Patched in Tegra support.

1 files changed, 328 insertions, 563 deletions

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2aa69c8ae60..09ced58e6a5 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -245,8 +245,6 @@
  *      TCP_CLOSE               socket is finished
  */
 
-#define pr_fmt(fmt) "TCP: " fmt
-
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/types.h>
@@ -268,12 +266,15 @@
 #include <linux/crypto.h>
 #include <linux/time.h>
 #include <linux/slab.h>
+#include <linux/uid_stat.h>
 
 #include <net/icmp.h>
-#include <net/inet_common.h>
 #include <net/tcp.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
+#include <net/ip6_route.h>
+#include <net/ipv6.h>
+#include <net/transp_v6.h>
 #include <net/netdma.h>
 #include <net/sock.h>
 
@@ -285,9 +286,11 @@ int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
 struct percpu_counter tcp_orphan_count;
 EXPORT_SYMBOL_GPL(tcp_orphan_count);
 
+long sysctl_tcp_mem[3] __read_mostly;
 int sysctl_tcp_wmem[3] __read_mostly;
 int sysctl_tcp_rmem[3] __read_mostly;
 
+EXPORT_SYMBOL(sysctl_tcp_mem);
 EXPORT_SYMBOL(sysctl_tcp_rmem);
 EXPORT_SYMBOL(sysctl_tcp_wmem);
 
@@ -364,72 +367,6 @@ static int retrans_to_secs(u8 retrans, int timeout, int rto_max)
         return period;
 }
 
-/* Address-family independent initialization for a tcp_sock.
- *
- * NOTE: A lot of things set to zero explicitly by call to
- *       sk_alloc() so need not be done here.
- */
-void tcp_init_sock(struct sock *sk)
-{
-        struct inet_connection_sock *icsk = inet_csk(sk);
-        struct tcp_sock *tp = tcp_sk(sk);
-
-        skb_queue_head_init(&tp->out_of_order_queue);
-        tcp_init_xmit_timers(sk);
-        tcp_prequeue_init(tp);
-        INIT_LIST_HEAD(&tp->tsq_node);
-
-        icsk->icsk_rto = TCP_TIMEOUT_INIT;
-        tp->mdev = TCP_TIMEOUT_INIT;
-
-        /* So many TCP implementations out there (incorrectly) count the
-         * initial SYN frame in their delayed-ACK and congestion control
-         * algorithms that we must have the following bandaid to talk
-         * efficiently to them.  -DaveM
-         */
-        tp->snd_cwnd = TCP_INIT_CWND;
-
-        /* See draft-stevens-tcpca-spec-01 for discussion of the
-         * initialization of these values.
-         */
-        tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
-        tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache = TCP_MSS_DEFAULT;
-
-        tp->reordering = sysctl_tcp_reordering;
-        tcp_enable_early_retrans(tp);
-        icsk->icsk_ca_ops = &tcp_init_congestion_ops;
-
-        sk->sk_state = TCP_CLOSE;
-
-        sk->sk_write_space = sk_stream_write_space;
-        sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
-
-        icsk->icsk_sync_mss = tcp_sync_mss;
-
-        /* TCP Cookie Transactions */
-        if (sysctl_tcp_cookie_size > 0) {
-                /* Default, cookies without s_data_payload. */
-                tp->cookie_values =
-                        kzalloc(sizeof(*tp->cookie_values),
-                                sk->sk_allocation);
-                if (tp->cookie_values != NULL)
-                        kref_init(&tp->cookie_values->kref);
-        }
-        /* Presumed zeroed, in order of appearance:
-         *      cookie_in_always, cookie_out_never,
-         *      s_data_constant, s_data_in, s_data_out
-         */
-        sk->sk_sndbuf = sysctl_tcp_wmem[1];
-        sk->sk_rcvbuf = sysctl_tcp_rmem[1];
-
-        local_bh_disable();
-        sock_update_memcg(sk);
-        sk_sockets_allocated_inc(sk);
-        local_bh_enable();
-}
-EXPORT_SYMBOL(tcp_init_sock);
-
 /*
  *      Wait for a TCP event.
  *
@@ -441,7 +378,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
         unsigned int mask;
         struct sock *sk = sock->sk;
-        const struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
 
         sock_poll_wait(file, sk_sleep(sk), wait);
         if (sk->sk_state == TCP_LISTEN)
@@ -486,9 +423,8 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
         if (sk->sk_shutdown & RCV_SHUTDOWN)
                 mask |= POLLIN | POLLRDNORM | POLLRDHUP;
 
-        /* Connected or passive Fast Open socket? */
-        if (sk->sk_state != TCP_SYN_SENT &&
-            (sk->sk_state != TCP_SYN_RECV || tp->fastopen_rsk != NULL)) {
+        /* Connected? */
+        if ((1 << sk->sk_state) & ~(TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 int target = sock_rcvlowat(sk, 0, INT_MAX);
 
                 if (tp->urg_seq == tp->copied_seq &&
@@ -536,29 +472,30 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int answ;
-        bool slow;
 
         switch (cmd) {
         case SIOCINQ:
                 if (sk->sk_state == TCP_LISTEN)
                         return -EINVAL;
 
-                slow = lock_sock_fast(sk);
+                lock_sock(sk);
                 if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))
                         answ = 0;
                 else if (sock_flag(sk, SOCK_URGINLINE) ||
                          !tp->urg_data ||
                          before(tp->urg_seq, tp->copied_seq) ||
                          !before(tp->urg_seq, tp->rcv_nxt)) {
+                        struct sk_buff *skb;
 
                         answ = tp->rcv_nxt - tp->copied_seq;
 
-                        /* Subtract 1, if FIN was received */
-                        if (answ && sock_flag(sk, SOCK_DONE))
-                                answ--;
+                        /* Subtract 1, if FIN is in queue. */
+                        skb = skb_peek_tail(&sk->sk_receive_queue);
+                        if (answ && skb)
+                                answ -= tcp_hdr(skb)->fin;
                 } else
                         answ = tp->urg_seq - tp->copied_seq;
-                unlock_sock_fast(sk, slow);
+                release_sock(sk);
                 break;
         case SIOCATMARK:
                 answ = tp->urg_data && tp->urg_seq == tp->copied_seq;
@@ -591,11 +528,11 @@ EXPORT_SYMBOL(tcp_ioctl);
 
 static inline void tcp_mark_push(struct tcp_sock *tp, struct sk_buff *skb)
 {
-        TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
+        TCP_SKB_CB(skb)->flags |= TCPHDR_PSH;
         tp->pushed_seq = tp->write_seq;
 }
 
-static inline bool forced_push(const struct tcp_sock *tp)
+static inline int forced_push(struct tcp_sock *tp)
 {
         return after(tp->write_seq, tp->pushed_seq + (tp->max_window >> 1));
 }
@@ -607,7 +544,7 @@ static inline void skb_entail(struct sock *sk, struct sk_buff *skb)
 
         skb->csum    = 0;
         tcb->seq     = tcb->end_seq = tp->write_seq;
-        tcb->tcp_flags = TCPHDR_ACK;
+        tcb->flags   = TCPHDR_ACK;
         tcb->sacked  = 0;
         skb_header_release(skb);
         tcp_add_write_queue_tail(sk, skb);
@@ -768,12 +705,11 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
         skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
         if (skb) {
                 if (sk_wmem_schedule(sk, skb->truesize)) {
-                        skb_reserve(skb, sk->sk_prot->max_header);
                         /*
                          * Make sure that we have exactly size bytes
                          * available to the caller, no more, no less.
                          */
-                        skb->avail_size = size;
+                        skb_reserve(skb, skb_tailroom(skb) - size);
                         return skb;
                 }
                 __kfree_skb(skb);
@@ -798,10 +734,6 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
                                   inet_csk(sk)->icsk_ext_hdr_len -
                                   tp->tcp_header_len);
 
