Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6 into common/serial-rework

Conflicts:
	arch/sh/kernel/cpu/sh2/setup-sh7619.c
	arch/sh/kernel/cpu/sh2a/setup-mxg.c
	arch/sh/kernel/cpu/sh2a/setup-sh7201.c
	arch/sh/kernel/cpu/sh2a/setup-sh7203.c
	arch/sh/kernel/cpu/sh2a/setup-sh7206.c
	arch/sh/kernel/cpu/sh3/setup-sh7705.c
	arch/sh/kernel/cpu/sh3/setup-sh770x.c
	arch/sh/kernel/cpu/sh3/setup-sh7710.c
	arch/sh/kernel/cpu/sh3/setup-sh7720.c
	arch/sh/kernel/cpu/sh4/setup-sh4-202.c
	arch/sh/kernel/cpu/sh4/setup-sh7750.c
	arch/sh/kernel/cpu/sh4/setup-sh7760.c
	arch/sh/kernel/cpu/sh4a/setup-sh7343.c
	arch/sh/kernel/cpu/sh4a/setup-sh7366.c
	arch/sh/kernel/cpu/sh4a/setup-sh7722.c
	arch/sh/kernel/cpu/sh4a/setup-sh7723.c
	arch/sh/kernel/cpu/sh4a/setup-sh7724.c
	arch/sh/kernel/cpu/sh4a/setup-sh7763.c
	arch/sh/kernel/cpu/sh4a/setup-sh7770.c
	arch/sh/kernel/cpu/sh4a/setup-sh7780.c
	arch/sh/kernel/cpu/sh4a/setup-sh7785.c
	arch/sh/kernel/cpu/sh4a/setup-sh7786.c
	arch/sh/kernel/cpu/sh4a/setup-shx3.c
	arch/sh/kernel/cpu/sh5/setup-sh5.c
	drivers/serial/sh-sci.c
	drivers/serial/sh-sci.h
	include/linux/serial_sci.h

116 files changed, 9937 insertions, 7277 deletions

diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 70491d9035eb..9e95d7fb6d5a 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -46,7 +46,7 @@ config IP_ADVANCED_ROUTER
           rp_filter on use:
 
           echo 1 > /proc/sys/net/ipv4/conf/<device>/rp_filter
-           and
+           or
           echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
 
           Note that some distributions enable it in startup scripts.
@@ -84,7 +84,7 @@ config IP_FIB_TRIE
 
           An experimental study of compression methods for dynamic tries
           Stefan Nilsson and Matti Tikkanen. Algorithmica, 33(1):19-33, 2002.
-          http://www.nada.kth.se/~snilsson/public/papers/dyntrie2/
+          <http://www.csc.kth.se/~snilsson/software/dyntrie2/>
 
 endchoice
 
@@ -166,7 +166,7 @@ config IP_PNP_DHCP
 
           If unsure, say Y. Note that if you want to use DHCP, a DHCP server
           must be operating on your network.  Read
-          <file:Documentation/filesystems/nfsroot.txt> for details.
+          <file:Documentation/filesystems/nfs/nfsroot.txt> for details.
 
 config IP_PNP_BOOTP
         bool "IP: BOOTP support"
@@ -181,7 +181,7 @@ config IP_PNP_BOOTP
           does BOOTP itself, providing all necessary information on the kernel
           command line, you can say N here. If unsure, say Y. Note that if you
           want to use BOOTP, a BOOTP server must be operating on your network.
-          Read <file:Documentation/filesystems/nfsroot.txt> for details.
+          Read <file:Documentation/filesystems/nfs/nfsroot.txt> for details.
 
 config IP_PNP_RARP
         bool "IP: RARP support"
@@ -194,7 +194,7 @@ config IP_PNP_RARP
           older protocol which is being obsoleted by BOOTP and DHCP), say Y
           here. Note that if you want to use RARP, a RARP server must be
           operating on your network. Read
-          <file:Documentation/filesystems/nfsroot.txt> for details.
+          <file:Documentation/filesystems/nfs/nfsroot.txt> for details.
 
 # not yet ready..
 #   bool '    IP: ARP support' CONFIG_IP_PNP_ARP
@@ -215,8 +215,15 @@ config NET_IPIP
           be inserted in and removed from the running kernel whenever you
           want). Most people won't need this and can say N.
 
+config NET_IPGRE_DEMUX
+        tristate "IP: GRE demultiplexer"
+        help
+         This is helper module to demultiplex GRE packets on GRE version field criteria.
+         Required by ip_gre and pptp modules.
+
 config NET_IPGRE
         tristate "IP: GRE tunnels over IP"
+        depends on (IPV6 || IPV6=n) && NET_IPGRE_DEMUX
         help
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
@@ -250,6 +257,20 @@ config IP_MROUTE
           <file:Documentation/networking/multicast.txt>. If you haven't heard
           about it, you don't need it.
 
+config IP_MROUTE_MULTIPLE_TABLES
+        bool "IP: multicast policy routing"
+        depends on IP_MROUTE && IP_ADVANCED_ROUTER
+        select FIB_RULES
+        help
+          Normally, a multicast router runs a userspace daemon and decides
+          what to do with a multicast packet based on the source and
+          destination addresses. If you say Y here, the multicast router
+          will also be able to take interfaces and packet marks into
+          account and run multiple instances of userspace daemons
+          simultaneously, each one handling a single table.
+
+          If unsure, say N.
+
 config IP_PIMSM_V1
         bool "IP: PIM-SM version 1 support"
         depends on IP_MROUTE
@@ -289,7 +310,7 @@ config ARPD
           If unsure, say N.
 
 config SYN_COOKIES
-        bool "IP: TCP syncookie support (disabled per default)"
+        bool "IP: TCP syncookie support"
         ---help---
           Normal TCP/IP networking is open to an attack known as "SYN
           flooding". This denial-of-service attack prevents legitimate remote
@@ -314,13 +335,13 @@ config SYN_COOKIES
           server is really overloaded. If this happens frequently better turn
           them off.
 
-          If you say Y here, note that SYN cookies aren't enabled by default;
-          you can enable them by saying Y to "/proc file system support" and
+          If you say Y here, you can disable SYN cookies at run time by
+          saying Y to "/proc file system support" and
           "Sysctl support" below and executing the command
 
-          echo 1 >/proc/sys/net/ipv4/tcp_syncookies
+          echo 0 > /proc/sys/net/ipv4/tcp_syncookies
 
-          at boot time after the /proc file system has been mounted.
+          after the /proc file system has been mounted.
 
           If unsure, say N.
 
@@ -398,7 +419,7 @@ config INET_XFRM_MODE_BEET
           If unsure, say Y.
 
 config INET_LRO
-        bool "Large Receive Offload (ipv4/tcp)"
+        tristate "Large Receive Offload (ipv4/tcp)"
         default y
         ---help---
           Support for Large Receive Offload (ipv4/tcp).
@@ -541,7 +562,7 @@ config TCP_CONG_VENO
         distinguishing to circumvent the difficult judgment of the packet loss
         type. TCP Veno cuts down less congestion window in response to random
         loss packets.
-        See http://www.ntu.edu.sg/home5/ZHOU0022/papers/CPFu03a.pdf
+        See <http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=1177186> 
 
 config TCP_CONG_YEAH
         tristate "YeAH TCP"
@@ -587,9 +608,15 @@ choice
         config DEFAULT_HTCP
                 bool "Htcp" if TCP_CONG_HTCP=y
 
+        config DEFAULT_HYBLA
+                bool "Hybla" if TCP_CONG_HYBLA=y
+
         config DEFAULT_VEGAS
                 bool "Vegas" if TCP_CONG_VEGAS=y
 
+        config DEFAULT_VENO
+                bool "Veno" if TCP_CONG_VENO=y
+
         config DEFAULT_WESTWOOD
                 bool "Westwood" if TCP_CONG_WESTWOOD=y
 
@@ -610,8 +637,10 @@ config DEFAULT_TCP_CONG
         default "bic" if DEFAULT_BIC
         default "cubic" if DEFAULT_CUBIC
         default "htcp" if DEFAULT_HTCP
+        default "hybla" if DEFAULT_HYBLA
         default "vegas" if DEFAULT_VEGAS
         default "westwood" if DEFAULT_WESTWOOD
+        default "veno" if DEFAULT_VENO
         default "reno" if DEFAULT_RENO
         default "cubic"
 
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index 80ff87ce43aa..4978d22f9a75 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -20,6 +20,7 @@ obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_IP_MULTIPLE_TABLES) += fib_rules.o
 obj-$(CONFIG_IP_MROUTE) += ipmr.o
 obj-$(CONFIG_NET_IPIP) += ipip.o
+obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o
 obj-$(CONFIG_NET_IPGRE) += ip_gre.o
 obj-$(CONFIG_SYN_COOKIES) += syncookies.o
 obj-$(CONFIG_INET_AH) += ah4.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 566ea6c4321d..f2b61107df6c 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -86,6 +86,7 @@
 #include <linux/poll.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -124,7 +125,6 @@ static struct list_head inetsw[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw_lock);
 
 struct ipv4_config ipv4_config;
-
 EXPORT_SYMBOL(ipv4_config);
 
 /* New destruction routine */
@@ -139,12 +139,12 @@ void inet_sock_destruct(struct sock *sk)
         sk_mem_reclaim(sk);
 
         if (sk->sk_type == SOCK_STREAM && sk->sk_state != TCP_CLOSE) {
-                printk("Attempt to release TCP socket in state %d %p\n",
+                pr_err("Attempt to release TCP socket in state %d %p\n",
                        sk->sk_state, sk);
                 return;
         }
         if (!sock_flag(sk, SOCK_DEAD)) {
-                printk("Attempt to release alive inet socket %p\n", sk);
+                pr_err("Attempt to release alive inet socket %p\n", sk);
                 return;
         }
 
@@ -154,9 +154,10 @@ void inet_sock_destruct(struct sock *sk)
         WARN_ON(sk->sk_forward_alloc);
 
         kfree(inet->opt);
-        dst_release(sk->sk_dst_cache);
+        dst_release(rcu_dereference_check(sk->sk_dst_cache, 1));
         sk_refcnt_debug_dec(sk);
 }
+EXPORT_SYMBOL(inet_sock_destruct);
 
 /*
  *      The routines beyond this point handle the behaviour of an AF_INET
@@ -174,12 +175,12 @@ static int inet_autobind(struct sock *sk)
         /* We may need to bind the socket. */
         lock_sock(sk);
         inet = inet_sk(sk);
-        if (!inet->num) {
+        if (!inet->inet_num) {
                 if (sk->sk_prot->get_port(sk, 0)) {
                         release_sock(sk);
                         return -EAGAIN;
                 }
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
         }
         release_sock(sk);
         return 0;
@@ -219,31 +220,30 @@ out:
         release_sock(sk);
         return err;
 }
+EXPORT_SYMBOL(inet_listen);
 
 u32 inet_ehash_secret __read_mostly;
 EXPORT_SYMBOL(inet_ehash_secret);
 
 /*
  * inet_ehash_secret must be set exactly once
- * Instead of using a dedicated spinlock, we (ab)use inetsw_lock
  */
 void build_ehash_secret(void)
 {
         u32 rnd;
+
         do {
                 get_random_bytes(&rnd, sizeof(rnd));
         } while (rnd == 0);
-        spin_lock_bh(&inetsw_lock);
-        if (!inet_ehash_secret)
-                inet_ehash_secret = rnd;
-        spin_unlock_bh(&inetsw_lock);
+
+        cmpxchg(&inet_ehash_secret, 0, rnd);
 }
 EXPORT_SYMBOL(build_ehash_secret);
 
 static inline int inet_netns_ok(struct net *net, int protocol)
 {
         int hash;
-        struct net_protocol *ipprot;
+        const struct net_protocol *ipprot;
 
         if (net_eq(net, &init_net))
                 return 1;
@@ -261,7 +261,8 @@ static inline int inet_netns_ok(struct net *net, int protocol)
  *      Create an inet socket.
  */
 
-static int inet_create(struct net *net, struct socket *sock, int protocol)
+static int inet_create(struct net *net, struct socket *sock, int protocol,
+                       int kern)
 {
         struct sock *sk;
         struct inet_protosw *answer;
@@ -324,7 +325,7 @@ lookup_protocol:
         }
 
         err = -EPERM;
-        if (answer->capability > 0 && !capable(answer->capability))
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                 goto out_rcu_unlock;
 
         err = -EAFNOSUPPORT;
@@ -352,8 +353,10 @@ lookup_protocol:
         inet = inet_sk(sk);
         inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
+        inet->nodefrag = 0;
+
         if (SOCK_RAW == sock->type) {
-                inet->num = protocol;
+                inet->inet_num = protocol;
                 if (IPPROTO_RAW == protocol)
                         inet->hdrincl = 1;
         }
@@ -363,7 +366,7 @@ lookup_protocol:
         else
                 inet->pmtudisc = IP_PMTUDISC_WANT;
 
-        inet->id = 0;
+        inet->inet_id = 0;
 
         sock_init_data(sock, sk);
 
@@ -380,13 +383,13 @@ lookup_protocol:
 
         sk_refcnt_debug_inc(sk);
 
-        if (inet->num) {
+        if (inet->inet_num) {
                 /* It assumes that any protocol which allows
                  * the user to assign a number at socket
                  * creation time automatically
                  * shares.
                  */
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
                 /* Add to protocol hash chains. */
                 sk->sk_prot->hash(sk);
         }
@@ -416,6 +419,8 @@ int inet_release(struct socket *sock)
         if (sk) {
                 long timeout;
 
+                sock_rps_reset_flow(sk);
+
                 /* Applications forget to leave groups before exiting */
                 ip_mc_drop_socket(sk);
 
@@ -435,9 +440,11 @@ int inet_release(struct socket *sock)
         }
         return 0;
 }
+EXPORT_SYMBOL(inet_release);
 
 /* It is off by default, see below. */
 int sysctl_ip_nonlocal_bind __read_mostly;
+EXPORT_SYMBOL(sysctl_ip_nonlocal_bind);
 
 int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
@@ -491,27 +498,27 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         /* Check these errors (active socket, double bind). */
         err = -EINVAL;
-        if (sk->sk_state != TCP_CLOSE || inet->num)
+        if (sk->sk_state != TCP_CLOSE || inet->inet_num)
                 goto out_release_sock;
 
-        inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
-                inet->saddr = 0;  /* Use device */
+                inet->inet_saddr = 0;  /* Use device */
 
         /* Make sure we are allowed to bind here. */
         if (sk->sk_prot->get_port(sk, snum)) {
-                inet->saddr = inet->rcv_saddr = 0;
+                inet->inet_saddr = inet->inet_rcv_saddr = 0;
                 err = -EADDRINUSE;
                 goto out_release_sock;
         }
 
-        if (inet->rcv_saddr)
+        if (inet->inet_rcv_saddr)
                 sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
         if (snum)
                 sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
-        inet->sport = htons(inet->num);
-        inet->daddr = 0;
-        inet->dport = 0;
+        inet->inet_sport = htons(inet->inet_num);
+        inet->inet_daddr = 0;
+        inet->inet_dport = 0;
         sk_dst_reset(sk);
         err = 0;
 out_release_sock:
@@ -519,25 +526,29 @@ out_release_sock:
 out:
         return err;
 }
+EXPORT_SYMBOL(inet_bind);
 
 int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
                        int addr_len, int flags)
 {
         struct sock *sk = sock->sk;
 
+        if (addr_len < sizeof(uaddr->sa_family))
+                return -EINVAL;
         if (uaddr->sa_family == AF_UNSPEC)
                 return sk->sk_prot->disconnect(sk, flags);
 
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
         return sk->sk_prot->connect(sk, (struct sockaddr *)uaddr, addr_len);
 }
+EXPORT_SYMBOL(inet_dgram_connect);
 
 static long inet_wait_for_connect(struct sock *sk, long timeo)
 {
         DEFINE_WAIT(wait);
 
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
         /* Basic assumption: if someone sets sk->sk_err, he _must_
          * change state of the socket from TCP_SYN_*.
@@ -550,9 +561,9 @@ static long inet_wait_for_connect(struct sock *sk, long timeo)
                 lock_sock(sk);
                 if (signal_pending(current) || !timeo)
                         break;
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return timeo;
 }
 
@@ -567,6 +578,9 @@ int inet_stream_connect(struct socket *sock, struct sockaddr *uaddr,
         int err;
         long timeo;
 
+        if (addr_len < sizeof(uaddr->sa_family))
+                return -EINVAL;
+
         lock_sock(sk);
 
         if (uaddr->sa_family == AF_UNSPEC) {
@@ -641,6 +655,7 @@ sock_error:
                 sock->state = SS_DISCONNECTING;
         goto out;
 }
+EXPORT_SYMBOL(inet_stream_connect);
 
 /*
  *      Accept a pending connection. The TCP layer now gives BSD semantics.
@@ -668,6 +683,7 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags)
 do_err:
         return err;
 }
+EXPORT_SYMBOL(inet_accept);
 
 
 /*
@@ -678,54 +694,79 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr,
 {
         struct sock *sk         = sock->sk;
         struct inet_sock *inet  = inet_sk(sk);
-        struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, uaddr);
 
         sin->sin_family = AF_INET;
         if (peer) {
-                if (!inet->dport ||
+                if (!inet->inet_dport ||
                     (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)) &&
                      peer == 1))
                         return -ENOTCONN;
-                sin->sin_port = inet->dport;
-                sin->sin_addr.s_addr = inet->daddr;
+                sin->sin_port = inet->inet_dport;
+                sin->sin_addr.s_addr = inet->inet_daddr;
         } else {
-                __be32 addr = inet->rcv_saddr;
+                __be32 addr = inet->inet_rcv_saddr;
                 if (!addr)
-                        addr = inet->saddr;
-                sin->sin_port = inet->sport;
+                        addr = inet->inet_saddr;
+                sin->sin_port = inet->inet_sport;
                 sin->sin_addr.s_addr = addr;
         }
         memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
         *uaddr_len = sizeof(*sin);
         return 0;
 }
+EXPORT_SYMBOL(inet_getname);
 
 int inet_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                  size_t size)
 {
         struct sock *sk = sock->sk;
 
+        sock_rps_record_flow(sk);
+
         /* We may need to bind the socket. */
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && !sk->sk_prot->no_autobind &&
+            inet_autobind(sk))
                 return -EAGAIN;
 
         return sk->sk_prot->sendmsg(iocb, sk, msg, size);
 }
+EXPORT_SYMBOL(inet_sendmsg);
 
-
-static ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset, size_t size, int flags)
+ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset,
+                      size_t size, int flags)
 {
         struct sock *sk = sock->sk;
 
+        sock_rps_record_flow(sk);
+
         /* We may need to bind the socket. */
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && !sk->sk_prot->no_autobind &&
+            inet_autobind(sk))
                 return -EAGAIN;
 
         if (sk->sk_prot->sendpage)
                 return sk->sk_prot->sendpage(sk, page, offset, size, flags);
         return sock_no_sendpage(sock, page, offset, size, flags);
 }
+EXPORT_SYMBOL(inet_sendpage);
+
+int inet_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
+                 size_t size, int flags)
+{
+        struct sock *sk = sock->sk;
+        int addr_len = 0;
+        int err;
 
+        sock_rps_record_flow(sk);
+
+        err = sk->sk_prot->recvmsg(iocb, sk, msg, size, flags & MSG_DONTWAIT,
+                                   flags & ~MSG_DONTWAIT, &addr_len);
+        if (err >= 0)
+                msg->msg_namelen = addr_len;
+        return err;
+}
+EXPORT_SYMBOL(inet_recvmsg);
 
 int inet_shutdown(struct socket *sock, int how)
 {
@@ -780,6 +821,7 @@ int inet_shutdown(struct socket *sock, int how)
         release_sock(sk);
         return err;
 }
+EXPORT_SYMBOL(inet_shutdown);
 
 /*
  *      ioctl() calls you can issue on an INET socket. Most of these are
@@ -798,44 +840,45 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         struct net *net = sock_net(sk);
 
         switch (cmd) {
-                case SIOCGSTAMP:
-                        err = sock_get_timestamp(sk, (struct timeval __user *)arg);
-                        break;
-                case SIOCGSTAMPNS:
-                        err = sock_get_timestampns(sk, (struct timespec __user *)arg);
-                        break;
-                case SIOCADDRT:
-                case SIOCDELRT:
-                case SIOCRTMSG:
-                        err = ip_rt_ioctl(net, cmd, (void __user *)arg);
-                        break;
-                case SIOCDARP:
-                case SIOCGARP:
-                case SIOCSARP:
-                        err = arp_ioctl(net, cmd, (void __user *)arg);
-                        break;
-                case SIOCGIFADDR:
-                case SIOCSIFADDR:
-                case SIOCGIFBRDADDR:
-                case SIOCSIFBRDADDR:
-                case SIOCGIFNETMASK:
-                case SIOCSIFNETMASK:
-                case SIOCGIFDSTADDR:
-                case SIOCSIFDSTADDR:
-                case SIOCSIFPFLAGS:
-                case SIOCGIFPFLAGS:
-                case SIOCSIFFLAGS:
-                        err = devinet_ioctl(net, cmd, (void __user *)arg);
-                        break;
-                default:
-                        if (sk->sk_prot->ioctl)
-                                err = sk->sk_prot->ioctl(sk, cmd, arg);
-                        else
-                                err = -ENOIOCTLCMD;
-                        break;
+        case SIOCGSTAMP:
+                err = sock_get_timestamp(sk, (struct timeval __user *)arg);
+                break;
+        case SIOCGSTAMPNS:
+                err = sock_get_timestampns(sk, (struct timespec __user *)arg);
+                break;
+        case SIOCADDRT:
+        case SIOCDELRT:
+        case SIOCRTMSG:
+                err = ip_rt_ioctl(net, cmd, (void __user *)arg);
+                break;
+        case SIOCDARP:
+        case SIOCGARP:
+        case SIOCSARP:
+                err = arp_ioctl(net, cmd, (void __user *)arg);
+                break;
+        case SIOCGIFADDR:
+        case SIOCSIFADDR:
+        case SIOCGIFBRDADDR:
+        case SIOCSIFBRDADDR:
+        case SIOCGIFNETMASK:
+        case SIOCSIFNETMASK:
+        case SIOCGIFDSTADDR:
+        case SIOCSIFDSTADDR:
+        case SIOCSIFPFLAGS:
+        case SIOCGIFPFLAGS:
+        case SIOCSIFFLAGS:
+                err = devinet_ioctl(net, cmd, (void __user *)arg);
+                break;
+        default:
+                if (sk->sk_prot->ioctl)
+                        err = sk->sk_prot->ioctl(sk, cmd, arg);
+                else
+                        err = -ENOIOCTLCMD;
+                break;
         }
         return err;
 }
+EXPORT_SYMBOL(inet_ioctl);
 
 const struct proto_ops inet_stream_ops = {
         .family            = PF_INET,
@@ -852,16 +895,17 @@ const struct proto_ops inet_stream_ops = {
         .shutdown          = inet_shutdown,
         .setsockopt        = sock_common_setsockopt,
         .getsockopt        = sock_common_getsockopt,
-        .sendmsg           = tcp_sendmsg,
-        .recvmsg           = sock_common_recvmsg,
+        .sendmsg           = inet_sendmsg,
+        .recvmsg           = inet_recvmsg,
         .mmap              = sock_no_mmap,
-        .sendpage          = tcp_sendpage,
+        .sendpage          = inet_sendpage,
         .splice_read       = tcp_splice_read,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_sock_common_setsockopt,
         .compat_getsockopt = compat_sock_common_getsockopt,
 #endif
 };
+EXPORT_SYMBOL(inet_stream_ops);
 
 const struct proto_ops inet_dgram_ops = {
         .family            = PF_INET,
@@ -879,7 +923,7 @@ const struct proto_ops inet_dgram_ops = {
         .setsockopt        = sock_common_setsockopt,
         .getsockopt        = sock_common_getsockopt,
         .sendmsg           = inet_sendmsg,
-        .recvmsg           = sock_common_recvmsg,
+        .recvmsg           = inet_recvmsg,
         .mmap              = sock_no_mmap,
         .sendpage          = inet_sendpage,
 #ifdef CONFIG_COMPAT
@@ -887,6 +931,7 @@ const struct proto_ops inet_dgram_ops = {
         .compat_getsockopt = compat_sock_common_getsockopt,
 #endif
 };
+EXPORT_SYMBOL(inet_dgram_ops);
 
 /*
  * For SOCK_RAW sockets; should be the same as inet_dgram_ops but without
@@ -908,7 +953,7 @@ static const struct proto_ops inet_sockraw_ops = {
         .setsockopt        = sock_common_setsockopt,
         .getsockopt        = sock_common_getsockopt,
         .sendmsg           = inet_sendmsg,
-        .recvmsg           = sock_common_recvmsg,
+        .recvmsg           = inet_recvmsg,
         .mmap              = sock_no_mmap,
         .sendpage          = inet_sendpage,
 #ifdef CONFIG_COMPAT
@@ -917,7 +962,7 @@ static const struct proto_ops inet_sockraw_ops = {
 #endif
 };
 
-static struct net_proto_family inet_family_ops = {
+static const struct net_proto_family inet_family_ops = {
         .family = PF_INET,
         .create = inet_create,
         .owner  = THIS_MODULE,
@@ -933,7 +978,6 @@ static struct inet_protosw inetsw_array[] =
                 .protocol =   IPPROTO_TCP,
                 .prot =       &tcp_prot,
                 .ops =        &inet_stream_ops,
-                .capability = -1,
                 .no_check =   0,
                 .flags =      INET_PROTOSW_PERMANENT |
                               INET_PROTOSW_ICSK,
@@ -944,7 +988,6 @@ static struct inet_protosw inetsw_array[] =
                 .protocol =   IPPROTO_UDP,
                 .prot =       &udp_prot,
                 .ops =        &inet_dgram_ops,
-                .capability = -1,
                 .no_check =   UDP_CSUM_DEFAULT,
                 .flags =      INET_PROTOSW_PERMANENT,
        },
@@ -955,7 +998,6 @@ static struct inet_protosw inetsw_array[] =
                .protocol =   IPPROTO_IP,        /* wild card */
                .prot =       &raw_prot,
                .ops =        &inet_sockraw_ops,
-               .capability = CAP_NET_RAW,
                .no_check =   UDP_CSUM_DEFAULT,
                .flags =      INET_PROTOSW_REUSE,
        }
@@ -1016,6 +1058,7 @@ out_illegal:
                p->type);
         goto out;
 }
+EXPORT_SYMBOL(inet_register_protosw);
 
 void inet_unregister_protosw(struct inet_protosw *p)
 {
@@ -1031,6 +1074,7 @@ void inet_unregister_protosw(struct inet_protosw *p)
                 synchronize_net();
         }
 }
+EXPORT_SYMBOL(inet_unregister_protosw);
 
 /*
  *      Shall we try to damage output packets if routing dev changes?
@@ -1043,9 +1087,9 @@ static int inet_sk_reselect_saddr(struct sock *sk)
         struct inet_sock *inet = inet_sk(sk);
         int err;
         struct rtable *rt;
-        __be32 old_saddr = inet->saddr;
+        __be32 old_saddr = inet->inet_saddr;
         __be32 new_saddr;
-        __be32 daddr = inet->daddr;
+        __be32 daddr = inet->inet_daddr;
 
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
@@ -1055,11 +1099,11 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                                RT_CONN_FLAGS(sk),
                                sk->sk_bound_dev_if,
                                sk->sk_protocol,
-                               inet->sport, inet->dport, sk, 0);
+                               inet->inet_sport, inet->inet_dport, sk, 0);
         if (err)
                 return err;
 
-        sk_setup_caps(sk, &rt->u.dst);
+        sk_setup_caps(sk, &rt->dst);
 
         new_saddr = rt->rt_src;
 
@@ -1071,7 +1115,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                        __func__, &old_saddr, &new_saddr);
         }
 
-        inet->saddr = inet->rcv_saddr = new_saddr;
+        inet->inet_saddr = inet->inet_rcv_saddr = new_saddr;
 
         /*
          * XXX The only one ugly spot where we need to
@@ -1097,34 +1141,27 @@ int inet_sk_rebuild_header(struct sock *sk)
                 return 0;
 
         /* Reroute. */
-        daddr = inet->daddr;
+        daddr = inet->inet_daddr;
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
 {
         struct flowi fl = {
                 .oif = sk->sk_bound_dev_if,
-                .nl_u = {
-                        .ip4_u = {
-                                .daddr  = daddr,
-                                .saddr  = inet->saddr,
-                                .tos    = RT_CONN_FLAGS(sk),
-                        },
-                },
+                .mark = sk->sk_mark,
+                .fl4_dst = daddr,
+                .fl4_src = inet->inet_saddr,
+                .fl4_tos = RT_CONN_FLAGS(sk),
                 .proto = sk->sk_protocol,
                 .flags = inet_sk_flowi_flags(sk),
-                .uli_u = {
-                        .ports = {
-                                .sport = inet->sport,
-                                .dport = inet->dport,
-                        },
-                },
+                .fl_ip_sport = inet->inet_sport,
+                .fl_ip_dport = inet->inet_dport,
         };
 
         security_sk_classify_flow(sk, &fl);
         err = ip_route_output_flow(sock_net(sk), &rt, &fl, sk, 0);
 }
         if (!err)
-                sk_setup_caps(sk, &rt->u.dst);
+                sk_setup_caps(sk, &rt->dst);
         else {
                 /* Routing failed... */
                 sk->sk_route_caps = 0;
@@ -1141,13 +1178,12 @@ int inet_sk_rebuild_header(struct sock *sk)
 
         return err;
 }
-
 EXPORT_SYMBOL(inet_sk_rebuild_header);
 
 static int inet_gso_send_check(struct sk_buff *skb)
 {
         struct iphdr *iph;
-        struct net_protocol *ops;
+        const struct net_protocol *ops;
         int proto;
         int ihl;
         int err = -EINVAL;
@@ -1183,10 +1219,11 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct iphdr *iph;
-        struct net_protocol *ops;
+        const struct net_protocol *ops;
         int proto;
         int ihl;
         int id;
+        unsigned int offset = 0;
 
         if (!(features & NETIF_F_V4_CSUM))
                 features &= ~NETIF_F_SG;
@@ -1229,7 +1266,14 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features)
         skb = segs;
         do {
                 iph = ip_hdr(skb);
-                iph->id = htons(id++);
+                if (proto == IPPROTO_UDP) {
+                        iph->id = htons(id);
+                        iph->frag_off = htons(offset >> 3);
+                        if (skb->next != NULL)
+                                iph->frag_off |= htons(IP_MF);
+                        offset += (skb->len - skb->mac_len - iph->ihl * 4);
+                } else
+                        iph->id = htons(id++);
                 iph->tot_len = htons(skb->len - skb->mac_len);
                 iph->check = 0;
                 iph->check = ip_fast_csum(skb_network_header(skb), iph->ihl);
@@ -1242,7 +1286,7 @@ out:
 static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                                          struct sk_buff *skb)
 {
-        struct net_protocol *ops;
+        const struct net_protocol *ops;
         struct sk_buff **pp = NULL;
         struct sk_buff *p;
         struct iphdr *iph;
@@ -1274,8 +1318,8 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
         if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
                 goto out_unlock;
 
-        id = ntohl(*(u32 *)&iph->id);
-        flush = (u16)((ntohl(*(u32 *)iph) ^ skb_gro_len(skb)) | (id ^ IP_DF));
+        id = ntohl(*(__be32 *)&iph->id);
+        flush = (u16)((ntohl(*(__be32 *)iph) ^ skb_gro_len(skb)) | (id ^ IP_DF));
         id >>= 16;
 
         for (p = *head; p; p = p->next) {
@@ -1288,8 +1332,8 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
 
                 if ((iph->protocol ^ iph2->protocol) |
                     (iph->tos ^ iph2->tos) |
-                    (iph->saddr ^ iph2->saddr) |
-                    (iph->daddr ^ iph2->daddr)) {
+                    ((__force u32)iph->saddr ^ (__force u32)iph2->saddr) |
+                    ((__force u32)iph->daddr ^ (__force u32)iph2->daddr)) {
                         NAPI_GRO_CB(p)->same_flow = 0;
                         continue;
                 }
@@ -1319,7 +1363,7 @@ out:
 
 static int inet_gro_complete(struct sk_buff *skb)
 {
-        struct net_protocol *ops;
+        const struct net_protocol *ops;
         struct iphdr *iph = ip_hdr(skb);
         int proto = iph->protocol & (MAX_INET_PROTOS - 1);
         int err = -ENOSYS;
@@ -1361,10 +1405,9 @@ int inet_ctl_sock_create(struct sock **sk, unsigned short family,
         }
         return rc;
 }
-
 EXPORT_SYMBOL_GPL(inet_ctl_sock_create);
 
-unsigned long snmp_fold_field(void *mib[], int offt)
+unsigned long snmp_fold_field(void __percpu *mib[], int offt)
 {
         unsigned long res = 0;
         int i;
@@ -1377,13 +1420,49 @@ unsigned long snmp_fold_field(void *mib[], int offt)
 }
 EXPORT_SYMBOL_GPL(snmp_fold_field);
 
-int snmp_mib_init(void *ptr[2], size_t mibsize)
+#if BITS_PER_LONG==32
+
+u64 snmp_fold_field64(void __percpu *mib[], int offt, size_t syncp_offset)
+{
+        u64 res = 0;
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                void *bhptr, *userptr;
+                struct u64_stats_sync *syncp;
+                u64 v_bh, v_user;
+                unsigned int start;
+
+                /* first mib used by softirq context, we must use _bh() accessors */
+                bhptr = per_cpu_ptr(SNMP_STAT_BHPTR(mib), cpu);
+                syncp = (struct u64_stats_sync *)(bhptr + syncp_offset);
+                do {
+                        start = u64_stats_fetch_begin_bh(syncp);
+                        v_bh = *(((u64 *) bhptr) + offt);
+                } while (u64_stats_fetch_retry_bh(syncp, start));
+
+                /* second mib used in USER context */
+                userptr = per_cpu_ptr(SNMP_STAT_USRPTR(mib), cpu);
+                syncp = (struct u64_stats_sync *)(userptr + syncp_offset);
+                do {
+                        start = u64_stats_fetch_begin(syncp);
+                        v_user = *(((u64 *) userptr) + offt);
+                } while (u64_stats_fetch_retry(syncp, start));
+
+                res += v_bh + v_user;
+        }
+        return res;
+}
+EXPORT_SYMBOL_GPL(snmp_fold_field64);
+#endif
+
+int snmp_mib_init(void __percpu *ptr[2], size_t mibsize, size_t align)
 {
         BUG_ON(ptr == NULL);
-        ptr[0] = __alloc_percpu(mibsize, __alignof__(unsigned long long));
+        ptr[0] = __alloc_percpu(mibsize, align);
         if (!ptr[0])
                 goto err0;
-        ptr[1] = __alloc_percpu(mibsize, __alignof__(unsigned long long));
+        ptr[1] = __alloc_percpu(mibsize, align);
         if (!ptr[1])
                 goto err1;
         return 0;
@@ -1395,7 +1474,7 @@ err0:
 }
 EXPORT_SYMBOL_GPL(snmp_mib_init);
 
-void snmp_mib_free(void *ptr[2])
+void snmp_mib_free(void __percpu *ptr[2])
 {
         BUG_ON(ptr == NULL);
         free_percpu(ptr[0]);
@@ -1405,13 +1484,13 @@ void snmp_mib_free(void *ptr[2])
 EXPORT_SYMBOL_GPL(snmp_mib_free);
 
 #ifdef CONFIG_IP_MULTICAST
-static struct net_protocol igmp_protocol = {
+static const struct net_protocol igmp_protocol = {
         .handler =      igmp_rcv,
         .netns_ok =     1,
 };
 #endif
 
-static struct net_protocol tcp_protocol = {
+static const struct net_protocol tcp_protocol = {
         .handler =      tcp_v4_rcv,
         .err_handler =  tcp_v4_err,
         .gso_send_check = tcp_v4_gso_send_check,
@@ -1422,14 +1501,16 @@ static struct net_protocol tcp_protocol = {
         .netns_ok =     1,
 };
 
-static struct net_protocol udp_protocol = {
+static const struct net_protocol udp_protocol = {
         .handler =      udp_rcv,
         .err_handler =  udp_err,
+        .gso_send_check = udp4_ufo_send_check,
+        .gso_segment = udp4_ufo_fragment,
         .no_policy =    1,
         .netns_ok =     1,
 };
 
-static struct net_protocol icmp_protocol = {
+static const struct net_protocol icmp_protocol = {
         .handler =      icmp_rcv,
         .no_policy =    1,
         .netns_ok =     1,
@@ -1437,56 +1518,63 @@ static struct net_protocol icmp_protocol = {
 
 static __net_init int ipv4_mib_init_net(struct net *net)
 {
-        if (snmp_mib_init((void **)net->mib.tcp_statistics,
-                          sizeof(struct tcp_mib)) < 0)
+        if (snmp_mib_init((void __percpu **)net->mib.tcp_statistics,
+                          sizeof(struct tcp_mib),
+                          __alignof__(struct tcp_mib)) < 0)
                 goto err_tcp_mib;
-        if (snmp_mib_init((void **)net->mib.ip_statistics,
-                          sizeof(struct ipstats_mib)) < 0)
+        if (snmp_mib_init((void __percpu **)net->mib.ip_statistics,
+                          sizeof(struct ipstats_mib),
+                          __alignof__(struct ipstats_mib)) < 0)
                 goto err_ip_mib;
-        if (snmp_mib_init((void **)net->mib.net_statistics,
-                          sizeof(struct linux_mib)) < 0)
+        if (snmp_mib_init((void __percpu **)net->mib.net_statistics,
+                          sizeof(struct linux_mib),
+                          __alignof__(struct linux_mib)) < 0)
                 goto err_net_mib;
-        if (snmp_mib_init((void **)net->mib.udp_statistics,
-                          sizeof(struct udp_mib)) < 0)
+        if (snmp_mib_init((void __percpu **)net->mib.udp_statistics,
+                          sizeof(struct udp_mib),
+                          __alignof__(struct udp_mib)) < 0)
                 goto err_udp_mib;
-        if (snmp_mib_init((void **)net->mib.udplite_statistics,
-                          sizeof(struct udp_mib)) < 0)
+        if (snmp_mib_init((void __percpu **)net->mib.udplite_statistics,
+                          sizeof(struct udp_mib),
+                          __alignof__(struct udp_mib)) < 0)
                 goto err_udplite_mib;
-        if (snmp_mib_init((void **)net->mib.icmp_statistics,
-                          sizeof(struct icmp_mib)) < 0)
+        if (snmp_mib_init((void __percpu **)net->mib.icmp_statistics,
+                          sizeof(struct icmp_mib),
+                          __alignof__(struct icmp_mib)) < 0)
                 goto err_icmp_mib;
-        if (snmp_mib_init((void **)net->mib.icmpmsg_statistics,
-                          sizeof(struct icmpmsg_mib)) < 0)
+        if (snmp_mib_init((void __percpu **)net->mib.icmpmsg_statistics,
+                          sizeof(struct icmpmsg_mib),
+                          __alignof__(struct icmpmsg_mib)) < 0)
                 goto err_icmpmsg_mib;
 
         tcp_mib_init(net);
         return 0;
 
 err_icmpmsg_mib:
-        snmp_mib_free((void **)net->mib.icmp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmp_statistics);
 err_icmp_mib:
-        snmp_mib_free((void **)net->mib.udplite_statistics);
+        snmp_mib_free((void __percpu **)net->mib.udplite_statistics);
 err_udplite_mib:
-        snmp_mib_free((void **)net->mib.udp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.udp_statistics);
 err_udp_mib:
-        snmp_mib_free((void **)net->mib.net_statistics);
+        snmp_mib_free((void __percpu **)net->mib.net_statistics);
 err_net_mib:
-        snmp_mib_free((void **)net->mib.ip_statistics);
+        snmp_mib_free((void __percpu **)net->mib.ip_statistics);
 err_ip_mib:
-        snmp_mib_free((void **)net->mib.tcp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.tcp_statistics);
 err_tcp_mib:
         return -ENOMEM;
 }
 
 static __net_exit void ipv4_mib_exit_net(struct net *net)
 {
-        snmp_mib_free((void **)net->mib.icmpmsg_statistics);
-        snmp_mib_free((void **)net->mib.icmp_statistics);
-        snmp_mib_free((void **)net->mib.udplite_statistics);
-        snmp_mib_free((void **)net->mib.udp_statistics);
-        snmp_mib_free((void **)net->mib.net_statistics);
-        snmp_mib_free((void **)net->mib.ip_statistics);
-        snmp_mib_free((void **)net->mib.tcp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmpmsg_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.udplite_statistics);
+        snmp_mib_free((void __percpu **)net->mib.udp_statistics);
+        snmp_mib_free((void __percpu **)net->mib.net_statistics);
+        snmp_mib_free((void __percpu **)net->mib.ip_statistics);
+        snmp_mib_free((void __percpu **)net->mib.tcp_statistics);
 }
 
 static __net_initdata struct pernet_operations ipv4_mib_ops = {
@@ -1523,9 +1611,13 @@ static int __init inet_init(void)
 
         BUILD_BUG_ON(sizeof(struct inet_skb_parm) > sizeof(dummy_skb->cb));
 
+        sysctl_local_reserved_ports = kzalloc(65536 / 8, GFP_KERNEL);
+        if (!sysctl_local_reserved_ports)
+                goto out;
+
         rc = proto_register(&tcp_prot, 1);
         if (rc)
-                goto out;
+                goto out_free_reserved_ports;
 
         rc = proto_register(&udp_prot, 1);
         if (rc)
@@ -1624,6 +1716,8 @@ out_unregister_udp_proto:
         proto_unregister(&udp_prot);
 out_unregister_tcp_proto:
         proto_unregister(&tcp_prot);
+out_free_reserved_ports:
+        kfree(sysctl_local_reserved_ports);
         goto out;
 }
 
@@ -1666,19 +1760,3 @@ static int __init ipv4_proc_init(void)
 
 MODULE_ALIAS_NETPROTO(PF_INET);
 
-EXPORT_SYMBOL(inet_accept);
-EXPORT_SYMBOL(inet_bind);
-EXPORT_SYMBOL(inet_dgram_connect);
-EXPORT_SYMBOL(inet_dgram_ops);
-EXPORT_SYMBOL(inet_getname);
-EXPORT_SYMBOL(inet_ioctl);
-EXPORT_SYMBOL(inet_listen);
-EXPORT_SYMBOL(inet_register_protosw);
-EXPORT_SYMBOL(inet_release);
-EXPORT_SYMBOL(inet_sendmsg);
-EXPORT_SYMBOL(inet_shutdown);
-EXPORT_SYMBOL(inet_sock_destruct);
-EXPORT_SYMBOL(inet_stream_connect);
-EXPORT_SYMBOL(inet_stream_ops);
-EXPORT_SYMBOL(inet_unregister_protosw);
-EXPORT_SYMBOL(sysctl_ip_nonlocal_bind);
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index e878e494296e..86961bec70ab 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -1,14 +1,73 @@
+#include <crypto/hash.h>
 #include <linux/err.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
-#include <linux/spinlock.h>
+#include <linux/scatterlist.h>
 #include <net/icmp.h>
 #include <net/protocol.h>
 
+struct ah_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+
+#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+
+static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+                          unsigned int size)
+{
+        unsigned int len;
+
+        len = size + crypto_ahash_digestsize(ahash) +
+              (crypto_ahash_alignmask(ahash) &
+               ~(crypto_tfm_ctx_alignment() - 1));
+
+        len = ALIGN(len, crypto_tfm_ctx_alignment());
+
+        len += sizeof(struct ahash_request) + crypto_ahash_reqsize(ahash);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+
+        len += sizeof(struct scatterlist) * nfrags;
+
+        return kmalloc(len, GFP_ATOMIC);
+}
+
+static inline u8 *ah_tmp_auth(void *tmp, unsigned int offset)
+{
+        return tmp + offset;
+}
+
+static inline u8 *ah_tmp_icv(struct crypto_ahash *ahash, void *tmp,
+                             unsigned int offset)
+{
+        return PTR_ALIGN((u8 *)tmp + offset, crypto_ahash_alignmask(ahash) + 1);
+}
+
+static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash,
+                                               u8 *icv)
+{
+        struct ahash_request *req;
+
+        req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash),
+                                crypto_tfm_ctx_alignment());
+
+        ahash_request_set_tfm(req, ahash);
+
+        return req;
+}
+
+static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
+                                             struct ahash_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_ahash_reqsize(ahash),
+                             __alignof__(struct scatterlist));
+}
 
 /* Clear mutable options and find final destination to substitute
  * into IP header for icv calculation. Options are already checked
@@ -54,20 +113,72 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr)
         return 0;
 }
 
+static void ah_output_done(struct crypto_async_request *base, int err)
+{
+        u8 *icv;
+        struct iphdr *iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = skb_dst(skb)->xfrm;
+        struct ah_data *ahp = x->data;
+        struct iphdr *top_iph = ip_hdr(skb);
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int ihl = ip_hdrlen(skb);
+
+        iph = AH_SKB_CB(skb)->tmp;
+        icv = ah_tmp_icv(ahp->ahash, iph, ihl);
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+
+        top_iph->tos = iph->tos;
+        top_iph->ttl = iph->ttl;
+        top_iph->frag_off = iph->frag_off;
+        if (top_iph->ihl != 5) {
+                top_iph->daddr = iph->daddr;
+                memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
+        }
+
+        err = ah->nexthdr;
+
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
+
 static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
+        int nfrags;
+        int ihl;
+        u8 *icv;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
         struct iphdr *iph, *top_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        union {
-                struct iphdr    iph;
-                char            buf[60];
-        } tmp_iph;
+
+        ahp = x->data;
+        ahash = ahp->ahash;
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
 
         skb_push(skb, -skb_network_offset(skb));
+        ah = ip_auth_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
+        err = -ENOMEM;
+        iph = ah_alloc_tmp(ahash, nfrags, ihl);
+        if (!iph)
+                goto out;
+
+        icv = ah_tmp_icv(ahash, iph, ihl);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
         top_iph = ip_hdr(skb);
-        iph = &tmp_iph.iph;
 
         iph->tos = top_iph->tos;
         iph->ttl = top_iph->ttl;
@@ -78,10 +189,9 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 memcpy(iph+1, top_iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
                 err = ip_clear_mutable_options(top_iph, &top_iph->daddr);
                 if (err)
-                        goto error;
+                        goto out_free;
         }
 
-        ah = ip_auth_hdr(skb);
         ah->nexthdr = *skb_mac_header(skb);
         *skb_mac_header(skb) = IPPROTO_AH;
 
@@ -91,20 +201,31 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->ttl = 0;
         top_iph->check = 0;
 
-        ahp = x->data;
         ah->hdrlen  = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2;
 
         ah->reserved = 0;
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
 
-        spin_lock_bh(&x->lock);
-        err = ah_mac_digest(ahp, skb, ah->auth_data);
-        memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
-        spin_unlock_bh(&x->lock);
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
 
-        if (err)
-                goto error;
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah_output_done, skb);
+
+        AH_SKB_CB(skb)->tmp = iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
+        }
+
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
 
         top_iph->tos = iph->tos;
         top_iph->ttl = iph->ttl;
@@ -114,28 +235,67 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
         }
 
-        err = 0;
-
-error:
+out_free:
+        kfree(iph);
+out:
         return err;
 }
 
+static void ah_input_done(struct crypto_async_request *base, int err)
+{
+        u8 *auth_data;
+        u8 *icv;
+        struct iphdr *work_iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = xfrm_input_state(skb);
+        struct ah_data *ahp = x->data;
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int ihl = ip_hdrlen(skb);
+        int ah_hlen = (ah->hdrlen + 2) << 2;
+
+        work_iph = AH_SKB_CB(skb)->tmp;
+        auth_data = ah_tmp_auth(work_iph, ihl);
+        icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
+
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
+        if (err)
+                goto out;
+
+        skb->network_header += ah_hlen;
+        memcpy(skb_network_header(skb), work_iph, ihl);
+        __skb_pull(skb, ah_hlen + ihl);
+        skb_set_transport_header(skb, -ihl);
+
+        err = ah->nexthdr;
+out:
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_input_resume(skb, err);
+}
+
 static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int ah_hlen;
         int ihl;
         int nexthdr;
-        int err = -EINVAL;
-        struct iphdr *iph;
+        int nfrags;
+        u8 *auth_data;
+        u8 *icv;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
+        struct iphdr *iph, *work_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        char work_buf[60];
+        int err = -ENOMEM;
 
         if (!pskb_may_pull(skb, sizeof(*ah)))
                 goto out;
 
         ah = (struct ip_auth_hdr *)skb->data;
         ahp = x->data;
+        ahash = ahp->ahash;
+
         nexthdr = ah->nexthdr;
         ah_hlen = (ah->hdrlen + 2) << 2;
 
@@ -154,11 +314,27 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb->ip_summed = CHECKSUM_NONE;
 
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
+
         ah = (struct ip_auth_hdr *)skb->data;
         iph = ip_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
+        work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
+        if (!work_iph)
+                goto out;
+
+        auth_data = ah_tmp_auth(work_iph, ihl);
+        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
 
-        ihl = skb->data - skb_network_header(skb);
-        memcpy(work_buf, iph, ihl);
+        memcpy(work_iph, iph, ihl);
+        memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
 
         iph->ttl = 0;
         iph->tos = 0;
@@ -166,35 +342,44 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
         iph->check = 0;
         if (ihl > sizeof(*iph)) {
                 __be32 dummy;
-                if (ip_clear_mutable_options(iph, &dummy))
-                        goto out;
+                err = ip_clear_mutable_options(iph, &dummy);
+                if (err)
+                        goto out_free;
         }
 
-        spin_lock(&x->lock);
-        {
-                u8 auth_data[MAX_AH_AUTH_LEN];
+        skb_push(skb, ihl);
 
-                memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
-                skb_push(skb, ihl);
-                err = ah_mac_digest(ahp, skb, ah->auth_data);
-                if (err)
-                        goto unlock;
-                if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len))
-                        err = -EBADMSG;
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
+
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah_input_done, skb);
+
+        AH_SKB_CB(skb)->tmp = work_iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
         }
-unlock:
-        spin_unlock(&x->lock);
 
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
         if (err)
-                goto out;
+                goto out_free;
 
         skb->network_header += ah_hlen;
-        memcpy(skb_network_header(skb), work_buf, ihl);
-        skb->transport_header = skb->network_header;
+        memcpy(skb_network_header(skb), work_iph, ihl);
         __skb_pull(skb, ah_hlen + ihl);
+        skb_set_transport_header(skb, -ihl);
 
-        return nexthdr;
+        err = nexthdr;
 
+out_free:
+        kfree (work_iph);
 out:
         return err;
 }
@@ -210,7 +395,7 @@ static void ah4_err(struct sk_buff *skb, u32 info)
             icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
                 return;
 
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
         if (!x)
                 return;
         printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n",
@@ -222,7 +407,7 @@ static int ah_init_state(struct xfrm_state *x)
 {
         struct ah_data *ahp = NULL;
         struct xfrm_algo_desc *aalg_desc;
-        struct crypto_hash *tfm;
+        struct crypto_ahash *ahash;
 
         if (!x->aalg)
                 goto error;
@@ -231,44 +416,40 @@ static int ah_init_state(struct xfrm_state *x)
                 goto error;
 
         ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
-        if (ahp == NULL)
+        if (!ahp)
                 return -ENOMEM;
 
-        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
+        ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
+        if (IS_ERR(ahash))
                 goto error;
 
-        ahp->tfm = tfm;
-        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
-                               (x->aalg->alg_key_len + 7) / 8))
+        ahp->ahash = ahash;
+        if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
+                                (x->aalg->alg_key_len + 7) / 8))
                 goto error;
 
         /*
          * Lookup the algorithm description maintained by xfrm_algo,
          * verify crypto transform properties, and store information
          * we need for AH processing.  This lookup cannot fail here
-         * after a successful crypto_alloc_hash().
+         * after a successful crypto_alloc_ahash().
          */
         aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
         BUG_ON(!aalg_desc);
 
         if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-            crypto_hash_digestsize(tfm)) {
+            crypto_ahash_digestsize(ahash)) {
                 printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_hash_digestsize(tfm),
+                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
                        aalg_desc->uinfo.auth.icv_fullbits/8);
                 goto error;
         }
 
         ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
-        ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
+        ahp->icv_trunc_len = x->aalg->alg_trunc_len/8;
 
         BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
 
-        ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
-        if (!ahp->work_icv)
-                goto error;
-
         x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
                                           ahp->icv_trunc_len);
         if (x->props.mode == XFRM_MODE_TUNNEL)
@@ -279,8 +460,7 @@ static int ah_init_state(struct xfrm_state *x)
 
 error:
         if (ahp) {
-                kfree(ahp->work_icv);
-                crypto_free_hash(ahp->tfm);
+                crypto_free_ahash(ahp->ahash);
                 kfree(ahp);
         }
         return -EINVAL;
@@ -293,8 +473,7 @@ static void ah_destroy(struct xfrm_state *x)
         if (!ahp)
                 return;
 
-        kfree(ahp->work_icv);
-        crypto_free_hash(ahp->tfm);
+        crypto_free_ahash(ahp->ahash);
         kfree(ahp);
 }
 
@@ -311,7 +490,7 @@ static const struct xfrm_type ah_type =
         .output         = ah_output
 };
 
-static struct net_protocol ah4_protocol = {
+static const struct net_protocol ah4_protocol = {
         .handler        =       xfrm4_rcv,
         .err_handler    =       ah4_err,
         .no_policy      =       1,
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 8a3881e28aca..04c8b69fd426 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -55,7 +55,7 @@
  *              Stuart Cheshire :       Metricom and grat arp fixes
  *                                      *** FOR 2.1 clean this up ***
  *              Lawrence V. Stefani: (08/12/96) Added FDDI support.
- *              Alan Cox        :       Took the AP1000 nasty FDDI hack and
+ *              Alan Cox        :       Took the AP1000 nasty FDDI hack and
  *                                      folded into the mainstream FDDI code.
  *                                      Ack spit, Linus how did you allow that
  *                                      one in...
@@ -70,6 +70,7 @@
  *                                      bonding can change the skb before
  *                                      sending (e.g. insert 8021q tag).
  *              Harald Welte    :       convert to make use of jenkins hash
+ *              Jesper D. Brouer:       Proxy ARP PVLAN RFC 3069 support.
  */
 
 #include <linux/module.h>
@@ -97,6 +98,7 @@
 #include <linux/net.h>
 #include <linux/rcupdate.h>
 #include <linux/jhash.h>
+#include <linux/slab.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
@@ -114,23 +116,24 @@
 #if defined(CONFIG_ATM_CLIP) || defined(CONFIG_ATM_CLIP_MODULE)
 #include <net/atmclip.h>
 struct neigh_table *clip_tbl_hook;
+EXPORT_SYMBOL(clip_tbl_hook);
 #endif
 
 #include <asm/system.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include <linux/netfilter_arp.h>
 
 /*
  *      Interface to generic neighbour cache.
  */
-static u32 arp_hash(const void *pkey, const struct net_device *dev);
+static u32 arp_hash(const void *pkey, const struct net_device *dev, __u32 rnd);
 static int arp_constructor(struct neighbour *neigh);
 static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb);
 static void arp_error_report(struct neighbour *neigh, struct sk_buff *skb);
 static void parp_redo(struct sk_buff *skb);
 
-static struct neigh_ops arp_generic_ops = {
+static const struct neigh_ops arp_generic_ops = {
         .family =               AF_INET,
         .solicit =              arp_solicit,
         .error_report =         arp_error_report,
@@ -140,7 +143,7 @@ static struct neigh_ops arp_generic_ops = {
         .queue_xmit =           dev_queue_xmit,
 };
 
-static struct neigh_ops arp_hh_ops = {
+static const struct neigh_ops arp_hh_ops = {
         .family =               AF_INET,
         .solicit =              arp_solicit,
         .error_report =         arp_error_report,
@@ -150,7 +153,7 @@ static struct neigh_ops arp_hh_ops = {
         .queue_xmit =           dev_queue_xmit,
 };
 
-static struct neigh_ops arp_direct_ops = {
+static const struct neigh_ops arp_direct_ops = {
         .family =               AF_INET,
         .output =               dev_queue_xmit,
         .connected_output =     dev_queue_xmit,
@@ -158,7 +161,7 @@ static struct neigh_ops arp_direct_ops = {
         .queue_xmit =           dev_queue_xmit,
 };
 
-struct neigh_ops arp_broken_ops = {
+static const struct neigh_ops arp_broken_ops = {
         .family =               AF_INET,
         .solicit =              arp_solicit,
         .error_report =         arp_error_report,
@@ -169,33 +172,34 @@ struct neigh_ops arp_broken_ops = {
 };
 
 struct neigh_table arp_tbl = {
-        .family =       AF_INET,
-        .entry_size =   sizeof(struct neighbour) + 4,
-        .key_len =      4,
-        .hash =         arp_hash,
-        .constructor =  arp_constructor,
-        .proxy_redo =   parp_redo,
-        .id =           "arp_cache",
-        .parms = {
-                .tbl =                  &arp_tbl,
-                .base_reachable_time =  30 * HZ,
-                .retrans_time = 1 * HZ,
-                .gc_staletime = 60 * HZ,
-                .reachable_time =               30 * HZ,
-                .delay_probe_time =     5 * HZ,
-                .queue_len =            3,
-                .ucast_probes = 3,
-                .mcast_probes = 3,
-                .anycast_delay =        1 * HZ,
-                .proxy_delay =          (8 * HZ) / 10,
-                .proxy_qlen =           64,
-                .locktime =             1 * HZ,
+        .family         = AF_INET,
+        .entry_size     = sizeof(struct neighbour) + 4,
+        .key_len        = 4,
+        .hash           = arp_hash,
+        .constructor    = arp_constructor,
+        .proxy_redo     = parp_redo,
+        .id             = "arp_cache",
+        .parms          = {
+                .tbl                    = &arp_tbl,
+                .base_reachable_time    = 30 * HZ,
+                .retrans_time           = 1 * HZ,
+                .gc_staletime           = 60 * HZ,
+                .reachable_time         = 30 * HZ,
+                .delay_probe_time       = 5 * HZ,
+                .queue_len              = 3,
+                .ucast_probes           = 3,
+                .mcast_probes           = 3,
+                .anycast_delay          = 1 * HZ,
+                .proxy_delay            = (8 * HZ) / 10,
+                .proxy_qlen             = 64,
+                .locktime               = 1 * HZ,
         },
-        .gc_interval =  30 * HZ,
-        .gc_thresh1 =   128,
-        .gc_thresh2 =   512,
-        .gc_thresh3 =   1024,
+        .gc_interval    = 30 * HZ,
+        .gc_thresh1     = 128,
+        .gc_thresh2     = 512,
+        .gc_thresh3     = 1024,
 };
+EXPORT_SYMBOL(arp_tbl);
 
 int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir)
 {
@@ -221,14 +225,16 @@ int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir)
 }
 
 
-static u32 arp_hash(const void *pkey, const struct net_device *dev)
+static u32 arp_hash(const void *pkey,
+                    const struct net_device *dev,
+                    __u32 hash_rnd)
 {
-        return jhash_2words(*(u32 *)pkey, dev->ifindex, arp_tbl.hash_rnd);
+        return jhash_2words(*(u32 *)pkey, dev->ifindex, hash_rnd);
 }
 
 static int arp_constructor(struct neighbour *neigh)
 {
-        __be32 addr = *(__be32*)neigh->primary_key;
+        __be32 addr = *(__be32 *)neigh->primary_key;
         struct net_device *dev = neigh->dev;
         struct in_device *in_dev;
         struct neigh_parms *parms;
@@ -291,16 +297,19 @@ static int arp_constructor(struct neighbour *neigh)
                         neigh->ops = &arp_broken_ops;
                         neigh->output = neigh->ops->output;
                         return 0;
+#else
+                        break;
 #endif
-                ;}
+                }
 #endif
                 if (neigh->type == RTN_MULTICAST) {
                         neigh->nud_state = NUD_NOARP;
                         arp_mc_map(addr, neigh->ha, dev, 1);
-                } else if (dev->flags&(IFF_NOARP|IFF_LOOPBACK)) {
+                } else if (dev->flags & (IFF_NOARP | IFF_LOOPBACK)) {
                         neigh->nud_state = NUD_NOARP;
                         memcpy(neigh->ha, dev->dev_addr, dev->addr_len);
-                } else if (neigh->type == RTN_BROADCAST || dev->flags&IFF_POINTOPOINT) {
+                } else if (neigh->type == RTN_BROADCAST ||
+                           (dev->flags & IFF_POINTOPOINT)) {
                         neigh->nud_state = NUD_NOARP;
                         memcpy(neigh->ha, dev->broadcast, dev->addr_len);
                 }
@@ -310,7 +319,7 @@ static int arp_constructor(struct neighbour *neigh)
                 else
                         neigh->ops = &arp_generic_ops;
 
-                if (neigh->nud_state&NUD_VALID)
+                if (neigh->nud_state & NUD_VALID)
                         neigh->output = neigh->ops->connected_output;
                 else
                         neigh->output = neigh->ops->output;
@@ -329,17 +338,21 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         __be32 saddr = 0;
         u8  *dst_ha = NULL;
         struct net_device *dev = neigh->dev;
-        __be32 target = *(__be32*)neigh->primary_key;
+        __be32 target = *(__be32 *)neigh->primary_key;
         int probes = atomic_read(&neigh->probes);
-        struct in_device *in_dev = in_dev_get(dev);
+        struct in_device *in_dev;
 
-        if (!in_dev)
+        rcu_read_lock();
+        in_dev = __in_dev_get_rcu(dev);
+        if (!in_dev) {
+                rcu_read_unlock();
                 return;
-
+        }
         switch (IN_DEV_ARP_ANNOUNCE(in_dev)) {
         default:
         case 0:         /* By default announce any local IP */
-                if (skb && inet_addr_type(dev_net(dev), ip_hdr(skb)->saddr) == RTN_LOCAL)
+                if (skb && inet_addr_type(dev_net(dev),
+                                          ip_hdr(skb)->saddr) == RTN_LOCAL)
                         saddr = ip_hdr(skb)->saddr;
                 break;
         case 1:         /* Restrict announcements of saddr in same subnet */
@@ -356,22 +369,26 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         case 2:         /* Avoid secondary IPs, get a primary/preferred one */
                 break;
         }
+        rcu_read_unlock();
 
-        if (in_dev)
-                in_dev_put(in_dev);
         if (!saddr)
                 saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
 
-        if ((probes -= neigh->parms->ucast_probes) < 0) {
-                if (!(neigh->nud_state&NUD_VALID))
-                        printk(KERN_DEBUG "trying to ucast probe in NUD_INVALID\n");
+        probes -= neigh->parms->ucast_probes;
+        if (probes < 0) {
+                if (!(neigh->nud_state & NUD_VALID))
+                        printk(KERN_DEBUG
+                               "trying to ucast probe in NUD_INVALID\n");
                 dst_ha = neigh->ha;
                 read_lock_bh(&neigh->lock);
-        } else if ((probes -= neigh->parms->app_probes) < 0) {
+        } else {
+                probes -= neigh->parms->app_probes;
+                if (probes < 0) {
 #ifdef CONFIG_ARPD
-                neigh_app_ns(neigh);
+                        neigh_app_ns(neigh);
 #endif
-                return;
+                        return;
+                }
         }
 
         arp_send(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr,
@@ -416,8 +433,8 @@ static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
 
 static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
 {
-        struct flowi fl = { .nl_u = { .ip4_u = { .daddr = sip,
-                                                 .saddr = tip } } };
+        struct flowi fl = { .fl4_dst = sip,
+                            .fl4_src = tip };
         struct rtable *rt;
         int flag = 0;
         /*unsigned long now; */
@@ -425,7 +442,7 @@ static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
 
         if (ip_route_output_key(net, &rt, &fl) < 0)
                 return 1;
-        if (rt->u.dst.dev != dev) {
+        if (rt->dst.dev != dev) {
                 NET_INC_STATS_BH(net, LINUX_MIB_ARPFILTER);
                 flag = 1;
         }
@@ -444,7 +461,8 @@ static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
  *      is allowed to use this function, it is scheduled to be removed. --ANK
  */
 
-static int arp_set_predefined(int addr_hint, unsigned char * haddr, __be32 paddr, struct net_device * dev)
+static int arp_set_predefined(int addr_hint, unsigned char *haddr,
+                              __be32 paddr, struct net_device *dev)
 {
         switch (addr_hint) {
         case RTN_LOCAL:
@@ -476,17 +494,16 @@ int arp_find(unsigned char *haddr, struct sk_buff *skb)
 
         paddr = skb_rtable(skb)->rt_gateway;
 
-        if (arp_set_predefined(inet_addr_type(dev_net(dev), paddr), haddr, paddr, dev))
+        if (arp_set_predefined(inet_addr_type(dev_net(dev), paddr), haddr,
+                               paddr, dev))
                 return 0;
 
         n = __neigh_lookup(&arp_tbl, &paddr, dev, 1);
 
         if (n) {
                 n->used = jiffies;
-                if (n->nud_state&NUD_VALID || neigh_event_send(n, skb) == 0) {
-                        read_lock_bh(&n->lock);
-                        memcpy(haddr, n->ha, dev->addr_len);
-                        read_unlock_bh(&n->lock);
+                if (n->nud_state & NUD_VALID || neigh_event_send(n, skb) == 0) {
+                        neigh_ha_snapshot(haddr, n, dev);
                         neigh_release(n);
                         return 0;
                 }
@@ -495,6 +512,7 @@ int arp_find(unsigned char *haddr, struct sk_buff *skb)
                 kfree_skb(skb);
         return 1;
 }
+EXPORT_SYMBOL(arp_find);
 
 /* END OF OBSOLETE FUNCTIONS */
 
@@ -507,13 +525,14 @@ int arp_bind_neighbour(struct dst_entry *dst)
                 return -EINVAL;
         if (n == NULL) {
                 __be32 nexthop = ((struct rtable *)dst)->rt_gateway;
-                if (dev->flags&(IFF_LOOPBACK|IFF_POINTOPOINT))
+                if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT))
                         nexthop = 0;
                 n = __neigh_lookup_errno(
 #if defined(CONFIG_ATM_CLIP) || defined(CONFIG_ATM_CLIP_MODULE)
-                    dev->type == ARPHRD_ATM ? clip_tbl_hook :
+                                         dev->type == ARPHRD_ATM ?
+                                         clip_tbl_hook :
 #endif
-                    &arp_tbl, &nexthop, dev);
+                                         &arp_tbl, &nexthop, dev);
                 if (IS_ERR(n))
                         return PTR_ERR(n);
                 dst->neighbour = n;
@@ -524,27 +543,67 @@ int arp_bind_neighbour(struct dst_entry *dst)
 /*
  * Check if we can use proxy ARP for this path
  */
-
-static inline int arp_fwd_proxy(struct in_device *in_dev, struct rtable *rt)
+static inline int arp_fwd_proxy(struct in_device *in_dev,
+                                struct net_device *dev, struct rtable *rt)
 {
         struct in_device *out_dev;
         int imi, omi = -1;
 
-        if (!IN_DEV_PROXY_ARP(in_dev))
+        if (rt->dst.dev == dev)
                 return 0;
 
-        if ((imi = IN_DEV_MEDIUM_ID(in_dev)) == 0)
+        if (!IN_DEV_PROXY_ARP(in_dev))
+                return 0;
+        imi = IN_DEV_MEDIUM_ID(in_dev);
+        if (imi == 0)
                 return 1;
         if (imi == -1)
                 return 0;
 
         /* place to check for proxy_arp for routes */
 
-        if ((out_dev = in_dev_get(rt->u.dst.dev)) != NULL) {
+        out_dev = __in_dev_get_rcu(rt->dst.dev);
+        if (out_dev)
                 omi = IN_DEV_MEDIUM_ID(out_dev);
-                in_dev_put(out_dev);
-        }
-        return (omi != imi && omi != -1);
+
+        return omi != imi && omi != -1;
+}
+
+/*
+ * Check for RFC3069 proxy arp private VLAN (allow to send back to same dev)
+ *
+ * RFC3069 supports proxy arp replies back to the same interface.  This
+ * is done to support (ethernet) switch features, like RFC 3069, where
+ * the individual ports are not allowed to communicate with each
+ * other, BUT they are allowed to talk to the upstream router.  As
+ * described in RFC 3069, it is possible to allow these hosts to
+ * communicate through the upstream router, by proxy_arp'ing.
+ *
+ * RFC 3069: "VLAN Aggregation for Efficient IP Address Allocation"
+ *
+ *  This technology is known by different names:
+ *    In RFC 3069 it is called VLAN Aggregation.
+ *    Cisco and Allied Telesyn call it Private VLAN.
+ *    Hewlett-Packard call it Source-Port filtering or port-isolation.
+ *    Ericsson call it MAC-Forced Forwarding (RFC Draft).
+ *
+ */
+static inline int arp_fwd_pvlan(struct in_device *in_dev,
+                                struct net_device *dev, struct rtable *rt,
+                                __be32 sip, __be32 tip)
+{
+        /* Private VLAN is only concerned about the same ethernet segment */
+        if (rt->dst.dev != dev)
+                return 0;
+
+        /* Don't reply on self probes (often done by windowz boxes)*/
+        if (sip == tip)
+                return 0;
+
+        if (IN_DEV_PROXY_ARP_PVLAN(in_dev))
+                return 1;
+        else
+                return 0;
 }
 
 /*
@@ -619,13 +678,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
 #endif
 #endif
 
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
         case ARPHRD_FDDI:
                 arp->ar_hrd = htons(ARPHRD_ETHER);
                 arp->ar_pro = htons(ETH_P_IP);
                 break;
 #endif
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
         case ARPHRD_IEEE802_TR:
                 arp->ar_hrd = htons(ARPHRD_IEEE802);
                 arp->ar_pro = htons(ETH_P_IP);
@@ -637,7 +696,7 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
         arp->ar_pln = 4;
         arp->ar_op = htons(type);
 
-        arp_ptr=(unsigned char *)(arp+1);
+        arp_ptr = (unsigned char *)(arp + 1);
 
         memcpy(arp_ptr, src_hw, dev->addr_len);
         arp_ptr += dev->addr_len;
@@ -656,6 +715,7 @@ out:
         kfree_skb(skb);
         return NULL;
 }
+EXPORT_SYMBOL(arp_create);
 
 /*
  *      Send an arp packet.
@@ -665,6 +725,7 @@ void arp_xmit(struct sk_buff *skb)
         /* Send it off, maybe filter it using firewalling first.  */
         NF_HOOK(NFPROTO_ARP, NF_ARP_OUT, skb, NULL, skb->dev, dev_queue_xmit);
 }
+EXPORT_SYMBOL(arp_xmit);
 
 /*
  *      Create and send an arp packet.
@@ -685,12 +746,12 @@ void arp_send(int type, int ptype, __be32 dest_ip,
 
         skb = arp_create(type, ptype, dest_ip, dev, src_ip,
                          dest_hw, src_hw, target_hw);
-        if (skb == NULL) {
+        if (skb == NULL)
                 return;
-        }
 
         arp_xmit(skb);
 }
+EXPORT_SYMBOL(arp_send);
 
 /*
  *      Process an arp request.
@@ -699,7 +760,7 @@ void arp_send(int type, int ptype, __be32 dest_ip,
 static int arp_process(struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
-        struct in_device *in_dev = in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rcu(dev);
         struct arphdr *arp;
         unsigned char *arp_ptr;
         struct rtable *rt;
@@ -764,7 +825,7 @@ static int arp_process(struct sk_buff *skb)
 /*
  *      Extract fields
  */
-        arp_ptr= (unsigned char *)(arp+1);
+        arp_ptr = (unsigned char *)(arp + 1);
         sha     = arp_ptr;
         arp_ptr += dev->addr_len;
         memcpy(&sip, arp_ptr, 4);
@@ -801,11 +862,8 @@ static int arp_process(struct sk_buff *skb)
  *  cache.
  */
 
-        /*
-         *  Special case: IPv4 duplicate address detection packet (RFC2131)
-         *  and Gratuitous ARP/ARP Announce. (RFC3927, Section 2.4)
-         */
-        if (sip == 0 || tip == sip) {
+        /* Special case: IPv4 duplicate address detection packet (RFC2131) */
+        if (sip == 0) {
                 if (arp->ar_op == htons(ARPOP_REQUEST) &&
                     inet_addr_type(net, tip) == RTN_LOCAL &&
                     !arp_ignore(in_dev, sip, tip))
@@ -815,29 +873,32 @@ static int arp_process(struct sk_buff *skb)
         }
 
         if (arp->ar_op == htons(ARPOP_REQUEST) &&
-            ip_route_input(skb, tip, sip, 0, dev) == 0) {
+            ip_route_input_noref(skb, tip, sip, 0, dev) == 0) {
 
                 rt = skb_rtable(skb);
                 addr_type = rt->rt_type;
 
                 if (addr_type == RTN_LOCAL) {
-                        int dont_send = 0;
+                        int dont_send;
 
-                        if (!dont_send)
-                                dont_send |= arp_ignore(in_dev,sip,tip);
+                        dont_send = arp_ignore(in_dev, sip, tip);
                         if (!dont_send && IN_DEV_ARPFILTER(in_dev))
-                                dont_send |= arp_filter(sip,tip,dev);
+                                dont_send = arp_filter(sip, tip, dev);
                         if (!dont_send) {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n) {
-                                        arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha);
+                                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip,
+                                                 dev, tip, sha, dev->dev_addr,
+                                                 sha);
                                         neigh_release(n);
                                 }
                         }
                         goto out;
                 } else if (IN_DEV_FORWARD(in_dev)) {
-                            if (addr_type == RTN_UNICAST  && rt->u.dst.dev != dev &&
-                             (arp_fwd_proxy(in_dev, rt) || pneigh_lookup(&arp_tbl, net, &tip, dev, 0))) {
+                        if (addr_type == RTN_UNICAST  &&
+                            (arp_fwd_proxy(in_dev, dev, rt) ||
+                             arp_fwd_pvlan(in_dev, dev, rt, sip, tip) ||
+                             pneigh_lookup(&arp_tbl, net, &tip, dev, 0))) {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n)
                                         neigh_release(n);
@@ -845,10 +906,12 @@ static int arp_process(struct sk_buff *skb)
                                 if (NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED ||
                                     skb->pkt_type == PACKET_HOST ||
                                     in_dev->arp_parms->proxy_delay == 0) {
-                                        arp_send(ARPOP_REPLY,ETH_P_ARP,sip,dev,tip,sha,dev->dev_addr,sha);
+                                        arp_send(ARPOP_REPLY, ETH_P_ARP, sip,
+                                                 dev, tip, sha, dev->dev_addr,
+                                                 sha);
                                 } else {
-                                        pneigh_enqueue(&arp_tbl, in_dev->arp_parms, skb);
-                                        in_dev_put(in_dev);
+                                        pneigh_enqueue(&arp_tbl,
+                                                       in_dev->arp_parms, skb);
                                         return 0;
                                 }
                                 goto out;
@@ -866,7 +929,8 @@ static int arp_process(struct sk_buff *skb)
                    devices (strip is candidate)
                  */
                 if (n == NULL &&
-                    arp->ar_op == htons(ARPOP_REPLY) &&
+                    (arp->ar_op == htons(ARPOP_REPLY) ||
+                     (arp->ar_op == htons(ARPOP_REQUEST) && tip == sip)) &&
                     inet_addr_type(net, sip) == RTN_UNICAST)
                         n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
         }
@@ -888,13 +952,12 @@ static int arp_process(struct sk_buff *skb)
                 if (arp->ar_op != htons(ARPOP_REPLY) ||
                     skb->pkt_type != PACKET_HOST)
                         state = NUD_STALE;
-                neigh_update(n, sha, state, override ? NEIGH_UPDATE_F_OVERRIDE : 0);
+                neigh_update(n, sha, state,
+                             override ? NEIGH_UPDATE_F_OVERRIDE : 0);
                 neigh_release(n);
         }
 
 out:
-        if (in_dev)
-                in_dev_put(in_dev);
         consume_skb(skb);
         return 0;
 }
@@ -926,7 +989,8 @@ static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
             arp->ar_pln != 4)
                 goto freeskb;
 
-        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (skb == NULL)
                 goto out_of_mem;
 
         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
@@ -953,13 +1017,14 @@ static int arp_req_set_proxy(struct net *net, struct net_device *dev, int on)
                 IPV4_DEVCONF_ALL(net, PROXY_ARP) = on;
                 return 0;
         }
-        if (__in_dev_get_rtnl(dev)) {
-                IN_DEV_CONF_SET(__in_dev_get_rtnl(dev), PROXY_ARP, on);
+        if (__in_dev_get_rcu(dev)) {
+                IN_DEV_CONF_SET(__in_dev_get_rcu(dev), PROXY_ARP, on);
                 return 0;
         }
         return -ENXIO;
 }
 
+/* must be called with rcu_read_lock() */
 static int arp_req_set_public(struct net *net, struct arpreq *r,
                 struct net_device *dev)
 {
@@ -969,8 +1034,8 @@ static int arp_req_set_public(struct net *net, struct arpreq *r,
         if (mask && mask != htonl(0xFFFFFFFF))
                 return -EINVAL;
         if (!dev && (r->arp_flags & ATF_COM)) {
-                dev = dev_getbyhwaddr(net, r->arp_ha.sa_family,
-                                r->arp_ha.sa_data);
+                dev = dev_getbyhwaddr_rcu(net, r->arp_ha.sa_family,
+                                      r->arp_ha.sa_data);
                 if (!dev)
                         return -ENODEV;
         }
@@ -984,7 +1049,7 @@ static int arp_req_set_public(struct net *net, struct arpreq *r,
 }
 
 static int arp_req_set(struct net *net, struct arpreq *r,
-                struct net_device * dev)
+                       struct net_device *dev)
 {
         __be32 ip;
         struct neighbour *neigh;
@@ -997,18 +1062,19 @@ static int arp_req_set(struct net *net, struct arpreq *r,
         if (r->arp_flags & ATF_PERM)
                 r->arp_flags |= ATF_COM;
         if (dev == NULL) {
-                struct flowi fl = { .nl_u = { .ip4_u = { .daddr = ip,
-                                                         .tos = RTO_ONLINK } } };
-                struct rtable * rt;
-                if ((err = ip_route_output_key(net, &rt, &fl)) != 0)
+                struct flowi fl = { .fl4_dst = ip,
+                                    .fl4_tos = RTO_ONLINK };
+                struct rtable *rt;
+                err = ip_route_output_key(net, &rt, &fl);
+                if (err != 0)
                         return err;
-                dev = rt->u.dst.dev;
+                dev = rt->dst.dev;
                 ip_rt_put(rt);
                 if (!dev)
                         return -EINVAL;
         }
         switch (dev->type) {
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
         case ARPHRD_FDDI:
                 /*
                  * According to RFC 1390, FDDI devices should accept ARP
@@ -1034,9 +1100,9 @@ static int arp_req_set(struct net *net, struct arpreq *r,
                 unsigned state = NUD_STALE;
                 if (r->arp_flags & ATF_PERM)
                         state = NUD_PERMANENT;
-                err = neigh_update(neigh, (r->arp_flags&ATF_COM) ?
+                err = neigh_update(neigh, (r->arp_flags & ATF_COM) ?
                                    r->arp_ha.sa_data : NULL, state,
-                                   NEIGH_UPDATE_F_OVERRIDE|
+                                   NEIGH_UPDATE_F_OVERRIDE |
                                    NEIGH_UPDATE_F_ADMIN);
                 neigh_release(neigh);
         }
@@ -1045,12 +1111,12 @@ static int arp_req_set(struct net *net, struct arpreq *r,
 
 static unsigned arp_state_to_flags(struct neighbour *neigh)
 {
-        unsigned flags = 0;
         if (neigh->nud_state&NUD_PERMANENT)
-                flags = ATF_PERM|ATF_COM;
+                return ATF_PERM | ATF_COM;
         else if (neigh->nud_state&NUD_VALID)
-                flags = ATF_COM;
-        return flags;
+                return ATF_COM;
+        else
+                return 0;
 }
 
 /*
@@ -1077,6 +1143,23 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev)
         return err;
 }
 
+int arp_invalidate(struct net_device *dev, __be32 ip)
+{
+        struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev);
+        int err = -ENXIO;
+
+        if (neigh) {
+                if (neigh->nud_state & ~NUD_NOARP)
+                        err = neigh_update(neigh, NULL, NUD_FAILED,
+                                           NEIGH_UPDATE_F_OVERRIDE|
+                                           NEIGH_UPDATE_F_ADMIN);
+                neigh_release(neigh);
+        }
+
+        return err;
+}
+EXPORT_SYMBOL(arp_invalidate);
+
 static int arp_req_delete_public(struct net *net, struct arpreq *r,
                 struct net_device *dev)
 {
@@ -1093,37 +1176,28 @@ static int arp_req_delete_public(struct net *net, struct arpreq *r,
 }
 
 static int arp_req_delete(struct net *net, struct arpreq *r,
-                struct net_device * dev)
+                          struct net_device *dev)
 {
         int err;
         __be32 ip;
-        struct neighbour *neigh;
 
         if (r->arp_flags & ATF_PUBL)
                 return arp_req_delete_public(net, r, dev);
 
         ip = ((struct sockaddr_in *)&r->arp_pa)->sin_addr.s_addr;
         if (dev == NULL) {
-                struct flowi fl = { .nl_u = { .ip4_u = { .daddr = ip,
-                                                         .tos = RTO_ONLINK } } };
-                struct rtable * rt;
-                if ((err = ip_route_output_key(net, &rt, &fl)) != 0)
+                struct flowi fl = { .fl4_dst = ip,
+                                    .fl4_tos = RTO_ONLINK };
+                struct rtable *rt;
+                err = ip_route_output_key(net, &rt, &fl);
+                if (err != 0)
                         return err;
-                dev = rt->u.dst.dev;
+                dev = rt->dst.dev;
                 ip_rt_put(rt);
                 if (!dev)
                         return -EINVAL;
         }
-        err = -ENXIO;
-        neigh = neigh_lookup(&arp_tbl, &ip, dev);
-        if (neigh) {
-                if (neigh->nud_state&~NUD_NOARP)
-                        err = neigh_update(neigh, NULL, NUD_FAILED,
-                                           NEIGH_UPDATE_F_OVERRIDE|
-                                           NEIGH_UPDATE_F_ADMIN);
-                neigh_release(neigh);
-        }
-        return err;
+        return arp_invalidate(dev, ip);
 }
 
 /*
@@ -1137,32 +1211,33 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         struct net_device *dev = NULL;
 
         switch (cmd) {
-                case SIOCDARP:
-                case SIOCSARP:
-                        if (!capable(CAP_NET_ADMIN))
-                                return -EPERM;
-                case SIOCGARP:
-                        err = copy_from_user(&r, arg, sizeof(struct arpreq));
-                        if (err)
-                                return -EFAULT;
-                        break;
-                default:
-                        return -EINVAL;
+        case SIOCDARP:
+        case SIOCSARP:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+        case SIOCGARP:
+                err = copy_from_user(&r, arg, sizeof(struct arpreq));
+                if (err)
+                        return -EFAULT;
+                break;
+        default:
+                return -EINVAL;
         }
 
         if (r.arp_pa.sa_family != AF_INET)
                 return -EPFNOSUPPORT;
 
         if (!(r.arp_flags & ATF_PUBL) &&
-            (r.arp_flags & (ATF_NETMASK|ATF_DONTPUB)))
+            (r.arp_flags & (ATF_NETMASK | ATF_DONTPUB)))
                 return -EINVAL;
         if (!(r.arp_flags & ATF_NETMASK))
                 ((struct sockaddr_in *)&r.arp_netmask)->sin_addr.s_addr =
                                                            htonl(0xFFFFFFFFUL);
-        rtnl_lock();
+        rcu_read_lock();
         if (r.arp_dev[0]) {
                 err = -ENODEV;
-                if ((dev = __dev_get_by_name(net, r.arp_dev)) == NULL)
+                dev = dev_get_by_name_rcu(net, r.arp_dev);
+                if (dev == NULL)
                         goto out;
 
                 /* Mmmm... It is wrong... ARPHRD_NETROM==0 */
@@ -1185,16 +1260,17 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                 break;
         case SIOCGARP:
                 err = arp_req_get(&r, dev);
-                if (!err && copy_to_user(arg, &r, sizeof(r)))
-                        err = -EFAULT;
                 break;
         }
 out:
-        rtnl_unlock();
+        rcu_read_unlock();
+        if (cmd == SIOCGARP && !err && copy_to_user(arg, &r, sizeof(r)))
+                err = -EFAULT;
         return err;
 }
 
-static int arp_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
+static int arp_netdev_event(struct notifier_block *this, unsigned long event,
+                            void *ptr)
 {
         struct net_device *dev = ptr;
 
@@ -1242,8 +1318,7 @@ void __init arp_init(void)
         dev_add_pack(&arp_packet_type);
         arp_proc_init();
 #ifdef CONFIG_SYSCTL
-        neigh_sysctl_register(NULL, &arp_tbl.parms, NET_IPV4,
-                              NET_IPV4_NEIGH, "ipv4", NULL, NULL);
+        neigh_sysctl_register(NULL, &arp_tbl.parms, "ipv4", NULL);
 #endif
         register_netdevice_notifier(&arp_netdev_notifier);
 }
@@ -1263,12 +1338,13 @@ static char *ax2asc2(ax25_address *a, char *buf)
         for (n = 0, s = buf; n < 6; n++) {
                 c = (a->ax25_call[n] >> 1) & 0x7F;
 
-                if (c != ' ') *s++ = c;
+                if (c != ' ')
+                        *s++ = c;
         }
 
         *s++ = '-';
-
-        if ((n = ((a->ax25_call[6] >> 1) & 0x0F)) > 9) {
+        n = (a->ax25_call[6] >> 1) & 0x0F;
+        if (n > 9) {
                 *s++ = '1';
                 n -= 10;
         }
@@ -1277,10 +1353,9 @@ static char *ax2asc2(ax25_address *a, char *buf)
         *s++ = '\0';
 
         if (*buf == '\0' || *buf == '-')
-           return "*";
+                return "*";
 
         return buf;
-
 }
 #endif /* CONFIG_AX25 */
 
@@ -1307,7 +1382,9 @@ static void arp_format_neigh_entry(struct seq_file *seq,
                 hbuffer[k++] = hex_asc_lo(n->ha[j]);
                 hbuffer[k++] = ':';
         }
-        hbuffer[--k] = 0;
+        if (k != 0)
+                --k;
+        hbuffer[k] = 0;
 #if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
         }
 #endif
@@ -1358,10 +1435,10 @@ static void *arp_seq_start(struct seq_file *seq, loff_t *pos)
 /* ------------------------------------------------------------------------ */
 
 static const struct seq_operations arp_seq_ops = {
-        .start  = arp_seq_start,
-        .next   = neigh_seq_next,
-        .stop   = neigh_seq_stop,
-        .show   = arp_seq_show,
+        .start  = arp_seq_start,
+        .next   = neigh_seq_next,
+        .stop   = neigh_seq_stop,
+        .show   = arp_seq_show,
 };
 
 static int arp_seq_open(struct inode *inode, struct file *file)
@@ -1409,14 +1486,3 @@ static int __init arp_proc_init(void)
 }
 
 #endif /* CONFIG_PROC_FS */
-
-EXPORT_SYMBOL(arp_broken_ops);
-EXPORT_SYMBOL(arp_find);
-EXPORT_SYMBOL(arp_create);
-EXPORT_SYMBOL(arp_xmit);
-EXPORT_SYMBOL(arp_send);
-EXPORT_SYMBOL(arp_tbl);
-
-#if defined(CONFIG_ATM_CLIP) || defined(CONFIG_ATM_CLIP_MODULE)
-EXPORT_SYMBOL(clip_tbl_hook);
-#endif
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 039cc1ffe977..094e150c6260 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -9,7 +9,7 @@
  *
  * The CIPSO draft specification can be found in the kernel's Documentation
  * directory as well as the following URL:
- *   http://netlabel.sourceforge.net/files/draft-ietf-cipso-ipsecurity-01.txt
+ *   http://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt
  * The FIPS-188 specification can be found at the following URL:
  *   http://www.itl.nist.gov/fipspubs/fip188.htm
  *
@@ -44,6 +44,7 @@
 #include <linux/string.h>
 #include <linux/jhash.h>
 #include <linux/audit.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 #include <net/icmp.h>
 #include <net/tcp.h>
@@ -289,8 +290,6 @@ void cipso_v4_cache_invalidate(void)
                 cipso_v4_cache[iter].size = 0;
                 spin_unlock_bh(&cipso_v4_cache[iter].lock);
         }
-
-        return;
 }
 
 /**
@@ -2017,7 +2016,7 @@ req_setattr_failure:
  * values on failure.
  *
  */
-int cipso_v4_delopt(struct ip_options **opt_ptr)
+static int cipso_v4_delopt(struct ip_options **opt_ptr)
 {
         int hdr_delta = 0;
         struct ip_options *opt = *opt_ptr;
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 5e6c5a0f3fde..174be6caa5c8 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -39,7 +39,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_dst_reset(sk);
 
         oif = sk->sk_bound_dev_if;
-        saddr = inet->saddr;
+        saddr = inet->inet_saddr;
         if (ipv4_is_multicast(usin->sin_addr.s_addr)) {
                 if (!oif)
                         oif = inet->mc_index;
@@ -49,7 +49,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         err = ip_route_connect(&rt, usin->sin_addr.s_addr, saddr,
                                RT_CONN_FLAGS(sk), oif,
                                sk->sk_protocol,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (err) {
                 if (err == -ENETUNREACH)
                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -60,18 +60,19 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 ip_rt_put(rt);
                 return -EACCES;
         }
-        if (!inet->saddr)
-                inet->saddr = rt->rt_src;       /* Update source address */
-        if (!inet->rcv_saddr)
-                inet->rcv_saddr = rt->rt_src;
-        inet->daddr = rt->rt_dst;
-        inet->dport = usin->sin_port;
+        if (!inet->inet_saddr)
+                inet->inet_saddr = rt->rt_src;  /* Update source address */
+        if (!inet->inet_rcv_saddr) {
+                inet->inet_rcv_saddr = rt->rt_src;
+                if (sk->sk_prot->rehash)
+                        sk->sk_prot->rehash(sk);
+        }
+        inet->inet_daddr = rt->rt_dst;
+        inet->inet_dport = usin->sin_port;
         sk->sk_state = TCP_ESTABLISHED;
-        inet->id = jiffies;
+        inet->inet_id = jiffies;
 
-        sk_dst_set(sk, &rt->u.dst);
-        return(0);
+        sk_dst_set(sk, &rt->dst);
+        return 0;
 }
-
 EXPORT_SYMBOL(ip4_datagram_connect);
-
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 3863c3a4223f..748cb5b337bd 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -50,6 +50,7 @@
 #include <linux/notifier.h>
 #include <linux/inetdevice.h>
 #include <linux/igmp.h>
+#include <linux/slab.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
@@ -64,20 +65,20 @@
 
 static struct ipv4_devconf ipv4_devconf = {
         .data = {
-                [NET_IPV4_CONF_ACCEPT_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SEND_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SECURE_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SHARED_MEDIA - 1] = 1,
+                [IPV4_DEVCONF_ACCEPT_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SEND_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SECURE_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SHARED_MEDIA - 1] = 1,
         },
 };
 
 static struct ipv4_devconf ipv4_devconf_dflt = {
         .data = {
-                [NET_IPV4_CONF_ACCEPT_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SEND_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SECURE_REDIRECTS - 1] = 1,
-                [NET_IPV4_CONF_SHARED_MEDIA - 1] = 1,
-                [NET_IPV4_CONF_ACCEPT_SOURCE_ROUTE - 1] = 1,
+                [IPV4_DEVCONF_ACCEPT_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SEND_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SECURE_REDIRECTS - 1] = 1,
+                [IPV4_DEVCONF_SHARED_MEDIA - 1] = 1,
+                [IPV4_DEVCONF_ACCEPT_SOURCE_ROUTE - 1] = 1,
         },
 };
 
@@ -140,11 +141,11 @@ void in_dev_finish_destroy(struct in_device *idev)
 #endif
         dev_put(dev);
         if (!idev->dead)
-                printk("Freeing alive in_device %p\n", idev);
-        else {
+                pr_err("Freeing alive in_device %p\n", idev);
+        else
                 kfree(idev);
-        }
 }
+EXPORT_SYMBOL(in_dev_finish_destroy);
 
 static struct in_device *inetdev_init(struct net_device *dev)
 {
@@ -159,7 +160,8 @@ static struct in_device *inetdev_init(struct net_device *dev)
                         sizeof(in_dev->cnf));
         in_dev->cnf.sysctl = NULL;
         in_dev->dev = dev;
-        if ((in_dev->arp_parms = neigh_parms_alloc(dev, &arp_tbl)) == NULL)
+        in_dev->arp_parms = neigh_parms_alloc(dev, &arp_tbl);
+        if (!in_dev->arp_parms)
                 goto out_kfree;
         if (IPV4_DEVCONF(in_dev->cnf, FORWARDING))
                 dev_disable_lro(dev);
@@ -207,7 +209,7 @@ static void inetdev_destroy(struct in_device *in_dev)
                 inet_free_ifa(ifa);
         }
 
-        dev->ip_ptr = NULL;
+        rcu_assign_pointer(dev->ip_ptr, NULL);
 
         devinet_sysctl_unregister(in_dev);
         neigh_parms_release(&arp_tbl, in_dev->arp_parms);
@@ -401,17 +403,22 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
         return inet_insert_ifa(ifa);
 }
 
+/* Caller must hold RCU or RTNL :
+ * We dont take a reference on found in_device
+ */
 struct in_device *inetdev_by_index(struct net *net, int ifindex)
 {
         struct net_device *dev;
         struct in_device *in_dev = NULL;
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_index(net, ifindex);
+
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifindex);
         if (dev)
-                in_dev = in_dev_get(dev);
-        read_unlock(&dev_base_lock);
+                in_dev = rcu_dereference_rtnl(dev->ip_ptr);
+        rcu_read_unlock();
         return in_dev;
 }
+EXPORT_SYMBOL(inetdev_by_index);
 
 /* Called only from RTNL semaphored context. No locks. */
 
@@ -449,8 +456,6 @@ static int inet_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
                 goto errout;
         }
 
-        __in_dev_put(in_dev);
-
         for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL;
              ifap = &ifa->ifa_next) {
                 if (tb[IFA_LOCAL] &&
@@ -557,7 +562,7 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
  *      Determine a default network mask, based on the IP address.
  */
 
-static __inline__ int inet_abc_len(__be32 addr)
+static inline int inet_abc_len(__be32 addr)
 {
         int rc = -1;    /* Something else, probably a multicast. */
 
@@ -646,13 +651,15 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         rtnl_lock();
 
         ret = -ENODEV;
-        if ((dev = __dev_get_by_name(net, ifr.ifr_name)) == NULL)
+        dev = __dev_get_by_name(net, ifr.ifr_name);
+        if (!dev)
                 goto done;
 
         if (colon)
                 *colon = ':';
 
-        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
+        in_dev = __in_dev_get_rtnl(dev);
+        if (in_dev) {
                 if (tryaddrmatch) {
                         /* Matthias Andree */
                         /* compare label and address (4.4BSD style) */
@@ -720,7 +727,8 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 
                 if (!ifa) {
                         ret = -ENOBUFS;
-                        if ((ifa = inet_alloc_ifa()) == NULL)
+                        ifa = inet_alloc_ifa();
+                        if (!ifa)
                                 break;
                         if (colon)
                                 memcpy(ifa->ifa_label, ifr.ifr_name, IFNAMSIZ);
@@ -822,10 +830,10 @@ static int inet_gifconf(struct net_device *dev, char __user *buf, int len)
         struct ifreq ifr;
         int done = 0;
 
-        if (!in_dev || (ifa = in_dev->ifa_list) == NULL)
+        if (!in_dev)
                 goto out;
 
-        for (; ifa; ifa = ifa->ifa_next) {
+        for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
                 if (!buf) {
                         done += sizeof(ifr);
                         continue;
@@ -875,36 +883,33 @@ __be32 inet_select_addr(const struct net_device *dev, __be32 dst, int scope)
                 if (!addr)
                         addr = ifa->ifa_local;
         } endfor_ifa(in_dev);
-no_in_dev:
-        rcu_read_unlock();
 
         if (addr)
-                goto out;
+                goto out_unlock;
+no_in_dev:
 
         /* Not loopback addresses on loopback should be preferred
            in this case. It is importnat that lo is the first interface
            in dev_base list.
          */
-        read_lock(&dev_base_lock);
-        rcu_read_lock();
-        for_each_netdev(net, dev) {
-                if ((in_dev = __in_dev_get_rcu(dev)) == NULL)
+        for_each_netdev_rcu(net, dev) {
+                in_dev = __in_dev_get_rcu(dev);
+                if (!in_dev)
                         continue;
 
                 for_primary_ifa(in_dev) {
                         if (ifa->ifa_scope != RT_SCOPE_LINK &&
                             ifa->ifa_scope <= scope) {
                                 addr = ifa->ifa_local;
-                                goto out_unlock_both;
+                                goto out_unlock;
                         }
                 } endfor_ifa(in_dev);
         }
-out_unlock_both:
-        read_unlock(&dev_base_lock);
+out_unlock:
         rcu_read_unlock();
-out:
         return addr;
 }
+EXPORT_SYMBOL(inet_select_addr);
 
 static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
                               __be32 local, int scope)
@@ -940,7 +945,7 @@ static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
                 }
         } endfor_ifa(in_dev);
 
-        return same? addr : 0;
+        return same ? addr : 0;
 }
 
 /*
@@ -961,17 +966,16 @@ __be32 inet_confirm_addr(struct in_device *in_dev,
                 return confirm_addr_indev(in_dev, dst, local, scope);
 
         net = dev_net(in_dev->dev);
-        read_lock(&dev_base_lock);
         rcu_read_lock();
-        for_each_netdev(net, dev) {
-                if ((in_dev = __in_dev_get_rcu(dev))) {
+        for_each_netdev_rcu(net, dev) {
+                in_dev = __in_dev_get_rcu(dev);
+                if (in_dev) {
                         addr = confirm_addr_indev(in_dev, dst, local, scope);
                         if (addr)
                                 break;
                 }
         }
         rcu_read_unlock();
-        read_unlock(&dev_base_lock);
 
         return addr;
 }
@@ -984,14 +988,16 @@ int register_inetaddr_notifier(struct notifier_block *nb)
 {
         return blocking_notifier_chain_register(&inetaddr_chain, nb);
 }
+EXPORT_SYMBOL(register_inetaddr_notifier);
 
 int unregister_inetaddr_notifier(struct notifier_block *nb)
 {
         return blocking_notifier_chain_unregister(&inetaddr_chain, nb);
 }
+EXPORT_SYMBOL(unregister_inetaddr_notifier);
 
-/* Rename ifa_labels for a device name change. Make some effort to preserve existing
- * alias numbering and to create unique labels if possible.
+/* Rename ifa_labels for a device name change. Make some effort to preserve
+ * existing alias numbering and to create unique labels if possible.
 */
 static void inetdev_changename(struct net_device *dev, struct in_device *in_dev)
 {
@@ -1010,11 +1016,10 @@ static void inetdev_changename(struct net_device *dev, struct in_device *in_dev)
                         sprintf(old, ":%d", named);
                         dot = old;
                 }
-                if (strlen(dot) + strlen(dev->name) < IFNAMSIZ) {
+                if (strlen(dot) + strlen(dev->name) < IFNAMSIZ)
                         strcat(ifa->ifa_label, dot);
-                } else {
+                else
                         strcpy(ifa->ifa_label + (IFNAMSIZ - strlen(dot) - 1), dot);
-                }
 skip:
                 rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
         }
@@ -1055,14 +1060,15 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
         switch (event) {
         case NETDEV_REGISTER:
                 printk(KERN_DEBUG "inetdev_event: bug\n");
-                dev->ip_ptr = NULL;
+                rcu_assign_pointer(dev->ip_ptr, NULL);
                 break;
         case NETDEV_UP:
                 if (!inetdev_valid_mtu(dev->mtu))
                         break;
                 if (dev->flags & IFF_LOOPBACK) {
-                        struct in_ifaddr *ifa;
-                        if ((ifa = inet_alloc_ifa()) != NULL) {
+                        struct in_ifaddr *ifa = inet_alloc_ifa();
+
+                        if (ifa) {
                                 ifa->ifa_local =
                                   ifa->ifa_address = htonl(INADDR_LOOPBACK);
                                 ifa->ifa_prefixlen = 8;
@@ -1076,17 +1082,28 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 }
                 ip_mc_up(in_dev);
                 /* fall through */
+        case NETDEV_NOTIFY_PEERS:
         case NETDEV_CHANGEADDR:
-                if (IN_DEV_ARP_NOTIFY(in_dev))
-                        arp_send(ARPOP_REQUEST, ETH_P_ARP,
-                                 in_dev->ifa_list->ifa_address,
-                                 dev,
-                                 in_dev->ifa_list->ifa_address,
-                                 NULL, dev->dev_addr, NULL);
+                /* Send gratuitous ARP to notify of link change */
+                if (IN_DEV_ARP_NOTIFY(in_dev)) {
+                        struct in_ifaddr *ifa = in_dev->ifa_list;
+
+                        if (ifa)
+                                arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                                         ifa->ifa_address, dev,
+                                         ifa->ifa_address, NULL,
+                                         dev->dev_addr, NULL);
+                }
                 break;
         case NETDEV_DOWN:
                 ip_mc_down(in_dev);
                 break;
+        case NETDEV_PRE_TYPE_CHANGE:
+                ip_mc_unmap(in_dev);
+                break;
+        case NETDEV_POST_TYPE_CHANGE:
+                ip_mc_remap(in_dev);
+                break;
         case NETDEV_CHANGEMTU:
                 if (inetdev_valid_mtu(dev->mtu))
                         break;
@@ -1160,38 +1177,54 @@ nla_put_failure:
 static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
-        int idx, ip_idx;
+        int h, s_h;
+        int idx, s_idx;
+        int ip_idx, s_ip_idx;
         struct net_device *dev;
         struct in_device *in_dev;
         struct in_ifaddr *ifa;
-        int s_ip_idx, s_idx = cb->args[0];
+        struct hlist_head *head;
+        struct hlist_node *node;
 
-        s_ip_idx = ip_idx = cb->args[1];
-        idx = 0;
-        for_each_netdev(net, dev) {
-                if (idx < s_idx)
-                        goto cont;
-                if (idx > s_idx)
-                        s_ip_idx = 0;
-                if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
-                        goto cont;
-
-                for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
-                     ifa = ifa->ifa_next, ip_idx++) {
-                        if (ip_idx < s_ip_idx)
-                                continue;
-                        if (inet_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
+        s_h = cb->args[0];
+        s_idx = idx = cb->args[1];
+        s_ip_idx = ip_idx = cb->args[2];
+
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        if (h > s_h || idx > s_idx)
+                                s_ip_idx = 0;
+                        in_dev = __in_dev_get_rcu(dev);
+                        if (!in_dev)
+                                goto cont;
+
+                        for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
+                             ifa = ifa->ifa_next, ip_idx++) {
+                                if (ip_idx < s_ip_idx)
+                                        continue;
+                                if (inet_fill_ifaddr(skb, ifa,
+                                             NETLINK_CB(cb->skb).pid,
                                              cb->nlh->nlmsg_seq,
-                                             RTM_NEWADDR, NLM_F_MULTI) <= 0)
-                                goto done;
-                }
+                                             RTM_NEWADDR, NLM_F_MULTI) <= 0) {
+                                        rcu_read_unlock();
+                                        goto done;
+                                }
+                        }
 cont:
-                idx++;
+                        idx++;
+                }
+                rcu_read_unlock();
         }
 
 done:
-        cb->args[0] = idx;
-        cb->args[1] = ip_idx;
+        cb->args[0] = h;
+        cb->args[1] = idx;
+        cb->args[2] = ip_idx;
 
         return skb->len;
 }
@@ -1223,24 +1256,105 @@ errout:
                 rtnl_set_sk_err(net, RTNLGRP_IPV4_IFADDR, err);
 }
 
+static size_t inet_get_link_af_size(const struct net_device *dev)
+{
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
+
+        if (!in_dev)
+                return 0;
+
+        return nla_total_size(IPV4_DEVCONF_MAX * 4); /* IFLA_INET_CONF */
+}
+
+static int inet_fill_link_af(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
+        struct nlattr *nla;
+        int i;
+
+        if (!in_dev)
+                return -ENODATA;
+
+        nla = nla_reserve(skb, IFLA_INET_CONF, IPV4_DEVCONF_MAX * 4);
+        if (nla == NULL)
+                return -EMSGSIZE;
+
+        for (i = 0; i < IPV4_DEVCONF_MAX; i++)
+                ((u32 *) nla_data(nla))[i] = in_dev->cnf.data[i];
+
+        return 0;
+}
+
+static const struct nla_policy inet_af_policy[IFLA_INET_MAX+1] = {
+        [IFLA_INET_CONF]        = { .type = NLA_NESTED },
+};
+
+static int inet_validate_link_af(const struct net_device *dev,
+                                 const struct nlattr *nla)
+{
+        struct nlattr *a, *tb[IFLA_INET_MAX+1];
+        int err, rem;
+
+        if (dev && !__in_dev_get_rtnl(dev))
+                return -EAFNOSUPPORT;
+
+        err = nla_parse_nested(tb, IFLA_INET_MAX, nla, inet_af_policy);
+        if (err < 0)
+                return err;
+
+        if (tb[IFLA_INET_CONF]) {
+                nla_for_each_nested(a, tb[IFLA_INET_CONF], rem) {
+                        int cfgid = nla_type(a);
+
+                        if (nla_len(a) < 4)
+                                return -EINVAL;
+
+                        if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX)
+                                return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
+static int inet_set_link_af(struct net_device *dev, const struct nlattr *nla)
+{
+        struct in_device *in_dev = __in_dev_get_rtnl(dev);
+        struct nlattr *a, *tb[IFLA_INET_MAX+1];
+        int rem;
+
+        if (!in_dev)
+                return -EAFNOSUPPORT;
+
+        if (nla_parse_nested(tb, IFLA_INET_MAX, nla, NULL) < 0)
+                BUG();
+
+        if (tb[IFLA_INET_CONF]) {
+                nla_for_each_nested(a, tb[IFLA_INET_CONF], rem)
+                        ipv4_devconf_set(in_dev, nla_type(a), nla_get_u32(a));
+        }
+
+        return 0;
+}
+
 #ifdef CONFIG_SYSCTL
 
 static void devinet_copy_dflt_conf(struct net *net, int i)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
                 struct in_device *in_dev;
-                rcu_read_lock();
+
                 in_dev = __in_dev_get_rcu(dev);
                 if (in_dev && !test_bit(i, in_dev->cnf.state))
                         in_dev->cnf.data[i] = net->ipv4.devconf_dflt->data[i];
-                rcu_read_unlock();
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
+/* called with RTNL locked */
 static void inet_forward_change(struct net *net)
 {
         struct net_device *dev;
@@ -1249,7 +1363,6 @@ static void inet_forward_change(struct net *net)
         IPV4_DEVCONF_ALL(net, ACCEPT_REDIRECTS) = !on;
         IPV4_DEVCONF_DFLT(net, FORWARDING) = on;
 
-        read_lock(&dev_base_lock);
         for_each_netdev(net, dev) {
                 struct in_device *in_dev;
                 if (on)
@@ -1260,14 +1373,13 @@ static void inet_forward_change(struct net *net)
                         IN_DEV_CONF_SET(in_dev, FORWARDING, on);
                 rcu_read_unlock();
         }
-        read_unlock(&dev_base_lock);
 }
 
 static int devinet_conf_proc(ctl_table *ctl, int write,
-                             struct file *filp, void __user *buffer,
+                             void __user *buffer,
                              size_t *lenp, loff_t *ppos)
 {
-        int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write) {
                 struct ipv4_devconf *cnf = ctl->extra1;
@@ -1283,72 +1395,25 @@ static int devinet_conf_proc(ctl_table *ctl, int write,
         return ret;
 }
 
-static int devinet_conf_sysctl(ctl_table *table,
-                               void __user *oldval, size_t __user *oldlenp,
-                               void __user *newval, size_t newlen)
-{
-        struct ipv4_devconf *cnf;
-        struct net *net;
-        int *valp = table->data;
-        int new;
-        int i;
-
-        if (!newval || !newlen)
-                return 0;
-
-        if (newlen != sizeof(int))
-                return -EINVAL;
-
-        if (get_user(new, (int __user *)newval))
-                return -EFAULT;
-
-        if (new == *valp)
-                return 0;
-
-        if (oldval && oldlenp) {
-                size_t len;
-
-                if (get_user(len, oldlenp))
-                        return -EFAULT;
-
-                if (len) {
-                        if (len > table->maxlen)
-                                len = table->maxlen;
-                        if (copy_to_user(oldval, valp, len))
-                                return -EFAULT;
-                        if (put_user(len, oldlenp))
-                                return -EFAULT;
-                }
-        }
-
-        *valp = new;
-
-        cnf = table->extra1;
-        net = table->extra2;
-        i = (int *)table->data - cnf->data;
-
-        set_bit(i, cnf->state);
-
-        if (cnf == net->ipv4.devconf_dflt)
-                devinet_copy_dflt_conf(net, i);
-
-        return 1;
-}
-
 static int devinet_sysctl_forward(ctl_table *ctl, int write,
-                                  struct file *filp, void __user *buffer,
+                                  void __user *buffer,
                                   size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
         int val = *valp;
-        int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        loff_t pos = *ppos;
+        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write && *valp != val) {
                 struct net *net = ctl->extra2;
 
                 if (valp != &IPV4_DEVCONF_DFLT(net, FORWARDING)) {
-                        if (!rtnl_trylock())
+                        if (!rtnl_trylock()) {
+                                /* Restore the original values before restarting */
+                                *valp = val;
+                                *ppos = pos;
                                 return restart_syscall();
+                        }
                         if (valp == &IPV4_DEVCONF_ALL(net, FORWARDING)) {
                                 inet_forward_change(net);
                         } else if (*valp) {
@@ -1365,13 +1430,13 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
         return ret;
 }
 
-int ipv4_doint_and_flush(ctl_table *ctl, int write,
-                         struct file *filp, void __user *buffer,
-                         size_t *lenp, loff_t *ppos)
+static int ipv4_doint_and_flush(ctl_table *ctl, int write,
+                                void __user *buffer,
+                                size_t *lenp, loff_t *ppos)
 {
         int *valp = ctl->data;
         int val = *valp;
-        int ret = proc_dointvec(ctl, write, filp, buffer, lenp, ppos);
+        int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
         struct net *net = ctl->extra2;
 
         if (write && *valp != val)
@@ -1380,57 +1445,37 @@ int ipv4_doint_and_flush(ctl_table *ctl, int write,
         return ret;
 }
 
-int ipv4_doint_and_flush_strategy(ctl_table *table,
-                                  void __user *oldval, size_t __user *oldlenp,
-                                  void __user *newval, size_t newlen)
-{
-        int ret = devinet_conf_sysctl(table, oldval, oldlenp, newval, newlen);
-        struct net *net = table->extra2;
-
-        if (ret == 1)
-                rt_cache_flush(net, 0);
-
-        return ret;
-}
-
-
-#define DEVINET_SYSCTL_ENTRY(attr, name, mval, proc, sysctl) \
+#define DEVINET_SYSCTL_ENTRY(attr, name, mval, proc) \
         { \
-                .ctl_name       = NET_IPV4_CONF_ ## attr, \
                 .procname       = name, \
                 .data           = ipv4_devconf.data + \
-                                  NET_IPV4_CONF_ ## attr - 1, \
+                                  IPV4_DEVCONF_ ## attr - 1, \
                 .maxlen         = sizeof(int), \
                 .mode           = mval, \
                 .proc_handler   = proc, \
-                .strategy       = sysctl, \
                 .extra1         = &ipv4_devconf, \
         }
 
 #define DEVINET_SYSCTL_RW_ENTRY(attr, name) \
-        DEVINET_SYSCTL_ENTRY(attr, name, 0644, devinet_conf_proc, \
-                             devinet_conf_sysctl)
+        DEVINET_SYSCTL_ENTRY(attr, name, 0644, devinet_conf_proc)
 
 #define DEVINET_SYSCTL_RO_ENTRY(attr, name) \
-        DEVINET_SYSCTL_ENTRY(attr, name, 0444, devinet_conf_proc, \
-                             devinet_conf_sysctl)
+        DEVINET_SYSCTL_ENTRY(attr, name, 0444, devinet_conf_proc)
 
-#define DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, proc, sysctl) \
-        DEVINET_SYSCTL_ENTRY(attr, name, 0644, proc, sysctl)
+#define DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, proc) \
+        DEVINET_SYSCTL_ENTRY(attr, name, 0644, proc)
 
 #define DEVINET_SYSCTL_FLUSHING_ENTRY(attr, name) \
-        DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, ipv4_doint_and_flush, \
-                                     ipv4_doint_and_flush_strategy)
+        DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, ipv4_doint_and_flush)
 
 static struct devinet_sysctl_table {
         struct ctl_table_header *sysctl_header;
-        struct ctl_table devinet_vars[__NET_IPV4_CONF_MAX];
+        struct ctl_table devinet_vars[__IPV4_DEVCONF_MAX];
         char *dev_name;
 } devinet_sysctl = {
         .devinet_vars = {
                 DEVINET_SYSCTL_COMPLEX_ENTRY(FORWARDING, "forwarding",
-                                             devinet_sysctl_forward,
-                                             devinet_conf_sysctl),
+                                             devinet_sysctl_forward),
                 DEVINET_SYSCTL_RO_ENTRY(MC_FORWARDING, "mc_forwarding"),
 
                 DEVINET_SYSCTL_RW_ENTRY(ACCEPT_REDIRECTS, "accept_redirects"),
@@ -1440,6 +1485,8 @@ static struct devinet_sysctl_table {
                 DEVINET_SYSCTL_RW_ENTRY(SEND_REDIRECTS, "send_redirects"),
                 DEVINET_SYSCTL_RW_ENTRY(ACCEPT_SOURCE_ROUTE,
                                         "accept_source_route"),
+                DEVINET_SYSCTL_RW_ENTRY(ACCEPT_LOCAL, "accept_local"),
+                DEVINET_SYSCTL_RW_ENTRY(SRC_VMARK, "src_valid_mark"),
                 DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP, "proxy_arp"),
                 DEVINET_SYSCTL_RW_ENTRY(MEDIUM_ID, "medium_id"),
                 DEVINET_SYSCTL_RW_ENTRY(BOOTP_RELAY, "bootp_relay"),
@@ -1450,6 +1497,7 @@ static struct devinet_sysctl_table {
                 DEVINET_SYSCTL_RW_ENTRY(ARP_IGNORE, "arp_ignore"),
                 DEVINET_SYSCTL_RW_ENTRY(ARP_ACCEPT, "arp_accept"),
                 DEVINET_SYSCTL_RW_ENTRY(ARP_NOTIFY, "arp_notify"),
+                DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP_PVLAN, "proxy_arp_pvlan"),
 
                 DEVINET_SYSCTL_FLUSHING_ENTRY(NOXFRM, "disable_xfrm"),
                 DEVINET_SYSCTL_FLUSHING_ENTRY(NOPOLICY, "disable_policy"),
@@ -1461,7 +1509,7 @@ static struct devinet_sysctl_table {
 };
 
 static int __devinet_sysctl_register(struct net *net, char *dev_name,
-                int ctl_name, struct ipv4_devconf *p)
+                                        struct ipv4_devconf *p)
 {
         int i;
         struct devinet_sysctl_table *t;
@@ -1469,9 +1517,9 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name,
 #define DEVINET_CTL_PATH_DEV    3
 
         struct ctl_path devinet_ctl_path[] = {
-                { .procname = "net", .ctl_name = CTL_NET, },
-                { .procname = "ipv4", .ctl_name = NET_IPV4, },
-                { .procname = "conf", .ctl_name = NET_IPV4_CONF, },
+                { .procname = "net",  },
+                { .procname = "ipv4", },
+                { .procname = "conf", },
                 { /* to be set */ },
                 { },
         };
@@ -1496,7 +1544,6 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name,
                 goto free;
 
         devinet_ctl_path[DEVINET_CTL_PATH_DEV].procname = t->dev_name;
-        devinet_ctl_path[DEVINET_CTL_PATH_DEV].ctl_name = ctl_name;
 
         t->sysctl_header = register_net_sysctl_table(net, devinet_ctl_path,
                         t->devinet_vars);
@@ -1529,10 +1576,9 @@ static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf)
 
 static void devinet_sysctl_register(struct in_device *idev)
 {
-        neigh_sysctl_register(idev->dev, idev->arp_parms, NET_IPV4,
-                        NET_IPV4_NEIGH, "ipv4", NULL, NULL);
+        neigh_sysctl_register(idev->dev, idev->arp_parms, "ipv4", NULL);
         __devinet_sysctl_register(dev_net(idev->dev), idev->dev->name,
-                        idev->dev->ifindex, &idev->cnf);
+                                        &idev->cnf);
 }
 
 static void devinet_sysctl_unregister(struct in_device *idev)
@@ -1543,14 +1589,12 @@ static void devinet_sysctl_unregister(struct in_device *idev)
 
 static struct ctl_table ctl_forward_entry[] = {
         {
-                .ctl_name       = NET_IPV4_FORWARD,
                 .procname       = "ip_forward",
                 .data           = &ipv4_devconf.data[
-                                        NET_IPV4_CONF_FORWARDING - 1],
+                                        IPV4_DEVCONF_FORWARDING - 1],
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = devinet_sysctl_forward,
-                .strategy       = devinet_conf_sysctl,
                 .extra1         = &ipv4_devconf,
                 .extra2         = &init_net,
         },
@@ -1558,8 +1602,8 @@ static struct ctl_table ctl_forward_entry[] = {
 };
 
 static __net_initdata struct ctl_path net_ipv4_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
         { },
 };
 #endif
@@ -1577,7 +1621,7 @@ static __net_init int devinet_init_net(struct net *net)
         all = &ipv4_devconf;
         dflt = &ipv4_devconf_dflt;
 
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 all = kmemdup(all, sizeof(ipv4_devconf), GFP_KERNEL);
                 if (all == NULL)
                         goto err_alloc_all;
@@ -1591,20 +1635,18 @@ static __net_init int devinet_init_net(struct net *net)
                 if (tbl == NULL)
                         goto err_alloc_ctl;
 
-                tbl[0].data = &all->data[NET_IPV4_CONF_FORWARDING - 1];
+                tbl[0].data = &all->data[IPV4_DEVCONF_FORWARDING - 1];
                 tbl[0].extra1 = all;
                 tbl[0].extra2 = net;
 #endif
         }
 
 #ifdef CONFIG_SYSCTL
-        err = __devinet_sysctl_register(net, "all",
-                        NET_PROTO_CONF_ALL, all);
+        err = __devinet_sysctl_register(net, "all", all);
         if (err < 0)
                 goto err_reg_all;
 
-        err = __devinet_sysctl_register(net, "default",
-                        NET_PROTO_CONF_DEFAULT, dflt);
+        err = __devinet_sysctl_register(net, "default", dflt);
         if (err < 0)
                 goto err_reg_dflt;
 
@@ -1658,6 +1700,14 @@ static __net_initdata struct pernet_operations devinet_ops = {
         .exit = devinet_exit_net,
 };
 
+static struct rtnl_af_ops inet_af_ops = {
+        .family           = AF_INET,
+        .fill_link_af     = inet_fill_link_af,
+        .get_link_af_size = inet_get_link_af_size,
+        .validate_link_af = inet_validate_link_af,
+        .set_link_af      = inet_set_link_af,
+};
+
 void __init devinet_init(void)
 {
         register_pernet_subsys(&devinet_ops);
@@ -1665,13 +1715,10 @@ void __init devinet_init(void)
         register_gifconf(PF_INET, inet_gifconf);
         register_netdevice_notifier(&ip_netdev_notifier);
 
+        rtnl_af_register(&inet_af_ops);
+
         rtnl_register(PF_INET, RTM_NEWADDR, inet_rtm_newaddr, NULL);
         rtnl_register(PF_INET, RTM_DELADDR, inet_rtm_deladdr, NULL);
         rtnl_register(PF_INET, RTM_GETADDR, NULL, inet_dump_ifaddr);
 }
 
-EXPORT_SYMBOL(in_dev_finish_destroy);
-EXPORT_SYMBOL(inet_select_addr);
-EXPORT_SYMBOL(inetdev_by_index);
-EXPORT_SYMBOL(register_inetaddr_notifier);
-EXPORT_SYMBOL(unregister_inetaddr_notifier);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 18bb383ea393..e42a905180f0 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -23,6 +23,8 @@ struct esp_skb_cb {
 
 #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0]))
 
+static u32 esp4_get_mtu(struct xfrm_state *x, int mtu);
+
 /*
  * Allocate an AEAD request structure with extra space for SG and IV.
  *
@@ -117,25 +119,35 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         int blksize;
         int clen;
         int alen;
+        int plen;
+        int tfclen;
         int nfrags;
 
         /* skb is pure payload to encrypt */
 
         err = -ENOMEM;
 
-        /* Round to block size */
-        clen = skb->len;
-
         esp = x->data;
         aead = esp->aead;
         alen = crypto_aead_authsize(aead);
 
+        tfclen = 0;
+        if (x->tfcpad) {
+                struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb);
+                u32 padto;
+
+                padto = min(x->tfcpad, esp4_get_mtu(x, dst->child_mtu_cached));
+                if (skb->len < padto)
+                        tfclen = padto - skb->len;
+        }
         blksize = ALIGN(crypto_aead_blocksize(aead), 4);
-        clen = ALIGN(clen + 2, blksize);
+        clen = ALIGN(skb->len + 2 + tfclen, blksize);
         if (esp->padlen)
                 clen = ALIGN(clen, esp->padlen);
+        plen = clen - skb->len - tfclen;
 
-        if ((err = skb_cow_data(skb, clen - skb->len + alen, &trailer)) < 0)
+        err = skb_cow_data(skb, tfclen + plen + alen, &trailer);
+        if (err < 0)
                 goto error;
         nfrags = err;
 
@@ -150,13 +162,17 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
 
         /* Fill padding... */
         tail = skb_tail_pointer(trailer);
+        if (tfclen) {
+                memset(tail, 0, tfclen);
+                tail += tfclen;
+        }
         do {
                 int i;
-                for (i=0; i<clen-skb->len - 2; i++)
+                for (i = 0; i < plen - 2; i++)
                         tail[i] = i + 1;
         } while (0);
-        tail[clen - skb->len - 2] = (clen - skb->len) - 2;
-        tail[clen - skb->len - 1] = *skb_mac_header(skb);
+        tail[plen - 2] = plen - 2;
+        tail[plen - 1] = *skb_mac_header(skb);
         pskb_put(skb, trailer, clen - skb->len + alen);
 
         skb_push(skb, -skb_network_offset(skb));
@@ -422,7 +438,7 @@ static void esp4_err(struct sk_buff *skb, u32 info)
             icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
                 return;
 
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);
         if (!x)
                 return;
         NETDEBUG(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x\n",
@@ -530,7 +546,7 @@ static int esp_init_authenc(struct xfrm_state *x)
                 }
 
                 err = crypto_aead_setauthsize(
-                        aead, aalg_desc->uinfo.auth.icv_truncbits / 8);
+                        aead, x->aalg->alg_trunc_len / 8);
                 if (err)
                         goto free_key;
         }
@@ -615,7 +631,7 @@ static const struct xfrm_type esp_type =
         .output         = esp_output
 };
 
-static struct net_protocol esp4_protocol = {
+static const struct net_protocol esp4_protocol = {
         .handler        =       xfrm4_rcv,
         .err_handler    =       esp4_err,
         .no_policy      =       1,
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index e2f950592566..1d2cdd43a878 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -34,6 +34,7 @@
 #include <linux/skbuff.h>
 #include <linux/init.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -125,7 +126,7 @@ void fib_select_default(struct net *net,
 #endif
         tb = fib_get_table(net, table);
         if (FIB_RES_GW(*res) && FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
-                tb->tb_select_default(tb, flp, res);
+                fib_table_select_default(tb, flp, res);
 }
 
 static void fib_flush(struct net *net)
@@ -139,21 +140,27 @@ static void fib_flush(struct net *net)
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 head = &net->ipv4.fib_table_hash[h];
                 hlist_for_each_entry(tb, node, head, tb_hlist)
-                        flushed += tb->tb_flush(tb);
+                        flushed += fib_table_flush(tb);
         }
 
         if (flushed)
                 rt_cache_flush(net, -1);
 }
 
-/*
- *      Find the first device with a given source address.
+/**
+ * __ip_dev_find - find the first device with a given source address.
+ * @net: the net namespace
+ * @addr: the source address
+ * @devref: if true, take a reference on the found device
+ *
+ * If a caller uses devref=false, it should be protected by RCU, or RTNL
  */
-
-struct net_device * ip_dev_find(struct net *net, __be32 addr)
+struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref)
 {
-        struct flowi fl = { .nl_u = { .ip4_u = { .daddr = addr } } };
-        struct fib_result res;
+        struct flowi fl = {
+                .fl4_dst = addr,
+        };
+        struct fib_result res = { 0 };
         struct net_device *dev = NULL;
         struct fib_table *local_table;
 
@@ -161,19 +168,24 @@ struct net_device * ip_dev_find(struct net *net, __be32 addr)
         res.r = NULL;
 #endif
 
+        rcu_read_lock();
         local_table = fib_get_table(net, RT_TABLE_LOCAL);
-        if (!local_table || local_table->tb_lookup(local_table, &fl, &res))
+        if (!local_table ||
+            fib_table_lookup(local_table, &fl, &res, FIB_LOOKUP_NOREF)) {
+                rcu_read_unlock();
                 return NULL;
+        }
         if (res.type != RTN_LOCAL)
                 goto out;
         dev = FIB_RES_DEV(res);
 
-        if (dev)
+        if (dev && devref)
                 dev_hold(dev);
 out:
-        fib_res_put(&res);
+        rcu_read_unlock();
         return dev;
 }
+EXPORT_SYMBOL(__ip_dev_find);
 
 /*
  * Find address type as if only "dev" was present in the system. If
@@ -183,7 +195,7 @@ static inline unsigned __inet_dev_addr_type(struct net *net,
                                             const struct net_device *dev,
                                             __be32 addr)
 {
-        struct flowi            fl = { .nl_u = { .ip4_u = { .daddr = addr } } };
+        struct flowi            fl = { .fl4_dst = addr };
         struct fib_result       res;
         unsigned ret = RTN_BROADCAST;
         struct fib_table *local_table;
@@ -200,11 +212,12 @@ static inline unsigned __inet_dev_addr_type(struct net *net,
         local_table = fib_get_table(net, RT_TABLE_LOCAL);
         if (local_table) {
                 ret = RTN_UNICAST;
-                if (!local_table->tb_lookup(local_table, &fl, &res)) {
+                rcu_read_lock();
+                if (!fib_table_lookup(local_table, &fl, &res, FIB_LOOKUP_NOREF)) {
                         if (!dev || dev == res.fi->fib_dev)
                                 ret = res.type;
-                        fib_res_put(&res);
                 }
+                rcu_read_unlock();
         }
         return ret;
 }
@@ -213,43 +226,50 @@ unsigned int inet_addr_type(struct net *net, __be32 addr)
 {
         return __inet_dev_addr_type(net, NULL, addr);
 }
+EXPORT_SYMBOL(inet_addr_type);
 
 unsigned int inet_dev_addr_type(struct net *net, const struct net_device *dev,
                                 __be32 addr)
 {
-       return __inet_dev_addr_type(net, dev, addr);
+        return __inet_dev_addr_type(net, dev, addr);
 }
+EXPORT_SYMBOL(inet_dev_addr_type);
 
 /* Given (packet source, input interface) and optional (dst, oif, tos):
-   - (main) check, that source is valid i.e. not broadcast or our local
-     address.
-   - figure out what "logical" interface this packet arrived
-     and calculate "specific destination" address.
-   - check, that packet arrived from expected physical interface.
+ * - (main) check, that source is valid i.e. not broadcast or our local
+ *   address.
+ * - figure out what "logical" interface this packet arrived
+ *   and calculate "specific destination" address.
+ * - check, that packet arrived from expected physical interface.
+ * called with rcu_read_lock()
  */
-
 int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
-                        struct net_device *dev, __be32 *spec_dst, u32 *itag)
+                        struct net_device *dev, __be32 *spec_dst,
+                        u32 *itag, u32 mark)
 {
         struct in_device *in_dev;
-        struct flowi fl = { .nl_u = { .ip4_u =
-                                      { .daddr = src,
-                                        .saddr = dst,
-                                        .tos = tos } },
-                            .iif = oif };
+        struct flowi fl = {
+                .fl4_dst = src,
+                .fl4_src = dst,
+                .fl4_tos = tos,
+                .mark = mark,
+                .iif = oif
+        };
         struct fib_result res;
-        int no_addr, rpf;
+        int no_addr, rpf, accept_local;
+        bool dev_match;
         int ret;
         struct net *net;
 
-        no_addr = rpf = 0;
-        rcu_read_lock();
+        no_addr = rpf = accept_local = 0;
         in_dev = __in_dev_get_rcu(dev);
         if (in_dev) {
                 no_addr = in_dev->ifa_list == NULL;
                 rpf = IN_DEV_RPFILTER(in_dev);
+                accept_local = IN_DEV_ACCEPT_LOCAL(in_dev);
+                if (mark && !IN_DEV_SRC_VMARK(in_dev))
+                        fl.mark = 0;
         }
-        rcu_read_unlock();
 
         if (in_dev == NULL)
                 goto e_inval;
@@ -257,25 +277,35 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
         net = dev_net(dev);
         if (fib_lookup(net, &fl, &res))
                 goto last_resort;
-        if (res.type != RTN_UNICAST)
-                goto e_inval_res;
+        if (res.type != RTN_UNICAST) {
+                if (res.type != RTN_LOCAL || !accept_local)
+                        goto e_inval;
+        }
         *spec_dst = FIB_RES_PREFSRC(res);
         fib_combine_itag(itag, &res);
+        dev_match = false;
+
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-        if (FIB_RES_DEV(res) == dev || res.fi->fib_nhs > 1)
+        for (ret = 0; ret < res.fi->fib_nhs; ret++) {
+                struct fib_nh *nh = &res.fi->fib_nh[ret];
+
+                if (nh->nh_dev == dev) {
+                        dev_match = true;
+                        break;
+                }
+        }
 #else
         if (FIB_RES_DEV(res) == dev)
+                dev_match = true;
 #endif
-        {
+        if (dev_match) {
                 ret = FIB_RES_NH(res).nh_scope >= RT_SCOPE_HOST;
-                fib_res_put(&res);
                 return ret;
         }
-        fib_res_put(&res);
         if (no_addr)
                 goto last_resort;
         if (rpf == 1)
-                goto e_inval;
+                goto e_rpf;
         fl.oif = dev->ifindex;
 
         ret = 0;
@@ -284,21 +314,20 @@ int fib_validate_source(__be32 src, __be32 dst, u8 tos, int oif,
                         *spec_dst = FIB_RES_PREFSRC(res);
                         ret = FIB_RES_NH(res).nh_scope >= RT_SCOPE_HOST;
                 }
-                fib_res_put(&res);
         }
         return ret;
 
 last_resort:
         if (rpf)
-                goto e_inval;
+                goto e_rpf;
         *spec_dst = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE);
         *itag = 0;
         return 0;
 
-e_inval_res:
-        fib_res_put(&res);
 e_inval:
         return -EINVAL;
+e_rpf:
+        return -EXDEV;
 }
 
 static inline __be32 sk_extract_addr(struct sockaddr *addr)
@@ -447,9 +476,9 @@ static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt,
 }
 
 /*
- *      Handle IP routing ioctl calls. These are used to manipulate the routing tables
+ * Handle IP routing ioctl calls.
+ * These are used to manipulate the routing tables
  */
-
 int ip_rt_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 {
         struct fib_config cfg;
@@ -473,13 +502,13 @@ int ip_rt_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                         if (cmd == SIOCDELRT) {
                                 tb = fib_get_table(net, cfg.fc_table);
                                 if (tb)
-                                        err = tb->tb_delete(tb, &cfg);
+                                        err = fib_table_delete(tb, &cfg);
                                 else
                                         err = -ESRCH;
                         } else {
                                 tb = fib_new_table(net, cfg.fc_table);
                                 if (tb)
-                                        err = tb->tb_insert(tb, &cfg);
+                                        err = fib_table_insert(tb, &cfg);
                                 else
                                         err = -ENOBUFS;
                         }
@@ -493,7 +522,7 @@ int ip_rt_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         return -EINVAL;
 }
 
-const struct nla_policy rtm_ipv4_policy[RTA_MAX+1] = {
+const struct nla_policy rtm_ipv4_policy[RTA_MAX + 1] = {
         [RTA_DST]               = { .type = NLA_U32 },
         [RTA_SRC]               = { .type = NLA_U32 },
         [RTA_IIF]               = { .type = NLA_U32 },
@@ -507,7 +536,7 @@ const struct nla_policy rtm_ipv4_policy[RTA_MAX+1] = {
 };
 
 static int rtm_to_fib_config(struct net *net, struct sk_buff *skb,
-                            struct nlmsghdr *nlh, struct fib_config *cfg)
+                             struct nlmsghdr *nlh, struct fib_config *cfg)
 {
         struct nlattr *attr;
         int err, remaining;
@@ -594,7 +623,7 @@ static int inet_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *ar
                 goto errout;
         }
 
-        err = tb->tb_delete(tb, &cfg);
+        err = fib_table_delete(tb, &cfg);
 errout:
         return err;
 }
@@ -616,7 +645,7 @@ static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *ar
                 goto errout;
         }
 
-        err = tb->tb_insert(tb, &cfg);
+        err = fib_table_insert(tb, &cfg);
 errout:
         return err;
 }
@@ -647,7 +676,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                         if (dumped)
                                 memset(&cb->args[2], 0, sizeof(cb->args) -
                                                  2 * sizeof(cb->args[0]));
-                        if (tb->tb_dump(tb, skb, cb) < 0)
+                        if (fib_table_dump(tb, skb, cb) < 0)
                                 goto out;
                         dumped = 1;
 next:
@@ -662,12 +691,11 @@ out:
 }
 
 /* Prepare and feed intra-kernel routing request.
-   Really, it should be netlink message, but :-( netlink
-   can be not configured, so that we feed it directly
-   to fib engine. It is legal, because all events occur
-   only when netlink is already locked.
+ * Really, it should be netlink message, but :-( netlink
+ * can be not configured, so that we feed it directly
+ * to fib engine. It is legal, because all events occur
+ * only when netlink is already locked.
  */
-
 static void fib_magic(int cmd, int type, __be32 dst, int dst_len, struct in_ifaddr *ifa)
 {
         struct net *net = dev_net(ifa->ifa_dev->dev);
@@ -701,9 +729,9 @@ static void fib_magic(int cmd, int type, __be32 dst, int dst_len, struct in_ifad
                 cfg.fc_scope = RT_SCOPE_HOST;
 
         if (cmd == RTM_NEWROUTE)
-                tb->tb_insert(tb, &cfg);
+                fib_table_insert(tb, &cfg);
         else
-                tb->tb_delete(tb, &cfg);
+                fib_table_delete(tb, &cfg);
 }
 
 void fib_add_ifaddr(struct in_ifaddr *ifa)
@@ -713,9 +741,9 @@ void fib_add_ifaddr(struct in_ifaddr *ifa)
         struct in_ifaddr *prim = ifa;
         __be32 mask = ifa->ifa_mask;
         __be32 addr = ifa->ifa_local;
-        __be32 prefix = ifa->ifa_address&mask;
+        __be32 prefix = ifa->ifa_address & mask;
 
-        if (ifa->ifa_flags&IFA_F_SECONDARY) {
+        if (ifa->ifa_flags & IFA_F_SECONDARY) {
                 prim = inet_ifa_byprefix(in_dev, prefix, mask);
                 if (prim == NULL) {
                         printk(KERN_WARNING "fib_add_ifaddr: bug: prim == NULL\n");
@@ -725,22 +753,24 @@ void fib_add_ifaddr(struct in_ifaddr *ifa)
 
         fib_magic(RTM_NEWROUTE, RTN_LOCAL, addr, 32, prim);
 
-        if (!(dev->flags&IFF_UP))
+        if (!(dev->flags & IFF_UP))
                 return;
 
         /* Add broadcast address, if it is explicitly assigned. */
         if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF))
                 fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim);
 
-        if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags&IFA_F_SECONDARY) &&
+        if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) &&
             (prefix != addr || ifa->ifa_prefixlen < 32)) {
-                fib_magic(RTM_NEWROUTE, dev->flags&IFF_LOOPBACK ? RTN_LOCAL :
-                          RTN_UNICAST, prefix, ifa->ifa_prefixlen, prim);
+                fib_magic(RTM_NEWROUTE,
+                          dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST,
+                          prefix, ifa->ifa_prefixlen, prim);
 
                 /* Add network specific broadcasts, when it takes a sense */
                 if (ifa->ifa_prefixlen < 31) {
                         fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix, 32, prim);
-                        fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix|~mask, 32, prim);
+                        fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask,
+                                  32, prim);
                 }
         }
 }
@@ -751,17 +781,18 @@ static void fib_del_ifaddr(struct in_ifaddr *ifa)
         struct net_device *dev = in_dev->dev;
         struct in_ifaddr *ifa1;
         struct in_ifaddr *prim = ifa;
-        __be32 brd = ifa->ifa_address|~ifa->ifa_mask;
-        __be32 any = ifa->ifa_address&ifa->ifa_mask;
+        __be32 brd = ifa->ifa_address | ~ifa->ifa_mask;
+        __be32 any = ifa->ifa_address & ifa->ifa_mask;
 #define LOCAL_OK        1
 #define BRD_OK          2
 #define BRD0_OK         4
 #define BRD1_OK         8
         unsigned ok = 0;
 
-        if (!(ifa->ifa_flags&IFA_F_SECONDARY))
-                fib_magic(RTM_DELROUTE, dev->flags&IFF_LOOPBACK ? RTN_LOCAL :
-                          RTN_UNICAST, any, ifa->ifa_prefixlen, prim);
+        if (!(ifa->ifa_flags & IFA_F_SECONDARY))
+                fib_magic(RTM_DELROUTE,
+                          dev->flags & IFF_LOOPBACK ? RTN_LOCAL : RTN_UNICAST,
+                          any, ifa->ifa_prefixlen, prim);
         else {
                 prim = inet_ifa_byprefix(in_dev, any, ifa->ifa_mask);
                 if (prim == NULL) {
@@ -771,9 +802,9 @@ static void fib_del_ifaddr(struct in_ifaddr *ifa)
         }
 
         /* Deletion is more complicated than add.
-           We should take care of not to delete too much :-)
-
-           Scan address list to be sure that addresses are really gone.
+         * We should take care of not to delete too much :-)
+         *
+         * Scan address list to be sure that addresses are really gone.
          */
 
         for (ifa1 = in_dev->ifa_list; ifa1; ifa1 = ifa1->ifa_next) {
@@ -787,23 +818,23 @@ static void fib_del_ifaddr(struct in_ifaddr *ifa)
                         ok |= BRD0_OK;
         }
 
-        if (!(ok&BRD_OK))
+        if (!(ok & BRD_OK))
                 fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim);
-        if (!(ok&BRD1_OK))
+        if (!(ok & BRD1_OK))
                 fib_magic(RTM_DELROUTE, RTN_BROADCAST, brd, 32, prim);
-        if (!(ok&BRD0_OK))
+        if (!(ok & BRD0_OK))
                 fib_magic(RTM_DELROUTE, RTN_BROADCAST, any, 32, prim);
-        if (!(ok&LOCAL_OK)) {
+        if (!(ok & LOCAL_OK)) {
                 fib_magic(RTM_DELROUTE, RTN_LOCAL, ifa->ifa_local, 32, prim);
 
                 /* Check, that this local address finally disappeared. */
                 if (inet_addr_type(dev_net(dev), ifa->ifa_local) != RTN_LOCAL) {
                         /* And the last, but not the least thing.
-                           We must flush stray FIB entries.
-
-                           First of all, we scan fib_info list searching
-                           for stray nexthop entries, then ignite fib_flush.
-                        */
+                         * We must flush stray FIB entries.
+                         *
+                         * First of all, we scan fib_info list searching
+                         * for stray nexthop entries, then ignite fib_flush.
+                         */
                         if (fib_sync_down_addr(dev_net(dev), ifa->ifa_local))
                                 fib_flush(dev_net(dev));
                 }
@@ -814,14 +845,16 @@ static void fib_del_ifaddr(struct in_ifaddr *ifa)
 #undef BRD1_OK
 }
 
-static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
+static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb)
 {
 
         struct fib_result       res;
-        struct flowi            fl = { .mark = frn->fl_mark,
-                                       .nl_u = { .ip4_u = { .daddr = frn->fl_addr,
-                                                            .tos = frn->fl_tos,
-                                                            .scope = frn->fl_scope } } };
+        struct flowi            fl = {
+                .mark = frn->fl_mark,
+                .fl4_dst = frn->fl_addr,
+                .fl4_tos = frn->fl_tos,
+                .fl4_scope = frn->fl_scope,
+        };
 
 #ifdef CONFIG_IP_MULTIPLE_TABLES
         res.r = NULL;
@@ -832,15 +865,16 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
                 local_bh_disable();
 
                 frn->tb_id = tb->tb_id;
-                frn->err = tb->tb_lookup(tb, &fl, &res);
+                rcu_read_lock();
+                frn->err = fib_table_lookup(tb, &fl, &res, FIB_LOOKUP_NOREF);
 
                 if (!frn->err) {
                         frn->prefixlen = res.prefixlen;
                         frn->nh_sel = res.nh_sel;
                         frn->type = res.type;
                         frn->scope = res.scope;
-                        fib_res_put(&res);
                 }
+                rcu_read_unlock();
                 local_bh_enable();
         }
 }
@@ -869,13 +903,13 @@ static void nl_fib_input(struct sk_buff *skb)
 
         nl_fib_lookup(frn, tb);
 
-        pid = NETLINK_CB(skb).pid;       /* pid of sending process */
-        NETLINK_CB(skb).pid = 0;         /* from kernel */
+        pid = NETLINK_CB(skb).pid;      /* pid of sending process */
+        NETLINK_CB(skb).pid = 0;        /* from kernel */
         NETLINK_CB(skb).dst_group = 0;  /* unicast */
         netlink_unicast(net->ipv4.fibnl, skb, pid, MSG_DONTWAIT);
 }
 
-static int nl_fib_lookup_init(struct net *net)
+static int __net_init nl_fib_lookup_init(struct net *net)
 {
         struct sock *sk;
         sk = netlink_kernel_create(net, NETLINK_FIB_LOOKUP, 0,
@@ -892,11 +926,11 @@ static void nl_fib_lookup_exit(struct net *net)
         net->ipv4.fibnl = NULL;
 }
 
-static void fib_disable_ip(struct net_device *dev, int force)
+static void fib_disable_ip(struct net_device *dev, int force, int delay)
 {
         if (fib_sync_down_dev(dev, force))
                 fib_flush(dev_net(dev));
-        rt_cache_flush(dev_net(dev), 0);
+        rt_cache_flush(dev_net(dev), delay);
         arp_ifdown(dev);
 }
 
@@ -917,9 +951,9 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
                 fib_del_ifaddr(ifa);
                 if (ifa->ifa_dev->ifa_list == NULL) {
                         /* Last address was deleted from this interface.
-                           Disable IP.
+                         * Disable IP.
                          */
-                        fib_disable_ip(dev, 1);
+                        fib_disable_ip(dev, 1, 0);
                 } else {
                         rt_cache_flush(dev_net(dev), -1);
                 }
@@ -934,7 +968,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
         struct in_device *in_dev = __in_dev_get_rtnl(dev);
 
         if (event == NETDEV_UNREGISTER) {
-                fib_disable_ip(dev, 2);
+                fib_disable_ip(dev, 2, -1);
                 return NOTIFY_DONE;
         }
 
@@ -952,12 +986,19 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
                 rt_cache_flush(dev_net(dev), -1);
                 break;
         case NETDEV_DOWN:
-                fib_disable_ip(dev, 0);
+                fib_disable_ip(dev, 0, 0);
                 break;
         case NETDEV_CHANGEMTU:
         case NETDEV_CHANGE:
                 rt_cache_flush(dev_net(dev), 0);
                 break;
+        case NETDEV_UNREGISTER_BATCH:
+                /* The batch unregister is only called on the first
+                 * device in the list of devices being unregistered.
+                 * Therefore we should not pass dev_net(dev) in here.
+                 */
+                rt_cache_flush_batch(NULL);
+                break;
         }
         return NOTIFY_DONE;
 }
@@ -973,16 +1014,15 @@ static struct notifier_block fib_netdev_notifier = {
 static int __net_init ip_fib_net_init(struct net *net)
 {
         int err;
-        unsigned int i;
+        size_t size = sizeof(struct hlist_head) * FIB_TABLE_HASHSZ;
+
+        /* Avoid false sharing : Use at least a full cache line */
+        size = max_t(size_t, size, L1_CACHE_BYTES);
 
-        net->ipv4.fib_table_hash = kzalloc(
-                        sizeof(struct hlist_head)*FIB_TABLE_HASHSZ, GFP_KERNEL);
+        net->ipv4.fib_table_hash = kzalloc(size, GFP_KERNEL);
         if (net->ipv4.fib_table_hash == NULL)
                 return -ENOMEM;
 
-        for (i = 0; i < FIB_TABLE_HASHSZ; i++)
-                INIT_HLIST_HEAD(&net->ipv4.fib_table_hash[i]);
-
         err = fib4_rules_init(net);
         if (err < 0)
                 goto fail;
@@ -993,7 +1033,7 @@ fail:
         return err;
 }
 
-static void __net_exit ip_fib_net_exit(struct net *net)
+static void ip_fib_net_exit(struct net *net)
 {
         unsigned int i;
 
@@ -1009,8 +1049,8 @@ static void __net_exit ip_fib_net_exit(struct net *net)
                 head = &net->ipv4.fib_table_hash[i];
                 hlist_for_each_entry_safe(tb, node, tmp, head, tb_hlist) {
                         hlist_del(node);
-                        tb->tb_flush(tb);
-                        kfree(tb);
+                        fib_table_flush(tb);
+                        fib_free_table(tb);
                 }
         }
         kfree(net->ipv4.fib_table_hash);
@@ -1063,7 +1103,3 @@ void __init ip_fib_init(void)
 
         fib_hash_init();
 }
-
-EXPORT_SYMBOL(inet_addr_type);
-EXPORT_SYMBOL(inet_dev_addr_type);
-EXPORT_SYMBOL(ip_dev_find);
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index ecd39454235c..b3acb0417b21 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -32,6 +32,7 @@
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 
 #include <net/net_namespace.h>
 #include <net/ip.h>
@@ -53,36 +54,37 @@ struct fib_node {
         struct fib_alias        fn_embedded_alias;
 };
 
