Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:
 "Highlights:

   1) Maintain the TCP retransmit queue using an rbtree, with 1GB
      windows at 100Gb this really has become necessary. From Eric
      Dumazet.

   2) Multi-program support for cgroup+bpf, from Alexei Starovoitov.

   3) Perform broadcast flooding in hardware in mv88e6xxx, from Andrew
      Lunn.

   4) Add meter action support to openvswitch, from Andy Zhou.

   5) Add a data meta pointer for BPF accessible packets, from Daniel
      Borkmann.

   6) Namespace-ify almost all TCP sysctl knobs, from Eric Dumazet.

   7) Turn on Broadcom Tags in b53 driver, from Florian Fainelli.

   8) More work to move the RTNL mutex down, from Florian Westphal.

   9) Add 'bpftool' utility, to help with bpf program introspection.
      From Jakub Kicinski.

  10) Add new 'cpumap' type for XDP_REDIRECT action, from Jesper
      Dangaard Brouer.

  11) Support 'blocks' of transformations in the packet scheduler which
      can span multiple network devices, from Jiri Pirko.

  12) TC flower offload support in cxgb4, from Kumar Sanghvi.

  13) Priority based stream scheduler for SCTP, from Marcelo Ricardo
      Leitner.

  14) Thunderbolt networking driver, from Amir Levy and Mika Westerberg.

  15) Add RED qdisc offloadability, and use it in mlxsw driver. From
      Nogah Frankel.

  16) eBPF based device controller for cgroup v2, from Roman Gushchin.

  17) Add some fundamental tracepoints for TCP, from Song Liu.

  18) Remove garbage collection from ipv6 route layer, this is a
      significant accomplishment. From Wei Wang.

  19) Add multicast route offload support to mlxsw, from Yotam Gigi"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2177 commits)
  tcp: highest_sack fix
  geneve: fix fill_info when link down
  bpf: fix lockdep splat
  net: cdc_ncm: GetNtbFormat endian fix
  openvswitch: meter: fix NULL pointer dereference in ovs_meter_cmd_reply_start
  netem: remove unnecessary 64 bit modulus
  netem: use 64 bit divide by rate
  tcp: Namespace-ify sysctl_tcp_default_congestion_control
  net: Protect iterations over net::fib_notifier_ops in fib_seq_sum()
  ipv6: set all.accept_dad to 0 by default
  uapi: fix linux/tls.h userspace compilation error
  usbnet: ipheth: prevent TX queue timeouts when device not ready
  vhost_net: conditionally enable tx polling
  uapi: fix linux/rxrpc.h userspace compilation errors
  net: stmmac: fix LPI transitioning for dwmac4
  atm: horizon: Fix irq release error
  net-sysfs: trigger netlink notification on ifalias change via sysfs
  openvswitch: Using kfree_rcu() to simplify the code
  openvswitch: Make local function ovs_nsh_key_attr_size() static
  openvswitch: Fix return value check in ovs_meter_cmd_features()
  ...

1 files changed, 266 insertions, 331 deletions

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 887585045b27..dabbf1d392fb 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -76,25 +76,10 @@
 #include <linux/ipsec.h>
 #include <asm/unaligned.h>
 #include <linux/errqueue.h>
+#include <trace/events/tcp.h>
+#include <linux/static_key.h>
 
-int sysctl_tcp_fack __read_mostly;
-int sysctl_tcp_max_reordering __read_mostly = 300;
-int sysctl_tcp_dsack __read_mostly = 1;
-int sysctl_tcp_app_win __read_mostly = 31;
-int sysctl_tcp_adv_win_scale __read_mostly = 1;
-EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
-
-/* rfc5961 challenge ack rate limiting */
-int sysctl_tcp_challenge_ack_limit = 1000;
-
-int sysctl_tcp_stdurg __read_mostly;
-int sysctl_tcp_rfc1337 __read_mostly;
 int sysctl_tcp_max_orphans __read_mostly = NR_FILE;
-int sysctl_tcp_frto __read_mostly = 2;
-int sysctl_tcp_min_rtt_wlen __read_mostly = 300;
-int sysctl_tcp_moderate_rcvbuf __read_mostly = 1;
-int sysctl_tcp_early_retrans __read_mostly = 3;
-int sysctl_tcp_invalid_ratelimit __read_mostly = HZ/2;
 
 #define FLAG_DATA               0x01 /* Incoming frame contained data.          */
 #define FLAG_WIN_UPDATE         0x02 /* Incoming ACK was a window update.       */
@@ -335,7 +320,7 @@ static void tcp_sndbuf_expand(struct sock *sk)
         sndmem *= nr_segs * per_mss;
 
         if (sk->sk_sndbuf < sndmem)
-                sk->sk_sndbuf = min(sndmem, sysctl_tcp_wmem[2]);
+                sk->sk_sndbuf = min(sndmem, sock_net(sk)->ipv4.sysctl_tcp_wmem[2]);
 }
 
 /* 2. Tuning advertised window (window_clamp, rcv_ssthresh)
@@ -368,8 +353,8 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         /* Optimize this! */
-        int truesize = tcp_win_from_space(skb->truesize) >> 1;
-        int window = tcp_win_from_space(sysctl_tcp_rmem[2]) >> 1;
+        int truesize = tcp_win_from_space(sk, skb->truesize) >> 1;
+        int window = tcp_win_from_space(sk, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]) >> 1;
 
         while (tp->rcv_ssthresh <= window) {
                 if (truesize <= skb->len)
@@ -394,7 +379,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
                 /* Check #2. Increase window, if skb with such overhead
                  * will fit to rcvbuf in future.
                  */
-                if (tcp_win_from_space(skb->truesize) <= skb->len)
+                if (tcp_win_from_space(sk, skb->truesize) <= skb->len)
                         incr = 2 * tp->advmss;
                 else
                         incr = __tcp_grow_window(sk, skb);
@@ -420,11 +405,11 @@ static void tcp_fixup_rcvbuf(struct sock *sk)
         /* Dynamic Right Sizing (DRS) has 2 to 3 RTT latency
          * Allow enough cushion so that sender is not limited by our window
          */
-        if (sysctl_tcp_moderate_rcvbuf)
+        if (sock_net(sk)->ipv4.sysctl_tcp_moderate_rcvbuf)
                 rcvmem <<= 2;
 
         if (sk->sk_rcvbuf < rcvmem)
-                sk->sk_rcvbuf = min(rcvmem, sysctl_tcp_rmem[2]);
+                sk->sk_rcvbuf = min(rcvmem, sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
 }
 
 /* 4. Try to fixup all. It is made immediately after connection enters
@@ -432,6 +417,7 @@ static void tcp_fixup_rcvbuf(struct sock *sk)
  */
 void tcp_init_buffer_space(struct sock *sk)
 {
+        int tcp_app_win = sock_net(sk)->ipv4.sysctl_tcp_app_win;
         struct tcp_sock *tp = tcp_sk(sk);
         int maxwin;
 
@@ -450,14 +436,14 @@ void tcp_init_buffer_space(struct sock *sk)
         if (tp->window_clamp >= maxwin) {
                 tp->window_clamp = maxwin;
 
-                if (sysctl_tcp_app_win && maxwin > 4 * tp->advmss)
+                if (tcp_app_win && maxwin > 4 * tp->advmss)
                         tp->window_clamp = max(maxwin -
-                                               (maxwin >> sysctl_tcp_app_win),
+                                               (maxwin >> tcp_app_win),
                                                4 * tp->advmss);
         }
 
         /* Force reservation of one segment. */
-        if (sysctl_tcp_app_win &&
+        if (tcp_app_win &&
             tp->window_clamp > 2 * tp->advmss &&
             tp->window_clamp + tp->advmss > maxwin)
                 tp->window_clamp = max(2 * tp->advmss, maxwin - tp->advmss);
@@ -471,15 +457,16 @@ static void tcp_clamp_window(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct net *net = sock_net(sk);
 
         icsk->icsk_ack.quick = 0;
 
-        if (sk->sk_rcvbuf < sysctl_tcp_rmem[2] &&
+        if (sk->sk_rcvbuf < net->ipv4.sysctl_tcp_rmem[2] &&
             !(sk->sk_userlocks & SOCK_RCVBUF_LOCK) &&
             !tcp_under_memory_pressure(sk) &&
             sk_memory_allocated(sk) < sk_prot_mem_limits(sk, 0)) {
                 sk->sk_rcvbuf = min(atomic_read(&sk->sk_rmem_alloc),
-                                    sysctl_tcp_rmem[2]);
+                                    net->ipv4.sysctl_tcp_rmem[2]);
         }
         if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
                 tp->rcv_ssthresh = min(tp->window_clamp, 2U * tp->advmss);
@@ -610,7 +597,7 @@ void tcp_rcv_space_adjust(struct sock *sk)
          * <prev RTT . ><current RTT .. ><next RTT .... >
          */
 
