv->bv_len - con->in_msg_pos.page_pos));
+
+        p = kmap(bv->bv_page) + bv->bv_offset;
+
+        ret = ceph_tcp_recvmsg(con->sock, p + con->in_msg_pos.page_pos,
+                               left);
+        if (ret > 0 && datacrc)
+                con->in_data_crc =
+                        crc32c(con->in_data_crc,
+                                  p + con->in_msg_pos.page_pos, ret);
+        kunmap(bv->bv_page);
+        if (ret <= 0)
+                return ret;
+        con->in_msg_pos.data_pos += ret;
+        con->in_msg_pos.page_pos += ret;
+        if (con->in_msg_pos.page_pos == bv->bv_len) {
+                con->in_msg_pos.page_pos = 0;
+                iter_bio_next(bio_iter, bio_seg);
+        }
+
+        return ret;
+}
+#endif
+
+/*
+ * read (part of) a message.
+ */
+static int read_partial_message(struct ceph_connection *con)
+{
+        struct ceph_msg *m = con->in_msg;
+        int ret;
+        int to, left;
+        unsigned front_len, middle_len, data_len, data_off;
+        int datacrc = con->msgr->nocrc;
+        int skip;
+        u64 seq;
+
+        dout("read_partial_message con %p msg %p\n", con, m);
+
+        /* header */
+        while (con->in_base_pos < sizeof(con->in_hdr)) {
+                left = sizeof(con->in_hdr) - con->in_base_pos;
+                ret = ceph_tcp_recvmsg(con->sock,
+                                       (char *)&con->in_hdr + con->in_base_pos,
+                                       left);
+                if (ret <= 0)
+                        return ret;
+                con->in_base_pos += ret;
+                if (con->in_base_pos == sizeof(con->in_hdr)) {
+                        u32 crc = crc32c(0, (void *)&con->in_hdr,
+                                 sizeof(con->in_hdr) - sizeof(con->in_hdr.crc));
+                        if (crc != le32_to_cpu(con->in_hdr.crc)) {
+                                pr_err("read_partial_message bad hdr "
+                                       " crc %u != expected %u\n",
+                                       crc, con->in_hdr.crc);
+                                return -EBADMSG;
+                        }
+                }
+        }
+        front_len = le32_to_cpu(con->in_hdr.front_len);
+        if (front_len > CEPH_MSG_MAX_FRONT_LEN)
+                return -EIO;
+        middle_len = le32_to_cpu(con->in_hdr.middle_len);
+        if (middle_len > CEPH_MSG_MAX_DATA_LEN)
+                return -EIO;
+        data_len = le32_to_cpu(con->in_hdr.data_len);
+        if (data_len > CEPH_MSG_MAX_DATA_LEN)
+                return -EIO;
+        data_off = le16_to_cpu(con->in_hdr.data_off);
+
+        /* verify seq# */
+        seq = le64_to_cpu(con->in_hdr.seq);
+        if ((s64)seq - (s64)con->in_seq < 1) {
+                pr_info("skipping %s%lld %s seq %lld, expected %lld\n",
+                        ENTITY_NAME(con->peer_name),
+                        ceph_pr_addr(&con->peer_addr.in_addr),
+                        seq, con->in_seq + 1);
+                con->in_base_pos = -front_len - middle_len - data_len -
+                        sizeof(m->footer);
+                con->in_tag = CEPH_MSGR_TAG_READY;
+                con->in_seq++;
+                return 0;
+        } else if ((s64)seq - (s64)con->in_seq > 1) {
+                pr_err("read_partial_message bad seq %lld expected %lld\n",
+                       seq, con->in_seq + 1);
+                con->error_msg = "bad message sequence # for incoming message";
+                return -EBADMSG;
+        }
+
+        /* allocate message? */
+        if (!con->in_msg) {
+                dout("got hdr type %d front %d data %d\n", con->in_hdr.type,
+                     con->in_hdr.front_len, con->in_hdr.data_len);
+                skip = 0;
+                con->in_msg = ceph_alloc_msg(con, &con->in_hdr, &skip);
+                if (skip) {
+                        /* skip this message */
+                        dout("alloc_msg said skip message\n");
+                        BUG_ON(con->in_msg);
+                        con->in_base_pos = -front_len - middle_len - data_len -
+                                sizeof(m->footer);
+                        con->in_tag = CEPH_MSGR_TAG_READY;
+                        con->in_seq++;
+                        return 0;
+                }
+                if (!con->in_msg) {
+                        con->error_msg =
+                                "error allocating memory for incoming message";
+                        return -ENOMEM;
+                }
+                m = con->in_msg;
+                m->front.iov_len = 0;    /* haven't read it yet */
+                if (m->middle)
+                        m->middle->vec.iov_len = 0;
+
+                con->in_msg_pos.page = 0;
+                if (m->pages)
+                        con->in_msg_pos.page_pos = data_off & ~PAGE_MASK;
+                else
+                        con->in_msg_pos.page_pos = 0;
+                con->in_msg_pos.data_pos = 0;
+        }
+
+        /* front */
+        ret = read_partial_message_section(con, &m->front, front_len,
+                                           &con->in_front_crc);
+        if (ret <= 0)
+                return ret;
+
+        /* middle */
+        if (m->middle) {
+                ret = read_partial_message_section(con, &m->middle->vec,
+                                                   middle_len,
+                                                   &con->in_middle_crc);
+                if (ret <= 0)
+                        return ret;
+        }
+#ifdef CONFIG_BLOCK
+        if (m->bio && !m->bio_iter)
+                init_bio_iter(m->bio, &m->bio_iter, &m->bio_seg);
+#endif
+
+        /* (page) data */
+        while (con->in_msg_pos.data_pos < data_len) {
+                if (m->pages) {
+                        ret = read_partial_message_pages(con, m->pages,
+                                                 data_len, datacrc);
+                        if (ret <= 0)
+                                return ret;
+#ifdef CONFIG_BLOCK
+                } else if (m->bio) {
+
+                        ret = read_partial_message_bio(con,
+                                                 &m->bio_iter, &m->bio_seg,
+                                                 data_len, datacrc);
+                        if (ret <= 0)
+                                return ret;
+#endif
+                } else {
+                        BUG_ON(1);
+                }
+        }
+
+        /* footer */
+        to = sizeof(m->hdr) + sizeof(m->footer);
+        while (con->in_base_pos < to) {
+                left = to - con->in_base_pos;
+                ret = ceph_tcp_recvmsg(con->sock, (char *)&m->footer +
+                                       (con->in_base_pos - sizeof(m->hdr)),
+                                       left);
+                if (ret <= 0)
+                        return ret;
+                con->in_base_pos += ret;
+        }
+        dout("read_partial_message got msg %p %d (%u) + %d (%u) + %d (%u)\n",
+             m, front_len, m->footer.front_crc, middle_len,
+             m->footer.middle_crc, data_len, m->footer.data_crc);
+
+        /* crc ok? */
+        if (con->in_front_crc != le32_to_cpu(m->footer.front_crc)) {
+                pr_err("read_partial_message %p front crc %u != exp. %u\n",
+                       m, con->in_front_crc, m->footer.front_crc);
+                return -EBADMSG;
+        }
+        if (con->in_middle_crc != le32_to_cpu(m->footer.middle_crc)) {
+                pr_err("read_partial_message %p middle crc %u != exp %u\n",
+                       m, con->in_middle_crc, m->footer.middle_crc);
+                return -EBADMSG;
+        }
+        if (datacrc &&
+            (m->footer.flags & CEPH_MSG_FOOTER_NOCRC) == 0 &&
+            con->in_data_crc != le32_to_cpu(m->footer.data_crc)) {
+                pr_err("read_partial_message %p data crc %u != exp. %u\n", m,
+                       con->in_data_crc, le32_to_cpu(m->footer.data_crc));
+                return -EBADMSG;
+        }
+
+        return 1; /* done! */
+}
+
+/*
+ * Process message.  This happens in the worker thread.  The callback should
+ * be careful not to do anything that waits on other incoming messages or it
+ * may deadlock.
+ */
+static void process_message(struct ceph_connection *con)
+{
+        struct ceph_msg *msg;
+
+        msg = con->in_msg;
+        con->in_msg = NULL;
+
+        /* if first message, set peer_name */
+        if (con->peer_name.type == 0)
+                con->peer_name = msg->hdr.src;
+
+        con->in_seq++;
+        mutex_unlock(&con->mutex);
+
+        dout("===== %p %llu from %s%lld %d=%s len %d+%d (%u %u %u) =====\n",
+             msg, le64_to_cpu(msg->hdr.seq),
+             ENTITY_NAME(msg->hdr.src),
+             le16_to_cpu(msg->hdr.type),
+             ceph_msg_type_name(le16_to_cpu(msg->hdr.type)),
+             le32_to_cpu(msg->hdr.front_len),
+             le32_to_cpu(msg->hdr.data_len),
+             con->in_front_crc, con->in_middle_crc, con->in_data_crc);
+        con->ops->dispatch(con, msg);
+
+        mutex_lock(&con->mutex);
+        prepare_read_tag(con);
+}
+
+
+/*
+ * Write something to the socket.  Called in a worker thread when the
+ * socket appears to be writeable and we have something ready to send.
+ */
+static int try_write(struct ceph_connection *con)
+{
+        struct ceph_messenger *msgr = con->msgr;
+        int ret = 1;
+
+        dout("try_write start %p state %lu nref %d\n", con, con->state,
+             atomic_read(&con->nref));
+
+more:
+        dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes);
+
+        /* open the socket first? */
+        if (con->sock == NULL) {
+                /*
+                 * if we were STANDBY and are reconnecting _this_
+                 * connection, bump connect_seq now.  Always bump
+                 * global_seq.
+                 */
+                if (test_and_clear_bit(STANDBY, &con->state))
+                        con->connect_seq++;
+
+                prepare_write_banner(msgr, con);
+                prepare_write_connect(msgr, con, 1);
+                prepare_read_banner(con);
+                set_bit(CONNECTING, &con->state);
+                clear_bit(NEGOTIATING, &con->state);
+
+                BUG_ON(con->in_msg);
+                con->in_tag = CEPH_MSGR_TAG_READY;
+                dout("try_write initiating connect on %p new state %lu\n",
+                     con, con->state);
+                con->sock = ceph_tcp_connect(con);
+                if (IS_ERR(con->sock)) {
+                        con->sock = NULL;
+                        con->error_msg = "connect error";
+                        ret = -1;
+                        goto out;
+                }
+        }
+
+more_kvec:
+        /* kvec data queued? */
+        if (con->out_skip) {
+                ret = write_partial_skip(con);
+                if (ret <= 0)
+                        goto done;
+                if (ret < 0) {
+                        dout("try_write write_partial_skip err %d\n", ret);
+                        goto done;
+                }
+        }
+        if (con->out_kvec_left) {
+                ret = write_partial_kvec(con);
+                if (ret <= 0)
+                        goto done;
+        }
+
+        /* msg pages? */
+        if (con->out_msg) {
+                if (con->out_msg_done) {
+                        ceph_msg_put(con->out_msg);
+                        con->out_msg = NULL;   /* we're done with this one */
+                        goto do_next;
+                }
+
+                ret = write_partial_msg_pages(con);
+                if (ret == 1)
+                        goto more_kvec;  /* we need to send the footer, too! */
+                if (ret == 0)
+                        goto done;
+                if (ret < 0) {
+                        dout("try_write write_partial_msg_pages err %d\n",
+                             ret);
+                        goto done;
+                }
+        }
+
+do_next:
+        if (!test_bit(CONNECTING, &con->state)) {
+                /* is anything else pending? */
+                if (!list_empty(&con->out_queue)) {
+                        prepare_write_message(con);
+                        goto more;
+                }
+                if (con->in_seq > con->in_seq_acked) {
+                        prepare_write_ack(con);
+                        goto more;
+                }
+                if (test_and_clear_bit(KEEPALIVE_PENDING, &con->state)) {
+                        prepare_write_keepalive(con);
+                        goto more;
+                }
+        }
+
+        /* Nothing to do! */
+        clear_bit(WRITE_PENDING, &con->state);
+        dout("try_write nothing else to write.\n");
+done:
+        ret = 0;
+out:
+        dout("try_write done on %p\n", con);
+        return ret;
+}
+
+
+
+/*
+ * Read what we can from the socket.
+ */
+static int try_read(struct ceph_connection *con)
+{
+        int ret = -1;
+
+        if (!con->sock)
+                return 0;
+
+        if (test_bit(STANDBY, &con->state))
+                return 0;
+
+        dout("try_read start on %p\n", con);
+
+more:
+        dout("try_read tag %d in_base_pos %d\n", (int)con->in_tag,
+             con->in_base_pos);
+        if (test_bit(CONNECTING, &con->state)) {
+                if (!test_bit(NEGOTIATING, &con->state)) {
+                        dout("try_read connecting\n");
+                        ret = read_partial_banner(con);
+                        if (ret <= 0)
+                                goto done;
+                        if (process_banner(con) < 0) {
+                                ret = -1;
+                                goto out;
+                        }
+                }
+                ret = read_partial_connect(con);
+                if (ret <= 0)
+                        goto done;
+                if (process_connect(con) < 0) {
+                        ret = -1;
+                        goto out;
+                }
+                goto more;
+        }
+
+        if (con->in_base_pos < 0) {
+                /*
+                 * skipping + discarding content.
+                 *
+                 * FIXME: there must be a better way to do this!
+                 */
+                static char buf[1024];
+                int skip = min(1024, -con->in_base_pos);
+                dout("skipping %d / %d bytes\n", skip, -con->in_base_pos);
+                ret = ceph_tcp_recvmsg(con->sock, buf, skip);
+                if (ret <= 0)
+                        goto done;
+                con->in_base_pos += ret;
+                if (con->in_base_pos)
+                        goto more;
+        }
+        if (con->in_tag == CEPH_MSGR_TAG_READY) {
+                /*
+                 * what's next?
+                 */
+                ret = ceph_tcp_recvmsg(con->sock, &con->in_tag, 1);
+                if (ret <= 0)
+                        goto done;
+                dout("try_read got tag %d\n", (int)con->in_tag);
+                switch (con->in_tag) {
+                case CEPH_MSGR_TAG_MSG:
+                        prepare_read_message(con);
+                        break;
+                case CEPH_MSGR_TAG_ACK:
+                        prepare_read_ack(con);
+                        break;
+                case CEPH_MSGR_TAG_CLOSE:
+                        set_bit(CLOSED, &con->state);   /* fixme */
+                        goto done;
+                default:
+                        goto bad_tag;
+                }
+        }
+        if (con->in_tag == CEPH_MSGR_TAG_MSG) {
+                ret = read_partial_message(con);
+                if (ret <= 0) {
+                        switch (ret) {
+                        case -EBADMSG:
+                                con->error_msg = "bad crc";
+                                ret = -EIO;
+                                goto out;
+                        case -EIO:
+                                con->error_msg = "io error";
+                                goto out;
+                        default:
+                                goto done;
+                        }
+                }
+                if (con->in_tag == CEPH_MSGR_TAG_READY)
+                        goto more;
+                process_message(con);
+                goto more;
+        }
+        if (con->in_tag == CEPH_MSGR_TAG_ACK) {
+                ret = read_partial_ack(con);
+                if (ret <= 0)
+                        goto done;
+                process_ack(con);
+                goto more;
+        }
+
+done:
+        ret = 0;
+out:
+        dout("try_read done on %p\n", con);
+        return ret;
+
+bad_tag:
+        pr_err("try_read bad con->in_tag = %d\n", (int)con->in_tag);
+        con->error_msg = "protocol error, garbage tag";
+        ret = -1;
+        goto out;
+}
+
+
+/*
+ * Atomically queue work on a connection.  Bump @con reference to
+ * avoid races with connection teardown.
+ *
+ * There is some trickery going on with QUEUED and BUSY because we
+ * only want a _single_ thread operating on each connection at any
+ * point in time, but we want to use all available CPUs.
+ *
+ * The worker thread only proceeds if it can atomically set BUSY.  It
+ * clears QUEUED and does it's thing.  When it thinks it's done, it
+ * clears BUSY, then rechecks QUEUED.. if it's set again, it loops
+ * (tries again to set BUSY).
+ *
+ * To queue work, we first set QUEUED, _then_ if BUSY isn't set, we
+ * try to queue work.  If that fails (work is already queued, or BUSY)
+ * we give up (work also already being done or is queued) but leave QUEUED
+ * set so that the worker thread will loop if necessary.
+ */
+static void queue_con(struct ceph_connection *con)
+{
+        if (test_bit(DEAD, &con->state)) {
+                dout("queue_con %p ignoring: DEAD\n",
+                     con);
+                return;
+        }
+
+        if (!con->ops->get(con)) {
+                dout("queue_con %p ref count 0\n", con);
+                return;
+        }
+
+        set_bit(QUEUED, &con->state);
+        if (test_bit(BUSY, &con->state)) {
+                dout("queue_con %p - already BUSY\n", con);
+                con->ops->put(con);
+        } else if (!queue_work(ceph_msgr_wq, &con->work.work)) {
+                dout("queue_con %p - already queued\n", con);
+                con->ops->put(con);
+        } else {
+                dout("queue_con %p\n", con);
+        }
+}
+
+/*
+ * Do some work on a connection.  Drop a connection ref when we're done.
+ */
+static void con_work(struct work_struct *work)
+{
+        struct ceph_connection *con = container_of(work, struct ceph_connection,
+                                                   work.work);
+        int backoff = 0;
+
+more:
+        if (test_and_set_bit(BUSY, &con->state) != 0) {
+                dout("con_work %p BUSY already set\n", con);
+                goto out;
+        }
+        dout("con_work %p start, clearing QUEUED\n", con);
+        clear_bit(QUEUED, &con->state);
+
+        mutex_lock(&con->mutex);
+
+        if (test_bit(CLOSED, &con->state)) { /* e.g. if we are replaced */
+                dout("con_work CLOSED\n");
+                con_close_socket(con);
+                goto done;
+        }
+        if (test_and_clear_bit(OPENING, &con->state)) {
+                /* reopen w/ new peer */
+                dout("con_work OPENING\n");
+                con_close_socket(con);
+        }
+
+        if (test_and_clear_bit(SOCK_CLOSED, &con->state) ||
+            try_read(con) < 0 ||
+            try_write(con) < 0) {
+                mutex_unlock(&con->mutex);
+                backoff = 1;
+                ceph_fault(con);     /* error/fault path */
+                goto done_unlocked;
+        }
+
+done:
+        mutex_unlock(&con->mutex);
+
+done_unlocked:
+        clear_bit(BUSY, &con->state);
+        dout("con->state=%lu\n", con->state);
+        if (test_bit(QUEUED, &con->state)) {
+                if (!backoff || test_bit(OPENING, &con->state)) {
+                        dout("con_work %p QUEUED reset, looping\n", con);
+                        goto more;
+                }
+                dout("con_work %p QUEUED reset, but just faulted\n", con);
+                clear_bit(QUEUED, &con->state);
+        }
+        dout("con_work %p done\n", con);
+
+out:
+        con->ops->put(con);
+}
+
+
+/*
+ * Generic error/fault handler.  A retry mechanism is used with
+ * exponential backoff
+ */
+static void ceph_fault(struct ceph_connection *con)
+{
+        pr_err("%s%lld %s %s\n", ENTITY_NAME(con->peer_name),
+               ceph_pr_addr(&con->peer_addr.in_addr), con->error_msg);
+        dout("fault %p state %lu to peer %s\n",
+             con, con->state, ceph_pr_addr(&con->peer_addr.in_addr));
+
+        if (test_bit(LOSSYTX, &con->state)) {
+                dout("fault on LOSSYTX channel\n");
+                goto out;
+        }
+
+        mutex_lock(&con->mutex);
+        if (test_bit(CLOSED, &con->state))
+                goto out_unlock;
+
+        con_close_socket(con);
+
+        if (con->in_msg) {
+                ceph_msg_put(con->in_msg);
+                con->in_msg = NULL;
+        }
+
+        /* Requeue anything that hasn't been acked */
+        list_splice_init(&con->out_sent, &con->out_queue);
+
+        /* If there are no messages in the queue, place the connection
+         * in a STANDBY state (i.e., don't try to reconnect just yet). */
+        if (list_empty(&con->out_queue) && !con->out_keepalive_pending) {
+                dout("fault setting STANDBY\n");
+                set_bit(STANDBY, &con->state);
+        } else {
+                /* retry after a delay. */
+                if (con->delay == 0)
+                        con->delay = BASE_DELAY_INTERVAL;
+                else if (con->delay < MAX_DELAY_INTERVAL)
+                        con->delay *= 2;
+                dout("fault queueing %p delay %lu\n", con, con->delay);
+                con->ops->get(con);
+                if (queue_delayed_work(ceph_msgr_wq, &con->work,
+                                       round_jiffies_relative(con->delay)) == 0)
+                        con->ops->put(con);
+        }
+
+out_unlock:
+        mutex_unlock(&con->mutex);
+out:
+        /*
+         * in case we faulted due to authentication, invalidate our
+         * current tickets so that we can get new ones.
+         */
+        if (con->auth_retry && con->ops->invalidate_authorizer) {
+                dout("calling invalidate_authorizer()\n");
+                con->ops->invalidate_authorizer(con);
+        }
+
+        if (con->ops->fault)
+                con->ops->fault(con);
+}
+
+
+
+/*
+ * create a new messenger instance
+ */
+struct ceph_messenger *ceph_messenger_create(struct ceph_entity_addr *myaddr,
+                                             u32 supported_features,
+                                             u32 required_features)
+{
+        struct ceph_messenger *msgr;
+
+        msgr = kzalloc(sizeof(*msgr), GFP_KERNEL);
+        if (msgr == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        msgr->supported_features = supported_features;
+        msgr->required_features = required_features;
+
+        spin_lock_init(&msgr->global_seq_lock);
+
+        /* the zero page is needed if a request is "canceled" while the message
+         * is being written over the socket */
+        msgr->zero_page = __page_cache_alloc(GFP_KERNEL | __GFP_ZERO);
+        if (!msgr->zero_page) {
+                kfree(msgr);
+                return ERR_PTR(-ENOMEM);
+        }
+        kmap(msgr->zero_page);
+
+        if (myaddr)
+                msgr->inst.addr = *myaddr;
+
+        /* select a random nonce */
+        msgr->inst.addr.type = 0;
+        get_random_bytes(&msgr->inst.addr.nonce, sizeof(msgr->inst.addr.nonce));
+        encode_my_addr(msgr);
+
+        dout("messenger_create %p\n", msgr);
+        return msgr;
+}
+EXPORT_SYMBOL(ceph_messenger_create);
+
+void ceph_messenger_destroy(struct ceph_messenger *msgr)
+{
+        dout("destroy %p\n", msgr);
+        kunmap(msgr->zero_page);
+        __free_page(msgr->zero_page);
+        kfree(msgr);
+        dout("destroyed messenger %p\n", msgr);
+}
+EXPORT_SYMBOL(ceph_messenger_destroy);
+
+/*
+ * Queue up an outgoing message on the given connection.
+ */
+void ceph_con_send(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        if (test_bit(CLOSED, &con->state)) {
+                dout("con_send %p closed, dropping %p\n", con, msg);
+                ceph_msg_put(msg);
+                return;
+        }
+
+        /* set src+dst */
+        msg->hdr.src = con->msgr->inst.name;
+
+        BUG_ON(msg->front.iov_len != le32_to_cpu(msg->hdr.front_len));
+
+        msg->needs_out_seq = true;
+
+        /* queue */
+        mutex_lock(&con->mutex);
+        BUG_ON(!list_empty(&msg->list_head));
+        list_add_tail(&msg->list_head, &con->out_queue);
+        dout("----- %p to %s%lld %d=%s len %d+%d+%d -----\n", msg,
+             ENTITY_NAME(con->peer_name), le16_to_cpu(msg->hdr.type),
+             ceph_msg_type_name(le16_to_cpu(msg->hdr.type)),
+             le32_to_cpu(msg->hdr.front_len),
+             le32_to_cpu(msg->hdr.middle_len),
+             le32_to_cpu(msg->hdr.data_len));
+        mutex_unlock(&con->mutex);
+
+        /* if there wasn't anything waiting to send before, queue
+         * new work */
+        if (test_and_set_bit(WRITE_PENDING, &con->state) == 0)
+                queue_con(con);
+}
+EXPORT_SYMBOL(ceph_con_send);
+
+/*
+ * Revoke a message that was previously queued for send
+ */
+void ceph_con_revoke(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        mutex_lock(&con->mutex);
+        if (!list_empty(&msg->list_head)) {
+                dout("con_revoke %p msg %p - was on queue\n", con, msg);
+                list_del_init(&msg->list_head);
+                ceph_msg_put(msg);
+                msg->hdr.seq = 0;
+        }
+        if (con->out_msg == msg) {
+                dout("con_revoke %p msg %p - was sending\n", con, msg);
+                con->out_msg = NULL;
+                if (con->out_kvec_is_msg) {
+                        con->out_skip = con->out_kvec_bytes;
+                        con->out_kvec_is_msg = false;
+                }
+                ceph_msg_put(msg);
+                msg->hdr.seq = 0;
+        }
+        mutex_unlock(&con->mutex);
+}
+
+/*
+ * Revoke a message that we may be reading data into
+ */
+void ceph_con_revoke_message(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        mutex_lock(&con->mutex);
+        if (con->in_msg && con->in_msg == msg) {
+                unsigned front_len = le32_to_cpu(con->in_hdr.front_len);
+                unsigned middle_len = le32_to_cpu(con->in_hdr.middle_len);
+                unsigned data_len = le32_to_cpu(con->in_hdr.data_len);
+
+                /* skip rest of message */
+                dout("con_revoke_pages %p msg %p revoked\n", con, msg);
+                        con->in_base_pos = con->in_base_pos -
+                                sizeof(struct ceph_msg_header) -
+                                front_len -
+                                middle_len -
+                                data_len -
+                                sizeof(struct ceph_msg_footer);
+                ceph_msg_put(con->in_msg);
+                con->in_msg = NULL;
+                con->in_tag = CEPH_MSGR_TAG_READY;
+                con->in_seq++;
+        } else {
+                dout("con_revoke_pages %p msg %p pages %p no-op\n",
+                     con, con->in_msg, msg);
+        }
+        mutex_unlock(&con->mutex);
+}
+
+/*
+ * Queue a keepalive byte to ensure the tcp connection is alive.
+ */
+void ceph_con_keepalive(struct ceph_connection *con)
+{
+        if (test_and_set_bit(KEEPALIVE_PENDING, &con->state) == 0 &&
+            test_and_set_bit(WRITE_PENDING, &con->state) == 0)
+                queue_con(con);
+}
+EXPORT_SYMBOL(ceph_con_keepalive);
+
+
+/*
+ * construct a new message with given type, size
+ * the new msg has a ref count of 1.
+ */
+struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
+{
+        struct ceph_msg *m;
+
+        m = kmalloc(sizeof(*m), flags);
+        if (m == NULL)
+                goto out;
+        kref_init(&m->kref);
+        INIT_LIST_HEAD(&m->list_head);
+
+        m->hdr.tid = 0;
+        m->hdr.type = cpu_to_le16(type);
+        m->hdr.priority = cpu_to_le16(CEPH_MSG_PRIO_DEFAULT);
+        m->hdr.version = 0;
+        m->hdr.front_len = cpu_to_le32(front_len);
+        m->hdr.middle_len = 0;
+        m->hdr.data_len = 0;
+        m->hdr.data_off = 0;
+        m->hdr.reserved = 0;
+        m->footer.front_crc = 0;
+        m->footer.middle_crc = 0;
+        m->footer.data_crc = 0;
+        m->footer.flags = 0;
+        m->front_max = front_len;
+        m->front_is_vmalloc = false;
+        m->more_to_follow = false;
+        m->pool = NULL;
+
+        /* front */
+        if (front_len) {
+                if (front_len > PAGE_CACHE_SIZE) {
+                        m->front.iov_base = __vmalloc(front_len, flags,
+                                                      PAGE_KERNEL);
+                        m->front_is_vmalloc = true;
+                } else {
+                        m->front.iov_base = kmalloc(front_len, flags);
+                }
+                if (m->front.iov_base == NULL) {
+                        pr_err("msg_new can't allocate %d bytes\n",
+                             front_len);
+                        goto out2;
+                }
+        } else {
+                m->front.iov_base = NULL;
+        }
+        m->front.iov_len = front_len;
+
+        /* middle */
+        m->middle = NULL;
+
+        /* data */
+        m->nr_pages = 0;
+        m->pages = NULL;
+        m->pagelist = NULL;
+        m->bio = NULL;
+        m->bio_iter = NULL;
+        m->bio_seg = 0;
+        m->trail = NULL;
+
+        dout("ceph_msg_new %p front %d\n", m, front_len);
+        return m;
+
+out2:
+        ceph_msg_put(m);
+out:
+        pr_err("msg_new can't create type %d front %d\n", type, front_len);
+        return NULL;
+}
+EXPORT_SYMBOL(ceph_msg_new);
+
+/*
+ * Allocate "middle" portion of a message, if it is needed and wasn't
+ * allocated by alloc_msg.  This allows us to read a small fixed-size
+ * per-type header in the front and then gracefully fail (i.e.,
+ * propagate the error to the caller based on info in the front) when
+ * the middle is too large.
+ */
+static int ceph_alloc_middle(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        int type = le16_to_cpu(msg->hdr.type);
+        int middle_len = le32_to_cpu(msg->hdr.middle_len);
+
+        dout("alloc_middle %p type %d %s middle_len %d\n", msg, type,
+             ceph_msg_type_name(type), middle_len);
+        BUG_ON(!middle_len);
+        BUG_ON(msg->middle);
+
+        msg->middle = ceph_buffer_new(middle_len, GFP_NOFS);
+        if (!msg->middle)
+                return -ENOMEM;
+        return 0;
+}
+
+/*
+ * Generic message allocator, for incoming messages.
+ */
+static struct ceph_msg *ceph_alloc_msg(struct ceph_connection *con,
+                                struct ceph_msg_header *hdr,
+                                int *skip)
+{
+        int type = le16_to_cpu(hdr->type);
+        int front_len = le32_to_cpu(hdr->front_len);
+        int middle_len = le32_to_cpu(hdr->middle_len);
+        struct ceph_msg *msg = NULL;
+        int ret;
+
+        if (con->ops->alloc_msg) {
+                mutex_unlock(&con->mutex);
+                msg = con->ops->alloc_msg(con, hdr, skip);
+                mutex_lock(&con->mutex);
+                if (!msg || *skip)
+                        return NULL;
+        }
+        if (!msg) {
+                *skip = 0;
+                msg = ceph_msg_new(type, front_len, GFP_NOFS);
+                if (!msg) {
+                        pr_err("unable to allocate msg type %d len %d\n",
+                               type, front_len);
+                        return NULL;
+                }
+        }
+        memcpy(&msg->hdr, &con->in_hdr, sizeof(con->in_hdr));
+
+        if (middle_len && !msg->middle) {
+                ret = ceph_alloc_middle(con, msg);
+                if (ret < 0) {
+                        ceph_msg_put(msg);
+                        return NULL;
+                }
+        }
+
+        return msg;
+}
+
+
+/*
+ * Free a generically kmalloc'd message.
+ */
+void ceph_msg_kfree(struct ceph_msg *m)
+{
+        dout("msg_kfree %p\n", m);
+        if (m->front_is_vmalloc)
+                vfree(m->front.iov_base);
+        else
+                kfree(m->front.iov_base);
+        kfree(m);
+}
+
+/*
+ * Drop a msg ref.  Destroy as needed.
+ */
+void ceph_msg_last_put(struct kref *kref)
+{
+        struct ceph_msg *m = container_of(kref, struct ceph_msg, kref);
+
+        dout("ceph_msg_put last one on %p\n", m);
+        WARN_ON(!list_empty(&m->list_head));
+
+        /* drop middle, data, if any */
+        if (m->middle) {
+                ceph_buffer_put(m->middle);
+                m->middle = NULL;
+        }
+        m->nr_pages = 0;
+        m->pages = NULL;
+
+        if (m->pagelist) {
+                ceph_pagelist_release(m->pagelist);
+                kfree(m->pagelist);
+                m->pagelist = NULL;
+        }
+
+        m->trail = NULL;
+
+        if (m->pool)
+                ceph_msgpool_put(m->pool, m);
+        else
+                ceph_msg_kfree(m);
+}
+EXPORT_SYMBOL(ceph_msg_last_put);
+
+void ceph_msg_dump(struct ceph_msg *msg)
+{
+        pr_debug("msg_dump %p (front_max %d nr_pages %d)\n", msg,
+                 msg->front_max, msg->nr_pages);
+        print_hex_dump(KERN_DEBUG, "header: ",
+                       DUMP_PREFIX_OFFSET, 16, 1,
+                       &msg->hdr, sizeof(msg->hdr), true);
+        print_hex_dump(KERN_DEBUG, " front: ",
+                       DUMP_PREFIX_OFFSET, 16, 1,
+                       msg->front.iov_base, msg->front.iov_len, true);
+        if (msg->middle)
+                print_hex_dump(KERN_DEBUG, "middle: ",
+                               DUMP_PREFIX_OFFSET, 16, 1,
+                               msg->middle->vec.iov_base,
+                               msg->middle->vec.iov_len, true);
+        print_hex_dump(KERN_DEBUG, "footer: ",
+                       DUMP_PREFIX_OFFSET, 16, 1,
+                       &msg->footer, sizeof(msg->footer), true);
+}
+EXPORT_SYMBOL(ceph_msg_dump);
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
new file mode 100644
index 000000000000..8a079399174a
--- /dev/null
+++ b/net/ceph/mon_client.c
@@ -0,0 +1,1027 @@
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/random.h>
+#include <linux/sched.h>
+
+#include <linux/ceph/mon_client.h>
+#include <linux/ceph/libceph.h>
+#include <linux/ceph/decode.h>
+
+#include <linux/ceph/auth.h>
+
+/*
+ * Interact with Ceph monitor cluster.  Handle requests for new map
+ * versions, and periodically resend as needed.  Also implement
+ * statfs() and umount().
+ *
+ * A small cluster of Ceph "monitors" are responsible for managing critical
+ * cluster configuration and state information.  An odd number (e.g., 3, 5)
+ * of cmon daemons use a modified version of the Paxos part-time parliament
+ * algorithm to manage the MDS map (mds cluster membership), OSD map, and
+ * list of clients who have mounted the file system.
+ *
+ * We maintain an open, active session with a monitor at all times in order to
+ * receive timely MDSMap updates.  We periodically send a keepalive byte on the
+ * TCP socket to ensure we detect a failure.  If the connection does break, we
+ * randomly hunt for a new monitor.  Once the connection is reestablished, we
+ * resend any outstanding requests.
+ */
+
+static const struct ceph_connection_operations mon_con_ops;
+
+static int __validate_auth(struct ceph_mon_client *monc);
+
+/*
+ * Decode a monmap blob (e.g., during mount).
+ */
+struct ceph_monmap *ceph_monmap_decode(void *p, void *end)
+{
+        struct ceph_monmap *m = NULL;
+        int i, err = -EINVAL;
+        struct ceph_fsid fsid;
+        u32 epoch, num_mon;
+        u16 version;
+        u32 len;
+
+        ceph_decode_32_safe(&p, end, len, bad);
+        ceph_decode_need(&p, end, len, bad);
+
+        dout("monmap_decode %p %p len %d\n", p, end, (int)(end-p));
+
+        ceph_decode_16_safe(&p, end, version, bad);
+
+        ceph_decode_need(&p, end, sizeof(fsid) + 2*sizeof(u32), bad);
+        ceph_decode_copy(&p, &fsid, sizeof(fsid));
+        epoch = ceph_decode_32(&p);
+
+        num_mon = ceph_decode_32(&p);
+        ceph_decode_need(&p, end, num_mon*sizeof(m->mon_inst[0]), bad);
+
+        if (num_mon >= CEPH_MAX_MON)
+                goto bad;
+        m = kmalloc(sizeof(*m) + sizeof(m->mon_inst[0])*num_mon, GFP_NOFS);
+        if (m == NULL)
+                return ERR_PTR(-ENOMEM);
+        m->fsid = fsid;
+        m->epoch = epoch;
+        m->num_mon = num_mon;
+        ceph_decode_copy(&p, m->mon_inst, num_mon*sizeof(m->mon_inst[0]));
+        for (i = 0; i < num_mon; i++)
+                ceph_decode_addr(&m->mon_inst[i].addr);
+
+        dout("monmap_decode epoch %d, num_mon %d\n", m->epoch,
+             m->num_mon);
+        for (i = 0; i < m->num_mon; i++)
+                dout("monmap_decode  mon%d is %s\n", i,
+                     ceph_pr_addr(&m->mon_inst[i].addr.in_addr));
+        return m;
+
+bad:
+        dout("monmap_decode failed with %d\n", err);
+        kfree(m);
+        return ERR_PTR(err);
+}
+
+/*
+ * return true if *addr is included in the monmap.
+ */
+int ceph_monmap_contains(struct ceph_monmap *m, struct ceph_entity_addr *addr)
+{
+        int i;
+
+        for (i = 0; i < m->num_mon; i++)
+                if (memcmp(addr, &m->mon_inst[i].addr, sizeof(*addr)) == 0)
+                        return 1;
+        return 0;
+}
+
+/*
+ * Send an auth request.
+ */
+static void __send_prepared_auth_request(struct ceph_mon_client *monc, int len)
+{
+        monc->pending_auth = 1;
+        monc->m_auth->front.iov_len = len;
+        monc->m_auth->hdr.front_len = cpu_to_le32(len);
+        ceph_con_revoke(monc->con, monc->m_auth);
+        ceph_msg_get(monc->m_auth);  /* keep our ref */
+        ceph_con_send(monc->con, monc->m_auth);
+}
+
+/*
+ * Close monitor session, if any.
+ */
+static void __close_session(struct ceph_mon_client *monc)
+{
+        if (monc->con) {
+                dout("__close_session closing mon%d\n", monc->cur_mon);
+                ceph_con_revoke(monc->con, monc->m_auth);
+                ceph_con_close(monc->con);
+                monc->cur_mon = -1;
+                monc->pending_auth = 0;
+                ceph_auth_reset(monc->auth);
+        }
+}
+
+/*
+ * Open a session with a (new) monitor.
+ */
+static int __open_session(struct ceph_mon_client *monc)
+{
+        char r;
+        int ret;
+
+        if (monc->cur_mon < 0) {
+                get_random_bytes(&r, 1);
+                monc->cur_mon = r % monc->monmap->num_mon;
+                dout("open_session num=%d r=%d -> mon%d\n",
+                     monc->monmap->num_mon, r, monc->cur_mon);
+                monc->sub_sent = 0;
+                monc->sub_renew_after = jiffies;  /* i.e., expired */
+                monc->want_next_osdmap = !!monc->want_next_osdmap;
+
+                dout("open_session mon%d opening\n", monc->cur_mon);
+                monc->con->peer_name.type = CEPH_ENTITY_TYPE_MON;
+                monc->con->peer_name.num = cpu_to_le64(monc->cur_mon);
+                ceph_con_open(monc->con,
+                              &monc->monmap->mon_inst[monc->cur_mon].addr);
+
+                /* initiatiate authentication handshake */
+                ret = ceph_auth_build_hello(monc->auth,
+                                            monc->m_auth->front.iov_base,
+                                            monc->m_auth->front_max);
+                __send_prepared_auth_request(monc, ret);
+        } else {
+                dout("open_session mon%d already open\n", monc->cur_mon);
+        }
+        return 0;
+}
+
+static bool __sub_expired(struct ceph_mon_client *monc)
+{
+        return time_after_eq(jiffies, monc->sub_renew_after);
+}
+
+/*
+ * Reschedule delayed work timer.
+ */
+static void __schedule_delayed(struct ceph_mon_client *monc)
+{
+        unsigned delay;
+
+        if (monc->cur_mon < 0 || __sub_expired(monc))
+                delay = 10 * HZ;
+        else
+                delay = 20 * HZ;
+        dout("__schedule_delayed after %u\n", delay);
+        schedule_delayed_work(&monc->delayed_work, delay);
+}
+
+/*
+ * Send subscribe request for mdsmap and/or osdmap.
+ */
+static void __send_subscribe(struct ceph_mon_client *monc)
+{
+        dout("__send_subscribe sub_sent=%u exp=%u want_osd=%d\n",
+             (unsigned)monc->sub_sent, __sub_expired(monc),
+             monc->want_next_osdmap);
+        if ((__sub_expired(monc) && !monc->sub_sent) ||
+            monc->want_next_osdmap == 1) {
+                struct ceph_msg *msg = monc->m_subscribe;
+                struct ceph_mon_subscribe_item *i;
+                void *p, *end;
+                int num;
+
+                p = msg->front.iov_base;
+                end = p + msg->front_max;
+
+                num = 1 + !!monc->want_next_osdmap + !!monc->want_mdsmap;
+                ceph_encode_32(&p, num);
+
+                if (monc->want_next_osdmap) {
+                        dout("__send_subscribe to 'osdmap' %u\n",
+                             (unsigned)monc->have_osdmap);
+                        ceph_encode_string(&p, end, "osdmap", 6);
+                        i = p;
+                        i->have = cpu_to_le64(monc->have_osdmap);
+                        i->onetime = 1;
+                        p += sizeof(*i);
+                        monc->want_next_osdmap = 2;  /* requested */
+                }
+                if (monc->want_mdsmap) {
+                        dout("__send_subscribe to 'mdsmap' %u+\n",
+                             (unsigned)monc->have_mdsmap);
+                        ceph_encode_string(&p, end, "mdsmap", 6);
+                        i = p;
+                        i->have = cpu_to_le64(monc->have_mdsmap);
+                        i->onetime = 0;
+                        p += sizeof(*i);
+                }
+                ceph_encode_string(&p, end, "monmap", 6);
+                i = p;
+                i->have = 0;
+                i->onetime = 0;
+                p += sizeof(*i);
+
+                msg->front.iov_len = p - msg->front.iov_base;
+                msg->hdr.front_len = cpu_to_le32(msg->front.iov_len);
+                ceph_con_revoke(monc->con, msg);
+                ceph_con_send(monc->con, ceph_msg_get(msg));
+
+                monc->sub_sent = jiffies | 1;  /* never 0 */
+        }
+}
+
+static void handle_subscribe_ack(struct ceph_mon_client *monc,
+                                 struct ceph_msg *msg)
+{
+        unsigned seconds;
+        struct ceph_mon_subscribe_ack *h = msg->front.iov_base;
+
+        if (msg->front.iov_len < sizeof(*h))
+                goto bad;
+        seconds = le32_to_cpu(h->duration);
+
+        mutex_lock(&monc->mutex);
+        if (monc->hunting) {
+                pr_info("mon%d %s session established\n",
+                        monc->cur_mon,
+                        ceph_pr_addr(&monc->con->peer_addr.in_addr));
+                monc->hunting = false;
+        }
+        dout("handle_subscribe_ack after %d seconds\n", seconds);
+        monc->sub_renew_after = monc->sub_sent + (seconds >> 1)*HZ - 1;
+        monc->sub_sent = 0;
+        mutex_unlock(&monc->mutex);
+        return;
+bad:
+        pr_err("got corrupt subscribe-ack msg\n");
+        ceph_msg_dump(msg);
+}
+
+/*
+ * Keep track of which maps we have
+ */
+int ceph_monc_got_mdsmap(struct ceph_mon_client *monc, u32 got)
+{
+        mutex_lock(&monc->mutex);
+        monc->have_mdsmap = got;
+        mutex_unlock(&monc->mutex);
+        return 0;
+}
+EXPORT_SYMBOL(ceph_monc_got_mdsmap);
+
+int ceph_monc_got_osdmap(struct ceph_mon_client *monc, u32 got)
+{
+        mutex_lock(&monc->mutex);
+        monc->have_osdmap = got;
+        monc->want_next_osdmap = 0;
+        mutex_unlock(&monc->mutex);
+        return 0;
+}
+
+/*
+ * Register interest in the next osdmap
+ */
+void ceph_monc_request_next_osdmap(struct ceph_mon_client *monc)
+{
+        dout("request_next_osdmap have %u\n", monc->have_osdmap);
+        mutex_lock(&monc->mutex);
+        if (!monc->want_next_osdmap)
+                monc->want_next_osdmap = 1;
+        if (monc->want_next_osdmap < 2)
+                __send_subscribe(monc);
+        mutex_unlock(&monc->mutex);
+}
+
+/*
+ *
+ */
+int ceph_monc_open_session(struct ceph_mon_client *monc)
+{
+        if (!monc->con) {
+                monc->con = kmalloc(sizeof(*monc->con), GFP_KERNEL);
+                if (!monc->con)
+                        return -ENOMEM;
+                ceph_con_init(monc->client->msgr, monc->con);
+                monc->con->private = monc;
+                monc->con->ops = &mon_con_ops;
+        }
+
+        mutex_lock(&monc->mutex);
+        __open_session(monc);
+        __schedule_delayed(monc);
+        mutex_unlock(&monc->mutex);
+        return 0;
+}
+EXPORT_SYMBOL(ceph_monc_open_session);
+
+/*
+ * The monitor responds with mount ack indicate mount success.  The