-struct fn_zone {
-        struct fn_zone          *fz_next;       /* Next not empty zone  */
-        struct hlist_head       *fz_hash;       /* Hash table pointer   */
-        int                     fz_nent;        /* Number of entries    */
+#define EMBEDDED_HASH_SIZE (L1_CACHE_BYTES / sizeof(struct hlist_head))
 
-        int                     fz_divisor;     /* Hash divisor         */
+struct fn_zone {
+        struct fn_zone __rcu    *fz_next;       /* Next not empty zone  */
+        struct hlist_head __rcu *fz_hash;       /* Hash table pointer   */
+        seqlock_t               fz_lock;
         u32                     fz_hashmask;    /* (fz_divisor - 1)     */
-#define FZ_HASHMASK(fz)         ((fz)->fz_hashmask)
 
-        int                     fz_order;       /* Zone order           */
-        __be32                  fz_mask;
+        u8                      fz_order;       /* Zone order (0..32)   */
+        u8                      fz_revorder;    /* 32 - fz_order        */
+        __be32                  fz_mask;        /* inet_make_mask(order) */
 #define FZ_MASK(fz)             ((fz)->fz_mask)
-};
 
-/* NOTE. On fast computers evaluation of fz_hashmask and fz_mask
- * can be cheaper than memory lookup, so that FZ_* macros are used.
- */
+        struct hlist_head       fz_embedded_hash[EMBEDDED_HASH_SIZE];
+
+        int                     fz_nent;        /* Number of entries    */
+        int                     fz_divisor;     /* Hash size (mask+1)   */
+};
 
 struct fn_hash {
-        struct fn_zone  *fn_zones[33];
-        struct fn_zone  *fn_zone_list;
+        struct fn_zone          *fn_zones[33];
+        struct fn_zone __rcu    *fn_zone_list;
 };
 
 static inline u32 fn_hash(__be32 key, struct fn_zone *fz)
 {
-        u32 h = ntohl(key)>>(32 - fz->fz_order);
+        u32 h = ntohl(key) >> fz->fz_revorder;
         h ^= (h>>20);
         h ^= (h>>10);
         h ^= (h>>5);
-        h &= FZ_HASHMASK(fz);
+        h &= fz->fz_hashmask;
         return h;
 }
 
@@ -91,7 +93,6 @@ static inline __be32 fz_key(__be32 dst, struct fn_zone *fz)
         return dst & FZ_MASK(fz);
 }
 
-static DEFINE_RWLOCK(fib_hash_lock);
 static unsigned int fib_hash_genid;
 
 #define FZ_MAX_DIVISOR ((PAGE_SIZE<<MAX_ORDER) / sizeof(struct hlist_head))
@@ -100,12 +101,11 @@ static struct hlist_head *fz_hash_alloc(int divisor)
 {
         unsigned long size = divisor * sizeof(struct hlist_head);
 
-        if (size <= PAGE_SIZE) {
+        if (size <= PAGE_SIZE)
                 return kzalloc(size, GFP_KERNEL);
-        } else {
-                return (struct hlist_head *)
-                        __get_free_pages(GFP_KERNEL | __GFP_ZERO, get_order(size));
-        }
+
+        return (struct hlist_head *)
+                __get_free_pages(GFP_KERNEL | __GFP_ZERO, get_order(size));
 }
 
 /* The fib hash lock must be held when this is called. */
@@ -122,10 +122,11 @@ static inline void fn_rebuild_zone(struct fn_zone *fz,
                 hlist_for_each_entry_safe(f, node, n, &old_ht[i], fn_hash) {
                         struct hlist_head *new_head;
 
-                        hlist_del(&f->fn_hash);
+                        hlist_del_rcu(&f->fn_hash);
 
-                        new_head = &fz->fz_hash[fn_hash(f->fn_key, fz)];
-                        hlist_add_head(&f->fn_hash, new_head);
+                        new_head = rcu_dereference_protected(fz->fz_hash, 1) +
+                                   fn_hash(f->fn_key, fz);
+                        hlist_add_head_rcu(&f->fn_hash, new_head);
                 }
         }
 }
@@ -146,14 +147,14 @@ static void fn_rehash_zone(struct fn_zone *fz)
         int old_divisor, new_divisor;
         u32 new_hashmask;
 
-        old_divisor = fz->fz_divisor;
+        new_divisor = old_divisor = fz->fz_divisor;
 
         switch (old_divisor) {
-        case 16:
-                new_divisor = 256;
+        case EMBEDDED_HASH_SIZE:
+                new_divisor *= EMBEDDED_HASH_SIZE;
                 break;
-        case 256:
-                new_divisor = 1024;
+        case EMBEDDED_HASH_SIZE*EMBEDDED_HASH_SIZE:
+                new_divisor *= (EMBEDDED_HASH_SIZE/2);
                 break;
         default:
                 if ((old_divisor << 1) > FZ_MAX_DIVISOR) {
@@ -174,31 +175,55 @@ static void fn_rehash_zone(struct fn_zone *fz)
         ht = fz_hash_alloc(new_divisor);
 
         if (ht) {
-                write_lock_bh(&fib_hash_lock);
-                old_ht = fz->fz_hash;
-                fz->fz_hash = ht;
+                struct fn_zone nfz;
+
+                memcpy(&nfz, fz, sizeof(nfz));
+
+                write_seqlock_bh(&fz->fz_lock);
+                old_ht = rcu_dereference_protected(fz->fz_hash, 1);
+                RCU_INIT_POINTER(nfz.fz_hash, ht);
+                nfz.fz_hashmask = new_hashmask;
+                nfz.fz_divisor = new_divisor;
+                fn_rebuild_zone(&nfz, old_ht, old_divisor);
+                fib_hash_genid++;
+                rcu_assign_pointer(fz->fz_hash, ht);
                 fz->fz_hashmask = new_hashmask;
                 fz->fz_divisor = new_divisor;
-                fn_rebuild_zone(fz, old_ht, old_divisor);
-                fib_hash_genid++;
-                write_unlock_bh(&fib_hash_lock);
+                write_sequnlock_bh(&fz->fz_lock);
 
-                fz_hash_free(old_ht, old_divisor);
+                if (old_ht != fz->fz_embedded_hash) {
+                        synchronize_rcu();
+                        fz_hash_free(old_ht, old_divisor);
+                }
         }
 }
 
-static inline void fn_free_node(struct fib_node * f)
+static void fn_free_node_rcu(struct rcu_head *head)
 {
+        struct fib_node *f = container_of(head, struct fib_node, fn_embedded_alias.rcu);
+
         kmem_cache_free(fn_hash_kmem, f);
 }
 
+static inline void fn_free_node(struct fib_node *f)
+{
+        call_rcu(&f->fn_embedded_alias.rcu, fn_free_node_rcu);
+}
+
+static void fn_free_alias_rcu(struct rcu_head *head)
+{
+        struct fib_alias *fa = container_of(head, struct fib_alias, rcu);
+
+        kmem_cache_free(fn_alias_kmem, fa);
+}
+
 static inline void fn_free_alias(struct fib_alias *fa, struct fib_node *f)
 {
         fib_release_info(fa->fa_info);
         if (fa == &f->fn_embedded_alias)
                 fa->fa_info = NULL;
         else
-                kmem_cache_free(fn_alias_kmem, fa);
+                call_rcu(&fa->rcu, fn_free_alias_rcu);
 }
 
 static struct fn_zone *
@@ -209,73 +234,76 @@ fn_new_zone(struct fn_hash *table, int z)
         if (!fz)
                 return NULL;
 
-        if (z) {
-                fz->fz_divisor = 16;
-        } else {
-                fz->fz_divisor = 1;
-        }
-        fz->fz_hashmask = (fz->fz_divisor - 1);
-        fz->fz_hash = fz_hash_alloc(fz->fz_divisor);
-        if (!fz->fz_hash) {
-                kfree(fz);
-                return NULL;
-        }
+        seqlock_init(&fz->fz_lock);
+        fz->fz_divisor = z ? EMBEDDED_HASH_SIZE : 1;
+        fz->fz_hashmask = fz->fz_divisor - 1;
+        RCU_INIT_POINTER(fz->fz_hash, fz->fz_embedded_hash);
         fz->fz_order = z;
+        fz->fz_revorder = 32 - z;
         fz->fz_mask = inet_make_mask(z);
 
         /* Find the first not empty zone with more specific mask */
-        for (i=z+1; i<=32; i++)
+        for (i = z + 1; i <= 32; i++)
                 if (table->fn_zones[i])
                         break;
-        write_lock_bh(&fib_hash_lock);
-        if (i>32) {
+        if (i > 32) {
                 /* No more specific masks, we are the first. */
-                fz->fz_next = table->fn_zone_list;
-                table->fn_zone_list = fz;
+                rcu_assign_pointer(fz->fz_next,
+                                   rtnl_dereference(table->fn_zone_list));
+                rcu_assign_pointer(table->fn_zone_list, fz);
         } else {
-                fz->fz_next = table->fn_zones[i]->fz_next;
-                table->fn_zones[i]->fz_next = fz;
+                rcu_assign_pointer(fz->fz_next,
+                                   rtnl_dereference(table->fn_zones[i]->fz_next));
+                rcu_assign_pointer(table->fn_zones[i]->fz_next, fz);
         }
         table->fn_zones[z] = fz;
         fib_hash_genid++;
-        write_unlock_bh(&fib_hash_lock);
         return fz;
 }
 
-static int
-fn_hash_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+int fib_table_lookup(struct fib_table *tb,
+                     const struct flowi *flp, struct fib_result *res,
+                     int fib_flags)
 {
         int err;
         struct fn_zone *fz;
         struct fn_hash *t = (struct fn_hash *)tb->tb_data;
 
-        read_lock(&fib_hash_lock);
-        for (fz = t->fn_zone_list; fz; fz = fz->fz_next) {
+        rcu_read_lock();
+        for (fz = rcu_dereference(t->fn_zone_list);
+             fz != NULL;
+             fz = rcu_dereference(fz->fz_next)) {
                 struct hlist_head *head;
                 struct hlist_node *node;
                 struct fib_node *f;
-                __be32 k = fz_key(flp->fl4_dst, fz);
+                __be32 k;
+                unsigned int seq;
 
-                head = &fz->fz_hash[fn_hash(k, fz)];
-                hlist_for_each_entry(f, node, head, fn_hash) {
-                        if (f->fn_key != k)
-                                continue;
+                do {
+                        seq = read_seqbegin(&fz->fz_lock);
+                        k = fz_key(flp->fl4_dst, fz);
 
-                        err = fib_semantic_match(&f->fn_alias,
+                        head = rcu_dereference(fz->fz_hash) + fn_hash(k, fz);
+                        hlist_for_each_entry_rcu(f, node, head, fn_hash) {
+                                if (f->fn_key != k)
+                                        continue;
+
+                                err = fib_semantic_match(&f->fn_alias,
                                                  flp, res,
-                                                 fz->fz_order);
-                        if (err <= 0)
-                                goto out;
-                }
+                                                 fz->fz_order, fib_flags);
+                                if (err <= 0)
+                                        goto out;
+                        }
+                } while (read_seqretry(&fz->fz_lock, seq));
         }
         err = 1;
 out:
-        read_unlock(&fib_hash_lock);
+        rcu_read_unlock();
         return err;
 }
 
-static void
-fn_hash_select_default(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+void fib_table_select_default(struct fib_table *tb,
+                              const struct flowi *flp, struct fib_result *res)
 {
         int order, last_idx;
         struct hlist_node *node;
@@ -284,6 +312,7 @@ fn_hash_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
         struct fib_info *last_resort;
         struct fn_hash *t = (struct fn_hash *)tb->tb_data;
         struct fn_zone *fz = t->fn_zones[0];
+        struct hlist_head *head;
 
         if (fz == NULL)
                 return;
@@ -292,11 +321,12 @@ fn_hash_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
         last_resort = NULL;
         order = -1;
 
-        read_lock(&fib_hash_lock);
-        hlist_for_each_entry(f, node, &fz->fz_hash[0], fn_hash) {
+        rcu_read_lock();
+        head = rcu_dereference(fz->fz_hash);
+        hlist_for_each_entry_rcu(f, node, head, fn_hash) {
                 struct fib_alias *fa;
 
-                list_for_each_entry(fa, &f->fn_alias, fa_list) {
+                list_for_each_entry_rcu(fa, &f->fn_alias, fa_list) {
                         struct fib_info *next_fi = fa->fa_info;
 
                         if (fa->fa_scope != res->scope ||
@@ -308,7 +338,8 @@ fn_hash_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
                         if (!next_fi->fib_nh[0].nh_gw ||
                             next_fi->fib_nh[0].nh_scope != RT_SCOPE_LINK)
                                 continue;
-                        fa->fa_state |= FA_S_ACCESSED;
+
+                        fib_alias_accessed(fa);
 
                         if (fi == NULL) {
                                 if (next_fi != res->fi)
@@ -340,25 +371,25 @@ fn_hash_select_default(struct fib_table *tb, const struct flowi *flp, struct fib
                 fib_result_assign(res, last_resort);
         tb->tb_default = last_idx;
 out:
-        read_unlock(&fib_hash_lock);
+        rcu_read_unlock();
 }
 
 /* Insert node F to FZ. */
 static inline void fib_insert_node(struct fn_zone *fz, struct fib_node *f)
 {
-        struct hlist_head *head = &fz->fz_hash[fn_hash(f->fn_key, fz)];
+        struct hlist_head *head = rtnl_dereference(fz->fz_hash) + fn_hash(f->fn_key, fz);
 
-        hlist_add_head(&f->fn_hash, head);
+        hlist_add_head_rcu(&f->fn_hash, head);
 }
 
 /* Return the node in FZ matching KEY. */
 static struct fib_node *fib_find_node(struct fn_zone *fz, __be32 key)
 {
-        struct hlist_head *head = &fz->fz_hash[fn_hash(key, fz)];
+        struct hlist_head *head = rtnl_dereference(fz->fz_hash) + fn_hash(key, fz);
         struct hlist_node *node;
         struct fib_node *f;
 
-        hlist_for_each_entry(f, node, head, fn_hash) {
+        hlist_for_each_entry_rcu(f, node, head, fn_hash) {
                 if (f->fn_key == key)
                         return f;
         }
@@ -366,7 +397,18 @@ static struct fib_node *fib_find_node(struct fn_zone *fz, __be32 key)
         return NULL;
 }
 
-static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
+
+static struct fib_alias *fib_fast_alloc(struct fib_node *f)
+{
+        struct fib_alias *fa = &f->fn_embedded_alias;
+
+        if (fa->fa_info != NULL)
+                fa = kmem_cache_alloc(fn_alias_kmem, GFP_KERNEL);
+        return fa;
+}
+
+/* Caller must hold RTNL. */
+int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct fn_hash *table = (struct fn_hash *) tb->tb_data;
         struct fib_node *new_f = NULL;
@@ -450,7 +492,6 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
                 }
 
                 if (cfg->fc_nlflags & NLM_F_REPLACE) {
-                        struct fib_info *fi_drop;
                         u8 state;
 
                         fa = fa_first;
@@ -459,21 +500,25 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
                                         err = 0;
                                 goto out;
                         }
-                        write_lock_bh(&fib_hash_lock);
-                        fi_drop = fa->fa_info;
-                        fa->fa_info = fi;
-                        fa->fa_type = cfg->fc_type;
-                        fa->fa_scope = cfg->fc_scope;
+                        err = -ENOBUFS;
+                        new_fa = fib_fast_alloc(f);
+                        if (new_fa == NULL)
+                                goto out;
+
+                        new_fa->fa_tos = fa->fa_tos;
+                        new_fa->fa_info = fi;
+                        new_fa->fa_type = cfg->fc_type;
+                        new_fa->fa_scope = cfg->fc_scope;
                         state = fa->fa_state;
-                        fa->fa_state &= ~FA_S_ACCESSED;
+                        new_fa->fa_state = state & ~FA_S_ACCESSED;
                         fib_hash_genid++;
-                        write_unlock_bh(&fib_hash_lock);
+                        list_replace_rcu(&fa->fa_list, &new_fa->fa_list);
 
-                        fib_release_info(fi_drop);
+                        fn_free_alias(fa, f);
                         if (state & FA_S_ACCESSED)
                                 rt_cache_flush(cfg->fc_nlinfo.nl_net, -1);
-                        rtmsg_fib(RTM_NEWROUTE, key, fa, cfg->fc_dst_len, tb->tb_id,
-                                  &cfg->fc_nlinfo, NLM_F_REPLACE);
+                        rtmsg_fib(RTM_NEWROUTE, key, new_fa, cfg->fc_dst_len,
+                                  tb->tb_id, &cfg->fc_nlinfo, NLM_F_REPLACE);
                         return 0;
                 }
 
@@ -505,12 +550,10 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
                 f = new_f;
         }
 
-        new_fa = &f->fn_embedded_alias;
-        if (new_fa->fa_info != NULL) {
-                new_fa = kmem_cache_alloc(fn_alias_kmem, GFP_KERNEL);
-                if (new_fa == NULL)
-                        goto out;
-        }
+        new_fa = fib_fast_alloc(f);
+        if (new_fa == NULL)
+                goto out;
+
         new_fa->fa_info = fi;
         new_fa->fa_tos = tos;
         new_fa->fa_type = cfg->fc_type;
@@ -521,13 +564,11 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
          * Insert new entry to the list.
          */
 
-        write_lock_bh(&fib_hash_lock);
         if (new_f)
                 fib_insert_node(fz, new_f);
-        list_add_tail(&new_fa->fa_list,
+        list_add_tail_rcu(&new_fa->fa_list,
                  (fa ? &fa->fa_list : &f->fn_alias));
         fib_hash_genid++;
-        write_unlock_bh(&fib_hash_lock);
 
         if (new_f)
                 fz->fz_nent++;
@@ -544,8 +585,7 @@ out:
         return err;
 }
 
-
-static int fn_hash_delete(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct fn_hash *table = (struct fn_hash *)tb->tb_data;
         struct fib_node *f;
@@ -603,14 +643,12 @@ static int fn_hash_delete(struct fib_table *tb, struct fib_config *cfg)
                           tb->tb_id, &cfg->fc_nlinfo, 0);
 
                 kill_fn = 0;
-                write_lock_bh(&fib_hash_lock);
-                list_del(&fa->fa_list);
+                list_del_rcu(&fa->fa_list);
                 if (list_empty(&f->fn_alias)) {
-                        hlist_del(&f->fn_hash);
+                        hlist_del_rcu(&f->fn_hash);
                         kill_fn = 1;
                 }
                 fib_hash_genid++;
-                write_unlock_bh(&fib_hash_lock);
 
                 if (fa->fa_state & FA_S_ACCESSED)
                         rt_cache_flush(cfg->fc_nlinfo.nl_net, -1);
@@ -627,7 +665,7 @@ static int fn_hash_delete(struct fib_table *tb, struct fib_config *cfg)
 
 static int fn_flush_list(struct fn_zone *fz, int idx)
 {
-        struct hlist_head *head = &fz->fz_hash[idx];
+        struct hlist_head *head = rtnl_dereference(fz->fz_hash) + idx;
         struct hlist_node *node, *n;
         struct fib_node *f;
         int found = 0;
@@ -641,14 +679,12 @@ static int fn_flush_list(struct fn_zone *fz, int idx)
                         struct fib_info *fi = fa->fa_info;
 
                         if (fi && (fi->fib_flags&RTNH_F_DEAD)) {
-                                write_lock_bh(&fib_hash_lock);
-                                list_del(&fa->fa_list);
+                                list_del_rcu(&fa->fa_list);
                                 if (list_empty(&f->fn_alias)) {
-                                        hlist_del(&f->fn_hash);
+                                        hlist_del_rcu(&f->fn_hash);
                                         kill_f = 1;
                                 }
                                 fib_hash_genid++;
-                                write_unlock_bh(&fib_hash_lock);
 
                                 fn_free_alias(fa, f);
                                 found++;
@@ -662,13 +698,16 @@ static int fn_flush_list(struct fn_zone *fz, int idx)
         return found;
 }
 
-static int fn_hash_flush(struct fib_table *tb)
+/* caller must hold RTNL. */
+int fib_table_flush(struct fib_table *tb)
 {
         struct fn_hash *table = (struct fn_hash *) tb->tb_data;
         struct fn_zone *fz;
         int found = 0;
 
-        for (fz = table->fn_zone_list; fz; fz = fz->fz_next) {
+        for (fz = rtnl_dereference(table->fn_zone_list);
+             fz != NULL;
+             fz = rtnl_dereference(fz->fz_next)) {
                 int i;
 
                 for (i = fz->fz_divisor - 1; i >= 0; i--)
@@ -677,6 +716,24 @@ static int fn_hash_flush(struct fib_table *tb)
         return found;
 }
 
+void fib_free_table(struct fib_table *tb)
+{
+        struct fn_hash *table = (struct fn_hash *) tb->tb_data;
+        struct fn_zone *fz, *next;
+
+        next = table->fn_zone_list;
+        while (next != NULL) {
+                fz = next;
+                next = fz->fz_next;
+
+                if (fz->fz_hash != fz->fz_embedded_hash)
+                        fz_hash_free(fz->fz_hash, fz->fz_divisor);
+
+                kfree(fz);
+        }
+
+        kfree(tb);
+}
 
 static inline int
 fn_hash_dump_bucket(struct sk_buff *skb, struct netlink_callback *cb,
@@ -690,10 +747,10 @@ fn_hash_dump_bucket(struct sk_buff *skb, struct netlink_callback *cb,
 
         s_i = cb->args[4];
         i = 0;
-        hlist_for_each_entry(f, node, head, fn_hash) {
+        hlist_for_each_entry_rcu(f, node, head, fn_hash) {
                 struct fib_alias *fa;
 
-                list_for_each_entry(fa, &f->fn_alias, fa_list) {
+                list_for_each_entry_rcu(fa, &f->fn_alias, fa_list) {
                         if (i < s_i)
                                 goto next;
 
@@ -711,7 +768,7 @@ fn_hash_dump_bucket(struct sk_buff *skb, struct netlink_callback *cb,
                                 cb->args[4] = i;
                                 return -1;
                         }
-                next:
+next:
                         i++;
                 }
         }
@@ -725,14 +782,15 @@ fn_hash_dump_zone(struct sk_buff *skb, struct netlink_callback *cb,
                    struct fn_zone *fz)
 {
         int h, s_h;
+        struct hlist_head *head = rcu_dereference(fz->fz_hash);
 
-        if (fz->fz_hash == NULL)
+        if (head == NULL)
                 return skb->len;
         s_h = cb->args[3];
         for (h = s_h; h < fz->fz_divisor; h++) {
-                if (hlist_empty(&fz->fz_hash[h]))
+                if (hlist_empty(head + h))
                         continue;
-                if (fn_hash_dump_bucket(skb, cb, tb, fz, &fz->fz_hash[h]) < 0) {
+                if (fn_hash_dump_bucket(skb, cb, tb, fz, head + h) < 0) {
                         cb->args[3] = h;
                         return -1;
                 }
@@ -743,25 +801,29 @@ fn_hash_dump_zone(struct sk_buff *skb, struct netlink_callback *cb,
         return skb->len;
 }
 
-static int fn_hash_dump(struct fib_table *tb, struct sk_buff *skb, struct netlink_callback *cb)
+int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
+                   struct netlink_callback *cb)
 {
-        int m, s_m;
+        int m = 0, s_m;
         struct fn_zone *fz;
         struct fn_hash *table = (struct fn_hash *)tb->tb_data;
 
         s_m = cb->args[2];
-        read_lock(&fib_hash_lock);
-        for (fz = table->fn_zone_list, m=0; fz; fz = fz->fz_next, m++) {
-                if (m < s_m) continue;
+        rcu_read_lock();
+        for (fz = rcu_dereference(table->fn_zone_list);
+             fz != NULL;
+             fz = rcu_dereference(fz->fz_next), m++) {
+                if (m < s_m)
+                        continue;
                 if (fn_hash_dump_zone(skb, cb, tb, fz) < 0) {
                         cb->args[2] = m;
-                        read_unlock(&fib_hash_lock);
+                        rcu_read_unlock();
                         return -1;
                 }
                 memset(&cb->args[3], 0,
                        sizeof(cb->args) - 3*sizeof(cb->args[0]));
         }
-        read_unlock(&fib_hash_lock);
+        rcu_read_unlock();
         cb->args[2] = m;
         return skb->len;
 }
@@ -787,12 +849,7 @@ struct fib_table *fib_hash_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
-        tb->tb_lookup = fn_hash_lookup;
-        tb->tb_insert = fn_hash_insert;
-        tb->tb_delete = fn_hash_delete;
-        tb->tb_flush = fn_hash_flush;
-        tb->tb_select_default = fn_hash_select_default;
-        tb->tb_dump = fn_hash_dump;
+
         memset(tb->tb_data, 0, sizeof(struct fn_hash));
         return tb;
 }
@@ -829,14 +886,15 @@ static struct fib_alias *fib_get_first(struct seq_file *seq)
         iter->genid     = fib_hash_genid;
         iter->valid     = 1;
 
-        for (iter->zone = table->fn_zone_list; iter->zone;
-             iter->zone = iter->zone->fz_next) {
+        for (iter->zone = rcu_dereference(table->fn_zone_list);
+             iter->zone != NULL;
+             iter->zone = rcu_dereference(iter->zone->fz_next)) {
                 int maxslot;
 
                 if (!iter->zone->fz_nent)
                         continue;
 
-                iter->hash_head = iter->zone->fz_hash;
+                iter->hash_head = rcu_dereference(iter->zone->fz_hash);
                 maxslot = iter->zone->fz_divisor;
 
                 for (iter->bucket = 0; iter->bucket < maxslot;
@@ -915,13 +973,13 @@ static struct fib_alias *fib_get_next(struct seq_file *seq)
                         }
                 }
 
-                iter->zone = iter->zone->fz_next;
+                iter->zone = rcu_dereference(iter->zone->fz_next);
 
                 if (!iter->zone)
                         goto out;
 
                 iter->bucket = 0;
-                iter->hash_head = iter->zone->fz_hash;
+                iter->hash_head = rcu_dereference(iter->zone->fz_hash);
 
                 hlist_for_each_entry(fn, node, iter->hash_head, fn_hash) {
                         list_for_each_entry(fa, &fn->fn_alias, fa_list) {
@@ -954,11 +1012,11 @@ static struct fib_alias *fib_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *fib_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(fib_hash_lock)
+        __acquires(RCU)
 {
         void *v = NULL;
 
-        read_lock(&fib_hash_lock);
+        rcu_read_lock();
         if (fib_get_table(seq_file_net(seq), RT_TABLE_MAIN))
                 v = *pos ? fib_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
         return v;
@@ -971,15 +1029,16 @@ static void *fib_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void fib_seq_stop(struct seq_file *seq, void *v)
-        __releases(fib_hash_lock)
+        __releases(RCU)
 {
-        read_unlock(&fib_hash_lock);
+        rcu_read_unlock();
 }
 
 static unsigned fib_flag_trans(int type, __be32 mask, struct fib_info *fi)
 {
         static const unsigned type2flags[RTN_MAX + 1] = {
-                [7] = RTF_REJECT, [8] = RTF_REJECT,
+                [7] = RTF_REJECT,
+                [8] = RTF_REJECT,
         };
         unsigned flags = type2flags[type];
 
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index 637b133973bd..c079cc0ec651 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -12,17 +12,22 @@ struct fib_alias {
         u8                      fa_type;
         u8                      fa_scope;
         u8                      fa_state;
-#ifdef CONFIG_IP_FIB_TRIE
         struct rcu_head         rcu;
-#endif
 };
 
 #define FA_S_ACCESSED   0x01
 
+/* Dont write on fa_state unless needed, to keep it shared on all cpus */
+static inline void fib_alias_accessed(struct fib_alias *fa)
+{
+        if (!(fa->fa_state & FA_S_ACCESSED))
+                fa->fa_state |= FA_S_ACCESSED;
+}
+
 /* Exported by fib_semantics.c */
 extern int fib_semantic_match(struct list_head *head,
                               const struct flowi *flp,
-                              struct fib_result *res, int prefixlen);
+                              struct fib_result *res, int prefixlen, int fib_flags);
 extern void fib_release_info(struct fib_info *);
 extern struct fib_info *fib_create_info(struct fib_config *cfg);
 extern int fib_nh_match(struct fib_config *cfg, struct fib_info *fi);
@@ -42,11 +47,8 @@ extern int fib_detect_death(struct fib_info *fi, int order,
 static inline void fib_result_assign(struct fib_result *res,
                                      struct fib_info *fi)
 {
-        if (res->fi != NULL)
-                fib_info_put(res->fi);
+        /* we used to play games with refcounts, but we now use RCU */
         res->fi = fi;
-        if (fi != NULL)
-                atomic_inc(&fi->fib_clntref);
 }
 
 #endif /* _FIB_LOOKUP_H */
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 92d9d97ec5e3..7981a24f5c7b 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -6,7 +6,7 @@
  *              IPv4 Forwarding Information Base: policy rules.
  *
  * Authors:     Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
- *              Thomas Graf <tgraf@suug.ch>
+ *              Thomas Graf <tgraf@suug.ch>
  *
  *              This program is free software; you can redistribute it and/or
  *              modify it under the terms of the GNU General Public License
@@ -14,7 +14,7 @@
  *              2 of the License, or (at your option) any later version.
  *
  * Fixes:
- *              Rani Assaf      :       local_rule cannot be deleted
+ *              Rani Assaf      :       local_rule cannot be deleted
  *              Marc Boucher    :       routing by fwmark
  */
 
@@ -32,8 +32,7 @@
 #include <net/ip_fib.h>
 #include <net/fib_rules.h>
 
-struct fib4_rule
-{
+struct fib4_rule {
         struct fib_rule         common;
         u8                      dst_len;
         u8                      src_len;
@@ -58,6 +57,7 @@ int fib_lookup(struct net *net, struct flowi *flp, struct fib_result *res)
 {
         struct fib_lookup_arg arg = {
                 .result = res,
+                .flags = FIB_LOOKUP_NOREF,
         };
         int err;
 
@@ -91,10 +91,11 @@ static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp,
                 goto errout;
         }
 
-        if ((tbl = fib_get_table(rule->fr_net, rule->table)) == NULL)
+        tbl = fib_get_table(rule->fr_net, rule->table);
+        if (!tbl)
                 goto errout;
 
-        err = tbl->tb_lookup(tbl, flp, (struct fib_result *) arg->result);
+        err = fib_table_lookup(tbl, flp, (struct fib_result *) arg->result, arg->flags);
         if (err > 0)
                 err = -EAGAIN;
 errout:
@@ -213,7 +214,6 @@ static int fib4_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
 {
         struct fib4_rule *rule4 = (struct fib4_rule *) rule;
 
-        frh->family = AF_INET;
         frh->dst_len = rule4->dst_len;
         frh->src_len = rule4->src_len;
         frh->tos = rule4->tos;
@@ -234,23 +234,6 @@ nla_put_failure:
         return -ENOBUFS;
 }
 
-static u32 fib4_rule_default_pref(struct fib_rules_ops *ops)
-{
-        struct list_head *pos;
-        struct fib_rule *rule;
-
-        if (!list_empty(&ops->rules_list)) {
-                pos = ops->rules_list.next;
-                if (pos->next != &ops->rules_list) {
-                        rule = list_entry(pos->next, struct fib_rule, list);
-                        if (rule->pref)
-                                return rule->pref - 1;
-                }
-        }
-
-        return 0;
-}
-
 static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
 {
         return nla_total_size(4) /* dst */
@@ -263,7 +246,7 @@ static void fib4_rule_flush_cache(struct fib_rules_ops *ops)
         rt_cache_flush(ops->fro_net, -1);
 }
 
-static struct fib_rules_ops fib4_rules_ops_template = {
+static const struct fib_rules_ops __net_initdata fib4_rules_ops_template = {
         .family         = AF_INET,
         .rule_size      = sizeof(struct fib4_rule),
         .addr_size      = sizeof(u32),
@@ -272,7 +255,7 @@ static struct fib_rules_ops fib4_rules_ops_template = {
         .configure      = fib4_rule_configure,
         .compare        = fib4_rule_compare,
         .fill           = fib4_rule_fill,
-        .default_pref   = fib4_rule_default_pref,
+        .default_pref   = fib_default_rule_pref,
         .nlmsg_payload  = fib4_rule_nlmsg_payload,
         .flush_cache    = fib4_rule_flush_cache,
         .nlgroup        = RTNLGRP_IPV4_RULE,
@@ -284,7 +267,7 @@ static int fib_default_rules_init(struct fib_rules_ops *ops)
 {
         int err;
 
-        err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, FIB_RULE_PERMANENT);
+        err = fib_default_rule_add(ops, 0, RT_TABLE_LOCAL, 0);
         if (err < 0)
                 return err;
         err = fib_default_rule_add(ops, 0x7FFE, RT_TABLE_MAIN, 0);
@@ -301,13 +284,9 @@ int __net_init fib4_rules_init(struct net *net)
         int err;
         struct fib_rules_ops *ops;
 
-        ops = kmemdup(&fib4_rules_ops_template, sizeof(*ops), GFP_KERNEL);
-        if (ops == NULL)
-                return -ENOMEM;
-        INIT_LIST_HEAD(&ops->rules_list);
-        ops->fro_net = net;
-
-        fib_rules_register(ops);
+        ops = fib_rules_register(&fib4_rules_ops_template, net);
+        if (IS_ERR(ops))
+                return PTR_ERR(ops);
 
         err = fib_default_rules_init(ops);
         if (err < 0)
@@ -318,12 +297,10 @@ int __net_init fib4_rules_init(struct net *net)
 fail:
         /* also cleans all rules already added */
         fib_rules_unregister(ops);
-        kfree(ops);
         return err;
 }
 
 void __net_exit fib4_rules_exit(struct net *net)
 {
         fib_rules_unregister(net->ipv4.rules_ops);
-        kfree(net->ipv4.rules_ops);
 }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 9b096d6ff3f2..12d3dc3df1b7 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -32,6 +32,7 @@
 #include <linux/proc_fs.h>
 #include <linux/skbuff.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 
 #include <net/arp.h>
 #include <net/ip.h>
@@ -59,21 +60,30 @@ static struct hlist_head fib_info_devhash[DEVINDEX_HASHSIZE];
 
 static DEFINE_SPINLOCK(fib_multipath_lock);
 
-#define for_nexthops(fi) { int nhsel; const struct fib_nh * nh; \
-for (nhsel=0, nh = (fi)->fib_nh; nhsel < (fi)->fib_nhs; nh++, nhsel++)
+#define for_nexthops(fi) {                                              \
+        int nhsel; const struct fib_nh *nh;                             \
+        for (nhsel = 0, nh = (fi)->fib_nh;                              \
+             nhsel < (fi)->fib_nhs;                                     \
+             nh++, nhsel++)
 
-#define change_nexthops(fi) { int nhsel; struct fib_nh * nh; \
-for (nhsel=0, nh = (struct fib_nh *)((fi)->fib_nh); nhsel < (fi)->fib_nhs; nh++, nhsel++)
+#define change_nexthops(fi) {                                           \
+        int nhsel; struct fib_nh *nexthop_nh;                           \
+        for (nhsel = 0, nexthop_nh = (struct fib_nh *)((fi)->fib_nh);   \
+             nhsel < (fi)->fib_nhs;                                     \
+             nexthop_nh++, nhsel++)
 
 #else /* CONFIG_IP_ROUTE_MULTIPATH */
 
 /* Hope, that gcc will optimize it to get rid of dummy loop */
 
-#define for_nexthops(fi) { int nhsel = 0; const struct fib_nh * nh = (fi)->fib_nh; \
-for (nhsel=0; nhsel < 1; nhsel++)
+#define for_nexthops(fi) {                                              \
+        int nhsel; const struct fib_nh *nh = (fi)->fib_nh;              \
+        for (nhsel = 0; nhsel < 1; nhsel++)
 
-#define change_nexthops(fi) { int nhsel = 0; struct fib_nh * nh = (struct fib_nh *)((fi)->fib_nh); \
-for (nhsel=0; nhsel < 1; nhsel++)
+#define change_nexthops(fi) {                                           \
+        int nhsel;                                                      \
+        struct fib_nh *nexthop_nh = (struct fib_nh *)((fi)->fib_nh);    \
+        for (nhsel = 0; nhsel < 1; nhsel++)
 
 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
 
@@ -85,73 +95,80 @@ static const struct
         int     error;
         u8      scope;
 } fib_props[RTN_MAX + 1] = {
-        {
+        [RTN_UNSPEC] = {
                 .error  = 0,
                 .scope  = RT_SCOPE_NOWHERE,
-        },      /* RTN_UNSPEC */
-        {
+        },
+        [RTN_UNICAST] = {
                 .error  = 0,
                 .scope  = RT_SCOPE_UNIVERSE,
-        },      /* RTN_UNICAST */
-        {
+        },
+        [RTN_LOCAL] = {
                 .error  = 0,
                 .scope  = RT_SCOPE_HOST,
-        },      /* RTN_LOCAL */
-        {
+        },
+        [RTN_BROADCAST] = {
                 .error  = 0,
                 .scope  = RT_SCOPE_LINK,
-        },      /* RTN_BROADCAST */
-        {
+        },
+        [RTN_ANYCAST] = {
                 .error  = 0,
                 .scope  = RT_SCOPE_LINK,
-        },      /* RTN_ANYCAST */
-        {
+        },
+        [RTN_MULTICAST] = {
                 .error  = 0,
                 .scope  = RT_SCOPE_UNIVERSE,
-        },      /* RTN_MULTICAST */
-        {
+        },
+        [RTN_BLACKHOLE] = {
                 .error  = -EINVAL,
                 .scope  = RT_SCOPE_UNIVERSE,
-        },      /* RTN_BLACKHOLE */
-        {
+        },
+        [RTN_UNREACHABLE] = {
                 .error  = -EHOSTUNREACH,
                 .scope  = RT_SCOPE_UNIVERSE,
-        },      /* RTN_UNREACHABLE */
-        {
+        },
+        [RTN_PROHIBIT] = {
                 .error  = -EACCES,
                 .scope  = RT_SCOPE_UNIVERSE,
-        },      /* RTN_PROHIBIT */
-        {
+        },
+        [RTN_THROW] = {
                 .error  = -EAGAIN,
                 .scope  = RT_SCOPE_UNIVERSE,
-        },      /* RTN_THROW */
-        {
+        },
+        [RTN_NAT] = {
                 .error  = -EINVAL,
                 .scope  = RT_SCOPE_NOWHERE,
-        },      /* RTN_NAT */
-        {
+        },
+        [RTN_XRESOLVE] = {
                 .error  = -EINVAL,
                 .scope  = RT_SCOPE_NOWHERE,
-        },      /* RTN_XRESOLVE */
+        },
 };
 
 
 /* Release a nexthop info record */
 
+static void free_fib_info_rcu(struct rcu_head *head)
+{
+        struct fib_info *fi = container_of(head, struct fib_info, rcu);
+
+        kfree(fi);
+}
+
 void free_fib_info(struct fib_info *fi)
 {
         if (fi->fib_dead == 0) {
-                printk(KERN_WARNING "Freeing alive fib_info %p\n", fi);
+                pr_warning("Freeing alive fib_info %p\n", fi);
                 return;
         }
         change_nexthops(fi) {
-                if (nh->nh_dev)
-                        dev_put(nh->nh_dev);
-                nh->nh_dev = NULL;
+                if (nexthop_nh->nh_dev)
+                        dev_put(nexthop_nh->nh_dev);
+                nexthop_nh->nh_dev = NULL;
         } endfor_nexthops(fi);
         fib_info_cnt--;
         release_net(fi->fib_net);
-        kfree(fi);
+        call_rcu(&fi->rcu, free_fib_info_rcu);
 }
 
 void fib_release_info(struct fib_info *fi)
@@ -162,9 +179,9 @@ void fib_release_info(struct fib_info *fi)
                 if (fi->fib_prefsrc)
                         hlist_del(&fi->fib_lhash);
                 change_nexthops(fi) {
-                        if (!nh->nh_dev)
+                        if (!nexthop_nh->nh_dev)
                                 continue;
-                        hlist_del(&nh->nh_hash);
+                        hlist_del(&nexthop_nh->nh_hash);
                 } endfor_nexthops(fi)
                 fi->fib_dead = 1;
                 fib_info_put(fi);
@@ -172,7 +189,7 @@ void fib_release_info(struct fib_info *fi)
         spin_unlock_bh(&fib_info_lock);
 }
 
-static __inline__ int nh_comp(const struct fib_info *fi, const struct fib_info *ofi)
+static inline int nh_comp(const struct fib_info *fi, const struct fib_info *ofi)
 {
         const struct fib_nh *onh = ofi->fib_nh;
 
@@ -186,7 +203,7 @@ static __inline__ int nh_comp(const struct fib_info *fi, const struct fib_info *
 #ifdef CONFIG_NET_CLS_ROUTE
                     nh->nh_tclassid != onh->nh_tclassid ||
 #endif
-                    ((nh->nh_flags^onh->nh_flags)&~RTNH_F_DEAD))
+                    ((nh->nh_flags ^ onh->nh_flags) & ~RTNH_F_DEAD))
                         return -1;
                 onh++;
         } endfor_nexthops(fi);
@@ -228,7 +245,7 @@ static struct fib_info *fib_find_info(const struct fib_info *nfi)
         head = &fib_info_hash[hash];
 
         hlist_for_each_entry(fi, node, head, fib_hash) {
-                if (fi->fib_net != nfi->fib_net)
+                if (!net_eq(fi->fib_net, nfi->fib_net))
                         continue;
                 if (fi->fib_nhs != nfi->fib_nhs)
                         continue;
@@ -237,7 +254,7 @@ static struct fib_info *fib_find_info(const struct fib_info *nfi)
                     nfi->fib_priority == fi->fib_priority &&
                     memcmp(nfi->fib_metrics, fi->fib_metrics,
                            sizeof(fi->fib_metrics)) == 0 &&
-                    ((nfi->fib_flags^fi->fib_flags)&~RTNH_F_DEAD) == 0 &&
+                    ((nfi->fib_flags ^ fi->fib_flags) & ~RTNH_F_DEAD) == 0 &&
                     (nfi->fib_nhs == 0 || nh_comp(fi, nfi) == 0))
                         return fi;
         }
@@ -246,9 +263,8 @@ static struct fib_info *fib_find_info(const struct fib_info *nfi)
 }
 
 /* Check, that the gateway is already configured.
-   Used only by redirect accept routine.
+ * Used only by redirect accept routine.
  */
-
 int ip_fib_check_default(__be32 gw, struct net_device *dev)
 {
         struct hlist_head *head;
@@ -263,7 +279,7 @@ int ip_fib_check_default(__be32 gw, struct net_device *dev)
         hlist_for_each_entry(nh, node, head, nh_hash) {
                 if (nh->nh_dev == dev &&
                     nh->nh_gw == gw &&
-                    !(nh->nh_flags&RTNH_F_DEAD)) {
+                    !(nh->nh_flags & RTNH_F_DEAD)) {
                         spin_unlock(&fib_info_lock);
                         return 0;
                 }
@@ -361,10 +377,10 @@ int fib_detect_death(struct fib_info *fi, int order,
         }
         if (state == NUD_REACHABLE)
                 return 0;
-        if ((state&NUD_VALID) && order != dflt)
+        if ((state & NUD_VALID) && order != dflt)
                 return 0;
-        if ((state&NUD_VALID) ||
-            (*last_idx<0 && order > dflt)) {
+        if ((state & NUD_VALID) ||
+            (*last_idx < 0 && order > dflt)) {
                 *last_resort = fi;
                 *last_idx = order;
         }
@@ -395,19 +411,20 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
                 if (!rtnh_ok(rtnh, remaining))
                         return -EINVAL;
 
-                nh->nh_flags = (cfg->fc_flags & ~0xFF) | rtnh->rtnh_flags;
-                nh->nh_oif = rtnh->rtnh_ifindex;
-                nh->nh_weight = rtnh->rtnh_hops + 1;
+                nexthop_nh->nh_flags =
+                        (cfg->fc_flags & ~0xFF) | rtnh->rtnh_flags;
+                nexthop_nh->nh_oif = rtnh->rtnh_ifindex;
+                nexthop_nh->nh_weight = rtnh->rtnh_hops + 1;
 
                 attrlen = rtnh_attrlen(rtnh);
                 if (attrlen > 0) {
                         struct nlattr *nla, *attrs = rtnh_attrs(rtnh);
 
                         nla = nla_find(attrs, attrlen, RTA_GATEWAY);
-                        nh->nh_gw = nla ? nla_get_be32(nla) : 0;
+                        nexthop_nh->nh_gw = nla ? nla_get_be32(nla) : 0;
 #ifdef CONFIG_NET_CLS_ROUTE
                         nla = nla_find(attrs, attrlen, RTA_FLOW);
-                        nh->nh_tclassid = nla ? nla_get_u32(nla) : 0;
+                        nexthop_nh->nh_tclassid = nla ? nla_get_u32(nla) : 0;
 #endif
                 }
 
@@ -474,137 +491,133 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi)
 
 
 /*
-   Picture
-   -------
-
-   Semantics of nexthop is very messy by historical reasons.
-   We have to take into account, that:
-   a) gateway can be actually local interface address,
-      so that gatewayed route is direct.
-   b) gateway must be on-link address, possibly
-      described not by an ifaddr, but also by a direct route.
-   c) If both gateway and interface are specified, they should not
-      contradict.
-   d) If we use tunnel routes, gateway could be not on-link.
-
-   Attempt to reconcile all of these (alas, self-contradictory) conditions
-   results in pretty ugly and hairy code with obscure logic.
-
-   I chose to generalized it instead, so that the size
-   of code does not increase practically, but it becomes
-   much more general.
-   Every prefix is assigned a "scope" value: "host" is local address,
-   "link" is direct route,
-   [ ... "site" ... "interior" ... ]
-   and "universe" is true gateway route with global meaning.
-
-   Every prefix refers to a set of "nexthop"s (gw, oif),
-   where gw must have narrower scope. This recursion stops
-   when gw has LOCAL scope or if "nexthop" is declared ONLINK,
-   which means that gw is forced to be on link.
-
-   Code is still hairy, but now it is apparently logically
-   consistent and very flexible. F.e. as by-product it allows
-   to co-exists in peace independent exterior and interior
-   routing processes.
-
-   Normally it looks as following.
-
-   {universe prefix}  -> (gw, oif) [scope link]
-                          |
-                          |-> {link prefix} -> (gw, oif) [scope local]
-                                                |
-                                                |-> {local prefix} (terminal node)
+ * Picture
+ * -------
+ *
+ * Semantics of nexthop is very messy by historical reasons.
+ * We have to take into account, that:
+ * a) gateway can be actually local interface address,
+ *    so that gatewayed route is direct.
+ * b) gateway must be on-link address, possibly
+ *    described not by an ifaddr, but also by a direct route.
+ * c) If both gateway and interface are specified, they should not
+ *    contradict.
+ * d) If we use tunnel routes, gateway could be not on-link.
+ *
+ * Attempt to reconcile all of these (alas, self-contradictory) conditions
+ * results in pretty ugly and hairy code with obscure logic.
+ *
+ * I chose to generalized it instead, so that the size
+ * of code does not increase practically, but it becomes
+ * much more general.
+ * Every prefix is assigned a "scope" value: "host" is local address,
+ * "link" is direct route,
+ * [ ... "site" ... "interior" ... ]
+ * and "universe" is true gateway route with global meaning.
+ *
+ * Every prefix refers to a set of "nexthop"s (gw, oif),
+ * where gw must have narrower scope. This recursion stops
+ * when gw has LOCAL scope or if "nexthop" is declared ONLINK,
+ * which means that gw is forced to be on link.
+ *
+ * Code is still hairy, but now it is apparently logically
+ * consistent and very flexible. F.e. as by-product it allows
+ * to co-exists in peace independent exterior and interior
+ * routing processes.
+ *
+ * Normally it looks as following.
+ *
+ * {universe prefix}  -> (gw, oif) [scope link]
+ *                |
+ *                |-> {link prefix} -> (gw, oif) [scope local]
+ *                                      |
+ *                                      |-> {local prefix} (terminal node)
  */
-
 static int fib_check_nh(struct fib_config *cfg, struct fib_info *fi,
                         struct fib_nh *nh)
 {
         int err;
         struct net *net;
+        struct net_device *dev;
 
         net = cfg->fc_nlinfo.nl_net;
         if (nh->nh_gw) {
                 struct fib_result res;
 
-#ifdef CONFIG_IP_ROUTE_PERVASIVE
-                if (nh->nh_flags&RTNH_F_PERVASIVE)
-                        return 0;
-#endif
-                if (nh->nh_flags&RTNH_F_ONLINK) {
-                        struct net_device *dev;
+                if (nh->nh_flags & RTNH_F_ONLINK) {
 
                         if (cfg->fc_scope >= RT_SCOPE_LINK)
                                 return -EINVAL;
                         if (inet_addr_type(net, nh->nh_gw) != RTN_UNICAST)
                                 return -EINVAL;
-                        if ((dev = __dev_get_by_index(net, nh->nh_oif)) == NULL)
+                        dev = __dev_get_by_index(net, nh->nh_oif);
+                        if (!dev)
                                 return -ENODEV;
-                        if (!(dev->flags&IFF_UP))
+                        if (!(dev->flags & IFF_UP))
                                 return -ENETDOWN;
                         nh->nh_dev = dev;
                         dev_hold(dev);
                         nh->nh_scope = RT_SCOPE_LINK;
                         return 0;
                 }
+                rcu_read_lock();
                 {
                         struct flowi fl = {
-                                .nl_u = {
-                                        .ip4_u = {
-                                                .daddr = nh->nh_gw,
-                                                .scope = cfg->fc_scope + 1,
-                                        },
-                                },
+                                .fl4_dst = nh->nh_gw,
+                                .fl4_scope = cfg->fc_scope + 1,
                                 .oif = nh->nh_oif,
                         };
 
                         /* It is not necessary, but requires a bit of thinking */
                         if (fl.fl4_scope < RT_SCOPE_LINK)
                                 fl.fl4_scope = RT_SCOPE_LINK;
-                        if ((err = fib_lookup(net, &fl, &res)) != 0)
+                        err = fib_lookup(net, &fl, &res);
+                        if (err) {
+                                rcu_read_unlock();
                                 return err;
+                        }
                 }
                 err = -EINVAL;
                 if (res.type != RTN_UNICAST && res.type != RTN_LOCAL)
                         goto out;
                 nh->nh_scope = res.scope;
                 nh->nh_oif = FIB_RES_OIF(res);
-                if ((nh->nh_dev = FIB_RES_DEV(res)) == NULL)
+                nh->nh_dev = dev = FIB_RES_DEV(res);
+                if (!dev)
                         goto out;
-                dev_hold(nh->nh_dev);
-                err = -ENETDOWN;
-                if (!(nh->nh_dev->flags & IFF_UP))
-                        goto out;
-                err = 0;
-out:
-                fib_res_put(&res);
-                return err;
+                dev_hold(dev);
+                err = (dev->flags & IFF_UP) ? 0 : -ENETDOWN;
         } else {
                 struct in_device *in_dev;
 
-                if (nh->nh_flags&(RTNH_F_PERVASIVE|RTNH_F_ONLINK))
+                if (nh->nh_flags & (RTNH_F_PERVASIVE | RTNH_F_ONLINK))
                         return -EINVAL;
 
+                rcu_read_lock();
+                err = -ENODEV;
                 in_dev = inetdev_by_index(net, nh->nh_oif);
                 if (in_dev == NULL)
-                        return -ENODEV;
-                if (!(in_dev->dev->flags&IFF_UP)) {
-                        in_dev_put(in_dev);
-                        return -ENETDOWN;
-                }
+                        goto out;
+                err = -ENETDOWN;
+                if (!(in_dev->dev->flags & IFF_UP))
+                        goto out;
                 nh->nh_dev = in_dev->dev;
                 dev_hold(nh->nh_dev);
                 nh->nh_scope = RT_SCOPE_HOST;
-                in_dev_put(in_dev);
+                err = 0;
         }
-        return 0;
+out:
+        rcu_read_unlock();
+        return err;
 }
 
 static inline unsigned int fib_laddr_hashfn(__be32 val)
 {
         unsigned int mask = (fib_hash_size - 1);
 
-        return ((__force u32)val ^ ((__force u32)val >> 7) ^ ((__force u32)val >> 14)) & mask;
+        return ((__force u32)val ^
+                ((__force u32)val >> 7) ^
+                ((__force u32)val >> 14)) & mask;
 }
 
 static struct hlist_head *fib_hash_alloc(int bytes)
@@ -613,7 +626,8 @@ static struct hlist_head *fib_hash_alloc(int bytes)
                 return kzalloc(bytes, GFP_KERNEL);
         else
                 return (struct hlist_head *)
-                        __get_free_pages(GFP_KERNEL | __GFP_ZERO, get_order(bytes));
+                        __get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                         get_order(bytes));
 }
 
 static void fib_hash_free(struct hlist_head *hash, int bytes)
@@ -738,7 +752,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
 
         fi->fib_nhs = nhs;
         change_nexthops(fi) {
-                nh->nh_parent = fi;
+                nexthop_nh->nh_parent = fi;
         } endfor_nexthops(fi)
 
         if (cfg->fc_mx) {
@@ -808,7 +822,8 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
                         goto failure;
         } else {
                 change_nexthops(fi) {
-                        if ((err = fib_check_nh(cfg, fi, nh)) != 0)
+                        err = fib_check_nh(cfg, fi, nexthop_nh);
+                        if (err != 0)
                                 goto failure;
                 } endfor_nexthops(fi)
         }
@@ -821,7 +836,8 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
         }
 
 link_it:
-        if ((ofi = fib_find_info(fi)) != NULL) {
+        ofi = fib_find_info(fi);
+        if (ofi) {
                 fi->fib_dead = 1;
                 free_fib_info(fi);
                 ofi->fib_treeref++;
@@ -843,11 +859,11 @@ link_it:
                 struct hlist_head *head;
                 unsigned int hash;
 
-                if (!nh->nh_dev)
+                if (!nexthop_nh->nh_dev)
                         continue;
-                hash = fib_devindex_hashfn(nh->nh_dev->ifindex);
+                hash = fib_devindex_hashfn(nexthop_nh->nh_dev->ifindex);
                 head = &fib_info_devhash[hash];
-                hlist_add_head(&nh->nh_hash, head);
+                hlist_add_head(&nexthop_nh->nh_hash, head);
         } endfor_nexthops(fi)
         spin_unlock_bh(&fib_info_lock);
         return fi;
@@ -866,7 +882,7 @@ failure:
 
 /* Note! fib_semantic_match intentionally uses  RCU list functions. */
 int fib_semantic_match(struct list_head *head, const struct flowi *flp,
-                       struct fib_result *res, int prefixlen)
+                       struct fib_result *res, int prefixlen, int fib_flags)
 {
         struct fib_alias *fa;
         int nh_sel = 0;
@@ -881,7 +897,7 @@ int fib_semantic_match(struct list_head *head, const struct flowi *flp,
                 if (fa->fa_scope < flp->fl4_scope)
                         continue;
 
-                fa->fa_state |= FA_S_ACCESSED;
+                fib_alias_accessed(fa);
 
                 err = fib_props[fa->fa_type].error;
                 if (err == 0) {
@@ -897,7 +913,7 @@ int fib_semantic_match(struct list_head *head, const struct flowi *flp,
                         case RTN_ANYCAST:
                         case RTN_MULTICAST:
                                 for_nexthops(fi) {
-                                        if (nh->nh_flags&RTNH_F_DEAD)
+                                        if (nh->nh_flags & RTNH_F_DEAD)
                                                 continue;
                                         if (!flp->oif || flp->oif == nh->nh_oif)
                                                 break;
@@ -908,16 +924,15 @@ int fib_semantic_match(struct list_head *head, const struct flowi *flp,
                                         goto out_fill_res;
                                 }
 #else
-                                if (nhsel < 1) {
+                                if (nhsel < 1)
                                         goto out_fill_res;
-                                }
 #endif
                                 endfor_nexthops(fi);
                                 continue;
 
                         default:
-                                printk(KERN_WARNING "fib_semantic_match bad type %#x\n",
-                                        fa->fa_type);
+                                pr_warning("fib_semantic_match bad type %#x\n",
+                                           fa->fa_type);
                                 return -EINVAL;
                         }
                 }
@@ -931,7 +946,8 @@ out_fill_res:
         res->type = fa->fa_type;
         res->scope = fa->fa_scope;
         res->fi = fa->fa_info;
-        atomic_inc(&res->fi->fib_clntref);
+        if (!(fib_flags & FIB_LOOKUP_NOREF))
+                atomic_inc(&res->fi->fib_clntref);
         return 0;
 }
 
@@ -1030,10 +1046,10 @@ nla_put_failure:
 }
 
 /*
-   Update FIB if:
-   - local address disappeared -> we must delete all the entries
-     referring to it.
-   - device went down -> we must shutdown all nexthops going via it.
+ * Update FIB if:
+ * - local address disappeared -> we must delete all the entries
+ *   referring to it.
+ * - device went down -> we must shutdown all nexthops going via it.
  */
 int fib_sync_down_addr(struct net *net, __be32 local)
 {
@@ -1047,7 +1063,7 @@ int fib_sync_down_addr(struct net *net, __be32 local)
                 return 0;
 
         hlist_for_each_entry(fi, node, head, fib_lhash) {
-                if (fi->fib_net != net)
+                if (!net_eq(fi->fib_net, net))
                         continue;
                 if (fi->fib_prefsrc == local) {
                         fi->fib_flags |= RTNH_F_DEAD;
@@ -1080,21 +1096,21 @@ int fib_sync_down_dev(struct net_device *dev, int force)
                 prev_fi = fi;
                 dead = 0;
                 change_nexthops(fi) {
-                        if (nh->nh_flags&RTNH_F_DEAD)
+                        if (nexthop_nh->nh_flags & RTNH_F_DEAD)
                                 dead++;
-                        else if (nh->nh_dev == dev &&
-                                        nh->nh_scope != scope) {
-                                nh->nh_flags |= RTNH_F_DEAD;
+                        else if (nexthop_nh->nh_dev == dev &&
+                                 nexthop_nh->nh_scope != scope) {
+                                nexthop_nh->nh_flags |= RTNH_F_DEAD;
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
                                 spin_lock_bh(&fib_multipath_lock);
-                                fi->fib_power -= nh->nh_power;
-                                nh->nh_power = 0;
+                                fi->fib_power -= nexthop_nh->nh_power;
+                                nexthop_nh->nh_power = 0;
                                 spin_unlock_bh(&fib_multipath_lock);
 #endif
                                 dead++;
                         }
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-                        if (force > 1 && nh->nh_dev == dev) {
+                        if (force > 1 && nexthop_nh->nh_dev == dev) {
                                 dead = fi->fib_nhs;
                                 break;
                         }
@@ -1112,10 +1128,9 @@ int fib_sync_down_dev(struct net_device *dev, int force)
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
 
 /*
-   Dead device goes up. We wake up dead nexthops.
-   It takes sense only on multipath routes.
+ * Dead device goes up. We wake up dead nexthops.
+ * It takes sense only on multipath routes.
  */
-
 int fib_sync_up(struct net_device *dev)
 {
         struct fib_info *prev_fi;
@@ -1125,7 +1140,7 @@ int fib_sync_up(struct net_device *dev)
         struct fib_nh *nh;
         int ret;
 
-        if (!(dev->flags&IFF_UP))
+        if (!(dev->flags & IFF_UP))
                 return 0;
 
         prev_fi = NULL;
@@ -1144,18 +1159,20 @@ int fib_sync_up(struct net_device *dev)
                 prev_fi = fi;
                 alive = 0;
                 change_nexthops(fi) {
-                        if (!(nh->nh_flags&RTNH_F_DEAD)) {
+                        if (!(nexthop_nh->nh_flags & RTNH_F_DEAD)) {
                                 alive++;
                                 continue;
                         }
-                        if (nh->nh_dev == NULL || !(nh->nh_dev->flags&IFF_UP))
+                        if (nexthop_nh->nh_dev == NULL ||
+                            !(nexthop_nh->nh_dev->flags & IFF_UP))
                                 continue;
-                        if (nh->nh_dev != dev || !__in_dev_get_rtnl(dev))
+                        if (nexthop_nh->nh_dev != dev ||
+                            !__in_dev_get_rtnl(dev))
                                 continue;
                         alive++;
                         spin_lock_bh(&fib_multipath_lock);
-                        nh->nh_power = 0;
-                        nh->nh_flags &= ~RTNH_F_DEAD;
+                        nexthop_nh->nh_power = 0;
+                        nexthop_nh->nh_flags &= ~RTNH_F_DEAD;
                         spin_unlock_bh(&fib_multipath_lock);
                 } endfor_nexthops(fi)
 
@@ -1169,10 +1186,9 @@ int fib_sync_up(struct net_device *dev)
 }
 
 /*
-   The algorithm is suboptimal, but it provides really
-   fair weighted route distribution.
+ * The algorithm is suboptimal, but it provides really
+ * fair weighted route distribution.
  */
-
 void fib_select_multipath(const struct flowi *flp, struct fib_result *res)
 {
         struct fib_info *fi = res->fi;
@@ -1182,9 +1198,9 @@ void fib_select_multipath(const struct flowi *flp, struct fib_result *res)
         if (fi->fib_power <= 0) {
                 int power = 0;
                 change_nexthops(fi) {
-                        if (!(nh->nh_flags&RTNH_F_DEAD)) {
-                                power += nh->nh_weight;
-                                nh->nh_power = nh->nh_weight;
+                        if (!(nexthop_nh->nh_flags & RTNH_F_DEAD)) {
+                                power += nexthop_nh->nh_weight;
+                                nexthop_nh->nh_power = nexthop_nh->nh_weight;
                         }
                 } endfor_nexthops(fi);
                 fi->fib_power = power;
@@ -1198,15 +1214,17 @@ void fib_select_multipath(const struct flowi *flp, struct fib_result *res)
 
 
         /* w should be random number [0..fi->fib_power-1],
-           it is pretty bad approximation.
+         * it is pretty bad approximation.
          */
 
         w = jiffies % fi->fib_power;
 
         change_nexthops(fi) {
-                if (!(nh->nh_flags&RTNH_F_DEAD) && nh->nh_power) {
-                        if ((w -= nh->nh_power) <= 0) {
-                                nh->nh_power--;
+                if (!(nexthop_nh->nh_flags & RTNH_F_DEAD) &&
+                    nexthop_nh->nh_power) {
+                        w -= nexthop_nh->nh_power;
+                        if (w <= 0) {
+                                nexthop_nh->nh_power--;
                                 fi->fib_power--;
                                 res->nh_sel = nhsel;
                                 spin_unlock_bh(&fib_multipath_lock);
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 012cf5a68581..0f280348e0fd 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -16,7 +16,7 @@
  *
  * An experimental study of compression methods for dynamic tries
  * Stefan Nilsson and Matti Tikkanen. Algorithmica, 33(1):19-33, 2002.
- * http://www.nada.kth.se/~snilsson/public/papers/dyntrie2/
+ * http://www.csc.kth.se/~snilsson/software/dyntrie2/
  *
  *
  * IP-address lookup using LC-tries. Stefan Nilsson and Gunnar Karlsson
@@ -48,7 +48,7 @@
  *              Patrick McHardy <kaber@trash.net>
  */
 
-#define VERSION "0.408"
+#define VERSION "0.409"
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -71,6 +71,7 @@
 #include <linux/netlink.h>
 #include <linux/init.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -164,6 +165,14 @@ static struct tnode *inflate(struct trie *t, struct tnode *tn);
 static struct tnode *halve(struct trie *t, struct tnode *tn);
 /* tnodes to free after resize(); protected by RTNL */
 static struct tnode *tnode_free_head;
+static size_t tnode_free_size;
+
+/*
+ * synchronize_rcu after call_rcu for that many pages; it should be especially
+ * useful before resizing the root node with PREEMPT_NONE configs; the value was
+ * obtained experimentally, aiming to avoid visible slowdown.
+ */
+static const int sync_pages = 128;
 
 static struct kmem_cache *fn_alias_kmem __read_mostly;
 static struct kmem_cache *trie_leaf_kmem __read_mostly;
@@ -177,7 +186,7 @@ static inline struct tnode *node_parent_rcu(struct node *node)
 {
         struct tnode *ret = node_parent(node);
 
-        return rcu_dereference(ret);
+        return rcu_dereference_rtnl(ret);
 }
 
 /* Same as rcu_assign_pointer
@@ -200,7 +209,7 @@ static inline struct node *tnode_get_child_rcu(struct tnode *tn, unsigned int i)
 {
         struct node *ret = tnode_get_child(tn, i);
 
-        return rcu_dereference(ret);
+        return rcu_dereference_rtnl(ret);
 }
 
 static inline int tnode_child_length(const struct tnode *tn)
@@ -316,9 +325,8 @@ static inline void check_tnode(const struct tnode *tn)
 
 static const int halve_threshold = 25;
 static const int inflate_threshold = 50;
-static const int halve_threshold_root = 8;
-static const int inflate_threshold_root = 15;
-
+static const int halve_threshold_root = 15;
+static const int inflate_threshold_root = 30;
 
 static void __alias_free_mem(struct rcu_head *head)
 {
@@ -357,7 +365,7 @@ static struct tnode *tnode_alloc(size_t size)
         if (size <= PAGE_SIZE)
                 return kzalloc(size, GFP_KERNEL);
         else
-                return __vmalloc(size, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL);
+                return vzalloc(size);
 }
 
 static void __tnode_vfree(struct work_struct *arg)
@@ -393,6 +401,8 @@ static void tnode_free_safe(struct tnode *tn)
         BUG_ON(IS_LEAF(tn));
         tn->tnode_free = tnode_free_head;
         tnode_free_head = tn;
+        tnode_free_size += sizeof(struct tnode) +
+                           (sizeof(struct node *) << tn->bits);
 }
 
 static void tnode_free_flush(void)
@@ -404,6 +414,11 @@ static void tnode_free_flush(void)
                 tn->tnode_free = NULL;
                 tnode_free(tn);
         }
+
+        if (tnode_free_size >= PAGE_SIZE * sync_pages) {
+                tnode_free_size = 0;
+                synchronize_rcu();
+        }
 }
 
 static struct leaf *leaf_new(void)
@@ -440,8 +455,8 @@ static struct tnode *tnode_new(t_key key, int pos, int bits)
                 tn->empty_children = 1<<bits;
         }
 
-        pr_debug("AT %p s=%u %lu\n", tn, (unsigned int) sizeof(struct tnode),
-                 (unsigned long) (sizeof(struct node) << bits));
+        pr_debug("AT %p s=%zu %zu\n", tn, sizeof(struct tnode),
+                 sizeof(struct node) << bits);
         return tn;
 }
 
@@ -499,14 +514,14 @@ static void tnode_put_child_reorg(struct tnode *tn, int i, struct node *n,
         rcu_assign_pointer(tn->child[i], n);
 }
 
+#define MAX_WORK 10
 static struct node *resize(struct trie *t, struct tnode *tn)
 {
         int i;
-        int err = 0;
         struct tnode *old_tn;
         int inflate_threshold_use;
         int halve_threshold_use;
-        int max_resize;
+        int max_work;
 
         if (!tn)
                 return NULL;
@@ -521,18 +536,7 @@ static struct node *resize(struct trie *t, struct tnode *tn)
         }
         /* One child */
         if (tn->empty_children == tnode_child_length(tn) - 1)
-                for (i = 0; i < tnode_child_length(tn); i++) {
-                        struct node *n;
-
-                        n = tn->child[i];
-                        if (!n)
-                                continue;
-
-                        /* compress one level */
-                        node_set_parent(n, NULL);
-                        tnode_free_safe(tn);
-                        return n;
-                }
+                goto one_child;
         /*
          * Double as long as the resulting node has a number of
          * nonempty nodes that are above the threshold.
@@ -601,14 +605,16 @@ static struct node *resize(struct trie *t, struct tnode *tn)
 
         /* Keep root node larger  */
 
-        if (!tn->parent)
+        if (!node_parent((struct node *)tn)) {
                 inflate_threshold_use = inflate_threshold_root;
-        else
+                halve_threshold_use = halve_threshold_root;
+        } else {
                 inflate_threshold_use = inflate_threshold;
+                halve_threshold_use = halve_threshold;
+        }
 
-        err = 0;
-        max_resize = 10;
-        while ((tn->full_children > 0 &&  max_resize-- &&
+        max_work = MAX_WORK;
+        while ((tn->full_children > 0 &&  max_work-- &&
                 50 * (tn->full_children + tnode_child_length(tn)
                       - tn->empty_children)
                 >= inflate_threshold_use * tnode_child_length(tn))) {
@@ -625,35 +631,19 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                 }
         }
 
-        if (max_resize < 0) {
-                if (!tn->parent)
-                        pr_warning("Fix inflate_threshold_root."
-                                   " Now=%d size=%d bits\n",
-                                   inflate_threshold_root, tn->bits);
-                else
-                        pr_warning("Fix inflate_threshold."
-                                   " Now=%d size=%d bits\n",
-                                   inflate_threshold, tn->bits);
-        }
-
         check_tnode(tn);
 
+        /* Return if at least one inflate is run */
+        if (max_work != MAX_WORK)
+                return (struct node *) tn;
+
         /*
          * Halve as long as the number of empty children in this
          * node is above threshold.
          */
 
-
-        /* Keep root node larger  */
-
-        if (!tn->parent)
-                halve_threshold_use = halve_threshold_root;
-        else
-                halve_threshold_use = halve_threshold;
-
-        err = 0;
-        max_resize = 10;
-        while (tn->bits > 1 &&  max_resize-- &&
+        max_work = MAX_WORK;
+        while (tn->bits > 1 &&  max_work-- &&
                100 * (tnode_child_length(tn) - tn->empty_children) <
                halve_threshold_use * tnode_child_length(tn)) {
 
@@ -668,19 +658,10 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                 }
         }
 
-        if (max_resize < 0) {
-                if (!tn->parent)
-                        pr_warning("Fix halve_threshold_root."
-                                   " Now=%d size=%d bits\n",
-                                   halve_threshold_root, tn->bits);
-                else
-                        pr_warning("Fix halve_threshold."
-                                   " Now=%d size=%d bits\n",
-                                   halve_threshold, tn->bits);
-        }
 
         /* Only one child remains */
-        if (tn->empty_children == tnode_child_length(tn) - 1)
+        if (tn->empty_children == tnode_child_length(tn) - 1) {
+one_child:
                 for (i = 0; i < tnode_child_length(tn); i++) {
                         struct node *n;
 
@@ -694,7 +675,7 @@ static struct node *resize(struct trie *t, struct tnode *tn)
                         tnode_free_safe(tn);
                         return n;
                 }
-
+        }
         return (struct node *) tn;
 }
 
@@ -980,7 +961,7 @@ fib_find_node(struct trie *t, u32 key)
         struct node *n;
 
         pos = 0;
-        n = rcu_dereference(t->trie);
+        n = rcu_dereference_rtnl(t->trie);
 
         while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
                 tn = (struct tnode *) n;
@@ -1021,6 +1002,9 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
                                       (struct node *)tn, wasfull);
 
                 tp = node_parent((struct node *) tn);
+                if (!tp)
+                        rcu_assign_pointer(t->trie, (struct node *)tn);
+
                 tnode_free_flush();
                 if (!tp)
                         break;
@@ -1033,8 +1017,6 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
 
         rcu_assign_pointer(t->trie, (struct node *)tn);
         tnode_free_flush();
-
-        return;
 }
 
 /* only used from updater-side */
@@ -1190,7 +1172,7 @@ done:
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct fib_alias *fa, *new_fa;
@@ -1360,7 +1342,7 @@ err:
 /* should be called with rcu_read_lock */
 static int check_leaf(struct trie *t, struct leaf *l,
                       t_key key,  const struct flowi *flp,
-                      struct fib_result *res)
+                      struct fib_result *res, int fib_flags)
 {
         struct leaf_info *li;
         struct hlist_head *hhead = &l->list;
@@ -1374,7 +1356,7 @@ static int check_leaf(struct trie *t, struct leaf *l,
                 if (l->key != (key & ntohl(mask)))
                         continue;
 
-                err = fib_semantic_match(&li->falh, flp, res, plen);
+                err = fib_semantic_match(&li->falh, flp, res, plen, fib_flags);
 
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                 if (err <= 0)
@@ -1389,8 +1371,8 @@ static int check_leaf(struct trie *t, struct leaf *l,
         return 1;
 }
 
-static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
-                          struct fib_result *res)
+int fib_table_lookup(struct fib_table *tb, const struct flowi *flp,
+                     struct fib_result *res, int fib_flags)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         int ret;
@@ -1402,8 +1384,7 @@ static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
         t_key cindex = 0;
         int current_prefix_length = KEYLENGTH;
         struct tnode *cn;
-        t_key node_prefix, key_prefix, pref_mismatch;
-        int mp;
+        t_key pref_mismatch;
 
         rcu_read_lock();
 
@@ -1417,7 +1398,7 @@ static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
 
         /* Just a leaf? */
         if (IS_LEAF(n)) {
-                ret = check_leaf(t, (struct leaf *)n, key, flp, res);
+                ret = check_leaf(t, (struct leaf *)n, key, flp, res, fib_flags);
                 goto found;
         }
 
@@ -1432,7 +1413,7 @@ static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
                         cindex = tkey_extract_bits(mask_pfx(key, current_prefix_length),
                                                    pos, bits);
 
-                n = tnode_get_child(pn, cindex);
+                n = tnode_get_child_rcu(pn, cindex);
 
                 if (n == NULL) {
 #ifdef CONFIG_IP_FIB_TRIE_STATS
@@ -1442,7 +1423,7 @@ static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
                 }
 
                 if (IS_LEAF(n)) {
-                        ret = check_leaf(t, (struct leaf *)n, key, flp, res);
+                        ret = check_leaf(t, (struct leaf *)n, key, flp, res, fib_flags);
                         if (ret > 0)
                                 goto backtrace;
                         goto found;
@@ -1518,10 +1499,7 @@ static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
                  * matching prefix.
                  */
 
-                node_prefix = mask_pfx(cn->key, cn->pos);
-                key_prefix = mask_pfx(key, cn->pos);
-                pref_mismatch = key_prefix^node_prefix;
-                mp = 0;
+                pref_mismatch = mask_pfx(cn->key ^ key, cn->pos);
 
                 /*
                  * In short: If skipped bits in this node do not match
@@ -1529,13 +1507,9 @@ static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
                  * state.directly.
                  */
                 if (pref_mismatch) {
-                        while (!(pref_mismatch & (1<<(KEYLENGTH-1)))) {
-                                mp++;
-                                pref_mismatch = pref_mismatch << 1;
-                        }
-                        key_prefix = tkey_extract_bits(cn->key, mp, cn->pos-mp);
+                        int mp = KEYLENGTH - fls(pref_mismatch);
 
-                        if (key_prefix != 0)
+                        if (tkey_extract_bits(cn->key, mp, cn->pos - mp) != 0)
                                 goto backtrace;
 
                         if (current_prefix_length >= cn->pos)
@@ -1567,7 +1541,7 @@ backtrace:
                 if (chopped_off <= pn->bits) {
                         cindex &= ~(1 << (chopped_off-1));
                 } else {
-                        struct tnode *parent = node_parent((struct node *) pn);
+                        struct tnode *parent = node_parent_rcu((struct node *) pn);
                         if (!parent)
                                 goto failed;
 
@@ -1611,7 +1585,7 @@ static void trie_leaf_remove(struct trie *t, struct leaf *l)
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         u32 key, mask;
@@ -1759,14 +1733,14 @@ static struct leaf *leaf_walk_rcu(struct tnode *p, struct node *c)
 
                 /* Node empty, walk back up to parent */
                 c = (struct node *) p;
-        } while ( (p = node_parent_rcu(c)) != NULL);
+        } while ((p = node_parent_rcu(c)) != NULL);
 
         return NULL; /* Root of trie */
 }
 
 static struct leaf *trie_firstleaf(struct trie *t)
 {
-        struct tnode *n = (struct tnode *) rcu_dereference(t->trie);
+        struct tnode *n = (struct tnode *)rcu_dereference_rtnl(t->trie);
 
         if (!n)
                 return NULL;
@@ -1780,7 +1754,7 @@ static struct leaf *trie_firstleaf(struct trie *t)
 static struct leaf *trie_nextleaf(struct leaf *l)
 {
         struct node *c = (struct node *) l;
-        struct tnode *p = node_parent(c);
+        struct tnode *p = node_parent_rcu(c);
 
         if (!p)
                 return NULL;    /* trie with just one leaf */
@@ -1802,7 +1776,7 @@ static struct leaf *trie_leafindex(struct trie *t, int index)
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_flush(struct fib_table *tb)
+int fib_table_flush(struct fib_table *tb)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct leaf *l, *ll = NULL;
@@ -1823,9 +1797,14 @@ static int fn_trie_flush(struct fib_table *tb)
         return found;
 }
 
-static void fn_trie_select_default(struct fib_table *tb,
-                                   const struct flowi *flp,
-                                   struct fib_result *res)
+void fib_free_table(struct fib_table *tb)
+{
+        kfree(tb);
+}
+
+void fib_table_select_default(struct fib_table *tb,
+                              const struct flowi *flp,
+                              struct fib_result *res)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         int order, last_idx;
@@ -1864,7 +1843,8 @@ static void fn_trie_select_default(struct fib_table *tb,
                 if (!next_fi->fib_nh[0].nh_gw ||
                     next_fi->fib_nh[0].nh_scope != RT_SCOPE_LINK)
                         continue;
-                fa->fa_state |= FA_S_ACCESSED;
+
+                fib_alias_accessed(fa);
 
                 if (fi == NULL) {
                         if (next_fi != res->fi)
@@ -1968,8 +1948,8 @@ static int fn_trie_dump_leaf(struct leaf *l, struct fib_table *tb,
         return skb->len;
 }
 
-static int fn_trie_dump(struct fib_table *tb, struct sk_buff *skb,
-                        struct netlink_callback *cb)
+int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
+                   struct netlink_callback *cb)
 {
         struct leaf *l;
         struct trie *t = (struct trie *) tb->tb_data;
@@ -2036,12 +2016,6 @@ struct fib_table *fib_hash_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
-        tb->tb_lookup = fn_trie_lookup;
-        tb->tb_insert = fn_trie_insert;
-        tb->tb_delete = fn_trie_delete;
-        tb->tb_flush = fn_trie_flush;
-        tb->tb_select_default = fn_trie_select_default;
-        tb->tb_dump = fn_trie_dump;
 
         t = (struct trie *) tb->tb_data;
         memset(t, 0, sizeof(*t));
@@ -2058,14 +2032,14 @@ struct fib_trie_iter {
         struct seq_net_private p;
         struct fib_table *tb;
         struct tnode *tnode;
-        unsigned index;
-        unsigned depth;
+        unsigned int index;
+        unsigned int depth;
 };
 
 static struct node *fib_trie_get_next(struct fib_trie_iter *iter)
 {
         struct tnode *tn = iter->tnode;
-        unsigned cindex = iter->index;
+        unsigned int cindex = iter->index;
         struct tnode *p;
 
         /* A single entry routing table */
@@ -2174,7 +2148,7 @@ static void trie_collect_stats(struct trie *t, struct trie_stat *s)
  */
 static void trie_show_stats(struct seq_file *seq, struct trie_stat *stat)
 {
-        unsigned i, max, pointers, bytes, avdepth;
+        unsigned int i, max, pointers, bytes, avdepth;
 
         if (stat->leaves)
                 avdepth = stat->totdepth*100 / stat->leaves;
@@ -2371,7 +2345,8 @@ static void fib_trie_seq_stop(struct seq_file *seq, void *v)
 
 static void seq_indent(struct seq_file *seq, int n)
 {
-        while (n-- > 0) seq_puts(seq, "   ");
+        while (n-- > 0)
+                seq_puts(seq, "   ");
 }
 
 static inline const char *rtn_scope(char *buf, size_t len, enum rt_scope_t s)
@@ -2388,7 +2363,7 @@ static inline const char *rtn_scope(char *buf, size_t len, enum rt_scope_t s)
         }
 }
 
-static const char *rtn_type_names[__RTN_MAX] = {
+static const char *const rtn_type_names[__RTN_MAX] = {
         [RTN_UNSPEC] = "UNSPEC",
         [RTN_UNICAST] = "UNICAST",
         [RTN_LOCAL] = "LOCAL",
@@ -2403,7 +2378,7 @@ static const char *rtn_type_names[__RTN_MAX] = {
         [RTN_XRESOLVE] = "XRESOLVE",
 };
 
-static inline const char *rtn_type(char *buf, size_t len, unsigned t)
+static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
 {
         if (t < __RTN_MAX && rtn_type_names[t])
                 return rtn_type_names[t];
@@ -2559,13 +2534,12 @@ static void fib_route_seq_stop(struct seq_file *seq, void *v)
         rcu_read_unlock();
 }
 
-static unsigned fib_flag_trans(int type, __be32 mask, const struct fib_info *fi)
+static unsigned int fib_flag_trans(int type, __be32 mask, const struct fib_info *fi)
 {
-        static unsigned type2flags[RTN_MAX + 1] = {
-                [7] = RTF_REJECT, [8] = RTF_REJECT,
-        };
-        unsigned flags = type2flags[type];
+        unsigned int flags = 0;
 
+        if (type == RTN_UNREACHABLE || type == RTN_PROHIBIT)
+                flags = RTF_REJECT;
         if (fi && fi->fib_nh->nh_gw)
                 flags |= RTF_GATEWAY;
         if (mask == htonl(0xFFFFFFFF))
@@ -2577,7 +2551,7 @@ static unsigned fib_flag_trans(int type, __be32 mask, const struct fib_info *fi)
 /*
  *      This outputs /proc/net/route.
  *      The format of the file is not supposed to be changed
- *      and needs to be same as fib_hash output to avoid breaking
+ *      and needs to be same as fib_hash output to avoid breaking
  *      legacy utilities
  */
 static int fib_route_seq_show(struct seq_file *seq, void *v)
@@ -2602,7 +2576,7 @@ static int fib_route_seq_show(struct seq_file *seq, void *v)
 
                 list_for_each_entry_rcu(fa, &li->falh, fa_list) {
                         const struct fib_info *fi = fa->fa_info;
-                        unsigned flags = fib_flag_trans(fa->fa_type, mask, fi);
+                        unsigned int flags = fib_flag_trans(fa->fa_type, mask, fi);
                         int len;
 
                         if (fa->fa_type == RTN_BROADCAST
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
new file mode 100644
index 000000000000..c6933f2ea310
--- /dev/null
+++ b/net/ipv4/gre.c
@@ -0,0 +1,152 @@
+/*
+ *      GRE over IPv4 demultiplexer driver
+ *
+ *      Authors: Dmitry Kozlov (xeb@mail.ru)
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/kmod.h>
+#include <linux/skbuff.h>
+#include <linux/in.h>
+#include <linux/netdevice.h>
+#include <linux/version.h>
+#include <linux/spinlock.h>
+#include <net/protocol.h>
+#include <net/gre.h>
+
+
+static const struct gre_protocol __rcu *gre_proto[GREPROTO_MAX] __read_mostly;
+static DEFINE_SPINLOCK(gre_proto_lock);
+
+int gre_add_protocol(const struct gre_protocol *proto, u8 version)
+{
+        if (version >= GREPROTO_MAX)
+                goto err_out;
+
+        spin_lock(&gre_proto_lock);
+        if (gre_proto[version])
+                goto err_out_unlock;
+
+        rcu_assign_pointer(gre_proto[version], proto);
+        spin_unlock(&gre_proto_lock);
+        return 0;
+
+err_out_unlock:
+        spin_unlock(&gre_proto_lock);
+err_out:
+        return -1;
+}
+EXPORT_SYMBOL_GPL(gre_add_protocol);
+
+int gre_del_protocol(const struct gre_protocol *proto, u8 version)
+{
+        if (version >= GREPROTO_MAX)
+                goto err_out;
+
+        spin_lock(&gre_proto_lock);
+        if (rcu_dereference_protected(gre_proto[version],
+                        lockdep_is_held(&gre_proto_lock)) != proto)
+                goto err_out_unlock;
+        rcu_assign_pointer(gre_proto[version], NULL);
+        spin_unlock(&gre_proto_lock);
+        synchronize_rcu();
+        return 0;
+
+err_out_unlock:
+        spin_unlock(&gre_proto_lock);
+err_out:
+        return -1;
+}
+EXPORT_SYMBOL_GPL(gre_del_protocol);
+
+static int gre_rcv(struct sk_buff *skb)
+{
+        const struct gre_protocol *proto;
+        u8 ver;
+        int ret;
+
+        if (!pskb_may_pull(skb, 12))
+                goto drop;
+
+        ver = skb->data[1]&0x7f;
+        if (ver >= GREPROTO_MAX)
+                goto drop;
+
+        rcu_read_lock();
+        proto = rcu_dereference(gre_proto[ver]);
+        if (!proto || !proto->handler)
+                goto drop_unlock;
+        ret = proto->handler(skb);
+        rcu_read_unlock();
+        return ret;
+
+drop_unlock:
+        rcu_read_unlock();
+drop:
+        kfree_skb(skb);
+        return NET_RX_DROP;
+}
+
+static void gre_err(struct sk_buff *skb, u32 info)
+{
+        const struct gre_protocol *proto;
+        u8 ver;
+
+        if (!pskb_may_pull(skb, 12))
+                goto drop;
+
+        ver = skb->data[1]&0x7f;
+        if (ver >= GREPROTO_MAX)
+                goto drop;
+
+        rcu_read_lock();
+        proto = rcu_dereference(gre_proto[ver]);
+        if (!proto || !proto->err_handler)
+                goto drop_unlock;
+        proto->err_handler(skb, info);
+        rcu_read_unlock();
+        return;
+
+drop_unlock:
+        rcu_read_unlock();
+drop:
+        kfree_skb(skb);
+}
+
+static const struct net_protocol net_gre_protocol = {
+        .handler     = gre_rcv,
+        .err_handler = gre_err,
+        .netns_ok    = 1,
+};
+
+static int __init gre_init(void)
+{
+        pr_info("GRE over IPv4 demultiplexor driver");
+
+        if (inet_add_protocol(&net_gre_protocol, IPPROTO_GRE) < 0) {
+                pr_err("gre: can't add protocol\n");
+                return -EAGAIN;
+        }
+
+        return 0;
+}
+
+static void __exit gre_exit(void)
+{
+        inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
+}
+
+module_init(gre_init);
+module_exit(gre_exit);
+
+MODULE_DESCRIPTION("GRE over IPv4 demultiplexer driver");
+MODULE_AUTHOR("D. Kozlov (xeb@mail.ru)");
+MODULE_LICENSE("GPL");
+
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 97c410e84388..4aa1b7f01ea0 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -74,6 +74,7 @@
 #include <linux/netdevice.h>
 #include <linux/string.h>
 #include <linux/netfilter_ipv4.h>
+#include <linux/slab.h>
 #include <net/snmp.h>
 #include <net/ip.h>
 #include <net/route.h>
@@ -114,7 +115,7 @@ struct icmp_bxm {
 /* An array of errno for error messages from dest unreach. */
 /* RFC 1122: 3.2.2.1 States that NET_UNREACH, HOST_UNREACH and SR_FAILED MUST be considered 'transient errs'. */
 
-struct icmp_err icmp_err_convert[] = {
+const struct icmp_err icmp_err_convert[] = {
         {
                 .errno = ENETUNREACH,   /* ICMP_NET_UNREACH */
                 .fatal = 0,
@@ -180,6 +181,7 @@ struct icmp_err icmp_err_convert[] = {
                 .fatal = 1,
         },
 };
+EXPORT_SYMBOL(icmp_err_convert);
 
 /*
  *      ICMP control array. This specifies what to do with each ICMP.
@@ -266,11 +268,12 @@ int xrlim_allow(struct dst_entry *dst, int timeout)
         dst->rate_tokens = token;
         return rc;
 }
+EXPORT_SYMBOL(xrlim_allow);
 
 static inline int icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
                 int type, int code)
 {
-        struct dst_entry *dst = &rt->u.dst;
+        struct dst_entry *dst = &rt->dst;
         int rc = 1;
 
         if (type > NR_ICMP_TYPES)
@@ -326,13 +329,14 @@ static void icmp_push_reply(struct icmp_bxm *icmp_param,
         struct sock *sk;
         struct sk_buff *skb;
 
-        sk = icmp_sk(dev_net((*rt)->u.dst.dev));
+        sk = icmp_sk(dev_net((*rt)->dst.dev));
         if (ip_append_data(sk, icmp_glue_bits, icmp_param,
                            icmp_param->data_len+icmp_param->head_len,
                            icmp_param->head_len,
-                           ipc, rt, MSG_DONTWAIT) < 0)
+                           ipc, rt, MSG_DONTWAIT) < 0) {
+                ICMP_INC_STATS_BH(sock_net(sk), ICMP_MIB_OUTERRORS);
                 ip_flush_pending_frames(sk);
-        else if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
+        } else if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
                 struct icmphdr *icmph = icmp_hdr(skb);
                 __wsum csum = 0;
                 struct sk_buff *skb1;
@@ -357,7 +361,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
 {
         struct ipcm_cookie ipc;
         struct rtable *rt = skb_rtable(skb);
-        struct net *net = dev_net(rt->u.dst.dev);
+        struct net *net = dev_net(rt->dst.dev);
         struct sock *sk;
         struct inet_sock *inet;
         __be32 daddr;
@@ -375,17 +379,16 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
         inet->tos = ip_hdr(skb)->tos;
         daddr = ipc.addr = rt->rt_src;
         ipc.opt = NULL;
-        ipc.shtx.flags = 0;
+        ipc.tx_flags = 0;
         if (icmp_param->replyopts.optlen) {
                 ipc.opt = &icmp_param->replyopts;
                 if (ipc.opt->srr)
                         daddr = icmp_param->replyopts.faddr;
         }
         {
-                struct flowi fl = { .nl_u = { .ip4_u =
-                                              { .daddr = daddr,
-                                                .saddr = rt->rt_spec_dst,
-                                                .tos = RT_TOS(ip_hdr(skb)->tos) } },
+                struct flowi fl = { .fl4_dst= daddr,
+                                    .fl4_src = rt->rt_spec_dst,
+                                    .fl4_tos = RT_TOS(ip_hdr(skb)->tos),
                                     .proto = IPPROTO_ICMP };
                 security_skb_classify_flow(skb, &fl);
                 if (ip_route_output_key(net, &rt, &fl))
@@ -425,7 +428,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
 
         if (!rt)
                 goto out;
-        net = dev_net(rt->u.dst.dev);
+        net = dev_net(rt->dst.dev);
 
         /*
          *      Find the original header. It is expected to be valid, of course.
@@ -501,15 +504,16 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         if (!(rt->rt_flags & RTCF_LOCAL)) {
                 struct net_device *dev = NULL;
 
-                if (rt->fl.iif &&
-                        net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
-                        dev = dev_get_by_index(net, rt->fl.iif);
+                rcu_read_lock();
+                if (rt_is_input_route(rt) &&
+                    net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
+                        dev = dev_get_by_index_rcu(net, rt->fl.iif);
 
-                if (dev) {
+                if (dev)
                         saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
-                        dev_put(dev);
-                } else
+                else
                         saddr = 0;
+                rcu_read_unlock();
         }
 
         tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
@@ -533,26 +537,17 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         inet_sk(sk)->tos = tos;
         ipc.addr = iph->saddr;
         ipc.opt = &icmp_param.replyopts;
-        ipc.shtx.flags = 0;
+        ipc.tx_flags = 0;
 
         {
                 struct flowi fl = {
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = icmp_param.replyopts.srr ?
-                                                icmp_param.replyopts.faddr :
-                                                iph->saddr,
-                                        .saddr = saddr,
-                                        .tos = RT_TOS(tos)
-                                }
-                        },
+                        .fl4_dst = icmp_param.replyopts.srr ?
+                                   icmp_param.replyopts.faddr : iph->saddr,
+                        .fl4_src = saddr,
+                        .fl4_tos = RT_TOS(tos),
                         .proto = IPPROTO_ICMP,
-                        .uli_u = {
-                                .icmpt = {
-                                        .type = type,
-                                        .code = code
-                                }
-                        }
+                        .fl_icmp_type = type,
+                        .fl_icmp_code = code,
                 };
                 int err;
                 struct rtable *rt2;
@@ -564,6 +559,9 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                 /* No need to clone since we're just using its address. */
                 rt2 = rt;
 
+                if (!fl.nl_u.ip4_u.saddr)
+                        fl.nl_u.ip4_u.saddr = rt->rt_src;
+
                 err = xfrm_lookup(net, (struct dst_entry **)&rt, &fl, NULL, 0);
                 switch (err) {
                 case 0:
@@ -584,20 +582,20 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                         err = __ip_route_output_key(net, &rt2, &fl);
                 else {
                         struct flowi fl2 = {};
-                        struct dst_entry *odst;
+                        unsigned long orefdst;
 
                         fl2.fl4_dst = fl.fl4_src;
                         if (ip_route_output_key(net, &rt2, &fl2))
                                 goto relookup_failed;
 
                         /* Ugh! */
-                        odst = skb_dst(skb_in);
+                        orefdst = skb_in->_skb_refdst; /* save old refdst */
                         err = ip_route_input(skb_in, fl.fl4_dst, fl.fl4_src,
-                                             RT_TOS(tos), rt2->u.dst.dev);
+                                             RT_TOS(tos), rt2->dst.dev);
 
-                        dst_release(&rt2->u.dst);
+                        dst_release(&rt2->dst);
                         rt2 = skb_rtable(skb_in);
-                        skb_dst_set(skb_in, odst);
+                        skb_in->_skb_refdst = orefdst; /* restore old refdst */
                 }
 
                 if (err)
@@ -607,7 +605,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
                                   XFRM_LOOKUP_ICMP);
                 switch (err) {
                 case 0:
-                        dst_release(&rt->u.dst);
+                        dst_release(&rt->dst);
                         rt = rt2;
                         break;
                 case -EPERM:
@@ -626,7 +624,7 @@ route_done:
 
         /* RFC says return as much as we can without exceeding 576 bytes. */
 
-        room = dst_mtu(&rt->u.dst);
+        room = dst_mtu(&rt->dst);
         if (room > 576)
                 room = 576;
         room -= sizeof(struct iphdr) + icmp_param.replyopts.optlen;
@@ -644,6 +642,7 @@ out_unlock:
         icmp_xmit_unlock(sk);
 out:;
 }
+EXPORT_SYMBOL(icmp_send);
 
 
 /*
@@ -655,7 +654,7 @@ static void icmp_unreach(struct sk_buff *skb)
         struct iphdr *iph;
         struct icmphdr *icmph;
         int hash, protocol;
-        struct net_protocol *ipprot;
+        const struct net_protocol *ipprot;
         u32 info = 0;
         struct net *net;
 
@@ -922,6 +921,7 @@ static void icmp_address(struct sk_buff *skb)
 /*
  * RFC1812 (4.3.3.9).   A router SHOULD listen all replies, and complain
  *                      loudly if an inconsistency is found.
+ * called with rcu_read_lock()
  */
 
 static void icmp_address_reply(struct sk_buff *skb)
@@ -932,12 +932,12 @@ static void icmp_address_reply(struct sk_buff *skb)
         struct in_ifaddr *ifa;
 
         if (skb->len < 4 || !(rt->rt_flags&RTCF_DIRECTSRC))
-                goto out;
+                return;
 
-        in_dev = in_dev_get(dev);
+        in_dev = __in_dev_get_rcu(dev);
         if (!in_dev)
-                goto out;
-        rcu_read_lock();
+                return;
+
         if (in_dev->ifa_list &&
             IN_DEV_LOG_MARTIANS(in_dev) &&
             IN_DEV_FORWARD(in_dev)) {
@@ -955,9 +955,6 @@ static void icmp_address_reply(struct sk_buff *skb)
                                mp, dev->name, &rt->rt_src);
                 }
         }
-        rcu_read_unlock();
-        in_dev_put(in_dev);
-out:;
 }
 
 static void icmp_discard(struct sk_buff *skb)
@@ -971,7 +968,7 @@ int icmp_rcv(struct sk_buff *skb)
 {
         struct icmphdr *icmph;
         struct rtable *rt = skb_rtable(skb);
-        struct net *net = dev_net(rt->u.dst.dev);
+        struct net *net = dev_net(rt->dst.dev);
 
         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                 struct sec_path *sp = skb_sec_path(skb);
@@ -1165,6 +1162,10 @@ static int __net_init icmp_sk_init(struct net *net)
                 sk->sk_sndbuf =
                         (2 * ((64 * 1024) + sizeof(struct sk_buff)));
 
+                /*
+                 * Speedup sock_wfree()
+                 */
+                sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
                 inet_sk(sk)->pmtudisc = IP_PMTUDISC_DONT;
         }
 
@@ -1209,7 +1210,3 @@ int __init icmp_init(void)
 {
         return register_pernet_subsys(&icmp_sk_ops);
 }
-
-EXPORT_SYMBOL(icmp_err_convert);
-EXPORT_SYMBOL(icmp_send);
-EXPORT_SYMBOL(xrlim_allow);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 01b4284ed694..e0e77e297de3 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -71,6 +71,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 #include <linux/types.h>
@@ -148,21 +149,37 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc);
 static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                          int sfcount, __be32 *psfsrc, int delta);
 
+
+static void ip_mc_list_reclaim(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ip_mc_list, rcu));
+}
+
 static void ip_ma_put(struct ip_mc_list *im)
 {
         if (atomic_dec_and_test(&im->refcnt)) {
                 in_dev_put(im->interface);
-                kfree(im);
+                call_rcu(&im->rcu, ip_mc_list_reclaim);
         }
 }
 
+#define for_each_pmc_rcu(in_dev, pmc)                           \
+        for (pmc = rcu_dereference(in_dev->mc_list);            \
+             pmc != NULL;                                       \
+             pmc = rcu_dereference(pmc->next_rcu))
+
+#define for_each_pmc_rtnl(in_dev, pmc)                          \
+        for (pmc = rtnl_dereference(in_dev->mc_list);           \
+             pmc != NULL;                                       \
+             pmc = rtnl_dereference(pmc->next_rcu))
+
 #ifdef CONFIG_IP_MULTICAST
 
 /*
  *      Timer management
  */
 
-static __inline__ void igmp_stop_timer(struct ip_mc_list *im)
+static void igmp_stop_timer(struct ip_mc_list *im)
 {
         spin_lock_bh(&im->lock);
         if (del_timer(&im->timer))
@@ -283,6 +300,8 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
         return scount;
 }
 
+#define igmp_skb_size(skb) (*(unsigned int *)((skb)->cb))
+
 static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
 {
         struct sk_buff *skb;
@@ -291,14 +310,20 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         struct igmpv3_report *pig;
         struct net *net = dev_net(dev);
 
-        skb = alloc_skb(size + LL_ALLOCATED_SPACE(dev), GFP_ATOMIC);
-        if (skb == NULL)
-                return NULL;
+        while (1) {
+                skb = alloc_skb(size + LL_ALLOCATED_SPACE(dev),
+                                GFP_ATOMIC | __GFP_NOWARN);
+                if (skb)
+                        break;
+                size >>= 1;
+                if (size < 256)
+                        return NULL;
+        }
+        igmp_skb_size(skb) = size;
 
         {
                 struct flowi fl = { .oif = dev->ifindex,
-                                    .nl_u = { .ip4_u = {
-                                    .daddr = IGMPV3_ALL_MCR } },
+                                    .fl4_dst = IGMPV3_ALL_MCR,
                                     .proto = IPPROTO_IGMP };
                 if (ip_route_output_key(net, &rt, &fl)) {
                         kfree_skb(skb);
@@ -311,7 +336,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
                 return NULL;
         }
 
-        skb_dst_set(skb, &rt->u.dst);
+        skb_dst_set(skb, &rt->dst);
         skb->dev = dev;
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
@@ -329,7 +354,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
         pip->saddr    = rt->rt_src;
         pip->protocol = IPPROTO_IGMP;
         pip->tot_len  = 0;      /* filled in later */
-        ip_select_ident(pip, &rt->u.dst, NULL);
+        ip_select_ident(pip, &rt->dst, NULL);
         ((u8*)&pip[1])[0] = IPOPT_RA;
         ((u8*)&pip[1])[1] = 4;
         ((u8*)&pip[1])[2] = 0;
@@ -383,7 +408,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc,
         return skb;
 }
 
-#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? (skb)->dev->mtu - (skb)->len : \
+#define AVAILABLE(skb) ((skb) ? ((skb)->dev ? igmp_skb_size(skb) - (skb)->len : \
         skb_tailroom(skb)) : 0)
 
 static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
@@ -501,8 +526,8 @@ static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
         int type;
 
         if (!pmc) {
-                read_lock(&in_dev->mc_list_lock);
-                for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
+                rcu_read_lock();
+                for_each_pmc_rcu(in_dev, pmc) {
                         if (pmc->multiaddr == IGMP_ALL_HOSTS)
                                 continue;
                         spin_lock_bh(&pmc->lock);
@@ -513,7 +538,7 @@ static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)
                         skb = add_grec(skb, pmc, type, 0, 0);
                         spin_unlock_bh(&pmc->lock);
                 }
-                read_unlock(&in_dev->mc_list_lock);
+                rcu_read_unlock();
         } else {
                 spin_lock_bh(&pmc->lock);
                 if (pmc->sfcount[MCAST_EXCLUDE])
@@ -555,7 +580,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
         struct sk_buff *skb = NULL;
         int type, dtype;
 
-        read_lock(&in_dev->mc_list_lock);
+        rcu_read_lock();
         spin_lock_bh(&in_dev->mc_tomb_lock);
 
         /* deleted MCA's */
@@ -592,7 +617,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
         spin_unlock_bh(&in_dev->mc_tomb_lock);
 
         /* change recs */
-        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rcu(in_dev, pmc) {
                 spin_lock_bh(&pmc->lock);
                 if (pmc->sfcount[MCAST_EXCLUDE]) {
                         type = IGMPV3_BLOCK_OLD_SOURCES;
@@ -615,7 +640,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
                 }
                 spin_unlock_bh(&pmc->lock);
         }
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 
         if (!skb)
                 return;
@@ -643,7 +668,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
 
         {
                 struct flowi fl = { .oif = dev->ifindex,
-                                    .nl_u = { .ip4_u = { .daddr = dst } },
+                                    .fl4_dst = dst,
                                     .proto = IPPROTO_IGMP };
                 if (ip_route_output_key(net, &rt, &fl))
                         return -1;
@@ -659,7 +684,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
                 return -1;
         }
 
-        skb_dst_set(skb, &rt->u.dst);
+        skb_dst_set(skb, &rt->dst);
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
 
@@ -675,7 +700,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
         iph->daddr    = dst;
         iph->saddr    = rt->rt_src;
         iph->protocol = IPPROTO_IGMP;
-        ip_select_ident(iph, &rt->u.dst, NULL);
+        ip_select_ident(iph, &rt->dst, NULL);
         ((u8*)&iph[1])[0] = IPOPT_RA;
         ((u8*)&iph[1])[1] = 4;
         ((u8*)&iph[1])[2] = 0;
@@ -812,14 +837,14 @@ static void igmp_heard_report(struct in_device *in_dev, __be32 group)
         if (group == IGMP_ALL_HOSTS)
                 return;
 
-        read_lock(&in_dev->mc_list_lock);
-        for (im=in_dev->mc_list; im!=NULL; im=im->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, im) {
                 if (im->multiaddr == group) {
                         igmp_stop_timer(im);
                         break;
                 }
         }
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 }
 
 static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
@@ -855,6 +880,18 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                 igmpv3_clear_delrec(in_dev);
         } else if (len < 12) {
                 return; /* ignore bogus packet; freed by caller */
+        } else if (IGMP_V1_SEEN(in_dev)) {
+                /* This is a v3 query with v1 queriers present */
+                max_delay = IGMP_Query_Response_Interval;
+                group = 0;
+        } else if (IGMP_V2_SEEN(in_dev)) {
+                /* this is a v3 query with v2 queriers present;
+                 * Interpretation of the max_delay code is problematic here.
+                 * A real v2 host would use ih_code directly, while v3 has a
+                 * different encoding. We use the v3 encoding as more likely
+                 * to be intended in a v3 query.
+                 */
+                max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
         } else { /* v3 */
                 if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
                         return;
@@ -893,8 +930,8 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
          * - Use the igmp->igmp_code field as the maximum
          *   delay possible
          */
-        read_lock(&in_dev->mc_list_lock);
-        for (im=in_dev->mc_list; im!=NULL; im=im->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, im) {
                 int changed;
 
                 if (group && group != im->multiaddr)
@@ -912,21 +949,22 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                 if (changed)
                         igmp_mod_timer(im, max_delay);
         }
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 }
 
+/* called in rcu_read_lock() section */
 int igmp_rcv(struct sk_buff *skb)
 {
         /* This basically follows the spec line by line -- see RFC1112 */
         struct igmphdr *ih;
-        struct in_device *in_dev = in_dev_get(skb->dev);
+        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
         int len = skb->len;
 
         if (in_dev == NULL)
                 goto drop;
 
         if (!pskb_may_pull(skb, sizeof(struct igmphdr)))
-                goto drop_ref;
+                goto drop;
 
         switch (skb->ip_summed) {
         case CHECKSUM_COMPLETE:
@@ -936,7 +974,7 @@ int igmp_rcv(struct sk_buff *skb)
         case CHECKSUM_NONE:
                 skb->csum = 0;
                 if (__skb_checksum_complete(skb))
-                        goto drop_ref;
+                        goto drop;
         }
 
         ih = igmp_hdr(skb);
@@ -946,9 +984,8 @@ int igmp_rcv(struct sk_buff *skb)
                 break;
         case IGMP_HOST_MEMBERSHIP_REPORT:
         case IGMPV2_HOST_MEMBERSHIP_REPORT:
-        case IGMPV3_HOST_MEMBERSHIP_REPORT:
                 /* Is it our report looped back? */
-                if (skb_rtable(skb)->fl.iif == 0)
+                if (rt_is_output_route(skb_rtable(skb)))
                         break;
                 /* don't rely on MC router hearing unicast reports */
                 if (skb->pkt_type == PACKET_MULTICAST ||
@@ -957,9 +994,9 @@ int igmp_rcv(struct sk_buff *skb)
                 break;
         case IGMP_PIM:
 #ifdef CONFIG_IP_PIMSM_V1
-                in_dev_put(in_dev);
                 return pim_rcv_v1(skb);
 #endif
+        case IGMPV3_HOST_MEMBERSHIP_REPORT:
         case IGMP_DVMRP:
         case IGMP_TRACE:
         case IGMP_HOST_LEAVE_MESSAGE:
@@ -970,8 +1007,6 @@ int igmp_rcv(struct sk_buff *skb)
                 break;
         }
 
-drop_ref:
-        in_dev_put(in_dev);
 drop:
         kfree_skb(skb);
         return 0;
@@ -997,7 +1032,7 @@ static void ip_mc_filter_add(struct in_device *in_dev, __be32 addr)
            --ANK
            */
         if (arp_mc_map(addr, buf, dev, 0) == 0)
-                dev_mc_add(dev, buf, dev->addr_len, 0);
+                dev_mc_add(dev, buf);
 }
 
 /*
@@ -1010,7 +1045,7 @@ static void ip_mc_filter_del(struct in_device *in_dev, __be32 addr)
         struct net_device *dev = in_dev->dev;
 
         if (arp_mc_map(addr, buf, dev, 0) == 0)
-                dev_mc_delete(dev, buf, dev->addr_len, 0);
+                dev_mc_del(dev, buf);
 }
 
 #ifdef CONFIG_IP_MULTICAST
@@ -1099,8 +1134,8 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
                 kfree(pmc);
         }
         /* clear dead sources, too */
-        read_lock(&in_dev->mc_list_lock);
-        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, pmc) {
                 struct ip_sf_list *psf, *psf_next;
 
                 spin_lock_bh(&pmc->lock);
@@ -1112,7 +1147,7 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
                         kfree(psf);
                 }
         }
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 }
 #endif
 
@@ -1198,7 +1233,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 
         ASSERT_RTNL();
 
-        for (im=in_dev->mc_list; im; im=im->next) {
+        for_each_pmc_rtnl(in_dev, im) {
                 if (im->multiaddr == addr) {
                         im->users++;
                         ip_mc_add_src(in_dev, &addr, MCAST_EXCLUDE, 0, NULL, 0);
@@ -1206,7 +1241,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
                 }
         }
 
-        im = kmalloc(sizeof(*im), GFP_KERNEL);
+        im = kzalloc(sizeof(*im), GFP_KERNEL);
         if (!im)
                 goto out;
 
@@ -1216,26 +1251,18 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
         im->multiaddr = addr;
         /* initial mode is (EX, empty) */
         im->sfmode = MCAST_EXCLUDE;
-        im->sfcount[MCAST_INCLUDE] = 0;
         im->sfcount[MCAST_EXCLUDE] = 1;
-        im->sources = NULL;
-        im->tomb = NULL;
-        im->crcount = 0;
         atomic_set(&im->refcnt, 1);
         spin_lock_init(&im->lock);
 #ifdef CONFIG_IP_MULTICAST
-        im->tm_running = 0;
         setup_timer(&im->timer, &igmp_timer_expire, (unsigned long)im);
         im->unsolicit_count = IGMP_Unsolicited_Report_Count;
-        im->reporter = 0;
-        im->gsquery = 0;
 #endif
-        im->loaded = 0;
-        write_lock_bh(&in_dev->mc_list_lock);
-        im->next = in_dev->mc_list;
-        in_dev->mc_list = im;
+
+        im->next_rcu = in_dev->mc_list;
         in_dev->mc_count++;
-        write_unlock_bh(&in_dev->mc_list_lock);
+        rcu_assign_pointer(in_dev->mc_list, im);
+
 #ifdef CONFIG_IP_MULTICAST
         igmpv3_del_delrec(in_dev, im->multiaddr);
 #endif
@@ -1245,28 +1272,36 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
 out:
         return;
 }
+EXPORT_SYMBOL(ip_mc_inc_group);
 
 /*
  *      Resend IGMP JOIN report; used for bonding.
+ *      Called with rcu_read_lock()
  */
-void ip_mc_rejoin_group(struct ip_mc_list *im)
+void ip_mc_rejoin_groups(struct in_device *in_dev)
 {
 #ifdef CONFIG_IP_MULTICAST
-        struct in_device *in_dev = im->interface;
+        struct ip_mc_list *im;
+        int type;
 
-        if (im->multiaddr == IGMP_ALL_HOSTS)
-                return;
+        for_each_pmc_rcu(in_dev, im) {
+                if (im->multiaddr == IGMP_ALL_HOSTS)
+                        continue;
 
-        if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev)) {
-                igmp_mod_timer(im, IGMP_Initial_Report_Delay);
-                return;
+                /* a failover is happening and switches
+                 * must be notified immediately
+                 */
+                if (IGMP_V1_SEEN(in_dev))
+                        type = IGMP_HOST_MEMBERSHIP_REPORT;
+                else if (IGMP_V2_SEEN(in_dev))
+                        type = IGMPV2_HOST_MEMBERSHIP_REPORT;
+                else
+                        type = IGMPV3_HOST_MEMBERSHIP_REPORT;
+                igmp_send_report(in_dev, im, type);
         }
-        /* else, v3 */
-        im->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
-                IGMP_Unsolicited_Report_Count;
-        igmp_ifc_event(in_dev);
 #endif
 }
+EXPORT_SYMBOL(ip_mc_rejoin_groups);
 
 /*
  *      A socket has left a multicast group on device dev
@@ -1274,17 +1309,18 @@ void ip_mc_rejoin_group(struct ip_mc_list *im)
 
 void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
 {
-        struct ip_mc_list *i, **ip;
+        struct ip_mc_list *i;
+        struct ip_mc_list __rcu **ip;
 
         ASSERT_RTNL();
 
-        for (ip=&in_dev->mc_list; (i=*ip)!=NULL; ip=&i->next) {
+        for (ip = &in_dev->mc_list;
+             (i = rtnl_dereference(*ip)) != NULL;
+             ip = &i->next_rcu) {
                 if (i->multiaddr == addr) {
                         if (--i->users == 0) {
-                                write_lock_bh(&in_dev->mc_list_lock);
-                                *ip = i->next;
+                                *ip = i->next_rcu;
                                 in_dev->mc_count--;
-                                write_unlock_bh(&in_dev->mc_list_lock);
                                 igmp_group_dropped(i);
 
                                 if (!in_dev->dead)
@@ -1297,17 +1333,40 @@ void ip_mc_dec_group(struct in_device *in_dev, __be32 addr)
                 }
         }
 }
+EXPORT_SYMBOL(ip_mc_dec_group);
+
+/* Device changing type */
+
+void ip_mc_unmap(struct in_device *in_dev)
+{
+        struct ip_mc_list *pmc;
+
+        ASSERT_RTNL();
+
+        for_each_pmc_rtnl(in_dev, pmc)
+                igmp_group_dropped(pmc);
+}
+
+void ip_mc_remap(struct in_device *in_dev)
+{
+        struct ip_mc_list *pmc;
+
+        ASSERT_RTNL();
+
+        for_each_pmc_rtnl(in_dev, pmc)
+                igmp_group_added(pmc);
+}
 
 /* Device going down */
 
 void ip_mc_down(struct in_device *in_dev)
 {
-        struct ip_mc_list *i;
+        struct ip_mc_list *pmc;
 
         ASSERT_RTNL();
 
-        for (i=in_dev->mc_list; i; i=i->next)
-                igmp_group_dropped(i);
+        for_each_pmc_rtnl(in_dev, pmc)
+                igmp_group_dropped(pmc);
 
 #ifdef CONFIG_IP_MULTICAST
         in_dev->mr_ifc_count = 0;
@@ -1338,7 +1397,6 @@ void ip_mc_init_dev(struct in_device *in_dev)
         in_dev->mr_qrv = IGMP_Unsolicited_Report_Count;
 #endif
 
-        rwlock_init(&in_dev->mc_list_lock);
         spin_lock_init(&in_dev->mc_tomb_lock);
 }
 
@@ -1346,14 +1404,14 @@ void ip_mc_init_dev(struct in_device *in_dev)
 
 void ip_mc_up(struct in_device *in_dev)
 {
-        struct ip_mc_list *i;
+        struct ip_mc_list *pmc;
 
         ASSERT_RTNL();
 
         ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
 
-        for (i=in_dev->mc_list; i; i=i->next)
-                igmp_group_added(i);
+        for_each_pmc_rtnl(in_dev, pmc)
+                igmp_group_added(pmc);
 }
 
 /*
@@ -1369,42 +1427,35 @@ void ip_mc_destroy_dev(struct in_device *in_dev)
         /* Deactivate timers */
         ip_mc_down(in_dev);
 
-        write_lock_bh(&in_dev->mc_list_lock);
-        while ((i = in_dev->mc_list) != NULL) {
-                in_dev->mc_list = i->next;
+        while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) {
+                in_dev->mc_list = i->next_rcu;
                 in_dev->mc_count--;
-                write_unlock_bh(&in_dev->mc_list_lock);
+
                 igmp_group_dropped(i);
                 ip_ma_put(i);
-
-                write_lock_bh(&in_dev->mc_list_lock);
         }
-        write_unlock_bh(&in_dev->mc_list_lock);
 }
 
+/* RTNL is locked */
 static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
 {
-        struct flowi fl = { .nl_u = { .ip4_u =
-                                      { .daddr = imr->imr_multiaddr.s_addr } } };
+        struct flowi fl = { .fl4_dst = imr->imr_multiaddr.s_addr };
         struct rtable *rt;
         struct net_device *dev = NULL;
         struct in_device *idev = NULL;
 
         if (imr->imr_ifindex) {
                 idev = inetdev_by_index(net, imr->imr_ifindex);
-                if (idev)
-                        __in_dev_put(idev);
                 return idev;
         }
         if (imr->imr_address.s_addr) {
-                dev = ip_dev_find(net, imr->imr_address.s_addr);
+                dev = __ip_dev_find(net, imr->imr_address.s_addr, false);
                 if (!dev)
                         return NULL;
-                dev_put(dev);
         }
 
         if (!dev && !ip_route_output_key(net, &rt, &fl)) {
-                dev = rt->u.dst.dev;
+                dev = rt->dst.dev;
                 ip_rt_put(rt);
         }
         if (dev) {
@@ -1479,18 +1530,18 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 
         if (!in_dev)
                 return -ENODEV;
-        read_lock(&in_dev->mc_list_lock);
-        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, pmc) {
                 if (*pmca == pmc->multiaddr)
                         break;
         }
         if (!pmc) {
                 /* MCA not found?? bug */
-                read_unlock(&in_dev->mc_list_lock);
+                rcu_read_unlock();
                 return -ESRCH;
         }
         spin_lock_bh(&pmc->lock);
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 #ifdef CONFIG_IP_MULTICAST
         sf_markstate(pmc);
 #endif
@@ -1623,8 +1674,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                                 if (dpsf->sf_inaddr == psf->sf_inaddr)
                                         break;
                         if (!dpsf) {
-                                dpsf = (struct ip_sf_list *)
-                                        kmalloc(sizeof(*dpsf), GFP_ATOMIC);
+                                dpsf = kmalloc(sizeof(*dpsf), GFP_ATOMIC);
                                 if (!dpsf)
                                         continue;
                                 *dpsf = *psf;
@@ -1652,18 +1702,18 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 
         if (!in_dev)
                 return -ENODEV;
-        read_lock(&in_dev->mc_list_lock);
-        for (pmc=in_dev->mc_list; pmc; pmc=pmc->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, pmc) {
                 if (*pmca == pmc->multiaddr)
                         break;
         }
         if (!pmc) {
                 /* MCA not found?? bug */
-                read_unlock(&in_dev->mc_list_lock);
+                rcu_read_unlock();
                 return -ESRCH;
         }
         spin_lock_bh(&pmc->lock);
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
 
 #ifdef CONFIG_IP_MULTICAST
         sf_markstate(pmc);
@@ -1760,7 +1810,7 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
 
         err = -EADDRINUSE;
         ifindex = imr->imr_ifindex;
-        for (i = inet->mc_list; i; i = i->next) {
+        for_each_pmc_rtnl(inet, i) {
                 if (i->multi.imr_multiaddr.s_addr == addr &&
                     i->multi.imr_ifindex == ifindex)
                         goto done;
@@ -1774,35 +1824,52 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
                 goto done;
 
         memcpy(&iml->multi, imr, sizeof(*imr));
-        iml->next = inet->mc_list;
+        iml->next_rcu = inet->mc_list;
         iml->sflist = NULL;
         iml->sfmode = MCAST_EXCLUDE;
-        inet->mc_list = iml;
+        rcu_assign_pointer(inet->mc_list, iml);
         ip_mc_inc_group(in_dev, addr);
         err = 0;
 done:
         rtnl_unlock();
         return err;
 }
+EXPORT_SYMBOL(ip_mc_join_group);
+
+static void ip_sf_socklist_reclaim(struct rcu_head *rp)
+{
+        kfree(container_of(rp, struct ip_sf_socklist, rcu));
+        /* sk_omem_alloc should have been decreased by the caller*/
+}
 
 static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
                            struct in_device *in_dev)
 {
+        struct ip_sf_socklist *psf = rtnl_dereference(iml->sflist);
         int err;
 
-        if (iml->sflist == NULL) {
+        if (psf == NULL) {
                 /* any-source empty exclude case */
                 return ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
                         iml->sfmode, 0, NULL, 0);
         }
         err = ip_mc_del_src(in_dev, &iml->multi.imr_multiaddr.s_addr,
-                        iml->sfmode, iml->sflist->sl_count,
-                        iml->sflist->sl_addr, 0);
-        sock_kfree_s(sk, iml->sflist, IP_SFLSIZE(iml->sflist->sl_max));
-        iml->sflist = NULL;
+                        iml->sfmode, psf->sl_count, psf->sl_addr, 0);
+        rcu_assign_pointer(iml->sflist, NULL);
+        /* decrease mem now to avoid the memleak warning */
+        atomic_sub(IP_SFLSIZE(psf->sl_max), &sk->sk_omem_alloc);
+        call_rcu(&psf->rcu, ip_sf_socklist_reclaim);
         return err;
 }
 
+
+static void ip_mc_socklist_reclaim(struct rcu_head *rp)
+{
+        kfree(container_of(rp, struct ip_mc_socklist, rcu));
+        /* sk_omem_alloc should have been decreased by the caller*/
+}
+
+
 /*
  *      Ask a socket to leave a group.
  */
@@ -1810,7 +1877,8 @@ static int ip_mc_leave_src(struct sock *sk, struct ip_mc_socklist *iml,
 int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
 {
         struct inet_sock *inet = inet_sk(sk);
-        struct ip_mc_socklist *iml, **imlp;
+        struct ip_mc_socklist *iml;
+        struct ip_mc_socklist __rcu **imlp;
         struct in_device *in_dev;
         struct net *net = sock_net(sk);
         __be32 group = imr->imr_multiaddr.s_addr;
@@ -1820,7 +1888,9 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
         rtnl_lock();
         in_dev = ip_mc_find_dev(net, imr);
         ifindex = imr->imr_ifindex;
-        for (imlp = &inet->mc_list; (iml = *imlp) != NULL; imlp = &iml->next) {
+        for (imlp = &inet->mc_list;
+             (iml = rtnl_dereference(*imlp)) != NULL;
+             imlp = &iml->next_rcu) {
                 if (iml->multi.imr_multiaddr.s_addr != group)
                         continue;
                 if (ifindex) {
@@ -1832,12 +1902,14 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
 
                 (void) ip_mc_leave_src(sk, iml, in_dev);
 
-                *imlp = iml->next;
+                *imlp = iml->next_rcu;
 
                 if (in_dev)
                         ip_mc_dec_group(in_dev, group);
                 rtnl_unlock();
-                sock_kfree_s(sk, iml, sizeof(*iml));
+                /* decrease mem now to avoid the memleak warning */
+                atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
+                call_rcu(&iml->rcu, ip_mc_socklist_reclaim);
                 return 0;
         }
         if (!in_dev)
@@ -1876,9 +1948,10 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         }
         err = -EADDRNOTAVAIL;
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
-                if (pmc->multi.imr_multiaddr.s_addr == imr.imr_multiaddr.s_addr
-                    && pmc->multi.imr_ifindex == imr.imr_ifindex)
+        for_each_pmc_rtnl(inet, pmc) {
+                if ((pmc->multi.imr_multiaddr.s_addr ==
+                     imr.imr_multiaddr.s_addr) &&
+                    (pmc->multi.imr_ifindex == imr.imr_ifindex))
                         break;
         }
         if (!pmc) {             /* must have a prior join */
@@ -1899,7 +1972,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 pmc->sfmode = omode;
         }
 
-        psl = pmc->sflist;
+        psl = rtnl_dereference(pmc->sflist);
         if (!add) {
                 if (!psl)
                         goto done;      /* err = -EADDRNOTAVAIL */
@@ -1951,9 +2024,12 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 if (psl) {
                         for (i=0; i<psl->sl_count; i++)
                                 newpsl->sl_addr[i] = psl->sl_addr[i];
-                        sock_kfree_s(sk, psl, IP_SFLSIZE(psl->sl_max));
+                        /* decrease mem now to avoid the memleak warning */
+                        atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+                        call_rcu(&psl->rcu, ip_sf_socklist_reclaim);
                 }
-                pmc->sflist = psl = newpsl;
+                rcu_assign_pointer(pmc->sflist, newpsl);
+                psl = newpsl;
         }
         rv = 1; /* > 0 for insert logic below if sl_count is 0 */
         for (i=0; i<psl->sl_count; i++) {
@@ -2015,7 +2091,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                 goto done;
         }
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rtnl(inet, pmc) {
                 if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
                     pmc->multi.imr_ifindex == imr.imr_ifindex)
                         break;
@@ -2045,15 +2121,17 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
                 (void) ip_mc_add_src(in_dev, &msf->imsf_multiaddr,
                                      msf->imsf_fmode, 0, NULL, 0);
         }
-        psl = pmc->sflist;
+        psl = rtnl_dereference(pmc->sflist);
         if (psl) {
                 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
                         psl->sl_count, psl->sl_addr, 0);
-                sock_kfree_s(sk, psl, IP_SFLSIZE(psl->sl_max));
+                /* decrease mem now to avoid the memleak warning */
+                atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+                call_rcu(&psl->rcu, ip_sf_socklist_reclaim);
         } else
                 (void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
                         0, NULL, 0);
-        pmc->sflist = newpsl;
+        rcu_assign_pointer(pmc->sflist, newpsl);
         pmc->sfmode = msf->imsf_fmode;
         err = 0;
 done:
@@ -2091,7 +2169,7 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
         }
         err = -EADDRNOTAVAIL;
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rtnl(inet, pmc) {
                 if (pmc->multi.imr_multiaddr.s_addr == msf->imsf_multiaddr &&
                     pmc->multi.imr_ifindex == imr.imr_ifindex)
                         break;
@@ -2099,7 +2177,7 @@ int ip_mc_msfget(struct sock *sk, struct ip_msfilter *msf,
         if (!pmc)               /* must have a prior join */
                 goto done;
         msf->imsf_fmode = pmc->sfmode;
-        psl = pmc->sflist;
+        psl = rtnl_dereference(pmc->sflist);
         rtnl_unlock();
         if (!psl) {
                 len = 0;
@@ -2144,7 +2222,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
 
         err = -EADDRNOTAVAIL;
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rtnl(inet, pmc) {
                 if (pmc->multi.imr_multiaddr.s_addr == addr &&
                     pmc->multi.imr_ifindex == gsf->gf_interface)
                         break;
@@ -2152,7 +2230,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
         if (!pmc)               /* must have a prior join */
                 goto done;
         gsf->gf_fmode = pmc->sfmode;
-        psl = pmc->sflist;
+        psl = rtnl_dereference(pmc->sflist);
         rtnl_unlock();
         count = psl ? psl->sl_count : 0;
         copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
@@ -2186,30 +2264,40 @@ int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
         struct ip_mc_socklist *pmc;
         struct ip_sf_socklist *psl;
         int i;
+        int ret;
 
+        ret = 1;
         if (!ipv4_is_multicast(loc_addr))
-                return 1;
+                goto out;
 
-        for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(inet, pmc) {
                 if (pmc->multi.imr_multiaddr.s_addr == loc_addr &&
                     pmc->multi.imr_ifindex == dif)
                         break;
         }
+        ret = inet->mc_all;
         if (!pmc)
-                return inet->mc_all;
-        psl = pmc->sflist;
+                goto unlock;
+        psl = rcu_dereference(pmc->sflist);
+        ret = (pmc->sfmode == MCAST_EXCLUDE);
         if (!psl)
-                return pmc->sfmode == MCAST_EXCLUDE;
+                goto unlock;
 
         for (i=0; i<psl->sl_count; i++) {
                 if (psl->sl_addr[i] == rmt_addr)
                         break;
         }
+        ret = 0;
         if (pmc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
-                return 0;
+                goto unlock;
         if (pmc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
-                return 0;
-        return 1;
+                goto unlock;
+        ret = 1;
+unlock:
+        rcu_read_unlock();
+out:
+        return ret;
 }
 
 /*
@@ -2226,17 +2314,17 @@ void ip_mc_drop_socket(struct sock *sk)
                 return;
 
         rtnl_lock();
-        while ((iml = inet->mc_list) != NULL) {
+        while ((iml = rtnl_dereference(inet->mc_list)) != NULL) {
                 struct in_device *in_dev;
-                inet->mc_list = iml->next;
 
+                inet->mc_list = iml->next_rcu;
                 in_dev = inetdev_by_index(net, iml->multi.imr_ifindex);
                 (void) ip_mc_leave_src(sk, iml, in_dev);
-                if (in_dev != NULL) {
+                if (in_dev != NULL)
                         ip_mc_dec_group(in_dev, iml->multi.imr_multiaddr.s_addr);
-                        in_dev_put(in_dev);
-                }
-                sock_kfree_s(sk, iml, sizeof(*iml));
+                /* decrease mem now to avoid the memleak warning */
+                atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
+                call_rcu(&iml->rcu, ip_mc_socklist_reclaim);
         }
         rtnl_unlock();
 }
@@ -2247,8 +2335,8 @@ int ip_check_mc(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u16 p
         struct ip_sf_list *psf;
         int rv = 0;
 
-        read_lock(&in_dev->mc_list_lock);
-        for (im=in_dev->mc_list; im; im=im->next) {
+        rcu_read_lock();
+        for_each_pmc_rcu(in_dev, im) {
                 if (im->multiaddr == mc_addr)
                         break;
         }
@@ -2269,7 +2357,7 @@ int ip_check_mc(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u16 p
                 } else
                         rv = 1; /* unspecified source; tentatively allow */
         }
-        read_unlock(&in_dev->mc_list_lock);
+        rcu_read_unlock();
         return rv;
 }
 
@@ -2289,19 +2377,17 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
 
         state->in_dev = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct in_device *in_dev;
-                in_dev = in_dev_get(state->dev);
+
+                in_dev = __in_dev_get_rcu(state->dev);
                 if (!in_dev)
                         continue;
-                read_lock(&in_dev->mc_list_lock);
-                im = in_dev->mc_list;
+                im = rcu_dereference(in_dev->mc_list);
                 if (im) {
                         state->in_dev = in_dev;
                         break;
                 }
-                read_unlock(&in_dev->mc_list_lock);
-                in_dev_put(in_dev);
         }
         return im;
 }
@@ -2309,22 +2395,18 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
 static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_list *im)
 {
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
-        im = im->next;
+
+        im = rcu_dereference(im->next_rcu);
         while (!im) {
-                if (likely(state->in_dev != NULL)) {
-                        read_unlock(&state->in_dev->mc_list_lock);
-                        in_dev_put(state->in_dev);
-                }
-                state->dev = next_net_device(state->dev);
+                state->dev = next_net_device_rcu(state->dev);
                 if (!state->dev) {
                         state->in_dev = NULL;
                         break;
                 }
-                state->in_dev = in_dev_get(state->dev);
+                state->in_dev = __in_dev_get_rcu(state->dev);
                 if (!state->in_dev)
                         continue;
-                read_lock(&state->in_dev->mc_list_lock);
-                im = state->in_dev->mc_list;
+                im = rcu_dereference(state->in_dev->mc_list);
         }
         return im;
 }
@@ -2339,9 +2421,9 @@ static struct ip_mc_list *igmp_mc_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *igmp_mc_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(rcu)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return *pos ? igmp_mc_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
@@ -2357,16 +2439,13 @@ static void *igmp_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(rcu)
 {
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
-        if (likely(state->in_dev != NULL)) {
-                read_unlock(&state->in_dev->mc_list_lock);
-                in_dev_put(state->in_dev);
-                state->in_dev = NULL;
-        }
+
+        state->in_dev = NULL;
         state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int igmp_mc_seq_show(struct seq_file *seq, void *v)
@@ -2386,7 +2465,7 @@ static int igmp_mc_seq_show(struct seq_file *seq, void *v)
                 querier = "NONE";
 #endif
 
-                if (state->in_dev->mc_list == im) {
+                if (rcu_dereference(state->in_dev->mc_list) == im) {
                         seq_printf(seq, "%d\t%-10s: %5d %7s\n",
                                    state->dev->ifindex, state->dev->name, state->in_dev->mc_count, querier);
                 }
@@ -2440,13 +2519,12 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
 
         state->idev = NULL;
         state->im = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct in_device *idev;
-                idev = in_dev_get(state->dev);
+                idev = __in_dev_get_rcu(state->dev);
                 if (unlikely(idev == NULL))
                         continue;
-                read_lock(&idev->mc_list_lock);
-                im = idev->mc_list;
+                im = rcu_dereference(idev->mc_list);
                 if (likely(im != NULL)) {
                         spin_lock_bh(&im->lock);
                         psf = im->sources;
@@ -2457,8 +2535,6 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
                         }
                         spin_unlock_bh(&im->lock);
                 }
-                read_unlock(&idev->mc_list_lock);
-                in_dev_put(idev);
         }
         return psf;
 }
@@ -2472,20 +2548,15 @@ static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_l
                 spin_unlock_bh(&state->im->lock);
                 state->im = state->im->next;
                 while (!state->im) {
-                        if (likely(state->idev != NULL)) {
-                                read_unlock(&state->idev->mc_list_lock);
-                                in_dev_put(state->idev);
-                        }
-                        state->dev = next_net_device(state->dev);
+                        state->dev = next_net_device_rcu(state->dev);
                         if (!state->dev) {
                                 state->idev = NULL;
                                 goto out;
                         }
-                        state->idev = in_dev_get(state->dev);
+                        state->idev = __in_dev_get_rcu(state->dev);
                         if (!state->idev)
                                 continue;
-                        read_lock(&state->idev->mc_list_lock);
-                        state->im = state->idev->mc_list;
+                        state->im = rcu_dereference(state->idev->mc_list);
                 }
                 if (!state->im)
                         break;
@@ -2506,8 +2577,9 @@ static struct ip_sf_list *igmp_mcf_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *igmp_mcf_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(rcu)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return *pos ? igmp_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
@@ -2523,19 +2595,16 @@ static void *igmp_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
+        __releases(rcu)
 {
         struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
         if (likely(state->im != NULL)) {
                 spin_unlock_bh(&state->im->lock);
                 state->im = NULL;
         }
-        if (likely(state->idev != NULL)) {
-                read_unlock(&state->idev->mc_list_lock);
-                in_dev_put(state->idev);
-                state->idev = NULL;
-        }
+        state->idev = NULL;
         state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int igmp_mcf_seq_show(struct seq_file *seq, void *v)
@@ -2583,7 +2652,7 @@ static const struct file_operations igmp_mcf_seq_fops = {
         .release        =       seq_release_net,
 };
 
-static int igmp_net_init(struct net *net)
+static int __net_init igmp_net_init(struct net *net)
 {
         struct proc_dir_entry *pde;
 
@@ -2601,7 +2670,7 @@ out_igmp:
         return -ENOMEM;
 }
 
-static void igmp_net_exit(struct net *net)
+static void __net_exit igmp_net_exit(struct net *net)
 {
         proc_net_remove(net, "mcfilter");
         proc_net_remove(net, "igmp");
@@ -2617,8 +2686,3 @@ int __init igmp_mc_proc_init(void)
         return register_pernet_subsys(&igmp_net_ops);
 }
 #endif
-
-EXPORT_SYMBOL(ip_mc_dec_group);
-EXPORT_SYMBOL(ip_mc_inc_group);
-EXPORT_SYMBOL(ip_mc_join_group);
-EXPORT_SYMBOL(ip_mc_rejoin_group);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 22cd19ee44e5..97e5fb765265 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -37,6 +37,9 @@ struct local_ports sysctl_local_ports __read_mostly = {
         .range = { 32768, 61000 },
 };
 
+unsigned long *sysctl_local_reserved_ports;
+EXPORT_SYMBOL(sysctl_local_reserved_ports);
+
 void inet_get_local_port_range(int *low, int *high)
 {
         unsigned seq;
@@ -52,7 +55,6 @@ EXPORT_SYMBOL(inet_get_local_port_range);
 int inet_csk_bind_conflict(const struct sock *sk,
                            const struct inet_bind_bucket *tb)
 {
-        const __be32 sk_rcv_saddr = inet_rcv_saddr(sk);
         struct sock *sk2;
         struct hlist_node *node;
         int reuse = sk->sk_reuse;
@@ -71,17 +73,16 @@ int inet_csk_bind_conflict(const struct sock *sk,
                      !sk2->sk_bound_dev_if ||
                      sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
                         if (!reuse || !sk2->sk_reuse ||
-                            sk2->sk_state == TCP_LISTEN) {
-                                const __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
-                                if (!sk2_rcv_saddr || !sk_rcv_saddr ||
-                                    sk2_rcv_saddr == sk_rcv_saddr)
+                            ((1 << sk2->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))) {
+                                const __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2);
+                                if (!sk2_rcv_saddr || !sk_rcv_saddr(sk) ||
+                                    sk2_rcv_saddr == sk_rcv_saddr(sk))
                                         break;
                         }
                 }
         }
         return node != NULL;
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_bind_conflict);
 
 /* Obtain a reference to a local port for the given sock,
@@ -108,18 +109,21 @@ again:
 
                 smallest_size = -1;
                 do {
+                        if (inet_is_reserved_local_port(rover))
+                                goto next_nolock;
                         head = &hashinfo->bhash[inet_bhashfn(net, rover,
                                         hashinfo->bhash_size)];
                         spin_lock(&head->lock);
                         inet_bind_bucket_for_each(tb, node, &head->chain)
-                                if (ib_net(tb) == net && tb->port == rover) {
+                                if (net_eq(ib_net(tb), net) && tb->port == rover) {
                                         if (tb->fastreuse > 0 &&
                                             sk->sk_reuse &&
                                             sk->sk_state != TCP_LISTEN &&
                                             (tb->num_owners < smallest_size || smallest_size == -1)) {
                                                 smallest_size = tb->num_owners;
                                                 smallest_rover = rover;
-                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
+                                                if (atomic_read(&hashinfo->bsockets) > (high - low) + 1 &&
+                                                    !inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
                                                         spin_unlock(&head->lock);
                                                         snum = smallest_rover;
                                                         goto have_snum;
@@ -130,6 +134,7 @@ again:
                         break;
                 next:
                         spin_unlock(&head->lock);
+                next_nolock:
                         if (++rover > high)
                                 rover = low;
                 } while (--remaining > 0);
@@ -158,7 +163,7 @@ have_snum:
                                 hashinfo->bhash_size)];
                 spin_lock(&head->lock);
                 inet_bind_bucket_for_each(tb, node, &head->chain)
-                        if (ib_net(tb) == net && tb->port == snum)
+                        if (net_eq(ib_net(tb), net) && tb->port == snum)
                                 goto tb_found;
         }
         tb = NULL;
@@ -206,7 +211,6 @@ fail:
         local_bh_enable();
         return ret;
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_get_port);
 
 /*
@@ -234,7 +238,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
          * having to remove and re-insert us on the wait queue.
          */
         for (;;) {
-                prepare_to_wait_exclusive(sk->sk_sleep, &wait,
+                prepare_to_wait_exclusive(sk_sleep(sk), &wait,
                                           TASK_INTERRUPTIBLE);
                 release_sock(sk);
                 if (reqsk_queue_empty(&icsk->icsk_accept_queue))
@@ -253,7 +257,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
                 if (!timeo)
                         break;
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return err;
 }
 
@@ -299,7 +303,6 @@ out_err:
         *err = error;
         goto out;
 }
-
 EXPORT_SYMBOL(inet_csk_accept);
 
 /*
@@ -321,7 +324,6 @@ void inet_csk_init_xmit_timers(struct sock *sk,
         setup_timer(&sk->sk_timer, keepalive_handler, (unsigned long)sk);
         icsk->icsk_pending = icsk->icsk_ack.pending = 0;
 }
-
 EXPORT_SYMBOL(inet_csk_init_xmit_timers);
 
 void inet_csk_clear_xmit_timers(struct sock *sk)
@@ -334,21 +336,18 @@ void inet_csk_clear_xmit_timers(struct sock *sk)
         sk_stop_timer(sk, &icsk->icsk_delack_timer);
         sk_stop_timer(sk, &sk->sk_timer);
 }
-
 EXPORT_SYMBOL(inet_csk_clear_xmit_timers);
 
 void inet_csk_delete_keepalive_timer(struct sock *sk)
 {
         sk_stop_timer(sk, &sk->sk_timer);
 }
-
 EXPORT_SYMBOL(inet_csk_delete_keepalive_timer);
 
 void inet_csk_reset_keepalive_timer(struct sock *sk, unsigned long len)
 {
         sk_reset_timer(sk, &sk->sk_timer, jiffies + len);
 }
-
 EXPORT_SYMBOL(inet_csk_reset_keepalive_timer);
 
 struct dst_entry *inet_csk_route_req(struct sock *sk,
@@ -358,17 +357,15 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct ip_options *opt = inet_rsk(req)->opt;
         struct flowi fl = { .oif = sk->sk_bound_dev_if,
-                            .nl_u = { .ip4_u =
-                                      { .daddr = ((opt && opt->srr) ?
-                                                  opt->faddr :
-                                                  ireq->rmt_addr),
-                                        .saddr = ireq->loc_addr,
-                                        .tos = RT_CONN_FLAGS(sk) } },
+                            .mark = sk->sk_mark,
+                            .fl4_dst = ((opt && opt->srr) ?
+                                          opt->faddr : ireq->rmt_addr),
+                            .fl4_src = ireq->loc_addr,
+                            .fl4_tos = RT_CONN_FLAGS(sk),
                             .proto = sk->sk_protocol,
                             .flags = inet_sk_flowi_flags(sk),
-                            .uli_u = { .ports =
-                                       { .sport = inet_sk(sk)->sport,
-                                         .dport = ireq->rmt_port } } };
+                            .fl_ip_sport = inet_sk(sk)->inet_sport,
+                            .fl_ip_dport = ireq->rmt_port };
         struct net *net = sock_net(sk);
 
         security_req_classify_flow(req, &fl);
@@ -376,7 +373,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
                 goto no_route;
         if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
                 goto route_err;
-        return &rt->u.dst;
+        return &rt->dst;
 
 route_err:
         ip_rt_put(rt);
@@ -384,7 +381,6 @@ no_route:
         IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES);
         return NULL;
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_route_req);
 
 static inline u32 inet_synq_hash(const __be32 raddr, const __be16 rport,
@@ -426,7 +422,6 @@ struct request_sock *inet_csk_search_req(const struct sock *sk,
 
         return req;
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_search_req);
 
 void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,
@@ -440,11 +435,33 @@ void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,
         reqsk_queue_hash_req(&icsk->icsk_accept_queue, h, req, timeout);
         inet_csk_reqsk_queue_added(sk, timeout);
 }
+EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add);
 
 /* Only thing we need from tcp.h */
 extern int sysctl_tcp_synack_retries;
 
-EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add);
+
+/* Decide when to expire the request and when to resend SYN-ACK */
+static inline void syn_ack_recalc(struct request_sock *req, const int thresh,
+                                  const int max_retries,
+                                  const u8 rskq_defer_accept,
+                                  int *expire, int *resend)
+{
+        if (!rskq_defer_accept) {
+                *expire = req->retrans >= thresh;
+                *resend = 1;
+                return;
+        }
+        *expire = req->retrans >= thresh &&
+                  (!inet_rsk(req)->acked || req->retrans >= max_retries);
+        /*
+         * Do not resend while waiting for data after ACK,
+         * start to resend on end of deferring period to give
+         * last chance for data or ACK to create established socket.
+         */
+        *resend = !inet_rsk(req)->acked ||
+                  req->retrans >= rskq_defer_accept - 1;
+}
 
 void inet_csk_reqsk_queue_prune(struct sock *parent,
                                 const unsigned long interval,
@@ -501,9 +518,17 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                 reqp=&lopt->syn_table[i];
                 while ((req = *reqp) != NULL) {
                         if (time_after_eq(now, req->expires)) {
-                                if ((req->retrans < thresh ||
-                                     (inet_rsk(req)->acked && req->retrans < max_retries))
-                                    && !req->rsk_ops->rtx_syn_ack(parent, req)) {
+                                int expire = 0, resend = 0;
+
+                                syn_ack_recalc(req, thresh, max_retries,
+                                               queue->rskq_defer_accept,
+                                               &expire, &resend);
+                                if (req->rsk_ops->syn_ack_timeout)
+                                        req->rsk_ops->syn_ack_timeout(parent, req);
+                                if (!expire &&
+                                    (!resend ||
+                                     !req->rsk_ops->rtx_syn_ack(parent, req, NULL) ||
+                                     inet_rsk(req)->acked)) {
                                         unsigned long timeo;
 
                                         if (req->retrans++ == 0)
@@ -532,7 +557,6 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
         if (lopt->qlen)
                 inet_csk_reset_keepalive_timer(parent, interval);
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_prune);
 
 struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req,
@@ -546,9 +570,9 @@ struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req,
                 newsk->sk_state = TCP_SYN_RECV;
                 newicsk->icsk_bind_hash = NULL;
 
-                inet_sk(newsk)->dport = inet_rsk(req)->rmt_port;
-                inet_sk(newsk)->num = ntohs(inet_rsk(req)->loc_port);
-                inet_sk(newsk)->sport = inet_rsk(req)->loc_port;
+                inet_sk(newsk)->inet_dport = inet_rsk(req)->rmt_port;
+                inet_sk(newsk)->inet_num = ntohs(inet_rsk(req)->loc_port);
+                inet_sk(newsk)->inet_sport = inet_rsk(req)->loc_port;
                 newsk->sk_write_space = sk_stream_write_space;
 
                 newicsk->icsk_retransmits = 0;
@@ -562,7 +586,6 @@ struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req,
         }
         return newsk;
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_clone);
 
 /*
@@ -579,8 +602,8 @@ void inet_csk_destroy_sock(struct sock *sk)
         /* It cannot be in hash table! */
         WARN_ON(!sk_unhashed(sk));
 
-        /* If it has not 0 inet_sk(sk)->num, it must be bound */
-        WARN_ON(inet_sk(sk)->num && !inet_csk(sk)->icsk_bind_hash);
+        /* If it has not 0 inet_sk(sk)->inet_num, it must be bound */
+        WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);
 
         sk->sk_prot->destroy(sk);
 
@@ -593,7 +616,6 @@ void inet_csk_destroy_sock(struct sock *sk)
         percpu_counter_dec(sk->sk_prot->orphan_count);
         sock_put(sk);
 }
-
 EXPORT_SYMBOL(inet_csk_destroy_sock);
 
 int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
@@ -615,8 +637,8 @@ int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
          * after validation is complete.
          */
         sk->sk_state = TCP_LISTEN;
-        if (!sk->sk_prot->get_port(sk, inet->num)) {
-                inet->sport = htons(inet->num);
+        if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
+                inet->inet_sport = htons(inet->inet_num);
 
                 sk_dst_reset(sk);
                 sk->sk_prot->hash(sk);
@@ -628,7 +650,6 @@ int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
         __reqsk_queue_destroy(&icsk->icsk_accept_queue);
         return -EADDRINUSE;
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_listen_start);
 
 /*
@@ -683,7 +704,6 @@ void inet_csk_listen_stop(struct sock *sk)
         }
         WARN_ON(sk->sk_ack_backlog);
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_listen_stop);
 
 void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr)
@@ -692,10 +712,9 @@ void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr)
         const struct inet_sock *inet = inet_sk(sk);
 
         sin->sin_family         = AF_INET;
-        sin->sin_addr.s_addr    = inet->daddr;
-        sin->sin_port           = inet->dport;
+        sin->sin_addr.s_addr    = inet->inet_daddr;
+        sin->sin_port           = inet->inet_dport;
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_addr2sockaddr);
 