-        if (sysctl_tcp_moderate_rcvbuf &&
+        if (sock_net(sk)->ipv4.sysctl_tcp_moderate_rcvbuf &&
             !(sk->sk_userlocks & SOCK_RCVBUF_LOCK)) {
                 int rcvwin, rcvmem, rcvbuf;
 
@@ -634,10 +621,11 @@ void tcp_rcv_space_adjust(struct sock *sk)
                 }
 
                 rcvmem = SKB_TRUESIZE(tp->advmss + MAX_TCP_HEADER);
-                while (tcp_win_from_space(rcvmem) < tp->advmss)
+                while (tcp_win_from_space(sk, rcvmem) < tp->advmss)
                         rcvmem += 128;
 
-                rcvbuf = min(rcvwin / tp->advmss * rcvmem, sysctl_tcp_rmem[2]);
+                rcvbuf = min(rcvwin / tp->advmss * rcvmem,
+                             sock_net(sk)->ipv4.sysctl_tcp_rmem[2]);
                 if (rcvbuf > sk->sk_rcvbuf) {
                         sk->sk_rcvbuf = rcvbuf;
 
@@ -781,15 +769,6 @@ static void tcp_rtt_estimator(struct sock *sk, long mrtt_us)
         tp->srtt_us = max(1U, srtt);
 }
 
-/* Set the sk_pacing_rate to allow proper sizing of TSO packets.
- * Note: TCP stack does not yet implement pacing.
- * FQ packet scheduler can be used to implement cheap but effective
- * TCP pacing, to smooth the burst on large writes when packets
- * in flight is significantly lower than cwnd (or rwin)
- */
-int sysctl_tcp_pacing_ss_ratio __read_mostly = 200;
-int sysctl_tcp_pacing_ca_ratio __read_mostly = 120;
-
 static void tcp_update_pacing_rate(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
@@ -807,9 +786,9 @@ static void tcp_update_pacing_rate(struct sock *sk)
          *       end of slow start and should slow down.
          */
         if (tp->snd_cwnd < tp->snd_ssthresh / 2)
-                rate *= sysctl_tcp_pacing_ss_ratio;
+                rate *= sock_net(sk)->ipv4.sysctl_tcp_pacing_ss_ratio;
         else
-                rate *= sysctl_tcp_pacing_ca_ratio;
+                rate *= sock_net(sk)->ipv4.sysctl_tcp_pacing_ca_ratio;
 
         rate *= max(tp->snd_cwnd, tp->packets_out);
 
@@ -863,60 +842,46 @@ __u32 tcp_init_cwnd(const struct tcp_sock *tp, const struct dst_entry *dst)
         return min_t(__u32, cwnd, tp->snd_cwnd_clamp);
 }
 
-/*
- * Packet counting of FACK is based on in-order assumptions, therefore TCP
- * disables it when reordering is detected
- */
-void tcp_disable_fack(struct tcp_sock *tp)
-{
-        /* RFC3517 uses different metric in lost marker => reset on change */
-        if (tcp_is_fack(tp))
-                tp->lost_skb_hint = NULL;
-        tp->rx_opt.sack_ok &= ~TCP_FACK_ENABLED;
-}
-
 /* Take a notice that peer is sending D-SACKs */
 static void tcp_dsack_seen(struct tcp_sock *tp)
 {
         tp->rx_opt.sack_ok |= TCP_DSACK_SEEN;
+        tp->rack.dsack_seen = 1;
 }
 
-static void tcp_update_reordering(struct sock *sk, const int metric,
-                                  const int ts)
+/* It's reordering when higher sequence was delivered (i.e. sacked) before
+ * some lower never-retransmitted sequence ("low_seq"). The maximum reordering
+ * distance is approximated in full-mss packet distance ("reordering").
+ */
+static void tcp_check_sack_reordering(struct sock *sk, const u32 low_seq,
+                                      const int ts)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int mib_idx;
+        const u32 mss = tp->mss_cache;
+        u32 fack, metric;
 
-        if (WARN_ON_ONCE(metric < 0))
+        fack = tcp_highest_sack_seq(tp);
+        if (!before(low_seq, fack))
                 return;
 
-        if (metric > tp->reordering) {
-                tp->reordering = min(sysctl_tcp_max_reordering, metric);
-
+        metric = fack - low_seq;
+        if ((metric > tp->reordering * mss) && mss) {
 #if FASTRETRANS_DEBUG > 1
                 pr_debug("Disorder%d %d %u f%u s%u rr%d\n",
                          tp->rx_opt.sack_ok, inet_csk(sk)->icsk_ca_state,
                          tp->reordering,
-                         tp->fackets_out,
+                         0,
                          tp->sacked_out,
                          tp->undo_marker ? tp->undo_retrans : 0);
 #endif
-                tcp_disable_fack(tp);
+                tp->reordering = min_t(u32, (metric + mss - 1) / mss,
+                                       sock_net(sk)->ipv4.sysctl_tcp_max_reordering);
         }
 
         tp->rack.reord = 1;
-
         /* This exciting event is worth to be remembered. 8) */
-        if (ts)
-                mib_idx = LINUX_MIB_TCPTSREORDER;
-        else if (tcp_is_reno(tp))
-                mib_idx = LINUX_MIB_TCPRENOREORDER;
-        else if (tcp_is_fack(tp))
-                mib_idx = LINUX_MIB_TCPFACKREORDER;
-        else
-                mib_idx = LINUX_MIB_TCPSACKREORDER;
-
-        NET_INC_STATS(sock_net(sk), mib_idx);
+        NET_INC_STATS(sock_net(sk),
+                      ts ? LINUX_MIB_TCPTSREORDER : LINUX_MIB_TCPSACKREORDER);
 }
 
 /* This must be called before lost_out is incremented */
@@ -990,7 +955,6 @@ void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *skb)
  * 3. Loss detection event of two flavors:
  *      A. Scoreboard estimator decided the packet is lost.
  *         A'. Reno "three dupacks" marks head of queue lost.
- *         A''. Its FACK modification, head until snd.fack is lost.
  *      B. SACK arrives sacking SND.NXT at the moment, when the
  *         segment was retransmitted.
  * 4. D-SACK added new rule: D-SACK changes any tag to S.
@@ -1133,8 +1097,7 @@ static bool tcp_check_dsack(struct sock *sk, const struct sk_buff *ack_skb,
 }
 
 struct tcp_sacktag_state {
-        int     reord;
-        int     fack_count;
+        u32     reord;
         /* Timestamps for earliest and latest never-retransmitted segment
          * that was SACKed. RTO needs the earliest RTT to stay conservative,
          * but congestion control should still get an accurate delay signal.
@@ -1143,6 +1106,7 @@ struct tcp_sacktag_state {
         u64     last_sackt;
         struct rate_sample *rate;
         int     flag;
+        unsigned int mss_now;
 };
 
 /* Check if skb is fully within the SACK block. In presence of GSO skbs,
@@ -1192,7 +1156,8 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
                 if (pkt_len >= skb->len && !in_sack)
                         return 0;
 
-                err = tcp_fragment(sk, skb, pkt_len, mss, GFP_ATOMIC);
+                err = tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb,
+                                   pkt_len, mss, GFP_ATOMIC);
                 if (err < 0)
                         return err;
         }
@@ -1208,15 +1173,15 @@ static u8 tcp_sacktag_one(struct sock *sk,
                           u64 xmit_time)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int fack_count = state->fack_count;
 
         /* Account D-SACK for retransmitted packet. */
         if (dup_sack && (sacked & TCPCB_RETRANS)) {
                 if (tp->undo_marker && tp->undo_retrans > 0 &&
                     after(end_seq, tp->undo_marker))
                         tp->undo_retrans--;
-                if (sacked & TCPCB_SACKED_ACKED)
-                        state->reord = min(fack_count, state->reord);
+                if ((sacked & TCPCB_SACKED_ACKED) &&
+                    before(start_seq, state->reord))
+                                state->reord = start_seq;
         }
 
         /* Nothing to do; acked frame is about to be dropped (was ACKed). */
@@ -1242,9 +1207,10 @@ static u8 tcp_sacktag_one(struct sock *sk,
                                  * which was in hole. It is reordering.
                                  */
                                 if (before(start_seq,
-                                           tcp_highest_sack_seq(tp)))
-                                        state->reord = min(fack_count,
-                                                           state->reord);
+                                           tcp_highest_sack_seq(tp)) &&
+                                    before(start_seq, state->reord))
+                                        state->reord = start_seq;
+
                                 if (!after(end_seq, tp->high_seq))
                                         state->flag |= FLAG_ORIG_SACK_ACKED;
                                 if (state->first_sackt == 0)
@@ -1263,15 +1229,10 @@ static u8 tcp_sacktag_one(struct sock *sk,
                 tp->sacked_out += pcount;
                 tp->delivered += pcount;  /* Out-of-order packets delivered */
 