+ * included client ticket allows the client to talk to MDSs and OSDs.
+ */
+static void ceph_monc_handle_map(struct ceph_mon_client *monc,
+                                 struct ceph_msg *msg)
+{
+        struct ceph_client *client = monc->client;
+        struct ceph_monmap *monmap = NULL, *old = monc->monmap;
+        void *p, *end;
+
+        mutex_lock(&monc->mutex);
+
+        dout("handle_monmap\n");
+        p = msg->front.iov_base;
+        end = p + msg->front.iov_len;
+
+        monmap = ceph_monmap_decode(p, end);
+        if (IS_ERR(monmap)) {
+                pr_err("problem decoding monmap, %d\n",
+                       (int)PTR_ERR(monmap));
+                goto out;
+        }
+
+        if (ceph_check_fsid(monc->client, &monmap->fsid) < 0) {
+                kfree(monmap);
+                goto out;
+        }
+
+        client->monc.monmap = monmap;
+        kfree(old);
+
+out:
+        mutex_unlock(&monc->mutex);
+        wake_up_all(&client->auth_wq);
+}
+
+/*
+ * generic requests (e.g., statfs, poolop)
+ */
+static struct ceph_mon_generic_request *__lookup_generic_req(
+        struct ceph_mon_client *monc, u64 tid)
+{
+        struct ceph_mon_generic_request *req;
+        struct rb_node *n = monc->generic_request_tree.rb_node;
+
+        while (n) {
+                req = rb_entry(n, struct ceph_mon_generic_request, node);
+                if (tid < req->tid)
+                        n = n->rb_left;
+                else if (tid > req->tid)
+                        n = n->rb_right;
+                else
+                        return req;
+        }
+        return NULL;
+}
+
+static void __insert_generic_request(struct ceph_mon_client *monc,
+                            struct ceph_mon_generic_request *new)
+{
+        struct rb_node **p = &monc->generic_request_tree.rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_mon_generic_request *req = NULL;
+
+        while (*p) {
+                parent = *p;
+                req = rb_entry(parent, struct ceph_mon_generic_request, node);
+                if (new->tid < req->tid)
+                        p = &(*p)->rb_left;
+                else if (new->tid > req->tid)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&new->node, parent, p);
+        rb_insert_color(&new->node, &monc->generic_request_tree);
+}
+
+static void release_generic_request(struct kref *kref)
+{
+        struct ceph_mon_generic_request *req =
+                container_of(kref, struct ceph_mon_generic_request, kref);
+
+        if (req->reply)
+                ceph_msg_put(req->reply);
+        if (req->request)
+                ceph_msg_put(req->request);
+
+        kfree(req);
+}
+
+static void put_generic_request(struct ceph_mon_generic_request *req)
+{
+        kref_put(&req->kref, release_generic_request);
+}
+
+static void get_generic_request(struct ceph_mon_generic_request *req)
+{
+        kref_get(&req->kref);
+}
+
+static struct ceph_msg *get_generic_reply(struct ceph_connection *con,
+                                         struct ceph_msg_header *hdr,
+                                         int *skip)
+{
+        struct ceph_mon_client *monc = con->private;
+        struct ceph_mon_generic_request *req;
+        u64 tid = le64_to_cpu(hdr->tid);
+        struct ceph_msg *m;
+
+        mutex_lock(&monc->mutex);
+        req = __lookup_generic_req(monc, tid);
+        if (!req) {
+                dout("get_generic_reply %lld dne\n", tid);
+                *skip = 1;
+                m = NULL;
+        } else {
+                dout("get_generic_reply %lld got %p\n", tid, req->reply);
+                m = ceph_msg_get(req->reply);
+                /*
+                 * we don't need to track the connection reading into
+                 * this reply because we only have one open connection
+                 * at a time, ever.
+                 */
+        }
+        mutex_unlock(&monc->mutex);
+        return m;
+}
+
+static int do_generic_request(struct ceph_mon_client *monc,
+                              struct ceph_mon_generic_request *req)
+{
+        int err;
+
+        /* register request */
+        mutex_lock(&monc->mutex);
+        req->tid = ++monc->last_tid;
+        req->request->hdr.tid = cpu_to_le64(req->tid);
+        __insert_generic_request(monc, req);
+        monc->num_generic_requests++;
+        ceph_con_send(monc->con, ceph_msg_get(req->request));
+        mutex_unlock(&monc->mutex);
+
+        err = wait_for_completion_interruptible(&req->completion);
+
+        mutex_lock(&monc->mutex);
+        rb_erase(&req->node, &monc->generic_request_tree);
+        monc->num_generic_requests--;
+        mutex_unlock(&monc->mutex);
+
+        if (!err)
+                err = req->result;
+        return err;
+}
+
+/*
+ * statfs
+ */
+static void handle_statfs_reply(struct ceph_mon_client *monc,
+                                struct ceph_msg *msg)
+{
+        struct ceph_mon_generic_request *req;
+        struct ceph_mon_statfs_reply *reply = msg->front.iov_base;
+        u64 tid = le64_to_cpu(msg->hdr.tid);
+
+        if (msg->front.iov_len != sizeof(*reply))
+                goto bad;
+        dout("handle_statfs_reply %p tid %llu\n", msg, tid);
+
+        mutex_lock(&monc->mutex);
+        req = __lookup_generic_req(monc, tid);
+        if (req) {
+                *(struct ceph_statfs *)req->buf = reply->st;
+                req->result = 0;
+                get_generic_request(req);
+        }
+        mutex_unlock(&monc->mutex);
+        if (req) {
+                complete_all(&req->completion);
+                put_generic_request(req);
+        }
+        return;
+
+bad:
+        pr_err("corrupt generic reply, tid %llu\n", tid);
+        ceph_msg_dump(msg);
+}
+
+/*
+ * Do a synchronous statfs().
+ */
+int ceph_monc_do_statfs(struct ceph_mon_client *monc, struct ceph_statfs *buf)
+{
+        struct ceph_mon_generic_request *req;
+        struct ceph_mon_statfs *h;
+        int err;
+
+        req = kzalloc(sizeof(*req), GFP_NOFS);
+        if (!req)
+                return -ENOMEM;
+
+        kref_init(&req->kref);
+        req->buf = buf;
+        req->buf_len = sizeof(*buf);
+        init_completion(&req->completion);
+
+        err = -ENOMEM;
+        req->request = ceph_msg_new(CEPH_MSG_STATFS, sizeof(*h), GFP_NOFS);
+        if (!req->request)
+                goto out;
+        req->reply = ceph_msg_new(CEPH_MSG_STATFS_REPLY, 1024, GFP_NOFS);
+        if (!req->reply)
+                goto out;
+
+        /* fill out request */
+        h = req->request->front.iov_base;
+        h->monhdr.have_version = 0;
+        h->monhdr.session_mon = cpu_to_le16(-1);
+        h->monhdr.session_mon_tid = 0;
+        h->fsid = monc->monmap->fsid;
+
+        err = do_generic_request(monc, req);
+
+out:
+        kref_put(&req->kref, release_generic_request);
+        return err;
+}
+EXPORT_SYMBOL(ceph_monc_do_statfs);
+
+/*
+ * pool ops
+ */
+static int get_poolop_reply_buf(const char *src, size_t src_len,
+                                char *dst, size_t dst_len)
+{
+        u32 buf_len;
+
+        if (src_len != sizeof(u32) + dst_len)
+                return -EINVAL;
+
+        buf_len = le32_to_cpu(*(u32 *)src);
+        if (buf_len != dst_len)
+                return -EINVAL;
+
+        memcpy(dst, src + sizeof(u32), dst_len);
+        return 0;
+}
+
+static void handle_poolop_reply(struct ceph_mon_client *monc,
+                                struct ceph_msg *msg)
+{
+        struct ceph_mon_generic_request *req;
+        struct ceph_mon_poolop_reply *reply = msg->front.iov_base;
+        u64 tid = le64_to_cpu(msg->hdr.tid);
+
+        if (msg->front.iov_len < sizeof(*reply))
+                goto bad;
+        dout("handle_poolop_reply %p tid %llu\n", msg, tid);
+
+        mutex_lock(&monc->mutex);
+        req = __lookup_generic_req(monc, tid);
+        if (req) {
+                if (req->buf_len &&
+                    get_poolop_reply_buf(msg->front.iov_base + sizeof(*reply),
+                                     msg->front.iov_len - sizeof(*reply),
+                                     req->buf, req->buf_len) < 0) {
+                        mutex_unlock(&monc->mutex);
+                        goto bad;
+                }
+                req->result = le32_to_cpu(reply->reply_code);
+                get_generic_request(req);
+        }
+        mutex_unlock(&monc->mutex);
+        if (req) {
+                complete(&req->completion);
+                put_generic_request(req);
+        }
+        return;
+
+bad:
+        pr_err("corrupt generic reply, tid %llu\n", tid);
+        ceph_msg_dump(msg);
+}
+
+/*
+ * Do a synchronous pool op.
+ */
+int ceph_monc_do_poolop(struct ceph_mon_client *monc, u32 op,
+                        u32 pool, u64 snapid,
+                        char *buf, int len)
+{
+        struct ceph_mon_generic_request *req;
+        struct ceph_mon_poolop *h;
+        int err;
+
+        req = kzalloc(sizeof(*req), GFP_NOFS);
+        if (!req)
+                return -ENOMEM;
+
+        kref_init(&req->kref);
+        req->buf = buf;
+        req->buf_len = len;
+        init_completion(&req->completion);
+
+        err = -ENOMEM;
+        req->request = ceph_msg_new(CEPH_MSG_POOLOP, sizeof(*h), GFP_NOFS);
+        if (!req->request)
+                goto out;
+        req->reply = ceph_msg_new(CEPH_MSG_POOLOP_REPLY, 1024, GFP_NOFS);
+        if (!req->reply)
+                goto out;
+
+        /* fill out request */
+        req->request->hdr.version = cpu_to_le16(2);
+        h = req->request->front.iov_base;
+        h->monhdr.have_version = 0;
+        h->monhdr.session_mon = cpu_to_le16(-1);
+        h->monhdr.session_mon_tid = 0;
+        h->fsid = monc->monmap->fsid;
+        h->pool = cpu_to_le32(pool);
+        h->op = cpu_to_le32(op);
+        h->auid = 0;
+        h->snapid = cpu_to_le64(snapid);
+        h->name_len = 0;
+
+        err = do_generic_request(monc, req);
+
+out:
+        kref_put(&req->kref, release_generic_request);
+        return err;
+}
+
+int ceph_monc_create_snapid(struct ceph_mon_client *monc,
+                            u32 pool, u64 *snapid)
+{
+        return ceph_monc_do_poolop(monc,  POOL_OP_CREATE_UNMANAGED_SNAP,
+                                   pool, 0, (char *)snapid, sizeof(*snapid));
+
+}
+EXPORT_SYMBOL(ceph_monc_create_snapid);
+
+int ceph_monc_delete_snapid(struct ceph_mon_client *monc,
+                            u32 pool, u64 snapid)
+{
+        return ceph_monc_do_poolop(monc,  POOL_OP_CREATE_UNMANAGED_SNAP,
+                                   pool, snapid, 0, 0);
+
+}
+
+/*
+ * Resend pending generic requests.
+ */
+static void __resend_generic_request(struct ceph_mon_client *monc)
+{
+        struct ceph_mon_generic_request *req;
+        struct rb_node *p;
+
+        for (p = rb_first(&monc->generic_request_tree); p; p = rb_next(p)) {
+                req = rb_entry(p, struct ceph_mon_generic_request, node);
+                ceph_con_revoke(monc->con, req->request);
+                ceph_con_send(monc->con, ceph_msg_get(req->request));
+        }
+}
+
+/*
+ * Delayed work.  If we haven't mounted yet, retry.  Otherwise,
+ * renew/retry subscription as needed (in case it is timing out, or we
+ * got an ENOMEM).  And keep the monitor connection alive.
+ */
+static void delayed_work(struct work_struct *work)
+{
+        struct ceph_mon_client *monc =
+                container_of(work, struct ceph_mon_client, delayed_work.work);
+
+        dout("monc delayed_work\n");
+        mutex_lock(&monc->mutex);
+        if (monc->hunting) {
+                __close_session(monc);
+                __open_session(monc);  /* continue hunting */
+        } else {
+                ceph_con_keepalive(monc->con);
+
+                __validate_auth(monc);
+
+                if (monc->auth->ops->is_authenticated(monc->auth))
+                        __send_subscribe(monc);
+        }
+        __schedule_delayed(monc);
+        mutex_unlock(&monc->mutex);
+}
+
+/*
+ * On startup, we build a temporary monmap populated with the IPs
+ * provided by mount(2).
+ */
+static int build_initial_monmap(struct ceph_mon_client *monc)
+{
+        struct ceph_options *opt = monc->client->options;
+        struct ceph_entity_addr *mon_addr = opt->mon_addr;
+        int num_mon = opt->num_mon;
+        int i;
+
+        /* build initial monmap */
+        monc->monmap = kzalloc(sizeof(*monc->monmap) +
+                               num_mon*sizeof(monc->monmap->mon_inst[0]),
+                               GFP_KERNEL);
+        if (!monc->monmap)
+                return -ENOMEM;
+        for (i = 0; i < num_mon; i++) {
+                monc->monmap->mon_inst[i].addr = mon_addr[i];
+                monc->monmap->mon_inst[i].addr.nonce = 0;
+                monc->monmap->mon_inst[i].name.type =
+                        CEPH_ENTITY_TYPE_MON;
+                monc->monmap->mon_inst[i].name.num = cpu_to_le64(i);
+        }
+        monc->monmap->num_mon = num_mon;
+        monc->have_fsid = false;
+        return 0;
+}
+
+int ceph_monc_init(struct ceph_mon_client *monc, struct ceph_client *cl)
+{
+        int err = 0;
+
+        dout("init\n");
+        memset(monc, 0, sizeof(*monc));
+        monc->client = cl;
+        monc->monmap = NULL;
+        mutex_init(&monc->mutex);
+
+        err = build_initial_monmap(monc);
+        if (err)
+                goto out;
+
+        monc->con = NULL;
+
+        /* authentication */
+        monc->auth = ceph_auth_init(cl->options->name,
+                                    cl->options->secret);
+        if (IS_ERR(monc->auth))
+                return PTR_ERR(monc->auth);
+        monc->auth->want_keys =
+                CEPH_ENTITY_TYPE_AUTH | CEPH_ENTITY_TYPE_MON |
+                CEPH_ENTITY_TYPE_OSD | CEPH_ENTITY_TYPE_MDS;
+
+        /* msgs */
+        err = -ENOMEM;
+        monc->m_subscribe_ack = ceph_msg_new(CEPH_MSG_MON_SUBSCRIBE_ACK,
+                                     sizeof(struct ceph_mon_subscribe_ack),
+                                     GFP_NOFS);
+        if (!monc->m_subscribe_ack)
+                goto out_monmap;
+
+        monc->m_subscribe = ceph_msg_new(CEPH_MSG_MON_SUBSCRIBE, 96, GFP_NOFS);
+        if (!monc->m_subscribe)
+                goto out_subscribe_ack;
+
+        monc->m_auth_reply = ceph_msg_new(CEPH_MSG_AUTH_REPLY, 4096, GFP_NOFS);
+        if (!monc->m_auth_reply)
+                goto out_subscribe;
+
+        monc->m_auth = ceph_msg_new(CEPH_MSG_AUTH, 4096, GFP_NOFS);
+        monc->pending_auth = 0;
+        if (!monc->m_auth)
+                goto out_auth_reply;
+
+        monc->cur_mon = -1;
+        monc->hunting = true;
+        monc->sub_renew_after = jiffies;
+        monc->sub_sent = 0;
+
+        INIT_DELAYED_WORK(&monc->delayed_work, delayed_work);
+        monc->generic_request_tree = RB_ROOT;
+        monc->num_generic_requests = 0;
+        monc->last_tid = 0;
+
+        monc->have_mdsmap = 0;
+        monc->have_osdmap = 0;
+        monc->want_next_osdmap = 1;
+        return 0;
+
+out_auth_reply:
+        ceph_msg_put(monc->m_auth_reply);
+out_subscribe:
+        ceph_msg_put(monc->m_subscribe);
+out_subscribe_ack:
+        ceph_msg_put(monc->m_subscribe_ack);
+out_monmap:
+        kfree(monc->monmap);
+out:
+        return err;
+}
+EXPORT_SYMBOL(ceph_monc_init);
+
+void ceph_monc_stop(struct ceph_mon_client *monc)
+{
+        dout("stop\n");
+        cancel_delayed_work_sync(&monc->delayed_work);
+
+        mutex_lock(&monc->mutex);
+        __close_session(monc);
+        if (monc->con) {
+                monc->con->private = NULL;
+                monc->con->ops->put(monc->con);
+                monc->con = NULL;
+        }
+        mutex_unlock(&monc->mutex);
+
+        ceph_auth_destroy(monc->auth);
+
+        ceph_msg_put(monc->m_auth);
+        ceph_msg_put(monc->m_auth_reply);
+        ceph_msg_put(monc->m_subscribe);
+        ceph_msg_put(monc->m_subscribe_ack);
+
+        kfree(monc->monmap);
+}
+EXPORT_SYMBOL(ceph_monc_stop);
+
+static void handle_auth_reply(struct ceph_mon_client *monc,
+                              struct ceph_msg *msg)
+{
+        int ret;
+        int was_auth = 0;
+
+        mutex_lock(&monc->mutex);
+        if (monc->auth->ops)
+                was_auth = monc->auth->ops->is_authenticated(monc->auth);
+        monc->pending_auth = 0;
+        ret = ceph_handle_auth_reply(monc->auth, msg->front.iov_base,
+                                     msg->front.iov_len,
+                                     monc->m_auth->front.iov_base,
+                                     monc->m_auth->front_max);
+        if (ret < 0) {
+                monc->client->auth_err = ret;
+                wake_up_all(&monc->client->auth_wq);
+        } else if (ret > 0) {
+                __send_prepared_auth_request(monc, ret);
+        } else if (!was_auth && monc->auth->ops->is_authenticated(monc->auth)) {
+                dout("authenticated, starting session\n");
+
+                monc->client->msgr->inst.name.type = CEPH_ENTITY_TYPE_CLIENT;
+                monc->client->msgr->inst.name.num =
+                                        cpu_to_le64(monc->auth->global_id);
+
+                __send_subscribe(monc);
+                __resend_generic_request(monc);
+        }
+        mutex_unlock(&monc->mutex);
+}
+
+static int __validate_auth(struct ceph_mon_client *monc)
+{
+        int ret;
+
+        if (monc->pending_auth)
+                return 0;
+
+        ret = ceph_build_auth(monc->auth, monc->m_auth->front.iov_base,
+                              monc->m_auth->front_max);
+        if (ret <= 0)
+                return ret; /* either an error, or no need to authenticate */
+        __send_prepared_auth_request(monc, ret);
+        return 0;
+}
+
+int ceph_monc_validate_auth(struct ceph_mon_client *monc)
+{
+        int ret;
+
+        mutex_lock(&monc->mutex);
+        ret = __validate_auth(monc);
+        mutex_unlock(&monc->mutex);
+        return ret;
+}
+EXPORT_SYMBOL(ceph_monc_validate_auth);
+
+/*
+ * handle incoming message
+ */
+static void dispatch(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        struct ceph_mon_client *monc = con->private;
+        int type = le16_to_cpu(msg->hdr.type);
+
+        if (!monc)
+                return;
+
+        switch (type) {
+        case CEPH_MSG_AUTH_REPLY:
+                handle_auth_reply(monc, msg);
+                break;
+
+        case CEPH_MSG_MON_SUBSCRIBE_ACK:
+                handle_subscribe_ack(monc, msg);
+                break;
+
+        case CEPH_MSG_STATFS_REPLY:
+                handle_statfs_reply(monc, msg);
+                break;
+
+        case CEPH_MSG_POOLOP_REPLY:
+                handle_poolop_reply(monc, msg);
+                break;
+
+        case CEPH_MSG_MON_MAP:
+                ceph_monc_handle_map(monc, msg);
+                break;
+
+        case CEPH_MSG_OSD_MAP:
+                ceph_osdc_handle_map(&monc->client->osdc, msg);
+                break;
+
+        default:
+                /* can the chained handler handle it? */
+                if (monc->client->extra_mon_dispatch &&
+                    monc->client->extra_mon_dispatch(monc->client, msg) == 0)
+                        break;
+                        
+                pr_err("received unknown message type %d %s\n", type,
+                       ceph_msg_type_name(type));
+        }
+        ceph_msg_put(msg);
+}
+
+/*
+ * Allocate memory for incoming message
+ */
+static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con,
+                                      struct ceph_msg_header *hdr,
+                                      int *skip)
+{
+        struct ceph_mon_client *monc = con->private;
+        int type = le16_to_cpu(hdr->type);
+        int front_len = le32_to_cpu(hdr->front_len);
+        struct ceph_msg *m = NULL;
+
+        *skip = 0;
+
+        switch (type) {
+        case CEPH_MSG_MON_SUBSCRIBE_ACK:
+                m = ceph_msg_get(monc->m_subscribe_ack);
+                break;
+        case CEPH_MSG_POOLOP_REPLY:
+        case CEPH_MSG_STATFS_REPLY:
+                return get_generic_reply(con, hdr, skip);
+        case CEPH_MSG_AUTH_REPLY:
+                m = ceph_msg_get(monc->m_auth_reply);
+                break;
+        case CEPH_MSG_MON_MAP:
+        case CEPH_MSG_MDS_MAP:
+        case CEPH_MSG_OSD_MAP:
+                m = ceph_msg_new(type, front_len, GFP_NOFS);
+                break;
+        }
+
+        if (!m) {
+                pr_info("alloc_msg unknown type %d\n", type);
+                *skip = 1;
+        }
+        return m;
+}
+
+/*
+ * If the monitor connection resets, pick a new monitor and resubmit
+ * any pending requests.
+ */
+static void mon_fault(struct ceph_connection *con)
+{
+        struct ceph_mon_client *monc = con->private;
+
+        if (!monc)
+                return;
+
+        dout("mon_fault\n");
+        mutex_lock(&monc->mutex);
+        if (!con->private)
+                goto out;
+
+        if (monc->con && !monc->hunting)
+                pr_info("mon%d %s session lost, "
+                        "hunting for new mon\n", monc->cur_mon,
+                        ceph_pr_addr(&monc->con->peer_addr.in_addr));
+
+        __close_session(monc);
+        if (!monc->hunting) {
+                /* start hunting */
+                monc->hunting = true;
+                __open_session(monc);
+        } else {
+                /* already hunting, let's wait a bit */
+                __schedule_delayed(monc);
+        }
+out:
+        mutex_unlock(&monc->mutex);
+}
+
+static const struct ceph_connection_operations mon_con_ops = {
+        .get = ceph_con_get,
+        .put = ceph_con_put,
+        .dispatch = dispatch,
+        .fault = mon_fault,
+        .alloc_msg = mon_alloc_msg,
+};
diff --git a/net/ceph/msgpool.c b/net/ceph/msgpool.c
new file mode 100644
index 000000000000..d5f2d97ac05c
--- /dev/null
+++ b/net/ceph/msgpool.c
@@ -0,0 +1,64 @@
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/err.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+#include <linux/vmalloc.h>
+
+#include <linux/ceph/msgpool.h>
+
+static void *alloc_fn(gfp_t gfp_mask, void *arg)
+{
+        struct ceph_msgpool *pool = arg;
+        void *p;
+
+        p = ceph_msg_new(0, pool->front_len, gfp_mask);
+        if (!p)
+                pr_err("msgpool %s alloc failed\n", pool->name);
+        return p;
+}
+
+static void free_fn(void *element, void *arg)
+{
+        ceph_msg_put(element);
+}
+
+int ceph_msgpool_init(struct ceph_msgpool *pool,
+                      int front_len, int size, bool blocking, const char *name)
+{
+        pool->front_len = front_len;
+        pool->pool = mempool_create(size, alloc_fn, free_fn, pool);
+        if (!pool->pool)
+                return -ENOMEM;
+        pool->name = name;
+        return 0;
+}
+
+void ceph_msgpool_destroy(struct ceph_msgpool *pool)
+{
+        mempool_destroy(pool->pool);
+}
+
+struct ceph_msg *ceph_msgpool_get(struct ceph_msgpool *pool,
+                                  int front_len)
+{
+        if (front_len > pool->front_len) {
+                pr_err("msgpool_get pool %s need front %d, pool size is %d\n",
+                       pool->name, front_len, pool->front_len);
+                WARN_ON(1);
+
+                /* try to alloc a fresh message */
+                return ceph_msg_new(0, front_len, GFP_NOFS);
+        }
+
+        return mempool_alloc(pool->pool, GFP_NOFS);
+}
+
+void ceph_msgpool_put(struct ceph_msgpool *pool, struct ceph_msg *msg)
+{
+        /* reset msg front_len; user may have changed it */
+        msg->front.iov_len = pool->front_len;
+        msg->hdr.front_len = cpu_to_le32(pool->front_len);
+
+        kref_init(&msg->kref);  /* retake single ref */
+}
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
new file mode 100644
index 000000000000..79391994b3ed
--- /dev/null
+++ b/net/ceph/osd_client.c
@@ -0,0 +1,1773 @@
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/module.h>
+#include <linux/err.h>
+#include <linux/highmem.h>
+#include <linux/mm.h>
+#include <linux/pagemap.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#ifdef CONFIG_BLOCK
+#include <linux/bio.h>
+#endif
+
+#include <linux/ceph/libceph.h>
+#include <linux/ceph/osd_client.h>
+#include <linux/ceph/messenger.h>
+#include <linux/ceph/decode.h>
+#include <linux/ceph/auth.h>
+#include <linux/ceph/pagelist.h>
+
+#define OSD_OP_FRONT_LEN        4096
+#define OSD_OPREPLY_FRONT_LEN   512
+
+static const struct ceph_connection_operations osd_con_ops;
+static int __kick_requests(struct ceph_osd_client *osdc,
+                          struct ceph_osd *kickosd);
+
+static void kick_requests(struct ceph_osd_client *osdc, struct ceph_osd *osd);
+
+static int op_needs_trail(int op)
+{
+        switch (op) {
+        case CEPH_OSD_OP_GETXATTR:
+        case CEPH_OSD_OP_SETXATTR:
+        case CEPH_OSD_OP_CMPXATTR:
+        case CEPH_OSD_OP_CALL:
+                return 1;
+        default:
+                return 0;
+        }
+}
+
+static int op_has_extent(int op)
+{
+        return (op == CEPH_OSD_OP_READ ||
+                op == CEPH_OSD_OP_WRITE);
+}
+
+void ceph_calc_raw_layout(struct ceph_osd_client *osdc,
+                        struct ceph_file_layout *layout,
+                        u64 snapid,
+                        u64 off, u64 *plen, u64 *bno,
+                        struct ceph_osd_request *req,
+                        struct ceph_osd_req_op *op)
+{
+        struct ceph_osd_request_head *reqhead = req->r_request->front.iov_base;
+        u64 orig_len = *plen;
+        u64 objoff, objlen;    /* extent in object */
+
+        reqhead->snapid = cpu_to_le64(snapid);
+
+        /* object extent? */
+        ceph_calc_file_object_mapping(layout, off, plen, bno,
+                                      &objoff, &objlen);
+        if (*plen < orig_len)
+                dout(" skipping last %llu, final file extent %llu~%llu\n",
+                     orig_len - *plen, off, *plen);
+
+        if (op_has_extent(op->op)) {
+                op->extent.offset = objoff;
+                op->extent.length = objlen;
+        }
+        req->r_num_pages = calc_pages_for(off, *plen);
+        if (op->op == CEPH_OSD_OP_WRITE)
+                op->payload_len = *plen;
+
+        dout("calc_layout bno=%llx %llu~%llu (%d pages)\n",
+             *bno, objoff, objlen, req->r_num_pages);
+
+}
+EXPORT_SYMBOL(ceph_calc_raw_layout);
+
+/*
+ * Implement client access to distributed object storage cluster.
+ *
+ * All data objects are stored within a cluster/cloud of OSDs, or
+ * "object storage devices."  (Note that Ceph OSDs have _nothing_ to
+ * do with the T10 OSD extensions to SCSI.)  Ceph OSDs are simply
+ * remote daemons serving up and coordinating consistent and safe
+ * access to storage.
+ *
+ * Cluster membership and the mapping of data objects onto storage devices
+ * are described by the osd map.
+ *
+ * We keep track of pending OSD requests (read, write), resubmit
+ * requests to different OSDs when the cluster topology/data layout
+ * change, or retry the affected requests when the communications
+ * channel with an OSD is reset.
+ */
+
+/*
+ * calculate the mapping of a file extent onto an object, and fill out the
+ * request accordingly.  shorten extent as necessary if it crosses an
+ * object boundary.
+ *
+ * fill osd op in request message.
+ */
+static void calc_layout(struct ceph_osd_client *osdc,
+                        struct ceph_vino vino,
+                        struct ceph_file_layout *layout,
+                        u64 off, u64 *plen,
+                        struct ceph_osd_request *req,
+                        struct ceph_osd_req_op *op)
+{
+        u64 bno;
+
+        ceph_calc_raw_layout(osdc, layout, vino.snap, off,
+                             plen, &bno, req, op);
+
+        sprintf(req->r_oid, "%llx.%08llx", vino.ino, bno);
+        req->r_oid_len = strlen(req->r_oid);
+}
+
+/*
+ * requests
+ */
+void ceph_osdc_release_request(struct kref *kref)
+{
+        struct ceph_osd_request *req = container_of(kref,
+                                                    struct ceph_osd_request,
+                                                    r_kref);
+
+        if (req->r_request)
+                ceph_msg_put(req->r_request);
+        if (req->r_reply)
+                ceph_msg_put(req->r_reply);
+        if (req->r_con_filling_msg) {
+                dout("release_request revoking pages %p from con %p\n",
+                     req->r_pages, req->r_con_filling_msg);
+                ceph_con_revoke_message(req->r_con_filling_msg,
+                                      req->r_reply);
+                ceph_con_put(req->r_con_filling_msg);
+        }
+        if (req->r_own_pages)
+                ceph_release_page_vector(req->r_pages,
+                                         req->r_num_pages);
+#ifdef CONFIG_BLOCK
+        if (req->r_bio)
+                bio_put(req->r_bio);
+#endif
+        ceph_put_snap_context(req->r_snapc);
+        if (req->r_trail) {
+                ceph_pagelist_release(req->r_trail);
+                kfree(req->r_trail);
+        }
+        if (req->r_mempool)
+                mempool_free(req, req->r_osdc->req_mempool);
+        else
+                kfree(req);
+}
+EXPORT_SYMBOL(ceph_osdc_release_request);
+
+static int get_num_ops(struct ceph_osd_req_op *ops, int *needs_trail)
+{
+        int i = 0;
+
+        if (needs_trail)
+                *needs_trail = 0;
+        while (ops[i].op) {
+                if (needs_trail && op_needs_trail(ops[i].op))
+                        *needs_trail = 1;
+                i++;
+        }
+
+        return i;
+}
+
+struct ceph_osd_request *ceph_osdc_alloc_request(struct ceph_osd_client *osdc,
+                                               int flags,
+                                               struct ceph_snap_context *snapc,
+                                               struct ceph_osd_req_op *ops,
+                                               bool use_mempool,
+                                               gfp_t gfp_flags,
+                                               struct page **pages,
+                                               struct bio *bio)
+{
+        struct ceph_osd_request *req;
+        struct ceph_msg *msg;
+        int needs_trail;
+        int num_op = get_num_ops(ops, &needs_trail);
+        size_t msg_size = sizeof(struct ceph_osd_request_head);
+
+        msg_size += num_op*sizeof(struct ceph_osd_op);
+
+        if (use_mempool) {
+                req = mempool_alloc(osdc->req_mempool, gfp_flags);
+                memset(req, 0, sizeof(*req));
+        } else {
+                req = kzalloc(sizeof(*req), gfp_flags);
+        }
+        if (req == NULL)
+                return NULL;
+
+        req->r_osdc = osdc;
+        req->r_mempool = use_mempool;
+
+        kref_init(&req->r_kref);
+        init_completion(&req->r_completion);
+        init_completion(&req->r_safe_completion);
+        INIT_LIST_HEAD(&req->r_unsafe_item);
+        req->r_flags = flags;
+
+        WARN_ON((flags & (CEPH_OSD_FLAG_READ|CEPH_OSD_FLAG_WRITE)) == 0);
+
+        /* create reply message */
+        if (use_mempool)
+                msg = ceph_msgpool_get(&osdc->msgpool_op_reply, 0);
+        else
+                msg = ceph_msg_new(CEPH_MSG_OSD_OPREPLY,
+                                   OSD_OPREPLY_FRONT_LEN, gfp_flags);
+        if (!msg) {
+                ceph_osdc_put_request(req);
+                return NULL;
+        }
+        req->r_reply = msg;
+
+        /* allocate space for the trailing data */
+        if (needs_trail) {
+                req->r_trail = kmalloc(sizeof(struct ceph_pagelist), gfp_flags);
+                if (!req->r_trail) {
+                        ceph_osdc_put_request(req);
+                        return NULL;
+                }
+                ceph_pagelist_init(req->r_trail);
+        }
+        /* create request message; allow space for oid */
+        msg_size += 40;
+        if (snapc)
+                msg_size += sizeof(u64) * snapc->num_snaps;
+        if (use_mempool)
+                msg = ceph_msgpool_get(&osdc->msgpool_op, 0);
+        else
+                msg = ceph_msg_new(CEPH_MSG_OSD_OP, msg_size, gfp_flags);
+        if (!msg) {
+                ceph_osdc_put_request(req);
+                return NULL;
+        }
+
+        msg->hdr.type = cpu_to_le16(CEPH_MSG_OSD_OP);
+        memset(msg->front.iov_base, 0, msg->front.iov_len);
+
+        req->r_request = msg;
+        req->r_pages = pages;
+#ifdef CONFIG_BLOCK
+        if (bio) {
+                req->r_bio = bio;
+                bio_get(req->r_bio);
+        }
+#endif
+
+        return req;
+}
+EXPORT_SYMBOL(ceph_osdc_alloc_request);
+
+static void osd_req_encode_op(struct ceph_osd_request *req,
+                              struct ceph_osd_op *dst,
+                              struct ceph_osd_req_op *src)
+{
+        dst->op = cpu_to_le16(src->op);
+
+        switch (dst->op) {
+        case CEPH_OSD_OP_READ:
+        case CEPH_OSD_OP_WRITE:
+                dst->extent.offset =
+                        cpu_to_le64(src->extent.offset);
+                dst->extent.length =
+                        cpu_to_le64(src->extent.length);
+                dst->extent.truncate_size =
+                        cpu_to_le64(src->extent.truncate_size);
+                dst->extent.truncate_seq =
+                        cpu_to_le32(src->extent.truncate_seq);
+                break;
+
+        case CEPH_OSD_OP_GETXATTR:
+        case CEPH_OSD_OP_SETXATTR:
+        case CEPH_OSD_OP_CMPXATTR:
+                BUG_ON(!req->r_trail);
+
+                dst->xattr.name_len = cpu_to_le32(src->xattr.name_len);
+                dst->xattr.value_len = cpu_to_le32(src->xattr.value_len);
+                dst->xattr.cmp_op = src->xattr.cmp_op;
+                dst->xattr.cmp_mode = src->xattr.cmp_mode;
+                ceph_pagelist_append(req->r_trail, src->xattr.name,
+                                     src->xattr.name_len);
+                ceph_pagelist_append(req->r_trail, src->xattr.val,
+                                     src->xattr.value_len);
+                break;
+        case CEPH_OSD_OP_CALL:
+                BUG_ON(!req->r_trail);
+
+                dst->cls.class_len = src->cls.class_len;
+                dst->cls.method_len = src->cls.method_len;
+                dst->cls.indata_len = cpu_to_le32(src->cls.indata_len);
+
+                ceph_pagelist_append(req->r_trail, src->cls.class_name,
+                                     src->cls.class_len);
+                ceph_pagelist_append(req->r_trail, src->cls.method_name,
+                                     src->cls.method_len);
+                ceph_pagelist_append(req->r_trail, src->cls.indata,
+                                     src->cls.indata_len);
+                break;
+        case CEPH_OSD_OP_ROLLBACK:
+                dst->snap.snapid = cpu_to_le64(src->snap.snapid);
+                break;
+        case CEPH_OSD_OP_STARTSYNC:
+                break;
+        default:
+                pr_err("unrecognized osd opcode %d\n", dst->op);
+                WARN_ON(1);
+                break;
+        }
+        dst->payload_len = cpu_to_le32(src->payload_len);
+}
+
+/*
+ * build new request AND message
+ *
+ */
+void ceph_osdc_build_request(struct ceph_osd_request *req,
+                             u64 off, u64 *plen,
+                             struct ceph_osd_req_op *src_ops,
+                             struct ceph_snap_context *snapc,
+                             struct timespec *mtime,
+                             const char *oid,
+                             int oid_len)
+{
+        struct ceph_msg *msg = req->r_request;
+        struct ceph_osd_request_head *head;
+        struct ceph_osd_req_op *src_op;
+        struct ceph_osd_op *op;
+        void *p;
+        int num_op = get_num_ops(src_ops, NULL);
+        size_t msg_size = sizeof(*head) + num_op*sizeof(*op);
+        int flags = req->r_flags;
+        u64 data_len = 0;
+        int i;
+
+        head = msg->front.iov_base;
+        op = (void *)(head + 1);
+        p = (void *)(op + num_op);
+
+        req->r_snapc = ceph_get_snap_context(snapc);
+
+        head->client_inc = cpu_to_le32(1); /* always, for now. */
+        head->flags = cpu_to_le32(flags);
+        if (flags & CEPH_OSD_FLAG_WRITE)
+                ceph_encode_timespec(&head->mtime, mtime);
+        head->num_ops = cpu_to_le16(num_op);
+
+
+        /* fill in oid */
+        head->object_len = cpu_to_le32(oid_len);
+        memcpy(p, oid, oid_len);
+        p += oid_len;
+
+        src_op = src_ops;
+        while (src_op->op) {
+                osd_req_encode_op(req, op, src_op);
+                src_op++;
+                op++;
+        }
+
+        if (req->r_trail)
+                data_len += req->r_trail->length;
+
+        if (snapc) {
+                head->snap_seq = cpu_to_le64(snapc->seq);
+                head->num_snaps = cpu_to_le32(snapc->num_snaps);
+                for (i = 0; i < snapc->num_snaps; i++) {
+                        put_unaligned_le64(snapc->snaps[i], p);
+                        p += sizeof(u64);
+                }
+        }
+
+        if (flags & CEPH_OSD_FLAG_WRITE) {
+                req->r_request->hdr.data_off = cpu_to_le16(off);
+                req->r_request->hdr.data_len = cpu_to_le32(*plen + data_len);
+        } else if (data_len) {
+                req->r_request->hdr.data_off = 0;
+                req->r_request->hdr.data_len = cpu_to_le32(data_len);
+        }
+
+        BUG_ON(p > msg->front.iov_base + msg->front.iov_len);
+        msg_size = p - msg->front.iov_base;
+        msg->front.iov_len = msg_size;
+        msg->hdr.front_len = cpu_to_le32(msg_size);
+        return;
+}
+EXPORT_SYMBOL(ceph_osdc_build_request);
+
+/*
+ * build new request AND message, calculate layout, and adjust file
+ * extent as needed.
+ *
+ * if the file was recently truncated, we include information about its
+ * old and new size so that the object can be updated appropriately.  (we
+ * avoid synchronously deleting truncated objects because it's slow.)
+ *
+ * if @do_sync, include a 'startsync' command so that the osd will flush
+ * data quickly.
+ */
+struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
+                                               struct ceph_file_layout *layout,
+                                               struct ceph_vino vino,
+                                               u64 off, u64 *plen,
+                                               int opcode, int flags,
+                                               struct ceph_snap_context *snapc,
+                                               int do_sync,
+                                               u32 truncate_seq,
+                                               u64 truncate_size,
+                                               struct timespec *mtime,
+                                               bool use_mempool, int num_reply)
+{
+        struct ceph_osd_req_op ops[3];
+        struct ceph_osd_request *req;
+
+        ops[0].op = opcode;
+        ops[0].extent.truncate_seq = truncate_seq;
+        ops[0].extent.truncate_size = truncate_size;
+        ops[0].payload_len = 0;
+
+        if (do_sync) {
+                ops[1].op = CEPH_OSD_OP_STARTSYNC;
+                ops[1].payload_len = 0;
+                ops[2].op = 0;
+        } else
+                ops[1].op = 0;
+
+        req = ceph_osdc_alloc_request(osdc, flags,
+                                         snapc, ops,
+                                         use_mempool,
+                                         GFP_NOFS, NULL, NULL);
+        if (IS_ERR(req))
+                return req;
+
+        /* calculate max write size */
+        calc_layout(osdc, vino, layout, off, plen, req, ops);
+        req->r_file_layout = *layout;  /* keep a copy */
+
+        ceph_osdc_build_request(req, off, plen, ops,
+                                snapc,
+                                mtime,
+                                req->r_oid, req->r_oid_len);
+
+        return req;
+}
+EXPORT_SYMBOL(ceph_osdc_new_request);
+
+/*
+ * We keep osd requests in an rbtree, sorted by ->r_tid.
+ */
+static void __insert_request(struct ceph_osd_client *osdc,
+                             struct ceph_osd_request *new)
+{
+        struct rb_node **p = &osdc->requests.rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_osd_request *req = NULL;
+
+        while (*p) {
+                parent = *p;
+                req = rb_entry(parent, struct ceph_osd_request, r_node);
+                if (new->r_tid < req->r_tid)
+                        p = &(*p)->rb_left;
+                else if (new->r_tid > req->r_tid)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&new->r_node, parent, p);
+        rb_insert_color(&new->r_node, &osdc->requests);
+}
+
+static struct ceph_osd_request *__lookup_request(struct ceph_osd_client *osdc,
+                                                 u64 tid)
+{
+        struct ceph_osd_request *req;
+        struct rb_node *n = osdc->requests.rb_node;
+
+        while (n) {
+                req = rb_entry(n, struct ceph_osd_request, r_node);
+                if (tid < req->r_tid)
+                        n = n->rb_left;
+                else if (tid > req->r_tid)
+                        n = n->rb_right;
+                else
+                        return req;
+        }
+        return NULL;
+}
+
+static struct ceph_osd_request *
+__lookup_request_ge(struct ceph_osd_client *osdc,
+                    u64 tid)
+{
+        struct ceph_osd_request *req;
+        struct rb_node *n = osdc->requests.rb_node;
+
+        while (n) {
+                req = rb_entry(n, struct ceph_osd_request, r_node);
+                if (tid < req->r_tid) {
+                        if (!n->rb_left)
+                                return req;
+                        n = n->rb_left;
+                } else if (tid > req->r_tid) {
+                        n = n->rb_right;
+                } else {
+                        return req;
+                }
+        }
+        return NULL;
+}
+
+
+/*
+ * If the osd connection drops, we need to resubmit all requests.
+ */
+static void osd_reset(struct ceph_connection *con)
+{
+        struct ceph_osd *osd = con->private;
+        struct ceph_osd_client *osdc;
+
+        if (!osd)
+                return;
+        dout("osd_reset osd%d\n", osd->o_osd);
+        osdc = osd->o_osdc;
+        down_read(&osdc->map_sem);
+        kick_requests(osdc, osd);
+        up_read(&osdc->map_sem);
+}
+
+/*
+ * Track open sessions with osds.
+ */
+static struct ceph_osd *create_osd(struct ceph_osd_client *osdc)
+{
+        struct ceph_osd *osd;
+
+        osd = kzalloc(sizeof(*osd), GFP_NOFS);
+        if (!osd)
+                return NULL;
+
+        atomic_set(&osd->o_ref, 1);
+        osd->o_osdc = osdc;
+        INIT_LIST_HEAD(&osd->o_requests);
+        INIT_LIST_HEAD(&osd->o_osd_lru);
+        osd->o_incarnation = 1;
+
+        ceph_con_init(osdc->client->msgr, &osd->o_con);
+        osd->o_con.private = osd;
+        osd->o_con.ops = &osd_con_ops;
+        osd->o_con.peer_name.type = CEPH_ENTITY_TYPE_OSD;
+
+        INIT_LIST_HEAD(&osd->o_keepalive_item);
+        return osd;
+}
+
+static struct ceph_osd *get_osd(struct ceph_osd *osd)
+{
+        if (atomic_inc_not_zero(&osd->o_ref)) {
+                dout("get_osd %p %d -> %d\n", osd, atomic_read(&osd->o_ref)-1,
+                     atomic_read(&osd->o_ref));
+                return osd;
+        } else {
+                dout("get_osd %p FAIL\n", osd);
+                return NULL;
+        }
+}
+
+static void put_osd(struct ceph_osd *osd)
+{
+        dout("put_osd %p %d -> %d\n", osd, atomic_read(&osd->o_ref),
+             atomic_read(&osd->o_ref) - 1);
+        if (atomic_dec_and_test(&osd->o_ref)) {
+                struct ceph_auth_client *ac = osd->o_osdc->client->monc.auth;
+
+                if (osd->o_authorizer)
+                        ac->ops->destroy_authorizer(ac, osd->o_authorizer);
+                kfree(osd);
+        }
+}
+
+/*
+ * remove an osd from our map
+ */
+static void __remove_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
+{
+        dout("__remove_osd %p\n", osd);
+        BUG_ON(!list_empty(&osd->o_requests));
+        rb_erase(&osd->o_node, &osdc->osds);
+        list_del_init(&osd->o_osd_lru);
+        ceph_con_close(&osd->o_con);
+        put_osd(osd);
+}
+
+static void __move_osd_to_lru(struct ceph_osd_client *osdc,
+                              struct ceph_osd *osd)
+{
+        dout("__move_osd_to_lru %p\n", osd);
+        BUG_ON(!list_empty(&osd->o_osd_lru));
+        list_add_tail(&osd->o_osd_lru, &osdc->osd_lru);
+        osd->lru_ttl = jiffies + osdc->client->options->osd_idle_ttl * HZ;
+}
+
+static void __remove_osd_from_lru(struct ceph_osd *osd)
+{
+        dout("__remove_osd_from_lru %p\n", osd);
+        if (!list_empty(&osd->o_osd_lru))
+                list_del_init(&osd->o_osd_lru);
+}
+
+static void remove_old_osds(struct ceph_osd_client *osdc, int remove_all)
+{
+        struct ceph_osd *osd, *nosd;
+
+        dout("__remove_old_osds %p\n", osdc);
+        mutex_lock(&osdc->request_mutex);
+        list_for_each_entry_safe(osd, nosd, &osdc->osd_lru, o_osd_lru) {
+                if (!remove_all && time_before(jiffies, osd->lru_ttl))
+                        break;
+                __remove_osd(osdc, osd);