-                /* TSQ : try to have two TSO segments in flight */
-                xmit_size_goal = min_t(u32, xmit_size_goal,
-                                       sysctl_tcp_limit_output_bytes >> 1);
-
                 xmit_size_goal = tcp_bound_to_half_wnd(tp, xmit_size_goal);
 
                 /* We try hard to avoid divides here */
@@ -811,9 +743,7 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now,
                            old_size_goal + mss_now > xmit_size_goal)) {
                         xmit_size_goal = old_size_goal;
                 } else {
-                        tp->xmit_size_goal_segs =
-                                min_t(u16, xmit_size_goal / mss_now,
-                                      sk->sk_gso_max_segs);
+                        tp->xmit_size_goal_segs = xmit_size_goal / mss_now;
                         xmit_size_goal = tp->xmit_size_goal_segs * mss_now;
                 }
         }
@@ -831,8 +761,8 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags)
         return mss_now;
 }
 
-static ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
-                                size_t size, int flags)
+static ssize_t do_tcp_sendpages(struct sock *sk, struct page **pages, int poffset,
+                         size_t psize, int flags)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int mss_now, size_goal;
@@ -840,15 +770,10 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
         ssize_t copied;
         long timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
 
-        /* Wait for a connection to finish. One exception is TCP Fast Open
-         * (passive side) where data is allowed to be sent before a connection
-         * is fully established.
-         */
-        if (((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) &&
-            !tcp_passive_fastopen(sk)) {
+        /* Wait for a connection to finish. */
+        if ((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT))
                 if ((err = sk_stream_wait_connect(sk, &timeo)) != 0)
                         goto out_err;
-        }
 
         clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
 
@@ -859,10 +784,12 @@ static ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
         if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                 goto out_err;
 
-        while (size > 0) {
+        while (psize > 0) {
                 struct sk_buff *skb = tcp_write_queue_tail(sk);
-                int copy, i;
-                bool can_coalesce;
+                struct page *page = pages[poffset / PAGE_SIZE];
+                int copy, i, can_coalesce;
+                int offset = poffset % PAGE_SIZE;
+                int size = min_t(size_t, psize, PAGE_SIZE - offset);
 
                 if (!tcp_send_head(sk) || (copy = size_goal - skb->len) <= 0) {
 new_segment:
@@ -890,7 +817,7 @@ new_segment:
                         goto wait_for_memory;
 
                 if (can_coalesce) {
-                        skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
+                        skb_shinfo(skb)->frags[i - 1].size += copy;
                 } else {
                         get_page(page);
                         skb_fill_page_desc(skb, i, page, offset, copy);
@@ -907,11 +834,11 @@ new_segment:
                 skb_shinfo(skb)->gso_segs = 0;
 
                 if (!copied)
-                        TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_PSH;
+                        TCP_SKB_CB(skb)->flags &= ~TCPHDR_PSH;
 
                 copied += copy;
-                offset += copy;
-                if (!(size -= copy))
+                poffset += copy;
+                if (!(psize -= copy))
                         goto out;
 
                 if (skb->len < size_goal || (flags & MSG_OOB))
@@ -927,7 +854,8 @@ new_segment:
 wait_for_sndbuf:
                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                if (copied)
+                        tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
 
                 if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                         goto do_error;
@@ -936,7 +864,7 @@ wait_for_memory:
         }
 
 out:
-        if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
+        if (copied)
                 tcp_push(sk, flags, mss_now, tp->nonagle);
         return copied;
 
@@ -958,24 +886,24 @@ int tcp_sendpage(struct sock *sk, struct page *page, int offset,
                                         flags);
 
         lock_sock(sk);
-        res = do_tcp_sendpages(sk, page, offset, size, flags);
+        res = do_tcp_sendpages(sk, &page, offset, size, flags);
         release_sock(sk);
         return res;
 }
 EXPORT_SYMBOL(tcp_sendpage);
 
-static inline int select_size(const struct sock *sk, bool sg)
+#define TCP_PAGE(sk)    (sk->sk_sndmsg_page)
+#define TCP_OFF(sk)     (sk->sk_sndmsg_off)
+
+static inline int select_size(struct sock *sk, int sg)
 {
-        const struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
         int tmp = tp->mss_cache;
 
         if (sg) {
-                if (sk_can_gso(sk)) {
-                        /* Small frames wont use a full page:
-                         * Payload will immediately follow tcp header.
-                         */
-                        tmp = SKB_WITH_OVERHEAD(2048 - MAX_TCP_HEADER);
-                } else {
+                if (sk_can_gso(sk))
+                        tmp = 0;
+                else {
                         int pgbreak = SKB_MAX_HEAD(MAX_TCP_HEADER);
 
                         if (tmp >= pgbreak &&
@@ -987,86 +915,27 @@ static inline int select_size(const struct sock *sk, bool sg)
         return tmp;
 }
 
-void tcp_free_fastopen_req(struct tcp_sock *tp)
-{
-        if (tp->fastopen_req != NULL) {
-                kfree(tp->fastopen_req);
-                tp->fastopen_req = NULL;
-        }
-}
-
-static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, int *size)
-{
-        struct tcp_sock *tp = tcp_sk(sk);
-        int err, flags;
-
-        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE))
-                return -EOPNOTSUPP;
-        if (tp->fastopen_req != NULL)
-                return -EALREADY; /* Another Fast Open is in progress */
-
-        tp->fastopen_req = kzalloc(sizeof(struct tcp_fastopen_request),
-                                   sk->sk_allocation);
-        if (unlikely(tp->fastopen_req == NULL))
-                return -ENOBUFS;
-        tp->fastopen_req->data = msg;
-
-        flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
-        err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
-                                    msg->msg_namelen, flags);
-        *size = tp->fastopen_req->copied;
-        tcp_free_fastopen_req(tp);
-        return err;
-}
-
 int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 size_t size)
 {
         struct iovec *iov;
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
-        int iovlen, flags, err, copied = 0;
-        int mss_now = 0, size_goal, copied_syn = 0, offset = 0;
-        bool sg;
+        int iovlen, flags;
+        int mss_now, size_goal;
+        int sg, err, copied;
         long timeo;
 
         lock_sock(sk);
 
         flags = msg->msg_flags;
-        if (flags & MSG_FASTOPEN) {
-                err = tcp_sendmsg_fastopen(sk, msg, &copied_syn);
-                if (err == -EINPROGRESS && copied_syn > 0)
-                        goto out;
-                else if (err)
-                        goto out_err;
-                offset = copied_syn;
-        }
-
         timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT);
 