-                fack_count += pcount;
-
                 /* Lost marker hint past SACKed? Tweak RFC3517 cnt */
-                if (!tcp_is_fack(tp) && tp->lost_skb_hint &&
+                if (tp->lost_skb_hint &&
                     before(start_seq, TCP_SKB_CB(tp->lost_skb_hint)->seq))
                         tp->lost_cnt_hint += pcount;
-
-                if (fack_count > tp->fackets_out)
-                        tp->fackets_out = fack_count;
         }
 
         /* D-SACK. We can detect redundant retransmission in S|R and plain R
@@ -1289,13 +1250,13 @@ static u8 tcp_sacktag_one(struct sock *sk,
 /* Shift newly-SACKed bytes from this skb to the immediately previous
  * already-SACKed sk_buff. Mark the newly-SACKed bytes as such.
  */
-static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
+static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *prev,
+                            struct sk_buff *skb,
                             struct tcp_sacktag_state *state,
                             unsigned int pcount, int shifted, int mss,
                             bool dup_sack)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *prev = tcp_write_queue_prev(sk, skb);
         u32 start_seq = TCP_SKB_CB(skb)->seq;   /* start of newly-SACKed */
         u32 end_seq = start_seq + shifted;      /* end of newly-SACKed */
 
@@ -1364,8 +1325,7 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
         if (unlikely(TCP_SKB_CB(prev)->tx.delivered_mstamp))
                 TCP_SKB_CB(prev)->tx.delivered_mstamp = 0;
 
-        tcp_unlink_write_queue(skb, sk);
-        sk_wmem_free_skb(sk, skb);
+        tcp_rtx_queue_unlink_and_free(skb, sk);
 
         NET_INC_STATS(sock_net(sk), LINUX_MIB_SACKMERGED);
 
@@ -1415,9 +1375,9 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
                 goto fallback;
 
         /* Can only happen with delayed DSACK + discard craziness */
-        if (unlikely(skb == tcp_write_queue_head(sk)))
+        prev = skb_rb_prev(skb);
+        if (!prev)
                 goto fallback;
-        prev = tcp_write_queue_prev(sk, skb);
 
         if ((TCP_SKB_CB(prev)->sacked & TCPCB_TAGBITS) != TCPCB_SACKED_ACKED)
                 goto fallback;
@@ -1496,18 +1456,17 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
 
         if (!skb_shift(prev, skb, len))
                 goto fallback;
-        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
+        if (!tcp_shifted_skb(sk, prev, skb, state, pcount, len, mss, dup_sack))
                 goto out;
 
         /* Hole filled allows collapsing with the next as well, this is very
          * useful when hole on every nth skb pattern happens
          */
-        if (prev == tcp_write_queue_tail(sk))
+        skb = skb_rb_next(prev);
+        if (!skb)
                 goto out;
-        skb = tcp_write_queue_next(sk, prev);
 
         if (!skb_can_shift(skb) ||
-            (skb == tcp_send_head(sk)) ||
             ((TCP_SKB_CB(skb)->sacked & TCPCB_TAGBITS) != TCPCB_SACKED_ACKED) ||
             (mss != tcp_skb_seglen(skb)))
                 goto out;
@@ -1515,11 +1474,11 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
         len = skb->len;
         if (skb_shift(prev, skb, len)) {
                 pcount += tcp_skb_pcount(skb);
-                tcp_shifted_skb(sk, skb, state, tcp_skb_pcount(skb), len, mss, 0);
+                tcp_shifted_skb(sk, prev, skb, state, tcp_skb_pcount(skb),
+                                len, mss, 0);
         }
 
 out:
-        state->fack_count += pcount;
         return prev;
 
 noop:
@@ -1539,13 +1498,10 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *tmp;
 
-        tcp_for_write_queue_from(skb, sk) {
+        skb_rbtree_walk_from(skb) {
                 int in_sack = 0;
                 bool dup_sack = dup_sack_in;
 
-                if (skb == tcp_send_head(sk))
-                        break;
-
                 /* queue is in-order => we can short-circuit the walk early */
                 if (!before(TCP_SKB_CB(skb)->seq, end_seq))
                         break;
@@ -1594,34 +1550,48 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,
                                                 tcp_skb_pcount(skb),
                                                 skb->skb_mstamp);
                         tcp_rate_skb_delivered(sk, skb, state->rate);
+                        if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)
+                                list_del_init(&skb->tcp_tsorted_anchor);
 
                         if (!before(TCP_SKB_CB(skb)->seq,
                                     tcp_highest_sack_seq(tp)))
                                 tcp_advance_highest_sack(sk, skb);
                 }
-
-                state->fack_count += tcp_skb_pcount(skb);
         }
         return skb;
 }
 
-/* Avoid all extra work that is being done by sacktag while walking in
- * a normal way
- */
+static struct sk_buff *tcp_sacktag_bsearch(struct sock *sk,
+                                           struct tcp_sacktag_state *state,
+                                           u32 seq)
+{
+        struct rb_node *parent, **p = &sk->tcp_rtx_queue.rb_node;
+        struct sk_buff *skb;
+
+        while (*p) {
+                parent = *p;
+                skb = rb_to_skb(parent);
+                if (before(seq, TCP_SKB_CB(skb)->seq)) {
+                        p = &parent->rb_left;
+                        continue;
+                }
+                if (!before(seq, TCP_SKB_CB(skb)->end_seq)) {
+                        p = &parent->rb_right;
+                        continue;
+                }
+                return skb;
+        }
+        return NULL;
+}
+
 static struct sk_buff *tcp_sacktag_skip(struct sk_buff *skb, struct sock *sk,
                                         struct tcp_sacktag_state *state,
                                         u32 skip_to_seq)
 {
-        tcp_for_write_queue_from(skb, sk) {
-                if (skb == tcp_send_head(sk))
-                        break;
-
-                if (after(TCP_SKB_CB(skb)->end_seq, skip_to_seq))
-                        break;
+        if (skb && after(TCP_SKB_CB(skb)->seq, skip_to_seq))
+                return skb;
 
-                state->fack_count += tcp_skb_pcount(skb);
-        }
-        return skb;
+        return tcp_sacktag_bsearch(sk, state, skip_to_seq);
 }
 
 static struct sk_buff *tcp_maybe_skipping_dsack(struct sk_buff *skb,
@@ -1666,13 +1636,10 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
         int first_sack_index;
 
         state->flag = 0;
-        state->reord = tp->packets_out;
+        state->reord = tp->snd_nxt;
 
-        if (!tp->sacked_out) {
-                if (WARN_ON(tp->fackets_out))
-                        tp->fackets_out = 0;
+        if (!tp->sacked_out)
                 tcp_highest_sack_reset(sk);
-        }
 
         found_dup_sack = tcp_check_dsack(sk, ack_skb, sp_wire,
                                          num_sacks, prior_snd_una);
@@ -1743,8 +1710,8 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
                 }
         }
 
-        skb = tcp_write_queue_head(sk);
-        state->fack_count = 0;
+        state->mss_now = tcp_current_mss(sk);
+        skb = NULL;
         i = 0;
 
         if (!tp->sacked_out) {
@@ -1801,7 +1768,6 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
                                 skb = tcp_highest_sack(sk);
                                 if (!skb)
                                         break;
-                                state->fack_count = tp->fackets_out;
                                 cache++;
                                 goto walk;
                         }
@@ -1816,7 +1782,6 @@ tcp_sacktag_write_queue(struct sock *sk, const struct sk_buff *ack_skb,
                         skb = tcp_highest_sack(sk);
                         if (!skb)
                                 break;
-                        state->fack_count = tp->fackets_out;
                 }
                 skb = tcp_sacktag_skip(skb, sk, state, start_seq);
 
@@ -1836,9 +1801,8 @@ advance_sp:
         for (j = 0; j < used_sacks; j++)
                 tp->recv_sack_cache[i++] = sp[j];
 
-        if ((state->reord < tp->fackets_out) &&
-            ((inet_csk(sk)->icsk_ca_state != TCP_CA_Loss) || tp->undo_marker))
-                tcp_update_reordering(sk, tp->fackets_out - state->reord, 0);
+        if (inet_csk(sk)->icsk_ca_state != TCP_CA_Loss || tp->undo_marker)
+                tcp_check_sack_reordering(sk, state->reord, 0);
 
         tcp_verify_left_out(tp);
 out:
@@ -1876,8 +1840,13 @@ static bool tcp_limit_reno_sacked(struct tcp_sock *tp)
 static void tcp_check_reno_reordering(struct sock *sk, const int addend)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        if (tcp_limit_reno_sacked(tp))
-                tcp_update_reordering(sk, tp->packets_out + addend, 0);
+
+        if (!tcp_limit_reno_sacked(tp))
+                return;
+
+        tp->reordering = min_t(u32, tp->packets_out + addend,
+                               sock_net(sk)->ipv4.sysctl_tcp_max_reordering);
+        NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRENOREORDER);
 }
 