 #ifdef CONFIG_COMPAT
@@ -710,11 +729,10 @@ int inet_csk_compat_getsockopt(struct sock *sk, int level, int optname,
         return icsk->icsk_af_ops->getsockopt(sk, level, optname,
                                              optval, optlen);
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_compat_getsockopt);
 
 int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname,
-                               char __user *optval, int optlen)
+                               char __user *optval, unsigned int optlen)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
 
@@ -724,6 +742,5 @@ int inet_csk_compat_setsockopt(struct sock *sk, int level, int optname,
         return icsk->icsk_af_ops->setsockopt(sk, level, optname,
                                              optval, optlen);
 }
-
 EXPORT_SYMBOL_GPL(inet_csk_compat_setsockopt);
 #endif
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index a706a47f4dbb..2746c1fa6417 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -14,6 +14,7 @@
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <linux/cache.h>
 #include <linux/init.h>
 #include <linux/time.h>
@@ -116,10 +117,10 @@ static int inet_csk_diag_fill(struct sock *sk,
         r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
         r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
 
-        r->id.idiag_sport = inet->sport;
-        r->id.idiag_dport = inet->dport;
-        r->id.idiag_src[0] = inet->rcv_saddr;
-        r->id.idiag_dst[0] = inet->daddr;
+        r->id.idiag_sport = inet->inet_sport;
+        r->id.idiag_dport = inet->inet_dport;
+        r->id.idiag_src[0] = inet->inet_rcv_saddr;
+        r->id.idiag_dst[0] = inet->inet_daddr;
 
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
         if (r->idiag_family == AF_INET6) {
@@ -368,7 +369,7 @@ static int inet_diag_bc_run(const void *bc, int len,
                         yes = entry->sport >= op[1].no;
                         break;
                 case INET_DIAG_BC_S_LE:
-                        yes = entry->dport <= op[1].no;
+                        yes = entry->sport <= op[1].no;
                         break;
                 case INET_DIAG_BC_D_GE:
                         yes = entry->dport >= op[1].no;
@@ -424,7 +425,7 @@ static int inet_diag_bc_run(const void *bc, int len,
                         bc += op->no;
                 }
         }
-        return (len == 0);
+        return len == 0;
 }
 
 static int valid_cc(const void *bc, int len, int cc)
@@ -489,9 +490,11 @@ static int inet_csk_diag_dump(struct sock *sk,
 {
         struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
 
-        if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
+        if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
                 struct inet_diag_entry entry;
-                struct rtattr *bc = (struct rtattr *)(r + 1);
+                const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
+                                                          sizeof(*r),
+                                                          INET_DIAG_REQ_BYTECODE);
                 struct inet_sock *inet = inet_sk(sk);
 
                 entry.family = sk->sk_family;
@@ -504,14 +507,14 @@ static int inet_csk_diag_dump(struct sock *sk,
                 } else
 #endif
                 {
-                        entry.saddr = &inet->rcv_saddr;
-                        entry.daddr = &inet->daddr;
+                        entry.saddr = &inet->inet_rcv_saddr;
+                        entry.daddr = &inet->inet_daddr;
                 }
-                entry.sport = inet->num;
-                entry.dport = ntohs(inet->dport);
+                entry.sport = inet->inet_num;
+                entry.dport = ntohs(inet->inet_dport);
                 entry.userlocks = sk->sk_userlocks;
 
-                if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
+                if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
                         return 0;
         }
 
@@ -526,9 +529,11 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
 {
         struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
 
-        if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
+        if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
                 struct inet_diag_entry entry;
-                struct rtattr *bc = (struct rtattr *)(r + 1);
+                const struct nlattr *bc = nlmsg_find_attr(cb->nlh,
+                                                          sizeof(*r),
+                                                          INET_DIAG_REQ_BYTECODE);
 
                 entry.family = tw->tw_family;
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
@@ -547,7 +552,7 @@ static int inet_twsk_diag_dump(struct inet_timewait_sock *tw,
                 entry.dport = ntohs(tw->tw_dport);
                 entry.userlocks = 0;
 
-                if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
+                if (!inet_diag_bc_run(nla_data(bc), nla_len(bc), &entry))
                         return 0;
         }
 
@@ -584,7 +589,7 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
         if (tmo < 0)
                 tmo = 0;
 
-        r->id.idiag_sport = inet->sport;
+        r->id.idiag_sport = inet->inet_sport;
         r->id.idiag_dport = ireq->rmt_port;
         r->id.idiag_src[0] = ireq->loc_addr;
         r->id.idiag_dst[0] = ireq->rmt_addr;
@@ -617,7 +622,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
         struct inet_diag_req *r = NLMSG_DATA(cb->nlh);
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct listen_sock *lopt;
-        struct rtattr *bc = NULL;
+        const struct nlattr *bc = NULL;
         struct inet_sock *inet = inet_sk(sk);
         int j, s_j;
         int reqnum, s_reqnum;
@@ -637,9 +642,10 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
         if (!lopt || !lopt->qlen)
                 goto out;
 
-        if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
-                bc = (struct rtattr *)(r + 1);
-                entry.sport = inet->num;
+        if (nlmsg_attrlen(cb->nlh, sizeof(*r))) {
+                bc = nlmsg_find_attr(cb->nlh, sizeof(*r),
+                                     INET_DIAG_REQ_BYTECODE);
+                entry.sport = inet->inet_num;
                 entry.userlocks = sk->sk_userlocks;
         }
 
@@ -671,8 +677,8 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
                                         &ireq->rmt_addr;
                                 entry.dport = ntohs(ireq->rmt_port);
 
-                                if (!inet_diag_bc_run(RTA_DATA(bc),
-                                                    RTA_PAYLOAD(bc), &entry))
+                                if (!inet_diag_bc_run(nla_data(bc),
+                                                      nla_len(bc), &entry))
                                         continue;
                         }
 
@@ -732,7 +738,7 @@ static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                         continue;
                                 }
 
-                                if (r->id.idiag_sport != inet->sport &&
+                                if (r->id.idiag_sport != inet->inet_sport &&
                                     r->id.idiag_sport)
                                         goto next_listen;
 
@@ -774,7 +780,7 @@ skip_listen_ht:
         if (!(r->idiag_states & ~(TCPF_LISTEN | TCPF_SYN_RECV)))
                 goto unlock;
 
-        for (i = s_i; i < hashinfo->ehash_size; i++) {
+        for (i = s_i; i <= hashinfo->ehash_mask; i++) {
                 struct inet_ehash_bucket *head = &hashinfo->ehash[i];
                 spinlock_t *lock = inet_ehash_lockp(hashinfo, i);
                 struct sock *sk;
@@ -797,10 +803,10 @@ skip_listen_ht:
                                 goto next_normal;
                         if (!(r->idiag_states & (1 << sk->sk_state)))
                                 goto next_normal;
-                        if (r->id.idiag_sport != inet->sport &&
+                        if (r->id.idiag_sport != inet->inet_sport &&
                             r->id.idiag_sport)
                                 goto next_normal;
-                        if (r->id.idiag_dport != inet->dport &&
+                        if (r->id.idiag_dport != inet->inet_dport &&
                             r->id.idiag_dport)
                                 goto next_normal;
                         if (inet_csk_diag_dump(sk, skb, cb) < 0) {
@@ -852,7 +858,7 @@ static int inet_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
             nlmsg_len(nlh) < hdrlen)
                 return -EINVAL;
 
-        if (nlh->nlmsg_flags & NLM_F_DUMP) {
+        if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
                 if (nlmsg_attrlen(nlh, hdrlen)) {
                         struct nlattr *attr;
 
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index eaf3e2c8646a..5ff2a51b6d0c 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -19,6 +19,7 @@
 #include <linux/random.h>
 #include <linux/skbuff.h>
 #include <linux/rtnetlink.h>
+#include <linux/slab.h>
 
 #include <net/inet_frag.h>
 
@@ -113,7 +114,6 @@ void inet_frag_kill(struct inet_frag_queue *fq, struct inet_frags *f)
                 fq->last_in |= INET_FRAG_COMPLETE;
         }
 }
-
 EXPORT_SYMBOL(inet_frag_kill);
 
 static inline void frag_kfree_skb(struct netns_frags *nf, struct inet_frags *f,
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 625cc5f64c94..3c0369a3a663 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -64,7 +64,7 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
 
         atomic_inc(&hashinfo->bsockets);
 
-        inet_sk(sk)->num = snum;
+        inet_sk(sk)->inet_num = snum;
         sk_add_bind_node(sk, &tb->owners);
         tb->num_owners++;
         inet_csk(sk)->icsk_bind_hash = tb;
@@ -76,7 +76,7 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
 static void __inet_put_port(struct sock *sk)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
-        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(sk)->num,
+        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(sk)->inet_num,
                         hashinfo->bhash_size);
         struct inet_bind_hashbucket *head = &hashinfo->bhash[bhash];
         struct inet_bind_bucket *tb;
@@ -88,7 +88,7 @@ static void __inet_put_port(struct sock *sk)
         __sk_del_bind_node(sk);
         tb->num_owners--;
         inet_csk(sk)->icsk_bind_hash = NULL;
-        inet_sk(sk)->num = 0;
+        inet_sk(sk)->inet_num = 0;
         inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
         spin_unlock(&head->lock);
 }
@@ -99,24 +99,45 @@ void inet_put_port(struct sock *sk)
         __inet_put_port(sk);
         local_bh_enable();
 }
-
 EXPORT_SYMBOL(inet_put_port);
 
-void __inet_inherit_port(struct sock *sk, struct sock *child)
+int __inet_inherit_port(struct sock *sk, struct sock *child)
 {
         struct inet_hashinfo *table = sk->sk_prot->h.hashinfo;
-        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(child)->num,
+        unsigned short port = inet_sk(child)->inet_num;
+        const int bhash = inet_bhashfn(sock_net(sk), port,
                         table->bhash_size);
         struct inet_bind_hashbucket *head = &table->bhash[bhash];
         struct inet_bind_bucket *tb;
 
         spin_lock(&head->lock);
         tb = inet_csk(sk)->icsk_bind_hash;
-        sk_add_bind_node(child, &tb->owners);
-        inet_csk(child)->icsk_bind_hash = tb;
+        if (tb->port != port) {
+                /* NOTE: using tproxy and redirecting skbs to a proxy
+                 * on a different listener port breaks the assumption
+                 * that the listener socket's icsk_bind_hash is the same
+                 * as that of the child socket. We have to look up or
+                 * create a new bind bucket for the child here. */
+                struct hlist_node *node;
+                inet_bind_bucket_for_each(tb, node, &head->chain) {
+                        if (net_eq(ib_net(tb), sock_net(sk)) &&
+                            tb->port == port)
+                                break;
+                }
+                if (!node) {
+                        tb = inet_bind_bucket_create(table->bind_bucket_cachep,
+                                                     sock_net(sk), head, port);
+                        if (!tb) {
+                                spin_unlock(&head->lock);
+                                return -ENOMEM;
+                        }
+                }
+        }
+        inet_bind_hash(child, tb, port);
         spin_unlock(&head->lock);
-}
 
+        return 0;
+}
 EXPORT_SYMBOL_GPL(__inet_inherit_port);
 
 static inline int compute_score(struct sock *sk, struct net *net,
@@ -126,9 +147,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
         int score = -1;
         struct inet_sock *inet = inet_sk(sk);
 
-        if (net_eq(sock_net(sk), net) && inet->num == hnum &&
+        if (net_eq(sock_net(sk), net) && inet->inet_num == hnum &&
                         !ipv6_only_sock(sk)) {
-                __be32 rcv_saddr = inet->rcv_saddr;
+                __be32 rcv_saddr = inet->inet_rcv_saddr;
                 score = sk->sk_family == PF_INET ? 1 : 0;
                 if (rcv_saddr) {
                         if (rcv_saddr != daddr)
@@ -209,7 +230,7 @@ struct sock * __inet_lookup_established(struct net *net,
          * have wildcards anyways.
          */
         unsigned int hash = inet_ehashfn(net, daddr, hnum, saddr, sport);
-        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        unsigned int slot = hash & hashinfo->ehash_mask;
         struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
         rcu_read_lock();
@@ -273,18 +294,20 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
         struct inet_sock *inet = inet_sk(sk);
-        __be32 daddr = inet->rcv_saddr;
-        __be32 saddr = inet->daddr;
+        __be32 daddr = inet->inet_rcv_saddr;
+        __be32 saddr = inet->inet_daddr;
         int dif = sk->sk_bound_dev_if;
         INET_ADDR_COOKIE(acookie, saddr, daddr)
-        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->inet_dport, lport);
         struct net *net = sock_net(sk);
-        unsigned int hash = inet_ehashfn(net, daddr, lport, saddr, inet->dport);
+        unsigned int hash = inet_ehashfn(net, daddr, lport,
+                                         saddr, inet->inet_dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
         const struct hlist_nulls_node *node;
         struct inet_timewait_sock *tw;
+        int twrefcnt = 0;
 
         spin_lock(lock);
 
@@ -312,25 +335,28 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 unique:
         /* Must record num and sport now. Otherwise we will see
          * in hash table socket with a funny identity. */
-        inet->num = lport;
-        inet->sport = htons(lport);
+        inet->inet_num = lport;
+        inet->inet_sport = htons(lport);
         sk->sk_hash = hash;
         WARN_ON(!sk_unhashed(sk));
         __sk_nulls_add_node_rcu(sk, &head->chain);
+        if (tw) {
+                twrefcnt = inet_twsk_unhash(tw);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
+        }
         spin_unlock(lock);
+        if (twrefcnt)
+                inet_twsk_put(tw);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
 
         if (twp) {
                 *twp = tw;
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
         } else if (tw) {
                 /* Silly. Should hash-dance instead... */
                 inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
 
                 inet_twsk_put(tw);
         }
-
         return 0;
 
 not_unique:
@@ -341,16 +367,18 @@ not_unique:
 static inline u32 inet_sk_port_offset(const struct sock *sk)
 {
         const struct inet_sock *inet = inet_sk(sk);
-        return secure_ipv4_port_ephemeral(inet->rcv_saddr, inet->daddr,
-                                          inet->dport);
+        return secure_ipv4_port_ephemeral(inet->inet_rcv_saddr,
+                                          inet->inet_daddr,
+                                          inet->inet_dport);
 }
 
-void __inet_hash_nolisten(struct sock *sk)
+int __inet_hash_nolisten(struct sock *sk, struct inet_timewait_sock *tw)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
         struct hlist_nulls_head *list;
         spinlock_t *lock;
         struct inet_ehash_bucket *head;
+        int twrefcnt = 0;
 
         WARN_ON(!sk_unhashed(sk));
 
@@ -361,8 +389,13 @@ void __inet_hash_nolisten(struct sock *sk)
 
         spin_lock(lock);
         __sk_nulls_add_node_rcu(sk, list);
+        if (tw) {
+                WARN_ON(sk->sk_hash != tw->tw_hash);
+                twrefcnt = inet_twsk_unhash(tw);
+        }
         spin_unlock(lock);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+        return twrefcnt;
 }
 EXPORT_SYMBOL_GPL(__inet_hash_nolisten);
 
@@ -372,7 +405,7 @@ static void __inet_hash(struct sock *sk)
         struct inet_listen_hashbucket *ilb;
 
         if (sk->sk_state != TCP_LISTEN) {
-                __inet_hash_nolisten(sk);
+                __inet_hash_nolisten(sk, NULL);
                 return;
         }
 
@@ -421,14 +454,15 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 struct sock *sk, u32 port_offset,
                 int (*check_established)(struct inet_timewait_death_row *,
                         struct sock *, __u16, struct inet_timewait_sock **),
-                void (*hash)(struct sock *sk))
+                int (*hash)(struct sock *sk, struct inet_timewait_sock *twp))
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
-        const unsigned short snum = inet_sk(sk)->num;
+        const unsigned short snum = inet_sk(sk)->inet_num;
         struct inet_bind_hashbucket *head;
         struct inet_bind_bucket *tb;
         int ret;
         struct net *net = sock_net(sk);
+        int twrefcnt = 1;
 
         if (!snum) {
                 int i, remaining, low, high, port;
@@ -443,6 +477,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 local_bh_disable();
                 for (i = 1; i <= remaining; i++) {
                         port = low + (i + offset) % remaining;
+                        if (inet_is_reserved_local_port(port))
+                                continue;
                         head = &hinfo->bhash[inet_bhashfn(net, port,
                                         hinfo->bhash_size)];
                         spin_lock(&head->lock);
@@ -452,7 +488,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                          * unique enough.
                          */
                         inet_bind_bucket_for_each(tb, node, &head->chain) {
-                                if (ib_net(tb) == net && tb->port == port) {
+                                if (net_eq(ib_net(tb), net) &&
+                                    tb->port == port) {
                                         if (tb->fastreuse >= 0)
                                                 goto next_port;
                                         WARN_ON(hlist_empty(&tb->owners));
@@ -485,14 +522,19 @@ ok:
                 /* Head lock still held and bh's disabled */
                 inet_bind_hash(sk, tb, port);
                 if (sk_unhashed(sk)) {
-                        inet_sk(sk)->sport = htons(port);
-                        hash(sk);
+                        inet_sk(sk)->inet_sport = htons(port);
+                        twrefcnt += hash(sk, tw);
                 }
+                if (tw)
+                        twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
                 spin_unlock(&head->lock);
 
                 if (tw) {
                         inet_twsk_deschedule(tw, death_row);
-                        inet_twsk_put(tw);
+                        while (twrefcnt) {
+                                twrefcnt--;
+                                inet_twsk_put(tw);
+                        }
                 }
 
                 ret = 0;
@@ -503,7 +545,7 @@ ok:
         tb  = inet_csk(sk)->icsk_bind_hash;
         spin_lock_bh(&head->lock);
         if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
-                hash(sk);
+                hash(sk, NULL);
                 spin_unlock_bh(&head->lock);
                 return 0;
         } else {
@@ -525,7 +567,6 @@ int inet_hash_connect(struct inet_timewait_death_row *death_row,
         return __inet_hash_connect(death_row, sk, inet_sk_port_offset(sk),
                         __inet_check_established, __inet_hash_nolisten);
 }
-
 EXPORT_SYMBOL_GPL(inet_hash_connect);
 
 void inet_hashinfo_init(struct inet_hashinfo *h)
@@ -539,5 +580,4 @@ void inet_hashinfo_init(struct inet_hashinfo *h)
                                       i + LISTENING_NULLS_BASE);
                 }
 }
-
 EXPORT_SYMBOL_GPL(inet_hashinfo_init);
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 6a667dae315e..47038cb6c138 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -64,15 +64,15 @@ static int lro_tcp_ip_check(struct iphdr *iph, struct tcphdr *tcph,
         if (iph->ihl != IPH_LEN_WO_OPTIONS)
                 return -1;
 
-        if (tcph->cwr || tcph->ece || tcph->urg || !tcph->ack
-            || tcph->rst || tcph->syn || tcph->fin)
+        if (tcph->cwr || tcph->ece || tcph->urg || !tcph->ack ||
+            tcph->rst || tcph->syn || tcph->fin)
                 return -1;
 
         if (INET_ECN_is_ce(ipv4_get_dsfield(iph)))
                 return -1;
 
-        if (tcph->doff != TCPH_LEN_WO_OPTIONS
-            && tcph->doff != TCPH_LEN_W_TIMESTAMP)
+        if (tcph->doff != TCPH_LEN_WO_OPTIONS &&
+            tcph->doff != TCPH_LEN_W_TIMESTAMP)
                 return -1;
 
         /* check tcp options (only timestamp allowed) */
@@ -262,10 +262,10 @@ static int lro_check_tcp_conn(struct net_lro_desc *lro_desc,
                               struct iphdr *iph,
                               struct tcphdr *tcph)
 {
-        if ((lro_desc->iph->saddr != iph->saddr)
-            || (lro_desc->iph->daddr != iph->daddr)
-            || (lro_desc->tcph->source != tcph->source)
-            || (lro_desc->tcph->dest != tcph->dest))
+        if ((lro_desc->iph->saddr != iph->saddr) ||
+            (lro_desc->iph->daddr != iph->daddr) ||
+            (lro_desc->tcph->source != tcph->source) ||
+            (lro_desc->tcph->dest != tcph->dest))
                 return -1;
         return 0;
 }
@@ -339,9 +339,9 @@ static int __lro_proc_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
         u64 flags;
         int vlan_hdr_len = 0;
 
-        if (!lro_mgr->get_skb_header
-            || lro_mgr->get_skb_header(skb, (void *)&iph, (void *)&tcph,
-                                       &flags, priv))
+        if (!lro_mgr->get_skb_header ||
+            lro_mgr->get_skb_header(skb, (void *)&iph, (void *)&tcph,
+                                    &flags, priv))
                 goto out;
 
         if (!(flags & LRO_IPV4) || !(flags & LRO_TCP))
@@ -351,8 +351,8 @@ static int __lro_proc_skb(struct net_lro_mgr *lro_mgr, struct sk_buff *skb,
         if (!lro_desc)
                 goto out;
 
-        if ((skb->protocol == htons(ETH_P_8021Q))
-            && !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
+        if ((skb->protocol == htons(ETH_P_8021Q)) &&
+            !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
                 vlan_hdr_len = VLAN_HLEN;
 
         if (!lro_desc->active) { /* start new lro session */
@@ -446,9 +446,9 @@ static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
         int hdr_len = LRO_MAX_PG_HLEN;
         int vlan_hdr_len = 0;
 
-        if (!lro_mgr->get_frag_header
-            || lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
-                                        (void *)&tcph, &flags, priv)) {
+        if (!lro_mgr->get_frag_header ||
+            lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
+                                     (void *)&tcph, &flags, priv)) {
                 mac_hdr = page_address(frags->page) + frags->page_offset;
                 goto out1;
         }
@@ -472,8 +472,8 @@ static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
                 if (!skb)
                         goto out;
 
-                if ((skb->protocol == htons(ETH_P_8021Q))
-                    && !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
+                if ((skb->protocol == htons(ETH_P_8021Q)) &&
+                    !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
                         vlan_hdr_len = VLAN_HLEN;
 
                 iph = (void *)(skb->data + vlan_hdr_len);
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 61283f928825..c5af909cf701 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -10,44 +10,92 @@
 
 #include <linux/kernel.h>
 #include <linux/kmemcheck.h>
+#include <linux/slab.h>
 #include <net/inet_hashtables.h>
 #include <net/inet_timewait_sock.h>
 #include <net/ip.h>
 
+
+/**
+ *      inet_twsk_unhash - unhash a timewait socket from established hash
+ *      @tw: timewait socket
+ *
+ *      unhash a timewait socket from established hash, if hashed.
+ *      ehash lock must be held by caller.
+ *      Returns 1 if caller should call inet_twsk_put() after lock release.
+ */
+int inet_twsk_unhash(struct inet_timewait_sock *tw)
+{
+        if (hlist_nulls_unhashed(&tw->tw_node))
+                return 0;
+
+        hlist_nulls_del_rcu(&tw->tw_node);
+        sk_nulls_node_init(&tw->tw_node);
+        /*
+         * We cannot call inet_twsk_put() ourself under lock,
+         * caller must call it for us.
+         */
+        return 1;
+}
+
+/**
+ *      inet_twsk_bind_unhash - unhash a timewait socket from bind hash
+ *      @tw: timewait socket
+ *      @hashinfo: hashinfo pointer
+ *
+ *      unhash a timewait socket from bind hash, if hashed.
+ *      bind hash lock must be held by caller.
+ *      Returns 1 if caller should call inet_twsk_put() after lock release.
+ */
+int inet_twsk_bind_unhash(struct inet_timewait_sock *tw,
+                          struct inet_hashinfo *hashinfo)
+{
+        struct inet_bind_bucket *tb = tw->tw_tb;
+
+        if (!tb)
+                return 0;
+
+        __hlist_del(&tw->tw_bind_node);
+        tw->tw_tb = NULL;
+        inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
+        /*
+         * We cannot call inet_twsk_put() ourself under lock,
+         * caller must call it for us.
+         */
+        return 1;
+}
+
 /* Must be called with locally disabled BHs. */
 static void __inet_twsk_kill(struct inet_timewait_sock *tw,
                              struct inet_hashinfo *hashinfo)
 {
         struct inet_bind_hashbucket *bhead;
-        struct inet_bind_bucket *tb;
+        int refcnt;
         /* Unlink from established hashes. */
         spinlock_t *lock = inet_ehash_lockp(hashinfo, tw->tw_hash);
 
         spin_lock(lock);
-        if (hlist_nulls_unhashed(&tw->tw_node)) {
-                spin_unlock(lock);
-                return;
-        }
-        hlist_nulls_del_rcu(&tw->tw_node);
-        sk_nulls_node_init(&tw->tw_node);
+        refcnt = inet_twsk_unhash(tw);
         spin_unlock(lock);
 
         /* Disassociate with bind bucket. */
         bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), tw->tw_num,
                         hashinfo->bhash_size)];
+
         spin_lock(&bhead->lock);
-        tb = tw->tw_tb;
-        __hlist_del(&tw->tw_bind_node);
-        tw->tw_tb = NULL;
-        inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
+        refcnt += inet_twsk_bind_unhash(tw, hashinfo);
         spin_unlock(&bhead->lock);
+
 #ifdef SOCK_REFCNT_DEBUG
         if (atomic_read(&tw->tw_refcnt) != 1) {
                 printk(KERN_DEBUG "%s timewait_sock %p refcnt=%d\n",
                        tw->tw_prot->name, tw, atomic_read(&tw->tw_refcnt));
         }
 #endif
-        inet_twsk_put(tw);
+        while (refcnt) {
+                inet_twsk_put(tw);
+                refcnt--;
+        }
 }
 
 static noinline void inet_twsk_free(struct inet_timewait_sock *tw)
@@ -86,7 +134,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
            Note, that any socket with inet->num != 0 MUST be bound in
            binding cache, even if it is closed.
          */
-        bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->num,
+        bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->inet_num,
                         hashinfo->bhash_size)];
         spin_lock(&bhead->lock);
         tw->tw_tb = icsk->icsk_bind_hash;
@@ -101,16 +149,24 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
          * Should be done before removing sk from established chain
          * because readers are lockless and search established first.
          */
-        atomic_inc(&tw->tw_refcnt);
         inet_twsk_add_node_rcu(tw, &ehead->twchain);
 
         /* Step 3: Remove SK from established hash. */
         if (__sk_nulls_del_node_init_rcu(sk))
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
 
+        /*
+         * Notes :
+         * - We initially set tw_refcnt to 0 in inet_twsk_alloc()
+         * - We add one reference for the bhash link
+         * - We add one reference for the ehash link
+         * - We want this refcnt update done before allowing other
+         *   threads to find this tw in ehash chain.
+         */
+        atomic_add(1 + 1 + 1, &tw->tw_refcnt);
+
         spin_unlock(lock);
 }
-
 EXPORT_SYMBOL_GPL(__inet_twsk_hashdance);
 
 struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int state)
@@ -124,14 +180,14 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                 kmemcheck_annotate_bitfield(tw, flags);
 
                 /* Give us an identity. */
-                tw->tw_daddr        = inet->daddr;
-                tw->tw_rcv_saddr    = inet->rcv_saddr;
+                tw->tw_daddr        = inet->inet_daddr;
+                tw->tw_rcv_saddr    = inet->inet_rcv_saddr;
                 tw->tw_bound_dev_if = sk->sk_bound_dev_if;
-                tw->tw_num          = inet->num;
+                tw->tw_num          = inet->inet_num;
                 tw->tw_state        = TCP_TIME_WAIT;
                 tw->tw_substate     = state;
-                tw->tw_sport        = inet->sport;
-                tw->tw_dport        = inet->dport;
+                tw->tw_sport        = inet->inet_sport;
+                tw->tw_dport        = inet->inet_dport;
                 tw->tw_family       = sk->sk_family;
                 tw->tw_reuse        = sk->sk_reuse;
                 tw->tw_hash         = sk->sk_hash;
@@ -139,14 +195,18 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                 tw->tw_transparent  = inet->transparent;
                 tw->tw_prot         = sk->sk_prot_creator;
                 twsk_net_set(tw, hold_net(sock_net(sk)));
-                atomic_set(&tw->tw_refcnt, 1);
+                /*
+                 * Because we use RCU lookups, we should not set tw_refcnt
+                 * to a non null value before everything is setup for this
+                 * timewait socket.
+                 */
+                atomic_set(&tw->tw_refcnt, 0);
                 inet_twsk_dead_node_init(tw);
                 __module_get(tw->tw_prot->owner);
         }
 
         return tw;
 }
-
 EXPORT_SYMBOL_GPL(inet_twsk_alloc);
 
 /* Returns non-zero if quota exceeded.  */
@@ -218,14 +278,13 @@ void inet_twdr_hangman(unsigned long data)
                 /* We purged the entire slot, anything left?  */
                 if (twdr->tw_count)
                         need_timer = 1;
+                twdr->slot = ((twdr->slot + 1) & (INET_TWDR_TWKILL_SLOTS - 1));
         }
-        twdr->slot = ((twdr->slot + 1) & (INET_TWDR_TWKILL_SLOTS - 1));
         if (need_timer)
                 mod_timer(&twdr->tw_timer, jiffies + twdr->period);
 out:
         spin_unlock(&twdr->death_lock);
 }
-
 EXPORT_SYMBOL_GPL(inet_twdr_hangman);
 
 void inet_twdr_twkill_work(struct work_struct *work)
@@ -256,7 +315,6 @@ void inet_twdr_twkill_work(struct work_struct *work)
                 spin_unlock_bh(&twdr->death_lock);
         }
 }
-
 EXPORT_SYMBOL_GPL(inet_twdr_twkill_work);
 
 /* These are always called from BH context.  See callers in
@@ -276,7 +334,6 @@ void inet_twsk_deschedule(struct inet_timewait_sock *tw,
         spin_unlock(&twdr->death_lock);
         __inet_twsk_kill(tw, twdr->hashinfo);
 }
-
 EXPORT_SYMBOL(inet_twsk_deschedule);
 
 void inet_twsk_schedule(struct inet_timewait_sock *tw,
@@ -357,7 +414,6 @@ void inet_twsk_schedule(struct inet_timewait_sock *tw,
                 mod_timer(&twdr->tw_timer, jiffies + twdr->period);
         spin_unlock(&twdr->death_lock);
 }
-
 EXPORT_SYMBOL_GPL(inet_twsk_schedule);
 
 void inet_twdr_twcal_tick(unsigned long data)
@@ -418,40 +474,48 @@ out:
 #endif
         spin_unlock(&twdr->death_lock);
 }
-
 EXPORT_SYMBOL_GPL(inet_twdr_twcal_tick);
 
-void inet_twsk_purge(struct net *net, struct inet_hashinfo *hashinfo,
+void inet_twsk_purge(struct inet_hashinfo *hashinfo,
                      struct inet_timewait_death_row *twdr, int family)
 {
         struct inet_timewait_sock *tw;
         struct sock *sk;
         struct hlist_nulls_node *node;
-        int h;
+        unsigned int slot;
 
-        local_bh_disable();
-        for (h = 0; h < (hashinfo->ehash_size); h++) {
-                struct inet_ehash_bucket *head =
-                        inet_ehash_bucket(hashinfo, h);
-                spinlock_t *lock = inet_ehash_lockp(hashinfo, h);
+        for (slot = 0; slot <= hashinfo->ehash_mask; slot++) {
+                struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
+restart_rcu:
+                rcu_read_lock();
 restart:
-                spin_lock(lock);
-                sk_nulls_for_each(sk, node, &head->twchain) {
-
+                sk_nulls_for_each_rcu(sk, node, &head->twchain) {
                         tw = inet_twsk(sk);
-                        if (!net_eq(twsk_net(tw), net) ||
-                            tw->tw_family != family)
+                        if ((tw->tw_family != family) ||
+                                atomic_read(&twsk_net(tw)->count))
                                 continue;
 
-                        atomic_inc(&tw->tw_refcnt);
-                        spin_unlock(lock);
+                        if (unlikely(!atomic_inc_not_zero(&tw->tw_refcnt)))
+                                continue;
+
+                        if (unlikely((tw->tw_family != family) ||
+                                     atomic_read(&twsk_net(tw)->count))) {
+                                inet_twsk_put(tw);
+                                goto restart;
+                        }
+
+                        rcu_read_unlock();
                         inet_twsk_deschedule(tw, twdr);
                         inet_twsk_put(tw);
-
-                        goto restart;
+                        goto restart_rcu;
                 }
-                spin_unlock(lock);
+                /* If the nulls value we got at the end of this lookup is
+                 * not the expected one, we must restart lookup.
+                 * We probably met an item that was moved to another chain.
+                 */
+                if (get_nulls_value(node) != slot)
+                        goto restart;
+                rcu_read_unlock();
         }
-        local_bh_enable();
 }
 EXPORT_SYMBOL_GPL(inet_twsk_purge);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index b1fbe18feb5a..d9bc85751c74 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -51,8 +51,8 @@
  *  lookups performed with disabled BHs.
  *
  *  Serialisation issues.
- *  1.  Nodes may appear in the tree only with the pool write lock held.
- *  2.  Nodes may disappear from the tree only with the pool write lock held
+ *  1.  Nodes may appear in the tree only with the pool lock held.
+ *  2.  Nodes may disappear from the tree only with the pool lock held
  *      AND reference count being 0.
  *  3.  Nodes appears and disappears from unused node list only under
  *      "inet_peer_unused_lock".
@@ -63,27 +63,42 @@
  *              refcnt: atomically against modifications on other CPU;
  *                 usually under some other lock to prevent node disappearing
  *              dtime: unused node list lock
- *              v4daddr: unchangeable
- *              ip_id_count: idlock
+ *              daddr: unchangeable
+ *              ip_id_count: atomic value (no lock needed)
  */
 
-/* Exported for inet_getid inline function.  */
-DEFINE_SPINLOCK(inet_peer_idlock);
-
 static struct kmem_cache *peer_cachep __read_mostly;
 
 #define node_height(x) x->avl_height
-static struct inet_peer peer_fake_node = {
-        .avl_left       = &peer_fake_node,
-        .avl_right      = &peer_fake_node,
+
+#define peer_avl_empty ((struct inet_peer *)&peer_fake_node)
+#define peer_avl_empty_rcu ((struct inet_peer __rcu __force *)&peer_fake_node)
+static const struct inet_peer peer_fake_node = {
+        .avl_left       = peer_avl_empty_rcu,
+        .avl_right      = peer_avl_empty_rcu,
         .avl_height     = 0
 };
-#define peer_avl_empty (&peer_fake_node)
-static struct inet_peer *peer_root = peer_avl_empty;
-static DEFINE_RWLOCK(peer_pool_lock);
+
+struct inet_peer_base {
+        struct inet_peer __rcu *root;
+        spinlock_t      lock;
+        int             total;
+};
+
+static struct inet_peer_base v4_peers = {
+        .root           = peer_avl_empty_rcu,
+        .lock           = __SPIN_LOCK_UNLOCKED(v4_peers.lock),
+        .total          = 0,
+};
+
+static struct inet_peer_base v6_peers = {
+        .root           = peer_avl_empty_rcu,
+        .lock           = __SPIN_LOCK_UNLOCKED(v6_peers.lock),
+        .total          = 0,
+};
+
 #define PEER_MAXDEPTH 40 /* sufficient for about 2^27 nodes */
 
-static int peer_total;
 /* Exported for sysctl_net_ipv4.  */
 int inet_peer_threshold __read_mostly = 65536 + 128;    /* start to throw entries more
                                          * aggressively at this stage */
@@ -92,8 +107,13 @@ int inet_peer_maxttl __read_mostly = 10 * 60 * HZ;	/* usual time to live: 10 min
 int inet_peer_gc_mintime __read_mostly = 10 * HZ;
 int inet_peer_gc_maxtime __read_mostly = 120 * HZ;
 
-static LIST_HEAD(unused_peers);
-static DEFINE_SPINLOCK(inet_peer_unused_lock);
+static struct {
+        struct list_head        list;
+        spinlock_t              lock;
+} unused_peers = {
+        .list                   = LIST_HEAD_INIT(unused_peers.list),
+        .lock                   = __SPIN_LOCK_UNLOCKED(unused_peers.lock),
+};
 
 static void peer_check_expire(unsigned long dummy);
 static DEFINE_TIMER(peer_periodic_timer, peer_check_expire, 0, 0);
@@ -119,7 +139,7 @@ void __init inet_initpeers(void)
 
         peer_cachep = kmem_cache_create("inet_peer_cache",
                         sizeof(struct inet_peer),
-                        0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
+                        0, SLAB_HWCACHE_ALIGN | SLAB_PANIC,
                         NULL);
 
         /* All the timers, started at system startup tend
@@ -134,122 +154,194 @@ void __init inet_initpeers(void)
 /* Called with or without local BH being disabled. */
 static void unlink_from_unused(struct inet_peer *p)
 {
-        spin_lock_bh(&inet_peer_unused_lock);
-        list_del_init(&p->unused);
-        spin_unlock_bh(&inet_peer_unused_lock);
+        if (!list_empty(&p->unused)) {
+                spin_lock_bh(&unused_peers.lock);
+                list_del_init(&p->unused);
+                spin_unlock_bh(&unused_peers.lock);
+        }
+}
+
+static int addr_compare(const struct inetpeer_addr *a,
+                        const struct inetpeer_addr *b)
+{
+        int i, n = (a->family == AF_INET ? 1 : 4);
+
+        for (i = 0; i < n; i++) {
+                if (a->a6[i] == b->a6[i])
+                        continue;
+                if (a->a6[i] < b->a6[i])
+                        return -1;
+                return 1;
+        }
+
+        return 0;
 }
 
 /*
  * Called with local BH disabled and the pool lock held.
- * _stack is known to be NULL or not at compile time,
- * so compiler will optimize the if (_stack) tests.
  */
-#define lookup(_daddr, _stack)                                  \
+#define lookup(_daddr, _stack, _base)                           \
 ({                                                              \
-        struct inet_peer *u, **v;                               \
-        if (_stack != NULL) {                                   \
-                stackptr = _stack;                              \
-                *stackptr++ = &peer_root;                       \
-        }                                                       \
-        for (u = peer_root; u != peer_avl_empty; ) {            \
-                if (_daddr == u->v4daddr)                       \
+        struct inet_peer *u;                                    \
+        struct inet_peer __rcu **v;                             \
+                                                                \
+        stackptr = _stack;                                      \
+        *stackptr++ = &_base->root;                             \
+        for (u = rcu_dereference_protected(_base->root,         \
+                        lockdep_is_held(&_base->lock));         \
+             u != peer_avl_empty; ) {                           \
+                int cmp = addr_compare(_daddr, &u->daddr);      \
+                if (cmp == 0)                                   \
                         break;                                  \
-                if ((__force __u32)_daddr < (__force __u32)u->v4daddr)  \
+                if (cmp == -1)                                  \
                         v = &u->avl_left;                       \
                 else                                            \
                         v = &u->avl_right;                      \
-                if (_stack != NULL)                             \
-                        *stackptr++ = v;                        \
-                u = *v;                                         \
+                *stackptr++ = v;                                \
+                u = rcu_dereference_protected(*v,               \
+                        lockdep_is_held(&_base->lock));         \
         }                                                       \
         u;                                                      \
 })
 
-/* Called with local BH disabled and the pool write lock held. */
-#define lookup_rightempty(start)                                \
+/*
+ * Called with rcu_read_lock_bh()
+ * Because we hold no lock against a writer, its quite possible we fall
+ * in an endless loop.
+ * But every pointer we follow is guaranteed to be valid thanks to RCU.
+ * We exit from this function if number of links exceeds PEER_MAXDEPTH
+ */
+static struct inet_peer *lookup_rcu_bh(const struct inetpeer_addr *daddr,
+                                       struct inet_peer_base *base)
+{
+        struct inet_peer *u = rcu_dereference_bh(base->root);
+        int count = 0;
+
+        while (u != peer_avl_empty) {
+                int cmp = addr_compare(daddr, &u->daddr);
+                if (cmp == 0) {
+                        /* Before taking a reference, check if this entry was
+                         * deleted, unlink_from_pool() sets refcnt=-1 to make
+                         * distinction between an unused entry (refcnt=0) and
+                         * a freed one.
+                         */
+                        if (unlikely(!atomic_add_unless(&u->refcnt, 1, -1)))
+                                u = NULL;
+                        return u;
+                }
+                if (cmp == -1)
+                        u = rcu_dereference_bh(u->avl_left);
+                else
+                        u = rcu_dereference_bh(u->avl_right);
+                if (unlikely(++count == PEER_MAXDEPTH))
+                        break;
+        }
+        return NULL;
+}
+
+/* Called with local BH disabled and the pool lock held. */
+#define lookup_rightempty(start, base)                          \
 ({                                                              \
-        struct inet_peer *u, **v;                               \
+        struct inet_peer *u;                                    \
+        struct inet_peer __rcu **v;                             \
         *stackptr++ = &start->avl_left;                         \
         v = &start->avl_left;                                   \
-        for (u = *v; u->avl_right != peer_avl_empty; ) {        \
+        for (u = rcu_dereference_protected(*v,                  \
+                        lockdep_is_held(&base->lock));          \
+             u->avl_right != peer_avl_empty_rcu; ) {            \
                 v = &u->avl_right;                              \
                 *stackptr++ = v;                                \
-                u = *v;                                         \
+                u = rcu_dereference_protected(*v,               \
+                        lockdep_is_held(&base->lock));          \
         }                                                       \
         u;                                                      \
 })
 
-/* Called with local BH disabled and the pool write lock held.
+/* Called with local BH disabled and the pool lock held.
  * Variable names are the proof of operation correctness.
- * Look into mm/map_avl.c for more detail description of the ideas.  */
-static void peer_avl_rebalance(struct inet_peer **stack[],
-                struct inet_peer ***stackend)
+ * Look into mm/map_avl.c for more detail description of the ideas.
+ */
+static void peer_avl_rebalance(struct inet_peer __rcu **stack[],
+                               struct inet_peer __rcu ***stackend,
+                               struct inet_peer_base *base)
 {
-        struct inet_peer **nodep, *node, *l, *r;
+        struct inet_peer __rcu **nodep;
+        struct inet_peer *node, *l, *r;
         int lh, rh;
 
         while (stackend > stack) {
                 nodep = *--stackend;
-                node = *nodep;
-                l = node->avl_left;
-                r = node->avl_right;
+                node = rcu_dereference_protected(*nodep,
+                                lockdep_is_held(&base->lock));
+                l = rcu_dereference_protected(node->avl_left,
+                                lockdep_is_held(&base->lock));
+                r = rcu_dereference_protected(node->avl_right,
+                                lockdep_is_held(&base->lock));
                 lh = node_height(l);
                 rh = node_height(r);
                 if (lh > rh + 1) { /* l: RH+2 */
                         struct inet_peer *ll, *lr, *lrl, *lrr;
                         int lrh;
-                        ll = l->avl_left;
-                        lr = l->avl_right;
+                        ll = rcu_dereference_protected(l->avl_left,
+                                lockdep_is_held(&base->lock));
+                        lr = rcu_dereference_protected(l->avl_right,
+                                lockdep_is_held(&base->lock));
                         lrh = node_height(lr);
                         if (lrh <= node_height(ll)) {   /* ll: RH+1 */
-                                node->avl_left = lr;    /* lr: RH or RH+1 */
-                                node->avl_right = r;    /* r: RH */
+                                RCU_INIT_POINTER(node->avl_left, lr);   /* lr: RH or RH+1 */
+                                RCU_INIT_POINTER(node->avl_right, r);   /* r: RH */
                                 node->avl_height = lrh + 1; /* RH+1 or RH+2 */
-                                l->avl_left = ll;       /* ll: RH+1 */
-                                l->avl_right = node;    /* node: RH+1 or RH+2 */
+                                RCU_INIT_POINTER(l->avl_left, ll);       /* ll: RH+1 */
+                                RCU_INIT_POINTER(l->avl_right, node);   /* node: RH+1 or RH+2 */
                                 l->avl_height = node->avl_height + 1;
-                                *nodep = l;
+                                RCU_INIT_POINTER(*nodep, l);
                         } else { /* ll: RH, lr: RH+1 */
-                                lrl = lr->avl_left;     /* lrl: RH or RH-1 */
-                                lrr = lr->avl_right;    /* lrr: RH or RH-1 */
-                                node->avl_left = lrr;   /* lrr: RH or RH-1 */
-                                node->avl_right = r;    /* r: RH */
+                                lrl = rcu_dereference_protected(lr->avl_left,
+                                        lockdep_is_held(&base->lock));  /* lrl: RH or RH-1 */
+                                lrr = rcu_dereference_protected(lr->avl_right,
+                                        lockdep_is_held(&base->lock));  /* lrr: RH or RH-1 */
+                                RCU_INIT_POINTER(node->avl_left, lrr);  /* lrr: RH or RH-1 */
+                                RCU_INIT_POINTER(node->avl_right, r);   /* r: RH */
                                 node->avl_height = rh + 1; /* node: RH+1 */
-                                l->avl_left = ll;       /* ll: RH */
-                                l->avl_right = lrl;     /* lrl: RH or RH-1 */
+                                RCU_INIT_POINTER(l->avl_left, ll);      /* ll: RH */
+                                RCU_INIT_POINTER(l->avl_right, lrl);    /* lrl: RH or RH-1 */
                                 l->avl_height = rh + 1; /* l: RH+1 */
-                                lr->avl_left = l;       /* l: RH+1 */
-                                lr->avl_right = node;   /* node: RH+1 */
+                                RCU_INIT_POINTER(lr->avl_left, l);      /* l: RH+1 */
+                                RCU_INIT_POINTER(lr->avl_right, node);  /* node: RH+1 */
                                 lr->avl_height = rh + 2;
-                                *nodep = lr;
+                                RCU_INIT_POINTER(*nodep, lr);
                         }
                 } else if (rh > lh + 1) { /* r: LH+2 */
                         struct inet_peer *rr, *rl, *rlr, *rll;
                         int rlh;
-                        rr = r->avl_right;
-                        rl = r->avl_left;
+                        rr = rcu_dereference_protected(r->avl_right,
+                                lockdep_is_held(&base->lock));
+                        rl = rcu_dereference_protected(r->avl_left,
+                                lockdep_is_held(&base->lock));
                         rlh = node_height(rl);
                         if (rlh <= node_height(rr)) {   /* rr: LH+1 */
-                                node->avl_right = rl;   /* rl: LH or LH+1 */
-                                node->avl_left = l;     /* l: LH */
+                                RCU_INIT_POINTER(node->avl_right, rl);  /* rl: LH or LH+1 */
+                                RCU_INIT_POINTER(node->avl_left, l);    /* l: LH */
                                 node->avl_height = rlh + 1; /* LH+1 or LH+2 */
-                                r->avl_right = rr;      /* rr: LH+1 */
-                                r->avl_left = node;     /* node: LH+1 or LH+2 */
+                                RCU_INIT_POINTER(r->avl_right, rr);     /* rr: LH+1 */
+                                RCU_INIT_POINTER(r->avl_left, node);    /* node: LH+1 or LH+2 */
                                 r->avl_height = node->avl_height + 1;
-                                *nodep = r;
+                                RCU_INIT_POINTER(*nodep, r);
                         } else { /* rr: RH, rl: RH+1 */
-                                rlr = rl->avl_right;    /* rlr: LH or LH-1 */
-                                rll = rl->avl_left;     /* rll: LH or LH-1 */
-                                node->avl_right = rll;  /* rll: LH or LH-1 */
-                                node->avl_left = l;     /* l: LH */
+                                rlr = rcu_dereference_protected(rl->avl_right,
+                                        lockdep_is_held(&base->lock));  /* rlr: LH or LH-1 */
+                                rll = rcu_dereference_protected(rl->avl_left,
+                                        lockdep_is_held(&base->lock));  /* rll: LH or LH-1 */
+                                RCU_INIT_POINTER(node->avl_right, rll); /* rll: LH or LH-1 */
+                                RCU_INIT_POINTER(node->avl_left, l);    /* l: LH */
                                 node->avl_height = lh + 1; /* node: LH+1 */
-                                r->avl_right = rr;      /* rr: LH */
-                                r->avl_left = rlr;      /* rlr: LH or LH-1 */
+                                RCU_INIT_POINTER(r->avl_right, rr);     /* rr: LH */
+                                RCU_INIT_POINTER(r->avl_left, rlr);     /* rlr: LH or LH-1 */
                                 r->avl_height = lh + 1; /* r: LH+1 */
-                                rl->avl_right = r;      /* r: LH+1 */
-                                rl->avl_left = node;    /* node: LH+1 */
+                                RCU_INIT_POINTER(rl->avl_right, r);     /* r: LH+1 */
+                                RCU_INIT_POINTER(rl->avl_left, node);   /* node: LH+1 */
                                 rl->avl_height = lh + 2;
-                                *nodep = rl;
+                                RCU_INIT_POINTER(*nodep, rl);
                         }
                 } else {
                         node->avl_height = (lh > rh ? lh : rh) + 1;
@@ -257,88 +349,107 @@ static void peer_avl_rebalance(struct inet_peer **stack[],
         }
 }
 
-/* Called with local BH disabled and the pool write lock held. */
-#define link_to_pool(n)                                         \
+/* Called with local BH disabled and the pool lock held. */
+#define link_to_pool(n, base)                                   \
 do {                                                            \
         n->avl_height = 1;                                      \
-        n->avl_left = peer_avl_empty;                           \
-        n->avl_right = peer_avl_empty;                          \
-        **--stackptr = n;                                       \
-        peer_avl_rebalance(stack, stackptr);                    \
-} while(0)
+        n->avl_left = peer_avl_empty_rcu;                       \
+        n->avl_right = peer_avl_empty_rcu;                      \
+        /* lockless readers can catch us now */                 \
+        rcu_assign_pointer(**--stackptr, n);                    \
+        peer_avl_rebalance(stack, stackptr, base);              \
+} while (0)
+
+static void inetpeer_free_rcu(struct rcu_head *head)
+{
+        kmem_cache_free(peer_cachep, container_of(head, struct inet_peer, rcu));
+}
 
 /* May be called with local BH enabled. */
-static void unlink_from_pool(struct inet_peer *p)
+static void unlink_from_pool(struct inet_peer *p, struct inet_peer_base *base)
 {
         int do_free;
 
         do_free = 0;
 
-        write_lock_bh(&peer_pool_lock);
+        spin_lock_bh(&base->lock);
         /* Check the reference counter.  It was artificially incremented by 1
-         * in cleanup() function to prevent sudden disappearing.  If the
-         * reference count is still 1 then the node is referenced only as `p'
-         * here and from the pool.  So under the exclusive pool lock it's safe
-         * to remove the node and free it later. */
-        if (atomic_read(&p->refcnt) == 1) {
-                struct inet_peer **stack[PEER_MAXDEPTH];
-                struct inet_peer ***stackptr, ***delp;
-                if (lookup(p->v4daddr, stack) != p)
+         * in cleanup() function to prevent sudden disappearing.  If we can
+         * atomically (because of lockless readers) take this last reference,
+         * it's safe to remove the node and free it later.
+         * We use refcnt=-1 to alert lockless readers this entry is deleted.
+         */
+        if (atomic_cmpxchg(&p->refcnt, 1, -1) == 1) {
+                struct inet_peer __rcu **stack[PEER_MAXDEPTH];
+                struct inet_peer __rcu ***stackptr, ***delp;
+                if (lookup(&p->daddr, stack, base) != p)
                         BUG();
                 delp = stackptr - 1; /* *delp[0] == p */
-                if (p->avl_left == peer_avl_empty) {
+                if (p->avl_left == peer_avl_empty_rcu) {
                         *delp[0] = p->avl_right;
                         --stackptr;
                 } else {
                         /* look for a node to insert instead of p */
                         struct inet_peer *t;
-                        t = lookup_rightempty(p);
-                        BUG_ON(*stackptr[-1] != t);
+                        t = lookup_rightempty(p, base);
+                        BUG_ON(rcu_dereference_protected(*stackptr[-1],
+                                        lockdep_is_held(&base->lock)) != t);
                         **--stackptr = t->avl_left;
-                        /* t is removed, t->v4daddr > x->v4daddr for any
+                        /* t is removed, t->daddr > x->daddr for any
                          * x in p->avl_left subtree.
                          * Put t in the old place of p. */
-                        *delp[0] = t;
+                        RCU_INIT_POINTER(*delp[0], t);
                         t->avl_left = p->avl_left;
                         t->avl_right = p->avl_right;
                         t->avl_height = p->avl_height;
                         BUG_ON(delp[1] != &p->avl_left);
                         delp[1] = &t->avl_left; /* was &p->avl_left */
                 }
-                peer_avl_rebalance(stack, stackptr);
-                peer_total--;
+                peer_avl_rebalance(stack, stackptr, base);
+                base->total--;
                 do_free = 1;
         }
-        write_unlock_bh(&peer_pool_lock);
+        spin_unlock_bh(&base->lock);
 
         if (do_free)
-                kmem_cache_free(peer_cachep, p);
+                call_rcu_bh(&p->rcu, inetpeer_free_rcu);
         else
                 /* The node is used again.  Decrease the reference counter
                  * back.  The loop "cleanup -> unlink_from_unused
                  *   -> unlink_from_pool -> putpeer -> link_to_unused
                  *   -> cleanup (for the same node)"
                  * doesn't really exist because the entry will have a
-                 * recent deletion time and will not be cleaned again soon. */
+                 * recent deletion time and will not be cleaned again soon.
+                 */
                 inet_putpeer(p);
 }
 
+static struct inet_peer_base *family_to_base(int family)
+{
+        return (family == AF_INET ? &v4_peers : &v6_peers);
+}
+
+static struct inet_peer_base *peer_to_base(struct inet_peer *p)
+{
+        return family_to_base(p->daddr.family);
+}
+
 /* May be called with local BH enabled. */
 static int cleanup_once(unsigned long ttl)
 {
         struct inet_peer *p = NULL;
 
         /* Remove the first entry from the list of unused nodes. */
-        spin_lock_bh(&inet_peer_unused_lock);
-        if (!list_empty(&unused_peers)) {
+        spin_lock_bh(&unused_peers.lock);
+        if (!list_empty(&unused_peers.list)) {
                 __u32 delta;
 
-                p = list_first_entry(&unused_peers, struct inet_peer, unused);
+                p = list_first_entry(&unused_peers.list, struct inet_peer, unused);
                 delta = (__u32)jiffies - p->dtime;
 
                 if (delta < ttl) {
                         /* Do not prune fresh entries. */
-                        spin_unlock_bh(&inet_peer_unused_lock);
+                        spin_unlock_bh(&unused_peers.lock);
                         return -1;
                 }
 
@@ -348,7 +459,7 @@ static int cleanup_once(unsigned long ttl)
                  * before unlink_from_pool() call. */
                 atomic_inc(&p->refcnt);
         }
-        spin_unlock_bh(&inet_peer_unused_lock);
+        spin_unlock_bh(&unused_peers.lock);
 
         if (p == NULL)
                 /* It means that the total number of USED entries has
@@ -356,84 +467,86 @@ static int cleanup_once(unsigned long ttl)
                  * happen because of entry limits in route cache. */
                 return -1;
 
-        unlink_from_pool(p);
+        unlink_from_pool(p, peer_to_base(p));
         return 0;
 }
 
 /* Called with or without local BH being disabled. */
-struct inet_peer *inet_getpeer(__be32 daddr, int create)
+struct inet_peer *inet_getpeer(struct inetpeer_addr *daddr, int create)
 {
-        struct inet_peer *p, *n;
-        struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
+        struct inet_peer __rcu **stack[PEER_MAXDEPTH], ***stackptr;
+        struct inet_peer_base *base = family_to_base(AF_INET);
+        struct inet_peer *p;
 
-        /* Look up for the address quickly. */
-        read_lock_bh(&peer_pool_lock);
-        p = lookup(daddr, NULL);
-        if (p != peer_avl_empty)
-                atomic_inc(&p->refcnt);
-        read_unlock_bh(&peer_pool_lock);
+        /* Look up for the address quickly, lockless.
+         * Because of a concurrent writer, we might not find an existing entry.
+         */
+        rcu_read_lock_bh();
+        p = lookup_rcu_bh(daddr, base);
+        rcu_read_unlock_bh();
+
+        if (p) {
+                /* The existing node has been found.
+                 * Remove the entry from unused list if it was there.
+                 */
+                unlink_from_unused(p);
+                return p;
+        }
 
+        /* retry an exact lookup, taking the lock before.
+         * At least, nodes should be hot in our cache.
+         */
+        spin_lock_bh(&base->lock);
+        p = lookup(daddr, stack, base);
         if (p != peer_avl_empty) {
-                /* The existing node has been found. */
+                atomic_inc(&p->refcnt);
+                spin_unlock_bh(&base->lock);
                 /* Remove the entry from unused list if it was there. */
                 unlink_from_unused(p);
                 return p;
         }
+        p = create ? kmem_cache_alloc(peer_cachep, GFP_ATOMIC) : NULL;
+        if (p) {
+                p->daddr = *daddr;
+                atomic_set(&p->refcnt, 1);
+                atomic_set(&p->rid, 0);
+                atomic_set(&p->ip_id_count, secure_ip_id(daddr->a4));
+                p->tcp_ts_stamp = 0;
+                INIT_LIST_HEAD(&p->unused);
+
+
+                /* Link the node. */
+                link_to_pool(p, base);
+                base->total++;
+        }
+        spin_unlock_bh(&base->lock);
 
-        if (!create)
-                return NULL;
-
-        /* Allocate the space outside the locked region. */
-        n = kmem_cache_alloc(peer_cachep, GFP_ATOMIC);
-        if (n == NULL)
-                return NULL;
-        n->v4daddr = daddr;
-        atomic_set(&n->refcnt, 1);
-        atomic_set(&n->rid, 0);
-        n->ip_id_count = secure_ip_id(daddr);
-        n->tcp_ts_stamp = 0;
-
-        write_lock_bh(&peer_pool_lock);
-        /* Check if an entry has suddenly appeared. */
-        p = lookup(daddr, stack);
-        if (p != peer_avl_empty)
-                goto out_free;
-
-        /* Link the node. */
-        link_to_pool(n);
-        INIT_LIST_HEAD(&n->unused);
-        peer_total++;
-        write_unlock_bh(&peer_pool_lock);
-
-        if (peer_total >= inet_peer_threshold)
+        if (base->total >= inet_peer_threshold)
                 /* Remove one less-recently-used entry. */
                 cleanup_once(0);
 
-        return n;
-
-out_free:
-        /* The appropriate node is already in the pool. */
-        atomic_inc(&p->refcnt);
-        write_unlock_bh(&peer_pool_lock);
-        /* Remove the entry from unused list if it was there. */
-        unlink_from_unused(p);
-        /* Free preallocated the preallocated node. */
-        kmem_cache_free(peer_cachep, n);
         return p;
 }
 
+static int compute_total(void)
+{
+        return v4_peers.total + v6_peers.total;
+}
+EXPORT_SYMBOL_GPL(inet_getpeer);
+
 /* Called with local BH disabled. */
 static void peer_check_expire(unsigned long dummy)
 {
         unsigned long now = jiffies;
-        int ttl;
+        int ttl, total;
 
-        if (peer_total >= inet_peer_threshold)
+        total = compute_total();
+        if (total >= inet_peer_threshold)
                 ttl = inet_peer_minttl;
         else
                 ttl = inet_peer_maxttl
                                 - (inet_peer_maxttl - inet_peer_minttl) / HZ *
-                                        peer_total / inet_peer_threshold * HZ;
+                                        total / inet_peer_threshold * HZ;
         while (!cleanup_once(ttl)) {
                 if (jiffies != now)
                         break;
@@ -442,22 +555,27 @@ static void peer_check_expire(unsigned long dummy)
         /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
          * interval depending on the total number of entries (more entries,
          * less interval). */
-        if (peer_total >= inet_peer_threshold)
+        total = compute_total();
+        if (total >= inet_peer_threshold)
                 peer_periodic_timer.expires = jiffies + inet_peer_gc_mintime;
         else
                 peer_periodic_timer.expires = jiffies
                         + inet_peer_gc_maxtime
                         - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
-                                peer_total / inet_peer_threshold * HZ;
+                                total / inet_peer_threshold * HZ;
         add_timer(&peer_periodic_timer);
 }
 
 void inet_putpeer(struct inet_peer *p)
 {
-        spin_lock_bh(&inet_peer_unused_lock);
-        if (atomic_dec_and_test(&p->refcnt)) {
-                list_add_tail(&p->unused, &unused_peers);
+        local_bh_disable();
+
+        if (atomic_dec_and_lock(&p->refcnt, &unused_peers.lock)) {
+                list_add_tail(&p->unused, &unused_peers.list);
                 p->dtime = (__u32)jiffies;
+                spin_unlock(&unused_peers.lock);
         }
-        spin_unlock_bh(&inet_peer_unused_lock);
+
+        local_bh_enable();
 }
+EXPORT_SYMBOL_GPL(inet_putpeer);
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index a2991bc8e32e..99461f09320f 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -25,6 +25,7 @@
 #include <linux/ip.h>
 #include <linux/icmp.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/ip.h>
 #include <net/tcp.h>
@@ -86,16 +87,16 @@ int ip_forward(struct sk_buff *skb)
         if (opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
                 goto sr_failed;
 
-        if (unlikely(skb->len > dst_mtu(&rt->u.dst) && !skb_is_gso(skb) &&
+        if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) &&
                      (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
-                IP_INC_STATS(dev_net(rt->u.dst.dev), IPSTATS_MIB_FRAGFAILS);
+                IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS);
                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
-                          htonl(dst_mtu(&rt->u.dst)));
+                          htonl(dst_mtu(&rt->dst)));
                 goto drop;
         }
 
         /* We are about to mangle packet. Copy it! */
-        if (skb_cow(skb, LL_RESERVED_SPACE(rt->u.dst.dev)+rt->u.dst.header_len))
+        if (skb_cow(skb, LL_RESERVED_SPACE(rt->dst.dev)+rt->dst.header_len))
                 goto drop;
         iph = ip_hdr(skb);
 
@@ -111,8 +112,8 @@ int ip_forward(struct sk_buff *skb)
 
         skb->priority = rt_tos2priority(iph->tos);
 
-        return NF_HOOK(PF_INET, NF_INET_FORWARD, skb, skb->dev, rt->u.dst.dev,
-                       ip_forward_finish);
+        return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD, skb, skb->dev,
+                       rt->dst.dev, ip_forward_finish);
 
 sr_failed:
         /*
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 575f9bd51ccd..a1151b8adf3c 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -32,6 +32,9 @@
 #include <linux/netdevice.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
+#include <linux/slab.h>
+#include <net/route.h>
+#include <net/dst.h>
 #include <net/sock.h>
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -42,6 +45,7 @@
 #include <linux/udp.h>
 #include <linux/inet.h>
 #include <linux/netfilter_ipv4.h>
+#include <net/inet_ecn.h>
 
 /* NOTE. Logic of IP defragmentation is parallel to corresponding IPv6
  * code now. If you change something here, _PLEASE_ update ipv6/reassembly.c
@@ -67,11 +71,28 @@ struct ipq {
         __be32          daddr;
         __be16          id;
         u8              protocol;
+        u8              ecn; /* RFC3168 support */
         int             iif;
         unsigned int    rid;
         struct inet_peer *peer;
 };
 
+#define IPFRAG_ECN_CLEAR  0x01 /* one frag had INET_ECN_NOT_ECT */
+#define IPFRAG_ECN_SET_CE 0x04 /* one frag had INET_ECN_CE */
+
+static inline u8 ip4_frag_ecn(u8 tos)
+{
+        tos = (tos & INET_ECN_MASK) + 1;
+        /*
+         * After the last operation we have (in binary):
+         * INET_ECN_NOT_ECT => 001
+         * INET_ECN_ECT_1   => 010
+         * INET_ECN_ECT_0   => 011
+         * INET_ECN_CE      => 100
+         */
+        return (tos & 2) ? 0 : tos;
+}
+
 static struct inet_frags ip4_frags;
 
 int ip_frag_nqueues(struct net *net)
@@ -113,19 +134,16 @@ static int ip4_frag_match(struct inet_frag_queue *q, void *a)
         struct ip4_create_arg *arg = a;
 
         qp = container_of(q, struct ipq, q);
-        return (qp->id == arg->iph->id &&
+        return  qp->id == arg->iph->id &&
                         qp->saddr == arg->iph->saddr &&
                         qp->daddr == arg->iph->daddr &&
                         qp->protocol == arg->iph->protocol &&
-                        qp->user == arg->user);
+                        qp->user == arg->user;
 }
 
 /* Memory Tracking Functions. */
-static __inline__ void frag_kfree_skb(struct netns_frags *nf,
-                struct sk_buff *skb, int *work)
+static void frag_kfree_skb(struct netns_frags *nf, struct sk_buff *skb)
 {
-        if (work)
-                *work -= skb->truesize;
         atomic_sub(skb->truesize, &nf->mem);
         kfree_skb(skb);
 }
@@ -137,11 +155,12 @@ static void ip4_frag_init(struct inet_frag_queue *q, void *a)
 
         qp->protocol = arg->iph->protocol;
         qp->id = arg->iph->id;
+        qp->ecn = ip4_frag_ecn(arg->iph->tos);
         qp->saddr = arg->iph->saddr;
         qp->daddr = arg->iph->daddr;
         qp->user = arg->user;
         qp->peer = sysctl_ipfrag_max_dist ?
-                inet_getpeer(arg->iph->saddr, 1) : NULL;
+                inet_getpeer_v4(arg->iph->saddr, 1) : NULL;
 }
 
 static __inline__ void ip4_frag_free(struct inet_frag_queue *q)
@@ -205,11 +224,35 @@ static void ip_expire(unsigned long arg)
         if ((qp->q.last_in & INET_FRAG_FIRST_IN) && qp->q.fragments != NULL) {
                 struct sk_buff *head = qp->q.fragments;
 
-                /* Send an ICMP "Fragment Reassembly Timeout" message. */
-                if ((head->dev = dev_get_by_index(net, qp->iif)) != NULL) {
-                        icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
-                        dev_put(head->dev);
+                rcu_read_lock();
+                head->dev = dev_get_by_index_rcu(net, qp->iif);
+                if (!head->dev)
+                        goto out_rcu_unlock;
+
+                /*
+                 * Only search router table for the head fragment,
+                 * when defraging timeout at PRE_ROUTING HOOK.
+                 */
+                if (qp->user == IP_DEFRAG_CONNTRACK_IN && !skb_dst(head)) {
+                        const struct iphdr *iph = ip_hdr(head);
+                        int err = ip_route_input(head, iph->daddr, iph->saddr,
+                                                 iph->tos, head->dev);
+                        if (unlikely(err))
+                                goto out_rcu_unlock;
+
+                        /*
+                         * Only an end host needs to send an ICMP
+                         * "Fragment Reassembly Timeout" message, per RFC792.
+                         */
+                        if (skb_rtable(head)->rt_type != RTN_LOCAL)
+                                goto out_rcu_unlock;
+
                 }
+
+                /* Send an ICMP "Fragment Reassembly Timeout" message. */
+                icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
+out_rcu_unlock:
+                rcu_read_unlock();
         }
 out:
         spin_unlock(&qp->q.lock);
@@ -282,7 +325,7 @@ static int ip_frag_reinit(struct ipq *qp)
         fp = qp->q.fragments;
         do {
                 struct sk_buff *xp = fp->next;
-                frag_kfree_skb(qp->q.net, fp, NULL);
+                frag_kfree_skb(qp->q.net, fp);
                 fp = xp;
         } while (fp);
 
@@ -290,7 +333,9 @@ static int ip_frag_reinit(struct ipq *qp)
         qp->q.len = 0;
         qp->q.meat = 0;
         qp->q.fragments = NULL;
+        qp->q.fragments_tail = NULL;
         qp->iif = 0;
+        qp->ecn = 0;
 
         return 0;
 }
@@ -303,6 +348,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
         int flags, offset;
         int ihl, end;
         int err = -ENOENT;
+        u8 ecn;
 
         if (qp->q.last_in & INET_FRAG_COMPLETE)
                 goto err;
@@ -314,6 +360,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                 goto err;
         }
 
+        ecn = ip4_frag_ecn(ip_hdr(skb)->tos);
         offset = ntohs(ip_hdr(skb)->frag_off);
         flags = offset & ~IP_OFFSET;
         offset &= IP_OFFSET;
@@ -362,6 +409,11 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
          * in the chain of fragments so far.  We must know where to put
          * this fragment, right?
          */
+        prev = qp->q.fragments_tail;
+        if (!prev || FRAG_CB(prev)->offset < offset) {
+                next = NULL;
+                goto found;
+        }
         prev = NULL;
         for (next = qp->q.fragments; next != NULL; next = next->next) {
                 if (FRAG_CB(next)->offset >= offset)
@@ -369,6 +421,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                 prev = next;
         }
 
+found:
         /* We found where to put this one.  Check for overlap with
          * preceding fragment, and, if needed, align things so that
          * any overlaps are eliminated.
@@ -419,7 +472,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
                                 qp->q.fragments = next;
 
                         qp->q.meat -= free_it->len;
-                        frag_kfree_skb(qp->q.net, free_it, NULL);
+                        frag_kfree_skb(qp->q.net, free_it);
                 }
         }
 
@@ -427,6 +480,8 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
 
         /* Insert this fragment in the chain of fragments. */
         skb->next = next;
+        if (!next)
+                qp->q.fragments_tail = skb;
         if (prev)
                 prev->next = skb;
         else
@@ -439,6 +494,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
         }
         qp->q.stamp = skb->tstamp;
         qp->q.meat += skb->len;
+        qp->ecn |= ecn;
         atomic_add(skb->truesize, &qp->q.net->mem);
         if (offset == 0)
                 qp->q.last_in |= INET_FRAG_FIRST_IN;
@@ -480,6 +536,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                         goto out_nomem;
 
                 fp->next = head->next;
+                if (!fp->next)
+                        qp->q.fragments_tail = fp;
                 prev->next = fp;
 
                 skb_morph(head, qp->q.fragments);
@@ -507,7 +565,7 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
          * and the second, holding only fragments. */
-        if (skb_has_frags(head)) {
+        if (skb_has_frag_list(head)) {
                 struct sk_buff *clone;
                 int i, plen = 0;
 
@@ -529,7 +587,6 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
 
         skb_shinfo(head)->frag_list = head->next;
         skb_push(head, head->data - skb_network_header(head));
-        atomic_sub(head->truesize, &qp->q.net->mem);
 
         for (fp=head->next; fp; fp = fp->next) {
                 head->data_len += fp->len;
@@ -539,8 +596,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 else if (head->ip_summed == CHECKSUM_COMPLETE)
                         head->csum = csum_add(head->csum, fp->csum);
                 head->truesize += fp->truesize;
-                atomic_sub(fp->truesize, &qp->q.net->mem);
         }
+        atomic_sub(head->truesize, &qp->q.net->mem);
 
         head->next = NULL;
         head->dev = dev;
@@ -549,8 +606,20 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
         iph = ip_hdr(head);
         iph->frag_off = 0;
         iph->tot_len = htons(len);
+        /* RFC3168 5.3 Fragmentation support
+         * If one fragment had INET_ECN_NOT_ECT,
+         *      reassembled frame also has INET_ECN_NOT_ECT
+         * Elif one fragment had INET_ECN_CE
+         *      reassembled frame also has INET_ECN_CE
+         */
+        if (qp->ecn & IPFRAG_ECN_CLEAR)
+                iph->tos &= ~INET_ECN_MASK;
+        else if (qp->ecn & IPFRAG_ECN_SET_CE)
+                iph->tos |= INET_ECN_CE;
+
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
         qp->q.fragments = NULL;
+        qp->q.fragments_tail = NULL;
         return 0;
 
 out_nomem:
@@ -563,7 +632,7 @@ out_oversize:
                 printk(KERN_INFO "Oversized IP packet from %pI4.\n",
                         &qp->saddr);
 out_fail:
-        IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS);
+        IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
         return err;
 }
 
@@ -597,13 +666,13 @@ int ip_defrag(struct sk_buff *skb, u32 user)
         kfree_skb(skb);
         return -ENOMEM;
 }
+EXPORT_SYMBOL(ip_defrag);
 
 #ifdef CONFIG_SYSCTL
 static int zero;
 
 static struct ctl_table ip4_frags_ns_ctl_table[] = {
         {
-                .ctl_name       = NET_IPV4_IPFRAG_HIGH_THRESH,
                 .procname       = "ipfrag_high_thresh",
                 .data           = &init_net.ipv4.frags.high_thresh,
                 .maxlen         = sizeof(int),
@@ -611,7 +680,6 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_IPFRAG_LOW_THRESH,
                 .procname       = "ipfrag_low_thresh",
                 .data           = &init_net.ipv4.frags.low_thresh,
                 .maxlen         = sizeof(int),
@@ -619,26 +687,22 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_IPFRAG_TIME,
                 .procname       = "ipfrag_time",
                 .data           = &init_net.ipv4.frags.timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         { }
 };
 
 static struct ctl_table ip4_frags_ctl_table[] = {
         {
-                .ctl_name       = NET_IPV4_IPFRAG_SECRET_INTERVAL,
                 .procname       = "ipfrag_secret_interval",
                 .data           = &ip4_frags.secret_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
                 .procname       = "ipfrag_max_dist",
@@ -651,13 +715,13 @@ static struct ctl_table ip4_frags_ctl_table[] = {
         { }
 };
 
-static int ip4_frags_ns_ctl_register(struct net *net)
+static int __net_init ip4_frags_ns_ctl_register(struct net *net)
 {
         struct ctl_table *table;
         struct ctl_table_header *hdr;
 
         table = ip4_frags_ns_ctl_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 table = kmemdup(table, sizeof(ip4_frags_ns_ctl_table), GFP_KERNEL);
                 if (table == NULL)
                         goto err_alloc;
@@ -675,13 +739,13 @@ static int ip4_frags_ns_ctl_register(struct net *net)
         return 0;
 
 err_reg:
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 kfree(table);
 err_alloc:
         return -ENOMEM;
 }
 
-static void ip4_frags_ns_ctl_unregister(struct net *net)
+static void __net_exit ip4_frags_ns_ctl_unregister(struct net *net)
 {
         struct ctl_table *table;
 
@@ -709,7 +773,7 @@ static inline void ip4_frags_ctl_register(void)
 }
 #endif
 
-static int ipv4_frags_init_net(struct net *net)
+static int __net_init ipv4_frags_init_net(struct net *net)
 {
         /*
          * Fragment cache limits. We will commit 256K at one time. Should we
@@ -731,7 +795,7 @@ static int ipv4_frags_init_net(struct net *net)
         return ip4_frags_ns_ctl_register(net);
 }
 
-static void ipv4_frags_exit_net(struct net *net)
+static void __net_exit ipv4_frags_exit_net(struct net *net)
 {
         ip4_frags_ns_ctl_unregister(net);
         inet_frags_exit_net(&net->ipv4.frags, &ip4_frags);
@@ -756,5 +820,3 @@ void __init ipfrag_init(void)
         ip4_frags.secret_interval = 10 * 60 * HZ;
         inet_frags_init(&ip4_frags);
 }
-
-EXPORT_SYMBOL(ip_defrag);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 44e2a3d2359a..eb68a0e34e49 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
@@ -43,8 +44,9 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
+#include <net/gre.h>
 
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <net/ipv6.h>
 #include <net/ip6_fib.h>
 #include <net/ip6_route.h>
@@ -62,16 +64,13 @@
    We cannot track such dead loops during route installation,
    it is infeasible task. The most general solutions would be
    to keep skb->encapsulation counter (sort of local ttl),
-   and silently drop packet when it expires. It is the best
+   and silently drop packet when it expires. It is a good
    solution, but it supposes maintaing new variable in ALL
    skb, even if no tunneling is used.
 
-   Current solution: t->recursion lock breaks dead loops. It looks
-   like dev->tbusy flag, but I preferred new variable, because
-   the semantics is different. One day, when hard_start_xmit
-   will be multithreaded we will have to use skb->encapsulation.
-
-
+   Current solution: xmit_recursion breaks dead loops. This is a percpu
+   counter, since when we enter the first ndo_xmit(), cpu migration is
+   forbidden. We force an exit if this counter reaches RECURSION_LIMIT
 
    2. Networking dead loops would not kill routers, but would really
    kill network. IP hop limit plays role of "t->recursion" in this case,
@@ -128,9 +127,9 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev);
 
 #define HASH_SIZE  16
 
-static int ipgre_net_id;
+static int ipgre_net_id __read_mostly;
 struct ipgre_net {
-        struct ip_tunnel *tunnels[4][HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels[4][HASH_SIZE];
 
         struct net_device *fb_tunnel_dev;
 };
@@ -159,8 +158,40 @@ struct ipgre_net {
 #define tunnels_r       tunnels[2]
 #define tunnels_l       tunnels[1]
 #define tunnels_wc      tunnels[0]
+/*
+ * Locking : hash tables are protected by RCU and RTNL
+ */
 
-static DEFINE_RWLOCK(ipgre_lock);
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
+
+/* often modified stats are per cpu, other are shared (netdev->stats) */
+struct pcpu_tstats {
+        unsigned long   rx_packets;
+        unsigned long   rx_bytes;
+        unsigned long   tx_packets;
+        unsigned long   tx_bytes;
+};
+
+static struct net_device_stats *ipgre_get_stats(struct net_device *dev)
+{
+        struct pcpu_tstats sum = { 0 };
+        int i;
+
+        for_each_possible_cpu(i) {
+                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
+
+                sum.rx_packets += tstats->rx_packets;
+                sum.rx_bytes   += tstats->rx_bytes;
+                sum.tx_packets += tstats->tx_packets;
+                sum.tx_bytes   += tstats->tx_bytes;
+        }
+        dev->stats.rx_packets = sum.rx_packets;
+        dev->stats.rx_bytes   = sum.rx_bytes;
+        dev->stats.tx_packets = sum.tx_packets;
+        dev->stats.tx_bytes   = sum.tx_bytes;
+        return &dev->stats;
+}
 
 /* Given src, dst and key, find appropriate for input tunnel. */
 
@@ -170,15 +201,15 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
 {
         struct net *net = dev_net(dev);
         int link = dev->ifindex;
-        unsigned h0 = HASH(remote);
-        unsigned h1 = HASH(key);
+        unsigned int h0 = HASH(remote);
+        unsigned int h1 = HASH(key);
         struct ip_tunnel *t, *cand = NULL;
         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
         int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
                        ARPHRD_ETHER : ARPHRD_IPGRE;
         int score, cand_score = 4;
 
-        for (t = ign->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_r_l[h0 ^ h1]) {
                 if (local != t->parms.iph.saddr ||
                     remote != t->parms.iph.daddr ||
                     key != t->parms.i_key ||
@@ -203,7 +234,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_r[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_r[h0 ^ h1]) {
                 if (remote != t->parms.iph.daddr ||
                     key != t->parms.i_key ||
                     !(t->dev->flags & IFF_UP))
@@ -227,7 +258,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_l[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_l[h1]) {
                 if ((local != t->parms.iph.saddr &&
                      (local != t->parms.iph.daddr ||
                       !ipv4_is_multicast(local))) ||
@@ -253,7 +284,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_wc[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_wc[h1]) {
                 if (t->parms.i_key != key ||
                     !(t->dev->flags & IFF_UP))
                         continue;
@@ -279,19 +310,20 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
         if (cand != NULL)
                 return cand;
 
-        if (ign->fb_tunnel_dev->flags & IFF_UP)
-                return netdev_priv(ign->fb_tunnel_dev);
+        dev = ign->fb_tunnel_dev;
+        if (dev->flags & IFF_UP)
+                return netdev_priv(dev);
 
         return NULL;
 }
 
-static struct ip_tunnel **__ipgre_bucket(struct ipgre_net *ign,
+static struct ip_tunnel __rcu **__ipgre_bucket(struct ipgre_net *ign,
                 struct ip_tunnel_parm *parms)
 {
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
         __be32 key = parms->i_key;
-        unsigned h = HASH(key);
+        unsigned int h = HASH(key);
         int prio = 0;
 
         if (local)
@@ -304,7 +336,7 @@ static struct ip_tunnel **__ipgre_bucket(struct ipgre_net *ign,
         return &ign->tunnels[prio][h];
 }
 
-static inline struct ip_tunnel **ipgre_bucket(struct ipgre_net *ign,
+static inline struct ip_tunnel __rcu **ipgre_bucket(struct ipgre_net *ign,
                 struct ip_tunnel *t)
 {
         return __ipgre_bucket(ign, &t->parms);
@@ -312,23 +344,22 @@ static inline struct ip_tunnel **ipgre_bucket(struct ipgre_net *ign,
 
 static void ipgre_tunnel_link(struct ipgre_net *ign, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp = ipgre_bucket(ign, t);
+        struct ip_tunnel __rcu **tp = ipgre_bucket(ign, t);
 
-        t->next = *tp;
-        write_lock_bh(&ipgre_lock);
-        *tp = t;
-        write_unlock_bh(&ipgre_lock);
+        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
+        rcu_assign_pointer(*tp, t);
 }
 
 static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp;
-
-        for (tp = ipgre_bucket(ign, t); *tp; tp = &(*tp)->next) {
-                if (t == *tp) {
-                        write_lock_bh(&ipgre_lock);
-                        *tp = t->next;
-                        write_unlock_bh(&ipgre_lock);
+        struct ip_tunnel __rcu **tp;
+        struct ip_tunnel *iter;
+
+        for (tp = ipgre_bucket(ign, t);
+             (iter = rtnl_dereference(*tp)) != NULL;
+             tp = &iter->next) {
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
                         break;
                 }
         }
@@ -342,10 +373,13 @@ static struct ip_tunnel *ipgre_tunnel_find(struct net *net,
         __be32 local = parms->iph.saddr;
         __be32 key = parms->i_key;
         int link = parms->link;
-        struct ip_tunnel *t, **tp;
+        struct ip_tunnel *t;
+        struct ip_tunnel __rcu **tp;
         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
 
-        for (tp = __ipgre_bucket(ign, parms); (t = *tp) != NULL; tp = &t->next)
+        for (tp = __ipgre_bucket(ign, parms);
+             (t = rtnl_dereference(*tp)) != NULL;
+             tp = &t->next)
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
                     key == t->parms.i_key &&
@@ -356,7 +390,7 @@ static struct ip_tunnel *ipgre_tunnel_find(struct net *net,
         return t;
 }
 
-static struct ip_tunnel * ipgre_tunnel_locate(struct net *net,
+static struct ip_tunnel *ipgre_tunnel_locate(struct net *net,
                 struct ip_tunnel_parm *parms, int create)
 {
         struct ip_tunnel *t, *nt;
@@ -371,11 +405,11 @@ static struct ip_tunnel * ipgre_tunnel_locate(struct net *net,
         if (parms->name[0])
                 strlcpy(name, parms->name, IFNAMSIZ);
         else
-                sprintf(name, "gre%%d");
+                strcpy(name, "gre%d");
 
         dev = alloc_netdev(sizeof(*t), name, ipgre_tunnel_setup);
         if (!dev)
-          return NULL;
+                return NULL;
 
         dev_net_set(dev, net);
 
@@ -479,7 +513,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 break;
         }
 
-        read_lock(&ipgre_lock);
+        rcu_read_lock();
         t = ipgre_tunnel_lookup(skb->dev, iph->daddr, iph->saddr,
                                 flags & GRE_KEY ?
                                 *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
@@ -497,8 +531,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipgre_lock);
-        return;
+        rcu_read_unlock();
 }
 
 static inline void ipgre_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
@@ -534,7 +567,6 @@ static int ipgre_rcv(struct sk_buff *skb)
         struct ip_tunnel *tunnel;
         int    offset = 4;
         __be16 gre_proto;
-        unsigned int len;
 
         if (!pskb_may_pull(skb, 16))
                 goto drop_nolock;
@@ -576,11 +608,11 @@ static int ipgre_rcv(struct sk_buff *skb)
 
         gre_proto = *(__be16 *)(h + 2);
 
-        read_lock(&ipgre_lock);
+        rcu_read_lock();
         if ((tunnel = ipgre_tunnel_lookup(skb->dev,
                                           iph->saddr, iph->daddr, key,
                                           gre_proto))) {
-                struct net_device_stats *stats = &tunnel->dev->stats;
+                struct pcpu_tstats *tstats;
 
                 secpath_reset(skb);
 
@@ -602,36 +634,34 @@ static int ipgre_rcv(struct sk_buff *skb)
 #ifdef CONFIG_NET_IPGRE_BROADCAST
                 if (ipv4_is_multicast(iph->daddr)) {
                         /* Looped back packet, drop it! */
-                        if (skb_rtable(skb)->fl.iif == 0)
+                        if (rt_is_output_route(skb_rtable(skb)))
                                 goto drop;
-                        stats->multicast++;
+                        tunnel->dev->stats.multicast++;
                         skb->pkt_type = PACKET_BROADCAST;
                 }
 #endif
 
                 if (((flags&GRE_CSUM) && csum) ||
                     (!(flags&GRE_CSUM) && tunnel->parms.i_flags&GRE_CSUM)) {
-                        stats->rx_crc_errors++;
-                        stats->rx_errors++;
+                        tunnel->dev->stats.rx_crc_errors++;
+                        tunnel->dev->stats.rx_errors++;
                         goto drop;
                 }
                 if (tunnel->parms.i_flags&GRE_SEQ) {
                         if (!(flags&GRE_SEQ) ||
                             (tunnel->i_seqno && (s32)(seqno - tunnel->i_seqno) < 0)) {
-                                stats->rx_fifo_errors++;
-                                stats->rx_errors++;
+                                tunnel->dev->stats.rx_fifo_errors++;
+                                tunnel->dev->stats.rx_errors++;
                                 goto drop;
                         }
                         tunnel->i_seqno = seqno + 1;
                 }
 
-                len = skb->len;
-
                 /* Warning: All skb pointers will be invalidated! */
                 if (tunnel->dev->type == ARPHRD_ETHER) {
                         if (!pskb_may_pull(skb, ETH_HLEN)) {
-                                stats->rx_length_errors++;
-                                stats->rx_errors++;
+                                tunnel->dev->stats.rx_length_errors++;
+                                tunnel->dev->stats.rx_errors++;
                                 goto drop;
                         }
 
@@ -640,49 +670,45 @@ static int ipgre_rcv(struct sk_buff *skb)
                         skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
                 }
 
-                stats->rx_packets++;
-                stats->rx_bytes += len;
-                skb->dev = tunnel->dev;
-                skb_dst_drop(skb);
-                nf_reset(skb);
+                tstats = this_cpu_ptr(tunnel->dev->tstats);
+                tstats->rx_packets++;
+                tstats->rx_bytes += skb->len;
+
+                __skb_tunnel_rx(skb, tunnel->dev);
 
                 skb_reset_network_header(skb);
                 ipgre_ecn_decapsulate(iph, skb);
 
                 netif_rx(skb);
-                read_unlock(&ipgre_lock);
-                return(0);
+
+                rcu_read_unlock();
+                return 0;
         }
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 
 drop:
-        read_unlock(&ipgre_lock);
+        rcu_read_unlock();
 drop_nolock:
         kfree_skb(skb);
-        return(0);
+        return 0;
 }
 
-static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct pcpu_tstats *tstats;
         struct iphdr  *old_iph = ip_hdr(skb);
         struct iphdr  *tiph;
         u8     tos;
         __be16 df;
         struct rtable *rt;                      /* Route to the other host */
-        struct net_device *tdev;                        /* Device to other host */
+        struct net_device *tdev;                /* Device to other host */
         struct iphdr  *iph;                     /* Our new IP header */
         unsigned int max_headroom;              /* The extra header space needed */
         int    gre_hlen;
         __be32 dst;
         int    mtu;
 
-        if (tunnel->recursion++) {
-                stats->collisions++;
-                goto tx_error;
-        }
-
         if (dev->type == ARPHRD_ETHER)
                 IPCB(skb)->flags = 0;
 
@@ -698,7 +724,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 /* NBMA tunnel */
 
                 if (skb_dst(skb) == NULL) {
-                        stats->tx_fifo_errors++;
+                        dev->stats.tx_fifo_errors++;
                         goto tx_error;
                 }
 
@@ -707,7 +733,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         if ((dst = rt->rt_gateway) == 0)
                                 goto tx_error_icmp;
                 }
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (skb->protocol == htons(ETH_P_IPV6)) {
                         struct in6_addr *addr6;
                         int addr_type;
@@ -735,35 +761,38 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         tos = tiph->tos;
-        if (tos&1) {
+        if (tos == 1) {
+                tos = 0;
                 if (skb->protocol == htons(ETH_P_IP))
                         tos = old_iph->tos;
-                tos &= ~1;
+                else if (skb->protocol == htons(ETH_P_IPV6))
+                        tos = ipv6_get_dsfield((struct ipv6hdr *)old_iph);
         }
 
         {
-                struct flowi fl = { .oif = tunnel->parms.link,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = dst,
-                                                .saddr = tiph->saddr,
-                                                .tos = RT_TOS(tos) } },
-                                    .proto = IPPROTO_GRE };
+                struct flowi fl = {
+                        .oif = tunnel->parms.link,
+                        .fl4_dst = dst,
+                        .fl4_src = tiph->saddr,
+                        .fl4_tos = RT_TOS(tos),
+                        .fl_gre_key = tunnel->parms.o_key
+                };
                 if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
-                        stats->tx_carrier_errors++;
+                        dev->stats.tx_carrier_errors++;
                         goto tx_error;
                 }
         }
-        tdev = rt->u.dst.dev;
+        tdev = rt->dst.dev;
 
         if (tdev == dev) {
                 ip_rt_put(rt);
-                stats->collisions++;
+                dev->stats.collisions++;
                 goto tx_error;
         }
 
         df = tiph->frag_off;
         if (df)
-                mtu = dst_mtu(&rt->u.dst) - dev->hard_header_len - tunnel->hlen;
+                mtu = dst_mtu(&rt->dst) - dev->hard_header_len - tunnel->hlen;
         else
                 mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
 
@@ -780,7 +809,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         goto tx_error;
                 }
         }
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         else if (skb->protocol == htons(ETH_P_IPV6)) {
                 struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
 
@@ -789,12 +818,12 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                              !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
                             rt6->rt6i_dst.plen == 128) {
                                 rt6->rt6i_flags |= RTF_MODIFIED;
-                                skb_dst(skb)->metrics[RTAX_MTU-1] = mtu;
+                                dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
                         }
                 }
 
                 if (mtu >= IPV6_MIN_MTU && mtu < skb->len - tunnel->hlen + gre_hlen) {
-                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                         ip_rt_put(rt);
                         goto tx_error;
                 }
@@ -811,17 +840,18 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         tunnel->err_count = 0;
         }
 
-        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen;
+        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + rt->dst.header_len;
 
         if (skb_headroom(skb) < max_headroom || skb_shared(skb)||
             (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
+                if (max_headroom > dev->needed_headroom)
+                        dev->needed_headroom = max_headroom;
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        dev->stats.tx_dropped++;
                         dev_kfree_skb(skb);
-                        tunnel->recursion--;
-                        return 0;
+                        return NETDEV_TX_OK;
                 }
                 if (skb->sk)
                         skb_set_owner_w(new_skb, skb->sk);
@@ -837,7 +867,7 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
                               IPSKB_REROUTED);
         skb_dst_drop(skb);
-        skb_dst_set(skb, &rt->u.dst);
+        skb_dst_set(skb, &rt->dst);
 
         /*
          *      Push down and install the IPIP header.
@@ -855,12 +885,12 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         if ((iph->ttl = tiph->ttl) == 0) {
                 if (skb->protocol == htons(ETH_P_IP))
                         iph->ttl = old_iph->ttl;
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (skb->protocol == htons(ETH_P_IPV6))
                         iph->ttl = ((struct ipv6hdr *)old_iph)->hop_limit;
 #endif
                 else
-                        iph->ttl = dst_metric(&rt->u.dst, RTAX_HOPLIMIT);
+                        iph->ttl = ip4_dst_hoplimit(&rt->dst);
         }
 
         ((__be16 *)(iph + 1))[0] = tunnel->parms.o_flags;
@@ -886,19 +916,17 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         nf_reset(skb);
-
-        IPTUNNEL_XMIT();
-        tunnel->recursion--;
-        return 0;
+        tstats = this_cpu_ptr(dev->tstats);
+        __IPTUNNEL_XMIT(tstats, &dev->stats);
+        return NETDEV_TX_OK;
 
 tx_error_icmp:
         dst_link_failure(skb);
 
 tx_error:
-        stats->tx_errors++;
+        dev->stats.tx_errors++;
         dev_kfree_skb(skb);
-        tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static int ipgre_tunnel_bind_dev(struct net_device *dev)
@@ -916,15 +944,18 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
         /* Guess output device to choose reasonable mtu and needed_headroom */
 
         if (iph->daddr) {
-                struct flowi fl = { .oif = tunnel->parms.link,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = iph->daddr,
-                                                .saddr = iph->saddr,
-                                                .tos = RT_TOS(iph->tos) } },
-                                    .proto = IPPROTO_GRE };
+                struct flowi fl = {
+                        .oif = tunnel->parms.link,
+                        .fl4_dst = iph->daddr,
+                        .fl4_src = iph->saddr,
+                        .fl4_tos = RT_TOS(iph->tos),
+                        .proto = IPPROTO_GRE,
+                        .fl_gre_key = tunnel->parms.o_key
+                };
                 struct rtable *rt;
+
                 if (!ip_route_output_key(dev_net(dev), &rt, &fl)) {
-                        tdev = rt->u.dst.dev;
+                        tdev = rt->dst.dev;
                         ip_rt_put(rt);
                 }
 
@@ -951,7 +982,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
                         addend += 4;
         }
         dev->needed_headroom = addend + hlen;
-        mtu -= dev->hard_header_len - addend;
+        mtu -= dev->hard_header_len + addend;
 
         if (mtu < 68)
                 mtu = 68;
@@ -1019,7 +1050,7 @@ ipgre_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                                         break;
                                 }
                         } else {
-                                unsigned nflags = 0;
+                                unsigned int nflags = 0;
 
                                 t = netdev_priv(dev);
 
@@ -1033,6 +1064,7 @@ ipgre_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                                         break;
                                 }
                                 ipgre_tunnel_unlink(ign, t);
+                                synchronize_net();
                                 t->parms.iph.saddr = p.iph.saddr;
                                 t->parms.iph.daddr = p.iph.daddr;
                                 t->parms.i_key = p.i_key;
@@ -1132,7 +1164,7 @@ static int ipgre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 
 static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
                         unsigned short type,
-                        const void *daddr, const void *saddr, unsigned len)
+                        const void *daddr, const void *saddr, unsigned int len)
 {
         struct ip_tunnel *t = netdev_priv(dev);
         struct iphdr *iph = (struct iphdr *)skb_push(skb, t->hlen);
@@ -1148,12 +1180,9 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
 
         if (saddr)
                 memcpy(&iph->saddr, saddr, 4);
-
-        if (daddr) {
+        if (daddr)
                 memcpy(&iph->daddr, daddr, 4);
-                return t->hlen;
-        }
-        if (iph->daddr && !ipv4_is_multicast(iph->daddr))
+        if (iph->daddr)
                 return t->hlen;
 
         return -t->hlen;
@@ -1177,16 +1206,19 @@ static int ipgre_open(struct net_device *dev)
         struct ip_tunnel *t = netdev_priv(dev);
 
         if (ipv4_is_multicast(t->parms.iph.daddr)) {
-                struct flowi fl = { .oif = t->parms.link,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = t->parms.iph.daddr,
-                                                .saddr = t->parms.iph.saddr,
-                                                .tos = RT_TOS(t->parms.iph.tos) } },
-                                    .proto = IPPROTO_GRE };
+                struct flowi fl = {
+                        .oif = t->parms.link,
+                        .fl4_dst = t->parms.iph.daddr,
+                        .fl4_src = t->parms.iph.saddr,
+                        .fl4_tos = RT_TOS(t->parms.iph.tos),
+                        .proto = IPPROTO_GRE,
+                        .fl_gre_key = t->parms.o_key
+                };
                 struct rtable *rt;
+
                 if (ip_route_output_key(dev_net(dev), &rt, &fl))
                         return -EADDRNOTAVAIL;
-                dev = rt->u.dst.dev;
+                dev = rt->dst.dev;
                 ip_rt_put(rt);
                 if (__in_dev_get_rtnl(dev) == NULL)
                         return -EADDRNOTAVAIL;
@@ -1203,10 +1235,8 @@ static int ipgre_close(struct net_device *dev)
         if (ipv4_is_multicast(t->parms.iph.daddr) && t->mlink) {
                 struct in_device *in_dev;
                 in_dev = inetdev_by_index(dev_net(dev), t->mlink);
-                if (in_dev) {
+                if (in_dev)
                         ip_mc_dec_group(in_dev, t->parms.iph.daddr);
-                        in_dev_put(in_dev);
-                }
         }
         return 0;
 }
@@ -1223,12 +1253,19 @@ static const struct net_device_ops ipgre_netdev_ops = {
         .ndo_start_xmit         = ipgre_tunnel_xmit,
         .ndo_do_ioctl           = ipgre_tunnel_ioctl,
         .ndo_change_mtu         = ipgre_tunnel_change_mtu,
+        .ndo_get_stats          = ipgre_get_stats,
 };
 
+static void ipgre_dev_free(struct net_device *dev)
+{
+        free_percpu(dev->tstats);
+        free_netdev(dev);
+}
+
 static void ipgre_tunnel_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &ipgre_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->destructor         = ipgre_dev_free;
 
         dev->type               = ARPHRD_IPGRE;
         dev->needed_headroom    = LL_MAX_HEADER + sizeof(struct iphdr) + 4;
@@ -1266,6 +1303,10 @@ static int ipgre_tunnel_init(struct net_device *dev)
         } else
                 dev->header_ops = &ipgre_header_ops;
 
+        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        if (!dev->tstats)
+                return -ENOMEM;
+
         return 0;
 }
 
@@ -1273,7 +1314,6 @@ static void ipgre_fb_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct iphdr *iph = &tunnel->parms.iph;
-        struct ipgre_net *ign = net_generic(dev_net(dev), ipgre_net_id);
 
         tunnel->dev = dev;
         strcpy(tunnel->parms.name, dev->name);
@@ -1284,17 +1324,15 @@ static void ipgre_fb_tunnel_init(struct net_device *dev)
         tunnel->hlen            = sizeof(struct iphdr) + 4;
 
         dev_hold(dev);
-        ign->tunnels_wc[0]      = tunnel;
 }
 
 
-static struct net_protocol ipgre_protocol = {
-        .handler        =       ipgre_rcv,
-        .err_handler    =       ipgre_err,
-        .netns_ok       =       1,
+static const struct gre_protocol ipgre_protocol = {
+        .handler     = ipgre_rcv,
+        .err_handler = ipgre_err,
 };
 
-static void ipgre_destroy_tunnels(struct ipgre_net *ign)
+static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
 {
         int prio;
 
@@ -1302,25 +1340,21 @@ static void ipgre_destroy_tunnels(struct ipgre_net *ign)
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
                         struct ip_tunnel *t;
-                        while ((t = ign->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+
+                        t = rtnl_dereference(ign->tunnels[prio][h]);
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = rtnl_dereference(t->next);
+                        }
                 }
         }
 }
 
-static int ipgre_init_net(struct net *net)
+static int __net_init ipgre_init_net(struct net *net)
 {
+        struct ipgre_net *ign = net_generic(net, ipgre_net_id);
         int err;
-        struct ipgre_net *ign;
-
-        err = -ENOMEM;
-        ign = kzalloc(sizeof(struct ipgre_net), GFP_KERNEL);
-        if (ign == NULL)
-                goto err_alloc;
-
-        err = net_assign_generic(net, ipgre_net_id, ign);
-        if (err < 0)
-                goto err_assign;
 
         ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "gre0",
                                            ipgre_tunnel_setup);
@@ -1336,32 +1370,33 @@ static int ipgre_init_net(struct net *net)
         if ((err = register_netdev(ign->fb_tunnel_dev)))
                 goto err_reg_dev;
 
+        rcu_assign_pointer(ign->tunnels_wc[0],
+                           netdev_priv(ign->fb_tunnel_dev));
         return 0;
 
 err_reg_dev:
-        free_netdev(ign->fb_tunnel_dev);
+        ipgre_dev_free(ign->fb_tunnel_dev);
 err_alloc_dev:
-        /* nothing */
-err_assign:
-        kfree(ign);
-err_alloc:
         return err;
 }
 
-static void ipgre_exit_net(struct net *net)
+static void __net_exit ipgre_exit_net(struct net *net)
 {
         struct ipgre_net *ign;
+        LIST_HEAD(list);
 
         ign = net_generic(net, ipgre_net_id);
         rtnl_lock();
-        ipgre_destroy_tunnels(ign);
+        ipgre_destroy_tunnels(ign, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
-        kfree(ign);
 }
 
 static struct pernet_operations ipgre_net_ops = {
         .init = ipgre_init_net,
         .exit = ipgre_exit_net,
+        .id   = &ipgre_net_id,
+        .size = sizeof(struct ipgre_net),
 };
 
 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
@@ -1458,6 +1493,10 @@ static int ipgre_tap_init(struct net_device *dev)
 
         ipgre_tunnel_bind_dev(dev);
 
+        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        if (!dev->tstats)
+                return -ENOMEM;
+
         return 0;
 }
 
@@ -1468,6 +1507,7 @@ static const struct net_device_ops ipgre_tap_netdev_ops = {
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_change_mtu         = ipgre_tunnel_change_mtu,
+        .ndo_get_stats          = ipgre_get_stats,
 };
 
 static void ipgre_tap_setup(struct net_device *dev)
@@ -1475,14 +1515,14 @@ static void ipgre_tap_setup(struct net_device *dev)
 
         ether_setup(dev);
 
-        dev->netdev_ops         = &ipgre_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->netdev_ops         = &ipgre_tap_netdev_ops;
+        dev->destructor         = ipgre_dev_free;
 
         dev->iflink             = 0;
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
-static int ipgre_newlink(struct net_device *dev, struct nlattr *tb[],
+static int ipgre_newlink(struct net *src_net, struct net_device *dev, struct nlattr *tb[],
                          struct nlattr *data[])
 {
         struct ip_tunnel *nt;
@@ -1504,6 +1544,10 @@ static int ipgre_newlink(struct net_device *dev, struct nlattr *tb[],
         if (!tb[IFLA_MTU])
                 dev->mtu = mtu;
 
+        /* Can use a lockless transmit, unless we generate output sequences */
+        if (!(nt->parms.o_flags & GRE_SEQ))
+                dev->features |= NETIF_F_LLTX;
+
         err = register_netdevice(dev);
         if (err)
                 goto out;
@@ -1536,25 +1580,29 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
                 if (t->dev != dev)
                         return -EEXIST;
         } else {
-                unsigned nflags = 0;
-
                 t = nt;
 
-                if (ipv4_is_multicast(p.iph.daddr))
-                        nflags = IFF_BROADCAST;
-                else if (p.iph.daddr)
-                        nflags = IFF_POINTOPOINT;
+                if (dev->type != ARPHRD_ETHER) {
+                        unsigned int nflags = 0;
 
-                if ((dev->flags ^ nflags) &
-                    (IFF_POINTOPOINT | IFF_BROADCAST))
-                        return -EINVAL;
+                        if (ipv4_is_multicast(p.iph.daddr))
+                                nflags = IFF_BROADCAST;
+                        else if (p.iph.daddr)
+                                nflags = IFF_POINTOPOINT;
+
+                        if ((dev->flags ^ nflags) &
+                            (IFF_POINTOPOINT | IFF_BROADCAST))
+                                return -EINVAL;
+                }
 
                 ipgre_tunnel_unlink(ign, t);
                 t->parms.iph.saddr = p.iph.saddr;
                 t->parms.iph.daddr = p.iph.daddr;
                 t->parms.i_key = p.i_key;
-                memcpy(dev->dev_addr, &p.iph.saddr, 4);
-                memcpy(dev->broadcast, &p.iph.daddr, 4);
+                if (dev->type != ARPHRD_ETHER) {
+                        memcpy(dev->dev_addr, &p.iph.saddr, 4);
+                        memcpy(dev->broadcast, &p.iph.daddr, 4);
+                }
                 ipgre_tunnel_link(ign, t);
                 netdev_state_change(dev);
         }
@@ -1672,15 +1720,16 @@ static int __init ipgre_init(void)
 
         printk(KERN_INFO "GRE over IPv4 tunneling driver\n");
 
-        if (inet_add_protocol(&ipgre_protocol, IPPROTO_GRE) < 0) {
+        err = register_pernet_device(&ipgre_net_ops);
+        if (err < 0)
+                return err;
+
+        err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO);
+        if (err < 0) {
                 printk(KERN_INFO "ipgre init: can't add protocol\n");
-                return -EAGAIN;
+                goto add_proto_failed;
         }
 
-        err = register_pernet_gen_device(&ipgre_net_id, &ipgre_net_ops);
-        if (err < 0)
-                goto gen_device_failed;
-
         err = rtnl_link_register(&ipgre_link_ops);
         if (err < 0)
                 goto rtnl_link_failed;
@@ -1695,9 +1744,9 @@ out:
 tap_ops_failed:
         rtnl_link_unregister(&ipgre_link_ops);
 rtnl_link_failed:
-        unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
-gen_device_failed:
-        inet_del_protocol(&ipgre_protocol, IPPROTO_GRE);
+        gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
+add_proto_failed:
+        unregister_pernet_device(&ipgre_net_ops);
         goto out;
 }
 
@@ -1705,9 +1754,9 @@ static void __exit ipgre_fini(void)
 {
         rtnl_link_unregister(&ipgre_tap_ops);
         rtnl_link_unregister(&ipgre_link_ops);
-        unregister_pernet_gen_device(ipgre_net_id, &ipgre_net_ops);
-        if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0)
+        if (gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO) < 0)
                 printk(KERN_INFO "ipgre close: can't remove protocol\n");
+        unregister_pernet_device(&ipgre_net_ops);
 }
 
 module_init(ipgre_init);
@@ -1715,3 +1764,4 @@ module_exit(ipgre_fini);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_RTNL_LINK("gre");
 MODULE_ALIAS_RTNL_LINK("gretap");
+MODULE_ALIAS("gre0");
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 490ce20faf38..d859bcc26cb7 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -119,6 +119,7 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/errno.h>
+#include <linux/slab.h>
 
 #include <linux/net.h>
 #include <linux/socket.h>
@@ -145,7 +146,7 @@
 #include <linux/netlink.h>
 
 /*
- *      Process Router Attention IP option
+ *      Process Router Attention IP option (RFC 2113)
  */
 int ip_call_ra_chain(struct sk_buff *skb)
 {
@@ -154,22 +155,19 @@ int ip_call_ra_chain(struct sk_buff *skb)
         struct sock *last = NULL;
         struct net_device *dev = skb->dev;
 
-        read_lock(&ip_ra_lock);
-        for (ra = ip_ra_chain; ra; ra = ra->next) {
+        for (ra = rcu_dereference(ip_ra_chain); ra; ra = rcu_dereference(ra->next)) {
                 struct sock *sk = ra->sk;
 
                 /* If socket is bound to an interface, only report
                  * the packet if it came  from that interface.
                  */
-                if (sk && inet_sk(sk)->num == protocol &&
+                if (sk && inet_sk(sk)->inet_num == protocol &&
                     (!sk->sk_bound_dev_if ||
                      sk->sk_bound_dev_if == dev->ifindex) &&
-                    sock_net(sk) == dev_net(dev)) {
+                    net_eq(sock_net(sk), dev_net(dev))) {
                         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                                if (ip_defrag(skb, IP_DEFRAG_CALL_RA_CHAIN)) {
-                                        read_unlock(&ip_ra_lock);
+                                if (ip_defrag(skb, IP_DEFRAG_CALL_RA_CHAIN))
                                         return 1;
-                                }
                         }
                         if (last) {
                                 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
@@ -182,10 +180,8 @@ int ip_call_ra_chain(struct sk_buff *skb)
 
         if (last) {
                 raw_rcv(last, skb);
-                read_unlock(&ip_ra_lock);
                 return 1;
         }
-        read_unlock(&ip_ra_lock);
         return 0;
 }
 
@@ -202,7 +198,7 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
         {
                 int protocol = ip_hdr(skb)->protocol;
                 int hash, raw;
-                struct net_protocol *ipprot;
+                const struct net_protocol *ipprot;
 
         resubmit:
                 raw = raw_local_deliver(skb, protocol);
@@ -265,7 +261,7 @@ int ip_local_deliver(struct sk_buff *skb)
                         return 0;
         }
 
-        return NF_HOOK(PF_INET, NF_INET_LOCAL_IN, skb, skb->dev, NULL,
+        return NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_IN, skb, skb->dev, NULL,
                        ip_local_deliver_finish);
 }
 
@@ -297,18 +293,16 @@ static inline int ip_rcv_options(struct sk_buff *skb)
         }
 
         if (unlikely(opt->srr)) {
-                struct in_device *in_dev = in_dev_get(dev);
+                struct in_device *in_dev = __in_dev_get_rcu(dev);
+
                 if (in_dev) {
                         if (!IN_DEV_SOURCE_ROUTE(in_dev)) {
                                 if (IN_DEV_LOG_MARTIANS(in_dev) &&
                                     net_ratelimit())
                                         printk(KERN_INFO "source route option %pI4 -> %pI4\n",
                                                &iph->saddr, &iph->daddr);
-                                in_dev_put(in_dev);
                                 goto drop;
                         }
-
-                        in_dev_put(in_dev);
                 }
 
                 if (ip_options_rcv_srr(skb))
@@ -330,8 +324,8 @@ static int ip_rcv_finish(struct sk_buff *skb)
          *      how the packet travels inside Linux networking.
          */
         if (skb_dst(skb) == NULL) {
-                int err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
-                                         skb->dev);
+                int err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
+                                               iph->tos, skb->dev);
                 if (unlikely(err)) {
                         if (err == -EHOSTUNREACH)
                                 IP_INC_STATS_BH(dev_net(skb->dev),
@@ -339,13 +333,16 @@ static int ip_rcv_finish(struct sk_buff *skb)
                         else if (err == -ENETUNREACH)
                                 IP_INC_STATS_BH(dev_net(skb->dev),
                                                 IPSTATS_MIB_INNOROUTES);
+                        else if (err == -EXDEV)
+                                NET_INC_STATS_BH(dev_net(skb->dev),
+                                                 LINUX_MIB_IPRPFILTER);
                         goto drop;
                 }
         }
 
 #ifdef CONFIG_NET_CLS_ROUTE
         if (unlikely(skb_dst(skb)->tclassid)) {
-                struct ip_rt_acct *st = per_cpu_ptr(ip_rt_acct, smp_processor_id());
+                struct ip_rt_acct *st = this_cpu_ptr(ip_rt_acct);
                 u32 idx = skb_dst(skb)->tclassid;
                 st[idx&0xFF].o_packets++;
                 st[idx&0xFF].o_bytes += skb->len;
@@ -359,10 +356,10 @@ static int ip_rcv_finish(struct sk_buff *skb)
 
         rt = skb_rtable(skb);
         if (rt->rt_type == RTN_MULTICAST) {
-                IP_UPD_PO_STATS_BH(dev_net(rt->u.dst.dev), IPSTATS_MIB_INMCAST,
+                IP_UPD_PO_STATS_BH(dev_net(rt->dst.dev), IPSTATS_MIB_INMCAST,
                                 skb->len);
         } else if (rt->rt_type == RTN_BROADCAST)
-                IP_UPD_PO_STATS_BH(dev_net(rt->u.dst.dev), IPSTATS_MIB_INBCAST,
+                IP_UPD_PO_STATS_BH(dev_net(rt->dst.dev), IPSTATS_MIB_INBCAST,
                                 skb->len);
 
         return dst_input(skb);
@@ -440,7 +437,10 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
         /* Remove any debris in the socket control block */
         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
 
-        return NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, dev, NULL,
+        /* Must drop socket now because of tproxy. */
+        skb_orphan(skb);
+
+        return NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, dev, NULL,
                        ip_rcv_finish);
 
 inhdr_error:
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 94bf105ef3c9..1906fa35860c 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -11,6 +11,7 @@
 
 #include <linux/capability.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <asm/uaccess.h>
 #include <linux/skbuff.h>
@@ -237,7 +238,6 @@ void ip_options_fragment(struct sk_buff * skb)
         opt->rr_needaddr = 0;
         opt->ts_needaddr = 0;
         opt->ts_needtime = 0;
-        return;
 }
 
 /*
@@ -466,7 +466,7 @@ error:
         }
         return -EINVAL;
 }
-
+EXPORT_SYMBOL(ip_options_compile);
 
 /*
  *      Undo all the changes done by ip_options_compile().
@@ -600,6 +600,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
         unsigned char *optptr = skb_network_header(skb) + opt->srr;
         struct rtable *rt = skb_rtable(skb);
         struct rtable *rt2;
+        unsigned long orefdst;
         int err;
 
         if (!opt->srr)
@@ -623,16 +624,16 @@ int ip_options_rcv_srr(struct sk_buff *skb)
                 }
                 memcpy(&nexthop, &optptr[srrptr-1], 4);
 
-                rt = skb_rtable(skb);
+                orefdst = skb->_skb_refdst;
                 skb_dst_set(skb, NULL);
                 err = ip_route_input(skb, nexthop, iph->saddr, iph->tos, skb->dev);
                 rt2 = skb_rtable(skb);
                 if (err || (rt2->rt_type != RTN_UNICAST && rt2->rt_type != RTN_LOCAL)) {
-                        ip_rt_put(rt2);
-                        skb_dst_set(skb, &rt->u.dst);
+                        skb_dst_drop(skb);
+                        skb->_skb_refdst = orefdst;
                         return -EINVAL;
                 }
-                ip_rt_put(rt);
+                refdst_drop(orefdst);
                 if (rt2->rt_type != RTN_LOCAL)
                         break;
                 /* Superfast 8) loopback forward */
@@ -645,3 +646,4 @@ int ip_options_rcv_srr(struct sk_buff *skb)
         }
         return 0;
 }
+EXPORT_SYMBOL(ip_options_rcv_srr);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 247026282669..04c7b3ba6b39 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -51,6 +51,7 @@
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/highmem.h>
+#include <linux/slab.h>
 
 #include <linux/socket.h>
 #include <linux/sockios.h>
@@ -81,6 +82,7 @@
 #include <linux/tcp.h>
 
 int sysctl_ip_default_ttl __read_mostly = IPDEFTTL;
+EXPORT_SYMBOL(sysctl_ip_default_ttl);
 
 /* Generate a checksum for an outgoing IP datagram. */
 __inline__ void ip_send_check(struct iphdr *iph)
@@ -88,6 +90,7 @@ __inline__ void ip_send_check(struct iphdr *iph)
         iph->check = 0;
         iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
 }
+EXPORT_SYMBOL(ip_send_check);
 
 int __ip_local_out(struct sk_buff *skb)
 {
@@ -95,8 +98,8 @@ int __ip_local_out(struct sk_buff *skb)
 
         iph->tot_len = htons(skb->len);
         ip_send_check(iph);
-        return nf_hook(PF_INET, NF_INET_LOCAL_OUT, skb, NULL, skb_dst(skb)->dev,
-                       dst_output);
+        return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, skb, NULL,
+                       skb_dst(skb)->dev, dst_output);
 }
 
 int ip_local_out(struct sk_buff *skb)
@@ -119,7 +122,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         WARN_ON(!skb_dst(newskb));
-        netif_rx(newskb);
+        netif_rx_ni(newskb);
         return 0;
 }
 
@@ -128,7 +131,7 @@ static inline int ip_select_ttl(struct inet_sock *inet, struct dst_entry *dst)
         int ttl = inet->uc_ttl;
 
         if (ttl < 0)
-                ttl = dst_metric(dst, RTAX_HOPLIMIT);
+                ttl = ip4_dst_hoplimit(dst);
         return ttl;
 }
 
@@ -150,15 +153,15 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
         iph->version  = 4;
         iph->ihl      = 5;
         iph->tos      = inet->tos;
-        if (ip_dont_fragment(sk, &rt->u.dst))
+        if (ip_dont_fragment(sk, &rt->dst))
                 iph->frag_off = htons(IP_DF);
         else
                 iph->frag_off = 0;
-        iph->ttl      = ip_select_ttl(inet, &rt->u.dst);
+        iph->ttl      = ip_select_ttl(inet, &rt->dst);
         iph->daddr    = rt->rt_dst;
         iph->saddr    = rt->rt_src;
         iph->protocol = sk->sk_protocol;
-        ip_select_ident(iph, &rt->u.dst, sk);
+        ip_select_ident(iph, &rt->dst, sk);
 
         if (opt && opt->optlen) {
                 iph->ihl += opt->optlen>>2;
@@ -171,7 +174,6 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
         /* Send it out. */
         return ip_local_out(skb);
 }
-
 EXPORT_SYMBOL_GPL(ip_build_and_send_pkt);
 
 static inline int ip_finish_output2(struct sk_buff *skb)
@@ -239,7 +241,7 @@ int ip_mc_output(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
         struct rtable *rt = skb_rtable(skb);
-        struct net_device *dev = rt->u.dst.dev;
+        struct net_device *dev = rt->dst.dev;
 
         /*
          *      If the indicated interface is up and running, send the packet.
@@ -254,7 +256,7 @@ int ip_mc_output(struct sk_buff *skb)
          */
 
         if (rt->rt_flags&RTCF_MULTICAST) {
-                if ((!sk || inet_sk(sk)->mc_loop)
+                if (sk_mc_loop(sk)
 #ifdef CONFIG_IP_MROUTE
                 /* Small optimization: do not loopback not local frames,
                    which returned after forwarding; they will be  dropped
@@ -264,13 +266,15 @@ int ip_mc_output(struct sk_buff *skb)
 
                    This check is duplicated in ip_mr_input at the moment.
                  */
-                    && ((rt->rt_flags&RTCF_LOCAL) || !(IPCB(skb)->flags&IPSKB_FORWARDED))
+                    &&
+                    ((rt->rt_flags & RTCF_LOCAL) ||
+                     !(IPCB(skb)->flags & IPSKB_FORWARDED))
 #endif
-                ) {
+                   ) {
                         struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
                         if (newskb)
-                                NF_HOOK(PF_INET, NF_INET_POST_ROUTING, newskb,
-                                        NULL, newskb->dev,
+                                NF_HOOK(NFPROTO_IPV4, NF_INET_POST_ROUTING,
+                                        newskb, NULL, newskb->dev,
                                         ip_dev_loopback_xmit);
                 }
 
@@ -285,12 +289,12 @@ int ip_mc_output(struct sk_buff *skb)
         if (rt->rt_flags&RTCF_BROADCAST) {
                 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
                 if (newskb)
-                        NF_HOOK(PF_INET, NF_INET_POST_ROUTING, newskb, NULL,
-                                newskb->dev, ip_dev_loopback_xmit);
+                        NF_HOOK(NFPROTO_IPV4, NF_INET_POST_ROUTING, newskb,
+                                NULL, newskb->dev, ip_dev_loopback_xmit);
         }
 
-        return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
-                            ip_finish_output,
+        return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, skb, NULL,
+                            skb->dev, ip_finish_output,
                             !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
 
@@ -303,22 +307,24 @@ int ip_output(struct sk_buff *skb)
         skb->dev = dev;
         skb->protocol = htons(ETH_P_IP);
 
-        return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb, NULL, dev,
+        return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, skb, NULL, dev,
                             ip_finish_output,
                             !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
 
-int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
+int ip_queue_xmit(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ip_options *opt = inet->opt;
         struct rtable *rt;
         struct iphdr *iph;
+        int res;
 
         /* Skip all of this if the packet is already routed,
          * f.e. by something like SCTP.
          */
+        rcu_read_lock();
         rt = skb_rtable(skb);
         if (rt != NULL)
                 goto packet_routed;
@@ -329,21 +335,20 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                 __be32 daddr;
 
                 /* Use correct destination address if we have options. */
-                daddr = inet->daddr;
+                daddr = inet->inet_daddr;
                 if(opt && opt->srr)
                         daddr = opt->faddr;
 
                 {
                         struct flowi fl = { .oif = sk->sk_bound_dev_if,
-                                            .nl_u = { .ip4_u =
-                                                      { .daddr = daddr,
-                                                        .saddr = inet->saddr,
-                                                        .tos = RT_CONN_FLAGS(sk) } },
+                                            .mark = sk->sk_mark,
+                                            .fl4_dst = daddr,
+                                            .fl4_src = inet->inet_saddr,
+                                            .fl4_tos = RT_CONN_FLAGS(sk),
                                             .proto = sk->sk_protocol,
                                             .flags = inet_sk_flowi_flags(sk),
-                                            .uli_u = { .ports =
-                                                       { .sport = inet->sport,
-                                                         .dport = inet->dport } } };
+                                            .fl_ip_sport = inet->inet_sport,
+                                            .fl_ip_dport = inet->inet_dport };
 
                         /* If this fails, retransmit mechanism of transport layer will
                          * keep trying until route appears or the connection times
@@ -353,9 +358,9 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                         if (ip_route_output_flow(sock_net(sk), &rt, &fl, sk, 0))
                                 goto no_route;
                 }
-                sk_setup_caps(sk, &rt->u.dst);
+                sk_setup_caps(sk, &rt->dst);
         }
-        skb_dst_set(skb, dst_clone(&rt->u.dst));
+        skb_dst_set_noref(skb, &rt->dst);
 
 packet_routed:
         if (opt && opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
@@ -366,11 +371,11 @@ packet_routed:
         skb_reset_network_header(skb);
         iph = ip_hdr(skb);
         *((__be16 *)iph) = htons((4 << 12) | (5 << 8) | (inet->tos & 0xff));
-        if (ip_dont_fragment(sk, &rt->u.dst) && !ipfragok)
+        if (ip_dont_fragment(sk, &rt->dst) && !skb->local_df)
                 iph->frag_off = htons(IP_DF);
         else
                 iph->frag_off = 0;
-        iph->ttl      = ip_select_ttl(inet, &rt->u.dst);
+        iph->ttl      = ip_select_ttl(inet, &rt->dst);
         iph->protocol = sk->sk_protocol;
         iph->saddr    = rt->rt_src;
         iph->daddr    = rt->rt_dst;
@@ -378,22 +383,26 @@ packet_routed:
 
         if (opt && opt->optlen) {
                 iph->ihl += opt->optlen >> 2;
-                ip_options_build(skb, opt, inet->daddr, rt, 0);
+                ip_options_build(skb, opt, inet->inet_daddr, rt, 0);
         }
 
-        ip_select_ident_more(iph, &rt->u.dst, sk,
+        ip_select_ident_more(iph, &rt->dst, sk,
                              (skb_shinfo(skb)->gso_segs ?: 1) - 1);
 
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
 
-        return ip_local_out(skb);
+        res = ip_local_out(skb);
+        rcu_read_unlock();
+        return res;
 
 no_route:
+        rcu_read_unlock();
         IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
         kfree_skb(skb);
         return -EHOSTUNREACH;
 }
+EXPORT_SYMBOL(ip_queue_xmit);
 
 
 static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
@@ -402,7 +411,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->priority = from->priority;
         to->protocol = from->protocol;
         skb_dst_drop(to);
-        skb_dst_set(to, dst_clone(skb_dst(from)));
+        skb_dst_copy(to, from);
         to->dev = from->dev;
         to->mark = from->mark;
 
@@ -433,17 +442,16 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
 int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
         struct iphdr *iph;
-        int raw = 0;
         int ptr;
         struct net_device *dev;
         struct sk_buff *skb2;
-        unsigned int mtu, hlen, left, len, ll_rs, pad;
+        unsigned int mtu, hlen, left, len, ll_rs;
         int offset;
         __be16 not_last_frag;
         struct rtable *rt = skb_rtable(skb);
         int err = 0;
 
-        dev = rt->u.dst.dev;
+        dev = rt->dst.dev;
 
         /*
          *      Point into the IP datagram header.
@@ -464,7 +472,11 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
          */
 
         hlen = iph->ihl * 4;
-        mtu = dst_mtu(&rt->u.dst) - hlen;       /* Size of data space */
+        mtu = dst_mtu(&rt->dst) - hlen; /* Size of data space */
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge)
+                mtu -= nf_bridge_mtu_reduction(skb);
+#endif
         IPCB(skb)->flags |= IPSKB_FRAG_COMPLETE;
 
         /* When frag_list is given, use it. First, check its validity:
@@ -474,10 +486,9 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
          * LATER: this step can be merged to real generation of fragments,
          * we can switch to copy when see the first bad fragment.
          */
-        if (skb_has_frags(skb)) {
-                struct sk_buff *frag;
+        if (skb_has_frag_list(skb)) {
+                struct sk_buff *frag, *frag2;
                 int first_len = skb_pagelen(skb);
-                int truesizes = 0;
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
@@ -490,18 +501,18 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         if (frag->len > mtu ||
                             ((frag->len & 7) && frag->next) ||
                             skb_headroom(frag) < hlen)
-                            goto slow_path;
+                                goto slow_path_clean;
 
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
-                                goto slow_path;
+                                goto slow_path_clean;
 
                         BUG_ON(frag->sk);
                         if (skb->sk) {
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
-                                truesizes += frag->truesize;
                         }
+                        skb->truesize -= frag->truesize;
                 }
 
                 /* Everything is OK. Generate! */
@@ -511,7 +522,6 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 frag = skb_shinfo(skb)->frag_list;
                 skb_frag_list_init(skb);
                 skb->data_len = first_len - skb_headlen(skb);
-                skb->truesize -= truesizes;
                 skb->len = first_len;
                 iph->tot_len = htons(first_len);
                 iph->frag_off = htons(IP_MF);
@@ -563,18 +573,25 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 }
                 IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
                 return err;
+
+slow_path_clean:
+                skb_walk_frags(skb, frag2) {
+                        if (frag2 == frag)
+                                break;
+                        frag2->sk = NULL;
+                        frag2->destructor = NULL;
+                        skb->truesize += frag2->truesize;
+                }
         }
 
 slow_path:
         left = skb->len - hlen;         /* Space per frame */
-        ptr = raw + hlen;               /* Where to start from */
+        ptr = hlen;             /* Where to start from */
 
         /* for bridged IP traffic encapsulated inside f.e. a vlan header,
          * we need to make room for the encapsulating header
          */
-        pad = nf_bridge_pad(skb);
-        ll_rs = LL_RESERVED_SPACE_EXTRA(rt->u.dst.dev, pad);
-        mtu -= pad;
+        ll_rs = LL_RESERVED_SPACE_EXTRA(rt->dst.dev, nf_bridge_pad(skb));
 
         /*
          *      Fragment the datagram.
@@ -684,7 +701,6 @@ fail:
         IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
         return err;
 }
-
 EXPORT_SYMBOL(ip_fragment);
 
 int
@@ -703,6 +719,7 @@ ip_generic_getfrag(void *from, char *to, int offset, int len, int odd, struct sk
         }
         return 0;
 }
+EXPORT_SYMBOL(ip_generic_getfrag);
 
 static inline __wsum
 csum_page(struct page *page, int offset, int copy)
@@ -813,21 +830,22 @@ int ip_append_data(struct sock *sk,
                         inet->cork.addr = ipc->addr;
                 }
                 rt = *rtp;
+                if (unlikely(!rt))
+                        return -EFAULT;
                 /*
                  * We steal reference to this route, caller should not release it
                  */
                 *rtp = NULL;
                 inet->cork.fragsize = mtu = inet->pmtudisc == IP_PMTUDISC_PROBE ?
-                                            rt->u.dst.dev->mtu :
-                                            dst_mtu(rt->u.dst.path);
-                inet->cork.dst = &rt->u.dst;
+                                            rt->dst.dev->mtu :
+                                            dst_mtu(rt->dst.path);
+                inet->cork.dst = &rt->dst;
                 inet->cork.length = 0;
                 sk->sk_sndmsg_page = NULL;
                 sk->sk_sndmsg_off = 0;
-                if ((exthdrlen = rt->u.dst.header_len) != 0) {
-                        length += exthdrlen;
-                        transhdrlen += exthdrlen;
-                }
+                exthdrlen = rt->dst.header_len;
+                length += exthdrlen;
+                transhdrlen += exthdrlen;
         } else {
                 rt = (struct rtable *)inet->cork.dst;
                 if (inet->cork.flags & IPCORK_OPT)
@@ -837,13 +855,14 @@ int ip_append_data(struct sock *sk,
                 exthdrlen = 0;
                 mtu = inet->cork.fragsize;
         }
-        hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);
+        hh_len = LL_RESERVED_SPACE(rt->dst.dev);
 
         fragheaderlen = sizeof(struct iphdr) + (opt ? opt->optlen : 0);
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
 
         if (inet->cork.length + length > 0xFFFF - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport, mtu-exthdrlen);
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport,
+                               mtu-exthdrlen);
                 return -EMSGSIZE;
         }
 
@@ -853,14 +872,16 @@ int ip_append_data(struct sock *sk,
          */
         if (transhdrlen &&
             length + fragheaderlen <= mtu &&
-            rt->u.dst.dev->features & NETIF_F_V4_CSUM &&
+            rt->dst.dev->features & NETIF_F_V4_CSUM &&
             !exthdrlen)
                 csummode = CHECKSUM_PARTIAL;
 
+        skb = skb_peek_tail(&sk->sk_write_queue);
+
         inet->cork.length += length;
-        if (((length> mtu) || !skb_queue_empty(&sk->sk_write_queue)) &&
+        if (((length > mtu) || (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->u.dst.dev->features & NETIF_F_UFO)) {
+            (rt->dst.dev->features & NETIF_F_UFO)) {
                 err = ip_ufo_append_data(sk, getfrag, from, length, hh_len,
                                          fragheaderlen, transhdrlen, mtu,
                                          flags);
@@ -876,7 +897,7 @@ int ip_append_data(struct sock *sk,
          * adding appropriate IP header.
          */
 
-        if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
+        if (!skb)
                 goto alloc_new_skb;
 
         while (length > 0) {
@@ -908,19 +929,22 @@ alloc_new_skb:
                         fraglen = datalen + fragheaderlen;
 
                         if ((flags & MSG_MORE) &&
-                            !(rt->u.dst.dev->features&NETIF_F_SG))
+                            !(rt->dst.dev->features&NETIF_F_SG))
                                 alloclen = mtu;
                         else
-                                alloclen = datalen + fragheaderlen;
+                                alloclen = fraglen;
 
                         /* The last fragment gets additional space at tail.
                          * Note, with MSG_MORE we overallocate on fragments,
                          * because we have no idea what fragment will be
                          * the last.
                          */
-                        if (datalen == length + fraggap)
-                                alloclen += rt->u.dst.trailer_len;
-
+                        if (datalen == length + fraggap) {
+                                alloclen += rt->dst.trailer_len;
+                                /* make sure mtu is not reached */
+                                if (datalen > mtu - fragheaderlen - rt->dst.trailer_len)
+                                        datalen -= ALIGN(rt->dst.trailer_len, 8);
+                        }
                         if (transhdrlen) {
                                 skb = sock_alloc_send_skb(sk,
                                                 alloclen + hh_len + 15,
@@ -937,7 +961,7 @@ alloc_new_skb:
                                 else
                                         /* only the initial fragment is
                                            time stamped */
-                                        ipc->shtx.flags = 0;
+                                        ipc->tx_flags = 0;
                         }
                         if (skb == NULL)
                                 goto error;
@@ -948,7 +972,7 @@ alloc_new_skb:
                         skb->ip_summed = csummode;
                         skb->csum = 0;
                         skb_reserve(skb, hh_len);
-                        *skb_tx(skb) = ipc->shtx;
+                        skb_shinfo(skb)->tx_flags = ipc->tx_flags;
 
                         /*
                          *      Find where to start putting bytes.
@@ -992,7 +1016,7 @@ alloc_new_skb:
                 if (copy > length)
                         copy = length;
 
-                if (!(rt->u.dst.dev->features&NETIF_F_SG)) {
+                if (!(rt->dst.dev->features&NETIF_F_SG)) {
                         unsigned int off;
 
                         off = skb->len;
@@ -1087,17 +1111,17 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
         if (inet->cork.flags & IPCORK_OPT)
                 opt = inet->cork.opt;
 
-        if (!(rt->u.dst.dev->features&NETIF_F_SG))
+        if (!(rt->dst.dev->features&NETIF_F_SG))
                 return -EOPNOTSUPP;
 
-        hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);
+        hh_len = LL_RESERVED_SPACE(rt->dst.dev);
         mtu = inet->cork.fragsize;
 
         fragheaderlen = sizeof(struct iphdr) + (opt ? opt->optlen : 0);
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
 
         if (inet->cork.length + size > 0xFFFF - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport, mtu);
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport, mtu);
                 return -EMSGSIZE;
         }
 
@@ -1105,8 +1129,9 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
                 return -EINVAL;
 
         inet->cork.length += size;
-        if ((sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->u.dst.dev->features & NETIF_F_UFO)) {
+        if ((size + skb->len > mtu) &&
+            (sk->sk_protocol == IPPROTO_UDP) &&
+            (rt->dst.dev->features & NETIF_F_UFO)) {
                 skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
         }
@@ -1243,7 +1268,6 @@ int ip_push_pending_frames(struct sock *sk)
                 skb->len += tmp_skb->len;
                 skb->data_len += tmp_skb->len;
                 skb->truesize += tmp_skb->truesize;
-                __sock_put(tmp_skb->sk);
                 tmp_skb->destructor = NULL;
                 tmp_skb->sk = NULL;
         }
@@ -1259,8 +1283,8 @@ int ip_push_pending_frames(struct sock *sk)
          * If local_df is set too, we still allow to fragment this frame
          * locally. */
         if (inet->pmtudisc >= IP_PMTUDISC_DO ||
-            (skb->len <= dst_mtu(&rt->u.dst) &&
-             ip_dont_fragment(sk, &rt->u.dst)))
+            (skb->len <= dst_mtu(&rt->dst) &&
+             ip_dont_fragment(sk, &rt->dst)))
                 df = htons(IP_DF);
 
         if (inet->cork.flags & IPCORK_OPT)
@@ -1269,7 +1293,7 @@ int ip_push_pending_frames(struct sock *sk)
         if (rt->rt_type == RTN_MULTICAST)
                 ttl = inet->mc_ttl;
         else
-                ttl = ip_select_ttl(inet, &rt->u.dst);
+                ttl = ip_select_ttl(inet, &rt->dst);
 
         iph = (struct iphdr *)skb->data;
         iph->version = 4;
@@ -1280,7 +1304,7 @@ int ip_push_pending_frames(struct sock *sk)
         }
         iph->tos = inet->tos;
         iph->frag_off = df;
-        ip_select_ident(iph, &rt->u.dst, sk);
+        ip_select_ident(iph, &rt->dst, sk);
         iph->ttl = ttl;
         iph->protocol = sk->sk_protocol;
         iph->saddr = rt->rt_src;
@@ -1293,7 +1317,7 @@ int ip_push_pending_frames(struct sock *sk)
          * on dst refcount
          */
         inet->cork.dst = NULL;
-        skb_dst_set(skb, &rt->u.dst);
+        skb_dst_set(skb, &rt->dst);
 
         if (iph->protocol == IPPROTO_ICMP)
                 icmp_out_count(net, ((struct icmphdr *)
@@ -1303,7 +1327,7 @@ int ip_push_pending_frames(struct sock *sk)
         err = ip_local_out(skb);
         if (err) {
                 if (err > 0)
-                        err = inet->recverr ? net_xmit_errno(err) : 0;
+                        err = net_xmit_errno(err);
                 if (err)
                         goto error;
         }
@@ -1368,7 +1392,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
 
         daddr = ipc.addr = rt->rt_src;
         ipc.opt = NULL;
-        ipc.shtx.flags = 0;
+        ipc.tx_flags = 0;
 
         if (replyopts.opt.optlen) {
                 ipc.opt = &replyopts.opt;
@@ -1379,14 +1403,11 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
 
         {
                 struct flowi fl = { .oif = arg->bound_dev_if,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = daddr,
-                                                .saddr = rt->rt_spec_dst,
-                                                .tos = RT_TOS(ip_hdr(skb)->tos) } },
-                                    /* Not quite clean, but right. */
-                                    .uli_u = { .ports =
-                                               { .sport = tcp_hdr(skb)->dest,
-                                                 .dport = tcp_hdr(skb)->source } },
+                                    .fl4_dst = daddr,
+                                    .fl4_src = rt->rt_spec_dst,
+                                    .fl4_tos = RT_TOS(ip_hdr(skb)->tos),
+                                    .fl_ip_sport = tcp_hdr(skb)->dest,
+                                    .fl_ip_dport = tcp_hdr(skb)->source,
                                     .proto = sk->sk_protocol,
                                     .flags = ip_reply_arg_flowi_flags(arg) };
                 security_skb_classify_flow(skb, &fl);
@@ -1430,7 +1451,3 @@ void __init ip_init(void)
         igmp_mc_proc_init();
 #endif
 }
-
-EXPORT_SYMBOL(ip_generic_getfrag);
-EXPORT_SYMBOL(ip_queue_xmit);
-EXPORT_SYMBOL(ip_send_check);
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fc7993e9061f..3948c86e59ca 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -23,6 +23,7 @@
 #include <linux/icmp.h>
 #include <linux/inetdevice.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -237,48 +238,68 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc)
    but receiver should be enough clever f.e. to forward mtrace requests,
    sent to multicast group to reach destination designated router.
  */
-struct ip_ra_chain *ip_ra_chain;
-DEFINE_RWLOCK(ip_ra_lock);
+struct ip_ra_chain __rcu *ip_ra_chain;
+static DEFINE_SPINLOCK(ip_ra_lock);
+
+
+static void ip_ra_destroy_rcu(struct rcu_head *head)
+{
+        struct ip_ra_chain *ra = container_of(head, struct ip_ra_chain, rcu);
+
+        sock_put(ra->saved_sk);
+        kfree(ra);
+}
 
 int ip_ra_control(struct sock *sk, unsigned char on,
                   void (*destructor)(struct sock *))
 {
-        struct ip_ra_chain *ra, *new_ra, **rap;
+        struct ip_ra_chain *ra, *new_ra;
+        struct ip_ra_chain __rcu **rap;
 
-        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num == IPPROTO_RAW)
+        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num == IPPROTO_RAW)
                 return -EINVAL;
 
         new_ra = on ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
 
-        write_lock_bh(&ip_ra_lock);
-        for (rap = &ip_ra_chain; (ra = *rap) != NULL; rap = &ra->next) {
+        spin_lock_bh(&ip_ra_lock);
+        for (rap = &ip_ra_chain;
+             (ra = rcu_dereference_protected(*rap,
+                        lockdep_is_held(&ip_ra_lock))) != NULL;
+             rap = &ra->next) {
                 if (ra->sk == sk) {
                         if (on) {
-                                write_unlock_bh(&ip_ra_lock);
+                                spin_unlock_bh(&ip_ra_lock);
                                 kfree(new_ra);
                                 return -EADDRINUSE;
                         }
-                        *rap = ra->next;
-                        write_unlock_bh(&ip_ra_lock);
+                        /* dont let ip_call_ra_chain() use sk again */
+                        ra->sk = NULL;
+                        rcu_assign_pointer(*rap, ra->next);
+                        spin_unlock_bh(&ip_ra_lock);
 
                         if (ra->destructor)
                                 ra->destructor(sk);
-                        sock_put(sk);
-                        kfree(ra);
+                        /*
+                         * Delay sock_put(sk) and kfree(ra) after one rcu grace
+                         * period. This guarantee ip_call_ra_chain() dont need
+                         * to mess with socket refcounts.
+                         */
+                        ra->saved_sk = sk;
+                        call_rcu(&ra->rcu, ip_ra_destroy_rcu);
                         return 0;
                 }
         }
         if (new_ra == NULL) {
-                write_unlock_bh(&ip_ra_lock);
+                spin_unlock_bh(&ip_ra_lock);
                 return -ENOBUFS;
         }
         new_ra->sk = sk;
         new_ra->destructor = destructor;
 
         new_ra->next = ra;
-        *rap = new_ra;
+        rcu_assign_pointer(*rap, new_ra);
         sock_hold(sk);
-        write_unlock_bh(&ip_ra_lock);
+        spin_unlock_bh(&ip_ra_lock);
 
         return 0;
 }
@@ -286,12 +307,8 @@ int ip_ra_control(struct sock *sk, unsigned char on,
 void ip_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
                    __be16 port, u32 info, u8 *payload)
 {
-        struct inet_sock *inet = inet_sk(sk);
         struct sock_exterr_skb *serr;
 
-        if (!inet->recverr)
-                return;
-
         skb = skb_clone(skb, GFP_ATOMIC);
         if (!skb)
                 return;
@@ -440,7 +457,7 @@ out:
  */
 
 static int do_ip_setsockopt(struct sock *sk, int level,
-                            int optname, char __user *optval, int optlen)
+                            int optname, char __user *optval, unsigned int optlen)
 {
         struct inet_sock *inet = inet_sk(sk);
         int val = 0, err;
@@ -451,7 +468,8 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                              (1<<IP_TTL) | (1<<IP_HDRINCL) |
                              (1<<IP_MTU_DISCOVER) | (1<<IP_RECVERR) |
                              (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
-                             (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT))) ||
+                             (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |
+                             (1<<IP_MINTTL) | (1<<IP_NODEFRAG))) ||
             optname == IP_MULTICAST_TTL ||
             optname == IP_MULTICAST_ALL ||
             optname == IP_MULTICAST_LOOP ||
@@ -480,7 +498,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         case IP_OPTIONS:
         {
                 struct ip_options *opt = NULL;
-                if (optlen > 40 || optlen < 0)
+                if (optlen > 40)
                         goto e_inval;
                 err = ip_options_get_from_user(sock_net(sk), &opt,
                                                optval, optlen);
@@ -492,7 +510,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         if (sk->sk_family == PF_INET ||
                             (!((1 << sk->sk_state) &
                                (TCPF_LISTEN | TCPF_CLOSE)) &&
-                             inet->daddr != LOOPBACK4_IPV6)) {
+                             inet->inet_daddr != LOOPBACK4_IPV6)) {
 #endif
                                 if (inet->opt)
                                         icsk->icsk_ext_hdr_len -= inet->opt->optlen;
@@ -574,8 +592,15 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 }
                 inet->hdrincl = val ? 1 : 0;
                 break;
+        case IP_NODEFRAG:
+                if (sk->sk_type != SOCK_RAW) {
+                        err = -ENOPROTOOPT;
+                        break;
+                }
+                inet->nodefrag = val ? 1 : 0;
+                break;
         case IP_MTU_DISCOVER:
-                if (val < 0 || val > 3)
+                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
                         goto e_inval;
                 inet->pmtudisc = val;
                 break;
@@ -611,6 +636,9 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                  *      Check the arguments are allowable
                  */
 
+                if (optlen < sizeof(struct in_addr))
+                        goto e_inval;
+
                 err = -EFAULT;
                 if (optlen >= sizeof(struct ip_mreqn)) {
                         if (copy_from_user(&mreq, optval, sizeof(mreq)))
@@ -631,17 +659,16 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                                 break;
                         }
                         dev = ip_dev_find(sock_net(sk), mreq.imr_address.s_addr);
-                        if (dev) {
+                        if (dev)
                                 mreq.imr_ifindex = dev->ifindex;
-                                dev_put(dev);
-                        }
                 } else
-                        dev = __dev_get_by_index(sock_net(sk), mreq.imr_ifindex);
+                        dev = dev_get_by_index(sock_net(sk), mreq.imr_ifindex);
 
 
                 err = -EADDRNOTAVAIL;
                 if (!dev)
                         break;
+                dev_put(dev);
 
                 err = -EINVAL;
                 if (sk->sk_bound_dev_if &&
@@ -934,6 +961,14 @@ mc_msf_out:
                 inet->transparent = !!val;
                 break;
 
+        case IP_MINTTL:
+                if (optlen < 1)
+                        goto e_inval;
+                if (val < 0 || val > 255)
+                        goto e_inval;
+                inet->min_ttl = val;
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -946,8 +981,24 @@ e_inval:
         return -EINVAL;
 }
 
+/**
+ * ip_queue_rcv_skb - Queue an skb into sock receive queue
+ * @sk: socket
+ * @skb: buffer
+ *
+ * Queues an skb into socket receive queue. If IP_CMSG_PKTINFO option
+ * is not set, we drop skb dst entry now, while dst cache line is hot.
+ */
+int ip_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+{
+        if (!(inet_sk(sk)->cmsg_flags & IP_CMSG_PKTINFO))
+                skb_dst_drop(skb);
+        return sock_queue_rcv_skb(sk, skb);
+}
+EXPORT_SYMBOL(ip_queue_rcv_skb);
+
 int ip_setsockopt(struct sock *sk, int level,
-                int optname, char __user *optval, int optlen)
+                int optname, char __user *optval, unsigned int optlen)
 {
         int err;
 
@@ -972,7 +1023,7 @@ EXPORT_SYMBOL(ip_setsockopt);
 
 #ifdef CONFIG_COMPAT
 int compat_ip_setsockopt(struct sock *sk, int level, int optname,
-                         char __user *optval, int optlen)
+                         char __user *optval, unsigned int optlen)
 {
         int err;
 
@@ -1082,6 +1133,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         case IP_HDRINCL:
                 val = inet->hdrincl;
                 break;
+        case IP_NODEFRAG:
+                val = inet->nodefrag;
+                break;
         case IP_MTU_DISCOVER:
                 val = inet->pmtudisc;
                 break;
@@ -1178,8 +1232,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                 if (inet->cmsg_flags & IP_CMSG_PKTINFO) {
                         struct in_pktinfo info;
 
-                        info.ipi_addr.s_addr = inet->rcv_saddr;
-                        info.ipi_spec_dst.s_addr = inet->rcv_saddr;
+                        info.ipi_addr.s_addr = inet->inet_rcv_saddr;
+                        info.ipi_spec_dst.s_addr = inet->inet_rcv_saddr;
                         info.ipi_ifindex = inet->mc_index;
                         put_cmsg(&msg, SOL_IP, IP_PKTINFO, sizeof(info), &info);
                 }
@@ -1196,6 +1250,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         case IP_TRANSPARENT:
                 val = inet->transparent;
                 break;
+        case IP_MINTTL:
+                val = inet->min_ttl;
+                break;
         default:
                 release_sock(sk);
                 return -ENOPROTOOPT;
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 3262ce06294c..629067571f02 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -25,6 +25,7 @@
 
 static void ipcomp4_err(struct sk_buff *skb, u32 info)
 {
+        struct net *net = dev_net(skb->dev);
         __be32 spi;
         struct iphdr *iph = (struct iphdr *)skb->data;
         struct ip_comp_hdr *ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
@@ -35,7 +36,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
                 return;
 
         spi = htonl(ntohs(ipch->cpi));
-        x = xfrm_state_lookup(&init_net, (xfrm_address_t *)&iph->daddr,
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr,
                               spi, IPPROTO_COMP, AF_INET);
         if (!x)
                 return;
@@ -47,9 +48,10 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
 /* We always hold one tunnel user reference to indicate a tunnel */
 static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
 {
+        struct net *net = xs_net(x);
         struct xfrm_state *t;
 