+        }
+        mutex_unlock(&osdc->request_mutex);
+}
+
+/*
+ * reset osd connect
+ */
+static int __reset_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
+{
+        struct ceph_osd_request *req;
+        int ret = 0;
+
+        dout("__reset_osd %p osd%d\n", osd, osd->o_osd);
+        if (list_empty(&osd->o_requests)) {
+                __remove_osd(osdc, osd);
+        } else if (memcmp(&osdc->osdmap->osd_addr[osd->o_osd],
+                          &osd->o_con.peer_addr,
+                          sizeof(osd->o_con.peer_addr)) == 0 &&
+                   !ceph_con_opened(&osd->o_con)) {
+                dout(" osd addr hasn't changed and connection never opened,"
+                     " letting msgr retry");
+                /* touch each r_stamp for handle_timeout()'s benfit */
+                list_for_each_entry(req, &osd->o_requests, r_osd_item)
+                        req->r_stamp = jiffies;
+                ret = -EAGAIN;
+        } else {
+                ceph_con_close(&osd->o_con);
+                ceph_con_open(&osd->o_con, &osdc->osdmap->osd_addr[osd->o_osd]);
+                osd->o_incarnation++;
+        }
+        return ret;
+}
+
+static void __insert_osd(struct ceph_osd_client *osdc, struct ceph_osd *new)
+{
+        struct rb_node **p = &osdc->osds.rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_osd *osd = NULL;
+
+        while (*p) {
+                parent = *p;
+                osd = rb_entry(parent, struct ceph_osd, o_node);
+                if (new->o_osd < osd->o_osd)
+                        p = &(*p)->rb_left;
+                else if (new->o_osd > osd->o_osd)
+                        p = &(*p)->rb_right;
+                else
+                        BUG();
+        }
+
+        rb_link_node(&new->o_node, parent, p);
+        rb_insert_color(&new->o_node, &osdc->osds);
+}
+
+static struct ceph_osd *__lookup_osd(struct ceph_osd_client *osdc, int o)
+{
+        struct ceph_osd *osd;
+        struct rb_node *n = osdc->osds.rb_node;
+
+        while (n) {
+                osd = rb_entry(n, struct ceph_osd, o_node);
+                if (o < osd->o_osd)
+                        n = n->rb_left;
+                else if (o > osd->o_osd)
+                        n = n->rb_right;
+                else
+                        return osd;
+        }
+        return NULL;
+}
+
+static void __schedule_osd_timeout(struct ceph_osd_client *osdc)
+{
+        schedule_delayed_work(&osdc->timeout_work,
+                        osdc->client->options->osd_keepalive_timeout * HZ);
+}
+
+static void __cancel_osd_timeout(struct ceph_osd_client *osdc)
+{
+        cancel_delayed_work(&osdc->timeout_work);
+}
+
+/*
+ * Register request, assign tid.  If this is the first request, set up
+ * the timeout event.
+ */
+static void register_request(struct ceph_osd_client *osdc,
+                             struct ceph_osd_request *req)
+{
+        mutex_lock(&osdc->request_mutex);
+        req->r_tid = ++osdc->last_tid;
+        req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
+        INIT_LIST_HEAD(&req->r_req_lru_item);
+
+        dout("register_request %p tid %lld\n", req, req->r_tid);
+        __insert_request(osdc, req);
+        ceph_osdc_get_request(req);
+        osdc->num_requests++;
+
+        if (osdc->num_requests == 1) {
+                dout(" first request, scheduling timeout\n");
+                __schedule_osd_timeout(osdc);
+        }
+        mutex_unlock(&osdc->request_mutex);
+}
+
+/*
+ * called under osdc->request_mutex
+ */
+static void __unregister_request(struct ceph_osd_client *osdc,
+                                 struct ceph_osd_request *req)
+{
+        dout("__unregister_request %p tid %lld\n", req, req->r_tid);
+        rb_erase(&req->r_node, &osdc->requests);
+        osdc->num_requests--;
+
+        if (req->r_osd) {
+                /* make sure the original request isn't in flight. */
+                ceph_con_revoke(&req->r_osd->o_con, req->r_request);
+
+                list_del_init(&req->r_osd_item);
+                if (list_empty(&req->r_osd->o_requests))
+                        __move_osd_to_lru(osdc, req->r_osd);
+                req->r_osd = NULL;
+        }
+
+        ceph_osdc_put_request(req);
+
+        list_del_init(&req->r_req_lru_item);
+        if (osdc->num_requests == 0) {
+                dout(" no requests, canceling timeout\n");
+                __cancel_osd_timeout(osdc);
+        }
+}
+
+/*
+ * Cancel a previously queued request message
+ */
+static void __cancel_request(struct ceph_osd_request *req)
+{
+        if (req->r_sent && req->r_osd) {
+                ceph_con_revoke(&req->r_osd->o_con, req->r_request);
+                req->r_sent = 0;
+        }
+        list_del_init(&req->r_req_lru_item);
+}
+
+/*
+ * Pick an osd (the first 'up' osd in the pg), allocate the osd struct
+ * (as needed), and set the request r_osd appropriately.  If there is
+ * no up osd, set r_osd to NULL.
+ *
+ * Return 0 if unchanged, 1 if changed, or negative on error.
+ *
+ * Caller should hold map_sem for read and request_mutex.
+ */
+static int __map_osds(struct ceph_osd_client *osdc,
+                      struct ceph_osd_request *req)
+{
+        struct ceph_osd_request_head *reqhead = req->r_request->front.iov_base;
+        struct ceph_pg pgid;
+        int acting[CEPH_PG_MAX_SIZE];
+        int o = -1, num = 0;
+        int err;
+
+        dout("map_osds %p tid %lld\n", req, req->r_tid);
+        err = ceph_calc_object_layout(&reqhead->layout, req->r_oid,
+                                      &req->r_file_layout, osdc->osdmap);
+        if (err)
+                return err;
+        pgid = reqhead->layout.ol_pgid;
+        req->r_pgid = pgid;
+
+        err = ceph_calc_pg_acting(osdc->osdmap, pgid, acting);
+        if (err > 0) {
+                o = acting[0];
+                num = err;
+        }
+
+        if ((req->r_osd && req->r_osd->o_osd == o &&
+             req->r_sent >= req->r_osd->o_incarnation &&
+             req->r_num_pg_osds == num &&
+             memcmp(req->r_pg_osds, acting, sizeof(acting[0])*num) == 0) ||
+            (req->r_osd == NULL && o == -1))
+                return 0;  /* no change */
+
+        dout("map_osds tid %llu pgid %d.%x osd%d (was osd%d)\n",
+             req->r_tid, le32_to_cpu(pgid.pool), le16_to_cpu(pgid.ps), o,
+             req->r_osd ? req->r_osd->o_osd : -1);
+
+        /* record full pg acting set */
+        memcpy(req->r_pg_osds, acting, sizeof(acting[0]) * num);
+        req->r_num_pg_osds = num;
+
+        if (req->r_osd) {
+                __cancel_request(req);
+                list_del_init(&req->r_osd_item);
+                req->r_osd = NULL;
+        }
+
+        req->r_osd = __lookup_osd(osdc, o);
+        if (!req->r_osd && o >= 0) {
+                err = -ENOMEM;
+                req->r_osd = create_osd(osdc);
+                if (!req->r_osd)
+                        goto out;
+
+                dout("map_osds osd %p is osd%d\n", req->r_osd, o);
+                req->r_osd->o_osd = o;
+                req->r_osd->o_con.peer_name.num = cpu_to_le64(o);
+                __insert_osd(osdc, req->r_osd);
+
+                ceph_con_open(&req->r_osd->o_con, &osdc->osdmap->osd_addr[o]);
+        }
+
+        if (req->r_osd) {
+                __remove_osd_from_lru(req->r_osd);
+                list_add(&req->r_osd_item, &req->r_osd->o_requests);
+        }
+        err = 1;   /* osd or pg changed */
+
+out:
+        return err;
+}
+
+/*
+ * caller should hold map_sem (for read) and request_mutex
+ */
+static int __send_request(struct ceph_osd_client *osdc,
+                          struct ceph_osd_request *req)
+{
+        struct ceph_osd_request_head *reqhead;
+        int err;
+
+        err = __map_osds(osdc, req);
+        if (err < 0)
+                return err;
+        if (req->r_osd == NULL) {
+                dout("send_request %p no up osds in pg\n", req);
+                ceph_monc_request_next_osdmap(&osdc->client->monc);
+                return 0;
+        }
+
+        dout("send_request %p tid %llu to osd%d flags %d\n",
+             req, req->r_tid, req->r_osd->o_osd, req->r_flags);
+
+        reqhead = req->r_request->front.iov_base;
+        reqhead->osdmap_epoch = cpu_to_le32(osdc->osdmap->epoch);
+        reqhead->flags |= cpu_to_le32(req->r_flags);  /* e.g., RETRY */
+        reqhead->reassert_version = req->r_reassert_version;
+
+        req->r_stamp = jiffies;
+        list_move_tail(&req->r_req_lru_item, &osdc->req_lru);
+
+        ceph_msg_get(req->r_request); /* send consumes a ref */
+        ceph_con_send(&req->r_osd->o_con, req->r_request);
+        req->r_sent = req->r_osd->o_incarnation;
+        return 0;
+}
+
+/*
+ * Timeout callback, called every N seconds when 1 or more osd
+ * requests has been active for more than N seconds.  When this
+ * happens, we ping all OSDs with requests who have timed out to
+ * ensure any communications channel reset is detected.  Reset the
+ * request timeouts another N seconds in the future as we go.
+ * Reschedule the timeout event another N seconds in future (unless
+ * there are no open requests).
+ */
+static void handle_timeout(struct work_struct *work)
+{
+        struct ceph_osd_client *osdc =
+                container_of(work, struct ceph_osd_client, timeout_work.work);
+        struct ceph_osd_request *req, *last_req = NULL;
+        struct ceph_osd *osd;
+        unsigned long timeout = osdc->client->options->osd_timeout * HZ;
+        unsigned long keepalive =
+                osdc->client->options->osd_keepalive_timeout * HZ;
+        unsigned long last_stamp = 0;
+        struct rb_node *p;
+        struct list_head slow_osds;
+
+        dout("timeout\n");
+        down_read(&osdc->map_sem);
+
+        ceph_monc_request_next_osdmap(&osdc->client->monc);
+
+        mutex_lock(&osdc->request_mutex);
+        for (p = rb_first(&osdc->requests); p; p = rb_next(p)) {
+                req = rb_entry(p, struct ceph_osd_request, r_node);
+
+                if (req->r_resend) {
+                        int err;
+
+                        dout("osdc resending prev failed %lld\n", req->r_tid);
+                        err = __send_request(osdc, req);
+                        if (err)
+                                dout("osdc failed again on %lld\n", req->r_tid);
+                        else
+                                req->r_resend = false;
+                        continue;
+                }
+        }
+
+        /*
+         * reset osds that appear to be _really_ unresponsive.  this
+         * is a failsafe measure.. we really shouldn't be getting to
+         * this point if the system is working properly.  the monitors
+         * should mark the osd as failed and we should find out about
+         * it from an updated osd map.
+         */
+        while (timeout && !list_empty(&osdc->req_lru)) {
+                req = list_entry(osdc->req_lru.next, struct ceph_osd_request,
+                                 r_req_lru_item);
+
+                if (time_before(jiffies, req->r_stamp + timeout))
+                        break;
+
+                BUG_ON(req == last_req && req->r_stamp == last_stamp);
+                last_req = req;
+                last_stamp = req->r_stamp;
+
+                osd = req->r_osd;
+                BUG_ON(!osd);
+                pr_warning(" tid %llu timed out on osd%d, will reset osd\n",
+                           req->r_tid, osd->o_osd);
+                __kick_requests(osdc, osd);
+        }
+
+        /*
+         * ping osds that are a bit slow.  this ensures that if there
+         * is a break in the TCP connection we will notice, and reopen
+         * a connection with that osd (from the fault callback).
+         */
+        INIT_LIST_HEAD(&slow_osds);
+        list_for_each_entry(req, &osdc->req_lru, r_req_lru_item) {
+                if (time_before(jiffies, req->r_stamp + keepalive))
+                        break;
+
+                osd = req->r_osd;
+                BUG_ON(!osd);
+                dout(" tid %llu is slow, will send keepalive on osd%d\n",
+                     req->r_tid, osd->o_osd);
+                list_move_tail(&osd->o_keepalive_item, &slow_osds);
+        }
+        while (!list_empty(&slow_osds)) {
+                osd = list_entry(slow_osds.next, struct ceph_osd,
+                                 o_keepalive_item);
+                list_del_init(&osd->o_keepalive_item);
+                ceph_con_keepalive(&osd->o_con);
+        }
+
+        __schedule_osd_timeout(osdc);
+        mutex_unlock(&osdc->request_mutex);
+
+        up_read(&osdc->map_sem);
+}
+
+static void handle_osds_timeout(struct work_struct *work)
+{
+        struct ceph_osd_client *osdc =
+                container_of(work, struct ceph_osd_client,
+                             osds_timeout_work.work);
+        unsigned long delay =
+                osdc->client->options->osd_idle_ttl * HZ >> 2;
+
+        dout("osds timeout\n");
+        down_read(&osdc->map_sem);
+        remove_old_osds(osdc, 0);
+        up_read(&osdc->map_sem);
+
+        schedule_delayed_work(&osdc->osds_timeout_work,
+                              round_jiffies_relative(delay));
+}
+
+/*
+ * handle osd op reply.  either call the callback if it is specified,
+ * or do the completion to wake up the waiting thread.
+ */
+static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
+                         struct ceph_connection *con)
+{
+        struct ceph_osd_reply_head *rhead = msg->front.iov_base;
+        struct ceph_osd_request *req;
+        u64 tid;
+        int numops, object_len, flags;
+        s32 result;
+
+        tid = le64_to_cpu(msg->hdr.tid);
+        if (msg->front.iov_len < sizeof(*rhead))
+                goto bad;
+        numops = le32_to_cpu(rhead->num_ops);
+        object_len = le32_to_cpu(rhead->object_len);
+        result = le32_to_cpu(rhead->result);
+        if (msg->front.iov_len != sizeof(*rhead) + object_len +
+            numops * sizeof(struct ceph_osd_op))
+                goto bad;
+        dout("handle_reply %p tid %llu result %d\n", msg, tid, (int)result);
+
+        /* lookup */
+        mutex_lock(&osdc->request_mutex);
+        req = __lookup_request(osdc, tid);
+        if (req == NULL) {
+                dout("handle_reply tid %llu dne\n", tid);
+                mutex_unlock(&osdc->request_mutex);
+                return;
+        }
+        ceph_osdc_get_request(req);
+        flags = le32_to_cpu(rhead->flags);
+
+        /*
+         * if this connection filled our message, drop our reference now, to
+         * avoid a (safe but slower) revoke later.
+         */
+        if (req->r_con_filling_msg == con && req->r_reply == msg) {
+                dout(" dropping con_filling_msg ref %p\n", con);
+                req->r_con_filling_msg = NULL;
+                ceph_con_put(con);
+        }
+
+        if (!req->r_got_reply) {
+                unsigned bytes;
+
+                req->r_result = le32_to_cpu(rhead->result);
+                bytes = le32_to_cpu(msg->hdr.data_len);
+                dout("handle_reply result %d bytes %d\n", req->r_result,
+                     bytes);
+                if (req->r_result == 0)
+                        req->r_result = bytes;
+
+                /* in case this is a write and we need to replay, */
+                req->r_reassert_version = rhead->reassert_version;
+
+                req->r_got_reply = 1;
+        } else if ((flags & CEPH_OSD_FLAG_ONDISK) == 0) {
+                dout("handle_reply tid %llu dup ack\n", tid);
+                mutex_unlock(&osdc->request_mutex);
+                goto done;
+        }
+
+        dout("handle_reply tid %llu flags %d\n", tid, flags);
+
+        /* either this is a read, or we got the safe response */
+        if (result < 0 ||
+            (flags & CEPH_OSD_FLAG_ONDISK) ||
+            ((flags & CEPH_OSD_FLAG_WRITE) == 0))
+                __unregister_request(osdc, req);
+
+        mutex_unlock(&osdc->request_mutex);
+
+        if (req->r_callback)
+                req->r_callback(req, msg);
+        else
+                complete_all(&req->r_completion);
+
+        if (flags & CEPH_OSD_FLAG_ONDISK) {
+                if (req->r_safe_callback)
+                        req->r_safe_callback(req, msg);
+                complete_all(&req->r_safe_completion);  /* fsync waiter */
+        }
+
+done:
+        ceph_osdc_put_request(req);
+        return;
+
+bad:
+        pr_err("corrupt osd_op_reply got %d %d expected %d\n",
+               (int)msg->front.iov_len, le32_to_cpu(msg->hdr.front_len),
+               (int)sizeof(*rhead));
+        ceph_msg_dump(msg);
+}
+
+
+static int __kick_requests(struct ceph_osd_client *osdc,
+                          struct ceph_osd *kickosd)
+{
+        struct ceph_osd_request *req;
+        struct rb_node *p, *n;
+        int needmap = 0;
+        int err;
+
+        dout("kick_requests osd%d\n", kickosd ? kickosd->o_osd : -1);
+        if (kickosd) {
+                err = __reset_osd(osdc, kickosd);
+                if (err == -EAGAIN)
+                        return 1;
+        } else {
+                for (p = rb_first(&osdc->osds); p; p = n) {
+                        struct ceph_osd *osd =
+                                rb_entry(p, struct ceph_osd, o_node);
+
+                        n = rb_next(p);
+                        if (!ceph_osd_is_up(osdc->osdmap, osd->o_osd) ||
+                            memcmp(&osd->o_con.peer_addr,
+                                   ceph_osd_addr(osdc->osdmap,
+                                                 osd->o_osd),
+                                   sizeof(struct ceph_entity_addr)) != 0)
+                                __reset_osd(osdc, osd);
+                }
+        }
+
+        for (p = rb_first(&osdc->requests); p; p = rb_next(p)) {
+                req = rb_entry(p, struct ceph_osd_request, r_node);
+
+                if (req->r_resend) {
+                        dout(" r_resend set on tid %llu\n", req->r_tid);
+                        __cancel_request(req);
+                        goto kick;
+                }
+                if (req->r_osd && kickosd == req->r_osd) {
+                        __cancel_request(req);
+                        goto kick;
+                }
+
+                err = __map_osds(osdc, req);
+                if (err == 0)
+                        continue;  /* no change */
+                if (err < 0) {
+                        /*
+                         * FIXME: really, we should set the request
+                         * error and fail if this isn't a 'nofail'
+                         * request, but that's a fair bit more
+                         * complicated to do.  So retry!
+                         */
+                        dout(" setting r_resend on %llu\n", req->r_tid);
+                        req->r_resend = true;
+                        continue;
+                }
+                if (req->r_osd == NULL) {
+                        dout("tid %llu maps to no valid osd\n", req->r_tid);
+                        needmap++;  /* request a newer map */
+                        continue;
+                }
+
+kick:
+                dout("kicking %p tid %llu osd%d\n", req, req->r_tid,
+                     req->r_osd ? req->r_osd->o_osd : -1);
+                req->r_flags |= CEPH_OSD_FLAG_RETRY;
+                err = __send_request(osdc, req);
+                if (err) {
+                        dout(" setting r_resend on %llu\n", req->r_tid);
+                        req->r_resend = true;
+                }
+        }
+
+        return needmap;
+}
+
+/*
+ * Resubmit osd requests whose osd or osd address has changed.  Request
+ * a new osd map if osds are down, or we are otherwise unable to determine
+ * how to direct a request.
+ *
+ * Close connections to down osds.
+ *
+ * If @who is specified, resubmit requests for that specific osd.
+ *
+ * Caller should hold map_sem for read and request_mutex.
+ */
+static void kick_requests(struct ceph_osd_client *osdc,
+                          struct ceph_osd *kickosd)
+{
+        int needmap;
+
+        mutex_lock(&osdc->request_mutex);
+        needmap = __kick_requests(osdc, kickosd);
+        mutex_unlock(&osdc->request_mutex);
+
+        if (needmap) {
+                dout("%d requests for down osds, need new map\n", needmap);
+                ceph_monc_request_next_osdmap(&osdc->client->monc);
+        }
+
+}
+/*
+ * Process updated osd map.
+ *
+ * The message contains any number of incremental and full maps, normally
+ * indicating some sort of topology change in the cluster.  Kick requests
+ * off to different OSDs as needed.
+ */
+void ceph_osdc_handle_map(struct ceph_osd_client *osdc, struct ceph_msg *msg)
+{
+        void *p, *end, *next;
+        u32 nr_maps, maplen;
+        u32 epoch;
+        struct ceph_osdmap *newmap = NULL, *oldmap;
+        int err;
+        struct ceph_fsid fsid;
+
+        dout("handle_map have %u\n", osdc->osdmap ? osdc->osdmap->epoch : 0);
+        p = msg->front.iov_base;
+        end = p + msg->front.iov_len;
+
+        /* verify fsid */
+        ceph_decode_need(&p, end, sizeof(fsid), bad);
+        ceph_decode_copy(&p, &fsid, sizeof(fsid));
+        if (ceph_check_fsid(osdc->client, &fsid) < 0)
+                return;
+
+        down_write(&osdc->map_sem);
+
+        /* incremental maps */
+        ceph_decode_32_safe(&p, end, nr_maps, bad);
+        dout(" %d inc maps\n", nr_maps);
+        while (nr_maps > 0) {
+                ceph_decode_need(&p, end, 2*sizeof(u32), bad);
+                epoch = ceph_decode_32(&p);
+                maplen = ceph_decode_32(&p);
+                ceph_decode_need(&p, end, maplen, bad);
+                next = p + maplen;
+                if (osdc->osdmap && osdc->osdmap->epoch+1 == epoch) {
+                        dout("applying incremental map %u len %d\n",
+                             epoch, maplen);
+                        newmap = osdmap_apply_incremental(&p, next,
+                                                          osdc->osdmap,
+                                                          osdc->client->msgr);
+                        if (IS_ERR(newmap)) {
+                                err = PTR_ERR(newmap);
+                                goto bad;
+                        }
+                        BUG_ON(!newmap);
+                        if (newmap != osdc->osdmap) {
+                                ceph_osdmap_destroy(osdc->osdmap);
+                                osdc->osdmap = newmap;
+                        }
+                } else {
+                        dout("ignoring incremental map %u len %d\n",
+                             epoch, maplen);
+                }
+                p = next;
+                nr_maps--;
+        }
+        if (newmap)
+                goto done;
+
+        /* full maps */
+        ceph_decode_32_safe(&p, end, nr_maps, bad);
+        dout(" %d full maps\n", nr_maps);
+        while (nr_maps) {
+                ceph_decode_need(&p, end, 2*sizeof(u32), bad);
+                epoch = ceph_decode_32(&p);
+                maplen = ceph_decode_32(&p);
+                ceph_decode_need(&p, end, maplen, bad);
+                if (nr_maps > 1) {
+                        dout("skipping non-latest full map %u len %d\n",
+                             epoch, maplen);
+                } else if (osdc->osdmap && osdc->osdmap->epoch >= epoch) {
+                        dout("skipping full map %u len %d, "
+                             "older than our %u\n", epoch, maplen,
+                             osdc->osdmap->epoch);
+                } else {
+                        dout("taking full map %u len %d\n", epoch, maplen);
+                        newmap = osdmap_decode(&p, p+maplen);
+                        if (IS_ERR(newmap)) {
+                                err = PTR_ERR(newmap);
+                                goto bad;
+                        }
+                        BUG_ON(!newmap);
+                        oldmap = osdc->osdmap;
+                        osdc->osdmap = newmap;
+                        if (oldmap)
+                                ceph_osdmap_destroy(oldmap);
+                }
+                p += maplen;
+                nr_maps--;
+        }
+
+done:
+        downgrade_write(&osdc->map_sem);
+        ceph_monc_got_osdmap(&osdc->client->monc, osdc->osdmap->epoch);
+        if (newmap)
+                kick_requests(osdc, NULL);
+        up_read(&osdc->map_sem);
+        wake_up_all(&osdc->client->auth_wq);
+        return;
+
+bad:
+        pr_err("osdc handle_map corrupt msg\n");
+        ceph_msg_dump(msg);
+        up_write(&osdc->map_sem);
+        return;
+}
+
+/*
+ * Register request, send initial attempt.
+ */
+int ceph_osdc_start_request(struct ceph_osd_client *osdc,
+                            struct ceph_osd_request *req,
+                            bool nofail)
+{
+        int rc = 0;
+
+        req->r_request->pages = req->r_pages;
+        req->r_request->nr_pages = req->r_num_pages;
+#ifdef CONFIG_BLOCK
+        req->r_request->bio = req->r_bio;
+#endif
+        req->r_request->trail = req->r_trail;
+
+        register_request(osdc, req);
+
+        down_read(&osdc->map_sem);
+        mutex_lock(&osdc->request_mutex);
+        /*
+         * a racing kick_requests() may have sent the message for us
+         * while we dropped request_mutex above, so only send now if
+         * the request still han't been touched yet.
+         */
+        if (req->r_sent == 0) {
+                rc = __send_request(osdc, req);
+                if (rc) {
+                        if (nofail) {
+                                dout("osdc_start_request failed send, "
+                                     " marking %lld\n", req->r_tid);
+                                req->r_resend = true;
+                                rc = 0;
+                        } else {
+                                __unregister_request(osdc, req);
+                        }
+                }
+        }
+        mutex_unlock(&osdc->request_mutex);
+        up_read(&osdc->map_sem);
+        return rc;
+}
+EXPORT_SYMBOL(ceph_osdc_start_request);
+
+/*
+ * wait for a request to complete
+ */
+int ceph_osdc_wait_request(struct ceph_osd_client *osdc,
+                           struct ceph_osd_request *req)
+{
+        int rc;
+
+        rc = wait_for_completion_interruptible(&req->r_completion);
+        if (rc < 0) {
+                mutex_lock(&osdc->request_mutex);
+                __cancel_request(req);
+                __unregister_request(osdc, req);
+                mutex_unlock(&osdc->request_mutex);
+                dout("wait_request tid %llu canceled/timed out\n", req->r_tid);
+                return rc;
+        }
+
+        dout("wait_request tid %llu result %d\n", req->r_tid, req->r_result);
+        return req->r_result;
+}
+EXPORT_SYMBOL(ceph_osdc_wait_request);
+
+/*
+ * sync - wait for all in-flight requests to flush.  avoid starvation.
+ */
+void ceph_osdc_sync(struct ceph_osd_client *osdc)
+{
+        struct ceph_osd_request *req;
+        u64 last_tid, next_tid = 0;
+
+        mutex_lock(&osdc->request_mutex);
+        last_tid = osdc->last_tid;
+        while (1) {
+                req = __lookup_request_ge(osdc, next_tid);
+                if (!req)
+                        break;
+                if (req->r_tid > last_tid)
+                        break;
+
+                next_tid = req->r_tid + 1;
+                if ((req->r_flags & CEPH_OSD_FLAG_WRITE) == 0)
+                        continue;
+
+                ceph_osdc_get_request(req);
+                mutex_unlock(&osdc->request_mutex);
+                dout("sync waiting on tid %llu (last is %llu)\n",
+                     req->r_tid, last_tid);
+                wait_for_completion(&req->r_safe_completion);
+                mutex_lock(&osdc->request_mutex);
+                ceph_osdc_put_request(req);
+        }
+        mutex_unlock(&osdc->request_mutex);
+        dout("sync done (thru tid %llu)\n", last_tid);
+}
+EXPORT_SYMBOL(ceph_osdc_sync);
+
+/*
+ * init, shutdown
+ */
+int ceph_osdc_init(struct ceph_osd_client *osdc, struct ceph_client *client)
+{
+        int err;
+
+        dout("init\n");
+        osdc->client = client;
+        osdc->osdmap = NULL;
+        init_rwsem(&osdc->map_sem);
+        init_completion(&osdc->map_waiters);
+        osdc->last_requested_map = 0;
+        mutex_init(&osdc->request_mutex);
+        osdc->last_tid = 0;
+        osdc->osds = RB_ROOT;
+        INIT_LIST_HEAD(&osdc->osd_lru);
+        osdc->requests = RB_ROOT;
+        INIT_LIST_HEAD(&osdc->req_lru);
+        osdc->num_requests = 0;
+        INIT_DELAYED_WORK(&osdc->timeout_work, handle_timeout);
+        INIT_DELAYED_WORK(&osdc->osds_timeout_work, handle_osds_timeout);
+
+        schedule_delayed_work(&osdc->osds_timeout_work,
+           round_jiffies_relative(osdc->client->options->osd_idle_ttl * HZ));
+
+        err = -ENOMEM;
+        osdc->req_mempool = mempool_create_kmalloc_pool(10,
+                                        sizeof(struct ceph_osd_request));
+        if (!osdc->req_mempool)
+                goto out;
+
+        err = ceph_msgpool_init(&osdc->msgpool_op, OSD_OP_FRONT_LEN, 10, true,
+                                "osd_op");
+        if (err < 0)
+                goto out_mempool;
+        err = ceph_msgpool_init(&osdc->msgpool_op_reply,
+                                OSD_OPREPLY_FRONT_LEN, 10, true,
+                                "osd_op_reply");
+        if (err < 0)
+                goto out_msgpool;
+        return 0;
+
+out_msgpool:
+        ceph_msgpool_destroy(&osdc->msgpool_op);
+out_mempool:
+        mempool_destroy(osdc->req_mempool);
+out:
+        return err;
+}
+EXPORT_SYMBOL(ceph_osdc_init);
+
+void ceph_osdc_stop(struct ceph_osd_client *osdc)
+{
+        cancel_delayed_work_sync(&osdc->timeout_work);
+        cancel_delayed_work_sync(&osdc->osds_timeout_work);
+        if (osdc->osdmap) {
+                ceph_osdmap_destroy(osdc->osdmap);
+                osdc->osdmap = NULL;
+        }
+        remove_old_osds(osdc, 1);
+        mempool_destroy(osdc->req_mempool);
+        ceph_msgpool_destroy(&osdc->msgpool_op);
+        ceph_msgpool_destroy(&osdc->msgpool_op_reply);
+}
+EXPORT_SYMBOL(ceph_osdc_stop);
+
+/*
+ * Read some contiguous pages.  If we cross a stripe boundary, shorten
+ * *plen.  Return number of bytes read, or error.
+ */
+int ceph_osdc_readpages(struct ceph_osd_client *osdc,
+                        struct ceph_vino vino, struct ceph_file_layout *layout,
+                        u64 off, u64 *plen,
+                        u32 truncate_seq, u64 truncate_size,
+                        struct page **pages, int num_pages)
+{
+        struct ceph_osd_request *req;
+        int rc = 0;
+
+        dout("readpages on ino %llx.%llx on %llu~%llu\n", vino.ino,
+             vino.snap, off, *plen);
+        req = ceph_osdc_new_request(osdc, layout, vino, off, plen,
+                                    CEPH_OSD_OP_READ, CEPH_OSD_FLAG_READ,
+                                    NULL, 0, truncate_seq, truncate_size, NULL,
+                                    false, 1);
+        if (!req)
+                return -ENOMEM;
+
+        /* it may be a short read due to an object boundary */
+        req->r_pages = pages;
+
+        dout("readpages  final extent is %llu~%llu (%d pages)\n",
+             off, *plen, req->r_num_pages);
+
+        rc = ceph_osdc_start_request(osdc, req, false);
+        if (!rc)
+                rc = ceph_osdc_wait_request(osdc, req);
+
+        ceph_osdc_put_request(req);
+        dout("readpages result %d\n", rc);
+        return rc;
+}
+EXPORT_SYMBOL(ceph_osdc_readpages);
+
+/*
+ * do a synchronous write on N pages
+ */
+int ceph_osdc_writepages(struct ceph_osd_client *osdc, struct ceph_vino vino,
+                         struct ceph_file_layout *layout,
+                         struct ceph_snap_context *snapc,
+                         u64 off, u64 len,
+                         u32 truncate_seq, u64 truncate_size,
+                         struct timespec *mtime,
+                         struct page **pages, int num_pages,
+                         int flags, int do_sync, bool nofail)
+{
+        struct ceph_osd_request *req;
+        int rc = 0;
+
+        BUG_ON(vino.snap != CEPH_NOSNAP);
+        req = ceph_osdc_new_request(osdc, layout, vino, off, &len,
+                                    CEPH_OSD_OP_WRITE,
+                                    flags | CEPH_OSD_FLAG_ONDISK |
+                                            CEPH_OSD_FLAG_WRITE,
+                                    snapc, do_sync,
+                                    truncate_seq, truncate_size, mtime,
+                                    nofail, 1);
+        if (!req)
+                return -ENOMEM;
+
+        /* it may be a short write due to an object boundary */
+        req->r_pages = pages;
+        dout("writepages %llu~%llu (%d pages)\n", off, len,
+             req->r_num_pages);
+
+        rc = ceph_osdc_start_request(osdc, req, nofail);
+        if (!rc)
+                rc = ceph_osdc_wait_request(osdc, req);
+
+        ceph_osdc_put_request(req);
+        if (rc == 0)
+                rc = len;
+        dout("writepages result %d\n", rc);
+        return rc;
+}
+EXPORT_SYMBOL(ceph_osdc_writepages);
+
+/*
+ * handle incoming message
+ */
+static void dispatch(struct ceph_connection *con, struct ceph_msg *msg)
+{
+        struct ceph_osd *osd = con->private;
+        struct ceph_osd_client *osdc;
+        int type = le16_to_cpu(msg->hdr.type);
+
+        if (!osd)
+                goto out;
+        osdc = osd->o_osdc;
+
+        switch (type) {
+        case CEPH_MSG_OSD_MAP:
+                ceph_osdc_handle_map(osdc, msg);
+                break;
+        case CEPH_MSG_OSD_OPREPLY:
+                handle_reply(osdc, msg, con);
+                break;
+
+        default:
+                pr_err("received unknown message type %d %s\n", type,
+                       ceph_msg_type_name(type));
+        }
+out:
+        ceph_msg_put(msg);
+}
+
+/*
+ * lookup and return message for incoming reply.  set up reply message
+ * pages.
+ */
+static struct ceph_msg *get_reply(struct ceph_connection *con,
+                                  struct ceph_msg_header *hdr,
+                                  int *skip)
+{
+        struct ceph_osd *osd = con->private;
+        struct ceph_osd_client *osdc = osd->o_osdc;
+        struct ceph_msg *m;
+        struct ceph_osd_request *req;
+        int front = le32_to_cpu(hdr->front_len);
+        int data_len = le32_to_cpu(hdr->data_len);
+        u64 tid;
+
+        tid = le64_to_cpu(hdr->tid);
+        mutex_lock(&osdc->request_mutex);
+        req = __lookup_request(osdc, tid);
+        if (!req) {
+                *skip = 1;
+                m = NULL;
+                pr_info("get_reply unknown tid %llu from osd%d\n", tid,
+                        osd->o_osd);
+                goto out;
+        }
+
+        if (req->r_con_filling_msg) {
+                dout("get_reply revoking msg %p from old con %p\n",
+                     req->r_reply, req->r_con_filling_msg);
+                ceph_con_revoke_message(req->r_con_filling_msg, req->r_reply);
+                ceph_con_put(req->r_con_filling_msg);
+                req->r_con_filling_msg = NULL;
+        }
+
+        if (front > req->r_reply->front.iov_len) {
+                pr_warning("get_reply front %d > preallocated %d\n",
+                           front, (int)req->r_reply->front.iov_len);
+                m = ceph_msg_new(CEPH_MSG_OSD_OPREPLY, front, GFP_NOFS);
+                if (!m)
+                        goto out;
+                ceph_msg_put(req->r_reply);
+                req->r_reply = m;
+        }
+        m = ceph_msg_get(req->r_reply);
+
+        if (data_len > 0) {
+                unsigned data_off = le16_to_cpu(hdr->data_off);
+                int want = calc_pages_for(data_off & ~PAGE_MASK, data_len);
+
+                if (unlikely(req->r_num_pages < want)) {
+                        pr_warning("tid %lld reply %d > expected %d pages\n",
+                                   tid, want, m->nr_pages);
+                        *skip = 1;
+                        ceph_msg_put(m);
+                        m = NULL;
+                        goto out;
+                }
+                m->pages = req->r_pages;
+                m->nr_pages = req->r_num_pages;
+#ifdef CONFIG_BLOCK
+                m->bio = req->r_bio;
+#endif
+        }
+        *skip = 0;
+        req->r_con_filling_msg = ceph_con_get(con);
+        dout("get_reply tid %lld %p\n", tid, m);
+
+out:
+        mutex_unlock(&osdc->request_mutex);
+        return m;
+
+}
+
+static struct ceph_msg *alloc_msg(struct ceph_connection *con,
+                                  struct ceph_msg_header *hdr,
+                                  int *skip)
+{
+        struct ceph_osd *osd = con->private;
+        int type = le16_to_cpu(hdr->type);
+        int front = le32_to_cpu(hdr->front_len);
+
+        switch (type) {
+        case CEPH_MSG_OSD_MAP:
+                return ceph_msg_new(type, front, GFP_NOFS);
+        case CEPH_MSG_OSD_OPREPLY:
+                return get_reply(con, hdr, skip);
+        default:
+                pr_info("alloc_msg unexpected msg type %d from osd%d\n", type,
+                        osd->o_osd);
+                *skip = 1;
+                return NULL;
+        }
+}
+
+/*
+ * Wrappers to refcount containing ceph_osd struct
+ */
+static struct ceph_connection *get_osd_con(struct ceph_connection *con)
+{
+        struct ceph_osd *osd = con->private;
+        if (get_osd(osd))
+                return con;
+        return NULL;
+}
+
+static void put_osd_con(struct ceph_connection *con)
+{
+        struct ceph_osd *osd = con->private;
+        put_osd(osd);
+}
+
+/*
+ * authentication
+ */
+static int get_authorizer(struct ceph_connection *con,
+                          void **buf, int *len, int *proto,
+                          void **reply_buf, int *reply_len, int force_new)
+{
+        struct ceph_osd *o = con->private;
+        struct ceph_osd_client *osdc = o->o_osdc;
+        struct ceph_auth_client *ac = osdc->client->monc.auth;
+        int ret = 0;
+
+        if (force_new && o->o_authorizer) {
+                ac->ops->destroy_authorizer(ac, o->o_authorizer);
+                o->o_authorizer = NULL;
+        }
+        if (o->o_authorizer == NULL) {
+                ret = ac->ops->create_authorizer(
+                        ac, CEPH_ENTITY_TYPE_OSD,
+                        &o->o_authorizer,
+                        &o->o_authorizer_buf,
+                        &o->o_authorizer_buf_len,
+                        &o->o_authorizer_reply_buf,
+                        &o->o_authorizer_reply_buf_len);
+                if (ret)
+                        return ret;
+        }
+
+        *proto = ac->protocol;
+        *buf = o->o_authorizer_buf;
+        *len = o->o_authorizer_buf_len;
+        *reply_buf = o->o_authorizer_reply_buf;
+        *reply_len = o->o_authorizer_reply_buf_len;
+        return 0;
+}
+
+
+static int verify_authorizer_reply(struct ceph_connection *con, int len)
+{
+        struct ceph_osd *o = con->private;
+        struct ceph_osd_client *osdc = o->o_osdc;
+        struct ceph_auth_client *ac = osdc->client->monc.auth;
+
+        return ac->ops->verify_authorizer_reply(ac, o->o_authorizer, len);
+}
+
+static int invalidate_authorizer(struct ceph_connection *con)
+{
+        struct ceph_osd *o = con->private;
+        struct ceph_osd_client *osdc = o->o_osdc;
+        struct ceph_auth_client *ac = osdc->client->monc.auth;
+
+        if (ac->ops->invalidate_authorizer)
+                ac->ops->invalidate_authorizer(ac, CEPH_ENTITY_TYPE_OSD);
+
+        return ceph_monc_validate_auth(&osdc->client->monc);
+}
+
+static const struct ceph_connection_operations osd_con_ops = {
+        .get = get_osd_con,
+        .put = put_osd_con,
+        .dispatch = dispatch,
+        .get_authorizer = get_authorizer,
+        .verify_authorizer_reply = verify_authorizer_reply,
+        .invalidate_authorizer = invalidate_authorizer,
+        .alloc_msg = alloc_msg,
+        .fault = osd_reset,
+};
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
new file mode 100644
index 000000000000..d73f3f6efa36
--- /dev/null
+++ b/net/ceph/osdmap.c
@@ -0,0 +1,1128 @@
+
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <asm/div64.h>
+
+#include <linux/ceph/libceph.h>
+#include <linux/ceph/osdmap.h>
+#include <linux/ceph/decode.h>
+#include <linux/crush/hash.h>
+#include <linux/crush/mapper.h>
+
+char *ceph_osdmap_state_str(char *str, int len, int state)
+{
+        int flag = 0;
+
+        if (!len)
+                goto done;
+
+        *str = '\0';
+        if (state) {
+                if (state & CEPH_OSD_EXISTS) {
+                        snprintf(str, len, "exists");
+                        flag = 1;
+                }
+                if (state & CEPH_OSD_UP) {
+                        snprintf(str, len, "%s%s%s", str, (flag ? ", " : ""),
+                                 "up");
+                        flag = 1;
+                }
+        } else {
+                snprintf(str, len, "doesn't exist");
+        }
+done:
+        return str;
+}
+
+/* maps */
+
+static int calc_bits_of(unsigned t)
+{
+        int b = 0;
+        while (t) {
+                t = t >> 1;
+                b++;
+        }
+        return b;
+}
+
+/*
+ * the foo_mask is the smallest value 2^n-1 that is >= foo.
+ */
+static void calc_pg_masks(struct ceph_pg_pool_info *pi)
+{
+        pi->pg_num_mask = (1 << calc_bits_of(le32_to_cpu(pi->v.pg_num)-1)) - 1;
+        pi->pgp_num_mask =
+                (1 << calc_bits_of(le32_to_cpu(pi->v.pgp_num)-1)) - 1;
+        pi->lpg_num_mask =
+                (1 << calc_bits_of(le32_to_cpu(pi->v.lpg_num)-1)) - 1;
+        pi->lpgp_num_mask =
+                (1 << calc_bits_of(le32_to_cpu(pi->v.lpgp_num)-1)) - 1;
+}
+
+/*
+ * decode crush map
+ */
+static int crush_decode_uniform_bucket(void **p, void *end,
+                                       struct crush_bucket_uniform *b)
+{
+        dout("crush_decode_uniform_bucket %p to %p\n", *p, end);
+        ceph_decode_need(p, end, (1+b->h.size) * sizeof(u32), bad);
+        b->item_weight = ceph_decode_32(p);
+        return 0;
+bad:
+        return -EINVAL;
+}
+
+static int crush_decode_list_bucket(void **p, void *end,
+                                    struct crush_bucket_list *b)
+{
+        int j;
+        dout("crush_decode_list_bucket %p to %p\n", *p, end);
+        b->item_weights = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
+        if (b->item_weights == NULL)
+                return -ENOMEM;
+        b->sum_weights = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
+        if (b->sum_weights == NULL)
+                return -ENOMEM;
+        ceph_decode_need(p, end, 2 * b->h.size * sizeof(u32), bad);
+        for (j = 0; j < b->h.size; j++) {
+                b->item_weights[j] = ceph_decode_32(p);
+                b->sum_weights[j] = ceph_decode_32(p);
+        }
+        return 0;
+bad:
+        return -EINVAL;
+}
+
+static int crush_decode_tree_bucket(void **p, void *end,
+                                    struct crush_bucket_tree *b)
+{
+        int j;
+        dout("crush_decode_tree_bucket %p to %p\n", *p, end);
+        ceph_decode_32_safe(p, end, b->num_nodes, bad);
+        b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
+        if (b->node_weights == NULL)
+                return -ENOMEM;
+        ceph_decode_need(p, end, b->num_nodes * sizeof(u32), bad);
+        for (j = 0; j < b->num_nodes; j++)
+                b->node_weights[j] = ceph_decode_32(p);
+        return 0;
+bad:
+        return -EINVAL;
+}
+
+static int crush_decode_straw_bucket(void **p, void *end,
+                                     struct crush_bucket_straw *b)
+{
+        int j;
+        dout("crush_decode_straw_bucket %p to %p\n", *p, end);
+        b->item_weights = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
+        if (b->item_weights == NULL)
+                return -ENOMEM;
+        b->straws = kcalloc(b->h.size, sizeof(u32), GFP_NOFS);
+        if (b->straws == NULL)
+                return -ENOMEM;
+        ceph_decode_need(p, end, 2 * b->h.size * sizeof(u32), bad);
+        for (j = 0; j < b->h.size; j++) {
+                b->item_weights[j] = ceph_decode_32(p);
+                b->straws[j] = ceph_decode_32(p);
+        }
+        return 0;
+bad:
+        return -EINVAL;
+}
+
+static struct crush_map *crush_decode(void *pbyval, void *end)
+{
+        struct crush_map *c;
+        int err = -EINVAL;
+        int i, j;
+        void **p = &pbyval;
+        void *start = pbyval;
+        u32 magic;
+
+        dout("crush_decode %p to %p len %d\n", *p, end, (int)(end - *p));
+
+        c = kzalloc(sizeof(*c), GFP_NOFS);
+        if (c == NULL)
+                return ERR_PTR(-ENOMEM);
+
+        ceph_decode_need(p, end, 4*sizeof(u32), bad);
+        magic = ceph_decode_32(p);
+        if (magic != CRUSH_MAGIC) {
+                pr_err("crush_decode magic %x != current %x\n",
+                       (unsigned)magic, (unsigned)CRUSH_MAGIC);
+                goto bad;
+        }
+        c->max_buckets = ceph_decode_32(p);
+        c->max_rules = ceph_decode_32(p);
+        c->max_devices = ceph_decode_32(p);