 /* Emulate SACKs for SACKless connection: account for a new dupack. */
@@ -1923,7 +1892,6 @@ void tcp_clear_retrans(struct tcp_sock *tp)
         tp->lost_out = 0;
         tp->undo_marker = 0;
         tp->undo_retrans = -1;
-        tp->fackets_out = 0;
         tp->sacked_out = 0;
 }
 
@@ -1968,19 +1936,15 @@ void tcp_enter_loss(struct sock *sk)
         if (tcp_is_reno(tp))
                 tcp_reset_reno_sack(tp);
 
-        skb = tcp_write_queue_head(sk);
+        skb = tcp_rtx_queue_head(sk);
         is_reneg = skb && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED);
         if (is_reneg) {
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSACKRENEGING);
                 tp->sacked_out = 0;
-                tp->fackets_out = 0;
         }
         tcp_clear_all_retrans_hints(tp);
 
-        tcp_for_write_queue(skb, sk) {
-                if (skb == tcp_send_head(sk))
-                        break;
-
+        skb_rbtree_walk_from(skb) {
                 mark_lost = (!(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
                              is_reneg);
                 if (mark_lost)
@@ -2014,7 +1978,7 @@ void tcp_enter_loss(struct sock *sk)
          * falsely raise the receive window, which results in repeated
          * timeouts and stop-and-go behavior.
          */
-        tp->frto = sysctl_tcp_frto &&
+        tp->frto = net->ipv4.sysctl_tcp_frto &&
                    (new_recovery || icsk->icsk_retransmits) &&
                    !inet_csk(sk)->icsk_mtup.probe_size;
 }
@@ -2043,19 +2007,10 @@ static bool tcp_check_sack_reneging(struct sock *sk, int flag)
         return false;
 }
 
-static inline int tcp_fackets_out(const struct tcp_sock *tp)
-{
-        return tcp_is_reno(tp) ? tp->sacked_out + 1 : tp->fackets_out;
-}
-
 /* Heurestics to calculate number of duplicate ACKs. There's no dupACKs
  * counter when SACK is enabled (without SACK, sacked_out is used for
  * that purpose).
  *
- * Instead, with FACK TCP uses fackets_out that includes both SACKed
- * segments up to the highest received SACK block so far and holes in
- * between them.
- *
  * With reordering, holes may still be in flight, so RFC3517 recovery
  * uses pure sacked_out (total number of SACKed segments) even though
  * it violates the RFC that uses duplicate ACKs, often these are equal
@@ -2065,10 +2020,10 @@ static inline int tcp_fackets_out(const struct tcp_sock *tp)
  */
 static inline int tcp_dupack_heuristics(const struct tcp_sock *tp)
 {
-        return tcp_is_fack(tp) ? tp->fackets_out : tp->sacked_out + 1;
+        return tp->sacked_out + 1;
 }
 
-/* Linux NewReno/SACK/FACK/ECN state machine.
+/* Linux NewReno/SACK/ECN state machine.
  * --------------------------------------
  *
  * "Open"       Normal state, no dubious events, fast path.
@@ -2133,16 +2088,6 @@ static inline int tcp_dupack_heuristics(const struct tcp_sock *tp)
  *              dynamically measured and adjusted. This is implemented in
  *              tcp_rack_mark_lost.
  *
- *              FACK (Disabled by default. Subsumbed by RACK):
- *              It is the simplest heuristics. As soon as we decided
- *              that something is lost, we decide that _all_ not SACKed
- *              packets until the most forward SACK are lost. I.e.
- *              lost_out = fackets_out - sacked_out and left_out = fackets_out.
- *              It is absolutely correct estimate, if network does not reorder
- *              packets. And it loses any connection to reality when reordering
- *              takes place. We use FACK by default until reordering
- *              is suspected on the path to this destination.
- *
  *              If the receiver does not support SACK:
  *
  *              NewReno (RFC6582): in Recovery we assume that one segment
@@ -2191,7 +2136,7 @@ static bool tcp_time_to_recover(struct sock *sk, int flag)
 }
 
 /* Detect loss in event "A" above by marking head of queue up as lost.
- * For FACK or non-SACK(Reno) senders, the first "packets" number of segments
+ * For non-SACK(Reno) senders, the first "packets" number of segments
  * are considered lost. For RFC3517 SACK, a segment is considered lost if it
  * has at least tp->reordering SACKed seqments above it; "packets" refers to
  * the maximum SACKed segments to pass before reaching this limit.
@@ -2206,20 +2151,18 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
         const u32 loss_high = tcp_is_sack(tp) ?  tp->snd_nxt : tp->high_seq;
 
         WARN_ON(packets > tp->packets_out);
-        if (tp->lost_skb_hint) {
-                skb = tp->lost_skb_hint;
-                cnt = tp->lost_cnt_hint;
+        skb = tp->lost_skb_hint;
+        if (skb) {
                 /* Head already handled? */
-                if (mark_head && skb != tcp_write_queue_head(sk))
+                if (mark_head && after(TCP_SKB_CB(skb)->seq, tp->snd_una))
                         return;
+                cnt = tp->lost_cnt_hint;
         } else {
-                skb = tcp_write_queue_head(sk);
+                skb = tcp_rtx_queue_head(sk);
                 cnt = 0;
         }
 
-        tcp_for_write_queue_from(skb, sk) {
-                if (skb == tcp_send_head(sk))
-                        break;
+        skb_rbtree_walk_from(skb) {
                 /* TODO: do this better */
                 /* this is not the most efficient way to do this... */
                 tp->lost_skb_hint = skb;
@@ -2229,12 +2172,12 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                         break;
 
                 oldcnt = cnt;
-                if (tcp_is_fack(tp) || tcp_is_reno(tp) ||
+                if (tcp_is_reno(tp) ||
                     (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                         cnt += tcp_skb_pcount(skb);
 
                 if (cnt > packets) {
-                        if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                        if (tcp_is_sack(tp) ||
                             (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
                             (oldcnt >= packets))
                                 break;
@@ -2243,7 +2186,8 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                         /* If needed, chop off the prefix to mark as lost. */
                         lost = (packets - oldcnt) * mss;
                         if (lost < skb->len &&
-                            tcp_fragment(sk, skb, lost, mss, GFP_ATOMIC) < 0)
+                            tcp_fragment(sk, TCP_FRAG_IN_RTX_QUEUE, skb,
+                                         lost, mss, GFP_ATOMIC) < 0)
                                 break;
                         cnt = packets;
                 }
@@ -2264,11 +2208,6 @@ static void tcp_update_scoreboard(struct sock *sk, int fast_rexmit)
 
         if (tcp_is_reno(tp)) {
                 tcp_mark_head_lost(sk, 1, 1);
-        } else if (tcp_is_fack(tp)) {
-                int lost = tp->fackets_out - tp->reordering;
-                if (lost <= 0)
-                        lost = 1;
-                tcp_mark_head_lost(sk, lost, 0);
         } else {
                 int sacked_upto = tp->sacked_out - tp->reordering;
                 if (sacked_upto >= 0)
@@ -2327,16 +2266,16 @@ static bool tcp_any_retrans_done(const struct sock *sk)
         if (tp->retrans_out)
                 return true;
 
-        skb = tcp_write_queue_head(sk);
+        skb = tcp_rtx_queue_head(sk);
         if (unlikely(skb && TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS))
                 return true;
 
         return false;
 }
 
-#if FASTRETRANS_DEBUG > 1
 static void DBGUNDO(struct sock *sk, const char *msg)
 {
+#if FASTRETRANS_DEBUG > 1
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
 
@@ -2358,10 +2297,8 @@ static void DBGUNDO(struct sock *sk, const char *msg)
                          tp->packets_out);
         }
 #endif
-}
-#else
-#define DBGUNDO(x...) do { } while (0)
 #endif
+}
 
 static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)
 {
@@ -2370,9 +2307,7 @@ static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)
         if (unmark_loss) {
                 struct sk_buff *skb;
 
-                tcp_for_write_queue(skb, sk) {
-                        if (skb == tcp_send_head(sk))
-                                break;
+                skb_rbtree_walk(skb, &sk->tcp_rtx_queue) {
                         TCP_SKB_CB(skb)->sacked &= ~TCPCB_LOST;
                 }
                 tp->lost_out = 0;
@@ -2417,6 +2352,8 @@ static bool tcp_try_undo_recovery(struct sock *sk)
                         mib_idx = LINUX_MIB_TCPFULLUNDO;
 