-        /* Wait for a connection to finish. One exception is TCP Fast Open
-         * (passive side) where data is allowed to be sent before a connection
-         * is fully established.
-         */
-        if (((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) &&
-            !tcp_passive_fastopen(sk)) {
+        /* Wait for a connection to finish. */
+        if ((1 << sk->sk_state) & ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT))
                 if ((err = sk_stream_wait_connect(sk, &timeo)) != 0)
-                        goto do_error;
-        }
-
-        if (unlikely(tp->repair)) {
-                if (tp->repair_queue == TCP_RECV_QUEUE) {
-                        copied = tcp_send_rcvq(sk, msg, size);
-                        goto out;
-                }
-
-                err = -EINVAL;
-                if (tp->repair_queue == TCP_NO_QUEUE)
                         goto out_err;
 
-                /* 'common' sending to sendq */
-        }
-
         /* This should be in poll */
         clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
 
@@ -1081,22 +950,13 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                 goto out_err;
 
-        sg = !!(sk->sk_route_caps & NETIF_F_SG);
+        sg = sk->sk_route_caps & NETIF_F_SG;
 
         while (--iovlen >= 0) {
                 size_t seglen = iov->iov_len;
                 unsigned char __user *from = iov->iov_base;
 
                 iov++;
-                if (unlikely(offset > 0)) {  /* Skip bytes copied in SYN */
-                        if (offset >= seglen) {
-                                offset -= seglen;
-                                continue;
-                        }
-                        seglen -= offset;
-                        from += offset;
-                        offset = 0;
-                }
 
                 while (seglen > 0) {
                         int copy = 0;
@@ -1139,54 +999,86 @@ new_segment:
                                 copy = seglen;
 
                         /* Where to copy to? */
-                        if (skb_availroom(skb) > 0) {
+                        if (skb_tailroom(skb) > 0) {
                                 /* We have some space in skb head. Superb! */
-                                copy = min_t(int, copy, skb_availroom(skb));
+                                if (copy > skb_tailroom(skb))
+                                        copy = skb_tailroom(skb);
                                 err = skb_add_data_nocache(sk, skb, from, copy);
                                 if (err)
                                         goto do_fault;
                         } else {
-                                bool merge = true;
+                                int merge = 0;
                                 int i = skb_shinfo(skb)->nr_frags;
-                                struct page_frag *pfrag = sk_page_frag(sk);
-
-                                if (!sk_page_frag_refill(sk, pfrag))
-                                        goto wait_for_memory;
-
-                                if (!skb_can_coalesce(skb, i, pfrag->page,
-                                                      pfrag->offset)) {
-                                        if (i == MAX_SKB_FRAGS || !sg) {
-                                                tcp_mark_push(tp, skb);
-                                                goto new_segment;
+                                struct page *page = TCP_PAGE(sk);
+                                int off = TCP_OFF(sk);
+
+                                if (skb_can_coalesce(skb, i, page, off) &&
+                                    off != PAGE_SIZE) {
+                                        /* We can extend the last page
+                                         * fragment. */
+                                        merge = 1;
+                                } else if (i == MAX_SKB_FRAGS || !sg) {
+                                        /* Need to add new fragment and cannot
+                                         * do this because interface is non-SG,
+                                         * or because all the page slots are
+                                         * busy. */
+                                        tcp_mark_push(tp, skb);
+                                        goto new_segment;
+                                } else if (page) {
+                                        if (off == PAGE_SIZE) {
+                                                put_page(page);
+                                                TCP_PAGE(sk) = page = NULL;
+                                                off = 0;
                                         }
-                                        merge = false;
-                                }
+                                } else
+                                        off = 0;
 
-                                copy = min_t(int, copy, pfrag->size - pfrag->offset);
+                                if (copy > PAGE_SIZE - off)
+                                        copy = PAGE_SIZE - off;
 
                                 if (!sk_wmem_schedule(sk, copy))
                                         goto wait_for_memory;
 
+                                if (!page) {
+                                        /* Allocate new cache page. */
+                                        if (!(page = sk_stream_alloc_page(sk)))
+                                                goto wait_for_memory;
+                                }
+
+                                /* Time to copy data. We are close to
+                                 * the end! */
                                 err = skb_copy_to_page_nocache(sk, from, skb,
-                                                               pfrag->page,
-                                                               pfrag->offset,
-                                                               copy);
-                                if (err)
+                                                               page, off, copy);
+                                if (err) {
+                                        /* If this page was new, give it to the
+                                         * socket so it does not get leaked.
+                                         */
+                                        if (!TCP_PAGE(sk)) {
+                                                TCP_PAGE(sk) = page;
+                                                TCP_OFF(sk) = 0;
+                                        }
                                         goto do_error;
+                                }
 
                                 /* Update the skb. */
                                 if (merge) {
-                                        skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
+                                        skb_shinfo(skb)->frags[i - 1].size +=
+                                                                        copy;
                                 } else {
-                                        skb_fill_page_desc(skb, i, pfrag->page,
-                                                           pfrag->offset, copy);
-                                        get_page(pfrag->page);
+                                        skb_fill_page_desc(skb, i, page, off, copy);
+                                        if (TCP_PAGE(sk)) {
+                                                get_page(page);
+                                        } else if (off + copy < PAGE_SIZE) {
+                                                get_page(page);
+                                                TCP_PAGE(sk) = page;
+                                        }
                                 }
-                                pfrag->offset += copy;
+
+                                TCP_OFF(sk) = off + copy;
                         }
 
                         if (!copied)
-                                TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_PSH;
+                                TCP_SKB_CB(skb)->flags &= ~TCPHDR_PSH;
 
                         tp->write_seq += copy;
                         TCP_SKB_CB(skb)->end_seq += copy;
@@ -1197,7 +1089,7 @@ new_segment:
                         if ((seglen -= copy) == 0 && iovlen == 0)
                                 goto out;
 
-                        if (skb->len < max || (flags & MSG_OOB) || unlikely(tp->repair))
+                        if (skb->len < max || (flags & MSG_OOB))
                                 continue;
 
                         if (forced_push(tp)) {
@@ -1224,7 +1116,10 @@ out:
         if (copied)
                 tcp_push(sk, flags, mss_now, tp->nonagle);
         release_sock(sk);
-        return copied + copied_syn;
+
+        if (copied > 0)
+                uid_stat_tcp_snd(current_uid(), copied);
+        return copied;
 
 do_fault:
         if (!skb->len) {
@@ -1237,7 +1132,7 @@ do_fault:
         }
 
 do_error:
-        if (copied + copied_syn)
+        if (copied)
                 goto out;
 out_err:
         err = sk_stream_error(sk, flags, err);
@@ -1295,24 +1190,6 @@ static int tcp_recv_urg(struct sock *sk, struct msghdr *msg, int len, int flags)
         return -EAGAIN;
 }
 
-static int tcp_peek_sndq(struct sock *sk, struct msghdr *msg, int len)
-{
-        struct sk_buff *skb;
-        int copied = 0, err = 0;
-
-        /* XXX -- need to support SO_PEEK_OFF */
-
-        skb_queue_walk(&sk->sk_write_queue, skb) {
-                err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, skb->len);
-                if (err)
-                        break;
-
-                copied += skb->len;
-        }
-
-        return err ?: copied;
-}
-
 /* Clean up the receive buffer for full frames taken by the user,
  * then send an ACK if necessary.  COPIED is the number of bytes
  * tcp_recvmsg has given to the user so far, it speeds up the
@@ -1322,13 +1199,15 @@ static int tcp_peek_sndq(struct sock *sk, struct msghdr *msg, int len)
 void tcp_cleanup_rbuf(struct sock *sk, int copied)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        bool time_to_ack = false;
+        int time_to_ack = 0;
 