+
+        c->device_parents = kcalloc(c->max_devices, sizeof(u32), GFP_NOFS);
+        if (c->device_parents == NULL)
+                goto badmem;
+        c->bucket_parents = kcalloc(c->max_buckets, sizeof(u32), GFP_NOFS);
+        if (c->bucket_parents == NULL)
+                goto badmem;
+
+        c->buckets = kcalloc(c->max_buckets, sizeof(*c->buckets), GFP_NOFS);
+        if (c->buckets == NULL)
+                goto badmem;
+        c->rules = kcalloc(c->max_rules, sizeof(*c->rules), GFP_NOFS);
+        if (c->rules == NULL)
+                goto badmem;
+
+        /* buckets */
+        for (i = 0; i < c->max_buckets; i++) {
+                int size = 0;
+                u32 alg;
+                struct crush_bucket *b;
+
+                ceph_decode_32_safe(p, end, alg, bad);
+                if (alg == 0) {
+                        c->buckets[i] = NULL;
+                        continue;
+                }
+                dout("crush_decode bucket %d off %x %p to %p\n",
+                     i, (int)(*p-start), *p, end);
+
+                switch (alg) {
+                case CRUSH_BUCKET_UNIFORM:
+                        size = sizeof(struct crush_bucket_uniform);
+                        break;
+                case CRUSH_BUCKET_LIST:
+                        size = sizeof(struct crush_bucket_list);
+                        break;
+                case CRUSH_BUCKET_TREE:
+                        size = sizeof(struct crush_bucket_tree);
+                        break;
+                case CRUSH_BUCKET_STRAW:
+                        size = sizeof(struct crush_bucket_straw);
+                        break;
+                default:
+                        err = -EINVAL;
+                        goto bad;
+                }
+                BUG_ON(size == 0);
+                b = c->buckets[i] = kzalloc(size, GFP_NOFS);
+                if (b == NULL)
+                        goto badmem;
+
+                ceph_decode_need(p, end, 4*sizeof(u32), bad);
+                b->id = ceph_decode_32(p);
+                b->type = ceph_decode_16(p);
+                b->alg = ceph_decode_8(p);
+                b->hash = ceph_decode_8(p);
+                b->weight = ceph_decode_32(p);
+                b->size = ceph_decode_32(p);
+
+                dout("crush_decode bucket size %d off %x %p to %p\n",
+                     b->size, (int)(*p-start), *p, end);
+
+                b->items = kcalloc(b->size, sizeof(__s32), GFP_NOFS);
+                if (b->items == NULL)
+                        goto badmem;
+                b->perm = kcalloc(b->size, sizeof(u32), GFP_NOFS);
+                if (b->perm == NULL)
+                        goto badmem;
+                b->perm_n = 0;
+
+                ceph_decode_need(p, end, b->size*sizeof(u32), bad);
+                for (j = 0; j < b->size; j++)
+                        b->items[j] = ceph_decode_32(p);
+
+                switch (b->alg) {
+                case CRUSH_BUCKET_UNIFORM:
+                        err = crush_decode_uniform_bucket(p, end,
+                                  (struct crush_bucket_uniform *)b);
+                        if (err < 0)
+                                goto bad;
+                        break;
+                case CRUSH_BUCKET_LIST:
+                        err = crush_decode_list_bucket(p, end,
+                               (struct crush_bucket_list *)b);
+                        if (err < 0)
+                                goto bad;
+                        break;
+                case CRUSH_BUCKET_TREE:
+                        err = crush_decode_tree_bucket(p, end,
+                                (struct crush_bucket_tree *)b);
+                        if (err < 0)
+                                goto bad;
+                        break;
+                case CRUSH_BUCKET_STRAW:
+                        err = crush_decode_straw_bucket(p, end,
+                                (struct crush_bucket_straw *)b);
+                        if (err < 0)
+                                goto bad;
+                        break;
+                }
+        }
+
+        /* rules */
+        dout("rule vec is %p\n", c->rules);
+        for (i = 0; i < c->max_rules; i++) {
+                u32 yes;
+                struct crush_rule *r;
+
+                ceph_decode_32_safe(p, end, yes, bad);
+                if (!yes) {
+                        dout("crush_decode NO rule %d off %x %p to %p\n",
+                             i, (int)(*p-start), *p, end);
+                        c->rules[i] = NULL;
+                        continue;
+                }
+
+                dout("crush_decode rule %d off %x %p to %p\n",
+                     i, (int)(*p-start), *p, end);
+
+                /* len */
+                ceph_decode_32_safe(p, end, yes, bad);
+#if BITS_PER_LONG == 32
+                err = -EINVAL;
+                if (yes > ULONG_MAX / sizeof(struct crush_rule_step))
+                        goto bad;
+#endif
+                r = c->rules[i] = kmalloc(sizeof(*r) +
+                                          yes*sizeof(struct crush_rule_step),
+                                          GFP_NOFS);
+                if (r == NULL)
+                        goto badmem;
+                dout(" rule %d is at %p\n", i, r);
+                r->len = yes;
+                ceph_decode_copy_safe(p, end, &r->mask, 4, bad); /* 4 u8's */
+                ceph_decode_need(p, end, r->len*3*sizeof(u32), bad);
+                for (j = 0; j < r->len; j++) {
+                        r->steps[j].op = ceph_decode_32(p);
+                        r->steps[j].arg1 = ceph_decode_32(p);
+                        r->steps[j].arg2 = ceph_decode_32(p);
+                }
+        }
+
+        /* ignore trailing name maps. */
+
+        dout("crush_decode success\n");
+        return c;
+
+badmem:
+        err = -ENOMEM;
+bad:
+        dout("crush_decode fail %d\n", err);
+        crush_destroy(c);
+        return ERR_PTR(err);
+}
+
+/*
+ * rbtree of pg_mapping for handling pg_temp (explicit mapping of pgid
+ * to a set of osds)
+ */
+static int pgid_cmp(struct ceph_pg l, struct ceph_pg r)
+{
+        u64 a = *(u64 *)&l;
+        u64 b = *(u64 *)&r;
+
+        if (a < b)
+                return -1;
+        if (a > b)
+                return 1;
+        return 0;
+}
+
+static int __insert_pg_mapping(struct ceph_pg_mapping *new,
+                               struct rb_root *root)
+{
+        struct rb_node **p = &root->rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_pg_mapping *pg = NULL;
+        int c;
+
+        while (*p) {
+                parent = *p;
+                pg = rb_entry(parent, struct ceph_pg_mapping, node);
+                c = pgid_cmp(new->pgid, pg->pgid);
+                if (c < 0)
+                        p = &(*p)->rb_left;
+                else if (c > 0)
+                        p = &(*p)->rb_right;
+                else
+                        return -EEXIST;
+        }
+
+        rb_link_node(&new->node, parent, p);
+        rb_insert_color(&new->node, root);
+        return 0;
+}
+
+static struct ceph_pg_mapping *__lookup_pg_mapping(struct rb_root *root,
+                                                   struct ceph_pg pgid)
+{
+        struct rb_node *n = root->rb_node;
+        struct ceph_pg_mapping *pg;
+        int c;
+
+        while (n) {
+                pg = rb_entry(n, struct ceph_pg_mapping, node);
+                c = pgid_cmp(pgid, pg->pgid);
+                if (c < 0)
+                        n = n->rb_left;
+                else if (c > 0)
+                        n = n->rb_right;
+                else
+                        return pg;
+        }
+        return NULL;
+}
+
+/*
+ * rbtree of pg pool info
+ */
+static int __insert_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *new)
+{
+        struct rb_node **p = &root->rb_node;
+        struct rb_node *parent = NULL;
+        struct ceph_pg_pool_info *pi = NULL;
+
+        while (*p) {
+                parent = *p;
+                pi = rb_entry(parent, struct ceph_pg_pool_info, node);
+                if (new->id < pi->id)
+                        p = &(*p)->rb_left;
+                else if (new->id > pi->id)
+                        p = &(*p)->rb_right;
+                else
+                        return -EEXIST;
+        }
+
+        rb_link_node(&new->node, parent, p);
+        rb_insert_color(&new->node, root);
+        return 0;
+}
+
+static struct ceph_pg_pool_info *__lookup_pg_pool(struct rb_root *root, int id)
+{
+        struct ceph_pg_pool_info *pi;
+        struct rb_node *n = root->rb_node;
+
+        while (n) {
+                pi = rb_entry(n, struct ceph_pg_pool_info, node);
+                if (id < pi->id)
+                        n = n->rb_left;
+                else if (id > pi->id)
+                        n = n->rb_right;
+                else
+                        return pi;
+        }
+        return NULL;
+}
+
+int ceph_pg_poolid_by_name(struct ceph_osdmap *map, const char *name)
+{
+        struct rb_node *rbp;
+
+        for (rbp = rb_first(&map->pg_pools); rbp; rbp = rb_next(rbp)) {
+                struct ceph_pg_pool_info *pi =
+                        rb_entry(rbp, struct ceph_pg_pool_info, node);
+                if (pi->name && strcmp(pi->name, name) == 0)
+                        return pi->id;
+        }
+        return -ENOENT;
+}
+EXPORT_SYMBOL(ceph_pg_poolid_by_name);
+
+static void __remove_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *pi)
+{
+        rb_erase(&pi->node, root);
+        kfree(pi->name);
+        kfree(pi);
+}
+
+static int __decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi)
+{
+        unsigned n, m;
+
+        ceph_decode_copy(p, &pi->v, sizeof(pi->v));
+        calc_pg_masks(pi);
+
+        /* num_snaps * snap_info_t */
+        n = le32_to_cpu(pi->v.num_snaps);
+        while (n--) {
+                ceph_decode_need(p, end, sizeof(u64) + 1 + sizeof(u64) +
+                                 sizeof(struct ceph_timespec), bad);
+                *p += sizeof(u64) +       /* key */
+                        1 + sizeof(u64) + /* u8, snapid */
+                        sizeof(struct ceph_timespec);
+                m = ceph_decode_32(p);    /* snap name */
+                *p += m;
+        }
+
+        *p += le32_to_cpu(pi->v.num_removed_snap_intervals) * sizeof(u64) * 2;
+        return 0;
+
+bad:
+        return -EINVAL;
+}
+
+static int __decode_pool_names(void **p, void *end, struct ceph_osdmap *map)
+{
+        struct ceph_pg_pool_info *pi;
+        u32 num, len, pool;
+
+        ceph_decode_32_safe(p, end, num, bad);
+        dout(" %d pool names\n", num);
+        while (num--) {
+                ceph_decode_32_safe(p, end, pool, bad);
+                ceph_decode_32_safe(p, end, len, bad);
+                dout("  pool %d len %d\n", pool, len);
+                pi = __lookup_pg_pool(&map->pg_pools, pool);
+                if (pi) {
+                        kfree(pi->name);
+                        pi->name = kmalloc(len + 1, GFP_NOFS);
+                        if (pi->name) {
+                                memcpy(pi->name, *p, len);
+                                pi->name[len] = '\0';
+                                dout("  name is %s\n", pi->name);
+                        }
+                }
+                *p += len;
+        }
+        return 0;
+
+bad:
+        return -EINVAL;
+}
+
+/*
+ * osd map
+ */
+void ceph_osdmap_destroy(struct ceph_osdmap *map)
+{
+        dout("osdmap_destroy %p\n", map);
+        if (map->crush)
+                crush_destroy(map->crush);
+        while (!RB_EMPTY_ROOT(&map->pg_temp)) {
+                struct ceph_pg_mapping *pg =
+                        rb_entry(rb_first(&map->pg_temp),
+                                 struct ceph_pg_mapping, node);
+                rb_erase(&pg->node, &map->pg_temp);
+                kfree(pg);
+        }
+        while (!RB_EMPTY_ROOT(&map->pg_pools)) {
+                struct ceph_pg_pool_info *pi =
+                        rb_entry(rb_first(&map->pg_pools),
+                                 struct ceph_pg_pool_info, node);
+                __remove_pg_pool(&map->pg_pools, pi);
+        }
+        kfree(map->osd_state);
+        kfree(map->osd_weight);
+        kfree(map->osd_addr);
+        kfree(map);
+}
+
+/*
+ * adjust max osd value.  reallocate arrays.
+ */
+static int osdmap_set_max_osd(struct ceph_osdmap *map, int max)
+{
+        u8 *state;
+        struct ceph_entity_addr *addr;
+        u32 *weight;
+
+        state = kcalloc(max, sizeof(*state), GFP_NOFS);
+        addr = kcalloc(max, sizeof(*addr), GFP_NOFS);
+        weight = kcalloc(max, sizeof(*weight), GFP_NOFS);
+        if (state == NULL || addr == NULL || weight == NULL) {
+                kfree(state);
+                kfree(addr);
+                kfree(weight);
+                return -ENOMEM;
+        }
+
+        /* copy old? */
+        if (map->osd_state) {
+                memcpy(state, map->osd_state, map->max_osd*sizeof(*state));
+                memcpy(addr, map->osd_addr, map->max_osd*sizeof(*addr));
+                memcpy(weight, map->osd_weight, map->max_osd*sizeof(*weight));
+                kfree(map->osd_state);
+                kfree(map->osd_addr);
+                kfree(map->osd_weight);
+        }
+
+        map->osd_state = state;
+        map->osd_weight = weight;
+        map->osd_addr = addr;
+        map->max_osd = max;
+        return 0;
+}
+
+/*
+ * decode a full map.
+ */
+struct ceph_osdmap *osdmap_decode(void **p, void *end)
+{
+        struct ceph_osdmap *map;
+        u16 version;
+        u32 len, max, i;
+        u8 ev;
+        int err = -EINVAL;
+        void *start = *p;
+        struct ceph_pg_pool_info *pi;
+
+        dout("osdmap_decode %p to %p len %d\n", *p, end, (int)(end - *p));
+
+        map = kzalloc(sizeof(*map), GFP_NOFS);
+        if (map == NULL)
+                return ERR_PTR(-ENOMEM);
+        map->pg_temp = RB_ROOT;
+
+        ceph_decode_16_safe(p, end, version, bad);
+        if (version > CEPH_OSDMAP_VERSION) {
+                pr_warning("got unknown v %d > %d of osdmap\n", version,
+                           CEPH_OSDMAP_VERSION);
+                goto bad;
+        }
+
+        ceph_decode_need(p, end, 2*sizeof(u64)+6*sizeof(u32), bad);
+        ceph_decode_copy(p, &map->fsid, sizeof(map->fsid));
+        map->epoch = ceph_decode_32(p);
+        ceph_decode_copy(p, &map->created, sizeof(map->created));
+        ceph_decode_copy(p, &map->modified, sizeof(map->modified));
+
+        ceph_decode_32_safe(p, end, max, bad);
+        while (max--) {
+                ceph_decode_need(p, end, 4 + 1 + sizeof(pi->v), bad);
+                pi = kzalloc(sizeof(*pi), GFP_NOFS);
+                if (!pi)
+                        goto bad;
+                pi->id = ceph_decode_32(p);
+                ev = ceph_decode_8(p); /* encoding version */
+                if (ev > CEPH_PG_POOL_VERSION) {
+                        pr_warning("got unknown v %d > %d of ceph_pg_pool\n",
+                                   ev, CEPH_PG_POOL_VERSION);
+                        kfree(pi);
+                        goto bad;
+                }
+                err = __decode_pool(p, end, pi);
+                if (err < 0)
+                        goto bad;
+                __insert_pg_pool(&map->pg_pools, pi);
+        }
+
+        if (version >= 5 && __decode_pool_names(p, end, map) < 0)
+                goto bad;
+
+        ceph_decode_32_safe(p, end, map->pool_max, bad);
+
+        ceph_decode_32_safe(p, end, map->flags, bad);
+
+        max = ceph_decode_32(p);
+
+        /* (re)alloc osd arrays */
+        err = osdmap_set_max_osd(map, max);
+        if (err < 0)
+                goto bad;
+        dout("osdmap_decode max_osd = %d\n", map->max_osd);
+
+        /* osds */
+        err = -EINVAL;
+        ceph_decode_need(p, end, 3*sizeof(u32) +
+                         map->max_osd*(1 + sizeof(*map->osd_weight) +
+                                       sizeof(*map->osd_addr)), bad);
+        *p += 4; /* skip length field (should match max) */
+        ceph_decode_copy(p, map->osd_state, map->max_osd);
+
+        *p += 4; /* skip length field (should match max) */
+        for (i = 0; i < map->max_osd; i++)
+                map->osd_weight[i] = ceph_decode_32(p);
+
+        *p += 4; /* skip length field (should match max) */
+        ceph_decode_copy(p, map->osd_addr, map->max_osd*sizeof(*map->osd_addr));
+        for (i = 0; i < map->max_osd; i++)
+                ceph_decode_addr(&map->osd_addr[i]);
+
+        /* pg_temp */
+        ceph_decode_32_safe(p, end, len, bad);
+        for (i = 0; i < len; i++) {
+                int n, j;
+                struct ceph_pg pgid;
+                struct ceph_pg_mapping *pg;
+
+                ceph_decode_need(p, end, sizeof(u32) + sizeof(u64), bad);
+                ceph_decode_copy(p, &pgid, sizeof(pgid));
+                n = ceph_decode_32(p);
+                ceph_decode_need(p, end, n * sizeof(u32), bad);
+                err = -ENOMEM;
+                pg = kmalloc(sizeof(*pg) + n*sizeof(u32), GFP_NOFS);
+                if (!pg)
+                        goto bad;
+                pg->pgid = pgid;
+                pg->len = n;
+                for (j = 0; j < n; j++)
+                        pg->osds[j] = ceph_decode_32(p);
+
+                err = __insert_pg_mapping(pg, &map->pg_temp);
+                if (err)
+                        goto bad;
+                dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid, len);
+        }
+
+        /* crush */
+        ceph_decode_32_safe(p, end, len, bad);
+        dout("osdmap_decode crush len %d from off 0x%x\n", len,
+             (int)(*p - start));
+        ceph_decode_need(p, end, len, bad);
+        map->crush = crush_decode(*p, end);
+        *p += len;
+        if (IS_ERR(map->crush)) {
+                err = PTR_ERR(map->crush);
+                map->crush = NULL;
+                goto bad;
+        }
+
+        /* ignore the rest of the map */
+        *p = end;
+
+        dout("osdmap_decode done %p %p\n", *p, end);
+        return map;
+
+bad:
+        dout("osdmap_decode fail\n");
+        ceph_osdmap_destroy(map);
+        return ERR_PTR(err);
+}
+
+/*
+ * decode and apply an incremental map update.
+ */
+struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
+                                             struct ceph_osdmap *map,
+                                             struct ceph_messenger *msgr)
+{
+        struct crush_map *newcrush = NULL;
+        struct ceph_fsid fsid;
+        u32 epoch = 0;
+        struct ceph_timespec modified;
+        u32 len, pool;
+        __s32 new_pool_max, new_flags, max;
+        void *start = *p;
+        int err = -EINVAL;
+        u16 version;
+        struct rb_node *rbp;
+
+        ceph_decode_16_safe(p, end, version, bad);
+        if (version > CEPH_OSDMAP_INC_VERSION) {
+                pr_warning("got unknown v %d > %d of inc osdmap\n", version,
+                           CEPH_OSDMAP_INC_VERSION);
+                goto bad;
+        }
+
+        ceph_decode_need(p, end, sizeof(fsid)+sizeof(modified)+2*sizeof(u32),
+                         bad);
+        ceph_decode_copy(p, &fsid, sizeof(fsid));
+        epoch = ceph_decode_32(p);
+        BUG_ON(epoch != map->epoch+1);
+        ceph_decode_copy(p, &modified, sizeof(modified));
+        new_pool_max = ceph_decode_32(p);
+        new_flags = ceph_decode_32(p);
+
+        /* full map? */
+        ceph_decode_32_safe(p, end, len, bad);
+        if (len > 0) {
+                dout("apply_incremental full map len %d, %p to %p\n",
+                     len, *p, end);
+                return osdmap_decode(p, min(*p+len, end));
+        }
+
+        /* new crush? */
+        ceph_decode_32_safe(p, end, len, bad);
+        if (len > 0) {
+                dout("apply_incremental new crush map len %d, %p to %p\n",
+                     len, *p, end);
+                newcrush = crush_decode(*p, min(*p+len, end));
+                if (IS_ERR(newcrush))
+                        return ERR_CAST(newcrush);
+                *p += len;
+        }
+
+        /* new flags? */
+        if (new_flags >= 0)
+                map->flags = new_flags;
+        if (new_pool_max >= 0)
+                map->pool_max = new_pool_max;
+
+        ceph_decode_need(p, end, 5*sizeof(u32), bad);
+
+        /* new max? */
+        max = ceph_decode_32(p);
+        if (max >= 0) {
+                err = osdmap_set_max_osd(map, max);
+                if (err < 0)
+                        goto bad;
+        }
+
+        map->epoch++;
+        map->modified = map->modified;
+        if (newcrush) {
+                if (map->crush)
+                        crush_destroy(map->crush);
+                map->crush = newcrush;
+                newcrush = NULL;
+        }
+
+        /* new_pool */
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                __u8 ev;
+                struct ceph_pg_pool_info *pi;
+
+                ceph_decode_32_safe(p, end, pool, bad);
+                ceph_decode_need(p, end, 1 + sizeof(pi->v), bad);
+                ev = ceph_decode_8(p);  /* encoding version */
+                if (ev > CEPH_PG_POOL_VERSION) {
+                        pr_warning("got unknown v %d > %d of ceph_pg_pool\n",
+                                   ev, CEPH_PG_POOL_VERSION);
+                        goto bad;
+                }
+                pi = __lookup_pg_pool(&map->pg_pools, pool);
+                if (!pi) {
+                        pi = kzalloc(sizeof(*pi), GFP_NOFS);
+                        if (!pi) {
+                                err = -ENOMEM;
+                                goto bad;
+                        }
+                        pi->id = pool;
+                        __insert_pg_pool(&map->pg_pools, pi);
+                }
+                err = __decode_pool(p, end, pi);
+                if (err < 0)
+                        goto bad;
+        }
+        if (version >= 5 && __decode_pool_names(p, end, map) < 0)
+                goto bad;
+
+        /* old_pool */
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                struct ceph_pg_pool_info *pi;
+
+                ceph_decode_32_safe(p, end, pool, bad);
+                pi = __lookup_pg_pool(&map->pg_pools, pool);
+                if (pi)
+                        __remove_pg_pool(&map->pg_pools, pi);
+        }
+
+        /* new_up */
+        err = -EINVAL;
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                u32 osd;
+                struct ceph_entity_addr addr;
+                ceph_decode_32_safe(p, end, osd, bad);
+                ceph_decode_copy_safe(p, end, &addr, sizeof(addr), bad);
+                ceph_decode_addr(&addr);
+                pr_info("osd%d up\n", osd);
+                BUG_ON(osd >= map->max_osd);
+                map->osd_state[osd] |= CEPH_OSD_UP;
+                map->osd_addr[osd] = addr;
+        }
+
+        /* new_down */
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                u32 osd;
+                ceph_decode_32_safe(p, end, osd, bad);
+                (*p)++;  /* clean flag */
+                pr_info("osd%d down\n", osd);
+                if (osd < map->max_osd)
+                        map->osd_state[osd] &= ~CEPH_OSD_UP;
+        }
+
+        /* new_weight */
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                u32 osd, off;
+                ceph_decode_need(p, end, sizeof(u32)*2, bad);
+                osd = ceph_decode_32(p);
+                off = ceph_decode_32(p);
+                pr_info("osd%d weight 0x%x %s\n", osd, off,
+                     off == CEPH_OSD_IN ? "(in)" :
+                     (off == CEPH_OSD_OUT ? "(out)" : ""));
+                if (osd < map->max_osd)
+                        map->osd_weight[osd] = off;
+        }
+
+        /* new_pg_temp */
+        rbp = rb_first(&map->pg_temp);
+        ceph_decode_32_safe(p, end, len, bad);
+        while (len--) {
+                struct ceph_pg_mapping *pg;
+                int j;
+                struct ceph_pg pgid;
+                u32 pglen;
+                ceph_decode_need(p, end, sizeof(u64) + sizeof(u32), bad);
+                ceph_decode_copy(p, &pgid, sizeof(pgid));
+                pglen = ceph_decode_32(p);
+
+                /* remove any? */
+                while (rbp && pgid_cmp(rb_entry(rbp, struct ceph_pg_mapping,
+                                                node)->pgid, pgid) <= 0) {
+                        struct ceph_pg_mapping *cur =
+                                rb_entry(rbp, struct ceph_pg_mapping, node);
+
+                        rbp = rb_next(rbp);
+                        dout(" removed pg_temp %llx\n", *(u64 *)&cur->pgid);
+                        rb_erase(&cur->node, &map->pg_temp);
+                        kfree(cur);
+                }
+
+                if (pglen) {
+                        /* insert */
+                        ceph_decode_need(p, end, pglen*sizeof(u32), bad);
+                        pg = kmalloc(sizeof(*pg) + sizeof(u32)*pglen, GFP_NOFS);
+                        if (!pg) {
+                                err = -ENOMEM;
+                                goto bad;
+                        }
+                        pg->pgid = pgid;
+                        pg->len = pglen;
+                        for (j = 0; j < pglen; j++)
+                                pg->osds[j] = ceph_decode_32(p);
+                        err = __insert_pg_mapping(pg, &map->pg_temp);
+                        if (err) {
+                                kfree(pg);
+                                goto bad;
+                        }
+                        dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid,
+                             pglen);
+                }
+        }
+        while (rbp) {
+                struct ceph_pg_mapping *cur =
+                        rb_entry(rbp, struct ceph_pg_mapping, node);
+
+                rbp = rb_next(rbp);
+                dout(" removed pg_temp %llx\n", *(u64 *)&cur->pgid);
+                rb_erase(&cur->node, &map->pg_temp);
+                kfree(cur);
+        }
+
+        /* ignore the rest */
+        *p = end;
+        return map;
+
+bad:
+        pr_err("corrupt inc osdmap epoch %d off %d (%p of %p-%p)\n",
+               epoch, (int)(*p - start), *p, start, end);
+        print_hex_dump(KERN_DEBUG, "osdmap: ",
+                       DUMP_PREFIX_OFFSET, 16, 1,
+                       start, end - start, true);
+        if (newcrush)
+                crush_destroy(newcrush);
+        return ERR_PTR(err);
+}
+
+
+
+
+/*
+ * calculate file layout from given offset, length.
+ * fill in correct oid, logical length, and object extent
+ * offset, length.
+ *
+ * for now, we write only a single su, until we can
+ * pass a stride back to the caller.
+ */
+void ceph_calc_file_object_mapping(struct ceph_file_layout *layout,
+                                   u64 off, u64 *plen,
+                                   u64 *ono,
+                                   u64 *oxoff, u64 *oxlen)
+{
+        u32 osize = le32_to_cpu(layout->fl_object_size);
+        u32 su = le32_to_cpu(layout->fl_stripe_unit);
+        u32 sc = le32_to_cpu(layout->fl_stripe_count);
+        u32 bl, stripeno, stripepos, objsetno;
+        u32 su_per_object;
+        u64 t, su_offset;
+
+        dout("mapping %llu~%llu  osize %u fl_su %u\n", off, *plen,
+             osize, su);
+        su_per_object = osize / su;
+        dout("osize %u / su %u = su_per_object %u\n", osize, su,
+             su_per_object);
+
+        BUG_ON((su & ~PAGE_MASK) != 0);
+        /* bl = *off / su; */
+        t = off;
+        do_div(t, su);
+        bl = t;
+        dout("off %llu / su %u = bl %u\n", off, su, bl);
+
+        stripeno = bl / sc;
+        stripepos = bl % sc;
+        objsetno = stripeno / su_per_object;
+
+        *ono = objsetno * sc + stripepos;
+        dout("objset %u * sc %u = ono %u\n", objsetno, sc, (unsigned)*ono);
+
+        /* *oxoff = *off % layout->fl_stripe_unit;  # offset in su */
+        t = off;
+        su_offset = do_div(t, su);
+        *oxoff = su_offset + (stripeno % su_per_object) * su;
+
+        /*
+         * Calculate the length of the extent being written to the selected
+         * object. This is the minimum of the full length requested (plen) or
+         * the remainder of the current stripe being written to.
+         */
+        *oxlen = min_t(u64, *plen, su - su_offset);
+        *plen = *oxlen;
+
+        dout(" obj extent %llu~%llu\n", *oxoff, *oxlen);
+}
+EXPORT_SYMBOL(ceph_calc_file_object_mapping);
+
+/*
+ * calculate an object layout (i.e. pgid) from an oid,
+ * file_layout, and osdmap
+ */
+int ceph_calc_object_layout(struct ceph_object_layout *ol,
+                            const char *oid,
+                            struct ceph_file_layout *fl,
+                            struct ceph_osdmap *osdmap)
+{
+        unsigned num, num_mask;
+        struct ceph_pg pgid;
+        s32 preferred = (s32)le32_to_cpu(fl->fl_pg_preferred);
+        int poolid = le32_to_cpu(fl->fl_pg_pool);
+        struct ceph_pg_pool_info *pool;
+        unsigned ps;
+
+        BUG_ON(!osdmap);
+
+        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
+        if (!pool)
+                return -EIO;
+        ps = ceph_str_hash(pool->v.object_hash, oid, strlen(oid));
+        if (preferred >= 0) {
+                ps += preferred;
+                num = le32_to_cpu(pool->v.lpg_num);
+                num_mask = pool->lpg_num_mask;
+        } else {
+                num = le32_to_cpu(pool->v.pg_num);
+                num_mask = pool->pg_num_mask;
+        }
+
+        pgid.ps = cpu_to_le16(ps);
+        pgid.preferred = cpu_to_le16(preferred);
+        pgid.pool = fl->fl_pg_pool;
+        if (preferred >= 0)
+                dout("calc_object_layout '%s' pgid %d.%xp%d\n", oid, poolid, ps,
+                     (int)preferred);
+        else
+                dout("calc_object_layout '%s' pgid %d.%x\n", oid, poolid, ps);
+
+        ol->ol_pgid = pgid;
+        ol->ol_stripe_unit = fl->fl_object_stripe_unit;
+        return 0;
+}
+EXPORT_SYMBOL(ceph_calc_object_layout);
+
+/*
+ * Calculate raw osd vector for the given pgid.  Return pointer to osd
+ * array, or NULL on failure.
+ */
+static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+                        int *osds, int *num)
+{
+        struct ceph_pg_mapping *pg;
+        struct ceph_pg_pool_info *pool;
+        int ruleno;
+        unsigned poolid, ps, pps;
+        int preferred;
+
+        /* pg_temp? */
+        pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
+        if (pg) {
+                *num = pg->len;
+                return pg->osds;
+        }
+
+        /* crush */
+        poolid = le32_to_cpu(pgid.pool);
+        ps = le16_to_cpu(pgid.ps);
+        preferred = (s16)le16_to_cpu(pgid.preferred);
+
+        /* don't forcefeed bad device ids to crush */
+        if (preferred >= osdmap->max_osd ||
+            preferred >= osdmap->crush->max_devices)
+                preferred = -1;
+
+        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
+        if (!pool)
+                return NULL;
+        ruleno = crush_find_rule(osdmap->crush, pool->v.crush_ruleset,
+                                 pool->v.type, pool->v.size);
+        if (ruleno < 0) {
+                pr_err("no crush rule pool %d ruleset %d type %d size %d\n",
+                       poolid, pool->v.crush_ruleset, pool->v.type,
+                       pool->v.size);
+                return NULL;
+        }
+
+        if (preferred >= 0)
+                pps = ceph_stable_mod(ps,
+                                      le32_to_cpu(pool->v.lpgp_num),
+                                      pool->lpgp_num_mask);
+        else
+                pps = ceph_stable_mod(ps,
+                                      le32_to_cpu(pool->v.pgp_num),
+                                      pool->pgp_num_mask);
+        pps += poolid;
+        *num = crush_do_rule(osdmap->crush, ruleno, pps, osds,
+                             min_t(int, pool->v.size, *num),
+                             preferred, osdmap->osd_weight);
+        return osds;
+}
+
+/*
+ * Return acting set for given pgid.
+ */
+int ceph_calc_pg_acting(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+                        int *acting)
+{
+        int rawosds[CEPH_PG_MAX_SIZE], *osds;
+        int i, o, num = CEPH_PG_MAX_SIZE;
+
+        osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
+        if (!osds)
+                return -1;
+
+        /* primary is first up osd */
+        o = 0;
+        for (i = 0; i < num; i++)
+                if (ceph_osd_is_up(osdmap, osds[i]))
+                        acting[o++] = osds[i];
+        return o;
+}
+
+/*
+ * Return primary osd for given pgid, or -1 if none.
+ */
+int ceph_calc_pg_primary(struct ceph_osdmap *osdmap, struct ceph_pg pgid)
+{
+        int rawosds[CEPH_PG_MAX_SIZE], *osds;
+        int i, num = CEPH_PG_MAX_SIZE;
+
+        osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
+        if (!osds)
+                return -1;
+
+        /* primary is first up osd */
+        for (i = 0; i < num; i++)
+                if (ceph_osd_is_up(osdmap, osds[i]))
+                        return osds[i];
+        return -1;
+}
+EXPORT_SYMBOL(ceph_calc_pg_primary);
diff --git a/net/ceph/pagelist.c b/net/ceph/pagelist.c
new file mode 100644
index 000000000000..13cb409a7bba
--- /dev/null
+++ b/net/ceph/pagelist.c
@@ -0,0 +1,154 @@
+
+#include <linux/module.h>
+#include <linux/gfp.h>
+#include <linux/pagemap.h>
+#include <linux/highmem.h>
+#include <linux/ceph/pagelist.h>
+
+static void ceph_pagelist_unmap_tail(struct ceph_pagelist *pl)
+{
+        if (pl->mapped_tail) {
+                struct page *page = list_entry(pl->head.prev, struct page, lru);
+                kunmap(page);
+                pl->mapped_tail = NULL;
+        }
+}
+
+int ceph_pagelist_release(struct ceph_pagelist *pl)
+{
+        ceph_pagelist_unmap_tail(pl);
+        while (!list_empty(&pl->head)) {
+                struct page *page = list_first_entry(&pl->head, struct page,
+                                                     lru);
+                list_del(&page->lru);
+                __free_page(page);
+        }
+        ceph_pagelist_free_reserve(pl);
+        return 0;
+}
+EXPORT_SYMBOL(ceph_pagelist_release);
+
+static int ceph_pagelist_addpage(struct ceph_pagelist *pl)
+{
+        struct page *page;
+
+        if (!pl->num_pages_free) {
+                page = __page_cache_alloc(GFP_NOFS);
+        } else {
+                page = list_first_entry(&pl->free_list, struct page, lru);
+                list_del(&page->lru);
+                --pl->num_pages_free;
+        }
+        if (!page)
+                return -ENOMEM;
+        pl->room += PAGE_SIZE;
+        ceph_pagelist_unmap_tail(pl);
+        list_add_tail(&page->lru, &pl->head);
+        pl->mapped_tail = kmap(page);
+        return 0;
+}
+
+int ceph_pagelist_append(struct ceph_pagelist *pl, const void *buf, size_t len)
+{
+        while (pl->room < len) {
+                size_t bit = pl->room;
+                int ret;
+
+                memcpy(pl->mapped_tail + (pl->length & ~PAGE_CACHE_MASK),
+                       buf, bit);
+                pl->length += bit;
+                pl->room -= bit;
+                buf += bit;
+                len -= bit;
+                ret = ceph_pagelist_addpage(pl);
+                if (ret)
+                        return ret;
+        }
+
+        memcpy(pl->mapped_tail + (pl->length & ~PAGE_CACHE_MASK), buf, len);
+        pl->length += len;
+        pl->room -= len;
+        return 0;
+}
+EXPORT_SYMBOL(ceph_pagelist_append);
+
+/**
+ * Allocate enough pages for a pagelist to append the given amount
+ * of data without without allocating.
+ * Returns: 0 on success, -ENOMEM on error.
+ */
+int ceph_pagelist_reserve(struct ceph_pagelist *pl, size_t space)
+{
+        if (space <= pl->room)
+                return 0;
+        space -= pl->room;
+        space = (space + PAGE_SIZE - 1) >> PAGE_SHIFT;   /* conv to num pages */
+
+        while (space > pl->num_pages_free) {
+                struct page *page = __page_cache_alloc(GFP_NOFS);
+                if (!page)
+                        return -ENOMEM;
+                list_add_tail(&page->lru, &pl->free_list);
+                ++pl->num_pages_free;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(ceph_pagelist_reserve);
+
+/**
+ * Free any pages that have been preallocated.
+ */
+int ceph_pagelist_free_reserve(struct ceph_pagelist *pl)
+{
+        while (!list_empty(&pl->free_list)) {
+                struct page *page = list_first_entry(&pl->free_list,
+                                                     struct page, lru);
+                list_del(&page->lru);
+                __free_page(page);
+                --pl->num_pages_free;
+        }
+        BUG_ON(pl->num_pages_free);
+        return 0;
+}
+EXPORT_SYMBOL(ceph_pagelist_free_reserve);
+
+/**
+ * Create a truncation point.
+ */
+void ceph_pagelist_set_cursor(struct ceph_pagelist *pl,
+                              struct ceph_pagelist_cursor *c)
+{
+        c->pl = pl;
+        c->page_lru = pl->head.prev;
+        c->room = pl->room;
+}
+EXPORT_SYMBOL(ceph_pagelist_set_cursor);
+
+/**
+ * Truncate a pagelist to the given point. Move extra pages to reserve.
+ * This won't sleep.
+ * Returns: 0 on success,
+ *          -EINVAL if the pagelist doesn't match the trunc point pagelist
+ */
+int ceph_pagelist_truncate(struct ceph_pagelist *pl,
+                           struct ceph_pagelist_cursor *c)
+{
+        struct page *page;
+
+        if (pl != c->pl)
+                return -EINVAL;
+        ceph_pagelist_unmap_tail(pl);
+        while (pl->head.prev != c->page_lru) {
+                page = list_entry(pl->head.prev, struct page, lru);
+                list_del(&page->lru);                /* remove from pagelist */
+                list_add_tail(&page->lru, &pl->free_list); /* add to reserve */
+                ++pl->num_pages_free;
+        }
+        pl->room = c->room;
+        if (!list_empty(&pl->head)) {
+                page = list_entry(pl->head.prev, struct page, lru);
+                pl->mapped_tail = kmap(page);
+        }
+        return 0;
+}
+EXPORT_SYMBOL(ceph_pagelist_truncate);
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
new file mode 100644
index 000000000000..54caf0687155
--- /dev/null
+++ b/net/ceph/pagevec.c
@@ -0,0 +1,223 @@
+#include <linux/ceph/ceph_debug.h>
+
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/file.h>
+#include <linux/namei.h>
+#include <linux/writeback.h>
+
+#include <linux/ceph/libceph.h>
+
+/*
+ * build a vector of user pages
+ */
+struct page **ceph_get_direct_page_vector(const char __user *data,
+                                                 int num_pages,
+                                                 loff_t off, size_t len)
+{
+        struct page **pages;
+        int rc;
+
+        pages = kmalloc(sizeof(*pages) * num_pages, GFP_NOFS);
+        if (!pages)
+                return ERR_PTR(-ENOMEM);
+
+        down_read(&current->mm->mmap_sem);
+        rc = get_user_pages(current, current->mm, (unsigned long)data,
+                            num_pages, 0, 0, pages, NULL);
+        up_read(&current->mm->mmap_sem);
+        if (rc < 0)
+                goto fail;
+        return pages;
+
+fail:
+        kfree(pages);
+        return ERR_PTR(rc);
+}
+EXPORT_SYMBOL(ceph_get_direct_page_vector);
+
+void ceph_put_page_vector(struct page **pages, int num_pages)
+{
+        int i;
+
+        for (i = 0; i < num_pages; i++)
+                put_page(pages[i]);
+        kfree(pages);
+}
+EXPORT_SYMBOL(ceph_put_page_vector);
+
+void ceph_release_page_vector(struct page **pages, int num_pages)
+{
+        int i;
+
+        for (i = 0; i < num_pages; i++)
+                __free_pages(pages[i], 0);
+        kfree(pages);
+}
+EXPORT_SYMBOL(ceph_release_page_vector);
+
+/*
+ * allocate a vector new pages
+ */
+struct page **ceph_alloc_page_vector(int num_pages, gfp_t flags)
+{
+        struct page **pages;
+        int i;
+
+        pages = kmalloc(sizeof(*pages) * num_pages, flags);
+        if (!pages)
+                return ERR_PTR(-ENOMEM);
+        for (i = 0; i < num_pages; i++) {
+                pages[i] = __page_cache_alloc(flags);
+                if (pages[i] == NULL) {
+                        ceph_release_page_vector(pages, i);
+                        return ERR_PTR(-ENOMEM);
+                }
+        }
+        return pages;
+}
+EXPORT_SYMBOL(ceph_alloc_page_vector);
+
+/*
+ * copy user data into a page vector
+ */
+int ceph_copy_user_to_page_vector(struct page **pages,
+                                         const char __user *data,
+                                         loff_t off, size_t len)
+{
+        int i = 0;
+        int po = off & ~PAGE_CACHE_MASK;
+        int left = len;
+        int l, bad;
+
+        while (left > 0) {
+                l = min_t(int, PAGE_CACHE_SIZE-po, left);
+                bad = copy_from_user(page_address(pages[i]) + po, data, l);
+                if (bad == l)
+                        return -EFAULT;
+                data += l - bad;
+                left -= l - bad;
+                po += l - bad;
+                if (po == PAGE_CACHE_SIZE) {
+                        po = 0;
+                        i++;
+                }
+        }
+        return len;
+}
+EXPORT_SYMBOL(ceph_copy_user_to_page_vector);
+
+int ceph_copy_to_page_vector(struct page **pages,
+                                    const char *data,
+                                    loff_t off, size_t len)
+{
+        int i = 0;
+        size_t po = off & ~PAGE_CACHE_MASK;
+        size_t left = len;
+        size_t l;
+
+        while (left > 0) {
+                l = min_t(size_t, PAGE_CACHE_SIZE-po, left);
+                memcpy(page_address(pages[i]) + po, data, l);
+                data += l;
+                left -= l;
+                po += l;
+                if (po == PAGE_CACHE_SIZE) {
+                        po = 0;
+                        i++;
+                }
+        }
+        return len;
+}
+EXPORT_SYMBOL(ceph_copy_to_page_vector);
+
+int ceph_copy_from_page_vector(struct page **pages,
+                                    char *data,
+                                    loff_t off, size_t len)
+{
+        int i = 0;
+        size_t po = off & ~PAGE_CACHE_MASK;
+        size_t left = len;
+        size_t l;
+
+        while (left > 0) {
+                l = min_t(size_t, PAGE_CACHE_SIZE-po, left);
+                memcpy(data, page_address(pages[i]) + po, l);
+                data += l;
+                left -= l;
+                po += l;
+                if (po == PAGE_CACHE_SIZE) {
+                        po = 0;
+                        i++;
+                }
+        }
+        return len;
+}
+EXPORT_SYMBOL(ceph_copy_from_page_vector);
+
+/*
+ * copy user data from a page vector into a user pointer
+ */
+int ceph_copy_page_vector_to_user(struct page **pages,
+                                         char __user *data,
+                                         loff_t off, size_t len)
+{
+        int i = 0;
+        int po = off & ~PAGE_CACHE_MASK;
+        int left = len;
+        int l, bad;
+
+        while (left > 0) {
+                l = min_t(int, left, PAGE_CACHE_SIZE-po);
+                bad = copy_to_user(data, page_address(pages[i]) + po, l);
+                if (bad == l)
+                        return -EFAULT;
+                data += l - bad;
+                left -= l - bad;
+                if (po) {
+                        po += l - bad;
+                        if (po == PAGE_CACHE_SIZE)
+                                po = 0;
+                }
+                i++;
+        }
+        return len;
+}
+EXPORT_SYMBOL(ceph_copy_page_vector_to_user);
+
+/*
+ * Zero an extent within a page vector.  Offset is relative to the
+ * start of the first page.
+ */
+void ceph_zero_page_vector_range(int off, int len, struct page **pages)
+{
+        int i = off >> PAGE_CACHE_SHIFT;
+
+        off &= ~PAGE_CACHE_MASK;
+
+        dout("zero_page_vector_page %u~%u\n", off, len);
+
+        /* leading partial page? */
+        if (off) {
+                int end = min((int)PAGE_CACHE_SIZE, off + len);
+                dout("zeroing %d %p head from %d\n", i, pages[i],
+                     (int)off);
+                zero_user_segment(pages[i], off, end);
+                len -= (end - off);
+                i++;
+        }
+        while (len >= PAGE_CACHE_SIZE) {
+                dout("zeroing %d %p len=%d\n", i, pages[i], len);
+                zero_user_segment(pages[i], 0, PAGE_CACHE_SIZE);
+                len -= PAGE_CACHE_SIZE;
+                i++;
+        }
+        /* trailing partial page? */
+        if (len) {
+                dout("zeroing %d %p tail to %d\n", i, pages[i], (int)len);
+                zero_user_segment(pages[i], 0, len);
+        }
+}
+EXPORT_SYMBOL(ceph_zero_page_vector_range);
+
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 251997a95483..282806ba7a57 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -243,6 +243,7 @@ void skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb)
         unlock_sock_fast(sk, slow);
 