-        t = xfrm_state_alloc(&init_net);
+        t = xfrm_state_alloc(net);
         if (t == NULL)
                 goto out;
 
@@ -61,6 +63,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
         t->props.mode = x->props.mode;
         t->props.saddr.a4 = x->props.saddr.a4;
         t->props.flags = x->props.flags;
+        memcpy(&t->mark, &x->mark, sizeof(t->mark));
 
         if (xfrm_init_state(t))
                 goto error;
@@ -82,10 +85,12 @@ error:
  */
 static int ipcomp_tunnel_attach(struct xfrm_state *x)
 {
+        struct net *net = xs_net(x);
         int err = 0;
         struct xfrm_state *t;
+        u32 mark = x->mark.v & x->mark.m;
 
-        t = xfrm_state_lookup(&init_net, (xfrm_address_t *)&x->id.daddr.a4,
+        t = xfrm_state_lookup(net, mark, (xfrm_address_t *)&x->id.daddr.a4,
                               x->props.saddr.a4, IPPROTO_IPIP, AF_INET);
         if (!t) {
                 t = ipcomp_tunnel_create(x);
@@ -124,16 +129,12 @@ static int ipcomp4_init_state(struct xfrm_state *x)
         if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp_tunnel_attach(x);
                 if (err)
-                        goto error_tunnel;
+                        goto out;
         }
 
         err = 0;
 out:
         return err;
-
-error_tunnel:
-        ipcomp_destroy(x);
-        goto out;
 }
 
 static const struct xfrm_type ipcomp_type = {
@@ -146,7 +147,7 @@ static const struct xfrm_type ipcomp_type = {
         .output         = ipcomp_output
 };
 
-static struct net_protocol ipcomp4_protocol = {
+static const struct net_protocol ipcomp4_protocol = {
         .handler        =       xfrm4_rcv,
         .err_handler    =       ipcomp4_err,
         .no_policy      =       1,
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index f8d04c256454..2b097752426b 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -53,6 +53,7 @@
 #include <linux/root_dev.h>
 #include <linux/delay.h>
 #include <linux/nfs_fs.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/arp.h>
 #include <net/ip.h>
@@ -187,6 +188,16 @@ struct ic_device {
 static struct ic_device *ic_first_dev __initdata = NULL;/* List of open device */
 static struct net_device *ic_dev __initdata = NULL;     /* Selected device */
 
+static bool __init ic_device_match(struct net_device *dev)
+{
+        if (user_dev_name[0] ? !strcmp(dev->name, user_dev_name) :
+            (!(dev->flags & IFF_LOOPBACK) &&
+             (dev->flags & (IFF_POINTOPOINT|IFF_BROADCAST)) &&
+             strncmp(dev->name, "dummy", 5)))
+                return true;
+        return false;
+}
+
 static int __init ic_open_devs(void)
 {
         struct ic_device *d, **last;
@@ -207,10 +218,7 @@ static int __init ic_open_devs(void)
         for_each_netdev(&init_net, dev) {
                 if (dev->flags & IFF_LOOPBACK)
                         continue;
-                if (user_dev_name[0] ? !strcmp(dev->name, user_dev_name) :
-                    (!(dev->flags & IFF_LOOPBACK) &&
-                     (dev->flags & (IFF_POINTOPOINT|IFF_BROADCAST)) &&
-                     strncmp(dev->name, "dummy", 5))) {
+                if (ic_device_match(dev)) {
                         int able = 0;
                         if (dev->mtu >= 364)
                                 able |= IC_BOOTP;
@@ -228,7 +236,7 @@ static int __init ic_open_devs(void)
                         }
                         if (!(d = kmalloc(sizeof(struct ic_device), GFP_KERNEL))) {
                                 rtnl_unlock();
-                                return -1;
+                                return -ENOMEM;
                         }
                         d->dev = dev;
                         *last = d;
@@ -253,7 +261,7 @@ static int __init ic_open_devs(void)
                         printk(KERN_ERR "IP-Config: Device `%s' not found.\n", user_dev_name);
                 else
                         printk(KERN_ERR "IP-Config: No network devices available.\n");
-                return -1;
+                return -ENODEV;
         }
         return 0;
 }
@@ -657,6 +665,13 @@ ic_dhcp_init_options(u8 *options)
                 memcpy(e, ic_req_params, sizeof(ic_req_params));
                 e += sizeof(ic_req_params);
 
+                if (ic_host_name_set) {
+                        *e++ = 12;      /* host-name */
+                        len = strlen(utsname()->nodename);
+                        *e++ = len;
+                        memcpy(e, utsname()->nodename, len);
+                        e += len;
+                }
                 if (*vendor_class_identifier) {
                         printk(KERN_INFO "DHCP: sending class identifier \"%s\"\n",
                                vendor_class_identifier);
@@ -968,7 +983,7 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
         /* Is it a reply for the device we are configuring? */
         if (b->xid != ic_dev_xid) {
                 if (net_ratelimit())
-                        printk(KERN_ERR "DHCP/BOOTP: Ignoring delayed packet \n");
+                        printk(KERN_ERR "DHCP/BOOTP: Ignoring delayed packet\n");
                 goto drop_unlock;
         }
 
@@ -1172,18 +1187,17 @@ static int __init ic_dynamic(void)
                         schedule_timeout_uninterruptible(1);
 #ifdef IPCONFIG_DHCP
                 /* DHCP isn't done until we get a DHCPACK. */
-                if ((ic_got_reply & IC_BOOTP)
-                    && (ic_proto_enabled & IC_USE_DHCP)
-                    && ic_dhcp_msgtype != DHCPACK)
-                {
+                if ((ic_got_reply & IC_BOOTP) &&
+                    (ic_proto_enabled & IC_USE_DHCP) &&
+                    ic_dhcp_msgtype != DHCPACK) {
                         ic_got_reply = 0;
-                        printk(",");
+                        printk(KERN_CONT ",");
                         continue;
                 }
 #endif /* IPCONFIG_DHCP */
 
                 if (ic_got_reply) {
-                        printk(" OK\n");
+                        printk(KERN_CONT " OK\n");
                         break;
                 }
 
@@ -1191,7 +1205,7 @@ static int __init ic_dynamic(void)
                         continue;
 
                 if (! --retries) {
-                        printk(" timed out!\n");
+                        printk(KERN_CONT " timed out!\n");
                         break;
                 }
 
@@ -1201,7 +1215,7 @@ static int __init ic_dynamic(void)
                 if (timeout > CONF_TIMEOUT_MAX)
                         timeout = CONF_TIMEOUT_MAX;
 
-                printk(".");
+                printk(KERN_CONT ".");
         }
 
 #ifdef IPCONFIG_BOOTP
@@ -1222,7 +1236,7 @@ static int __init ic_dynamic(void)
                 ((ic_got_reply & IC_RARP) ? "RARP"
                  : (ic_proto_enabled & IC_USE_DHCP) ? "DHCP" : "BOOTP"),
                 &ic_servaddr);
-        printk("my address is %pI4\n", &ic_myaddr);
+        printk(KERN_CONT "my address is %pI4\n", &ic_myaddr);
 
         return 0;
 }
@@ -1304,6 +1318,32 @@ __be32 __init root_nfs_parse_addr(char *name)
         return addr;
 }
 
+#define DEVICE_WAIT_MAX         12 /* 12 seconds */
+
+static int __init wait_for_devices(void)
+{
+        int i;
+
+        msleep(CONF_PRE_OPEN);
+        for (i = 0; i < DEVICE_WAIT_MAX; i++) {
+                struct net_device *dev;
+                int found = 0;
+
+                rtnl_lock();
+                for_each_netdev(&init_net, dev) {
+                        if (ic_device_match(dev)) {
+                                found = 1;
+                                break;
+                        }
+                }
+                rtnl_unlock();
+                if (found)
+                        return 0;
+                ssleep(1);
+        }
+        return -ENODEV;
+}
+
 /*
  *      IP Autoconfig dispatcher.
  */
@@ -1314,6 +1354,7 @@ static int __init ip_auto_config(void)
 #ifdef IPCONFIG_DYNAMIC
         int retries = CONF_OPEN_RETRIES;
 #endif
+        int err;
 
 #ifdef CONFIG_PROC_FS
         proc_net_fops_create(&init_net, "pnp", S_IRUGO, &pnp_seq_fops);
@@ -1326,12 +1367,15 @@ static int __init ip_auto_config(void)
 #ifdef IPCONFIG_DYNAMIC
  try_try_again:
 #endif
-        /* Give hardware a chance to settle */
-        msleep(CONF_PRE_OPEN);
+        /* Wait for devices to appear */
+        err = wait_for_devices();
+        if (err)
+                return err;
 
         /* Setup all network devices */
-        if (ic_open_devs() < 0)
-                return -1;
+        err = ic_open_devs();
+        if (err)
+                return err;
 
         /* Give drivers a chance to settle */
         ssleep(CONF_POST_OPEN);
@@ -1344,9 +1388,9 @@ static int __init ip_auto_config(void)
          */
         if (ic_myaddr == NONE ||
 #ifdef CONFIG_ROOT_NFS
-            (root_server_addr == NONE
-             && ic_servaddr == NONE
-             && ROOT_DEV == Root_NFS) ||
+            (root_server_addr == NONE &&
+             ic_servaddr == NONE &&
+             ROOT_DEV == Root_NFS) ||
 #endif
             ic_first_dev->next) {
 #ifdef IPCONFIG_DYNAMIC
@@ -1424,19 +1468,19 @@ static int __init ip_auto_config(void)
         /*
          * Clue in the operator.
          */
-        printk("IP-Config: Complete:");
-        printk("\n     device=%s", ic_dev->name);
-        printk(", addr=%pI4", &ic_myaddr);
-        printk(", mask=%pI4", &ic_netmask);
-        printk(", gw=%pI4", &ic_gateway);
-        printk(",\n     host=%s, domain=%s, nis-domain=%s",
+        printk("IP-Config: Complete:\n");
+        printk("     device=%s", ic_dev->name);
+        printk(KERN_CONT ", addr=%pI4", &ic_myaddr);
+        printk(KERN_CONT ", mask=%pI4", &ic_netmask);
+        printk(KERN_CONT ", gw=%pI4", &ic_gateway);
+        printk(KERN_CONT ",\n     host=%s, domain=%s, nis-domain=%s",
                utsname()->nodename, ic_domain, utsname()->domainname);
-        printk(",\n     bootserver=%pI4", &ic_servaddr);
-        printk(", rootserver=%pI4", &root_server_addr);
-        printk(", rootpath=%s", root_server_path);
+        printk(KERN_CONT ",\n     bootserver=%pI4", &ic_servaddr);
+        printk(KERN_CONT ", rootserver=%pI4", &root_server_addr);
+        printk(KERN_CONT ", rootpath=%s", root_server_path);
         if (ic_dev_mtu)
-                printk(", mtu=%d", ic_dev_mtu);
-        printk("\n");
+                printk(KERN_CONT ", mtu=%d", ic_dev_mtu);
+        printk(KERN_CONT "\n");
 #endif /* !SILENT */
 
         return 0;
@@ -1447,7 +1491,7 @@ late_initcall(ip_auto_config);
 
 /*
  *  Decode any IP configuration options in the "ip=" or "nfsaddrs=" kernel
- *  command line parameter.  See Documentation/filesystems/nfsroot.txt.
+ *  command line parameter.  See Documentation/filesystems/nfs/nfsroot.txt.
  */
 static int __init ic_proto_name(char *name)
 {
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 93e2b787da20..988f52fba54a 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -95,6 +95,7 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
@@ -119,55 +120,89 @@
 #define HASH_SIZE  16
 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 
-static int ipip_net_id;
+static int ipip_net_id __read_mostly;
 struct ipip_net {
-        struct ip_tunnel *tunnels_r_l[HASH_SIZE];
-        struct ip_tunnel *tunnels_r[HASH_SIZE];
-        struct ip_tunnel *tunnels_l[HASH_SIZE];
-        struct ip_tunnel *tunnels_wc[1];
-        struct ip_tunnel **tunnels[4];
+        struct ip_tunnel __rcu *tunnels_r_l[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_r[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_l[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_wc[1];
+        struct ip_tunnel __rcu **tunnels[4];
 
         struct net_device *fb_tunnel_dev;
 };
 
-static void ipip_fb_tunnel_init(struct net_device *dev);
-static void ipip_tunnel_init(struct net_device *dev);
+static int ipip_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_setup(struct net_device *dev);
+static void ipip_dev_free(struct net_device *dev);
 
-static DEFINE_RWLOCK(ipip_lock);
+/*
+ * Locking : hash tables are protected by RCU and RTNL
+ */
+
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
+
+/* often modified stats are per cpu, other are shared (netdev->stats) */
+struct pcpu_tstats {
+        unsigned long   rx_packets;
+        unsigned long   rx_bytes;
+        unsigned long   tx_packets;
+        unsigned long   tx_bytes;
+};
+
+static struct net_device_stats *ipip_get_stats(struct net_device *dev)
+{
+        struct pcpu_tstats sum = { 0 };
+        int i;
+
+        for_each_possible_cpu(i) {
+                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
+
+                sum.rx_packets += tstats->rx_packets;
+                sum.rx_bytes   += tstats->rx_bytes;
+                sum.tx_packets += tstats->tx_packets;
+                sum.tx_bytes   += tstats->tx_bytes;
+        }
+        dev->stats.rx_packets = sum.rx_packets;
+        dev->stats.rx_bytes   = sum.rx_bytes;
+        dev->stats.tx_packets = sum.tx_packets;
+        dev->stats.tx_bytes   = sum.tx_bytes;
+        return &dev->stats;
+}
 
 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
                 __be32 remote, __be32 local)
 {
-        unsigned h0 = HASH(remote);
-        unsigned h1 = HASH(local);
+        unsigned int h0 = HASH(remote);
+        unsigned int h1 = HASH(local);
         struct ip_tunnel *t;
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
-        for (t = ipn->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ipn->tunnels_r_l[h0 ^ h1])
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        for (t = ipn->tunnels_r[h0]; t; t = t->next) {
+
+        for_each_ip_tunnel_rcu(ipn->tunnels_r[h0])
                 if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        for (t = ipn->tunnels_l[h1]; t; t = t->next) {
+
+        for_each_ip_tunnel_rcu(ipn->tunnels_l[h1])
                 if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        if ((t = ipn->tunnels_wc[0]) != NULL && (t->dev->flags&IFF_UP))
+
+        t = rcu_dereference(ipn->tunnels_wc[0]);
+        if (t && (t->dev->flags&IFF_UP))
                 return t;
         return NULL;
 }
 
-static struct ip_tunnel **__ipip_bucket(struct ipip_net *ipn,
+static struct ip_tunnel __rcu **__ipip_bucket(struct ipip_net *ipn,
                 struct ip_tunnel_parm *parms)
 {
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
-        unsigned h = 0;
+        unsigned int h = 0;
         int prio = 0;
 
         if (remote) {
@@ -181,7 +216,7 @@ static struct ip_tunnel **__ipip_bucket(struct ipip_net *ipn,
         return &ipn->tunnels[prio][h];
 }
 
-static inline struct ip_tunnel **ipip_bucket(struct ipip_net *ipn,
+static inline struct ip_tunnel __rcu **ipip_bucket(struct ipip_net *ipn,
                 struct ip_tunnel *t)
 {
         return __ipip_bucket(ipn, &t->parms);
@@ -189,13 +224,14 @@ static inline struct ip_tunnel **ipip_bucket(struct ipip_net *ipn,
 
 static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp;
-
-        for (tp = ipip_bucket(ipn, t); *tp; tp = &(*tp)->next) {
-                if (t == *tp) {
-                        write_lock_bh(&ipip_lock);
-                        *tp = t->next;
-                        write_unlock_bh(&ipip_lock);
+        struct ip_tunnel __rcu **tp;
+        struct ip_tunnel *iter;
+
+        for (tp = ipip_bucket(ipn, t);
+             (iter = rtnl_dereference(*tp)) != NULL;
+             tp = &iter->next) {
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
                         break;
                 }
         }
@@ -203,12 +239,10 @@ static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
 
 static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp = ipip_bucket(ipn, t);
+        struct ip_tunnel __rcu **tp = ipip_bucket(ipn, t);
 
-        t->next = *tp;
-        write_lock_bh(&ipip_lock);
-        *tp = t;
-        write_unlock_bh(&ipip_lock);
+        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
+        rcu_assign_pointer(*tp, t);
 }
 
 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
@@ -216,12 +250,15 @@ static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
 {
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
-        struct ip_tunnel *t, **tp, *nt;
+        struct ip_tunnel *t, *nt;
+        struct ip_tunnel __rcu **tp;
         struct net_device *dev;
         char name[IFNAMSIZ];
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
-        for (tp = __ipip_bucket(ipn, parms); (t = *tp) != NULL; tp = &t->next) {
+        for (tp = __ipip_bucket(ipn, parms);
+                 (t = rtnl_dereference(*tp)) != NULL;
+                 tp = &t->next) {
                 if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr)
                         return t;
         }
@@ -231,7 +268,7 @@ static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
         if (parms->name[0])
                 strlcpy(name, parms->name, IFNAMSIZ);
         else
-                sprintf(name, "tunl%%d");
+                strcpy(name, "tunl%d");
 
         dev = alloc_netdev(sizeof(*t), name, ipip_tunnel_setup);
         if (dev == NULL)
@@ -247,7 +284,8 @@ static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
         nt = netdev_priv(dev);
         nt->parms = *parms;
 
-        ipip_tunnel_init(dev);
+        if (ipip_tunnel_init(dev) < 0)
+                goto failed_free;
 
         if (register_netdevice(dev) < 0)
                 goto failed_free;
@@ -257,20 +295,19 @@ static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
         return nt;
 
 failed_free:
-        free_netdev(dev);
+        ipip_dev_free(dev);
         return NULL;
 }
 
+/* called with RTNL */
 static void ipip_tunnel_uninit(struct net_device *dev)
 {
         struct net *net = dev_net(dev);
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
-        if (dev == ipn->fb_tunnel_dev) {
-                write_lock_bh(&ipip_lock);
-                ipn->tunnels_wc[0] = NULL;
-                write_unlock_bh(&ipip_lock);
-        } else
+        if (dev == ipn->fb_tunnel_dev)
+                rcu_assign_pointer(ipn->tunnels_wc[0], NULL);
+        else
                 ipip_tunnel_unlink(ipn, netdev_priv(dev));
         dev_put(dev);
 }
@@ -318,7 +355,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
 
         err = -ENOENT;
 
-        read_lock(&ipip_lock);
+        rcu_read_lock();
         t = ipip_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
         if (t == NULL || t->parms.iph.daddr == 0)
                 goto out;
@@ -333,7 +370,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipip_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -351,11 +388,13 @@ static int ipip_rcv(struct sk_buff *skb)
         struct ip_tunnel *tunnel;
         const struct iphdr *iph = ip_hdr(skb);
 
-        read_lock(&ipip_lock);
-        if ((tunnel = ipip_tunnel_lookup(dev_net(skb->dev),
-                                        iph->saddr, iph->daddr)) != NULL) {
+        rcu_read_lock();
+        tunnel = ipip_tunnel_lookup(dev_net(skb->dev), iph->saddr, iph->daddr);
+        if (tunnel != NULL) {
+                struct pcpu_tstats *tstats;
+
                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                        read_unlock(&ipip_lock);
+                        rcu_read_unlock();
                         kfree_skb(skb);
                         return 0;
                 }
@@ -367,17 +406,20 @@ static int ipip_rcv(struct sk_buff *skb)
                 skb->protocol = htons(ETH_P_IP);
                 skb->pkt_type = PACKET_HOST;
 
-                tunnel->dev->stats.rx_packets++;
-                tunnel->dev->stats.rx_bytes += skb->len;
-                skb->dev = tunnel->dev;
-                skb_dst_drop(skb);
-                nf_reset(skb);
+                tstats = this_cpu_ptr(tunnel->dev->tstats);
+                tstats->rx_packets++;
+                tstats->rx_bytes += skb->len;
+
+                __skb_tunnel_rx(skb, tunnel->dev);
+
                 ipip_ecn_decapsulate(iph, skb);
+
                 netif_rx(skb);
-                read_unlock(&ipip_lock);
+
+                rcu_read_unlock();
                 return 0;
         }
-        read_unlock(&ipip_lock);
+        rcu_read_unlock();
 
         return -1;
 }
@@ -387,36 +429,31 @@ static int ipip_rcv(struct sk_buff *skb)
  *      and that skb is filled properly by that function.
  */
 
-static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct pcpu_tstats *tstats;
         struct iphdr  *tiph = &tunnel->parms.iph;
         u8     tos = tunnel->parms.iph.tos;
         __be16 df = tiph->frag_off;
         struct rtable *rt;                      /* Route to the other host */
-        struct net_device *tdev;                        /* Device to other host */
+        struct net_device *tdev;                /* Device to other host */
         struct iphdr  *old_iph = ip_hdr(skb);
         struct iphdr  *iph;                     /* Our new IP header */
         unsigned int max_headroom;              /* The extra header space needed */
         __be32 dst = tiph->daddr;
         int    mtu;
 
-        if (tunnel->recursion++) {
-                stats->collisions++;
-                goto tx_error;
-        }
-
         if (skb->protocol != htons(ETH_P_IP))
                 goto tx_error;
 
-        if (tos&1)
+        if (tos & 1)
                 tos = old_iph->tos;
 
         if (!dst) {
                 /* NBMA tunnel */
                 if ((rt = skb_rtable(skb)) == NULL) {
-                        stats->tx_fifo_errors++;
+                        dev->stats.tx_fifo_errors++;
                         goto tx_error;
                 }
                 if ((dst = rt->rt_gateway) == 0)
@@ -424,44 +461,48 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         {
-                struct flowi fl = { .oif = tunnel->parms.link,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = dst,
-                                                .saddr = tiph->saddr,
-                                                .tos = RT_TOS(tos) } },
-                                    .proto = IPPROTO_IPIP };
+                struct flowi fl = {
+                        .oif = tunnel->parms.link,
+                        .fl4_dst = dst,
+                        .fl4_src= tiph->saddr,
+                        .fl4_tos = RT_TOS(tos),
+                        .proto = IPPROTO_IPIP
+                };
+
                 if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
-                        stats->tx_carrier_errors++;
+                        dev->stats.tx_carrier_errors++;
                         goto tx_error_icmp;
                 }
         }
-        tdev = rt->u.dst.dev;
+        tdev = rt->dst.dev;
 
         if (tdev == dev) {
                 ip_rt_put(rt);
-                stats->collisions++;
+                dev->stats.collisions++;
                 goto tx_error;
         }
 
-        if (tiph->frag_off)
-                mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
-        else
-                mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
+        df |= old_iph->frag_off & htons(IP_DF);
 
-        if (mtu < 68) {
-                stats->collisions++;
-                ip_rt_put(rt);
-                goto tx_error;
-        }
-        if (skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
+        if (df) {
+                mtu = dst_mtu(&rt->dst) - sizeof(struct iphdr);
 
-        df |= (old_iph->frag_off&htons(IP_DF));
+                if (mtu < 68) {
+                        dev->stats.collisions++;
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
 
-        if ((old_iph->frag_off&htons(IP_DF)) && mtu < ntohs(old_iph->tot_len)) {
-                icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
-                ip_rt_put(rt);
-                goto tx_error;
+                if (skb_dst(skb))
+                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
+
+                if ((old_iph->frag_off & htons(IP_DF)) &&
+                    mtu < ntohs(old_iph->tot_len)) {
+                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+                                  htonl(mtu));
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
         }
 
         if (tunnel->err_count > 0) {
@@ -483,10 +524,9 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        dev->stats.tx_dropped++;
                         dev_kfree_skb(skb);
-                        tunnel->recursion--;
-                        return 0;
+                        return NETDEV_TX_OK;
                 }
                 if (skb->sk)
                         skb_set_owner_w(new_skb, skb->sk);
@@ -502,7 +542,7 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
                               IPSKB_REROUTED);
         skb_dst_drop(skb);
-        skb_dst_set(skb, &rt->u.dst);
+        skb_dst_set(skb, &rt->dst);
 
         /*
          *      Push down and install the IPIP header.
@@ -521,18 +561,16 @@ static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 iph->ttl        =       old_iph->ttl;
 
         nf_reset(skb);
-
-        IPTUNNEL_XMIT();
-        tunnel->recursion--;
-        return 0;
+        tstats = this_cpu_ptr(dev->tstats);
+        __IPTUNNEL_XMIT(tstats, &dev->stats);
+        return NETDEV_TX_OK;
 
 tx_error_icmp:
         dst_link_failure(skb);
 tx_error:
-        stats->tx_errors++;
+        dev->stats.tx_errors++;
         dev_kfree_skb(skb);
-        tunnel->recursion--;
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static void ipip_tunnel_bind_dev(struct net_device *dev)
@@ -545,15 +583,17 @@ static void ipip_tunnel_bind_dev(struct net_device *dev)
         iph = &tunnel->parms.iph;
 
         if (iph->daddr) {
-                struct flowi fl = { .oif = tunnel->parms.link,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = iph->daddr,
-                                                .saddr = iph->saddr,
-                                                .tos = RT_TOS(iph->tos) } },
-                                    .proto = IPPROTO_IPIP };
+                struct flowi fl = {
+                        .oif = tunnel->parms.link,
+                        .fl4_dst = iph->daddr,
+                        .fl4_src = iph->saddr,
+                        .fl4_tos = RT_TOS(iph->tos),
+                        .proto = IPPROTO_IPIP
+                };
                 struct rtable *rt;
+
                 if (!ip_route_output_key(dev_net(dev), &rt, &fl)) {
-                        tdev = rt->u.dst.dev;
+                        tdev = rt->dst.dev;
                         ip_rt_put(rt);
                 }
                 dev->flags |= IFF_POINTOPOINT;
@@ -628,6 +668,7 @@ ipip_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                                 }
                                 t = netdev_priv(dev);
                                 ipip_tunnel_unlink(ipn, t);
+                                synchronize_net();
                                 t->parms.iph.saddr = p.iph.saddr;
                                 t->parms.iph.daddr = p.iph.daddr;
                                 memcpy(dev->dev_addr, &p.iph.saddr, 4);
@@ -697,13 +738,19 @@ static const struct net_device_ops ipip_netdev_ops = {
         .ndo_start_xmit = ipip_tunnel_xmit,
         .ndo_do_ioctl   = ipip_tunnel_ioctl,
         .ndo_change_mtu = ipip_tunnel_change_mtu,
-
+        .ndo_get_stats  = ipip_get_stats,
 };
 
+static void ipip_dev_free(struct net_device *dev)
+{
+        free_percpu(dev->tstats);
+        free_netdev(dev);
+}
+
 static void ipip_tunnel_setup(struct net_device *dev)
 {
         dev->netdev_ops         = &ipip_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->destructor         = ipip_dev_free;
 
         dev->type               = ARPHRD_TUNNEL;
         dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
@@ -712,10 +759,11 @@ static void ipip_tunnel_setup(struct net_device *dev)
         dev->iflink             = 0;
         dev->addr_len           = 4;
         dev->features           |= NETIF_F_NETNS_LOCAL;
+        dev->features           |= NETIF_F_LLTX;
         dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
 }
 
-static void ipip_tunnel_init(struct net_device *dev)
+static int ipip_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
 
@@ -726,9 +774,15 @@ static void ipip_tunnel_init(struct net_device *dev)
         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
 
         ipip_tunnel_bind_dev(dev);
+
+        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        if (!dev->tstats)
+                return -ENOMEM;
+
+        return 0;
 }
 
-static void ipip_fb_tunnel_init(struct net_device *dev)
+static int __net_init ipip_fb_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct iphdr *iph = &tunnel->parms.iph;
@@ -741,11 +795,16 @@ static void ipip_fb_tunnel_init(struct net_device *dev)
         iph->protocol           = IPPROTO_IPIP;
         iph->ihl                = 5;
 
+        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        if (!dev->tstats)
+                return -ENOMEM;
+
         dev_hold(dev);
-        ipn->tunnels_wc[0]      = tunnel;
+        rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
+        return 0;
 }
 
-static struct xfrm_tunnel ipip_handler = {
+static struct xfrm_tunnel ipip_handler __read_mostly = {
         .handler        =       ipip_rcv,
         .err_handler    =       ipip_err,
         .priority       =       1,
@@ -754,7 +813,7 @@ static struct xfrm_tunnel ipip_handler = {
 static const char banner[] __initconst =
         KERN_INFO "IPv4 over IPv4 tunneling driver\n";
 
-static void ipip_destroy_tunnels(struct ipip_net *ipn)
+static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
 {
         int prio;
 
@@ -762,25 +821,20 @@ static void ipip_destroy_tunnels(struct ipip_net *ipn)
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
                         struct ip_tunnel *t;
-                        while ((t = ipn->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+
+                        t = rtnl_dereference(ipn->tunnels[prio][h]);
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = rtnl_dereference(t->next);
+                        }
                 }
         }
 }
 
-static int ipip_init_net(struct net *net)
+static int __net_init ipip_init_net(struct net *net)
 {
+        struct ipip_net *ipn = net_generic(net, ipip_net_id);
         int err;
-        struct ipip_net *ipn;
-
-        err = -ENOMEM;
-        ipn = kzalloc(sizeof(struct ipip_net), GFP_KERNEL);
-        if (ipn == NULL)
-                goto err_alloc;
-
-        err = net_assign_generic(net, ipip_net_id, ipn);
-        if (err < 0)
-                goto err_assign;
 
         ipn->tunnels[0] = ipn->tunnels_wc;
         ipn->tunnels[1] = ipn->tunnels_l;
@@ -796,7 +850,9 @@ static int ipip_init_net(struct net *net)
         }
         dev_net_set(ipn->fb_tunnel_dev, net);
 
-        ipip_fb_tunnel_init(ipn->fb_tunnel_dev);
+        err = ipip_fb_tunnel_init(ipn->fb_tunnel_dev);
+        if (err)
+                goto err_reg_dev;
 
         if ((err = register_netdev(ipn->fb_tunnel_dev)))
                 goto err_reg_dev;
@@ -804,30 +860,29 @@ static int ipip_init_net(struct net *net)
         return 0;
 
 err_reg_dev:
-        free_netdev(ipn->fb_tunnel_dev);
+        ipip_dev_free(ipn->fb_tunnel_dev);
 err_alloc_dev:
         /* nothing */
-err_assign:
-        kfree(ipn);
-err_alloc:
         return err;
 }
 
-static void ipip_exit_net(struct net *net)
+static void __net_exit ipip_exit_net(struct net *net)
 {
-        struct ipip_net *ipn;
+        struct ipip_net *ipn = net_generic(net, ipip_net_id);
+        LIST_HEAD(list);
 
-        ipn = net_generic(net, ipip_net_id);
         rtnl_lock();
-        ipip_destroy_tunnels(ipn);
-        unregister_netdevice(ipn->fb_tunnel_dev);
+        ipip_destroy_tunnels(ipn, &list);
+        unregister_netdevice_queue(ipn->fb_tunnel_dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
-        kfree(ipn);
 }
 
 static struct pernet_operations ipip_net_ops = {
         .init = ipip_init_net,
         .exit = ipip_exit_net,
+        .id   = &ipip_net_id,
+        .size = sizeof(struct ipip_net),
 };
 
 static int __init ipip_init(void)
@@ -836,15 +891,14 @@ static int __init ipip_init(void)
 
         printk(banner);
 
-        if (xfrm4_tunnel_register(&ipip_handler, AF_INET)) {
+        err = register_pernet_device(&ipip_net_ops);
+        if (err < 0)
+                return err;
+        err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
+        if (err < 0) {
+                unregister_pernet_device(&ipip_net_ops);
                 printk(KERN_INFO "ipip init: can't register tunnel\n");
-                return -EAGAIN;
         }
-
-        err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops);
-        if (err)
-                xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
-
         return err;
 }
 
@@ -853,9 +907,10 @@ static void __exit ipip_fini(void)
         if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
                 printk(KERN_INFO "ipip close: can't deregister tunnel\n");
 
-        unregister_pernet_gen_device(ipip_net_id, &ipip_net_ops);
+        unregister_pernet_device(&ipip_net_ops);
 }
 
 module_init(ipip_init);
 module_exit(ipip_fini);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("tunl0");
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9a8da5ed92b7..3f3a9afd73e0 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -22,7 +22,7 @@
  *                                      overflow.
  *      Carlos Picoto           :       PIMv1 Support
  *      Pavlin Ivanov Radoslavov:       PIMv2 Registers must checksum only PIM header
- *                                      Relax this requrement to work with older peers.
+ *                                      Relax this requirement to work with older peers.
  *
  */
 
@@ -47,6 +47,7 @@
 #include <linux/mroute.h>
 #include <linux/init.h>
 #include <linux/if_ether.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -62,13 +63,42 @@
 #include <net/ipip.h>
 #include <net/checksum.h>
 #include <net/netlink.h>
+#include <net/fib_rules.h>
 
 #if defined(CONFIG_IP_PIMSM_V1) || defined(CONFIG_IP_PIMSM_V2)
 #define CONFIG_IP_PIMSM 1
 #endif
 
+struct mr_table {
+        struct list_head        list;
+#ifdef CONFIG_NET_NS
+        struct net              *net;
+#endif
+        u32                     id;
+        struct sock __rcu       *mroute_sk;
+        struct timer_list       ipmr_expire_timer;
+        struct list_head        mfc_unres_queue;
+        struct list_head        mfc_cache_array[MFC_LINES];
+        struct vif_device       vif_table[MAXVIFS];
+        int                     maxvif;
+        atomic_t                cache_resolve_queue_len;
+        int                     mroute_do_assert;
+        int                     mroute_do_pim;
+#if defined(CONFIG_IP_PIMSM_V1) || defined(CONFIG_IP_PIMSM_V2)
+        int                     mroute_reg_vif_num;
+#endif
+};
+
+struct ipmr_rule {
+        struct fib_rule         common;
+};
+
+struct ipmr_result {
+        struct mr_table         *mrt;
+};
+
 /* Big lock, protecting vif table, mrt cache and mroute socket state.
-   Note that the changes are semaphored via rtnl_lock.
+ * Note that the changes are semaphored via rtnl_lock.
  */
 
 static DEFINE_RWLOCK(mrt_lock);
@@ -77,33 +107,232 @@ static DEFINE_RWLOCK(mrt_lock);
  *      Multicast router control variables
  */
 
-#define VIF_EXISTS(_net, _idx) ((_net)->ipv4.vif_table[_idx].dev != NULL)
-
-static struct mfc_cache *mfc_unres_queue;               /* Queue of unresolved entries */
+#define VIF_EXISTS(_mrt, _idx) ((_mrt)->vif_table[_idx].dev != NULL)
 
 /* Special spinlock for queue of unresolved entries */
 static DEFINE_SPINLOCK(mfc_unres_lock);
 
 /* We return to original Alan's scheme. Hash table of resolved
-   entries is changed only in process context and protected
-   with weak lock mrt_lock. Queue of unresolved entries is protected
-   with strong spinlock mfc_unres_lock.
-
-   In this case data path is free of exclusive locks at all.
+ * entries is changed only in process context and protected
+ * with weak lock mrt_lock. Queue of unresolved entries is protected
+ * with strong spinlock mfc_unres_lock.
+ *
+ * In this case data path is free of exclusive locks at all.
  */
 
 static struct kmem_cache *mrt_cachep __read_mostly;
 
-static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local);
-static int ipmr_cache_report(struct net *net,
+static struct mr_table *ipmr_new_table(struct net *net, u32 id);
+static int ip_mr_forward(struct net *net, struct mr_table *mrt,
+                         struct sk_buff *skb, struct mfc_cache *cache,
+                         int local);
+static int ipmr_cache_report(struct mr_table *mrt,
                              struct sk_buff *pkt, vifi_t vifi, int assert);
-static int ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm);
+static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
+                              struct mfc_cache *c, struct rtmsg *rtm);
+static void ipmr_expire_process(unsigned long arg);
 
-#ifdef CONFIG_IP_PIMSM_V2
-static struct net_protocol pim_protocol;
+#ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
+#define ipmr_for_each_table(mrt, net) \
+        list_for_each_entry_rcu(mrt, &net->ipv4.mr_tables, list)
+
+static struct mr_table *ipmr_get_table(struct net *net, u32 id)
+{
+        struct mr_table *mrt;
+
+        ipmr_for_each_table(mrt, net) {
+                if (mrt->id == id)
+                        return mrt;
+        }
+        return NULL;
+}
+
+static int ipmr_fib_lookup(struct net *net, struct flowi *flp,
+                           struct mr_table **mrt)
+{
+        struct ipmr_result res;
+        struct fib_lookup_arg arg = { .result = &res, };
+        int err;
+
+        err = fib_rules_lookup(net->ipv4.mr_rules_ops, flp, 0, &arg);
+        if (err < 0)
+                return err;
+        *mrt = res.mrt;
+        return 0;
+}
+
+static int ipmr_rule_action(struct fib_rule *rule, struct flowi *flp,
+                            int flags, struct fib_lookup_arg *arg)
+{
+        struct ipmr_result *res = arg->result;
+        struct mr_table *mrt;
+
+        switch (rule->action) {
+        case FR_ACT_TO_TBL:
+                break;
+        case FR_ACT_UNREACHABLE:
+                return -ENETUNREACH;
+        case FR_ACT_PROHIBIT:
+                return -EACCES;
+        case FR_ACT_BLACKHOLE:
+        default:
+                return -EINVAL;
+        }
+
+        mrt = ipmr_get_table(rule->fr_net, rule->table);
+        if (mrt == NULL)
+                return -EAGAIN;
+        res->mrt = mrt;
+        return 0;
+}
+
+static int ipmr_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
+{
+        return 1;
+}
+
+static const struct nla_policy ipmr_rule_policy[FRA_MAX + 1] = {
+        FRA_GENERIC_POLICY,
+};
+
+static int ipmr_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
+                               struct fib_rule_hdr *frh, struct nlattr **tb)
+{
+        return 0;
+}
+
+static int ipmr_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
+                             struct nlattr **tb)
+{
+        return 1;
+}
+
+static int ipmr_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
+                          struct fib_rule_hdr *frh)
+{
+        frh->dst_len = 0;
+        frh->src_len = 0;
+        frh->tos     = 0;
+        return 0;
+}
+
+static const struct fib_rules_ops __net_initdata ipmr_rules_ops_template = {
+        .family         = RTNL_FAMILY_IPMR,
+        .rule_size      = sizeof(struct ipmr_rule),
+        .addr_size      = sizeof(u32),
+        .action         = ipmr_rule_action,
+        .match          = ipmr_rule_match,
+        .configure      = ipmr_rule_configure,
+        .compare        = ipmr_rule_compare,
+        .default_pref   = fib_default_rule_pref,
+        .fill           = ipmr_rule_fill,
+        .nlgroup        = RTNLGRP_IPV4_RULE,
+        .policy         = ipmr_rule_policy,
+        .owner          = THIS_MODULE,
+};
+
+static int __net_init ipmr_rules_init(struct net *net)
+{
+        struct fib_rules_ops *ops;
+        struct mr_table *mrt;
+        int err;
+
+        ops = fib_rules_register(&ipmr_rules_ops_template, net);
+        if (IS_ERR(ops))
+                return PTR_ERR(ops);
+
+        INIT_LIST_HEAD(&net->ipv4.mr_tables);
+
+        mrt = ipmr_new_table(net, RT_TABLE_DEFAULT);
+        if (mrt == NULL) {
+                err = -ENOMEM;
+                goto err1;
+        }
+
+        err = fib_default_rule_add(ops, 0x7fff, RT_TABLE_DEFAULT, 0);
+        if (err < 0)
+                goto err2;
+
+        net->ipv4.mr_rules_ops = ops;
+        return 0;
+
+err2:
+        kfree(mrt);
+err1:
+        fib_rules_unregister(ops);
+        return err;
+}
+
+static void __net_exit ipmr_rules_exit(struct net *net)
+{
+        struct mr_table *mrt, *next;
+
+        list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
+                list_del(&mrt->list);
+                kfree(mrt);
+        }
+        fib_rules_unregister(net->ipv4.mr_rules_ops);
+}
+#else
+#define ipmr_for_each_table(mrt, net) \
+        for (mrt = net->ipv4.mrt; mrt; mrt = NULL)
+
+static struct mr_table *ipmr_get_table(struct net *net, u32 id)
+{
+        return net->ipv4.mrt;
+}
+
+static int ipmr_fib_lookup(struct net *net, struct flowi *flp,
+                           struct mr_table **mrt)
+{
+        *mrt = net->ipv4.mrt;
+        return 0;
+}
+
+static int __net_init ipmr_rules_init(struct net *net)
+{
+        net->ipv4.mrt = ipmr_new_table(net, RT_TABLE_DEFAULT);
+        return net->ipv4.mrt ? 0 : -ENOMEM;
+}
+
+static void __net_exit ipmr_rules_exit(struct net *net)
+{
+        kfree(net->ipv4.mrt);
+}
 #endif
 
-static struct timer_list ipmr_expire_timer;
+static struct mr_table *ipmr_new_table(struct net *net, u32 id)
+{
+        struct mr_table *mrt;
+        unsigned int i;
+
+        mrt = ipmr_get_table(net, id);
+        if (mrt != NULL)
+                return mrt;
+
+        mrt = kzalloc(sizeof(*mrt), GFP_KERNEL);
+        if (mrt == NULL)
+                return NULL;
+        write_pnet(&mrt->net, net);
+        mrt->id = id;
+
+        /* Forwarding cache */
+        for (i = 0; i < MFC_LINES; i++)
+                INIT_LIST_HEAD(&mrt->mfc_cache_array[i]);
+
+        INIT_LIST_HEAD(&mrt->mfc_unres_queue);
+
+        setup_timer(&mrt->ipmr_expire_timer, ipmr_expire_process,
+                    (unsigned long)mrt);
+
+#ifdef CONFIG_IP_PIMSM
+        mrt->mroute_reg_vif_num = -1;
+#endif
+#ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
+        list_add_tail_rcu(&mrt->list, &net->ipv4.mr_tables);
+#endif
+        return mrt;
+}
 
 /* Service routines creating virtual interfaces: DVMRP tunnels and PIMREG */
 
@@ -167,9 +396,9 @@ struct net_device *ipmr_new_tunnel(struct net *net, struct vifctl *v)
                         set_fs(KERNEL_DS);
                         err = ops->ndo_do_ioctl(dev, &ifr, SIOCADDTUNNEL);
                         set_fs(oldfs);
-                } else
+                } else {
                         err = -EOPNOTSUPP;
-
+                }
                 dev = NULL;
 
                 if (err == 0 &&
@@ -201,18 +430,30 @@ failure:
 
 #ifdef CONFIG_IP_PIMSM
 
-static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct net *net = dev_net(dev);
+        struct mr_table *mrt;
+        struct flowi fl = {
+                .oif            = dev->ifindex,
+                .iif            = skb->skb_iif,
+                .mark           = skb->mark,
+        };
+        int err;
+
+        err = ipmr_fib_lookup(net, &fl, &mrt);
+        if (err < 0) {
+                kfree_skb(skb);
+                return err;
+        }
 
         read_lock(&mrt_lock);
         dev->stats.tx_bytes += skb->len;
         dev->stats.tx_packets++;
-        ipmr_cache_report(net, skb, net->ipv4.mroute_reg_vif_num,
-                          IGMPMSG_WHOLEPKT);
+        ipmr_cache_report(mrt, skb, mrt->mroute_reg_vif_num, IGMPMSG_WHOLEPKT);
         read_unlock(&mrt_lock);
         kfree_skb(skb);
-        return 0;
+        return NETDEV_TX_OK;
 }
 
 static const struct net_device_ops reg_vif_netdev_ops = {
@@ -229,12 +470,18 @@ static void reg_vif_setup(struct net_device *dev)
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
-static struct net_device *ipmr_reg_vif(struct net *net)
+static struct net_device *ipmr_reg_vif(struct net *net, struct mr_table *mrt)
 {
         struct net_device *dev;
         struct in_device *in_dev;
+        char name[IFNAMSIZ];
+
+        if (mrt->id == RT_TABLE_DEFAULT)
+                sprintf(name, "pimreg");
+        else
+                sprintf(name, "pimreg%u", mrt->id);
 
-        dev = alloc_netdev(0, "pimreg", reg_vif_setup);
+        dev = alloc_netdev(0, name, reg_vif_setup);
 
         if (dev == NULL)
                 return NULL;
@@ -248,7 +495,8 @@ static struct net_device *ipmr_reg_vif(struct net *net)
         dev->iflink = 0;
 
         rcu_read_lock();
-        if ((in_dev = __in_dev_get_rcu(dev)) == NULL) {
+        in_dev = __in_dev_get_rcu(dev);
+        if (!in_dev) {
                 rcu_read_unlock();
                 goto failure;
         }
@@ -279,16 +527,17 @@ failure:
  *      @notify: Set to 1, if the caller is a notifier_call
  */
 
-static int vif_delete(struct net *net, int vifi, int notify)
+static int vif_delete(struct mr_table *mrt, int vifi, int notify,
+                      struct list_head *head)
 {
         struct vif_device *v;
         struct net_device *dev;
         struct in_device *in_dev;
 
-        if (vifi < 0 || vifi >= net->ipv4.maxvif)
+        if (vifi < 0 || vifi >= mrt->maxvif)
                 return -EADDRNOTAVAIL;
 
-        v = &net->ipv4.vif_table[vifi];
+        v = &mrt->vif_table[vifi];
 
         write_lock_bh(&mrt_lock);
         dev = v->dev;
@@ -300,52 +549,60 @@ static int vif_delete(struct net *net, int vifi, int notify)
         }
 
 #ifdef CONFIG_IP_PIMSM
-        if (vifi == net->ipv4.mroute_reg_vif_num)
-                net->ipv4.mroute_reg_vif_num = -1;
+        if (vifi == mrt->mroute_reg_vif_num)
+                mrt->mroute_reg_vif_num = -1;
 #endif
 
-        if (vifi+1 == net->ipv4.maxvif) {
+        if (vifi + 1 == mrt->maxvif) {
                 int tmp;
-                for (tmp=vifi-1; tmp>=0; tmp--) {
-                        if (VIF_EXISTS(net, tmp))
+
+                for (tmp = vifi - 1; tmp >= 0; tmp--) {
+                        if (VIF_EXISTS(mrt, tmp))
                                 break;
                 }
-                net->ipv4.maxvif = tmp+1;
+                mrt->maxvif = tmp+1;
         }
 
         write_unlock_bh(&mrt_lock);
 
         dev_set_allmulti(dev, -1);
 
-        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
+        in_dev = __in_dev_get_rtnl(dev);
+        if (in_dev) {
                 IPV4_DEVCONF(in_dev->cnf, MC_FORWARDING)--;
                 ip_rt_multicast_event(in_dev);
         }
 
-        if (v->flags&(VIFF_TUNNEL|VIFF_REGISTER) && !notify)
-                unregister_netdevice(dev);
+        if (v->flags & (VIFF_TUNNEL | VIFF_REGISTER) && !notify)
+                unregister_netdevice_queue(dev, head);
 
         dev_put(dev);
         return 0;
 }
 
-static inline void ipmr_cache_free(struct mfc_cache *c)
+static void ipmr_cache_free_rcu(struct rcu_head *head)
 {
-        release_net(mfc_net(c));
+        struct mfc_cache *c = container_of(head, struct mfc_cache, rcu);
+
         kmem_cache_free(mrt_cachep, c);
 }
 
+static inline void ipmr_cache_free(struct mfc_cache *c)
+{
+        call_rcu(&c->rcu, ipmr_cache_free_rcu);
+}
+
 /* Destroy an unresolved cache entry, killing queued skbs
-   and reporting error to netlink readers.
+ * and reporting error to netlink readers.
  */
 
-static void ipmr_destroy_unres(struct mfc_cache *c)
+static void ipmr_destroy_unres(struct mr_table *mrt, struct mfc_cache *c)
 {
+        struct net *net = read_pnet(&mrt->net);
         struct sk_buff *skb;
         struct nlmsgerr *e;
-        struct net *net = mfc_net(c);
 
-        atomic_dec(&net->ipv4.cache_resolve_queue_len);
+        atomic_dec(&mrt->cache_resolve_queue_len);
 
         while ((skb = skb_dequeue(&c->mfc_un.unres.unresolved))) {
                 if (ip_hdr(skb)->version == 0) {
@@ -358,50 +615,49 @@ static void ipmr_destroy_unres(struct mfc_cache *c)
                         memset(&e->msg, 0, sizeof(e->msg));
 
                         rtnl_unicast(skb, net, NETLINK_CB(skb).pid);
-                } else
+                } else {
                         kfree_skb(skb);
+                }
         }
 
         ipmr_cache_free(c);
 }
 
 
-/* Single timer process for all the unresolved queue. */
+/* Timer process for the unresolved queue. */
 
-static void ipmr_expire_process(unsigned long dummy)
+static void ipmr_expire_process(unsigned long arg)
 {
+        struct mr_table *mrt = (struct mr_table *)arg;
         unsigned long now;
         unsigned long expires;
-        struct mfc_cache *c, **cp;
+        struct mfc_cache *c, *next;
 
         if (!spin_trylock(&mfc_unres_lock)) {
-                mod_timer(&ipmr_expire_timer, jiffies+HZ/10);
+                mod_timer(&mrt->ipmr_expire_timer, jiffies+HZ/10);
                 return;
         }
 
-        if (mfc_unres_queue == NULL)
+        if (list_empty(&mrt->mfc_unres_queue))
                 goto out;
 
         now = jiffies;
         expires = 10*HZ;
-        cp = &mfc_unres_queue;
 
-        while ((c=*cp) != NULL) {
+        list_for_each_entry_safe(c, next, &mrt->mfc_unres_queue, list) {
                 if (time_after(c->mfc_un.unres.expires, now)) {
                         unsigned long interval = c->mfc_un.unres.expires - now;
                         if (interval < expires)
                                 expires = interval;
-                        cp = &c->next;
                         continue;
                 }
 
-                *cp = c->next;
-
-                ipmr_destroy_unres(c);
+                list_del(&c->list);
+                ipmr_destroy_unres(mrt, c);
         }
 
-        if (mfc_unres_queue != NULL)
-                mod_timer(&ipmr_expire_timer, jiffies + expires);
+        if (!list_empty(&mrt->mfc_unres_queue))
+                mod_timer(&mrt->ipmr_expire_timer, jiffies + expires);
 
 out:
         spin_unlock(&mfc_unres_lock);
@@ -409,17 +665,17 @@ out:
 
 /* Fill oifs list. It is called under write locked mrt_lock. */
 
-static void ipmr_update_thresholds(struct mfc_cache *cache, unsigned char *ttls)
+static void ipmr_update_thresholds(struct mr_table *mrt, struct mfc_cache *cache,
+                                   unsigned char *ttls)
 {
         int vifi;
-        struct net *net = mfc_net(cache);
 
         cache->mfc_un.res.minvif = MAXVIFS;
         cache->mfc_un.res.maxvif = 0;
         memset(cache->mfc_un.res.ttls, 255, MAXVIFS);
 
-        for (vifi = 0; vifi < net->ipv4.maxvif; vifi++) {
-                if (VIF_EXISTS(net, vifi) &&
+        for (vifi = 0; vifi < mrt->maxvif; vifi++) {
+                if (VIF_EXISTS(mrt, vifi) &&
                     ttls[vifi] && ttls[vifi] < 255) {
                         cache->mfc_un.res.ttls[vifi] = ttls[vifi];
                         if (cache->mfc_un.res.minvif > vifi)
@@ -430,16 +686,17 @@ static void ipmr_update_thresholds(struct mfc_cache *cache, unsigned char *ttls)
         }
 }
 
-static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
+static int vif_add(struct net *net, struct mr_table *mrt,
+                   struct vifctl *vifc, int mrtsock)
 {
         int vifi = vifc->vifc_vifi;
-        struct vif_device *v = &net->ipv4.vif_table[vifi];
+        struct vif_device *v = &mrt->vif_table[vifi];
         struct net_device *dev;
         struct in_device *in_dev;
         int err;
 
         /* Is vif busy ? */
-        if (VIF_EXISTS(net, vifi))
+        if (VIF_EXISTS(mrt, vifi))
                 return -EADDRINUSE;
 
         switch (vifc->vifc_flags) {
@@ -449,9 +706,9 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                  * Special Purpose VIF in PIM
                  * All the packets will be sent to the daemon
                  */
-                if (net->ipv4.mroute_reg_vif_num >= 0)
+                if (mrt->mroute_reg_vif_num >= 0)
                         return -EADDRINUSE;
-                dev = ipmr_reg_vif(net);
+                dev = ipmr_reg_vif(net, mrt);
                 if (!dev)
                         return -ENOBUFS;
                 err = dev_set_allmulti(dev, 1);
@@ -473,8 +730,18 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                         return err;
                 }
                 break;
+
+        case VIFF_USE_IFINDEX:
         case 0:
-                dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+                if (vifc->vifc_flags == VIFF_USE_IFINDEX) {
+                        dev = dev_get_by_index(net, vifc->vifc_lcl_ifindex);
+                        if (dev && __in_dev_get_rtnl(dev) == NULL) {
+                                dev_put(dev);
+                                return -EADDRNOTAVAIL;
+                        }
+                } else {
+                        dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+                }
                 if (!dev)
                         return -EADDRNOTAVAIL;
                 err = dev_set_allmulti(dev, 1);
@@ -487,14 +754,16 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                 return -EINVAL;
         }
 
-        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
+        in_dev = __in_dev_get_rtnl(dev);
+        if (!in_dev) {
+                dev_put(dev);
                 return -EADDRNOTAVAIL;
+        }
         IPV4_DEVCONF(in_dev->cnf, MC_FORWARDING)++;
         ip_rt_multicast_event(in_dev);
 
-        /*
-         *      Fill in the VIF structures
-         */
+        /* Fill in the VIF structures */
+
         v->rate_limit = vifc->vifc_rate_limit;
         v->local = vifc->vifc_lcl_addr.s_addr;
         v->remote = vifc->vifc_rmt_addr.s_addr;
@@ -507,57 +776,57 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
         v->pkt_in = 0;
         v->pkt_out = 0;
         v->link = dev->ifindex;
-        if (v->flags&(VIFF_TUNNEL|VIFF_REGISTER))
+        if (v->flags & (VIFF_TUNNEL | VIFF_REGISTER))
                 v->link = dev->iflink;
 
         /* And finish update writing critical data */
         write_lock_bh(&mrt_lock);
         v->dev = dev;
 #ifdef CONFIG_IP_PIMSM
-        if (v->flags&VIFF_REGISTER)
-                net->ipv4.mroute_reg_vif_num = vifi;
+        if (v->flags & VIFF_REGISTER)
+                mrt->mroute_reg_vif_num = vifi;
 #endif
-        if (vifi+1 > net->ipv4.maxvif)
-                net->ipv4.maxvif = vifi+1;
+        if (vifi+1 > mrt->maxvif)
+                mrt->maxvif = vifi+1;
         write_unlock_bh(&mrt_lock);
         return 0;
 }
 
-static struct mfc_cache *ipmr_cache_find(struct net *net,
+/* called with rcu_read_lock() */
+static struct mfc_cache *ipmr_cache_find(struct mr_table *mrt,
                                          __be32 origin,
                                          __be32 mcastgrp)
 {
         int line = MFC_HASH(mcastgrp, origin);
         struct mfc_cache *c;
 
-        for (c = net->ipv4.mfc_cache_array[line]; c; c = c->next) {
-                if (c->mfc_origin==origin && c->mfc_mcastgrp==mcastgrp)
-                        break;
+        list_for_each_entry_rcu(c, &mrt->mfc_cache_array[line], list) {
+                if (c->mfc_origin == origin && c->mfc_mcastgrp == mcastgrp)
+                        return c;
         }
-        return c;
+        return NULL;
 }
 
 /*
  *      Allocate a multicast cache entry
  */
-static struct mfc_cache *ipmr_cache_alloc(struct net *net)
+static struct mfc_cache *ipmr_cache_alloc(void)
 {
         struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
-        if (c == NULL)
-                return NULL;
-        c->mfc_un.res.minvif = MAXVIFS;
-        mfc_net_set(c, net);
+
+        if (c)
+                c->mfc_un.res.minvif = MAXVIFS;
         return c;
 }
 
-static struct mfc_cache *ipmr_cache_alloc_unres(struct net *net)
+static struct mfc_cache *ipmr_cache_alloc_unres(void)
 {
         struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_ATOMIC);
-        if (c == NULL)
-                return NULL;
-        skb_queue_head_init(&c->mfc_un.unres.unresolved);
-        c->mfc_un.unres.expires = jiffies + 10*HZ;
-        mfc_net_set(c, net);
+
+        if (c) {
+                skb_queue_head_init(&c->mfc_un.unres.unresolved);
+                c->mfc_un.unres.expires = jiffies + 10*HZ;
+        }
         return c;
 }
 
@@ -565,22 +834,21 @@ static struct mfc_cache *ipmr_cache_alloc_unres(struct net *net)
  *      A cache entry has gone into a resolved state from queued
  */
 
-static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
+static void ipmr_cache_resolve(struct net *net, struct mr_table *mrt,
+                               struct mfc_cache *uc, struct mfc_cache *c)
 {
         struct sk_buff *skb;
         struct nlmsgerr *e;
 
-        /*
-         *      Play the pending entries through our router
-         */
+        /* Play the pending entries through our router */
 
         while ((skb = __skb_dequeue(&uc->mfc_un.unres.unresolved))) {
                 if (ip_hdr(skb)->version == 0) {
                         struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct iphdr));
 
-                        if (ipmr_fill_mroute(skb, c, NLMSG_DATA(nlh)) > 0) {
-                                nlh->nlmsg_len = (skb_tail_pointer(skb) -
-                                                  (u8 *)nlh);
+                        if (__ipmr_fill_mroute(mrt, skb, c, NLMSG_DATA(nlh)) > 0) {
+                                nlh->nlmsg_len = skb_tail_pointer(skb) -
+                                                 (u8 *)nlh;
                         } else {
                                 nlh->nlmsg_type = NLMSG_ERROR;
                                 nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
@@ -590,9 +858,10 @@ static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
                                 memset(&e->msg, 0, sizeof(e->msg));
                         }
 
-                        rtnl_unicast(skb, mfc_net(c), NETLINK_CB(skb).pid);
-                } else
-                        ip_mr_forward(skb, c, 0);
+                        rtnl_unicast(skb, net, NETLINK_CB(skb).pid);
+                } else {
+                        ip_mr_forward(net, mrt, skb, c, 0);
+                }
         }
 }
 
@@ -603,13 +872,14 @@ static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
  *      Called under mrt_lock.
  */
 
-static int ipmr_cache_report(struct net *net,
+static int ipmr_cache_report(struct mr_table *mrt,
                              struct sk_buff *pkt, vifi_t vifi, int assert)
 {
         struct sk_buff *skb;
         const int ihl = ip_hdrlen(pkt);
         struct igmphdr *igmp;
         struct igmpmsg *msg;
+        struct sock *mroute_sk;
         int ret;
 
 #ifdef CONFIG_IP_PIMSM
@@ -625,9 +895,9 @@ static int ipmr_cache_report(struct net *net,
 #ifdef CONFIG_IP_PIMSM
         if (assert == IGMPMSG_WHOLEPKT) {
                 /* Ugly, but we have no choice with this interface.
-                   Duplicate old header, fix ihl, length etc.
-                   And all this only to mangle msg->im_msgtype and
-                   to set msg->im_mbz to "mbz" :-)
+                 * Duplicate old header, fix ihl, length etc.
+                 * And all this only to mangle msg->im_msgtype and
+                 * to set msg->im_mbz to "mbz" :-)
                  */
                 skb_push(skb, sizeof(struct iphdr));
                 skb_reset_network_header(skb);
@@ -636,7 +906,7 @@ static int ipmr_cache_report(struct net *net,
                 memcpy(msg, skb_network_header(pkt), sizeof(struct iphdr));
                 msg->im_msgtype = IGMPMSG_WHOLEPKT;
                 msg->im_mbz = 0;
-                msg->im_vif = net->ipv4.mroute_reg_vif_num;
+                msg->im_vif = mrt->mroute_reg_vif_num;
                 ip_hdr(skb)->ihl = sizeof(struct iphdr) >> 2;
                 ip_hdr(skb)->tot_len = htons(ntohs(ip_hdr(pkt)->tot_len) +
                                              sizeof(struct iphdr));
@@ -644,39 +914,38 @@ static int ipmr_cache_report(struct net *net,
 #endif
         {
 
-        /*
-         *      Copy the IP header
-         */
+        /* Copy the IP header */
 
         skb->network_header = skb->tail;
         skb_put(skb, ihl);
         skb_copy_to_linear_data(skb, pkt->data, ihl);
-        ip_hdr(skb)->protocol = 0;                      /* Flag to the kernel this is a route add */
+        ip_hdr(skb)->protocol = 0;      /* Flag to the kernel this is a route add */
         msg = (struct igmpmsg *)skb_network_header(skb);
         msg->im_vif = vifi;
         skb_dst_set(skb, dst_clone(skb_dst(pkt)));
 
-        /*
-         *      Add our header
-         */
+        /* Add our header */
 
-        igmp=(struct igmphdr *)skb_put(skb, sizeof(struct igmphdr));
+        igmp = (struct igmphdr *)skb_put(skb, sizeof(struct igmphdr));
         igmp->type      =
         msg->im_msgtype = assert;
-        igmp->code      =       0;
-        ip_hdr(skb)->tot_len = htons(skb->len);                 /* Fix the length */
+        igmp->code      = 0;
+        ip_hdr(skb)->tot_len = htons(skb->len);         /* Fix the length */
         skb->transport_header = skb->network_header;
         }
 
-        if (net->ipv4.mroute_sk == NULL) {
+        rcu_read_lock();
+        mroute_sk = rcu_dereference(mrt->mroute_sk);
+        if (mroute_sk == NULL) {
+                rcu_read_unlock();
                 kfree_skb(skb);
                 return -EINVAL;
         }
 
-        /*
-         *      Deliver to mrouted
-         */
-        ret = sock_queue_rcv_skb(net->ipv4.mroute_sk, skb);
+        /* Deliver to mrouted */
+
+        ret = sock_queue_rcv_skb(mroute_sk, skb);
+        rcu_read_unlock();
         if (ret < 0) {
                 if (net_ratelimit())
                         printk(KERN_WARNING "mroute: pending queue full, dropping entries.\n");
@@ -691,44 +960,42 @@ static int ipmr_cache_report(struct net *net,
  */
 
 static int
-ipmr_cache_unresolved(struct net *net, vifi_t vifi, struct sk_buff *skb)
+ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi, struct sk_buff *skb)
 {
+        bool found = false;
         int err;
         struct mfc_cache *c;
         const struct iphdr *iph = ip_hdr(skb);
 
         spin_lock_bh(&mfc_unres_lock);
-        for (c=mfc_unres_queue; c; c=c->next) {
-                if (net_eq(mfc_net(c), net) &&
-                    c->mfc_mcastgrp == iph->daddr &&
-                    c->mfc_origin == iph->saddr)
+        list_for_each_entry(c, &mrt->mfc_unres_queue, list) {
+                if (c->mfc_mcastgrp == iph->daddr &&
+                    c->mfc_origin == iph->saddr) {
+                        found = true;
                         break;
+                }
         }
 
-        if (c == NULL) {
-                /*
-                 *      Create a new entry if allowable
-                 */
+        if (!found) {
+                /* Create a new entry if allowable */
 
-                if (atomic_read(&net->ipv4.cache_resolve_queue_len) >= 10 ||
-                    (c = ipmr_cache_alloc_unres(net)) == NULL) {
+                if (atomic_read(&mrt->cache_resolve_queue_len) >= 10 ||
+                    (c = ipmr_cache_alloc_unres()) == NULL) {
                         spin_unlock_bh(&mfc_unres_lock);
 
                         kfree_skb(skb);
                         return -ENOBUFS;
                 }
 
-                /*
-                 *      Fill in the new cache entry
-                 */
+                /* Fill in the new cache entry */
+
                 c->mfc_parent   = -1;
                 c->mfc_origin   = iph->saddr;
                 c->mfc_mcastgrp = iph->daddr;
 
-                /*
-                 *      Reflect first query at mrouted.
-                 */
-                err = ipmr_cache_report(net, skb, vifi, IGMPMSG_NOCACHE);
+                /* Reflect first query at mrouted. */
+
+                err = ipmr_cache_report(mrt, skb, vifi, IGMPMSG_NOCACHE);
                 if (err < 0) {
                         /* If the report failed throw the cache entry
                            out - Brad Parker
@@ -740,17 +1007,16 @@ ipmr_cache_unresolved(struct net *net, vifi_t vifi, struct sk_buff *skb)
                         return err;
                 }
 
-                atomic_inc(&net->ipv4.cache_resolve_queue_len);
-                c->next = mfc_unres_queue;
-                mfc_unres_queue = c;
+                atomic_inc(&mrt->cache_resolve_queue_len);
+                list_add(&c->list, &mrt->mfc_unres_queue);
 
-                mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
+                if (atomic_read(&mrt->cache_resolve_queue_len) == 1)
+                        mod_timer(&mrt->ipmr_expire_timer, c->mfc_un.unres.expires);
         }
 
-        /*
-         *      See if we can append the packet
-         */
-        if (c->mfc_un.unres.unresolved.qlen>3) {
+        /* See if we can append the packet */
+
+        if (c->mfc_un.unres.unresolved.qlen > 3) {
                 kfree_skb(skb);
                 err = -ENOBUFS;
         } else {
@@ -766,20 +1032,17 @@ ipmr_cache_unresolved(struct net *net, vifi_t vifi, struct sk_buff *skb)
  *      MFC cache manipulation by user space mroute daemon
  */
 
-static int ipmr_mfc_delete(struct net *net, struct mfcctl *mfc)
+static int ipmr_mfc_delete(struct mr_table *mrt, struct mfcctl *mfc)
 {
         int line;
-        struct mfc_cache *c, **cp;
+        struct mfc_cache *c, *next;
 
         line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
-        for (cp = &net->ipv4.mfc_cache_array[line];
-             (c = *cp) != NULL; cp = &c->next) {
+        list_for_each_entry_safe(c, next, &mrt->mfc_cache_array[line], list) {
                 if (c->mfc_origin == mfc->mfcc_origin.s_addr &&
                     c->mfc_mcastgrp == mfc->mfcc_mcastgrp.s_addr) {
-                        write_lock_bh(&mrt_lock);
-                        *cp = c->next;
-                        write_unlock_bh(&mrt_lock);
+                        list_del_rcu(&c->list);
 
                         ipmr_cache_free(c);
                         return 0;
@@ -788,24 +1051,30 @@ static int ipmr_mfc_delete(struct net *net, struct mfcctl *mfc)
         return -ENOENT;
 }
 
-static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
+static int ipmr_mfc_add(struct net *net, struct mr_table *mrt,
+                        struct mfcctl *mfc, int mrtsock)
 {
+        bool found = false;
         int line;
-        struct mfc_cache *uc, *c, **cp;
+        struct mfc_cache *uc, *c;
+
+        if (mfc->mfcc_parent >= MAXVIFS)
+                return -ENFILE;
 
         line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
-        for (cp = &net->ipv4.mfc_cache_array[line];
-             (c = *cp) != NULL; cp = &c->next) {
+        list_for_each_entry(c, &mrt->mfc_cache_array[line], list) {
                 if (c->mfc_origin == mfc->mfcc_origin.s_addr &&
-                    c->mfc_mcastgrp == mfc->mfcc_mcastgrp.s_addr)
+                    c->mfc_mcastgrp == mfc->mfcc_mcastgrp.s_addr) {
+                        found = true;
                         break;
+                }
         }
 
-        if (c != NULL) {
+        if (found) {
                 write_lock_bh(&mrt_lock);
                 c->mfc_parent = mfc->mfcc_parent;
-                ipmr_update_thresholds(c, mfc->mfcc_ttls);
+                ipmr_update_thresholds(mrt, c, mfc->mfcc_ttls);
                 if (!mrtsock)
                         c->mfc_flags |= MFC_STATIC;
                 write_unlock_bh(&mrt_lock);
@@ -815,43 +1084,40 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
         if (!ipv4_is_multicast(mfc->mfcc_mcastgrp.s_addr))
                 return -EINVAL;
 
-        c = ipmr_cache_alloc(net);
+        c = ipmr_cache_alloc();
         if (c == NULL)
                 return -ENOMEM;
 
         c->mfc_origin = mfc->mfcc_origin.s_addr;
         c->mfc_mcastgrp = mfc->mfcc_mcastgrp.s_addr;
         c->mfc_parent = mfc->mfcc_parent;
-        ipmr_update_thresholds(c, mfc->mfcc_ttls);
+        ipmr_update_thresholds(mrt, c, mfc->mfcc_ttls);
         if (!mrtsock)
                 c->mfc_flags |= MFC_STATIC;
 
-        write_lock_bh(&mrt_lock);
-        c->next = net->ipv4.mfc_cache_array[line];
-        net->ipv4.mfc_cache_array[line] = c;
-        write_unlock_bh(&mrt_lock);
+        list_add_rcu(&c->list, &mrt->mfc_cache_array[line]);
 
         /*
          *      Check to see if we resolved a queued list. If so we
          *      need to send on the frames and tidy up.
          */
+        found = false;
         spin_lock_bh(&mfc_unres_lock);
-        for (cp = &mfc_unres_queue; (uc=*cp) != NULL;
-             cp = &uc->next) {
-                if (net_eq(mfc_net(uc), net) &&
-                    uc->mfc_origin == c->mfc_origin &&
+        list_for_each_entry(uc, &mrt->mfc_unres_queue, list) {
+                if (uc->mfc_origin == c->mfc_origin &&
                     uc->mfc_mcastgrp == c->mfc_mcastgrp) {
-                        *cp = uc->next;
-                        atomic_dec(&net->ipv4.cache_resolve_queue_len);
+                        list_del(&uc->list);
+                        atomic_dec(&mrt->cache_resolve_queue_len);
+                        found = true;
                         break;
                 }
         }
-        if (mfc_unres_queue == NULL)
-                del_timer(&ipmr_expire_timer);
+        if (list_empty(&mrt->mfc_unres_queue))
+                del_timer(&mrt->ipmr_expire_timer);
         spin_unlock_bh(&mfc_unres_lock);
 
-        if (uc) {
-                ipmr_cache_resolve(uc, c);
+        if (found) {
+                ipmr_cache_resolve(net, mrt, uc, c);
                 ipmr_cache_free(uc);
         }
         return 0;
@@ -861,69 +1127,56 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
  *      Close the multicast socket, and clear the vif tables etc
  */
 
-static void mroute_clean_tables(struct net *net)
+static void mroute_clean_tables(struct mr_table *mrt)
 {
         int i;
+        LIST_HEAD(list);
+        struct mfc_cache *c, *next;
 
-        /*
-         *      Shut down all active vif entries
-         */
-        for (i = 0; i < net->ipv4.maxvif; i++) {
-                if (!(net->ipv4.vif_table[i].flags&VIFF_STATIC))
-                        vif_delete(net, i, 0);
+        /* Shut down all active vif entries */
+
+        for (i = 0; i < mrt->maxvif; i++) {
+                if (!(mrt->vif_table[i].flags & VIFF_STATIC))
+                        vif_delete(mrt, i, 0, &list);
         }
+        unregister_netdevice_many(&list);
 
-        /*
-         *      Wipe the cache
-         */
-        for (i=0; i<MFC_LINES; i++) {
-                struct mfc_cache *c, **cp;
+        /* Wipe the cache */
 
-                cp = &net->ipv4.mfc_cache_array[i];
-                while ((c = *cp) != NULL) {
-                        if (c->mfc_flags&MFC_STATIC) {
-                                cp = &c->next;
+        for (i = 0; i < MFC_LINES; i++) {
+                list_for_each_entry_safe(c, next, &mrt->mfc_cache_array[i], list) {
+                        if (c->mfc_flags & MFC_STATIC)
                                 continue;
-                        }
-                        write_lock_bh(&mrt_lock);
-                        *cp = c->next;
-                        write_unlock_bh(&mrt_lock);
-
+                        list_del_rcu(&c->list);
                         ipmr_cache_free(c);
                 }
         }
 
-        if (atomic_read(&net->ipv4.cache_resolve_queue_len) != 0) {
-                struct mfc_cache *c, **cp;
-
+        if (atomic_read(&mrt->cache_resolve_queue_len) != 0) {
                 spin_lock_bh(&mfc_unres_lock);
-                cp = &mfc_unres_queue;
-                while ((c = *cp) != NULL) {
-                        if (!net_eq(mfc_net(c), net)) {
-                                cp = &c->next;
-                                continue;
-                        }
-                        *cp = c->next;
-
-                        ipmr_destroy_unres(c);
+                list_for_each_entry_safe(c, next, &mrt->mfc_unres_queue, list) {
+                        list_del(&c->list);
+                        ipmr_destroy_unres(mrt, c);
                 }
                 spin_unlock_bh(&mfc_unres_lock);
         }
 }
 
+/* called from ip_ra_control(), before an RCU grace period,
+ * we dont need to call synchronize_rcu() here
+ */
 static void mrtsock_destruct(struct sock *sk)
 {
         struct net *net = sock_net(sk);
+        struct mr_table *mrt;
 
         rtnl_lock();
-        if (sk == net->ipv4.mroute_sk) {
-                IPV4_DEVCONF_ALL(net, MC_FORWARDING)--;
-
-                write_lock_bh(&mrt_lock);
-                net->ipv4.mroute_sk = NULL;
-                write_unlock_bh(&mrt_lock);
-
-                mroute_clean_tables(net);
+        ipmr_for_each_table(mrt, net) {
+                if (sk == rtnl_dereference(mrt->mroute_sk)) {
+                        IPV4_DEVCONF_ALL(net, MC_FORWARDING)--;
+                        rcu_assign_pointer(mrt->mroute_sk, NULL);
+                        mroute_clean_tables(mrt);
+                }
         }
         rtnl_unlock();
 }
@@ -935,44 +1188,47 @@ static void mrtsock_destruct(struct sock *sk)
  *      MOSPF/PIM router set up we can clean this up.
  */
 
-int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int optlen)
+int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsigned int optlen)
 {
         int ret;
         struct vifctl vif;
         struct mfcctl mfc;
         struct net *net = sock_net(sk);
+        struct mr_table *mrt;
+
+        mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
+        if (mrt == NULL)
+                return -ENOENT;
 
         if (optname != MRT_INIT) {
-                if (sk != net->ipv4.mroute_sk && !capable(CAP_NET_ADMIN))
+                if (sk != rcu_dereference_raw(mrt->mroute_sk) &&
+                    !capable(CAP_NET_ADMIN))
                         return -EACCES;
         }
 
         switch (optname) {
         case MRT_INIT:
                 if (sk->sk_type != SOCK_RAW ||
-                    inet_sk(sk)->num != IPPROTO_IGMP)
+                    inet_sk(sk)->inet_num != IPPROTO_IGMP)
                         return -EOPNOTSUPP;
                 if (optlen != sizeof(int))
                         return -ENOPROTOOPT;
 
                 rtnl_lock();
-                if (net->ipv4.mroute_sk) {
+                if (rtnl_dereference(mrt->mroute_sk)) {
                         rtnl_unlock();
                         return -EADDRINUSE;
                 }
 
                 ret = ip_ra_control(sk, 1, mrtsock_destruct);
                 if (ret == 0) {
-                        write_lock_bh(&mrt_lock);
-                        net->ipv4.mroute_sk = sk;
-                        write_unlock_bh(&mrt_lock);
-
+                        rcu_assign_pointer(mrt->mroute_sk, sk);
                         IPV4_DEVCONF_ALL(net, MC_FORWARDING)++;
                 }
                 rtnl_unlock();
                 return ret;
         case MRT_DONE:
-                if (sk != net->ipv4.mroute_sk)
+                if (sk != rcu_dereference_raw(mrt->mroute_sk))
                         return -EACCES;
                 return ip_ra_control(sk, 0, NULL);
         case MRT_ADD_VIF:
@@ -985,9 +1241,10 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
                         return -ENFILE;
                 rtnl_lock();
                 if (optname == MRT_ADD_VIF) {
-                        ret = vif_add(net, &vif, sk == net->ipv4.mroute_sk);
+                        ret = vif_add(net, mrt, &vif,
+                                      sk == rtnl_dereference(mrt->mroute_sk));
                 } else {
-                        ret = vif_delete(net, vif.vifc_vifi, 0);
+                        ret = vif_delete(mrt, vif.vifc_vifi, 0, NULL);
                 }
                 rtnl_unlock();
                 return ret;
@@ -1004,9 +1261,10 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
                         return -EFAULT;
                 rtnl_lock();
                 if (optname == MRT_DEL_MFC)
-                        ret = ipmr_mfc_delete(net, &mfc);
+                        ret = ipmr_mfc_delete(mrt, &mfc);
                 else
-                        ret = ipmr_mfc_add(net, &mfc, sk == net->ipv4.mroute_sk);
+                        ret = ipmr_mfc_add(net, mrt, &mfc,
+                                           sk == rtnl_dereference(mrt->mroute_sk));
                 rtnl_unlock();
                 return ret;
                 /*
@@ -1015,9 +1273,9 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
         case MRT_ASSERT:
         {
                 int v;
-                if (get_user(v,(int __user *)optval))
+                if (get_user(v, (int __user *)optval))
                         return -EFAULT;
-                net->ipv4.mroute_do_assert = (v) ? 1 : 0;
+                mrt->mroute_do_assert = (v) ? 1 : 0;
                 return 0;
         }
 #ifdef CONFIG_IP_PIMSM
@@ -1025,15 +1283,38 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
         {
                 int v;
 
-                if (get_user(v,(int __user *)optval))
+                if (get_user(v, (int __user *)optval))
                         return -EFAULT;
                 v = (v) ? 1 : 0;
 
                 rtnl_lock();
                 ret = 0;
-                if (v != net->ipv4.mroute_do_pim) {
-                        net->ipv4.mroute_do_pim = v;
-                        net->ipv4.mroute_do_assert = v;
+                if (v != mrt->mroute_do_pim) {
+                        mrt->mroute_do_pim = v;
+                        mrt->mroute_do_assert = v;
+                }
+                rtnl_unlock();
+                return ret;
+        }
+#endif
+#ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
+        case MRT_TABLE:
+        {
+                u32 v;
+
+                if (optlen != sizeof(u32))
+                        return -EINVAL;
+                if (get_user(v, (u32 __user *)optval))
+                        return -EFAULT;
+
+                rtnl_lock();
+                ret = 0;
+                if (sk == rtnl_dereference(mrt->mroute_sk)) {
+                        ret = -EBUSY;
+                } else {
+                        if (!ipmr_new_table(net, v))
+                                ret = -ENOMEM;
+                        raw_sk(sk)->ipmr_table = v;
                 }
                 rtnl_unlock();
                 return ret;
@@ -1057,12 +1338,17 @@ int ip_mroute_getsockopt(struct sock *sk, int optname, char __user *optval, int
         int olr;
         int val;
         struct net *net = sock_net(sk);
+        struct mr_table *mrt;
+
+        mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
+        if (mrt == NULL)
+                return -ENOENT;
 
         if (optname != MRT_VERSION &&
 #ifdef CONFIG_IP_PIMSM
-           optname!=MRT_PIM &&
+           optname != MRT_PIM &&
 #endif
-           optname!=MRT_ASSERT)
+           optname != MRT_ASSERT)
                 return -ENOPROTOOPT;
 
         if (get_user(olr, optlen))
@@ -1078,10 +1364,10 @@ int ip_mroute_getsockopt(struct sock *sk, int optname, char __user *optval, int
                 val = 0x0305;
 #ifdef CONFIG_IP_PIMSM
         else if (optname == MRT_PIM)
-                val = net->ipv4.mroute_do_pim;
+                val = mrt->mroute_do_pim;
 #endif
         else
-                val = net->ipv4.mroute_do_assert;
+                val = mrt->mroute_do_assert;
         if (copy_to_user(optval, &val, olr))
                 return -EFAULT;
         return 0;
@@ -1098,16 +1384,21 @@ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg)
         struct vif_device *vif;
         struct mfc_cache *c;
         struct net *net = sock_net(sk);
+        struct mr_table *mrt;
+
+        mrt = ipmr_get_table(net, raw_sk(sk)->ipmr_table ? : RT_TABLE_DEFAULT);
+        if (mrt == NULL)
+                return -ENOENT;
 
         switch (cmd) {
         case SIOCGETVIFCNT:
                 if (copy_from_user(&vr, arg, sizeof(vr)))
                         return -EFAULT;
-                if (vr.vifi >= net->ipv4.maxvif)
+                if (vr.vifi >= mrt->maxvif)
                         return -EINVAL;
                 read_lock(&mrt_lock);
-                vif = &net->ipv4.vif_table[vr.vifi];
-                if (VIF_EXISTS(net, vr.vifi)) {
+                vif = &mrt->vif_table[vr.vifi];
+                if (VIF_EXISTS(mrt, vr.vifi)) {
                         vr.icount = vif->pkt_in;
                         vr.ocount = vif->pkt_out;
                         vr.ibytes = vif->bytes_in;
@@ -1124,19 +1415,19 @@ int ipmr_ioctl(struct sock *sk, int cmd, void __user *arg)
                 if (copy_from_user(&sr, arg, sizeof(sr)))
                         return -EFAULT;
 
-                read_lock(&mrt_lock);
-                c = ipmr_cache_find(net, sr.src.s_addr, sr.grp.s_addr);
+                rcu_read_lock();
+                c = ipmr_cache_find(mrt, sr.src.s_addr, sr.grp.s_addr);
                 if (c) {
                         sr.pktcnt = c->mfc_un.res.pkt;
                         sr.bytecnt = c->mfc_un.res.bytes;
                         sr.wrong_if = c->mfc_un.res.wrong_if;
-                        read_unlock(&mrt_lock);
+                        rcu_read_unlock();
 
                         if (copy_to_user(arg, &sr, sizeof(sr)))
                                 return -EFAULT;
                         return 0;
                 }
-                read_unlock(&mrt_lock);
+                rcu_read_unlock();
                 return -EADDRNOTAVAIL;
         default:
                 return -ENOIOCTLCMD;
@@ -1148,19 +1439,22 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
 {
         struct net_device *dev = ptr;
         struct net *net = dev_net(dev);
+        struct mr_table *mrt;
         struct vif_device *v;
         int ct;
-
-        if (!net_eq(dev_net(dev), net))
-                return NOTIFY_DONE;
+        LIST_HEAD(list);
 
         if (event != NETDEV_UNREGISTER)
                 return NOTIFY_DONE;
-        v = &net->ipv4.vif_table[0];
-        for (ct = 0; ct < net->ipv4.maxvif; ct++, v++) {
-                if (v->dev == dev)
-                        vif_delete(net, ct, 1);
+
+        ipmr_for_each_table(mrt, net) {
+                v = &mrt->vif_table[0];
+                for (ct = 0; ct < mrt->maxvif; ct++, v++) {
+                        if (v->dev == dev)
+                                vif_delete(mrt, ct, 1, &list);
+                }
         }
+        unregister_netdevice_many(&list);
         return NOTIFY_DONE;
 }
 
@@ -1170,7 +1464,7 @@ static struct notifier_block ip_mr_notifier = {
 };
 
 /*
- *      Encapsulate a packet by attaching a valid IPIP header to it.
+ *      Encapsulate a packet by attaching a valid IPIP header to it.
  *      This avoids tunnel drivers and other mess and gives us the speed so
  *      important for multicast video.
  */
@@ -1185,7 +1479,7 @@ static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
         skb_reset_network_header(skb);
         iph = ip_hdr(skb);
 
-        iph->version    =       4;
+        iph->version    =       4;
         iph->tos        =       old_iph->tos;
         iph->ttl        =       old_iph->ttl;
         iph->frag_off   =       0;
@@ -1203,7 +1497,7 @@ static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
 
 static inline int ipmr_forward_finish(struct sk_buff *skb)
 {
-        struct ip_options * opt = &(IPCB(skb)->opt);
+        struct ip_options *opt = &(IPCB(skb)->opt);
 
         IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
 
@@ -1217,11 +1511,11 @@ static inline int ipmr_forward_finish(struct sk_buff *skb)
  *      Processing handlers for ipmr_forward
  */
 
-static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
+static void ipmr_queue_xmit(struct net *net, struct mr_table *mrt,
+                            struct sk_buff *skb, struct mfc_cache *c, int vifi)
 {
-        struct net *net = mfc_net(c);
         const struct iphdr *iph = ip_hdr(skb);
-        struct vif_device *vif = &net->ipv4.vif_table[vifi];
+        struct vif_device *vif = &mrt->vif_table[vifi];
         struct net_device *dev;
         struct rtable *rt;
         int    encap = 0;
@@ -1235,37 +1529,41 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
                 vif->bytes_out += skb->len;
                 vif->dev->stats.tx_bytes += skb->len;
                 vif->dev->stats.tx_packets++;
-                ipmr_cache_report(net, skb, vifi, IGMPMSG_WHOLEPKT);
+                ipmr_cache_report(mrt, skb, vifi, IGMPMSG_WHOLEPKT);
                 goto out_free;
         }
 #endif
 
-        if (vif->flags&VIFF_TUNNEL) {
-                struct flowi fl = { .oif = vif->link,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = vif->remote,
-                                                .saddr = vif->local,
-                                                .tos = RT_TOS(iph->tos) } },
-                                    .proto = IPPROTO_IPIP };
+        if (vif->flags & VIFF_TUNNEL) {
+                struct flowi fl = {
+                        .oif = vif->link,
+                        .fl4_dst = vif->remote,
+                        .fl4_src = vif->local,
+                        .fl4_tos = RT_TOS(iph->tos),
+                        .proto = IPPROTO_IPIP
+                };
+
                 if (ip_route_output_key(net, &rt, &fl))
                         goto out_free;
                 encap = sizeof(struct iphdr);
         } else {
-                struct flowi fl = { .oif = vif->link,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = iph->daddr,
-                                                .tos = RT_TOS(iph->tos) } },
-                                    .proto = IPPROTO_IPIP };
+                struct flowi fl = {
+                        .oif = vif->link,
+                        .fl4_dst = iph->daddr,
+                        .fl4_tos = RT_TOS(iph->tos),
+                        .proto = IPPROTO_IPIP
+                };
+
                 if (ip_route_output_key(net, &rt, &fl))
                         goto out_free;
         }
 
-        dev = rt->u.dst.dev;
+        dev = rt->dst.dev;
 
-        if (skb->len+encap > dst_mtu(&rt->u.dst) && (ntohs(iph->frag_off) & IP_DF)) {
+        if (skb->len+encap > dst_mtu(&rt->dst) && (ntohs(iph->frag_off) & IP_DF)) {
                 /* Do not fragment multicasts. Alas, IPv4 does not
-                   allow to send ICMP, so that packets will disappear
-                   to blackhole.
+                 * allow to send ICMP, so that packets will disappear
+                 * to blackhole.
                  */
 
                 IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
@@ -1273,7 +1571,7 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
                 goto out_free;
         }
 
-        encap += LL_RESERVED_SPACE(dev) + rt->u.dst.header_len;
+        encap += LL_RESERVED_SPACE(dev) + rt->dst.header_len;
 
         if (skb_cow(skb, encap)) {
                 ip_rt_put(rt);
@@ -1284,11 +1582,12 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
         vif->bytes_out += skb->len;
 
         skb_dst_drop(skb);
-        skb_dst_set(skb, &rt->u.dst);
+        skb_dst_set(skb, &rt->dst);
         ip_decrease_ttl(ip_hdr(skb));
 
         /* FIXME: forward and output firewalls used to be called here.
-         * What do we do with netfilter? -- RR */
+         * What do we do with netfilter? -- RR
+         */
         if (vif->flags & VIFF_TUNNEL) {
                 ip_encap(skb, vif->local, vif->remote);
                 /* FIXME: extra output firewall step used to be here. --RR */
@@ -1309,21 +1608,20 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
          * not mrouter) cannot join to more than one interface - it will
          * result in receiving multiple packets.
          */
-        NF_HOOK(PF_INET, NF_INET_FORWARD, skb, skb->dev, dev,
+        NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD, skb, skb->dev, dev,
                 ipmr_forward_finish);
         return;
 
 out_free:
         kfree_skb(skb);
-        return;
 }
 
-static int ipmr_find_vif(struct net_device *dev)
+static int ipmr_find_vif(struct mr_table *mrt, struct net_device *dev)
 {
-        struct net *net = dev_net(dev);
         int ct;
-        for (ct = net->ipv4.maxvif-1; ct >= 0; ct--) {
-                if (net->ipv4.vif_table[ct].dev == dev)
+
+        for (ct = mrt->maxvif-1; ct >= 0; ct--) {
+                if (mrt->vif_table[ct].dev == dev)
                         break;
         }
         return ct;
@@ -1331,11 +1629,12 @@ static int ipmr_find_vif(struct net_device *dev)
 
 /* "local" means that we should preserve one skb (for local delivery) */
 
-static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local)
+static int ip_mr_forward(struct net *net, struct mr_table *mrt,
+                         struct sk_buff *skb, struct mfc_cache *cache,
+                         int local)
 {
         int psend = -1;
         int vif, ct;
-        struct net *net = mfc_net(cache);
 
         vif = cache->mfc_parent;
         cache->mfc_un.res.pkt++;
@@ -1344,55 +1643,58 @@ static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local
         /*
          * Wrong interface: drop packet and (maybe) send PIM assert.
          */
-        if (net->ipv4.vif_table[vif].dev != skb->dev) {
+        if (mrt->vif_table[vif].dev != skb->dev) {
                 int true_vifi;
 
-                if (skb_rtable(skb)->fl.iif == 0) {
+                if (rt_is_output_route(skb_rtable(skb))) {
                         /* It is our own packet, looped back.
-                           Very complicated situation...
-
-                           The best workaround until routing daemons will be
-                           fixed is not to redistribute packet, if it was
-                           send through wrong interface. It means, that
-                           multicast applications WILL NOT work for
-                           (S,G), which have default multicast route pointing
-                           to wrong oif. In any case, it is not a good
-                           idea to use multicasting applications on router.
+                         * Very complicated situation...
+                         *
+                         * The best workaround until routing daemons will be
+                         * fixed is not to redistribute packet, if it was
+                         * send through wrong interface. It means, that
+                         * multicast applications WILL NOT work for
+                         * (S,G), which have default multicast route pointing
+                         * to wrong oif. In any case, it is not a good
+                         * idea to use multicasting applications on router.
                          */
                         goto dont_forward;
                 }
 
                 cache->mfc_un.res.wrong_if++;
-                true_vifi = ipmr_find_vif(skb->dev);
+                true_vifi = ipmr_find_vif(mrt, skb->dev);
 
-                if (true_vifi >= 0 && net->ipv4.mroute_do_assert &&
+                if (true_vifi >= 0 && mrt->mroute_do_assert &&
                     /* pimsm uses asserts, when switching from RPT to SPT,
-                       so that we cannot check that packet arrived on an oif.
-                       It is bad, but otherwise we would need to move pretty
-                       large chunk of pimd to kernel. Ough... --ANK
+                     * so that we cannot check that packet arrived on an oif.
+                     * It is bad, but otherwise we would need to move pretty
+                     * large chunk of pimd to kernel. Ough... --ANK
                      */
-                    (net->ipv4.mroute_do_pim ||
+                    (mrt->mroute_do_pim ||
                      cache->mfc_un.res.ttls[true_vifi] < 255) &&
                     time_after(jiffies,
                                cache->mfc_un.res.last_assert + MFC_ASSERT_THRESH)) {
                         cache->mfc_un.res.last_assert = jiffies;
-                        ipmr_cache_report(net, skb, true_vifi, IGMPMSG_WRONGVIF);
+                        ipmr_cache_report(mrt, skb, true_vifi, IGMPMSG_WRONGVIF);
                 }
                 goto dont_forward;
         }
 
-        net->ipv4.vif_table[vif].pkt_in++;
-        net->ipv4.vif_table[vif].bytes_in += skb->len;
+        mrt->vif_table[vif].pkt_in++;
+        mrt->vif_table[vif].bytes_in += skb->len;
 
         /*
          *      Forward the frame
          */
-        for (ct = cache->mfc_un.res.maxvif-1; ct >= cache->mfc_un.res.minvif; ct--) {
+        for (ct = cache->mfc_un.res.maxvif - 1;
+             ct >= cache->mfc_un.res.minvif; ct--) {
                 if (ip_hdr(skb)->ttl > cache->mfc_un.res.ttls[ct]) {
                         if (psend != -1) {
                                 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
+
                                 if (skb2)
-                                        ipmr_queue_xmit(skb2, cache, psend);
+                                        ipmr_queue_xmit(net, mrt, skb2, cache,
+                                                        psend);
                         }
                         psend = ct;
                 }
@@ -1400,10 +1702,11 @@ static int ip_mr_forward(struct sk_buff *skb, struct mfc_cache *cache, int local
         if (psend != -1) {
                 if (local) {
                         struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
+
                         if (skb2)
-                                ipmr_queue_xmit(skb2, cache, psend);
+                                ipmr_queue_xmit(net, mrt, skb2, cache, psend);
                 } else {
-                        ipmr_queue_xmit(skb, cache, psend);
+                        ipmr_queue_xmit(net, mrt, skb, cache, psend);
                         return 0;
                 }
         }
@@ -1417,6 +1720,7 @@ dont_forward:
 
 /*
  *      Multicast packets for forwarding arrive here
+ *      Called with rcu_read_lock();
  */
 
 int ip_mr_input(struct sk_buff *skb)
@@ -1424,37 +1728,45 @@ int ip_mr_input(struct sk_buff *skb)
         struct mfc_cache *cache;
         struct net *net = dev_net(skb->dev);
         int local = skb_rtable(skb)->rt_flags & RTCF_LOCAL;
+        struct mr_table *mrt;
+        int err;
 
         /* Packet is looped back after forward, it should not be
-           forwarded second time, but still can be delivered locally.
+         * forwarded second time, but still can be delivered locally.
          */
-        if (IPCB(skb)->flags&IPSKB_FORWARDED)
+        if (IPCB(skb)->flags & IPSKB_FORWARDED)
                 goto dont_forward;
 
+        err = ipmr_fib_lookup(net, &skb_rtable(skb)->fl, &mrt);
+        if (err < 0) {
+                kfree_skb(skb);
+                return err;
+        }
+
         if (!local) {
-                    if (IPCB(skb)->opt.router_alert) {
-                            if (ip_call_ra_chain(skb))
-                                    return 0;
-                    } else if (ip_hdr(skb)->protocol == IPPROTO_IGMP){
-                            /* IGMPv1 (and broken IGMPv2 implementations sort of
-                               Cisco IOS <= 11.2(8)) do not put router alert
-                               option to IGMP packets destined to routable
-                               groups. It is very bad, because it means
-                               that we can forward NO IGMP messages.
-                             */
-                            read_lock(&mrt_lock);
-                            if (net->ipv4.mroute_sk) {
-                                    nf_reset(skb);
-                                    raw_rcv(net->ipv4.mroute_sk, skb);
-                                    read_unlock(&mrt_lock);
-                                    return 0;
-                            }
-                            read_unlock(&mrt_lock);
+                if (IPCB(skb)->opt.router_alert) {
+                        if (ip_call_ra_chain(skb))
+                                return 0;
+                } else if (ip_hdr(skb)->protocol == IPPROTO_IGMP) {
+                        /* IGMPv1 (and broken IGMPv2 implementations sort of
+                         * Cisco IOS <= 11.2(8)) do not put router alert
+                         * option to IGMP packets destined to routable
+                         * groups. It is very bad, because it means
+                         * that we can forward NO IGMP messages.
+                         */
+                        struct sock *mroute_sk;
+
+                        mroute_sk = rcu_dereference(mrt->mroute_sk);
+                        if (mroute_sk) {
+                                nf_reset(skb);
+                                raw_rcv(mroute_sk, skb);
+                                return 0;
+                        }
                     }
         }
 
-        read_lock(&mrt_lock);
-        cache = ipmr_cache_find(net, ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
+        /* already under rcu_read_lock() */
+        cache = ipmr_cache_find(mrt, ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
 
         /*
          *      No usable cache entry
@@ -1465,27 +1777,26 @@ int ip_mr_input(struct sk_buff *skb)
                 if (local) {
                         struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
                         ip_local_deliver(skb);
-                        if (skb2 == NULL) {
-                                read_unlock(&mrt_lock);
+                        if (skb2 == NULL)
                                 return -ENOBUFS;
-                        }
                         skb = skb2;
                 }
 
-                vif = ipmr_find_vif(skb->dev);
+                read_lock(&mrt_lock);
+                vif = ipmr_find_vif(mrt, skb->dev);
                 if (vif >= 0) {
-                        int err = ipmr_cache_unresolved(net, vif, skb);
+                        int err2 = ipmr_cache_unresolved(mrt, vif, skb);
                         read_unlock(&mrt_lock);
 
-                        return err;
+                        return err2;
                 }
                 read_unlock(&mrt_lock);
                 kfree_skb(skb);
                 return -ENODEV;
         }
 
-        ip_mr_forward(skb, cache, local);
-
+        read_lock(&mrt_lock);
+        ip_mr_forward(net, mrt, skb, cache, local);
         read_unlock(&mrt_lock);
 
         if (local)
@@ -1501,18 +1812,19 @@ dont_forward:
 }
 
 #ifdef CONFIG_IP_PIMSM
-static int __pim_rcv(struct sk_buff *skb, unsigned int pimlen)
+/* called with rcu_read_lock() */
+static int __pim_rcv(struct mr_table *mrt, struct sk_buff *skb,
+                     unsigned int pimlen)
 {
         struct net_device *reg_dev = NULL;
         struct iphdr *encap;
-        struct net *net = dev_net(skb->dev);
 
         encap = (struct iphdr *)(skb_transport_header(skb) + pimlen);
         /*
-           Check that:
-           a. packet is really destinted to a multicast group
-           b. packet is not a NULL-REGISTER
-           c. packet is not truncated
+         * Check that:
+         * a. packet is really sent to a multicast group
+         * b. packet is not a NULL-REGISTER
+         * c. packet is not truncated
          */
         if (!ipv4_is_multicast(encap->daddr) ||
             encap->tot_len == 0 ||
@@ -1520,30 +1832,25 @@ static int __pim_rcv(struct sk_buff *skb, unsigned int pimlen)
                 return 1;
 
         read_lock(&mrt_lock);
-        if (net->ipv4.mroute_reg_vif_num >= 0)
-                reg_dev = net->ipv4.vif_table[net->ipv4.mroute_reg_vif_num].dev;
-        if (reg_dev)
-                dev_hold(reg_dev);
+        if (mrt->mroute_reg_vif_num >= 0)
+                reg_dev = mrt->vif_table[mrt->mroute_reg_vif_num].dev;
         read_unlock(&mrt_lock);
 
         if (reg_dev == NULL)
                 return 1;
 
         skb->mac_header = skb->network_header;
-        skb_pull(skb, (u8*)encap - skb->data);
+        skb_pull(skb, (u8 *)encap - skb->data);
         skb_reset_network_header(skb);
-        skb->dev = reg_dev;
         skb->protocol = htons(ETH_P_IP);
-        skb->ip_summed = 0;
+        skb->ip_summed = CHECKSUM_NONE;
         skb->pkt_type = PACKET_HOST;
-        skb_dst_drop(skb);
-        reg_dev->stats.rx_bytes += skb->len;
-        reg_dev->stats.rx_packets++;
-        nf_reset(skb);
+
+        skb_tunnel_rx(skb, reg_dev);
+
         netif_rx(skb);
-        dev_put(reg_dev);
 
-        return 0;
+        return NET_RX_SUCCESS;
 }
 #endif
 
@@ -1552,21 +1859,25 @@ static int __pim_rcv(struct sk_buff *skb, unsigned int pimlen)
  * Handle IGMP messages of PIMv1
  */
 
-int pim_rcv_v1(struct sk_buff * skb)
+int pim_rcv_v1(struct sk_buff *skb)
 {
         struct igmphdr *pim;
         struct net *net = dev_net(skb->dev);
+        struct mr_table *mrt;
 
         if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(struct iphdr)))
                 goto drop;
 
         pim = igmp_hdr(skb);
 
-        if (!net->ipv4.mroute_do_pim ||
+        if (ipmr_fib_lookup(net, &skb_rtable(skb)->fl, &mrt) < 0)
+                goto drop;
+
+        if (!mrt->mroute_do_pim ||
             pim->group != PIM_V1_VERSION || pim->code != PIM_V1_REGISTER)
                 goto drop;
 
-        if (__pim_rcv(skb, sizeof(*pim))) {
+        if (__pim_rcv(mrt, skb, sizeof(*pim))) {
 drop:
                 kfree_skb(skb);
         }
@@ -1575,21 +1886,26 @@ drop:
 #endif
 
 #ifdef CONFIG_IP_PIMSM_V2
-static int pim_rcv(struct sk_buff * skb)
+static int pim_rcv(struct sk_buff *skb)
 {
         struct pimreghdr *pim;
+        struct net *net = dev_net(skb->dev);
+        struct mr_table *mrt;
 
         if (!pskb_may_pull(skb, sizeof(*pim) + sizeof(struct iphdr)))
                 goto drop;
 
         pim = (struct pimreghdr *)skb_transport_header(skb);
-        if (pim->type != ((PIM_VERSION<<4)|(PIM_REGISTER)) ||
-            (pim->flags&PIM_NULL_REGISTER) ||
+        if (pim->type != ((PIM_VERSION << 4) | (PIM_REGISTER)) ||
+            (pim->flags & PIM_NULL_REGISTER) ||
             (ip_compute_csum((void *)pim, sizeof(*pim)) != 0 &&
              csum_fold(skb_checksum(skb, 0, skb->len, 0))))
                 goto drop;
 
-        if (__pim_rcv(skb, sizeof(*pim))) {
+        if (ipmr_fib_lookup(net, &skb_rtable(skb)->fl, &mrt) < 0)
+                goto drop;
+
+        if (__pim_rcv(mrt, skb, sizeof(*pim))) {
 drop:
                 kfree_skb(skb);
         }
@@ -1597,29 +1913,31 @@ drop:
 }
 #endif
 
-static int
-ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
+static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
+                              struct mfc_cache *c, struct rtmsg *rtm)
 {
         int ct;
         struct rtnexthop *nhp;
-        struct net *net = mfc_net(c);
-        struct net_device *dev = net->ipv4.vif_table[c->mfc_parent].dev;
         u8 *b = skb_tail_pointer(skb);
         struct rtattr *mp_head;
 
-        if (dev)
-                RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
+        /* If cache is unresolved, don't try to parse IIF and OIF */
+        if (c->mfc_parent >= MAXVIFS)
+                return -ENOENT;
+
+        if (VIF_EXISTS(mrt, c->mfc_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &mrt->vif_table[c->mfc_parent].dev->ifindex);
 
         mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
 
         for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
-                if (c->mfc_un.res.ttls[ct] < 255) {
+                if (VIF_EXISTS(mrt, ct) && c->mfc_un.res.ttls[ct] < 255) {
                         if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                 goto rtattr_failure;
                         nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
                         nhp->rtnh_flags = 0;
                         nhp->rtnh_hops = c->mfc_un.res.ttls[ct];
-                        nhp->rtnh_ifindex = net->ipv4.vif_table[ct].dev->ifindex;
+                        nhp->rtnh_ifindex = mrt->vif_table[ct].dev->ifindex;
                         nhp->rtnh_len = sizeof(*nhp);
                 }
         }
@@ -1637,31 +1955,41 @@ int ipmr_get_route(struct net *net,
                    struct sk_buff *skb, struct rtmsg *rtm, int nowait)
 {
         int err;
+        struct mr_table *mrt;
         struct mfc_cache *cache;
         struct rtable *rt = skb_rtable(skb);
 
-        read_lock(&mrt_lock);
-        cache = ipmr_cache_find(net, rt->rt_src, rt->rt_dst);
+        mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
+        if (mrt == NULL)
+                return -ENOENT;
+
+        rcu_read_lock();
+        cache = ipmr_cache_find(mrt, rt->rt_src, rt->rt_dst);
 
         if (cache == NULL) {
                 struct sk_buff *skb2;
                 struct iphdr *iph;
                 struct net_device *dev;
-                int vif;
+                int vif = -1;
 
                 if (nowait) {
-                        read_unlock(&mrt_lock);
+                        rcu_read_unlock();
                         return -EAGAIN;
                 }
 
                 dev = skb->dev;
-                if (dev == NULL || (vif = ipmr_find_vif(dev)) < 0) {
+                read_lock(&mrt_lock);
+                if (dev)
+                        vif = ipmr_find_vif(mrt, dev);
+                if (vif < 0) {
                         read_unlock(&mrt_lock);
+                        rcu_read_unlock();
                         return -ENODEV;
                 }
                 skb2 = skb_clone(skb, GFP_ATOMIC);
                 if (!skb2) {
                         read_unlock(&mrt_lock);
+                        rcu_read_unlock();
                         return -ENOMEM;
                 }
 
@@ -1672,24 +2000,111 @@ int ipmr_get_route(struct net *net,
                 iph->saddr = rt->rt_src;
                 iph->daddr = rt->rt_dst;
                 iph->version = 0;
-                err = ipmr_cache_unresolved(net, vif, skb2);
+                err = ipmr_cache_unresolved(mrt, vif, skb2);
                 read_unlock(&mrt_lock);
+                rcu_read_unlock();
                 return err;
         }
 
-        if (!nowait && (rtm->rtm_flags&RTM_F_NOTIFY))
+        read_lock(&mrt_lock);
+        if (!nowait && (rtm->rtm_flags & RTM_F_NOTIFY))
                 cache->mfc_flags |= MFC_NOTIFY;
-        err = ipmr_fill_mroute(skb, cache, rtm);
+        err = __ipmr_fill_mroute(mrt, skb, cache, rtm);
         read_unlock(&mrt_lock);
+        rcu_read_unlock();
         return err;
 }
 
+static int ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
+                            u32 pid, u32 seq, struct mfc_cache *c)
+{
+        struct nlmsghdr *nlh;
+        struct rtmsg *rtm;
+
+        nlh = nlmsg_put(skb, pid, seq, RTM_NEWROUTE, sizeof(*rtm), NLM_F_MULTI);
+        if (nlh == NULL)
+                return -EMSGSIZE;
+
+        rtm = nlmsg_data(nlh);
+        rtm->rtm_family   = RTNL_FAMILY_IPMR;
+        rtm->rtm_dst_len  = 32;
+        rtm->rtm_src_len  = 32;
+        rtm->rtm_tos      = 0;
+        rtm->rtm_table    = mrt->id;
+        NLA_PUT_U32(skb, RTA_TABLE, mrt->id);
+        rtm->rtm_type     = RTN_MULTICAST;
+        rtm->rtm_scope    = RT_SCOPE_UNIVERSE;
+        rtm->rtm_protocol = RTPROT_UNSPEC;
+        rtm->rtm_flags    = 0;
+
+        NLA_PUT_BE32(skb, RTA_SRC, c->mfc_origin);
+        NLA_PUT_BE32(skb, RTA_DST, c->mfc_mcastgrp);
+
+        if (__ipmr_fill_mroute(mrt, skb, c, rtm) < 0)
+                goto nla_put_failure;
+
+        return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
+}
+
+static int ipmr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        struct mr_table *mrt;
+        struct mfc_cache *mfc;
+        unsigned int t = 0, s_t;
+        unsigned int h = 0, s_h;
+        unsigned int e = 0, s_e;
+
+        s_t = cb->args[0];
+        s_h = cb->args[1];
+        s_e = cb->args[2];
+
+        rcu_read_lock();
+        ipmr_for_each_table(mrt, net) {
+                if (t < s_t)
+                        goto next_table;
+                if (t > s_t)
+                        s_h = 0;
+                for (h = s_h; h < MFC_LINES; h++) {
+                        list_for_each_entry_rcu(mfc, &mrt->mfc_cache_array[h], list) {
+                                if (e < s_e)
+                                        goto next_entry;
+                                if (ipmr_fill_mroute(mrt, skb,
+                                                     NETLINK_CB(cb->skb).pid,
+                                                     cb->nlh->nlmsg_seq,
+                                                     mfc) < 0)
+                                        goto done;
+next_entry:
+                                e++;
+                        }
+                        e = s_e = 0;
+                }
+                s_h = 0;
+next_table:
+                t++;
+        }
+done:
+        rcu_read_unlock();
+
+        cb->args[2] = e;
+        cb->args[1] = h;
+        cb->args[0] = t;
+
+        return skb->len;
+}
+
 #ifdef CONFIG_PROC_FS
 /*
- *      The /proc interfaces to multicast routing /proc/ip_mr_cache /proc/ip_mr_vif
+ *      The /proc interfaces to multicast routing :
+ *      /proc/net/ip_mr_cache & /proc/net/ip_mr_vif
  */
 struct ipmr_vif_iter {
         struct seq_net_private p;
+        struct mr_table *mrt;
         int ct;
 };
 
@@ -1697,11 +2112,13 @@ static struct vif_device *ipmr_vif_seq_idx(struct net *net,
                                            struct ipmr_vif_iter *iter,
                                            loff_t pos)
 {
-        for (iter->ct = 0; iter->ct < net->ipv4.maxvif; ++iter->ct) {
-                if (!VIF_EXISTS(net, iter->ct))
+        struct mr_table *mrt = iter->mrt;
+
+        for (iter->ct = 0; iter->ct < mrt->maxvif; ++iter->ct) {
+                if (!VIF_EXISTS(mrt, iter->ct))
                         continue;
                 if (pos-- == 0)
-                        return &net->ipv4.vif_table[iter->ct];
+                        return &mrt->vif_table[iter->ct];
         }
         return NULL;
 }
@@ -1709,7 +2126,15 @@ static struct vif_device *ipmr_vif_seq_idx(struct net *net,
 static void *ipmr_vif_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(mrt_lock)
 {
+        struct ipmr_vif_iter *iter = seq->private;
         struct net *net = seq_file_net(seq);
+        struct mr_table *mrt;
+
+        mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
+        if (mrt == NULL)
+                return ERR_PTR(-ENOENT);
+
+        iter->mrt = mrt;
 
         read_lock(&mrt_lock);
         return *pos ? ipmr_vif_seq_idx(net, seq->private, *pos - 1)
@@ -1720,15 +2145,16 @@ static void *ipmr_vif_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct ipmr_vif_iter *iter = seq->private;
         struct net *net = seq_file_net(seq);
+        struct mr_table *mrt = iter->mrt;
 
         ++*pos;
         if (v == SEQ_START_TOKEN)
                 return ipmr_vif_seq_idx(net, iter, 0);
 
-        while (++iter->ct < net->ipv4.maxvif) {
-                if (!VIF_EXISTS(net, iter->ct))
+        while (++iter->ct < mrt->maxvif) {
+                if (!VIF_EXISTS(mrt, iter->ct))
                         continue;
-                return &net->ipv4.vif_table[iter->ct];
+                return &mrt->vif_table[iter->ct];
         }
         return NULL;
 }
@@ -1741,7 +2167,8 @@ static void ipmr_vif_seq_stop(struct seq_file *seq, void *v)
 
 static int ipmr_vif_seq_show(struct seq_file *seq, void *v)
 {
-        struct net *net = seq_file_net(seq);
+        struct ipmr_vif_iter *iter = seq->private;
+        struct mr_table *mrt = iter->mrt;
 
         if (v == SEQ_START_TOKEN) {
                 seq_puts(seq,
@@ -1752,7 +2179,7 @@ static int ipmr_vif_seq_show(struct seq_file *seq, void *v)
 
                 seq_printf(seq,
                            "%2Zd %-10s %8ld %7ld  %8ld %7ld %05X %08X %08X\n",
-                           vif - net->ipv4.vif_table,
+                           vif - mrt->vif_table,
                            name, vif->bytes_in, vif->pkt_in,
                            vif->bytes_out, vif->pkt_out,
                            vif->flags, vif->local, vif->remote);
@@ -1783,7 +2210,8 @@ static const struct file_operations ipmr_vif_fops = {
 
 struct ipmr_mfc_iter {
         struct seq_net_private p;
-        struct mfc_cache **cache;
+        struct mr_table *mrt;
+        struct list_head *cache;
         int ct;
 };
 
@@ -1791,22 +2219,22 @@ struct ipmr_mfc_iter {
 static struct mfc_cache *ipmr_mfc_seq_idx(struct net *net,
                                           struct ipmr_mfc_iter *it, loff_t pos)
 {
+        struct mr_table *mrt = it->mrt;
         struct mfc_cache *mfc;
 
-        it->cache = net->ipv4.mfc_cache_array;
-        read_lock(&mrt_lock);
-        for (it->ct = 0; it->ct < MFC_LINES; it->ct++)
-                for (mfc = net->ipv4.mfc_cache_array[it->ct];
-                     mfc; mfc = mfc->next)
+        rcu_read_lock();
+        for (it->ct = 0; it->ct < MFC_LINES; it->ct++) {
+                it->cache = &mrt->mfc_cache_array[it->ct];
+                list_for_each_entry_rcu(mfc, it->cache, list)
                         if (pos-- == 0)
                                 return mfc;
-        read_unlock(&mrt_lock);
+        }
+        rcu_read_unlock();
 
-        it->cache = &mfc_unres_queue;
         spin_lock_bh(&mfc_unres_lock);
-        for (mfc = mfc_unres_queue; mfc; mfc = mfc->next)
-                if (net_eq(mfc_net(mfc), net) &&
-                    pos-- == 0)
+        it->cache = &mrt->mfc_unres_queue;
+        list_for_each_entry(mfc, it->cache, list)
+                if (pos-- == 0)
                         return mfc;
         spin_unlock_bh(&mfc_unres_lock);
 
@@ -1819,7 +2247,13 @@ static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct ipmr_mfc_iter *it = seq->private;
         struct net *net = seq_file_net(seq);
+        struct mr_table *mrt;
 
+        mrt = ipmr_get_table(net, RT_TABLE_DEFAULT);
+        if (mrt == NULL)
+                return ERR_PTR(-ENOENT);
+
+        it->mrt = mrt;
         it->cache = NULL;
         it->ct = 0;
         return *pos ? ipmr_mfc_seq_idx(net, seq->private, *pos - 1)
@@ -1831,39 +2265,38 @@ static void *ipmr_mfc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         struct mfc_cache *mfc = v;
         struct ipmr_mfc_iter *it = seq->private;
         struct net *net = seq_file_net(seq);
+        struct mr_table *mrt = it->mrt;
 
         ++*pos;
 
         if (v == SEQ_START_TOKEN)
                 return ipmr_mfc_seq_idx(net, seq->private, 0);
 
-        if (mfc->next)
-                return mfc->next;
+        if (mfc->list.next != it->cache)
+                return list_entry(mfc->list.next, struct mfc_cache, list);
 
-        if (it->cache == &mfc_unres_queue)
+        if (it->cache == &mrt->mfc_unres_queue)
                 goto end_of_list;
 
-        BUG_ON(it->cache != net->ipv4.mfc_cache_array);
+        BUG_ON(it->cache != &mrt->mfc_cache_array[it->ct]);
 
         while (++it->ct < MFC_LINES) {
-                mfc = net->ipv4.mfc_cache_array[it->ct];
-                if (mfc)
-                        return mfc;
+                it->cache = &mrt->mfc_cache_array[it->ct];
+                if (list_empty(it->cache))
+                        continue;
+                return list_first_entry(it->cache, struct mfc_cache, list);
         }
 
         /* exhausted cache_array, show unresolved */
-        read_unlock(&mrt_lock);
-        it->cache = &mfc_unres_queue;
+        rcu_read_unlock();
+        it->cache = &mrt->mfc_unres_queue;
         it->ct = 0;
 
         spin_lock_bh(&mfc_unres_lock);
-        mfc = mfc_unres_queue;
-        while (mfc && !net_eq(mfc_net(mfc), net))
-                mfc = mfc->next;
-        if (mfc)
-                return mfc;
+        if (!list_empty(it->cache))
+                return list_first_entry(it->cache, struct mfc_cache, list);
 
- end_of_list:
+end_of_list:
         spin_unlock_bh(&mfc_unres_lock);
         it->cache = NULL;
 
@@ -1873,18 +2306,17 @@ static void *ipmr_mfc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 static void ipmr_mfc_seq_stop(struct seq_file *seq, void *v)
 {
         struct ipmr_mfc_iter *it = seq->private;
-        struct net *net = seq_file_net(seq);
+        struct mr_table *mrt = it->mrt;
 
-        if (it->cache == &mfc_unres_queue)
+        if (it->cache == &mrt->mfc_unres_queue)
                 spin_unlock_bh(&mfc_unres_lock);
-        else if (it->cache == net->ipv4.mfc_cache_array)
-                read_unlock(&mrt_lock);
+        else if (it->cache == &mrt->mfc_cache_array[it->ct])
+                rcu_read_unlock();
 }
 
 static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
 {
         int n;
-        struct net *net = seq_file_net(seq);
 
         if (v == SEQ_START_TOKEN) {
                 seq_puts(seq,
@@ -1892,20 +2324,21 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
         } else {
                 const struct mfc_cache *mfc = v;
                 const struct ipmr_mfc_iter *it = seq->private;
+                const struct mr_table *mrt = it->mrt;
 
-                seq_printf(seq, "%08lX %08lX %-3hd",
-                           (unsigned long) mfc->mfc_mcastgrp,
-                           (unsigned long) mfc->mfc_origin,
+                seq_printf(seq, "%08X %08X %-3hd",
+                           (__force u32) mfc->mfc_mcastgrp,
+                           (__force u32) mfc->mfc_origin,
                            mfc->mfc_parent);
 
-                if (it->cache != &mfc_unres_queue) {
+                if (it->cache != &mrt->mfc_unres_queue) {
                         seq_printf(seq, " %8lu %8lu %8lu",
                                    mfc->mfc_un.res.pkt,
                                    mfc->mfc_un.res.bytes,
                                    mfc->mfc_un.res.wrong_if);
                         for (n = mfc->mfc_un.res.minvif;
-                             n < mfc->mfc_un.res.maxvif; n++ ) {
-                                if (VIF_EXISTS(net, n) &&
+                             n < mfc->mfc_un.res.maxvif; n++) {
+                                if (VIF_EXISTS(mrt, n) &&
                                     mfc->mfc_un.res.ttls[n] < 255)
                                         seq_printf(seq,
                                            " %2d:%-3d",
@@ -1945,7 +2378,7 @@ static const struct file_operations ipmr_mfc_fops = {
 #endif
 
 #ifdef CONFIG_IP_PIMSM_V2
-static struct net_protocol pim_protocol = {
+static const struct net_protocol pim_protocol = {
         .handler        =       pim_rcv,
         .netns_ok       =       1,
 };
@@ -1957,27 +2390,11 @@ static struct net_protocol pim_protocol = {
  */
 static int __net_init ipmr_net_init(struct net *net)
 {
-        int err = 0;
+        int err;
 
-        net->ipv4.vif_table = kcalloc(MAXVIFS, sizeof(struct vif_device),
-                                      GFP_KERNEL);
-        if (!net->ipv4.vif_table) {
-                err = -ENOMEM;
+        err = ipmr_rules_init(net);
+        if (err < 0)
                 goto fail;
-        }
-
-        /* Forwarding cache */
-        net->ipv4.mfc_cache_array = kcalloc(MFC_LINES,
-                                            sizeof(struct mfc_cache *),
-                                            GFP_KERNEL);
-        if (!net->ipv4.mfc_cache_array) {
-                err = -ENOMEM;
-                goto fail_mfc_cache;
-        }
-
-#ifdef CONFIG_IP_PIMSM
-        net->ipv4.mroute_reg_vif_num = -1;
-#endif
 
 #ifdef CONFIG_PROC_FS
         err = -ENOMEM;
@@ -1992,10 +2409,8 @@ static int __net_init ipmr_net_init(struct net *net)
 proc_cache_fail:
         proc_net_remove(net, "ip_mr_vif");
 proc_vif_fail:
-        kfree(net->ipv4.mfc_cache_array);
+        ipmr_rules_exit(net);
 #endif
-fail_mfc_cache:
-        kfree(net->ipv4.vif_table);
 fail:
         return err;
 }
@@ -2006,8 +2421,7 @@ static void __net_exit ipmr_net_exit(struct net *net)
         proc_net_remove(net, "ip_mr_cache");
         proc_net_remove(net, "ip_mr_vif");
 #endif
-        kfree(net->ipv4.mfc_cache_array);
-        kfree(net->ipv4.vif_table);
+        ipmr_rules_exit(net);
 }
 
 static struct pernet_operations ipmr_net_ops = {
@@ -2021,7 +2435,7 @@ int __init ip_mr_init(void)
 
         mrt_cachep = kmem_cache_create("ip_mrt_cache",
                                        sizeof(struct mfc_cache),
-                                       0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
+                                       0, SLAB_HWCACHE_ALIGN | SLAB_PANIC,
                                        NULL);
         if (!mrt_cachep)
                 return -ENOMEM;
@@ -2030,7 +2444,6 @@ int __init ip_mr_init(void)
         if (err)
                 goto reg_pernet_fail;
 
-        setup_timer(&ipmr_expire_timer, ipmr_expire_process, 0);
         err = register_netdevice_notifier(&ip_mr_notifier);
         if (err)
                 goto reg_notif_fail;
@@ -2041,6 +2454,7 @@ int __init ip_mr_init(void)
                 goto add_proto_fail;
         }
 #endif
+        rtnl_register(RTNL_FAMILY_IPMR, RTM_GETROUTE, NULL, ipmr_rtm_dumproute);
         return 0;
 
 #ifdef CONFIG_IP_PIMSM_V2
@@ -2048,7 +2462,6 @@ add_proto_fail:
         unregister_netdevice_notifier(&ip_mr_notifier);
 #endif
 reg_notif_fail:
-        del_timer(&ipmr_expire_timer);
         unregister_pernet_subsys(&ipmr_net_ops);
 reg_pernet_fail:
         kmem_cache_destroy(mrt_cachep);
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 1725dc0ef688..994a1f29ebbc 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -4,6 +4,7 @@
 #include <linux/netfilter_ipv4.h>
 #include <linux/ip.h>
 #include <linux/skbuff.h>
+#include <linux/gfp.h>
 #include <net/route.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
@@ -16,7 +17,7 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
         const struct iphdr *iph = ip_hdr(skb);
         struct rtable *rt;
         struct flowi fl = {};
-        struct dst_entry *odst;
+        unsigned long orefdst;
         unsigned int hh_len;
         unsigned int type;
 
@@ -30,10 +31,10 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
          * packets with foreign saddr to appear on the NF_INET_LOCAL_OUT hook.
          */
         if (addr_type == RTN_LOCAL) {
-                fl.nl_u.ip4_u.daddr = iph->daddr;
+                fl.fl4_dst = iph->daddr;
                 if (type == RTN_LOCAL)
-                        fl.nl_u.ip4_u.saddr = iph->saddr;
-                fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
+                        fl.fl4_src = iph->saddr;
+                fl.fl4_tos = RT_TOS(iph->tos);
                 fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0;
                 fl.mark = skb->mark;
                 fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0;
@@ -42,22 +43,22 @@ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type)
 
                 /* Drop old route. */
                 skb_dst_drop(skb);
-                skb_dst_set(skb, &rt->u.dst);
+                skb_dst_set(skb, &rt->dst);
         } else {
                 /* non-local src, find valid iif to satisfy
                  * rp-filter when calling ip_route_input. */
-                fl.nl_u.ip4_u.daddr = iph->saddr;
+                fl.fl4_dst = iph->saddr;
                 if (ip_route_output_key(net, &rt, &fl) != 0)
                         return -1;
 
-                odst = skb_dst(skb);
+                orefdst = skb->_skb_refdst;
                 if (ip_route_input(skb, iph->daddr, iph->saddr,
-                                   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
-                        dst_release(&rt->u.dst);
+                                   RT_TOS(iph->tos), rt->dst.dev) != 0) {
+                        dst_release(&rt->dst);
                         return -1;
                 }
-                dst_release(&rt->u.dst);
-                dst_release(odst);
+                dst_release(&rt->dst);
+                refdst_drop(orefdst);
         }
 
         if (skb_dst(skb)->error)
@@ -155,10 +156,10 @@ static int nf_ip_reroute(struct sk_buff *skb,
         if (entry->hook == NF_INET_LOCAL_OUT) {
                 const struct iphdr *iph = ip_hdr(skb);
 
-                if (!(iph->tos == rt_info->tos
-                      && skb->mark == rt_info->mark
-                      && iph->daddr == rt_info->daddr
-                      && iph->saddr == rt_info->saddr))
+                if (!(iph->tos == rt_info->tos &&
+                      skb->mark == rt_info->mark &&
+                      iph->daddr == rt_info->daddr &&
+                      iph->saddr == rt_info->saddr))
                         return ip_route_me_harder(skb, RTN_UNSPEC);
         }
         return 0;
@@ -211,9 +212,7 @@ static __sum16 nf_ip_checksum_partial(struct sk_buff *skb, unsigned int hook,
                 skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr, protocol,
                                                skb->len - dataoff, 0);
                 skb->ip_summed = CHECKSUM_NONE;
-                csum = __skb_checksum_complete_head(skb, dataoff + len);
-                if (!csum)
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                return __skb_checksum_complete_head(skb, dataoff + len);
         }
         return csum;
 }
@@ -248,9 +247,9 @@ module_exit(ipv4_netfilter_fini);
 
 #ifdef CONFIG_SYSCTL
 struct ctl_path nf_net_ipv4_netfilter_sysctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
-        { .procname = "netfilter", .ctl_name = NET_IPV4_NETFILTER, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
+        { .procname = "netfilter", },
         { }
 };
 EXPORT_SYMBOL_GPL(nf_net_ipv4_netfilter_sysctl_path);
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 1833bdbf9805..babd1a2bae5f 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -147,7 +147,7 @@ config IP_NF_TARGET_ULOG
           which can only be viewed through syslog.
 
           The appropriate userspace logging daemon (ulogd) may be obtained from
-          <http://www.gnumonks.org/projects/ulogd/>
+          <http://www.netfilter.org/projects/ulogd/index.html>
 
           To compile it as a module, choose M here.  If unsure, say N.
 
@@ -324,10 +324,10 @@ config IP_NF_TARGET_ECN
 
 config IP_NF_TARGET_TTL
         tristate '"TTL" target support'
-        depends on NETFILTER_ADVANCED
+        depends on NETFILTER_ADVANCED && IP_NF_MANGLE
         select NETFILTER_XT_TARGET_HL
         ---help---
-        This is a backwards-compat option for the user's convenience
+        This is a backwards-compatible option for the user's convenience
         (e.g. when running oldconfig). It selects
         CONFIG_NETFILTER_XT_TARGET_HL.
 