                 NET_INC_STATS(sock_net(sk), mib_idx);
+        } else if (tp->rack.reo_wnd_persist) {
+                tp->rack.reo_wnd_persist--;
         }
         if (tp->snd_una == tp->high_seq && tcp_is_reno(tp)) {
                 /* Hold old state until something *above* high_seq
@@ -2436,6 +2373,8 @@ static bool tcp_try_undo_dsack(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
 
         if (tp->undo_marker && !tp->undo_retrans) {
+                tp->rack.reo_wnd_persist = min(TCP_RACK_RECOVERY_THRESH,
+                                               tp->rack.reo_wnd_persist + 1);
                 DBGUNDO(sk, "D-SACK");
                 tcp_undo_cwnd_reduction(sk, false);
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPDSACKUNDO);
@@ -2616,9 +2555,7 @@ void tcp_simple_retransmit(struct sock *sk)
         struct sk_buff *skb;
         unsigned int mss = tcp_current_mss(sk);
 
-        tcp_for_write_queue(skb, sk) {
-                if (skb == tcp_send_head(sk))
-                        break;
+        skb_rbtree_walk(skb, &sk->tcp_rtx_queue) {
                 if (tcp_skb_seglen(skb) > mss &&
                     !(TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)) {
                         if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS) {
@@ -2712,7 +2649,7 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack,
                          * is updated in tcp_ack()). Otherwise fall back to
                          * the conventional recovery.
                          */
-                        if (tcp_send_head(sk) &&
+                        if (!tcp_write_queue_empty(sk) &&
                             after(tcp_wnd_end(tp), tp->snd_nxt)) {
                                 *rexmit = REXMIT_NEW;
                                 return;
@@ -2739,15 +2676,15 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack,
 }
 
 /* Undo during fast recovery after partial ACK. */
-static bool tcp_try_undo_partial(struct sock *sk, const int acked)
+static bool tcp_try_undo_partial(struct sock *sk, u32 prior_snd_una)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
         if (tp->undo_marker && tcp_packet_delayed(tp)) {
                 /* Plain luck! Hole if filled with delayed
-                 * packet, rather than with a retransmit.
+                 * packet, rather than with a retransmit. Check reordering.
                  */
-                tcp_update_reordering(sk, tcp_fackets_out(tp) + acked, 1);
+                tcp_check_sack_reordering(sk, prior_snd_una, 1);
 
                 /* We are getting evidence that the reordering degree is higher
                  * than we realized. If there are no retransmits out then we
@@ -2774,7 +2711,7 @@ static void tcp_rack_identify_loss(struct sock *sk, int *ack_flag)
         struct tcp_sock *tp = tcp_sk(sk);
 
         /* Use RACK to detect loss */
-        if (sysctl_tcp_recovery & TCP_RACK_LOSS_DETECTION) {
+        if (sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_LOSS_DETECTION) {
                 u32 prior_retrans = tp->retrans_out;
 
                 tcp_rack_mark_lost(sk);
@@ -2783,6 +2720,14 @@ static void tcp_rack_identify_loss(struct sock *sk, int *ack_flag)
         }
 }
 
+static bool tcp_force_fast_retransmit(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        return after(tcp_highest_sack_seq(tp),
+                     tp->snd_una + tp->reordering * tp->mss_cache);
+}
+
 /* Process an event, which can update packets-in-flight not trivially.
  * Main goal of this function is to calculate new estimate for left_out,
  * taking into account both packets sitting in receiver's buffer and
@@ -2795,19 +2740,17 @@ static void tcp_rack_identify_loss(struct sock *sk, int *ack_flag)
  * It does _not_ decide what to send, it is made in function
  * tcp_xmit_retransmit_queue().
  */
-static void tcp_fastretrans_alert(struct sock *sk, const int acked,
+static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una,
                                   bool is_dupack, int *ack_flag, int *rexmit)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         int fast_rexmit = 0, flag = *ack_flag;
         bool do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
-                                    (tcp_fackets_out(tp) > tp->reordering));
+                                     tcp_force_fast_retransmit(sk));
 
-        if (WARN_ON(!tp->packets_out && tp->sacked_out))
+        if (!tp->packets_out && tp->sacked_out)
                 tp->sacked_out = 0;
-        if (WARN_ON(!tp->sacked_out && tp->fackets_out))
-                tp->fackets_out = 0;
 
         /* Now state machine starts.
          * A. ECE, hence prohibit cwnd undoing, the reduction is required. */
@@ -2854,11 +2797,11 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked,
                         if (tcp_is_reno(tp) && is_dupack)
                                 tcp_add_reno_sack(sk);
                 } else {
-                        if (tcp_try_undo_partial(sk, acked))
+                        if (tcp_try_undo_partial(sk, prior_snd_una))
                                 return;
                         /* Partial ACK arrived. Force fast retransmit. */
                         do_lost = tcp_is_reno(tp) ||
-                                  tcp_fackets_out(tp) > tp->reordering;
+                                  tcp_force_fast_retransmit(sk);
                 }
                 if (tcp_try_undo_dsack(sk)) {
                         tcp_try_keep_open(sk);
@@ -2873,6 +2816,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked,
                       (*ack_flag & FLAG_LOST_RETRANS)))
                         return;
                 /* Change state if cwnd is undone or retransmits are lost */
+                /* fall through */
         default:
                 if (tcp_is_reno(tp)) {
                         if (flag & FLAG_SND_UNA_ADVANCED)
@@ -2913,8 +2857,8 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked,
 
 static void tcp_update_rtt_min(struct sock *sk, u32 rtt_us)
 {
+        u32 wlen = sock_net(sk)->ipv4.sysctl_tcp_min_rtt_wlen * HZ;
         struct tcp_sock *tp = tcp_sk(sk);
-        u32 wlen = sysctl_tcp_min_rtt_wlen * HZ;
 
         minmax_running_min(&tp->rtt_min, wlen, tcp_jiffies32,
                            rtt_us ? : jiffies_to_usecs(1));
@@ -3056,28 +3000,31 @@ static void tcp_ack_tstamp(struct sock *sk, struct sk_buff *skb,
 
         shinfo = skb_shinfo(skb);
         if (!before(shinfo->tskey, prior_snd_una) &&
-            before(shinfo->tskey, tcp_sk(sk)->snd_una))
-                __skb_tstamp_tx(skb, NULL, sk, SCM_TSTAMP_ACK);
+            before(shinfo->tskey, tcp_sk(sk)->snd_una)) {
+                tcp_skb_tsorted_save(skb) {
+                        __skb_tstamp_tx(skb, NULL, sk, SCM_TSTAMP_ACK);
+                } tcp_skb_tsorted_restore(skb);
+        }
 }
 
 /* Remove acknowledged frames from the retransmission queue. If our packet
  * is before the ack sequence we can discard it as it's confirmed to have
  * arrived at the other end.
  */
-static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
-                               u32 prior_snd_una, int *acked,
+static int tcp_clean_rtx_queue(struct sock *sk, u32 prior_fack,
+                               u32 prior_snd_una,
                                struct tcp_sacktag_state *sack)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u64 first_ackt, last_ackt;
         struct tcp_sock *tp = tcp_sk(sk);
         u32 prior_sacked = tp->sacked_out;
-        u32 reord = tp->packets_out;
+        u32 reord = tp->snd_nxt; /* lowest acked un-retx un-sacked seq */
+        struct sk_buff *skb, *next;
         bool fully_acked = true;
         long sack_rtt_us = -1L;
         long seq_rtt_us = -1L;
         long ca_rtt_us = -1L;
-        struct sk_buff *skb;
         u32 pkts_acked = 0;
         u32 last_in_flight = 0;
         bool rtt_update;
@@ -3085,8 +3032,9 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
 
         first_ackt = 0;
 
-        while ((skb = tcp_write_queue_head(sk)) && skb != tcp_send_head(sk)) {
+        for (skb = skb_rb_first(&sk->tcp_rtx_queue); skb; skb = next) {
                 struct tcp_skb_cb *scb = TCP_SKB_CB(skb);
+                const u32 start_seq = scb->seq;
                 u8 sacked = scb->sacked;
                 u32 acked_pcount;
 
@@ -3103,8 +3051,6 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                                 break;
                         fully_acked = false;
                 } else {
-                        /* Speedup tcp_unlink_write_queue() and next loop */
-                        prefetchw(skb->next);
                         acked_pcount = tcp_skb_pcount(skb);
                 }
 
@@ -3119,7 +3065,8 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                                 first_ackt = last_ackt;
 