+#if TCP_DEBUG
         struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 
         WARN(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq),
              "cleanup rbuf bug: copied %X seq %X rcvnxt %X\n",
              tp->copied_seq, TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt);
+#endif
 
         if (inet_csk_ack_scheduled(sk)) {
                 const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -1348,7 +1227,7 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
                       ((icsk->icsk_ack.pending & ICSK_ACK_PUSHED) &&
                        !icsk->icsk_ack.pingpong)) &&
                       !atomic_read(&sk->sk_rmem_alloc)))
-                        time_to_ack = true;
+                        time_to_ack = 1;
         }
 
         /* We send an ACK if we can now advertise a non-zero window
@@ -1370,7 +1249,7 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
                          * "Lots" means "at least twice" here.
                          */
                         if (new_window && new_window >= 2 * rcv_window_now)
-                                time_to_ack = true;
+                                time_to_ack = 1;
                 }
         }
         if (time_to_ack)
@@ -1428,12 +1307,12 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
 }
 #endif
 
-static struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
+static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
 {
         struct sk_buff *skb;
         u32 offset;
 
-        while ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) {
+        skb_queue_walk(&sk->sk_receive_queue, skb) {
                 offset = seq - TCP_SKB_CB(skb)->seq;
                 if (tcp_hdr(skb)->syn)
                         offset--;
@@ -1441,11 +1320,6 @@ static struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
                         *off = offset;
                         return skb;
                 }
-                /* This looks weird, but this can happen if TCP collapsing
-                 * splitted a fat GRO packet, while we released socket lock
-                 * in skb_splice_bits()
-                 */
-                sk_eat_skb(sk, skb, false);
         }
         return NULL;
 }
@@ -1487,7 +1361,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                                         break;
                         }
                         used = recv_actor(desc, skb, offset, len);
-                        if (used <= 0) {
+                        if (used < 0) {
                                 if (!copied)
                                         copied = used;
                                 break;
@@ -1496,26 +1370,22 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                                 copied += used;
                                 offset += used;
                         }
-                        /* If recv_actor drops the lock (e.g. TCP splice
+                        /*
+                         * If recv_actor drops the lock (e.g. TCP splice
                          * receive) the skb pointer might be invalid when
                          * getting here: tcp_collapse might have deleted it
                          * while aggregating skbs from the socket queue.
                          */
-                        skb = tcp_recv_skb(sk, seq - 1, &offset);
-                        if (!skb)
+                        skb = tcp_recv_skb(sk, seq-1, &offset);
+                        if (!skb || (offset+1 != skb->len))
                                 break;
-                        /* TCP coalescing might have appended data to the skb.
-                         * Try to splice more frags
-                         */
-                        if (offset + 1 != skb->len)
-                                continue;
                 }
                 if (tcp_hdr(skb)->fin) {
-                        sk_eat_skb(sk, skb, false);
+                        sk_eat_skb(sk, skb, 0);
                         ++seq;
                         break;
                 }
-                sk_eat_skb(sk, skb, false);
+                sk_eat_skb(sk, skb, 0);
                 if (!desc->count)
                         break;
                 tp->copied_seq = seq;
@@ -1526,9 +1396,10 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
 
         /* Clean up data we have read: This will do ACK frames. */
         if (copied > 0) {
-                tcp_recv_skb(sk, seq, &offset);
                 tcp_cleanup_rbuf(sk, copied);
+                uid_stat_tcp_rcv(current_uid(), copied);
         }
+
         return copied;
 }
 EXPORT_SYMBOL(tcp_read_sock);
@@ -1553,7 +1424,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         int target;             /* Read at least this many bytes */
         long timeo;
         struct task_struct *user_recv = NULL;
-        bool copied_early = false;
+        int copied_early = 0;
         struct sk_buff *skb;
         u32 urg_hole = 0;
 
@@ -1569,21 +1440,6 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (flags & MSG_OOB)
                 goto recv_urg;
 
-        if (unlikely(tp->repair)) {
-                err = -EPERM;
-                if (!(flags & MSG_PEEK))
-                        goto out;
-
-                if (tp->repair_queue == TCP_SEND_QUEUE)
-                        goto recv_sndq;
-
-                err = -EINVAL;
-                if (tp->repair_queue == TCP_NO_QUEUE)
-                        goto out;
-
-                /* 'common' recv queue MSG_PEEK-ing */
-        }
-
         seq = &tp->copied_seq;
         if (flags & MSG_PEEK) {
                 peek_seq = tp->copied_seq;
@@ -1604,7 +1460,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 if ((available < target) &&
                     (len > sysctl_tcp_dma_copybreak) && !(flags & MSG_PEEK) &&
                     !sysctl_tcp_low_latency &&
-                    net_dma_find_channel()) {
+                    dma_find_channel(DMA_MEMCPY)) {
                         preempt_enable_no_resched();
                         tp->ucopy.pinned_list =
                                         dma_pin_iovec_pages(msg->msg_iov, len);
@@ -1745,14 +1601,8 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 }
 
 #ifdef CONFIG_NET_DMA
-                if (tp->ucopy.dma_chan) {
-                        if (tp->rcv_wnd == 0 &&
-                            !skb_queue_empty(&sk->sk_async_wait_queue)) {
-                                tcp_service_net_dma(sk, true);
-                                tcp_cleanup_rbuf(sk, copied);
-                        } else
-                                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
-                }
+                if (tp->ucopy.dma_chan)
+                        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
 #endif
                 if (copied >= target) {
                         /* Do not sleep, just process backlog. */
@@ -1791,9 +1641,9 @@ do_prequeue:
                 }
                 if ((flags & MSG_PEEK) &&
                     (peek_seq - copied - urg_hole != tp->copied_seq)) {
-                        net_dbg_ratelimited("TCP(%s:%d): Application bug, race in MSG_PEEK\n",
-                                            current->comm,
-                                            task_pid_nr(current));
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "TCP(%s:%d): Application bug, race in MSG_PEEK.\n",
+                                       current->comm, task_pid_nr(current));
                         peek_seq = tp->copied_seq;
                 }
                 continue;
@@ -1825,7 +1675,7 @@ do_prequeue:
                 if (!(flags & MSG_TRUNC)) {
 #ifdef CONFIG_NET_DMA
                         if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                                tp->ucopy.dma_chan = net_dma_find_channel();
+                                tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
 
                         if (tp->ucopy.dma_chan) {
                                 tp->ucopy.dma_cookie = dma_skb_copy_datagram_iovec(
@@ -1835,8 +1685,7 @@ do_prequeue:
 
                                 if (tp->ucopy.dma_cookie < 0) {
 
-                                        pr_alert("%s: dma_cookie < 0\n",
-                                                 __func__);
+                                        printk(KERN_ALERT "dma_cookie < 0\n");
 
                                         /* Exception. Bailout! */
                                         if (!copied)
@@ -1847,7 +1696,7 @@ do_prequeue:
                                 dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
 
                                 if ((offset + used) == skb->len)
-                                        copied_early = true;
+                                        copied_early = 1;
 