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 48111594ee9b..19eb59d01037 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -3,15 +3,15 @@
 #
 
 # objects for l3 independent conntrack
-nf_conntrack_ipv4-objs  :=  nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
+nf_conntrack_ipv4-y     :=  nf_conntrack_l3proto_ipv4.o nf_conntrack_proto_icmp.o
 ifeq ($(CONFIG_NF_CONNTRACK_PROC_COMPAT),y)
 ifeq ($(CONFIG_PROC_FS),y)
 nf_conntrack_ipv4-objs  += nf_conntrack_l3proto_ipv4_compat.o
 endif
 endif
 
-nf_nat-objs             := nf_nat_core.o nf_nat_helper.o nf_nat_proto_unknown.o nf_nat_proto_common.o nf_nat_proto_tcp.o nf_nat_proto_udp.o nf_nat_proto_icmp.o
-iptable_nat-objs        := nf_nat_rule.o nf_nat_standalone.o
+nf_nat-y                := nf_nat_core.o nf_nat_helper.o nf_nat_proto_unknown.o nf_nat_proto_common.o nf_nat_proto_tcp.o nf_nat_proto_udp.o nf_nat_proto_icmp.o
+iptable_nat-y   := nf_nat_rule.o nf_nat_standalone.o
 
 # connection tracking
 obj-$(CONFIG_NF_CONNTRACK_IPV4) += nf_conntrack_ipv4.o
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 7505dff4ffdf..e855fffaed95 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -8,7 +8,7 @@
  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
  *
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
@@ -27,6 +27,7 @@
 
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_arp/arp_tables.h>
+#include "../../netfilter/xt_repldata.h"
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
@@ -48,16 +49,17 @@ MODULE_DESCRIPTION("arptables core");
 #endif
 
 #ifdef CONFIG_NETFILTER_DEBUG
-#define ARP_NF_ASSERT(x)                                        \
-do {                                                            \
-        if (!(x))                                               \
-                printk("ARP_NF_ASSERT: %s:%s:%u\n",             \
-                       __func__, __FILE__, __LINE__);   \
-} while(0)
+#define ARP_NF_ASSERT(x)        WARN_ON(!(x))
 #else
 #define ARP_NF_ASSERT(x)
 #endif
 
+void *arpt_alloc_initial_table(const struct xt_table *info)
+{
+        return xt_alloc_initial_table(arpt, ARPT);
+}
+EXPORT_SYMBOL_GPL(arpt_alloc_initial_table);
+
 static inline int arp_devaddr_compare(const struct arpt_devaddr_info *ap,
                                       const char *hdr_addr, int len)
 {
@@ -70,7 +72,7 @@ static inline int arp_devaddr_compare(const struct arpt_devaddr_info *ap,
         for (i = 0; i < len; i++)
                 ret |= (hdr_addr[i] ^ ap->addr[i]) & ap->mask[i];
 
-        return (ret != 0);
+        return ret != 0;
 }
 
 /*
@@ -217,16 +219,23 @@ static inline int arp_checkentry(const struct arpt_arp *arp)
 }
 
 static unsigned int
-arpt_error(struct sk_buff *skb, const struct xt_target_param *par)
+arpt_error(struct sk_buff *skb, const struct xt_action_param *par)
 {
         if (net_ratelimit())
-                printk("arp_tables: error: '%s'\n",
+                pr_err("arp_tables: error: '%s'\n",
                        (const char *)par->targinfo);
 
         return NF_DROP;
 }
 
-static inline struct arpt_entry *get_entry(void *base, unsigned int offset)
+static inline const struct xt_entry_target *
+arpt_get_target_c(const struct arpt_entry *e)
+{
+        return arpt_get_target((struct arpt_entry *)e);
+}
+
+static inline struct arpt_entry *
+get_entry(const void *base, unsigned int offset)
 {
         return (struct arpt_entry *)(base + offset);
 }
@@ -246,12 +255,11 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
         unsigned int verdict = NF_DROP;
         const struct arphdr *arp;
-        bool hotdrop = false;
         struct arpt_entry *e, *back;
         const char *indev, *outdev;
         void *table_base;
         const struct xt_table_info *private;
-        struct xt_target_param tgpar;
+        struct xt_action_param acpar;
 
         if (!pskb_may_pull(skb, arp_hdr_len(skb->dev)))
                 return NF_DROP;
@@ -266,35 +274,33 @@ unsigned int arpt_do_table(struct sk_buff *skb,
         e = get_entry(table_base, private->hook_entry[hook]);
         back = get_entry(table_base, private->underflow[hook]);
 
-        tgpar.in      = in;
-        tgpar.out     = out;
-        tgpar.hooknum = hook;
-        tgpar.family  = NFPROTO_ARP;
+        acpar.in      = in;
+        acpar.out     = out;
+        acpar.hooknum = hook;
+        acpar.family  = NFPROTO_ARP;
+        acpar.hotdrop = false;
 
         arp = arp_hdr(skb);
         do {
-                struct arpt_entry_target *t;
-                int hdr_len;
+                const struct xt_entry_target *t;
 
                 if (!arp_packet_match(arp, skb->dev, indev, outdev, &e->arp)) {
                         e = arpt_next_entry(e);
                         continue;
                 }
 
-                hdr_len = sizeof(*arp) + (2 * sizeof(struct in_addr)) +
-                        (2 * skb->dev->addr_len);
-                ADD_COUNTER(e->counters, hdr_len, 1);
+                ADD_COUNTER(e->counters, arp_hdr_len(skb->dev), 1);
 
-                t = arpt_get_target(e);
+                t = arpt_get_target_c(e);
 
                 /* Standard target? */
                 if (!t->u.kernel.target->target) {
                         int v;
 
-                        v = ((struct arpt_standard_target *)t)->verdict;
+                        v = ((struct xt_standard_target *)t)->verdict;
                         if (v < 0) {
                                 /* Pop from stack? */
-                                if (v != ARPT_RETURN) {
+                                if (v != XT_RETURN) {
                                         verdict = (unsigned)(-v) - 1;
                                         break;
                                 }
@@ -319,43 +325,39 @@ unsigned int arpt_do_table(struct sk_buff *skb,
                 /* Targets which reenter must return
                  * abs. verdicts
                  */
-                tgpar.target   = t->u.kernel.target;
-                tgpar.targinfo = t->data;
-                verdict = t->u.kernel.target->target(skb, &tgpar);
+                acpar.target   = t->u.kernel.target;
+                acpar.targinfo = t->data;
+                verdict = t->u.kernel.target->target(skb, &acpar);
 
                 /* Target might have changed stuff. */
                 arp = arp_hdr(skb);
 
-                if (verdict == ARPT_CONTINUE)
+                if (verdict == XT_CONTINUE)
                         e = arpt_next_entry(e);
                 else
                         /* Verdict */
                         break;
-        } while (!hotdrop);
+        } while (!acpar.hotdrop);
         xt_info_rdunlock_bh();
 
-        if (hotdrop)
+        if (acpar.hotdrop)
                 return NF_DROP;
         else
                 return verdict;
 }
 
 /* All zeroes == unconditional rule. */
-static inline int unconditional(const struct arpt_arp *arp)
+static inline bool unconditional(const struct arpt_arp *arp)
 {
-        unsigned int i;
+        static const struct arpt_arp uncond;
 
-        for (i = 0; i < sizeof(*arp)/sizeof(__u32); i++)
-                if (((__u32 *)arp)[i])
-                        return 0;
-
-        return 1;
+        return memcmp(arp, &uncond, sizeof(uncond)) == 0;
 }
 
 /* Figures out from what hook each rule can be called: returns 0 if
  * there are loops.  Puts hook bitmask in comefrom.
  */
-static int mark_source_chains(struct xt_table_info *newinfo,
+static int mark_source_chains(const struct xt_table_info *newinfo,
                               unsigned int valid_hooks, void *entry0)
 {
         unsigned int hook;
@@ -375,12 +377,12 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                 e->counters.pcnt = pos;
 
                 for (;;) {
-                        const struct arpt_standard_target *t
-                                = (void *)arpt_get_target(e);
+                        const struct xt_standard_target *t
+                                = (void *)arpt_get_target_c(e);
                         int visited = e->comefrom & (1 << hook);
 
                         if (e->comefrom & (1 << NF_ARP_NUMHOOKS)) {
-                                printk("arptables: loop hook %u pos %u %08X.\n",
+                                pr_notice("arptables: loop hook %u pos %u %08X.\n",
                                        hook, pos, e->comefrom);
                                 return 0;
                         }
@@ -388,15 +390,15 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                                 |= ((1 << hook) | (1 << NF_ARP_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct arpt_entry)
-                            && (strcmp(t->target.u.user.name,
-                                       ARPT_STANDARD_TARGET) == 0)
-                            && t->verdict < 0
-                            && unconditional(&e->arp)) || visited) {
+                        if ((e->target_offset == sizeof(struct arpt_entry) &&
+                             (strcmp(t->target.u.user.name,
+                                     XT_STANDARD_TARGET) == 0) &&
+                             t->verdict < 0 && unconditional(&e->arp)) ||
+                            visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
-                                            ARPT_STANDARD_TARGET) == 0) &&
+                                            XT_STANDARD_TARGET) == 0) &&
                                     t->verdict < -NF_MAX_VERDICT - 1) {
                                         duprintf("mark_source_chains: bad "
                                                 "negative verdict (%i)\n",
@@ -431,8 +433,8 @@ static int mark_source_chains(struct xt_table_info *newinfo,
                                 int newpos = t->verdict;
 
                                 if (strcmp(t->target.u.user.name,
-                                           ARPT_STANDARD_TARGET) == 0
-                                    && newpos >= 0) {
+                                           XT_STANDARD_TARGET) == 0 &&
+                                    newpos >= 0) {
                                         if (newpos > newinfo->size -
                                                 sizeof(struct arpt_entry)) {
                                                 duprintf("mark_source_chains: "
@@ -460,19 +462,19 @@ static int mark_source_chains(struct xt_table_info *newinfo,
         return 1;
 }
 
-static inline int check_entry(struct arpt_entry *e, const char *name)
+static inline int check_entry(const struct arpt_entry *e, const char *name)
 {
-        const struct arpt_entry_target *t;
+        const struct xt_entry_target *t;
 
         if (!arp_checkentry(&e->arp)) {
                 duprintf("arp_tables: arp check failed %p %s.\n", e, name);
                 return -EINVAL;
         }
 
-        if (e->target_offset + sizeof(struct arpt_entry_target) > e->next_offset)
+        if (e->target_offset + sizeof(struct xt_entry_target) > e->next_offset)
                 return -EINVAL;
 
-        t = arpt_get_target(e);
+        t = arpt_get_target_c(e);
         if (e->target_offset + t->u.target_size > e->next_offset)
                 return -EINVAL;
 
@@ -481,7 +483,7 @@ static inline int check_entry(struct arpt_entry *e, const char *name)
 
 static inline int check_target(struct arpt_entry *e, const char *name)
 {
-        struct arpt_entry_target *t = arpt_get_target(e);
+        struct xt_entry_target *t = arpt_get_target(e);
         int ret;
         struct xt_tgchk_param par = {
                 .table     = name,
@@ -502,10 +504,9 @@ static inline int check_target(struct arpt_entry *e, const char *name)
 }
 
 static inline int
-find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
-                 unsigned int *i)
+find_check_entry(struct arpt_entry *e, const char *name, unsigned int size)
 {
-        struct arpt_entry_target *t;
+        struct xt_entry_target *t;
         struct xt_target *target;
         int ret;
 
@@ -514,13 +515,11 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
                 return ret;
 
         t = arpt_get_target(e);
-        target = try_then_request_module(xt_find_target(NFPROTO_ARP,
-                                                        t->u.user.name,
-                                                        t->u.user.revision),
-                                         "arpt_%s", t->u.user.name);
-        if (IS_ERR(target) || !target) {
+        target = xt_request_find_target(NFPROTO_ARP, t->u.user.name,
+                                        t->u.user.revision);
+        if (IS_ERR(target)) {
                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
-                ret = target ? PTR_ERR(target) : -ENOENT;
+                ret = PTR_ERR(target);
                 goto out;
         }
         t->u.kernel.target = target;
@@ -528,8 +527,6 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size,
         ret = check_target(e, name);
         if (ret)
                 goto err;
-
-        (*i)++;
         return 0;
 err:
         module_put(t->u.kernel.target->me);
@@ -537,24 +534,39 @@ out:
         return ret;
 }
 
+static bool check_underflow(const struct arpt_entry *e)
+{
+        const struct xt_entry_target *t;
+        unsigned int verdict;
+
+        if (!unconditional(&e->arp))
+                return false;
+        t = arpt_get_target_c(e);
+        if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
+                return false;
+        verdict = ((struct xt_standard_target *)t)->verdict;
+        verdict = -verdict - 1;
+        return verdict == NF_DROP || verdict == NF_ACCEPT;
+}
+
 static inline int check_entry_size_and_hooks(struct arpt_entry *e,
                                              struct xt_table_info *newinfo,
-                                             unsigned char *base,
-                                             unsigned char *limit,
+                                             const unsigned char *base,
+                                             const unsigned char *limit,
                                              const unsigned int *hook_entries,
                                              const unsigned int *underflows,
-                                             unsigned int *i)
+                                             unsigned int valid_hooks)
 {
         unsigned int h;
 
-        if ((unsigned long)e % __alignof__(struct arpt_entry) != 0
-            || (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct arpt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct arpt_entry) >= limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
 
         if (e->next_offset
-            < sizeof(struct arpt_entry) + sizeof(struct arpt_entry_target)) {
+            < sizeof(struct arpt_entry) + sizeof(struct xt_entry_target)) {
                 duprintf("checking: element %p size %u\n",
                          e, e->next_offset);
                 return -EINVAL;
@@ -562,30 +574,31 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
 
         /* Check hooks & underflows */
         for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
+                if (!(valid_hooks & (1 << h)))
+                        continue;
                 if ((unsigned char *)e - base == hook_entries[h])
                         newinfo->hook_entry[h] = hook_entries[h];
-                if ((unsigned char *)e - base == underflows[h])
+                if ((unsigned char *)e - base == underflows[h]) {
+                        if (!check_underflow(e)) {
+                                pr_err("Underflows must be unconditional and "
+                                       "use the STANDARD target with "
+                                       "ACCEPT/DROP\n");
+                                return -EINVAL;
+                        }
                         newinfo->underflow[h] = underflows[h];
+                }
         }
 
-        /* FIXME: underflows must be unconditional, standard verdicts
-           < 0 (not ARPT_RETURN). --RR */
-
         /* Clear counters and comefrom */
         e->counters = ((struct xt_counters) { 0, 0 });
         e->comefrom = 0;
-
-        (*i)++;
         return 0;
 }
 
-static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i)
+static inline void cleanup_entry(struct arpt_entry *e)
 {
         struct xt_tgdtor_param par;
-        struct arpt_entry_target *t;
-
-        if (i && (*i)-- == 0)
-                return 1;
+        struct xt_entry_target *t;
 
         t = arpt_get_target(e);
         par.target   = t->u.kernel.target;
@@ -594,26 +607,20 @@ static inline int cleanup_entry(struct arpt_entry *e, unsigned int *i)
         if (par.target->destroy != NULL)
                 par.target->destroy(&par);
         module_put(par.target->me);
-        return 0;
 }
 
 /* Checks and translates the user-supplied table segment (held in
  * newinfo).
  */
-static int translate_table(const char *name,
-                           unsigned int valid_hooks,
-                           struct xt_table_info *newinfo,
-                           void *entry0,
-                           unsigned int size,
-                           unsigned int number,
-                           const unsigned int *hook_entries,
-                           const unsigned int *underflows)
+static int translate_table(struct xt_table_info *newinfo, void *entry0,
+                           const struct arpt_replace *repl)
 {
+        struct arpt_entry *iter;
         unsigned int i;
-        int ret;
+        int ret = 0;
 
-        newinfo->size = size;
-        newinfo->number = number;
+        newinfo->size = repl->size;
+        newinfo->number = repl->num_entries;
 
         /* Init all hooks to impossible value. */
         for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
@@ -625,52 +632,66 @@ static int translate_table(const char *name,
         i = 0;
 
         /* Walk through entries, checking offsets. */
-        ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                 check_entry_size_and_hooks,
-                                 newinfo,
-                                 entry0,
-                                 entry0 + size,
-                                 hook_entries, underflows, &i);
+        xt_entry_foreach(iter, entry0, newinfo->size) {
+                ret = check_entry_size_and_hooks(iter, newinfo, entry0,
+                                                 entry0 + repl->size,
+                                                 repl->hook_entry,
+                                                 repl->underflow,
+                                                 repl->valid_hooks);
+                if (ret != 0)
+                        break;
+                ++i;
+                if (strcmp(arpt_get_target(iter)->u.user.name,
+                    XT_ERROR_TARGET) == 0)
+                        ++newinfo->stacksize;
+        }
         duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);
         if (ret != 0)
                 return ret;
 
-        if (i != number) {
+        if (i != repl->num_entries) {
                 duprintf("translate_table: %u not %u entries\n",
-                         i, number);
+                         i, repl->num_entries);
                 return -EINVAL;
         }
 
         /* Check hooks all assigned */
         for (i = 0; i < NF_ARP_NUMHOOKS; i++) {
                 /* Only hooks which are valid */
-                if (!(valid_hooks & (1 << i)))
+                if (!(repl->valid_hooks & (1 << i)))
                         continue;
                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
                         duprintf("Invalid hook entry %u %u\n",
-                                 i, hook_entries[i]);
+                                 i, repl->hook_entry[i]);
                         return -EINVAL;
                 }
                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
                         duprintf("Invalid underflow %u %u\n",
-                                 i, underflows[i]);
+                                 i, repl->underflow[i]);
                         return -EINVAL;
                 }
         }
 
-        if (!mark_source_chains(newinfo, valid_hooks, entry0)) {
+        if (!mark_source_chains(newinfo, repl->valid_hooks, entry0)) {
                 duprintf("Looping hook\n");
                 return -ELOOP;
         }
 
         /* Finally, each sanity check must pass */
         i = 0;
-        ret = ARPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                 find_check_entry, name, size, &i);
+        xt_entry_foreach(iter, entry0, newinfo->size) {
+                ret = find_check_entry(iter, repl->name, repl->size);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
 
         if (ret != 0) {
-                ARPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                cleanup_entry, &i);
+                xt_entry_foreach(iter, entry0, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter);
+                }
                 return ret;
         }
 
@@ -683,78 +704,45 @@ static int translate_table(const char *name,
         return ret;
 }
 
-/* Gets counters. */
-static inline int add_entry_to_counter(const struct arpt_entry *e,
-                                       struct xt_counters total[],
-                                       unsigned int *i)
-{
-        ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-static inline int set_entry_to_counter(const struct arpt_entry *e,
-                                       struct xt_counters total[],
-                                       unsigned int *i)
-{
-        SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-        (*i)++;
-        return 0;
-}
-
 static void get_counters(const struct xt_table_info *t,
                          struct xt_counters counters[])
 {
+        struct arpt_entry *iter;
         unsigned int cpu;
         unsigned int i;
-        unsigned int curcpu;
-
-        /* Instead of clearing (by a previous call to memset())
-         * the counters and using adds, we set the counters
-         * with data used by 'current' CPU
-         *
-         * Bottom half has to be disabled to prevent deadlock
-         * if new softirq were to run and call ipt_do_table
-         */
-        local_bh_disable();
-        curcpu = smp_processor_id();
-
-        i = 0;
-        ARPT_ENTRY_ITERATE(t->entries[curcpu],
-                           t->size,
-                           set_entry_to_counter,
-                           counters,
-                           &i);
 
         for_each_possible_cpu(cpu) {
-                if (cpu == curcpu)
-                        continue;
+                seqlock_t *lock = &per_cpu(xt_info_locks, cpu).lock;
+
                 i = 0;
-                xt_info_wrlock(cpu);
-                ARPT_ENTRY_ITERATE(t->entries[cpu],
-                                   t->size,
-                                   add_entry_to_counter,
-                                   counters,
-                                   &i);
-                xt_info_wrunlock(cpu);
+                xt_entry_foreach(iter, t->entries[cpu], t->size) {
+                        u64 bcnt, pcnt;
+                        unsigned int start;
+
+                        do {
+                                start = read_seqbegin(lock);
+                                bcnt = iter->counters.bcnt;
+                                pcnt = iter->counters.pcnt;
+                        } while (read_seqretry(lock, start));
+
+                        ADD_COUNTER(counters[i], bcnt, pcnt);
+                        ++i;
+                }
         }
-        local_bh_enable();
 }
 
-static struct xt_counters *alloc_counters(struct xt_table *table)
+static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
         unsigned int countersize;
         struct xt_counters *counters;
-        struct xt_table_info *private = table->private;
+        const struct xt_table_info *private = table->private;
 
         /* We need atomic snapshot of counters: rest doesn't change
          * (other than comefrom, which userspace doesn't care
          * about).
          */
         countersize = sizeof(struct xt_counters) * private->number;
-        counters = vmalloc_node(countersize, numa_node_id());
+        counters = vzalloc(countersize);
 
         if (counters == NULL)
                 return ERR_PTR(-ENOMEM);
@@ -765,11 +753,11 @@ static struct xt_counters *alloc_counters(struct xt_table *table)
 }
 
 static int copy_entries_to_user(unsigned int total_size,
-                                struct xt_table *table,
+                                const struct xt_table *table,
                                 void __user *userptr)
 {
         unsigned int off, num;
-        struct arpt_entry *e;
+        const struct arpt_entry *e;
         struct xt_counters *counters;
         struct xt_table_info *private = table->private;
         int ret = 0;
@@ -789,7 +777,7 @@ static int copy_entries_to_user(unsigned int total_size,
         /* FIXME: use iterator macros --RR */
         /* ... then go back and fix counters and names */
         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
-                struct arpt_entry_target *t;
+                const struct xt_entry_target *t;
 
                 e = (struct arpt_entry *)(loc_cpu_entry + off);
                 if (copy_to_user(userptr + off
@@ -800,9 +788,9 @@ static int copy_entries_to_user(unsigned int total_size,
                         goto free_counters;
                 }
 
-                t = arpt_get_target(e);
+                t = arpt_get_target_c(e);
                 if (copy_to_user(userptr + off + e->target_offset
-                                 + offsetof(struct arpt_entry_target,
+                                 + offsetof(struct xt_entry_target,
                                             u.user.name),
                                  t->u.kernel.target->name,
                                  strlen(t->u.kernel.target->name)+1) != 0) {
@@ -817,7 +805,7 @@ static int copy_entries_to_user(unsigned int total_size,
 }
 
 #ifdef CONFIG_COMPAT
-static void compat_standard_from_user(void *dst, void *src)
+static void compat_standard_from_user(void *dst, const void *src)
 {
         int v = *(compat_int_t *)src;
 
@@ -826,7 +814,7 @@ static void compat_standard_from_user(void *dst, void *src)
         memcpy(dst, &v, sizeof(v));
 }
 
-static int compat_standard_to_user(void __user *dst, void *src)
+static int compat_standard_to_user(void __user *dst, const void *src)
 {
         compat_int_t cv = *(int *)src;
 
@@ -835,18 +823,18 @@ static int compat_standard_to_user(void __user *dst, void *src)
         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
 
-static int compat_calc_entry(struct arpt_entry *e,
+static int compat_calc_entry(const struct arpt_entry *e,
                              const struct xt_table_info *info,
-                             void *base, struct xt_table_info *newinfo)
+                             const void *base, struct xt_table_info *newinfo)
 {
-        struct arpt_entry_target *t;
+        const struct xt_entry_target *t;
         unsigned int entry_offset;
         int off, i, ret;
 
         off = sizeof(struct arpt_entry) - sizeof(struct compat_arpt_entry);
         entry_offset = (void *)e - base;
 
-        t = arpt_get_target(e);
+        t = arpt_get_target_c(e);
         off += xt_compat_target_offset(t->u.kernel.target);
         newinfo->size -= off;
         ret = xt_compat_add_offset(NFPROTO_ARP, entry_offset, off);
@@ -867,7 +855,9 @@ static int compat_calc_entry(struct arpt_entry *e,
 static int compat_table_info(const struct xt_table_info *info,
                              struct xt_table_info *newinfo)
 {
+        struct arpt_entry *iter;
         void *loc_cpu_entry;
+        int ret;
 
         if (!newinfo || !info)
                 return -EINVAL;
@@ -876,15 +866,19 @@ static int compat_table_info(const struct xt_table_info *info,
         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
         newinfo->initial_entries = 0;
         loc_cpu_entry = info->entries[raw_smp_processor_id()];
-        return ARPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
-                                  compat_calc_entry, info, loc_cpu_entry,
-                                  newinfo);
+        xt_entry_foreach(iter, loc_cpu_entry, info->size) {
+                ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
+                if (ret != 0)
+                        return ret;
+        }
+        return 0;
 }
 #endif
 
-static int get_info(struct net *net, void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user,
+                    const int *len, int compat)
 {
-        char name[ARPT_TABLE_MAXNAMELEN];
+        char name[XT_TABLE_MAXNAMELEN];
         struct xt_table *t;
         int ret;
 
@@ -897,7 +891,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
         if (copy_from_user(name, user, sizeof(name)) != 0)
                 return -EFAULT;
 
-        name[ARPT_TABLE_MAXNAMELEN-1] = '\0';
+        name[XT_TABLE_MAXNAMELEN-1] = '\0';
 #ifdef CONFIG_COMPAT
         if (compat)
                 xt_compat_lock(NFPROTO_ARP);
@@ -907,15 +901,16 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
         if (t && !IS_ERR(t)) {
                 struct arpt_getinfo info;
                 const struct xt_table_info *private = t->private;
-
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
+
                 if (compat) {
-                        struct xt_table_info tmp;
                         ret = compat_table_info(private, &tmp);
                         xt_compat_flush_offsets(NFPROTO_ARP);
                         private = &tmp;
                 }
 #endif
+                memset(&info, 0, sizeof(info));
                 info.valid_hooks = t->valid_hooks;
                 memcpy(info.hook_entry, private->hook_entry,
                        sizeof(info.hook_entry));
@@ -941,7 +936,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
 }
 
 static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
-                       int *len)
+                       const int *len)
 {
         int ret;
         struct arpt_get_entries get;
@@ -992,10 +987,10 @@ static int __do_replace(struct net *net, const char *name,
         struct xt_table_info *oldinfo;
         struct xt_counters *counters;
         void *loc_cpu_old_entry;
+        struct arpt_entry *iter;
 
         ret = 0;
-        counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
-                                numa_node_id());
+        counters = vzalloc(num_counters * sizeof(struct xt_counters));
         if (!counters) {
                 ret = -ENOMEM;
                 goto out;
@@ -1035,8 +1030,8 @@ static int __do_replace(struct net *net, const char *name,
 
         /* Decrease module usage counts and free resource */
         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
-        ARPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
-                           NULL);
+        xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
+                cleanup_entry(iter);
 
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
@@ -1055,12 +1050,14 @@ static int __do_replace(struct net *net, const char *name,
         return ret;
 }
 
-static int do_replace(struct net *net, void __user *user, unsigned int len)
+static int do_replace(struct net *net, const void __user *user,
+                      unsigned int len)
 {
         int ret;
         struct arpt_replace tmp;
         struct xt_table_info *newinfo;
         void *loc_cpu_entry;
+        struct arpt_entry *iter;
 
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
@@ -1081,9 +1078,7 @@ static int do_replace(struct net *net, void __user *user, unsigned int len)
                 goto free_newinfo;
         }
 
-        ret = translate_table(tmp.name, tmp.valid_hooks,
-                              newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
-                              tmp.hook_entry, tmp.underflow);
+        ret = translate_table(newinfo, loc_cpu_entry, &tmp);
         if (ret != 0)
                 goto free_newinfo;
 
@@ -1096,27 +1091,15 @@ static int do_replace(struct net *net, void __user *user, unsigned int len)
         return 0;
 
  free_newinfo_untrans:
-        ARPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
 }
 
-/* We're lazy, and add to the first CPU; overflow works its fey magic
- * and everything is OK. */
-static int
-add_counter_to_entry(struct arpt_entry *e,
-                     const struct xt_counters addme[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-static int do_add_counters(struct net *net, void __user *user, unsigned int len,
-                           int compat)
+static int do_add_counters(struct net *net, const void __user *user,
+                           unsigned int len, int compat)
 {
         unsigned int i, curcpu;
         struct xt_counters_info tmp;
@@ -1129,6 +1112,7 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,
         const struct xt_table_info *private;
         int ret = 0;
         void *loc_cpu_entry;
+        struct arpt_entry *iter;
 #ifdef CONFIG_COMPAT
         struct compat_xt_counters_info compat_tmp;
 
@@ -1159,7 +1143,7 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,
         if (len != size + num_counters * sizeof(struct xt_counters))
                 return -EINVAL;
 
-        paddc = vmalloc_node(len - size, numa_node_id());
+        paddc = vmalloc(len - size);
         if (!paddc)
                 return -ENOMEM;
 
@@ -1186,11 +1170,10 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,
         curcpu = smp_processor_id();
         loc_cpu_entry = private->entries[curcpu];
         xt_info_wrlock(curcpu);
-        ARPT_ENTRY_ITERATE(loc_cpu_entry,
-                           private->size,
-                           add_counter_to_entry,
-                           paddc,
-                           &i);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size) {
+                ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
+                ++i;
+        }
         xt_info_wrunlock(curcpu);
  unlock_up_free:
         local_bh_enable();
@@ -1203,38 +1186,32 @@ static int do_add_counters(struct net *net, void __user *user, unsigned int len,
 }
 
 #ifdef CONFIG_COMPAT
-static inline int
-compat_release_entry(struct compat_arpt_entry *e, unsigned int *i)
+static inline void compat_release_entry(struct compat_arpt_entry *e)
 {
-        struct arpt_entry_target *t;
-
-        if (i && (*i)-- == 0)
-                return 1;
+        struct xt_entry_target *t;
 
         t = compat_arpt_get_target(e);
         module_put(t->u.kernel.target->me);
-        return 0;
 }
 
 static inline int
 check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
                                   struct xt_table_info *newinfo,
                                   unsigned int *size,
-                                  unsigned char *base,
-                                  unsigned char *limit,
-                                  unsigned int *hook_entries,
-                                  unsigned int *underflows,
-                                  unsigned int *i,
+                                  const unsigned char *base,
+                                  const unsigned char *limit,
+                                  const unsigned int *hook_entries,
+                                  const unsigned int *underflows,
                                   const char *name)
 {
-        struct arpt_entry_target *t;
+        struct xt_entry_target *t;
         struct xt_target *target;
         unsigned int entry_offset;
         int ret, off, h;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
-        if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0
-            || (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct compat_arpt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct compat_arpt_entry) >= limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
@@ -1255,14 +1232,12 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
         entry_offset = (void *)e - (void *)base;
 
         t = compat_arpt_get_target(e);
-        target = try_then_request_module(xt_find_target(NFPROTO_ARP,
-                                                        t->u.user.name,
-                                                        t->u.user.revision),
-                                         "arpt_%s", t->u.user.name);
-        if (IS_ERR(target) || !target) {
+        target = xt_request_find_target(NFPROTO_ARP, t->u.user.name,
+                                        t->u.user.revision);
+        if (IS_ERR(target)) {
                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
                          t->u.user.name);
-                ret = target ? PTR_ERR(target) : -ENOENT;
+                ret = PTR_ERR(target);
                 goto out;
         }
         t->u.kernel.target = target;
@@ -1284,8 +1259,6 @@ check_compat_entry_size_and_hooks(struct compat_arpt_entry *e,
         /* Clear counters and comefrom */
         memset(&e->counters, 0, sizeof(e->counters));
         e->comefrom = 0;
-
-        (*i)++;
         return 0;
 
 release_target:
@@ -1299,7 +1272,7 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr,
                             unsigned int *size, const char *name,
                             struct xt_table_info *newinfo, unsigned char *base)
 {
-        struct arpt_entry_target *t;
+        struct xt_entry_target *t;
         struct xt_target *target;
         struct arpt_entry *de;
         unsigned int origsize;
@@ -1329,19 +1302,6 @@ compat_copy_entry_from_user(struct compat_arpt_entry *e, void **dstptr,
         return ret;
 }
 
-static inline int compat_check_entry(struct arpt_entry *e, const char *name,
-                                     unsigned int *i)
-{
-        int ret;
-
-        ret = check_target(e, name);
-        if (ret)
-                return ret;
-
-        (*i)++;
-        return 0;
-}
-
 static int translate_compat_table(const char *name,
                                   unsigned int valid_hooks,
                                   struct xt_table_info **pinfo,
@@ -1354,8 +1314,10 @@ static int translate_compat_table(const char *name,
         unsigned int i, j;
         struct xt_table_info *newinfo, *info;
         void *pos, *entry0, *entry1;
+        struct compat_arpt_entry *iter0;
+        struct arpt_entry *iter1;
         unsigned int size;
-        int ret;
+        int ret = 0;
 
         info = *pinfo;
         entry0 = *pentry0;
@@ -1372,13 +1334,17 @@ static int translate_compat_table(const char *name,
         j = 0;
         xt_compat_lock(NFPROTO_ARP);
         /* Walk through entries, checking offsets. */
-        ret = COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size,
-                                        check_compat_entry_size_and_hooks,
-                                        info, &size, entry0,
-                                        entry0 + total_size,
-                                        hook_entries, underflows, &j, name);
-        if (ret != 0)
-                goto out_unlock;
+        xt_entry_foreach(iter0, entry0, total_size) {
+                ret = check_compat_entry_size_and_hooks(iter0, info, &size,
+                                                        entry0,
+                                                        entry0 + total_size,
+                                                        hook_entries,
+                                                        underflows,
+                                                        name);
+                if (ret != 0)
+                        goto out_unlock;
+                ++j;
+        }
 
         ret = -EINVAL;
         if (j != number) {
@@ -1417,9 +1383,12 @@ static int translate_compat_table(const char *name,
         entry1 = newinfo->entries[raw_smp_processor_id()];
         pos = entry1;
         size = total_size;
-        ret = COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size,
-                                        compat_copy_entry_from_user,
-                                        &pos, &size, name, newinfo, entry1);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                ret = compat_copy_entry_from_user(iter0, &pos, &size,
+                                                  name, newinfo, entry1);
+                if (ret != 0)
+                        break;
+        }
         xt_compat_flush_offsets(NFPROTO_ARP);
         xt_compat_unlock(NFPROTO_ARP);
         if (ret)
@@ -1430,13 +1399,35 @@ static int translate_compat_table(const char *name,
                 goto free_newinfo;
 
         i = 0;
-        ret = ARPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
-                                 name, &i);
+        xt_entry_foreach(iter1, entry1, newinfo->size) {
+                ret = check_target(iter1, name);
+                if (ret != 0)
+                        break;
+                ++i;
+                if (strcmp(arpt_get_target(iter1)->u.user.name,
+                    XT_ERROR_TARGET) == 0)
+                        ++newinfo->stacksize;
+        }
         if (ret) {
+                /*
+                 * The first i matches need cleanup_entry (calls ->destroy)
+                 * because they had called ->check already. The other j-i
+                 * entries need only release.
+                 */
+                int skip = i;
                 j -= i;
-                COMPAT_ARPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
-                                                   compat_release_entry, &j);
-                ARPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
+                xt_entry_foreach(iter0, entry0, newinfo->size) {
+                        if (skip-- > 0)
+                                continue;
+                        if (j-- == 0)
+                                break;
+                        compat_release_entry(iter0);
+                }
+                xt_entry_foreach(iter1, entry1, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter1);
+                }
                 xt_free_table_info(newinfo);
                 return ret;
         }
@@ -1454,7 +1445,11 @@ static int translate_compat_table(const char *name,
 free_newinfo:
         xt_free_table_info(newinfo);
 out:
-        COMPAT_ARPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                if (j-- == 0)
+                        break;
+                compat_release_entry(iter0);
+        }
         return ret;
 out_unlock:
         xt_compat_flush_offsets(NFPROTO_ARP);
@@ -1463,7 +1458,7 @@ out_unlock:
 }
 
 struct compat_arpt_replace {
-        char                            name[ARPT_TABLE_MAXNAMELEN];
+        char                            name[XT_TABLE_MAXNAMELEN];
         u32                             valid_hooks;
         u32                             num_entries;
         u32                             size;
@@ -1481,6 +1476,7 @@ static int compat_do_replace(struct net *net, void __user *user,
         struct compat_arpt_replace tmp;
         struct xt_table_info *newinfo;
         void *loc_cpu_entry;
+        struct arpt_entry *iter;
 
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
@@ -1518,7 +1514,8 @@ static int compat_do_replace(struct net *net, void __user *user,
         return 0;
 
  free_newinfo_untrans:
-        ARPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
@@ -1552,22 +1549,20 @@ static int compat_do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user,
 static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr,
                                      compat_uint_t *size,
                                      struct xt_counters *counters,
-                                     unsigned int *i)
+                                     unsigned int i)
 {
-        struct arpt_entry_target *t;
+        struct xt_entry_target *t;
         struct compat_arpt_entry __user *ce;
         u_int16_t target_offset, next_offset;
         compat_uint_t origsize;
         int ret;
 
-        ret = -EFAULT;
         origsize = *size;
         ce = (struct compat_arpt_entry __user *)*dstptr;
-        if (copy_to_user(ce, e, sizeof(struct arpt_entry)))
-                goto out;
-
-        if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
-                goto out;
+        if (copy_to_user(ce, e, sizeof(struct arpt_entry)) != 0 ||
+            copy_to_user(&ce->counters, &counters[i],
+            sizeof(counters[i])) != 0)
+                return -EFAULT;
 
         *dstptr += sizeof(struct compat_arpt_entry);
         *size -= sizeof(struct arpt_entry) - sizeof(struct compat_arpt_entry);
@@ -1577,18 +1572,12 @@ static int compat_copy_entry_to_user(struct arpt_entry *e, void __user **dstptr,
         t = arpt_get_target(e);
         ret = xt_compat_target_to_user(t, dstptr, size);
         if (ret)
-                goto out;
-        ret = -EFAULT;
+                return ret;
         next_offset = e->next_offset - (origsize - *size);
-        if (put_user(target_offset, &ce->target_offset))
-                goto out;
-        if (put_user(next_offset, &ce->next_offset))
-                goto out;
-
-        (*i)++;
+        if (put_user(target_offset, &ce->target_offset) != 0 ||
+            put_user(next_offset, &ce->next_offset) != 0)
+                return -EFAULT;
         return 0;
-out:
-        return ret;
 }
 
 static int compat_copy_entries_to_user(unsigned int total_size,
@@ -1602,6 +1591,7 @@ static int compat_copy_entries_to_user(unsigned int total_size,
         int ret = 0;
         void *loc_cpu_entry;
         unsigned int i = 0;
+        struct arpt_entry *iter;
 
         counters = alloc_counters(table);
         if (IS_ERR(counters))
@@ -1611,15 +1601,18 @@ static int compat_copy_entries_to_user(unsigned int total_size,
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
         pos = userptr;
         size = total_size;
-        ret = ARPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
-                                 compat_copy_entry_to_user,
-                                 &pos, &size, counters, &i);
+        xt_entry_foreach(iter, loc_cpu_entry, total_size) {
+                ret = compat_copy_entry_to_user(iter, &pos,
+                                                &size, counters, i++);
+                if (ret != 0)
+                        break;
+        }
         vfree(counters);
         return ret;
 }
 
 struct compat_arpt_get_entries {
-        char name[ARPT_TABLE_MAXNAMELEN];
+        char name[XT_TABLE_MAXNAMELEN];
         compat_uint_t size;
         struct compat_arpt_entry entrytable[0];
 };
@@ -1760,13 +1753,13 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
         return ret;
 }
 
-struct xt_table *arpt_register_table(struct net *net, struct xt_table *table,
+struct xt_table *arpt_register_table(struct net *net,
+                                     const struct xt_table *table,
                                      const struct arpt_replace *repl)
 {
         int ret;
         struct xt_table_info *newinfo;
-        struct xt_table_info bootstrap
-                = { 0, 0, 0, { 0 }, { 0 }, { } };
+        struct xt_table_info bootstrap = {0};
         void *loc_cpu_entry;
         struct xt_table *new_table;
 
@@ -1780,12 +1773,7 @@ struct xt_table *arpt_register_table(struct net *net, struct xt_table *table,
         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
         memcpy(loc_cpu_entry, repl->entries, repl->size);
 
-        ret = translate_table(table->name, table->valid_hooks,
-                              newinfo, loc_cpu_entry, repl->size,
-                              repl->num_entries,
-                              repl->hook_entry,
-                              repl->underflow);
-
+        ret = translate_table(newinfo, loc_cpu_entry, repl);
         duprintf("arpt_register_table: translate table gives %d\n", ret);
         if (ret != 0)
                 goto out_free;
@@ -1808,35 +1796,37 @@ void arpt_unregister_table(struct xt_table *table)
         struct xt_table_info *private;
         void *loc_cpu_entry;
         struct module *table_owner = table->me;
+        struct arpt_entry *iter;
 
         private = xt_unregister_table(table);
 
         /* Decrease module usage counts and free resources */
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
-        ARPT_ENTRY_ITERATE(loc_cpu_entry, private->size,
-                           cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size)
+                cleanup_entry(iter);
         if (private->number > private->initial_entries)
                 module_put(table_owner);
         xt_free_table_info(private);
 }
 
 /* The built-in targets: standard (NULL) and error. */
-static struct xt_target arpt_standard_target __read_mostly = {
-        .name           = ARPT_STANDARD_TARGET,
-        .targetsize     = sizeof(int),
-        .family         = NFPROTO_ARP,
+static struct xt_target arpt_builtin_tg[] __read_mostly = {
+        {
+                .name             = XT_STANDARD_TARGET,
+                .targetsize       = sizeof(int),
+                .family           = NFPROTO_ARP,
 #ifdef CONFIG_COMPAT
-        .compatsize     = sizeof(compat_int_t),
-        .compat_from_user = compat_standard_from_user,
-        .compat_to_user = compat_standard_to_user,
+                .compatsize       = sizeof(compat_int_t),
+                .compat_from_user = compat_standard_from_user,
+                .compat_to_user   = compat_standard_to_user,
 #endif
-};
-
-static struct xt_target arpt_error_target __read_mostly = {
-        .name           = ARPT_ERROR_TARGET,
-        .target         = arpt_error,
-        .targetsize     = ARPT_FUNCTION_MAXNAMELEN,
-        .family         = NFPROTO_ARP,
+        },
+        {
+                .name             = XT_ERROR_TARGET,
+                .target           = arpt_error,
+                .targetsize       = XT_FUNCTION_MAXNAMELEN,
+                .family           = NFPROTO_ARP,
+        },
 };
 
 static struct nf_sockopt_ops arpt_sockopts = {
@@ -1880,12 +1870,9 @@ static int __init arp_tables_init(void)
                 goto err1;
 
         /* Noone else will be downing sem now, so we won't sleep */
-        ret = xt_register_target(&arpt_standard_target);
+        ret = xt_register_targets(arpt_builtin_tg, ARRAY_SIZE(arpt_builtin_tg));
         if (ret < 0)
                 goto err2;
-        ret = xt_register_target(&arpt_error_target);
-        if (ret < 0)
-                goto err3;
 
         /* Register setsockopt */
         ret = nf_register_sockopt(&arpt_sockopts);
@@ -1896,9 +1883,7 @@ static int __init arp_tables_init(void)
         return 0;
 
 err4:
-        xt_unregister_target(&arpt_error_target);
-err3:
-        xt_unregister_target(&arpt_standard_target);
+        xt_unregister_targets(arpt_builtin_tg, ARRAY_SIZE(arpt_builtin_tg));
 err2:
         unregister_pernet_subsys(&arp_tables_net_ops);
 err1:
@@ -1908,8 +1893,7 @@ err1:
 static void __exit arp_tables_fini(void)
 {
         nf_unregister_sockopt(&arpt_sockopts);
-        xt_unregister_target(&arpt_error_target);
-        xt_unregister_target(&arpt_standard_target);
+        xt_unregister_targets(arpt_builtin_tg, ARRAY_SIZE(arpt_builtin_tg));
         unregister_pernet_subsys(&arp_tables_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
index b0d5b1d0a769..b8ddcc480ed9 100644
--- a/net/ipv4/netfilter/arpt_mangle.c
+++ b/net/ipv4/netfilter/arpt_mangle.c
@@ -9,7 +9,7 @@ MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
 MODULE_DESCRIPTION("arptables arp payload mangle target");
 
 static unsigned int
-target(struct sk_buff *skb, const struct xt_target_param *par)
+target(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct arpt_mangle *mangle = par->targinfo;
         const struct arphdr *arp;
@@ -54,7 +54,7 @@ target(struct sk_buff *skb, const struct xt_target_param *par)
         return mangle->target;
 }
 
-static bool checkentry(const struct xt_tgchk_param *par)
+static int checkentry(const struct xt_tgchk_param *par)
 {
         const struct arpt_mangle *mangle = par->targinfo;
 
@@ -63,7 +63,7 @@ static bool checkentry(const struct xt_tgchk_param *par)
                 return false;
 
         if (mangle->target != NF_DROP && mangle->target != NF_ACCEPT &&
-           mangle->target != ARPT_CONTINUE)
+           mangle->target != XT_CONTINUE)
                 return false;
         return true;
 }
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 6ecfdae7c589..79ca5e70d497 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -6,7 +6,9 @@
  */
 
 #include <linux/module.h>
+#include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_arp/arp_tables.h>
+#include <linux/slab.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
@@ -15,93 +17,37 @@ MODULE_DESCRIPTION("arptables filter table");
 #define FILTER_VALID_HOOKS ((1 << NF_ARP_IN) | (1 << NF_ARP_OUT) | \
                            (1 << NF_ARP_FORWARD))
 
-static struct
-{
-        struct arpt_replace repl;
-        struct arpt_standard entries[3];
-        struct arpt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "filter",
-                .valid_hooks = FILTER_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct arpt_standard) * 3 + sizeof(struct arpt_error),
-                .hook_entry = {
-                        [NF_ARP_IN] = 0,
-                        [NF_ARP_OUT] = sizeof(struct arpt_standard),
-                        [NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard),
-                },
-                .underflow = {
-                        [NF_ARP_IN] = 0,
-                        [NF_ARP_OUT] = sizeof(struct arpt_standard),
-                        [NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard),
-                },
-        },
-        .entries = {
-                ARPT_STANDARD_INIT(NF_ACCEPT),  /* ARP_IN */
-                ARPT_STANDARD_INIT(NF_ACCEPT),  /* ARP_OUT */
-                ARPT_STANDARD_INIT(NF_ACCEPT),  /* ARP_FORWARD */
-        },
-        .term = ARPT_ERROR_INIT,
-};
-
-static struct xt_table packet_filter = {
+static const struct xt_table packet_filter = {
         .name           = "filter",
         .valid_hooks    = FILTER_VALID_HOOKS,
         .me             = THIS_MODULE,
         .af             = NFPROTO_ARP,
+        .priority       = NF_IP_PRI_FILTER,
 };
 
 /* The work comes in here from netfilter.c */
-static unsigned int arpt_in_hook(unsigned int hook,
-                                 struct sk_buff *skb,
-                                 const struct net_device *in,
-                                 const struct net_device *out,
-                                 int (*okfn)(struct sk_buff *))
+static unsigned int
+arptable_filter_hook(unsigned int hook, struct sk_buff *skb,
+                     const struct net_device *in, const struct net_device *out,
+                     int (*okfn)(struct sk_buff *))
 {
-        return arpt_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv4.arptable_filter);
-}
+        const struct net *net = dev_net((in != NULL) ? in : out);
 
-static unsigned int arpt_out_hook(unsigned int hook,
-                                  struct sk_buff *skb,
-                                  const struct net_device *in,
-                                  const struct net_device *out,
-                                  int (*okfn)(struct sk_buff *))
-{
-        return arpt_do_table(skb, hook, in, out,
-                             dev_net(out)->ipv4.arptable_filter);
+        return arpt_do_table(skb, hook, in, out, net->ipv4.arptable_filter);
 }
 
-static struct nf_hook_ops arpt_ops[] __read_mostly = {
-        {
-                .hook           = arpt_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_ARP,
-                .hooknum        = NF_ARP_IN,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-        {
-                .hook           = arpt_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_ARP,
-                .hooknum        = NF_ARP_OUT,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-        {
-                .hook           = arpt_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_ARP,
-                .hooknum        = NF_ARP_FORWARD,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-};
+static struct nf_hook_ops *arpfilter_ops __read_mostly;
 
 static int __net_init arptable_filter_net_init(struct net *net)
 {
-        /* Register table */
+        struct arpt_replace *repl;
+        
+        repl = arpt_alloc_initial_table(&packet_filter);
+        if (repl == NULL)
+                return -ENOMEM;
         net->ipv4.arptable_filter =
-                arpt_register_table(net, &packet_filter, &initial_table.repl);
+                arpt_register_table(net, &packet_filter, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.arptable_filter))
                 return PTR_ERR(net->ipv4.arptable_filter);
         return 0;
@@ -125,9 +71,11 @@ static int __init arptable_filter_init(void)
         if (ret < 0)
                 return ret;
 
-        ret = nf_register_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
-        if (ret < 0)
+        arpfilter_ops = xt_hook_link(&packet_filter, arptable_filter_hook);
+        if (IS_ERR(arpfilter_ops)) {
+                ret = PTR_ERR(arpfilter_ops);
                 goto cleanup_table;
+        }
         return ret;
 
 cleanup_table:
@@ -137,7 +85,7 @@ cleanup_table:
 
 static void __exit arptable_filter_fini(void)
 {
-        nf_unregister_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
+        xt_hook_unlink(&packet_filter, arpfilter_ops);
         unregister_pernet_subsys(&arptable_filter_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index c156db215987..d2c1311cb28d 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -26,6 +26,7 @@
 #include <linux/security.h>
 #include <linux/net.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/route.h>
@@ -41,7 +42,7 @@ typedef int (*ipq_cmpfn)(struct nf_queue_entry *, unsigned long);
 
 static unsigned char copy_mode __read_mostly = IPQ_COPY_NONE;
 static unsigned int queue_maxlen __read_mostly = IPQ_QMAX_DEFAULT;
-static DEFINE_RWLOCK(queue_lock);
+static DEFINE_SPINLOCK(queue_lock);
 static int peer_pid __read_mostly;
 static unsigned int copy_range __read_mostly;
 static unsigned int queue_total;
@@ -71,10 +72,10 @@ __ipq_set_mode(unsigned char mode, unsigned int range)
                 break;
 
         case IPQ_COPY_PACKET:
-                copy_mode = mode;
+                if (range > 0xFFFF)
+                        range = 0xFFFF;
                 copy_range = range;
-                if (copy_range > 0xFFFF)
-                        copy_range = 0xFFFF;
+                copy_mode = mode;
                 break;
 
         default:
@@ -100,7 +101,7 @@ ipq_find_dequeue_entry(unsigned long id)
 {
         struct nf_queue_entry *entry = NULL, *i;
 
-        write_lock_bh(&queue_lock);
+        spin_lock_bh(&queue_lock);
 
         list_for_each_entry(i, &queue_list, list) {
                 if ((unsigned long)i == id) {
@@ -114,7 +115,7 @@ ipq_find_dequeue_entry(unsigned long id)
                 queue_total--;
         }
 
-        write_unlock_bh(&queue_lock);
+        spin_unlock_bh(&queue_lock);
         return entry;
 }
 
@@ -135,9 +136,9 @@ __ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
 static void
 ipq_flush(ipq_cmpfn cmpfn, unsigned long data)
 {
-        write_lock_bh(&queue_lock);
+        spin_lock_bh(&queue_lock);
         __ipq_flush(cmpfn, data);
-        write_unlock_bh(&queue_lock);
+        spin_unlock_bh(&queue_lock);
 }
 
 static struct sk_buff *
@@ -151,37 +152,29 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
         struct nlmsghdr *nlh;
         struct timeval tv;
 
-        read_lock_bh(&queue_lock);
-
-        switch (copy_mode) {
+        switch (ACCESS_ONCE(copy_mode)) {
         case IPQ_COPY_META:
         case IPQ_COPY_NONE:
                 size = NLMSG_SPACE(sizeof(*pmsg));
                 break;
 
         case IPQ_COPY_PACKET:
-                if ((entry->skb->ip_summed == CHECKSUM_PARTIAL ||
-                     entry->skb->ip_summed == CHECKSUM_COMPLETE) &&
-                    (*errp = skb_checksum_help(entry->skb))) {
-                        read_unlock_bh(&queue_lock);
+                if (entry->skb->ip_summed == CHECKSUM_PARTIAL &&
+                    (*errp = skb_checksum_help(entry->skb)))
                         return NULL;
-                }
-                if (copy_range == 0 || copy_range > entry->skb->len)
+
+                data_len = ACCESS_ONCE(copy_range);
+                if (data_len == 0 || data_len > entry->skb->len)
                         data_len = entry->skb->len;
-                else
-                        data_len = copy_range;
 
                 size = NLMSG_SPACE(sizeof(*pmsg) + data_len);
                 break;
 
         default:
                 *errp = -EINVAL;
-                read_unlock_bh(&queue_lock);
                 return NULL;
         }
 
-        read_unlock_bh(&queue_lock);
-
         skb = alloc_skb(size, GFP_ATOMIC);
         if (!skb)
                 goto nlmsg_failure;
@@ -242,7 +235,7 @@ ipq_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
         if (nskb == NULL)
                 return status;
 
-        write_lock_bh(&queue_lock);
+        spin_lock_bh(&queue_lock);
 
         if (!peer_pid)
                 goto err_out_free_nskb;
@@ -266,14 +259,14 @@ ipq_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum)
 
         __ipq_enqueue_entry(entry);
 
-        write_unlock_bh(&queue_lock);
+        spin_unlock_bh(&queue_lock);
         return status;
 
 err_out_free_nskb:
         kfree_skb(nskb);
 
 err_out_unlock:
-        write_unlock_bh(&queue_lock);
+        spin_unlock_bh(&queue_lock);
         return status;
 }
 
@@ -342,9 +335,9 @@ ipq_set_mode(unsigned char mode, unsigned int range)
 {
         int status;
 
-        write_lock_bh(&queue_lock);
+        spin_lock_bh(&queue_lock);
         status = __ipq_set_mode(mode, range);
-        write_unlock_bh(&queue_lock);
+        spin_unlock_bh(&queue_lock);
         return status;
 }
 
@@ -440,11 +433,11 @@ __ipq_rcv_skb(struct sk_buff *skb)
         if (security_netlink_recv(skb, CAP_NET_ADMIN))
                 RCV_SKB_FAIL(-EPERM);
 
-        write_lock_bh(&queue_lock);
+        spin_lock_bh(&queue_lock);
 
         if (peer_pid) {
                 if (peer_pid != pid) {
-                        write_unlock_bh(&queue_lock);
+                        spin_unlock_bh(&queue_lock);
                         RCV_SKB_FAIL(-EBUSY);
                 }
         } else {
@@ -452,7 +445,7 @@ __ipq_rcv_skb(struct sk_buff *skb)
                 peer_pid = pid;
         }
 
-        write_unlock_bh(&queue_lock);
+        spin_unlock_bh(&queue_lock);
 
         status = ipq_receive_peer(NLMSG_DATA(nlh), type,
                                   nlmsglen - NLMSG_LENGTH(0));
@@ -461,7 +454,6 @@ __ipq_rcv_skb(struct sk_buff *skb)
 
         if (flags & NLM_F_ACK)
                 netlink_ack(skb, nlh, 0);
-        return;
 }
 
 static void
@@ -497,12 +489,11 @@ ipq_rcv_nl_event(struct notifier_block *this,
 {
         struct netlink_notify *n = ptr;
 
-        if (event == NETLINK_URELEASE &&
-            n->protocol == NETLINK_FIREWALL && n->pid) {
-                write_lock_bh(&queue_lock);
-                if ((n->net == &init_net) && (n->pid == peer_pid))
+        if (event == NETLINK_URELEASE && n->protocol == NETLINK_FIREWALL) {
+                spin_lock_bh(&queue_lock);
+                if ((net_eq(n->net, &init_net)) && (n->pid == peer_pid))
                         __ipq_reset();
-                write_unlock_bh(&queue_lock);
+                spin_unlock_bh(&queue_lock);
         }
         return NOTIFY_DONE;
 }
@@ -516,21 +507,20 @@ static struct ctl_table_header *ipq_sysctl_header;
 
 static ctl_table ipq_table[] = {
         {
-                .ctl_name       = NET_IPQ_QMAX,
                 .procname       = NET_IPQ_QMAX_NAME,
                 .data           = &queue_maxlen,
                 .maxlen         = sizeof(queue_maxlen),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        { .ctl_name = 0 }
+        { }
 };
 #endif
 
 #ifdef CONFIG_PROC_FS
 static int ip_queue_show(struct seq_file *m, void *v)
 {
-        read_lock_bh(&queue_lock);
+        spin_lock_bh(&queue_lock);
 
         seq_printf(m,
                       "Peer PID          : %d\n"
@@ -548,7 +538,7 @@ static int ip_queue_show(struct seq_file *m, void *v)
                       queue_dropped,
                       queue_user_dropped);
 
-        read_unlock_bh(&queue_lock);
+        spin_unlock_bh(&queue_lock);
         return 0;
 }
 
@@ -622,7 +612,7 @@ cleanup_netlink_notifier:
 static void __exit ip_queue_fini(void)
 {
         nf_unregister_queue_handlers(&nfqh);
-        synchronize_net();
+
         ipq_flush(NULL, 0);
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index fdefae6b5dfc..652efea013dc 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -8,6 +8,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/cache.h>
 #include <linux/capability.h>
 #include <linux/skbuff.h>
@@ -27,6 +28,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <net/netfilter/nf_log.h>
+#include "../../netfilter/xt_repldata.h"
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -37,24 +39,19 @@ MODULE_DESCRIPTION("IPv4 packet filter");
 /*#define DEBUG_IP_FIREWALL_USER*/
 
 #ifdef DEBUG_IP_FIREWALL
-#define dprintf(format, args...)  printk(format , ## args)
+#define dprintf(format, args...) pr_info(format , ## args)
 #else
 #define dprintf(format, args...)
 #endif
 
 #ifdef DEBUG_IP_FIREWALL_USER
-#define duprintf(format, args...) printk(format , ## args)
+#define duprintf(format, args...) pr_info(format , ## args)
 #else
 #define duprintf(format, args...)
 #endif
 
 #ifdef CONFIG_NETFILTER_DEBUG
-#define IP_NF_ASSERT(x)                                         \
-do {                                                            \
-        if (!(x))                                               \
-                printk("IP_NF_ASSERT: %s:%s:%u\n",              \
-                       __func__, __FILE__, __LINE__);   \
-} while(0)
+#define IP_NF_ASSERT(x)         WARN_ON(!(x))
 #else
 #define IP_NF_ASSERT(x)
 #endif
@@ -65,6 +62,12 @@ do {								\
 #define inline
 #endif
 
+void *ipt_alloc_initial_table(const struct xt_table *info)
+{
+        return xt_alloc_initial_table(ipt, IPT);
+}
+EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
+
 /*
    We keep a set of rules for each CPU, so we can avoid write-locking
    them in the softirq when updating the counters and therefore
@@ -88,9 +91,9 @@ ip_packet_match(const struct iphdr *ip,
 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
 
         if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
-                  IPT_INV_SRCIP)
-            || FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
-                     IPT_INV_DSTIP)) {
+                  IPT_INV_SRCIP) ||
+            FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+                  IPT_INV_DSTIP)) {
                 dprintf("Source or dest mismatch.\n");
 
                 dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
@@ -121,8 +124,8 @@ ip_packet_match(const struct iphdr *ip,
         }
 
         /* Check specific protocol */
-        if (ipinfo->proto
-            && FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
+        if (ipinfo->proto &&
+            FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
                 dprintf("Packet protocol %hi does not match %hi.%s\n",
                         ip->protocol, ipinfo->proto,
                         ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
@@ -157,52 +160,38 @@ ip_checkentry(const struct ipt_ip *ip)
 }
 
 static unsigned int
-ipt_error(struct sk_buff *skb, const struct xt_target_param *par)
+ipt_error(struct sk_buff *skb, const struct xt_action_param *par)
 {
         if (net_ratelimit())
-                printk("ip_tables: error: `%s'\n",
-                       (const char *)par->targinfo);
+                pr_info("error: `%s'\n", (const char *)par->targinfo);
 
         return NF_DROP;
 }
 
-/* Performance critical - called for every packet */
-static inline bool
-do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
-         struct xt_match_param *par)
-{
-        par->match     = m->u.kernel.match;
-        par->matchinfo = m->data;
-
-        /* Stop iteration if it doesn't match */
-        if (!m->u.kernel.match->match(skb, par))
-                return true;
-        else
-                return false;
-}
-
 /* Performance critical */
 static inline struct ipt_entry *
-get_entry(void *base, unsigned int offset)
+get_entry(const void *base, unsigned int offset)
 {
         return (struct ipt_entry *)(base + offset);
 }
 
 /* All zeroes == unconditional rule. */
 /* Mildly perf critical (only if packet tracing is on) */
-static inline int
-unconditional(const struct ipt_ip *ip)
+static inline bool unconditional(const struct ipt_ip *ip)
 {
-        unsigned int i;
-
-        for (i = 0; i < sizeof(*ip)/sizeof(__u32); i++)
-                if (((__u32 *)ip)[i])
-                        return 0;
+        static const struct ipt_ip uncond;
 
-        return 1;
+        return memcmp(ip, &uncond, sizeof(uncond)) == 0;
 #undef FWINV
 }
 
+/* for const-correctness */
+static inline const struct xt_entry_target *
+ipt_get_target_c(const struct ipt_entry *e)
+{
+        return ipt_get_target((struct ipt_entry *)e);
+}
+
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 static const char *const hooknames[] = {
@@ -237,24 +226,24 @@ static struct nf_loginfo trace_loginfo = {
 
 /* Mildly perf critical (only if packet tracing is on) */
 static inline int
-get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
+get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
                       const char *hookname, const char **chainname,
                       const char **comment, unsigned int *rulenum)
 {
-        struct ipt_standard_target *t = (void *)ipt_get_target(s);
+        const struct xt_standard_target *t = (void *)ipt_get_target_c(s);
 
-        if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
+        if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
                 /* Head of user chain: ERROR target with chainname */
                 *chainname = t->target.data;
                 (*rulenum) = 0;
         } else if (s == e) {
                 (*rulenum)++;
 
-                if (s->target_offset == sizeof(struct ipt_entry)
-                   && strcmp(t->target.u.kernel.target->name,
-                             IPT_STANDARD_TARGET) == 0
-                   && t->verdict < 0
-                   && unconditional(&s->ip)) {
+                if (s->target_offset == sizeof(struct ipt_entry) &&
+                    strcmp(t->target.u.kernel.target->name,
+                           XT_STANDARD_TARGET) == 0 &&
+                   t->verdict < 0 &&
+                   unconditional(&s->ip)) {
                         /* Tail of chains: STANDARD target (return/policy) */
                         *comment = *chainname == hookname
                                 ? comments[NF_IP_TRACE_COMMENT_POLICY]
@@ -267,17 +256,18 @@ get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
         return 0;
 }
 
-static void trace_packet(struct sk_buff *skb,
+static void trace_packet(const struct sk_buff *skb,
                          unsigned int hook,
                          const struct net_device *in,
                          const struct net_device *out,
                          const char *tablename,
-                         struct xt_table_info *private,
-                         struct ipt_entry *e)
+                         const struct xt_table_info *private,
+                         const struct ipt_entry *e)
 {
-        void *table_base;
+        const void *table_base;
         const struct ipt_entry *root;
         const char *hookname, *chainname, *comment;
+        const struct ipt_entry *iter;
         unsigned int rulenum = 0;
 
         table_base = private->entries[smp_processor_id()];
@@ -286,10 +276,10 @@ static void trace_packet(struct sk_buff *skb,
         hookname = chainname = hooknames[hook];
         comment = comments[NF_IP_TRACE_COMMENT_RULE];
 
-        IPT_ENTRY_ITERATE(root,
-                          private->size - private->hook_entry[hook],
-                          get_chainname_rulenum,
-                          e, hookname, &chainname, &comment, &rulenum);
+        xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
+                if (get_chainname_rulenum(iter, e, hookname,
+                    &chainname, &comment, &rulenum) != 0)
+                        break;
 
         nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
                       "TRACE: %s:%s:%s:%u ",
@@ -311,24 +301,19 @@ ipt_do_table(struct sk_buff *skb,
              const struct net_device *out,
              struct xt_table *table)
 {
-#define tb_comefrom ((struct ipt_entry *)table_base)->comefrom
-
         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
         const struct iphdr *ip;
-        u_int16_t datalen;
-        bool hotdrop = false;
         /* Initializing verdict to NF_DROP keeps gcc happy. */
         unsigned int verdict = NF_DROP;
         const char *indev, *outdev;
-        void *table_base;
-        struct ipt_entry *e, *back;
-        struct xt_table_info *private;
-        struct xt_match_param mtpar;
-        struct xt_target_param tgpar;
+        const void *table_base;
+        struct ipt_entry *e, **jumpstack;
+        unsigned int *stackptr, origptr, cpu;
+        const struct xt_table_info *private;
+        struct xt_action_param acpar;
 
         /* Initialization */
         ip = ip_hdr(skb);
-        datalen = skb->len - ip->ihl * 4;
         indev = in ? in->name : nulldevname;
         outdev = out ? out->name : nulldevname;
         /* We handle fragments by dealing with the first fragment as
@@ -337,37 +322,49 @@ ipt_do_table(struct sk_buff *skb,
          * things we don't know, ie. tcp syn flag or ports).  If the
          * rule is also a fragment-specific rule, non-fragments won't
          * match it. */
-        mtpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
-        mtpar.thoff   = ip_hdrlen(skb);
-        mtpar.hotdrop = &hotdrop;
-        mtpar.in      = tgpar.in  = in;
-        mtpar.out     = tgpar.out = out;
-        mtpar.family  = tgpar.family = NFPROTO_IPV4;
-        mtpar.hooknum = tgpar.hooknum = hook;
+        acpar.fragoff = ntohs(ip->frag_off) & IP_OFFSET;
+        acpar.thoff   = ip_hdrlen(skb);
+        acpar.hotdrop = false;
+        acpar.in      = in;
+        acpar.out     = out;
+        acpar.family  = NFPROTO_IPV4;
+        acpar.hooknum = hook;
 
         IP_NF_ASSERT(table->valid_hooks & (1 << hook));
         xt_info_rdlock_bh();
         private = table->private;
-        table_base = private->entries[smp_processor_id()];
+        cpu        = smp_processor_id();
+        table_base = private->entries[cpu];
+        jumpstack  = (struct ipt_entry **)private->jumpstack[cpu];
+        stackptr   = per_cpu_ptr(private->stackptr, cpu);
+        origptr    = *stackptr;
 
         e = get_entry(table_base, private->hook_entry[hook]);
 
-        /* For return from builtin chain */
-        back = get_entry(table_base, private->underflow[hook]);
+        pr_debug("Entering %s(hook %u); sp at %u (UF %p)\n",
+                 table->name, hook, origptr,
+                 get_entry(table_base, private->underflow[hook]));
 
         do {
-                struct ipt_entry_target *t;
+                const struct xt_entry_target *t;
+                const struct xt_entry_match *ematch;
 
                 IP_NF_ASSERT(e);
-                IP_NF_ASSERT(back);
                 if (!ip_packet_match(ip, indev, outdev,
-                    &e->ip, mtpar.fragoff) ||
-                    IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
+                    &e->ip, acpar.fragoff)) {
+ no_match:
                         e = ipt_next_entry(e);
                         continue;
                 }
 
-                ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
+                xt_ematch_foreach(ematch, e) {
+                        acpar.match     = ematch->u.kernel.match;
+                        acpar.matchinfo = ematch->data;
+                        if (!acpar.match->match(skb, &acpar))
+                                goto no_match;
+                }
+
+                ADD_COUNTER(e->counters, skb->len, 1);
 
                 t = ipt_get_target(e);
                 IP_NF_ASSERT(t->u.kernel.target);
@@ -383,75 +380,70 @@ ipt_do_table(struct sk_buff *skb,
                 if (!t->u.kernel.target->target) {
                         int v;
 
-                        v = ((struct ipt_standard_target *)t)->verdict;
+                        v = ((struct xt_standard_target *)t)->verdict;
                         if (v < 0) {
                                 /* Pop from stack? */
-                                if (v != IPT_RETURN) {
+                                if (v != XT_RETURN) {
                                         verdict = (unsigned)(-v) - 1;
                                         break;
                                 }
-                                e = back;
-                                back = get_entry(table_base, back->comefrom);
+                                if (*stackptr == 0) {
+                                        e = get_entry(table_base,
+                                            private->underflow[hook]);
+                                        pr_debug("Underflow (this is normal) "
+                                                 "to %p\n", e);
+                                } else {
+                                        e = jumpstack[--*stackptr];
+                                        pr_debug("Pulled %p out from pos %u\n",
+                                                 e, *stackptr);
+                                        e = ipt_next_entry(e);
+                                }
                                 continue;
                         }
-                        if (table_base + v != ipt_next_entry(e)
-                            && !(e->ip.flags & IPT_F_GOTO)) {
-                                /* Save old back ptr in next entry */
-                                struct ipt_entry *next = ipt_next_entry(e);
-                                next->comefrom = (void *)back - table_base;
-                                /* set back pointer to next entry */
-                                back = next;
+                        if (table_base + v != ipt_next_entry(e) &&
+                            !(e->ip.flags & IPT_F_GOTO)) {
+                                if (*stackptr >= private->stacksize) {
+                                        verdict = NF_DROP;
+                                        break;
+                                }
+                                jumpstack[(*stackptr)++] = e;
+                                pr_debug("Pushed %p into pos %u\n",
+                                         e, *stackptr - 1);
                         }
 
                         e = get_entry(table_base, v);
                         continue;
                 }
 
-                /* Targets which reenter must return
-                   abs. verdicts */
-                tgpar.target   = t->u.kernel.target;
-                tgpar.targinfo = t->data;
-
+                acpar.target   = t->u.kernel.target;
+                acpar.targinfo = t->data;
 
-#ifdef CONFIG_NETFILTER_DEBUG
-                tb_comefrom = 0xeeeeeeec;
-#endif
-                verdict = t->u.kernel.target->target(skb, &tgpar);
-#ifdef CONFIG_NETFILTER_DEBUG
-                if (tb_comefrom != 0xeeeeeeec && verdict == IPT_CONTINUE) {
-                        printk("Target %s reentered!\n",
-                               t->u.kernel.target->name);
-                        verdict = NF_DROP;
-                }
-                tb_comefrom = 0x57acc001;
-#endif
+                verdict = t->u.kernel.target->target(skb, &acpar);
                 /* Target might have changed stuff. */
                 ip = ip_hdr(skb);
-                datalen = skb->len - ip->ihl * 4;
-
-                if (verdict == IPT_CONTINUE)
+                if (verdict == XT_CONTINUE)
                         e = ipt_next_entry(e);
                 else
                         /* Verdict */
                         break;
-        } while (!hotdrop);
+        } while (!acpar.hotdrop);
         xt_info_rdunlock_bh();
-
+        pr_debug("Exiting %s; resetting sp from %u to %u\n",
+                 __func__, *stackptr, origptr);
+        *stackptr = origptr;
 #ifdef DEBUG_ALLOW_ALL
         return NF_ACCEPT;
 #else
-        if (hotdrop)
+        if (acpar.hotdrop)
                 return NF_DROP;
         else return verdict;
 #endif
-
-#undef tb_comefrom
 }
 
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
-mark_source_chains(struct xt_table_info *newinfo,
+mark_source_chains(const struct xt_table_info *newinfo,
                    unsigned int valid_hooks, void *entry0)
 {
         unsigned int hook;
@@ -469,27 +461,27 @@ mark_source_chains(struct xt_table_info *newinfo,
                 e->counters.pcnt = pos;
 
                 for (;;) {
-                        struct ipt_standard_target *t
-                                = (void *)ipt_get_target(e);
+                        const struct xt_standard_target *t
+                                = (void *)ipt_get_target_c(e);
                         int visited = e->comefrom & (1 << hook);
 
                         if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
-                                printk("iptables: loop hook %u pos %u %08X.\n",
+                                pr_err("iptables: loop hook %u pos %u %08X.\n",
                                        hook, pos, e->comefrom);
                                 return 0;
                         }
                         e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 
                         /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct ipt_entry)
-                            && (strcmp(t->target.u.user.name,
-                                       IPT_STANDARD_TARGET) == 0)
-                            && t->verdict < 0
-                            && unconditional(&e->ip)) || visited) {
+                        if ((e->target_offset == sizeof(struct ipt_entry) &&
+                             (strcmp(t->target.u.user.name,
+                                     XT_STANDARD_TARGET) == 0) &&
+                             t->verdict < 0 && unconditional(&e->ip)) ||
+                            visited) {
                                 unsigned int oldpos, size;
 
                                 if ((strcmp(t->target.u.user.name,
-                                            IPT_STANDARD_TARGET) == 0) &&
+                                            XT_STANDARD_TARGET) == 0) &&
                                     t->verdict < -NF_MAX_VERDICT - 1) {
                                         duprintf("mark_source_chains: bad "
                                                 "negative verdict (%i)\n",
@@ -532,8 +524,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                                 int newpos = t->verdict;
 
                                 if (strcmp(t->target.u.user.name,
-                                           IPT_STANDARD_TARGET) == 0
-                                    && newpos >= 0) {
+                                           XT_STANDARD_TARGET) == 0 &&
+                                    newpos >= 0) {
                                         if (newpos > newinfo->size -
                                                 sizeof(struct ipt_entry)) {
                                                 duprintf("mark_source_chains: "
@@ -560,38 +552,34 @@ mark_source_chains(struct xt_table_info *newinfo,
         return 1;
 }
 
-static int
-cleanup_match(struct ipt_entry_match *m, unsigned int *i)
+static void cleanup_match(struct xt_entry_match *m, struct net *net)
 {
         struct xt_mtdtor_param par;
 
-        if (i && (*i)-- == 0)
-                return 1;
-
+        par.net       = net;
         par.match     = m->u.kernel.match;
         par.matchinfo = m->data;
         par.family    = NFPROTO_IPV4;
         if (par.match->destroy != NULL)
                 par.match->destroy(&par);
         module_put(par.match->me);
-        return 0;
 }
 
 static int
-check_entry(struct ipt_entry *e, const char *name)
+check_entry(const struct ipt_entry *e, const char *name)
 {
-        struct ipt_entry_target *t;
+        const struct xt_entry_target *t;
 
         if (!ip_checkentry(&e->ip)) {
-                duprintf("ip_tables: ip check failed %p %s.\n", e, name);
+                duprintf("ip check failed %p %s.\n", e, par->match->name);
                 return -EINVAL;
         }
 
-        if (e->target_offset + sizeof(struct ipt_entry_target) >
+        if (e->target_offset + sizeof(struct xt_entry_target) >
             e->next_offset)
                 return -EINVAL;
 
-        t = ipt_get_target(e);
+        t = ipt_get_target_c(e);
         if (e->target_offset + t->u.target_size > e->next_offset)
                 return -EINVAL;
 
@@ -599,8 +587,7 @@ check_entry(struct ipt_entry *e, const char *name)
 }
 
 static int
-check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
-            unsigned int *i)
+check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 {
         const struct ipt_ip *ip = par->entryinfo;
         int ret;
@@ -611,31 +598,27 @@ check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
         ret = xt_check_match(par, m->u.match_size - sizeof(*m),
               ip->proto, ip->invflags & IPT_INV_PROTO);
         if (ret < 0) {
-                duprintf("ip_tables: check failed for `%s'.\n",
-                         par.match->name);
+                duprintf("check failed for `%s'.\n", par->match->name);
                 return ret;
         }
-        ++*i;
         return 0;
 }
 
 static int
-find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
-                 unsigned int *i)
+find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 {
         struct xt_match *match;
         int ret;
 
-        match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
-                                                      m->u.user.revision),
-                                        "ipt_%s", m->u.user.name);
-        if (IS_ERR(match) || !match) {
+        match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
+                                      m->u.user.revision);
+        if (IS_ERR(match)) {
                 duprintf("find_check_match: `%s' not found\n", m->u.user.name);
-                return match ? PTR_ERR(match) : -ENOENT;
+                return PTR_ERR(match);
         }
         m->u.kernel.match = match;
 
-        ret = check_match(m, par, i);
+        ret = check_match(m, par);
         if (ret)
                 goto err;
 
@@ -645,10 +628,11 @@ err:
         return ret;
 }
 
-static int check_target(struct ipt_entry *e, const char *name)
+static int check_target(struct ipt_entry *e, struct net *net, const char *name)
 {
-        struct ipt_entry_target *t = ipt_get_target(e);
+        struct xt_entry_target *t = ipt_get_target(e);
         struct xt_tgchk_param par = {
+                .net       = net,
                 .table     = name,
                 .entryinfo = e,
                 .target    = t->u.kernel.target,
@@ -661,7 +645,7 @@ static int check_target(struct ipt_entry *e, const char *name)
         ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
               e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
         if (ret < 0) {
-                duprintf("ip_tables: check failed for `%s'.\n",
+                duprintf("check failed for `%s'.\n",
                          t->u.kernel.target->name);
                 return ret;
         }
@@ -669,72 +653,92 @@ static int check_target(struct ipt_entry *e, const char *name)
 }
 
 static int
-find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
-                 unsigned int *i)
+find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
+                 unsigned int size)
 {
-        struct ipt_entry_target *t;
+        struct xt_entry_target *t;
         struct xt_target *target;
         int ret;
         unsigned int j;
         struct xt_mtchk_param mtpar;
+        struct xt_entry_match *ematch;
 
         ret = check_entry(e, name);
         if (ret)
                 return ret;
 
         j = 0;
+        mtpar.net       = net;
         mtpar.table     = name;
         mtpar.entryinfo = &e->ip;
         mtpar.hook_mask = e->comefrom;
         mtpar.family    = NFPROTO_IPV4;
-        ret = IPT_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
-        if (ret != 0)
-                goto cleanup_matches;
+        xt_ematch_foreach(ematch, e) {
+                ret = find_check_match(ematch, &mtpar);
+                if (ret != 0)
+                        goto cleanup_matches;
+                ++j;
+        }
 
         t = ipt_get_target(e);
-        target = try_then_request_module(xt_find_target(AF_INET,
-                                                        t->u.user.name,
-                                                        t->u.user.revision),
-                                         "ipt_%s", t->u.user.name);
-        if (IS_ERR(target) || !target) {
+        target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
+                                        t->u.user.revision);
+        if (IS_ERR(target)) {
                 duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
-                ret = target ? PTR_ERR(target) : -ENOENT;
+                ret = PTR_ERR(target);
                 goto cleanup_matches;
         }
         t->u.kernel.target = target;
 
-        ret = check_target(e, name);
+        ret = check_target(e, net, name);
         if (ret)
                 goto err;
-
-        (*i)++;
         return 0;
  err:
         module_put(t->u.kernel.target->me);
  cleanup_matches:
-        IPT_MATCH_ITERATE(e, cleanup_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                cleanup_match(ematch, net);
+        }
         return ret;
 }
 
+static bool check_underflow(const struct ipt_entry *e)
+{
+        const struct xt_entry_target *t;
+        unsigned int verdict;
+
+        if (!unconditional(&e->ip))
+                return false;
+        t = ipt_get_target_c(e);
+        if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
+                return false;
+        verdict = ((struct xt_standard_target *)t)->verdict;
+        verdict = -verdict - 1;
+        return verdict == NF_DROP || verdict == NF_ACCEPT;
+}
+
 static int
 check_entry_size_and_hooks(struct ipt_entry *e,
                            struct xt_table_info *newinfo,
-                           unsigned char *base,
-                           unsigned char *limit,
+                           const unsigned char *base,
+                           const unsigned char *limit,
                            const unsigned int *hook_entries,
                            const unsigned int *underflows,
-                           unsigned int *i)
+                           unsigned int valid_hooks)
 {
         unsigned int h;
 
-        if ((unsigned long)e % __alignof__(struct ipt_entry) != 0
-            || (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
                 duprintf("Bad offset %p\n", e);
                 return -EINVAL;
         }
 
         if (e->next_offset
-            < sizeof(struct ipt_entry) + sizeof(struct ipt_entry_target)) {
+            < sizeof(struct ipt_entry) + sizeof(struct xt_entry_target)) {
                 duprintf("checking: element %p size %u\n",
                          e, e->next_offset);
                 return -EINVAL;
@@ -742,62 +746,60 @@ check_entry_size_and_hooks(struct ipt_entry *e,
 
         /* Check hooks & underflows */
         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
+                if (!(valid_hooks & (1 << h)))
+                        continue;
                 if ((unsigned char *)e - base == hook_entries[h])
                         newinfo->hook_entry[h] = hook_entries[h];
-                if ((unsigned char *)e - base == underflows[h])
+                if ((unsigned char *)e - base == underflows[h]) {
+                        if (!check_underflow(e)) {
+                                pr_err("Underflows must be unconditional and "
+                                       "use the STANDARD target with "
+                                       "ACCEPT/DROP\n");
+                                return -EINVAL;
+                        }
                         newinfo->underflow[h] = underflows[h];
+                }
         }
 
-        /* FIXME: underflows must be unconditional, standard verdicts
-           < 0 (not IPT_RETURN). --RR */
-
         /* Clear counters and comefrom */
         e->counters = ((struct xt_counters) { 0, 0 });
         e->comefrom = 0;
-
-        (*i)++;
         return 0;
 }
 
-static int
-cleanup_entry(struct ipt_entry *e, unsigned int *i)
+static void
+cleanup_entry(struct ipt_entry *e, struct net *net)
 {
         struct xt_tgdtor_param par;
-        struct ipt_entry_target *t;
-
-        if (i && (*i)-- == 0)
-                return 1;
+        struct xt_entry_target *t;
+        struct xt_entry_match *ematch;
 
         /* Cleanup all matches */
-        IPT_MATCH_ITERATE(e, cleanup_match, NULL);
+        xt_ematch_foreach(ematch, e)
+                cleanup_match(ematch, net);
         t = ipt_get_target(e);
 
+        par.net      = net;
         par.target   = t->u.kernel.target;
         par.targinfo = t->data;
         par.family   = NFPROTO_IPV4;
         if (par.target->destroy != NULL)
                 par.target->destroy(&par);
         module_put(par.target->me);
-        return 0;
 }
 
 /* Checks and translates the user-supplied table segment (held in
    newinfo) */
 static int
-translate_table(const char *name,
-                unsigned int valid_hooks,
-                struct xt_table_info *newinfo,
-                void *entry0,
-                unsigned int size,
-                unsigned int number,
-                const unsigned int *hook_entries,
-                const unsigned int *underflows)
+translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+                const struct ipt_replace *repl)
 {
+        struct ipt_entry *iter;
         unsigned int i;
-        int ret;
+        int ret = 0;
 
-        newinfo->size = size;
-        newinfo->number = number;
+        newinfo->size = repl->size;
+        newinfo->number = repl->num_entries;
 
         /* Init all hooks to impossible value. */
         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
@@ -808,49 +810,61 @@ translate_table(const char *name,
         duprintf("translate_table: size %u\n", newinfo->size);
         i = 0;
         /* Walk through entries, checking offsets. */
-        ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                check_entry_size_and_hooks,
-                                newinfo,
-                                entry0,
-                                entry0 + size,
-                                hook_entries, underflows, &i);
-        if (ret != 0)
-                return ret;
+        xt_entry_foreach(iter, entry0, newinfo->size) {
+                ret = check_entry_size_and_hooks(iter, newinfo, entry0,
+                                                 entry0 + repl->size,
+                                                 repl->hook_entry,
+                                                 repl->underflow,
+                                                 repl->valid_hooks);
+                if (ret != 0)
+                        return ret;
+                ++i;
+                if (strcmp(ipt_get_target(iter)->u.user.name,
+                    XT_ERROR_TARGET) == 0)
+                        ++newinfo->stacksize;
+        }
 
-        if (i != number) {
+        if (i != repl->num_entries) {
                 duprintf("translate_table: %u not %u entries\n",
-                         i, number);
+                         i, repl->num_entries);
                 return -EINVAL;
         }
 
         /* Check hooks all assigned */
         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
                 /* Only hooks which are valid */
-                if (!(valid_hooks & (1 << i)))
+                if (!(repl->valid_hooks & (1 << i)))
                         continue;
                 if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
                         duprintf("Invalid hook entry %u %u\n",
-                                 i, hook_entries[i]);
+                                 i, repl->hook_entry[i]);
                         return -EINVAL;
                 }
                 if (newinfo->underflow[i] == 0xFFFFFFFF) {
                         duprintf("Invalid underflow %u %u\n",
-                                 i, underflows[i]);
+                                 i, repl->underflow[i]);
                         return -EINVAL;
                 }
         }
 
-        if (!mark_source_chains(newinfo, valid_hooks, entry0))
+        if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
                 return -ELOOP;
 
         /* Finally, each sanity check must pass */
         i = 0;
-        ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                find_check_entry, name, size, &i);
+        xt_entry_foreach(iter, entry0, newinfo->size) {
+                ret = find_check_entry(iter, net, repl->name, repl->size);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
 
         if (ret != 0) {
-                IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                                cleanup_entry, &i);
+                xt_entry_foreach(iter, entry0, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter, net);
+                }
                 return ret;
         }
 
@@ -863,80 +877,45 @@ translate_table(const char *name,
         return ret;
 }
 
-/* Gets counters. */
-static inline int
-add_entry_to_counter(const struct ipt_entry *e,
-                     struct xt_counters total[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-        (*i)++;
-        return 0;
-}
-
-static inline int
-set_entry_to_counter(const struct ipt_entry *e,
-                     struct ipt_counters total[],
-                     unsigned int *i)
-{
-        SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-        (*i)++;
-        return 0;
-}
-
 static void
 get_counters(const struct xt_table_info *t,
              struct xt_counters counters[])
 {
+        struct ipt_entry *iter;
         unsigned int cpu;
         unsigned int i;
-        unsigned int curcpu;
-
-        /* Instead of clearing (by a previous call to memset())
-         * the counters and using adds, we set the counters
-         * with data used by 'current' CPU.
-         *
-         * Bottom half has to be disabled to prevent deadlock
-         * if new softirq were to run and call ipt_do_table
-         */
-        local_bh_disable();
-        curcpu = smp_processor_id();
-
-        i = 0;
-        IPT_ENTRY_ITERATE(t->entries[curcpu],
-                          t->size,
-                          set_entry_to_counter,
-                          counters,
-                          &i);
 
         for_each_possible_cpu(cpu) {
-                if (cpu == curcpu)
-                        continue;
+                seqlock_t *lock = &per_cpu(xt_info_locks, cpu).lock;
+
                 i = 0;
-                xt_info_wrlock(cpu);
-                IPT_ENTRY_ITERATE(t->entries[cpu],
-                                  t->size,
-                                  add_entry_to_counter,
-                                  counters,
-                                  &i);
-                xt_info_wrunlock(cpu);
+                xt_entry_foreach(iter, t->entries[cpu], t->size) {
+                        u64 bcnt, pcnt;
+                        unsigned int start;
+
+                        do {
+                                start = read_seqbegin(lock);
+                                bcnt = iter->counters.bcnt;
+                                pcnt = iter->counters.pcnt;
+                        } while (read_seqretry(lock, start));
+
+                        ADD_COUNTER(counters[i], bcnt, pcnt);
+                        ++i; /* macro does multi eval of i */
+                }
         }
-        local_bh_enable();
 }
 
-static struct xt_counters * alloc_counters(struct xt_table *table)
+static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
         unsigned int countersize;
         struct xt_counters *counters;
-        struct xt_table_info *private = table->private;
+        const struct xt_table_info *private = table->private;
 
         /* We need atomic snapshot of counters: rest doesn't change
            (other than comefrom, which userspace doesn't care
            about). */
         countersize = sizeof(struct xt_counters) * private->number;
-        counters = vmalloc_node(countersize, numa_node_id());
+        counters = vzalloc(countersize);
 
         if (counters == NULL)
                 return ERR_PTR(-ENOMEM);
@@ -948,11 +927,11 @@ static struct xt_counters * alloc_counters(struct xt_table *table)
 
 static int
 copy_entries_to_user(unsigned int total_size,
-                     struct xt_table *table,
+                     const struct xt_table *table,
                      void __user *userptr)
 {
         unsigned int off, num;
-        struct ipt_entry *e;
+        const struct ipt_entry *e;
         struct xt_counters *counters;
         const struct xt_table_info *private = table->private;
         int ret = 0;
@@ -976,8 +955,8 @@ copy_entries_to_user(unsigned int total_size,
         /* ... then go back and fix counters and names */
         for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
                 unsigned int i;
-                const struct ipt_entry_match *m;
-                const struct ipt_entry_target *t;
+                const struct xt_entry_match *m;
+                const struct xt_entry_target *t;
 
                 e = (struct ipt_entry *)(loc_cpu_entry + off);
                 if (copy_to_user(userptr + off
@@ -994,7 +973,7 @@ copy_entries_to_user(unsigned int total_size,
                         m = (void *)e + i;
 
                         if (copy_to_user(userptr + off + i
-                                         + offsetof(struct ipt_entry_match,
+                                         + offsetof(struct xt_entry_match,
                                                     u.user.name),
                                          m->u.kernel.match->name,
                                          strlen(m->u.kernel.match->name)+1)
@@ -1004,9 +983,9 @@ copy_entries_to_user(unsigned int total_size,
                         }
                 }
 
-                t = ipt_get_target(e);
+                t = ipt_get_target_c(e);
                 if (copy_to_user(userptr + off + e->target_offset
-                                 + offsetof(struct ipt_entry_target,
+                                 + offsetof(struct xt_entry_target,
                                             u.user.name),
                                  t->u.kernel.target->name,
                                  strlen(t->u.kernel.target->name)+1) != 0) {
@@ -1021,7 +1000,7 @@ copy_entries_to_user(unsigned int total_size,
 }
 
 #ifdef CONFIG_COMPAT
-static void compat_standard_from_user(void *dst, void *src)
+static void compat_standard_from_user(void *dst, const void *src)
 {
         int v = *(compat_int_t *)src;
 
@@ -1030,7 +1009,7 @@ static void compat_standard_from_user(void *dst, void *src)
         memcpy(dst, &v, sizeof(v));
 }
 
-static int compat_standard_to_user(void __user *dst, void *src)
+static int compat_standard_to_user(void __user *dst, const void *src)
 {
         compat_int_t cv = *(int *)src;
 
@@ -1039,25 +1018,20 @@ static int compat_standard_to_user(void __user *dst, void *src)
         return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
 
-static inline int
-compat_calc_match(struct ipt_entry_match *m, int *size)
-{
-        *size += xt_compat_match_offset(m->u.kernel.match);
-        return 0;
-}
-
-static int compat_calc_entry(struct ipt_entry *e,
+static int compat_calc_entry(const struct ipt_entry *e,
                              const struct xt_table_info *info,
-                             void *base, struct xt_table_info *newinfo)
+                             const void *base, struct xt_table_info *newinfo)
 {
-        struct ipt_entry_target *t;
+        const struct xt_entry_match *ematch;
+        const struct xt_entry_target *t;
         unsigned int entry_offset;
         int off, i, ret;
 
         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
         entry_offset = (void *)e - base;
-        IPT_MATCH_ITERATE(e, compat_calc_match, &off);
-        t = ipt_get_target(e);
+        xt_ematch_foreach(ematch, e)
+                off += xt_compat_match_offset(ematch->u.kernel.match);
+        t = ipt_get_target_c(e);
         off += xt_compat_target_offset(t->u.kernel.target);
         newinfo->size -= off;
         ret = xt_compat_add_offset(AF_INET, entry_offset, off);
@@ -1078,7 +1052,9 @@ static int compat_calc_entry(struct ipt_entry *e,
 static int compat_table_info(const struct xt_table_info *info,
                              struct xt_table_info *newinfo)
 {
+        struct ipt_entry *iter;
         void *loc_cpu_entry;
+        int ret;
 
         if (!newinfo || !info)
                 return -EINVAL;
@@ -1087,15 +1063,19 @@ static int compat_table_info(const struct xt_table_info *info,
         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
         newinfo->initial_entries = 0;
         loc_cpu_entry = info->entries[raw_smp_processor_id()];
-        return IPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
-                                 compat_calc_entry, info, loc_cpu_entry,
-                                 newinfo);
+        xt_entry_foreach(iter, loc_cpu_entry, info->size) {
+                ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
+                if (ret != 0)
+                        return ret;
+        }
+        return 0;
 }
 #endif
 
-static int get_info(struct net *net, void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user,
+                    const int *len, int compat)
 {
-        char name[IPT_TABLE_MAXNAMELEN];
+        char name[XT_TABLE_MAXNAMELEN];
         struct xt_table *t;
         int ret;
 
@@ -1108,7 +1088,7 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
         if (copy_from_user(name, user, sizeof(name)) != 0)
                 return -EFAULT;
 
-        name[IPT_TABLE_MAXNAMELEN-1] = '\0';
+        name[XT_TABLE_MAXNAMELEN-1] = '\0';
 #ifdef CONFIG_COMPAT
         if (compat)
                 xt_compat_lock(AF_INET);
@@ -1118,15 +1098,16 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
         if (t && !IS_ERR(t)) {
                 struct ipt_getinfo info;
                 const struct xt_table_info *private = t->private;
-
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
+
                 if (compat) {
-                        struct xt_table_info tmp;
                         ret = compat_table_info(private, &tmp);
                         xt_compat_flush_offsets(AF_INET);
                         private = &tmp;
                 }
 #endif
+                memset(&info, 0, sizeof(info));
                 info.valid_hooks = t->valid_hooks;
                 memcpy(info.hook_entry, private->hook_entry,
                        sizeof(info.hook_entry));
@@ -1153,7 +1134,8 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
 }
 
 static int
-get_entries(struct net *net, struct ipt_get_entries __user *uptr, int *len)
+get_entries(struct net *net, struct ipt_get_entries __user *uptr,
+            const int *len)
 {
         int ret;
         struct ipt_get_entries get;
@@ -1201,9 +1183,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
         struct xt_table_info *oldinfo;
         struct xt_counters *counters;
         void *loc_cpu_old_entry;
+        struct ipt_entry *iter;
 
         ret = 0;
-        counters = vmalloc(num_counters * sizeof(struct xt_counters));
+        counters = vzalloc(num_counters * sizeof(struct xt_counters));
         if (!counters) {
                 ret = -ENOMEM;
                 goto out;
@@ -1243,8 +1226,9 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 
         /* Decrease module usage counts and free resource */
         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
-        IPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
-                          NULL);
+        xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
+                cleanup_entry(iter, net);
+
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
                          sizeof(struct xt_counters) * num_counters) != 0)
@@ -1263,12 +1247,13 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 }
 
 static int
-do_replace(struct net *net, void __user *user, unsigned int len)
+do_replace(struct net *net, const void __user *user, unsigned int len)
 {
         int ret;
         struct ipt_replace tmp;
         struct xt_table_info *newinfo;
         void *loc_cpu_entry;
+        struct ipt_entry *iter;
 
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
@@ -1289,13 +1274,11 @@ do_replace(struct net *net, void __user *user, unsigned int len)
                 goto free_newinfo;
         }
 
-        ret = translate_table(tmp.name, tmp.valid_hooks,
-                              newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
-                              tmp.hook_entry, tmp.underflow);
+        ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
         if (ret != 0)
                 goto free_newinfo;
 
-        duprintf("ip_tables: Translated table\n");
+        duprintf("Translated table\n");
 
         ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
                            tmp.num_counters, tmp.counters);
@@ -1304,27 +1287,16 @@ do_replace(struct net *net, void __user *user, unsigned int len)
         return 0;
 
  free_newinfo_untrans:
-        IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter, net);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
 }
 
-/* We're lazy, and add to the first CPU; overflow works its fey magic
- * and everything is OK. */
-static int
-add_counter_to_entry(struct ipt_entry *e,
-                     const struct xt_counters addme[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
-
-        (*i)++;
-        return 0;
-}
-
 static int
-do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)
+do_add_counters(struct net *net, const void __user *user,
+                unsigned int len, int compat)
 {
         unsigned int i, curcpu;
         struct xt_counters_info tmp;
@@ -1337,6 +1309,7 @@ do_add_counters(struct net *net, void __user *user, unsigned int len, int compat
         const struct xt_table_info *private;
         int ret = 0;
         void *loc_cpu_entry;
+        struct ipt_entry *iter;
 #ifdef CONFIG_COMPAT
         struct compat_xt_counters_info compat_tmp;
 
@@ -1367,7 +1340,7 @@ do_add_counters(struct net *net, void __user *user, unsigned int len, int compat
         if (len != size + num_counters * sizeof(struct xt_counters))
                 return -EINVAL;
 
-        paddc = vmalloc_node(len - size, numa_node_id());
+        paddc = vmalloc(len - size);
         if (!paddc)
                 return -ENOMEM;
 
@@ -1394,11 +1367,10 @@ do_add_counters(struct net *net, void __user *user, unsigned int len, int compat
         curcpu = smp_processor_id();
         loc_cpu_entry = private->entries[curcpu];
         xt_info_wrlock(curcpu);
-        IPT_ENTRY_ITERATE(loc_cpu_entry,
-                          private->size,
-                          add_counter_to_entry,
-                          paddc,
-                          &i);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size) {
+                ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
+                ++i;
+        }
         xt_info_wrunlock(curcpu);
  unlock_up_free:
         local_bh_enable();
@@ -1412,130 +1384,109 @@ do_add_counters(struct net *net, void __user *user, unsigned int len, int compat
 
 #ifdef CONFIG_COMPAT
 struct compat_ipt_replace {
-        char                    name[IPT_TABLE_MAXNAMELEN];
+        char                    name[XT_TABLE_MAXNAMELEN];
         u32                     valid_hooks;
         u32                     num_entries;
         u32                     size;
         u32                     hook_entry[NF_INET_NUMHOOKS];
         u32                     underflow[NF_INET_NUMHOOKS];
         u32                     num_counters;
-        compat_uptr_t           counters;       /* struct ipt_counters * */
+        compat_uptr_t           counters;       /* struct xt_counters * */
         struct compat_ipt_entry entries[0];
 };
 
 static int
 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
                           unsigned int *size, struct xt_counters *counters,
-                          unsigned int *i)
+                          unsigned int i)
 {
-        struct ipt_entry_target *t;
+        struct xt_entry_target *t;
         struct compat_ipt_entry __user *ce;
         u_int16_t target_offset, next_offset;
         compat_uint_t origsize;
-        int ret;
+        const struct xt_entry_match *ematch;
+        int ret = 0;
 
-        ret = -EFAULT;
         origsize = *size;
         ce = (struct compat_ipt_entry __user *)*dstptr;
-        if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
-                goto out;
-
-        if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
-                goto out;
+        if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
+            copy_to_user(&ce->counters, &counters[i],
+            sizeof(counters[i])) != 0)
+                return -EFAULT;
 
         *dstptr += sizeof(struct compat_ipt_entry);
         *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
 
-        ret = IPT_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
+        xt_ematch_foreach(ematch, e) {
+                ret = xt_compat_match_to_user(ematch, dstptr, size);
+                if (ret != 0)
+                        return ret;
+        }
         target_offset = e->target_offset - (origsize - *size);
-        if (ret)
-                goto out;
         t = ipt_get_target(e);
         ret = xt_compat_target_to_user(t, dstptr, size);
         if (ret)
-                goto out;
-        ret = -EFAULT;
+                return ret;
         next_offset = e->next_offset - (origsize - *size);
-        if (put_user(target_offset, &ce->target_offset))
-                goto out;
-        if (put_user(next_offset, &ce->next_offset))
-                goto out;
-
-        (*i)++;
+        if (put_user(target_offset, &ce->target_offset) != 0 ||
+            put_user(next_offset, &ce->next_offset) != 0)
+                return -EFAULT;
         return 0;
-out:
-        return ret;
 }
 
 static int
-compat_find_calc_match(struct ipt_entry_match *m,
+compat_find_calc_match(struct xt_entry_match *m,
                        const char *name,
                        const struct ipt_ip *ip,
                        unsigned int hookmask,
-                       int *size, unsigned int *i)
+                       int *size)
 {
         struct xt_match *match;
 
-        match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
-                                                      m->u.user.revision),
-                                        "ipt_%s", m->u.user.name);
-        if (IS_ERR(match) || !match) {
+        match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
+                                      m->u.user.revision);
+        if (IS_ERR(match)) {
                 duprintf("compat_check_calc_match: `%s' not found\n",
                          m->u.user.name);
-                return match ? PTR_ERR(match) : -ENOENT;
+                return PTR_ERR(match);
         }
         m->u.kernel.match = match;
         *size += xt_compat_match_offset(match);
-
-        (*i)++;
         return 0;
 }
 
-static int
-compat_release_match(struct ipt_entry_match *m, unsigned int *i)
+static void compat_release_entry(struct compat_ipt_entry *e)
 {
-        if (i && (*i)-- == 0)
-                return 1;
-
-        module_put(m->u.kernel.match->me);
-        return 0;
-}
-
-static int
-compat_release_entry(struct compat_ipt_entry *e, unsigned int *i)
-{
-        struct ipt_entry_target *t;
-
-        if (i && (*i)-- == 0)
-                return 1;
+        struct xt_entry_target *t;
+        struct xt_entry_match *ematch;
 
         /* Cleanup all matches */
-        COMPAT_IPT_MATCH_ITERATE(e, compat_release_match, NULL);
+        xt_ematch_foreach(ematch, e)
+                module_put(ematch->u.kernel.match->me);
         t = compat_ipt_get_target(e);
         module_put(t->u.kernel.target->me);
-        return 0;
 }
 
 static int
 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
                                   struct xt_table_info *newinfo,
                                   unsigned int *size,
-                                  unsigned char *base,
-                                  unsigned char *limit,
-                                  unsigned int *hook_entries,
-                                  unsigned int *underflows,
-                                  unsigned int *i,
+                                  const unsigned char *base,
+                                  const unsigned char *limit,
+                                  const unsigned int *hook_entries,
+                                  const unsigned int *underflows,
                                   const char *name)
 {
-        struct ipt_entry_target *t;
+        struct xt_entry_match *ematch;
+        struct xt_entry_target *t;
         struct xt_target *target;
         unsigned int entry_offset;
         unsigned int j;
         int ret, off, h;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
-        if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
-            || (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
+        if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
+            (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
                 duprintf("Bad offset %p, limit = %p\n", e, limit);
                 return -EINVAL;
         }
@@ -1555,20 +1506,21 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
         off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
         entry_offset = (void *)e - (void *)base;
         j = 0;
-        ret = COMPAT_IPT_MATCH_ITERATE(e, compat_find_calc_match, name,
-                                       &e->ip, e->comefrom, &off, &j);
-        if (ret != 0)
-                goto release_matches;
+        xt_ematch_foreach(ematch, e) {
+                ret = compat_find_calc_match(ematch, name,
+                                             &e->ip, e->comefrom, &off);
+                if (ret != 0)
+                        goto release_matches;
+                ++j;
+        }
 
         t = compat_ipt_get_target(e);
-        target = try_then_request_module(xt_find_target(AF_INET,
-                                                        t->u.user.name,
-                                                        t->u.user.revision),
-                                         "ipt_%s", t->u.user.name);
-        if (IS_ERR(target) || !target) {
+        target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
+                                        t->u.user.revision);
+        if (IS_ERR(target)) {
                 duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
                          t->u.user.name);
-                ret = target ? PTR_ERR(target) : -ENOENT;
+                ret = PTR_ERR(target);
                 goto release_matches;
         }
         t->u.kernel.target = target;
@@ -1590,14 +1542,16 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
         /* Clear counters and comefrom */
         memset(&e->counters, 0, sizeof(e->counters));
         e->comefrom = 0;
-
-        (*i)++;
         return 0;
 
 out:
         module_put(t->u.kernel.target->me);
 release_matches:
-        IPT_MATCH_ITERATE(e, compat_release_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                module_put(ematch->u.kernel.match->me);
+        }
         return ret;
 }
 
@@ -1606,11 +1560,12 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
                             unsigned int *size, const char *name,
                             struct xt_table_info *newinfo, unsigned char *base)
 {
-        struct ipt_entry_target *t;
+        struct xt_entry_target *t;
         struct xt_target *target;
         struct ipt_entry *de;
         unsigned int origsize;
         int ret, h;
+        struct xt_entry_match *ematch;
 
         ret = 0;
         origsize = *size;
@@ -1621,10 +1576,11 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
         *dstptr += sizeof(struct ipt_entry);
         *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
 
-        ret = COMPAT_IPT_MATCH_ITERATE(e, xt_compat_match_from_user,
-                                       dstptr, size);
-        if (ret)
-                return ret;
+        xt_ematch_foreach(ematch, e) {
+                ret = xt_compat_match_from_user(ematch, dstptr, size);
+                if (ret != 0)
+                        return ret;
+        }
         de->target_offset = e->target_offset - (origsize - *size);
         t = compat_ipt_get_target(e);
         target = t->u.kernel.target;
@@ -1641,36 +1597,43 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
 }
 
 static int
-compat_check_entry(struct ipt_entry *e, const char *name,
-                                     unsigned int *i)
+compat_check_entry(struct ipt_entry *e, struct net *net, const char *name)
 {
+        struct xt_entry_match *ematch;
         struct xt_mtchk_param mtpar;
         unsigned int j;
-        int ret;
+        int ret = 0;
 
         j = 0;
+        mtpar.net       = net;
         mtpar.table     = name;
         mtpar.entryinfo = &e->ip;
         mtpar.hook_mask = e->comefrom;
         mtpar.family    = NFPROTO_IPV4;
-        ret = IPT_MATCH_ITERATE(e, check_match, &mtpar, &j);
-        if (ret)
-                goto cleanup_matches;
+        xt_ematch_foreach(ematch, e) {
+                ret = check_match(ematch, &mtpar);
+                if (ret != 0)
+                        goto cleanup_matches;
+                ++j;
+        }
 
-        ret = check_target(e, name);
+        ret = check_target(e, net, name);
         if (ret)
                 goto cleanup_matches;
-
-        (*i)++;
         return 0;
 
  cleanup_matches:
-        IPT_MATCH_ITERATE(e, cleanup_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                cleanup_match(ematch, net);
+        }
         return ret;
 }
 
 static int
-translate_compat_table(const char *name,
+translate_compat_table(struct net *net,
+                       const char *name,
                        unsigned int valid_hooks,
                        struct xt_table_info **pinfo,
                        void **pentry0,
@@ -1682,6 +1645,8 @@ translate_compat_table(const char *name,
         unsigned int i, j;
         struct xt_table_info *newinfo, *info;
         void *pos, *entry0, *entry1;
+        struct compat_ipt_entry *iter0;
+        struct ipt_entry *iter1;
         unsigned int size;
         int ret;
 
@@ -1700,13 +1665,17 @@ translate_compat_table(const char *name,
         j = 0;
         xt_compat_lock(AF_INET);
         /* Walk through entries, checking offsets. */
-        ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
-                                       check_compat_entry_size_and_hooks,
-                                       info, &size, entry0,
-                                       entry0 + total_size,
-                                       hook_entries, underflows, &j, name);
-        if (ret != 0)
-                goto out_unlock;
+        xt_entry_foreach(iter0, entry0, total_size) {
+                ret = check_compat_entry_size_and_hooks(iter0, info, &size,
+                                                        entry0,
+                                                        entry0 + total_size,
+                                                        hook_entries,
+                                                        underflows,
+                                                        name);
+                if (ret != 0)
+                        goto out_unlock;
+                ++j;
+        }
 
         ret = -EINVAL;
         if (j != number) {
@@ -1745,9 +1714,12 @@ translate_compat_table(const char *name,
         entry1 = newinfo->entries[raw_smp_processor_id()];
         pos = entry1;
         size = total_size;
-        ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
-                                       compat_copy_entry_from_user,
-                                       &pos, &size, name, newinfo, entry1);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                ret = compat_copy_entry_from_user(iter0, &pos, &size,
+                                                  name, newinfo, entry1);
+                if (ret != 0)
+                        break;
+        }
         xt_compat_flush_offsets(AF_INET);
         xt_compat_unlock(AF_INET);
         if (ret)
@@ -1758,13 +1730,35 @@ translate_compat_table(const char *name,
                 goto free_newinfo;
 
         i = 0;
-        ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
-                                name, &i);
+        xt_entry_foreach(iter1, entry1, newinfo->size) {
+                ret = compat_check_entry(iter1, net, name);
+                if (ret != 0)
+                        break;
+                ++i;
+                if (strcmp(ipt_get_target(iter1)->u.user.name,
+                    XT_ERROR_TARGET) == 0)
+                        ++newinfo->stacksize;
+        }
         if (ret) {
+                /*
+                 * The first i matches need cleanup_entry (calls ->destroy)
+                 * because they had called ->check already. The other j-i
+                 * entries need only release.
+                 */
+                int skip = i;
                 j -= i;
-                COMPAT_IPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
-                                                  compat_release_entry, &j);
-                IPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
+                xt_entry_foreach(iter0, entry0, newinfo->size) {
+                        if (skip-- > 0)
+                                continue;
+                        if (j-- == 0)
+                                break;
+                        compat_release_entry(iter0);
+                }
+                xt_entry_foreach(iter1, entry1, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter1, net);
+                }
                 xt_free_table_info(newinfo);
                 return ret;
         }
@@ -1782,7 +1776,11 @@ translate_compat_table(const char *name,
 free_newinfo:
         xt_free_table_info(newinfo);
 out:
-        COMPAT_IPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                if (j-- == 0)
+                        break;
+                compat_release_entry(iter0);
+        }
         return ret;
 out_unlock:
         xt_compat_flush_offsets(AF_INET);
@@ -1797,6 +1795,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
         struct compat_ipt_replace tmp;
         struct xt_table_info *newinfo;
         void *loc_cpu_entry;
+        struct ipt_entry *iter;
 
         if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                 return -EFAULT;
@@ -1819,7 +1818,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                 goto free_newinfo;
         }
 
-        ret = translate_compat_table(tmp.name, tmp.valid_hooks,
+        ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
                                      &newinfo, &loc_cpu_entry, tmp.size,
                                      tmp.num_entries, tmp.hook_entry,
                                      tmp.underflow);
@@ -1835,7 +1834,8 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
         return 0;
 
  free_newinfo_untrans:
-        IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter, net);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
@@ -1868,7 +1868,7 @@ compat_do_ipt_set_ctl(struct sock *sk,	int cmd, void __user *user,
 }
 
 struct compat_ipt_get_entries {
-        char name[IPT_TABLE_MAXNAMELEN];
+        char name[XT_TABLE_MAXNAMELEN];
         compat_uint_t size;
         struct compat_ipt_entry entrytable[0];
 };
@@ -1884,6 +1884,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
         int ret = 0;
         const void *loc_cpu_entry;
         unsigned int i = 0;
+        struct ipt_entry *iter;
 
         counters = alloc_counters(table);
         if (IS_ERR(counters))
@@ -1896,9 +1897,12 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
         pos = userptr;
         size = total_size;
-        ret = IPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
-                                compat_copy_entry_to_user,
-                                &pos, &size, counters, &i);
+        xt_entry_foreach(iter, loc_cpu_entry, total_size) {
+                ret = compat_copy_entry_to_user(iter, &pos,
+                                                &size, counters, i++);
+                if (ret != 0)
+                        break;
+        }
 
         vfree(counters);
         return ret;
@@ -2019,7 +2023,7 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 
         case IPT_SO_GET_REVISION_MATCH:
         case IPT_SO_GET_REVISION_TARGET: {
-                struct ipt_get_revision rev;
+                struct xt_get_revision rev;
                 int target;
 
                 if (*len != sizeof(rev)) {
@@ -2051,13 +2055,13 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         return ret;
 }
 
-struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
+struct xt_table *ipt_register_table(struct net *net,
+                                    const struct xt_table *table,
                                     const struct ipt_replace *repl)
 {
         int ret;
         struct xt_table_info *newinfo;
-        struct xt_table_info bootstrap
-                = { 0, 0, 0, { 0 }, { 0 }, { } };
+        struct xt_table_info bootstrap = {0};
         void *loc_cpu_entry;
         struct xt_table *new_table;
 
@@ -2071,11 +2075,7 @@ struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
         memcpy(loc_cpu_entry, repl->entries, repl->size);
 
-        ret = translate_table(table->name, table->valid_hooks,
-                              newinfo, loc_cpu_entry, repl->size,
-                              repl->num_entries,
-                              repl->hook_entry,
-                              repl->underflow);
+        ret = translate_table(net, newinfo, loc_cpu_entry, repl);
         if (ret != 0)
                 goto out_free;
 
@@ -2093,17 +2093,19 @@ out:
         return ERR_PTR(ret);
 }
 
-void ipt_unregister_table(struct xt_table *table)
+void ipt_unregister_table(struct net *net, struct xt_table *table)
 {
         struct xt_table_info *private;
         void *loc_cpu_entry;
         struct module *table_owner = table->me;
+        struct ipt_entry *iter;
 
         private = xt_unregister_table(table);
 
         /* Decrease module usage counts and free resources */
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
-        IPT_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size)
+                cleanup_entry(iter, net);
         if (private->number > private->initial_entries)
                 module_put(table_owner);
         xt_free_table_info(private);
@@ -2121,7 +2123,7 @@ icmp_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
 }
 
 static bool
-icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
+icmp_match(const struct sk_buff *skb, struct xt_action_param *par)
 {
         const struct icmphdr *ic;
         struct icmphdr _icmph;
@@ -2137,7 +2139,7 @@ icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
                  * can't.  Hence, no choice but to drop.
                  */
                 duprintf("Dropping evil ICMP tinygram.\n");
-                *par->hotdrop = true;
+                par->hotdrop = true;
                 return false;
         }
 
@@ -2148,31 +2150,31 @@ icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
                                     !!(icmpinfo->invflags&IPT_ICMP_INV));
 }
 
-static bool icmp_checkentry(const struct xt_mtchk_param *par)
+static int icmp_checkentry(const struct xt_mtchk_param *par)
 {
         const struct ipt_icmp *icmpinfo = par->matchinfo;
 
         /* Must specify no unknown invflags */
-        return !(icmpinfo->invflags & ~IPT_ICMP_INV);
+        return (icmpinfo->invflags & ~IPT_ICMP_INV) ? -EINVAL : 0;
 }
 
-/* The built-in targets: standard (NULL) and error. */
-static struct xt_target ipt_standard_target __read_mostly = {
-        .name           = IPT_STANDARD_TARGET,
-        .targetsize     = sizeof(int),
-        .family         = NFPROTO_IPV4,
+static struct xt_target ipt_builtin_tg[] __read_mostly = {
+        {
+                .name             = XT_STANDARD_TARGET,
+                .targetsize       = sizeof(int),
+                .family           = NFPROTO_IPV4,
 #ifdef CONFIG_COMPAT
-        .compatsize     = sizeof(compat_int_t),
-        .compat_from_user = compat_standard_from_user,
-        .compat_to_user = compat_standard_to_user,
+                .compatsize       = sizeof(compat_int_t),
+                .compat_from_user = compat_standard_from_user,
+                .compat_to_user   = compat_standard_to_user,
 #endif
-};
-
-static struct xt_target ipt_error_target __read_mostly = {
-        .name           = IPT_ERROR_TARGET,
-        .target         = ipt_error,
-        .targetsize     = IPT_FUNCTION_MAXNAMELEN,
-        .family         = NFPROTO_IPV4,
+        },
+        {
+                .name             = XT_ERROR_TARGET,
+                .target           = ipt_error,
+                .targetsize       = XT_FUNCTION_MAXNAMELEN,
+                .family           = NFPROTO_IPV4,
+        },
 };
 
 static struct nf_sockopt_ops ipt_sockopts = {
@@ -2192,13 +2194,15 @@ static struct nf_sockopt_ops ipt_sockopts = {
         .owner          = THIS_MODULE,
 };
 
-static struct xt_match icmp_matchstruct __read_mostly = {
-        .name           = "icmp",
-        .match          = icmp_match,
-        .matchsize      = sizeof(struct ipt_icmp),
-        .checkentry     = icmp_checkentry,
-        .proto          = IPPROTO_ICMP,
-        .family         = NFPROTO_IPV4,
+static struct xt_match ipt_builtin_mt[] __read_mostly = {
+        {
+                .name       = "icmp",
+                .match      = icmp_match,
+                .matchsize  = sizeof(struct ipt_icmp),
+                .checkentry = icmp_checkentry,
+                .proto      = IPPROTO_ICMP,
+                .family     = NFPROTO_IPV4,
+        },
 };
 
 static int __net_init ip_tables_net_init(struct net *net)
@@ -2225,13 +2229,10 @@ static int __init ip_tables_init(void)
                 goto err1;
 
         /* Noone else will be downing sem now, so we won't sleep */
-        ret = xt_register_target(&ipt_standard_target);
+        ret = xt_register_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
         if (ret < 0)
                 goto err2;
-        ret = xt_register_target(&ipt_error_target);
-        if (ret < 0)
-                goto err3;
-        ret = xt_register_match(&icmp_matchstruct);
+        ret = xt_register_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
         if (ret < 0)
                 goto err4;
 
@@ -2240,15 +2241,13 @@ static int __init ip_tables_init(void)
         if (ret < 0)
                 goto err5;
 
-        printk(KERN_INFO "ip_tables: (C) 2000-2006 Netfilter Core Team\n");
+        pr_info("(C) 2000-2006 Netfilter Core Team\n");
         return 0;
 
 err5:
-        xt_unregister_match(&icmp_matchstruct);
+        xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
 err4:
-        xt_unregister_target(&ipt_error_target);
-err3:
-        xt_unregister_target(&ipt_standard_target);
+        xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
 err2:
         unregister_pernet_subsys(&ip_tables_net_ops);
 err1:
@@ -2259,10 +2258,8 @@ static void __exit ip_tables_fini(void)
 {
         nf_unregister_sockopt(&ipt_sockopts);
 
-        xt_unregister_match(&icmp_matchstruct);
-        xt_unregister_target(&ipt_error_target);
-        xt_unregister_target(&ipt_standard_target);
-
+        xt_unregister_matches(ipt_builtin_mt, ARRAY_SIZE(ipt_builtin_mt));
+        xt_unregister_targets(ipt_builtin_tg, ARRAY_SIZE(ipt_builtin_tg));
         unregister_pernet_subsys(&ip_tables_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 2e4f98b85524..1e26a4897655 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -9,11 +9,13 @@
  * published by the Free Software Foundation.
  *
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
 #include <linux/proc_fs.h>
 #include <linux/jhash.h>
 #include <linux/bitops.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/ip.h>
 #include <linux/tcp.h>
 #include <linux/udp.h>
@@ -27,6 +29,7 @@
 #include <net/netfilter/nf_conntrack.h>
 #include <net/net_namespace.h>
 #include <net/checksum.h>
+#include <net/ip.h>
 
 #define CLUSTERIP_VERSION "0.8"
 
@@ -51,12 +54,13 @@ struct clusterip_config {
 #endif
         enum clusterip_hashmode hash_mode;      /* which hashing mode */
         u_int32_t hash_initval;                 /* hash initialization */
+        struct rcu_head rcu;
 };
 
 static LIST_HEAD(clusterip_configs);
 
 /* clusterip_lock protects the clusterip_configs list */
-static DEFINE_RWLOCK(clusterip_lock);
+static DEFINE_SPINLOCK(clusterip_lock);
 
 #ifdef CONFIG_PROC_FS
 static const struct file_operations clusterip_proc_fops;
@@ -69,11 +73,17 @@ clusterip_config_get(struct clusterip_config *c)
         atomic_inc(&c->refcount);
 }
 
+
+static void clusterip_config_rcu_free(struct rcu_head *head)
+{
+        kfree(container_of(head, struct clusterip_config, rcu));
+}
+
 static inline void
 clusterip_config_put(struct clusterip_config *c)
 {
         if (atomic_dec_and_test(&c->refcount))
-                kfree(c);
+                call_rcu_bh(&c->rcu, clusterip_config_rcu_free);
 }
 
 /* decrease the count of entries using/referencing this config.  If last
@@ -82,12 +92,13 @@ clusterip_config_put(struct clusterip_config *c)
 static inline void
 clusterip_config_entry_put(struct clusterip_config *c)
 {
-        write_lock_bh(&clusterip_lock);
-        if (atomic_dec_and_test(&c->entries)) {
-                list_del(&c->list);
-                write_unlock_bh(&clusterip_lock);
+        local_bh_disable();
+        if (atomic_dec_and_lock(&c->entries, &clusterip_lock)) {
+                list_del_rcu(&c->list);
+                spin_unlock(&clusterip_lock);
+                local_bh_enable();
 
-                dev_mc_delete(c->dev, c->clustermac, ETH_ALEN, 0);
+                dev_mc_del(c->dev, c->clustermac);
                 dev_put(c->dev);
 
                 /* In case anyone still accesses the file, the open/close
@@ -98,7 +109,7 @@ clusterip_config_entry_put(struct clusterip_config *c)
 #endif
                 return;
         }
-        write_unlock_bh(&clusterip_lock);
+        local_bh_enable();
 }
 
 static struct clusterip_config *
@@ -106,7 +117,7 @@ __clusterip_config_find(__be32 clusterip)
 {
         struct clusterip_config *c;
 
-        list_for_each_entry(c, &clusterip_configs, list) {
+        list_for_each_entry_rcu(c, &clusterip_configs, list) {
                 if (c->clusterip == clusterip)
                         return c;
         }
@@ -119,16 +130,15 @@ clusterip_config_find_get(__be32 clusterip, int entry)
 {
         struct clusterip_config *c;
 
-        read_lock_bh(&clusterip_lock);
+        rcu_read_lock_bh();
         c = __clusterip_config_find(clusterip);
-        if (!c) {
-                read_unlock_bh(&clusterip_lock);
-                return NULL;
+        if (c) {
+                if (unlikely(!atomic_inc_not_zero(&c->refcount)))
+                        c = NULL;
+                else if (entry)
+                        atomic_inc(&c->entries);
         }
-        atomic_inc(&c->refcount);
-        if (entry)
-                atomic_inc(&c->entries);
-        read_unlock_bh(&clusterip_lock);
+        rcu_read_unlock_bh();
 
         return c;
 }
@@ -179,9 +189,9 @@ clusterip_config_init(const struct ipt_clusterip_tgt_info *i, __be32 ip,
         }
 #endif
 
-        write_lock_bh(&clusterip_lock);
-        list_add(&c->list, &clusterip_configs);
-        write_unlock_bh(&clusterip_lock);
+        spin_lock_bh(&clusterip_lock);
+        list_add_rcu(&c->list, &clusterip_configs);
+        spin_unlock_bh(&clusterip_lock);
 
         return c;
 }
@@ -222,25 +232,22 @@ clusterip_hashfn(const struct sk_buff *skb,
 {
         const struct iphdr *iph = ip_hdr(skb);
         unsigned long hashval;
-        u_int16_t sport, dport;
-        const u_int16_t *ports;
-
-        switch (iph->protocol) {
-        case IPPROTO_TCP:
-        case IPPROTO_UDP:
-        case IPPROTO_UDPLITE:
-        case IPPROTO_SCTP:
-        case IPPROTO_DCCP:
-        case IPPROTO_ICMP:
-                ports = (const void *)iph+iph->ihl*4;
-                sport = ports[0];
-                dport = ports[1];
-                break;
-        default:
+        u_int16_t sport = 0, dport = 0;
+        int poff;
+
+        poff = proto_ports_offset(iph->protocol);
+        if (poff >= 0) {
+                const u_int16_t *ports;
+                u16 _ports[2];
+
+                ports = skb_header_pointer(skb, iph->ihl * 4 + poff, 4, _ports);
+                if (ports) {
+                        sport = ports[0];
+                        dport = ports[1];
+                }
+        } else {
                 if (net_ratelimit())
-                        printk(KERN_NOTICE "CLUSTERIP: unknown protocol `%u'\n",
-                                iph->protocol);
-                sport = dport = 0;
+                        pr_info("unknown protocol %u\n", iph->protocol);
         }
 
         switch (config->hash_mode) {
@@ -261,7 +268,7 @@ clusterip_hashfn(const struct sk_buff *skb,
                 hashval = 0;
                 /* This cannot happen, unless the check function wasn't called
                  * at rule load time */
-                printk("CLUSTERIP: unknown mode `%u'\n", config->hash_mode);
+                pr_info("unknown mode %u\n", config->hash_mode);
                 BUG();
                 break;
         }
@@ -281,7 +288,7 @@ clusterip_responsible(const struct clusterip_config *config, u_int32_t hash)
  ***********************************************************************/
 
 static unsigned int
-clusterip_tg(struct sk_buff *skb, const struct xt_target_param *par)
+clusterip_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
         struct nf_conn *ct;
@@ -294,7 +301,7 @@ clusterip_tg(struct sk_buff *skb, const struct xt_target_param *par)
 
         ct = nf_ct_get(skb, &ctinfo);
         if (ct == NULL) {
-                printk(KERN_ERR "CLUSTERIP: no conntrack!\n");
+                pr_info("no conntrack!\n");
                         /* FIXME: need to drop invalid ones, since replies
                          * to outgoing connections of other nodes will be
                          * marked as INVALID */
@@ -303,9 +310,9 @@ clusterip_tg(struct sk_buff *skb, const struct xt_target_param *par)
 
         /* special case: ICMP error handling. conntrack distinguishes between
          * error messages (RELATED) and information requests (see below) */
-        if (ip_hdr(skb)->protocol == IPPROTO_ICMP
-            && (ctinfo == IP_CT_RELATED
-                || ctinfo == IP_CT_RELATED+IP_CT_IS_REPLY))
+        if (ip_hdr(skb)->protocol == IPPROTO_ICMP &&
+            (ctinfo == IP_CT_RELATED ||
+             ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY))
                 return XT_CONTINUE;
 
         /* ip_conntrack_icmp guarantees us that we only have ICMP_ECHO,
@@ -347,25 +354,24 @@ clusterip_tg(struct sk_buff *skb, const struct xt_target_param *par)
         return XT_CONTINUE;
 }
 
-static bool clusterip_tg_check(const struct xt_tgchk_param *par)
+static int clusterip_tg_check(const struct xt_tgchk_param *par)
 {
         struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
         const struct ipt_entry *e = par->entryinfo;
-
         struct clusterip_config *config;
+        int ret;
 
         if (cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP &&
             cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT &&
             cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT_DPT) {
-                printk(KERN_WARNING "CLUSTERIP: unknown mode `%u'\n",
-                        cipinfo->hash_mode);
-                return false;
+                pr_info("unknown mode %u\n", cipinfo->hash_mode);
+                return -EINVAL;
 
         }
-        if (e->ip.dmsk.s_addr != htonl(0xffffffff)
-            || e->ip.dst.s_addr == 0) {
-                printk(KERN_ERR "CLUSTERIP: Please specify destination IP\n");
-                return false;
+        if (e->ip.dmsk.s_addr != htonl(0xffffffff) ||
+            e->ip.dst.s_addr == 0) {
+                pr_info("Please specify destination IP\n");
+                return -EINVAL;
         }
 
         /* FIXME: further sanity checks */
@@ -373,41 +379,41 @@ static bool clusterip_tg_check(const struct xt_tgchk_param *par)
         config = clusterip_config_find_get(e->ip.dst.s_addr, 1);
         if (!config) {
                 if (!(cipinfo->flags & CLUSTERIP_FLAG_NEW)) {
-                        printk(KERN_WARNING "CLUSTERIP: no config found for %pI4, need 'new'\n", &e->ip.dst.s_addr);
-                        return false;
+                        pr_info("no config found for %pI4, need 'new'\n",
+                                &e->ip.dst.s_addr);
+                        return -EINVAL;
                 } else {
                         struct net_device *dev;
 
                         if (e->ip.iniface[0] == '\0') {
-                                printk(KERN_WARNING "CLUSTERIP: Please specify an interface name\n");
-                                return false;
+                                pr_info("Please specify an interface name\n");
+                                return -EINVAL;
                         }
 
                         dev = dev_get_by_name(&init_net, e->ip.iniface);
                         if (!dev) {
-                                printk(KERN_WARNING "CLUSTERIP: no such interface %s\n", e->ip.iniface);
-                                return false;
+                                pr_info("no such interface %s\n",
+                                        e->ip.iniface);
+                                return -ENOENT;
                         }
 
                         config = clusterip_config_init(cipinfo,
                                                         e->ip.dst.s_addr, dev);
                         if (!config) {
-                                printk(KERN_WARNING "CLUSTERIP: cannot allocate config\n");
+                                pr_info("cannot allocate config\n");
                                 dev_put(dev);
-                                return false;
+                                return -ENOMEM;
                         }
-                        dev_mc_add(config->dev,config->clustermac, ETH_ALEN, 0);
+                        dev_mc_add(config->dev, config->clustermac);
                 }
         }
         cipinfo->config = config;
 
-        if (nf_ct_l3proto_try_module_get(par->target->family) < 0) {
-                printk(KERN_WARNING "can't load conntrack support for "
-                                    "proto=%u\n", par->target->family);
-                return false;
-        }
-
-        return true;
+        ret = nf_ct_l3proto_try_module_get(par->family);
+        if (ret < 0)
+                pr_info("cannot load conntrack support for proto=%u\n",
+                        par->family);
+        return ret;
 }
 
 /* drop reference count of cluster config when rule is deleted */
@@ -421,7 +427,7 @@ static void clusterip_tg_destroy(const struct xt_tgdtor_param *par)
 
         clusterip_config_put(cipinfo->config);
 
-        nf_ct_l3proto_module_put(par->target->family);
+        nf_ct_l3proto_module_put(par->family);
 }
 
 #ifdef CONFIG_COMPAT
@@ -462,7 +468,7 @@ struct arp_payload {
         __be32 src_ip;
         u_int8_t dst_hw[ETH_ALEN];
         __be32 dst_ip;
-} __attribute__ ((packed));
+} __packed;
 
 #ifdef DEBUG
 static void arp_print(struct arp_payload *payload)
@@ -478,8 +484,8 @@ static void arp_print(struct arp_payload *payload)
         }
         hbuffer[--k]='\0';
 
-        printk("src %pI4@%s, dst %pI4\n",
-                &payload->src_ip, hbuffer, &payload->dst_ip);
+        pr_debug("src %pI4@%s, dst %pI4\n",
+                 &payload->src_ip, hbuffer, &payload->dst_ip);
 }
 #endif
 
@@ -495,14 +501,14 @@ arp_mangle(unsigned int hook,
         struct clusterip_config *c;
 
         /* we don't care about non-ethernet and non-ipv4 ARP */
-        if (arp->ar_hrd != htons(ARPHRD_ETHER)
-            || arp->ar_pro != htons(ETH_P_IP)
-            || arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
+        if (arp->ar_hrd != htons(ARPHRD_ETHER) ||
+            arp->ar_pro != htons(ETH_P_IP) ||
+            arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
                 return NF_ACCEPT;
 
         /* we only want to mangle arp requests and replies */
-        if (arp->ar_op != htons(ARPOP_REPLY)
-            && arp->ar_op != htons(ARPOP_REQUEST))
+        if (arp->ar_op != htons(ARPOP_REPLY) &&
+            arp->ar_op != htons(ARPOP_REQUEST))
                 return NF_ACCEPT;
 
         payload = (void *)(arp+1);
@@ -518,7 +524,7 @@ arp_mangle(unsigned int hook,
          * this wouldn't work, since we didn't subscribe the mcast group on
          * other interfaces */
         if (c->dev != out) {
-                pr_debug("CLUSTERIP: not mangling arp reply on different "
+                pr_debug("not mangling arp reply on different "
                          "interface: cip'%s'-skb'%s'\n",
                          c->dev->name, out->name);
                 clusterip_config_put(c);
@@ -529,7 +535,7 @@ arp_mangle(unsigned int hook,
         memcpy(payload->src_hw, c->clustermac, arp->ar_hln);
 
 #ifdef DEBUG
-        pr_debug(KERN_DEBUG "CLUSTERIP mangled arp reply: ");
+        pr_debug("mangled arp reply: ");
         arp_print(payload);
 #endif
 
@@ -560,8 +566,7 @@ struct clusterip_seq_position {
 
 static void *clusterip_seq_start(struct seq_file *s, loff_t *pos)
 {
-        const struct proc_dir_entry *pde = s->private;
-        struct clusterip_config *c = pde->data;
+        struct clusterip_config *c = s->private;
         unsigned int weight;
         u_int32_t local_nodes;
         struct clusterip_seq_position *idx;
@@ -601,7 +606,8 @@ static void *clusterip_seq_next(struct seq_file *s, void *v, loff_t *pos)
 
 static void clusterip_seq_stop(struct seq_file *s, void *v)
 {
-        kfree(v);
+        if (!IS_ERR(v))
+                kfree(v);
 }
 
 static int clusterip_seq_show(struct seq_file *s, void *v)
@@ -632,10 +638,9 @@ static int clusterip_proc_open(struct inode *inode, struct file *file)
 
         if (!ret) {
                 struct seq_file *sf = file->private_data;
-                struct proc_dir_entry *pde = PDE(inode);
-                struct clusterip_config *c = pde->data;
+                struct clusterip_config *c = PDE(inode)->data;
 
-                sf->private = pde;
+                sf->private = c;
 
                 clusterip_config_get(c);
         }
@@ -645,8 +650,7 @@ static int clusterip_proc_open(struct inode *inode, struct file *file)
 
 static int clusterip_proc_release(struct inode *inode, struct file *file)
 {
-        struct proc_dir_entry *pde = PDE(inode);
-        struct clusterip_config *c = pde->data;
+        struct clusterip_config *c = PDE(inode)->data;
         int ret;
 
         ret = seq_release(inode, file);
@@ -660,10 +664,9 @@ static int clusterip_proc_release(struct inode *inode, struct file *file)
 static ssize_t clusterip_proc_write(struct file *file, const char __user *input,
                                 size_t size, loff_t *ofs)
 {
+        struct clusterip_config *c = PDE(file->f_path.dentry->d_inode)->data;
 #define PROC_WRITELEN   10
         char buffer[PROC_WRITELEN+1];
-        const struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
-        struct clusterip_config *c = pde->data;
         unsigned long nodenum;
 
         if (copy_from_user(buffer, input, PROC_WRITELEN))
@@ -709,13 +712,13 @@ static int __init clusterip_tg_init(void)
 #ifdef CONFIG_PROC_FS
         clusterip_procdir = proc_mkdir("ipt_CLUSTERIP", init_net.proc_net);
         if (!clusterip_procdir) {
-                printk(KERN_ERR "CLUSTERIP: Unable to proc dir entry\n");
+                pr_err("Unable to proc dir entry\n");
                 ret = -ENOMEM;
                 goto cleanup_hook;
         }
 #endif /* CONFIG_PROC_FS */
 
-        printk(KERN_NOTICE "ClusterIP Version %s loaded successfully\n",
+        pr_info("ClusterIP Version %s loaded successfully\n",
                 CLUSTERIP_VERSION);
         return 0;
 
@@ -730,13 +733,15 @@ cleanup_target:
 
 static void __exit clusterip_tg_exit(void)
 {
-        printk(KERN_NOTICE "ClusterIP Version %s unloading\n",
-                CLUSTERIP_VERSION);
+        pr_info("ClusterIP Version %s unloading\n", CLUSTERIP_VERSION);
 #ifdef CONFIG_PROC_FS
         remove_proc_entry(clusterip_procdir->name, clusterip_procdir->parent);
 #endif
         nf_unregister_hook(&cip_arp_ops);
         xt_unregister_target(&clusterip_tg_reg);
+
+        /* Wait for completion of call_rcu_bh()'s (clusterip_config_rcu_free) */
+        rcu_barrier_bh();
 }
 
 module_init(clusterip_tg_init);
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index f7e2fa0974dc..4bf3dc49ad1e 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -6,7 +6,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
 */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/in.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
@@ -50,7 +50,7 @@ set_ect_tcp(struct sk_buff *skb, const struct ipt_ECN_info *einfo)
         struct tcphdr _tcph, *tcph;
         __be16 oldval;
 
-        /* Not enought header? */
+        /* Not enough header? */
         tcph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_tcph), &_tcph);
         if (!tcph)
                 return false;
@@ -77,7 +77,7 @@ set_ect_tcp(struct sk_buff *skb, const struct ipt_ECN_info *einfo)
 }
 
 static unsigned int
-ecn_tg(struct sk_buff *skb, const struct xt_target_param *par)
+ecn_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct ipt_ECN_info *einfo = par->targinfo;
 
@@ -85,36 +85,33 @@ ecn_tg(struct sk_buff *skb, const struct xt_target_param *par)
                 if (!set_ect_ip(skb, einfo))
                         return NF_DROP;
 
-        if (einfo->operation & (IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR)
-            && ip_hdr(skb)->protocol == IPPROTO_TCP)
+        if (einfo->operation & (IPT_ECN_OP_SET_ECE | IPT_ECN_OP_SET_CWR) &&
+            ip_hdr(skb)->protocol == IPPROTO_TCP)
                 if (!set_ect_tcp(skb, einfo))
                         return NF_DROP;
 
         return XT_CONTINUE;
 }
 
-static bool ecn_tg_check(const struct xt_tgchk_param *par)
+static int ecn_tg_check(const struct xt_tgchk_param *par)
 {
         const struct ipt_ECN_info *einfo = par->targinfo;
         const struct ipt_entry *e = par->entryinfo;
 
         if (einfo->operation & IPT_ECN_OP_MASK) {
-                printk(KERN_WARNING "ECN: unsupported ECN operation %x\n",
-                        einfo->operation);
-                return false;
+                pr_info("unsupported ECN operation %x\n", einfo->operation);
+                return -EINVAL;
         }
         if (einfo->ip_ect & ~IPT_ECN_IP_MASK) {
-                printk(KERN_WARNING "ECN: new ECT codepoint %x out of mask\n",
-                        einfo->ip_ect);
-                return false;
+                pr_info("new ECT codepoint %x out of mask\n", einfo->ip_ect);
+                return -EINVAL;
         }
-        if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR))
-            && (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & XT_INV_PROTO))) {
-                printk(KERN_WARNING "ECN: cannot use TCP operations on a "
-                       "non-tcp rule\n");
-                return false;
+        if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR)) &&
+            (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & XT_INV_PROTO))) {
+                pr_info("cannot use TCP operations on a non-tcp rule\n");
+                return -EINVAL;
         }
-        return true;
+        return 0;
 }
 
 static struct xt_target ecn_tg_reg __read_mostly = {
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index acc44c69eb68..72ffc8fda2e9 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -9,10 +9,11 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
 #include <linux/spinlock.h>
 #include <linux/skbuff.h>
+#include <linux/if_arp.h>
 #include <linux/ip.h>
 #include <net/icmp.h>
 #include <net/udp.h>
@@ -23,16 +24,15 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ipt_LOG.h>
 #include <net/netfilter/nf_log.h>
+#include <net/netfilter/xt_log.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("Xtables: IPv4 packet logging to syslog");
 
-/* Use lock to serialize, so printks don't overlap */
-static DEFINE_SPINLOCK(log_lock);
-
 /* One level of recursion won't kill us */
-static void dump_packet(const struct nf_loginfo *info,
+static void dump_packet(struct sbuff *m,
+                        const struct nf_loginfo *info,
                         const struct sk_buff *skb,
                         unsigned int iphoff)
 {
@@ -47,35 +47,35 @@ static void dump_packet(const struct nf_loginfo *info,
 
         ih = skb_header_pointer(skb, iphoff, sizeof(_iph), &_iph);
         if (ih == NULL) {
-                printk("TRUNCATED");
+                sb_add(m, "TRUNCATED");
                 return;
         }
 
         /* Important fields:
          * TOS, len, DF/MF, fragment offset, TTL, src, dst, options. */
         /* Max length: 40 "SRC=255.255.255.255 DST=255.255.255.255 " */
-        printk("SRC=%pI4 DST=%pI4 ",
+        sb_add(m, "SRC=%pI4 DST=%pI4 ",
                &ih->saddr, &ih->daddr);
 
         /* Max length: 46 "LEN=65535 TOS=0xFF PREC=0xFF TTL=255 ID=65535 " */
-        printk("LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
+        sb_add(m, "LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
                ntohs(ih->tot_len), ih->tos & IPTOS_TOS_MASK,
                ih->tos & IPTOS_PREC_MASK, ih->ttl, ntohs(ih->id));
 
         /* Max length: 6 "CE DF MF " */
         if (ntohs(ih->frag_off) & IP_CE)
-                printk("CE ");
+                sb_add(m, "CE ");
         if (ntohs(ih->frag_off) & IP_DF)
-                printk("DF ");
+                sb_add(m, "DF ");
         if (ntohs(ih->frag_off) & IP_MF)
-                printk("MF ");
+                sb_add(m, "MF ");
 
         /* Max length: 11 "FRAG:65535 " */
         if (ntohs(ih->frag_off) & IP_OFFSET)
-                printk("FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
+                sb_add(m, "FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
 
-        if ((logflags & IPT_LOG_IPOPT)
-            && ih->ihl * 4 > sizeof(struct iphdr)) {
+        if ((logflags & IPT_LOG_IPOPT) &&
+            ih->ihl * 4 > sizeof(struct iphdr)) {
                 const unsigned char *op;
                 unsigned char _opt[4 * 15 - sizeof(struct iphdr)];
                 unsigned int i, optsize;
@@ -84,15 +84,15 @@ static void dump_packet(const struct nf_loginfo *info,
                 op = skb_header_pointer(skb, iphoff+sizeof(_iph),
                                         optsize, _opt);
                 if (op == NULL) {
-                        printk("TRUNCATED");
+                        sb_add(m, "TRUNCATED");
                         return;
                 }
 
                 /* Max length: 127 "OPT (" 15*4*2chars ") " */
-                printk("OPT (");
+                sb_add(m, "OPT (");
                 for (i = 0; i < optsize; i++)
-                        printk("%02X", op[i]);
-                printk(") ");
+                        sb_add(m, "%02X", op[i]);
+                sb_add(m, ") ");
         }
 
         switch (ih->protocol) {
@@ -101,7 +101,7 @@ static void dump_packet(const struct nf_loginfo *info,
                 const struct tcphdr *th;
 
                 /* Max length: 10 "PROTO=TCP " */
-                printk("PROTO=TCP ");
+                sb_add(m, "PROTO=TCP ");
 
                 if (ntohs(ih->frag_off) & IP_OFFSET)
                         break;
@@ -110,44 +110,44 @@ static void dump_packet(const struct nf_loginfo *info,
                 th = skb_header_pointer(skb, iphoff + ih->ihl * 4,
                                         sizeof(_tcph), &_tcph);
                 if (th == NULL) {
-                        printk("INCOMPLETE [%u bytes] ",
+                        sb_add(m, "INCOMPLETE [%u bytes] ",
                                skb->len - iphoff - ih->ihl*4);
                         break;
                 }
 
                 /* Max length: 20 "SPT=65535 DPT=65535 " */
-                printk("SPT=%u DPT=%u ",
+                sb_add(m, "SPT=%u DPT=%u ",
                        ntohs(th->source), ntohs(th->dest));
                 /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
                 if (logflags & IPT_LOG_TCPSEQ)
-                        printk("SEQ=%u ACK=%u ",
+                        sb_add(m, "SEQ=%u ACK=%u ",
                                ntohl(th->seq), ntohl(th->ack_seq));
                 /* Max length: 13 "WINDOW=65535 " */
-                printk("WINDOW=%u ", ntohs(th->window));
+                sb_add(m, "WINDOW=%u ", ntohs(th->window));
                 /* Max length: 9 "RES=0x3F " */
-                printk("RES=0x%02x ", (u8)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));
+                sb_add(m, "RES=0x%02x ", (u8)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));
                 /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */
                 if (th->cwr)
-                        printk("CWR ");
+                        sb_add(m, "CWR ");
                 if (th->ece)
-                        printk("ECE ");
+                        sb_add(m, "ECE ");
                 if (th->urg)
-                        printk("URG ");
+                        sb_add(m, "URG ");
                 if (th->ack)
-                        printk("ACK ");
+                        sb_add(m, "ACK ");
                 if (th->psh)
-                        printk("PSH ");
+                        sb_add(m, "PSH ");
                 if (th->rst)
-                        printk("RST ");
+                        sb_add(m, "RST ");
                 if (th->syn)
-                        printk("SYN ");
+                        sb_add(m, "SYN ");
                 if (th->fin)
-                        printk("FIN ");
+                        sb_add(m, "FIN ");
                 /* Max length: 11 "URGP=65535 " */
-                printk("URGP=%u ", ntohs(th->urg_ptr));
+                sb_add(m, "URGP=%u ", ntohs(th->urg_ptr));
 
-                if ((logflags & IPT_LOG_TCPOPT)
-                    && th->doff * 4 > sizeof(struct tcphdr)) {
+                if ((logflags & IPT_LOG_TCPOPT) &&
+                    th->doff * 4 > sizeof(struct tcphdr)) {
                         unsigned char _opt[4 * 15 - sizeof(struct tcphdr)];
                         const unsigned char *op;
                         unsigned int i, optsize;
@@ -157,15 +157,15 @@ static void dump_packet(const struct nf_loginfo *info,
                                                 iphoff+ih->ihl*4+sizeof(_tcph),
                                                 optsize, _opt);
                         if (op == NULL) {
-                                printk("TRUNCATED");
+                                sb_add(m, "TRUNCATED");
                                 return;
                         }
 
                         /* Max length: 127 "OPT (" 15*4*2chars ") " */
-                        printk("OPT (");
+                        sb_add(m, "OPT (");
                         for (i = 0; i < optsize; i++)
-                                printk("%02X", op[i]);
-                        printk(") ");
+                                sb_add(m, "%02X", op[i]);
+                        sb_add(m, ") ");
                 }
                 break;
         }
@@ -176,9 +176,9 @@ static void dump_packet(const struct nf_loginfo *info,
 
                 if (ih->protocol == IPPROTO_UDP)
                         /* Max length: 10 "PROTO=UDP "     */
-                        printk("PROTO=UDP " );
+                        sb_add(m, "PROTO=UDP " );
                 else    /* Max length: 14 "PROTO=UDPLITE " */
-                        printk("PROTO=UDPLITE ");
+                        sb_add(m, "PROTO=UDPLITE ");
 
                 if (ntohs(ih->frag_off) & IP_OFFSET)
                         break;
@@ -187,13 +187,13 @@ static void dump_packet(const struct nf_loginfo *info,
                 uh = skb_header_pointer(skb, iphoff+ih->ihl*4,
                                         sizeof(_udph), &_udph);
                 if (uh == NULL) {
-                        printk("INCOMPLETE [%u bytes] ",
+                        sb_add(m, "INCOMPLETE [%u bytes] ",
                                skb->len - iphoff - ih->ihl*4);
                         break;
                 }
 
                 /* Max length: 20 "SPT=65535 DPT=65535 " */
-                printk("SPT=%u DPT=%u LEN=%u ",
+                sb_add(m, "SPT=%u DPT=%u LEN=%u ",
                        ntohs(uh->source), ntohs(uh->dest),
                        ntohs(uh->len));
                 break;
@@ -220,7 +220,7 @@ static void dump_packet(const struct nf_loginfo *info,
                             [ICMP_ADDRESSREPLY] = 12 };
 
                 /* Max length: 11 "PROTO=ICMP " */
-                printk("PROTO=ICMP ");
+                sb_add(m, "PROTO=ICMP ");
 
                 if (ntohs(ih->frag_off) & IP_OFFSET)
                         break;
@@ -229,19 +229,19 @@ static void dump_packet(const struct nf_loginfo *info,
                 ich = skb_header_pointer(skb, iphoff + ih->ihl * 4,
                                          sizeof(_icmph), &_icmph);
                 if (ich == NULL) {
-                        printk("INCOMPLETE [%u bytes] ",
+                        sb_add(m, "INCOMPLETE [%u bytes] ",
                                skb->len - iphoff - ih->ihl*4);
                         break;
                 }
 
                 /* Max length: 18 "TYPE=255 CODE=255 " */
-                printk("TYPE=%u CODE=%u ", ich->type, ich->code);
+                sb_add(m, "TYPE=%u CODE=%u ", ich->type, ich->code);
 
                 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
-                if (ich->type <= NR_ICMP_TYPES
-                    && required_len[ich->type]
-                    && skb->len-iphoff-ih->ihl*4 < required_len[ich->type]) {
-                        printk("INCOMPLETE [%u bytes] ",
+                if (ich->type <= NR_ICMP_TYPES &&
+                    required_len[ich->type] &&
+                    skb->len-iphoff-ih->ihl*4 < required_len[ich->type]) {
+                        sb_add(m, "INCOMPLETE [%u bytes] ",
                                skb->len - iphoff - ih->ihl*4);
                         break;
                 }
@@ -250,35 +250,35 @@ static void dump_packet(const struct nf_loginfo *info,
                 case ICMP_ECHOREPLY:
                 case ICMP_ECHO:
                         /* Max length: 19 "ID=65535 SEQ=65535 " */
-                        printk("ID=%u SEQ=%u ",
+                        sb_add(m, "ID=%u SEQ=%u ",
                                ntohs(ich->un.echo.id),
                                ntohs(ich->un.echo.sequence));
                         break;
 
                 case ICMP_PARAMETERPROB:
                         /* Max length: 14 "PARAMETER=255 " */
-                        printk("PARAMETER=%u ",
+                        sb_add(m, "PARAMETER=%u ",
                                ntohl(ich->un.gateway) >> 24);
                         break;
                 case ICMP_REDIRECT:
                         /* Max length: 24 "GATEWAY=255.255.255.255 " */
-                        printk("GATEWAY=%pI4 ", &ich->un.gateway);
+                        sb_add(m, "GATEWAY=%pI4 ", &ich->un.gateway);
                         /* Fall through */
                 case ICMP_DEST_UNREACH:
                 case ICMP_SOURCE_QUENCH:
                 case ICMP_TIME_EXCEEDED:
                         /* Max length: 3+maxlen */
                         if (!iphoff) { /* Only recurse once. */
-                                printk("[");
-                                dump_packet(info, skb,
+                                sb_add(m, "[");
+                                dump_packet(m, info, skb,
                                             iphoff + ih->ihl*4+sizeof(_icmph));
-                                printk("] ");
+                                sb_add(m, "] ");
                         }
 
                         /* Max length: 10 "MTU=65535 " */
-                        if (ich->type == ICMP_DEST_UNREACH
-                            && ich->code == ICMP_FRAG_NEEDED)
-                                printk("MTU=%u ", ntohs(ich->un.frag.mtu));
+                        if (ich->type == ICMP_DEST_UNREACH &&
+                            ich->code == ICMP_FRAG_NEEDED)
+                                sb_add(m, "MTU=%u ", ntohs(ich->un.frag.mtu));
                 }
                 break;
         }
@@ -291,19 +291,19 @@ static void dump_packet(const struct nf_loginfo *info,
                         break;
 
                 /* Max length: 9 "PROTO=AH " */
-                printk("PROTO=AH ");
+                sb_add(m, "PROTO=AH ");
 
                 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
                 ah = skb_header_pointer(skb, iphoff+ih->ihl*4,
                                         sizeof(_ahdr), &_ahdr);
                 if (ah == NULL) {
-                        printk("INCOMPLETE [%u bytes] ",
+                        sb_add(m, "INCOMPLETE [%u bytes] ",
                                skb->len - iphoff - ih->ihl*4);
                         break;
                 }
 
                 /* Length: 15 "SPI=0xF1234567 " */
-                printk("SPI=0x%x ", ntohl(ah->spi));
+                sb_add(m, "SPI=0x%x ", ntohl(ah->spi));
                 break;
         }
         case IPPROTO_ESP: {
@@ -311,7 +311,7 @@ static void dump_packet(const struct nf_loginfo *info,
                 const struct ip_esp_hdr *eh;
 
                 /* Max length: 10 "PROTO=ESP " */
-                printk("PROTO=ESP ");
+                sb_add(m, "PROTO=ESP ");
 
                 if (ntohs(ih->frag_off) & IP_OFFSET)
                         break;
@@ -320,25 +320,25 @@ static void dump_packet(const struct nf_loginfo *info,
                 eh = skb_header_pointer(skb, iphoff+ih->ihl*4,
                                         sizeof(_esph), &_esph);
                 if (eh == NULL) {
-                        printk("INCOMPLETE [%u bytes] ",
+                        sb_add(m, "INCOMPLETE [%u bytes] ",
                                skb->len - iphoff - ih->ihl*4);
                         break;
                 }
 
                 /* Length: 15 "SPI=0xF1234567 " */
-                printk("SPI=0x%x ", ntohl(eh->spi));
+                sb_add(m, "SPI=0x%x ", ntohl(eh->spi));
                 break;
         }
         /* Max length: 10 "PROTO 255 " */
         default:
-                printk("PROTO=%u ", ih->protocol);
+                sb_add(m, "PROTO=%u ", ih->protocol);
         }
 
         /* Max length: 15 "UID=4294967295 " */
         if ((logflags & IPT_LOG_UID) && !iphoff && skb->sk) {
                 read_lock_bh(&skb->sk->sk_callback_lock);
                 if (skb->sk->sk_socket && skb->sk->sk_socket->file)
-                        printk("UID=%u GID=%u ",
+                        sb_add(m, "UID=%u GID=%u ",
                                 skb->sk->sk_socket->file->f_cred->fsuid,
                                 skb->sk->sk_socket->file->f_cred->fsgid);
                 read_unlock_bh(&skb->sk->sk_callback_lock);
@@ -346,7 +346,7 @@ static void dump_packet(const struct nf_loginfo *info,
 
         /* Max length: 16 "MARK=0xFFFFFFFF " */
         if (!iphoff && skb->mark)
-                printk("MARK=0x%x ", skb->mark);
+                sb_add(m, "MARK=0x%x ", skb->mark);
 
         /* Proto    Max log string length */
         /* IP:      40+46+6+11+127 = 230 */
@@ -363,11 +363,48 @@ static void dump_packet(const struct nf_loginfo *info,
         /* maxlen = 230+   91  + 230 + 252 = 803 */
 }
 
+static void dump_mac_header(struct sbuff *m,
+                            const struct nf_loginfo *info,
+                            const struct sk_buff *skb)
+{
+        struct net_device *dev = skb->dev;
+        unsigned int logflags = 0;
+
+        if (info->type == NF_LOG_TYPE_LOG)
+                logflags = info->u.log.logflags;
+
+        if (!(logflags & IPT_LOG_MACDECODE))
+                goto fallback;
+
+        switch (dev->type) {
+        case ARPHRD_ETHER:
+                sb_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",
+                       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
+                       ntohs(eth_hdr(skb)->h_proto));
+                return;
+        default:
+                break;
+        }
+
+fallback:
+        sb_add(m, "MAC=");
+        if (dev->hard_header_len &&
+            skb->mac_header != skb->network_header) {
+                const unsigned char *p = skb_mac_header(skb);
+                unsigned int i;
+
+                sb_add(m, "%02x", *p++);
+                for (i = 1; i < dev->hard_header_len; i++, p++)
+                        sb_add(m, ":%02x", *p);
+        }
+        sb_add(m, " ");
+}
+
 static struct nf_loginfo default_loginfo = {
         .type   = NF_LOG_TYPE_LOG,
         .u = {
                 .log = {
-                        .level    = 0,
+                        .level    = 5,
                         .logflags = NF_LOG_MASK,
                 },
         },
@@ -382,11 +419,12 @@ ipt_log_packet(u_int8_t pf,
                const struct nf_loginfo *loginfo,
                const char *prefix)
 {
+        struct sbuff *m = sb_open();
+
         if (!loginfo)
                 loginfo = &default_loginfo;
 
-        spin_lock_bh(&log_lock);
-        printk("<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
+        sb_add(m, "<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
                prefix,
                in ? in->name : "",
                out ? out->name : "");
@@ -397,35 +435,24 @@ ipt_log_packet(u_int8_t pf,
 
                 physindev = skb->nf_bridge->physindev;
                 if (physindev && in != physindev)
-                        printk("PHYSIN=%s ", physindev->name);
+                        sb_add(m, "PHYSIN=%s ", physindev->name);
                 physoutdev = skb->nf_bridge->physoutdev;
                 if (physoutdev && out != physoutdev)
-                        printk("PHYSOUT=%s ", physoutdev->name);
+                        sb_add(m, "PHYSOUT=%s ", physoutdev->name);
         }
 #endif
 
-        if (in && !out) {
-                /* MAC logging for input chain only. */
-                printk("MAC=");
-                if (skb->dev && skb->dev->hard_header_len
-                    && skb->mac_header != skb->network_header) {
-                        int i;
-                        const unsigned char *p = skb_mac_header(skb);
-                        for (i = 0; i < skb->dev->hard_header_len; i++,p++)
-                                printk("%02x%c", *p,
-                                       i==skb->dev->hard_header_len - 1
-                                       ? ' ':':');
-                } else
-                        printk(" ");
-        }
+        /* MAC logging for input path only. */
+        if (in && !out)
+                dump_mac_header(m, loginfo, skb);
 
-        dump_packet(loginfo, skb, 0);
-        printk("\n");
-        spin_unlock_bh(&log_lock);
+        dump_packet(m, loginfo, skb, 0);
+
+        sb_close(m);
 }
 
 static unsigned int
-log_tg(struct sk_buff *skb, const struct xt_target_param *par)
+log_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct ipt_log_info *loginfo = par->targinfo;
         struct nf_loginfo li;
@@ -439,20 +466,19 @@ log_tg(struct sk_buff *skb, const struct xt_target_param *par)
         return XT_CONTINUE;
 }
 
-static bool log_tg_check(const struct xt_tgchk_param *par)
+static int log_tg_check(const struct xt_tgchk_param *par)
 {
         const struct ipt_log_info *loginfo = par->targinfo;
 
         if (loginfo->level >= 8) {
-                pr_debug("LOG: level %u >= 8\n", loginfo->level);
-                return false;
+                pr_debug("level %u >= 8\n", loginfo->level);
+                return -EINVAL;
         }
         if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
-                pr_debug("LOG: prefix term %i\n",
-                         loginfo->prefix[sizeof(loginfo->prefix)-1]);
-                return false;
+                pr_debug("prefix is not null-terminated\n");
+                return -EINVAL;
         }
-        return true;
+        return 0;
 }
 
 static struct xt_target log_tg_reg __read_mostly = {
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index dada0863946d..d2ed9dc74ebc 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -8,7 +8,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/types.h>
 #include <linux/inetdevice.h>
 #include <linux/ip.h>
@@ -28,23 +28,23 @@ MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("Xtables: automatic-address SNAT");
 
 /* FIXME: Multiple targets. --RR */
-static bool masquerade_tg_check(const struct xt_tgchk_param *par)
+static int masquerade_tg_check(const struct xt_tgchk_param *par)
 {
         const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
         if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
-                pr_debug("masquerade_check: bad MAP_IPS.\n");
-                return false;
+                pr_debug("bad MAP_IPS.\n");
+                return -EINVAL;
         }
         if (mr->rangesize != 1) {
-                pr_debug("masquerade_check: bad rangesize %u\n", mr->rangesize);
-                return false;
+                pr_debug("bad rangesize %u\n", mr->rangesize);
+                return -EINVAL;
         }
-        return true;
+        return 0;
 }
 
 static unsigned int
-masquerade_tg(struct sk_buff *skb, const struct xt_target_param *par)
+masquerade_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
         struct nf_conn *ct;
         struct nf_conn_nat *nat;
@@ -59,8 +59,8 @@ masquerade_tg(struct sk_buff *skb, const struct xt_target_param *par)
         ct = nf_ct_get(skb, &ctinfo);
         nat = nfct_nat(ct);
 
-        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
-                            || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
+        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
+                            ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
 
         /* Source address is 0.0.0.0 - locally generated packet that is
          * probably not supposed to be masqueraded.
@@ -72,7 +72,7 @@ masquerade_tg(struct sk_buff *skb, const struct xt_target_param *par)
         rt = skb_rtable(skb);
         newsrc = inet_select_addr(par->out, rt->rt_gateway, RT_SCOPE_UNIVERSE);
         if (!newsrc) {
-                printk("MASQUERADE: %s ate my IP address\n", par->out->name);
+                pr_info("%s ate my IP address\n", par->out->name);
                 return NF_DROP;
         }
 
diff --git a/net/ipv4/netfilter/ipt_NETMAP.c b/net/ipv4/netfilter/ipt_NETMAP.c
index 7c29582d4ec8..6cdb298f1035 100644
--- a/net/ipv4/netfilter/ipt_NETMAP.c
+++ b/net/ipv4/netfilter/ipt_NETMAP.c
@@ -9,7 +9,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/ip.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
@@ -22,23 +22,23 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Svenning Soerensen <svenning@post5.tele.dk>");
 MODULE_DESCRIPTION("Xtables: 1:1 NAT mapping of IPv4 subnets");
 
-static bool netmap_tg_check(const struct xt_tgchk_param *par)
+static int netmap_tg_check(const struct xt_tgchk_param *par)
 {
         const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
         if (!(mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)) {
-                pr_debug("NETMAP:check: bad MAP_IPS.\n");
-                return false;
+                pr_debug("bad MAP_IPS.\n");
+                return -EINVAL;
         }
         if (mr->rangesize != 1) {
-                pr_debug("NETMAP:check: bad rangesize %u.\n", mr->rangesize);
-                return false;
+                pr_debug("bad rangesize %u.\n", mr->rangesize);
+                return -EINVAL;
         }
-        return true;
+        return 0;
 }
 
 static unsigned int
-netmap_tg(struct sk_buff *skb, const struct xt_target_param *par)
+netmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
@@ -48,7 +48,8 @@ netmap_tg(struct sk_buff *skb, const struct xt_target_param *par)
 
         NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
                      par->hooknum == NF_INET_POST_ROUTING ||
-                     par->hooknum == NF_INET_LOCAL_OUT);
+                     par->hooknum == NF_INET_LOCAL_OUT ||
+                     par->hooknum == NF_INET_LOCAL_IN);
         ct = nf_ct_get(skb, &ctinfo);
 
         netmask = ~(mr->range[0].min_ip ^ mr->range[0].max_ip);
@@ -77,7 +78,8 @@ static struct xt_target netmap_tg_reg __read_mostly = {
         .table          = "nat",
         .hooks          = (1 << NF_INET_PRE_ROUTING) |
                           (1 << NF_INET_POST_ROUTING) |
-                          (1 << NF_INET_LOCAL_OUT),
+                          (1 << NF_INET_LOCAL_OUT) |
+                          (1 << NF_INET_LOCAL_IN),
         .checkentry     = netmap_tg_check,
         .me             = THIS_MODULE
 };
diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index 698e5e78685b..18a0656505a0 100644
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -6,7 +6,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/types.h>
 #include <linux/ip.h>
 #include <linux/timer.h>
@@ -26,23 +26,23 @@ MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("Xtables: Connection redirection to localhost");
 
 /* FIXME: Take multiple ranges --RR */
-static bool redirect_tg_check(const struct xt_tgchk_param *par)
+static int redirect_tg_check(const struct xt_tgchk_param *par)
 {
         const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
         if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
-                pr_debug("redirect_check: bad MAP_IPS.\n");
-                return false;
+                pr_debug("bad MAP_IPS.\n");
+                return -EINVAL;
         }
         if (mr->rangesize != 1) {
-                pr_debug("redirect_check: bad rangesize %u.\n", mr->rangesize);
-                return false;
+                pr_debug("bad rangesize %u.\n", mr->rangesize);
+                return -EINVAL;
         }
-        return true;
+        return 0;
 }
 
 static unsigned int
-redirect_tg(struct sk_buff *skb, const struct xt_target_param *par)
+redirect_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index c93ae44bff2a..1ff79e557f96 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -9,9 +9,10 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <linux/ip.h>
 #include <linux/udp.h>
 #include <linux/icmp.h>
@@ -94,10 +95,11 @@ static void send_reset(struct sk_buff *oldskb, int hook)
         }
 
         tcph->rst       = 1;
-        tcph->check     = tcp_v4_check(sizeof(struct tcphdr),
-                                       niph->saddr, niph->daddr,
-                                       csum_partial(tcph,
-                                                    sizeof(struct tcphdr), 0));
+        tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
+                                    niph->daddr, 0);
+        nskb->ip_summed = CHECKSUM_PARTIAL;
+        nskb->csum_start = (unsigned char *)tcph - nskb->head;
+        nskb->csum_offset = offsetof(struct tcphdr, check);
 
         addr_type = RTN_UNSPEC;
         if (hook != NF_INET_FORWARD
@@ -108,13 +110,13 @@ static void send_reset(struct sk_buff *oldskb, int hook)
                 addr_type = RTN_LOCAL;
 
         /* ip_route_me_harder expects skb->dst to be set */
-        skb_dst_set(nskb, dst_clone(skb_dst(oldskb)));
+        skb_dst_set_noref(nskb, skb_dst(oldskb));
 
+        nskb->protocol = htons(ETH_P_IP);
         if (ip_route_me_harder(nskb, addr_type))
                 goto free_nskb;
 
-        niph->ttl       = dst_metric(skb_dst(nskb), RTAX_HOPLIMIT);
-        nskb->ip_summed = CHECKSUM_NONE;
+        niph->ttl       = ip4_dst_hoplimit(skb_dst(nskb));
 
         /* "Never happens" */
         if (nskb->len > dst_mtu(skb_dst(nskb)))
@@ -135,13 +137,10 @@ static inline void send_unreach(struct sk_buff *skb_in, int code)
 }
 
 static unsigned int
-reject_tg(struct sk_buff *skb, const struct xt_target_param *par)
+reject_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
         const struct ipt_reject_info *reject = par->targinfo;
 
-        /* WARNING: This code causes reentry within iptables.
-           This means that the iptables jump stack is now crap.  We
-           must return an absolute verdict. --RR */
         switch (reject->with) {
         case IPT_ICMP_NET_UNREACHABLE:
                 send_unreach(skb, ICMP_NET_UNREACH);
@@ -174,23 +173,23 @@ reject_tg(struct sk_buff *skb, const struct xt_target_param *par)
         return NF_DROP;
 }
 