         /* skb is now orphaned, can be freed outside of locked section */
+        trace_kfree_skb(skb, skb_free_datagram_locked);
         __kfree_skb(skb);
 }
 EXPORT_SYMBOL(skb_free_datagram_locked);
diff --git a/net/core/dev.c b/net/core/dev.c
index 3721fbb9a83c..7ec85e27beed 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -128,6 +128,8 @@
 #include <linux/jhash.h>
 #include <linux/random.h>
 #include <trace/events/napi.h>
+#include <trace/events/net.h>
+#include <trace/events/skb.h>
 #include <linux/pci.h>
 
 #include "net-sysfs.h"
@@ -1978,6 +1980,7 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                 }
 
                 rc = ops->ndo_start_xmit(skb, dev);
+                trace_net_dev_xmit(skb, rc);
                 if (rc == NETDEV_TX_OK)
                         txq_trans_update(txq);
                 return rc;
@@ -1998,6 +2001,7 @@ gso:
                         skb_dst_drop(nskb);
 
                 rc = ops->ndo_start_xmit(nskb, dev);
+                trace_net_dev_xmit(nskb, rc);
                 if (unlikely(rc != NETDEV_TX_OK)) {
                         if (rc & ~NETDEV_TX_MASK)
                                 goto out_kfree_gso_skb;
@@ -2058,16 +2062,16 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
                                         struct sk_buff *skb)
 {
         int queue_index;
-        struct sock *sk = skb->sk;
+        const struct net_device_ops *ops = dev->netdev_ops;
 
-        queue_index = sk_tx_queue_get(sk);
-        if (queue_index < 0) {
-                const struct net_device_ops *ops = dev->netdev_ops;
+        if (ops->ndo_select_queue) {
+                queue_index = ops->ndo_select_queue(dev, skb);
+                queue_index = dev_cap_txqueue(dev, queue_index);
+        } else {
+                struct sock *sk = skb->sk;
+                queue_index = sk_tx_queue_get(sk);
+                if (queue_index < 0) {
 
-                if (ops->ndo_select_queue) {
-                        queue_index = ops->ndo_select_queue(dev, skb);
-                        queue_index = dev_cap_txqueue(dev, queue_index);
-                } else {
                         queue_index = 0;
                         if (dev->real_num_tx_queues > 1)
                                 queue_index = skb_tx_hash(dev, skb);
@@ -2186,6 +2190,7 @@ int dev_queue_xmit(struct sk_buff *skb)
 #ifdef CONFIG_NET_CLS_ACT
         skb->tc_verd = SET_TC_AT(skb->tc_verd, AT_EGRESS);
 #endif
+        trace_net_dev_queue(skb);
         if (q->enqueue) {
                 rc = __dev_xmit_skb(skb, q, dev, txq);
                 goto out;
@@ -2512,6 +2517,7 @@ int netif_rx(struct sk_buff *skb)
         if (netdev_tstamp_prequeue)
                 net_timestamp_check(skb);
 
+        trace_netif_rx(skb);
 #ifdef CONFIG_RPS
         {
                 struct rps_dev_flow voidflow, *rflow = &voidflow;
@@ -2571,6 +2577,7 @@ static void net_tx_action(struct softirq_action *h)
                         clist = clist->next;
 
                         WARN_ON(atomic_read(&skb->users));
+                        trace_kfree_skb(skb, net_tx_action);
                         __kfree_skb(skb);
                 }
         }
@@ -2828,6 +2835,7 @@ static int __netif_receive_skb(struct sk_buff *skb)
         if (!netdev_tstamp_prequeue)
                 net_timestamp_check(skb);
 
+        trace_netif_receive_skb(skb);
         if (vlan_tx_tag_present(skb) && vlan_hwaccel_do_receive(skb))
                 return NET_RX_SUCCESS;
 
@@ -4845,7 +4853,7 @@ static void rollback_registered_many(struct list_head *head)
         dev = list_first_entry(head, struct net_device, unreg_list);
         call_netdevice_notifiers(NETDEV_UNREGISTER_BATCH, dev);
 
-        synchronize_net();
+        rcu_barrier();
 
         list_for_each_entry(dev, head, unreg_list)
                 dev_put(dev);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 7a85367b3c2f..8451ab481095 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -348,7 +348,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
         if (info.cmd == ETHTOOL_GRXCLSRLALL) {
                 if (info.rule_cnt > 0) {
                         if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
-                                rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+                                rule_buf = kzalloc(info.rule_cnt * sizeof(u32),
                                                    GFP_USER);
                         if (!rule_buf)
                                 return -ENOMEM;
@@ -397,7 +397,7 @@ static noinline_for_stack int ethtool_get_rxfh_indir(struct net_device *dev,
             (KMALLOC_MAX_SIZE - sizeof(*indir)) / sizeof(*indir->ring_index))
                 return -ENOMEM;
         full_size = sizeof(*indir) + sizeof(*indir->ring_index) * table_size;
-        indir = kmalloc(full_size, GFP_USER);
+        indir = kzalloc(full_size, GFP_USER);
         if (!indir)
                 return -ENOMEM;
 
@@ -538,7 +538,7 @@ static int ethtool_get_rx_ntuple(struct net_device *dev, void __user *useraddr)
 
         gstrings.len = ret;
 
-        data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
+        data = kzalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
         if (!data)
                 return -ENOMEM;
 
@@ -775,7 +775,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         if (regs.len > reglen)
                 regs.len = reglen;
 
-        regbuf = kmalloc(reglen, GFP_USER);
+        regbuf = kzalloc(reglen, GFP_USER);
         if (!regbuf)
                 return -ENOMEM;
 
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 9fbe7f7429b0..6743146e4d6b 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -232,7 +232,7 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
         est->last_packets = bstats->packets;
         est->avpps = rate_est->pps<<10;
 
-        spin_lock(&est_tree_lock);
+        spin_lock_bh(&est_tree_lock);
         if (!elist[idx].timer.function) {
                 INIT_LIST_HEAD(&elist[idx].list);
                 setup_timer(&elist[idx].timer, est_timer, idx);
@@ -243,7 +243,7 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
 
         list_add_rcu(&est->list, &elist[idx].list);
         gen_add_node(est);
-        spin_unlock(&est_tree_lock);
+        spin_unlock_bh(&est_tree_lock);
 
         return 0;
 }
@@ -270,7 +270,7 @@ void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
 {
         struct gen_estimator *e;
 
-        spin_lock(&est_tree_lock);
+        spin_lock_bh(&est_tree_lock);
         while ((e = gen_find_node(bstats, rate_est))) {
                 rb_erase(&e->node, &est_root);
 
@@ -281,7 +281,7 @@ void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
                 list_del_rcu(&e->list);
                 call_rcu(&e->e_rcu, __gen_kill_estimator);
         }
-        spin_unlock(&est_tree_lock);
+        spin_unlock_bh(&est_tree_lock);
 }
 EXPORT_SYMBOL(gen_kill_estimator);
 
@@ -320,9 +320,9 @@ bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
 
         ASSERT_RTNL();
 
-        spin_lock(&est_tree_lock);
+        spin_lock_bh(&est_tree_lock);
         res = gen_find_node(bstats, rate_est) != NULL;
-        spin_unlock(&est_tree_lock);
+        spin_unlock_bh(&est_tree_lock);
 
         return res;
 }
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 1cd98df412df..e6b133b77ccb 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -35,9 +35,10 @@
  *      in any case.
  */
 
-int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode)
+long verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode)
 {
-        int size, err, ct;
+        int size, ct;
+        long err;
 
         if (m->msg_namelen) {
                 if (mode == VERIFY_READ) {
diff --git a/net/core/net-traces.c b/net/core/net-traces.c
index afa6380ed88a..7f1bb2aba03b 100644
--- a/net/core/net-traces.c
+++ b/net/core/net-traces.c
@@ -26,6 +26,7 @@
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/skb.h>
+#include <trace/events/net.h>
 #include <trace/events/napi.h>
 