                         } else
 #endif
@@ -1881,7 +1730,7 @@ skip_copy:
                         goto found_fin_ok;
                 if (!(flags & MSG_PEEK)) {
                         sk_eat_skb(sk, skb, copied_early);
-                        copied_early = false;
+                        copied_early = 0;
                 }
                 continue;
 
@@ -1890,7 +1739,7 @@ skip_copy:
                 ++*seq;
                 if (!(flags & MSG_PEEK)) {
                         sk_eat_skb(sk, skb, copied_early);
-                        copied_early = false;
+                        copied_early = 0;
                 }
                 break;
         } while (len > 0);
@@ -1932,6 +1781,9 @@ skip_copy:
         tcp_cleanup_rbuf(sk, copied);
 
         release_sock(sk);
+
+        if (copied > 0)
+                uid_stat_tcp_rcv(current_uid(), copied);
         return copied;
 
 out:
@@ -1940,10 +1792,8 @@ out:
 
 recv_urg:
         err = tcp_recv_urg(sk, msg, len, flags);
-        goto out;
-
-recv_sndq:
-        err = tcp_peek_sndq(sk, msg, len);
+        if (err > 0)
+                uid_stat_tcp_rcv(current_uid(), err);
         goto out;
 }
 EXPORT_SYMBOL(tcp_recvmsg);
@@ -2041,20 +1891,6 @@ void tcp_shutdown(struct sock *sk, int how)
 }
 EXPORT_SYMBOL(tcp_shutdown);
 
-bool tcp_check_oom(struct sock *sk, int shift)
-{
-        bool too_many_orphans, out_of_socket_memory;
-
-        too_many_orphans = tcp_too_many_orphans(sk, shift);
-        out_of_socket_memory = tcp_out_of_memory(sk);
-
-        if (too_many_orphans)
-                net_info_ratelimited("too many orphaned sockets\n");
-        if (out_of_socket_memory)
-                net_info_ratelimited("out of memory -- consider tuning tcp_mem\n");
-        return too_many_orphans || out_of_socket_memory;
-}
-
 void tcp_close(struct sock *sk, long timeout)
 {
         struct sk_buff *skb;
@@ -2097,9 +1933,7 @@ void tcp_close(struct sock *sk, long timeout)
          * advertise a zero window, then kill -9 the FTP client, wheee...
          * Note: timeout is always zero in such a case.
          */
-        if (unlikely(tcp_sk(sk)->repair)) {
-                sk->sk_prot->disconnect(sk, 0);
-        } else if (data_was_unread) {
+        if (data_was_unread) {
                 /* Unread data was tossed, zap the connection. */
                 NET_INC_STATS_USER(sock_net(sk), LINUX_MIB_TCPABORTONCLOSE);
                 tcp_set_state(sk, TCP_CLOSE);
@@ -2133,10 +1967,6 @@ void tcp_close(struct sock *sk, long timeout)
                  * they look as CLOSING or LAST_ACK for Linux)
                  * Probably, I missed some more holelets.
                  *                                              --ANK
-                 * XXX (TFO) - To start off we don't support SYN+ACK+FIN
-                 * in a single packet! (May consider it later but will
-                 * probably need API support or TCP_CORK SYN-ACK until
-                 * data is written and socket is closed.)
                  */
                 tcp_send_fin(sk);
         }
@@ -2200,7 +2030,10 @@ adjudge_to_death:
         }
         if (sk->sk_state != TCP_CLOSE) {
                 sk_mem_reclaim(sk);
-                if (tcp_check_oom(sk, 0)) {
+                if (tcp_too_many_orphans(sk, 0)) {
+                        if (net_ratelimit())
+                                printk(KERN_INFO "TCP: too many of orphaned "
+                                       "sockets\n");
                         tcp_set_state(sk, TCP_CLOSE);
                         tcp_send_active_reset(sk, GFP_ATOMIC);
                         NET_INC_STATS_BH(sock_net(sk),
@@ -2208,16 +2041,8 @@ adjudge_to_death:
                 }
         }
 
-        if (sk->sk_state == TCP_CLOSE) {
-                struct request_sock *req = tcp_sk(sk)->fastopen_rsk;
-                /* We could get here with a non-NULL req if the socket is
-                 * aborted (e.g., closed with unread data) before 3WHS
-                 * finishes.
-                 */
-                if (req != NULL)
-                        reqsk_fastopen_remove(sk, req, false);
+        if (sk->sk_state == TCP_CLOSE)
                 inet_csk_destroy_sock(sk);
-        }
         /* Otherwise, socket is reprieved until protocol close. */
 
 out:
@@ -2229,7 +2054,7 @@ EXPORT_SYMBOL(tcp_close);
 
 /* These states need RST on ABORT according to RFC793 */
 
-static inline bool tcp_need_reset(int state)
+static inline int tcp_need_reset(int state)
 {
         return (1 << state) &
                (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_FIN_WAIT1 |
@@ -2250,8 +2075,6 @@ int tcp_disconnect(struct sock *sk, int flags)
         /* ABORT function of RFC793 */
         if (old_state == TCP_LISTEN) {
                 inet_csk_listen_stop(sk);
-        } else if (unlikely(tp->repair)) {
-                sk->sk_err = ECONNABORTED;
         } else if (tcp_need_reset(old_state) ||
                    (tp->snd_nxt != tp->write_seq &&
                     (1 << old_state) & (TCPF_CLOSING | TCPF_LAST_ACK))) {
@@ -2303,68 +2126,6 @@ int tcp_disconnect(struct sock *sk, int flags)
 }
 EXPORT_SYMBOL(tcp_disconnect);
 