-static bool reject_tg_check(const struct xt_tgchk_param *par)
+static int reject_tg_check(const struct xt_tgchk_param *par)
 {
         const struct ipt_reject_info *rejinfo = par->targinfo;
         const struct ipt_entry *e = par->entryinfo;
 
         if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
-                printk("ipt_REJECT: ECHOREPLY no longer supported.\n");
-                return false;
+                pr_info("ECHOREPLY no longer supported.\n");
+                return -EINVAL;
         } else if (rejinfo->with == IPT_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
-                if (e->ip.proto != IPPROTO_TCP
-                    || (e->ip.invflags & XT_INV_PROTO)) {
-                        printk("ipt_REJECT: TCP_RESET invalid for non-tcp\n");
-                        return false;
+                if (e->ip.proto != IPPROTO_TCP ||
+                    (e->ip.invflags & XT_INV_PROTO)) {
+                        pr_info("TCP_RESET invalid for non-tcp\n");
+                        return -EINVAL;
                 }
         }
-        return true;
+        return 0;
 }
 
 static struct xt_target reject_tg_reg __read_mostly = {
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index d32cc4bb328a..446e0f467a17 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -29,10 +29,11 @@
  *   Specify, after how many hundredths of a second the queue should be
  *   flushed even if it is not full yet.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
 #include <linux/spinlock.h>
 #include <linux/socket.h>
+#include <linux/slab.h>
 #include <linux/skbuff.h>
 #include <linux/kernel.h>
 #include <linux/timer.h>
@@ -56,8 +57,6 @@ MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK, NETLINK_NFLOG);
 #define ULOG_NL_EVENT           111             /* Harald's favorite number */
 #define ULOG_MAXNLGROUPS        32              /* numer of nlgroups */
 
-#define PRINTR(format, args...) do { if (net_ratelimit()) printk(format , ## args); } while (0)
-
 static unsigned int nlbufsiz = NLMSG_GOODSIZE;
 module_param(nlbufsiz, uint, 0400);
 MODULE_PARM_DESC(nlbufsiz, "netlink buffer size");
@@ -90,12 +89,12 @@ static void ulog_send(unsigned int nlgroupnum)
         ulog_buff_t *ub = &ulog_buffers[nlgroupnum];
 
         if (timer_pending(&ub->timer)) {
-                pr_debug("ipt_ULOG: ulog_send: timer was pending, deleting\n");
+                pr_debug("ulog_send: timer was pending, deleting\n");
                 del_timer(&ub->timer);
         }
 
         if (!ub->skb) {
-                pr_debug("ipt_ULOG: ulog_send: nothing to send\n");
+                pr_debug("ulog_send: nothing to send\n");
                 return;
         }
 
@@ -104,7 +103,7 @@ static void ulog_send(unsigned int nlgroupnum)
                 ub->lastnlh->nlmsg_type = NLMSG_DONE;
 
         NETLINK_CB(ub->skb).dst_group = nlgroupnum + 1;
-        pr_debug("ipt_ULOG: throwing %d packets to netlink group %u\n",
+        pr_debug("throwing %d packets to netlink group %u\n",
                  ub->qlen, nlgroupnum + 1);
         netlink_broadcast(nflognl, ub->skb, 0, nlgroupnum + 1, GFP_ATOMIC);
 
@@ -117,7 +116,7 @@ static void ulog_send(unsigned int nlgroupnum)
 /* timer function to flush queue in flushtimeout time */
 static void ulog_timer(unsigned long data)
 {
-        pr_debug("ipt_ULOG: timer function called, calling ulog_send\n");
+        pr_debug("timer function called, calling ulog_send\n");
 
         /* lock to protect against somebody modifying our structure
          * from ipt_ulog_target at the same time */
@@ -138,7 +137,7 @@ static struct sk_buff *ulog_alloc_skb(unsigned int size)
         n = max(size, nlbufsiz);
         skb = alloc_skb(n, GFP_ATOMIC);
         if (!skb) {
-                PRINTR("ipt_ULOG: can't alloc whole buffer %ub!\n", n);
+                pr_debug("cannot alloc whole buffer %ub!\n", n);
 
                 if (n > size) {
                         /* try to allocate only as much as we need for
@@ -146,8 +145,7 @@ static struct sk_buff *ulog_alloc_skb(unsigned int size)
 
                         skb = alloc_skb(size, GFP_ATOMIC);
                         if (!skb)
-                                PRINTR("ipt_ULOG: can't even allocate %ub\n",
-                                       size);
+                                pr_debug("cannot even allocate %ub\n", size);
                 }
         }
 
@@ -198,8 +196,7 @@ static void ipt_ulog_packet(unsigned int hooknum,
                         goto alloc_failure;
         }
 
-        pr_debug("ipt_ULOG: qlen %d, qthreshold %Zu\n", ub->qlen,
-                 loginfo->qthreshold);
+        pr_debug("qlen %d, qthreshold %Zu\n", ub->qlen, loginfo->qthreshold);
 
         /* NLMSG_PUT contains a hidden goto nlmsg_failure !!! */
         nlh = NLMSG_PUT(ub->skb, 0, ub->qlen, ULOG_NL_EVENT,
@@ -226,9 +223,9 @@ static void ipt_ulog_packet(unsigned int hooknum,
         else
                 *(pm->prefix) = '\0';
 
-        if (in && in->hard_header_len > 0
-            && skb->mac_header != skb->network_header
-            && in->hard_header_len <= ULOG_MAC_LEN) {
+        if (in && in->hard_header_len > 0 &&
+            skb->mac_header != skb->network_header &&
+            in->hard_header_len <= ULOG_MAC_LEN) {
                 memcpy(pm->mac, skb_mac_header(skb), in->hard_header_len);
                 pm->mac_len = in->hard_header_len;
         } else
@@ -272,16 +269,14 @@ static void ipt_ulog_packet(unsigned int hooknum,
         return;
 
 nlmsg_failure:
-        PRINTR("ipt_ULOG: error during NLMSG_PUT\n");
-
+        pr_debug("error during NLMSG_PUT\n");
 alloc_failure:
-        PRINTR("ipt_ULOG: Error building netlink message\n");
-
+        pr_debug("Error building netlink message\n");
         spin_unlock_bh(&ulog_lock);
 }
 
 static unsigned int
-ulog_tg(struct sk_buff *skb, const struct xt_target_param *par)
+ulog_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
         ipt_ulog_packet(par->hooknum, skb, par->in, par->out,
                         par->targinfo, NULL);
@@ -313,21 +308,20 @@ static void ipt_logfn(u_int8_t pf,
         ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
 }
 
-static bool ulog_tg_check(const struct xt_tgchk_param *par)
+static int ulog_tg_check(const struct xt_tgchk_param *par)
 {
         const struct ipt_ulog_info *loginfo = par->targinfo;
 
         if (loginfo->prefix[sizeof(loginfo->prefix) - 1] != '\0') {
-                pr_debug("ipt_ULOG: prefix term %i\n",
-                         loginfo->prefix[sizeof(loginfo->prefix) - 1]);
-                return false;
+                pr_debug("prefix not null-terminated\n");
+                return -EINVAL;
         }
         if (loginfo->qthreshold > ULOG_MAX_QLEN) {
-                pr_debug("ipt_ULOG: queue threshold %Zu > MAX_QLEN\n",
+                pr_debug("queue threshold %Zu > MAX_QLEN\n",
                          loginfo->qthreshold);
-                return false;
+                return -EINVAL;
         }
-        return true;
+        return 0;
 }
 
 #ifdef CONFIG_COMPAT
@@ -338,7 +332,7 @@ struct compat_ipt_ulog_info {
         char            prefix[ULOG_PREFIX_LEN];
 };
 
-static void ulog_tg_compat_from_user(void *dst, void *src)
+static void ulog_tg_compat_from_user(void *dst, const void *src)
 {
         const struct compat_ipt_ulog_info *cl = src;
         struct ipt_ulog_info l = {
@@ -351,7 +345,7 @@ static void ulog_tg_compat_from_user(void *dst, void *src)
         memcpy(dst, &l, sizeof(l));
 }
 
-static int ulog_tg_compat_to_user(void __user *dst, void *src)
+static int ulog_tg_compat_to_user(void __user *dst, const void *src)
 {
         const struct ipt_ulog_info *l = src;
         struct compat_ipt_ulog_info cl = {
@@ -389,10 +383,10 @@ static int __init ulog_tg_init(void)
 {
         int ret, i;
 
-        pr_debug("ipt_ULOG: init module\n");
+        pr_debug("init module\n");
 
         if (nlbufsiz > 128*1024) {
-                printk("Netlink buffer has to be <= 128kB\n");
+                pr_warning("Netlink buffer has to be <= 128kB\n");
                 return -EINVAL;
         }
 
@@ -422,7 +416,7 @@ static void __exit ulog_tg_exit(void)
         ulog_buff_t *ub;
         int i;
 
-        pr_debug("ipt_ULOG: cleanup_module\n");
+        pr_debug("cleanup_module\n");
 
         if (nflog)
                 nf_log_unregister(&ipt_ulog_logger);
diff --git a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
index 3b216be3bc9f..db8bff0fb86d 100644
--- a/net/ipv4/netfilter/ipt_addrtype.c
+++ b/net/ipv4/netfilter/ipt_addrtype.c
@@ -8,7 +8,7 @@
  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
@@ -30,7 +30,7 @@ static inline bool match_type(struct net *net, const struct net_device *dev,
 }
 
 static bool
-addrtype_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
+addrtype_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
 {
         struct net *net = dev_net(par->in ? par->in : par->out);
         const struct ipt_addrtype_info *info = par->matchinfo;
@@ -48,7 +48,7 @@ addrtype_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
 }
 
 static bool
-addrtype_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par)
+addrtype_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
 {
         struct net *net = dev_net(par->in ? par->in : par->out);
         const struct ipt_addrtype_info_v1 *info = par->matchinfo;
@@ -70,34 +70,34 @@ addrtype_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par)
         return ret;
 }
 
-static bool addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
+static int addrtype_mt_checkentry_v1(const struct xt_mtchk_param *par)
 {
         struct ipt_addrtype_info_v1 *info = par->matchinfo;
 
         if (info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN &&
             info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT) {
-                printk(KERN_ERR "ipt_addrtype: both incoming and outgoing "
-                                "interface limitation cannot be selected\n");
-                return false;
+                pr_info("both incoming and outgoing "
+                        "interface limitation cannot be selected\n");
+                return -EINVAL;
         }
 
         if (par->hook_mask & ((1 << NF_INET_PRE_ROUTING) |
             (1 << NF_INET_LOCAL_IN)) &&
             info->flags & IPT_ADDRTYPE_LIMIT_IFACE_OUT) {
-                printk(KERN_ERR "ipt_addrtype: output interface limitation "
-                                "not valid in PRE_ROUTING and INPUT\n");
-                return false;
+                pr_info("output interface limitation "
+                        "not valid in PREROUTING and INPUT\n");
+                return -EINVAL;
         }
 
         if (par->hook_mask & ((1 << NF_INET_POST_ROUTING) |
             (1 << NF_INET_LOCAL_OUT)) &&
             info->flags & IPT_ADDRTYPE_LIMIT_IFACE_IN) {
-                printk(KERN_ERR "ipt_addrtype: input interface limitation "
-                                "not valid in POST_ROUTING and OUTPUT\n");
-                return false;
+                pr_info("input interface limitation "
+                        "not valid in POSTROUTING and OUTPUT\n");
+                return -EINVAL;
         }
 
-        return true;
+        return 0;
 }
 
 static struct xt_match addrtype_mt_reg[] __read_mostly = {
diff --git a/net/ipv4/netfilter/ipt_ah.c b/net/ipv4/netfilter/ipt_ah.c
index 0104c0b399de..14a2aa8b8a14 100644
--- a/net/ipv4/netfilter/ipt_ah.c
+++ b/net/ipv4/netfilter/ipt_ah.c
@@ -5,7 +5,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/in.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
@@ -18,25 +18,19 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Yon Uriarte <yon@astaro.de>");
 MODULE_DESCRIPTION("Xtables: IPv4 IPsec-AH SPI match");
 
-#ifdef DEBUG_CONNTRACK
-#define duprintf(format, args...) printk(format , ## args)
-#else
-#define duprintf(format, args...)
-#endif
-
 /* Returns 1 if the spi is matched by the range, 0 otherwise */
 static inline bool
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
         bool r;
-        duprintf("ah spi_match:%c 0x%x <= 0x%x <= 0x%x",invert? '!':' ',
-                min,spi,max);
+        pr_debug("spi_match:%c 0x%x <= 0x%x <= 0x%x\n",
+                 invert ? '!' : ' ', min, spi, max);
         r=(spi >= min && spi <= max) ^ invert;
-        duprintf(" result %s\n",r? "PASS" : "FAILED");
+        pr_debug(" result %s\n", r ? "PASS" : "FAILED");
         return r;
 }
 
-static bool ah_mt(const struct sk_buff *skb, const struct xt_match_param *par)
+static bool ah_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
         struct ip_auth_hdr _ahdr;
         const struct ip_auth_hdr *ah;
@@ -51,8 +45,8 @@ static bool ah_mt(const struct sk_buff *skb, const struct xt_match_param *par)
                 /* We've been asked to examine this packet, and we
                  * can't.  Hence, no choice but to drop.
                  */
-                duprintf("Dropping evil AH tinygram.\n");
-                *par->hotdrop = true;
+                pr_debug("Dropping evil AH tinygram.\n");
+                par->hotdrop = true;
                 return 0;
         }
 
@@ -61,16 +55,16 @@ static bool ah_mt(const struct sk_buff *skb, const struct xt_match_param *par)
                          !!(ahinfo->invflags & IPT_AH_INV_SPI));
 }
 
-static bool ah_mt_check(const struct xt_mtchk_param *par)
+static int ah_mt_check(const struct xt_mtchk_param *par)
 {
         const struct ipt_ah *ahinfo = par->matchinfo;
 
         /* Must specify no unknown invflags */
         if (ahinfo->invflags & ~IPT_AH_INV_MASK) {
-                duprintf("ipt_ah: unknown flags %X\n", ahinfo->invflags);
-                return false;
+                pr_debug("unknown flags %X\n", ahinfo->invflags);
+                return -EINVAL;
         }
-        return true;
+        return 0;
 }
 
 static struct xt_match ah_mt_reg __read_mostly = {
diff --git a/net/ipv4/netfilter/ipt_ecn.c b/net/ipv4/netfilter/ipt_ecn.c
index 6289b64144c6..af6e9c778345 100644
--- a/net/ipv4/netfilter/ipt_ecn.c
+++ b/net/ipv4/netfilter/ipt_ecn.c
@@ -6,7 +6,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <net/ip.h>
@@ -67,7 +67,7 @@ static inline bool match_tcp(const struct sk_buff *skb,
         return true;
 }
 
-static bool ecn_mt(const struct sk_buff *skb, const struct xt_match_param *par)
+static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
         const struct ipt_ecn_info *info = par->matchinfo;
 
@@ -78,32 +78,31 @@ static bool ecn_mt(const struct sk_buff *skb, const struct xt_match_param *par)
         if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) {
                 if (ip_hdr(skb)->protocol != IPPROTO_TCP)
                         return false;
-                if (!match_tcp(skb, info, par->hotdrop))
+                if (!match_tcp(skb, info, &par->hotdrop))
                         return false;
         }
 
         return true;
 }
 
-static bool ecn_mt_check(const struct xt_mtchk_param *par)
+static int ecn_mt_check(const struct xt_mtchk_param *par)
 {
         const struct ipt_ecn_info *info = par->matchinfo;
         const struct ipt_ip *ip = par->entryinfo;
 
         if (info->operation & IPT_ECN_OP_MATCH_MASK)
-                return false;
+                return -EINVAL;
 
         if (info->invert & IPT_ECN_OP_MATCH_MASK)
-                return false;
+                return -EINVAL;
 
-        if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)
-            && ip->proto != IPPROTO_TCP) {
-                printk(KERN_WARNING "ipt_ecn: can't match TCP bits in rule for"
-                       " non-tcp packets\n");
-                return false;
+        if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) &&
+            ip->proto != IPPROTO_TCP) {
+                pr_info("cannot match TCP bits in rule for non-tcp packets\n");
+                return -EINVAL;
         }
 
-        return true;
+        return 0;
 }
 
 static struct xt_match ecn_mt_reg __read_mostly = {
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index c30a969724f8..c37641e819f2 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -13,6 +13,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 
 MODULE_LICENSE("GPL");
@@ -23,104 +24,32 @@ MODULE_DESCRIPTION("iptables filter table");
                             (1 << NF_INET_FORWARD) | \
                             (1 << NF_INET_LOCAL_OUT))
 
-static struct
-{
-        struct ipt_replace repl;
-        struct ipt_standard entries[3];
-        struct ipt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "filter",
-                .valid_hooks = FILTER_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
-                .hook_entry = {
-                        [NF_INET_LOCAL_IN] = 0,
-                        [NF_INET_FORWARD] = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
-                },
-                .underflow = {
-                        [NF_INET_LOCAL_IN] = 0,
-                        [NF_INET_FORWARD] = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
-                },
-        },
-        .entries = {
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-        },
-        .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
-static struct xt_table packet_filter = {
+static const struct xt_table packet_filter = {
         .name           = "filter",
         .valid_hooks    = FILTER_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET,
+        .af             = NFPROTO_IPV4,
+        .priority       = NF_IP_PRI_FILTER,
 };
 
-/* The work comes in here from netfilter.c. */
-static unsigned int
-ipt_local_in_hook(unsigned int hook,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_filter);
-}
-
 static unsigned int
-ipt_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
+iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
+                    const struct net_device *in, const struct net_device *out,
+                    int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_filter);
-}
+        const struct net *net;
 
-static unsigned int
-ipt_local_out_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
-{
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr))
+        if (hook == NF_INET_LOCAL_OUT &&
+            (skb->len < sizeof(struct iphdr) ||
+             ip_hdrlen(skb) < sizeof(struct iphdr)))
+                /* root is playing with raw sockets. */
                 return NF_ACCEPT;
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(out)->ipv4.iptable_filter);
+
+        net = dev_net((in != NULL) ? in : out);
+        return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
 }
 
-static struct nf_hook_ops ipt_ops[] __read_mostly = {
-        {
-                .hook           = ipt_local_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-        {
-                .hook           = ipt_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-        {
-                .hook           = ipt_local_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP_PRI_FILTER,
-        },
-};
+static struct nf_hook_ops *filter_ops __read_mostly;
 
 /* Default to forward because I got too much mail already. */
 static int forward = NF_ACCEPT;
@@ -128,9 +57,18 @@ module_param(forward, bool, 0000);
 
 static int __net_init iptable_filter_net_init(struct net *net)
 {
-        /* Register table */
+        struct ipt_replace *repl;
+
+        repl = ipt_alloc_initial_table(&packet_filter);
+        if (repl == NULL)
+                return -ENOMEM;
+        /* Entry 1 is the FORWARD hook */
+        ((struct ipt_standard *)repl->entries)[1].target.verdict =
+                -forward - 1;
+
         net->ipv4.iptable_filter =
-                ipt_register_table(net, &packet_filter, &initial_table.repl);
+                ipt_register_table(net, &packet_filter, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.iptable_filter))
                 return PTR_ERR(net->ipv4.iptable_filter);
         return 0;
@@ -138,7 +76,7 @@ static int __net_init iptable_filter_net_init(struct net *net)
 
 static void __net_exit iptable_filter_net_exit(struct net *net)
 {
-        ipt_unregister_table(net->ipv4.iptable_filter);
+        ipt_unregister_table(net, net->ipv4.iptable_filter);
 }
 
 static struct pernet_operations iptable_filter_net_ops = {
@@ -151,21 +89,20 @@ static int __init iptable_filter_init(void)
         int ret;
 
         if (forward < 0 || forward > NF_MAX_VERDICT) {
-                printk("iptables forward must be 0 or 1\n");
+                pr_err("iptables forward must be 0 or 1\n");
                 return -EINVAL;
         }
 
-        /* Entry 1 is the FORWARD hook */
-        initial_table.entries[1].target.verdict = -forward - 1;
-
         ret = register_pernet_subsys(&iptable_filter_net_ops);
         if (ret < 0)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        if (ret < 0)
+        filter_ops = xt_hook_link(&packet_filter, iptable_filter_hook);
+        if (IS_ERR(filter_ops)) {
+                ret = PTR_ERR(filter_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -176,7 +113,7 @@ static int __init iptable_filter_init(void)
 
 static void __exit iptable_filter_fini(void)
 {
-        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
+        xt_hook_unlink(&packet_filter, filter_ops);
         unregister_pernet_subsys(&iptable_filter_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 4087614d9519..294a2a32f293 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -12,6 +12,7 @@
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/route.h>
 #include <linux/ip.h>
@@ -27,101 +28,16 @@ MODULE_DESCRIPTION("iptables mangle table");
                             (1 << NF_INET_LOCAL_OUT) | \
                             (1 << NF_INET_POST_ROUTING))
 
-/* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
-static struct
-{
-        struct ipt_replace repl;
-        struct ipt_standard entries[5];
-        struct ipt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "mangle",
-                .valid_hooks = MANGLE_VALID_HOOKS,
-                .num_entries = 6,
-                .size = sizeof(struct ipt_standard) * 5 + sizeof(struct ipt_error),
-                .hook_entry = {
-                        [NF_INET_PRE_ROUTING]   = 0,
-                        [NF_INET_LOCAL_IN]      = sizeof(struct ipt_standard),
-                        [NF_INET_FORWARD]       = sizeof(struct ipt_standard) * 2,
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 3,
-                        [NF_INET_POST_ROUTING]  = sizeof(struct ipt_standard) * 4,
-                },
-                .underflow = {
-                        [NF_INET_PRE_ROUTING]   = 0,
-                        [NF_INET_LOCAL_IN]      = sizeof(struct ipt_standard),
-                        [NF_INET_FORWARD]       = sizeof(struct ipt_standard) * 2,
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 3,
-                        [NF_INET_POST_ROUTING]  = sizeof(struct ipt_standard) * 4,
-                },
-        },
-        .entries = {
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* POST_ROUTING */
-        },
-        .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
-static struct xt_table packet_mangler = {
+static const struct xt_table packet_mangler = {
         .name           = "mangle",
         .valid_hooks    = MANGLE_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET,
+        .af             = NFPROTO_IPV4,
+        .priority       = NF_IP_PRI_MANGLE,
 };
 
-/* The work comes in here from netfilter.c. */
-static unsigned int
-ipt_pre_routing_hook(unsigned int hook,
-                     struct sk_buff *skb,
-                     const struct net_device *in,
-                     const struct net_device *out,
-                     int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_mangle);
-}
-
-static unsigned int
-ipt_post_routing_hook(unsigned int hook,
-                      struct sk_buff *skb,
-                      const struct net_device *in,
-                      const struct net_device *out,
-                      int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(out)->ipv4.iptable_mangle);
-}
-
-static unsigned int
-ipt_local_in_hook(unsigned int hook,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_mangle);
-}
-
-static unsigned int
-ipt_forward_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_mangle);
-}
-
 static unsigned int
-ipt_local_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
+ipt_mangle_out(struct sk_buff *skb, const struct net_device *out)
 {
         unsigned int ret;
         const struct iphdr *iph;
@@ -130,8 +46,8 @@ ipt_local_hook(unsigned int hook,
         u_int32_t mark;
 
         /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr))
+        if (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr))
                 return NF_ACCEPT;
 
         /* Save things which could affect route */
@@ -141,7 +57,7 @@ ipt_local_hook(unsigned int hook,
         daddr = iph->daddr;
         tos = iph->tos;
 
-        ret = ipt_do_table(skb, hook, in, out,
+        ret = ipt_do_table(skb, NF_INET_LOCAL_OUT, NULL, out,
                            dev_net(out)->ipv4.iptable_mangle);
         /* Reroute for ANY change. */
         if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
@@ -158,49 +74,36 @@ ipt_local_hook(unsigned int hook,
         return ret;
 }
 
-static struct nf_hook_ops ipt_ops[] __read_mostly = {
-        {
-                .hook           = ipt_pre_routing_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_PRE_ROUTING,
-                .priority       = NF_IP_PRI_MANGLE,
-        },
-        {
-                .hook           = ipt_local_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP_PRI_MANGLE,
-        },
-        {
-                .hook           = ipt_forward_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP_PRI_MANGLE,
-        },
-        {
-                .hook           = ipt_local_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP_PRI_MANGLE,
-        },
-        {
-                .hook           = ipt_post_routing_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_POST_ROUTING,
-                .priority       = NF_IP_PRI_MANGLE,
-        },
-};
+/* The work comes in here from netfilter.c. */
+static unsigned int
+iptable_mangle_hook(unsigned int hook,
+                     struct sk_buff *skb,
+                     const struct net_device *in,
+                     const struct net_device *out,
+                     int (*okfn)(struct sk_buff *))
+{
+        if (hook == NF_INET_LOCAL_OUT)
+                return ipt_mangle_out(skb, out);
+        if (hook == NF_INET_POST_ROUTING)
+                return ipt_do_table(skb, hook, in, out,
+                                    dev_net(out)->ipv4.iptable_mangle);
+        /* PREROUTING/INPUT/FORWARD: */
+        return ipt_do_table(skb, hook, in, out,
+                            dev_net(in)->ipv4.iptable_mangle);
+}
+
+static struct nf_hook_ops *mangle_ops __read_mostly;
 
 static int __net_init iptable_mangle_net_init(struct net *net)
 {
-        /* Register table */
+        struct ipt_replace *repl;
+
+        repl = ipt_alloc_initial_table(&packet_mangler);
+        if (repl == NULL)
+                return -ENOMEM;
         net->ipv4.iptable_mangle =
-                ipt_register_table(net, &packet_mangler, &initial_table.repl);
+                ipt_register_table(net, &packet_mangler, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.iptable_mangle))
                 return PTR_ERR(net->ipv4.iptable_mangle);
         return 0;
@@ -208,7 +111,7 @@ static int __net_init iptable_mangle_net_init(struct net *net)
 
 static void __net_exit iptable_mangle_net_exit(struct net *net)
 {
-        ipt_unregister_table(net->ipv4.iptable_mangle);
+        ipt_unregister_table(net, net->ipv4.iptable_mangle);
 }
 
 static struct pernet_operations iptable_mangle_net_ops = {
@@ -225,9 +128,11 @@ static int __init iptable_mangle_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        if (ret < 0)
+        mangle_ops = xt_hook_link(&packet_mangler, iptable_mangle_hook);
+        if (IS_ERR(mangle_ops)) {
+                ret = PTR_ERR(mangle_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -238,7 +143,7 @@ static int __init iptable_mangle_init(void)
 
 static void __exit iptable_mangle_fini(void)
 {
-        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
+        xt_hook_unlink(&packet_mangler, mangle_ops);
         unregister_pernet_subsys(&iptable_mangle_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index e5356da1fb54..07fb710cd722 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -5,94 +5,49 @@
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 
 #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
 
-static struct
-{
-        struct ipt_replace repl;
-        struct ipt_standard entries[2];
-        struct ipt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "raw",
-                .valid_hooks = RAW_VALID_HOOKS,
-                .num_entries = 3,
-                .size = sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error),
-                .hook_entry = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard)
-                },
-                .underflow = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_LOCAL_OUT]  = sizeof(struct ipt_standard)
-                },
-        },
-        .entries = {
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-        },
-        .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
-static struct xt_table packet_raw = {
+static const struct xt_table packet_raw = {
         .name = "raw",
         .valid_hooks =  RAW_VALID_HOOKS,
         .me = THIS_MODULE,
-        .af = AF_INET,
+        .af = NFPROTO_IPV4,
+        .priority = NF_IP_PRI_RAW,
 };
 
 /* The work comes in here from netfilter.c. */
 static unsigned int
-ipt_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
+iptable_raw_hook(unsigned int hook, struct sk_buff *skb,
+                 const struct net_device *in, const struct net_device *out,
+                 int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_raw);
-}
+        const struct net *net;
 
-static unsigned int
-ipt_local_hook(unsigned int hook,
-               struct sk_buff *skb,
-               const struct net_device *in,
-               const struct net_device *out,
-               int (*okfn)(struct sk_buff *))
-{
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr))
+        if (hook == NF_INET_LOCAL_OUT && 
+            (skb->len < sizeof(struct iphdr) ||
+             ip_hdrlen(skb) < sizeof(struct iphdr)))
+                /* root is playing with raw sockets. */
                 return NF_ACCEPT;
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(out)->ipv4.iptable_raw);
+
+        net = dev_net((in != NULL) ? in : out);
+        return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw);
 }
 
-/* 'raw' is the very first table. */
-static struct nf_hook_ops ipt_ops[] __read_mostly = {
-        {
-                .hook = ipt_hook,
-                .pf = PF_INET,
-                .hooknum = NF_INET_PRE_ROUTING,
-                .priority = NF_IP_PRI_RAW,
-                .owner = THIS_MODULE,
-        },
-        {
-                .hook = ipt_local_hook,
-                .pf = PF_INET,
-                .hooknum = NF_INET_LOCAL_OUT,
-                .priority = NF_IP_PRI_RAW,
-                .owner = THIS_MODULE,
-        },
-};
+static struct nf_hook_ops *rawtable_ops __read_mostly;
 
 static int __net_init iptable_raw_net_init(struct net *net)
 {
-        /* Register table */
+        struct ipt_replace *repl;
+
+        repl = ipt_alloc_initial_table(&packet_raw);
+        if (repl == NULL)
+                return -ENOMEM;
         net->ipv4.iptable_raw =
-                ipt_register_table(net, &packet_raw, &initial_table.repl);
+                ipt_register_table(net, &packet_raw, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.iptable_raw))
                 return PTR_ERR(net->ipv4.iptable_raw);
         return 0;
@@ -100,7 +55,7 @@ static int __net_init iptable_raw_net_init(struct net *net)
 
 static void __net_exit iptable_raw_net_exit(struct net *net)
 {
-        ipt_unregister_table(net->ipv4.iptable_raw);
+        ipt_unregister_table(net, net->ipv4.iptable_raw);
 }
 
 static struct pernet_operations iptable_raw_net_ops = {
@@ -117,9 +72,11 @@ static int __init iptable_raw_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        if (ret < 0)
+        rawtable_ops = xt_hook_link(&packet_raw, iptable_raw_hook);
+        if (IS_ERR(rawtable_ops)) {
+                ret = PTR_ERR(rawtable_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -130,7 +87,7 @@ static int __init iptable_raw_init(void)
 
 static void __exit iptable_raw_fini(void)
 {
-        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
+        xt_hook_unlink(&packet_raw, rawtable_ops);
         unregister_pernet_subsys(&iptable_raw_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 29ab630f240a..be45bdc4c602 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -17,6 +17,7 @@
  */
 #include <linux/module.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 
 MODULE_LICENSE("GPL");
@@ -27,109 +28,44 @@ MODULE_DESCRIPTION("iptables security table, for MAC rules");
                                 (1 << NF_INET_FORWARD) | \
                                 (1 << NF_INET_LOCAL_OUT)
 
-static struct
-{
-        struct ipt_replace repl;
-        struct ipt_standard entries[3];
-        struct ipt_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "security",
-                .valid_hooks = SECURITY_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
-                .hook_entry = {
-                        [NF_INET_LOCAL_IN]      = 0,
-                        [NF_INET_FORWARD]       = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 2,
-                },
-                .underflow = {
-                        [NF_INET_LOCAL_IN]      = 0,
-                        [NF_INET_FORWARD]       = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 2,
-                },
-        },
-        .entries = {
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-        },
-        .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
-static struct xt_table security_table = {
+static const struct xt_table security_table = {
         .name           = "security",
         .valid_hooks    = SECURITY_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET,
+        .af             = NFPROTO_IPV4,
+        .priority       = NF_IP_PRI_SECURITY,
 };
 
 static unsigned int
-ipt_local_in_hook(unsigned int hook,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
-{
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_security);
-}
-
-static unsigned int
-ipt_forward_hook(unsigned int hook,
-                 struct sk_buff *skb,
-                 const struct net_device *in,
-                 const struct net_device *out,
-                 int (*okfn)(struct sk_buff *))
+iptable_security_hook(unsigned int hook, struct sk_buff *skb,
+                      const struct net_device *in,
+                      const struct net_device *out,
+                      int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(in)->ipv4.iptable_security);
-}
+        const struct net *net;
 
-static unsigned int
-ipt_local_out_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
-{
-        /* Somebody is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr))
+        if (hook == NF_INET_LOCAL_OUT &&
+            (skb->len < sizeof(struct iphdr) ||
+             ip_hdrlen(skb) < sizeof(struct iphdr)))
+                /* Somebody is playing with raw sockets. */
                 return NF_ACCEPT;
-        return ipt_do_table(skb, hook, in, out,
-                            dev_net(out)->ipv4.iptable_security);
+
+        net = dev_net((in != NULL) ? in : out);
+        return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_security);
 }
 
-static struct nf_hook_ops ipt_ops[] __read_mostly = {
-        {
-                .hook           = ipt_local_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP_PRI_SECURITY,
-        },
-        {
-                .hook           = ipt_forward_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP_PRI_SECURITY,
-        },
-        {
-                .hook           = ipt_local_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP_PRI_SECURITY,
-        },
-};
+static struct nf_hook_ops *sectbl_ops __read_mostly;
 
 static int __net_init iptable_security_net_init(struct net *net)
 {
-        net->ipv4.iptable_security =
-                ipt_register_table(net, &security_table, &initial_table.repl);
+        struct ipt_replace *repl;
 
+        repl = ipt_alloc_initial_table(&security_table);
+        if (repl == NULL)
+                return -ENOMEM;
+        net->ipv4.iptable_security =
+                ipt_register_table(net, &security_table, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.iptable_security))
                 return PTR_ERR(net->ipv4.iptable_security);
 
@@ -138,7 +74,7 @@ static int __net_init iptable_security_net_init(struct net *net)
 
 static void __net_exit iptable_security_net_exit(struct net *net)
 {
-        ipt_unregister_table(net->ipv4.iptable_security);
+        ipt_unregister_table(net, net->ipv4.iptable_security);
 }
 
 static struct pernet_operations iptable_security_net_ops = {
@@ -154,9 +90,11 @@ static int __init iptable_security_init(void)
         if (ret < 0)
                 return ret;
 
-        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        if (ret < 0)
+        sectbl_ops = xt_hook_link(&security_table, iptable_security_hook);
+        if (IS_ERR(sectbl_ops)) {
+                ret = PTR_ERR(sectbl_ops);
                 goto cleanup_table;
+        }
 
         return ret;
 
@@ -167,7 +105,7 @@ cleanup_table:
 
 static void __exit iptable_security_fini(void)
 {
-        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
+        xt_hook_unlink(&security_table, sectbl_ops);
         unregister_pernet_subsys(&iptable_security_net_ops);
 }
 
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 7d2ead7228ac..5a03c02af999 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -22,10 +22,12 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#include <net/netfilter/nf_log.h>
 
 int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
                               struct nf_conn *ct,
@@ -113,8 +115,11 @@ static unsigned int ipv4_confirm(unsigned int hooknum,
 
         ret = helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),
                            ct, ctinfo);
-        if (ret != NF_ACCEPT)
+        if (ret != NF_ACCEPT) {
+                nf_log_packet(NFPROTO_IPV4, hooknum, skb, in, out, NULL,
+                              "nf_ct_%s: dropping packet", helper->name);
                 return ret;
+        }
 
         if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
                 typeof(nf_nat_seq_adjust_hook) seq_adjust;
@@ -158,28 +163,28 @@ static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
         {
                 .hook           = ipv4_conntrack_in,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_PRE_ROUTING,
                 .priority       = NF_IP_PRI_CONNTRACK,
         },
         {
                 .hook           = ipv4_conntrack_local,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP_PRI_CONNTRACK,
         },
         {
                 .hook           = ipv4_confirm,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_POST_ROUTING,
                 .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
         },
         {
                 .hook           = ipv4_confirm,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
         },
@@ -191,7 +196,6 @@ static int log_invalid_proto_max = 255;
 
 static ctl_table ip_ct_sysctl_table[] = {
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_MAX,
                 .procname       = "ip_conntrack_max",
                 .data           = &nf_conntrack_max,
                 .maxlen         = sizeof(int),
@@ -199,7 +203,6 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_COUNT,
                 .procname       = "ip_conntrack_count",
                 .data           = &init_net.ct.count,
                 .maxlen         = sizeof(int),
@@ -207,15 +210,13 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_BUCKETS,
                 .procname       = "ip_conntrack_buckets",
-                .data           = &nf_conntrack_htable_size,
+                .data           = &init_net.ct.htable_size,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0444,
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_CHECKSUM,
                 .procname       = "ip_conntrack_checksum",
                 .data           = &init_net.ct.sysctl_checksum,
                 .maxlen         = sizeof(int),
@@ -223,19 +224,15 @@ static ctl_table ip_ct_sysctl_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_NF_CONNTRACK_LOG_INVALID,
                 .procname       = "ip_conntrack_log_invalid",
                 .data           = &init_net.ct.sysctl_log_invalid,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &log_invalid_proto_min,
                 .extra2         = &log_invalid_proto_max,
         },
-        {
-                .ctl_name       = 0
-        }
+        { }
 };
 #endif /* CONFIG_SYSCTL && CONFIG_NF_CONNTRACK_PROC_COMPAT */
 
@@ -251,16 +248,16 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
         struct nf_conntrack_tuple tuple;
 
         memset(&tuple, 0, sizeof(tuple));
-        tuple.src.u3.ip = inet->rcv_saddr;
-        tuple.src.u.tcp.port = inet->sport;
-        tuple.dst.u3.ip = inet->daddr;
-        tuple.dst.u.tcp.port = inet->dport;
+        tuple.src.u3.ip = inet->inet_rcv_saddr;
+        tuple.src.u.tcp.port = inet->inet_sport;
+        tuple.dst.u3.ip = inet->inet_daddr;
+        tuple.dst.u.tcp.port = inet->inet_dport;
         tuple.src.l3num = PF_INET;
-        tuple.dst.protonum = IPPROTO_TCP;
+        tuple.dst.protonum = sk->sk_protocol;
 
-        /* We only do TCP at the moment: is there a better way? */
-        if (strcmp(sk->sk_prot->name, "TCP")) {
-                pr_debug("SO_ORIGINAL_DST: Not a TCP socket\n");
+        /* We only do TCP and SCTP at the moment: is there a better way? */
+        if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) {
+                pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n");
                 return -ENOPROTOOPT;
         }
 
@@ -270,7 +267,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                 return -EINVAL;
         }
 
-        h = nf_conntrack_find_get(sock_net(sk), &tuple);
+        h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
         if (h) {
                 struct sockaddr_in sin;
                 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
@@ -385,32 +382,32 @@ static int __init nf_conntrack_l3proto_ipv4_init(void)
 
         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_tcp4);
         if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register tcp.\n");
+                pr_err("nf_conntrack_ipv4: can't register tcp.\n");
                 goto cleanup_sockopt;
         }
 
         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udp4);
         if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register udp.\n");
+                pr_err("nf_conntrack_ipv4: can't register udp.\n");
                 goto cleanup_tcp;
         }
 
         ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_icmp);
         if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register icmp.\n");
+                pr_err("nf_conntrack_ipv4: can't register icmp.\n");
                 goto cleanup_udp;
         }
 
         ret = nf_conntrack_l3proto_register(&nf_conntrack_l3proto_ipv4);
         if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register ipv4\n");
+                pr_err("nf_conntrack_ipv4: can't register ipv4\n");
                 goto cleanup_icmp;
         }
 
         ret = nf_register_hooks(ipv4_conntrack_ops,
                                 ARRAY_SIZE(ipv4_conntrack_ops));
         if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register hooks.\n");
+                pr_err("nf_conntrack_ipv4: can't register hooks.\n");
                 goto cleanup_ipv4;
         }
 #if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 8668a3defda6..63f60fc5d26a 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -11,6 +11,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/percpu.h>
+#include <linux/security.h>
 #include <net/net_namespace.h>
 
 #include <linux/netfilter.h>
@@ -32,7 +33,7 @@ static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
         struct hlist_nulls_node *n;
 
         for (st->bucket = 0;
-             st->bucket < nf_conntrack_htable_size;
+             st->bucket < net->ct.htable_size;
              st->bucket++) {
                 n = rcu_dereference(net->ct.hash[st->bucket].first);
                 if (!is_a_nulls(n))
@@ -50,7 +51,7 @@ static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
         head = rcu_dereference(head->next);
         while (is_a_nulls(head)) {
                 if (likely(get_nulls_value(head) == st->bucket)) {
-                        if (++st->bucket >= nf_conntrack_htable_size)
+                        if (++st->bucket >= net->ct.htable_size)
                                 return NULL;
                 }
                 head = rcu_dereference(net->ct.hash[st->bucket].first);
@@ -87,6 +88,29 @@ static void ct_seq_stop(struct seq_file *s, void *v)
         rcu_read_unlock();
 }
 
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+static int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
+{
+        int ret;
+        u32 len;
+        char *secctx;
+
+        ret = security_secid_to_secctx(ct->secmark, &secctx, &len);
+        if (ret)
+                return 0;
+
+        ret = seq_printf(s, "secctx=%s ", secctx);
+
+        security_release_secctx(secctx, len);
+        return ret;
+}
+#else
+static inline int ct_show_secctx(struct seq_file *s, const struct nf_conn *ct)
+{
+        return 0;
+}
+#endif
+
 static int ct_seq_show(struct seq_file *s, void *v)
 {
         struct nf_conntrack_tuple_hash *hash = v;
@@ -148,10 +172,8 @@ static int ct_seq_show(struct seq_file *s, void *v)
                 goto release;
 #endif
 
-#ifdef CONFIG_NF_CONNTRACK_SECMARK
-        if (seq_printf(s, "secmark=%u ", ct->secmark))
+        if (ct_show_secctx(s, ct))
                 goto release;
-#endif
 
         if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
                 goto release;
@@ -336,12 +358,12 @@ static int ct_cpu_seq_show(struct seq_file *seq, void *v)
         const struct ip_conntrack_stat *st = v;
 
         if (v == SEQ_START_TOKEN) {
-                seq_printf(seq, "entries  searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error  expect_new expect_create expect_delete\n");
+                seq_printf(seq, "entries  searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error  expect_new expect_create expect_delete search_restart\n");
                 return 0;
         }
 
         seq_printf(seq, "%08x  %08x %08x %08x %08x %08x %08x %08x "
-                        "%08x %08x %08x %08x %08x  %08x %08x %08x \n",
+                        "%08x %08x %08x %08x %08x  %08x %08x %08x %08x\n",
                    nr_conntracks,
                    st->searched,
                    st->found,
@@ -358,7 +380,8 @@ static int ct_cpu_seq_show(struct seq_file *seq, void *v)
 
                    st->expect_new,
                    st->expect_create,
-                   st->expect_delete
+                   st->expect_delete,
+                   st->search_restart
                 );
         return 0;
 }
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index d71ba7677344..7404bde95994 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -18,6 +18,7 @@
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_log.h>
 
 static unsigned int nf_ct_icmp_timeout __read_mostly = 30*HZ;
@@ -54,8 +55,8 @@ static const u_int8_t invmap[] = {
 static bool icmp_invert_tuple(struct nf_conntrack_tuple *tuple,
                               const struct nf_conntrack_tuple *orig)
 {
-        if (orig->dst.u.icmp.type >= sizeof(invmap)
-            || !invmap[orig->dst.u.icmp.type])
+        if (orig->dst.u.icmp.type >= sizeof(invmap) ||
+            !invmap[orig->dst.u.icmp.type])
                 return false;
 
         tuple->src.u.icmp.id = orig->src.u.icmp.id;
@@ -101,8 +102,8 @@ static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
                 [ICMP_ADDRESS] = 1
         };
 
-        if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
-            || !valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
+        if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new) ||
+            !valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
                 /* Can't create a new ICMP `conn' with this. */
                 pr_debug("icmp: can't create new conn with type %u\n",
                          ct->tuplehash[0].tuple.dst.u.icmp.type);
@@ -114,13 +115,14 @@ static bool icmp_new(struct nf_conn *ct, const struct sk_buff *skb,
 
 /* Returns conntrack if it dealt with ICMP, and filled in skb fields */
 static int
-icmp_error_message(struct net *net, struct sk_buff *skb,
+icmp_error_message(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
                  enum ip_conntrack_info *ctinfo,
                  unsigned int hooknum)
 {
         struct nf_conntrack_tuple innertuple, origtuple;
         const struct nf_conntrack_l4proto *innerproto;
         const struct nf_conntrack_tuple_hash *h;
+        u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
 
         NF_CT_ASSERT(skb->nfct == NULL);
 
@@ -146,7 +148,7 @@ icmp_error_message(struct net *net, struct sk_buff *skb,
 
         *ctinfo = IP_CT_RELATED;
 
-        h = nf_conntrack_find_get(net, &innertuple);
+        h = nf_conntrack_find_get(net, zone, &innertuple);
         if (!h) {
                 pr_debug("icmp_error_message: no match\n");
                 return -NF_ACCEPT;
@@ -163,7 +165,8 @@ icmp_error_message(struct net *net, struct sk_buff *skb,
 
 /* Small and modified version of icmp_rcv */
 static int
-icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
+icmp_error(struct net *net, struct nf_conn *tmpl,
+           struct sk_buff *skb, unsigned int dataoff,
            enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)
 {
         const struct icmphdr *icmph;
@@ -201,14 +204,14 @@ icmp_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
         }
 
         /* Need to track icmp error message? */
-        if (icmph->type != ICMP_DEST_UNREACH
-            && icmph->type != ICMP_SOURCE_QUENCH
-            && icmph->type != ICMP_TIME_EXCEEDED
-            && icmph->type != ICMP_PARAMETERPROB
-            && icmph->type != ICMP_REDIRECT)
+        if (icmph->type != ICMP_DEST_UNREACH &&
+            icmph->type != ICMP_SOURCE_QUENCH &&
+            icmph->type != ICMP_TIME_EXCEEDED &&
+            icmph->type != ICMP_PARAMETERPROB &&
+            icmph->type != ICMP_REDIRECT)
                 return NF_ACCEPT;
 
-        return icmp_error_message(net, skb, ctinfo, hooknum);
+        return icmp_error_message(net, tmpl, skb, ctinfo, hooknum);
 }
 
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
@@ -238,17 +241,17 @@ static const struct nla_policy icmp_nla_policy[CTA_PROTO_MAX+1] = {
 static int icmp_nlattr_to_tuple(struct nlattr *tb[],
                                 struct nf_conntrack_tuple *tuple)
 {
-        if (!tb[CTA_PROTO_ICMP_TYPE]
-            || !tb[CTA_PROTO_ICMP_CODE]
-            || !tb[CTA_PROTO_ICMP_ID])
+        if (!tb[CTA_PROTO_ICMP_TYPE] ||
+            !tb[CTA_PROTO_ICMP_CODE] ||
+            !tb[CTA_PROTO_ICMP_ID])
                 return -EINVAL;
 
         tuple->dst.u.icmp.type = nla_get_u8(tb[CTA_PROTO_ICMP_TYPE]);
         tuple->dst.u.icmp.code = nla_get_u8(tb[CTA_PROTO_ICMP_CODE]);
         tuple->src.u.icmp.id = nla_get_be16(tb[CTA_PROTO_ICMP_ID]);
 
-        if (tuple->dst.u.icmp.type >= sizeof(invmap)
-            || !invmap[tuple->dst.u.icmp.type])
+        if (tuple->dst.u.icmp.type >= sizeof(invmap) ||
+            !invmap[tuple->dst.u.icmp.type])
                 return -EINVAL;
 
         return 0;
@@ -270,9 +273,7 @@ static struct ctl_table icmp_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name = 0
-        }
+        { }
 };
 #ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
 static struct ctl_table icmp_compat_sysctl_table[] = {
@@ -283,9 +284,7 @@ static struct ctl_table icmp_compat_sysctl_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
-        {
-                .ctl_name = 0
-        }
+        { }
 };
 #endif /* CONFIG_NF_CONNTRACK_PROC_COMPAT */
 #endif /* CONFIG_SYSCTL */
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index fa2d6b6fc3e5..f3a9b42b16c6 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -14,8 +14,13 @@
 #include <net/route.h>
 #include <net/ip.h>
 
+#include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv4.h>
 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#include <net/netfilter/nf_conntrack.h>
+#endif
+#include <net/netfilter/nf_conntrack_zones.h>
 
 /* Returns new sk_buff, or NULL */
 static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
@@ -34,26 +39,52 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
         return err;
 }
 
+static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
+                                              struct sk_buff *skb)
+{
+        u16 zone = NF_CT_DEFAULT_ZONE;
+
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+        if (skb->nfct)
+                zone = nf_ct_zone((struct nf_conn *)skb->nfct);
+#endif
+
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge &&
+            skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
+                return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone;
+#endif
+        if (hooknum == NF_INET_PRE_ROUTING)
+                return IP_DEFRAG_CONNTRACK_IN + zone;
+        else
+                return IP_DEFRAG_CONNTRACK_OUT + zone;
+}
+
 static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
                                           struct sk_buff *skb,
                                           const struct net_device *in,
                                           const struct net_device *out,
                                           int (*okfn)(struct sk_buff *))
 {
+        struct sock *sk = skb->sk;
+        struct inet_sock *inet = inet_sk(skb->sk);
+
+        if (sk && (sk->sk_family == PF_INET) &&
+            inet->nodefrag)
+                return NF_ACCEPT;
+
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 #if !defined(CONFIG_NF_NAT) && !defined(CONFIG_NF_NAT_MODULE)
         /* Previously seen (loopback)?  Ignore.  Do this before
            fragment check. */
-        if (skb->nfct)
+        if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
                 return NF_ACCEPT;
 #endif
 #endif
         /* Gather fragments. */
         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                if (nf_ct_ipv4_gather_frags(skb,
-                                            hooknum == NF_INET_PRE_ROUTING ?
-                                            IP_DEFRAG_CONNTRACK_IN :
-                                            IP_DEFRAG_CONNTRACK_OUT))
+                enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb);
+                if (nf_ct_ipv4_gather_frags(skb, user))
                         return NF_STOLEN;
         }
         return NF_ACCEPT;
diff --git a/net/ipv4/netfilter/nf_nat_amanda.c b/net/ipv4/netfilter/nf_nat_amanda.c
index c31b87668250..0f23b3f06df0 100644
--- a/net/ipv4/netfilter/nf_nat_amanda.c
+++ b/net/ipv4/netfilter/nf_nat_amanda.c
@@ -44,9 +44,16 @@ static unsigned int help(struct sk_buff *skb,
 
         /* Try to get same port: if not, try to change it. */
         for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        port = 0;
                         break;
+                }
         }
 
         if (port == 0)
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 3229e0a81ba6..c04787ce1a71 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -12,6 +12,7 @@
 #include <linux/types.h>
 #include <linux/timer.h>
 #include <linux/skbuff.h>
+#include <linux/gfp.h>
 #include <net/checksum.h>
 #include <net/icmp.h>
 #include <net/ip.h>
@@ -30,16 +31,14 @@
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 
 static DEFINE_SPINLOCK(nf_nat_lock);
 
 static struct nf_conntrack_l3proto *l3proto __read_mostly;
 
-/* Calculated at init based on memory size */
-static unsigned int nf_nat_htable_size __read_mostly;
-
 #define MAX_IP_NAT_PROTO 256
-static const struct nf_nat_protocol *nf_nat_protos[MAX_IP_NAT_PROTO]
+static const struct nf_nat_protocol __rcu *nf_nat_protos[MAX_IP_NAT_PROTO]
                                                 __read_mostly;
 
 static inline const struct nf_nat_protocol *
@@ -48,39 +47,18 @@ __nf_nat_proto_find(u_int8_t protonum)
         return rcu_dereference(nf_nat_protos[protonum]);
 }
 
-const struct nf_nat_protocol *
-nf_nat_proto_find_get(u_int8_t protonum)
-{
-        const struct nf_nat_protocol *p;
-
-        rcu_read_lock();
-        p = __nf_nat_proto_find(protonum);
-        if (!try_module_get(p->me))
-                p = &nf_nat_unknown_protocol;
-        rcu_read_unlock();
-
-        return p;
-}
-EXPORT_SYMBOL_GPL(nf_nat_proto_find_get);
-
-void
-nf_nat_proto_put(const struct nf_nat_protocol *p)
-{
-        module_put(p->me);
-}
-EXPORT_SYMBOL_GPL(nf_nat_proto_put);
-
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
-hash_by_src(const struct nf_conntrack_tuple *tuple)
+hash_by_src(const struct net *net, u16 zone,
+            const struct nf_conntrack_tuple *tuple)
 {
         unsigned int hash;
 
         /* Original src, to ensure we map it consistently if poss. */
         hash = jhash_3words((__force u32)tuple->src.u3.ip,
-                            (__force u32)tuple->src.u.all,
+                            (__force u32)tuple->src.u.all ^ zone,
                             tuple->dst.protonum, 0);
-        return ((u64)hash * nf_nat_htable_size) >> 32;
+        return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
 }
 
 /* Is this tuple already taken? (not by us) */
@@ -142,12 +120,12 @@ same_src(const struct nf_conn *ct,
 
 /* Only called for SRC manip */
 static int
-find_appropriate_src(struct net *net,
+find_appropriate_src(struct net *net, u16 zone,
                      const struct nf_conntrack_tuple *tuple,
                      struct nf_conntrack_tuple *result,
                      const struct nf_nat_range *range)
 {
-        unsigned int h = hash_by_src(tuple);
+        unsigned int h = hash_by_src(net, zone, tuple);
         const struct nf_conn_nat *nat;
         const struct nf_conn *ct;
         const struct hlist_node *n;
@@ -155,7 +133,7 @@ find_appropriate_src(struct net *net,
         rcu_read_lock();
         hlist_for_each_entry_rcu(nat, n, &net->ipv4.nat_bysource[h], bysource) {
                 ct = nat->ct;
-                if (same_src(ct, tuple)) {
+                if (same_src(ct, tuple) && nf_ct_zone(ct) == zone) {
                         /* Copy source part from reply tuple. */
                         nf_ct_invert_tuplepr(result,
                                        &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
@@ -178,7 +156,7 @@ find_appropriate_src(struct net *net,
    the ip with the lowest src-ip/dst-ip/proto usage.
 */
 static void
-find_best_ips_proto(struct nf_conntrack_tuple *tuple,
+find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
                     const struct nf_nat_range *range,
                     const struct nf_conn *ct,
                     enum nf_nat_manip_type maniptype)
@@ -212,7 +190,7 @@ find_best_ips_proto(struct nf_conntrack_tuple *tuple,
         maxip = ntohl(range->max_ip);
         j = jhash_2words((__force u32)tuple->src.u3.ip,
                          range->flags & IP_NAT_RANGE_PERSISTENT ?
-                                (__force u32)tuple->dst.u3.ip : 0, 0);
+                                0 : (__force u32)tuple->dst.u3.ip ^ zone, 0);
         j = ((u64)j * (maxip - minip + 1)) >> 32;
         *var_ipp = htonl(minip + j);
 }
@@ -232,6 +210,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
 {
         struct net *net = nf_ct_net(ct);
         const struct nf_nat_protocol *proto;
+        u16 zone = nf_ct_zone(ct);
 
         /* 1) If this srcip/proto/src-proto-part is currently mapped,
            and that same mapping gives a unique tuple within the given
@@ -242,7 +221,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
            manips not an issue.  */
         if (maniptype == IP_NAT_MANIP_SRC &&
             !(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) {
-                if (find_appropriate_src(net, orig_tuple, tuple, range)) {
+                if (find_appropriate_src(net, zone, orig_tuple, tuple, range)) {
                         pr_debug("get_unique_tuple: Found current src map\n");
                         if (!nf_nat_used_tuple(tuple, ct))
                                 return;
@@ -252,7 +231,7 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
         /* 2) Select the least-used IP/proto combination in the given
            range. */
         *tuple = *orig_tuple;
-        find_best_ips_proto(tuple, range, ct, maniptype);
+        find_best_ips_proto(zone, tuple, range, ct, maniptype);
 
         /* 3) The per-protocol part of the manip is made to map into
            the range to make a unique tuple. */
@@ -260,17 +239,18 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
         rcu_read_lock();
         proto = __nf_nat_proto_find(orig_tuple->dst.protonum);
 
-        /* Change protocol info to have some randomization */
-        if (range->flags & IP_NAT_RANGE_PROTO_RANDOM) {
-                proto->unique_tuple(tuple, range, maniptype, ct);
-                goto out;
-        }
-
         /* Only bother mapping if it's not already in range and unique */
-        if ((!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED) ||
-             proto->in_range(tuple, maniptype, &range->min, &range->max)) &&
-            !nf_nat_used_tuple(tuple, ct))
-                goto out;
+        if (!(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) {
+                if (range->flags & IP_NAT_RANGE_PROTO_SPECIFIED) {
+                        if (proto->in_range(tuple, maniptype, &range->min,
+                                            &range->max) &&
+                            (range->min.all == range->max.all ||
+                             !nf_nat_used_tuple(tuple, ct)))
+                                goto out;
+                } else if (!nf_nat_used_tuple(tuple, ct)) {
+                        goto out;
+                }
+        }
 
         /* Last change: get protocol to try to obtain unique tuple. */
         proto->unique_tuple(tuple, range, maniptype, ct);
@@ -330,7 +310,8 @@ nf_nat_setup_info(struct nf_conn *ct,
         if (have_to_hash) {
                 unsigned int srchash;
 
-                srchash = hash_by_src(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+                srchash = hash_by_src(net, nf_ct_zone(ct),
+                                      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
                 spin_lock_bh(&nf_nat_lock);
                 /* nf_conntrack_alter_reply might re-allocate exntension aera */
                 nat = nfct_nat(ct);
@@ -438,7 +419,7 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
         if (!skb_make_writable(skb, hdrlen + sizeof(*inside)))
                 return 0;
 
-        inside = (void *)skb->data + ip_hdrlen(skb);
+        inside = (void *)skb->data + hdrlen;
 
         /* We're actually going to mangle it beyond trivial checksum
            adjustment, so make sure the current checksum is correct. */
@@ -461,6 +442,18 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
                         return 0;
         }
 
+        if (manip == IP_NAT_MANIP_SRC)
+                statusbit = IPS_SRC_NAT;
+        else
+                statusbit = IPS_DST_NAT;
+
+        /* Invert if this is reply dir. */
+        if (dir == IP_CT_DIR_REPLY)
+                statusbit ^= IPS_NAT_MASK;
+
+        if (!(ct->status & statusbit))
+                return 1;
+
         pr_debug("icmp_reply_translation: translating error %p manip %u "
                  "dir %s\n", skb, manip,
                  dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY");
@@ -468,12 +461,10 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
         /* rcu_read_lock()ed by nf_hook_slow */
         l4proto = __nf_ct_l4proto_find(PF_INET, inside->ip.protocol);
 
-        if (!nf_ct_get_tuple(skb,
-                             ip_hdrlen(skb) + sizeof(struct icmphdr),
-                             (ip_hdrlen(skb) +
+        if (!nf_ct_get_tuple(skb, hdrlen + sizeof(struct icmphdr),
+                             (hdrlen +
                               sizeof(struct icmphdr) + inside->ip.ihl * 4),
-                             (u_int16_t)AF_INET,
-                             inside->ip.protocol,
+                             (u_int16_t)AF_INET, inside->ip.protocol,
                              &inner, l3proto, l4proto))
                 return 0;
 
@@ -482,15 +473,13 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
            pass all hooks (locally-generated ICMP).  Consider incoming
            packet: PREROUTING (DST manip), routing produces ICMP, goes
            through POSTROUTING (which must correct the DST manip). */
-        if (!manip_pkt(inside->ip.protocol, skb,
-                       ip_hdrlen(skb) + sizeof(inside->icmp),
-                       &ct->tuplehash[!dir].tuple,
-                       !manip))
+        if (!manip_pkt(inside->ip.protocol, skb, hdrlen + sizeof(inside->icmp),
+                       &ct->tuplehash[!dir].tuple, !manip))
                 return 0;
 
         if (skb->ip_summed != CHECKSUM_PARTIAL) {
                 /* Reloading "inside" here since manip_pkt inner. */
-                inside = (void *)skb->data + ip_hdrlen(skb);
+                inside = (void *)skb->data + hdrlen;
                 inside->icmp.checksum = 0;
                 inside->icmp.checksum =
                         csum_fold(skb_checksum(skb, hdrlen,
@@ -499,20 +488,9 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
 
         /* Change outer to look the reply to an incoming packet
          * (proto 0 means don't invert per-proto part). */
-        if (manip == IP_NAT_MANIP_SRC)
-                statusbit = IPS_SRC_NAT;
-        else
-                statusbit = IPS_DST_NAT;
-
-        /* Invert if this is reply dir. */
-        if (dir == IP_CT_DIR_REPLY)
-                statusbit ^= IPS_NAT_MASK;
-
-        if (ct->status & statusbit) {
-                nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
-                if (!manip_pkt(0, skb, 0, &target, manip))
-                        return 0;
-        }
+        nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
+        if (!manip_pkt(0, skb, 0, &target, manip))
+                return 0;
 
         return 1;
 }
@@ -590,6 +568,26 @@ static struct nf_ct_ext_type nat_extend __read_mostly = {
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 
+static const struct nf_nat_protocol *
+nf_nat_proto_find_get(u_int8_t protonum)
+{
+        const struct nf_nat_protocol *p;
+
+        rcu_read_lock();
+        p = __nf_nat_proto_find(protonum);
+        if (!try_module_get(p->me))
+                p = &nf_nat_unknown_protocol;
+        rcu_read_unlock();
+
+        return p;
+}
+
+static void
+nf_nat_proto_put(const struct nf_nat_protocol *p)
+{
+        module_put(p->me);
+}
+
 static const struct nla_policy protonat_nla_policy[CTA_PROTONAT_MAX+1] = {
         [CTA_PROTONAT_PORT_MIN] = { .type = NLA_U16 },
         [CTA_PROTONAT_PORT_MAX] = { .type = NLA_U16 },
@@ -620,7 +618,7 @@ static const struct nla_policy nat_nla_policy[CTA_NAT_MAX+1] = {
 };
 
 static int
-nfnetlink_parse_nat(struct nlattr *nat,
+nfnetlink_parse_nat(const struct nlattr *nat,
                     const struct nf_conn *ct, struct nf_nat_range *range)
 {
         struct nlattr *tb[CTA_NAT_MAX+1];
@@ -656,7 +654,7 @@ nfnetlink_parse_nat(struct nlattr *nat,
 static int
 nfnetlink_parse_nat_setup(struct nf_conn *ct,
                           enum nf_nat_manip_type manip,
-                          struct nlattr *attr)
+                          const struct nlattr *attr)
 {
         struct nf_nat_range range;
 
@@ -671,7 +669,7 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
 static int
 nfnetlink_parse_nat_setup(struct nf_conn *ct,
                           enum nf_nat_manip_type manip,
-                          struct nlattr *attr)
+                          const struct nlattr *attr)
 {
         return -EOPNOTSUPP;
 }
@@ -679,8 +677,10 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
 
 static int __net_init nf_nat_net_init(struct net *net)
 {
-        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size,
-                                                      &net->ipv4.nat_vmalloced, 0);
+        /* Leave them the same for the moment. */
+        net->ipv4.nat_htable_size = net->ct.htable_size;
+        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&net->ipv4.nat_htable_size,
+                                                       &net->ipv4.nat_vmalloced, 0);
         if (!net->ipv4.nat_bysource)
                 return -ENOMEM;
         return 0;
@@ -703,7 +703,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
         nf_ct_iterate_cleanup(net, &clean_nat, NULL);
         synchronize_rcu();
         nf_ct_free_hashtable(net->ipv4.nat_bysource, net->ipv4.nat_vmalloced,
-                             nf_nat_htable_size);
+                             net->ipv4.nat_htable_size);
 }
 
 static struct pernet_operations nf_nat_net_ops = {
@@ -724,9 +724,6 @@ static int __init nf_nat_init(void)
                 return ret;
         }
 
-        /* Leave them the same for the moment. */
-        nf_nat_htable_size = nf_conntrack_htable_size;
-
         ret = register_pernet_subsys(&nf_nat_net_ops);
         if (ret < 0)
                 goto cleanup_extend;
@@ -741,7 +738,7 @@ static int __init nf_nat_init(void)
         spin_unlock_bh(&nf_nat_lock);
 
         /* Initialize fake conntrack so that NAT will skip it */
-        nf_conntrack_untracked.status |= IPS_NAT_DONE_MASK;
+        nf_ct_untracked_status_or(IPS_NAT_DONE_MASK);
 
         l3proto = nf_ct_l3proto_find_get((u_int16_t)AF_INET);
 
@@ -750,6 +747,8 @@ static int __init nf_nat_init(void)
         BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
         rcu_assign_pointer(nfnetlink_parse_nat_setup_hook,
                            nfnetlink_parse_nat_setup);
+        BUG_ON(nf_ct_nat_offset != NULL);
+        rcu_assign_pointer(nf_ct_nat_offset, nf_nat_get_offset);
         return 0;
 
  cleanup_extend:
@@ -764,6 +763,7 @@ static void __exit nf_nat_cleanup(void)
         nf_ct_extend_unregister(&nat_extend);
         rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL);
         rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, NULL);
+        rcu_assign_pointer(nf_ct_nat_offset, NULL);
         synchronize_net();
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_ftp.c b/net/ipv4/netfilter/nf_nat_ftp.c
index a1d5d58a58bf..dc73abb3fe27 100644
--- a/net/ipv4/netfilter/nf_nat_ftp.c
+++ b/net/ipv4/netfilter/nf_nat_ftp.c
@@ -27,76 +27,29 @@ MODULE_ALIAS("ip_nat_ftp");
 
 /* FIXME: Time out? --RR */
 
-static int
-mangle_rfc959_packet(struct sk_buff *skb,
-                     __be32 newip,
-                     u_int16_t port,
-                     unsigned int matchoff,
-                     unsigned int matchlen,
-                     struct nf_conn *ct,
-                     enum ip_conntrack_info ctinfo)
+static int nf_nat_ftp_fmt_cmd(enum nf_ct_ftp_type type,
+                              char *buffer, size_t buflen,
+                              __be32 addr, u16 port)
 {
-        char buffer[sizeof("nnn,nnn,nnn,nnn,nnn,nnn")];
-
-        sprintf(buffer, "%u,%u,%u,%u,%u,%u",
-                NIPQUAD(newip), port>>8, port&0xFF);
-
-        pr_debug("calling nf_nat_mangle_tcp_packet\n");
-
-        return nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
-                                        matchlen, buffer, strlen(buffer));
-}
-
-/* |1|132.235.1.2|6275| */
-static int
-mangle_eprt_packet(struct sk_buff *skb,
-                   __be32 newip,
-                   u_int16_t port,
-                   unsigned int matchoff,
-                   unsigned int matchlen,
-                   struct nf_conn *ct,
-                   enum ip_conntrack_info ctinfo)
-{
-        char buffer[sizeof("|1|255.255.255.255|65535|")];
-
-        sprintf(buffer, "|1|%u.%u.%u.%u|%u|", NIPQUAD(newip), port);
-
-        pr_debug("calling nf_nat_mangle_tcp_packet\n");
-
-        return nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
-                                        matchlen, buffer, strlen(buffer));
-}
-
-/* |1|132.235.1.2|6275| */
-static int
-mangle_epsv_packet(struct sk_buff *skb,
-                   __be32 newip,
-                   u_int16_t port,
-                   unsigned int matchoff,
-                   unsigned int matchlen,
-                   struct nf_conn *ct,
-                   enum ip_conntrack_info ctinfo)
-{
-        char buffer[sizeof("|||65535|")];
-
-        sprintf(buffer, "|||%u|", port);
-
-        pr_debug("calling nf_nat_mangle_tcp_packet\n");
+        switch (type) {
+        case NF_CT_FTP_PORT:
+        case NF_CT_FTP_PASV:
+                return snprintf(buffer, buflen, "%u,%u,%u,%u,%u,%u",
+                                ((unsigned char *)&addr)[0],
+                                ((unsigned char *)&addr)[1],
+                                ((unsigned char *)&addr)[2],
+                                ((unsigned char *)&addr)[3],
+                                port >> 8,
+                                port & 0xFF);
+        case NF_CT_FTP_EPRT:
+                return snprintf(buffer, buflen, "|1|%pI4|%u|", &addr, port);
+        case NF_CT_FTP_EPSV:
+                return snprintf(buffer, buflen, "|||%u|", port);
+        }
 
-        return nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
-                                        matchlen, buffer, strlen(buffer));
+        return 0;
 }
 
-static int (*mangle[])(struct sk_buff *, __be32, u_int16_t,
-                       unsigned int, unsigned int, struct nf_conn *,
-                       enum ip_conntrack_info)
-= {
-        [NF_CT_FTP_PORT] = mangle_rfc959_packet,
-        [NF_CT_FTP_PASV] = mangle_rfc959_packet,
-        [NF_CT_FTP_EPRT] = mangle_eprt_packet,
-        [NF_CT_FTP_EPSV] = mangle_epsv_packet
-};
-
 /* So, this packet has hit the connection tracking matching code.
    Mangle it, and change the expectation to match the new version. */
 static unsigned int nf_nat_ftp(struct sk_buff *skb,
@@ -110,6 +63,8 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
         u_int16_t port;
         int dir = CTINFO2DIR(ctinfo);
         struct nf_conn *ct = exp->master;
+        char buffer[sizeof("|1|255.255.255.255|65535|")];
+        unsigned int buflen;
 
         pr_debug("FTP_NAT: type %i, off %u len %u\n", type, matchoff, matchlen);
 
@@ -124,19 +79,36 @@ static unsigned int nf_nat_ftp(struct sk_buff *skb,
 
         /* Try to get same port: if not, try to change it. */
         for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        port = 0;
                         break;
+                }
         }
 
         if (port == 0)
                 return NF_DROP;
 
-        if (!mangle[type](skb, newip, port, matchoff, matchlen, ct, ctinfo)) {
-                nf_ct_unexpect_related(exp);
-                return NF_DROP;
-        }
+        buflen = nf_nat_ftp_fmt_cmd(type, buffer, sizeof(buffer), newip, port);
+        if (!buflen)
+                goto out;
+
+        pr_debug("calling nf_nat_mangle_tcp_packet\n");
+
+        if (!nf_nat_mangle_tcp_packet(skb, ct, ctinfo, matchoff,
+                                      matchlen, buffer, buflen))
+                goto out;
+
         return NF_ACCEPT;
+
+out:
+        nf_ct_unexpect_related(exp);
+        return NF_DROP;
 }
 
 static void __exit nf_nat_ftp_fini(void)
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index 7e8e6fc75413..790f3160e012 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/moduleparam.h>
 #include <linux/tcp.h>
 #include <net/tcp.h>
 
@@ -44,7 +43,7 @@ static int set_addr(struct sk_buff *skb,
                                               addroff, sizeof(buf),
                                               (char *) &buf, sizeof(buf))) {
                         if (net_ratelimit())
-                                printk("nf_nat_h323: nf_nat_mangle_tcp_packet"
+                                pr_notice("nf_nat_h323: nf_nat_mangle_tcp_packet"
                                        " error\n");
                         return -1;
                 }
@@ -60,7 +59,7 @@ static int set_addr(struct sk_buff *skb,
                                               addroff, sizeof(buf),
                                               (char *) &buf, sizeof(buf))) {
                         if (net_ratelimit())
-                                printk("nf_nat_h323: nf_nat_mangle_udp_packet"
+                                pr_notice("nf_nat_h323: nf_nat_mangle_udp_packet"
                                        " error\n");
                         return -1;
                 }
@@ -216,26 +215,37 @@ static int nat_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
         /* Run out of expectations */
         if (i >= H323_RTP_CHANNEL_MAX) {
                 if (net_ratelimit())
-                        printk("nf_nat_h323: out of expectations\n");
+                        pr_notice("nf_nat_h323: out of expectations\n");
                 return 0;
         }
 
         /* Try to get a pair of ports. */
         for (nated_port = ntohs(rtp_exp->tuple.dst.u.udp.port);
              nated_port != 0; nated_port += 2) {
+                int ret;
+
                 rtp_exp->tuple.dst.u.udp.port = htons(nated_port);
-                if (nf_ct_expect_related(rtp_exp) == 0) {
+                ret = nf_ct_expect_related(rtp_exp);
+                if (ret == 0) {
                         rtcp_exp->tuple.dst.u.udp.port =
                             htons(nated_port + 1);
-                        if (nf_ct_expect_related(rtcp_exp) == 0)
+                        ret = nf_ct_expect_related(rtcp_exp);
+                        if (ret == 0)
+                                break;
+                        else if (ret != -EBUSY) {
+                                nf_ct_unexpect_related(rtp_exp);
+                                nated_port = 0;
                                 break;
-                        nf_ct_unexpect_related(rtp_exp);
+                        }
+                } else if (ret != -EBUSY) {
+                        nated_port = 0;
+                        break;
                 }
         }
 
         if (nated_port == 0) {  /* No port available */
                 if (net_ratelimit())
-                        printk("nf_nat_h323: out of RTP ports\n");
+                        pr_notice("nf_nat_h323: out of RTP ports\n");
                 return 0;
         }
 
@@ -285,14 +295,21 @@ static int nat_t120(struct sk_buff *skb, struct nf_conn *ct,
 
         /* Try to get same port: if not, try to change it. */
         for (; nated_port != 0; nated_port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(nated_port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        nated_port = 0;
                         break;
+                }
         }
 
         if (nated_port == 0) {  /* No port available */
                 if (net_ratelimit())
-                        printk("nf_nat_h323: out of TCP ports\n");
+                        pr_notice("nf_nat_h323: out of TCP ports\n");
                 return 0;
         }
 
@@ -335,14 +352,21 @@ static int nat_h245(struct sk_buff *skb, struct nf_conn *ct,
 
         /* Try to get same port: if not, try to change it. */
         for (; nated_port != 0; nated_port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(nated_port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
                         break;
+                else if (ret != -EBUSY) {
+                        nated_port = 0;
+                        break;
+                }
         }
 
         if (nated_port == 0) {  /* No port available */
                 if (net_ratelimit())
-                        printk("nf_nat_q931: out of TCP ports\n");
+                        pr_notice("nf_nat_q931: out of TCP ports\n");
                 return 0;
         }
 
@@ -419,14 +443,21 @@ static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
 
         /* Try to get same port: if not, try to change it. */
         for (; nated_port != 0; nated_port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(nated_port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        nated_port = 0;
                         break;
+                }
         }
 
         if (nated_port == 0) {  /* No port available */
                 if (net_ratelimit())
-                        printk("nf_nat_ras: out of TCP ports\n");
+                        pr_notice("nf_nat_ras: out of TCP ports\n");
                 return 0;
         }
 
@@ -501,14 +532,21 @@ static int nat_callforwarding(struct sk_buff *skb, struct nf_conn *ct,
 
         /* Try to get same port: if not, try to change it. */
         for (nated_port = ntohs(port); nated_port != 0; nated_port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(nated_port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
                         break;
+                else if (ret != -EBUSY) {
+                        nated_port = 0;
+                        break;
+                }
         }
 
         if (nated_port == 0) {  /* No port available */
                 if (net_ratelimit())
-                        printk("nf_nat_q931: out of TCP ports\n");
+                        pr_notice("nf_nat_q931: out of TCP ports\n");
                 return 0;
         }
 
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 155c008626c8..31427fb57aa8 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -8,6 +8,7 @@
  * published by the Free Software Foundation.
  */
 #include <linux/module.h>
+#include <linux/gfp.h>
 #include <linux/kmod.h>
 #include <linux/types.h>
 #include <linux/timer.h>
@@ -41,18 +42,14 @@ adjust_tcp_sequence(u32 seq,
                     struct nf_conn *ct,
                     enum ip_conntrack_info ctinfo)
 {
-        int dir;
-        struct nf_nat_seq *this_way, *other_way;
+        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         struct nf_conn_nat *nat = nfct_nat(ct);
+        struct nf_nat_seq *this_way = &nat->seq[dir];
 
-        pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n", seq, seq);
-
-        dir = CTINFO2DIR(ctinfo);
-
-        this_way = &nat->seq[dir];
-        other_way = &nat->seq[!dir];
+        pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n",
+                 seq, sizediff);
 
-        pr_debug("nf_nat_resize_packet: Seq_offset before: ");
+        pr_debug("adjust_tcp_sequence: Seq_offset before: ");
         DUMP_OFFSET(this_way);
 
         spin_lock_bh(&nf_nat_seqofs_lock);
@@ -63,16 +60,38 @@ adjust_tcp_sequence(u32 seq,
          * retransmit */
         if (this_way->offset_before == this_way->offset_after ||
             before(this_way->correction_pos, seq)) {
-                   this_way->correction_pos = seq;
-                   this_way->offset_before = this_way->offset_after;
-                   this_way->offset_after += sizediff;
+                this_way->correction_pos = seq;
+                this_way->offset_before = this_way->offset_after;
+                this_way->offset_after += sizediff;
         }
         spin_unlock_bh(&nf_nat_seqofs_lock);
 
-        pr_debug("nf_nat_resize_packet: Seq_offset after: ");
+        pr_debug("adjust_tcp_sequence: Seq_offset after: ");
         DUMP_OFFSET(this_way);
 }
 
+/* Get the offset value, for conntrack */
+s16 nf_nat_get_offset(const struct nf_conn *ct,
+                      enum ip_conntrack_dir dir,
+                      u32 seq)
+{
+        struct nf_conn_nat *nat = nfct_nat(ct);
+        struct nf_nat_seq *this_way;
+        s16 offset;
+
+        if (!nat)
+                return 0;
+
+        this_way = &nat->seq[dir];
+        spin_lock_bh(&nf_nat_seqofs_lock);
+        offset = after(seq, this_way->correction_pos)
+                 ? this_way->offset_after : this_way->offset_before;
+        spin_unlock_bh(&nf_nat_seqofs_lock);
+
+        return offset;
+}
+EXPORT_SYMBOL_GPL(nf_nat_get_offset);
+
 /* Frobs data inside this packet, which is linear. */
 static void mangle_contents(struct sk_buff *skb,
                             unsigned int dataoff,
@@ -123,6 +142,46 @@ static int enlarge_skb(struct sk_buff *skb, unsigned int extra)
         return 1;
 }
 
+void nf_nat_set_seq_adjust(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
+                           __be32 seq, s16 off)
+{
+        if (!off)
+                return;
+        set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
+        adjust_tcp_sequence(ntohl(seq), off, ct, ctinfo);
+        nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
+}
+EXPORT_SYMBOL_GPL(nf_nat_set_seq_adjust);
+
+static void nf_nat_csum(struct sk_buff *skb, struct iphdr *iph, void *data,
+                        int datalen, __sum16 *check, int oldlen)
+{
+        struct rtable *rt = skb_rtable(skb);
+
+        if (skb->ip_summed != CHECKSUM_PARTIAL) {
+                if (!(rt->rt_flags & RTCF_LOCAL) &&
+                    skb->dev->features & NETIF_F_V4_CSUM) {
+                        skb->ip_summed = CHECKSUM_PARTIAL;
+                        skb->csum_start = skb_headroom(skb) +
+                                          skb_network_offset(skb) +
+                                          iph->ihl * 4;
+                        skb->csum_offset = (void *)check - data;
+                        *check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                                    datalen, iph->protocol, 0);
+                } else {
+                        *check = 0;
+                        *check = csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                                   datalen, iph->protocol,
+                                                   csum_partial(data, datalen,
+                                                                0));
+                        if (iph->protocol == IPPROTO_UDP && !*check)
+                                *check = CSUM_MANGLED_0;
+                }
+        } else
+                inet_proto_csum_replace2(check, skb,
+                                         htons(oldlen), htons(datalen), 1);
+}
+
 /* Generic function for mangling variable-length address changes inside
  * NATed TCP connections (like the PORT XXX,XXX,XXX,XXX,XXX,XXX
  * command in FTP).
@@ -131,16 +190,14 @@ static int enlarge_skb(struct sk_buff *skb, unsigned int extra)
  * skb enlargement, ...
  *
  * */
-int
-nf_nat_mangle_tcp_packet(struct sk_buff *skb,
-                         struct nf_conn *ct,
-                         enum ip_conntrack_info ctinfo,
-                         unsigned int match_offset,
-                         unsigned int match_len,
-                         const char *rep_buffer,
-                         unsigned int rep_len)
+int __nf_nat_mangle_tcp_packet(struct sk_buff *skb,
+                               struct nf_conn *ct,
+                               enum ip_conntrack_info ctinfo,
+                               unsigned int match_offset,
+                               unsigned int match_len,
+                               const char *rep_buffer,
+                               unsigned int rep_len, bool adjust)
 {
-        struct rtable *rt = skb_rtable(skb);
         struct iphdr *iph;
         struct tcphdr *tcph;
         int oldlen, datalen;
@@ -163,41 +220,15 @@ nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                         match_offset, match_len, rep_buffer, rep_len);
 
         datalen = skb->len - iph->ihl*4;
-        if (skb->ip_summed != CHECKSUM_PARTIAL) {
-                if (!(rt->rt_flags & RTCF_LOCAL) &&
-                    skb->dev->features & NETIF_F_V4_CSUM) {
-                        skb->ip_summed = CHECKSUM_PARTIAL;
-                        skb->csum_start = skb_headroom(skb) +
-                                          skb_network_offset(skb) +
-                                          iph->ihl * 4;
-                        skb->csum_offset = offsetof(struct tcphdr, check);
-                        tcph->check = ~tcp_v4_check(datalen,
-                                                    iph->saddr, iph->daddr, 0);
-                } else {
-                        tcph->check = 0;
-                        tcph->check = tcp_v4_check(datalen,
-                                                   iph->saddr, iph->daddr,
-                                                   csum_partial(tcph,
-                                                                datalen, 0));
-                }
-        } else
-                inet_proto_csum_replace2(&tcph->check, skb,
-                                         htons(oldlen), htons(datalen), 1);
+        nf_nat_csum(skb, iph, tcph, datalen, &tcph->check, oldlen);
 
-        if (rep_len != match_len) {
-                set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
-                adjust_tcp_sequence(ntohl(tcph->seq),
-                                    (int)rep_len - (int)match_len,
-                                    ct, ctinfo);
-                /* Tell TCP window tracking about seq change */
-                nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
-                                        ct, CTINFO2DIR(ctinfo));
+        if (adjust && rep_len != match_len)
+                nf_nat_set_seq_adjust(ct, ctinfo, tcph->seq,
+                                      (int)rep_len - (int)match_len);
 
-                nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
-        }
         return 1;
 }
-EXPORT_SYMBOL(nf_nat_mangle_tcp_packet);
+EXPORT_SYMBOL(__nf_nat_mangle_tcp_packet);
 
 /* Generic function for mangling variable-length address changes inside
  * NATed UDP connections (like the CONNECT DATA XXXXX MESG XXXXX INDEX XXXXX
@@ -218,7 +249,6 @@ nf_nat_mangle_udp_packet(struct sk_buff *skb,
                          const char *rep_buffer,
                          unsigned int rep_len)
 {
-        struct rtable *rt = skb_rtable(skb);
         struct iphdr *iph;
         struct udphdr *udph;
         int datalen, oldlen;
@@ -252,29 +282,7 @@ nf_nat_mangle_udp_packet(struct sk_buff *skb,
         if (!udph->check && skb->ip_summed != CHECKSUM_PARTIAL)
                 return 1;
 
-        if (skb->ip_summed != CHECKSUM_PARTIAL) {
-                if (!(rt->rt_flags & RTCF_LOCAL) &&
-                    skb->dev->features & NETIF_F_V4_CSUM) {
-                        skb->ip_summed = CHECKSUM_PARTIAL;
-                        skb->csum_start = skb_headroom(skb) +
-                                          skb_network_offset(skb) +
-                                          iph->ihl * 4;
-                        skb->csum_offset = offsetof(struct udphdr, check);
-                        udph->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                         datalen, IPPROTO_UDP,
-                                                         0);
-                } else {
-                        udph->check = 0;
-                        udph->check = csum_tcpudp_magic(iph->saddr, iph->daddr,
-                                                        datalen, IPPROTO_UDP,
-                                                        csum_partial(udph,
-                                                                     datalen, 0));
-                        if (!udph->check)
-                                udph->check = CSUM_MANGLED_0;
-                }
-        } else
-                inet_proto_csum_replace2(&udph->check, skb,
-                                         htons(oldlen), htons(datalen), 1);
+        nf_nat_csum(skb, iph, udph, datalen, &udph->check, oldlen);
 
         return 1;
 }
@@ -377,6 +385,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         struct tcphdr *tcph;
         int dir;
         __be32 newseq, newack;
+        s16 seqoff, ackoff;
         struct nf_conn_nat *nat = nfct_nat(ct);
         struct nf_nat_seq *this_way, *other_way;
 
@@ -390,15 +399,18 @@ nf_nat_seq_adjust(struct sk_buff *skb,
 
         tcph = (void *)skb->data + ip_hdrlen(skb);
         if (after(ntohl(tcph->seq), this_way->correction_pos))
-                newseq = htonl(ntohl(tcph->seq) + this_way->offset_after);
+                seqoff = this_way->offset_after;
         else
-                newseq = htonl(ntohl(tcph->seq) + this_way->offset_before);
+                seqoff = this_way->offset_before;
 
         if (after(ntohl(tcph->ack_seq) - other_way->offset_before,
                   other_way->correction_pos))
-                newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_after);
+                ackoff = other_way->offset_after;
         else
-                newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_before);
+                ackoff = other_way->offset_before;
+
+        newseq = htonl(ntohl(tcph->seq) + seqoff);
+        newack = htonl(ntohl(tcph->ack_seq) - ackoff);
 
         inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
         inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
@@ -410,12 +422,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         tcph->seq = newseq;
         tcph->ack_seq = newack;
 
-        if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
-                return 0;
-
-        nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir);
-
-        return 1;
+        return nf_nat_sack_adjust(skb, tcph, ct, ctinfo);
 }
 
 /* Setup NAT on this expected conntrack so it follows master. */
diff --git a/net/ipv4/netfilter/nf_nat_irc.c b/net/ipv4/netfilter/nf_nat_irc.c
index ea83a886b03e..535e1a802356 100644
--- a/net/ipv4/netfilter/nf_nat_irc.c
+++ b/net/ipv4/netfilter/nf_nat_irc.c
@@ -45,9 +45,16 @@ static unsigned int help(struct sk_buff *skb,
 
         /* Try to get same port: if not, try to change it. */
         for (port = ntohs(exp->saved_proto.tcp.port); port != 0; port++) {
+                int ret;
+
                 exp->tuple.dst.u.tcp.port = htons(port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
+                        break;
+                else if (ret != -EBUSY) {
+                        port = 0;
                         break;
+                }
         }
 
         if (port == 0)
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index 9eb171056c63..4c060038d29f 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -25,6 +25,7 @@
 #include <net/netfilter/nf_nat_rule.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <linux/netfilter/nf_conntrack_proto_gre.h>
 #include <linux/netfilter/nf_conntrack_pptp.h>
 
@@ -74,7 +75,7 @@ static void pptp_nat_expected(struct nf_conn *ct,
 
         pr_debug("trying to unexpect other dir: ");
         nf_ct_dump_tuple_ip(&t);
-        other_exp = nf_ct_expect_find_get(net, &t);
+        other_exp = nf_ct_expect_find_get(net, nf_ct_zone(ct), &t);
         if (other_exp) {
                 nf_ct_unexpect_related(other_exp);
                 nf_ct_expect_put(other_exp);
diff --git a/net/ipv4/netfilter/nf_nat_proto_common.c b/net/ipv4/netfilter/nf_nat_proto_common.c
index 6c4f11f51446..3e61faf23a9a 100644
--- a/net/ipv4/netfilter/nf_nat_proto_common.c
+++ b/net/ipv4/netfilter/nf_nat_proto_common.c
@@ -34,7 +34,7 @@ bool nf_nat_proto_in_range(const struct nf_conntrack_tuple *tuple,
 }
 EXPORT_SYMBOL_GPL(nf_nat_proto_in_range);
 
-bool nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
+void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
                                const struct nf_nat_range *range,
                                enum nf_nat_manip_type maniptype,
                                const struct nf_conn *ct,
@@ -53,7 +53,7 @@ bool nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
         if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {
                 /* If it's dst rewrite, can't change port */
                 if (maniptype == IP_NAT_MANIP_DST)
-                        return false;
+                        return;
 
                 if (ntohs(*portptr) < 1024) {
                         /* Loose convention: >> 512 is credential passing */
@@ -81,15 +81,15 @@ bool nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
         else
                 off = *rover;
 
-        for (i = 0; i < range_size; i++, off++) {
+        for (i = 0; ; ++off) {
                 *portptr = htons(min + off % range_size);
-                if (nf_nat_used_tuple(tuple, ct))
+                if (++i != range_size && nf_nat_used_tuple(tuple, ct))
                         continue;
                 if (!(range->flags & IP_NAT_RANGE_PROTO_RANDOM))
                         *rover = off;
-                return true;
+                return;
         }
-        return false;
+        return;
 }
 EXPORT_SYMBOL_GPL(nf_nat_proto_unique_tuple);
 
diff --git a/net/ipv4/netfilter/nf_nat_proto_dccp.c b/net/ipv4/netfilter/nf_nat_proto_dccp.c
index 22485ce306d4..570faf2667b2 100644
--- a/net/ipv4/netfilter/nf_nat_proto_dccp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_dccp.c
@@ -22,14 +22,14 @@
 
 static u_int16_t dccp_port_rover;
 
-static bool
+static void
 dccp_unique_tuple(struct nf_conntrack_tuple *tuple,
                   const struct nf_nat_range *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
-        return nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
-                                         &dccp_port_rover);
+        nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
+                                  &dccp_port_rover);
 }
 
 static bool
diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index d7e89201351e..bc8d83a31c73 100644
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -37,7 +37,7 @@ MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
 MODULE_DESCRIPTION("Netfilter NAT protocol helper module for GRE");
 
 /* generate unique tuple ... */
-static bool
+static void
 gre_unique_tuple(struct nf_conntrack_tuple *tuple,
                  const struct nf_nat_range *range,
                  enum nf_nat_manip_type maniptype,
@@ -50,7 +50,7 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
         /* If there is no master conntrack we are not PPTP,
            do not change tuples */
         if (!ct->master)
-                return false;
+                return;
 
         if (maniptype == IP_NAT_MANIP_SRC)
                 keyptr = &tuple->src.u.gre.key;
@@ -68,14 +68,14 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
 
         pr_debug("min = %u, range_size = %u\n", min, range_size);
 
-        for (i = 0; i < range_size; i++, key++) {
+        for (i = 0; ; ++key) {
                 *keyptr = htons(min + key % range_size);
-                if (!nf_nat_used_tuple(tuple, ct))
-                        return true;
+                if (++i == range_size || !nf_nat_used_tuple(tuple, ct))
+                        return;
         }
 
         pr_debug("%p: no NAT mapping\n", ct);
-        return false;
+        return;
 }
 
 /* manipulate a GRE packet according to maniptype */
diff --git a/net/ipv4/netfilter/nf_nat_proto_icmp.c b/net/ipv4/netfilter/nf_nat_proto_icmp.c
index 19a8b0b07d8e..5744c3ec847c 100644
--- a/net/ipv4/netfilter/nf_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_icmp.c
@@ -27,7 +27,7 @@ icmp_in_range(const struct nf_conntrack_tuple *tuple,
                ntohs(tuple->src.u.icmp.id) <= ntohs(max->icmp.id);
 }
 
-static bool
+static void
 icmp_unique_tuple(struct nf_conntrack_tuple *tuple,
                   const struct nf_nat_range *range,
                   enum nf_nat_manip_type maniptype,
@@ -42,13 +42,13 @@ icmp_unique_tuple(struct nf_conntrack_tuple *tuple,
         if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED))
                 range_size = 0xFFFF;
 
-        for (i = 0; i < range_size; i++, id++) {
+        for (i = 0; ; ++id) {
                 tuple->src.u.icmp.id = htons(ntohs(range->min.icmp.id) +
                                              (id % range_size));
-                if (!nf_nat_used_tuple(tuple, ct))
-                        return true;
+                if (++i == range_size || !nf_nat_used_tuple(tuple, ct))
+                        return;
         }
-        return false;
+        return;
 }
 
 static bool
diff --git a/net/ipv4/netfilter/nf_nat_proto_sctp.c b/net/ipv4/netfilter/nf_nat_proto_sctp.c
index 3fc598eeeb1a..756331d42661 100644
--- a/net/ipv4/netfilter/nf_nat_proto_sctp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_sctp.c
@@ -16,14 +16,14 @@
 
 static u_int16_t nf_sctp_port_rover;
 
-static bool
+static void
 sctp_unique_tuple(struct nf_conntrack_tuple *tuple,
                   const struct nf_nat_range *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
-        return nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
-                                         &nf_sctp_port_rover);
+        nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
+                                  &nf_sctp_port_rover);
 }
 
 static bool
diff --git a/net/ipv4/netfilter/nf_nat_proto_tcp.c b/net/ipv4/netfilter/nf_nat_proto_tcp.c
index 399e2cfa263b..aa460a595d5d 100644
--- a/net/ipv4/netfilter/nf_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_tcp.c
@@ -20,14 +20,13 @@
 
 static u_int16_t tcp_port_rover;
 
-static bool
+static void
 tcp_unique_tuple(struct nf_conntrack_tuple *tuple,
                  const struct nf_nat_range *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
-        return nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
-                                         &tcp_port_rover);
+        nf_nat_proto_unique_tuple(tuple, range, maniptype, ct, &tcp_port_rover);
 }
 
 static bool
diff --git a/net/ipv4/netfilter/nf_nat_proto_udp.c b/net/ipv4/netfilter/nf_nat_proto_udp.c
index 9e61c79492e4..dfe65c7e2925 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_udp.c
@@ -19,14 +19,13 @@
 
 static u_int16_t udp_port_rover;
 
-static bool
+static void
 udp_unique_tuple(struct nf_conntrack_tuple *tuple,
                  const struct nf_nat_range *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
-        return nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
-                                         &udp_port_rover);
+        nf_nat_proto_unique_tuple(tuple, range, maniptype, ct, &udp_port_rover);
 }
 
 static bool
diff --git a/net/ipv4/netfilter/nf_nat_proto_udplite.c b/net/ipv4/netfilter/nf_nat_proto_udplite.c
index 440a229bbd87..3cc8c8af39ef 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udplite.c
+++ b/net/ipv4/netfilter/nf_nat_proto_udplite.c
@@ -18,14 +18,14 @@
 
 static u_int16_t udplite_port_rover;
 
-static bool
+static void
 udplite_unique_tuple(struct nf_conntrack_tuple *tuple,
                      const struct nf_nat_range *range,
                      enum nf_nat_manip_type maniptype,
                      const struct nf_conn *ct)
 {
-        return nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
-                                         &udplite_port_rover);
+        nf_nat_proto_unique_tuple(tuple, range, maniptype, ct,
+                                  &udplite_port_rover);
 }
 
 static bool
diff --git a/net/ipv4/netfilter/nf_nat_proto_unknown.c b/net/ipv4/netfilter/nf_nat_proto_unknown.c
index 14381c62acea..a50f2bc1c732 100644
--- a/net/ipv4/netfilter/nf_nat_proto_unknown.c
+++ b/net/ipv4/netfilter/nf_nat_proto_unknown.c
@@ -26,14 +26,14 @@ static bool unknown_in_range(const struct nf_conntrack_tuple *tuple,
         return true;
 }
 
-static bool unknown_unique_tuple(struct nf_conntrack_tuple *tuple,
+static void unknown_unique_tuple(struct nf_conntrack_tuple *tuple,
                                  const struct nf_nat_range *range,
                                  enum nf_nat_manip_type maniptype,
                                  const struct nf_conn *ct)
 {
         /* Sorry: we can't help you; if it's not unique, we can't frob
            anything. */
-        return false;
+        return;
 }
 
 static bool
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 6348a793936e..21c30426480b 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -7,6 +7,7 @@
  */
 
 /* Everything about the rules for NAT. */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/types.h>
 #include <linux/ip.h>
 #include <linux/netfilter.h>
@@ -15,6 +16,7 @@
 #include <linux/kmod.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
+#include <linux/slab.h>
 #include <net/checksum.h>
 #include <net/route.h>
 #include <linux/bitops.h>
@@ -26,54 +28,26 @@
 
 #define NAT_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \
                          (1 << NF_INET_POST_ROUTING) | \
-                         (1 << NF_INET_LOCAL_OUT))
+                         (1 << NF_INET_LOCAL_OUT) | \
+                         (1 << NF_INET_LOCAL_IN))
 
-static struct
-{
-        struct ipt_replace repl;
-        struct ipt_standard entries[3];
-        struct ipt_error term;
-} nat_initial_table __net_initdata = {
-        .repl = {
-                .name = "nat",
-                .valid_hooks = NAT_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
-                .hook_entry = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_POST_ROUTING] = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
-                },
-                .underflow = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_POST_ROUTING] = sizeof(struct ipt_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2
-                },
-        },
-        .entries = {
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* PRE_ROUTING */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* POST_ROUTING */
-                IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
-        },
-        .term = IPT_ERROR_INIT,                 /* ERROR */
-};
-
-static struct xt_table nat_table = {
+static const struct xt_table nat_table = {
         .name           = "nat",
         .valid_hooks    = NAT_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET,
+        .af             = NFPROTO_IPV4,
 };
 
 /* Source NAT */
 static unsigned int
-ipt_snat_target(struct sk_buff *skb, const struct xt_target_param *par)
+ipt_snat_target(struct sk_buff *skb, const struct xt_action_param *par)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
-        NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING);
+        NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING ||
+                     par->hooknum == NF_INET_LOCAL_IN);
 
         ct = nf_ct_get(skb, &ctinfo);
 
@@ -86,7 +60,7 @@ ipt_snat_target(struct sk_buff *skb, const struct xt_target_param *par)
 }
 
 static unsigned int
-ipt_dnat_target(struct sk_buff *skb, const struct xt_target_param *par)
+ipt_dnat_target(struct sk_buff *skb, const struct xt_action_param *par)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
@@ -103,45 +77,44 @@ ipt_dnat_target(struct sk_buff *skb, const struct xt_target_param *par)
         return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_DST);
 }
 
-static bool ipt_snat_checkentry(const struct xt_tgchk_param *par)
+static int ipt_snat_checkentry(const struct xt_tgchk_param *par)
 {
         const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
         /* Must be a valid range */
         if (mr->rangesize != 1) {
-                printk("SNAT: multiple ranges no longer supported\n");
-                return false;
+                pr_info("SNAT: multiple ranges no longer supported\n");
+                return -EINVAL;
         }
-        return true;
+        return 0;
 }
 
-static bool ipt_dnat_checkentry(const struct xt_tgchk_param *par)
+static int ipt_dnat_checkentry(const struct xt_tgchk_param *par)
 {
         const struct nf_nat_multi_range_compat *mr = par->targinfo;
 
         /* Must be a valid range */
         if (mr->rangesize != 1) {
-                printk("DNAT: multiple ranges no longer supported\n");
-                return false;
+                pr_info("DNAT: multiple ranges no longer supported\n");
+                return -EINVAL;
         }
-        return true;
+        return 0;
 }
 
-unsigned int
+static unsigned int
 alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
 {
         /* Force range to this IP; let proto decide mapping for
            per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
-           Use reply in case it's already been mangled (eg local packet).
         */
-        __be32 ip
-                = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC
-                   ? ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip
-                   : ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
-        struct nf_nat_range range
-                = { IP_NAT_RANGE_MAP_IPS, ip, ip, { 0 }, { 0 } };
-
-        pr_debug("Allocating NULL binding for %p (%pI4)\n", ct, &ip);
+        struct nf_nat_range range;
+
+        range.flags = 0;
+        pr_debug("Allocating NULL binding for %p (%pI4)\n", ct,
+                 HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC ?
+                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip :
+                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
+
         return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
 }
 
@@ -169,7 +142,7 @@ static struct xt_target ipt_snat_reg __read_mostly = {
         .target         = ipt_snat_target,
         .targetsize     = sizeof(struct nf_nat_multi_range_compat),
         .table          = "nat",
-        .hooks          = 1 << NF_INET_POST_ROUTING,
+        .hooks          = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_LOCAL_IN),
         .checkentry     = ipt_snat_checkentry,
         .family         = AF_INET,
 };
@@ -186,8 +159,13 @@ static struct xt_target ipt_dnat_reg __read_mostly = {
 
 static int __net_init nf_nat_rule_net_init(struct net *net)
 {
-        net->ipv4.nat_table = ipt_register_table(net, &nat_table,
-                                                 &nat_initial_table.repl);
+        struct ipt_replace *repl;
+
+        repl = ipt_alloc_initial_table(&nat_table);
+        if (repl == NULL)
+                return -ENOMEM;
+        net->ipv4.nat_table = ipt_register_table(net, &nat_table, repl);
+        kfree(repl);
         if (IS_ERR(net->ipv4.nat_table))
                 return PTR_ERR(net->ipv4.nat_table);
         return 0;
@@ -195,7 +173,7 @@ static int __net_init nf_nat_rule_net_init(struct net *net)
 
 static void __net_exit nf_nat_rule_net_exit(struct net *net)
 {
-        ipt_unregister_table(net->ipv4.nat_table);
+        ipt_unregister_table(net, net->ipv4.nat_table);
 }
 
 static struct pernet_operations nf_nat_rule_net_ops = {
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index 07d61a57613c..e40cf7816fdb 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -1,4 +1,4 @@
-/* SIP extension for UDP NAT alteration.
+/* SIP extension for NAT alteration.
  *
  * (C) 2005 by Christian Hentschel <chentschel@arnet.com.ar>
  * based on RR's ip_nat_ftp.c and other modules.
@@ -15,6 +15,7 @@
 #include <linux/ip.h>
 #include <net/ip.h>
 #include <linux/udp.h>
+#include <linux/tcp.h>
 
 #include <net/netfilter/nf_nat.h>
 #include <net/netfilter/nf_nat_helper.h>
@@ -29,25 +30,42 @@ MODULE_DESCRIPTION("SIP NAT helper");
 MODULE_ALIAS("ip_nat_sip");
 
 
-static unsigned int mangle_packet(struct sk_buff *skb,
+static unsigned int mangle_packet(struct sk_buff *skb, unsigned int dataoff,
                                   const char **dptr, unsigned int *datalen,
                                   unsigned int matchoff, unsigned int matchlen,
                                   const char *buffer, unsigned int buflen)
 {
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
-
-        if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, matchoff, matchlen,
-                                      buffer, buflen))
-                return 0;
+        struct tcphdr *th;
+        unsigned int baseoff;
+
+        if (nf_ct_protonum(ct) == IPPROTO_TCP) {
+                th = (struct tcphdr *)(skb->data + ip_hdrlen(skb));
+                baseoff = ip_hdrlen(skb) + th->doff * 4;
+                matchoff += dataoff - baseoff;
+
+                if (!__nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
+                                                matchoff, matchlen,
+                                                buffer, buflen, false))
+                        return 0;
+        } else {
+                baseoff = ip_hdrlen(skb) + sizeof(struct udphdr);
+                matchoff += dataoff - baseoff;
+
+                if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo,
+                                              matchoff, matchlen,
+                                              buffer, buflen))
+                        return 0;
+        }
 
         /* Reload data pointer and adjust datalen value */
-        *dptr = skb->data + ip_hdrlen(skb) + sizeof(struct udphdr);
+        *dptr = skb->data + dataoff;
         *datalen += buflen - matchlen;
         return 1;
 }
 
-static int map_addr(struct sk_buff *skb,
+static int map_addr(struct sk_buff *skb, unsigned int dataoff,
                     const char **dptr, unsigned int *datalen,
                     unsigned int matchoff, unsigned int matchlen,
                     union nf_inet_addr *addr, __be16 port)
@@ -76,11 +94,11 @@ static int map_addr(struct sk_buff *skb,
 
         buflen = sprintf(buffer, "%pI4:%u", &newaddr, ntohs(newport));
 
-        return mangle_packet(skb, dptr, datalen, matchoff, matchlen,
+        return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
                              buffer, buflen);
 }
 
-static int map_sip_addr(struct sk_buff *skb,
+static int map_sip_addr(struct sk_buff *skb, unsigned int dataoff,
                         const char **dptr, unsigned int *datalen,
                         enum sip_header_types type)
 {
@@ -93,16 +111,18 @@ static int map_sip_addr(struct sk_buff *skb,
         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen, type, NULL,
                                     &matchoff, &matchlen, &addr, &port) <= 0)
                 return 1;
-        return map_addr(skb, dptr, datalen, matchoff, matchlen, &addr, port);
+        return map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
+                        &addr, port);
 }
 
-static unsigned int ip_nat_sip(struct sk_buff *skb,
+static unsigned int ip_nat_sip(struct sk_buff *skb, unsigned int dataoff,
                                const char **dptr, unsigned int *datalen)
 {
         enum ip_conntrack_info ctinfo;
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-        unsigned int dataoff, matchoff, matchlen;
+        unsigned int coff, matchoff, matchlen;
+        enum sip_header_types hdr;
         union nf_inet_addr addr;
         __be16 port;
         int request, in_header;
@@ -112,16 +132,21 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                 if (ct_sip_parse_request(ct, *dptr, *datalen,
                                          &matchoff, &matchlen,
                                          &addr, &port) > 0 &&
-                    !map_addr(skb, dptr, datalen, matchoff, matchlen,
+                    !map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
                               &addr, port))
                         return NF_DROP;
                 request = 1;
         } else
                 request = 0;
 
+        if (nf_ct_protonum(ct) == IPPROTO_TCP)
+                hdr = SIP_HDR_VIA_TCP;
+        else
+                hdr = SIP_HDR_VIA_UDP;
+
         /* Translate topmost Via header and parameters */
         if (ct_sip_parse_header_uri(ct, *dptr, NULL, *datalen,
-                                    SIP_HDR_VIA, NULL, &matchoff, &matchlen,
+                                    hdr, NULL, &matchoff, &matchlen,
                                     &addr, &port) > 0) {
                 unsigned int matchend, poff, plen, buflen, n;
                 char buffer[sizeof("nnn.nnn.nnn.nnn:nnnnn")];
@@ -138,7 +163,7 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                                 goto next;
                 }
 
-                if (!map_addr(skb, dptr, datalen, matchoff, matchlen,
+                if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
                               &addr, port))
                         return NF_DROP;
 
@@ -153,8 +178,8 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                     addr.ip != ct->tuplehash[!dir].tuple.dst.u3.ip) {
                         buflen = sprintf(buffer, "%pI4",
                                         &ct->tuplehash[!dir].tuple.dst.u3.ip);
-                        if (!mangle_packet(skb, dptr, datalen, poff, plen,
-                                           buffer, buflen))
+                        if (!mangle_packet(skb, dataoff, dptr, datalen,
+                                           poff, plen, buffer, buflen))
                                 return NF_DROP;
                 }
 
@@ -167,8 +192,8 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                     addr.ip != ct->tuplehash[!dir].tuple.src.u3.ip) {
                         buflen = sprintf(buffer, "%pI4",
                                         &ct->tuplehash[!dir].tuple.src.u3.ip);
-                        if (!mangle_packet(skb, dptr, datalen, poff, plen,
-                                           buffer, buflen))
+                        if (!mangle_packet(skb, dataoff, dptr, datalen,
+                                           poff, plen, buffer, buflen))
                                 return NF_DROP;
                 }
 
@@ -181,31 +206,45 @@ static unsigned int ip_nat_sip(struct sk_buff *skb,
                     htons(n) != ct->tuplehash[!dir].tuple.src.u.udp.port) {
                         __be16 p = ct->tuplehash[!dir].tuple.src.u.udp.port;
                         buflen = sprintf(buffer, "%u", ntohs(p));
-                        if (!mangle_packet(skb, dptr, datalen, poff, plen,
-                                           buffer, buflen))
+                        if (!mangle_packet(skb, dataoff, dptr, datalen,
+                                           poff, plen, buffer, buflen))
                                 return NF_DROP;
                 }
         }
 
 next:
         /* Translate Contact headers */
-        dataoff = 0;
+        coff = 0;
         in_header = 0;
-        while (ct_sip_parse_header_uri(ct, *dptr, &dataoff, *datalen,
+        while (ct_sip_parse_header_uri(ct, *dptr, &coff, *datalen,
                                        SIP_HDR_CONTACT, &in_header,
                                        &matchoff, &matchlen,
                                        &addr, &port) > 0) {
-                if (!map_addr(skb, dptr, datalen, matchoff, matchlen,
+                if (!map_addr(skb, dataoff, dptr, datalen, matchoff, matchlen,
                               &addr, port))
                         return NF_DROP;
         }
 
-        if (!map_sip_addr(skb, dptr, datalen, SIP_HDR_FROM) ||
-            !map_sip_addr(skb, dptr, datalen, SIP_HDR_TO))
+        if (!map_sip_addr(skb, dataoff, dptr, datalen, SIP_HDR_FROM) ||
+            !map_sip_addr(skb, dataoff, dptr, datalen, SIP_HDR_TO))
                 return NF_DROP;
+
         return NF_ACCEPT;
 }
 
+static void ip_nat_sip_seq_adjust(struct sk_buff *skb, s16 off)
+{
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
+        const struct tcphdr *th;
+
+        if (nf_ct_protonum(ct) != IPPROTO_TCP || off == 0)
+                return;
+
+        th = (struct tcphdr *)(skb->data + ip_hdrlen(skb));
+        nf_nat_set_seq_adjust(ct, ctinfo, th->seq, off);
+}
+
 /* Handles expected signalling connections and media streams */
 static void ip_nat_sip_expected(struct nf_conn *ct,
                                 struct nf_conntrack_expect *exp)
@@ -232,7 +271,7 @@ static void ip_nat_sip_expected(struct nf_conn *ct,
         }
 }
 
-static unsigned int ip_nat_sip_expect(struct sk_buff *skb,
+static unsigned int ip_nat_sip_expect(struct sk_buff *skb, unsigned int dataoff,
                                       const char **dptr, unsigned int *datalen,
                                       struct nf_conntrack_expect *exp,
                                       unsigned int matchoff,
@@ -268,9 +307,16 @@ static unsigned int ip_nat_sip_expect(struct sk_buff *skb,
         exp->expectfn = ip_nat_sip_expected;
 
         for (; port != 0; port++) {
+                int ret;
+
                 exp->tuple.dst.u.udp.port = htons(port);
-                if (nf_ct_expect_related(exp) == 0)
+                ret = nf_ct_expect_related(exp);
+                if (ret == 0)
                         break;
+                else if (ret != -EBUSY) {
+                        port = 0;
+                        break;
+                }
         }
 
         if (port == 0)
@@ -279,8 +325,8 @@ static unsigned int ip_nat_sip_expect(struct sk_buff *skb,
         if (exp->tuple.dst.u3.ip != exp->saved_ip ||
             exp->tuple.dst.u.udp.port != exp->saved_proto.udp.port) {
                 buflen = sprintf(buffer, "%pI4:%u", &newip, port);
-                if (!mangle_packet(skb, dptr, datalen, matchoff, matchlen,
-                                   buffer, buflen))
+                if (!mangle_packet(skb, dataoff, dptr, datalen,
+                                   matchoff, matchlen, buffer, buflen))
                         goto err;
         }
         return NF_ACCEPT;
@@ -290,7 +336,7 @@ err:
         return NF_DROP;
 }
 
-static int mangle_content_len(struct sk_buff *skb,
+static int mangle_content_len(struct sk_buff *skb, unsigned int dataoff,
                               const char **dptr, unsigned int *datalen)
 {
         enum ip_conntrack_info ctinfo;
@@ -312,12 +358,13 @@ static int mangle_content_len(struct sk_buff *skb,
                 return 0;
 
         buflen = sprintf(buffer, "%u", c_len);
-        return mangle_packet(skb, dptr, datalen, matchoff, matchlen,
+        return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
                              buffer, buflen);
 }
 
-static int mangle_sdp_packet(struct sk_buff *skb, const char **dptr,
-                             unsigned int dataoff, unsigned int *datalen,
+static int mangle_sdp_packet(struct sk_buff *skb, unsigned int dataoff,
+                             const char **dptr, unsigned int *datalen,
+                             unsigned int sdpoff,
                              enum sdp_header_types type,
                              enum sdp_header_types term,
                              char *buffer, int buflen)
@@ -326,16 +373,16 @@ static int mangle_sdp_packet(struct sk_buff *skb, const char **dptr,
         struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
         unsigned int matchlen, matchoff;
 
-        if (ct_sip_get_sdp_header(ct, *dptr, dataoff, *datalen, type, term,
+        if (ct_sip_get_sdp_header(ct, *dptr, sdpoff, *datalen, type, term,
                                   &matchoff, &matchlen) <= 0)
                 return -ENOENT;
-        return mangle_packet(skb, dptr, datalen, matchoff, matchlen,
+        return mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
                              buffer, buflen) ? 0 : -EINVAL;
 }
 
-static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, const char **dptr,
-                                    unsigned int dataoff,
-                                    unsigned int *datalen,
+static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, unsigned int dataoff,
+                                    const char **dptr, unsigned int *datalen,
+                                    unsigned int sdpoff,
                                     enum sdp_header_types type,
                                     enum sdp_header_types term,
                                     const union nf_inet_addr *addr)
@@ -344,16 +391,15 @@ static unsigned int ip_nat_sdp_addr(struct sk_buff *skb, const char **dptr,
         unsigned int buflen;
 
         buflen = sprintf(buffer, "%pI4", &addr->ip);
-        if (mangle_sdp_packet(skb, dptr, dataoff, datalen, type, term,
+        if (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff, type, term,
                               buffer, buflen))
                 return 0;
 
-        return mangle_content_len(skb, dptr, datalen);
+        return mangle_content_len(skb, dataoff, dptr, datalen);
 }
 
-static unsigned int ip_nat_sdp_port(struct sk_buff *skb,
-                                    const char **dptr,
-                                    unsigned int *datalen,
+static unsigned int ip_nat_sdp_port(struct sk_buff *skb, unsigned int dataoff,
+                                    const char **dptr, unsigned int *datalen,
                                     unsigned int matchoff,
                                     unsigned int matchlen,
                                     u_int16_t port)
@@ -362,16 +408,16 @@ static unsigned int ip_nat_sdp_port(struct sk_buff *skb,
         unsigned int buflen;
 
         buflen = sprintf(buffer, "%u", port);
-        if (!mangle_packet(skb, dptr, datalen, matchoff, matchlen,
+        if (!mangle_packet(skb, dataoff, dptr, datalen, matchoff, matchlen,
                            buffer, buflen))
                 return 0;
 
-        return mangle_content_len(skb, dptr, datalen);
+        return mangle_content_len(skb, dataoff, dptr, datalen);
 }
 
-static unsigned int ip_nat_sdp_session(struct sk_buff *skb, const char **dptr,
-                                       unsigned int dataoff,
-                                       unsigned int *datalen,
+static unsigned int ip_nat_sdp_session(struct sk_buff *skb, unsigned int dataoff,
+                                       const char **dptr, unsigned int *datalen,
+                                       unsigned int sdpoff,
                                        const union nf_inet_addr *addr)
 {
         char buffer[sizeof("nnn.nnn.nnn.nnn")];
@@ -379,12 +425,12 @@ static unsigned int ip_nat_sdp_session(struct sk_buff *skb, const char **dptr,
 
         /* Mangle session description owner and contact addresses */
         buflen = sprintf(buffer, "%pI4", &addr->ip);
-        if (mangle_sdp_packet(skb, dptr, dataoff, datalen,
+        if (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff,
                                SDP_HDR_OWNER_IP4, SDP_HDR_MEDIA,
                                buffer, buflen))
                 return 0;
 
-        switch (mangle_sdp_packet(skb, dptr, dataoff, datalen,
+        switch (mangle_sdp_packet(skb, dataoff, dptr, datalen, sdpoff,
                                   SDP_HDR_CONNECTION_IP4, SDP_HDR_MEDIA,
                                   buffer, buflen)) {
         case 0:
@@ -401,14 +447,13 @@ static unsigned int ip_nat_sdp_session(struct sk_buff *skb, const char **dptr,
                 return 0;
         }
 
-        return mangle_content_len(skb, dptr, datalen);
+        return mangle_content_len(skb, dataoff, dptr, datalen);
 }
 
 /* So, this packet has hit the connection tracking matching code.
    Mangle it, and change the expectation to match the new version. */
-static unsigned int ip_nat_sdp_media(struct sk_buff *skb,
-                                     const char **dptr,
-                                     unsigned int *datalen,
+static unsigned int ip_nat_sdp_media(struct sk_buff *skb, unsigned int dataoff,
+                                     const char **dptr, unsigned int *datalen,
                                      struct nf_conntrack_expect *rtp_exp,
                                      struct nf_conntrack_expect *rtcp_exp,
                                      unsigned int mediaoff,
@@ -442,13 +487,25 @@ static unsigned int ip_nat_sdp_media(struct sk_buff *skb,
         /* Try to get same pair of ports: if not, try to change them. */
         for (port = ntohs(rtp_exp->tuple.dst.u.udp.port);
              port != 0; port += 2) {
+                int ret;
+
                 rtp_exp->tuple.dst.u.udp.port = htons(port);
-                if (nf_ct_expect_related(rtp_exp) != 0)
+                ret = nf_ct_expect_related(rtp_exp);
+                if (ret == -EBUSY)
                         continue;
+                else if (ret < 0) {
+                        port = 0;
+                        break;
+                }
                 rtcp_exp->tuple.dst.u.udp.port = htons(port + 1);
-                if (nf_ct_expect_related(rtcp_exp) == 0)
+                ret = nf_ct_expect_related(rtcp_exp);
+                if (ret == 0)
                         break;
-                nf_ct_unexpect_related(rtp_exp);
+                else if (ret != -EBUSY) {
+                        nf_ct_unexpect_related(rtp_exp);
+                        port = 0;
+                        break;
+                }
         }
 
         if (port == 0)
@@ -456,7 +513,8 @@ static unsigned int ip_nat_sdp_media(struct sk_buff *skb,
 
         /* Update media port. */
         if (rtp_exp->tuple.dst.u.udp.port != rtp_exp->saved_proto.udp.port &&
-            !ip_nat_sdp_port(skb, dptr, datalen, mediaoff, medialen, port))
+            !ip_nat_sdp_port(skb, dataoff, dptr, datalen,
+                             mediaoff, medialen, port))
                 goto err2;
 
         return NF_ACCEPT;
@@ -471,6 +529,7 @@ err1:
 static void __exit nf_nat_sip_fini(void)
 {
         rcu_assign_pointer(nf_nat_sip_hook, NULL);
+        rcu_assign_pointer(nf_nat_sip_seq_adjust_hook, NULL);
         rcu_assign_pointer(nf_nat_sip_expect_hook, NULL);
         rcu_assign_pointer(nf_nat_sdp_addr_hook, NULL);
         rcu_assign_pointer(nf_nat_sdp_port_hook, NULL);
@@ -482,12 +541,14 @@ static void __exit nf_nat_sip_fini(void)
 static int __init nf_nat_sip_init(void)
 {
         BUG_ON(nf_nat_sip_hook != NULL);
+        BUG_ON(nf_nat_sip_seq_adjust_hook != NULL);
         BUG_ON(nf_nat_sip_expect_hook != NULL);
         BUG_ON(nf_nat_sdp_addr_hook != NULL);
         BUG_ON(nf_nat_sdp_port_hook != NULL);
         BUG_ON(nf_nat_sdp_session_hook != NULL);
         BUG_ON(nf_nat_sdp_media_hook != NULL);
         rcu_assign_pointer(nf_nat_sip_hook, ip_nat_sip);
+        rcu_assign_pointer(nf_nat_sip_seq_adjust_hook, ip_nat_sip_seq_adjust);
         rcu_assign_pointer(nf_nat_sip_expect_hook, ip_nat_sip_expect);
         rcu_assign_pointer(nf_nat_sdp_addr_hook, ip_nat_sdp_addr);
         rcu_assign_pointer(nf_nat_sdp_port_hook, ip_nat_sdp_port);
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index d9521f6f9ed0..ee5f419d0a56 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -43,6 +43,7 @@
 #include <linux/moduleparam.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/in.h>
 #include <linux/ip.h>
 #include <linux/udp.h>
@@ -400,7 +401,7 @@ static unsigned char asn1_octets_decode(struct asn1_ctx *ctx,
         *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
         if (*octets == NULL) {
                 if (net_ratelimit())
-                        printk("OOM in bsalg (%d)\n", __LINE__);
+                        pr_notice("OOM in bsalg (%d)\n", __LINE__);
                 return 0;
         }
 
@@ -451,7 +452,7 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
         *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
         if (*oid == NULL) {
                 if (net_ratelimit())
-                        printk("OOM in bsalg (%d)\n", __LINE__);
+                        pr_notice("OOM in bsalg (%d)\n", __LINE__);
                 return 0;
         }
 
@@ -728,7 +729,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                         if (*obj == NULL) {
                                 kfree(id);
                                 if (net_ratelimit())
-                                        printk("OOM in bsalg (%d)\n", __LINE__);
+                                        pr_notice("OOM in bsalg (%d)\n", __LINE__);
                                 return 0;
                         }
                         (*obj)->syntax.l[0] = l;
@@ -745,7 +746,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                                 kfree(p);
                                 kfree(id);
                                 if (net_ratelimit())
-                                        printk("OOM in bsalg (%d)\n", __LINE__);
+                                        pr_notice("OOM in bsalg (%d)\n", __LINE__);
                                 return 0;
                         }
                         memcpy((*obj)->syntax.c, p, len);
@@ -760,7 +761,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                         if (*obj == NULL) {
                                 kfree(id);
                                 if (net_ratelimit())
-                                        printk("OOM in bsalg (%d)\n", __LINE__);
+                                        pr_notice("OOM in bsalg (%d)\n", __LINE__);
                                 return 0;
                         }
                         if (!asn1_null_decode(ctx, end)) {
@@ -781,7 +782,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                                 kfree(lp);
                                 kfree(id);
                                 if (net_ratelimit())
-                                        printk("OOM in bsalg (%d)\n", __LINE__);
+                                        pr_notice("OOM in bsalg (%d)\n", __LINE__);
                                 return 0;
                         }
                         memcpy((*obj)->syntax.ul, lp, len);
@@ -802,7 +803,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                                 kfree(p);
                                 kfree(id);
                                 if (net_ratelimit())
-                                        printk("OOM in bsalg (%d)\n", __LINE__);
+                                        pr_notice("OOM in bsalg (%d)\n", __LINE__);
                                 return 0;
                         }
                         memcpy((*obj)->syntax.uc, p, len);
@@ -820,7 +821,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                         if (*obj == NULL) {
                                 kfree(id);
                                 if (net_ratelimit())
-                                        printk("OOM in bsalg (%d)\n", __LINE__);
+                                        pr_notice("OOM in bsalg (%d)\n", __LINE__);
                                 return 0;
                         }
                         (*obj)->syntax.ul[0] = ul;
@@ -892,13 +893,15 @@ static void fast_csum(__sum16 *csum,
         unsigned char s[4];
 
         if (offset & 1) {
-                s[0] = s[2] = 0;
+                s[0] = ~0;
                 s[1] = ~*optr;
+                s[2] = 0;
                 s[3] = *nptr;
         } else {
-                s[1] = s[3] = 0;
                 s[0] = ~*optr;
+                s[1] = ~0;
                 s[2] = *nptr;
+                s[3] = 0;
         }
 
         *csum = csum_fold(csum_partial(s, 4, ~csum_unfold(*csum)));
@@ -1038,7 +1041,7 @@ static int snmp_parse_mangle(unsigned char *msg,
         unsigned int cls, con, tag, vers, pdutype;
         struct asn1_ctx ctx;
         struct asn1_octstr comm;
-        struct snmp_object **obj;
+        struct snmp_object *obj;
 
         if (debug > 1)
                 hex_dump(msg, len);
@@ -1148,43 +1151,34 @@ static int snmp_parse_mangle(unsigned char *msg,
         if (cls != ASN1_UNI || con != ASN1_CON || tag != ASN1_SEQ)
                 return 0;
 
-        obj = kmalloc(sizeof(struct snmp_object), GFP_ATOMIC);
-        if (obj == NULL) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "OOM in bsalg(%d)\n", __LINE__);
-                return 0;
-        }
-
         while (!asn1_eoc_decode(&ctx, eoc)) {
                 unsigned int i;
 
-                if (!snmp_object_decode(&ctx, obj)) {
-                        if (*obj) {
-                                kfree((*obj)->id);
-                                kfree(*obj);
+                if (!snmp_object_decode(&ctx, &obj)) {
+                        if (obj) {
+                                kfree(obj->id);
+                                kfree(obj);
                         }
-                        kfree(obj);
                         return 0;
                 }
 
                 if (debug > 1) {
                         printk(KERN_DEBUG "bsalg: object: ");
-                        for (i = 0; i < (*obj)->id_len; i++) {
+                        for (i = 0; i < obj->id_len; i++) {
                                 if (i > 0)
                                         printk(".");
-                                printk("%lu", (*obj)->id[i]);
+                                printk("%lu", obj->id[i]);
                         }
-                        printk(": type=%u\n", (*obj)->type);
+                        printk(": type=%u\n", obj->type);
 
                 }
 
-                if ((*obj)->type == SNMP_IPADDR)
+                if (obj->type == SNMP_IPADDR)
                         mangle_address(ctx.begin, ctx.pointer - 4 , map, check);
 
-                kfree((*obj)->id);
-                kfree(*obj);
+                kfree(obj->id);
+                kfree(obj);
         }
-        kfree(obj);
 
         if (!asn1_eoc_decode(&ctx, eoc))
                 return 0;
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 5567bd0d0750..95481fee8bdb 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -7,6 +7,7 @@
  */
 #include <linux/types.h>
 #include <linux/icmp.h>
+#include <linux/gfp.h>
 #include <linux/ip.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
@@ -97,7 +98,7 @@ nf_nat_fn(unsigned int hooknum,
                 return NF_ACCEPT;
 
         /* Don't try to NAT if this packet is not conntracked */
-        if (ct == &nf_conntrack_untracked)
+        if (nf_ct_is_untracked(ct))
                 return NF_ACCEPT;
 
         nat = nfct_nat(ct);
@@ -130,16 +131,9 @@ nf_nat_fn(unsigned int hooknum,
                 if (!nf_nat_initialized(ct, maniptype)) {
                         unsigned int ret;
 
-                        if (hooknum == NF_INET_LOCAL_IN)
-                                /* LOCAL_IN hook doesn't have a chain!  */
-                                ret = alloc_null_binding(ct, hooknum);
-                        else
-                                ret = nf_nat_rule_find(skb, hooknum, in, out,
-                                                       ct);
-
-                        if (ret != NF_ACCEPT) {
+                        ret = nf_nat_rule_find(skb, hooknum, in, out, ct);
+                        if (ret != NF_ACCEPT)
                                 return ret;
-                        }
                 } else
                         pr_debug("Already setup manip %s for ct %p\n",
                                  maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
@@ -197,11 +191,11 @@ nf_nat_out(unsigned int hooknum,
             (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 
-                if (ct->tuplehash[dir].tuple.src.u3.ip !=
-                    ct->tuplehash[!dir].tuple.dst.u3.ip
-                    || ct->tuplehash[dir].tuple.src.u.all !=
-                       ct->tuplehash[!dir].tuple.dst.u.all
-                    )
+                if ((ct->tuplehash[dir].tuple.src.u3.ip !=
+                     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
+                    (ct->tuplehash[dir].tuple.src.u.all !=
+                     ct->tuplehash[!dir].tuple.dst.u.all)
+                   )
                         return ip_xfrm_me_harder(skb) == 0 ? ret : NF_DROP;
         }
 #endif
@@ -251,7 +245,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         {
                 .hook           = nf_nat_in,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_PRE_ROUTING,
                 .priority       = NF_IP_PRI_NAT_DST,
         },
@@ -259,7 +253,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         {
                 .hook           = nf_nat_out,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_POST_ROUTING,
                 .priority       = NF_IP_PRI_NAT_SRC,
         },
@@ -267,7 +261,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         {
                 .hook           = nf_nat_local_fn,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP_PRI_NAT_DST,
         },
@@ -275,7 +269,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         {
                 .hook           = nf_nat_fn,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP_PRI_NAT_SRC,
         },
@@ -293,12 +287,12 @@ static int __init nf_nat_standalone_init(void)
 #endif
         ret = nf_nat_rule_init();
         if (ret < 0) {
-                printk("nf_nat_init: can't setup rules.\n");
+                pr_err("nf_nat_init: can't setup rules.\n");
                 goto cleanup_decode_session;
         }
         ret = nf_register_hooks(nf_nat_ops, ARRAY_SIZE(nf_nat_ops));
         if (ret < 0) {
-                printk("nf_nat_init: can't register hooks.\n");
+                pr_err("nf_nat_init: can't register hooks.\n");
                 goto cleanup_rule_init;
         }
         return ret;
diff --git a/net/ipv4/netfilter/nf_nat_tftp.c b/net/ipv4/netfilter/nf_nat_tftp.c
index b096e81500ae..7274a43c7a12 100644
--- a/net/ipv4/netfilter/nf_nat_tftp.c
+++ b/net/ipv4/netfilter/nf_nat_tftp.c
@@ -6,7 +6,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/moduleparam.h>
 #include <linux/udp.h>
 
 #include <net/netfilter/nf_nat_helper.h>
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index f25542c48b7d..b14ec7d03b6e 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -59,13 +59,13 @@ static int sockstat_seq_show(struct seq_file *seq, void *v)
         local_bh_enable();
 
         socket_seq_show(seq);
-        seq_printf(seq, "TCP: inuse %d orphan %d tw %d alloc %d mem %d\n",
+        seq_printf(seq, "TCP: inuse %d orphan %d tw %d alloc %d mem %ld\n",
                    sock_prot_inuse_get(net, &tcp_prot), orphans,
                    tcp_death_row.tw_count, sockets,
-                   atomic_read(&tcp_memory_allocated));
-        seq_printf(seq, "UDP: inuse %d mem %d\n",
+                   atomic_long_read(&tcp_memory_allocated));
+        seq_printf(seq, "UDP: inuse %d mem %ld\n",
                    sock_prot_inuse_get(net, &udp_prot),
-                   atomic_read(&udp_memory_allocated));
+                   atomic_long_read(&udp_memory_allocated));
         seq_printf(seq, "UDPLITE: inuse %d\n",
                    sock_prot_inuse_get(net, &udplite_prot));
         seq_printf(seq, "RAW: inuse %d\n",
@@ -127,8 +127,8 @@ static const struct snmp_mib snmp4_ipextstats_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-static struct {
-        char *name;
+static const struct {
+        const char *name;
         int index;
 } icmpmibmap[] = {
         { "DestUnreachs", ICMP_DEST_UNREACH },
@@ -249,6 +249,11 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPSackShifted", LINUX_MIB_SACKSHIFTED),
         SNMP_MIB_ITEM("TCPSackMerged", LINUX_MIB_SACKMERGED),
         SNMP_MIB_ITEM("TCPSackShiftFallback", LINUX_MIB_SACKSHIFTFALLBACK),
+        SNMP_MIB_ITEM("TCPBacklogDrop", LINUX_MIB_TCPBACKLOGDROP),
+        SNMP_MIB_ITEM("TCPMinTTLDrop", LINUX_MIB_TCPMINTTLDROP),
+        SNMP_MIB_ITEM("TCPDeferAcceptDrop", LINUX_MIB_TCPDEFERACCEPTDROP),
+        SNMP_MIB_ITEM("IPReversePathFilter", LINUX_MIB_IPRPFILTER),
+        SNMP_MIB_ITEM("TCPTimeWaitOverflow", LINUX_MIB_TCPTIMEWAITOVERFLOW),
         SNMP_MIB_SENTINEL
 };
 
@@ -280,7 +285,7 @@ static void icmpmsg_put(struct seq_file *seq)
 
         count = 0;
         for (i = 0; i < ICMPMSG_MIB_MAX; i++) {
-                val = snmp_fold_field((void **) net->mib.icmpmsg_statistics, i);
+                val = snmp_fold_field((void __percpu **) net->mib.icmpmsg_statistics, i);
                 if (val) {
                         type[count] = i;
                         vals[count++] = val;
@@ -307,18 +312,18 @@ static void icmp_put(struct seq_file *seq)
         for (i=0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " Out%s", icmpmibmap[i].name);
         seq_printf(seq, "\nIcmp: %lu %lu",
-                snmp_fold_field((void **) net->mib.icmp_statistics, ICMP_MIB_INMSGS),
-                snmp_fold_field((void **) net->mib.icmp_statistics, ICMP_MIB_INERRORS));
+                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_INMSGS),
+                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_INERRORS));
         for (i=0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                        snmp_fold_field((void **) net->mib.icmpmsg_statistics,
+                        snmp_fold_field((void __percpu **) net->mib.icmpmsg_statistics,
                                 icmpmibmap[i].index));
         seq_printf(seq, " %lu %lu",
-                snmp_fold_field((void **) net->mib.icmp_statistics, ICMP_MIB_OUTMSGS),
-                snmp_fold_field((void **) net->mib.icmp_statistics, ICMP_MIB_OUTERRORS));
+                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_OUTMSGS),
+                snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_OUTERRORS));
         for (i=0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                        snmp_fold_field((void **) net->mib.icmpmsg_statistics,
+                        snmp_fold_field((void __percpu **) net->mib.icmpmsg_statistics,
                                 icmpmibmap[i].index | 0x100));
 }
 
@@ -339,10 +344,12 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
                    IPV4_DEVCONF_ALL(net, FORWARDING) ? 1 : 2,
                    sysctl_ip_default_ttl);
 
+        BUILD_BUG_ON(offsetof(struct ipstats_mib, mibs) != 0);
         for (i = 0; snmp4_ipstats_list[i].name != NULL; i++)
-                seq_printf(seq, " %lu",
-                           snmp_fold_field((void **)net->mib.ip_statistics,
-                                           snmp4_ipstats_list[i].entry));
+                seq_printf(seq, " %llu",
+                           snmp_fold_field64((void __percpu **)net->mib.ip_statistics,
+                                             snmp4_ipstats_list[i].entry,
+                                             offsetof(struct ipstats_mib, syncp)));
 
         icmp_put(seq);  /* RFC 2011 compatibility */
         icmpmsg_put(seq);
@@ -356,11 +363,11 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
                 /* MaxConn field is signed, RFC 2012 */
                 if (snmp4_tcp_list[i].entry == TCP_MIB_MAXCONN)
                         seq_printf(seq, " %ld",
-                                   snmp_fold_field((void **)net->mib.tcp_statistics,
+                                   snmp_fold_field((void __percpu **)net->mib.tcp_statistics,
                                                    snmp4_tcp_list[i].entry));
                 else
                         seq_printf(seq, " %lu",
-                                   snmp_fold_field((void **)net->mib.tcp_statistics,
+                                   snmp_fold_field((void __percpu **)net->mib.tcp_statistics,
                                                    snmp4_tcp_list[i].entry));
         }
 
@@ -371,7 +378,7 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
         seq_puts(seq, "\nUdp:");
         for (i = 0; snmp4_udp_list[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                           snmp_fold_field((void **)net->mib.udp_statistics,
+                           snmp_fold_field((void __percpu **)net->mib.udp_statistics,
                                            snmp4_udp_list[i].entry));
 
         /* the UDP and UDP-Lite MIBs are the same */
@@ -382,7 +389,7 @@ static int snmp_seq_show(struct seq_file *seq, void *v)
         seq_puts(seq, "\nUdpLite:");
         for (i = 0; snmp4_udp_list[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                           snmp_fold_field((void **)net->mib.udplite_statistics,
+                           snmp_fold_field((void __percpu **)net->mib.udplite_statistics,
                                            snmp4_udp_list[i].entry));
 
         seq_putc(seq, '\n');
@@ -419,7 +426,7 @@ static int netstat_seq_show(struct seq_file *seq, void *v)
         seq_puts(seq, "\nTcpExt:");
         for (i = 0; snmp4_net_list[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
-                           snmp_fold_field((void **)net->mib.net_statistics,
+                           snmp_fold_field((void __percpu **)net->mib.net_statistics,
                                            snmp4_net_list[i].entry));
 
         seq_puts(seq, "\nIpExt:");
@@ -428,9 +435,10 @@ static int netstat_seq_show(struct seq_file *seq, void *v)
 
         seq_puts(seq, "\nIpExt:");
         for (i = 0; snmp4_ipextstats_list[i].name != NULL; i++)
-                seq_printf(seq, " %lu",
-                           snmp_fold_field((void **)net->mib.ip_statistics,
-                                           snmp4_ipextstats_list[i].entry));
+                seq_printf(seq, " %llu",
+                           snmp_fold_field64((void __percpu **)net->mib.ip_statistics,
+                                             snmp4_ipextstats_list[i].entry,
+                                             offsetof(struct ipstats_mib, syncp)));
 
         seq_putc(seq, '\n');
         return 0;
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index ea50da0649fd..9ae5c01cd0b2 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -22,75 +22,40 @@
  *              as published by the Free Software Foundation; either version
  *              2 of the License, or (at your option) any later version.
  */
-
-#include <asm/uaccess.h>
-#include <asm/system.h>
+#include <linux/cache.h>
 #include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/socket.h>
-#include <linux/in.h>
-#include <linux/inet.h>
 #include <linux/netdevice.h>
-#include <linux/timer.h>
-#include <net/ip.h>
+#include <linux/spinlock.h>
 #include <net/protocol.h>
-#include <linux/skbuff.h>
-#include <net/sock.h>
-#include <net/icmp.h>
-#include <net/udp.h>
-#include <net/ipip.h>
-#include <linux/igmp.h>
 
-struct net_protocol *inet_protos[MAX_INET_PROTOS] ____cacheline_aligned_in_smp;
-static DEFINE_SPINLOCK(inet_proto_lock);
+const struct net_protocol __rcu *inet_protos[MAX_INET_PROTOS] __read_mostly;
 
 /*
  *      Add a protocol handler to the hash tables
  */
 
-int inet_add_protocol(struct net_protocol *prot, unsigned char protocol)
+int inet_add_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
-        int hash, ret;
-
-        hash = protocol & (MAX_INET_PROTOS - 1);
+        int hash = protocol & (MAX_INET_PROTOS - 1);
 
-        spin_lock_bh(&inet_proto_lock);
-        if (inet_protos[hash]) {
-                ret = -1;
-        } else {
-                inet_protos[hash] = prot;
-                ret = 0;
-        }
-        spin_unlock_bh(&inet_proto_lock);
-
-        return ret;
+        return !cmpxchg((const struct net_protocol **)&inet_protos[hash],
+                        NULL, prot) ? 0 : -1;
 }
+EXPORT_SYMBOL(inet_add_protocol);
 
 /*
  *      Remove a protocol from the hash tables.
  */
 
-int inet_del_protocol(struct net_protocol *prot, unsigned char protocol)
+int inet_del_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
-        int hash, ret;
-
-        hash = protocol & (MAX_INET_PROTOS - 1);
+        int ret, hash = protocol & (MAX_INET_PROTOS - 1);
 
-        spin_lock_bh(&inet_proto_lock);
-        if (inet_protos[hash] == prot) {
-                inet_protos[hash] = NULL;
-                ret = 0;
-        } else {
-                ret = -1;
-        }
-        spin_unlock_bh(&inet_proto_lock);
+        ret = (cmpxchg((const struct net_protocol **)&inet_protos[hash],
+                       prot, NULL) == prot) ? 0 : -1;
 
         synchronize_net();
 
         return ret;
 }
-
-EXPORT_SYMBOL(inet_add_protocol);
 EXPORT_SYMBOL(inet_del_protocol);
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 2979f14bb188..a3d5ab786e81 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -60,7 +60,6 @@
 #include <net/net_namespace.h>
 #include <net/dst.h>
 #include <net/sock.h>
-#include <linux/gfp.h>
 #include <linux/ip.h>
 #include <linux/net.h>
 #include <net/ip.h>
@@ -87,7 +86,7 @@ void raw_hash_sk(struct sock *sk)
         struct raw_hashinfo *h = sk->sk_prot->h.raw_hash;
         struct hlist_head *head;
 
-        head = &h->ht[inet_sk(sk)->num & (RAW_HTABLE_SIZE - 1)];
+        head = &h->ht[inet_sk(sk)->inet_num & (RAW_HTABLE_SIZE - 1)];
 
         write_lock_bh(&h->lock);
         sk_add_node(sk, head);
@@ -115,9 +114,9 @@ static struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
         sk_for_each_from(sk, node) {
                 struct inet_sock *inet = inet_sk(sk);
 
-                if (net_eq(sock_net(sk), net) && inet->num == num       &&
-                    !(inet->daddr && inet->daddr != raddr)              &&
-                    !(inet->rcv_saddr && inet->rcv_saddr != laddr)      &&
+                if (net_eq(sock_net(sk), net) && inet->inet_num == num  &&
+                    !(inet->inet_daddr && inet->inet_daddr != raddr)    &&
+                    !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
                     !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
                         goto found; /* gotcha */
         }
@@ -291,8 +290,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
 {
         /* Charge it to the socket. */
 
-        if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
+        if (ip_queue_rcv_skb(sk, skb) < 0) {
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
@@ -316,7 +314,7 @@ int raw_rcv(struct sock *sk, struct sk_buff *skb)
 }
 
 static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
-                        struct rtable *rt,
+                        struct rtable **rtp,
                         unsigned int flags)
 {
         struct inet_sock *inet = inet_sk(sk);
@@ -325,25 +323,27 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
         struct sk_buff *skb;
         unsigned int iphlen;
         int err;
+        struct rtable *rt = *rtp;
 
-        if (length > rt->u.dst.dev->mtu) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport,
-                               rt->u.dst.dev->mtu);
+        if (length > rt->dst.dev->mtu) {
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport,
+                               rt->dst.dev->mtu);
                 return -EMSGSIZE;
         }
         if (flags&MSG_PROBE)
                 goto out;
 
         skb = sock_alloc_send_skb(sk,
-                                  length + LL_ALLOCATED_SPACE(rt->u.dst.dev) + 15,
+                                  length + LL_ALLOCATED_SPACE(rt->dst.dev) + 15,
                                   flags & MSG_DONTWAIT, &err);
         if (skb == NULL)
                 goto error;
-        skb_reserve(skb, LL_RESERVED_SPACE(rt->u.dst.dev));
+        skb_reserve(skb, LL_RESERVED_SPACE(rt->dst.dev));
 
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
-        skb_dst_set(skb, dst_clone(&rt->u.dst));
+        skb_dst_set(skb, &rt->dst);
+        *rtp = NULL;
 
         skb_reset_network_header(skb);
         iph = ip_hdr(skb);
@@ -352,19 +352,30 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
         skb->ip_summed = CHECKSUM_NONE;
 
         skb->transport_header = skb->network_header;
-        err = memcpy_fromiovecend((void *)iph, from, 0, length);
-        if (err)
-                goto error_fault;
+        err = -EFAULT;
+        if (memcpy_fromiovecend((void *)iph, from, 0, length))
+                goto error_free;
 
-        /* We don't modify invalid header */
         iphlen = iph->ihl * 4;
-        if (iphlen >= sizeof(*iph) && iphlen <= length) {
+
+        /*
+         * We don't want to modify the ip header, but we do need to
+         * be sure that it won't cause problems later along the network
+         * stack.  Specifically we want to make sure that iph->ihl is a
+         * sane value.  If ihl points beyond the length of the buffer passed
+         * in, reject the frame as invalid
+         */
+        err = -EINVAL;
+        if (iphlen > length)
+                goto error_free;
+
+        if (iphlen >= sizeof(*iph)) {
                 if (!iph->saddr)
                         iph->saddr = rt->rt_src;
                 iph->check   = 0;
                 iph->tot_len = htons(length);
                 if (!iph->id)
-                        ip_select_ident(iph, &rt->u.dst, NULL);
+                        ip_select_ident(iph, &rt->dst, NULL);
 
                 iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
         }
@@ -372,20 +383,21 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
                 icmp_out_count(net, ((struct icmphdr *)
                         skb_transport_header(skb))->type);
 
-        err = NF_HOOK(PF_INET, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
-                      dst_output);
+        err = NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, skb, NULL,
+                      rt->dst.dev, dst_output);
         if (err > 0)
-                err = inet->recverr ? net_xmit_errno(err) : 0;
+                err = net_xmit_errno(err);
         if (err)
                 goto error;
 out:
         return 0;
 
-error_fault:
-        err = -EFAULT;
+error_free:
         kfree_skb(skb);
 error:
         IP_INC_STATS(net, IPSTATS_MIB_OUTDISCARDS);
+        if (err == -ENOBUFS && !inet->recverr)
+                err = 0;
         return err;
 }
 
@@ -488,12 +500,12 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 err = -EDESTADDRREQ;
                 if (sk->sk_state != TCP_ESTABLISHED)
                         goto out;
-                daddr = inet->daddr;
+                daddr = inet->inet_daddr;
         }
 
-        ipc.addr = inet->saddr;
+        ipc.addr = inet->inet_saddr;
         ipc.opt = NULL;
-        ipc.shtx.flags = 0;
+        ipc.tx_flags = 0;
         ipc.oif = sk->sk_bound_dev_if;
 
         if (msg->msg_controllen) {
@@ -537,10 +549,9 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         {
                 struct flowi fl = { .oif = ipc.oif,
                                     .mark = sk->sk_mark,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = daddr,
-                                                .saddr = saddr,
-                                                .tos = tos } },
+                                    .fl4_dst = daddr,
+                                    .fl4_src = saddr,
+                                    .fl4_tos = tos,
                                     .proto = inet->hdrincl ? IPPROTO_RAW :
                                                              sk->sk_protocol,
                                   };
@@ -566,7 +577,7 @@ back_from_confirm:
 
         if (inet->hdrincl)
                 err = raw_send_hdrinc(sk, msg->msg_iov, len,
-                                        rt, msg->msg_flags);
+                                        &rt, msg->msg_flags);
 
          else {
                 if (!ipc.addr)
@@ -576,8 +587,11 @@ back_from_confirm:
                                         &ipc, &rt, msg->msg_flags);
                 if (err)
                         ip_flush_pending_frames(sk);
-                else if (!(msg->msg_flags & MSG_MORE))
+                else if (!(msg->msg_flags & MSG_MORE)) {
                         err = ip_push_pending_frames(sk);
+                        if (err == -ENOBUFS && !inet->recverr)
+                                err = 0;
+                }
                 release_sock(sk);
         }
 done:
@@ -591,7 +605,7 @@ out:
         return len;
 
 do_confirm:
-        dst_confirm(&rt->u.dst);
+        dst_confirm(&rt->dst);
         if (!(msg->msg_flags & MSG_PROBE) || len)
                 goto back_from_confirm;
         err = 0;
@@ -630,9 +644,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr->sin_addr.s_addr && chk_addr_ret != RTN_LOCAL &&
             chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
                 goto out;
-        inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
-                inet->saddr = 0;  /* Use device */
+                inet->inet_saddr = 0;  /* Use device */
         sk_dst_reset(sk);
         ret = 0;
 out:    return ret;
@@ -677,7 +691,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (err)
                 goto done;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (sin) {
@@ -702,7 +716,7 @@ static int raw_init(struct sock *sk)
 {
         struct raw_sock *rp = raw_sk(sk);
 