                         last_in_flight = TCP_SKB_CB(skb)->tx.in_flight;
-                        reord = min(pkts_acked, reord);
+                        if (before(start_seq, reord))
+                                reord = start_seq;
                         if (!after(scb->end_seq, tp->high_seq))
                                 flag |= FLAG_ORIG_SACK_ACKED;
                 }
@@ -3156,12 +3103,12 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                 if (!fully_acked)
                         break;
 
-                tcp_unlink_write_queue(skb, sk);
-                sk_wmem_free_skb(sk, skb);
+                next = skb_rb_next(skb);
                 if (unlikely(skb == tp->retransmit_skb_hint))
                         tp->retransmit_skb_hint = NULL;
                 if (unlikely(skb == tp->lost_skb_hint))
                         tp->lost_skb_hint = NULL;
+                tcp_rtx_queue_unlink_and_free(skb, sk);
         }
 
         if (!skb)
@@ -3197,16 +3144,12 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                         int delta;
 
                         /* Non-retransmitted hole got filled? That's reordering */
-                        if (reord < prior_fackets && reord <= tp->fackets_out)
-                                tcp_update_reordering(sk, tp->fackets_out - reord, 0);
+                        if (before(reord, prior_fack))
+                                tcp_check_sack_reordering(sk, reord, 0);
 
-                        delta = tcp_is_fack(tp) ? pkts_acked :
-                                                  prior_sacked - tp->sacked_out;
+                        delta = prior_sacked - tp->sacked_out;
                         tp->lost_cnt_hint -= min(tp->lost_cnt_hint, delta);
                 }
-
-                tp->fackets_out -= min(pkts_acked, tp->fackets_out);
-
         } else if (skb && rtt_update && sack_rtt_us >= 0 &&
                    sack_rtt_us > tcp_stamp_us_delta(tp->tcp_mstamp, skb->skb_mstamp)) {
                 /* Do not re-arm RTO if the sack RTT is measured from data sent
@@ -3247,18 +3190,19 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                 }
         }
 #endif
-        *acked = pkts_acked;
         return flag;
 }
 
 static void tcp_ack_probe(struct sock *sk)
 {
-        const struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct sk_buff *head = tcp_send_head(sk);
+        const struct tcp_sock *tp = tcp_sk(sk);
 
         /* Was it a usable window open? */
-
-        if (!after(TCP_SKB_CB(tcp_send_head(sk))->end_seq, tcp_wnd_end(tp))) {
+        if (!head)
+                return;
+        if (!after(TCP_SKB_CB(head)->end_seq, tcp_wnd_end(tp))) {
                 icsk->icsk_backoff = 0;
                 inet_csk_clear_xmit_timer(sk, ICSK_TIME_PROBE0);
                 /* Socket must be waked up by subsequent tcp_data_snd_check().
@@ -3378,7 +3322,7 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
                         tp->pred_flags = 0;
                         tcp_fast_path_check(sk);
 
-                        if (tcp_send_head(sk))
+                        if (!tcp_write_queue_empty(sk))
                                 tcp_slow_start_after_idle_check(sk);
 
                         if (nwin > tp->max_window) {
@@ -3399,7 +3343,7 @@ static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
         if (*last_oow_ack_time) {
                 s32 elapsed = (s32)(tcp_jiffies32 - *last_oow_ack_time);
 
-                if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
+                if (0 <= elapsed && elapsed < net->ipv4.sysctl_tcp_invalid_ratelimit) {
                         NET_INC_STATS(net, mib_idx);
                         return true;    /* rate-limited: don't send yet! */
                 }
@@ -3435,10 +3379,11 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
         static u32 challenge_timestamp;
         static unsigned int challenge_count;
         struct tcp_sock *tp = tcp_sk(sk);
+        struct net *net = sock_net(sk);
         u32 count, now;
 
         /* First check our per-socket dupack rate limit. */
-        if (__tcp_oow_rate_limited(sock_net(sk),
+        if (__tcp_oow_rate_limited(net,
                                    LINUX_MIB_TCPACKSKIPPEDCHALLENGE,
                                    &tp->last_oow_ack_time))
                 return;
@@ -3446,16 +3391,16 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
         /* Then check host-wide RFC 5961 rate limit. */
         now = jiffies / HZ;
         if (now != challenge_timestamp) {
-                u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
+                u32 ack_limit = net->ipv4.sysctl_tcp_challenge_ack_limit;
+                u32 half = (ack_limit + 1) >> 1;
 
                 challenge_timestamp = now;
-                WRITE_ONCE(challenge_count, half +
-                           prandom_u32_max(sysctl_tcp_challenge_ack_limit));
+                WRITE_ONCE(challenge_count, half + prandom_u32_max(ack_limit));
         }
         count = READ_ONCE(challenge_count);
         if (count > 0) {
                 WRITE_ONCE(challenge_count, count - 1);
-                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
+                NET_INC_STATS(net, LINUX_MIB_TCPCHALLENGEACK);
                 tcp_send_ack(sk);
         }
 }
@@ -3553,18 +3498,17 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
         u32 ack_seq = TCP_SKB_CB(skb)->seq;
         u32 ack = TCP_SKB_CB(skb)->ack_seq;
         bool is_dupack = false;
-        u32 prior_fackets;
         int prior_packets = tp->packets_out;
         u32 delivered = tp->delivered;
         u32 lost = tp->lost;
-        int acked = 0; /* Number of packets newly acked */
         int rexmit = REXMIT_NONE; /* Flag to (re)transmit to recover losses */
+        u32 prior_fack;
 
         sack_state.first_sackt = 0;
         sack_state.rate = &rs;
 
-        /* We very likely will need to access write queue head. */
-        prefetchw(sk->sk_write_queue.next);
+        /* We very likely will need to access rtx queue. */
+        prefetch(sk->tcp_rtx_queue.rb_node);
 
         /* If the ack is older than previous acks
          * then we can probably ignore it.
@@ -3590,7 +3534,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                 icsk->icsk_retransmits = 0;
         }
 
-        prior_fackets = tp->fackets_out;
+        prior_fack = tcp_is_sack(tp) ? tcp_highest_sack_seq(tp) : tp->snd_una;
         rs.prior_in_flight = tcp_packets_in_flight(tp);
 
         /* ts_recent update must be made after we are sure that the packet
@@ -3646,8 +3590,9 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                 goto no_queue;
 
         /* See if we can take anything off of the retransmit queue. */
-        flag |= tcp_clean_rtx_queue(sk, prior_fackets, prior_snd_una, &acked,
-                                    &sack_state);
+        flag |= tcp_clean_rtx_queue(sk, prior_fack, prior_snd_una, &sack_state);
+
+        tcp_rack_update_reo_wnd(sk, &rs);
 
         if (tp->tlp_high_seq)
                 tcp_process_tlp_ack(sk, ack, flag);
@@ -3657,7 +3602,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 
         if (tcp_ack_is_dubious(sk, flag)) {
                 is_dupack = !(flag & (FLAG_SND_UNA_ADVANCED | FLAG_NOT_DUP));
-                tcp_fastretrans_alert(sk, acked, is_dupack, &flag, &rexmit);
+                tcp_fastretrans_alert(sk, prior_snd_una, is_dupack, &flag,
+                                      &rexmit);
         }
 
         if ((flag & FLAG_FORWARD_PROGRESS) || !(flag & FLAG_NOT_DUP))
@@ -3673,13 +3619,13 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 no_queue:
         /* If data was DSACKed, see if we can undo a cwnd reduction. */
         if (flag & FLAG_DSACKING_ACK)
-                tcp_fastretrans_alert(sk, acked, is_dupack, &flag, &rexmit);
+                tcp_fastretrans_alert(sk, prior_snd_una, is_dupack, &flag,
+                                      &rexmit);
         /* If this ack opens up a zero window, clear backoff.  It was
          * being used to time the probes, and is probably far higher than
          * it needs to be for normal retransmission.
          */
-        if (tcp_send_head(sk))
-                tcp_ack_probe(sk);
+        tcp_ack_probe(sk);
 
         if (tp->tlp_high_seq)
                 tcp_process_tlp_ack(sk, ack, flag);
@@ -3696,7 +3642,8 @@ old_ack:
         if (TCP_SKB_CB(skb)->sacked) {
                 flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una,
                                                 &sack_state);
-                tcp_fastretrans_alert(sk, acked, is_dupack, &flag, &rexmit);
+                tcp_fastretrans_alert(sk, prior_snd_una, is_dupack, &flag,
+                                      &rexmit);
                 tcp_xmit_recovery(sk, rexmit);
         }
 
@@ -3721,6 +3668,21 @@ static void tcp_parse_fastopen_option(int len, const unsigned char *cookie,
         foc->exp = exp_opt;
 }
 