-void tcp_sock_destruct(struct sock *sk)
-{
-        inet_sock_destruct(sk);
-
-        kfree(inet_csk(sk)->icsk_accept_queue.fastopenq);
-}
-
-static inline bool tcp_can_repair_sock(const struct sock *sk)
-{
-        return ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN) &&
-                ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_ESTABLISHED));
-}
-
-static int tcp_repair_options_est(struct tcp_sock *tp,
-                struct tcp_repair_opt __user *optbuf, unsigned int len)
-{
-        struct tcp_repair_opt opt;
-
-        while (len >= sizeof(opt)) {
-                if (copy_from_user(&opt, optbuf, sizeof(opt)))
-                        return -EFAULT;
-
-                optbuf++;
-                len -= sizeof(opt);
-
-                switch (opt.opt_code) {
-                case TCPOPT_MSS:
-                        tp->rx_opt.mss_clamp = opt.opt_val;
-                        break;
-                case TCPOPT_WINDOW:
-                        {
-                                u16 snd_wscale = opt.opt_val & 0xFFFF;
-                                u16 rcv_wscale = opt.opt_val >> 16;
-
-                                if (snd_wscale > 14 || rcv_wscale > 14)
-                                        return -EFBIG;
-
-                                tp->rx_opt.snd_wscale = snd_wscale;
-                                tp->rx_opt.rcv_wscale = rcv_wscale;
-                                tp->rx_opt.wscale_ok = 1;
-                        }
-                        break;
-                case TCPOPT_SACK_PERM:
-                        if (opt.opt_val != 0)
-                                return -EINVAL;
-
-                        tp->rx_opt.sack_ok |= TCP_SACK_SEEN;
-                        if (sysctl_tcp_fack)
-                                tcp_enable_fack(tp);
-                        break;
-                case TCPOPT_TIMESTAMP:
-                        if (opt.opt_val != 0)
-                                return -EINVAL;
-
-                        tp->rx_opt.tstamp_ok = 1;
-                        break;
-                }
-        }
-
-        return 0;
-}
-
 /*
  *      Socket option code for TCP.
  */
@@ -2535,55 +2296,6 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                         err = -EINVAL;
                 else
                         tp->thin_dupack = val;
-                        if (tp->thin_dupack)
-                                tcp_disable_early_retrans(tp);
-                break;
-
-        case TCP_REPAIR:
-                if (!tcp_can_repair_sock(sk))
-                        err = -EPERM;
-                else if (val == 1) {
-                        tp->repair = 1;
-                        sk->sk_reuse = SK_FORCE_REUSE;
-                        tp->repair_queue = TCP_NO_QUEUE;
-                } else if (val == 0) {
-                        tp->repair = 0;
-                        sk->sk_reuse = SK_NO_REUSE;
-                        tcp_send_window_probe(sk);
-                } else
-                        err = -EINVAL;
-
-                break;
-
-        case TCP_REPAIR_QUEUE:
-                if (!tp->repair)
-                        err = -EPERM;
-                else if (val < TCP_QUEUES_NR)
-                        tp->repair_queue = val;
-                else
-                        err = -EINVAL;
-                break;
-
-        case TCP_QUEUE_SEQ:
-                if (sk->sk_state != TCP_CLOSE)
-                        err = -EPERM;
-                else if (tp->repair_queue == TCP_SEND_QUEUE)
-                        tp->write_seq = val;
-                else if (tp->repair_queue == TCP_RECV_QUEUE)
-                        tp->rcv_nxt = val;
-                else
-                        err = -EINVAL;
-                break;
-
-        case TCP_REPAIR_OPTIONS:
-                if (!tp->repair)
-                        err = -EINVAL;
-                else if (sk->sk_state == TCP_ESTABLISHED)
-                        err = tcp_repair_options_est(tp,
-                                        (struct tcp_repair_opt __user *)optval,
-                                        optlen);
-                else
-                        err = -EPERM;
                 break;
 
         case TCP_CORK:
@@ -2698,18 +2410,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 /* Cap the max timeout in ms TCP will retry/retrans
                  * before giving up and aborting (ETIMEDOUT) a connection.
                  */
-                if (val < 0)
-                        err = -EINVAL;
-                else
-                        icsk->icsk_user_timeout = msecs_to_jiffies(val);
-                break;
-
-        case TCP_FASTOPEN:
-                if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE |
-                    TCPF_LISTEN)))
-                        err = fastopen_init_queue(sk, val);
-                else
-                        err = -EINVAL;
+                icsk->icsk_user_timeout = msecs_to_jiffies(val);
                 break;
         default:
                 err = -ENOPROTOOPT;
@@ -2723,7 +2424,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
 int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                    unsigned int optlen)
 {
-        const struct inet_connection_sock *icsk = inet_csk(sk);
+        struct inet_connection_sock *icsk = inet_csk(sk);
 
         if (level != SOL_TCP)
                 return icsk->icsk_af_ops->setsockopt(sk, level, optname,
@@ -2745,9 +2446,9 @@ EXPORT_SYMBOL(compat_tcp_setsockopt);
 #endif
 
 /* Return information about state of tcp endpoint in API format. */
-void tcp_get_info(const struct sock *sk, struct tcp_info *info)
+void tcp_get_info(struct sock *sk, struct tcp_info *info)
 {
-        const struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u32 now = tcp_time_stamp;
 
@@ -2769,12 +2470,8 @@ void tcp_get_info(const struct sock *sk, struct tcp_info *info)
                 info->tcpi_rcv_wscale = tp->rx_opt.rcv_wscale;
         }
 
-        if (tp->ecn_flags & TCP_ECN_OK)
+        if (tp->ecn_flags&TCP_ECN_OK)
                 info->tcpi_options |= TCPI_OPT_ECN;
-        if (tp->ecn_flags & TCP_ECN_SEEN)
-                info->tcpi_options |= TCPI_OPT_ECN_SEEN;
-        if (tp->syn_data_acked)
-                info->tcpi_options |= TCPI_OPT_SYN_DATA;
 
         info->tcpi_rto = jiffies_to_usecs(icsk->icsk_rto);
         info->tcpi_ato = jiffies_to_usecs(icsk->icsk_ack.ato);
@@ -2832,8 +2529,6 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 val = tp->mss_cache;
                 if (!val && ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
                         val = tp->rx_opt.user_mss;
-                if (tp->repair)
-                        val = tp->rx_opt.mss_clamp;
                 break;
         case TCP_NODELAY:
                 val = !!(tp->nonagle&TCP_NAGLE_OFF);
@@ -2936,26 +2631,6 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 val = tp->thin_dupack;
                 break;
 
-        case TCP_REPAIR:
-                val = tp->repair;
-                break;
-
-        case TCP_REPAIR_QUEUE:
-                if (tp->repair)
-                        val = tp->repair_queue;
-                else
-                        return -EINVAL;
-                break;
-
-        case TCP_QUEUE_SEQ:
-                if (tp->repair_queue == TCP_SEND_QUEUE)
-                        val = tp->write_seq;
-                else if (tp->repair_queue == TCP_RECV_QUEUE)
-                        val = tp->rcv_nxt;
-                else
-                        return -EINVAL;
-                break;
-
         case TCP_USER_TIMEOUT:
                 val = jiffies_to_msecs(icsk->icsk_user_timeout);
                 break;
@@ -2994,12 +2669,11 @@ int compat_tcp_getsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL(compat_tcp_getsockopt);
 #endif
 
-struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
-        netdev_features_t features)
+struct sk_buff *tcp_tso_segment(struct sk_buff *skb, u32 features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct tcphdr *th;
-        unsigned int thlen;
+        unsigned thlen;
         unsigned int seq;
         __be32 delta;
         unsigned int oldlen;
@@ -3198,25 +2872,26 @@ EXPORT_SYMBOL(tcp_gro_complete);
 
 #ifdef CONFIG_TCP_MD5SIG
 static unsigned long tcp_md5sig_users;
-static struct tcp_md5sig_pool __percpu *tcp_md5sig_pool;
+static struct tcp_md5sig_pool * __percpu *tcp_md5sig_pool;
 static DEFINE_SPINLOCK(tcp_md5sig_pool_lock);
 
-static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool __percpu *pool)
+static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool * __percpu *pool)
 {
         int cpu;
-
         for_each_possible_cpu(cpu) {
-                struct tcp_md5sig_pool *p = per_cpu_ptr(pool, cpu);
-
-                if (p->md5_desc.tfm)
-                        crypto_free_hash(p->md5_desc.tfm);
+                struct tcp_md5sig_pool *p = *per_cpu_ptr(pool, cpu);
+                if (p) {
+                        if (p->md5_desc.tfm)
+                                crypto_free_hash(p->md5_desc.tfm);
+                        kfree(p);
+                }
         }
         free_percpu(pool);
 }
 
 void tcp_free_md5sig_pool(void)
 {
-        struct tcp_md5sig_pool __percpu *pool = NULL;
+        struct tcp_md5sig_pool * __percpu *pool = NULL;
 
         spin_lock_bh(&tcp_md5sig_pool_lock);
         if (--tcp_md5sig_users == 0) {
@@ -3229,24 +2904,30 @@ void tcp_free_md5sig_pool(void)
 }
 EXPORT_SYMBOL(tcp_free_md5sig_pool);
 