 EXPORT_TRACEPOINT_SYMBOL_GPL(kfree_skb);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 3a2513f0d0c3..56ba3c4e4761 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -466,6 +466,7 @@ void consume_skb(struct sk_buff *skb)
                 smp_rmb();
         else if (likely(!atomic_dec_and_test(&skb->users)))
                 return;
+        trace_consume_skb(skb);
         __kfree_skb(skb);
 }
 EXPORT_SYMBOL(consume_skb);
@@ -2573,6 +2574,10 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
                 __copy_skb_header(nskb, skb);
                 nskb->mac_len = skb->mac_len;
 
+                /* nskb and skb might have different headroom */
+                if (nskb->ip_summed == CHECKSUM_PARTIAL)
+                        nskb->csum_start += skb_headroom(nskb) - headroom;
+
                 skb_reset_mac_header(nskb);
                 skb_set_network_header(nskb, skb->mac_len);
                 nskb->transport_header = (nskb->network_header +
@@ -2703,7 +2708,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
                 return -E2BIG;
 
         headroom = skb_headroom(p);
-        nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
+        nskb = alloc_skb(headroom + skb_gro_offset(p), GFP_ATOMIC);
         if (unlikely(!nskb))
                 return -ENOMEM;
 
diff --git a/net/core/sock.c b/net/core/sock.c
index b05b9b6ddb87..7d99e13148e6 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1078,8 +1078,11 @@ static void sk_prot_free(struct proto *prot, struct sock *sk)
 #ifdef CONFIG_CGROUPS
 void sock_update_classid(struct sock *sk)
 {
-        u32 classid = task_cls_classid(current);
+        u32 classid;
 
+        rcu_read_lock();  /* doing current task, which cannot vanish. */
+        classid = task_cls_classid(current);
+        rcu_read_unlock();
         if (classid && classid != sk->sk_classid)
                 sk->sk_classid = classid;
 }
@@ -1351,9 +1354,9 @@ int sock_i_uid(struct sock *sk)
 {
         int uid;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         uid = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_uid : 0;
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         return uid;
 }
 EXPORT_SYMBOL(sock_i_uid);
@@ -1362,9 +1365,9 @@ unsigned long sock_i_ino(struct sock *sk)
 {
         unsigned long ino;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0;
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         return ino;
 }
 EXPORT_SYMBOL(sock_i_ino);
diff --git a/net/core/stream.c b/net/core/stream.c
index d959e0f41528..f5df85dcd20b 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -141,10 +141,10 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
 
                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
                 sk->sk_write_pending++;
-                sk_wait_event(sk, &current_timeo, !sk->sk_err &&
-                                                  !(sk->sk_shutdown & SEND_SHUTDOWN) &&
-                                                  sk_stream_memory_free(sk) &&
-                                                  vm_wait);
+                sk_wait_event(sk, &current_timeo, sk->sk_err ||
+                                                  (sk->sk_shutdown & SEND_SHUTDOWN) ||
+                                                  (sk_stream_memory_free(sk) &&
+                                                  !vm_wait));
                 sk->sk_write_pending--;
 
                 if (vm_wait) {
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 078e48d442fd..33d0e6297c21 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -149,6 +149,7 @@ static const struct file_operations dccpprobe_fops = {
         .owner   = THIS_MODULE,
         .open    = dccpprobe_open,
         .read    = dccpprobe_read,
+        .llseek  = noop_llseek,
 };
 
 static __init int dccpprobe_init(void)
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 7c3a7d191249..7cd7760144f7 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -46,7 +46,7 @@ config IP_ADVANCED_ROUTER
           rp_filter on use:
 
           echo 1 > /proc/sys/net/ipv4/conf/<device>/rp_filter
-           and
+           or
           echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
 
           Note that some distributions enable it in startup scripts.
@@ -217,6 +217,7 @@ config NET_IPIP
 
 config NET_IPGRE
         tristate "IP: GRE tunnels over IP"
+        depends on IPV6 || IPV6=n
         help
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
@@ -412,7 +413,7 @@ config INET_XFRM_MODE_BEET
           If unsure, say Y.
 
 config INET_LRO
-        bool "Large Receive Offload (ipv4/tcp)"
+        tristate "Large Receive Offload (ipv4/tcp)"
         default y
         ---help---
           Support for Large Receive Offload (ipv4/tcp).
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index f0550941df7b..721a8a37b45c 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -62,8 +62,11 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         }
         if (!inet->inet_saddr)
                 inet->inet_saddr = rt->rt_src;  /* Update source address */
-        if (!inet->inet_rcv_saddr)
+        if (!inet->inet_rcv_saddr) {
                 inet->inet_rcv_saddr = rt->rt_src;
+                if (sk->sk_prot->rehash)
+                        sk->sk_prot->rehash(sk);
+        }
         inet->inet_daddr = rt->rt_dst;
         inet->inet_dport = usin->sin_port;
         sk->sk_state = TCP_ESTABLISHED;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index a43968918350..7d02a9f999fa 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -246,6 +246,7 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
 
         struct fib_result res;
         int no_addr, rpf, accept_local;
+        bool dev_match;
         int ret;
         struct net *net;
 
@@ -273,12 +274,22 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
         }
         *spec_dst = FIB_RES_PREFSRC(res);
         fib_combine_itag(itag, &res);
+        dev_match = false;
+
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-        if (FIB_RES_DEV(res) == dev || res.fi->fib_nhs > 1)
+        for (ret = 0; ret < res.fi->fib_nhs; ret++) {
+                struct fib_nh *nh = &res.fi->fib_nh[ret];
+
+                if (nh->nh_dev == dev) {
+                        dev_match = true;
+                        break;
+                }
+        }
 #else
         if (FIB_RES_DEV(res) == dev)
+                dev_match = true;
 #endif
-        {
+        if (dev_match) {
                 ret = FIB_RES_NH(res).nh_scope >= RT_SCOPE_HOST;
                 fib_res_put(&res);
                 return ret;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 79d057a939ba..4a8e370862bc 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -186,7 +186,9 @@ static inline struct tnode *node_parent_rcu(struct node *node)
 {
         struct tnode *ret = node_parent(node);
 
-        return rcu_dereference(ret);
+        return rcu_dereference_check(ret,
+                                     rcu_read_lock_held() ||
+                                     lockdep_rtnl_is_held());
 }
 
 /* Same as rcu_assign_pointer
@@ -1753,7 +1755,9 @@ static struct leaf *leaf_walk_rcu(struct tnode *p, struct node *c)
 
 static struct leaf *trie_firstleaf(struct trie *t)
 {
-        struct tnode *n = (struct tnode *) rcu_dereference(t->trie);
+        struct tnode *n = (struct tnode *) rcu_dereference_check(t->trie,
+                                                        rcu_read_lock_held() ||
+                                                        lockdep_rtnl_is_held());
 
         if (!n)
                 return NULL;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index a1ad0e7180d2..2a4bb76f2132 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -856,6 +856,18 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                 igmpv3_clear_delrec(in_dev);
         } else if (len < 12) {
                 return; /* ignore bogus packet; freed by caller */
+        } else if (IGMP_V1_SEEN(in_dev)) {
+                /* This is a v3 query with v1 queriers present */
+                max_delay = IGMP_Query_Response_Interval;
+                group = 0;
+        } else if (IGMP_V2_SEEN(in_dev)) {
+                /* this is a v3 query with v2 queriers present;
+                 * Interpretation of the max_delay code is problematic here.
+                 * A real v2 host would use ih_code directly, while v3 has a
+                 * different encoding. We use the v3 encoding as more likely
+                 * to be intended in a v3 query.
+                 */
+                max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
         } else { /* v3 */
                 if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
                         return;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 945b20a5ad50..35c93e8b6a46 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -45,7 +45,7 @@
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
 
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <net/ipv6.h>
 #include <net/ip6_fib.h>
 #include <net/ip6_route.h>
@@ -699,7 +699,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         if ((dst = rt->rt_gateway) == 0)
                                 goto tx_error_icmp;
                 }
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (skb->protocol == htons(ETH_P_IPV6)) {
                         struct in6_addr *addr6;
                         int addr_type;
@@ -774,7 +774,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         goto tx_error;
                 }
         }
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         else if (skb->protocol == htons(ETH_P_IPV6)) {
                 struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
 
@@ -850,7 +850,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         if ((iph->ttl = tiph->ttl) == 0) {
                 if (skb->protocol == htons(ETH_P_IP))
                         iph->ttl = old_iph->ttl;
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (skb->protocol == htons(ETH_P_IPV6))
                         iph->ttl = ((struct ipv6hdr *)old_iph)->hop_limit;
 #endif
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 04b69896df5f..7649d7750075 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -488,9 +488,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
          * we can switch to copy when see the first bad fragment.
          */
         if (skb_has_frags(skb)) {
-                struct sk_buff *frag;
+                struct sk_buff *frag, *frag2;
                 int first_len = skb_pagelen(skb);
-                int truesizes = 0;
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
@@ -503,18 +502,18 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         if (frag->len > mtu ||
                             ((frag->len & 7) && frag->next) ||
                             skb_headroom(frag) < hlen)
-                            goto slow_path;
+                                goto slow_path_clean;
 
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
-                                goto slow_path;
+                                goto slow_path_clean;
 
                         BUG_ON(frag->sk);
                         if (skb->sk) {
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
                         }
-                        truesizes += frag->truesize;
+                        skb->truesize -= frag->truesize;
                 }
 
                 /* Everything is OK. Generate! */
@@ -524,7 +523,6 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 frag = skb_shinfo(skb)->frag_list;
                 skb_frag_list_init(skb);
                 skb->data_len = first_len - skb_headlen(skb);
-                skb->truesize -= truesizes;
                 skb->len = first_len;
                 iph->tot_len = htons(first_len);
                 iph->frag_off = htons(IP_MF);
@@ -576,6 +574,15 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 }
                 IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
                 return err;
+
+slow_path_clean:
+                skb_walk_frags(skb, frag2) {
+                        if (frag2 == frag)
+                                break;
+                        frag2->sk = NULL;
+                        frag2->destructor = NULL;
+                        skb->truesize += frag2->truesize;
+                }
         }
 
 slow_path:
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 6c40a8c46e79..64b70ad162e3 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1129,6 +1129,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         case IP_HDRINCL:
                 val = inet->hdrincl;
                 break;
+        case IP_NODEFRAG:
+                val = inet->nodefrag;
+                break;
         case IP_MTU_DISCOVER:
                 val = inet->pmtudisc;
                 break;
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index b254dafaf429..43eec80c0e7c 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -112,6 +112,7 @@ static void send_reset(struct sk_buff *oldskb, int hook)
         /* ip_route_me_harder expects skb->dst to be set */
         skb_dst_set_noref(nskb, skb_dst(oldskb));
 
+        nskb->protocol = htons(ETH_P_IP);
         if (ip_route_me_harder(nskb, addr_type))
                 goto free_nskb;
 
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 244f7cb08d68..37f8adb68c79 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -11,6 +11,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/percpu.h>
+#include <linux/security.h>
 #include <net/net_namespace.h>
 
 #include <linux/netfilter.h>
@@ -87,6 +88,29 @@ static void ct_seq_stop(struct seq_file *s, void *v)
         rcu_read_unlock();
 }
 
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
+{
+        int ret;
+        u32 len;
+        char *secctx;
+
+        ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
+        if (ret)
+                return ret;
+
+        ret = seq_printf(s, "secctx=%s ", secctx);
+
+        security_release_secctx(secctx, len);
+        return ret;
+}
+#else
+static inline int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
+{
+        return 0;
+}
+#endif
+
 static int ct_seq_show(struct seq_file *s, void *v)
 {
         struct nf_conntrack_tuple_hash *hash = v;
@@ -148,10 +172,8 @@ static int ct_seq_show(struct seq_file *s, void *v)
                 goto release;
 #endif
 
-#ifdef CONFIG_NF_CONNTRACK_SECMARK
-        if (seq_printf(s, "secmark=%u ", ct->secmark))
+        if (ct_show_secctx(s, ct))
                 goto release;
-#endif
 
         if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
                 goto release;
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index eab8de32f200..f3a9b42b16c6 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -66,9 +66,11 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
                                           const struct net_device *out,
                                           int (*okfn)(struct sk_buff *))
 {
+        struct sock *sk = skb->sk;
         struct inet_sock *inet = inet_sk(skb->sk);
 
-        if (inet && inet->nodefrag)
+        if (sk && (sk->sk_family == PF_INET) &&
+            inet->nodefrag)
                 return NF_ACCEPT;
 
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 8c8632d9b93c..957c9241fb0c 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -38,7 +38,7 @@ static DEFINE_SPINLOCK(nf_nat_lock);
 static struct nf_conntrack_l3proto *l3proto __read_mostly;
 
 #define MAX_IP_NAT_PROTO 256
-static const struct nf_nat_protocol *nf_nat_protos[MAX_IP_NAT_PROTO]
+static const struct nf_nat_protocol __rcu *nf_nat_protos[MAX_IP_NAT_PROTO]
                                                 __read_mostly;
 
 static inline const struct nf_nat_protocol *
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 1679e2c0963d..ee5f419d0a56 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -893,13 +893,15 @@ static void fast_csum(__sum16 *csum,
         unsigned char s[4];
 
         if (offset & 1) {
-                s[0] = s[2] = 0;
+                s[0] = ~0;
                 s[1] = ~*optr;
+                s[2] = 0;
                 s[3] = *nptr;
         } else {
-                s[1] = s[3] = 0;
                 s[0] = ~*optr;
+                s[1] = ~0;
                 s[2] = *nptr;
+                s[3] = 0;
         }
 
         *csum = csum_fold(csum_partial(s, 4, ~csum_unfold(*csum)));
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 3f56b6e6c6aa..ac6559cb54f9 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1231,7 +1231,7 @@ restart:
                         }
 
                         if (net_ratelimit())
-                                printk(KERN_WARNING "Neighbour table overflow.\n");
+                                printk(KERN_WARNING "ipv4: Neighbour table overflow.\n");
                         rt_drop(rt);
                         return -ENOBUFS;
                 }
@@ -2738,6 +2738,11 @@ slow_output:
 }
 EXPORT_SYMBOL_GPL(__ip_route_output_key);
 
+static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie)
+{
+        return NULL;
+}
+
 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
@@ -2746,7 +2751,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
         .family                 =       AF_INET,
         .protocol               =       cpu_to_be16(ETH_P_IP),
         .destroy                =       ipv4_dst_destroy,
-        .check                  =       ipv4_dst_check,
+        .check                  =       ipv4_blackhole_dst_check,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
         .entries                =       ATOMIC_INIT(0),
 };
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 3fb1428e526e..f115ea68a4ef 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -386,8 +386,6 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
          */
 
         mask = 0;
-        if (sk->sk_err)
-                mask = POLLERR;
 
         /*
          * POLLHUP is certainly not done right. But poll() doesn't
@@ -457,6 +455,11 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                 if (tp->urg_data & TCP_URG_VALID)
                         mask |= POLLPRI;
         }
+        /* This barrier is coupled with smp_wmb() in tcp_reset() */
+        smp_rmb();
+        if (sk->sk_err)
+                mask |= POLLERR;
+
         return mask;
 }
 EXPORT_SYMBOL(tcp_poll);
@@ -940,7 +943,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         sg = sk->sk_route_caps & NETIF_F_SG;
 
         while (--iovlen >= 0) {
-                int seglen = iov->iov_len;
+                size_t seglen = iov->iov_len;
                 unsigned char __user *from = iov->iov_base;
 
                 iov++;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e663b78a2ef6..b55f60f6fcbe 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2545,7 +2545,8 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
                         cnt += tcp_skb_pcount(skb);
 
                 if (cnt > packets) {
-                        if (tcp_is_sack(tp) || (oldcnt >= packets))
+                        if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                            (oldcnt >= packets))
                                 break;
 
                         mss = skb_shinfo(skb)->gso_size;
@@ -4048,6 +4049,8 @@ static void tcp_reset(struct sock *sk)
         default:
                 sk->sk_err = ECONNRESET;
         }
+        /* This barrier is coupled with smp_rmb() in tcp_poll() */
+        smp_wmb();
 
         if (!sock_flag(sk, SOCK_DEAD))
                 sk->sk_error_report(sk);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index f8efada580e8..6211e2114173 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -214,6 +214,7 @@ static const struct file_operations tcpprobe_fops = {
         .owner   = THIS_MODULE,
         .open    = tcpprobe_open,
         .read    = tcpprobe_read,
+        .llseek  = noop_llseek,
 };
 
 static __init int tcpprobe_init(void)
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index c35b469e851c..74c54b30600f 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -135,13 +135,16 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
 
 /* This function calculates a "timeout" which is equivalent to the timeout of a
  * TCP connection after "boundary" unsuccessful, exponentially backed-off
- * retransmissions with an initial RTO of TCP_RTO_MIN.
+ * retransmissions with an initial RTO of TCP_RTO_MIN or TCP_TIMEOUT_INIT if
+ * syn_set flag is set.
  */
 static bool retransmits_timed_out(struct sock *sk,
-                                  unsigned int boundary)
+                                  unsigned int boundary,
+                                  bool syn_set)
 {
         unsigned int timeout, linear_backoff_thresh;
         unsigned int start_ts;
+        unsigned int rto_base = syn_set ? TCP_TIMEOUT_INIT : TCP_RTO_MIN;
 
         if (!inet_csk(sk)->icsk_retransmits)
                 return false;
@@ -151,12 +154,12 @@ static bool retransmits_timed_out(struct sock *sk,
         else
                 start_ts = tcp_sk(sk)->retrans_stamp;
 
-        linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
+        linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
 
         if (boundary <= linear_backoff_thresh)
-                timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
+                timeout = ((2 << boundary) - 1) * rto_base;
         else
-                timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+                timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
                           (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
 
         return (tcp_time_stamp - start_ts) >= timeout;
@@ -167,14 +170,15 @@ static int tcp_write_timeout(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         int retry_until;
-        bool do_reset;
+        bool do_reset, syn_set = 0;
 
         if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 if (icsk->icsk_retransmits)
                         dst_negative_advice(sk);
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
+                syn_set = 1;
         } else {
-                if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
+                if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0)) {
                         /* Black hole detection */
                         tcp_mtu_probing(icsk, sk);
 
@@ -187,14 +191,14 @@ static int tcp_write_timeout(struct sock *sk)
 
                         retry_until = tcp_orphan_retries(sk, alive);
                         do_reset = alive ||
-                                   !retransmits_timed_out(sk, retry_until);
+                                   !retransmits_timed_out(sk, retry_until, 0);
 
                         if (tcp_out_of_resources(sk, do_reset))
                                 return 1;
                 }
         }
 
-        if (retransmits_timed_out(sk, retry_until)) {
+        if (retransmits_timed_out(sk, retry_until, syn_set)) {
                 /* Has it gone just too far? */
                 tcp_write_err(sk);
                 return 1;
@@ -436,7 +440,7 @@ out_reset_timer:
                 icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
         }
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
+        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0))
                 __sk_dst_reset(sk);
 
 out:;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 32e0bef60d0a..fb23c2e63b52 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1260,6 +1260,49 @@ void udp_lib_unhash(struct sock *sk)
 }
 EXPORT_SYMBOL(udp_lib_unhash);
 
+/*
+ * inet_rcv_saddr was changed, we must rehash secondary hash
+ */
+void udp_lib_rehash(struct sock *sk, u16 newhash)
+{
+        if (sk_hashed(sk)) {
+                struct udp_table *udptable = sk->sk_prot->h.udp_table;
+                struct udp_hslot *hslot, *hslot2, *nhslot2;
+
+                hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
+                nhslot2 = udp_hashslot2(udptable, newhash);
+                udp_sk(sk)->udp_portaddr_hash = newhash;
+                if (hslot2 != nhslot2) {
+                        hslot = udp_hashslot(udptable, sock_net(sk),
+                                             udp_sk(sk)->udp_port_hash);
+                        /* we must lock primary chain too */
+                        spin_lock_bh(&hslot->lock);
+
+                        spin_lock(&hslot2->lock);
+                        hlist_nulls_del_init_rcu(&udp_sk(sk)->udp_portaddr_node);
+                        hslot2->count--;
+                        spin_unlock(&hslot2->lock);
+
+                        spin_lock(&nhslot2->lock);
+                        hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
+                                                 &nhslot2->head);
+                        nhslot2->count++;
+                        spin_unlock(&nhslot2->lock);
+
+                        spin_unlock_bh(&hslot->lock);
+                }
+        }
+}
+EXPORT_SYMBOL(udp_lib_rehash);
+
+static void udp_v4_rehash(struct sock *sk)
+{
+        u16 new_hash = udp4_portaddr_hash(sock_net(sk),
+                                          inet_sk(sk)->inet_rcv_saddr,
+                                          inet_sk(sk)->inet_num);
+        udp_lib_rehash(sk, new_hash);
+}
+
 static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
@@ -1843,6 +1886,7 @@ struct proto udp_prot = {
         .backlog_rcv       = __udp_queue_rcv_skb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
+        .rehash            = udp_v4_rehash,
         .get_port          = udp_v4_get_port,
         .memory_allocated  = &udp_memory_allocated,
         .sysctl_mem        = sysctl_udp_mem,
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 869078d4eeb9..a580349f0b8a 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -61,7 +61,7 @@ static int xfrm4_get_saddr(struct net *net,
 
 static int xfrm4_get_tos(struct flowi *fl)
 {
-        return fl->fl4_tos;
+        return IPTOS_RT_MASK & fl->fl4_tos; /* Strip ECN bits */
 }
 
 static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 1ef1366a0a03..47947624eccc 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -21,21 +21,25 @@ static int xfrm4_init_flags(struct xfrm_state *x)
 }
 
 static void
-__xfrm4_init_tempsel(struct xfrm_state *x, struct flowi *fl,
-                     struct xfrm_tmpl *tmpl,
-                     xfrm_address_t *daddr, xfrm_address_t *saddr)
+__xfrm4_init_tempsel(struct xfrm_selector *sel, struct flowi *fl)
+{
+        sel->daddr.a4 = fl->fl4_dst;
+        sel->saddr.a4 = fl->fl4_src;
+        sel->dport = xfrm_flowi_dport(fl);
+        sel->dport_mask = htons(0xffff);
+        sel->sport = xfrm_flowi_sport(fl);
+        sel->sport_mask = htons(0xffff);
+        sel->family = AF_INET;
+        sel->prefixlen_d = 32;
+        sel->prefixlen_s = 32;
+        sel->proto = fl->proto;
+        sel->ifindex = fl->oif;
+}
+
+static void
+xfrm4_init_temprop(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
+                   xfrm_address_t *daddr, xfrm_address_t *saddr)
 {
-        x->sel.daddr.a4 = fl->fl4_dst;
-        x->sel.saddr.a4 = fl->fl4_src;
-        x->sel.dport = xfrm_flowi_dport(fl);
-        x->sel.dport_mask = htons(0xffff);
-        x->sel.sport = xfrm_flowi_sport(fl);
-        x->sel.sport_mask = htons(0xffff);
-        x->sel.family = AF_INET;
-        x->sel.prefixlen_d = 32;
-        x->sel.prefixlen_s = 32;
-        x->sel.proto = fl->proto;
-        x->sel.ifindex = fl->oif;
         x->id = tmpl->id;
         if (x->id.daddr.a4 == 0)
                 x->id.daddr.a4 = daddr->a4;
@@ -70,6 +74,7 @@ static struct xfrm_state_afinfo xfrm4_state_afinfo = {
         .owner                  = THIS_MODULE,
         .init_flags             = xfrm4_init_flags,
         .init_tempsel           = __xfrm4_init_tempsel,
+        .init_temprop           = xfrm4_init_temprop,
         .output                 = xfrm4_output,
         .extract_input          = xfrm4_extract_input,
         .extract_output         = xfrm4_extract_output,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index ab70a3fbcafa..324fac3b6c16 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4637,10 +4637,12 @@ int __init addrconf_init(void)
         if (err < 0) {
                 printk(KERN_CRIT "IPv6 Addrconf:"
                        " cannot initialize default policy table: %d.\n", err);
-                return err;
+                goto out;
         }
 
-        register_pernet_subsys(&addrconf_ops);
+        err = register_pernet_subsys(&addrconf_ops);
+        if (err < 0)
+                goto out_addrlabel;
 
         /* The addrconf netdev notifier requires that loopback_dev
          * has it's ipv6 private information allocated and setup
@@ -4692,7 +4694,9 @@ errout:
         unregister_netdevice_notifier(&ipv6_dev_notf);
 errlo:
         unregister_pernet_subsys(&addrconf_ops);
-
+out_addrlabel:
+        ipv6_addr_label_cleanup();
+out:
         return err;
 }
 
@@ -4703,6 +4707,7 @@ void addrconf_cleanup(void)
 
         unregister_netdevice_notifier(&ipv6_dev_notf);
         unregister_pernet_subsys(&addrconf_ops);
+        ipv6_addr_label_cleanup();
 
         rtnl_lock();
 
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index f0e774cea386..8175f802651b 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -393,6 +393,11 @@ int __init ipv6_addr_label_init(void)
         return register_pernet_subsys(&ipv6_addr_label_ops);
 }
 
+void ipv6_addr_label_cleanup(void)
+{
+        unregister_pernet_subsys(&ipv6_addr_label_ops);
+}
+
 static const struct nla_policy ifal_policy[IFAL_MAX+1] = {
         [IFAL_ADDRESS]          = { .len = sizeof(struct in6_addr), },
         [IFAL_LABEL]            = { .len = sizeof(u32), },
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 7d929a22cbc2..ef371aa01ac5 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -105,9 +105,12 @@ ipv4_connected:
                 if (ipv6_addr_any(&np->saddr))
                         ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
 
-                if (ipv6_addr_any(&np->rcv_saddr))
+                if (ipv6_addr_any(&np->rcv_saddr)) {
                         ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
                                                &np->rcv_saddr);
+                        if (sk->sk_prot->rehash)
+                                sk->sk_prot->rehash(sk);
+                }
 
                 goto out;
         }
@@ -181,6 +184,8 @@ ipv4_connected:
         if (ipv6_addr_any(&np->rcv_saddr)) {
                 ipv6_addr_copy(&np->rcv_saddr, &fl.fl6_src);
                 inet->inet_rcv_saddr = LOOPBACK4_IPV6;
+                if (sk->sk_prot->rehash)
+                        sk->sk_prot->rehash(sk);
         }
 
         ip6_dst_store(sk, dst,
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index d40b330c0ee6..980912ed7a38 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -639,7 +639,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
         if (skb_has_frags(skb)) {
                 int first_len = skb_pagelen(skb);
-                int truesizes = 0;
+                struct sk_buff *frag2;
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
@@ -651,18 +651,18 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         if (frag->len > mtu ||
                             ((frag->len & 7) && frag->next) ||
                             skb_headroom(frag) < hlen)
-                            goto slow_path;
+                                goto slow_path_clean;
 
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
-                                goto slow_path;
+                                goto slow_path_clean;
 
                         BUG_ON(frag->sk);
                         if (skb->sk) {
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
-                                truesizes += frag->truesize;
                         }
+                        skb->truesize -= frag->truesize;
                 }
 
                 err = 0;
@@ -693,7 +693,6 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
                 first_len = skb_pagelen(skb);
                 skb->data_len = first_len - skb_headlen(skb);
-                skb->truesize -= truesizes;
                 skb->len = first_len;
                 ipv6_hdr(skb)->payload_len = htons(first_len -
                                                    sizeof(struct ipv6hdr));
@@ -756,6 +755,15 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                               IPSTATS_MIB_FRAGFAILS);
                 dst_release(&rt->dst);
                 return err;
+
+slow_path_clean:
+                skb_walk_frags(skb, frag2) {
+                        if (frag2 == frag)
+                                break;
+                        frag2->sk = NULL;
+                        frag2->destructor = NULL;
+                        skb->truesize += frag2->truesize;
+                }
         }
 
 slow_path:
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 13ef5bc05cf5..578f3c1a16db 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -113,14 +113,6 @@ static void nf_skb_free(struct sk_buff *skb)
                 kfree_skb(NFCT_FRAG6_CB(skb)->orig);
 }
 
-/* Memory Tracking Functions. */
-static void frag_kfree_skb(struct sk_buff *skb)
-{
-        atomic_sub(skb->truesize, &nf_init_frags.mem);
-        nf_skb_free(skb);
-        kfree_skb(skb);
-}
-
 /* Destruction primitives. */
 
 static __inline__ void fq_put(struct nf_ct_frag6_queue *fq)
@@ -282,66 +274,22 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
         }
 
 found:
-        /* We found where to put this one.  Check for overlap with
-         * preceding fragment, and, if needed, align things so that
-         * any overlaps are eliminated.
-         */
-        if (prev) {
-                int i = (NFCT_FRAG6_CB(prev)->offset + prev->len) - offset;
-
-                if (i > 0) {
-                        offset += i;
-                        if (end <= offset) {
-                                pr_debug("overlap\n");
-                                goto err;
-                        }
-                        if (!pskb_pull(skb, i)) {
-                                pr_debug("Can't pull\n");
-                                goto err;
-                        }
-                        if (skb->ip_summed != CHECKSUM_UNNECESSARY)
-                                skb->ip_summed = CHECKSUM_NONE;
-                }
-        }
-
-        /* Look for overlap with succeeding segments.
-         * If we can merge fragments, do it.
+        /* RFC5722, Section 4:
+         *                                  When reassembling an IPv6 datagram, if
+         *   one or more its constituent fragments is determined to be an
+         *   overlapping fragment, the entire datagram (and any constituent
+         *   fragments, including those not yet received) MUST be silently
+         *   discarded.
          */
-        while (next && NFCT_FRAG6_CB(next)->offset < end) {
-                /* overlap is 'i' bytes */
-                int i = end - NFCT_FRAG6_CB(next)->offset;
-
-                if (i < next->len) {
-                        /* Eat head of the next overlapped fragment
-                         * and leave the loop. The next ones cannot overlap.
-                         */
-                        pr_debug("Eat head of the overlapped parts.: %d", i);
-                        if (!pskb_pull(next, i))
-                                goto err;
 
-                        /* next fragment */
-                        NFCT_FRAG6_CB(next)->offset += i;
-                        fq->q.meat -= i;
-                        if (next->ip_summed != CHECKSUM_UNNECESSARY)
-                                next->ip_summed = CHECKSUM_NONE;
-                        break;
-                } else {
-                        struct sk_buff *free_it = next;
-
-                        /* Old fragmnet is completely overridden with
-                         * new one drop it.
-                         */
-                        next = next->next;
+        /* Check for overlap with preceding fragment. */
+        if (prev &&
+            (NFCT_FRAG6_CB(prev)->offset + prev->len) - offset > 0)
+                goto discard_fq;
 
-                        if (prev)
-                                prev->next = next;
-                        else
-                                fq->q.fragments = next;
-
-                        fq->q.meat -= free_it->len;
-                        frag_kfree_skb(free_it);
-                }
-        }
+        /* Look for overlap with succeeding segment. */
+        if (next && NFCT_FRAG6_CB(next)->offset < end)
+                goto discard_fq;
 
         NFCT_FRAG6_CB(skb)->offset = offset;
 
@@ -371,6 +319,8 @@ found:
         write_unlock(&nf_frags.lock);
         return 0;
 
+discard_fq:
+        fq_kill(fq);
 err:
         return -1;
 }
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 545c4141b755..64cfef1b0a4c 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -149,13 +149,6 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
 }
 EXPORT_SYMBOL(ip6_frag_match);
 
-/* Memory Tracking Functions. */
-static void frag_kfree_skb(struct netns_frags *nf, struct sk_buff *skb)
-{
-        atomic_sub(skb->truesize, &nf->mem);
-        kfree_skb(skb);
-}
-
 void ip6_frag_init(struct inet_frag_queue *q, void *a)
 {
         struct frag_queue *fq = container_of(q, struct frag_queue, q);
@@ -346,58 +339,22 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
         }
 
 found:
-        /* We found where to put this one.  Check for overlap with
-         * preceding fragment, and, if needed, align things so that
-         * any overlaps are eliminated.
+        /* RFC5722, Section 4:
+         *                                  When reassembling an IPv6 datagram, if
+         *   one or more its constituent fragments is determined to be an
+         *   overlapping fragment, the entire datagram (and any constituent
+         *   fragments, including those not yet received) MUST be silently
+         *   discarded.
          */
-        if (prev) {
-                int i = (FRAG6_CB(prev)->offset + prev->len) - offset;
 
-                if (i > 0) {
-                        offset += i;
-                        if (end <= offset)
-                                goto err;
-                        if (!pskb_pull(skb, i))
-                                goto err;
-                        if (skb->ip_summed != CHECKSUM_UNNECESSARY)
-                                skb->ip_summed = CHECKSUM_NONE;
-                }
-        }
+        /* Check for overlap with preceding fragment. */
+        if (prev &&
+            (FRAG6_CB(prev)->offset + prev->len) - offset > 0)
+                goto discard_fq;
 
-        /* Look for overlap with succeeding segments.
-         * If we can merge fragments, do it.
-         */
-        while (next && FRAG6_CB(next)->offset < end) {
-                int i = end - FRAG6_CB(next)->offset; /* overlap is 'i' bytes */
-
-                if (i < next->len) {
-                        /* Eat head of the next overlapped fragment
-                         * and leave the loop. The next ones cannot overlap.
-                         */
-                        if (!pskb_pull(next, i))
-                                goto err;
-                        FRAG6_CB(next)->offset += i;    /* next fragment */
-                        fq->q.meat -= i;
-                        if (next->ip_summed != CHECKSUM_UNNECESSARY)
-                                next->ip_summed = CHECKSUM_NONE;
-                        break;
-                } else {
-                        struct sk_buff *free_it = next;
-
-                        /* Old fragment is completely overridden with
-                         * new one drop it.
-                         */
-                        next = next->next;
-
-                        if (prev)
-                                prev->next = next;
-                        else
-                                fq->q.fragments = next;
-
-                        fq->q.meat -= free_it->len;
-                        frag_kfree_skb(fq->q.net, free_it);
-                }
-        }
+        /* Look for overlap with succeeding segment. */
+        if (next && FRAG6_CB(next)->offset < end)
+                goto discard_fq;
 
         FRAG6_CB(skb)->offset = offset;
 
@@ -436,6 +393,8 @@ found:
         write_unlock(&ip6_frags.lock);
         return -1;
 
+discard_fq:
+        fq_kill(fq);
 err:
         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
                       IPSTATS_MIB_REASMFAILS);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d126365ac046..a275c6e1e25c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -670,7 +670,7 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, struct in6_addr *dad
 
                         if (net_ratelimit())
                                 printk(KERN_WARNING
-                                       "Neighbour table overflow.\n");
+                                       "ipv6: Neighbour table overflow.\n");
                         dst_free(&rt->dst);
                         return NULL;
                 }
@@ -1556,14 +1556,13 @@ out:
  *      i.e. Path MTU discovery
  */
 
-void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
-                        struct net_device *dev, u32 pmtu)
+static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
+                             struct net *net, u32 pmtu, int ifindex)
 {
         struct rt6_info *rt, *nrt;
-        struct net *net = dev_net(dev);
         int allfrag = 0;
 
-        rt = rt6_lookup(net, daddr, saddr, dev->ifindex, 0);
+        rt = rt6_lookup(net, daddr, saddr, ifindex, 0);
         if (rt == NULL)
                 return;
 
@@ -1631,6 +1630,27 @@ out:
         dst_release(&rt->dst);
 }
 
+void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
+                        struct net_device *dev, u32 pmtu)
+{
+        struct net *net = dev_net(dev);
+
+        /*
+         * RFC 1981 states that a node "MUST reduce the size of the packets it
+         * is sending along the path" that caused the Packet Too Big message.
+         * Since it's not possible in the general case to determine which
+         * interface was used to send the original packet, we update the MTU
+         * on the interface that will be used to send future packets. We also
+         * update the MTU on the interface that received the Packet Too Big in
+         * case the original packet was forced out that interface with
+         * SO_BINDTODEVICE or similar. This is the next best thing to the
+         * correct behaviour, which would be to update the MTU on all
+         * interfaces.
+         */
+        rt6_do_pmtu_disc(daddr, saddr, net, pmtu, 0);
+        rt6_do_pmtu_disc(daddr, saddr, net, pmtu, dev->ifindex);
+}
+
 /*
  *      Misc support functions
  */
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1dd1affdead2..5acb3560ff15 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -111,6 +111,15 @@ int udp_v6_get_port(struct sock *sk, unsigned short snum)
         return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal, hash2_nulladdr);
 }
 