-        if (inet_sk(sk)->num == IPPROTO_ICMP)
+        if (inet_sk(sk)->inet_num == IPPROTO_ICMP)
                 memset(&rp->filter, 0, sizeof(rp->filter));
         return 0;
 }
@@ -736,10 +750,10 @@ out:	return ret;
 }
 
 static int do_raw_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
         if (optname == ICMP_FILTER) {
-                if (inet_sk(sk)->num != IPPROTO_ICMP)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
                         return -EOPNOTSUPP;
                 else
                         return raw_seticmpfilter(sk, optval, optlen);
@@ -748,7 +762,7 @@ static int do_raw_setsockopt(struct sock *sk, int level, int optname,
 }
 
 static int raw_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
         if (level != SOL_RAW)
                 return ip_setsockopt(sk, level, optname, optval, optlen);
@@ -757,7 +771,7 @@ static int raw_setsockopt(struct sock *sk, int level, int optname,
 
 #ifdef CONFIG_COMPAT
 static int compat_raw_setsockopt(struct sock *sk, int level, int optname,
-                                 char __user *optval, int optlen)
+                                 char __user *optval, unsigned int optlen)
 {
         if (level != SOL_RAW)
                 return compat_ip_setsockopt(sk, level, optname, optval, optlen);
@@ -769,7 +783,7 @@ static int do_raw_getsockopt(struct sock *sk, int level, int optname,
                           char __user *optval, int __user *optlen)
 {
         if (optname == ICMP_FILTER) {
-                if (inet_sk(sk)->num != IPPROTO_ICMP)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
                         return -EOPNOTSUPP;
                 else
                         return raw_geticmpfilter(sk, optval, optlen);
@@ -928,10 +942,10 @@ EXPORT_SYMBOL_GPL(raw_seq_stop);
 static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
 {
         struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr,
-               src = inet->rcv_saddr;
+        __be32 dest = inet->inet_daddr,
+               src = inet->inet_rcv_saddr;
         __u16 destp = 0,
-              srcp  = inet->num;
+              srcp  = inet->inet_num;
 
         seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 65b3a8b11a6c..351dc4e85242 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -90,6 +90,7 @@
 #include <linux/jhash.h>
 #include <linux/rcupdate.h>
 #include <linux/times.h>
+#include <linux/slab.h>
 #include <net/dst.h>
 #include <net/net_namespace.h>
 #include <net/protocol.h>
@@ -128,7 +129,6 @@ static int ip_rt_gc_elasticity __read_mostly	= 8;
 static int ip_rt_mtu_expires __read_mostly      = 10 * 60 * HZ;
 static int ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
-static int ip_rt_secret_interval __read_mostly  = 10 * 60 * HZ;
 static int rt_chain_length_max __read_mostly    = 20;
 
 static struct delayed_work expires_work;
@@ -139,28 +139,32 @@ static unsigned long expires_ljiffies;
  */
 
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
+static unsigned int      ipv4_default_advmss(const struct dst_entry *dst);
+static unsigned int      ipv4_default_mtu(const struct dst_entry *dst);
 static void              ipv4_dst_destroy(struct dst_entry *dst);
-static void              ipv4_dst_ifdown(struct dst_entry *dst,
-                                         struct net_device *dev, int how);
 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
 static void              ipv4_link_failure(struct sk_buff *skb);
 static void              ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
 static int rt_garbage_collect(struct dst_ops *ops);
-static void rt_emergency_hash_rebuild(struct net *net);
 
+static void ipv4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+                            int how)
+{
+}
 
 static struct dst_ops ipv4_dst_ops = {
         .family =               AF_INET,
         .protocol =             cpu_to_be16(ETH_P_IP),
         .gc =                   rt_garbage_collect,
         .check =                ipv4_dst_check,
+        .default_advmss =       ipv4_default_advmss,
+        .default_mtu =          ipv4_default_mtu,
         .destroy =              ipv4_dst_destroy,
         .ifdown =               ipv4_dst_ifdown,
         .negative_advice =      ipv4_negative_advice,
         .link_failure =         ipv4_link_failure,
         .update_pmtu =          ip_rt_update_pmtu,
         .local_out =            __ip_local_out,
-        .entries =              ATOMIC_INIT(0),
 };
 
 #define ECN_OR_COST(class)      TC_PRIO_##class
@@ -200,7 +204,7 @@ const __u8 ip_tos2prio[16] = {
  */
 
 struct rt_hash_bucket {
-        struct rtable   *chain;
+        struct rtable __rcu     *chain;
 };
 
 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK) || \
@@ -254,14 +258,12 @@ static unsigned			rt_hash_mask __read_mostly;
 static unsigned int             rt_hash_log  __read_mostly;
 
 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
-#define RT_CACHE_STAT_INC(field) \
-        (__raw_get_cpu_var(rt_cache_stat).field++)
+#define RT_CACHE_STAT_INC(field) __this_cpu_inc(rt_cache_stat.field)
 
 static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
-                int genid)
+                                   int genid)
 {
-        return jhash_3words((__force u32)(__be32)(daddr),
-                            (__force u32)(__be32)(saddr),
+        return jhash_3words((__force u32)daddr, (__force u32)saddr,
                             idx, genid)
                 & rt_hash_mask;
 }
@@ -284,15 +286,15 @@ static struct rtable *rt_cache_get_first(struct seq_file *seq)
         struct rtable *r = NULL;
 
         for (st->bucket = rt_hash_mask; st->bucket >= 0; --st->bucket) {
-                if (!rt_hash_table[st->bucket].chain)
+                if (!rcu_dereference_raw(rt_hash_table[st->bucket].chain))
                         continue;
                 rcu_read_lock_bh();
-                r = rcu_dereference(rt_hash_table[st->bucket].chain);
+                r = rcu_dereference_bh(rt_hash_table[st->bucket].chain);
                 while (r) {
-                        if (dev_net(r->u.dst.dev) == seq_file_net(seq) &&
+                        if (dev_net(r->dst.dev) == seq_file_net(seq) &&
                             r->rt_genid == st->genid)
                                 return r;
-                        r = rcu_dereference(r->u.dst.rt_next);
+                        r = rcu_dereference_bh(r->dst.rt_next);
                 }
                 rcu_read_unlock_bh();
         }
@@ -304,17 +306,17 @@ static struct rtable *__rt_cache_get_next(struct seq_file *seq,
 {
         struct rt_cache_iter_state *st = seq->private;
 
-        r = r->u.dst.rt_next;
+        r = rcu_dereference_bh(r->dst.rt_next);
         while (!r) {
                 rcu_read_unlock_bh();
                 do {
                         if (--st->bucket < 0)
                                 return NULL;
-                } while (!rt_hash_table[st->bucket].chain);
+                } while (!rcu_dereference_raw(rt_hash_table[st->bucket].chain));
                 rcu_read_lock_bh();
-                r = rt_hash_table[st->bucket].chain;
+                r = rcu_dereference_bh(rt_hash_table[st->bucket].chain);
         }
-        return rcu_dereference(r);
+        return r;
 }
 
 static struct rtable *rt_cache_get_next(struct seq_file *seq,
@@ -322,7 +324,7 @@ static struct rtable *rt_cache_get_next(struct seq_file *seq,
 {
         struct rt_cache_iter_state *st = seq->private;
         while ((r = __rt_cache_get_next(seq, r)) != NULL) {
-                if (dev_net(r->u.dst.dev) != seq_file_net(seq))
+                if (dev_net(r->dst.dev) != seq_file_net(seq))
                         continue;
                 if (r->rt_genid == st->genid)
                         break;
@@ -378,20 +380,20 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
                 struct rtable *r = v;
                 int len;
 
-                seq_printf(seq, "%s\t%08lX\t%08lX\t%8X\t%d\t%u\t%d\t"
-                              "%08lX\t%d\t%u\t%u\t%02X\t%d\t%1d\t%08X%n",
-                        r->u.dst.dev ? r->u.dst.dev->name : "*",
-                        (unsigned long)r->rt_dst, (unsigned long)r->rt_gateway,
-                        r->rt_flags, atomic_read(&r->u.dst.__refcnt),
-                        r->u.dst.__use, 0, (unsigned long)r->rt_src,
-                        (dst_metric(&r->u.dst, RTAX_ADVMSS) ?
-                             (int)dst_metric(&r->u.dst, RTAX_ADVMSS) + 40 : 0),
-                        dst_metric(&r->u.dst, RTAX_WINDOW),
-                        (int)((dst_metric(&r->u.dst, RTAX_RTT) >> 3) +
-                              dst_metric(&r->u.dst, RTAX_RTTVAR)),
+                seq_printf(seq, "%s\t%08X\t%08X\t%8X\t%d\t%u\t%d\t"
+                              "%08X\t%d\t%u\t%u\t%02X\t%d\t%1d\t%08X%n",
+                        r->dst.dev ? r->dst.dev->name : "*",
+                        (__force u32)r->rt_dst,
+                        (__force u32)r->rt_gateway,
+                        r->rt_flags, atomic_read(&r->dst.__refcnt),
+                        r->dst.__use, 0, (__force u32)r->rt_src,
+                        dst_metric_advmss(&r->dst) + 40,
+                        dst_metric(&r->dst, RTAX_WINDOW),
+                        (int)((dst_metric(&r->dst, RTAX_RTT) >> 3) +
+                              dst_metric(&r->dst, RTAX_RTTVAR)),
                         r->fl.fl4_tos,
-                        r->u.dst.hh ? atomic_read(&r->u.dst.hh->hh_refcnt) : -1,
-                        r->u.dst.hh ? (r->u.dst.hh->hh_output ==
+                        r->dst.hh ? atomic_read(&r->dst.hh->hh_refcnt) : -1,
+                        r->dst.hh ? (r->dst.hh->hh_output ==
                                        dev_queue_xmit) : 0,
                         r->rt_spec_dst, &len);
 
@@ -468,7 +470,7 @@ static int rt_cpu_seq_show(struct seq_file *seq, void *v)
 
         seq_printf(seq,"%08x  %08x %08x %08x %08x %08x %08x %08x "
                    " %08x %08x %08x %08x %08x %08x %08x %08x %08x \n",
-                   atomic_read(&ipv4_dst_ops.entries),
+                   dst_entries_get_slow(&ipv4_dst_ops),
                    st->in_hit,
                    st->in_slow_tot,
                    st->in_slow_mc,
@@ -513,43 +515,42 @@ static const struct file_operations rt_cpu_seq_fops = {
 };
 
 #ifdef CONFIG_NET_CLS_ROUTE
-static int ip_rt_acct_read(char *buffer, char **start, off_t offset,
-                           int length, int *eof, void *data)
-{
-        unsigned int i;
-
-        if ((offset & 3) || (length & 3))
-                return -EIO;
-
-        if (offset >= sizeof(struct ip_rt_acct) * 256) {
-                *eof = 1;
-                return 0;
-        }
-
-        if (offset + length >= sizeof(struct ip_rt_acct) * 256) {
-                length = sizeof(struct ip_rt_acct) * 256 - offset;
-                *eof = 1;
+static int rt_acct_proc_show(struct seq_file *m, void *v)
+{
+        struct ip_rt_acct *dst, *src;
+        unsigned int i, j;
+
+        dst = kcalloc(256, sizeof(struct ip_rt_acct), GFP_KERNEL);
+        if (!dst)
+                return -ENOMEM;
+
+        for_each_possible_cpu(i) {
+                src = (struct ip_rt_acct *)per_cpu_ptr(ip_rt_acct, i);
+                for (j = 0; j < 256; j++) {
+                        dst[j].o_bytes   += src[j].o_bytes;
+                        dst[j].o_packets += src[j].o_packets;
+                        dst[j].i_bytes   += src[j].i_bytes;
+                        dst[j].i_packets += src[j].i_packets;
+                }
         }
 
-        offset /= sizeof(u32);
-
-        if (length > 0) {
-                u32 *dst = (u32 *) buffer;
-
-                *start = buffer;
-                memset(dst, 0, length);
-
-                for_each_possible_cpu(i) {
-                        unsigned int j;
-                        u32 *src;
+        seq_write(m, dst, 256 * sizeof(struct ip_rt_acct));
+        kfree(dst);
+        return 0;
+}
 
-                        src = ((u32 *) per_cpu_ptr(ip_rt_acct, i)) + offset;
-                        for (j = 0; j < length/4; j++)
-                                dst[j] += src[j];
-                }
-        }
-        return length;
+static int rt_acct_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, rt_acct_proc_show, NULL);
 }
+
+static const struct file_operations rt_acct_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = rt_acct_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
 #endif
 
 static int __net_init ip_rt_do_proc_init(struct net *net)
@@ -567,8 +568,7 @@ static int __net_init ip_rt_do_proc_init(struct net *net)
                 goto err2;
 
 #ifdef CONFIG_NET_CLS_ROUTE
-        pde = create_proc_read_entry("rt_acct", 0, net->proc_net,
-                        ip_rt_acct_read, NULL);
+        pde = proc_create("rt_acct", 0, net->proc_net, &rt_acct_proc_fops);
         if (!pde)
                 goto err3;
 #endif
@@ -588,7 +588,9 @@ static void __net_exit ip_rt_do_proc_exit(struct net *net)
 {
         remove_proc_entry("rt_cache", net->proc_net_stat);
         remove_proc_entry("rt_cache", net->proc_net);
+#ifdef CONFIG_NET_CLS_ROUTE
         remove_proc_entry("rt_acct", net->proc_net);
+#endif
 }
 
 static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
@@ -610,13 +612,13 @@ static inline int ip_rt_proc_init(void)
 
 static inline void rt_free(struct rtable *rt)
 {
-        call_rcu_bh(&rt->u.dst.rcu_head, dst_rcu_free);
+        call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
 }
 
 static inline void rt_drop(struct rtable *rt)
 {
         ip_rt_put(rt);
-        call_rcu_bh(&rt->u.dst.rcu_head, dst_rcu_free);
+        call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
 }
 
 static inline int rt_fast_clean(struct rtable *rth)
@@ -624,13 +626,13 @@ static inline int rt_fast_clean(struct rtable *rth)
         /* Kill broadcast/multicast entries very aggresively, if they
            collide in hash table with more useful entries */
         return (rth->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) &&
-                rth->fl.iif && rth->u.dst.rt_next;
+                rt_is_input_route(rth) && rth->dst.rt_next;
 }
 
 static inline int rt_valuable(struct rtable *rth)
 {
         return (rth->rt_flags & (RTCF_REDIRECTED | RTCF_NOTIFY)) ||
-                rth->u.dst.expires;
+                rth->dst.expires;
 }
 
 static int rt_may_expire(struct rtable *rth, unsigned long tmo1, unsigned long tmo2)
@@ -638,15 +640,15 @@ static int rt_may_expire(struct rtable *rth, unsigned long tmo1, unsigned long t
         unsigned long age;
         int ret = 0;
 
-        if (atomic_read(&rth->u.dst.__refcnt))
+        if (atomic_read(&rth->dst.__refcnt))
                 goto out;
 
         ret = 1;
-        if (rth->u.dst.expires &&
-            time_after_eq(jiffies, rth->u.dst.expires))
+        if (rth->dst.expires &&
+            time_after_eq(jiffies, rth->dst.expires))
                 goto out;
 
-        age = jiffies - rth->u.dst.lastuse;
+        age = jiffies - rth->dst.lastuse;
         ret = 0;
         if ((age <= tmo1 && !rt_fast_clean(rth)) ||
             (age <= tmo2 && rt_valuable(rth)))
@@ -662,14 +664,14 @@ out:	return ret;
  */
 static inline u32 rt_score(struct rtable *rt)
 {
-        u32 score = jiffies - rt->u.dst.lastuse;
+        u32 score = jiffies - rt->dst.lastuse;
 
         score = ~score & ~(3<<30);
 
         if (rt_valuable(rt))
                 score |= (1<<31);
 
-        if (!rt->fl.iif ||
+        if (rt_is_output_route(rt) ||
             !(rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL)))
                 score |= (1<<30);
 
@@ -685,30 +687,29 @@ static inline bool rt_caching(const struct net *net)
 static inline bool compare_hash_inputs(const struct flowi *fl1,
                                         const struct flowi *fl2)
 {
-        return (__force u32)(((fl1->nl_u.ip4_u.daddr ^ fl2->nl_u.ip4_u.daddr) |
-                (fl1->nl_u.ip4_u.saddr ^ fl2->nl_u.ip4_u.saddr) |
+        return ((((__force u32)fl1->fl4_dst ^ (__force u32)fl2->fl4_dst) |
+                ((__force u32)fl1->fl4_src ^ (__force u32)fl2->fl4_src) |
                 (fl1->iif ^ fl2->iif)) == 0);
 }
 
 static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 {
-        return ((__force u32)((fl1->nl_u.ip4_u.daddr ^ fl2->nl_u.ip4_u.daddr) |
-                (fl1->nl_u.ip4_u.saddr ^ fl2->nl_u.ip4_u.saddr)) |
+        return (((__force u32)fl1->fl4_dst ^ (__force u32)fl2->fl4_dst) |
+                ((__force u32)fl1->fl4_src ^ (__force u32)fl2->fl4_src) |
                 (fl1->mark ^ fl2->mark) |
-                (*(u16 *)&fl1->nl_u.ip4_u.tos ^
-                 *(u16 *)&fl2->nl_u.ip4_u.tos) |
+                (*(u16 *)&fl1->fl4_tos ^ *(u16 *)&fl2->fl4_tos) |
                 (fl1->oif ^ fl2->oif) |
                 (fl1->iif ^ fl2->iif)) == 0;
 }
 
 static inline int compare_netns(struct rtable *rt1, struct rtable *rt2)
 {
-        return dev_net(rt1->u.dst.dev) == dev_net(rt2->u.dst.dev);
+        return net_eq(dev_net(rt1->dst.dev), dev_net(rt2->dst.dev));
 }
 
 static inline int rt_is_expired(struct rtable *rth)
 {
-        return rth->rt_genid != rt_genid(dev_net(rth->u.dst.dev));
+        return rth->rt_genid != rt_genid(dev_net(rth->dst.dev));
 }
 
 /*
@@ -716,55 +717,48 @@ static inline int rt_is_expired(struct rtable *rth)
  * Can be called by a softirq or a process.
  * In the later case, we want to be reschedule if necessary
  */
-static void rt_do_flush(int process_context)
+static void rt_do_flush(struct net *net, int process_context)
 {
         unsigned int i;
         struct rtable *rth, *next;
-        struct rtable * tail;
 
         for (i = 0; i <= rt_hash_mask; i++) {
+                struct rtable __rcu **pprev;
+                struct rtable *list;
+
                 if (process_context && need_resched())
                         cond_resched();
-                rth = rt_hash_table[i].chain;
+                rth = rcu_dereference_raw(rt_hash_table[i].chain);
                 if (!rth)
                         continue;
 
                 spin_lock_bh(rt_hash_lock_addr(i));
-#ifdef CONFIG_NET_NS
-                {
-                struct rtable ** prev, * p;
 
-                rth = rt_hash_table[i].chain;
+                list = NULL;
+                pprev = &rt_hash_table[i].chain;
+                rth = rcu_dereference_protected(*pprev,
+                        lockdep_is_held(rt_hash_lock_addr(i)));
 
-                /* defer releasing the head of the list after spin_unlock */
-                for (tail = rth; tail; tail = tail->u.dst.rt_next)
-                        if (!rt_is_expired(tail))
-                                break;
-                if (rth != tail)
-                        rt_hash_table[i].chain = tail;
-
-                /* call rt_free on entries after the tail requiring flush */
-                prev = &rt_hash_table[i].chain;
-                for (p = *prev; p; p = next) {
-                        next = p->u.dst.rt_next;
-                        if (!rt_is_expired(p)) {
-                                prev = &p->u.dst.rt_next;
+                while (rth) {
+                        next = rcu_dereference_protected(rth->dst.rt_next,
+                                lockdep_is_held(rt_hash_lock_addr(i)));
+
+                        if (!net ||
+                            net_eq(dev_net(rth->dst.dev), net)) {
+                                rcu_assign_pointer(*pprev, next);
+                                rcu_assign_pointer(rth->dst.rt_next, list);
+                                list = rth;
                         } else {
-                                *prev = next;
-                                rt_free(p);
+                                pprev = &rth->dst.rt_next;
                         }
+                        rth = next;
                 }
-                }
-#else
-                rth = rt_hash_table[i].chain;
-                rt_hash_table[i].chain = NULL;
-                tail = NULL;
-#endif
+
                 spin_unlock_bh(rt_hash_lock_addr(i));
 
-                for (; rth != tail; rth = next) {
-                        next = rth->u.dst.rt_next;
-                        rt_free(rth);
+                for (; list; list = next) {
+                        next = rcu_dereference_protected(list->dst.rt_next, 1);
+                        rt_free(list);
                 }
         }
 }
@@ -780,11 +774,31 @@ static void rt_do_flush(int process_context)
 #define FRACT_BITS 3
 #define ONE (1UL << FRACT_BITS)
 
+/*
+ * Given a hash chain and an item in this hash chain,
+ * find if a previous entry has the same hash_inputs
+ * (but differs on tos, mark or oif)
+ * Returns 0 if an alias is found.
+ * Returns ONE if rth has no alias before itself.
+ */
+static int has_noalias(const struct rtable *head, const struct rtable *rth)
+{
+        const struct rtable *aux = head;
+
+        while (aux != rth) {
+                if (compare_hash_inputs(&aux->fl, &rth->fl))
+                        return 0;
+                aux = rcu_dereference_protected(aux->dst.rt_next, 1);
+        }
+        return ONE;
+}
+
 static void rt_check_expire(void)
 {
         static unsigned int rover;
         unsigned int i = rover, goal;
-        struct rtable *rth, *aux, **rthp;
+        struct rtable *rth;
+        struct rtable __rcu **rthp;
         unsigned long samples = 0;
         unsigned long sum = 0, sum2 = 0;
         unsigned long delta;
@@ -810,23 +824,24 @@ static void rt_check_expire(void)
 
                 samples++;
 
-                if (*rthp == NULL)
+                if (rcu_dereference_raw(*rthp) == NULL)
                         continue;
                 length = 0;
                 spin_lock_bh(rt_hash_lock_addr(i));
-                while ((rth = *rthp) != NULL) {
-                        prefetch(rth->u.dst.rt_next);
+                while ((rth = rcu_dereference_protected(*rthp,
+                                        lockdep_is_held(rt_hash_lock_addr(i)))) != NULL) {
+                        prefetch(rth->dst.rt_next);
                         if (rt_is_expired(rth)) {
-                                *rthp = rth->u.dst.rt_next;
+                                *rthp = rth->dst.rt_next;
                                 rt_free(rth);
                                 continue;
                         }
-                        if (rth->u.dst.expires) {
+                        if (rth->dst.expires) {
                                 /* Entry is expired even if it is in use */
-                                if (time_before_eq(jiffies, rth->u.dst.expires)) {
+                                if (time_before_eq(jiffies, rth->dst.expires)) {
 nofree:
                                         tmo >>= 1;
-                                        rthp = &rth->u.dst.rt_next;
+                                        rthp = &rth->dst.rt_next;
                                         /*
                                          * We only count entries on
                                          * a chain with equal hash inputs once
@@ -835,22 +850,14 @@ nofree:
                                          * attributes don't unfairly skew
                                          * the length computation
                                          */
-                                        for (aux = rt_hash_table[i].chain;;) {
-                                                if (aux == rth) {
-                                                        length += ONE;
-                                                        break;
-                                                }
-                                                if (compare_hash_inputs(&aux->fl, &rth->fl))
-                                                        break;
-                                                aux = aux->u.dst.rt_next;
-                                        }
+                                        length += has_noalias(rt_hash_table[i].chain, rth);
                                         continue;
                                 }
                         } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout))
                                 goto nofree;
 
                         /* Cleanup aged off entries. */
-                        *rthp = rth->u.dst.rt_next;
+                        *rthp = rth->dst.rt_next;
                         rt_free(rth);
                 }
                 spin_unlock_bh(rt_hash_lock_addr(i));
@@ -899,37 +906,20 @@ void rt_cache_flush(struct net *net, int delay)
 {
         rt_cache_invalidate(net);
         if (delay >= 0)
-                rt_do_flush(!in_softirq());
+                rt_do_flush(net, !in_softirq());
 }
 
-/*
- * We change rt_genid and let gc do the cleanup
- */
-static void rt_secret_rebuild(unsigned long __net)
+/* Flush previous cache invalidated entries from the cache */
+void rt_cache_flush_batch(struct net *net)
 {
-        struct net *net = (struct net *)__net;
-        rt_cache_invalidate(net);
-        mod_timer(&net->ipv4.rt_secret_timer, jiffies + ip_rt_secret_interval);
-}
-
-static void rt_secret_rebuild_oneshot(struct net *net)
-{
-        del_timer_sync(&net->ipv4.rt_secret_timer);
-        rt_cache_invalidate(net);
-        if (ip_rt_secret_interval) {
-                net->ipv4.rt_secret_timer.expires += ip_rt_secret_interval;
-                add_timer(&net->ipv4.rt_secret_timer);
-        }
+        rt_do_flush(net, !in_softirq());
 }
 
 static void rt_emergency_hash_rebuild(struct net *net)
 {
-        if (net_ratelimit()) {
+        if (net_ratelimit())
                 printk(KERN_WARNING "Route hash chain too long!\n");
-                printk(KERN_WARNING "Adjust your secret_interval!\n");
-        }
-
-        rt_secret_rebuild_oneshot(net);
+        rt_cache_invalidate(net);
 }
 
 /*
@@ -951,9 +941,11 @@ static int rt_garbage_collect(struct dst_ops *ops)
         static unsigned long last_gc;
         static int rover;
         static int equilibrium;
-        struct rtable *rth, **rthp;
+        struct rtable *rth;
+        struct rtable __rcu **rthp;
         unsigned long now = jiffies;
         int goal;
+        int entries = dst_entries_get_fast(&ipv4_dst_ops);
 
         /*
          * Garbage collection is pretty expensive,
@@ -963,28 +955,28 @@ static int rt_garbage_collect(struct dst_ops *ops)
         RT_CACHE_STAT_INC(gc_total);
 
         if (now - last_gc < ip_rt_gc_min_interval &&
-            atomic_read(&ipv4_dst_ops.entries) < ip_rt_max_size) {
+            entries < ip_rt_max_size) {
                 RT_CACHE_STAT_INC(gc_ignored);
                 goto out;
         }
 
+        entries = dst_entries_get_slow(&ipv4_dst_ops);
         /* Calculate number of entries, which we want to expire now. */
-        goal = atomic_read(&ipv4_dst_ops.entries) -
-                (ip_rt_gc_elasticity << rt_hash_log);
+        goal = entries - (ip_rt_gc_elasticity << rt_hash_log);
         if (goal <= 0) {
                 if (equilibrium < ipv4_dst_ops.gc_thresh)
                         equilibrium = ipv4_dst_ops.gc_thresh;
-                goal = atomic_read(&ipv4_dst_ops.entries) - equilibrium;
+                goal = entries - equilibrium;
                 if (goal > 0) {
                         equilibrium += min_t(unsigned int, goal >> 1, rt_hash_mask + 1);
-                        goal = atomic_read(&ipv4_dst_ops.entries) - equilibrium;
+                        goal = entries - equilibrium;
                 }
         } else {
                 /* We are in dangerous area. Try to reduce cache really
                  * aggressively.
                  */
                 goal = max_t(unsigned int, goal >> 1, rt_hash_mask + 1);
-                equilibrium = atomic_read(&ipv4_dst_ops.entries) - goal;
+                equilibrium = entries - goal;
         }
 
         if (now - last_gc >= ip_rt_gc_min_interval)
@@ -1004,14 +996,15 @@ static int rt_garbage_collect(struct dst_ops *ops)
                         k = (k + 1) & rt_hash_mask;
                         rthp = &rt_hash_table[k].chain;
                         spin_lock_bh(rt_hash_lock_addr(k));
-                        while ((rth = *rthp) != NULL) {
+                        while ((rth = rcu_dereference_protected(*rthp,
+                                        lockdep_is_held(rt_hash_lock_addr(k)))) != NULL) {
                                 if (!rt_is_expired(rth) &&
                                         !rt_may_expire(rth, tmo, expire)) {
                                         tmo >>= 1;
-                                        rthp = &rth->u.dst.rt_next;
+                                        rthp = &rth->dst.rt_next;
                                         continue;
                                 }
-                                *rthp = rth->u.dst.rt_next;
+                                *rthp = rth->dst.rt_next;
                                 rt_free(rth);
                                 goal--;
                         }
@@ -1041,14 +1034,16 @@ static int rt_garbage_collect(struct dst_ops *ops)
                 expire >>= 1;
 #if RT_CACHE_DEBUG >= 2
                 printk(KERN_DEBUG "expire>> %u %d %d %d\n", expire,
-                                atomic_read(&ipv4_dst_ops.entries), goal, i);
+                                dst_entries_get_fast(&ipv4_dst_ops), goal, i);
 #endif
 
-                if (atomic_read(&ipv4_dst_ops.entries) < ip_rt_max_size)
+                if (dst_entries_get_fast(&ipv4_dst_ops) < ip_rt_max_size)
                         goto out;
         } while (!in_softirq() && time_before_eq(jiffies, now));
 
-        if (atomic_read(&ipv4_dst_ops.entries) < ip_rt_max_size)
+        if (dst_entries_get_fast(&ipv4_dst_ops) < ip_rt_max_size)
+                goto out;
+        if (dst_entries_get_slow(&ipv4_dst_ops) < ip_rt_max_size)
                 goto out;
         if (net_ratelimit())
                 printk(KERN_WARNING "dst cache overflow\n");
@@ -1058,21 +1053,37 @@ static int rt_garbage_collect(struct dst_ops *ops)
 work_done:
         expire += ip_rt_gc_min_interval;
         if (expire > ip_rt_gc_timeout ||
-            atomic_read(&ipv4_dst_ops.entries) < ipv4_dst_ops.gc_thresh)
+            dst_entries_get_fast(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh ||
+            dst_entries_get_slow(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh)
                 expire = ip_rt_gc_timeout;
 #if RT_CACHE_DEBUG >= 2
         printk(KERN_DEBUG "expire++ %u %d %d %d\n", expire,
-                        atomic_read(&ipv4_dst_ops.entries), goal, rover);
+                        dst_entries_get_fast(&ipv4_dst_ops), goal, rover);
 #endif
 out:    return 0;
 }
 
+/*
+ * Returns number of entries in a hash chain that have different hash_inputs
+ */
+static int slow_chain_length(const struct rtable *head)
+{
+        int length = 0;
+        const struct rtable *rth = head;
+
+        while (rth) {
+                length += has_noalias(head, rth);
+                rth = rcu_dereference_protected(rth->dst.rt_next, 1);
+        }
+        return length >> FRACT_BITS;
+}
+
 static int rt_intern_hash(unsigned hash, struct rtable *rt,
-                          struct rtable **rp, struct sk_buff *skb)
+                          struct rtable **rp, struct sk_buff *skb, int ifindex)
 {
-        struct rtable   *rth, **rthp;
+        struct rtable   *rth, *cand;
+        struct rtable __rcu **rthp, **candp;
         unsigned long   now;
-        struct rtable *cand, **candp;
         u32             min_score;
         int             chain_length;
         int attempts = !in_softirq();
@@ -1084,7 +1095,7 @@ restart:
         candp = NULL;
         now = jiffies;
 
-        if (!rt_caching(dev_net(rt->u.dst.dev))) {
+        if (!rt_caching(dev_net(rt->dst.dev))) {
                 /*
                  * If we're not caching, just tell the caller we
                  * were successful and don't touch the route.  The
@@ -1093,28 +1104,48 @@ restart:
                  * If we drop it here, the callers have no way to resolve routes
                  * when we're not caching.  Instead, just point *rp at rt, so
                  * the caller gets a single use out of the route
+                 * Note that we do rt_free on this new route entry, so that
+                 * once its refcount hits zero, we are still able to reap it
+                 * (Thanks Alexey)
+                 * Note: To avoid expensive rcu stuff for this uncached dst,
+                 * we set DST_NOCACHE so that dst_release() can free dst without
+                 * waiting a grace period.
                  */
-                goto report_and_exit;
+
+                rt->dst.flags |= DST_NOCACHE;
+                if (rt->rt_type == RTN_UNICAST || rt_is_output_route(rt)) {
+                        int err = arp_bind_neighbour(&rt->dst);
+                        if (err) {
+                                if (net_ratelimit())
+                                        printk(KERN_WARNING
+                                            "Neighbour table failure & not caching routes.\n");
+                                ip_rt_put(rt);
+                                return err;
+                        }
+                }
+
+                goto skip_hashing;
         }
 
         rthp = &rt_hash_table[hash].chain;
 
         spin_lock_bh(rt_hash_lock_addr(hash));
-        while ((rth = *rthp) != NULL) {
+        while ((rth = rcu_dereference_protected(*rthp,
+                        lockdep_is_held(rt_hash_lock_addr(hash)))) != NULL) {
                 if (rt_is_expired(rth)) {
-                        *rthp = rth->u.dst.rt_next;
+                        *rthp = rth->dst.rt_next;
                         rt_free(rth);
                         continue;
                 }
                 if (compare_keys(&rth->fl, &rt->fl) && compare_netns(rth, rt)) {
                         /* Put it first */
-                        *rthp = rth->u.dst.rt_next;
+                        *rthp = rth->dst.rt_next;
                         /*
                          * Since lookup is lockfree, the deletion
                          * must be visible to another weakly ordered CPU before
                          * the insertion at the start of the hash chain.
                          */
-                        rcu_assign_pointer(rth->u.dst.rt_next,
+                        rcu_assign_pointer(rth->dst.rt_next,
                                            rt_hash_table[hash].chain);
                         /*
                          * Since lookup is lockfree, the update writes
@@ -1122,18 +1153,18 @@ restart:
                          */
                         rcu_assign_pointer(rt_hash_table[hash].chain, rth);
 
-                        dst_use(&rth->u.dst, now);
+                        dst_use(&rth->dst, now);
                         spin_unlock_bh(rt_hash_lock_addr(hash));
 
                         rt_drop(rt);
                         if (rp)
                                 *rp = rth;
                         else
-                                skb_dst_set(skb, &rth->u.dst);
+                                skb_dst_set(skb, &rth->dst);
                         return 0;
                 }
 
-                if (!atomic_read(&rth->u.dst.__refcnt)) {
+                if (!atomic_read(&rth->dst.__refcnt)) {
                         u32 score = rt_score(rth);
 
                         if (score <= min_score) {
@@ -1145,7 +1176,7 @@ restart:
 
                 chain_length++;
 
-                rthp = &rth->u.dst.rt_next;
+                rthp = &rth->dst.rt_next;
         }
 
         if (cand) {
@@ -1156,26 +1187,32 @@ restart:
                  * only 2 entries per bucket. We will see.
                  */
                 if (chain_length > ip_rt_gc_elasticity) {
-                        *candp = cand->u.dst.rt_next;
+                        *candp = cand->dst.rt_next;
                         rt_free(cand);
                 }
         } else {
-                if (chain_length > rt_chain_length_max) {
-                        struct net *net = dev_net(rt->u.dst.dev);
+                if (chain_length > rt_chain_length_max &&
+                    slow_chain_length(rt_hash_table[hash].chain) > rt_chain_length_max) {
+                        struct net *net = dev_net(rt->dst.dev);
                         int num = ++net->ipv4.current_rt_cache_rebuild_count;
-                        if (!rt_caching(dev_net(rt->u.dst.dev))) {
+                        if (!rt_caching(net)) {
                                 printk(KERN_WARNING "%s: %d rebuilds is over limit, route caching disabled\n",
-                                        rt->u.dst.dev->name, num);
+                                        rt->dst.dev->name, num);
                         }
-                        rt_emergency_hash_rebuild(dev_net(rt->u.dst.dev));
+                        rt_emergency_hash_rebuild(net);
+                        spin_unlock_bh(rt_hash_lock_addr(hash));
+
+                        hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
+                                        ifindex, rt_genid(net));
+                        goto restart;
                 }
         }
 
         /* Try to bind route to arp only if it is output
            route or unicast forwarding path.
          */
-        if (rt->rt_type == RTN_UNICAST || rt->fl.iif == 0) {
-                int err = arp_bind_neighbour(&rt->u.dst);
+        if (rt->rt_type == RTN_UNICAST || rt_is_output_route(rt)) {
+                int err = arp_bind_neighbour(&rt->dst);
                 if (err) {
                         spin_unlock_bh(rt_hash_lock_addr(hash));
 
@@ -1200,19 +1237,20 @@ restart:
                         }
 
                         if (net_ratelimit())
-                                printk(KERN_WARNING "Neighbour table overflow.\n");
+                                printk(KERN_WARNING "ipv4: Neighbour table overflow.\n");
                         rt_drop(rt);
                         return -ENOBUFS;
                 }
         }
 
-        rt->u.dst.rt_next = rt_hash_table[hash].chain;
+        rt->dst.rt_next = rt_hash_table[hash].chain;
 
 #if RT_CACHE_DEBUG >= 2
-        if (rt->u.dst.rt_next) {
+        if (rt->dst.rt_next) {
                 struct rtable *trt;
-                printk(KERN_DEBUG "rt_cache @%02x: %pI4", hash, &rt->rt_dst);
-                for (trt = rt->u.dst.rt_next; trt; trt = trt->u.dst.rt_next)
+                printk(KERN_DEBUG "rt_cache @%02x: %pI4",
+                       hash, &rt->rt_dst);
+                for (trt = rt->dst.rt_next; trt; trt = trt->dst.rt_next)
                         printk(" . %pI4", &trt->rt_dst);
                 printk("\n");
         }
@@ -1226,28 +1264,21 @@ restart:
 
         spin_unlock_bh(rt_hash_lock_addr(hash));
 
-report_and_exit:
+skip_hashing:
         if (rp)
                 *rp = rt;
         else
-                skb_dst_set(skb, &rt->u.dst);
+                skb_dst_set(skb, &rt->dst);
         return 0;
 }
 
 void rt_bind_peer(struct rtable *rt, int create)
 {
-        static DEFINE_SPINLOCK(rt_peer_lock);
         struct inet_peer *peer;
 
-        peer = inet_getpeer(rt->rt_dst, create);
+        peer = inet_getpeer_v4(rt->rt_dst, create);
 
-        spin_lock_bh(&rt_peer_lock);
-        if (rt->peer == NULL) {
-                rt->peer = peer;
-                peer = NULL;
-        }
-        spin_unlock_bh(&rt_peer_lock);
-        if (peer)
+        if (peer && cmpxchg(&rt->peer, NULL, peer) != NULL)
                 inet_putpeer(peer);
 }
 
@@ -1292,31 +1323,36 @@ void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
 
         ip_select_fb_ident(iph);
 }
+EXPORT_SYMBOL(__ip_select_ident);
 
 static void rt_del(unsigned hash, struct rtable *rt)
 {
-        struct rtable **rthp, *aux;
+        struct rtable __rcu **rthp;
+        struct rtable *aux;
 
         rthp = &rt_hash_table[hash].chain;
         spin_lock_bh(rt_hash_lock_addr(hash));
         ip_rt_put(rt);
-        while ((aux = *rthp) != NULL) {
+        while ((aux = rcu_dereference_protected(*rthp,
+                        lockdep_is_held(rt_hash_lock_addr(hash)))) != NULL) {
                 if (aux == rt || rt_is_expired(aux)) {
-                        *rthp = aux->u.dst.rt_next;
+                        *rthp = aux->dst.rt_next;
                         rt_free(aux);
                         continue;
                 }
-                rthp = &aux->u.dst.rt_next;
+                rthp = &aux->dst.rt_next;
         }
         spin_unlock_bh(rt_hash_lock_addr(hash));
 }
 
+/* called in rcu_read_lock() section */
 void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                     __be32 saddr, struct net_device *dev)
 {
         int i, k;
-        struct in_device *in_dev = in_dev_get(dev);
-        struct rtable *rth, **rthp;
+        struct in_device *in_dev = __in_dev_get_rcu(dev);
+        struct rtable *rth;
+        struct rtable __rcu **rthp;
         __be32  skeys[2] = { saddr, 0 };
         int  ikeys[2] = { dev->ifindex, 0 };
         struct netevent_redirect netevent;
@@ -1326,9 +1362,9 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                 return;
 
         net = dev_net(dev);
-        if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev)
-            || ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw)
-            || ipv4_is_zeronet(new_gw))
+        if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev) ||
+            ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw) ||
+            ipv4_is_zeronet(new_gw))
                 goto reject_redirect;
 
         if (!rt_caching(net))
@@ -1349,55 +1385,50 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                         unsigned hash = rt_hash(daddr, skeys[i], ikeys[k],
                                                 rt_genid(net));
 
-                        rthp=&rt_hash_table[hash].chain;
+                        rthp = &rt_hash_table[hash].chain;
 
-                        rcu_read_lock();
                         while ((rth = rcu_dereference(*rthp)) != NULL) {
                                 struct rtable *rt;
 
                                 if (rth->fl.fl4_dst != daddr ||
                                     rth->fl.fl4_src != skeys[i] ||
                                     rth->fl.oif != ikeys[k] ||
-                                    rth->fl.iif != 0 ||
+                                    rt_is_input_route(rth) ||
                                     rt_is_expired(rth) ||
-                                    !net_eq(dev_net(rth->u.dst.dev), net)) {
-                                        rthp = &rth->u.dst.rt_next;
+                                    !net_eq(dev_net(rth->dst.dev), net)) {
+                                        rthp = &rth->dst.rt_next;
                                         continue;
                                 }
 
                                 if (rth->rt_dst != daddr ||
                                     rth->rt_src != saddr ||
-                                    rth->u.dst.error ||
+                                    rth->dst.error ||
                                     rth->rt_gateway != old_gw ||
-                                    rth->u.dst.dev != dev)
+                                    rth->dst.dev != dev)
                                         break;
 
-                                dst_hold(&rth->u.dst);
-                                rcu_read_unlock();
+                                dst_hold(&rth->dst);
 
                                 rt = dst_alloc(&ipv4_dst_ops);
                                 if (rt == NULL) {
                                         ip_rt_put(rth);
-                                        in_dev_put(in_dev);
                                         return;
                                 }
 
                                 /* Copy all the information. */
                                 *rt = *rth;
-                                rt->u.dst.__use         = 1;
-                                atomic_set(&rt->u.dst.__refcnt, 1);
-                                rt->u.dst.child         = NULL;
-                                if (rt->u.dst.dev)
-                                        dev_hold(rt->u.dst.dev);
-                                if (rt->idev)
-                                        in_dev_hold(rt->idev);
-                                rt->u.dst.obsolete      = 0;
-                                rt->u.dst.lastuse       = jiffies;
-                                rt->u.dst.path          = &rt->u.dst;
-                                rt->u.dst.neighbour     = NULL;
-                                rt->u.dst.hh            = NULL;
+                                rt->dst.__use           = 1;
+                                atomic_set(&rt->dst.__refcnt, 1);
+                                rt->dst.child           = NULL;
+                                if (rt->dst.dev)
+                                        dev_hold(rt->dst.dev);
+                                rt->dst.obsolete        = -1;
+                                rt->dst.lastuse = jiffies;
+                                rt->dst.path            = &rt->dst;
+                                rt->dst.neighbour       = NULL;
+                                rt->dst.hh              = NULL;
 #ifdef CONFIG_XFRM
-                                rt->u.dst.xfrm          = NULL;
+                                rt->dst.xfrm            = NULL;
 #endif
                                 rt->rt_genid            = rt_genid(net);
                                 rt->rt_flags            |= RTCF_REDIRECTED;
@@ -1406,37 +1437,35 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                 rt->rt_gateway          = new_gw;
 
                                 /* Redirect received -> path was valid */
-                                dst_confirm(&rth->u.dst);
+                                dst_confirm(&rth->dst);
 
                                 if (rt->peer)
                                         atomic_inc(&rt->peer->refcnt);
 
-                                if (arp_bind_neighbour(&rt->u.dst) ||
-                                    !(rt->u.dst.neighbour->nud_state &
+                                if (arp_bind_neighbour(&rt->dst) ||
+                                    !(rt->dst.neighbour->nud_state &
                                             NUD_VALID)) {
-                                        if (rt->u.dst.neighbour)
-                                                neigh_event_send(rt->u.dst.neighbour, NULL);
+                                        if (rt->dst.neighbour)
+                                                neigh_event_send(rt->dst.neighbour, NULL);
                                         ip_rt_put(rth);
                                         rt_drop(rt);
                                         goto do_next;
                                 }
 
-                                netevent.old = &rth->u.dst;
-                                netevent.new = &rt->u.dst;
+                                netevent.old = &rth->dst;
+                                netevent.new = &rt->dst;
                                 call_netevent_notifiers(NETEVENT_REDIRECT,
                                                         &netevent);
 
                                 rt_del(hash, rth);
-                                if (!rt_intern_hash(hash, rt, &rt, NULL))
+                                if (!rt_intern_hash(hash, rt, &rt, NULL, rt->fl.oif))
                                         ip_rt_put(rt);
                                 goto do_next;
                         }
-                        rcu_read_unlock();
                 do_next:
                         ;
                 }
         }
-        in_dev_put(in_dev);
         return;
 
 reject_redirect:
@@ -1447,7 +1476,7 @@ reject_redirect:
                        &old_gw, dev->name, &new_gw,
                        &saddr, &daddr);
 #endif
-        in_dev_put(in_dev);
+        ;
 }
 
 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
@@ -1456,11 +1485,12 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
         struct dst_entry *ret = dst;
 
         if (rt) {
-                if (dst->obsolete) {
+                if (dst->obsolete > 0) {
                         ip_rt_put(rt);
                         ret = NULL;
                 } else if ((rt->rt_flags & RTCF_REDIRECTED) ||
-                           rt->u.dst.expires) {
+                           (rt->dst.expires &&
+                            time_after_eq(jiffies, rt->dst.expires))) {
                         unsigned hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
                                                 rt->fl.oif,
                                                 rt_genid(dev_net(dst->dev)));
@@ -1494,49 +1524,51 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
 void ip_rt_send_redirect(struct sk_buff *skb)
 {
         struct rtable *rt = skb_rtable(skb);
-        struct in_device *in_dev = in_dev_get(rt->u.dst.dev);
+        struct in_device *in_dev;
+        int log_martians;
 
-        if (!in_dev)
+        rcu_read_lock();
+        in_dev = __in_dev_get_rcu(rt->dst.dev);
+        if (!in_dev || !IN_DEV_TX_REDIRECTS(in_dev)) {
+                rcu_read_unlock();
                 return;
-
-        if (!IN_DEV_TX_REDIRECTS(in_dev))
-                goto out;
+        }
+        log_martians = IN_DEV_LOG_MARTIANS(in_dev);
+        rcu_read_unlock();
 
         /* No redirected packets during ip_rt_redirect_silence;
          * reset the algorithm.
          */
-        if (time_after(jiffies, rt->u.dst.rate_last + ip_rt_redirect_silence))
-                rt->u.dst.rate_tokens = 0;
+        if (time_after(jiffies, rt->dst.rate_last + ip_rt_redirect_silence))
+                rt->dst.rate_tokens = 0;
 
         /* Too many ignored redirects; do not send anything
-         * set u.dst.rate_last to the last seen redirected packet.
+         * set dst.rate_last to the last seen redirected packet.
          */
-        if (rt->u.dst.rate_tokens >= ip_rt_redirect_number) {
-                rt->u.dst.rate_last = jiffies;
-                goto out;
+        if (rt->dst.rate_tokens >= ip_rt_redirect_number) {
+                rt->dst.rate_last = jiffies;
+                return;
         }
 
         /* Check for load limit; set rate_last to the latest sent
          * redirect.
          */
-        if (rt->u.dst.rate_tokens == 0 ||
+        if (rt->dst.rate_tokens == 0 ||
             time_after(jiffies,
-                       (rt->u.dst.rate_last +
-                        (ip_rt_redirect_load << rt->u.dst.rate_tokens)))) {
+                       (rt->dst.rate_last +
+                        (ip_rt_redirect_load << rt->dst.rate_tokens)))) {
                 icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, rt->rt_gateway);
-                rt->u.dst.rate_last = jiffies;
-                ++rt->u.dst.rate_tokens;
+                rt->dst.rate_last = jiffies;
+                ++rt->dst.rate_tokens;
 #ifdef CONFIG_IP_ROUTE_VERBOSE
-                if (IN_DEV_LOG_MARTIANS(in_dev) &&
-                    rt->u.dst.rate_tokens == ip_rt_redirect_number &&
+                if (log_martians &&
+                    rt->dst.rate_tokens == ip_rt_redirect_number &&
                     net_ratelimit())
                         printk(KERN_WARNING "host %pI4/if%d ignores redirects for %pI4 to %pI4.\n",
                                 &rt->rt_src, rt->rt_iif,
                                 &rt->rt_dst, &rt->rt_gateway);
 #endif
         }
-out:
-        in_dev_put(in_dev);
 }
 
 static int ip_error(struct sk_buff *skb)
@@ -1545,7 +1577,7 @@ static int ip_error(struct sk_buff *skb)
         unsigned long now;
         int code;
 
-        switch (rt->u.dst.error) {
+        switch (rt->dst.error) {
                 case EINVAL:
                 default:
                         goto out;
@@ -1554,7 +1586,7 @@ static int ip_error(struct sk_buff *skb)
                         break;
                 case ENETUNREACH:
                         code = ICMP_NET_UNREACH;
-                        IP_INC_STATS_BH(dev_net(rt->u.dst.dev),
+                        IP_INC_STATS_BH(dev_net(rt->dst.dev),
                                         IPSTATS_MIB_INNOROUTES);
                         break;
                 case EACCES:
@@ -1563,12 +1595,12 @@ static int ip_error(struct sk_buff *skb)
         }
 
         now = jiffies;
-        rt->u.dst.rate_tokens += now - rt->u.dst.rate_last;
-        if (rt->u.dst.rate_tokens > ip_rt_error_burst)
-                rt->u.dst.rate_tokens = ip_rt_error_burst;
-        rt->u.dst.rate_last = now;
-        if (rt->u.dst.rate_tokens >= ip_rt_error_cost) {
-                rt->u.dst.rate_tokens -= ip_rt_error_cost;
+        rt->dst.rate_tokens += now - rt->dst.rate_last;
+        if (rt->dst.rate_tokens > ip_rt_error_burst)
+                rt->dst.rate_tokens = ip_rt_error_burst;
+        rt->dst.rate_last = now;
+        if (rt->dst.rate_tokens >= ip_rt_error_cost) {
+                rt->dst.rate_tokens -= ip_rt_error_cost;
                 icmp_send(skb, ICMP_DEST_UNREACH, code, 0);
         }
 
@@ -1606,9 +1638,6 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
         __be32  daddr = iph->daddr;
         unsigned short est_mtu = 0;
 
-        if (ipv4_config.no_pmtu_disc)
-                return 0;
-
         for (k = 0; k < 2; k++) {
                 for (i = 0; i < 2; i++) {
                         unsigned hash = rt_hash(daddr, skeys[i], ikeys[k],
@@ -1616,7 +1645,7 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
 
                         rcu_read_lock();
                         for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
-                             rth = rcu_dereference(rth->u.dst.rt_next)) {
+                             rth = rcu_dereference(rth->dst.rt_next)) {
                                 unsigned short mtu = new_mtu;
 
                                 if (rth->fl.fl4_dst != daddr ||
@@ -1624,9 +1653,9 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
                                     rth->rt_dst != daddr ||
                                     rth->rt_src != iph->saddr ||
                                     rth->fl.oif != ikeys[k] ||
-                                    rth->fl.iif != 0 ||
-                                    dst_metric_locked(&rth->u.dst, RTAX_MTU) ||
-                                    !net_eq(dev_net(rth->u.dst.dev), net) ||
+                                    rt_is_input_route(rth) ||
+                                    dst_metric_locked(&rth->dst, RTAX_MTU) ||
+                                    !net_eq(dev_net(rth->dst.dev), net) ||
                                     rt_is_expired(rth))
                                         continue;
 
@@ -1634,22 +1663,25 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
 
                                         /* BSD 4.2 compatibility hack :-( */
                                         if (mtu == 0 &&
-                                            old_mtu >= dst_mtu(&rth->u.dst) &&
+                                            old_mtu >= dst_mtu(&rth->dst) &&
                                             old_mtu >= 68 + (iph->ihl << 2))
                                                 old_mtu -= iph->ihl << 2;
 
                                         mtu = guess_mtu(old_mtu);
                                 }
-                                if (mtu <= dst_mtu(&rth->u.dst)) {
-                                        if (mtu < dst_mtu(&rth->u.dst)) {
-                                                dst_confirm(&rth->u.dst);
+                                if (mtu <= dst_mtu(&rth->dst)) {
+                                        if (mtu < dst_mtu(&rth->dst)) {
+                                                dst_confirm(&rth->dst);
                                                 if (mtu < ip_rt_min_pmtu) {
+                                                        u32 lock = dst_metric(&rth->dst,
+                                                                              RTAX_LOCK);
                                                         mtu = ip_rt_min_pmtu;
-                                                        rth->u.dst.metrics[RTAX_LOCK-1] |=
-                                                                (1 << RTAX_MTU);
+                                                        lock |= (1 << RTAX_MTU);
+                                                        dst_metric_set(&rth->dst, RTAX_LOCK,
+                                                                       lock);
                                                 }
-                                                rth->u.dst.metrics[RTAX_MTU-1] = mtu;
-                                                dst_set_expires(&rth->u.dst,
+                                                dst_metric_set(&rth->dst, RTAX_MTU, mtu);
+                                                dst_set_expires(&rth->dst,
                                                         ip_rt_mtu_expires);
                                         }
                                         est_mtu = mtu;
@@ -1666,10 +1698,11 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
         if (dst_mtu(dst) > mtu && mtu >= 68 &&
             !(dst_metric_locked(dst, RTAX_MTU))) {
                 if (mtu < ip_rt_min_pmtu) {
+                        u32 lock = dst_metric(dst, RTAX_LOCK);
                         mtu = ip_rt_min_pmtu;
-                        dst->metrics[RTAX_LOCK-1] |= (1 << RTAX_MTU);
+                        dst_metric_set(dst, RTAX_LOCK, lock | (1 << RTAX_MTU));
                 }
-                dst->metrics[RTAX_MTU-1] = mtu;
+                dst_metric_set(dst, RTAX_MTU, mtu);
                 dst_set_expires(dst, ip_rt_mtu_expires);
                 call_netevent_notifiers(NETEVENT_PMTU_UPDATE, dst);
         }
@@ -1677,40 +1710,22 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 {
-        return NULL;
+        if (rt_is_expired((struct rtable *)dst))
+                return NULL;
+        return dst;
 }
 
 static void ipv4_dst_destroy(struct dst_entry *dst)
 {
         struct rtable *rt = (struct rtable *) dst;
         struct inet_peer *peer = rt->peer;
-        struct in_device *idev = rt->idev;
 
         if (peer) {
                 rt->peer = NULL;
                 inet_putpeer(peer);
         }
-
-        if (idev) {
-                rt->idev = NULL;
-                in_dev_put(idev);
-        }
 }
 
-static void ipv4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
-                            int how)
-{
-        struct rtable *rt = (struct rtable *) dst;
-        struct in_device *idev = rt->idev;
-        if (dev != dev_net(dev)->loopback_dev && idev && idev->dev == dev) {
-                struct in_device *loopback_idev =
-                        in_dev_get(dev_net(dev)->loopback_dev);
-                if (loopback_idev) {
-                        rt->idev = loopback_idev;
-                        in_dev_put(idev);
-                }
-        }
-}
 
 static void ipv4_link_failure(struct sk_buff *skb)
 {
@@ -1720,7 +1735,7 @@ static void ipv4_link_failure(struct sk_buff *skb)
 
         rt = skb_rtable(skb);
         if (rt)
-                dst_set_expires(&rt->u.dst, 0);
+                dst_set_expires(&rt->dst, 0);
 }
 
 static int ip_rt_bug(struct sk_buff *skb)
@@ -1746,59 +1761,79 @@ void ip_rt_get_source(u8 *addr, struct rtable *rt)
         __be32 src;
         struct fib_result res;
 
-        if (rt->fl.iif == 0)
+        if (rt_is_output_route(rt))
                 src = rt->rt_src;
-        else if (fib_lookup(dev_net(rt->u.dst.dev), &rt->fl, &res) == 0) {
-                src = FIB_RES_PREFSRC(res);
-                fib_res_put(&res);
-        } else
-                src = inet_select_addr(rt->u.dst.dev, rt->rt_gateway,
+        else {
+                rcu_read_lock();
+                if (fib_lookup(dev_net(rt->dst.dev), &rt->fl, &res) == 0)
+                        src = FIB_RES_PREFSRC(res);
+                else
+                        src = inet_select_addr(rt->dst.dev, rt->rt_gateway,
                                         RT_SCOPE_UNIVERSE);
+                rcu_read_unlock();
+        }
         memcpy(addr, &src, 4);
 }
 
 #ifdef CONFIG_NET_CLS_ROUTE
 static void set_class_tag(struct rtable *rt, u32 tag)
 {
-        if (!(rt->u.dst.tclassid & 0xFFFF))
-                rt->u.dst.tclassid |= tag & 0xFFFF;
-        if (!(rt->u.dst.tclassid & 0xFFFF0000))
-                rt->u.dst.tclassid |= tag & 0xFFFF0000;
+        if (!(rt->dst.tclassid & 0xFFFF))
+                rt->dst.tclassid |= tag & 0xFFFF;
+        if (!(rt->dst.tclassid & 0xFFFF0000))
+                rt->dst.tclassid |= tag & 0xFFFF0000;
 }
 #endif
 
+static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
+{
+        unsigned int advmss = dst_metric_raw(dst, RTAX_ADVMSS);
+
+        if (advmss == 0) {
+                advmss = max_t(unsigned int, dst->dev->mtu - 40,
+                               ip_rt_min_advmss);
+                if (advmss > 65535 - 40)
+                        advmss = 65535 - 40;
+        }
+        return advmss;
+}
+
+static unsigned int ipv4_default_mtu(const struct dst_entry *dst)
+{
+        unsigned int mtu = dst->dev->mtu;
+
+        if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
+                const struct rtable *rt = (const struct rtable *) dst;
+
+                if (rt->rt_gateway != rt->rt_dst && mtu > 576)
+                        mtu = 576;
+        }
+
+        if (mtu > IP_MAX_MTU)
+                mtu = IP_MAX_MTU;
+
+        return mtu;
+}
+
 static void rt_set_nexthop(struct rtable *rt, struct fib_result *res, u32 itag)
 {
+        struct dst_entry *dst = &rt->dst;
         struct fib_info *fi = res->fi;
 
         if (fi) {
                 if (FIB_RES_GW(*res) &&
                     FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
                         rt->rt_gateway = FIB_RES_GW(*res);
-                memcpy(rt->u.dst.metrics, fi->fib_metrics,
-                       sizeof(rt->u.dst.metrics));
-                if (fi->fib_mtu == 0) {
-                        rt->u.dst.metrics[RTAX_MTU-1] = rt->u.dst.dev->mtu;
-                        if (dst_metric_locked(&rt->u.dst, RTAX_MTU) &&
-                            rt->rt_gateway != rt->rt_dst &&
-                            rt->u.dst.dev->mtu > 576)
-                                rt->u.dst.metrics[RTAX_MTU-1] = 576;
-                }
+                dst_import_metrics(dst, fi->fib_metrics);
 #ifdef CONFIG_NET_CLS_ROUTE
-                rt->u.dst.tclassid = FIB_RES_NH(*res).nh_tclassid;
+                dst->tclassid = FIB_RES_NH(*res).nh_tclassid;
 #endif
-        } else
-                rt->u.dst.metrics[RTAX_MTU-1]= rt->u.dst.dev->mtu;
-
-        if (dst_metric(&rt->u.dst, RTAX_HOPLIMIT) == 0)
-                rt->u.dst.metrics[RTAX_HOPLIMIT-1] = sysctl_ip_default_ttl;
-        if (dst_mtu(&rt->u.dst) > IP_MAX_MTU)
-                rt->u.dst.metrics[RTAX_MTU-1] = IP_MAX_MTU;
-        if (dst_metric(&rt->u.dst, RTAX_ADVMSS) == 0)
-                rt->u.dst.metrics[RTAX_ADVMSS-1] = max_t(unsigned int, rt->u.dst.dev->mtu - 40,
-                                       ip_rt_min_advmss);
-        if (dst_metric(&rt->u.dst, RTAX_ADVMSS) > 65535 - 40)
-                rt->u.dst.metrics[RTAX_ADVMSS-1] = 65535 - 40;
+        }
+
+        if (dst_mtu(dst) > IP_MAX_MTU)
+                dst_metric_set(dst, RTAX_MTU, IP_MAX_MTU);
+        if (dst_metric_raw(dst, RTAX_ADVMSS) > 65535 - 40)
+                dst_metric_set(dst, RTAX_ADVMSS, 65535 - 40);
 
 #ifdef CONFIG_NET_CLS_ROUTE
 #ifdef CONFIG_IP_MULTIPLE_TABLES
@@ -1809,14 +1844,16 @@ static void rt_set_nexthop(struct rtable *rt, struct fib_result *res, u32 itag)
         rt->rt_type = res->type;
 }
 
+/* called in rcu_read_lock() section */
 static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                                 u8 tos, struct net_device *dev, int our)
 {
-        unsigned hash;
+        unsigned int hash;
         struct rtable *rth;
         __be32 spec_dst;
-        struct in_device *in_dev = in_dev_get(dev);
+        struct in_device *in_dev = __in_dev_get_rcu(dev);
         u32 itag = 0;
+        int err;
 
         /* Primary sanity checks. */
 
@@ -1831,20 +1868,23 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                 if (!ipv4_is_local_multicast(daddr))
                         goto e_inval;
                 spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
-        } else if (fib_validate_source(saddr, 0, tos, 0,
-                                        dev, &spec_dst, &itag) < 0)
-                goto e_inval;
-
+        } else {
+                err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
+                                          &itag, 0);
+                if (err < 0)
+                        goto e_err;
+        }
         rth = dst_alloc(&ipv4_dst_ops);
         if (!rth)
                 goto e_nobufs;
 
-        rth->u.dst.output= ip_rt_bug;
+        rth->dst.output = ip_rt_bug;
+        rth->dst.obsolete = -1;
 
-        atomic_set(&rth->u.dst.__refcnt, 1);
-        rth->u.dst.flags= DST_HOST;
+        atomic_set(&rth->dst.__refcnt, 1);
+        rth->dst.flags= DST_HOST;
         if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
-                rth->u.dst.flags |= DST_NOPOLICY;
+                rth->dst.flags |= DST_NOPOLICY;
         rth->fl.fl4_dst = daddr;
         rth->rt_dst     = daddr;
         rth->fl.fl4_tos = tos;
@@ -1852,13 +1892,12 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         rth->fl.fl4_src = saddr;
         rth->rt_src     = saddr;
 #ifdef CONFIG_NET_CLS_ROUTE
-        rth->u.dst.tclassid = itag;
+        rth->dst.tclassid = itag;
 #endif
         rth->rt_iif     =
         rth->fl.iif     = dev->ifindex;
-        rth->u.dst.dev  = init_net.loopback_dev;
-        dev_hold(rth->u.dst.dev);
-        rth->idev       = in_dev_get(rth->u.dst.dev);
+        rth->dst.dev    = init_net.loopback_dev;
+        dev_hold(rth->dst.dev);
         rth->fl.oif     = 0;
         rth->rt_gateway = daddr;
         rth->rt_spec_dst= spec_dst;
@@ -1866,27 +1905,25 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         rth->rt_flags   = RTCF_MULTICAST;
         rth->rt_type    = RTN_MULTICAST;
         if (our) {
-                rth->u.dst.input= ip_local_deliver;
+                rth->dst.input= ip_local_deliver;
                 rth->rt_flags |= RTCF_LOCAL;
         }
 
 #ifdef CONFIG_IP_MROUTE
         if (!ipv4_is_local_multicast(daddr) && IN_DEV_MFORWARD(in_dev))
-                rth->u.dst.input = ip_mr_input;
+                rth->dst.input = ip_mr_input;
 #endif
         RT_CACHE_STAT_INC(in_slow_mc);
 
-        in_dev_put(in_dev);
         hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev)));
-        return rt_intern_hash(hash, rth, NULL, skb);
+        return rt_intern_hash(hash, rth, NULL, skb, dev->ifindex);
 
 e_nobufs:
-        in_dev_put(in_dev);
         return -ENOBUFS;
-
 e_inval:
-        in_dev_put(in_dev);
         return -EINVAL;
+e_err:
+        return err;
 }
 
 
@@ -1920,22 +1957,22 @@ static void ip_handle_martian_source(struct net_device *dev,
 #endif
 }
 
+/* called in rcu_read_lock() section */
 static int __mkroute_input(struct sk_buff *skb,
                            struct fib_result *res,
                            struct in_device *in_dev,
                            __be32 daddr, __be32 saddr, u32 tos,
                            struct rtable **result)
 {
-
         struct rtable *rth;
         int err;
         struct in_device *out_dev;
-        unsigned flags = 0;
+        unsigned int flags = 0;
         __be32 spec_dst;
         u32 itag;
 
         /* get a working reference to the output device */
-        out_dev = in_dev_get(FIB_RES_DEV(*res));
+        out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
         if (out_dev == NULL) {
                 if (net_ratelimit())
                         printk(KERN_CRIT "Bug in ip_route_input" \
@@ -1945,12 +1982,11 @@ static int __mkroute_input(struct sk_buff *skb,
 
 
         err = fib_validate_source(saddr, daddr, tos, FIB_RES_OIF(*res),
-                                  in_dev->dev, &spec_dst, &itag);
+                                  in_dev->dev, &spec_dst, &itag, skb->mark);
         if (err < 0) {
                 ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
                                          saddr);
 
-                err = -EINVAL;
                 goto cleanup;
         }
 
@@ -1965,8 +2001,13 @@ static int __mkroute_input(struct sk_buff *skb,
         if (skb->protocol != htons(ETH_P_IP)) {
                 /* Not IP (i.e. ARP). Do not create route, if it is
                  * invalid for proxy arp. DNAT routes are always valid.
+                 *
+                 * Proxy arp feature have been extended to allow, ARP
+                 * replies back to the same interface, to support
+                 * Private VLAN switch technologies. See arp.c.
                  */
-                if (out_dev == in_dev) {
+                if (out_dev == in_dev &&
+                    IN_DEV_PROXY_ARP_PVLAN(in_dev) == 0) {
                         err = -EINVAL;
                         goto cleanup;
                 }
@@ -1979,12 +2020,12 @@ static int __mkroute_input(struct sk_buff *skb,
                 goto cleanup;
         }
 
-        atomic_set(&rth->u.dst.__refcnt, 1);
-        rth->u.dst.flags= DST_HOST;
+        atomic_set(&rth->dst.__refcnt, 1);
+        rth->dst.flags= DST_HOST;
         if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
-                rth->u.dst.flags |= DST_NOPOLICY;
+                rth->dst.flags |= DST_NOPOLICY;
         if (IN_DEV_CONF_GET(out_dev, NOXFRM))
-                rth->u.dst.flags |= DST_NOXFRM;
+                rth->dst.flags |= DST_NOXFRM;
         rth->fl.fl4_dst = daddr;
         rth->rt_dst     = daddr;
         rth->fl.fl4_tos = tos;
@@ -1994,15 +2035,15 @@ static int __mkroute_input(struct sk_buff *skb,
         rth->rt_gateway = daddr;
         rth->rt_iif     =
                 rth->fl.iif     = in_dev->dev->ifindex;
-        rth->u.dst.dev  = (out_dev)->dev;
-        dev_hold(rth->u.dst.dev);
-        rth->idev       = in_dev_get(rth->u.dst.dev);
+        rth->dst.dev    = (out_dev)->dev;
+        dev_hold(rth->dst.dev);
         rth->fl.oif     = 0;
         rth->rt_spec_dst= spec_dst;
 
-        rth->u.dst.input = ip_forward;
-        rth->u.dst.output = ip_output;
-        rth->rt_genid = rt_genid(dev_net(rth->u.dst.dev));
+        rth->dst.obsolete = -1;
+        rth->dst.input = ip_forward;
+        rth->dst.output = ip_output;
+        rth->rt_genid = rt_genid(dev_net(rth->dst.dev));
 
         rt_set_nexthop(rth, res, itag);
 
@@ -2011,8 +2052,6 @@ static int __mkroute_input(struct sk_buff *skb,
         *result = rth;
         err = 0;
  cleanup:
-        /* release the working reference to the output device */
-        in_dev_put(out_dev);
         return err;
 }
 
@@ -2038,8 +2077,8 @@ static int ip_mkroute_input(struct sk_buff *skb,
 
         /* put it into the cache */
         hash = rt_hash(daddr, saddr, fl->iif,
-                       rt_genid(dev_net(rth->u.dst.dev)));
-        return rt_intern_hash(hash, rth, NULL, skb);
+                       rt_genid(dev_net(rth->dst.dev)));
+        return rt_intern_hash(hash, rth, NULL, skb, fl->iif);
 }
 
 /*
@@ -2050,19 +2089,18 @@ static int ip_mkroute_input(struct sk_buff *skb,
  *      Such approach solves two big problems:
  *      1. Not simplex devices are handled properly.
  *      2. IP spoofing attempts are filtered with 100% of guarantee.
+ *      called with rcu_read_lock()
  */
 
 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                                u8 tos, struct net_device *dev)
 {
         struct fib_result res;
-        struct in_device *in_dev = in_dev_get(dev);
-        struct flowi fl = { .nl_u = { .ip4_u =
-                                      { .daddr = daddr,
-                                        .saddr = saddr,
-                                        .tos = tos,
-                                        .scope = RT_SCOPE_UNIVERSE,
-                                      } },
+        struct in_device *in_dev = __in_dev_get_rcu(dev);
+        struct flowi fl = { .fl4_dst    = daddr,
+                            .fl4_src    = saddr,
+                            .fl4_tos    = tos,
+                            .fl4_scope  = RT_SCOPE_UNIVERSE,
                             .mark = skb->mark,
                             .iif = dev->ifindex };
         unsigned        flags = 0;
@@ -2071,7 +2109,6 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         unsigned        hash;
         __be32          spec_dst;
         int             err = -EINVAL;
-        int             free_res = 0;
         struct net    * net = dev_net(dev);
 
         /* IP on this device is disabled. */
@@ -2087,7 +2124,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
             ipv4_is_loopback(saddr))
                 goto martian_source;
 
-        if (daddr == htonl(0xFFFFFFFF) || (saddr == 0 && daddr == 0))
+        if (ipv4_is_lbcast(daddr) || (saddr == 0 && daddr == 0))
                 goto brd_input;
 
         /* Accept zero addresses only to limited broadcast;
@@ -2096,19 +2133,18 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         if (ipv4_is_zeronet(saddr))
                 goto martian_source;
 
-        if (ipv4_is_lbcast(daddr) || ipv4_is_zeronet(daddr) ||
-            ipv4_is_loopback(daddr))
+        if (ipv4_is_zeronet(daddr) || ipv4_is_loopback(daddr))
                 goto martian_destination;
 
         /*
          *      Now we are ready to route packet.
          */
-        if ((err = fib_lookup(net, &fl, &res)) != 0) {
+        err = fib_lookup(net, &fl, &res);
+        if (err != 0) {
                 if (!IN_DEV_FORWARD(in_dev))
                         goto e_hostunreach;
                 goto no_route;
         }
-        free_res = 1;
 
         RT_CACHE_STAT_INC(in_slow_tot);
 
@@ -2116,13 +2152,12 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                 goto brd_input;
 
         if (res.type == RTN_LOCAL) {
-                int result;
-                result = fib_validate_source(saddr, daddr, tos,
-                                             net->loopback_dev->ifindex,
-                                             dev, &spec_dst, &itag);
-                if (result < 0)
-                        goto martian_source;
-                if (result)
+                err = fib_validate_source(saddr, daddr, tos,
+                                          net->loopback_dev->ifindex,
+                                          dev, &spec_dst, &itag, skb->mark);
+                if (err < 0)
+                        goto martian_source_keep_err;
+                if (err)
                         flags |= RTCF_DIRECTSRC;
                 spec_dst = daddr;
                 goto local_input;
@@ -2134,10 +2169,6 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                 goto martian_destination;
 
         err = ip_mkroute_input(skb, &res, &fl, in_dev, daddr, saddr, tos);
-done:
-        in_dev_put(in_dev);
-        if (free_res)
-                fib_res_put(&res);
 out:    return err;
 
 brd_input:
@@ -2148,9 +2179,9 @@ brd_input:
                 spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
         else {
                 err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
-                                          &itag);
+                                          &itag, skb->mark);
                 if (err < 0)
-                        goto martian_source;
+                        goto martian_source_keep_err;
                 if (err)
                         flags |= RTCF_DIRECTSRC;
         }
@@ -2163,13 +2194,14 @@ local_input:
         if (!rth)
                 goto e_nobufs;
 
-        rth->u.dst.output= ip_rt_bug;
+        rth->dst.output= ip_rt_bug;
+        rth->dst.obsolete = -1;
         rth->rt_genid = rt_genid(net);
 
-        atomic_set(&rth->u.dst.__refcnt, 1);
-        rth->u.dst.flags= DST_HOST;
+        atomic_set(&rth->dst.__refcnt, 1);
+        rth->dst.flags= DST_HOST;
         if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
-                rth->u.dst.flags |= DST_NOPOLICY;
+                rth->dst.flags |= DST_NOPOLICY;
         rth->fl.fl4_dst = daddr;
         rth->rt_dst     = daddr;
         rth->fl.fl4_tos = tos;
@@ -2177,26 +2209,25 @@ local_input:
         rth->fl.fl4_src = saddr;
         rth->rt_src     = saddr;
 #ifdef CONFIG_NET_CLS_ROUTE
-        rth->u.dst.tclassid = itag;
+        rth->dst.tclassid = itag;
 #endif
         rth->rt_iif     =
         rth->fl.iif     = dev->ifindex;
-        rth->u.dst.dev  = net->loopback_dev;
-        dev_hold(rth->u.dst.dev);
-        rth->idev       = in_dev_get(rth->u.dst.dev);
+        rth->dst.dev    = net->loopback_dev;
+        dev_hold(rth->dst.dev);
         rth->rt_gateway = daddr;
         rth->rt_spec_dst= spec_dst;
-        rth->u.dst.input= ip_local_deliver;
+        rth->dst.input= ip_local_deliver;
         rth->rt_flags   = flags|RTCF_LOCAL;
         if (res.type == RTN_UNREACHABLE) {
-                rth->u.dst.input= ip_error;
-                rth->u.dst.error= -err;
+                rth->dst.input= ip_error;
+                rth->dst.error= -err;
                 rth->rt_flags   &= ~RTCF_LOCAL;
         }
         rth->rt_type    = res.type;
         hash = rt_hash(daddr, saddr, fl.iif, rt_genid(net));
-        err = rt_intern_hash(hash, rth, NULL, skb);
-        goto done;
+        err = rt_intern_hash(hash, rth, NULL, skb, fl.iif);
+        goto out;
 
 no_route:
         RT_CACHE_STAT_INC(in_no_route);
@@ -2219,57 +2250,65 @@ martian_destination:
 
 e_hostunreach:
         err = -EHOSTUNREACH;
-        goto done;
+        goto out;
 
 e_inval:
         err = -EINVAL;
-        goto done;
+        goto out;
 
 e_nobufs:
         err = -ENOBUFS;
-        goto done;
+        goto out;
 
 martian_source:
+        err = -EINVAL;
+martian_source_keep_err:
         ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);
-        goto e_inval;
+        goto out;
 }
 
-int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
-                   u8 tos, struct net_device *dev)
+int ip_route_input_common(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+                           u8 tos, struct net_device *dev, bool noref)
 {
         struct rtable * rth;
         unsigned        hash;
         int iif = dev->ifindex;
         struct net *net;
+        int res;
 
         net = dev_net(dev);
 
+        rcu_read_lock();
+
         if (!rt_caching(net))
                 goto skip_cache;
 
         tos &= IPTOS_RT_MASK;
         hash = rt_hash(daddr, saddr, iif, rt_genid(net));
 
-        rcu_read_lock();
         for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
-             rth = rcu_dereference(rth->u.dst.rt_next)) {
-                if (((rth->fl.fl4_dst ^ daddr) |
-                     (rth->fl.fl4_src ^ saddr) |
+             rth = rcu_dereference(rth->dst.rt_next)) {
+                if ((((__force u32)rth->fl.fl4_dst ^ (__force u32)daddr) |
+                     ((__force u32)rth->fl.fl4_src ^ (__force u32)saddr) |
                      (rth->fl.iif ^ iif) |
                      rth->fl.oif |
                      (rth->fl.fl4_tos ^ tos)) == 0 &&
                     rth->fl.mark == skb->mark &&
-                    net_eq(dev_net(rth->u.dst.dev), net) &&
+                    net_eq(dev_net(rth->dst.dev), net) &&
                     !rt_is_expired(rth)) {
-                        dst_use(&rth->u.dst, jiffies);
+                        if (noref) {
+                                dst_use_noref(&rth->dst, jiffies);
+                                skb_dst_set_noref(skb, &rth->dst);
+                        } else {
+                                dst_use(&rth->dst, jiffies);
+                                skb_dst_set(skb, &rth->dst);
+                        }
                         RT_CACHE_STAT_INC(in_hit);
                         rcu_read_unlock();
-                        skb_dst_set(skb, &rth->u.dst);
                         return 0;
                 }
                 RT_CACHE_STAT_INC(in_hlist_search);
         }
-        rcu_read_unlock();
 
 skip_cache:
         /* Multicast recognition logic is moved from route cache to here.
@@ -2284,29 +2323,34 @@ skip_cache:
            route cache entry is created eventually.
          */
         if (ipv4_is_multicast(daddr)) {
-                struct in_device *in_dev;
+                struct in_device *in_dev = __in_dev_get_rcu(dev);
 
-                rcu_read_lock();
-                if ((in_dev = __in_dev_get_rcu(dev)) != NULL) {
+                if (in_dev) {
                         int our = ip_check_mc(in_dev, daddr, saddr,
-                                ip_hdr(skb)->protocol);
+                                              ip_hdr(skb)->protocol);
                         if (our
 #ifdef CONFIG_IP_MROUTE
-                            || (!ipv4_is_local_multicast(daddr) &&
-                                IN_DEV_MFORWARD(in_dev))
+                                ||
+                            (!ipv4_is_local_multicast(daddr) &&
+                             IN_DEV_MFORWARD(in_dev))
 #endif
-                            ) {
+                           ) {
+                                int res = ip_route_input_mc(skb, daddr, saddr,
+                                                            tos, dev, our);
                                 rcu_read_unlock();
-                                return ip_route_input_mc(skb, daddr, saddr,
-                                                         tos, dev, our);
+                                return res;
                         }
                 }
                 rcu_read_unlock();
                 return -EINVAL;
         }
-        return ip_route_input_slow(skb, daddr, saddr, tos, dev);
+        res = ip_route_input_slow(skb, daddr, saddr, tos, dev);
+        rcu_read_unlock();
+        return res;
 }
+EXPORT_SYMBOL(ip_route_input_common);
 
+/* called with rcu_read_lock() */
 static int __mkroute_output(struct rtable **result,
                             struct fib_result *res,
                             const struct flowi *fl,
@@ -2317,60 +2361,51 @@ static int __mkroute_output(struct rtable **result,
         struct rtable *rth;
         struct in_device *in_dev;
         u32 tos = RT_FL_TOS(oldflp);
-        int err = 0;
 
-        if (ipv4_is_loopback(fl->fl4_src) && !(dev_out->flags&IFF_LOOPBACK))
+        if (ipv4_is_loopback(fl->fl4_src) && !(dev_out->flags & IFF_LOOPBACK))
                 return -EINVAL;
 
-        if (fl->fl4_dst == htonl(0xFFFFFFFF))
+        if (ipv4_is_lbcast(fl->fl4_dst))
                 res->type = RTN_BROADCAST;
         else if (ipv4_is_multicast(fl->fl4_dst))
                 res->type = RTN_MULTICAST;
-        else if (ipv4_is_lbcast(fl->fl4_dst) || ipv4_is_zeronet(fl->fl4_dst))
+        else if (ipv4_is_zeronet(fl->fl4_dst))
                 return -EINVAL;
 
         if (dev_out->flags & IFF_LOOPBACK)
                 flags |= RTCF_LOCAL;
 
-        /* get work reference to inet device */
-        in_dev = in_dev_get(dev_out);
+        in_dev = __in_dev_get_rcu(dev_out);
         if (!in_dev)
                 return -EINVAL;
 
         if (res->type == RTN_BROADCAST) {
                 flags |= RTCF_BROADCAST | RTCF_LOCAL;
-                if (res->fi) {
-                        fib_info_put(res->fi);
-                        res->fi = NULL;
-                }
+                res->fi = NULL;
         } else if (res->type == RTN_MULTICAST) {
-                flags |= RTCF_MULTICAST|RTCF_LOCAL;
+                flags |= RTCF_MULTICAST | RTCF_LOCAL;
                 if (!ip_check_mc(in_dev, oldflp->fl4_dst, oldflp->fl4_src,
                                  oldflp->proto))
                         flags &= ~RTCF_LOCAL;
                 /* If multicast route do not exist use
-                   default one, but do not gateway in this case.
-                   Yes, it is hack.
+                 * default one, but do not gateway in this case.
+                 * Yes, it is hack.
                  */
-                if (res->fi && res->prefixlen < 4) {
-                        fib_info_put(res->fi);
+                if (res->fi && res->prefixlen < 4)
                         res->fi = NULL;
-                }
         }
 
 
         rth = dst_alloc(&ipv4_dst_ops);
-        if (!rth) {
-                err = -ENOBUFS;
-                goto cleanup;
-        }
+        if (!rth)
+                return -ENOBUFS;
 
-        atomic_set(&rth->u.dst.__refcnt, 1);
-        rth->u.dst.flags= DST_HOST;
+        atomic_set(&rth->dst.__refcnt, 1);
+        rth->dst.flags= DST_HOST;
         if (IN_DEV_CONF_GET(in_dev, NOXFRM))
-                rth->u.dst.flags |= DST_NOXFRM;
+                rth->dst.flags |= DST_NOXFRM;
         if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
-                rth->u.dst.flags |= DST_NOPOLICY;
+                rth->dst.flags |= DST_NOPOLICY;
 
         rth->fl.fl4_dst = oldflp->fl4_dst;
         rth->fl.fl4_tos = tos;
@@ -2382,34 +2417,34 @@ static int __mkroute_output(struct rtable **result,
         rth->rt_iif     = oldflp->oif ? : dev_out->ifindex;
         /* get references to the devices that are to be hold by the routing
            cache entry */
-        rth->u.dst.dev  = dev_out;
+        rth->dst.dev    = dev_out;
         dev_hold(dev_out);
-        rth->idev       = in_dev_get(dev_out);
         rth->rt_gateway = fl->fl4_dst;
         rth->rt_spec_dst= fl->fl4_src;
 
-        rth->u.dst.output=ip_output;
+        rth->dst.output=ip_output;
+        rth->dst.obsolete = -1;
         rth->rt_genid = rt_genid(dev_net(dev_out));
 
         RT_CACHE_STAT_INC(out_slow_tot);
 
         if (flags & RTCF_LOCAL) {
-                rth->u.dst.input = ip_local_deliver;
+                rth->dst.input = ip_local_deliver;
                 rth->rt_spec_dst = fl->fl4_dst;
         }
         if (flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
                 rth->rt_spec_dst = fl->fl4_src;
                 if (flags & RTCF_LOCAL &&
                     !(dev_out->flags & IFF_LOOPBACK)) {
-                        rth->u.dst.output = ip_mc_output;
+                        rth->dst.output = ip_mc_output;
                         RT_CACHE_STAT_INC(out_slow_mc);
                 }
 #ifdef CONFIG_IP_MROUTE
                 if (res->type == RTN_MULTICAST) {
                         if (IN_DEV_MFORWARD(in_dev) &&
                             !ipv4_is_local_multicast(oldflp->fl4_dst)) {
-                                rth->u.dst.input = ip_mr_input;
-                                rth->u.dst.output = ip_mc_output;
+                                rth->dst.input = ip_mr_input;
+                                rth->dst.output = ip_mc_output;
                         }
                 }
 #endif
@@ -2418,15 +2453,11 @@ static int __mkroute_output(struct rtable **result,
         rt_set_nexthop(rth, res, 0);
 
         rth->rt_flags = flags;
-
         *result = rth;
- cleanup:
-        /* release work reference to inet device */
-        in_dev_put(in_dev);
-
-        return err;
+        return 0;
 }
 
+/* called with rcu_read_lock() */
 static int ip_mkroute_output(struct rtable **rp,
                              struct fib_result *res,
                              const struct flowi *fl,
@@ -2440,7 +2471,7 @@ static int ip_mkroute_output(struct rtable **rp,
         if (err == 0) {
                 hash = rt_hash(oldflp->fl4_dst, oldflp->fl4_src, oldflp->oif,
                                rt_genid(dev_net(dev_out)));
-                err = rt_intern_hash(hash, rth, rp, NULL);
+                err = rt_intern_hash(hash, rth, rp, NULL, oldflp->oif);
         }
 
         return err;
@@ -2448,27 +2479,24 @@ static int ip_mkroute_output(struct rtable **rp,
 
 /*
  * Major route resolver routine.
+ * called with rcu_read_lock();
  */
 
 static int ip_route_output_slow(struct net *net, struct rtable **rp,
                                 const struct flowi *oldflp)
 {
         u32 tos = RT_FL_TOS(oldflp);
-        struct flowi fl = { .nl_u = { .ip4_u =
-                                      { .daddr = oldflp->fl4_dst,
-                                        .saddr = oldflp->fl4_src,
-                                        .tos = tos & IPTOS_RT_MASK,
-                                        .scope = ((tos & RTO_ONLINK) ?
-                                                  RT_SCOPE_LINK :
-                                                  RT_SCOPE_UNIVERSE),
-                                      } },
+        struct flowi fl = { .fl4_dst = oldflp->fl4_dst,
+                            .fl4_src = oldflp->fl4_src,
+                            .fl4_tos = tos & IPTOS_RT_MASK,
+                            .fl4_scope = ((tos & RTO_ONLINK) ?
+                                          RT_SCOPE_LINK : RT_SCOPE_UNIVERSE),
                             .mark = oldflp->mark,
                             .iif = net->loopback_dev->ifindex,
                             .oif = oldflp->oif };
         struct fib_result res;
-        unsigned flags = 0;
+        unsigned int flags = 0;
         struct net_device *dev_out = NULL;
-        int free_res = 0;
         int err;
 
 
@@ -2492,11 +2520,11 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                       of another iface. --ANK
                  */
 
-                if (oldflp->oif == 0
-                    && (ipv4_is_multicast(oldflp->fl4_dst) ||
-                        oldflp->fl4_dst == htonl(0xFFFFFFFF))) {
+                if (oldflp->oif == 0 &&
+                    (ipv4_is_multicast(oldflp->fl4_dst) ||
+                     ipv4_is_lbcast(oldflp->fl4_dst))) {
                         /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
-                        dev_out = ip_dev_find(net, oldflp->fl4_src);
+                        dev_out = __ip_dev_find(net, oldflp->fl4_src, false);
                         if (dev_out == NULL)
                                 goto out;
 
@@ -2521,29 +2549,25 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
 
                 if (!(oldflp->flags & FLOWI_FLAG_ANYSRC)) {
                         /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
-                        dev_out = ip_dev_find(net, oldflp->fl4_src);
-                        if (dev_out == NULL)
+                        if (!__ip_dev_find(net, oldflp->fl4_src, false))
                                 goto out;
-                        dev_put(dev_out);
-                        dev_out = NULL;
                 }
         }
 
 
         if (oldflp->oif) {
-                dev_out = dev_get_by_index(net, oldflp->oif);
+                dev_out = dev_get_by_index_rcu(net, oldflp->oif);
                 err = -ENODEV;
                 if (dev_out == NULL)
                         goto out;
 
                 /* RACE: Check return value of inet_select_addr instead. */
-                if (__in_dev_get_rtnl(dev_out) == NULL) {
-                        dev_put(dev_out);
-                        goto out;       /* Wrong error code */
+                if (!(dev_out->flags & IFF_UP) || !__in_dev_get_rcu(dev_out)) {
+                        err = -ENETUNREACH;
+                        goto out;
                 }
-
                 if (ipv4_is_local_multicast(oldflp->fl4_dst) ||
-                    oldflp->fl4_dst == htonl(0xFFFFFFFF)) {
+                    ipv4_is_lbcast(oldflp->fl4_dst)) {
                         if (!fl.fl4_src)
                                 fl.fl4_src = inet_select_addr(dev_out, 0,
                                                               RT_SCOPE_LINK);
@@ -2563,10 +2587,7 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                 fl.fl4_dst = fl.fl4_src;
                 if (!fl.fl4_dst)
                         fl.fl4_dst = fl.fl4_src = htonl(INADDR_LOOPBACK);
-                if (dev_out)
-                        dev_put(dev_out);
                 dev_out = net->loopback_dev;
-                dev_hold(dev_out);
                 fl.oif = net->loopback_dev->ifindex;
                 res.type = RTN_LOCAL;
                 flags |= RTCF_LOCAL;
@@ -2600,23 +2621,19 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                         res.type = RTN_UNICAST;
                         goto make_route;
                 }
-                if (dev_out)
-                        dev_put(dev_out);
                 err = -ENETUNREACH;
                 goto out;
         }
-        free_res = 1;
 
         if (res.type == RTN_LOCAL) {
-                if (!fl.fl4_src)
-                        fl.fl4_src = fl.fl4_dst;
-                if (dev_out)
-                        dev_put(dev_out);
+                if (!fl.fl4_src) {
+                        if (res.fi->fib_prefsrc)
+                                fl.fl4_src = res.fi->fib_prefsrc;
+                        else
+                                fl.fl4_src = fl.fl4_dst;
+                }
                 dev_out = net->loopback_dev;
-                dev_hold(dev_out);
                 fl.oif = dev_out->ifindex;
-                if (res.fi)
-                        fib_info_put(res.fi);
                 res.fi = NULL;
                 flags |= RTCF_LOCAL;
                 goto make_route;
@@ -2633,28 +2650,21 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
         if (!fl.fl4_src)
                 fl.fl4_src = FIB_RES_PREFSRC(res);
 
-        if (dev_out)
-                dev_put(dev_out);
         dev_out = FIB_RES_DEV(res);
-        dev_hold(dev_out);
         fl.oif = dev_out->ifindex;
 
 
 make_route:
         err = ip_mkroute_output(rp, &res, &fl, oldflp, dev_out, flags);
 
-
-        if (free_res)
-                fib_res_put(&res);
-        if (dev_out)
-                dev_put(dev_out);
 out:    return err;
 }
 
 int __ip_route_output_key(struct net *net, struct rtable **rp,
                           const struct flowi *flp)
 {
-        unsigned hash;
+        unsigned int hash;
+        int res;
         struct rtable *rth;
 
         if (!rt_caching(net))
@@ -2663,18 +2673,18 @@ int __ip_route_output_key(struct net *net, struct rtable **rp,
         hash = rt_hash(flp->fl4_dst, flp->fl4_src, flp->oif, rt_genid(net));
 
         rcu_read_lock_bh();
-        for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
-                rth = rcu_dereference(rth->u.dst.rt_next)) {
+        for (rth = rcu_dereference_bh(rt_hash_table[hash].chain); rth;
+                rth = rcu_dereference_bh(rth->dst.rt_next)) {
                 if (rth->fl.fl4_dst == flp->fl4_dst &&
                     rth->fl.fl4_src == flp->fl4_src &&
-                    rth->fl.iif == 0 &&
+                    rt_is_output_route(rth) &&
                     rth->fl.oif == flp->oif &&
                     rth->fl.mark == flp->mark &&
                     !((rth->fl.fl4_tos ^ flp->fl4_tos) &
                             (IPTOS_RT_MASK | RTO_ONLINK)) &&
-                    net_eq(dev_net(rth->u.dst.dev), net) &&
+                    net_eq(dev_net(rth->dst.dev), net) &&
                     !rt_is_expired(rth)) {
-                        dst_use(&rth->u.dst, jiffies);
+                        dst_use(&rth->dst, jiffies);
                         RT_CACHE_STAT_INC(out_hit);
                         rcu_read_unlock_bh();
                         *rp = rth;
@@ -2685,11 +2695,18 @@ int __ip_route_output_key(struct net *net, struct rtable **rp,
         rcu_read_unlock_bh();
 
 slow_output:
-        return ip_route_output_slow(net, rp, flp);
+        rcu_read_lock();
+        res = ip_route_output_slow(net, rp, flp);
+        rcu_read_unlock();
+        return res;
 }
-
 EXPORT_SYMBOL_GPL(__ip_route_output_key);
 
+static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie)
+{
+        return NULL;
+}
+
 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
@@ -2698,9 +2715,8 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
         .family                 =       AF_INET,
         .protocol               =       cpu_to_be16(ETH_P_IP),
         .destroy                =       ipv4_dst_destroy,
-        .check                  =       ipv4_dst_check,
+        .check                  =       ipv4_blackhole_dst_check,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
-        .entries                =       ATOMIC_INIT(0),
 };
 
 
@@ -2711,23 +2727,20 @@ static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi
                 dst_alloc(&ipv4_dst_blackhole_ops);
 
         if (rt) {
-                struct dst_entry *new = &rt->u.dst;
+                struct dst_entry *new = &rt->dst;
 
                 atomic_set(&new->__refcnt, 1);
                 new->__use = 1;
                 new->input = dst_discard;
                 new->output = dst_discard;
-                memcpy(new->metrics, ort->u.dst.metrics, RTAX_MAX*sizeof(u32));
+                dst_copy_metrics(new, &ort->dst);
 
-                new->dev = ort->u.dst.dev;
+                new->dev = ort->dst.dev;
                 if (new->dev)
                         dev_hold(new->dev);
 
                 rt->fl = ort->fl;
 
-                rt->idev = ort->idev;
-                if (rt->idev)
-                        in_dev_hold(rt->idev);
                 rt->rt_genid = rt_genid(net);
                 rt->rt_flags = ort->rt_flags;
                 rt->rt_type = ort->rt_type;
@@ -2743,9 +2756,9 @@ static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi
                 dst_free(new);
         }
 
-        dst_release(&(*rp)->u.dst);
+        dst_release(&(*rp)->dst);
         *rp = rt;
-        return (rt ? 0 : -ENOMEM);
+        return rt ? 0 : -ENOMEM;
 }
 
 int ip_route_output_flow(struct net *net, struct rtable **rp, struct flowi *flp,
@@ -2771,13 +2784,13 @@ int ip_route_output_flow(struct net *net, struct rtable **rp, struct flowi *flp,
 
         return 0;
 }
-
 EXPORT_SYMBOL_GPL(ip_route_output_flow);
 
 int ip_route_output_key(struct net *net, struct rtable **rp, struct flowi *flp)
 {
         return ip_route_output_flow(net, rp, flp, NULL, 0);
 }
+EXPORT_SYMBOL(ip_route_output_key);
 
 static int rt_fill_info(struct net *net,
                         struct sk_buff *skb, u32 pid, u32 seq, int event,
@@ -2813,13 +2826,13 @@ static int rt_fill_info(struct net *net,
                 r->rtm_src_len = 32;
                 NLA_PUT_BE32(skb, RTA_SRC, rt->fl.fl4_src);
         }
-        if (rt->u.dst.dev)
-                NLA_PUT_U32(skb, RTA_OIF, rt->u.dst.dev->ifindex);
+        if (rt->dst.dev)
+                NLA_PUT_U32(skb, RTA_OIF, rt->dst.dev->ifindex);
 #ifdef CONFIG_NET_CLS_ROUTE
-        if (rt->u.dst.tclassid)
-                NLA_PUT_U32(skb, RTA_FLOW, rt->u.dst.tclassid);
+        if (rt->dst.tclassid)
+                NLA_PUT_U32(skb, RTA_FLOW, rt->dst.tclassid);
 #endif
-        if (rt->fl.iif)
+        if (rt_is_input_route(rt))
                 NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_spec_dst);
         else if (rt->rt_src != rt->fl.fl4_src)
                 NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_src);
@@ -2827,20 +2840,24 @@ static int rt_fill_info(struct net *net,
         if (rt->rt_dst != rt->rt_gateway)
                 NLA_PUT_BE32(skb, RTA_GATEWAY, rt->rt_gateway);
 
-        if (rtnetlink_put_metrics(skb, rt->u.dst.metrics) < 0)
+        if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                 goto nla_put_failure;
 
-        error = rt->u.dst.error;
-        expires = rt->u.dst.expires ? rt->u.dst.expires - jiffies : 0;
+        if (rt->fl.mark)
+                NLA_PUT_BE32(skb, RTA_MARK, rt->fl.mark);
+
+        error = rt->dst.error;
+        expires = rt->dst.expires ? rt->dst.expires - jiffies : 0;
         if (rt->peer) {
-                id = rt->peer->ip_id_count;
+                inet_peer_refcheck(rt->peer);
+                id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
                 if (rt->peer->tcp_ts_stamp) {
                         ts = rt->peer->tcp_ts;
                         tsage = get_seconds() - rt->peer->tcp_ts_stamp;
                 }
         }
 
-        if (rt->fl.iif) {
+        if (rt_is_input_route(rt)) {
 #ifdef CONFIG_IP_MROUTE
                 __be32 dst = rt->rt_dst;
 
@@ -2863,7 +2880,7 @@ static int rt_fill_info(struct net *net,
                         NLA_PUT_U32(skb, RTA_IIF, rt->fl.iif);
         }
 
-        if (rtnl_put_cacheinfo(skb, &rt->u.dst, id, ts, tsage,
+        if (rtnl_put_cacheinfo(skb, &rt->dst, id, ts, tsage,
                                expires, error) < 0)
                 goto nla_put_failure;
 
@@ -2884,6 +2901,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         __be32 src = 0;
         u32 iif;
         int err;
+        int mark;
         struct sk_buff *skb;
 
         err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv4_policy);
@@ -2911,6 +2929,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         src = tb[RTA_SRC] ? nla_get_be32(tb[RTA_SRC]) : 0;
         dst = tb[RTA_DST] ? nla_get_be32(tb[RTA_DST]) : 0;
         iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0;
+        mark = tb[RTA_MARK] ? nla_get_u32(tb[RTA_MARK]) : 0;
 
         if (iif) {
                 struct net_device *dev;
@@ -2923,23 +2942,21 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
 
                 skb->protocol   = htons(ETH_P_IP);
                 skb->dev        = dev;
+                skb->mark       = mark;
                 local_bh_disable();
                 err = ip_route_input(skb, dst, src, rtm->rtm_tos, dev);
                 local_bh_enable();
 
                 rt = skb_rtable(skb);
-                if (err == 0 && rt->u.dst.error)
-                        err = -rt->u.dst.error;
+                if (err == 0 && rt->dst.error)
+                        err = -rt->dst.error;
         } else {
                 struct flowi fl = {
-                        .nl_u = {
-                                .ip4_u = {
-                                        .daddr = dst,
-                                        .saddr = src,
-                                        .tos = rtm->rtm_tos,
-                                },
-                        },
+                        .fl4_dst = dst,
+                        .fl4_src = src,
+                        .fl4_tos = rtm->rtm_tos,
                         .oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0,
+                        .mark = mark,
                 };
                 err = ip_route_output_key(net, &rt, &fl);
         }
@@ -2947,7 +2964,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         if (err)
                 goto errout_free;
 
-        skb_dst_set(skb, &rt->u.dst);
+        skb_dst_set(skb, &rt->dst);
         if (rtm->rtm_flags & RTM_F_NOTIFY)
                 rt->rt_flags |= RTCF_NOTIFY;
 
@@ -2982,13 +2999,13 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
                 if (!rt_hash_table[h].chain)
                         continue;
                 rcu_read_lock_bh();
-                for (rt = rcu_dereference(rt_hash_table[h].chain), idx = 0; rt;
-                     rt = rcu_dereference(rt->u.dst.rt_next), idx++) {
-                        if (!net_eq(dev_net(rt->u.dst.dev), net) || idx < s_idx)
+                for (rt = rcu_dereference_bh(rt_hash_table[h].chain), idx = 0; rt;
+                     rt = rcu_dereference_bh(rt->dst.rt_next), idx++) {
+                        if (!net_eq(dev_net(rt->dst.dev), net) || idx < s_idx)
                                 continue;
                         if (rt_is_expired(rt))
                                 continue;
-                        skb_dst_set(skb, dst_clone(&rt->u.dst));
+                        skb_dst_set_noref(skb, &rt->dst);
                         if (rt_fill_info(net, skb, NETLINK_CB(cb->skb).pid,
                                          cb->nlh->nlmsg_seq, RTM_NEWROUTE,
                                          1, NLM_F_MULTI) <= 0) {
@@ -3014,7 +3031,7 @@ void ip_rt_multicast_event(struct in_device *in_dev)
 
 #ifdef CONFIG_SYSCTL
 static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
-                                        struct file *filp, void __user *buffer,
+                                        void __user *buffer,
                                         size_t *lenp, loff_t *ppos)
 {
         if (write) {
@@ -3024,7 +3041,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
 
                 memcpy(&ctl, __ctl, sizeof(ctl));
                 ctl.data = &flush_delay;
-                proc_dointvec(&ctl, write, filp, buffer, lenp, ppos);
+                proc_dointvec(&ctl, write, buffer, lenp, ppos);
 
                 net = (struct net *)__ctl->extra1;
                 rt_cache_flush(net, flush_delay);
@@ -3034,85 +3051,8 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
         return -EINVAL;
 }
 
-static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table,
-                                                void __user *oldval,
-                                                size_t __user *oldlenp,
-                                                void __user *newval,
-                                                size_t newlen)
-{
-        int delay;
-        struct net *net;
-        if (newlen != sizeof(int))
-                return -EINVAL;
-        if (get_user(delay, (int __user *)newval))
-                return -EFAULT;
-        net = (struct net *)table->extra1;
-        rt_cache_flush(net, delay);
-        return 0;
-}
-
-static void rt_secret_reschedule(int old)
-{
-        struct net *net;
-        int new = ip_rt_secret_interval;
-        int diff = new - old;
-
-        if (!diff)
-                return;
-
-        rtnl_lock();
-        for_each_net(net) {
-                int deleted = del_timer_sync(&net->ipv4.rt_secret_timer);
-
-                if (!new)
-                        continue;
-
-                if (deleted) {
-                        long time = net->ipv4.rt_secret_timer.expires - jiffies;
-
-                        if (time <= 0 || (time += diff) <= 0)
-                                time = 0;
-
-                        net->ipv4.rt_secret_timer.expires = time;
-                } else
-                        net->ipv4.rt_secret_timer.expires = new;
-
-                net->ipv4.rt_secret_timer.expires += jiffies;
-                add_timer(&net->ipv4.rt_secret_timer);
-        }
-        rtnl_unlock();
-}
-
-static int ipv4_sysctl_rt_secret_interval(ctl_table *ctl, int write,
-                                          struct file *filp,
-                                          void __user *buffer, size_t *lenp,
-                                          loff_t *ppos)
-{
-        int old = ip_rt_secret_interval;
-        int ret = proc_dointvec_jiffies(ctl, write, filp, buffer, lenp, ppos);
-
-        rt_secret_reschedule(old);
-
-        return ret;
-}
-
-static int ipv4_sysctl_rt_secret_interval_strategy(ctl_table *table,
-                                                   void __user *oldval,
-                                                   size_t __user *oldlenp,
-                                                   void __user *newval,
-                                                   size_t newlen)
-{
-        int old = ip_rt_secret_interval;
-        int ret = sysctl_jiffies(table, oldval, oldlenp, newval, newlen);
-
-        rt_secret_reschedule(old);
-
-        return ret;
-}
-
 static ctl_table ipv4_route_table[] = {
         {
-                .ctl_name       = NET_IPV4_ROUTE_GC_THRESH,
                 .procname       = "gc_thresh",
                 .data           = &ipv4_dst_ops.gc_thresh,
                 .maxlen         = sizeof(int),
@@ -3120,7 +3060,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_MAX_SIZE,
                 .procname       = "max_size",
                 .data           = &ip_rt_max_size,
                 .maxlen         = sizeof(int),
@@ -3130,43 +3069,34 @@ static ctl_table ipv4_route_table[] = {
         {
                 /*  Deprecated. Use gc_min_interval_ms */
 
-                .ctl_name       = NET_IPV4_ROUTE_GC_MIN_INTERVAL,
                 .procname       = "gc_min_interval",
                 .data           = &ip_rt_gc_min_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_GC_MIN_INTERVAL_MS,
                 .procname       = "gc_min_interval_ms",
                 .data           = &ip_rt_gc_min_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_ms_jiffies,
-                .strategy       = sysctl_ms_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_GC_TIMEOUT,
                 .procname       = "gc_timeout",
                 .data           = &ip_rt_gc_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_GC_INTERVAL,
                 .procname       = "gc_interval",
                 .data           = &ip_rt_gc_interval,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_REDIRECT_LOAD,
                 .procname       = "redirect_load",
                 .data           = &ip_rt_redirect_load,
                 .maxlen         = sizeof(int),
@@ -3174,7 +3104,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_REDIRECT_NUMBER,
                 .procname       = "redirect_number",
                 .data           = &ip_rt_redirect_number,
                 .maxlen         = sizeof(int),
@@ -3182,7 +3111,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_REDIRECT_SILENCE,
                 .procname       = "redirect_silence",
                 .data           = &ip_rt_redirect_silence,
                 .maxlen         = sizeof(int),
@@ -3190,7 +3118,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_ERROR_COST,
                 .procname       = "error_cost",
                 .data           = &ip_rt_error_cost,
                 .maxlen         = sizeof(int),
@@ -3198,7 +3125,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_ERROR_BURST,
                 .procname       = "error_burst",
                 .data           = &ip_rt_error_burst,
                 .maxlen         = sizeof(int),
@@ -3206,7 +3132,6 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_GC_ELASTICITY,
                 .procname       = "gc_elasticity",
                 .data           = &ip_rt_gc_elasticity,
                 .maxlen         = sizeof(int),
@@ -3214,16 +3139,13 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_MTU_EXPIRES,
                 .procname       = "mtu_expires",
                 .data           = &ip_rt_mtu_expires,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_MIN_PMTU,
                 .procname       = "min_pmtu",
                 .data           = &ip_rt_min_pmtu,
                 .maxlen         = sizeof(int),
@@ -3231,58 +3153,46 @@ static ctl_table ipv4_route_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_MIN_ADVMSS,
                 .procname       = "min_adv_mss",
                 .data           = &ip_rt_min_advmss,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        {
-                .ctl_name       = NET_IPV4_ROUTE_SECRET_INTERVAL,
-                .procname       = "secret_interval",
-                .data           = &ip_rt_secret_interval,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = ipv4_sysctl_rt_secret_interval,
-                .strategy       = ipv4_sysctl_rt_secret_interval_strategy,
-        },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_table empty[1];
 
 static struct ctl_table ipv4_skeleton[] =
 {
-        { .procname = "route", .ctl_name = NET_IPV4_ROUTE,
+        { .procname = "route", 
           .mode = 0555, .child = ipv4_route_table},
-        { .procname = "neigh", .ctl_name = NET_IPV4_NEIGH,
+        { .procname = "neigh", 
           .mode = 0555, .child = empty},
         { }
 };
 
 static __net_initdata struct ctl_path ipv4_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
         { },
 };
 
 static struct ctl_table ipv4_route_flush_table[] = {
         {
-                .ctl_name       = NET_IPV4_ROUTE_FLUSH,
                 .procname       = "flush",
                 .maxlen         = sizeof(int),
                 .mode           = 0200,
                 .proc_handler   = ipv4_sysctl_rtcache_flush,
-                .strategy       = ipv4_sysctl_rtcache_flush_strategy,
         },
-        { .ctl_name = 0 },
+        { },
 };
 
 static __net_initdata struct ctl_path ipv4_route_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
-        { .procname = "route", .ctl_name = NET_IPV4_ROUTE, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
+        { .procname = "route", },
         { },
 };
 
@@ -3291,7 +3201,7 @@ static __net_init int sysctl_route_net_init(struct net *net)
         struct ctl_table *tbl;
 
         tbl = ipv4_route_flush_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
                 if (tbl == NULL)
                         goto err_dup;
@@ -3327,39 +3237,20 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
 };
 #endif
 
-
-static __net_init int rt_secret_timer_init(struct net *net)
+static __net_init int rt_genid_init(struct net *net)
 {
-        atomic_set(&net->ipv4.rt_genid,
-                        (int) ((num_physpages ^ (num_physpages>>8)) ^
-                        (jiffies ^ (jiffies >> 7))));
-
-        net->ipv4.rt_secret_timer.function = rt_secret_rebuild;
-        net->ipv4.rt_secret_timer.data = (unsigned long)net;
-        init_timer_deferrable(&net->ipv4.rt_secret_timer);
-
-        if (ip_rt_secret_interval) {
-                net->ipv4.rt_secret_timer.expires =
-                        jiffies + net_random() % ip_rt_secret_interval +
-                        ip_rt_secret_interval;
-                add_timer(&net->ipv4.rt_secret_timer);
-        }
+        get_random_bytes(&net->ipv4.rt_genid,
+                         sizeof(net->ipv4.rt_genid));
         return 0;
 }
 
-static __net_exit void rt_secret_timer_exit(struct net *net)
-{
-        del_timer_sync(&net->ipv4.rt_secret_timer);
-}
-
-static __net_initdata struct pernet_operations rt_secret_timer_ops = {
-        .init = rt_secret_timer_init,
-        .exit = rt_secret_timer_exit,
+static __net_initdata struct pernet_operations rt_genid_ops = {
+        .init = rt_genid_init,
 };
 
 
 #ifdef CONFIG_NET_CLS_ROUTE
-struct ip_rt_acct *ip_rt_acct __read_mostly;
+struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
 #endif /* CONFIG_NET_CLS_ROUTE */
 
 static __initdata unsigned long rhash_entries;
@@ -3388,11 +3279,17 @@ int __init ip_rt_init(void)
 
         ipv4_dst_blackhole_ops.kmem_cachep = ipv4_dst_ops.kmem_cachep;
 
+        if (dst_entries_init(&ipv4_dst_ops) < 0)
+                panic("IP: failed to allocate ipv4_dst_ops counter\n");
+
+        if (dst_entries_init(&ipv4_dst_blackhole_ops) < 0)
+                panic("IP: failed to allocate ipv4_dst_blackhole_ops counter\n");
+
         rt_hash_table = (struct rt_hash_bucket *)
                 alloc_large_system_hash("IP route cache",
                                         sizeof(struct rt_hash_bucket),
                                         rhash_entries,
-                                        (num_physpages >= 128 * 1024) ?
+                                        (totalram_pages >= 128 * 1024) ?
                                         15 : 17,
                                         0,
                                         &rt_hash_log,
@@ -3415,20 +3312,18 @@ int __init ip_rt_init(void)
         schedule_delayed_work(&expires_work,
                 net_random() % ip_rt_gc_interval + ip_rt_gc_interval);
 
-        if (register_pernet_subsys(&rt_secret_timer_ops))
-                printk(KERN_ERR "Unable to setup rt_secret_timer\n");
-
         if (ip_rt_proc_init())
                 printk(KERN_ERR "Unable to create route proc files\n");
 #ifdef CONFIG_XFRM
         xfrm_init();
-        xfrm4_init();
+        xfrm4_init(ip_rt_max_size);
 #endif
         rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL);
 
 #ifdef CONFIG_SYSCTL
         register_pernet_subsys(&sysctl_route_ops);
 #endif
+        register_pernet_subsys(&rt_genid_ops);
         return rc;
 }
 
@@ -3442,7 +3337,3 @@ void __init ip_static_sysctl_init(void)
         register_sysctl_paths(ipv4_path, ipv4_skeleton);
 }
 #endif
-
-EXPORT_SYMBOL(__ip_select_ident);
-EXPORT_SYMBOL(ip_route_input);
-EXPORT_SYMBOL(ip_route_output_key);
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index cd2b97f1b6e1..47519205a014 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -18,8 +18,8 @@
 #include <net/tcp.h>
 #include <net/route.h>
 
-/* Timestamps: lowest 9 bits store TCP options */
-#define TSBITS 9
+/* Timestamps: lowest bits store TCP options */
+#define TSBITS 6
 #define TSMASK (((__u32)1 << TSBITS) - 1)
 
 extern int sysctl_tcp_syncookies;
@@ -37,12 +37,13 @@ __initcall(init_syncookies);
 #define COOKIEBITS 24   /* Upper bits store count */
 #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
 
-static DEFINE_PER_CPU(__u32, cookie_scratch)[16 + 5 + SHA_WORKSPACE_WORDS];
+static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS],
+                      ipv4_cookie_scratch);
 
 static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
                        u32 count, int c)
 {
-        __u32 *tmp = __get_cpu_var(cookie_scratch);
+        __u32 *tmp = __get_cpu_var(ipv4_cookie_scratch);
 
         memcpy(tmp + 4, syncookie_secret[c], sizeof(syncookie_secret[c]));
         tmp[0] = (__force u32)saddr;
@@ -57,7 +58,7 @@ static u32 cookie_hash(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport,
 
 /*
  * when syncookies are in effect and tcp timestamps are enabled we encode
- * tcp options in the lowest 9 bits of the timestamp value that will be
+ * tcp options in the lower bits of the timestamp value that will be
  * sent in the syn-ack.
  * Since subsequent timestamps use the normal tcp_time_stamp value, we
  * must make sure that the resulting initial timestamp is <= tcp_time_stamp.
@@ -69,11 +70,10 @@ __u32 cookie_init_timestamp(struct request_sock *req)
         u32 options = 0;
 
         ireq = inet_rsk(req);
-        if (ireq->wscale_ok) {
-                options = ireq->snd_wscale;
-                options |= ireq->rcv_wscale << 4;
-        }
-        options |= ireq->sack_ok << 8;
+
+        options = ireq->wscale_ok ? ireq->snd_wscale : 0xf;
+        options |= ireq->sack_ok << 4;
+        options |= ireq->ecn_ok << 5;
 
         ts = ts_now & ~TSMASK;
         ts |= options;
@@ -137,23 +137,23 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
 }
 
 /*
- * This table has to be sorted and terminated with (__u16)-1.
- * XXX generate a better table.
- * Unresolved Issues: HIPPI with a 64k MSS is not well supported.
+ * MSS Values are taken from the 2009 paper
+ * 'Measuring TCP Maximum Segment Size' by S. Alcock and R. Nelson:
+ *  - values 1440 to 1460 accounted for 80% of observed mss values
+ *  - values outside the 536-1460 range are rare (<0.2%).
+ *
+ * Table must be sorted.
  */
 static __u16 const msstab[] = {
-        64 - 1,
-        256 - 1,
-        512 - 1,
-        536 - 1,
-        1024 - 1,
-        1440 - 1,
-        1460 - 1,
-        4312 - 1,
-        (__u16)-1
+        64,
+        512,
+        536,
+        1024,
+        1440,
+        1460,
+        4312,
+        8960,
 };
-/* The number doesn't include the -1 terminator */
-#define NUM_MSS (ARRAY_SIZE(msstab) - 1)
 
 /*
  * Generate a syncookie.  mssp points to the mss, which is returned
@@ -168,10 +168,10 @@ __u32 cookie_v4_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
 
         tcp_synq_overflow(sk);
 
-        /* XXX sort msstab[] by probability?  Binary search? */
-        for (mssind = 0; mss > msstab[mssind + 1]; mssind++)
-                ;
-        *mssp = msstab[mssind] + 1;
+        for (mssind = ARRAY_SIZE(msstab) - 1; mssind ; mssind--)
+                if (mss >= msstab[mssind])
+                        break;
+        *mssp = msstab[mssind];
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
 
@@ -201,7 +201,7 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
                                             jiffies / (HZ * 60),
                                             COUNTER_TRIES);
 
-        return mssind < NUM_MSS ? msstab[mssind] + 1 : 0;
+        return mssind < ARRAY_SIZE(msstab) ? msstab[mssind] : 0;
 }
 
 static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
@@ -226,32 +226,46 @@ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
  * additional tcp options in the timestamp.
  * This extracts these options from the timestamp echo.
  *
- * The lowest 4 bits are for snd_wscale
- * The next 4 lsb are for rcv_wscale
- * The next lsb is for sack_ok
+ * The lowest 4 bits store snd_wscale.
+ * next 2 bits indicate SACK and ECN support.
+ *
+ * return false if we decode an option that should not be.
  */
-void cookie_check_timestamp(struct tcp_options_received *tcp_opt)
+bool cookie_check_timestamp(struct tcp_options_received *tcp_opt, bool *ecn_ok)
 {
-        /* echoed timestamp, 9 lowest bits contain options */
+        /* echoed timestamp, lowest bits contain options */
         u32 options = tcp_opt->rcv_tsecr & TSMASK;
 
-        tcp_opt->snd_wscale = options & 0xf;
-        options >>= 4;
-        tcp_opt->rcv_wscale = options & 0xf;
+        if (!tcp_opt->saw_tstamp)  {
+                tcp_clear_options(tcp_opt);
+                return true;
+        }
+
+        if (!sysctl_tcp_timestamps)
+                return false;
 
         tcp_opt->sack_ok = (options >> 4) & 0x1;
+        *ecn_ok = (options >> 5) & 1;
+        if (*ecn_ok && !sysctl_tcp_ecn)
+                return false;
+
+        if (tcp_opt->sack_ok && !sysctl_tcp_sack)
+                return false;
 
-        if (tcp_opt->sack_ok)
-                tcp_sack_reset(tcp_opt);
+        if ((options & 0xf) == 0xf)
+                return true; /* no window scaling */
 
-        if (tcp_opt->snd_wscale || tcp_opt->rcv_wscale)
-                tcp_opt->wscale_ok = 1;
+        tcp_opt->wscale_ok = 1;
+        tcp_opt->snd_wscale = options & 0xf;
+        return sysctl_tcp_window_scaling != 0;
 }
 EXPORT_SYMBOL(cookie_check_timestamp);
 
 struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                              struct ip_options *opt)
 {
+        struct tcp_options_received tcp_opt;
+        u8 *hash_location;
         struct inet_request_sock *ireq;
         struct tcp_request_sock *treq;
         struct tcp_sock *tp = tcp_sk(sk);
@@ -262,9 +276,9 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         int mss;
         struct rtable *rt;
         __u8 rcv_wscale;
-        struct tcp_options_received tcp_opt;
+        bool ecn_ok;
 
-        if (!sysctl_tcp_syncookies || !th->ack)
+        if (!sysctl_tcp_syncookies || !th->ack || th->rst)
                 goto out;
 
         if (tcp_synq_no_recent_overflow(sk) ||
@@ -277,10 +291,10 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         /* check for timestamp cookie support */
         memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, 0);
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
 
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
+        if (!cookie_check_timestamp(&tcp_opt, &ecn_ok))
+                goto out;
 
         ret = NULL;
         req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
@@ -296,9 +310,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->rmt_port          = th->source;
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
-        ireq->ecn_ok            = 0;
+        ireq->ecn_ok            = ecn_ok;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
         ireq->wscale_ok         = tcp_opt.wscale_ok;
         ireq->tstamp_ok         = tcp_opt.saw_tstamp;
@@ -332,33 +345,32 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          * no easy way to do this.
          */
         {
-                struct flowi fl = { .nl_u = { .ip4_u =
-                                              { .daddr = ((opt && opt->srr) ?
-                                                          opt->faddr :
-                                                          ireq->rmt_addr),
-                                                .saddr = ireq->loc_addr,
-                                                .tos = RT_CONN_FLAGS(sk) } },
+                struct flowi fl = { .mark = sk->sk_mark,
+                                    .fl4_dst = ((opt && opt->srr) ?
+                                                opt->faddr : ireq->rmt_addr),
+                                    .fl4_src = ireq->loc_addr,
+                                    .fl4_tos = RT_CONN_FLAGS(sk),
                                     .proto = IPPROTO_TCP,
                                     .flags = inet_sk_flowi_flags(sk),
-                                    .uli_u = { .ports =
-                                               { .sport = th->dest,
-                                                 .dport = th->source } } };
+                                    .fl_ip_sport = th->dest,
+                                    .fl_ip_dport = th->source };
                 security_req_classify_flow(req, &fl);
-                if (ip_route_output_key(&init_net, &rt, &fl)) {
+                if (ip_route_output_key(sock_net(sk), &rt, &fl)) {
                         reqsk_free(req);
                         goto out;
                 }
         }
 
         /* Try to redo what tcp_v4_send_synack did. */
-        req->window_clamp = tp->window_clamp ? :dst_metric(&rt->u.dst, RTAX_WINDOW);
+        req->window_clamp = tp->window_clamp ? :dst_metric(&rt->dst, RTAX_WINDOW);
 
         tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                   &req->rcv_wnd, &req->window_clamp,
-                                  ireq->wscale_ok, &rcv_wscale);
+                                  ireq->wscale_ok, &rcv_wscale,
+                                  dst_metric(&rt->dst, RTAX_INITRWND));
 
         ireq->rcv_wscale  = rcv_wscale;
 
-        ret = get_cookie_sock(sk, skb, req, &rt->u.dst);
+        ret = get_cookie_sock(sk, skb, req, &rt->dst);
 out:    return ret;
 }
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 4710d219f06a..1a456652086b 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -12,6 +12,7 @@
 #include <linux/inetdevice.h>
 #include <linux/seqlock.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/snmp.h>
 #include <net/icmp.h>
 #include <net/ip.h>
@@ -25,6 +26,10 @@ static int zero;
 static int tcp_retr1_max = 255;
 static int ip_local_port_range_min[] = { 1, 1 };
 static int ip_local_port_range_max[] = { 65535, 65535 };
+static int tcp_adv_win_scale_min = -31;
+static int tcp_adv_win_scale_max = 31;
+static int ip_ttl_min = 1;
+static int ip_ttl_max = 255;
 
 /* Update system visible IP port range */
 static void set_local_port_range(int range[2])
@@ -36,7 +41,7 @@ static void set_local_port_range(int range[2])
 }
 
 /* Validate changes from /proc interface. */
-static int ipv4_local_port_range(ctl_table *table, int write, struct file *filp,
+static int ipv4_local_port_range(ctl_table *table, int write,
                                  void __user *buffer,
                                  size_t *lenp, loff_t *ppos)
 {
@@ -51,7 +56,7 @@ static int ipv4_local_port_range(ctl_table *table, int write, struct file *filp,
         };
 
         inet_get_local_port_range(range, range + 1);
-        ret = proc_dointvec_minmax(&tmp, write, filp, buffer, lenp, ppos);
+        ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
 
         if (write && ret == 0) {
                 if (range[1] < range[0])
@@ -63,35 +68,7 @@ static int ipv4_local_port_range(ctl_table *table, int write, struct file *filp,
         return ret;
 }
 
-/* Validate changes from sysctl interface. */
-static int ipv4_sysctl_local_port_range(ctl_table *table,
-                                         void __user *oldval,
-                                         size_t __user *oldlenp,
-                                        void __user *newval, size_t newlen)
-{
-        int ret;
-        int range[2];
-        ctl_table tmp = {
-                .data = &range,
-                .maxlen = sizeof(range),
-                .mode = table->mode,
-                .extra1 = &ip_local_port_range_min,
-                .extra2 = &ip_local_port_range_max,
-        };
-
-        inet_get_local_port_range(range, range + 1);
-        ret = sysctl_intvec(&tmp, oldval, oldlenp, newval, newlen);
-        if (ret == 0 && newval && newlen) {
-                if (range[1] < range[0])
-                        ret = -EINVAL;
-                else
-                        set_local_port_range(range);
-        }
-        return ret;
-}
-
-
-static int proc_tcp_congestion_control(ctl_table *ctl, int write, struct file * filp,
+static int proc_tcp_congestion_control(ctl_table *ctl, int write,
                                        void __user *buffer, size_t *lenp, loff_t *ppos)
 {
         char val[TCP_CA_NAME_MAX];
@@ -103,33 +80,14 @@ static int proc_tcp_congestion_control(ctl_table *ctl, int write, struct file *
 
         tcp_get_default_congestion_control(val);
 
-        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
         if (write && ret == 0)
                 ret = tcp_set_default_congestion_control(val);
         return ret;
 }
 
-static int sysctl_tcp_congestion_control(ctl_table *table,
-                                         void __user *oldval,
-                                         size_t __user *oldlenp,
-                                         void __user *newval, size_t newlen)
-{
-        char val[TCP_CA_NAME_MAX];
-        ctl_table tbl = {
-                .data = val,
-                .maxlen = TCP_CA_NAME_MAX,
-        };
-        int ret;
-
-        tcp_get_default_congestion_control(val);
-        ret = sysctl_string(&tbl, oldval, oldlenp, newval, newlen);
-        if (ret == 1 && newval && newlen)
-                ret = tcp_set_default_congestion_control(val);
-        return ret;
-}
-
 static int proc_tcp_available_congestion_control(ctl_table *ctl,
-                                                 int write, struct file * filp,
+                                                 int write,
                                                  void __user *buffer, size_t *lenp,
                                                  loff_t *ppos)
 {
@@ -140,13 +98,13 @@ static int proc_tcp_available_congestion_control(ctl_table *ctl,
         if (!tbl.data)
                 return -ENOMEM;
         tcp_get_available_congestion_control(tbl.data, TCP_CA_BUF_MAX);
-        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
         kfree(tbl.data);
         return ret;
 }
 
 static int proc_allowed_congestion_control(ctl_table *ctl,
-                                           int write, struct file * filp,
+                                           int write,
                                            void __user *buffer, size_t *lenp,
                                            loff_t *ppos)
 {
@@ -158,39 +116,15 @@ static int proc_allowed_congestion_control(ctl_table *ctl,
                 return -ENOMEM;
 
         tcp_get_allowed_congestion_control(tbl.data, tbl.maxlen);
-        ret = proc_dostring(&tbl, write, filp, buffer, lenp, ppos);
+        ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
         if (write && ret == 0)
                 ret = tcp_set_allowed_congestion_control(tbl.data);
         kfree(tbl.data);
         return ret;
 }
 
-static int strategy_allowed_congestion_control(ctl_table *table,
-                                               void __user *oldval,
-                                               size_t __user *oldlenp,
-                                               void __user *newval,
-                                               size_t newlen)
-{
-        ctl_table tbl = { .maxlen = TCP_CA_BUF_MAX };
-        int ret;
-
-        tbl.data = kmalloc(tbl.maxlen, GFP_USER);
-        if (!tbl.data)
-                return -ENOMEM;
-
-        tcp_get_available_congestion_control(tbl.data, tbl.maxlen);
-        ret = sysctl_string(&tbl, oldval, oldlenp, newval, newlen);
-        if (ret == 1 && newval && newlen)
-                ret = tcp_set_allowed_congestion_control(tbl.data);
-        kfree(tbl.data);
-
-        return ret;
-
-}
-
 static struct ctl_table ipv4_table[] = {
         {
-                .ctl_name       = NET_IPV4_TCP_TIMESTAMPS,
                 .procname       = "tcp_timestamps",
                 .data           = &sysctl_tcp_timestamps,
                 .maxlen         = sizeof(int),
@@ -198,7 +132,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_WINDOW_SCALING,
                 .procname       = "tcp_window_scaling",
                 .data           = &sysctl_tcp_window_scaling,
                 .maxlen         = sizeof(int),
@@ -206,7 +139,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_SACK,
                 .procname       = "tcp_sack",
                 .data           = &sysctl_tcp_sack,
                 .maxlen         = sizeof(int),
@@ -214,7 +146,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_RETRANS_COLLAPSE,
                 .procname       = "tcp_retrans_collapse",
                 .data           = &sysctl_tcp_retrans_collapse,
                 .maxlen         = sizeof(int),
@@ -222,17 +153,15 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_DEFAULT_TTL,
                 .procname       = "ip_default_ttl",
                 .data           = &sysctl_ip_default_ttl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = ipv4_doint_and_flush,
-                .strategy       = ipv4_doint_and_flush_strategy,
-                .extra2         = &init_net,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &ip_ttl_min,
+                .extra2         = &ip_ttl_max,
         },
         {
-                .ctl_name       = NET_IPV4_NO_PMTU_DISC,
                 .procname       = "ip_no_pmtu_disc",
                 .data           = &ipv4_config.no_pmtu_disc,
                 .maxlen         = sizeof(int),
@@ -240,7 +169,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_NONLOCAL_BIND,
                 .procname       = "ip_nonlocal_bind",
                 .data           = &sysctl_ip_nonlocal_bind,
                 .maxlen         = sizeof(int),
@@ -248,7 +176,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_SYN_RETRIES,
                 .procname       = "tcp_syn_retries",
                 .data           = &sysctl_tcp_syn_retries,
                 .maxlen         = sizeof(int),
@@ -256,7 +183,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_SYNACK_RETRIES,
                 .procname       = "tcp_synack_retries",
                 .data           = &sysctl_tcp_synack_retries,
                 .maxlen         = sizeof(int),
@@ -264,7 +190,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_MAX_ORPHANS,
                 .procname       = "tcp_max_orphans",
                 .data           = &sysctl_tcp_max_orphans,
                 .maxlen         = sizeof(int),
@@ -272,7 +197,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_MAX_TW_BUCKETS,
                 .procname       = "tcp_max_tw_buckets",
                 .data           = &tcp_death_row.sysctl_max_tw_buckets,
                 .maxlen         = sizeof(int),
@@ -280,7 +204,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_DYNADDR,
                 .procname       = "ip_dynaddr",
                 .data           = &sysctl_ip_dynaddr,
                 .maxlen         = sizeof(int),
@@ -288,16 +211,13 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_KEEPALIVE_TIME,
                 .procname       = "tcp_keepalive_time",
                 .data           = &sysctl_tcp_keepalive_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_TCP_KEEPALIVE_PROBES,
                 .procname       = "tcp_keepalive_probes",
                 .data           = &sysctl_tcp_keepalive_probes,
                 .maxlen         = sizeof(int),
@@ -305,26 +225,21 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_KEEPALIVE_INTVL,
                 .procname       = "tcp_keepalive_intvl",
                 .data           = &sysctl_tcp_keepalive_intvl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_TCP_RETRIES1,
                 .procname       = "tcp_retries1",
                 .data           = &sysctl_tcp_retries1,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra2         = &tcp_retr1_max
         },
         {
-                .ctl_name       = NET_IPV4_TCP_RETRIES2,
                 .procname       = "tcp_retries2",
                 .data           = &sysctl_tcp_retries2,
                 .maxlen         = sizeof(int),
@@ -332,17 +247,14 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_TCP_FIN_TIMEOUT,
                 .procname       = "tcp_fin_timeout",
                 .data           = &sysctl_tcp_fin_timeout,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
 #ifdef CONFIG_SYN_COOKIES
         {
-                .ctl_name       = NET_TCP_SYNCOOKIES,
                 .procname       = "tcp_syncookies",
                 .data           = &sysctl_tcp_syncookies,
                 .maxlen         = sizeof(int),
@@ -351,7 +263,6 @@ static struct ctl_table ipv4_table[] = {
         },
 #endif
         {
-                .ctl_name       = NET_TCP_TW_RECYCLE,
                 .procname       = "tcp_tw_recycle",
                 .data           = &tcp_death_row.sysctl_tw_recycle,
                 .maxlen         = sizeof(int),
@@ -359,7 +270,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_ABORT_ON_OVERFLOW,
                 .procname       = "tcp_abort_on_overflow",
                 .data           = &sysctl_tcp_abort_on_overflow,
                 .maxlen         = sizeof(int),
@@ -367,7 +277,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_STDURG,
                 .procname       = "tcp_stdurg",
                 .data           = &sysctl_tcp_stdurg,
                 .maxlen         = sizeof(int),
@@ -375,7 +284,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_RFC1337,
                 .procname       = "tcp_rfc1337",
                 .data           = &sysctl_tcp_rfc1337,
                 .maxlen         = sizeof(int),
@@ -383,7 +291,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_MAX_SYN_BACKLOG,
                 .procname       = "tcp_max_syn_backlog",
                 .data           = &sysctl_max_syn_backlog,
                 .maxlen         = sizeof(int),
@@ -391,17 +298,21 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_LOCAL_PORT_RANGE,
                 .procname       = "ip_local_port_range",
                 .data           = &sysctl_local_ports.range,
                 .maxlen         = sizeof(sysctl_local_ports.range),
                 .mode           = 0644,
                 .proc_handler   = ipv4_local_port_range,
-                .strategy       = ipv4_sysctl_local_port_range,
+        },
+        {
+                .procname       = "ip_local_reserved_ports",
+                .data           = NULL, /* initialized in sysctl_ipv4_init */
+                .maxlen         = 65536,
+                .mode           = 0644,
+                .proc_handler   = proc_do_large_bitmap,
         },
 #ifdef CONFIG_IP_MULTICAST
         {
-                .ctl_name       = NET_IPV4_IGMP_MAX_MEMBERSHIPS,
                 .procname       = "igmp_max_memberships",
                 .data           = &sysctl_igmp_max_memberships,
                 .maxlen         = sizeof(int),
@@ -411,7 +322,6 @@ static struct ctl_table ipv4_table[] = {
 
 #endif
         {
-                .ctl_name       = NET_IPV4_IGMP_MAX_MSF,
                 .procname       = "igmp_max_msf",
                 .data           = &sysctl_igmp_max_msf,
                 .maxlen         = sizeof(int),
@@ -419,7 +329,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_INET_PEER_THRESHOLD,
                 .procname       = "inet_peer_threshold",
                 .data           = &inet_peer_threshold,
                 .maxlen         = sizeof(int),
@@ -427,43 +336,34 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_INET_PEER_MINTTL,
                 .procname       = "inet_peer_minttl",
                 .data           = &inet_peer_minttl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_INET_PEER_MAXTTL,
                 .procname       = "inet_peer_maxttl",
                 .data           = &inet_peer_maxttl,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_INET_PEER_GC_MINTIME,
                 .procname       = "inet_peer_gc_mintime",
                 .data           = &inet_peer_gc_mintime,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_INET_PEER_GC_MAXTIME,
                 .procname       = "inet_peer_gc_maxtime",
                 .data           = &inet_peer_gc_maxtime,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
         },
         {
-                .ctl_name       = NET_TCP_ORPHAN_RETRIES,
                 .procname       = "tcp_orphan_retries",
                 .data           = &sysctl_tcp_orphan_retries,
                 .maxlen         = sizeof(int),
@@ -471,7 +371,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_FACK,
                 .procname       = "tcp_fack",
                 .data           = &sysctl_tcp_fack,
                 .maxlen         = sizeof(int),
@@ -479,7 +378,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_REORDERING,
                 .procname       = "tcp_reordering",
                 .data           = &sysctl_tcp_reordering,
                 .maxlen         = sizeof(int),
@@ -487,7 +385,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_ECN,
                 .procname       = "tcp_ecn",
                 .data           = &sysctl_tcp_ecn,
                 .maxlen         = sizeof(int),
@@ -495,7 +392,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_DSACK,
                 .procname       = "tcp_dsack",
                 .data           = &sysctl_tcp_dsack,
                 .maxlen         = sizeof(int),
@@ -503,15 +399,13 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_MEM,
                 .procname       = "tcp_mem",
                 .data           = &sysctl_tcp_mem,
                 .maxlen         = sizeof(sysctl_tcp_mem),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_doulongvec_minmax
         },
         {
-                .ctl_name       = NET_TCP_WMEM,
                 .procname       = "tcp_wmem",
                 .data           = &sysctl_tcp_wmem,
                 .maxlen         = sizeof(sysctl_tcp_wmem),
@@ -519,7 +413,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_RMEM,
                 .procname       = "tcp_rmem",
                 .data           = &sysctl_tcp_rmem,
                 .maxlen         = sizeof(sysctl_tcp_rmem),
@@ -527,7 +420,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_APP_WIN,
                 .procname       = "tcp_app_win",
                 .data           = &sysctl_tcp_app_win,
                 .maxlen         = sizeof(int),
@@ -535,15 +427,15 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_ADV_WIN_SCALE,
                 .procname       = "tcp_adv_win_scale",
                 .data           = &sysctl_tcp_adv_win_scale,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &tcp_adv_win_scale_min,
+                .extra2         = &tcp_adv_win_scale_max,
         },
         {
-                .ctl_name       = NET_TCP_TW_REUSE,
                 .procname       = "tcp_tw_reuse",
                 .data           = &sysctl_tcp_tw_reuse,
                 .maxlen         = sizeof(int),
@@ -551,7 +443,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_FRTO,
                 .procname       = "tcp_frto",
                 .data           = &sysctl_tcp_frto,
                 .maxlen         = sizeof(int),
@@ -559,7 +450,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_FRTO_RESPONSE,
                 .procname       = "tcp_frto_response",
                 .data           = &sysctl_tcp_frto_response,
                 .maxlen         = sizeof(int),
@@ -567,7 +457,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_LOW_LATENCY,
                 .procname       = "tcp_low_latency",
                 .data           = &sysctl_tcp_low_latency,
                 .maxlen         = sizeof(int),
@@ -575,7 +464,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_TCP_NO_METRICS_SAVE,
                 .procname       = "tcp_no_metrics_save",
                 .data           = &sysctl_tcp_nometrics_save,
                 .maxlen         = sizeof(int),
@@ -583,7 +471,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_MODERATE_RCVBUF,
                 .procname       = "tcp_moderate_rcvbuf",
                 .data           = &sysctl_tcp_moderate_rcvbuf,
                 .maxlen         = sizeof(int),
@@ -591,7 +478,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_TSO_WIN_DIVISOR,
                 .procname       = "tcp_tso_win_divisor",
                 .data           = &sysctl_tcp_tso_win_divisor,
                 .maxlen         = sizeof(int),
@@ -599,15 +485,12 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_CONG_CONTROL,
                 .procname       = "tcp_congestion_control",
                 .mode           = 0644,
                 .maxlen         = TCP_CA_NAME_MAX,
                 .proc_handler   = proc_tcp_congestion_control,
-                .strategy       = sysctl_tcp_congestion_control,
         },
         {
-                .ctl_name       = NET_TCP_ABC,
                 .procname       = "tcp_abc",
                 .data           = &sysctl_tcp_abc,
                 .maxlen         = sizeof(int),
@@ -615,7 +498,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_MTU_PROBING,
                 .procname       = "tcp_mtu_probing",
                 .data           = &sysctl_tcp_mtu_probing,
                 .maxlen         = sizeof(int),
@@ -623,7 +505,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_TCP_BASE_MSS,
                 .procname       = "tcp_base_mss",
                 .data           = &sysctl_tcp_base_mss,
                 .maxlen         = sizeof(int),
@@ -631,7 +512,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_IPV4_TCP_WORKAROUND_SIGNED_WINDOWS,
                 .procname       = "tcp_workaround_signed_windows",
                 .data           = &sysctl_tcp_workaround_signed_windows,
                 .maxlen         = sizeof(int),
@@ -640,7 +520,6 @@ static struct ctl_table ipv4_table[] = {
         },
 #ifdef CONFIG_NET_DMA
         {
-                .ctl_name       = NET_TCP_DMA_COPYBREAK,
                 .procname       = "tcp_dma_copybreak",
                 .data           = &sysctl_tcp_dma_copybreak,
                 .maxlen         = sizeof(int),
@@ -649,7 +528,6 @@ static struct ctl_table ipv4_table[] = {
         },
 #endif
         {
-                .ctl_name       = NET_TCP_SLOW_START_AFTER_IDLE,
                 .procname       = "tcp_slow_start_after_idle",
                 .data           = &sysctl_tcp_slow_start_after_idle,
                 .maxlen         = sizeof(int),
@@ -658,7 +536,6 @@ static struct ctl_table ipv4_table[] = {
         },
 #ifdef CONFIG_NETLABEL
         {
-                .ctl_name       = NET_CIPSOV4_CACHE_ENABLE,
                 .procname       = "cipso_cache_enable",
                 .data           = &cipso_v4_cache_enabled,
                 .maxlen         = sizeof(int),
@@ -666,7 +543,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_CIPSOV4_CACHE_BUCKET_SIZE,
                 .procname       = "cipso_cache_bucket_size",
                 .data           = &cipso_v4_cache_bucketsize,
                 .maxlen         = sizeof(int),
@@ -674,7 +550,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_CIPSOV4_RBM_OPTFMT,
                 .procname       = "cipso_rbm_optfmt",
                 .data           = &cipso_v4_rbm_optfmt,
                 .maxlen         = sizeof(int),
@@ -682,7 +557,6 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = NET_CIPSOV4_RBM_STRICTVALID,
                 .procname       = "cipso_rbm_strictvalid",
                 .data           = &cipso_v4_rbm_strictvalid,
                 .maxlen         = sizeof(int),
@@ -697,15 +571,12 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_tcp_available_congestion_control,
         },
         {
-                .ctl_name       = NET_TCP_ALLOWED_CONG_CONTROL,
                 .procname       = "tcp_allowed_congestion_control",
                 .maxlen         = TCP_CA_BUF_MAX,
                 .mode           = 0644,
                 .proc_handler   = proc_allowed_congestion_control,
-                .strategy       = strategy_allowed_congestion_control,
         },
         {
-                .ctl_name       = NET_TCP_MAX_SSTHRESH,
                 .procname       = "tcp_max_ssthresh",
                 .data           = &sysctl_tcp_max_ssthresh,
                 .maxlen         = sizeof(int),
@@ -713,41 +584,54 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
+                .procname       = "tcp_cookie_size",
+                .data           = &sysctl_tcp_cookie_size,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_thin_linear_timeouts",
+                .data           = &sysctl_tcp_thin_linear_timeouts,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_thin_dupack",
+                .data           = &sysctl_tcp_thin_dupack,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
                 .procname       = "udp_mem",
                 .data           = &sysctl_udp_mem,
                 .maxlen         = sizeof(sysctl_udp_mem),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
-                .extra1         = &zero
+                .proc_handler   = proc_doulongvec_minmax,
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "udp_rmem_min",
                 .data           = &sysctl_udp_rmem_min,
                 .maxlen         = sizeof(sysctl_udp_rmem_min),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &zero
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "udp_wmem_min",
                 .data           = &sysctl_udp_wmem_min,
                 .maxlen         = sizeof(sysctl_udp_wmem_min),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &zero
         },
-        { .ctl_name = 0 }
+        { }
 };
 
 static struct ctl_table ipv4_net_table[] = {
         {
-                .ctl_name       = NET_IPV4_ICMP_ECHO_IGNORE_ALL,
                 .procname       = "icmp_echo_ignore_all",
                 .data           = &init_net.ipv4.sysctl_icmp_echo_ignore_all,
                 .maxlen         = sizeof(int),
@@ -755,7 +639,6 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_ICMP_ECHO_IGNORE_BROADCASTS,
                 .procname       = "icmp_echo_ignore_broadcasts",
                 .data           = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
                 .maxlen         = sizeof(int),
@@ -763,7 +646,6 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_ICMP_IGNORE_BOGUS_ERROR_RESPONSES,
                 .procname       = "icmp_ignore_bogus_error_responses",
                 .data           = &init_net.ipv4.sysctl_icmp_ignore_bogus_error_responses,
                 .maxlen         = sizeof(int),
@@ -771,7 +653,6 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_ICMP_ERRORS_USE_INBOUND_IFADDR,
                 .procname       = "icmp_errors_use_inbound_ifaddr",
                 .data           = &init_net.ipv4.sysctl_icmp_errors_use_inbound_ifaddr,
                 .maxlen         = sizeof(int),
@@ -779,16 +660,13 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = NET_IPV4_ICMP_RATELIMIT,
                 .procname       = "icmp_ratelimit",
                 .data           = &init_net.ipv4.sysctl_icmp_ratelimit,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_ms_jiffies,
-                .strategy       = sysctl_ms_jiffies
         },
         {
-                .ctl_name       = NET_IPV4_ICMP_RATEMASK,
                 .procname       = "icmp_ratemask",
                 .data           = &init_net.ipv4.sysctl_icmp_ratemask,
                 .maxlen         = sizeof(int),
@@ -796,7 +674,6 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
-                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "rt_cache_rebuild_count",
                 .data           = &init_net.ipv4.sysctl_rt_cache_rebuild_count,
                 .maxlen         = sizeof(int),
@@ -807,8 +684,8 @@ static struct ctl_table ipv4_net_table[] = {
 };
 
 struct ctl_path net_ipv4_ctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ipv4", .ctl_name = NET_IPV4, },
+        { .procname = "net", },
+        { .procname = "ipv4", },
         { },
 };
 EXPORT_SYMBOL_GPL(net_ipv4_ctl_path);
@@ -818,7 +695,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
         struct ctl_table *table;
 
         table = ipv4_net_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                 table = kmemdup(table, sizeof(ipv4_net_table), GFP_KERNEL);
                 if (table == NULL)
                         goto err_alloc;
@@ -849,7 +726,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
         return 0;
 
 err_reg:
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 kfree(table);
 err_alloc:
         return -ENOMEM;
@@ -872,6 +749,16 @@ static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
 static __init int sysctl_ipv4_init(void)
 {
         struct ctl_table_header *hdr;
+        struct ctl_table *i;
+
+        for (i = ipv4_table; i->procname; i++) {
+                if (strcmp(i->procname, "ip_local_reserved_ports") == 0) {
+                        i->data = sysctl_local_reserved_ports;
+                        break;
+                }
+        }
+        if (!i->procname)
+                return -EINVAL;
 
         hdr = register_sysctl_paths(net_ipv4_ctl_path, ipv4_table);
         if (hdr == NULL)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 17b89c523f9d..6c11eece262c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -264,6 +264,8 @@
 #include <linux/cache.h>
 #include <linux/err.h>
 #include <linux/crypto.h>
+#include <linux/time.h>
+#include <linux/slab.h>
 
 #include <net/icmp.h>
 #include <net/tcp.h>
@@ -280,7 +282,7 @@ int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
 struct percpu_counter tcp_orphan_count;
 EXPORT_SYMBOL_GPL(tcp_orphan_count);
 
-int sysctl_tcp_mem[3] __read_mostly;
+long sysctl_tcp_mem[3] __read_mostly;
 int sysctl_tcp_wmem[3] __read_mostly;
 int sysctl_tcp_rmem[3] __read_mostly;
 
@@ -288,7 +290,7 @@ EXPORT_SYMBOL(sysctl_tcp_mem);
 EXPORT_SYMBOL(sysctl_tcp_rmem);
 EXPORT_SYMBOL(sysctl_tcp_wmem);
 
-atomic_t tcp_memory_allocated;  /* Current allocated memory. */
+atomic_long_t tcp_memory_allocated;     /* Current allocated memory. */
 EXPORT_SYMBOL(tcp_memory_allocated);
 
 /*
@@ -313,7 +315,6 @@ struct tcp_splice_state {
  * is strict, actions are advisory and have some latency.
  */
 int tcp_memory_pressure __read_mostly;
-
 EXPORT_SYMBOL(tcp_memory_pressure);
 
 void tcp_enter_memory_pressure(struct sock *sk)
@@ -323,9 +324,45 @@ void tcp_enter_memory_pressure(struct sock *sk)
                 tcp_memory_pressure = 1;
         }
 }
-
 EXPORT_SYMBOL(tcp_enter_memory_pressure);
 