-static struct tcp_md5sig_pool __percpu *
+static struct tcp_md5sig_pool * __percpu *
 __tcp_alloc_md5sig_pool(struct sock *sk)
 {
         int cpu;
-        struct tcp_md5sig_pool __percpu *pool;
+        struct tcp_md5sig_pool * __percpu *pool;
 
-        pool = alloc_percpu(struct tcp_md5sig_pool);
+        pool = alloc_percpu(struct tcp_md5sig_pool *);
         if (!pool)
                 return NULL;
 
         for_each_possible_cpu(cpu) {
+                struct tcp_md5sig_pool *p;
                 struct crypto_hash *hash;
 
+                p = kzalloc(sizeof(*p), sk->sk_allocation);
+                if (!p)
+                        goto out_free;
+                *per_cpu_ptr(pool, cpu) = p;
+
                 hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
                 if (!hash || IS_ERR(hash))
                         goto out_free;
 
-                per_cpu_ptr(pool, cpu)->md5_desc.tfm = hash;
+                p->md5_desc.tfm = hash;
         }
         return pool;
 out_free:
@@ -3254,16 +2935,16 @@ out_free:
         return NULL;
 }
 
-struct tcp_md5sig_pool __percpu *tcp_alloc_md5sig_pool(struct sock *sk)
+struct tcp_md5sig_pool * __percpu *tcp_alloc_md5sig_pool(struct sock *sk)
 {
-        struct tcp_md5sig_pool __percpu *pool;
-        bool alloc = false;
+        struct tcp_md5sig_pool * __percpu *pool;
+        int alloc = 0;
 
 retry:
         spin_lock_bh(&tcp_md5sig_pool_lock);
         pool = tcp_md5sig_pool;
         if (tcp_md5sig_users++ == 0) {
-                alloc = true;
+                alloc = 1;
                 spin_unlock_bh(&tcp_md5sig_pool_lock);
         } else if (!pool) {
                 tcp_md5sig_users--;
@@ -3275,7 +2956,7 @@ retry:
 
         if (alloc) {
                 /* we cannot hold spinlock here because this may sleep. */
-                struct tcp_md5sig_pool __percpu *p;
+                struct tcp_md5sig_pool * __percpu *p;
 
                 p = __tcp_alloc_md5sig_pool(sk);
                 spin_lock_bh(&tcp_md5sig_pool_lock);
@@ -3308,7 +2989,7 @@ EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
  */
 struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
 {
-        struct tcp_md5sig_pool __percpu *p;
+        struct tcp_md5sig_pool * __percpu *p;
 
         local_bh_disable();
 
@@ -3319,7 +3000,7 @@ struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
         spin_unlock(&tcp_md5sig_pool_lock);
 
         if (p)
-                return this_cpu_ptr(p);
+                return *this_cpu_ptr(p);
 
         local_bh_enable();
         return NULL;
@@ -3334,32 +3015,30 @@ void tcp_put_md5sig_pool(void)
 EXPORT_SYMBOL(tcp_put_md5sig_pool);
 
 int tcp_md5_hash_header(struct tcp_md5sig_pool *hp,
-                        const struct tcphdr *th)
+                        struct tcphdr *th)
 {
         struct scatterlist sg;
-        struct tcphdr hdr;
         int err;
 
-        /* We are not allowed to change tcphdr, make a local copy */
-        memcpy(&hdr, th, sizeof(hdr));
-        hdr.check = 0;
-
+        __sum16 old_checksum = th->check;
+        th->check = 0;
         /* options aren't included in the hash */
-        sg_init_one(&sg, &hdr, sizeof(hdr));
-        err = crypto_hash_update(&hp->md5_desc, &sg, sizeof(hdr));
+        sg_init_one(&sg, th, sizeof(struct tcphdr));
+        err = crypto_hash_update(&hp->md5_desc, &sg, sizeof(struct tcphdr));
+        th->check = old_checksum;
         return err;
 }
 EXPORT_SYMBOL(tcp_md5_hash_header);
 
 int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
-                          const struct sk_buff *skb, unsigned int header_len)
+                          struct sk_buff *skb, unsigned header_len)
 {
         struct scatterlist sg;
         const struct tcphdr *tp = tcp_hdr(skb);
         struct hash_desc *desc = &hp->md5_desc;
-        unsigned int i;
-        const unsigned int head_data_len = skb_headlen(skb) > header_len ?
-                                           skb_headlen(skb) - header_len : 0;
+        unsigned i;
+        const unsigned head_data_len = skb_headlen(skb) > header_len ?
+                                       skb_headlen(skb) - header_len : 0;
         const struct skb_shared_info *shi = skb_shinfo(skb);
         struct sk_buff *frag_iter;
 
@@ -3371,9 +3050,8 @@ int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
 
         for (i = 0; i < shi->nr_frags; ++i) {
                 const struct skb_frag_struct *f = &shi->frags[i];
-                struct page *page = skb_frag_page(f);
-                sg_set_page(&sg, page, skb_frag_size(f), f->page_offset);
-                if (crypto_hash_update(desc, &sg, skb_frag_size(f)))
+                sg_set_page(&sg, f->page, f->size, f->page_offset);
+                if (crypto_hash_update(desc, &sg, f->size))
                         return 1;
         }
 
@@ -3385,7 +3063,7 @@ int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
 }
 EXPORT_SYMBOL(tcp_md5_hash_skb_data);
 
-int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, const struct tcp_md5sig_key *key)
+int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, struct tcp_md5sig_key *key)
 {
         struct scatterlist sg;
 
@@ -3396,7 +3074,8 @@ EXPORT_SYMBOL(tcp_md5_hash_key);
 
 #endif
 
-/* Each Responder maintains up to two secret values concurrently for
+/**
+ * Each Responder maintains up to two secret values concurrently for
  * efficient secret rollover.  Each secret value has 4 states:
  *
  * Generating.  (tcp_secret_generating != tcp_secret_primary)
@@ -3526,15 +3205,11 @@ EXPORT_SYMBOL(tcp_cookie_generator);
 
 void tcp_done(struct sock *sk)
 {
-        struct request_sock *req = tcp_sk(sk)->fastopen_rsk;
-
         if (sk->sk_state == TCP_SYN_SENT || sk->sk_state == TCP_SYN_RECV)
                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_ATTEMPTFAILS);
 
         tcp_set_state(sk, TCP_CLOSE);
         tcp_clear_xmit_timers(sk);
-        if (req != NULL)
-                reqsk_fastopen_remove(sk, req, false);
 
         sk->sk_shutdown = SHUTDOWN_MASK;
 
@@ -3550,34 +3225,18 @@ extern struct tcp_congestion_ops tcp_reno;
 static __initdata unsigned long thash_entries;
 static int __init set_thash_entries(char *str)
 {
-        ssize_t ret;
-
         if (!str)
                 return 0;
-
-        ret = kstrtoul(str, 0, &thash_entries);
-        if (ret)
-                return 0;
-
+        thash_entries = simple_strtoul(str, &str, 0);
         return 1;
 }
 __setup("thash_entries=", set_thash_entries);
 