+static void udp_v6_rehash(struct sock *sk)
+{
+        u16 new_hash = udp6_portaddr_hash(sock_net(sk),
+                                          &inet6_sk(sk)->rcv_saddr,
+                                          inet_sk(sk)->inet_num);
+
+        udp_lib_rehash(sk, new_hash);
+}
+
 static inline int compute_score(struct sock *sk, struct net *net,
                                 unsigned short hnum,
                                 struct in6_addr *saddr, __be16 sport,
@@ -1447,6 +1456,7 @@ struct proto udpv6_prot = {
         .backlog_rcv       = udpv6_queue_rcv_skb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
+        .rehash            = udp_v6_rehash,
         .get_port          = udp_v6_get_port,
         .memory_allocated  = &udp_memory_allocated,
         .sysctl_mem        = sysctl_udp_mem,
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index f417b77fa0e1..a67575d472a3 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -20,23 +20,27 @@
 #include <net/addrconf.h>
 
 static void
-__xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
-                     struct xfrm_tmpl *tmpl,
-                     xfrm_address_t *daddr, xfrm_address_t *saddr)
+__xfrm6_init_tempsel(struct xfrm_selector *sel, struct flowi *fl)
 {
         /* Initialize temporary selector matching only
          * to current session. */
-        ipv6_addr_copy((struct in6_addr *)&x->sel.daddr, &fl->fl6_dst);
-        ipv6_addr_copy((struct in6_addr *)&x->sel.saddr, &fl->fl6_src);
-        x->sel.dport = xfrm_flowi_dport(fl);
-        x->sel.dport_mask = htons(0xffff);
-        x->sel.sport = xfrm_flowi_sport(fl);
-        x->sel.sport_mask = htons(0xffff);
-        x->sel.family = AF_INET6;
-        x->sel.prefixlen_d = 128;
-        x->sel.prefixlen_s = 128;
-        x->sel.proto = fl->proto;
-        x->sel.ifindex = fl->oif;
+        ipv6_addr_copy((struct in6_addr *)&sel->daddr, &fl->fl6_dst);
+        ipv6_addr_copy((struct in6_addr *)&sel->saddr, &fl->fl6_src);
+        sel->dport = xfrm_flowi_dport(fl);
+        sel->dport_mask = htons(0xffff);
+        sel->sport = xfrm_flowi_sport(fl);
+        sel->sport_mask = htons(0xffff);
+        sel->family = AF_INET6;
+        sel->prefixlen_d = 128;
+        sel->prefixlen_s = 128;
+        sel->proto = fl->proto;
+        sel->ifindex = fl->oif;
+}
+
+static void
+xfrm6_init_temprop(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
+                   xfrm_address_t *daddr, xfrm_address_t *saddr)
+{
         x->id = tmpl->id;
         if (ipv6_addr_any((struct in6_addr*)&x->id.daddr))
                 memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
@@ -168,6 +172,7 @@ static struct xfrm_state_afinfo xfrm6_state_afinfo = {
         .eth_proto              = htons(ETH_P_IPV6),
         .owner                  = THIS_MODULE,
         .init_tempsel           = __xfrm6_init_tempsel,
+        .init_temprop           = xfrm6_init_temprop,
         .tmpl_sort              = __xfrm6_tmpl_sort,
         .state_sort             = __xfrm6_state_sort,
         .output                 = xfrm6_output,
diff --git a/net/ipx/Kconfig b/net/ipx/Kconfig
index e9ad0062fbb6..02549cb2c328 100644
--- a/net/ipx/Kconfig
+++ b/net/ipx/Kconfig
@@ -3,6 +3,7 @@
 #
 config IPX
         tristate "The IPX protocol"
+        depends on BKL # should be fixable
         select LLC
         ---help---
           This is support for the Novell networking protocol, IPX, commonly
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 79986a674f6e..fd55b5135de5 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -824,8 +824,8 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         err = irda_open_tsap(self, addr->sir_lsap_sel, addr->sir_name);
         if (err < 0) {
-                kfree(self->ias_obj->name);
-                kfree(self->ias_obj);
+                irias_delete_object(self->ias_obj);
+                self->ias_obj = NULL;
                 goto out;
         }
 
diff --git a/net/irda/irlan/irlan_common.c b/net/irda/irlan/irlan_common.c
index a788f9e9427d..6130f9d9dbe1 100644
--- a/net/irda/irlan/irlan_common.c
+++ b/net/irda/irlan/irlan_common.c
@@ -1102,7 +1102,7 @@ int irlan_extract_param(__u8 *buf, char *name, char *value, __u16 *len)
         memcpy(&val_len, buf+n, 2); /* To avoid alignment problems */
         le16_to_cpus(&val_len); n+=2;
 
-        if (val_len > 1016) {
+        if (val_len >= 1016) {
                 IRDA_DEBUG(2, "%s(), parameter length to long\n", __func__ );
                 return -RSP_INVALID_COMMAND_FORMAT;
         }
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 023ba820236f..582612998211 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -1024,7 +1024,8 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
 {
         struct sock *sk = sock->sk;
         struct llc_sock *llc = llc_sk(sk);
-        int rc = -EINVAL, opt;
+        unsigned int opt;
+        int rc = -EINVAL;
 
         lock_sock(sk);
         if (unlikely(level != SOL_LLC || optlen != sizeof(int)))
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index e4dae0244d76..cf4aea3ba30f 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -689,7 +689,7 @@ static void llc_station_rcv(struct sk_buff *skb)
 
 int __init llc_station_init(void)
 {
-        u16 rc = -ENOBUFS;
+        int rc = -ENOBUFS;
         struct sk_buff *skb;
         struct llc_station_state_ev *ev;
 
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index c893f236acea..8f23401832b7 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -175,6 +175,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
 
+        del_timer_sync(&tid_tx->addba_resp_timer);
+
         /*
          * After this packets are no longer handed right through
          * to the driver but are put onto tid_tx->pending instead,
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index a694c593ff6a..b8b0ae79a743 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -36,6 +36,7 @@ static ssize_t name## _read(struct file *file, char __user *userbuf,	\
 static const struct file_operations name## _ops = {                     \
         .read = name## _read,                                           \
         .open = mac80211_open_file_generic,                             \
+        .llseek = generic_file_llseek,                                  \
 };
 
 #define DEBUGFS_ADD(name)                                               \
@@ -101,7 +102,8 @@ static ssize_t tsf_write(struct file *file,
 static const struct file_operations tsf_ops = {
         .read = tsf_read,
         .write = tsf_write,
-        .open = mac80211_open_file_generic
+        .open = mac80211_open_file_generic,
+        .llseek = default_llseek,
 };
 
 static ssize_t reset_write(struct file *file, const char __user *user_buf,
@@ -120,6 +122,7 @@ static ssize_t reset_write(struct file *file, const char __user *user_buf,
 static const struct file_operations reset_ops = {
         .write = reset_write,
         .open = mac80211_open_file_generic,
+        .llseek = noop_llseek,
 };
 
 static ssize_t noack_read(struct file *file, char __user *user_buf,
@@ -155,7 +158,8 @@ static ssize_t noack_write(struct file *file,
 static const struct file_operations noack_ops = {
         .read = noack_read,
         .write = noack_write,
-        .open = mac80211_open_file_generic
+        .open = mac80211_open_file_generic,
+        .llseek = default_llseek,
 };
 
 static ssize_t uapsd_queues_read(struct file *file, char __user *user_buf,
@@ -201,7 +205,8 @@ static ssize_t uapsd_queues_write(struct file *file,
 static const struct file_operations uapsd_queues_ops = {
         .read = uapsd_queues_read,
         .write = uapsd_queues_write,
-        .open = mac80211_open_file_generic
+        .open = mac80211_open_file_generic,
+        .llseek = default_llseek,
 };
 
 static ssize_t uapsd_max_sp_len_read(struct file *file, char __user *user_buf,
@@ -247,7 +252,8 @@ static ssize_t uapsd_max_sp_len_write(struct file *file,
 static const struct file_operations uapsd_max_sp_len_ops = {
         .read = uapsd_max_sp_len_read,
         .write = uapsd_max_sp_len_write,
-        .open = mac80211_open_file_generic
+        .open = mac80211_open_file_generic,
+        .llseek = default_llseek,
 };
 
 static ssize_t channel_type_read(struct file *file, char __user *user_buf,
@@ -279,7 +285,8 @@ static ssize_t channel_type_read(struct file *file, char __user *user_buf,
 
 static const struct file_operations channel_type_ops = {
         .read = channel_type_read,
-        .open = mac80211_open_file_generic
+        .open = mac80211_open_file_generic,
+        .llseek = default_llseek,
 };
 
 static ssize_t queues_read(struct file *file, char __user *user_buf,
@@ -302,7 +309,8 @@ static ssize_t queues_read(struct file *file, char __user *user_buf,
 
 static const struct file_operations queues_ops = {
         .read = queues_read,
-        .open = mac80211_open_file_generic
+        .open = mac80211_open_file_generic,
+        .llseek = default_llseek,
 };
 
 /* statistics stuff */
@@ -346,6 +354,7 @@ static ssize_t stats_ ##name## _read(struct file *file,			\
 static const struct file_operations stats_ ##name## _ops = {            \
         .read = stats_ ##name## _read,                                  \
         .open = mac80211_open_file_generic,                             \
+        .llseek = generic_file_llseek,                                  \
 };
 
 #define DEBUGFS_STATS_ADD(name, field)                                  \
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index fa5e76e658ef..7cd8dd9fc240 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -32,6 +32,7 @@ static ssize_t key_##name##_read(struct file *file,			\
 static const struct file_operations key_ ##name## _ops = {              \
         .read = key_##name##_read,                                      \
         .open = mac80211_open_file_generic,                             \
+        .llseek = generic_file_llseek,                                  \
 }
 
 #define KEY_FILE(name, format)                                          \
@@ -46,6 +47,7 @@ static const struct file_operations key_ ##name## _ops = {		\
 static const struct file_operations key_ ##name## _ops = {              \
         .read = key_conf_##name##_read,                                 \
         .open = mac80211_open_file_generic,                             \
+        .llseek = generic_file_llseek,                                  \
 }
 
 #define KEY_CONF_FILE(name, format)                                     \
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 20b2998fa0ed..8ad33eef7dda 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -121,6 +121,7 @@ static const struct file_operations name##_ops = {			\
         .read = ieee80211_if_read_##name,                               \
         .write = (_write),                                              \
         .open = mac80211_open_file_generic,                             \
+        .llseek = generic_file_llseek,                                  \
 }
 
 #define __IEEE80211_IF_FILE_W(name)                                     \
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 76839d4dfaac..6a8fdc372c43 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -36,6 +36,7 @@ static ssize_t sta_ ##name## _read(struct file *file,			\
 static const struct file_operations sta_ ##name## _ops = {              \
         .read = sta_##name##_read,                                      \
         .open = mac80211_open_file_generic,                             \
+        .llseek = generic_file_llseek,                                  \
 }
 
 #define STA_OPS_RW(name)                                                \
@@ -43,6 +44,7 @@ static const struct file_operations sta_ ##name## _ops = {		\
         .read = sta_##name##_read,                                      \
         .write = sta_##name##_write,                                    \
         .open = mac80211_open_file_generic,                             \
+        .llseek = generic_file_llseek,                                  \
 }
 
 #define STA_FILE(name, field, format)                                   \
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 798a91b100cc..ded5c3843e06 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -732,6 +732,12 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
 
         rtnl_unlock();
 
+        /*
+         * Now all work items will be gone, but the
+         * timer might still be armed, so delete it
+         */
+        del_timer_sync(&local->work_timer);
+
         cancel_work_sync(&local->reconfig_filter);
 
         ieee80211_clear_tx_pending(local);
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index be04d46110fe..334cbd3d2aae 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -145,6 +145,7 @@ static ssize_t rcname_read(struct file *file, char __user *userbuf,
 static const struct file_operations rcname_ops = {
         .read = rcname_read,
         .open = mac80211_open_file_generic,
+        .llseek = default_llseek,
 };
 #endif
 
diff --git a/net/mac80211/rc80211_minstrel_debugfs.c b/net/mac80211/rc80211_minstrel_debugfs.c
index 241e76f3fdf2..a290ad231d77 100644
--- a/net/mac80211/rc80211_minstrel_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_debugfs.c
@@ -122,6 +122,7 @@ static const struct file_operations minstrel_stat_fops = {
         .open = minstrel_stats_open,
         .read = minstrel_stats_read,
         .release = minstrel_stats_release,
+        .llseek = default_llseek,
 };
 
 void
diff --git a/net/mac80211/rc80211_minstrel_ht_debugfs.c b/net/mac80211/rc80211_minstrel_ht_debugfs.c
index 4a5a4b3e7799..cefcb5d2dae6 100644
--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
@@ -90,7 +90,7 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 MINSTREL_TRUNC(mi->avg_ampdu_len * 10) % 10);
         ms->len = p - ms->buf;
 
-        return 0;
+        return nonseekable_open(inode, file);
 }
 
 static const struct file_operations minstrel_ht_stat_fops = {
@@ -98,6 +98,7 @@ static const struct file_operations minstrel_ht_stat_fops = {
         .open = minstrel_ht_stats_open,
         .read = minstrel_stats_read,
         .release = minstrel_stats_release,
+        .llseek = no_llseek,
 };
 
 void
diff --git a/net/mac80211/rc80211_pid_debugfs.c b/net/mac80211/rc80211_pid_debugfs.c
index 47438b4a9af5..7905f79cc2e4 100644
--- a/net/mac80211/rc80211_pid_debugfs.c
+++ b/net/mac80211/rc80211_pid_debugfs.c
@@ -206,6 +206,7 @@ static const struct file_operations rc_pid_fop_events = {
         .poll = rate_control_pid_events_poll,
         .open = rate_control_pid_events_open,
         .release = rate_control_pid_events_release,
+        .llseek = noop_llseek,
 };
 
 void rate_control_pid_add_sta_debugfs(void *priv, void *priv_sta,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fa0f37e4afe4..28624282c5f3 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2199,9 +2199,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         struct net_device *prev_dev = NULL;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
-        if (status->flag & RX_FLAG_INTERNAL_CMTR)
-                goto out_free_skb;
-
         if (skb_headroom(skb) < sizeof(*rthdr) &&
             pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
                 goto out_free_skb;
@@ -2260,7 +2257,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         } else
                 goto out_free_skb;
 
-        status->flag |= RX_FLAG_INTERNAL_CMTR;
         return;
 
  out_free_skb:
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 10caec5ea8fa..34da67995d94 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -377,7 +377,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                 skb2 = skb_clone(skb, GFP_ATOMIC);
                                 if (skb2) {
                                         skb2->dev = prev_dev;
-                                        netif_receive_skb(skb2);
+                                        netif_rx(skb2);
                                 }
                         }
 
@@ -386,7 +386,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
         if (prev_dev) {
                 skb->dev = prev_dev;
-                netif_receive_skb(skb);
+                netif_rx(skb);
                 skb = NULL;
         }
         rcu_read_unlock();
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 78b505d33bfb..fdaec7daff1d 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -27,7 +27,7 @@
 
 static DEFINE_MUTEX(afinfo_mutex);
 
-const struct nf_afinfo *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;
+const struct nf_afinfo __rcu *nf_afinfo[NFPROTO_NUMPROTO] __read_mostly;
 EXPORT_SYMBOL(nf_afinfo);
 
 int nf_register_afinfo(const struct nf_afinfo *afinfo)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 4f8ddba48011..4c2f89df5cce 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -924,6 +924,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_protocol *pp,
 
         ip_vs_out_stats(cp, skb);
         ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pp);
+        ip_vs_update_conntrack(skb, cp, 0);
         ip_vs_conn_put(cp);
 
         skb->ipvs_property = 1;
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index f228a17ec649..7e9af5b76d9e 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -45,6 +45,7 @@
 #include <linux/netfilter.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_helper.h>
 #include <linux/gfp.h>
 #include <net/protocol.h>
@@ -359,7 +360,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                 buf_len = strlen(buf);
 
                 ct = nf_ct_get(skb, &ctinfo);
-                if (ct && !nf_ct_is_untracked(ct)) {
+                if (ct && !nf_ct_is_untracked(ct) && nfct_nat(ct)) {
                         /* If mangling fails this function will return 0
                          * which will cause the packet to be dropped.
                          * Mangling can only fail under memory pressure,
@@ -409,7 +410,6 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
         union nf_inet_addr to;
         __be16 port;
         struct ip_vs_conn *n_cp;
-        struct nf_conn *ct;
 
 #ifdef CONFIG_IP_VS_IPV6
         /* This application helper doesn't work with IPv6 yet,
@@ -496,11 +496,6 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
                 ip_vs_control_add(n_cp, cp);
         }
 
-        ct = (struct nf_conn *)skb->nfct;
-        if (ct && ct != &nf_conntrack_untracked)
-                ip_vs_expect_related(skb, ct, n_cp,
-                                     IPPROTO_TCP, &n_cp->dport, 1);
-
         /*
          *      Move tunnel to listen state
          */
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 21e1a5e9b9d3..49df6bea6a2d 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -349,8 +349,8 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 }
 #endif
 
-static void
-ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp)
+void
+ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, int outin)
 {
         struct nf_conn *ct = (struct nf_conn *)skb->nfct;
         struct nf_conntrack_tuple new_tuple;
@@ -365,11 +365,17 @@ ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp)
          * real-server we will see RIP->DIP.
          */
         new_tuple = ct->tuplehash[IP_CT_DIR_REPLY].tuple;
-        new_tuple.src.u3 = cp->daddr;
+        if (outin)
+                new_tuple.src.u3 = cp->daddr;
+        else
+                new_tuple.dst.u3 = cp->vaddr;
         /*
          * This will also take care of UDP and other protocols.
          */
-        new_tuple.src.u.tcp.port = cp->dport;
+        if (outin)
+                new_tuple.src.u.tcp.port = cp->dport;
+        else
+                new_tuple.dst.u.tcp.port = cp->vport;
         nf_conntrack_alter_reply(ct, &new_tuple);
 }
 
@@ -428,7 +434,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         IP_VS_DBG_PKT(10, pp, skb, 0, "After DNAT");
 
-        ip_vs_update_conntrack(skb, cp);
+        ip_vs_update_conntrack(skb, cp, 1);
 
         /* FIXME: when application helper enlarges the packet and the length
            is larger than the MTU of outgoing device, there will be still
@@ -506,7 +512,7 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         IP_VS_DBG_PKT(10, pp, skb, 0, "After DNAT");
 
-        ip_vs_update_conntrack(skb, cp);
+        ip_vs_update_conntrack(skb, cp, 1);
 
         /* FIXME: when application helper enlarges the packet and the length
            is larger than the MTU of outgoing device, there will be still
diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
index cdcc7649476b..5702de35e2bb 100644
--- a/net/netfilter/nf_conntrack_ecache.c
+++ b/net/netfilter/nf_conntrack_ecache.c
@@ -26,10 +26,10 @@
 
 static DEFINE_MUTEX(nf_ct_ecache_mutex);
 
-struct nf_ct_event_notifier *nf_conntrack_event_cb __read_mostly;
+struct nf_ct_event_notifier __rcu *nf_conntrack_event_cb __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_event_cb);
 
-struct nf_exp_event_notifier *nf_expect_event_cb __read_mostly;
+struct nf_exp_event_notifier __rcu *nf_expect_event_cb __read_mostly;
 EXPORT_SYMBOL_GPL(nf_expect_event_cb);
 
 /* deliver cached events and clear cache entry - must be called with locally
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 7dcf7a404190..bd82450c193f 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -16,7 +16,7 @@
 #include <linux/skbuff.h>
 #include <net/netfilter/nf_conntrack_extend.h>
 
-static struct nf_ct_ext_type *nf_ct_ext_types[NF_CT_EXT_NUM];
+static struct nf_ct_ext_type __rcu *nf_ct_ext_types[NF_CT_EXT_NUM];
 static DEFINE_MUTEX(nf_ct_ext_type_mutex);
 
 void __nf_ct_ext_destroy(struct nf_conn *ct)
@@ -48,15 +48,17 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id, gfp_t gfp)
 {
         unsigned int off, len;
         struct nf_ct_ext_type *t;
+        size_t alloc_size;
 
         rcu_read_lock();
         t = rcu_dereference(nf_ct_ext_types[id]);
         BUG_ON(t == NULL);
         off = ALIGN(sizeof(struct nf_ct_ext), t->align);
         len = off + t->len;
+        alloc_size = t->alloc_size;
         rcu_read_unlock();
 
-        *ext = kzalloc(t->alloc_size, gfp);
+        *ext = kzalloc(alloc_size, gfp);
         if (!*ext)
                 return NULL;
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 5bae1cd15eea..146476c6441a 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -22,6 +22,7 @@
 #include <linux/rculist_nulls.h>
 #include <linux/types.h>
 #include <linux/timer.h>
+#include <linux/security.h>
 #include <linux/skbuff.h>
 #include <linux/errno.h>
 #include <linux/netlink.h>
@@ -245,16 +246,31 @@ nla_put_failure:
 
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
 static inline int
-ctnetlink_dump_secmark(struct sk_buff *skb, const struct nf_conn *ct)
+ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct)
 {
-        NLA_PUT_BE32(skb, CTA_SECMARK, htonl(ct->secmark));
-        return 0;
+        struct nlattr *nest_secctx;
+        int len, ret;
+        char *secctx;
+
+        ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
+        if (ret)
+                return ret;
+
+        ret = -1;
+        nest_secctx = nla_nest_start(skb, CTA_SECCTX | NLA_F_NESTED);
+        if (!nest_secctx)
+                goto nla_put_failure;
+
+        NLA_PUT_STRING(skb, CTA_SECCTX_NAME, secctx);
+        nla_nest_end(skb, nest_secctx);
 
+        ret = 0;
 nla_put_failure:
-        return -1;
+        security_release_secctx(secctx, len);
+        return ret;
 }
 #else
-#define ctnetlink_dump_secmark(a, b) (0)
+#define ctnetlink_dump_secctx(a, b) (0)
 #endif
 
 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
@@ -391,7 +407,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
             ctnetlink_dump_protoinfo(skb, ct) < 0 ||
             ctnetlink_dump_helpinfo(skb, ct) < 0 ||
             ctnetlink_dump_mark(skb, ct) < 0 ||
-            ctnetlink_dump_secmark(skb, ct) < 0 ||
+            ctnetlink_dump_secctx(skb, ct) < 0 ||
             ctnetlink_dump_id(skb, ct) < 0 ||
             ctnetlink_dump_use(skb, ct) < 0 ||
             ctnetlink_dump_master(skb, ct) < 0 ||
@@ -437,6 +453,17 @@ ctnetlink_counters_size(const struct nf_conn *ct)
                ;
 }
 
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+static int ctnetlink_nlmsg_secctx_size(const struct nf_conn *ct)
+{
+        int len;
+
+        security_secid_to_secctx(ct->secmark, NULL, &len);
+
+        return sizeof(char) * len;
+}
+#endif
+
 static inline size_t
 ctnetlink_nlmsg_size(const struct nf_conn *ct)
 {
@@ -453,7 +480,8 @@ ctnetlink_nlmsg_size(const struct nf_conn *ct)
                + nla_total_size(0) /* CTA_HELP */
                + nla_total_size(NF_CT_HELPER_NAME_LEN) /* CTA_HELP_NAME */
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
-               + nla_total_size(sizeof(u_int32_t)) /* CTA_SECMARK */
+               + nla_total_size(0) /* CTA_SECCTX */
+               + nla_total_size(ctnetlink_nlmsg_secctx_size(ct)) /* CTA_SECCTX_NAME */
 #endif
 #ifdef CONFIG_NF_NAT_NEEDED
                + 2 * nla_total_size(0) /* CTA_NAT_SEQ_ADJ_ORIG|REPL */
@@ -556,7 +584,7 @@ ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
 
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
                 if ((events & (1 << IPCT_SECMARK) || ct->secmark)
-                    && ctnetlink_dump_secmark(skb, ct) < 0)
+                    && ctnetlink_dump_secctx(skb, ct) < 0)
                         goto nla_put_failure;
 #endif
 
diff --git a/net/netfilter/nf_conntrack_proto.c b/net/netfilter/nf_conntrack_proto.c
index 5886ba1d52a0..ed6d92958023 100644
--- a/net/netfilter/nf_conntrack_proto.c
+++ b/net/netfilter/nf_conntrack_proto.c
@@ -28,8 +28,8 @@
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
 
-static struct nf_conntrack_l4proto **nf_ct_protos[PF_MAX] __read_mostly;
-struct nf_conntrack_l3proto *nf_ct_l3protos[AF_MAX] __read_mostly;
+static struct nf_conntrack_l4proto __rcu **nf_ct_protos[PF_MAX] __read_mostly;
+struct nf_conntrack_l3proto __rcu *nf_ct_l3protos[AF_MAX] __read_mostly;
 EXPORT_SYMBOL_GPL(nf_ct_l3protos);
 
 static DEFINE_MUTEX(nf_ct_proto_mutex);
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 53d892210a04..f64de9544866 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1376,7 +1376,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
         unsigned int msglen, origlen;
         const char *dptr, *end;
         s16 diff, tdiff = 0;
-        int ret;
+        int ret = NF_ACCEPT;
         typeof(nf_nat_sip_seq_adjust_hook) nf_nat_sip_seq_adjust;
 
         if (ctinfo != IP_CT_ESTABLISHED &&
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index eb973fcd67ab..0fb65705b44b 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -15,6 +15,7 @@
 #include <linux/seq_file.h>
 #include <linux/percpu.h>
 #include <linux/netdevice.h>
+#include <linux/security.h>
 #include <net/net_namespace.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
@@ -108,6 +109,29 @@ static void ct_seq_stop(struct seq_file *s, void *v)
         rcu_read_unlock();
 }
 
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
+{
+        int ret;
+        u32 len;
+        char *secctx;
+
+        ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
+        if (ret)
+                return ret;
+
+        ret = seq_printf(s, "secctx=%s ", secctx);
+
+        security_release_secctx(secctx, len);
+        return ret;
+}
+#else
+static inline int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
+{
+        return 0;
+}
+#endif
+
 /* return 0 on success, 1 in case of error */
 static int ct_seq_show(struct seq_file *s, void *v)
 {
@@ -168,10 +192,8 @@ static int ct_seq_show(struct seq_file *s, void *v)
                 goto release;
 #endif
 
-#ifdef CONFIG_NF_CONNTRACK_SECMARK
-        if (seq_printf(s, "secmark=%u ", ct->secmark))
+        if (ct_show_secctx(s, ct))
                 goto release;
-#endif
 
 #ifdef CONFIG_NF_CONNTRACK_ZONES
         if (seq_printf(s, "zone=%u ", nf_ct_zone(ct)))
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 7df37fd786bc..b07393eab88e 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -16,7 +16,7 @@
 #define NF_LOG_PREFIXLEN                128
 #define NFLOGGER_NAME_LEN               64
 
-static const struct nf_logger *nf_loggers[NFPROTO_NUMPROTO] __read_mostly;
+static const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO] __read_mostly;
 static struct list_head nf_loggers_l[NFPROTO_NUMPROTO] __read_mostly;
 static DEFINE_MUTEX(nf_log_mutex);
 
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index 78b3cf9c519c..74aebed5bd28 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -18,7 +18,7 @@
  * long term mutex.  The handler must provide an an outfn() to accept packets
  * for queueing and must reinject all packets it receives, no matter what.
  */
-static const struct nf_queue_handler *queue_handler[NFPROTO_NUMPROTO] __read_mostly;
+static const struct nf_queue_handler __rcu *queue_handler[NFPROTO_NUMPROTO] __read_mostly;
 
 static DEFINE_MUTEX(queue_handler_mutex);
 
diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c
index 5490fc37c92d..daab8c4a903c 100644
--- a/net/netfilter/nf_tproxy_core.c
+++ b/net/netfilter/nf_tproxy_core.c
@@ -70,7 +70,11 @@ nf_tproxy_destructor(struct sk_buff *skb)
 int
 nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
 {
-        if (inet_sk(sk)->transparent) {
+        bool transparent = (sk->sk_state == TCP_TIME_WAIT) ?
+                                inet_twsk(sk)->tw_transparent :
+                                inet_sk(sk)->transparent;
+
+        if (transparent) {
                 skb_orphan(skb);
                 skb->sk = sk;
                 skb->destructor = nf_tproxy_destructor;
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 0cb6053f02fd..782e51986a6f 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -9,7 +9,6 @@
 #include <linux/module.h>
 #include <linux/gfp.h>
 #include <linux/skbuff.h>
-#include <linux/selinux.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter/x_tables.h>
diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index 23b2d6c486b5..9faf5e050b79 100644
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -14,8 +14,8 @@
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
+#include <linux/security.h>
 #include <linux/skbuff.h>
-#include <linux/selinux.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_SECMARK.h>
 
@@ -39,9 +39,8 @@ secmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
 
         switch (mode) {
         case SECMARK_MODE_SEL:
-                secmark = info->u.sel.selsid;
+                secmark = info->secid;
                 break;
-
         default:
                 BUG();
         }
@@ -50,33 +49,33 @@ secmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
         return XT_CONTINUE;
 }
 
-static int checkentry_selinux(struct xt_secmark_target_info *info)
+static int checkentry_lsm(struct xt_secmark_target_info *info)
 {
         int err;
-        struct xt_secmark_target_selinux_info *sel = &info->u.sel;
 
-        sel->selctx[SECMARK_SELCTX_MAX - 1] = '\0';
+        info->secctx[SECMARK_SECCTX_MAX - 1] = '\0';
+        info->secid = 0;
 
-        err = selinux_string_to_sid(sel->selctx, &sel->selsid);
+        err = security_secctx_to_secid(info->secctx, strlen(info->secctx),
+                                       &info->secid);
         if (err) {
                 if (err == -EINVAL)
-                        pr_info("invalid SELinux context \'%s\'\n",
-                                sel->selctx);
+                        pr_info("invalid security context \'%s\'\n", info->secctx);
                 return err;
         }
 
-        if (!sel->selsid) {
-                pr_info("unable to map SELinux context \'%s\'\n", sel->selctx);
+        if (!info->secid) {
+                pr_info("unable to map security context \'%s\'\n", info->secctx);
                 return -ENOENT;
         }
 
-        err = selinux_secmark_relabel_packet_permission(sel->selsid);
+        err = security_secmark_relabel_packet(info->secid);
         if (err) {
                 pr_info("unable to obtain relabeling permission\n");
                 return err;
         }
 
-        selinux_secmark_refcount_inc();
+        security_secmark_refcount_inc();
         return 0;
 }
 
@@ -100,16 +99,16 @@ static int secmark_tg_check(const struct xt_tgchk_param *par)
 
         switch (info->mode) {
         case SECMARK_MODE_SEL:
-                err = checkentry_selinux(info);
-                if (err <= 0)
-                        return err;
                 break;
-
         default:
                 pr_info("invalid mode: %hu\n", info->mode);
                 return -EINVAL;
         }
 
+        err = checkentry_lsm(info);
+        if (err)
+                return err;
+
         if (!mode)
                 mode = info->mode;
         return 0;
@@ -119,7 +118,7 @@ static void secmark_tg_destroy(const struct xt_tgdtor_param *par)
 {
         switch (mode) {
         case SECMARK_MODE_SEL:
-                selinux_secmark_refcount_dec();
+                security_secmark_refcount_dec();
         }
 }
 
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 76aec6a44762..d2ff15a2412b 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -567,6 +567,7 @@ static const struct file_operations recent_mt_fops = {
         .write   = recent_mt_proc_write,
         .release = seq_release_private,
         .owner   = THIS_MODULE,
+        .llseek = seq_lseek,
 };
 
 static int __net_init recent_proc_net_init(struct net *net)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 980fe4ad0016..cd96ed3ccee4 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2102,6 +2102,26 @@ static void __net_exit netlink_net_exit(struct net *net)
 #endif
 }
 
+static void __init netlink_add_usersock_entry(void)
+{
+        unsigned long *listeners;
+        int groups = 32;
+
+        listeners = kzalloc(NLGRPSZ(groups) + sizeof(struct listeners_rcu_head),
+                            GFP_KERNEL);
+        if (!listeners)
+                panic("netlink_add_usersock_entry: Cannot allocate listneres\n");
+
+        netlink_table_grab();
+
+        nl_table[NETLINK_USERSOCK].groups = groups;
+        nl_table[NETLINK_USERSOCK].listeners = listeners;
+        nl_table[NETLINK_USERSOCK].module = THIS_MODULE;
+        nl_table[NETLINK_USERSOCK].registered = 1;
+
+        netlink_table_ungrab();
+}
+
 static struct pernet_operations __net_initdata netlink_net_ops = {
         .init = netlink_net_init,
         .exit = netlink_net_exit,
@@ -2150,6 +2170,8 @@ static int __init netlink_proto_init(void)
                 hash->rehash_time = jiffies;
         }
 
+        netlink_add_usersock_entry();
+
         sock_register(&netlink_family_ops);
         register_pernet_subsys(&netlink_net_ops);
         /* The netlink device handler may be needed early. */
diff --git a/net/nonet.c b/net/nonet.c
index 92e76640c7cd..b1a73fda9c12 100644
--- a/net/nonet.c
+++ b/net/nonet.c
@@ -22,4 +22,5 @@ static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
 const struct file_operations bad_sock_fops = {
         .owner = THIS_MODULE,
         .open = sock_no_open,
+        .llseek = noop_llseek,
 };
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index b2a3ae6cad78..15003021f4f0 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -225,12 +225,13 @@ static void pipe_grant_credits(struct sock *sk)
 static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
 {
         struct pep_sock *pn = pep_sk(sk);
-        struct pnpipehdr *hdr = pnp_hdr(skb);
+        struct pnpipehdr *hdr;
         int wake = 0;
 
         if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
                 return -EINVAL;
 
+        hdr = pnp_hdr(skb);
         if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
                 LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
                                 (unsigned)hdr->data[0]);
diff --git a/net/rds/page.c b/net/rds/page.c
index 595a952d4b17..1dfbfea12e9b 100644
--- a/net/rds/page.c
+++ b/net/rds/page.c
@@ -57,30 +57,17 @@ int rds_page_copy_user(struct page *page, unsigned long offset,
         unsigned long ret;
         void *addr;
 
-        if (to_user)
+        addr = kmap(page);
+        if (to_user) {
                 rds_stats_add(s_copy_to_user, bytes);
-        else
+                ret = copy_to_user(ptr, addr + offset, bytes);
+        } else {
                 rds_stats_add(s_copy_from_user, bytes);
-
-        addr = kmap_atomic(page, KM_USER0);
-        if (to_user)
-                ret = __copy_to_user_inatomic(ptr, addr + offset, bytes);
-        else
-                ret = __copy_from_user_inatomic(addr + offset, ptr, bytes);
-        kunmap_atomic(addr, KM_USER0);
-
-        if (ret) {
-                addr = kmap(page);
-                if (to_user)
-                        ret = copy_to_user(ptr, addr + offset, bytes);
-                else
-                        ret = copy_from_user(addr + offset, ptr, bytes);
-                kunmap(page);
-                if (ret)
-                        return -EFAULT;
+                ret = copy_from_user(addr + offset, ptr, bytes);
         }
+        kunmap(page);
 
-        return 0;
+        return ret ? -EFAULT : 0;
 }
 EXPORT_SYMBOL_GPL(rds_page_copy_user);
 
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index c397524c039c..c519939e8da9 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -43,7 +43,7 @@ void rds_tcp_state_change(struct sock *sk)
         struct rds_connection *conn;
         struct rds_tcp_connection *tc;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (conn == NULL) {
                 state_change = sk->sk_state_change;
@@ -68,7 +68,7 @@ void rds_tcp_state_change(struct sock *sk)
                         break;
         }
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         state_change(sk);
 }
 
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 975183fe6950..27844f231d10 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -114,7 +114,7 @@ void rds_tcp_listen_data_ready(struct sock *sk, int bytes)
 
         rdsdebug("listen data ready sk %p\n", sk);
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         ready = sk->sk_user_data;
         if (ready == NULL) { /* check for teardown race */
                 ready = sk->sk_data_ready;
@@ -131,7 +131,7 @@ void rds_tcp_listen_data_ready(struct sock *sk, int bytes)
                 queue_work(rds_wq, &rds_tcp_listen_work);
 
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         ready(sk, bytes);
 }
 
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index 1aba6878fa5d..e43797404102 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -324,7 +324,7 @@ void rds_tcp_data_ready(struct sock *sk, int bytes)
 
         rdsdebug("data ready sk %p bytes %d\n", sk, bytes);
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (conn == NULL) { /* check for teardown race */
                 ready = sk->sk_data_ready;
@@ -338,7 +338,7 @@ void rds_tcp_data_ready(struct sock *sk, int bytes)
         if (rds_tcp_read_sock(conn, GFP_ATOMIC, KM_SOFTIRQ0) == -ENOMEM)
                 queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         ready(sk, bytes);
 }
 
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
index a28b895ff0d1..2f012a07d94d 100644
--- a/net/rds/tcp_send.c
+++ b/net/rds/tcp_send.c
@@ -224,7 +224,7 @@ void rds_tcp_write_space(struct sock *sk)
         struct rds_connection *conn;
         struct rds_tcp_connection *tc;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (conn == NULL) {
                 write_space = sk->sk_write_space;
@@ -244,7 +244,7 @@ void rds_tcp_write_space(struct sock *sk)
                 queue_delayed_work(rds_wq, &conn->c_send_w, 0);
 
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 
         /*
          * write_space is only called when data leaves tcp's send queue if
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 51875a0c5d48..04f599089e6d 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -1241,6 +1241,7 @@ static const struct file_operations rfkill_fops = {
         .unlocked_ioctl = rfkill_fop_ioctl,
         .compat_ioctl   = rfkill_fop_ioctl,
 #endif
+        .llseek         = no_llseek,
 };
 
 static struct miscdevice rfkill_miscdev = {
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 8e45e76a95f5..d952e7eac188 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -679,7 +679,7 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
                 return -EINVAL;
 
-        if (addr->srose_ndigis > ROSE_MAX_DIGIS)
+        if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
                 return -EINVAL;
 
         if ((dev = rose_dev_get(&addr->srose_addr)) == NULL) {
@@ -739,7 +739,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
         if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
                 return -EINVAL;
 
-        if (addr->srose_ndigis > ROSE_MAX_DIGIS)
+        if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
                 return -EINVAL;
 
         /* Source + Destination digis should not exceed ROSE_MAX_DIGIS */
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 537a48732e9e..7ebf7439b478 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -350,22 +350,19 @@ tcf_act_police_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_police *police = a->priv;
-        struct tc_police opt;
-
-        opt.index = police->tcf_index;
-        opt.action = police->tcf_action;
-        opt.mtu = police->tcfp_mtu;
-        opt.burst = police->tcfp_burst;
-        opt.refcnt = police->tcf_refcnt - ref;
-        opt.bindcnt = police->tcf_bindcnt - bind;
+        struct tc_police opt = {
+                .index = police->tcf_index,
+                .action = police->tcf_action,
+                .mtu = police->tcfp_mtu,
+                .burst = police->tcfp_burst,
+                .refcnt = police->tcf_refcnt - ref,
+                .bindcnt = police->tcf_bindcnt - bind,
+        };
+
         if (police->tcfp_R_tab)
                 opt.rate = police->tcfp_R_tab->rate;
-        else
-                memset(&opt.rate, 0, sizeof(opt.rate));
         if (police->tcfp_P_tab)
                 opt.peakrate = police->tcfp_P_tab->rate;
-        else
-                memset(&opt.peakrate, 0, sizeof(opt.peakrate));
         NLA_PUT(skb, TCA_POLICE_TBF, sizeof(opt), &opt);
         if (police->tcfp_result)
                 NLA_PUT_U32(skb, TCA_POLICE_RESULT, police->tcfp_result);
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index 78ef2c5e130b..37dff78e9cb1 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -123,7 +123,7 @@ static int cls_cgroup_classify(struct sk_buff *skb, struct tcf_proto *tp,
          * calls by looking at the number of nested bh disable calls because
          * softirqs always disables bh.
          */
-        if (softirq_count() != SOFTIRQ_OFFSET) {
+        if (in_serving_softirq()) {
                 /* If there is an sk_classid we'll use that. */
                 if (!skb->sk)
                         return -1;
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 7416a5c73b2a..b0c2a82178af 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -137,7 +137,7 @@ next_knode:
                         int toff = off + key->off + (off2 & key->offmask);
                         __be32 *data, _data;
 