+static void smc_parse_options(const struct tcphdr *th,
+                              struct tcp_options_received *opt_rx,
+                              const unsigned char *ptr,
+                              int opsize)
+{
+#if IS_ENABLED(CONFIG_SMC)
+        if (static_branch_unlikely(&tcp_have_smc)) {
+                if (th->syn && !(opsize & 1) &&
+                    opsize >= TCPOLEN_EXP_SMC_BASE &&
+                    get_unaligned_be32(ptr) == TCPOPT_SMC_MAGIC)
+                        opt_rx->smc_ok = 1;
+        }
+#endif
+}
+
 /* Look for tcp options. Normally only called on SYN and SYNACK packets.
  * But, this can also be called on packets in the established flow when
  * the fast version below fails.
@@ -3828,6 +3790,9 @@ void tcp_parse_options(const struct net *net,
                                         tcp_parse_fastopen_option(opsize -
                                                 TCPOLEN_EXP_FASTOPEN_BASE,
                                                 ptr + 2, th->syn, foc, true);
+                                else
+                                        smc_parse_options(th, opt_rx, ptr,
+                                                          opsize);
                                 break;
 
                         }
@@ -3995,6 +3960,8 @@ static inline bool tcp_sequence(const struct tcp_sock *tp, u32 seq, u32 end_seq)
 /* When we get a reset we do this. */
 void tcp_reset(struct sock *sk)
 {
+        trace_tcp_receive_reset(sk);
+
         /* We want the right error as BSD sees it (and indeed as we do). */
         switch (sk->sk_state) {
         case TCP_SYN_SENT:
@@ -4117,7 +4084,7 @@ static void tcp_dsack_set(struct sock *sk, u32 seq, u32 end_seq)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
-        if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
+        if (tcp_is_sack(tp) && sock_net(sk)->ipv4.sysctl_tcp_dsack) {
                 int mib_idx;
 
                 if (before(seq, tp->rcv_nxt))
@@ -4152,7 +4119,7 @@ static void tcp_send_dupack(struct sock *sk, const struct sk_buff *skb)
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKLOST);
                 tcp_enter_quickack_mode(sk);
 
-                if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
+                if (tcp_is_sack(tp) && sock_net(sk)->ipv4.sysctl_tcp_dsack) {
                         u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
                         if (after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))
@@ -4268,11 +4235,6 @@ static void tcp_sack_remove(struct tcp_sock *tp)
         tp->rx_opt.num_sacks = num_sacks;
 }
 
-enum tcp_queue {
-        OOO_QUEUE,
-        RCV_QUEUE,
-};
-
 /**
  * tcp_try_coalesce - try to merge skb to prior one
  * @sk: socket
@@ -4288,7 +4250,6 @@ enum tcp_queue {
  * Returns true if caller should free @from instead of queueing it
  */
 static bool tcp_try_coalesce(struct sock *sk,
-                             enum tcp_queue dest,
                              struct sk_buff *to,
                              struct sk_buff *from,
                              bool *fragstolen)
@@ -4313,10 +4274,7 @@ static bool tcp_try_coalesce(struct sock *sk,
 
         if (TCP_SKB_CB(from)->has_rxtstamp) {
                 TCP_SKB_CB(to)->has_rxtstamp = true;
-                if (dest == OOO_QUEUE)
-                        TCP_SKB_CB(to)->swtstamp = TCP_SKB_CB(from)->swtstamp;
-                else
-                        to->tstamp = from->tstamp;
+                to->tstamp = from->tstamp;
         }
 
         return true;
@@ -4341,7 +4299,7 @@ static void tcp_ofo_queue(struct sock *sk)
 
         p = rb_first(&tp->out_of_order_queue);
         while (p) {
-                skb = rb_entry(p, struct sk_buff, rbnode);
+                skb = rb_to_skb(p);
                 if (after(TCP_SKB_CB(skb)->seq, tp->rcv_nxt))
                         break;
 
@@ -4353,9 +4311,6 @@ static void tcp_ofo_queue(struct sock *sk)
                 }
                 p = rb_next(p);
                 rb_erase(&skb->rbnode, &tp->out_of_order_queue);
-                /* Replace tstamp which was stomped by rbnode */
-                if (TCP_SKB_CB(skb)->has_rxtstamp)
-                        skb->tstamp = TCP_SKB_CB(skb)->swtstamp;
 
                 if (unlikely(!after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))) {
                         SOCK_DEBUG(sk, "ofo packet was already received\n");
@@ -4367,8 +4322,7 @@ static void tcp_ofo_queue(struct sock *sk)
                            TCP_SKB_CB(skb)->end_seq);
 
                 tail = skb_peek_tail(&sk->sk_receive_queue);
-                eaten = tail && tcp_try_coalesce(sk, RCV_QUEUE,
-                                                 tail, skb, &fragstolen);
+                eaten = tail && tcp_try_coalesce(sk, tail, skb, &fragstolen);
                 tcp_rcv_nxt_update(tp, TCP_SKB_CB(skb)->end_seq);
                 fin = TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN;
                 if (!eaten)
@@ -4409,7 +4363,7 @@ static int tcp_try_rmem_schedule(struct sock *sk, struct sk_buff *skb,
 static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct rb_node **p, *q, *parent;
+        struct rb_node **p, *parent;
         struct sk_buff *skb1;
         u32 seq, end_seq;
         bool fragstolen;
@@ -4422,10 +4376,6 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
                 return;
         }
 
-        /* Stash tstamp to avoid being stomped on by rbnode */
-        if (TCP_SKB_CB(skb)->has_rxtstamp)
-                TCP_SKB_CB(skb)->swtstamp = skb->tstamp;
-
         /* Disable header prediction. */
         tp->pred_flags = 0;
         inet_csk_schedule_ack(sk);
@@ -4453,7 +4403,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
         /* In the typical case, we are adding an skb to the end of the list.
          * Use of ooo_last_skb avoids the O(Log(N)) rbtree lookup.
          */
-        if (tcp_try_coalesce(sk, OOO_QUEUE, tp->ooo_last_skb,
+        if (tcp_try_coalesce(sk, tp->ooo_last_skb,
                              skb, &fragstolen)) {
 coalesce_done:
                 tcp_grow_window(sk, skb);
@@ -4472,7 +4422,7 @@ coalesce_done:
         parent = NULL;
         while (*p) {
                 parent = *p;
-                skb1 = rb_entry(parent, struct sk_buff, rbnode);
+                skb1 = rb_to_skb(parent);
                 if (before(seq, TCP_SKB_CB(skb1)->seq)) {
                         p = &parent->rb_left;
                         continue;
@@ -4504,7 +4454,7 @@ coalesce_done:
                                 __kfree_skb(skb1);
                                 goto merge_right;
                         }
-                } else if (tcp_try_coalesce(sk, OOO_QUEUE, skb1,
+                } else if (tcp_try_coalesce(sk, skb1,
                                             skb, &fragstolen)) {
                         goto coalesce_done;
                 }
@@ -4517,9 +4467,7 @@ insert:
 
 merge_right:
         /* Remove other segments covered by skb. */
-        while ((q = rb_next(&skb->rbnode)) != NULL) {
-                skb1 = rb_entry(q, struct sk_buff, rbnode);
-
+        while ((skb1 = skb_rb_next(skb)) != NULL) {
                 if (!after(end_seq, TCP_SKB_CB(skb1)->seq))
                         break;
                 if (before(end_seq, TCP_SKB_CB(skb1)->end_seq)) {
@@ -4534,7 +4482,7 @@ merge_right:
                 tcp_drop(sk, skb1);
         }
         /* If there is no skb after us, we are the last_skb ! */
-        if (!q)
+        if (!skb1)
                 tp->ooo_last_skb = skb;
 
 add_sack:
@@ -4556,7 +4504,7 @@ static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb, int
 
         __skb_pull(skb, hdrlen);
         eaten = (tail &&
-                 tcp_try_coalesce(sk, RCV_QUEUE, tail,
+                 tcp_try_coalesce(sk, tail,
                                   skb, fragstolen)) ? 1 : 0;
         tcp_rcv_nxt_update(tcp_sk(sk), TCP_SKB_CB(skb)->end_seq);
         if (!eaten) {
@@ -4720,7 +4668,7 @@ static struct sk_buff *tcp_skb_next(struct sk_buff *skb, struct sk_buff_head *li
         if (list)
                 return !skb_queue_is_last(list, skb) ? skb->next : NULL;
 
-        return rb_entry_safe(rb_next(&skb->rbnode), struct sk_buff, rbnode);
+        return skb_rb_next(skb);
 }
 
 static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
@@ -4741,7 +4689,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
 }
 