-void tcp_init_mem(struct net *net)
-{
-        unsigned long limit = nr_free_buffer_pages() / 8;
-        limit = max(limit, 128UL);
-        net->ipv4.sysctl_tcp_mem[0] = limit / 4 * 3;
-        net->ipv4.sysctl_tcp_mem[1] = limit;
-        net->ipv4.sysctl_tcp_mem[2] = net->ipv4.sysctl_tcp_mem[0] * 2;
-}
-
 void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
         unsigned long limit;
-        int max_rshare, max_wshare, cnt;
-        unsigned int i;
+        int i, max_share, cnt;
         unsigned long jiffy = jiffies;
 
         BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
@@ -3598,11 +3257,11 @@ void __init tcp_init(void)
                 alloc_large_system_hash("TCP established",
                                         sizeof(struct inet_ehash_bucket),
                                         thash_entries,
-                                        17, /* one slot per 128 KB of memory */
+                                        (totalram_pages >= 128 * 1024) ?
+                                        13 : 15,
                                         0,
                                         NULL,
                                         &tcp_hashinfo.ehash_mask,
-                                        0,
                                         thash_entries ? 0 : 512 * 1024);
         for (i = 0; i <= tcp_hashinfo.ehash_mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].chain, i);
@@ -3614,13 +3273,13 @@ void __init tcp_init(void)
                 alloc_large_system_hash("TCP bind",
                                         sizeof(struct inet_bind_hashbucket),
                                         tcp_hashinfo.ehash_mask + 1,
-                                        17, /* one slot per 128 KB of memory */
+                                        (totalram_pages >= 128 * 1024) ?
+                                        13 : 15,
                                         0,
                                         &tcp_hashinfo.bhash_size,
                                         NULL,
-                                        0,
                                         64 * 1024);
-        tcp_hashinfo.bhash_size = 1U << tcp_hashinfo.bhash_size;
+        tcp_hashinfo.bhash_size = 1 << tcp_hashinfo.bhash_size;
         for (i = 0; i < tcp_hashinfo.bhash_size; i++) {
                 spin_lock_init(&tcp_hashinfo.bhash[i].lock);
                 INIT_HLIST_HEAD(&tcp_hashinfo.bhash[i].chain);
@@ -3633,24 +3292,27 @@ void __init tcp_init(void)
         sysctl_tcp_max_orphans = cnt / 2;
         sysctl_max_syn_backlog = max(128, cnt / 256);
 
-        tcp_init_mem(&init_net);
+        limit = nr_free_buffer_pages() / 8;
+        limit = max(limit, 128UL);
+        sysctl_tcp_mem[0] = limit / 4 * 3;
+        sysctl_tcp_mem[1] = limit;
+        sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;
+
         /* Set per-socket limits to no more than 1/128 the pressure threshold */
-        limit = nr_free_buffer_pages() << (PAGE_SHIFT - 7);
-        max_wshare = min(4UL*1024*1024, limit);
-        max_rshare = min(6UL*1024*1024, limit);
+        limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
+        max_share = min(4UL*1024*1024, limit);
 
         sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
         sysctl_tcp_wmem[1] = 16*1024;
-        sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
+        sysctl_tcp_wmem[2] = max(64*1024, max_share);
 
         sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
         sysctl_tcp_rmem[1] = 87380;
-        sysctl_tcp_rmem[2] = max(87380, max_rshare);
+        sysctl_tcp_rmem[2] = max(87380, max_share);
 
-        pr_info("Hash tables configured (established %u bind %u)\n",
-                tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
-
-        tcp_metrics_init();
+        printk(KERN_INFO "TCP: Hash tables configured "
+               "(established %u bind %u)\n",
+               tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
 
         tcp_register_congestion_control(&tcp_reno);
 
@@ -3662,5 +3324,108 @@ void __init tcp_init(void)
         tcp_secret_primary = &tcp_secret_one;
         tcp_secret_retiring = &tcp_secret_two;
         tcp_secret_secondary = &tcp_secret_two;
-        tcp_tasklet_init();
+}
+
+static int tcp_is_local(struct net *net, __be32 addr) {
+        struct rtable *rt;
+        struct flowi4 fl4 = { .daddr = addr };
+        rt = ip_route_output_key(net, &fl4);
+        if (IS_ERR_OR_NULL(rt))
+                return 0;
+        return rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK);
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static int tcp_is_local6(struct net *net, struct in6_addr *addr) {
+        struct rt6_info *rt6 = rt6_lookup(net, addr, addr, 0, 0);
+        return rt6 && rt6->rt6i_dev && (rt6->rt6i_dev->flags & IFF_LOOPBACK);
+}
+#endif
+
+/*
+ * tcp_nuke_addr - destroy all sockets on the given local address
+ * if local address is the unspecified address (0.0.0.0 or ::), destroy all
+ * sockets with local addresses that are not configured.
+ */
+int tcp_nuke_addr(struct net *net, struct sockaddr *addr)
+{
+        int family = addr->sa_family;
+        unsigned int bucket;
+
+        struct in_addr *in;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        struct in6_addr *in6;
+#endif
+        if (family == AF_INET) {
+                in = &((struct sockaddr_in *)addr)->sin_addr;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        } else if (family == AF_INET6) {
+                in6 = &((struct sockaddr_in6 *)addr)->sin6_addr;
+#endif
+        } else {
+                return -EAFNOSUPPORT;
+        }
+
+        for (bucket = 0; bucket < tcp_hashinfo.ehash_mask; bucket++) {
+                struct hlist_nulls_node *node;
+                struct sock *sk;
+                spinlock_t *lock = inet_ehash_lockp(&tcp_hashinfo, bucket);
+
+restart:
+                spin_lock_bh(lock);
+                sk_nulls_for_each(sk, node, &tcp_hashinfo.ehash[bucket].chain) {
+                        struct inet_sock *inet = inet_sk(sk);
+
+                        if (sysctl_ip_dynaddr && sk->sk_state == TCP_SYN_SENT)
+                                continue;
+                        if (sock_flag(sk, SOCK_DEAD))
+                                continue;
+
+                        if (family == AF_INET) {
+                                __be32 s4 = inet->inet_rcv_saddr;
+                                if (s4 == LOOPBACK4_IPV6)
+                                        continue;
+
+                                if (in->s_addr != s4 &&
+                                    !(in->s_addr == INADDR_ANY &&
+                                      !tcp_is_local(net, s4)))
+                                        continue;
+                        }
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+                        if (family == AF_INET6) {
+                                struct in6_addr *s6;
+                                if (!inet->pinet6)
+                                        continue;
+
+                                s6 = &inet->pinet6->rcv_saddr;
+                                if (ipv6_addr_type(s6) == IPV6_ADDR_MAPPED)
+                                        continue;
+
+                                if (!ipv6_addr_equal(in6, s6) &&
+                                    !(ipv6_addr_equal(in6, &in6addr_any) &&
+                                      !tcp_is_local6(net, s6)))
+                                continue;
+                        }
+#endif
+
+                        sock_hold(sk);
+                        spin_unlock_bh(lock);
+
+                        local_bh_disable();
+                        bh_lock_sock(sk);
+                        sk->sk_err = ETIMEDOUT;
+                        sk->sk_error_report(sk);
+
+                        tcp_done(sk);
+                        bh_unlock_sock(sk);
+                        local_bh_enable();
+                        sock_put(sk);
+
+                        goto restart;
+                }
+                spin_unlock_bh(lock);
+        }
+
+        return 0;
 }