-                        if (skb_headroom(skb) + toff < 0)
+                        if (skb_headroom(skb) + toff > INT_MAX)
                                 goto out;
 
                         data = skb_header_pointer(skb, toff, 4, &_data);
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 340662789529..6318e1136b83 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -255,10 +255,6 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
                         error = -EINVAL;
                         goto err_out;
                 }
-                if (!list_empty(&flow->list)) {
-                        error = -EEXIST;
-                        goto err_out;
-                }
         } else {
                 int i;
                 unsigned long cl;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index abd904be4287..47496098d35c 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -761,8 +761,8 @@ init_vf(struct hfsc_class *cl, unsigned int len)
                 if (f != cl->cl_f) {
                         cl->cl_f = f;
                         cftree_update(cl);
-                        update_cfmin(cl->cl_parent);
                 }
+                update_cfmin(cl->cl_parent);
         }
 }
 
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 86366390038a..ddbbf7c81fa1 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -543,16 +543,20 @@ struct sctp_hmac *sctp_auth_asoc_get_hmac(const struct sctp_association *asoc)
                 id = ntohs(hmacs->hmac_ids[i]);
 
                 /* Check the id is in the supported range */
-                if (id > SCTP_AUTH_HMAC_ID_MAX)
+                if (id > SCTP_AUTH_HMAC_ID_MAX) {
+                        id = 0;
                         continue;
+                }
 
                 /* See is we support the id.  Supported IDs have name and
                  * length fields set, so that we can allocated and use
                  * them.  We can safely just check for name, for without the
                  * name, we can't allocate the TFM.
                  */
-                if (!sctp_hmac_list[id].hmac_name)
+                if (!sctp_hmac_list[id].hmac_name) {
+                        id = 0;
                         continue;
+                }
 
                 break;
         }
diff --git a/net/sctp/output.c b/net/sctp/output.c
index a646681f5acd..bcc4590ccaf2 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -92,7 +92,6 @@ struct sctp_packet *sctp_packet_config(struct sctp_packet *packet,
         SCTP_DEBUG_PRINTK("%s: packet:%p vtag:0x%x\n", __func__,
                           packet, vtag);
 
-        sctp_packet_reset(packet);
         packet->vtag = vtag;
 
         if (ecn_capable && sctp_packet_empty(packet)) {
diff --git a/net/sctp/probe.c b/net/sctp/probe.c
index db3a42b8b349..289b1ba62cac 100644
--- a/net/sctp/probe.c
+++ b/net/sctp/probe.c
@@ -117,6 +117,7 @@ static const struct file_operations sctpprobe_fops = {
         .owner  = THIS_MODULE,
         .open   = sctpprobe_open,
         .read   = sctpprobe_read,
+        .llseek = noop_llseek,
 };
 
 sctp_disposition_t jsctp_sf_eat_sack(const struct sctp_endpoint *ep,
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 24b2cd555637..d344dc481ccc 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1232,6 +1232,18 @@ out:
         return 0;
 }
 
+static bool list_has_sctp_addr(const struct list_head *list,
+                               union sctp_addr *ipaddr)
+{
+        struct sctp_transport *addr;
+
+        list_for_each_entry(addr, list, transports) {
+                if (sctp_cmp_addr_exact(ipaddr, &addr->ipaddr))
+                        return true;
+        }
+
+        return false;
+}
 /* A restart is occurring, check to make sure no new addresses
  * are being added as we may be under a takeover attack.
  */
@@ -1240,10 +1252,10 @@ static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
                                        struct sctp_chunk *init,
                                        sctp_cmd_seq_t *commands)
 {
-        struct sctp_transport *new_addr, *addr;
-        int found;
+        struct sctp_transport *new_addr;
+        int ret = 1;
 
-        /* Implementor's Guide - Sectin 5.2.2
+        /* Implementor's Guide - Section 5.2.2
          * ...
          * Before responding the endpoint MUST check to see if the
          * unexpected INIT adds new addresses to the association. If new
@@ -1254,31 +1266,19 @@ static int sctp_sf_check_restart_addrs(const struct sctp_association *new_asoc,
         /* Search through all current addresses and make sure
          * we aren't adding any new ones.
          */
-        new_addr = NULL;
-        found = 0;
-
         list_for_each_entry(new_addr, &new_asoc->peer.transport_addr_list,
-                        transports) {
-                found = 0;
-                list_for_each_entry(addr, &asoc->peer.transport_addr_list,
-                                transports) {
-                        if (sctp_cmp_addr_exact(&new_addr->ipaddr,
-                                                &addr->ipaddr)) {
-                                found = 1;
-                                break;
-                        }
-                }
-                if (!found)
+                            transports) {
+                if (!list_has_sctp_addr(&asoc->peer.transport_addr_list,
+                                        &new_addr->ipaddr)) {
+                        sctp_sf_send_restart_abort(&new_addr->ipaddr, init,
+                                                   commands);
+                        ret = 0;
                         break;
-        }
-
-        /* If a new address was added, ABORT the sender. */
-        if (!found && new_addr) {
-                sctp_sf_send_restart_abort(&new_addr->ipaddr, init, commands);
+                }
         }
 
         /* Return success if all addresses were found. */
-        return found;
+        return ret;
 }
 
 /* Populate the verification/tie tags based on overlapping INIT
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index ca44917872d2..fbb70770ad05 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -916,6 +916,11 @@ SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk,
         /* Walk through the addrs buffer and count the number of addresses. */
         addr_buf = kaddrs;
         while (walk_size < addrs_size) {
+                if (walk_size + sizeof(sa_family_t) > addrs_size) {
+                        kfree(kaddrs);
+                        return -EINVAL;
+                }
+
                 sa_addr = (struct sockaddr *)addr_buf;
                 af = sctp_get_af_specific(sa_addr->sa_family);
 
@@ -1002,9 +1007,13 @@ static int __sctp_connect(struct sock* sk,
         /* Walk through the addrs buffer and count the number of addresses. */
         addr_buf = kaddrs;
         while (walk_size < addrs_size) {
+                if (walk_size + sizeof(sa_family_t) > addrs_size) {
+                        err = -EINVAL;
+                        goto out_free;
+                }
+
                 sa_addr = (union sctp_addr *)addr_buf;
                 af = sctp_get_af_specific(sa_addr->sa.sa_family);
-                port = ntohs(sa_addr->v4.sin_port);
 
                 /* If the address family is not supported or if this address
                  * causes the address buffer to overflow return EINVAL.
@@ -1014,6 +1023,8 @@ static int __sctp_connect(struct sock* sk,
                         goto out_free;
                 }
 
+                port = ntohs(sa_addr->v4.sin_port);
+
                 /* Save current address so we can work with it */
                 memcpy(&to, sa_addr, af->sockaddr_len);
 
diff --git a/net/socket.c b/net/socket.c
index 2270b941bcc7..9eac5c394134 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -502,6 +502,7 @@ static int sock_no_open(struct inode *irrelevant, struct file *dontcare)
 const struct file_operations bad_sock_fops = {
         .owner = THIS_MODULE,
         .open = sock_no_open,
+        .llseek = noop_llseek,
 };
 
 /**
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 36cb66022a27..e9eaaf7d43c1 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -38,7 +38,7 @@ static const struct rpc_authops *auth_flavors[RPC_AUTH_MAXFLAVOR] = {
 static LIST_HEAD(cred_unused);
 static unsigned long number_cred_unused;
 
-#define MAX_HASHTABLE_BITS (10) 
+#define MAX_HASHTABLE_BITS (14)
 static int param_set_hashtbl_sz(const char *val, const struct kernel_param *kp)
 {
         unsigned long num;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index dcfc66bab2bb..12c485982814 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -745,17 +745,18 @@ gss_pipe_release(struct inode *inode)
         struct rpc_inode *rpci = RPC_I(inode);
         struct gss_upcall_msg *gss_msg;
 
+restart:
         spin_lock(&inode->i_lock);
-        while (!list_empty(&rpci->in_downcall)) {
+        list_for_each_entry(gss_msg, &rpci->in_downcall, list) {
 
-                gss_msg = list_entry(rpci->in_downcall.next,
-                                struct gss_upcall_msg, list);
+                if (!list_empty(&gss_msg->msg.list))
+                        continue;
                 gss_msg->msg.errno = -EPIPE;
                 atomic_inc(&gss_msg->count);
                 __gss_unhash_msg(gss_msg);
                 spin_unlock(&inode->i_lock);
                 gss_release_msg(gss_msg);
-                spin_lock(&inode->i_lock);
+                goto restart;
         }
         spin_unlock(&inode->i_lock);
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 032644610524..778e5dfc5144 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -237,6 +237,7 @@ get_key(const void *p, const void *end,
         if (!supported_gss_krb5_enctype(alg)) {
                 printk(KERN_WARNING "gss_kerberos_mech: unsupported "
                         "encryption key algorithm %d\n", alg);
+                p = ERR_PTR(-EINVAL);
                 goto out_err;
         }
         p = simple_get_netobj(p, end, &key);
@@ -282,15 +283,19 @@ gss_import_v1_context(const void *p, const void *end, struct krb5_ctx *ctx)
         ctx->enctype = ENCTYPE_DES_CBC_RAW;
 
         ctx->gk5e = get_gss_krb5_enctype(ctx->enctype);
-        if (ctx->gk5e == NULL)
+        if (ctx->gk5e == NULL) {
+                p = ERR_PTR(-EINVAL);
                 goto out_err;
+        }
 
         /* The downcall format was designed before we completely understood
          * the uses of the context fields; so it includes some stuff we
          * just give some minimal sanity-checking, and some we ignore
          * completely (like the next twenty bytes): */
-        if (unlikely(p + 20 > end || p + 20 < p))
+        if (unlikely(p + 20 > end || p + 20 < p)) {
+                p = ERR_PTR(-EFAULT);
                 goto out_err;
+        }
         p += 20;
         p = simple_get_bytes(p, end, &tmp, sizeof(tmp));
         if (IS_ERR(p))
@@ -619,6 +624,7 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx,
         if (ctx->seq_send64 != ctx->seq_send) {
                 dprintk("%s: seq_send64 %lx, seq_send %x overflow?\n", __func__,
                         (long unsigned)ctx->seq_send64, ctx->seq_send);
+                p = ERR_PTR(-EINVAL);
                 goto out_err;
         }
         p = simple_get_bytes(p, end, &ctx->enctype, sizeof(ctx->enctype));
diff --git a/net/sunrpc/auth_gss/gss_spkm3_mech.c b/net/sunrpc/auth_gss/gss_spkm3_mech.c
index dc3f1f5ed865..adade3d313f2 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_mech.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_mech.c
@@ -100,6 +100,7 @@ gss_import_sec_context_spkm3(const void *p, size_t len,
         if (version != 1) {
                 dprintk("RPC:       unknown spkm3 token format: "
                                 "obsolete nfs-utils?\n");
+                p = ERR_PTR(-EINVAL);
                 goto out_err_free_ctx;
         }
 
@@ -135,8 +136,10 @@ gss_import_sec_context_spkm3(const void *p, size_t len,
         if (IS_ERR(p))
                 goto out_err_free_intg_alg;
 
-        if (p != end)
+        if (p != end) {
+                p = ERR_PTR(-EFAULT);
                 goto out_err_free_intg_key;
+        }
 
         ctx_id->internal_ctx_id = ctx;
 
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 2b06410e584e..7dce81a926c5 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -28,7 +28,6 @@
 #include <linux/workqueue.h>
 #include <linux/mutex.h>
 #include <linux/pagemap.h>
-#include <linux/smp_lock.h>
 #include <asm/ioctls.h>
 #include <linux/sunrpc/types.h>
 #include <linux/sunrpc/cache.h>
@@ -1348,15 +1347,10 @@ static unsigned int cache_poll_procfs(struct file *filp, poll_table *wait)
 static long cache_ioctl_procfs(struct file *filp,
                                unsigned int cmd, unsigned long arg)
 {
-        long ret;
         struct inode *inode = filp->f_path.dentry->d_inode;
         struct cache_detail *cd = PDE(inode)->data;
 
-        lock_kernel();
-        ret = cache_ioctl(inode, filp, cmd, arg, cd);
-        unlock_kernel();
-
-        return ret;
+        return cache_ioctl(inode, filp, cmd, arg, cd);
 }
 
 static int cache_open_procfs(struct inode *inode, struct file *filp)
@@ -1441,6 +1435,7 @@ static const struct file_operations cache_flush_operations_procfs = {
         .read           = read_flush_procfs,
         .write          = write_flush_procfs,
         .release        = release_flush_procfs,
+        .llseek         = no_llseek,
 };
 
 static void remove_cache_proc_entries(struct cache_detail *cd)
@@ -1555,13 +1550,8 @@ static long cache_ioctl_pipefs(struct file *filp,
 {
         struct inode *inode = filp->f_dentry->d_inode;
         struct cache_detail *cd = RPC_I(inode)->private;
-        long ret;
 
-        lock_kernel();
-        ret = cache_ioctl(inode, filp, cmd, arg, cd);
-        unlock_kernel();
-
-        return ret;
+        return cache_ioctl(inode, filp, cmd, arg, cd);
 }
 
 static int cache_open_pipefs(struct inode *inode, struct file *filp)
@@ -1646,6 +1636,7 @@ const struct file_operations cache_flush_operations_pipefs = {
         .read           = read_flush_pipefs,
         .write          = write_flush_pipefs,
         .release        = release_flush_pipefs,
+        .llseek         = no_llseek,
 };
 
 int sunrpc_cache_register_pipefs(struct dentry *parent,
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 2388d83b68ff..fa5549079d79 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -226,7 +226,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
                         goto out_no_principal;
         }
 
-        kref_init(&clnt->cl_kref);
+        atomic_set(&clnt->cl_count, 1);
 
         err = rpc_setup_pipedir(clnt, program->pipe_dir_name);
         if (err < 0)
@@ -390,14 +390,14 @@ rpc_clone_client(struct rpc_clnt *clnt)
                 if (new->cl_principal == NULL)
                         goto out_no_principal;
         }
-        kref_init(&new->cl_kref);
+        atomic_set(&new->cl_count, 1);
         err = rpc_setup_pipedir(new, clnt->cl_program->pipe_dir_name);
         if (err != 0)
                 goto out_no_path;
         if (new->cl_auth)
                 atomic_inc(&new->cl_auth->au_count);
         xprt_get(clnt->cl_xprt);
-        kref_get(&clnt->cl_kref);
+        atomic_inc(&clnt->cl_count);
         rpc_register_client(new);
         rpciod_up();
         return new;
@@ -465,10 +465,8 @@ EXPORT_SYMBOL_GPL(rpc_shutdown_client);
  * Free an RPC client
  */
 static void
-rpc_free_client(struct kref *kref)
+rpc_free_client(struct rpc_clnt *clnt)
 {
-        struct rpc_clnt *clnt = container_of(kref, struct rpc_clnt, cl_kref);
-
         dprintk("RPC:       destroying %s client for %s\n",
                         clnt->cl_protname, clnt->cl_server);
         if (!IS_ERR(clnt->cl_path.dentry)) {
@@ -495,12 +493,10 @@ out_free:
  * Free an RPC client
  */
 static void
-rpc_free_auth(struct kref *kref)
+rpc_free_auth(struct rpc_clnt *clnt)
 {
-        struct rpc_clnt *clnt = container_of(kref, struct rpc_clnt, cl_kref);
-
         if (clnt->cl_auth == NULL) {
-                rpc_free_client(kref);
+                rpc_free_client(clnt);
                 return;
         }
 
@@ -509,10 +505,11 @@ rpc_free_auth(struct kref *kref)
          *       release remaining GSS contexts. This mechanism ensures
          *       that it can do so safely.
          */
-        kref_init(kref);
+        atomic_inc(&clnt->cl_count);
         rpcauth_release(clnt->cl_auth);
         clnt->cl_auth = NULL;
-        kref_put(kref, rpc_free_client);
+        if (atomic_dec_and_test(&clnt->cl_count))
+                rpc_free_client(clnt);
 }
 
 /*
@@ -525,7 +522,8 @@ rpc_release_client(struct rpc_clnt *clnt)
 
         if (list_empty(&clnt->cl_tasks))
                 wake_up(&destroy_wait);
-        kref_put(&clnt->cl_kref, rpc_free_auth);
+        if (atomic_dec_and_test(&clnt->cl_count))
+                rpc_free_auth(clnt);
 }
 
 /**
@@ -588,7 +586,7 @@ void rpc_task_set_client(struct rpc_task *task, struct rpc_clnt *clnt)
         if (clnt != NULL) {
                 rpc_task_release_client(task);
                 task->tk_client = clnt;
-                kref_get(&clnt->cl_kref);
+                atomic_inc(&clnt->cl_count);
                 if (clnt->cl_softrtry)
                         task->tk_flags |= RPC_TASK_SOFT;
                 /* Add to the client's list of all tasks */
@@ -931,7 +929,7 @@ call_reserveresult(struct rpc_task *task)
         task->tk_status = 0;
         if (status >= 0) {
                 if (task->tk_rqstp) {
-                        task->tk_action = call_allocate;
+                        task->tk_action = call_refresh;
                         return;
                 }
 
@@ -966,13 +964,54 @@ call_reserveresult(struct rpc_task *task)
 }
 
 /*
- * 2.   Allocate the buffer. For details, see sched.c:rpc_malloc.
+ * 2.   Bind and/or refresh the credentials
+ */
+static void
+call_refresh(struct rpc_task *task)
+{
+        dprint_status(task);
+
+        task->tk_action = call_refreshresult;
+        task->tk_status = 0;
+        task->tk_client->cl_stats->rpcauthrefresh++;
+        rpcauth_refreshcred(task);
+}
+
+/*
+ * 2a.  Process the results of a credential refresh
+ */
+static void
+call_refreshresult(struct rpc_task *task)
+{
+        int status = task->tk_status;
+
+        dprint_status(task);
+
+        task->tk_status = 0;
+        task->tk_action = call_allocate;
+        if (status >= 0 && rpcauth_uptodatecred(task))
+                return;
+        switch (status) {
+        case -EACCES:
+                rpc_exit(task, -EACCES);
+                return;
+        case -ENOMEM:
+                rpc_exit(task, -ENOMEM);
+                return;
+        case -ETIMEDOUT:
+                rpc_delay(task, 3*HZ);
+        }
+        task->tk_action = call_refresh;
+}
+
+/*
+ * 2b.  Allocate the buffer. For details, see sched.c:rpc_malloc.
  *      (Note: buffer memory is freed in xprt_release).
  */
 static void
 call_allocate(struct rpc_task *task)
 {
-        unsigned int slack = task->tk_client->cl_auth->au_cslack;
+        unsigned int slack = task->tk_rqstp->rq_cred->cr_auth->au_cslack;
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = task->tk_xprt;
         struct rpc_procinfo *proc = task->tk_msg.rpc_proc;
@@ -980,7 +1019,7 @@ call_allocate(struct rpc_task *task)
         dprint_status(task);
 
         task->tk_status = 0;
-        task->tk_action = call_refresh;
+        task->tk_action = call_bind;
 
         if (req->rq_buffer)
                 return;
@@ -1017,47 +1056,6 @@ call_allocate(struct rpc_task *task)
         rpc_exit(task, -ERESTARTSYS);
 }
 
-/*
- * 2a.  Bind and/or refresh the credentials
- */
-static void
-call_refresh(struct rpc_task *task)
-{
-        dprint_status(task);
-
-        task->tk_action = call_refreshresult;
-        task->tk_status = 0;
-        task->tk_client->cl_stats->rpcauthrefresh++;
-        rpcauth_refreshcred(task);
-}
-
-/*
- * 2b.  Process the results of a credential refresh
- */
-static void
-call_refreshresult(struct rpc_task *task)
-{
-        int status = task->tk_status;
-
-        dprint_status(task);
-
-        task->tk_status = 0;
-        task->tk_action = call_bind;
-        if (status >= 0 && rpcauth_uptodatecred(task))
-                return;
-        switch (status) {
-        case -EACCES:
-                rpc_exit(task, -EACCES);
-                return;
-        case -ENOMEM:
-                rpc_exit(task, -ENOMEM);
-                return;
-        case -ETIMEDOUT:
-                rpc_delay(task, 3*HZ);
-        }
-        task->tk_action = call_refresh;
-}
-
 static inline int
 rpc_task_need_encode(struct rpc_task *task)
 {
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 95ccbcf45d3e..28bcd52e3ce9 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -27,7 +27,6 @@
 #include <linux/workqueue.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
 #include <linux/sunrpc/cache.h>
-#include <linux/smp_lock.h>
 
 static struct vfsmount *rpc_mount __read_mostly;
 static int rpc_mount_count;
@@ -48,7 +47,7 @@ static void rpc_purge_list(struct rpc_inode *rpci, struct list_head *head,
                 return;
         do {
                 msg = list_entry(head->next, struct rpc_pipe_msg, list);
-                list_del(&msg->list);
+                list_del_init(&msg->list);
                 msg->errno = err;
                 destroy_msg(msg);
         } while (!list_empty(head));
@@ -208,7 +207,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp)
         if (msg != NULL) {
                 spin_lock(&inode->i_lock);
                 msg->errno = -EAGAIN;
-                list_del(&msg->list);
+                list_del_init(&msg->list);
                 spin_unlock(&inode->i_lock);
                 rpci->ops->destroy_msg(msg);
         }
@@ -268,7 +267,7 @@ rpc_pipe_read(struct file *filp, char __user *buf, size_t len, loff_t *offset)
         if (res < 0 || msg->len == msg->copied) {
                 filp->private_data = NULL;
                 spin_lock(&inode->i_lock);
-                list_del(&msg->list);
+                list_del_init(&msg->list);
                 spin_unlock(&inode->i_lock);
                 rpci->ops->destroy_msg(msg);
         }
@@ -309,40 +308,33 @@ rpc_pipe_poll(struct file *filp, struct poll_table_struct *wait)
         return mask;
 }
 
-static int
-rpc_pipe_ioctl_unlocked(struct file *filp, unsigned int cmd, unsigned long arg)
+static long
+rpc_pipe_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
-        struct rpc_inode *rpci = RPC_I(filp->f_path.dentry->d_inode);
+        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct rpc_inode *rpci = RPC_I(inode);
         int len;
 
         switch (cmd) {
         case FIONREAD:
-                if (rpci->ops == NULL)
+                spin_lock(&inode->i_lock);
+                if (rpci->ops == NULL) {
+                        spin_unlock(&inode->i_lock);
                         return -EPIPE;
+                }
                 len = rpci->pipelen;
                 if (filp->private_data) {
                         struct rpc_pipe_msg *msg;
                         msg = (struct rpc_pipe_msg *)filp->private_data;
                         len += msg->len - msg->copied;
                 }
+                spin_unlock(&inode->i_lock);
                 return put_user(len, (int __user *)arg);
         default:
                 return -EINVAL;
         }
 }
 
-static long
-rpc_pipe_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
-{
-        long ret;
-
-        lock_kernel();
-        ret = rpc_pipe_ioctl_unlocked(filp, cmd, arg);
-        unlock_kernel();
-
-        return ret;
-}
-
 static const struct file_operations rpc_pipe_fops = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
@@ -371,21 +363,23 @@ rpc_show_info(struct seq_file *m, void *v)
 static int
 rpc_info_open(struct inode *inode, struct file *file)
 {
-        struct rpc_clnt *clnt;
+        struct rpc_clnt *clnt = NULL;
         int ret = single_open(file, rpc_show_info, NULL);
 
         if (!ret) {
                 struct seq_file *m = file->private_data;
-                mutex_lock(&inode->i_mutex);
-                clnt = RPC_I(inode)->private;
-                if (clnt) {
-                        kref_get(&clnt->cl_kref);
+
+                spin_lock(&file->f_path.dentry->d_lock);
+                if (!d_unhashed(file->f_path.dentry))
+                        clnt = RPC_I(inode)->private;
+                if (clnt != NULL && atomic_inc_not_zero(&clnt->cl_count)) {
+                        spin_unlock(&file->f_path.dentry->d_lock);
                         m->private = clnt;
                 } else {
+                        spin_unlock(&file->f_path.dentry->d_lock);
                         single_release(inode, file);
                         ret = -EINVAL;
                 }
-                mutex_unlock(&inode->i_mutex);
         }
         return ret;
 }
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index b6309db56226..fe9306bf10cc 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -800,7 +800,7 @@ static void xs_udp_data_ready(struct sock *sk, int len)
         u32 _xid;
         __be32 *xp;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         dprintk("RPC:       xs_udp_data_ready...\n");
         if (!(xprt = xprt_from_sock(sk)))
                 goto out;
@@ -852,7 +852,7 @@ static void xs_udp_data_ready(struct sock *sk, int len)
  dropit:
         skb_free_datagram(sk, skb);
  out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 static inline void xs_tcp_read_fraghdr(struct rpc_xprt *xprt, struct xdr_skb_reader *desc)
@@ -1229,7 +1229,7 @@ static void xs_tcp_data_ready(struct sock *sk, int bytes)
 
         dprintk("RPC:       xs_tcp_data_ready...\n");
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         if (!(xprt = xprt_from_sock(sk)))
                 goto out;
         if (xprt->shutdown)
@@ -1248,7 +1248,7 @@ static void xs_tcp_data_ready(struct sock *sk, int bytes)
                 read = tcp_read_sock(sk, &rd_desc, xs_tcp_data_recv);
         } while (read > 0);
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 /*
@@ -1301,7 +1301,7 @@ static void xs_tcp_state_change(struct sock *sk)
 {
         struct rpc_xprt *xprt;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         if (!(xprt = xprt_from_sock(sk)))
                 goto out;
         dprintk("RPC:       xs_tcp_state_change client %p...\n", xprt);
@@ -1313,7 +1313,7 @@ static void xs_tcp_state_change(struct sock *sk)
 
         switch (sk->sk_state) {
         case TCP_ESTABLISHED:
-                spin_lock_bh(&xprt->transport_lock);
+                spin_lock(&xprt->transport_lock);
                 if (!xprt_test_and_set_connected(xprt)) {
                         struct sock_xprt *transport = container_of(xprt,
                                         struct sock_xprt, xprt);
@@ -1327,7 +1327,7 @@ static void xs_tcp_state_change(struct sock *sk)
 
                         xprt_wake_pending_tasks(xprt, -EAGAIN);
                 }
-                spin_unlock_bh(&xprt->transport_lock);
+                spin_unlock(&xprt->transport_lock);
                 break;
         case TCP_FIN_WAIT1:
                 /* The client initiated a shutdown of the socket */
@@ -1365,7 +1365,7 @@ static void xs_tcp_state_change(struct sock *sk)
                 xs_sock_mark_closed(xprt);
         }
  out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 /**
@@ -1376,7 +1376,7 @@ static void xs_error_report(struct sock *sk)
 {
         struct rpc_xprt *xprt;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         if (!(xprt = xprt_from_sock(sk)))
                 goto out;
         dprintk("RPC:       %s client %p...\n"
@@ -1384,7 +1384,7 @@ static void xs_error_report(struct sock *sk)
                         __func__, xprt, sk->sk_err);
         xprt_wake_pending_tasks(xprt, -EAGAIN);
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 static void xs_write_space(struct sock *sk)
@@ -1416,13 +1416,13 @@ static void xs_write_space(struct sock *sk)
  */
 static void xs_udp_write_space(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
 
         /* from net/core/sock.c:sock_def_write_space */
         if (sock_writeable(sk))
                 xs_write_space(sk);
 
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 /**
@@ -1437,13 +1437,13 @@ static void xs_udp_write_space(struct sock *sk)
  */
 static void xs_tcp_write_space(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
 
         /* from net/core/stream.c:sk_stream_write_space */
         if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
                 xs_write_space(sk);
 
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 static void xs_udp_do_set_buffer_size(struct rpc_xprt *xprt)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 4414a18c63b4..0b39b2451ea5 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -692,6 +692,7 @@ static int unix_autobind(struct socket *sock)
         static u32 ordernum = 1;
         struct unix_address *addr;
         int err;
+        unsigned int retries = 0;
 
         mutex_lock(&u->readlock);
 
@@ -717,9 +718,17 @@ retry:
         if (__unix_find_socket_byname(net, addr->name, addr->len, sock->type,
                                       addr->hash)) {
                 spin_unlock(&unix_table_lock);
-                /* Sanity yield. It is unusual case, but yet... */
-                if (!(ordernum&0xFF))
-                        yield();
+                /*
+                 * __unix_find_socket_byname() may take long time if many names
+                 * are already in use.
+                 */
+                cond_resched();
+                /* Give up if all names seems to be in use. */
+                if (retries++ == 0xFFFFF) {
+                        err = -ENOSPC;
+                        kfree(addr);
+                        goto out;
+                }
                 goto retry;
         }
         addr->hash ^= sk->sk_type;
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 541e2fff5e9c..d6d046b9f6f2 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -475,12 +475,10 @@ int wiphy_register(struct wiphy *wiphy)
         mutex_lock(&cfg80211_mutex);
 
         res = device_add(&rdev->wiphy.dev);
-        if (res)
-                goto out_unlock;
-
-        res = rfkill_register(rdev->rfkill);
-        if (res)
-                goto out_rm_dev;
+        if (res) {
+                mutex_unlock(&cfg80211_mutex);
+                return res;
+        }
 
         /* set up regulatory info */
         wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
@@ -509,13 +507,18 @@ int wiphy_register(struct wiphy *wiphy)
         cfg80211_debugfs_rdev_add(rdev);
         mutex_unlock(&cfg80211_mutex);
 
+        /*
+         * due to a locking dependency this has to be outside of the
+         * cfg80211_mutex lock
+         */
+        res = rfkill_register(rdev->rfkill);
+        if (res)
+                goto out_rm_dev;
+
         return 0;
 
 out_rm_dev:
         device_del(&rdev->wiphy.dev);
-
-out_unlock:
-        mutex_unlock(&cfg80211_mutex);
         return res;
 }
 EXPORT_SYMBOL(wiphy_register);
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index a4991a3efec0..39765bcfb472 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -34,6 +34,7 @@ static ssize_t name## _read(struct file *file, char __user *userbuf,	\
 static const struct file_operations name## _ops = {                     \
         .read = name## _read,                                           \
         .open = cfg80211_open_file_generic,                             \
+        .llseek = generic_file_llseek,                                  \
 };
 
 DEBUGFS_READONLY_FILE(rts_threshold, 20, "%d",
@@ -102,6 +103,7 @@ static ssize_t ht40allow_map_read(struct file *file,
 static const struct file_operations ht40allow_map_ops = {
         .read = ht40allow_map_read,
         .open = cfg80211_open_file_generic,
+        .llseek = default_llseek,
 };
 
 #define DEBUGFS_ADD(name)                                               \
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index bb5e0a5ecfa1..7e5c3a45f811 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -1420,6 +1420,9 @@ int cfg80211_wext_giwessid(struct net_device *dev,
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
 
+        data->flags = 0;
+        data->length = 0;
+
         switch (wdev->iftype) {
         case NL80211_IFTYPE_ADHOC:
                 return cfg80211_ibss_wext_giwessid(dev, info, data, ssid);
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 0ef17bc42bac..8f5116f5af19 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -782,6 +782,22 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                 }
         }
 
+        if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
+                /*
+                 * If this is a GET, but not NOMAX, it means that the extra
+                 * data is not bounded by userspace, but by max_tokens. Thus
+                 * set the length to max_tokens. This matches the extra data
+                 * allocation.
+                 * The driver should fill it with the number of tokens it
+                 * provided, and it may check iwp->length rather than having
+                 * knowledge of max_tokens. If the driver doesn't change the
+                 * iwp->length, this ioctl just copies back max_token tokens
+                 * filled with zeroes. Hopefully the driver isn't claiming
+                 * them to be valid data.
+                 */
+                iwp->length = descr->max_tokens;
+        }
+
         err = handler(dev, info, (union iwreq_data *) iwp, extra);
 
         iwp->length += essid_compat;
diff --git a/net/wireless/wext-priv.c b/net/wireless/wext-priv.c
index 3feb28e41c53..674d426a9d24 100644
--- a/net/wireless/wext-priv.c
+++ b/net/wireless/wext-priv.c
@@ -152,7 +152,7 @@ static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
         } else if (!iwp->pointer)
                 return -EFAULT;
 
-        extra = kmalloc(extra_size, GFP_KERNEL);
+        extra = kzalloc(extra_size, GFP_KERNEL);
         if (!extra)
                 return -ENOMEM;
 
diff --git a/net/x25/Kconfig b/net/x25/Kconfig
index e6759c9660bb..2196e55e4f61 100644
--- a/net/x25/Kconfig
+++ b/net/x25/Kconfig
@@ -5,6 +5,7 @@
 config X25
         tristate "CCITT X.25 Packet Layer (EXPERIMENTAL)"
         depends on EXPERIMENTAL
+        depends on BKL # should be fixable
         ---help---
           X.25 is a set of standardized network protocols, similar in scope to
           frame relay; the one physical line from your box to the X.25 network
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index a3cca0a94346..64f2ae1fdc15 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -101,7 +101,7 @@ resume:
                         err = -EHOSTUNREACH;
                         goto error_nolock;
                 }
-                skb_dst_set_noref(skb, dst);
+                skb_dst_set(skb, dst_clone(dst));
                 x = dst->xfrm;
         } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 2b3ed7ad4933..cbab6e1a8c9c 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1175,9 +1175,8 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl,
                     tmpl->mode == XFRM_MODE_BEET) {
                         remote = &tmpl->id.daddr;
                         local = &tmpl->saddr;
-                        family = tmpl->encap_family;
-                        if (xfrm_addr_any(local, family)) {
-                                error = xfrm_get_saddr(net, &tmp, remote, family);
+                        if (xfrm_addr_any(local, tmpl->encap_family)) {
+                                error = xfrm_get_saddr(net, &tmp, remote, tmpl->encap_family);
                                 if (error)
                                         goto fail;
                                 local = &tmp;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5208b12fbfb4..eb96ce52f178 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -656,15 +656,23 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
 EXPORT_SYMBOL(xfrm_sad_getinfo);
 
 static int
-xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
-                  struct xfrm_tmpl *tmpl,
-                  xfrm_address_t *daddr, xfrm_address_t *saddr,
-                  unsigned short family)
+xfrm_init_tempstate(struct xfrm_state *x, struct flowi *fl,
+                    struct xfrm_tmpl *tmpl,
+                    xfrm_address_t *daddr, xfrm_address_t *saddr,
+                    unsigned short family)
 {
         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
         if (!afinfo)
                 return -1;
-        afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
+        afinfo->init_tempsel(&x->sel, fl);
+
+        if (family != tmpl->encap_family) {
+                xfrm_state_put_afinfo(afinfo);
+                afinfo = xfrm_state_get_afinfo(tmpl->encap_family);
+                if (!afinfo)
+                        return -1;
+        }
+        afinfo->init_temprop(x, tmpl, daddr, saddr);
         xfrm_state_put_afinfo(afinfo);
         return 0;
 }
@@ -790,37 +798,38 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
         int error = 0;
         struct xfrm_state *best = NULL;
         u32 mark = pol->mark.v & pol->mark.m;
+        unsigned short encap_family = tmpl->encap_family;
 
         to_put = NULL;
 
         spin_lock_bh(&xfrm_state_lock);
-        h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, family);
+        h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
-                if (x->props.family == family &&
+                if (x->props.family == encap_family &&
                     x->props.reqid == tmpl->reqid &&
                     (mark & x->mark.m) == x->mark.v &&
                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
-                    xfrm_state_addr_check(x, daddr, saddr, family) &&
+                    xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
                     tmpl->mode == x->props.mode &&
                     tmpl->id.proto == x->id.proto &&
                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
-                        xfrm_state_look_at(pol, x, fl, family, daddr, saddr,
+                        xfrm_state_look_at(pol, x, fl, encap_family, daddr, saddr,
                                            &best, &acquire_in_progress, &error);
         }
         if (best)
                 goto found;
 
-        h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family);
+        h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);
         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) {
-                if (x->props.family == family &&
+                if (x->props.family == encap_family &&
                     x->props.reqid == tmpl->reqid &&
                     (mark & x->mark.m) == x->mark.v &&
                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
-                    xfrm_state_addr_check(x, daddr, saddr, family) &&
+                    xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
                     tmpl->mode == x->props.mode &&
                     tmpl->id.proto == x->id.proto &&
                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
-                        xfrm_state_look_at(pol, x, fl, family, daddr, saddr,
+                        xfrm_state_look_at(pol, x, fl, encap_family, daddr, saddr,
                                            &best, &acquire_in_progress, &error);
         }
 
@@ -829,7 +838,7 @@ found:
         if (!x && !error && !acquire_in_progress) {
                 if (tmpl->id.spi &&
                     (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
-                                              tmpl->id.proto, family)) != NULL) {
+                                              tmpl->id.proto, encap_family)) != NULL) {
                         to_put = x0;
                         error = -EEXIST;
                         goto out;
@@ -839,9 +848,9 @@ found:
                         error = -ENOMEM;
                         goto out;
                 }
-                /* Initialize temporary selector matching only
+                /* Initialize temporary state matching only
                  * to current session. */
-                xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
+                xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family);
                 memcpy(&x->mark, &pol->mark, sizeof(x->mark));
 
                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
@@ -856,10 +865,10 @@ found:
                         x->km.state = XFRM_STATE_ACQ;
                         list_add(&x->km.all, &net->xfrm.state_all);
                         hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
-                        h = xfrm_src_hash(net, daddr, saddr, family);
+                        h = xfrm_src_hash(net, daddr, saddr, encap_family);
                         hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
                         if (x->id.spi) {
-                                h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, family);
+                                h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family);
                                 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
                         }
                         x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index b14ed4b1f27c..8bae6b22c846 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1801,7 +1801,7 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
         struct xfrm_user_expire *ue = nlmsg_data(nlh);
         struct xfrm_usersa_info *p = &ue->state;
         struct xfrm_mark m;
-        u32 mark = xfrm_mark_get(attrs, &m);;
+        u32 mark = xfrm_mark_get(attrs, &m);
 
         x = xfrm_state_lookup(net, mark, &p->id.daddr, p->id.spi, p->id.proto, p->family);