 /* Insert skb into rb tree, ordered by TCP_SKB_CB(skb)->seq */
-static void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb)
+void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb)
 {
         struct rb_node **p = &root->rb_node;
         struct rb_node *parent = NULL;
@@ -4749,7 +4697,7 @@ static void tcp_rbtree_insert(struct rb_root *root, struct sk_buff *skb)
 
         while (*p) {
                 parent = *p;
-                skb1 = rb_entry(parent, struct sk_buff, rbnode);
+                skb1 = rb_to_skb(parent);
                 if (before(TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb1)->seq))
                         p = &parent->rb_left;
                 else
@@ -4796,7 +4744,7 @@ restart:
                  *   overlaps to the next one.
                  */
                 if (!(TCP_SKB_CB(skb)->tcp_flags & (TCPHDR_SYN | TCPHDR_FIN)) &&
-                    (tcp_win_from_space(skb->truesize) > skb->len ||
+                    (tcp_win_from_space(sk, skb->truesize) > skb->len ||
                      before(TCP_SKB_CB(skb)->seq, start))) {
                         end_of_skbs = false;
                         break;
@@ -4868,26 +4816,19 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb, *head;
-        struct rb_node *p;
         u32 start, end;
 
-        p = rb_first(&tp->out_of_order_queue);
-        skb = rb_entry_safe(p, struct sk_buff, rbnode);
+        skb = skb_rb_first(&tp->out_of_order_queue);
 new_range:
         if (!skb) {
-                p = rb_last(&tp->out_of_order_queue);
-                /* Note: This is possible p is NULL here. We do not
-                 * use rb_entry_safe(), as ooo_last_skb is valid only
-                 * if rbtree is not empty.
-                 */
-                tp->ooo_last_skb = rb_entry(p, struct sk_buff, rbnode);
+                tp->ooo_last_skb = skb_rb_last(&tp->out_of_order_queue);
                 return;
         }
         start = TCP_SKB_CB(skb)->seq;
         end = TCP_SKB_CB(skb)->end_seq;
 
         for (head = skb;;) {
-                skb = tcp_skb_next(skb, NULL);
+                skb = skb_rb_next(skb);
 
                 /* Range is terminated when we see a gap or when
                  * we are at the queue end.
@@ -4930,14 +4871,14 @@ static bool tcp_prune_ofo_queue(struct sock *sk)
         do {
                 prev = rb_prev(node);
                 rb_erase(node, &tp->out_of_order_queue);
-                tcp_drop(sk, rb_entry(node, struct sk_buff, rbnode));
+                tcp_drop(sk, rb_to_skb(node));
                 sk_mem_reclaim(sk);
                 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
                     !tcp_under_memory_pressure(sk))
                         break;
                 node = prev;
         } while (node);
-        tp->ooo_last_skb = rb_entry(prev, struct sk_buff, rbnode);
+        tp->ooo_last_skb = rb_to_skb(prev);
 
         /* Reset SACK state.  A conforming SACK implementation will
          * do the same at a timeout based retransmit.  When a connection
@@ -5112,7 +5053,7 @@ static void tcp_check_urg(struct sock *sk, const struct tcphdr *th)
         struct tcp_sock *tp = tcp_sk(sk);
         u32 ptr = ntohs(th->urg_ptr);
 
-        if (ptr && !sysctl_tcp_stdurg)
+        if (ptr && !sock_net(sk)->ipv4.sysctl_tcp_stdurg)
                 ptr--;
         ptr += ntohl(th->seq);
 
@@ -5532,20 +5473,13 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
                 security_inet_conn_established(sk, skb);
         }
 
-        /* Make sure socket is routed, for correct metrics.  */
-        icsk->icsk_af_ops->rebuild_header(sk);
-
-        tcp_init_metrics(sk);
-        tcp_call_bpf(sk, BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB);
-        tcp_init_congestion_control(sk);
+        tcp_init_transfer(sk, BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB);
 
         /* Prevent spurious tcp_cwnd_restart() on first data
          * packet.
          */
         tp->lsndtime = tcp_jiffies32;
 
-        tcp_init_buffer_space(sk);
-
         if (sock_flag(sk, SOCK_KEEPOPEN))
                 inet_csk_reset_keepalive_timer(sk, keepalive_time_when(tp));
 
@@ -5559,7 +5493,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
                                     struct tcp_fastopen_cookie *cookie)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct sk_buff *data = tp->syn_data ? tcp_write_queue_head(sk) : NULL;
+        struct sk_buff *data = tp->syn_data ? tcp_rtx_queue_head(sk) : NULL;
         u16 mss = tp->rx_opt.mss_clamp, try_exp = 0;
         bool syn_drop = false;
 
@@ -5594,9 +5528,8 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
         tcp_fastopen_cache_set(sk, mss, cookie, syn_drop, try_exp);
 
         if (data) { /* Retransmit unacked data in SYN */
-                tcp_for_write_queue_from(data, sk) {
-                        if (data == tcp_send_head(sk) ||
-                            __tcp_retransmit_skb(sk, data, 1))
+                skb_rbtree_walk_from(data) {
+                        if (__tcp_retransmit_skb(sk, data, 1))
                                 break;
                 }
                 tcp_rearm_rto(sk);
@@ -5614,6 +5547,16 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
         return false;
 }
 
+static void smc_check_reset_syn(struct tcp_sock *tp)
+{
+#if IS_ENABLED(CONFIG_SMC)
+        if (static_branch_unlikely(&tcp_have_smc)) {
+                if (tp->syn_smc && !tp->rx_opt.smc_ok)
+                        tp->syn_smc = 0;
+        }
+#endif
+}
+
 static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                                          const struct tcphdr *th)
 {
@@ -5709,10 +5652,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                         tp->tcp_header_len = sizeof(struct tcphdr);
                 }
 
-                if (tcp_is_sack(tp) && sysctl_tcp_fack)
-                        tcp_enable_fack(tp);
-
-                tcp_mtup_init(sk);
                 tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
                 tcp_initialize_rcv_mss(sk);
 
@@ -5721,6 +5660,8 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                  * is initialized. */
                 tp->copied_seq = tp->rcv_nxt;
 
+                smc_check_reset_syn(tp);
+
                 smp_mb();
 
                 tcp_finish_connect(sk, skb);
@@ -5938,15 +5879,18 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
                 if (req) {
                         inet_csk(sk)->icsk_retransmits = 0;
                         reqsk_fastopen_remove(sk, req, false);
+                        /* Re-arm the timer because data may have been sent out.
+                         * This is similar to the regular data transmission case
+                         * when new data has just been ack'ed.
+                         *
+                         * (TFO) - we could try to be more aggressive and
+                         * retransmitting any data sooner based on when they
+                         * are sent out.
+                         */
+                        tcp_rearm_rto(sk);
                 } else {
-                        /* Make sure socket is routed, for correct metrics. */
-                        icsk->icsk_af_ops->rebuild_header(sk);
-                        tcp_call_bpf(sk, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB);
-                        tcp_init_congestion_control(sk);
-
-                        tcp_mtup_init(sk);
+                        tcp_init_transfer(sk, BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB);
                         tp->copied_seq = tp->rcv_nxt;
-                        tcp_init_buffer_space(sk);
                 }
                 smp_mb();
                 tcp_set_state(sk, TCP_ESTABLISHED);
@@ -5966,19 +5910,6 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
                 if (tp->rx_opt.tstamp_ok)
                         tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
 
-                if (req) {
-                        /* Re-arm the timer because data may have been sent out.
-                         * This is similar to the regular data transmission case
-                         * when new data has just been ack'ed.
-                         *
-                         * (TFO) - we could try to be more aggressive and
-                         * retransmitting any data sooner based on when they
-                         * are sent out.
-                         */
-                        tcp_rearm_rto(sk);
-                } else
-                        tcp_init_metrics(sk);
-
                 if (!inet_csk(sk)->icsk_ca_ops->cong_control)
                         tcp_update_pacing_rate(sk);
 
@@ -6075,6 +6006,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
         case TCP_LAST_ACK:
                 if (!before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt))
                         break;
+                /* fall through */
         case TCP_FIN_WAIT1:
         case TCP_FIN_WAIT2:
                 /* RFC 793 says to queue data in these states,
@@ -6183,6 +6115,9 @@ static void tcp_openreq_init(struct request_sock *req,
         ireq->ir_rmt_port = tcp_hdr(skb)->source;
         ireq->ir_num = ntohs(tcp_hdr(skb)->dest);
         ireq->ir_mark = inet_request_mark(sk, skb);
+#if IS_ENABLED(CONFIG_SMC)
+        ireq->smc_ok = rx_opt->smc_ok;
+#endif
 }
 
 struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
@@ -6358,7 +6293,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
         tcp_openreq_init_rwin(req, sk, dst);
         if (!want_cookie) {
                 tcp_reqsk_record_syn(sk, req, skb);
-                fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc);
+                fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc, dst);
         }
         if (fastopen_sk) {
                 af_ops->send_synack(fastopen_sk, dst, &fl, req,