+/* Convert seconds to retransmits based on initial and max timeout */
+static u8 secs_to_retrans(int seconds, int timeout, int rto_max)
+{
+        u8 res = 0;
+
+        if (seconds > 0) {
+                int period = timeout;
+
+                res = 1;
+                while (seconds > period && res < 255) {
+                        res++;
+                        timeout <<= 1;
+                        if (timeout > rto_max)
+                                timeout = rto_max;
+                        period += timeout;
+                }
+        }
+        return res;
+}
+
+/* Convert retransmits to seconds based on initial and max timeout */
+static int retrans_to_secs(u8 retrans, int timeout, int rto_max)
+{
+        int period = 0;
+
+        if (retrans > 0) {
+                period = timeout;
+                while (--retrans) {
+                        timeout <<= 1;
+                        if (timeout > rto_max)
+                                timeout = rto_max;
+                        period += timeout;
+                }
+        }
+        return period;
+}
+
 /*
  *      Wait for a TCP event.
  *
@@ -339,7 +376,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
         struct sock *sk = sock->sk;
         struct tcp_sock *tp = tcp_sk(sk);
 
-        poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk_sleep(sk), wait);
         if (sk->sk_state == TCP_LISTEN)
                 return inet_csk_listen_poll(sk);
 
@@ -349,8 +386,6 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
          */
 
         mask = 0;
-        if (sk->sk_err)
-                mask = POLLERR;
 
         /*
          * POLLHUP is certainly not done right. But poll() doesn't
@@ -391,7 +426,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                 if (tp->urg_seq == tp->copied_seq &&
                     !sock_flag(sk, SOCK_URGINLINE) &&
                     tp->urg_data)
-                        target--;
+                        target++;
 
                 /* Potential race condition. If read of tp below will
                  * escape above sk->sk_state, we can be illegally awaken
@@ -414,13 +449,20 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                                 if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
                                         mask |= POLLOUT | POLLWRNORM;
                         }
-                }
+                } else
+                        mask |= POLLOUT | POLLWRNORM;
 
                 if (tp->urg_data & TCP_URG_VALID)
                         mask |= POLLPRI;
         }
+        /* This barrier is coupled with smp_wmb() in tcp_reset() */
+        smp_rmb();
+        if (sk->sk_err)
+                mask |= POLLERR;
+
         return mask;
 }
+EXPORT_SYMBOL(tcp_poll);
 
 int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 {
@@ -469,10 +511,11 @@ int tcp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 
         return put_user(answ, (int __user *)arg);
 }
+EXPORT_SYMBOL(tcp_ioctl);
 
 static inline void tcp_mark_push(struct tcp_sock *tp, struct sk_buff *skb)
 {
-        TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
+        TCP_SKB_CB(skb)->flags |= TCPHDR_PSH;
         tp->pushed_seq = tp->write_seq;
 }
 
@@ -488,7 +531,7 @@ static inline void skb_entail(struct sock *sk, struct sk_buff *skb)
 
         skb->csum    = 0;
         tcb->seq     = tcb->end_seq = tp->write_seq;
-        tcb->flags   = TCPCB_FLAG_ACK;
+        tcb->flags   = TCPHDR_ACK;
         tcb->sacked  = 0;
         skb_header_release(skb);
         tcp_add_write_queue_tail(sk, skb);
@@ -498,8 +541,7 @@ static inline void skb_entail(struct sock *sk, struct sk_buff *skb)
                 tp->nonagle &= ~TCP_NAGLE_PUSH;
 }
 
-static inline void tcp_mark_urg(struct tcp_sock *tp, int flags,
-                                struct sk_buff *skb)
+static inline void tcp_mark_urg(struct tcp_sock *tp, int flags)
 {
         if (flags & MSG_OOB)
                 tp->snd_up = tp->write_seq;
@@ -508,13 +550,13 @@ static inline void tcp_mark_urg(struct tcp_sock *tp, int flags,
 static inline void tcp_push(struct sock *sk, int flags, int mss_now,
                             int nonagle)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
-
         if (tcp_send_head(sk)) {
-                struct sk_buff *skb = tcp_write_queue_tail(sk);
+                struct tcp_sock *tp = tcp_sk(sk);
+
                 if (!(flags & MSG_MORE) || forced_push(tp))
-                        tcp_mark_push(tp, skb);
-                tcp_mark_urg(tp, flags, skb);
+                        tcp_mark_push(tp, tcp_write_queue_tail(sk));
+
+                tcp_mark_urg(tp, flags);
                 __tcp_push_pending_frames(sk, mss_now,
                                           (flags & MSG_MORE) ? TCP_NAGLE_CORK : nonagle);
         }
@@ -570,6 +612,7 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
         ssize_t spliced;
         int ret;
 
+        sock_rps_record_flow(sk);
         /*
          * We can't seek on a socket input
          */
@@ -580,7 +623,7 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
 
         lock_sock(sk);
 
-        timeo = sock_rcvtimeo(sk, flags & SPLICE_F_NONBLOCK);
+        timeo = sock_rcvtimeo(sk, sock->file->f_flags & O_NONBLOCK);
         while (tss.len) {
                 ret = __tcp_splice_read(sk, &tss);
                 if (ret < 0)
@@ -637,6 +680,7 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
 
         return ret;
 }
+EXPORT_SYMBOL(tcp_splice_read);
 
 struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
 {
@@ -777,7 +821,7 @@ new_segment:
                 skb_shinfo(skb)->gso_segs = 0;
 
                 if (!copied)
-                        TCP_SKB_CB(skb)->flags &= ~TCPCB_FLAG_PSH;
+                        TCP_SKB_CB(skb)->flags &= ~TCPHDR_PSH;
 
                 copied += copy;
                 poffset += copy;
@@ -818,15 +862,15 @@ out_err:
         return sk_stream_error(sk, flags, err);
 }
 
-ssize_t tcp_sendpage(struct socket *sock, struct page *page, int offset,
-                     size_t size, int flags)
+int tcp_sendpage(struct sock *sk, struct page *page, int offset,
+                 size_t size, int flags)
 {
         ssize_t res;
-        struct sock *sk = sock->sk;
 
         if (!(sk->sk_route_caps & NETIF_F_SG) ||
             !(sk->sk_route_caps & NETIF_F_ALL_CSUM))
-                return sock_no_sendpage(sock, page, offset, size, flags);
+                return sock_no_sendpage(sk->sk_socket, page, offset, size,
+                                        flags);
 
         lock_sock(sk);
         TCP_CHECK_TIMER(sk);
@@ -835,16 +879,17 @@ ssize_t tcp_sendpage(struct socket *sock, struct page *page, int offset,
         release_sock(sk);
         return res;
 }
+EXPORT_SYMBOL(tcp_sendpage);
 
 #define TCP_PAGE(sk)    (sk->sk_sndmsg_page)
 #define TCP_OFF(sk)     (sk->sk_sndmsg_off)
 
-static inline int select_size(struct sock *sk)
+static inline int select_size(struct sock *sk, int sg)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int tmp = tp->mss_cache;
 
-        if (sk->sk_route_caps & NETIF_F_SG) {
+        if (sg) {
                 if (sk_can_gso(sk))
                         tmp = 0;
                 else {
@@ -859,16 +904,15 @@ static inline int select_size(struct sock *sk)
         return tmp;
 }
 
-int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
+int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 size_t size)
 {
-        struct sock *sk = sock->sk;
         struct iovec *iov;
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
         int iovlen, flags;
         int mss_now, size_goal;
-        int err, copied;
+        int sg, err, copied;
         long timeo;
 
         lock_sock(sk);
@@ -896,20 +940,26 @@ int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                 goto out_err;
 
+        sg = sk->sk_route_caps & NETIF_F_SG;
+
         while (--iovlen >= 0) {
-                int seglen = iov->iov_len;
+                size_t seglen = iov->iov_len;
                 unsigned char __user *from = iov->iov_base;
 
                 iov++;
 
                 while (seglen > 0) {
-                        int copy;
+                        int copy = 0;
+                        int max = size_goal;
 
                         skb = tcp_write_queue_tail(sk);
+                        if (tcp_send_head(sk)) {
+                                if (skb->ip_summed == CHECKSUM_NONE)
+                                        max = mss_now;
+                                copy = max - skb->len;
+                        }
 
-                        if (!tcp_send_head(sk) ||
-                            (copy = size_goal - skb->len) <= 0) {
-
+                        if (copy <= 0) {
 new_segment:
                                 /* Allocate new segment. If the interface is SG,
                                  * allocate skb fitting to single page.
@@ -917,8 +967,9 @@ new_segment:
                                 if (!sk_stream_memory_free(sk))
                                         goto wait_for_sndbuf;
 
-                                skb = sk_stream_alloc_skb(sk, select_size(sk),
-                                                sk->sk_allocation);
+                                skb = sk_stream_alloc_skb(sk,
+                                                          select_size(sk, sg),
+                                                          sk->sk_allocation);
                                 if (!skb)
                                         goto wait_for_memory;
 
@@ -930,6 +981,7 @@ new_segment:
 
                                 skb_entail(sk, skb);
                                 copy = size_goal;
+                                max = size_goal;
                         }
 
                         /* Try to append data to the end of skb. */
@@ -954,9 +1006,7 @@ new_segment:
                                         /* We can extend the last page
                                          * fragment. */
                                         merge = 1;
-                                } else if (i == MAX_SKB_FRAGS ||
-                                           (!i &&
-                                           !(sk->sk_route_caps & NETIF_F_SG))) {
+                                } else if (i == MAX_SKB_FRAGS || !sg) {
                                         /* Need to add new fragment and cannot
                                          * do this because interface is non-SG,
                                          * or because all the page slots are
@@ -1017,7 +1067,7 @@ new_segment:
                         }
 
                         if (!copied)
-                                TCP_SKB_CB(skb)->flags &= ~TCPCB_FLAG_PSH;
+                                TCP_SKB_CB(skb)->flags &= ~TCPHDR_PSH;
 
                         tp->write_seq += copy;
                         TCP_SKB_CB(skb)->end_seq += copy;
@@ -1028,7 +1078,7 @@ new_segment:
                         if ((seglen -= copy) == 0 && iovlen == 0)
                                 goto out;
 
-                        if (skb->len < size_goal || (flags & MSG_OOB))
+                        if (skb->len < max || (flags & MSG_OOB))
                                 continue;
 
                         if (forced_push(tp)) {
@@ -1077,6 +1127,7 @@ out_err:
         release_sock(sk);
         return err;
 }
+EXPORT_SYMBOL(tcp_sendmsg);
 
 /*
  *      Handle reading urgent data. BSD has very simple semantics for
@@ -1141,7 +1192,9 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
 #if TCP_DEBUG
         struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 
-        WARN_ON(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
+        WARN(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq),
+             "cleanup rbuf bug: copied %X seq %X rcvnxt %X\n",
+             tp->copied_seq, TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt);
 #endif
 
         if (inet_csk_ack_scheduled(sk)) {
@@ -1209,6 +1262,39 @@ static void tcp_prequeue_process(struct sock *sk)
         tp->ucopy.memory = 0;
 }
 
+#ifdef CONFIG_NET_DMA
+static void tcp_service_net_dma(struct sock *sk, bool wait)
+{
+        dma_cookie_t done, used;
+        dma_cookie_t last_issued;
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        if (!tp->ucopy.dma_chan)
+                return;
+
+        last_issued = tp->ucopy.dma_cookie;
+        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+
+        do {
+                if (dma_async_memcpy_complete(tp->ucopy.dma_chan,
+                                              last_issued, &done,
+                                              &used) == DMA_SUCCESS) {
+                        /* Safe to free early-copied skbs now */
+                        __skb_queue_purge(&sk->sk_async_wait_queue);
+                        break;
+                } else {
+                        struct sk_buff *skb;
+                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
+                               (dma_async_is_complete(skb->dma_cookie, done,
+                                                      used) == DMA_SUCCESS)) {
+                                __skb_dequeue(&sk->sk_async_wait_queue);
+                                kfree_skb(skb);
+                        }
+                }
+        } while (wait);
+}
+#endif
+
 static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
 {
         struct sk_buff *skb;
@@ -1290,6 +1376,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                 sk_eat_skb(sk, skb, 0);
                 if (!desc->count)
                         break;
+                tp->copied_seq = seq;
         }
         tp->copied_seq = seq;
 
@@ -1300,6 +1387,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                 tcp_cleanup_rbuf(sk, copied);
         return copied;
 }
+EXPORT_SYMBOL(tcp_read_sock);
 
 /*
  *      This routine copies from a sock struct into the user buffer.
@@ -1388,11 +1476,12 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         /* Now that we have two receive queues this
                          * shouldn't happen.
                          */
-                        if (before(*seq, TCP_SKB_CB(skb)->seq)) {
-                                printk(KERN_INFO "recvmsg bug: copied %X "
-                                       "seq %X\n", *seq, TCP_SKB_CB(skb)->seq);
+                        if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
+                                 "recvmsg bug: copied %X seq %X rcvnxt %X fl %X\n",
+                                 *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
+                                 flags))
                                 break;
-                        }
+
                         offset = *seq - TCP_SKB_CB(skb)->seq;
                         if (tcp_hdr(skb)->syn)
                                 offset--;
@@ -1400,7 +1489,9 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                 goto found_ok_skb;
                         if (tcp_hdr(skb)->fin)
                                 goto found_fin_ok;
-                        WARN_ON(!(flags & MSG_PEEK));
+                        WARN(!(flags & MSG_PEEK),
+                             "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n",
+                             *seq, TCP_SKB_CB(skb)->seq, tp->rcv_nxt, flags);
                 }
 
                 /* Well, if we have backlog, try to process it now yet. */
@@ -1496,6 +1587,10 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         /* __ Set realtime policy in scheduler __ */
                 }
 
+#ifdef CONFIG_NET_DMA
+                if (tp->ucopy.dma_chan)
+                        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+#endif
                 if (copied >= target) {
                         /* Do not sleep, just process backlog. */
                         release_sock(sk);
@@ -1504,6 +1599,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         sk_wait_data(sk, &timeo);
 
 #ifdef CONFIG_NET_DMA
+                tcp_service_net_dma(sk, false);  /* Don't block */
                 tp->ucopy.wakeup = 0;
 #endif
 
@@ -1583,6 +1679,9 @@ do_prequeue:
                                                 copied = -EFAULT;
                                         break;
                                 }
+
+                                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+
                                 if ((offset + used) == skb->len)
                                         copied_early = 1;
 
@@ -1652,27 +1751,9 @@ skip_copy:
         }
 
 #ifdef CONFIG_NET_DMA
-        if (tp->ucopy.dma_chan) {
-                dma_cookie_t done, used;
-
-                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
-
-                while (dma_async_memcpy_complete(tp->ucopy.dma_chan,
-                                                 tp->ucopy.dma_cookie, &done,
-                                                 &used) == DMA_IN_PROGRESS) {
-                        /* do partial cleanup of sk_async_wait_queue */
-                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
-                               (dma_async_is_complete(skb->dma_cookie, done,
-                                                      used) == DMA_SUCCESS)) {
-                                __skb_dequeue(&sk->sk_async_wait_queue);
-                                kfree_skb(skb);
-                        }
-                }
+        tcp_service_net_dma(sk, true);  /* Wait for queue to drain */
+        tp->ucopy.dma_chan = NULL;
 
-                /* Safe to free early-copied skbs now */
-                __skb_queue_purge(&sk->sk_async_wait_queue);
-                tp->ucopy.dma_chan = NULL;
-        }
         if (tp->ucopy.pinned_list) {
                 dma_unpin_iovec_pages(tp->ucopy.pinned_list);
                 tp->ucopy.pinned_list = NULL;
@@ -1699,6 +1780,7 @@ recv_urg:
         err = tcp_recv_urg(sk, msg, len, flags);
         goto out;
 }
+EXPORT_SYMBOL(tcp_recvmsg);
 
 void tcp_set_state(struct sock *sk, int state)
 {
@@ -1791,6 +1873,7 @@ void tcp_shutdown(struct sock *sk, int how)
                         tcp_send_fin(sk);
         }
 }
+EXPORT_SYMBOL(tcp_shutdown);
 
 void tcp_close(struct sock *sk, long timeout)
 {
@@ -1823,6 +1906,10 @@ void tcp_close(struct sock *sk, long timeout)
 
         sk_mem_reclaim(sk);
 
+        /* If socket has been already reset (e.g. in tcp_reset()) - kill it. */
+        if (sk->sk_state == TCP_CLOSE)
+                goto adjudge_to_death;
+
         /* As outlined in RFC 2525, section 2.17, we send a RST here because
          * data was lost. To witness the awful effects of the old behavior of
          * always doing a FIN, run an older 2.1.x kernel or 2.0.x, start a bulk
@@ -1834,7 +1921,7 @@ void tcp_close(struct sock *sk, long timeout)
                 /* Unread data was tossed, zap the connection. */
                 NET_INC_STATS_USER(sock_net(sk), LINUX_MIB_TCPABORTONCLOSE);
                 tcp_set_state(sk, TCP_CLOSE);
-                tcp_send_active_reset(sk, GFP_KERNEL);
+                tcp_send_active_reset(sk, sk->sk_allocation);
         } else if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
                 /* Check zero linger _after_ checking for unread data. */
                 sk->sk_prot->disconnect(sk, 0);
@@ -1926,11 +2013,8 @@ adjudge_to_death:
                 }
         }
         if (sk->sk_state != TCP_CLOSE) {
-                int orphan_count = percpu_counter_read_positive(
-                                                sk->sk_prot->orphan_count);
-
                 sk_mem_reclaim(sk);
-                if (tcp_too_many_orphans(sk, orphan_count)) {
+                if (tcp_too_many_orphans(sk, 0)) {
                         if (net_ratelimit())
                                 printk(KERN_INFO "TCP: too many of orphaned "
                                        "sockets\n");
@@ -1950,6 +2034,7 @@ out:
         local_bh_enable();
         sock_put(sk);
 }
+EXPORT_SYMBOL(tcp_close);
 
 /* These states need RST on ABORT according to RFC793 */
 
@@ -1993,7 +2078,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         __skb_queue_purge(&sk->sk_async_wait_queue);
 #endif
 
-        inet->dport = 0;
+        inet->inet_dport = 0;
 
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
@@ -2007,9 +2092,10 @@ int tcp_disconnect(struct sock *sk, int flags)
         tp->snd_cwnd = 2;
         icsk->icsk_probes_out = 0;
         tp->packets_out = 0;
-        tp->snd_ssthresh = 0x7fffffff;
+        tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_cnt = 0;
         tp->bytes_acked = 0;
+        tp->window_clamp = 0;
         tcp_set_ca_state(sk, TCP_CA_Open);
         tcp_clear_retrans(tp);
         inet_csk_delack_init(sk);
@@ -2017,32 +2103,34 @@ int tcp_disconnect(struct sock *sk, int flags)
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
 
-        WARN_ON(inet->num && !icsk->icsk_bind_hash);
+        WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
 }
+EXPORT_SYMBOL(tcp_disconnect);
 
 /*
  *      Socket option code for TCP.
  */
 static int do_tcp_setsockopt(struct sock *sk, int level,
-                int optname, char __user *optval, int optlen)
+                int optname, char __user *optval, unsigned int optlen)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
         int val;
         int err = 0;
 
-        /* This is a string value all the others are int's */
-        if (optname == TCP_CONGESTION) {
+        /* These are data/string values, all the others are ints */
+        switch (optname) {
+        case TCP_CONGESTION: {
                 char name[TCP_CA_NAME_MAX];
 
                 if (optlen < 1)
                         return -EINVAL;
 
                 val = strncpy_from_user(name, optval,
-                                        min(TCP_CA_NAME_MAX-1, optlen));
+                                        min_t(long, TCP_CA_NAME_MAX-1, optlen));
                 if (val < 0)
                         return -EFAULT;
                 name[val] = 0;
@@ -2052,6 +2140,96 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 release_sock(sk);
                 return err;
         }
+        case TCP_COOKIE_TRANSACTIONS: {
+                struct tcp_cookie_transactions ctd;
+                struct tcp_cookie_values *cvp = NULL;
+
+                if (sizeof(ctd) > optlen)
+                        return -EINVAL;
+                if (copy_from_user(&ctd, optval, sizeof(ctd)))
+                        return -EFAULT;
+
+                if (ctd.tcpct_used > sizeof(ctd.tcpct_value) ||
+                    ctd.tcpct_s_data_desired > TCP_MSS_DESIRED)
+                        return -EINVAL;
+
+                if (ctd.tcpct_cookie_desired == 0) {
+                        /* default to global value */
+                } else if ((0x1 & ctd.tcpct_cookie_desired) ||
+                           ctd.tcpct_cookie_desired > TCP_COOKIE_MAX ||
+                           ctd.tcpct_cookie_desired < TCP_COOKIE_MIN) {
+                        return -EINVAL;
+                }
+
+                if (TCP_COOKIE_OUT_NEVER & ctd.tcpct_flags) {
+                        /* Supercedes all other values */
+                        lock_sock(sk);
+                        if (tp->cookie_values != NULL) {
+                                kref_put(&tp->cookie_values->kref,
+                                         tcp_cookie_values_release);
+                                tp->cookie_values = NULL;
+                        }
+                        tp->rx_opt.cookie_in_always = 0; /* false */
+                        tp->rx_opt.cookie_out_never = 1; /* true */
+                        release_sock(sk);
+                        return err;
+                }
+
+                /* Allocate ancillary memory before locking.
+                 */
+                if (ctd.tcpct_used > 0 ||
+                    (tp->cookie_values == NULL &&
+                     (sysctl_tcp_cookie_size > 0 ||
+                      ctd.tcpct_cookie_desired > 0 ||
+                      ctd.tcpct_s_data_desired > 0))) {
+                        cvp = kzalloc(sizeof(*cvp) + ctd.tcpct_used,
+                                      GFP_KERNEL);
+                        if (cvp == NULL)
+                                return -ENOMEM;
+
+                        kref_init(&cvp->kref);
+                }
+                lock_sock(sk);
+                tp->rx_opt.cookie_in_always =
+                        (TCP_COOKIE_IN_ALWAYS & ctd.tcpct_flags);
+                tp->rx_opt.cookie_out_never = 0; /* false */
+
+                if (tp->cookie_values != NULL) {
+                        if (cvp != NULL) {
+                                /* Changed values are recorded by a changed
+                                 * pointer, ensuring the cookie will differ,
+                                 * without separately hashing each value later.
+                                 */
+                                kref_put(&tp->cookie_values->kref,
+                                         tcp_cookie_values_release);
+                        } else {
+                                cvp = tp->cookie_values;
+                        }
+                }
+
+                if (cvp != NULL) {
+                        cvp->cookie_desired = ctd.tcpct_cookie_desired;
+
+                        if (ctd.tcpct_used > 0) {
+                                memcpy(cvp->s_data_payload, ctd.tcpct_value,
+                                       ctd.tcpct_used);
+                                cvp->s_data_desired = ctd.tcpct_used;
+                                cvp->s_data_constant = 1; /* true */
+                        } else {
+                                /* No constant payload data. */
+                                cvp->s_data_desired = ctd.tcpct_s_data_desired;
+                                cvp->s_data_constant = 0; /* false */
+                        }
+
+                        tp->cookie_values = cvp;
+                }
+                release_sock(sk);
+                return err;
+        }
+        default:
+                /* fallthru */
+                break;
+        }
 
         if (optlen < sizeof(int))
                 return -EINVAL;
@@ -2066,7 +2244,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 /* Values greater than interface MTU won't take effect. However
                  * at the point when this call is done we typically don't yet
                  * know which interface is going to be used */
-                if (val < 8 || val > MAX_TCP_WINDOW) {
+                if (val < TCP_MIN_MSS || val > MAX_TCP_WINDOW) {
                         err = -EINVAL;
                         break;
                 }
@@ -2090,6 +2268,20 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 }
                 break;
 
+        case TCP_THIN_LINEAR_TIMEOUTS:
+                if (val < 0 || val > 1)
+                        err = -EINVAL;
+                else
+                        tp->thin_lto = val;
+                break;
+
+        case TCP_THIN_DUPACK:
+                if (val < 0 || val > 1)
+                        err = -EINVAL;
+                else
+                        tp->thin_dupack = val;
+                break;
+
         case TCP_CORK:
                 /* When set indicates to always queue non-full frames.
                  * Later the user clears this option and we transmit
@@ -2120,7 +2312,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                         if (sock_flag(sk, SOCK_KEEPOPEN) &&
                             !((1 << sk->sk_state) &
                               (TCPF_CLOSE | TCPF_LISTEN))) {
-                                __u32 elapsed = tcp_time_stamp - tp->rcv_tstamp;
+                                u32 elapsed = keepalive_time_elapsed(tp);
                                 if (tp->keepalive_time > elapsed)
                                         elapsed = tp->keepalive_time - elapsed;
                                 else
@@ -2158,16 +2350,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 break;
 
         case TCP_DEFER_ACCEPT:
-                icsk->icsk_accept_queue.rskq_defer_accept = 0;
-                if (val > 0) {
-                        /* Translate value in seconds to number of
-                         * retransmits */
-                        while (icsk->icsk_accept_queue.rskq_defer_accept < 32 &&
-                               val > ((TCP_TIMEOUT_INIT / HZ) <<
-                                       icsk->icsk_accept_queue.rskq_defer_accept))
-                                icsk->icsk_accept_queue.rskq_defer_accept++;
-                        icsk->icsk_accept_queue.rskq_defer_accept++;
-                }
+                /* Translate value in seconds to number of retransmits */
+                icsk->icsk_accept_queue.rskq_defer_accept =
+                        secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ,
+                                        TCP_RTO_MAX / HZ);
                 break;
 
         case TCP_WINDOW_CLAMP:
@@ -2204,7 +2390,12 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 err = tp->af_specific->md5_parse(sk, optval, optlen);
                 break;
 #endif
-
+        case TCP_USER_TIMEOUT:
+                /* Cap the max timeout in ms TCP will retry/retrans
+                 * before giving up and aborting (ETIMEDOUT) a connection.
+                 */
+                icsk->icsk_user_timeout = msecs_to_jiffies(val);
+                break;
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -2215,7 +2406,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
 }
 
 int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
-                   int optlen)
+                   unsigned int optlen)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
 
@@ -2224,17 +2415,17 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval,
                                                      optval, optlen);
         return do_tcp_setsockopt(sk, level, optname, optval, optlen);
 }
+EXPORT_SYMBOL(tcp_setsockopt);
 
 #ifdef CONFIG_COMPAT
 int compat_tcp_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
         if (level != SOL_TCP)
                 return inet_csk_compat_setsockopt(sk, level, optname,
                                                   optval, optlen);
         return do_tcp_setsockopt(sk, level, optname, optval, optlen);
 }
-
 EXPORT_SYMBOL(compat_tcp_setsockopt);
 #endif
 
@@ -2300,7 +2491,6 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
 
         info->tcpi_total_retrans = tp->total_retrans;
 }
-
 EXPORT_SYMBOL_GPL(tcp_get_info);
 
 static int do_tcp_getsockopt(struct sock *sk, int level,
@@ -2331,13 +2521,13 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 val = !!(tp->nonagle&TCP_NAGLE_CORK);
                 break;
         case TCP_KEEPIDLE:
-                val = (tp->keepalive_time ? : sysctl_tcp_keepalive_time) / HZ;
+                val = keepalive_time_when(tp) / HZ;
                 break;
         case TCP_KEEPINTVL:
-                val = (tp->keepalive_intvl ? : sysctl_tcp_keepalive_intvl) / HZ;
+                val = keepalive_intvl_when(tp) / HZ;
                 break;
         case TCP_KEEPCNT:
-                val = tp->keepalive_probes ? : sysctl_tcp_keepalive_probes;
+                val = keepalive_probes(tp);
                 break;
         case TCP_SYNCNT:
                 val = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
@@ -2348,8 +2538,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                         val = (val ? : sysctl_tcp_fin_timeout) / HZ;
                 break;
         case TCP_DEFER_ACCEPT:
-                val = !icsk->icsk_accept_queue.rskq_defer_accept ? 0 :
-                        ((TCP_TIMEOUT_INIT / HZ) << (icsk->icsk_accept_queue.rskq_defer_accept - 1));
+                val = retrans_to_secs(icsk->icsk_accept_queue.rskq_defer_accept,
+                                      TCP_TIMEOUT_INIT / HZ, TCP_RTO_MAX / HZ);
                 break;
         case TCP_WINDOW_CLAMP:
                 val = tp->window_clamp;
@@ -2382,6 +2572,52 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                 if (copy_to_user(optval, icsk->icsk_ca_ops->name, len))
                         return -EFAULT;
                 return 0;
+
+        case TCP_COOKIE_TRANSACTIONS: {
+                struct tcp_cookie_transactions ctd;
+                struct tcp_cookie_values *cvp = tp->cookie_values;
+
+                if (get_user(len, optlen))
+                        return -EFAULT;
+                if (len < sizeof(ctd))
+                        return -EINVAL;
+
+                memset(&ctd, 0, sizeof(ctd));
+                ctd.tcpct_flags = (tp->rx_opt.cookie_in_always ?
+                                   TCP_COOKIE_IN_ALWAYS : 0)
+                                | (tp->rx_opt.cookie_out_never ?
+                                   TCP_COOKIE_OUT_NEVER : 0);
+
+                if (cvp != NULL) {
+                        ctd.tcpct_flags |= (cvp->s_data_in ?
+                                            TCP_S_DATA_IN : 0)
+                                         | (cvp->s_data_out ?
+                                            TCP_S_DATA_OUT : 0);
+
+                        ctd.tcpct_cookie_desired = cvp->cookie_desired;
+                        ctd.tcpct_s_data_desired = cvp->s_data_desired;
+
+                        memcpy(&ctd.tcpct_value[0], &cvp->cookie_pair[0],
+                               cvp->cookie_pair_size);
+                        ctd.tcpct_used = cvp->cookie_pair_size;
+                }
+
+                if (put_user(sizeof(ctd), optlen))
+                        return -EFAULT;
+                if (copy_to_user(optval, &ctd, sizeof(ctd)))
+                        return -EFAULT;
+                return 0;
+        }
+        case TCP_THIN_LINEAR_TIMEOUTS:
+                val = tp->thin_lto;
+                break;
+        case TCP_THIN_DUPACK:
+                val = tp->thin_dupack;
+                break;
+
+        case TCP_USER_TIMEOUT:
+                val = jiffies_to_msecs(icsk->icsk_user_timeout);
+                break;
         default:
                 return -ENOPROTOOPT;
         }
@@ -2403,6 +2639,7 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval,
                                                      optval, optlen);
         return do_tcp_getsockopt(sk, level, optname, optval, optlen);
 }
+EXPORT_SYMBOL(tcp_getsockopt);
 
 #ifdef CONFIG_COMPAT
 int compat_tcp_getsockopt(struct sock *sk, int level, int optname,
@@ -2413,7 +2650,6 @@ int compat_tcp_getsockopt(struct sock *sk, int level, int optname,
                                                   optval, optlen);
         return do_tcp_getsockopt(sk, level, optname, optval, optlen);
 }
-
 EXPORT_SYMBOL(compat_tcp_getsockopt);
 #endif
 
@@ -2513,7 +2749,7 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         struct tcphdr *th2;
         unsigned int len;
         unsigned int thlen;
-        unsigned int flags;
+        __be32 flags;
         unsigned int mss = 1;
         unsigned int hlen;
         unsigned int off;
@@ -2563,10 +2799,10 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
 found:
         flush = NAPI_GRO_CB(p)->flush;
-        flush |= flags & TCP_FLAG_CWR;
-        flush |= (flags ^ tcp_flag_word(th2)) &
-                  ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH);
-        flush |= th->ack_seq ^ th2->ack_seq;
+        flush |= (__force int)(flags & TCP_FLAG_CWR);
+        flush |= (__force int)((flags ^ tcp_flag_word(th2)) &
+                  ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH));
+        flush |= (__force int)(th->ack_seq ^ th2->ack_seq);
         for (i = sizeof(*th); i < thlen; i += 4)
                 flush |= *(u32 *)((u8 *)th + i) ^
                          *(u32 *)((u8 *)th2 + i);
@@ -2587,8 +2823,9 @@ found:
 
 out_check_final:
         flush = len < mss;
-        flush |= flags & (TCP_FLAG_URG | TCP_FLAG_PSH | TCP_FLAG_RST |
-                          TCP_FLAG_SYN | TCP_FLAG_FIN);
+        flush |= (__force int)(flags & (TCP_FLAG_URG | TCP_FLAG_PSH |
+                                        TCP_FLAG_RST | TCP_FLAG_SYN |
+                                        TCP_FLAG_FIN));
 
         if (p && (!NAPI_GRO_CB(skb)->same_flow || flush))
                 pp = head;
@@ -2619,10 +2856,10 @@ EXPORT_SYMBOL(tcp_gro_complete);
 
 #ifdef CONFIG_TCP_MD5SIG
 static unsigned long tcp_md5sig_users;
-static struct tcp_md5sig_pool **tcp_md5sig_pool;
+static struct tcp_md5sig_pool * __percpu *tcp_md5sig_pool;
 static DEFINE_SPINLOCK(tcp_md5sig_pool_lock);
 
-static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool **pool)
+static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool * __percpu *pool)
 {
         int cpu;
         for_each_possible_cpu(cpu) {
@@ -2631,7 +2868,6 @@ static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool **pool)
                         if (p->md5_desc.tfm)
                                 crypto_free_hash(p->md5_desc.tfm);
                         kfree(p);
-                        p = NULL;
                 }
         }
         free_percpu(pool);
@@ -2639,7 +2875,7 @@ static void __tcp_free_md5sig_pool(struct tcp_md5sig_pool **pool)
 
 void tcp_free_md5sig_pool(void)
 {
-        struct tcp_md5sig_pool **pool = NULL;
+        struct tcp_md5sig_pool * __percpu *pool = NULL;
 
         spin_lock_bh(&tcp_md5sig_pool_lock);
         if (--tcp_md5sig_users == 0) {
@@ -2650,13 +2886,13 @@ void tcp_free_md5sig_pool(void)
         if (pool)
                 __tcp_free_md5sig_pool(pool);
 }
-
 EXPORT_SYMBOL(tcp_free_md5sig_pool);
 
-static struct tcp_md5sig_pool **__tcp_alloc_md5sig_pool(void)
+static struct tcp_md5sig_pool * __percpu *
+__tcp_alloc_md5sig_pool(struct sock *sk)
 {
         int cpu;
-        struct tcp_md5sig_pool **pool;
+        struct tcp_md5sig_pool * __percpu *pool;
 
         pool = alloc_percpu(struct tcp_md5sig_pool *);
         if (!pool)
@@ -2666,7 +2902,7 @@ static struct tcp_md5sig_pool **__tcp_alloc_md5sig_pool(void)
                 struct tcp_md5sig_pool *p;
                 struct crypto_hash *hash;
 
-                p = kzalloc(sizeof(*p), GFP_KERNEL);
+                p = kzalloc(sizeof(*p), sk->sk_allocation);
                 if (!p)
                         goto out_free;
                 *per_cpu_ptr(pool, cpu) = p;
@@ -2683,9 +2919,9 @@ out_free:
         return NULL;
 }
 
-struct tcp_md5sig_pool **tcp_alloc_md5sig_pool(void)
+struct tcp_md5sig_pool * __percpu *tcp_alloc_md5sig_pool(struct sock *sk)
 {
-        struct tcp_md5sig_pool **pool;
+        struct tcp_md5sig_pool * __percpu *pool;
         int alloc = 0;
 
 retry:
@@ -2704,7 +2940,9 @@ retry:
 
         if (alloc) {
                 /* we cannot hold spinlock here because this may sleep. */
-                struct tcp_md5sig_pool **p = __tcp_alloc_md5sig_pool();
+                struct tcp_md5sig_pool * __percpu *p;
+
+                p = __tcp_alloc_md5sig_pool(sk);
                 spin_lock_bh(&tcp_md5sig_pool_lock);
                 if (!p) {
                         tcp_md5sig_users--;
@@ -2723,28 +2961,42 @@ retry:
         }
         return pool;
 }
-
 EXPORT_SYMBOL(tcp_alloc_md5sig_pool);
 
-struct tcp_md5sig_pool *__tcp_get_md5sig_pool(int cpu)
+
+/**
+ *      tcp_get_md5sig_pool - get md5sig_pool for this user
+ *
+ *      We use percpu structure, so if we succeed, we exit with preemption
+ *      and BH disabled, to make sure another thread or softirq handling
+ *      wont try to get same context.
+ */
+struct tcp_md5sig_pool *tcp_get_md5sig_pool(void)
 {
-        struct tcp_md5sig_pool **p;
-        spin_lock_bh(&tcp_md5sig_pool_lock);
+        struct tcp_md5sig_pool * __percpu *p;
+
+        local_bh_disable();
+
+        spin_lock(&tcp_md5sig_pool_lock);
         p = tcp_md5sig_pool;
         if (p)
                 tcp_md5sig_users++;
-        spin_unlock_bh(&tcp_md5sig_pool_lock);
-        return (p ? *per_cpu_ptr(p, cpu) : NULL);
-}
+        spin_unlock(&tcp_md5sig_pool_lock);
 
-EXPORT_SYMBOL(__tcp_get_md5sig_pool);
+        if (p)
+                return *this_cpu_ptr(p);
 
-void __tcp_put_md5sig_pool(void)
+        local_bh_enable();
+        return NULL;
+}
+EXPORT_SYMBOL(tcp_get_md5sig_pool);
+
+void tcp_put_md5sig_pool(void)
 {
+        local_bh_enable();
         tcp_free_md5sig_pool();
 }
-
-EXPORT_SYMBOL(__tcp_put_md5sig_pool);
+EXPORT_SYMBOL(tcp_put_md5sig_pool);
 
 int tcp_md5_hash_header(struct tcp_md5sig_pool *hp,
                         struct tcphdr *th)
@@ -2760,7 +3012,6 @@ int tcp_md5_hash_header(struct tcp_md5sig_pool *hp,
         th->check = old_checksum;
         return err;
 }
-
 EXPORT_SYMBOL(tcp_md5_hash_header);
 
 int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
@@ -2773,6 +3024,7 @@ int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
         const unsigned head_data_len = skb_headlen(skb) > header_len ?
                                        skb_headlen(skb) - header_len : 0;
         const struct skb_shared_info *shi = skb_shinfo(skb);
+        struct sk_buff *frag_iter;
 
         sg_init_table(&sg, 1);
 
@@ -2787,9 +3039,12 @@ int tcp_md5_hash_skb_data(struct tcp_md5sig_pool *hp,
                         return 1;
         }
 
+        skb_walk_frags(skb, frag_iter)
+                if (tcp_md5_hash_skb_data(hp, frag_iter, 0))
+                        return 1;
+
         return 0;
 }
-
 EXPORT_SYMBOL(tcp_md5_hash_skb_data);
 
 int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, struct tcp_md5sig_key *key)
@@ -2799,11 +3054,139 @@ int tcp_md5_hash_key(struct tcp_md5sig_pool *hp, struct tcp_md5sig_key *key)
         sg_init_one(&sg, key->key, key->keylen);
         return crypto_hash_update(&hp->md5_desc, &sg, key->keylen);
 }
-
 EXPORT_SYMBOL(tcp_md5_hash_key);
 
 #endif
 
+/**
+ * Each Responder maintains up to two secret values concurrently for
+ * efficient secret rollover.  Each secret value has 4 states:
+ *
+ * Generating.  (tcp_secret_generating != tcp_secret_primary)
+ *    Generates new Responder-Cookies, but not yet used for primary
+ *    verification.  This is a short-term state, typically lasting only
+ *    one round trip time (RTT).
+ *
+ * Primary.  (tcp_secret_generating == tcp_secret_primary)
+ *    Used both for generation and primary verification.
+ *
+ * Retiring.  (tcp_secret_retiring != tcp_secret_secondary)
+ *    Used for verification, until the first failure that can be
+ *    verified by the newer Generating secret.  At that time, this
+ *    cookie's state is changed to Secondary, and the Generating
+ *    cookie's state is changed to Primary.  This is a short-term state,
+ *    typically lasting only one round trip time (RTT).
+ *
+ * Secondary.  (tcp_secret_retiring == tcp_secret_secondary)
+ *    Used for secondary verification, after primary verification
+ *    failures.  This state lasts no more than twice the Maximum Segment
+ *    Lifetime (2MSL).  Then, the secret is discarded.
+ */
+struct tcp_cookie_secret {
+        /* The secret is divided into two parts.  The digest part is the
+         * equivalent of previously hashing a secret and saving the state,
+         * and serves as an initialization vector (IV).  The message part
+         * serves as the trailing secret.
+         */
+        u32                             secrets[COOKIE_WORKSPACE_WORDS];
+        unsigned long                   expires;
+};
+
+#define TCP_SECRET_1MSL (HZ * TCP_PAWS_MSL)
+#define TCP_SECRET_2MSL (HZ * TCP_PAWS_MSL * 2)
+#define TCP_SECRET_LIFE (HZ * 600)
+
+static struct tcp_cookie_secret tcp_secret_one;
+static struct tcp_cookie_secret tcp_secret_two;
+
+/* Essentially a circular list, without dynamic allocation. */
+static struct tcp_cookie_secret *tcp_secret_generating;
+static struct tcp_cookie_secret *tcp_secret_primary;
+static struct tcp_cookie_secret *tcp_secret_retiring;
+static struct tcp_cookie_secret *tcp_secret_secondary;
+
+static DEFINE_SPINLOCK(tcp_secret_locker);
+
+/* Select a pseudo-random word in the cookie workspace.
+ */
+static inline u32 tcp_cookie_work(const u32 *ws, const int n)
+{
+        return ws[COOKIE_DIGEST_WORDS + ((COOKIE_MESSAGE_WORDS-1) & ws[n])];
+}
+
+/* Fill bakery[COOKIE_WORKSPACE_WORDS] with generator, updating as needed.
+ * Called in softirq context.
+ * Returns: 0 for success.
+ */
+int tcp_cookie_generator(u32 *bakery)
+{
+        unsigned long jiffy = jiffies;
+
+        if (unlikely(time_after_eq(jiffy, tcp_secret_generating->expires))) {
+                spin_lock_bh(&tcp_secret_locker);
+                if (!time_after_eq(jiffy, tcp_secret_generating->expires)) {
+                        /* refreshed by another */
+                        memcpy(bakery,
+                               &tcp_secret_generating->secrets[0],
+                               COOKIE_WORKSPACE_WORDS);
+                } else {
+                        /* still needs refreshing */
+                        get_random_bytes(bakery, COOKIE_WORKSPACE_WORDS);
+
+                        /* The first time, paranoia assumes that the
+                         * randomization function isn't as strong.  But,
+                         * this secret initialization is delayed until
+                         * the last possible moment (packet arrival).
+                         * Although that time is observable, it is
+                         * unpredictably variable.  Mash in the most
+                         * volatile clock bits available, and expire the
+                         * secret extra quickly.
+                         */
+                        if (unlikely(tcp_secret_primary->expires ==
+                                     tcp_secret_secondary->expires)) {
+                                struct timespec tv;
+
+                                getnstimeofday(&tv);
+                                bakery[COOKIE_DIGEST_WORDS+0] ^=
+                                        (u32)tv.tv_nsec;
+
+                                tcp_secret_secondary->expires = jiffy
+                                        + TCP_SECRET_1MSL
+                                        + (0x0f & tcp_cookie_work(bakery, 0));
+                        } else {
+                                tcp_secret_secondary->expires = jiffy
+                                        + TCP_SECRET_LIFE
+                                        + (0xff & tcp_cookie_work(bakery, 1));
+                                tcp_secret_primary->expires = jiffy
+                                        + TCP_SECRET_2MSL
+                                        + (0x1f & tcp_cookie_work(bakery, 2));
+                        }
+                        memcpy(&tcp_secret_secondary->secrets[0],
+                               bakery, COOKIE_WORKSPACE_WORDS);
+
+                        rcu_assign_pointer(tcp_secret_generating,
+                                           tcp_secret_secondary);
+                        rcu_assign_pointer(tcp_secret_retiring,
+                                           tcp_secret_primary);
+                        /*
+                         * Neither call_rcu() nor synchronize_rcu() needed.
+                         * Retiring data is not freed.  It is replaced after
+                         * further (locked) pointer updates, and a quiet time
+                         * (minimum 1MSL, maximum LIFE - 2MSL).
+                         */
+                }
+                spin_unlock_bh(&tcp_secret_locker);
+        } else {
+                rcu_read_lock_bh();
+                memcpy(bakery,
+                       &rcu_dereference(tcp_secret_generating)->secrets[0],
+                       COOKIE_WORKSPACE_WORDS);
+                rcu_read_unlock_bh();
+        }
+        return 0;
+}
+EXPORT_SYMBOL(tcp_cookie_generator);
+
 void tcp_done(struct sock *sk)
 {
         if (sk->sk_state == TCP_SYN_SENT || sk->sk_state == TCP_SYN_RECV)
@@ -2837,7 +3220,8 @@ void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
         unsigned long nr_pages, limit;
-        int order, i, max_share;
+        int i, max_share, cnt;
+        unsigned long jiffy = jiffies;
 
         BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
 
@@ -2857,14 +3241,13 @@ void __init tcp_init(void)
                 alloc_large_system_hash("TCP established",
                                         sizeof(struct inet_ehash_bucket),
                                         thash_entries,
-                                        (num_physpages >= 128 * 1024) ?
+                                        (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
-                                        &tcp_hashinfo.ehash_size,
                                         NULL,
+                                        &tcp_hashinfo.ehash_mask,
                                         thash_entries ? 0 : 512 * 1024);
-        tcp_hashinfo.ehash_size = 1 << tcp_hashinfo.ehash_size;
-        for (i = 0; i < tcp_hashinfo.ehash_size; i++) {
+        for (i = 0; i <= tcp_hashinfo.ehash_mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].chain, i);
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].twchain, i);
         }
@@ -2873,8 +3256,8 @@ void __init tcp_init(void)
         tcp_hashinfo.bhash =
                 alloc_large_system_hash("TCP bind",
                                         sizeof(struct inet_bind_hashbucket),
-                                        tcp_hashinfo.ehash_size,
-                                        (num_physpages >= 128 * 1024) ?
+                                        tcp_hashinfo.ehash_mask + 1,
+                                        (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
                                         &tcp_hashinfo.bhash_size,
@@ -2886,22 +3269,12 @@ void __init tcp_init(void)
                 INIT_HLIST_HEAD(&tcp_hashinfo.bhash[i].chain);
         }
 
-        /* Try to be a bit smarter and adjust defaults depending
-         * on available memory.
-         */
-        for (order = 0; ((1 << order) << PAGE_SHIFT) <
-                        (tcp_hashinfo.bhash_size * sizeof(struct inet_bind_hashbucket));
-                        order++)
-                ;
-        if (order >= 4) {
-                tcp_death_row.sysctl_max_tw_buckets = 180000;
-                sysctl_tcp_max_orphans = 4096 << (order - 4);
-                sysctl_max_syn_backlog = 1024;
-        } else if (order < 3) {
-                tcp_death_row.sysctl_max_tw_buckets >>= (3 - order);
-                sysctl_tcp_max_orphans >>= (3 - order);
-                sysctl_max_syn_backlog = 128;
-        }
+
+        cnt = tcp_hashinfo.ehash_mask + 1;
+
+        tcp_death_row.sysctl_max_tw_buckets = cnt / 2;
+        sysctl_tcp_max_orphans = cnt / 2;
+        sysctl_max_syn_backlog = max(128, cnt / 256);
 
         /* Set the pressure threshold to be a fraction of global memory that
          * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
@@ -2928,21 +3301,17 @@ void __init tcp_init(void)
         sysctl_tcp_rmem[2] = max(87380, max_share);
 
         printk(KERN_INFO "TCP: Hash tables configured "
-               "(established %d bind %d)\n",
-               tcp_hashinfo.ehash_size, tcp_hashinfo.bhash_size);
+               "(established %u bind %u)\n",
+               tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
 
         tcp_register_congestion_control(&tcp_reno);
-}
 
-EXPORT_SYMBOL(tcp_close);
-EXPORT_SYMBOL(tcp_disconnect);
-EXPORT_SYMBOL(tcp_getsockopt);
-EXPORT_SYMBOL(tcp_ioctl);
-EXPORT_SYMBOL(tcp_poll);
-EXPORT_SYMBOL(tcp_read_sock);
-EXPORT_SYMBOL(tcp_recvmsg);
-EXPORT_SYMBOL(tcp_sendmsg);
-EXPORT_SYMBOL(tcp_splice_read);
-EXPORT_SYMBOL(tcp_sendpage);
-EXPORT_SYMBOL(tcp_setsockopt);
-EXPORT_SYMBOL(tcp_shutdown);
+        memset(&tcp_secret_one.secrets[0], 0, sizeof(tcp_secret_one.secrets));
+        memset(&tcp_secret_two.secrets[0], 0, sizeof(tcp_secret_two.secrets));
+        tcp_secret_one.expires = jiffy; /* past due */
+        tcp_secret_two.expires = jiffy; /* past due */
+        tcp_secret_generating = &tcp_secret_one;
+        tcp_secret_primary = &tcp_secret_one;
+        tcp_secret_retiring = &tcp_secret_two;
+        tcp_secret_secondary = &tcp_secret_two;
+}
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index e92beb9e55e0..850c737e08e2 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -10,6 +10,7 @@
 #include <linux/mm.h>
 #include <linux/types.h>
 #include <linux/list.h>
+#include <linux/gfp.h>
 #include <net/tcp.h>
 
 int sysctl_tcp_max_ssthresh = 0;
@@ -116,7 +117,7 @@ int tcp_set_default_congestion_control(const char *name)
         spin_lock(&tcp_cong_list_lock);
         ca = tcp_ca_find(name);
 #ifdef CONFIG_MODULES
-        if (!ca && capable(CAP_SYS_MODULE)) {
+        if (!ca && capable(CAP_NET_ADMIN)) {
                 spin_unlock(&tcp_cong_list_lock);
 
                 request_module("tcp_%s", name);
@@ -195,10 +196,10 @@ void tcp_get_allowed_congestion_control(char *buf, size_t maxlen)
 int tcp_set_allowed_congestion_control(char *val)
 {
         struct tcp_congestion_ops *ca;
-        char *clone, *name;
+        char *saved_clone, *clone, *name;
         int ret = 0;
 
-        clone = kstrdup(val, GFP_USER);
+        saved_clone = clone = kstrdup(val, GFP_USER);
         if (!clone)
                 return -ENOMEM;
 
@@ -225,6 +226,7 @@ int tcp_set_allowed_congestion_control(char *val)
         }
 out:
         spin_unlock(&tcp_cong_list_lock);
+        kfree(saved_clone);
 
         return ret;
 }
@@ -246,7 +248,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
 
 #ifdef CONFIG_MODULES
         /* not found attempt to autoload module */
-        if (!ca && capable(CAP_SYS_MODULE)) {
+        if (!ca && capable(CAP_NET_ADMIN)) {
                 rcu_read_unlock();
                 request_module("tcp_%s", name);
                 rcu_read_lock();
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index fcbcd4ff6c5f..939edb3b8e4d 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -27,7 +27,7 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
                 r->idiag_rqueue = sk->sk_ack_backlog;
                 r->idiag_wqueue = sk->sk_max_ack_backlog;
         } else {
-                r->idiag_rqueue = tp->rcv_nxt - tp->copied_seq;
+                r->idiag_rqueue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
                 r->idiag_wqueue = tp->write_seq - tp->snd_una;
         }
         if (info != NULL)
diff --git a/net/ipv4/tcp_htcp.c b/net/ipv4/tcp_htcp.c
index 26d5c7fc7de5..7c94a4955416 100644
--- a/net/ipv4/tcp_htcp.c
+++ b/net/ipv4/tcp_htcp.c
@@ -92,8 +92,8 @@ static inline void measure_rtt(struct sock *sk, u32 srtt)
         if (icsk->icsk_ca_state == TCP_CA_Open) {
                 if (ca->maxRTT < ca->minRTT)
                         ca->maxRTT = ca->minRTT;
-                if (ca->maxRTT < srtt
-                    && srtt <= ca->maxRTT + msecs_to_jiffies(20))
+                if (ca->maxRTT < srtt &&
+                    srtt <= ca->maxRTT + msecs_to_jiffies(20))
                         ca->maxRTT = srtt;
         }
 }
@@ -123,9 +123,9 @@ static void measure_achieved_throughput(struct sock *sk, u32 pkts_acked, s32 rtt
 
         ca->packetcount += pkts_acked;
 
-        if (ca->packetcount >= tp->snd_cwnd - (ca->alpha >> 7 ? : 1)
-            && now - ca->lasttime >= ca->minRTT
-            && ca->minRTT > 0) {
+        if (ca->packetcount >= tp->snd_cwnd - (ca->alpha >> 7 ? : 1) &&
+            now - ca->lasttime >= ca->minRTT &&
+            ca->minRTT > 0) {
                 __u32 cur_Bi = ca->packetcount * HZ / (now - ca->lasttime);
 
                 if (htcp_ccount(ca) <= 3) {
diff --git a/net/ipv4/tcp_hybla.c b/net/ipv4/tcp_hybla.c
index c209e054a634..377bc9349371 100644
--- a/net/ipv4/tcp_hybla.c
+++ b/net/ipv4/tcp_hybla.c
@@ -126,8 +126,8 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                  * calculate 2^fract in a <<7 value.
                  */
                 is_slowstart = 1;
-                increment = ((1 << ca->rho) * hybla_fraction(rho_fractions))
-                        - 128;
+                increment = ((1 << min(ca->rho, 16U)) *
+                        hybla_fraction(rho_fractions)) - 128;
         } else {
                 /*
                  * congestion avoidance
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 1eba160b72dc..00ca688d8964 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -6,7 +6,7 @@
  * The algorithm is described in:
  * "TCP-Illinois: A Loss and Delay-Based Congestion Control Algorithm
  *  for High-Speed Networks"
- * http://www.ews.uiuc.edu/~shaoliu/papersandslides/liubassri06perf.pdf
+ * http://www.ifp.illinois.edu/~srikant/Papers/liubassri06perf.pdf
  *
  * Implemented from description in paper and ns-2 simulation.
  * Copyright (C) 2007 Stephen Hemminger <shemminger@linux-foundation.org>
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2bdb0da237e6..2549b29b062d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -62,6 +62,7 @@
  */
 
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/sysctl.h>
 #include <linux/kernel.h>
@@ -77,10 +78,13 @@ int sysctl_tcp_window_scaling __read_mostly = 1;
 int sysctl_tcp_sack __read_mostly = 1;
 int sysctl_tcp_fack __read_mostly = 1;
 int sysctl_tcp_reordering __read_mostly = TCP_FASTRETRANS_THRESH;
+EXPORT_SYMBOL(sysctl_tcp_reordering);
 int sysctl_tcp_ecn __read_mostly = 2;
+EXPORT_SYMBOL(sysctl_tcp_ecn);
 int sysctl_tcp_dsack __read_mostly = 1;
 int sysctl_tcp_app_win __read_mostly = 31;
 int sysctl_tcp_adv_win_scale __read_mostly = 2;
+EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 
 int sysctl_tcp_stdurg __read_mostly;
 int sysctl_tcp_rfc1337 __read_mostly;
@@ -89,6 +93,8 @@ int sysctl_tcp_frto __read_mostly = 2;
 int sysctl_tcp_frto_response __read_mostly;
 int sysctl_tcp_nometrics_save __read_mostly;
 
+int sysctl_tcp_thin_dupack __read_mostly;
+
 int sysctl_tcp_moderate_rcvbuf __read_mostly = 1;
 int sysctl_tcp_abc __read_mostly;
 
@@ -140,7 +146,7 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)
                  * "len" is invariant segment length, including TCP header.
                  */
                 len += skb->data - skb_transport_header(skb);
-                if (len >= TCP_MIN_RCVMSS + sizeof(struct tcphdr) ||
+                if (len >= TCP_MSS_DEFAULT + sizeof(struct tcphdr) ||
                     /* If PSH is not set, packet should be
                      * full sized, provided peer TCP is not badly broken.
                      * This observation (if it is correct 8)) allows
@@ -176,7 +182,7 @@ static void tcp_incr_quickack(struct sock *sk)
                 icsk->icsk_ack.quick = min(quickacks, TCP_MAX_QUICKACKS);
 }
 
-void tcp_enter_quickack_mode(struct sock *sk)
+static void tcp_enter_quickack_mode(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         tcp_incr_quickack(sk);
@@ -253,8 +259,11 @@ static void tcp_fixup_sndbuf(struct sock *sk)
         int sndmem = tcp_sk(sk)->rx_opt.mss_clamp + MAX_TCP_HEADER + 16 +
                      sizeof(struct sk_buff);
 
-        if (sk->sk_sndbuf < 3 * sndmem)
-                sk->sk_sndbuf = min(3 * sndmem, sysctl_tcp_wmem[2]);
+        if (sk->sk_sndbuf < 3 * sndmem) {
+                sk->sk_sndbuf = 3 * sndmem;
+                if (sk->sk_sndbuf > sysctl_tcp_wmem[2])
+                        sk->sk_sndbuf = sysctl_tcp_wmem[2];
+        }
 }
 
 /* 2. Tuning advertised window (window_clamp, rcv_ssthresh)
@@ -390,7 +399,7 @@ static void tcp_clamp_window(struct sock *sk)
         if (sk->sk_rcvbuf < sysctl_tcp_rmem[2] &&
             !(sk->sk_userlocks & SOCK_RCVBUF_LOCK) &&
             !tcp_memory_pressure &&
-            atomic_read(&tcp_memory_allocated) < sysctl_tcp_mem[0]) {
+            atomic_long_read(&tcp_memory_allocated) < sysctl_tcp_mem[0]) {
                 sk->sk_rcvbuf = min(atomic_read(&sk->sk_rmem_alloc),
                                     sysctl_tcp_rmem[2]);
         }
@@ -411,20 +420,21 @@ void tcp_initialize_rcv_mss(struct sock *sk)
         unsigned int hint = min_t(unsigned int, tp->advmss, tp->mss_cache);
 
         hint = min(hint, tp->rcv_wnd / 2);
-        hint = min(hint, TCP_MIN_RCVMSS);
+        hint = min(hint, TCP_MSS_DEFAULT);
         hint = max(hint, TCP_MIN_MSS);
 
         inet_csk(sk)->icsk_ack.rcv_mss = hint;
 }
+EXPORT_SYMBOL(tcp_initialize_rcv_mss);
 
 /* Receiver "autotuning" code.
  *
  * The algorithm for RTT estimation w/o timestamps is based on
  * Dynamic Right-Sizing (DRS) by Wu Feng and Mike Fisk of LANL.
- * <http://www.lanl.gov/radiant/website/pubs/drs/lacsi2001.ps>
+ * <http://public.lanl.gov/radiant/pubs.html#DRS>
  *
  * More detail on this code can be found at
- * <http://www.psc.edu/~jheffner/senior_thesis.ps>,
+ * <http://staff.psc.edu/jheffner/>,
  * though this reference is out of date.  A new paper
  * is pending.
  */
@@ -685,7 +695,7 @@ static inline void tcp_set_rto(struct sock *sk)
          *    is invisible. Actually, Linux-2.4 also generates erratic
          *    ACKs in some circumstances.
          */
-        inet_csk(sk)->icsk_rto = (tp->srtt >> 3) + tp->rttvar;
+        inet_csk(sk)->icsk_rto = __tcp_set_rto(tp);
 
         /* 2. Fixups made earlier cannot be right.
          *    If we do not estimate RTO correctly without them,
@@ -696,8 +706,7 @@ static inline void tcp_set_rto(struct sock *sk)
         /* NOTE: clamping at TCP_RTO_MIN is not required, current algo
          * guarantees that rto is higher.
          */
-        if (inet_csk(sk)->icsk_rto > TCP_RTO_MAX)
-                inet_csk(sk)->icsk_rto = TCP_RTO_MAX;
+        tcp_bound_rto(sk);
 }
 
 /* Save metrics learned by this TCP session.
@@ -725,7 +734,7 @@ void tcp_update_metrics(struct sock *sk)
                          * Reset our results.
                          */
                         if (!(dst_metric_locked(dst, RTAX_RTT)))
-                                dst->metrics[RTAX_RTT - 1] = 0;
+                                dst_metric_set(dst, RTAX_RTT, 0);
                         return;
                 }
 
@@ -762,62 +771,53 @@ void tcp_update_metrics(struct sock *sk)
                         set_dst_metric_rtt(dst, RTAX_RTTVAR, var);
                 }
 
-                if (tp->snd_ssthresh >= 0xFFFF) {
+                if (tcp_in_initial_slowstart(tp)) {
                         /* Slow start still did not finish. */
                         if (dst_metric(dst, RTAX_SSTHRESH) &&
                             !dst_metric_locked(dst, RTAX_SSTHRESH) &&
                             (tp->snd_cwnd >> 1) > dst_metric(dst, RTAX_SSTHRESH))
-                                dst->metrics[RTAX_SSTHRESH-1] = tp->snd_cwnd >> 1;
+                                dst_metric_set(dst, RTAX_SSTHRESH, tp->snd_cwnd >> 1);
                         if (!dst_metric_locked(dst, RTAX_CWND) &&
                             tp->snd_cwnd > dst_metric(dst, RTAX_CWND))
-                                dst->metrics[RTAX_CWND - 1] = tp->snd_cwnd;
+                                dst_metric_set(dst, RTAX_CWND, tp->snd_cwnd);
                 } else if (tp->snd_cwnd > tp->snd_ssthresh &&
                            icsk->icsk_ca_state == TCP_CA_Open) {
                         /* Cong. avoidance phase, cwnd is reliable. */
                         if (!dst_metric_locked(dst, RTAX_SSTHRESH))
-                                dst->metrics[RTAX_SSTHRESH-1] =
-                                        max(tp->snd_cwnd >> 1, tp->snd_ssthresh);
+                                dst_metric_set(dst, RTAX_SSTHRESH,
+                                               max(tp->snd_cwnd >> 1, tp->snd_ssthresh));
                         if (!dst_metric_locked(dst, RTAX_CWND))
-                                dst->metrics[RTAX_CWND-1] = (dst_metric(dst, RTAX_CWND) + tp->snd_cwnd) >> 1;
+                                dst_metric_set(dst, RTAX_CWND,
+                                               (dst_metric(dst, RTAX_CWND) +
+                                                tp->snd_cwnd) >> 1);
                 } else {
                         /* Else slow start did not finish, cwnd is non-sense,
                            ssthresh may be also invalid.
                          */
                         if (!dst_metric_locked(dst, RTAX_CWND))
-                                dst->metrics[RTAX_CWND-1] = (dst_metric(dst, RTAX_CWND) + tp->snd_ssthresh) >> 1;
+                                dst_metric_set(dst, RTAX_CWND,
+                                               (dst_metric(dst, RTAX_CWND) +
+                                                tp->snd_ssthresh) >> 1);
                         if (dst_metric(dst, RTAX_SSTHRESH) &&
                             !dst_metric_locked(dst, RTAX_SSTHRESH) &&
                             tp->snd_ssthresh > dst_metric(dst, RTAX_SSTHRESH))
-                                dst->metrics[RTAX_SSTHRESH-1] = tp->snd_ssthresh;
+                                dst_metric_set(dst, RTAX_SSTHRESH, tp->snd_ssthresh);
                 }
 
                 if (!dst_metric_locked(dst, RTAX_REORDERING)) {
                         if (dst_metric(dst, RTAX_REORDERING) < tp->reordering &&
                             tp->reordering != sysctl_tcp_reordering)
-                                dst->metrics[RTAX_REORDERING-1] = tp->reordering;
+                                dst_metric_set(dst, RTAX_REORDERING, tp->reordering);
                 }
         }
 }
 
-/* Numbers are taken from RFC3390.
- *
- * John Heffner states:
- *
- *      The RFC specifies a window of no more than 4380 bytes
- *      unless 2*MSS > 4380.  Reading the pseudocode in the RFC
- *      is a bit misleading because they use a clamp at 4380 bytes
- *      rather than use a multiplier in the relevant range.
- */
 __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst)
 {
         __u32 cwnd = (dst ? dst_metric(dst, RTAX_INITCWND) : 0);
 
-        if (!cwnd) {
-                if (tp->mss_cache > 1460)
-                        cwnd = 2;
-                else
-                        cwnd = (tp->mss_cache > 1095) ? 3 : 4;
-        }
+        if (!cwnd)
+                cwnd = rfc3390_bytes_to_packets(tp->mss_cache);
         return min_t(__u32, cwnd, tp->snd_cwnd_clamp);
 }
 
@@ -916,25 +916,20 @@ static void tcp_init_metrics(struct sock *sk)
                 tp->mdev_max = tp->rttvar = max(tp->mdev, tcp_rto_min(sk));
         }
         tcp_set_rto(sk);
-        if (inet_csk(sk)->icsk_rto < TCP_TIMEOUT_INIT && !tp->rx_opt.saw_tstamp)
-                goto reset;
-
-cwnd:
-        tp->snd_cwnd = tcp_init_cwnd(tp, dst);
-        tp->snd_cwnd_stamp = tcp_time_stamp;
-        return;
-
+        if (inet_csk(sk)->icsk_rto < TCP_TIMEOUT_INIT && !tp->rx_opt.saw_tstamp) {
 reset:
-        /* Play conservative. If timestamps are not
-         * supported, TCP will fail to recalculate correct
-         * rtt, if initial rto is too small. FORGET ALL AND RESET!
-         */
-        if (!tp->rx_opt.saw_tstamp && tp->srtt) {
-                tp->srtt = 0;
-                tp->mdev = tp->mdev_max = tp->rttvar = TCP_TIMEOUT_INIT;
-                inet_csk(sk)->icsk_rto = TCP_TIMEOUT_INIT;
+                /* Play conservative. If timestamps are not
+                 * supported, TCP will fail to recalculate correct
+                 * rtt, if initial rto is too small. FORGET ALL AND RESET!
+                 */
+                if (!tp->rx_opt.saw_tstamp && tp->srtt) {
+                        tp->srtt = 0;
+                        tp->mdev = tp->mdev_max = tp->rttvar = TCP_TIMEOUT_INIT;
+                        inet_csk(sk)->icsk_rto = TCP_TIMEOUT_INIT;
+                }
         }
-        goto cwnd;
+        tp->snd_cwnd = tcp_init_cwnd(tp, dst);
+        tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
 static void tcp_update_reordering(struct sock *sk, const int metric,
@@ -2301,14 +2296,14 @@ static inline int tcp_fackets_out(struct tcp_sock *tp)
  * they differ. Since neither occurs due to loss, TCP should really
  * ignore them.
  */
-static inline int tcp_dupack_heurestics(struct tcp_sock *tp)
+static inline int tcp_dupack_heuristics(struct tcp_sock *tp)
 {
         return tcp_is_fack(tp) ? tp->fackets_out : tp->sacked_out + 1;
 }
 
 static inline int tcp_skb_timedout(struct sock *sk, struct sk_buff *skb)
 {
-        return (tcp_time_stamp - TCP_SKB_CB(skb)->when > inet_csk(sk)->icsk_rto);
+        return tcp_time_stamp - TCP_SKB_CB(skb)->when > inet_csk(sk)->icsk_rto;
 }
 
 static inline int tcp_head_timedout(struct sock *sk)
@@ -2426,7 +2421,7 @@ static int tcp_time_to_recover(struct sock *sk)
                 return 1;
 
         /* Not-A-Trick#2 : Classic rule... */
-        if (tcp_dupack_heurestics(tp) > tp->reordering)
+        if (tcp_dupack_heuristics(tp) > tp->reordering)
                 return 1;
 
         /* Trick#3 : when we use RFC2988 timer restart, fast
@@ -2448,6 +2443,16 @@ static int tcp_time_to_recover(struct sock *sk)
                 return 1;
         }
 
+        /* If a thin stream is detected, retransmit after first
+         * received dupack. Employ only if SACK is supported in order
+         * to avoid possible corner-case series of spurious retransmissions
+         * Use only if there are no unsent data.
+         */
+        if ((tp->thin_dupack || sysctl_tcp_thin_dupack) &&
+            tcp_stream_is_thin(tp) && tcp_dupack_heuristics(tp) > 1 &&
+            tcp_is_sack(tp) && !tcp_send_head(sk))
+                return 1;
+
         return 0;
 }
 
@@ -2492,7 +2497,7 @@ static void tcp_timeout_skbs(struct sock *sk)
 /* Mark head of queue up as lost. With RFC3517 SACK, the packets is
  * is against sacked "cnt", otherwise it's against facked "cnt"
  */
-static void tcp_mark_head_lost(struct sock *sk, int packets)
+static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
@@ -2504,6 +2509,9 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
         if (tp->lost_skb_hint) {
                 skb = tp->lost_skb_hint;
                 cnt = tp->lost_cnt_hint;
+                /* Head already handled? */
+                if (mark_head && skb != tcp_write_queue_head(sk))
+                        return;
         } else {
                 skb = tcp_write_queue_head(sk);
                 cnt = 0;
@@ -2526,7 +2534,8 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
                         cnt += tcp_skb_pcount(skb);
 
                 if (cnt > packets) {
-                        if (tcp_is_sack(tp) || (oldcnt >= packets))
+                        if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                            (oldcnt >= packets))
                                 break;
 
                         mss = skb_shinfo(skb)->gso_size;
@@ -2537,6 +2546,9 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
                 }
 
                 tcp_skb_mark_lost(tp, skb);
+
+                if (mark_head)
+                        break;
         }
         tcp_verify_left_out(tp);
 }
@@ -2548,17 +2560,18 @@ static void tcp_update_scoreboard(struct sock *sk, int fast_rexmit)
         struct tcp_sock *tp = tcp_sk(sk);
 
         if (tcp_is_reno(tp)) {
-                tcp_mark_head_lost(sk, 1);
+                tcp_mark_head_lost(sk, 1, 1);
         } else if (tcp_is_fack(tp)) {
                 int lost = tp->fackets_out - tp->reordering;
                 if (lost <= 0)
                         lost = 1;
-                tcp_mark_head_lost(sk, lost);
+                tcp_mark_head_lost(sk, lost, 0);
         } else {
                 int sacked_upto = tp->sacked_out - tp->reordering;
-                if (sacked_upto < fast_rexmit)
-                        sacked_upto = fast_rexmit;
-                tcp_mark_head_lost(sk, sacked_upto);
+                if (sacked_upto >= 0)
+                        tcp_mark_head_lost(sk, sacked_upto, 0);
+                else if (fast_rexmit)
+                        tcp_mark_head_lost(sk, 1, 1);
         }
 
         tcp_timeout_skbs(sk);
@@ -2624,7 +2637,7 @@ static void DBGUNDO(struct sock *sk, const char *msg)
         if (sk->sk_family == AF_INET) {
                 printk(KERN_DEBUG "Undo %s %pI4/%u c%u l%u ss%u/%u p%u\n",
                        msg,
-                       &inet->daddr, ntohs(inet->dport),
+                       &inet->inet_daddr, ntohs(inet->inet_dport),
                        tp->snd_cwnd, tcp_left_out(tp),
                        tp->snd_ssthresh, tp->prior_ssthresh,
                        tp->packets_out);
@@ -2634,7 +2647,7 @@ static void DBGUNDO(struct sock *sk, const char *msg)
                 struct ipv6_pinfo *np = inet6_sk(sk);
                 printk(KERN_DEBUG "Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n",
                        msg,
-                       &np->daddr, ntohs(inet->dport),
+                       &np->daddr, ntohs(inet->inet_dport),
                        tp->snd_cwnd, tcp_left_out(tp),
                        tp->snd_ssthresh, tp->prior_ssthresh,
                        tp->packets_out);
@@ -2718,6 +2731,35 @@ static void tcp_try_undo_dsack(struct sock *sk)
         }
 }
 
+/* We can clear retrans_stamp when there are no retransmissions in the
+ * window. It would seem that it is trivially available for us in
+ * tp->retrans_out, however, that kind of assumptions doesn't consider
+ * what will happen if errors occur when sending retransmission for the
+ * second time. ...It could the that such segment has only
+ * TCPCB_EVER_RETRANS set at the present time. It seems that checking
+ * the head skb is enough except for some reneging corner cases that
+ * are not worth the effort.
+ *
+ * Main reason for all this complexity is the fact that connection dying
+ * time now depends on the validity of the retrans_stamp, in particular,
+ * that successive retransmissions of a segment must not advance
+ * retrans_stamp under any conditions.
+ */
+static int tcp_any_retrans_done(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb;
+
+        if (tp->retrans_out)
+                return 1;
+
+        skb = tcp_write_queue_head(sk);
+        if (unlikely(skb && TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS))
+                return 1;
+
+        return 0;
+}
+
 /* Undo during fast recovery after partial ACK. */
 
 static int tcp_try_undo_partial(struct sock *sk, int acked)
@@ -2730,7 +2772,7 @@ static int tcp_try_undo_partial(struct sock *sk, int acked)
                 /* Plain luck! Hole if filled with delayed
                  * packet, rather than with a retransmit.
                  */
-                if (tp->retrans_out == 0)
+                if (!tcp_any_retrans_done(sk))
                         tp->retrans_stamp = 0;
 
                 tcp_update_reordering(sk, tcp_fackets_out(tp) + acked, 1);
@@ -2789,7 +2831,7 @@ static void tcp_try_keep_open(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         int state = TCP_CA_Open;
 
-        if (tcp_left_out(tp) || tp->retrans_out || tp->undo_marker)
+        if (tcp_left_out(tp) || tcp_any_retrans_done(sk) || tp->undo_marker)
                 state = TCP_CA_Disorder;
 
         if (inet_csk(sk)->icsk_ca_state != state) {
@@ -2804,7 +2846,7 @@ static void tcp_try_to_open(struct sock *sk, int flag)
 
         tcp_verify_left_out(tp);
 
-        if (!tp->frto_counter && tp->retrans_out == 0)
+        if (!tp->frto_counter && !tcp_any_retrans_done(sk))
                 tp->retrans_stamp = 0;
 
         if (flag & FLAG_ECE)
@@ -2838,7 +2880,7 @@ static void tcp_mtup_probe_success(struct sock *sk)
                        icsk->icsk_mtup.probe_size;
         tp->snd_cwnd_cnt = 0;
         tp->snd_cwnd_stamp = tcp_time_stamp;
-        tp->rcv_ssthresh = tcp_current_ssthresh(sk);
+        tp->snd_ssthresh = tcp_current_ssthresh(sk);
 
         icsk->icsk_mtup.search_low = icsk->icsk_mtup.probe_size;
         icsk->icsk_mtup.probe_size = 0;
@@ -2894,6 +2936,7 @@ void tcp_simple_retransmit(struct sock *sk)
         }
         tcp_xmit_retransmit_queue(sk);
 }
+EXPORT_SYMBOL(tcp_simple_retransmit);
 
 /* Process an event, which can update packets-in-flight not trivially.
  * Main goal of this function is to calculate new estimate for left_out,
@@ -2934,7 +2977,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
             before(tp->snd_una, tp->high_seq) &&
             icsk->icsk_ca_state != TCP_CA_Open &&
             tp->fackets_out > tp->reordering) {
-                tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering);
+                tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering, 0);
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPLOSS);
         }
 
@@ -3242,7 +3285,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                  * connection startup slow start one packet too
                  * quickly.  This is severely frowned upon behavior.
                  */
-                if (!(scb->flags & TCPCB_FLAG_SYN)) {
+                if (!(scb->flags & TCPHDR_SYN)) {
                         flag |= FLAG_DATA_ACKED;
                 } else {
                         flag |= FLAG_SYN_ACKED;
@@ -3362,8 +3405,8 @@ static void tcp_ack_probe(struct sock *sk)
 
 static inline int tcp_ack_is_dubious(const struct sock *sk, const int flag)
 {
-        return (!(flag & FLAG_NOT_DUP) || (flag & FLAG_CA_ALERT) ||
-                inet_csk(sk)->icsk_ca_state != TCP_CA_Open);
+        return !(flag & FLAG_NOT_DUP) || (flag & FLAG_CA_ALERT) ||
+                inet_csk(sk)->icsk_ca_state != TCP_CA_Open;
 }
 
 static inline int tcp_may_raise_cwnd(const struct sock *sk, const int flag)
@@ -3380,9 +3423,9 @@ static inline int tcp_may_update_window(const struct tcp_sock *tp,
                                         const u32 ack, const u32 ack_seq,
                                         const u32 nwin)
 {
-        return (after(ack, tp->snd_una) ||
+        return  after(ack, tp->snd_una) ||
                 after(ack_seq, tp->snd_wl1) ||
-                (ack_seq == tp->snd_wl1 && nwin > tp->snd_wnd));
+                (ack_seq == tp->snd_wl1 && nwin > tp->snd_wnd);
 }
 
 /* Update our send window.
@@ -3666,7 +3709,7 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
         }
 
         if ((flag & FLAG_FORWARD_PROGRESS) || !(flag & FLAG_NOT_DUP))
-                dst_confirm(sk->sk_dst_cache);
+                dst_confirm(__sk_dst_get(sk));
 
         return 1;
 
@@ -3699,7 +3742,7 @@ old_ack:
  * the fast version below fails.
  */
 void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
-                       int estab)
+                       u8 **hvpp, int estab)
 {
         unsigned char *ptr;
         struct tcphdr *th = tcp_hdr(skb);
@@ -3783,6 +3826,30 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                  */
                                 break;
 #endif
+                        case TCPOPT_COOKIE:
+                                /* This option is variable length.
+                                 */
+                                switch (opsize) {
+                                case TCPOLEN_COOKIE_BASE:
+                                        /* not yet implemented */
+                                        break;
+                                case TCPOLEN_COOKIE_PAIR:
+                                        /* not yet implemented */
+                                        break;
+                                case TCPOLEN_COOKIE_MIN+0:
+                                case TCPOLEN_COOKIE_MIN+2:
+                                case TCPOLEN_COOKIE_MIN+4:
+                                case TCPOLEN_COOKIE_MIN+6:
+                                case TCPOLEN_COOKIE_MAX:
+                                        /* 16-bit multiple */
+                                        opt_rx->cookie_plus = opsize;
+                                        *hvpp = ptr;
+                                        break;
+                                default:
+                                        /* ignore option */
+                                        break;
+                                }
+                                break;
                         }
 
                         ptr += opsize-2;
@@ -3790,6 +3857,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                 }
         }
 }
+EXPORT_SYMBOL(tcp_parse_options);
 
 static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, struct tcphdr *th)
 {
@@ -3811,17 +3879,20 @@ static int tcp_parse_aligned_timestamp(struct tcp_sock *tp, struct tcphdr *th)
  * If it is wrong it falls back on tcp_parse_options().
  */
 static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
-                                  struct tcp_sock *tp)
+                                  struct tcp_sock *tp, u8 **hvpp)
 {
-        if (th->doff == sizeof(struct tcphdr) >> 2) {
+        /* In the spirit of fast parsing, compare doff directly to constant
+         * values.  Because equality is used, short doff can be ignored here.
+         */
+        if (th->doff == (sizeof(*th) / 4)) {
                 tp->rx_opt.saw_tstamp = 0;
                 return 0;
         } else if (tp->rx_opt.tstamp_ok &&
-                   th->doff == (sizeof(struct tcphdr)>>2)+(TCPOLEN_TSTAMP_ALIGNED>>2)) {
+                   th->doff == ((sizeof(*th) + TCPOLEN_TSTAMP_ALIGNED) / 4)) {
                 if (tcp_parse_aligned_timestamp(tp, th))
                         return 1;
         }
-        tcp_parse_options(skb, &tp->rx_opt, 1);
+        tcp_parse_options(skb, &tp->rx_opt, hvpp, 1);
         return 1;
 }
 
@@ -3853,13 +3924,14 @@ u8 *tcp_parse_md5sig_option(struct tcphdr *th)
                         if (opsize < 2 || opsize > length)
                                 return NULL;
                         if (opcode == TCPOPT_MD5SIG)
-                                return ptr;
+                                return opsize == TCPOLEN_MD5SIG ? ptr : NULL;
                 }
                 ptr += opsize - 2;
                 length -= opsize;
         }
         return NULL;
 }
+EXPORT_SYMBOL(tcp_parse_md5sig_option);
 #endif
 
 static inline void tcp_store_ts_recent(struct tcp_sock *tp)
@@ -3970,6 +4042,8 @@ static void tcp_reset(struct sock *sk)
         default:
                 sk->sk_err = ECONNRESET;
         }
+        /* This barrier is coupled with smp_rmb() in tcp_poll() */
+        smp_wmb();
 
         if (!sock_flag(sk, SOCK_DEAD))
                 sk->sk_error_report(sk);
@@ -4249,7 +4323,7 @@ static void tcp_ofo_queue(struct sock *sk)
                 }
 
                 if (!after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt)) {
-                        SOCK_DEBUG(sk, "ofo packet was already received \n");
+                        SOCK_DEBUG(sk, "ofo packet was already received\n");
                         __skb_unlink(skb, &tp->out_of_order_queue);
                         __kfree_skb(skb);
                         continue;
@@ -4297,6 +4371,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
         if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq)
                 goto drop;
 
+        skb_dst_drop(skb);
         __skb_pull(skb, th->doff * 4);
 
         TCP_ECN_accept_cwr(tp, skb);
@@ -4788,7 +4863,7 @@ static int tcp_should_expand_sndbuf(struct sock *sk)
                 return 0;
 
         /* If we are under soft global TCP memory pressure, do not expand.  */
-        if (atomic_read(&tcp_memory_allocated) >= sysctl_tcp_mem[0])
+        if (atomic_long_read(&tcp_memory_allocated) >= sysctl_tcp_mem[0])
                 return 0;
 
         /* If we filled the congestion window, do not expand.  */
@@ -4846,11 +4921,11 @@ static void __tcp_ack_snd_check(struct sock *sk, int ofo_possible)
         struct tcp_sock *tp = tcp_sk(sk);
 
             /* More than one full frame received... */
-        if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss
+        if (((tp->rcv_nxt - tp->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss &&
              /* ... and right edge of window advances far enough.
               * (tcp_recvmsg() will send ACK otherwise). Or...
               */
-             && __tcp_select_window(sk) >= tp->rcv_wnd) ||
+             __tcp_select_window(sk) >= tp->rcv_wnd) ||
             /* We ACK each frame or... */
             tcp_in_quickack_mode(sk) ||
             /* We have out of order data. */
@@ -5071,10 +5146,12 @@ out:
 static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
                               struct tcphdr *th, int syn_inerr)
 {
+        u8 *hash_location;
         struct tcp_sock *tp = tcp_sk(sk);
 
         /* RFC1323: H1. Apply PAWS check first. */
-        if (tcp_fast_parse_options(skb, th, tp) && tp->rx_opt.saw_tstamp &&
+        if (tcp_fast_parse_options(skb, th, tp, &hash_location) &&
+            tp->rx_opt.saw_tstamp &&
             tcp_paws_discard(sk, skb)) {
                 if (!th->rst) {
                         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSESTABREJECTED);
@@ -5358,15 +5435,18 @@ discard:
         __kfree_skb(skb);
         return 0;
 }
+EXPORT_SYMBOL(tcp_rcv_established);
 
 static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                                          struct tcphdr *th, unsigned len)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
+        u8 *hash_location;
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp_cookie_values *cvp = tp->cookie_values;
         int saved_clamp = tp->rx_opt.mss_clamp;
 
-        tcp_parse_options(skb, &tp->rx_opt, 0);
+        tcp_parse_options(skb, &tp->rx_opt, &hash_location, 0);
 
         if (th->ack) {
                 /* rfc793:
@@ -5463,6 +5543,31 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                  * Change state from SYN-SENT only after copied_seq
                  * is initialized. */
                 tp->copied_seq = tp->rcv_nxt;
+
+                if (cvp != NULL &&
+                    cvp->cookie_pair_size > 0 &&
+                    tp->rx_opt.cookie_plus > 0) {
+                        int cookie_size = tp->rx_opt.cookie_plus
+                                        - TCPOLEN_COOKIE_BASE;
+                        int cookie_pair_size = cookie_size
+                                             + cvp->cookie_desired;
+
+                        /* A cookie extension option was sent and returned.
+                         * Note that each incoming SYNACK replaces the
+                         * Responder cookie.  The initial exchange is most
+                         * fragile, as protection against spoofing relies
+                         * entirely upon the sequence and timestamp (above).
+                         * This replacement strategy allows the correct pair to
+                         * pass through, while any others will be filtered via
+                         * Responder verification later.
+                         */
+                        if (sizeof(cvp->cookie_pair) >= cookie_pair_size) {
+                                memcpy(&cvp->cookie_pair[cvp->cookie_desired],
+                                       hash_location, cookie_size);
+                                cvp->cookie_pair_size = cookie_pair_size;
+                        }
+                }
+
                 smp_mb();
                 tcp_set_state(sk, TCP_ESTABLISHED);
 
@@ -5700,11 +5805,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
                                 /* tcp_ack considers this ACK as duplicate
                                  * and does not calculate rtt.
-                                 * Fix it at least with timestamps.
+                                 * Force it here.
                                  */
-                                if (tp->rx_opt.saw_tstamp &&
-                                    tp->rx_opt.rcv_tsecr && !tp->srtt)
-                                        tcp_ack_saw_tstamp(sk, 0);
+                                tcp_ack_update_rtt(sk, 0, 0);
 
                                 if (tp->rx_opt.tstamp_ok)
                                         tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
@@ -5736,7 +5839,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         if (tp->snd_una == tp->write_seq) {
                                 tcp_set_state(sk, TCP_FIN_WAIT2);
                                 sk->sk_shutdown |= SEND_SHUTDOWN;
-                                dst_confirm(sk->sk_dst_cache);
+                                dst_confirm(__sk_dst_get(sk));
 
                                 if (!sock_flag(sk, SOCK_DEAD))
                                         /* Wake up lingering close() */
@@ -5832,14 +5935,4 @@ discard:
         }
         return 0;
 }
-
-EXPORT_SYMBOL(sysctl_tcp_ecn);
-EXPORT_SYMBOL(sysctl_tcp_reordering);
-EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
-EXPORT_SYMBOL(tcp_parse_options);
-#ifdef CONFIG_TCP_MD5SIG
-EXPORT_SYMBOL(tcp_parse_md5sig_option);
-#endif
-EXPORT_SYMBOL(tcp_rcv_established);
 EXPORT_SYMBOL(tcp_rcv_state_process);
-EXPORT_SYMBOL(tcp_initialize_rcv_mss);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5a1ca2698c88..856f68466d49 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -60,6 +60,7 @@
 #include <linux/jhash.h>
 #include <linux/init.h>
 #include <linux/times.h>
+#include <linux/slab.h>
 
 #include <net/net_namespace.h>
 #include <net/icmp.h>
@@ -83,6 +84,7 @@
 
 int sysctl_tcp_tw_reuse __read_mostly;
 int sysctl_tcp_low_latency __read_mostly;
+EXPORT_SYMBOL(sysctl_tcp_low_latency);
 
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -99,6 +101,7 @@ struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk, __be32 addr)
 #endif
 
 struct inet_hashinfo tcp_hashinfo;
+EXPORT_SYMBOL(tcp_hashinfo);
 
 static inline __u32 tcp_v4_init_sequence(struct sk_buff *skb)
 {
@@ -138,7 +141,6 @@ int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp)
 
         return 0;
 }
-
 EXPORT_SYMBOL_GPL(tcp_twsk_unique);
 
 /* This will initiate an outgoing connection. */
@@ -165,10 +167,10 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 nexthop = inet->opt->faddr;
         }
 
-        tmp = ip_route_connect(&rt, nexthop, inet->saddr,
+        tmp = ip_route_connect(&rt, nexthop, inet->inet_saddr,
                                RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                                IPPROTO_TCP,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (tmp < 0) {
                 if (tmp == -ENETUNREACH)
                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -183,11 +185,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (!inet->opt || !inet->opt->srr)
                 daddr = rt->rt_dst;
 
-        if (!inet->saddr)
-                inet->saddr = rt->rt_src;
-        inet->rcv_saddr = inet->saddr;
+        if (!inet->inet_saddr)
+                inet->inet_saddr = rt->rt_src;
+        inet->inet_rcv_saddr = inet->inet_saddr;
 
-        if (tp->rx_opt.ts_recent_stamp && inet->daddr != daddr) {
+        if (tp->rx_opt.ts_recent_stamp && inet->inet_daddr != daddr) {
                 /* Reset inherited state */
                 tp->rx_opt.ts_recent       = 0;
                 tp->rx_opt.ts_recent_stamp = 0;
@@ -203,21 +205,23 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                  * TIME-WAIT * and initialize rx_opt.ts_recent from it,
                  * when trying new connection.
                  */
-                if (peer != NULL &&
-                    peer->tcp_ts_stamp + TCP_PAWS_MSL >= get_seconds()) {
-                        tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
-                        tp->rx_opt.ts_recent = peer->tcp_ts;
+                if (peer) {
+                        inet_peer_refcheck(peer);
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
+                                tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
+                                tp->rx_opt.ts_recent = peer->tcp_ts;
+                        }
                 }
         }
 
-        inet->dport = usin->sin_port;
-        inet->daddr = daddr;
+        inet->inet_dport = usin->sin_port;
+        inet->inet_daddr = daddr;
 
         inet_csk(sk)->icsk_ext_hdr_len = 0;
         if (inet->opt)
                 inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
 
-        tp->rx_opt.mss_clamp = 536;
+        tp->rx_opt.mss_clamp = TCP_MSS_DEFAULT;
 
         /* Socket identity is still unknown (sport may be zero).
          * However we set state to SYN-SENT and not releasing socket
@@ -230,21 +234,21 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 goto failure;
 
         err = ip_route_newports(&rt, IPPROTO_TCP,
-                                inet->sport, inet->dport, sk);
+                                inet->inet_sport, inet->inet_dport, sk);
         if (err)
                 goto failure;
 
         /* OK, now commit destination to socket.  */
         sk->sk_gso_type = SKB_GSO_TCPV4;
-        sk_setup_caps(sk, &rt->u.dst);
+        sk_setup_caps(sk, &rt->dst);
 
         if (!tp->write_seq)
-                tp->write_seq = secure_tcp_sequence_number(inet->saddr,
-                                                           inet->daddr,
-                                                           inet->sport,
+                tp->write_seq = secure_tcp_sequence_number(inet->inet_saddr,
+                                                           inet->inet_daddr,
+                                                           inet->inet_sport,
                                                            usin->sin_port);
 
-        inet->id = tp->write_seq ^ jiffies;
+        inet->inet_id = tp->write_seq ^ jiffies;
 
         err = tcp_connect(sk);
         rt = NULL;
@@ -261,9 +265,10 @@ failure:
         tcp_set_state(sk, TCP_CLOSE);
         ip_rt_put(rt);
         sk->sk_route_caps = 0;
-        inet->dport = 0;
+        inet->inet_dport = 0;
         return err;
 }
+EXPORT_SYMBOL(tcp_v4_connect);
 
 /*
  * This routine does path mtu discovery as defined in RFC1191.
@@ -328,26 +333,29 @@ static void do_pmtu_discovery(struct sock *sk, struct iphdr *iph, u32 mtu)
  *
  */
 
-void tcp_v4_err(struct sk_buff *skb, u32 info)
+void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 {
-        struct iphdr *iph = (struct iphdr *)skb->data;
-        struct tcphdr *th = (struct tcphdr *)(skb->data + (iph->ihl << 2));
+        struct iphdr *iph = (struct iphdr *)icmp_skb->data;
+        struct tcphdr *th = (struct tcphdr *)(icmp_skb->data + (iph->ihl << 2));
+        struct inet_connection_sock *icsk;
         struct tcp_sock *tp;
         struct inet_sock *inet;
-        const int type = icmp_hdr(skb)->type;
-        const int code = icmp_hdr(skb)->code;
+        const int type = icmp_hdr(icmp_skb)->type;
+        const int code = icmp_hdr(icmp_skb)->code;
         struct sock *sk;
+        struct sk_buff *skb;
         __u32 seq;
+        __u32 remaining;
         int err;
-        struct net *net = dev_net(skb->dev);
+        struct net *net = dev_net(icmp_skb->dev);
 
-        if (skb->len < (iph->ihl << 2) + 8) {
+        if (icmp_skb->len < (iph->ihl << 2) + 8) {
                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
         }
 
         sk = inet_lookup(net, &tcp_hashinfo, iph->daddr, th->dest,
-                        iph->saddr, th->source, inet_iif(skb));
+                        iph->saddr, th->source, inet_iif(icmp_skb));
         if (!sk) {
                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
@@ -367,6 +375,12 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
+        if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto out;
+        }
+
+        icsk = inet_csk(sk);
         tp = tcp_sk(sk);
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
@@ -393,6 +407,37 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                 }
 
                 err = icmp_err_convert[code].errno;
+                /* check if icmp_skb allows revert of backoff
+                 * (see draft-zimmermann-tcp-lcd) */
+                if (code != ICMP_NET_UNREACH && code != ICMP_HOST_UNREACH)
+                        break;
+                if (seq != tp->snd_una  || !icsk->icsk_retransmits ||
+                    !icsk->icsk_backoff)
+                        break;
+
+                if (sock_owned_by_user(sk))
+                        break;
+
+                icsk->icsk_backoff--;
+                inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
+                                         icsk->icsk_backoff;
+                tcp_bound_rto(sk);
+
+                skb = tcp_write_queue_head(sk);
+                BUG_ON(!skb);
+
+                remaining = icsk->icsk_rto - min(icsk->icsk_rto,
+                                tcp_time_stamp - TCP_SKB_CB(skb)->when);
+
+                if (remaining) {
+                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+                                                  remaining, TCP_RTO_MAX);
+                } else {
+                        /* RTO revert clocked out retransmission.
+                         * Will retransmit now */
+                        tcp_retransmit_timer(sk);
+                }
+
                 break;
         case ICMP_TIME_EXCEEDED:
                 err = EHOSTUNREACH;
@@ -476,25 +521,32 @@ out:
         sock_put(sk);
 }
 
-/* This routine computes an IPv4 TCP checksum. */
-void tcp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb)
+static void __tcp_v4_send_check(struct sk_buff *skb,
+                                __be32 saddr, __be32 daddr)
 {
-        struct inet_sock *inet = inet_sk(sk);
         struct tcphdr *th = tcp_hdr(skb);
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                th->check = ~tcp_v4_check(len, inet->saddr,
-                                          inet->daddr, 0);
+                th->check = ~tcp_v4_check(skb->len, saddr, daddr, 0);
                 skb->csum_start = skb_transport_header(skb) - skb->head;
                 skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
-                th->check = tcp_v4_check(len, inet->saddr, inet->daddr,
+                th->check = tcp_v4_check(skb->len, saddr, daddr,
                                          csum_partial(th,
                                                       th->doff << 2,
                                                       skb->csum));
         }
 }
 
+/* This routine computes an IPv4 TCP checksum. */
+void tcp_v4_send_check(struct sock *sk, struct sk_buff *skb)
+{
+        struct inet_sock *inet = inet_sk(sk);
+
+        __tcp_v4_send_check(skb, inet->inet_saddr, inet->inet_daddr);
+}
+EXPORT_SYMBOL(tcp_v4_send_check);
+
 int tcp_v4_gso_send_check(struct sk_buff *skb)
 {
         const struct iphdr *iph;
@@ -507,10 +559,8 @@ int tcp_v4_gso_send_check(struct sk_buff *skb)
         th = tcp_hdr(skb);
 
         th->check = 0;
-        th->check = ~tcp_v4_check(skb->len, iph->saddr, iph->daddr, 0);
-        skb->csum_start = skb_transport_header(skb) - skb->head;
-        skb->csum_offset = offsetof(struct tcphdr, check);
         skb->ip_summed = CHECKSUM_PARTIAL;
+        __tcp_v4_send_check(skb, iph->saddr, iph->daddr);
         return 0;
 }
 
@@ -704,8 +754,9 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  *      This still operates on a request_sock only, not on a big
  *      socket.
  */
-static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
-                                struct dst_entry *dst)
+static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
+                              struct request_sock *req,
+                              struct request_values *rvp)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         int err = -1;
@@ -715,16 +766,10 @@ static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
         if (!dst && (dst = inet_csk_route_req(sk, req)) == NULL)
                 return -1;
 
-        skb = tcp_make_synack(sk, dst, req);
+        skb = tcp_make_synack(sk, dst, req, rvp);
 
         if (skb) {
-                struct tcphdr *th = tcp_hdr(skb);
-
-                th->check = tcp_v4_check(skb->len,
-                                         ireq->loc_addr,
-                                         ireq->rmt_addr,
-                                         csum_partial(th, skb->len,
-                                                      skb->csum));
+                __tcp_v4_send_check(skb, ireq->loc_addr, ireq->rmt_addr);
 
                 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
                                             ireq->rmt_addr,
@@ -736,9 +781,11 @@ static int __tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
         return err;
 }
 
-static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req)
+static int tcp_v4_rtx_synack(struct sock *sk, struct request_sock *req,
+                              struct request_values *rvp)
 {
-        return __tcp_v4_send_synack(sk, req, NULL);
+        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
+        return tcp_v4_send_synack(sk, NULL, req, rvp);
 }
 
 /*
@@ -749,19 +796,20 @@ static void tcp_v4_reqsk_destructor(struct request_sock *req)
         kfree(inet_rsk(req)->opt);
 }
 
-#ifdef CONFIG_SYN_COOKIES
-static void syn_flood_warning(struct sk_buff *skb)
+static void syn_flood_warning(const struct sk_buff *skb)
 {
-        static unsigned long warntime;
+        const char *msg;
 
-        if (time_after(jiffies, (warntime + HZ * 60))) {
-                warntime = jiffies;
-                printk(KERN_INFO
-                       "possible SYN flooding on port %d. Sending cookies.\n",
-                       ntohs(tcp_hdr(skb)->dest));
-        }
-}
+#ifdef CONFIG_SYN_COOKIES
+        if (sysctl_tcp_syncookies)
+                msg = "Sending cookies";
+        else
 #endif
+                msg = "Dropping request";
+
+        pr_info("TCP: Possible SYN flooding on port %d. %s.\n",
+                                ntohs(tcp_hdr(skb)->dest), msg);
+}
 
 /*
  * Save and compile IPv4 options into the request_sock if needed.
@@ -811,9 +859,8 @@ static struct tcp_md5sig_key *
 struct tcp_md5sig_key *tcp_v4_md5_lookup(struct sock *sk,
                                          struct sock *addr_sk)
 {
-        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->daddr);
+        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->inet_daddr);
 }
-
 EXPORT_SYMBOL(tcp_v4_md5_lookup);
 
 static struct tcp_md5sig_key *tcp_v4_reqsk_md5_lookup(struct sock *sk,
@@ -847,9 +894,9 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                                 kfree(newkey);
                                 return -ENOMEM;
                         }
-                        sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
+                        sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                 }
-                if (tcp_alloc_md5sig_pool() == NULL) {
+                if (tcp_alloc_md5sig_pool(sk) == NULL) {
                         kfree(newkey);
                         return -ENOMEM;
                 }
@@ -880,13 +927,12 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
         }
         return 0;
 }
-
 EXPORT_SYMBOL(tcp_v4_md5_do_add);
 
 static int tcp_v4_md5_add_func(struct sock *sk, struct sock *addr_sk,
                                u8 *newkey, u8 newkeylen)
 {
-        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->daddr,
+        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->inet_daddr,
                                  newkey, newkeylen);
 }
 
@@ -918,7 +964,6 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
         }
         return -ENOENT;
 }
-
 EXPORT_SYMBOL(tcp_v4_md5_do_del);
 
 static void tcp_v4_clear_md5_list(struct sock *sk)
@@ -970,16 +1015,17 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval,
 
         if (!tcp_sk(sk)->md5sig_info) {
                 struct tcp_sock *tp = tcp_sk(sk);
-                struct tcp_md5sig_info *p = kzalloc(sizeof(*p), GFP_KERNEL);
+                struct tcp_md5sig_info *p;
 
+                p = kzalloc(sizeof(*p), sk->sk_allocation);
                 if (!p)
                         return -EINVAL;
 
                 tp->md5sig_info = p;
-                sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
+                sk_nocaps_add(sk, NETIF_F_GSO_MASK);
         }
 
-        newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
+        newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, sk->sk_allocation);
         if (!newkey)
                 return -ENOMEM;
         return tcp_v4_md5_do_add(sk, sin->sin_addr.s_addr,
@@ -1051,8 +1097,8 @@ int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
         __be32 saddr, daddr;
 
         if (sk) {
-                saddr = inet_sk(sk)->saddr;
-                daddr = inet_sk(sk)->daddr;
+                saddr = inet_sk(sk)->inet_saddr;
+                daddr = inet_sk(sk)->inet_daddr;
         } else if (req) {
                 saddr = inet_rsk(req)->loc_addr;
                 daddr = inet_rsk(req)->rmt_addr;
@@ -1090,7 +1136,6 @@ clear_hash_noput:
         memset(md5_hash, 0, 16);
         return 1;
 }
-
 EXPORT_SYMBOL(tcp_v4_md5_hash_skb);
 
 static int tcp_v4_inbound_md5_hash(struct sock *sk, struct sk_buff *skb)
@@ -1151,33 +1196,32 @@ static int tcp_v4_inbound_md5_hash(struct sock *sk, struct sk_buff *skb)
 struct request_sock_ops tcp_request_sock_ops __read_mostly = {
         .family         =       PF_INET,
         .obj_size       =       sizeof(struct tcp_request_sock),
-        .rtx_syn_ack    =       tcp_v4_send_synack,
+        .rtx_syn_ack    =       tcp_v4_rtx_synack,
         .send_ack       =       tcp_v4_reqsk_send_ack,
         .destructor     =       tcp_v4_reqsk_destructor,
         .send_reset     =       tcp_v4_send_reset,
+        .syn_ack_timeout =      tcp_syn_ack_timeout,
 };
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
+static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
         .md5_lookup     =       tcp_v4_reqsk_md5_lookup,
+        .calc_md5_hash  =       tcp_v4_md5_hash_skb,
 };
 #endif
 
-static struct timewait_sock_ops tcp_timewait_sock_ops = {
-        .twsk_obj_size  = sizeof(struct tcp_timewait_sock),
-        .twsk_unique    = tcp_twsk_unique,
-        .twsk_destructor= tcp_twsk_destructor,
-};
-
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 {
-        struct inet_request_sock *ireq;
+        struct tcp_extend_values tmp_ext;
         struct tcp_options_received tmp_opt;
+        u8 *hash_location;
         struct request_sock *req;
+        struct inet_request_sock *ireq;
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct dst_entry *dst = NULL;
         __be32 saddr = ip_hdr(skb)->saddr;
         __be32 daddr = ip_hdr(skb)->daddr;
         __u32 isn = TCP_SKB_CB(skb)->when;
-        struct dst_entry *dst = NULL;
 #ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
 #else
@@ -1193,6 +1237,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
          * evidently real one.
          */
         if (inet_csk_reqsk_queue_is_full(sk) && !isn) {
+                if (net_ratelimit())
+                        syn_flood_warning(skb);
 #ifdef CONFIG_SYN_COOKIES
                 if (sysctl_tcp_syncookies) {
                         want_cookie = 1;
@@ -1218,16 +1264,50 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 #endif
 
         tcp_clear_options(&tmp_opt);
-        tmp_opt.mss_clamp = 536;
-        tmp_opt.user_mss  = tcp_sk(sk)->rx_opt.user_mss;
+        tmp_opt.mss_clamp = TCP_MSS_DEFAULT;
+        tmp_opt.user_mss  = tp->rx_opt.user_mss;
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
+
+        if (tmp_opt.cookie_plus > 0 &&
+            tmp_opt.saw_tstamp &&
+            !tp->rx_opt.cookie_out_never &&
+            (sysctl_tcp_cookie_size > 0 ||
+             (tp->cookie_values != NULL &&
+              tp->cookie_values->cookie_desired > 0))) {
+                u8 *c;
+                u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
+                int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
+
+                if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
+                        goto drop_and_release;
 
-        tcp_parse_options(skb, &tmp_opt, 0);
+                /* Secret recipe starts with IP addresses */
+                *mess++ ^= (__force u32)daddr;
+                *mess++ ^= (__force u32)saddr;
+
+                /* plus variable length Initiator Cookie */
+                c = (u8 *)mess;
+                while (l-- > 0)
+                        *c++ ^= *hash_location++;
+
+#ifdef CONFIG_SYN_COOKIES
+                want_cookie = 0;        /* not our kind of cookie */
+#endif
+                tmp_ext.cookie_out_never = 0; /* false */
+                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
+        } else if (!tp->rx_opt.cookie_in_always) {
+                /* redundant indications, but ensure initialization. */
+                tmp_ext.cookie_out_never = 1; /* true */
+                tmp_ext.cookie_plus = 0;
+        } else {
+                goto drop_and_release;
+        }
+        tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
 
         if (want_cookie && !tmp_opt.saw_tstamp)
                 tcp_clear_options(&tmp_opt);
 
         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
-
         tcp_openreq_init(req, &tmp_opt, skb);
 
         ireq = inet_rsk(req);
@@ -1239,15 +1319,12 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         if (security_inet_conn_request(sk, skb, req))
                 goto drop_and_free;
 
-        if (!want_cookie)
+        if (!want_cookie || tmp_opt.tstamp_ok)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
 
         if (want_cookie) {
-#ifdef CONFIG_SYN_COOKIES
-                syn_flood_warning(skb);
-                req->cookie_ts = tmp_opt.tstamp_ok;
-#endif
                 isn = cookie_v4_init_sequence(sk, skb, &req->mss);
+                req->cookie_ts = tmp_opt.tstamp_ok;
         } else if (!isn) {
                 struct inet_peer *peer = NULL;
 
@@ -1264,8 +1341,9 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                     tcp_death_row.sysctl_tw_recycle &&
                     (dst = inet_csk_route_req(sk, req)) != NULL &&
                     (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
-                    peer->v4daddr == saddr) {
-                        if (get_seconds() < peer->tcp_ts_stamp + TCP_PAWS_MSL &&
+                    peer->daddr.a4 == saddr) {
+                        inet_peer_refcheck(peer);
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
                             (s32)(peer->tcp_ts - req->ts_recent) >
                                                         TCP_PAWS_WINDOW) {
                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
@@ -1294,7 +1372,9 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         }
         tcp_rsk(req)->snt_isn = isn;
 
-        if (__tcp_v4_send_synack(sk, req, dst) || want_cookie)
+        if (tcp_v4_send_synack(sk, dst, req,
+                               (struct request_values *)&tmp_ext) ||
+            want_cookie)
                 goto drop_and_free;
 
         inet_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
@@ -1307,6 +1387,7 @@ drop_and_free:
 drop:
         return 0;
 }
+EXPORT_SYMBOL(tcp_v4_conn_request);
 
 
 /*
@@ -1333,7 +1414,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         newsk = tcp_create_openreq_child(sk, req, skb);
         if (!newsk)
-                goto exit;
+                goto exit_nonewsk;
 
         newsk->sk_gso_type = SKB_GSO_TCPV4;
         sk_setup_caps(newsk, dst);
@@ -1341,9 +1422,9 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newtp                 = tcp_sk(newsk);
         newinet               = inet_sk(newsk);
         ireq                  = inet_rsk(req);
-        newinet->daddr        = ireq->rmt_addr;
-        newinet->rcv_saddr    = ireq->loc_addr;
-        newinet->saddr        = ireq->loc_addr;
+        newinet->inet_daddr   = ireq->rmt_addr;
+        newinet->inet_rcv_saddr = ireq->loc_addr;
+        newinet->inet_saddr           = ireq->loc_addr;
         newinet->opt          = ireq->opt;
         ireq->opt             = NULL;
         newinet->mc_index     = inet_iif(skb);
@@ -1351,11 +1432,11 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
         if (newinet->opt)
                 inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;
-        newinet->id = newtp->write_seq ^ jiffies;
+        newinet->inet_id = newtp->write_seq ^ jiffies;
 
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
-        newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
+        newtp->advmss = dst_metric_advmss(dst);
         if (tcp_sk(sk)->rx_opt.user_mss &&
             tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
                 newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
@@ -1364,7 +1445,8 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
-        if ((key = tcp_v4_md5_do_lookup(sk, newinet->daddr)) != NULL) {
+        key = tcp_v4_md5_do_lookup(sk, newinet->inet_daddr);
+        if (key != NULL) {
                 /*
                  * We're using one, so create a matching key
                  * on the newsk structure. If we fail to get
@@ -1373,24 +1455,29 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v4_md5_do_add(newsk, inet_sk(sk)->daddr,
+                        tcp_v4_md5_do_add(newsk, newinet->inet_daddr,
                                           newkey, key->keylen);
-                newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;
+                sk_nocaps_add(newsk, NETIF_F_GSO_MASK);
         }
 #endif
 
-        __inet_hash_nolisten(newsk);
-        __inet_inherit_port(sk, newsk);
+        if (__inet_inherit_port(sk, newsk) < 0) {
+                sock_put(newsk);
+                goto exit;
+        }
+        __inet_hash_nolisten(newsk, NULL);
 
         return newsk;
 
 exit_overflow:
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
+exit_nonewsk:
+        dst_release(dst);
 exit:
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
-        dst_release(dst);
         return NULL;
 }
+EXPORT_SYMBOL(tcp_v4_syn_recv_sock);
 
 static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
 {
@@ -1417,7 +1504,7 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
         }
 
 #ifdef CONFIG_SYN_COOKIES
-        if (!th->rst && !th->syn && th->ack)
+        if (!th->syn)
                 sk = cookie_v4_check(sk, skb, &(IPCB(skb)->opt));
 #endif
         return sk;
@@ -1468,6 +1555,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
 #endif
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+                sock_rps_save_rxhash(sk, skb->rxhash);
                 TCP_CHECK_TIMER(sk);
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
                         rsk = sk;
@@ -1492,7 +1580,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                         }
                         return 0;
                 }
-        }
+        } else
+                sock_rps_save_rxhash(sk, skb->rxhash);
+
 
         TCP_CHECK_TIMER(sk);
         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len)) {
@@ -1517,6 +1607,7 @@ csum_err:
         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
         goto discard;
 }
+EXPORT_SYMBOL(tcp_v4_do_rcv);
 
 /*
  *      From tcp_input.c
@@ -1571,6 +1662,11 @@ process:
         if (sk->sk_state == TCP_TIME_WAIT)
                 goto do_time_wait;
 
+        if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto discard_and_relse;
+        }
+
         if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
         nf_reset(skb);
@@ -1595,8 +1691,11 @@ process:
                         if (!tcp_prequeue(sk, skb))
                                 ret = tcp_v4_do_rcv(sk, skb);
                 }
-        } else
-                sk_add_backlog(sk, skb);
+        } else if (unlikely(sk_add_backlog(sk, skb))) {
+                bh_unlock_sock(sk);
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
+                goto discard_and_relse;
+        }
         bh_unlock_sock(sk);
 
         sock_put(sk);
@@ -1658,71 +1757,48 @@ do_time_wait:
         goto discard_it;
 }
 
-/* VJ's idea. Save last timestamp seen from this destination
- * and hold it at least for normal timewait interval to use for duplicate
- * segment detection in subsequent connections, before they enter synchronized
- * state.
- */
-
-int tcp_v4_remember_stamp(struct sock *sk)
+struct inet_peer *tcp_v4_get_peer(struct sock *sk, bool *release_it)
 {
+        struct rtable *rt = (struct rtable *) __sk_dst_get(sk);
         struct inet_sock *inet = inet_sk(sk);
-        struct tcp_sock *tp = tcp_sk(sk);
-        struct rtable *rt = (struct rtable *)__sk_dst_get(sk);
-        struct inet_peer *peer = NULL;
-        int release_it = 0;
+        struct inet_peer *peer;
 
-        if (!rt || rt->rt_dst != inet->daddr) {
-                peer = inet_getpeer(inet->daddr, 1);
-                release_it = 1;
+        if (!rt || rt->rt_dst != inet->inet_daddr) {
+                peer = inet_getpeer_v4(inet->inet_daddr, 1);
+                *release_it = true;
         } else {
                 if (!rt->peer)
                         rt_bind_peer(rt, 1);
                 peer = rt->peer;
+                *release_it = false;
         }
 
-        if (peer) {
-                if ((s32)(peer->tcp_ts - tp->rx_opt.ts_recent) <= 0 ||
-                    (peer->tcp_ts_stamp + TCP_PAWS_MSL < get_seconds() &&
-                     peer->tcp_ts_stamp <= tp->rx_opt.ts_recent_stamp)) {
-                        peer->tcp_ts_stamp = tp->rx_opt.ts_recent_stamp;
-                        peer->tcp_ts = tp->rx_opt.ts_recent;
-                }
-                if (release_it)
-                        inet_putpeer(peer);
-                return 1;
-        }
-
-        return 0;
+        return peer;
 }
+EXPORT_SYMBOL(tcp_v4_get_peer);
 
-int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
+void *tcp_v4_tw_get_peer(struct sock *sk)
 {
-        struct inet_peer *peer = inet_getpeer(tw->tw_daddr, 1);
-
-        if (peer) {
-                const struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
-
-                if ((s32)(peer->tcp_ts - tcptw->tw_ts_recent) <= 0 ||
-                    (peer->tcp_ts_stamp + TCP_PAWS_MSL < get_seconds() &&
-                     peer->tcp_ts_stamp <= tcptw->tw_ts_recent_stamp)) {
-                        peer->tcp_ts_stamp = tcptw->tw_ts_recent_stamp;
-                        peer->tcp_ts       = tcptw->tw_ts_recent;
-                }
-                inet_putpeer(peer);
-                return 1;
-        }
+        struct inet_timewait_sock *tw = inet_twsk(sk);
 
-        return 0;
+        return inet_getpeer_v4(tw->tw_daddr, 1);
 }
+EXPORT_SYMBOL(tcp_v4_tw_get_peer);
 
-struct inet_connection_sock_af_ops ipv4_specific = {
+static struct timewait_sock_ops tcp_timewait_sock_ops = {
+        .twsk_obj_size  = sizeof(struct tcp_timewait_sock),
+        .twsk_unique    = tcp_twsk_unique,
+        .twsk_destructor= tcp_twsk_destructor,
+        .twsk_getpeer   = tcp_v4_tw_get_peer,
+};
+
+const struct inet_connection_sock_af_ops ipv4_specific = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
         .conn_request      = tcp_v4_conn_request,
         .syn_recv_sock     = tcp_v4_syn_recv_sock,
-        .remember_stamp    = tcp_v4_remember_stamp,
+        .get_peer          = tcp_v4_get_peer,
         .net_header_len    = sizeof(struct iphdr),
         .setsockopt        = ip_setsockopt,
         .getsockopt        = ip_getsockopt,
@@ -1734,9 +1810,10 @@ struct inet_connection_sock_af_ops ipv4_specific = {
         .compat_getsockopt = compat_ip_getsockopt,
 #endif
 };
+EXPORT_SYMBOL(ipv4_specific);
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
+static const struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
         .md5_lookup             = tcp_v4_md5_lookup,
         .calc_md5_hash          = tcp_v4_md5_hash_skb,
         .md5_add                = tcp_v4_md5_add_func,
@@ -1769,9 +1846,9 @@ static int tcp_v4_init_sock(struct sock *sk)
         /* See draft-stevens-tcpca-spec-01 for discussion of the
          * initialization of these values.
          */
-        tp->snd_ssthresh = 0x7fffffff;  /* Infinity */
+        tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache = 536;
+        tp->mss_cache = TCP_MSS_DEFAULT;
 
         tp->reordering = sysctl_tcp_reordering;
         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
@@ -1787,6 +1864,19 @@ static int tcp_v4_init_sock(struct sock *sk)
         tp->af_specific = &tcp_sock_ipv4_specific;
 #endif
 
+        /* TCP Cookie Transactions */
+        if (sysctl_tcp_cookie_size > 0) {
+                /* Default, cookies without s_data_payload. */
+                tp->cookie_values =
+                        kzalloc(sizeof(*tp->cookie_values),
+                                sk->sk_allocation);
+                if (tp->cookie_values != NULL)
+                        kref_init(&tp->cookie_values->kref);
+        }
+        /* Presumed zeroed, in order of appearance:
+         *      cookie_in_always, cookie_out_never,
+         *      s_data_constant, s_data_in, s_data_out
+         */
         sk->sk_sndbuf = sysctl_tcp_wmem[1];
         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
 
@@ -1840,9 +1930,15 @@ void tcp_v4_destroy_sock(struct sock *sk)
                 sk->sk_sndmsg_page = NULL;
         }
 
+        /* TCP Cookie Transactions */
+        if (tp->cookie_values != NULL) {
+                kref_put(&tp->cookie_values->kref,
+                         tcp_cookie_values_release);
+                tp->cookie_values = NULL;
+        }
+
         percpu_counter_dec(&tcp_sockets_allocated);
 }
-
 EXPORT_SYMBOL(tcp_v4_destroy_sock);
 
 #ifdef CONFIG_PROC_FS
@@ -1860,6 +1956,11 @@ static inline struct inet_timewait_sock *tw_next(struct inet_timewait_sock *tw)
                 hlist_nulls_entry(tw->tw_node.next, typeof(*tw), tw_node) : NULL;
 }
 
+/*
+ * Get next listener socket follow cur.  If cur is NULL, get first socket
+ * starting from bucket given in st->bucket; when st->bucket is zero the
+ * very first socket in the hash table is returned.
+ */
 static void *listening_get_next(struct seq_file *seq, void *cur)
 {
         struct inet_connection_sock *icsk;
@@ -1870,14 +1971,15 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
         struct net *net = seq_file_net(seq);
 
         if (!sk) {
-                st->bucket = 0;
-                ilb = &tcp_hashinfo.listening_hash[0];
+                ilb = &tcp_hashinfo.listening_hash[st->bucket];
                 spin_lock_bh(&ilb->lock);
                 sk = sk_nulls_head(&ilb->head);
+                st->offset = 0;
                 goto get_sk;
         }
         ilb = &tcp_hashinfo.listening_hash[st->bucket];
         ++st->num;
+        ++st->offset;
 
         if (st->state == TCP_SEQ_STATE_OPENREQ) {
                 struct request_sock *req = cur;
@@ -1892,12 +1994,13 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
                                 }
                                 req = req->dl_next;
                         }
+                        st->offset = 0;
                         if (++st->sbucket >= icsk->icsk_accept_queue.listen_opt->nr_table_entries)
                                 break;
 get_req:
                         req = icsk->icsk_accept_queue.listen_opt->syn_table[st->sbucket];
                 }
-                sk        = sk_next(st->syn_wait_sk);
+                sk        = sk_nulls_next(st->syn_wait_sk);
                 st->state = TCP_SEQ_STATE_LISTENING;
                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
         } else {
@@ -1906,11 +2009,13 @@ get_req:
                 if (reqsk_queue_len(&icsk->icsk_accept_queue))
                         goto start_req;
                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
-                sk = sk_next(sk);
+                sk = sk_nulls_next(sk);
         }
 get_sk:
         sk_nulls_for_each_from(sk, node) {
-                if (sk->sk_family == st->family && net_eq(sock_net(sk), net)) {
+                if (!net_eq(sock_net(sk), net))
+                        continue;
+                if (sk->sk_family == st->family) {
                         cur = sk;
                         goto out;
                 }
@@ -1927,6 +2032,7 @@ start_req:
                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
         }
         spin_unlock_bh(&ilb->lock);
+        st->offset = 0;
         if (++st->bucket < INET_LHTABLE_SIZE) {
                 ilb = &tcp_hashinfo.listening_hash[st->bucket];
                 spin_lock_bh(&ilb->lock);
@@ -1940,7 +2046,12 @@ out:
 
 static void *listening_get_idx(struct seq_file *seq, loff_t *pos)
 {
-        void *rc = listening_get_next(seq, NULL);
+        struct tcp_iter_state *st = seq->private;
+        void *rc;
+
+        st->bucket = 0;
+        st->offset = 0;
+        rc = listening_get_next(seq, NULL);
 
         while (rc && *pos) {
                 rc = listening_get_next(seq, rc);
@@ -1955,13 +2066,18 @@ static inline int empty_bucket(struct tcp_iter_state *st)
                 hlist_nulls_empty(&tcp_hashinfo.ehash[st->bucket].twchain);
 }
 
+/*
+ * Get first established socket starting from bucket given in st->bucket.
+ * If st->bucket is zero, the very first socket in the hash is returned.
+ */
 static void *established_get_first(struct seq_file *seq)
 {
         struct tcp_iter_state *st = seq->private;
         struct net *net = seq_file_net(seq);
         void *rc = NULL;
 
-        for (st->bucket = 0; st->bucket < tcp_hashinfo.ehash_size; ++st->bucket) {
+        st->offset = 0;
+        for (; st->bucket <= tcp_hashinfo.ehash_mask; ++st->bucket) {
                 struct sock *sk;
                 struct hlist_nulls_node *node;
                 struct inet_timewait_sock *tw;
@@ -2006,6 +2122,7 @@ static void *established_get_next(struct seq_file *seq, void *cur)
         struct net *net = seq_file_net(seq);
 
         ++st->num;
+        ++st->offset;
 
         if (st->state == TCP_SEQ_STATE_TIME_WAIT) {
                 tw = cur;
@@ -2022,10 +2139,11 @@ get_tw:
                 st->state = TCP_SEQ_STATE_ESTABLISHED;
 
                 /* Look for next non empty bucket */
-                while (++st->bucket < tcp_hashinfo.ehash_size &&
+                st->offset = 0;
+                while (++st->bucket <= tcp_hashinfo.ehash_mask &&
                                 empty_bucket(st))
                         ;
-                if (st->bucket >= tcp_hashinfo.ehash_size)
+                if (st->bucket > tcp_hashinfo.ehash_mask)
                         return NULL;
 
                 spin_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
@@ -2049,7 +2167,11 @@ out:
 
 static void *established_get_idx(struct seq_file *seq, loff_t pos)
 {
-        void *rc = established_get_first(seq);
+        struct tcp_iter_state *st = seq->private;
+        void *rc;
+
+        st->bucket = 0;
+        rc = established_get_first(seq);
 
         while (rc && pos) {
                 rc = established_get_next(seq, rc);
@@ -2074,24 +2196,72 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos)
         return rc;
 }
 
+static void *tcp_seek_last_pos(struct seq_file *seq)
+{
+        struct tcp_iter_state *st = seq->private;
+        int offset = st->offset;
+        int orig_num = st->num;
+        void *rc = NULL;
+
+        switch (st->state) {
+        case TCP_SEQ_STATE_OPENREQ:
+        case TCP_SEQ_STATE_LISTENING:
+                if (st->bucket >= INET_LHTABLE_SIZE)
+                        break;
+                st->state = TCP_SEQ_STATE_LISTENING;
+                rc = listening_get_next(seq, NULL);
+                while (offset-- && rc)
+                        rc = listening_get_next(seq, rc);
+                if (rc)
+                        break;
+                st->bucket = 0;
+                /* Fallthrough */
+        case TCP_SEQ_STATE_ESTABLISHED:
+        case TCP_SEQ_STATE_TIME_WAIT:
+                st->state = TCP_SEQ_STATE_ESTABLISHED;
+                if (st->bucket > tcp_hashinfo.ehash_mask)
+                        break;
+                rc = established_get_first(seq);
+                while (offset-- && rc)
+                        rc = established_get_next(seq, rc);
+        }
+
+        st->num = orig_num;
+
+        return rc;
+}
+
 static void *tcp_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct tcp_iter_state *st = seq->private;
+        void *rc;
+
+        if (*pos && *pos == st->last_pos) {
+                rc = tcp_seek_last_pos(seq);
+                if (rc)
+                        goto out;
+        }
+
         st->state = TCP_SEQ_STATE_LISTENING;
         st->num = 0;
-        return *pos ? tcp_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
+        st->bucket = 0;
+        st->offset = 0;
+        rc = *pos ? tcp_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
+
+out:
+        st->last_pos = *pos;
+        return rc;
 }
 
 static void *tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
+        struct tcp_iter_state *st = seq->private;
         void *rc = NULL;
-        struct tcp_iter_state *st;
 
         if (v == SEQ_START_TOKEN) {
                 rc = tcp_get_idx(seq, 0);
                 goto out;
         }
-        st = seq->private;
 
         switch (st->state) {
         case TCP_SEQ_STATE_OPENREQ:
@@ -2099,6 +2269,8 @@ static void *tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                 rc = listening_get_next(seq, v);
                 if (!rc) {
                         st->state = TCP_SEQ_STATE_ESTABLISHED;
+                        st->bucket = 0;
+                        st->offset = 0;
                         rc        = established_get_first(seq);
                 }
                 break;
@@ -2109,6 +2281,7 @@ static void *tcp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
         }
 out:
         ++*pos;
+        st->last_pos = *pos;
         return rc;
 }
 
@@ -2147,6 +2320,7 @@ static int tcp_seq_open(struct inode *inode, struct file *file)
 
         s = ((struct seq_file *)file->private_data)->private;
         s->family               = afinfo->family;
+        s->last_pos             = 0;
         return 0;
 }
 
@@ -2170,11 +2344,13 @@ int tcp_proc_register(struct net *net, struct tcp_seq_afinfo *afinfo)
                 rc = -ENOMEM;
         return rc;
 }
+EXPORT_SYMBOL(tcp_proc_register);
 
 void tcp_proc_unregister(struct net *net, struct tcp_seq_afinfo *afinfo)
 {
         proc_net_remove(net, afinfo->name);
 }
+EXPORT_SYMBOL(tcp_proc_unregister);
 
 static void get_openreq4(struct sock *sk, struct request_sock *req,
                          struct seq_file *f, int i, int uid, int *len)
@@ -2186,7 +2362,7 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p%n",
                 i,
                 ireq->loc_addr,
-                ntohs(inet_sk(sk)->sport),
+                ntohs(inet_sk(sk)->inet_sport),
                 ireq->rmt_addr,
                 ntohs(ireq->rmt_port),
                 TCP_SYN_RECV,
@@ -2209,10 +2385,11 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct inet_sock *inet = inet_sk(sk);
-        __be32 dest = inet->daddr;
-        __be32 src = inet->rcv_saddr;
-        __u16 destp = ntohs(inet->dport);
-        __u16 srcp = ntohs(inet->sport);
+        __be32 dest = inet->inet_daddr;
+        __be32 src = inet->inet_rcv_saddr;
+        __u16 destp = ntohs(inet->inet_dport);
+        __u16 srcp = ntohs(inet->inet_sport);
+        int rx_queue;
 
         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
                 timer_active    = 1;
@@ -2228,12 +2405,19 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                 timer_expires = jiffies;
         }
 
+        if (sk->sk_state == TCP_LISTEN)
+                rx_queue = sk->sk_ack_backlog;
+        else
+                /*
+                 * because we dont lock socket, we might find a transient negative value
+                 */
+                rx_queue = max_t(int, tp->rcv_nxt - tp->copied_seq, 0);
+
         seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
                         "%08X %5d %8d %lu %d %p %lu %lu %u %u %d%n",
                 i, src, srcp, dest, destp, sk->sk_state,
                 tp->write_seq - tp->snd_una,
-                sk->sk_state == TCP_LISTEN ? sk->sk_ack_backlog :
-                                             (tp->rcv_nxt - tp->copied_seq),
+                rx_queue,
                 timer_active,
                 jiffies_to_clock_t(timer_expires - jiffies),
                 icsk->icsk_retransmits,
@@ -2245,7 +2429,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
                 jiffies_to_clock_t(icsk->icsk_ack.ato),
                 (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
                 tp->snd_cwnd,
-                tp->snd_ssthresh >= 0xFFFF ? -1 : tp->snd_ssthresh,
+                tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh,
                 len);
 }
 
@@ -2315,12 +2499,12 @@ static struct tcp_seq_afinfo tcp4_seq_afinfo = {
         },
 };
 
-static int tcp4_proc_init_net(struct net *net)
+static int __net_init tcp4_proc_init_net(struct net *net)
 {
         return tcp_proc_register(net, &tcp4_seq_afinfo);
 }
 
-static void tcp4_proc_exit_net(struct net *net)
+static void __net_exit tcp4_proc_exit_net(struct net *net)
 {
         tcp_proc_unregister(net, &tcp4_seq_afinfo);
 }
@@ -2361,7 +2545,6 @@ struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
         return tcp_gro_receive(head, skb);
 }
-EXPORT_SYMBOL(tcp4_gro_receive);
 
 int tcp4_gro_complete(struct sk_buff *skb)
 {
@@ -2374,7 +2557,6 @@ int tcp4_gro_complete(struct sk_buff *skb)
 
         return tcp_gro_complete(skb);
 }
-EXPORT_SYMBOL(tcp4_gro_complete);
 
 struct proto tcp_prot = {
         .name                   = "TCP",
@@ -2390,6 +2572,8 @@ struct proto tcp_prot = {
         .setsockopt             = tcp_setsockopt,
         .getsockopt             = tcp_getsockopt,
         .recvmsg                = tcp_recvmsg,
+        .sendmsg                = tcp_sendmsg,
+        .sendpage               = tcp_sendpage,
         .backlog_rcv            = tcp_v4_do_rcv,
         .hash                   = inet_hash,
         .unhash                 = inet_unhash,
@@ -2408,11 +2592,13 @@ struct proto tcp_prot = {
         .twsk_prot              = &tcp_timewait_sock_ops,
         .rsk_prot               = &tcp_request_sock_ops,
         .h.hashinfo             = &tcp_hashinfo,
+        .no_autobind            = true,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt      = compat_tcp_setsockopt,
         .compat_getsockopt      = compat_tcp_getsockopt,
 #endif
 };
+EXPORT_SYMBOL(tcp_prot);
 
 
 static int __net_init tcp_sk_init(struct net *net)
@@ -2424,12 +2610,17 @@ static int __net_init tcp_sk_init(struct net *net)
 static void __net_exit tcp_sk_exit(struct net *net)
 {
         inet_ctl_sock_destroy(net->ipv4.tcp_sock);
-        inet_twsk_purge(net, &tcp_hashinfo, &tcp_death_row, AF_INET);
+}
+
+static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
+{
+        inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET);
 }
 
 static struct pernet_operations __net_initdata tcp_sk_ops = {
-       .init = tcp_sk_init,
-       .exit = tcp_sk_exit,
+       .init       = tcp_sk_init,
+       .exit       = tcp_sk_exit,
+       .exit_batch = tcp_sk_exit_batch,
 };
 
 void __init tcp_v4_init(void)
@@ -2438,20 +2629,3 @@ void __init tcp_v4_init(void)
         if (register_pernet_subsys(&tcp_sk_ops))
                 panic("Failed to create the TCP control socket.\n");
 }
-
-EXPORT_SYMBOL(ipv4_specific);
-EXPORT_SYMBOL(tcp_hashinfo);
-EXPORT_SYMBOL(tcp_prot);
-EXPORT_SYMBOL(tcp_v4_conn_request);
-EXPORT_SYMBOL(tcp_v4_connect);
-EXPORT_SYMBOL(tcp_v4_do_rcv);
-EXPORT_SYMBOL(tcp_v4_remember_stamp);
-EXPORT_SYMBOL(tcp_v4_send_check);
-EXPORT_SYMBOL(tcp_v4_syn_recv_sock);
-
-#ifdef CONFIG_PROC_FS
-EXPORT_SYMBOL(tcp_proc_register);
-EXPORT_SYMBOL(tcp_proc_unregister);
-#endif
-EXPORT_SYMBOL(sysctl_tcp_low_latency);
-
diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
index ce3c41ff50b2..de870377fbba 100644
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -143,8 +143,8 @@ static u32 tcp_lp_remote_hz_estimator(struct sock *sk)
                 goto out;
 
         /* we can't calc remote HZ with no different!! */
-        if (tp->rx_opt.rcv_tsval == lp->remote_ref_time
-            || tp->rx_opt.rcv_tsecr == lp->local_ref_time)
+        if (tp->rx_opt.rcv_tsval == lp->remote_ref_time ||
+            tp->rx_opt.rcv_tsecr == lp->local_ref_time)
                 goto out;
 
         m = HZ * (tp->rx_opt.rcv_tsval -
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 43bbba7926ee..80b1f80759ab 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -20,19 +20,14 @@
 
 #include <linux/mm.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/workqueue.h>
 #include <net/tcp.h>
 #include <net/inet_common.h>
 #include <net/xfrm.h>
 
-#ifdef CONFIG_SYSCTL
-#define SYNC_INIT 0 /* let the user enable it */
-#else
-#define SYNC_INIT 1
-#endif
-
-int sysctl_tcp_syncookies __read_mostly = SYNC_INIT;
+int sysctl_tcp_syncookies __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_syncookies);
 
 int sysctl_tcp_abort_on_overflow __read_mostly;
@@ -52,16 +47,65 @@ struct inet_timewait_death_row tcp_death_row = {
         .twcal_timer    = TIMER_INITIALIZER(inet_twdr_twcal_tick, 0,
                                             (unsigned long)&tcp_death_row),
 };
-
 EXPORT_SYMBOL_GPL(tcp_death_row);
 
+/* VJ's idea. Save last timestamp seen from this destination
+ * and hold it at least for normal timewait interval to use for duplicate
+ * segment detection in subsequent connections, before they enter synchronized
+ * state.
+ */
+
+static int tcp_remember_stamp(struct sock *sk)
+{
+        const struct inet_connection_sock *icsk = inet_csk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct inet_peer *peer;
+        bool release_it;
+
+        peer = icsk->icsk_af_ops->get_peer(sk, &release_it);
+        if (peer) {
+                if ((s32)(peer->tcp_ts - tp->rx_opt.ts_recent) <= 0 ||
+                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
+                     peer->tcp_ts_stamp <= (u32)tp->rx_opt.ts_recent_stamp)) {
+                        peer->tcp_ts_stamp = (u32)tp->rx_opt.ts_recent_stamp;
+                        peer->tcp_ts = tp->rx_opt.ts_recent;
+                }
+                if (release_it)
+                        inet_putpeer(peer);
+                return 1;
+        }
+
+        return 0;
+}
+
+static int tcp_tw_remember_stamp(struct inet_timewait_sock *tw)
+{
+        struct sock *sk = (struct sock *) tw;
+        struct inet_peer *peer;
+
+        peer = twsk_getpeer(sk);
+        if (peer) {
+                const struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
+
+                if ((s32)(peer->tcp_ts - tcptw->tw_ts_recent) <= 0 ||
+                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
+                     peer->tcp_ts_stamp <= (u32)tcptw->tw_ts_recent_stamp)) {
+                        peer->tcp_ts_stamp = (u32)tcptw->tw_ts_recent_stamp;
+                        peer->tcp_ts       = tcptw->tw_ts_recent;
+                }
+                inet_putpeer(peer);
+                return 1;
+        }
+        return 0;
+}
+
 static __inline__ int tcp_in_window(u32 seq, u32 end_seq, u32 s_win, u32 e_win)
 {
         if (seq == s_win)
                 return 1;
         if (after(end_seq, s_win) && before(seq, e_win))
                 return 1;
-        return (seq == e_win && seq == end_seq);
+        return seq == e_win && seq == end_seq;
 }
 
 /*
@@ -96,13 +140,14 @@ enum tcp_tw_status
 tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
                            const struct tcphdr *th)
 {
-        struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
         struct tcp_options_received tmp_opt;
+        u8 *hash_location;
+        struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
         int paws_reject = 0;
 
         tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
-                tcp_parse_options(skb, &tmp_opt, 0);
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
@@ -128,7 +173,8 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
                         goto kill_with_rst;
 
                 /* Dup ACK? */
-                if (!after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
+                if (!th->ack ||
+                    !after(TCP_SKB_CB(skb)->end_seq, tcptw->tw_rcv_nxt) ||
                     TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
                         inet_twsk_put(tw);
                         return TCP_TW_SUCCESS;
@@ -153,14 +199,9 @@ kill_with_rst:
                         tcptw->tw_ts_recent       = tmp_opt.rcv_tsval;
                 }
 
-                /* I am shamed, but failed to make it more elegant.
-                 * Yes, it is direct reference to IP, which is impossible
-                 * to generalize to IPv6. Taking into account that IPv6
-                 * do not understand recycling in any case, it not
-                 * a big problem in practice. --ANK */
-                if (tw->tw_family == AF_INET &&
-                    tcp_death_row.sysctl_tw_recycle && tcptw->tw_ts_recent_stamp &&
-                    tcp_v4_tw_remember_stamp(tw))
+                if (tcp_death_row.sysctl_tw_recycle &&
+                    tcptw->tw_ts_recent_stamp &&
+                    tcp_tw_remember_stamp(tw))
                         inet_twsk_schedule(tw, &tcp_death_row, tw->tw_timeout,
                                            TCP_TIMEWAIT_LEN);
                 else
@@ -265,6 +306,7 @@ kill:
         inet_twsk_put(tw);
         return TCP_TW_SUCCESS;
 }
+EXPORT_SYMBOL(tcp_timewait_state_process);
 
 /*
  * Move a socket to time-wait or dead fin-wait-2 state.
@@ -277,7 +319,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
         int recycle_ok = 0;
 
         if (tcp_death_row.sysctl_tw_recycle && tp->rx_opt.ts_recent_stamp)
-                recycle_ok = icsk->icsk_af_ops->remember_stamp(sk);
+                recycle_ok = tcp_remember_stamp(sk);
 
         if (tcp_death_row.tw_count < tcp_death_row.sysctl_max_tw_buckets)
                 tw = inet_twsk_alloc(sk, state);
@@ -321,7 +363,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                         if (key != NULL) {
                                 memcpy(&tcptw->tw_md5_key, key->key, key->keylen);
                                 tcptw->tw_md5_keylen = key->keylen;
-                                if (tcp_alloc_md5sig_pool() == NULL)
+                                if (tcp_alloc_md5sig_pool(sk) == NULL)
                                         BUG();
                         }
                 } while (0);
@@ -350,7 +392,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                  * socket up.  We've got bigger problems than
                  * non-graceful socket closings.
                  */
-                LIMIT_NETDEBUG(KERN_INFO "TCP: time wait bucket table overflow\n");
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEWAITOVERFLOW);
         }
 
         tcp_update_metrics(sk);
@@ -362,10 +404,9 @@ void tcp_twsk_destructor(struct sock *sk)
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_timewait_sock *twsk = tcp_twsk(sk);
         if (twsk->tw_md5_keylen)
-                tcp_put_md5sig_pool();
+                tcp_free_md5sig_pool();
 #endif
 }
-
 EXPORT_SYMBOL_GPL(tcp_twsk_destructor);
 
 static inline void TCP_ECN_openreq_child(struct tcp_sock *tp,
@@ -388,14 +429,43 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 const struct inet_request_sock *ireq = inet_rsk(req);
                 struct tcp_request_sock *treq = tcp_rsk(req);
                 struct inet_connection_sock *newicsk = inet_csk(newsk);
-                struct tcp_sock *newtp;
+                struct tcp_sock *newtp = tcp_sk(newsk);
+                struct tcp_sock *oldtp = tcp_sk(sk);
+                struct tcp_cookie_values *oldcvp = oldtp->cookie_values;
+
+                /* TCP Cookie Transactions require space for the cookie pair,
+                 * as it differs for each connection.  There is no need to
+                 * copy any s_data_payload stored at the original socket.
+                 * Failure will prevent resuming the connection.
+                 *
+                 * Presumed copied, in order of appearance:
+                 *      cookie_in_always, cookie_out_never
+                 */
+                if (oldcvp != NULL) {
+                        struct tcp_cookie_values *newcvp =
+                                kzalloc(sizeof(*newtp->cookie_values),
+                                        GFP_ATOMIC);
+
+                        if (newcvp != NULL) {
+                                kref_init(&newcvp->kref);
+                                newcvp->cookie_desired =
+                                                oldcvp->cookie_desired;
+                                newtp->cookie_values = newcvp;
+                        } else {
+                                /* Not Yet Implemented */
+                                newtp->cookie_values = NULL;
+                        }
+                }
 
                 /* Now setup tcp_sock */
-                newtp = tcp_sk(newsk);
                 newtp->pred_flags = 0;
-                newtp->rcv_wup = newtp->copied_seq = newtp->rcv_nxt = treq->rcv_isn + 1;
-                newtp->snd_sml = newtp->snd_una = newtp->snd_nxt = treq->snt_isn + 1;
-                newtp->snd_up = treq->snt_isn + 1;
+
+                newtp->rcv_wup = newtp->copied_seq =
+                newtp->rcv_nxt = treq->rcv_isn + 1;
+
+                newtp->snd_sml = newtp->snd_una =
+                newtp->snd_nxt = newtp->snd_up =
+                        treq->snt_isn + 1 + tcp_s_data_size(oldtp);
 
                 tcp_prequeue_init(newtp);
 
@@ -409,7 +479,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 newtp->retrans_out = 0;
                 newtp->sacked_out = 0;
                 newtp->fackets_out = 0;
-                newtp->snd_ssthresh = 0x7fffffff;
+                newtp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
 
                 /* So many TCP implementations out there (incorrectly) count the
                  * initial SYN frame in their delayed-ACK and congestion control
@@ -428,8 +498,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 tcp_set_ca_state(newsk, TCP_CA_Open);
                 tcp_init_xmit_timers(newsk);
                 skb_queue_head_init(&newtp->out_of_order_queue);
-                newtp->write_seq = treq->snt_isn + 1;
-                newtp->pushed_seq = newtp->write_seq;
+                newtp->write_seq = newtp->pushed_seq =
+                        treq->snt_isn + 1 + tcp_s_data_size(oldtp);
 
                 newtp->rx_opt.saw_tstamp = 0;
 
@@ -475,7 +545,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 if (newtp->af_specific->md5_lookup(sk, newsk))
                         newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
 #endif
-                if (skb->len >= TCP_MIN_RCVMSS+newtp->tcp_header_len)
+                if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
                         newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
                 newtp->rx_opt.mss_clamp = req->mss;
                 TCP_ECN_openreq_child(newtp, req);
@@ -484,6 +554,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
         }
         return newsk;
 }
+EXPORT_SYMBOL(tcp_create_openreq_child);
 
 /*
  *      Process an incoming packet for SYN_RECV sockets represented
@@ -494,15 +565,16 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                            struct request_sock *req,
                            struct request_sock **prev)
 {
+        struct tcp_options_received tmp_opt;
+        u8 *hash_location;
+        struct sock *child;
         const struct tcphdr *th = tcp_hdr(skb);
         __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
         int paws_reject = 0;
-        struct tcp_options_received tmp_opt;
-        struct sock *child;
 
         tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(struct tcphdr)>>2)) {
-                tcp_parse_options(skb, &tmp_opt, 0);
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent = req->ts_recent;
@@ -536,7 +608,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                  * Enforce "SYN-ACK" according to figure 8, figure 6
                  * of RFC793, fixed by RFC1122.
                  */
-                req->rsk_ops->rtx_syn_ack(sk, req);
+                req->rsk_ops->rtx_syn_ack(sk, req, NULL);
                 return NULL;
         }
 
@@ -595,7 +667,8 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
          * Invalid ACK: reset will be sent by listening socket
          */
         if ((flg & TCP_FLAG_ACK) &&
-            (TCP_SKB_CB(skb)->ack_seq != tcp_rsk(req)->snt_isn + 1))
+            (TCP_SKB_CB(skb)->ack_seq !=
+             tcp_rsk(req)->snt_isn + 1 + tcp_s_data_size(tcp_sk(sk))))
                 return sk;
 
         /* Also, it would be not so bad idea to check rcv_tsecr, which
@@ -640,10 +713,11 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         if (!(flg & TCP_FLAG_ACK))
                 return NULL;
 
-        /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
-        if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
+        /* While TCP_DEFER_ACCEPT is active, drop bare ACK. */
+        if (req->retrans < inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
             TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
                 inet_rsk(req)->acked = 1;
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPDEFERACCEPTDROP);
                 return NULL;
         }
 
@@ -656,29 +730,6 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL);
         if (child == NULL)
                 goto listen_overflow;
-#ifdef CONFIG_TCP_MD5SIG
-        else {
-                /* Copy over the MD5 key from the original socket */
-                struct tcp_md5sig_key *key;
-                struct tcp_sock *tp = tcp_sk(sk);
-                key = tp->af_specific->md5_lookup(sk, child);
-                if (key != NULL) {
-                        /*
-                         * We're using one, so create a matching key on the
-                         * newsk structure. If we fail to get memory then we
-                         * end up not copying the key across. Shucks.
-                         */
-                        char *newkey = kmemdup(key->key, key->keylen,
-                                               GFP_ATOMIC);
-                        if (newkey) {
-                                if (!tcp_alloc_md5sig_pool())
-                                        BUG();
-                                tp->af_specific->md5_add(child, child, newkey,
-                                                         key->keylen);
-                        }
-                }
-        }
-#endif
 
         inet_csk_reqsk_queue_unlink(sk, req, prev);
         inet_csk_reqsk_queue_removed(sk, req);
@@ -700,6 +751,7 @@ embryonic_reset:
         inet_csk_reqsk_queue_drop(sk, req, prev);
         return NULL;
 }
+EXPORT_SYMBOL(tcp_check_req);
 
 /*
  * Queue segment on the new socket if the new socket is active,
@@ -724,15 +776,11 @@ int tcp_child_process(struct sock *parent, struct sock *child,
                  * in main socket hash table and lock on listening
                  * socket does not protect us more.
                  */
-                sk_add_backlog(child, skb);
+                __sk_add_backlog(child, skb);
         }
 
         bh_unlock_sock(child);
         sock_put(child);
         return ret;
 }
-
-EXPORT_SYMBOL(tcp_check_req);
 EXPORT_SYMBOL(tcp_child_process);
-EXPORT_SYMBOL(tcp_create_openreq_child);
-EXPORT_SYMBOL(tcp_timewait_state_process);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 416fc4c2e7eb..dc7c096ddfef 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -37,6 +37,7 @@
 #include <net/tcp.h>
 
 #include <linux/compiler.h>
+#include <linux/gfp.h>
 #include <linux/module.h>
 
 /* People can turn this off for buggy TCP's found in printers etc. */
@@ -54,11 +55,16 @@ int sysctl_tcp_workaround_signed_windows __read_mostly = 0;
 int sysctl_tcp_tso_win_divisor __read_mostly = 3;
 
 int sysctl_tcp_mtu_probing __read_mostly = 0;
-int sysctl_tcp_base_mss __read_mostly = 512;
+int sysctl_tcp_base_mss __read_mostly = TCP_BASE_MSS;
 
 /* By default, RFC2861 behavior.  */
 int sysctl_tcp_slow_start_after_idle __read_mostly = 1;
 
+int sysctl_tcp_cookie_size __read_mostly = 0; /* TCP_COOKIE_MAX */
+EXPORT_SYMBOL_GPL(sysctl_tcp_cookie_size);
+
+
+/* Account for new data that has been sent to the network. */
 static void tcp_event_new_data_sent(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -113,9 +119,13 @@ static __u16 tcp_advertise_mss(struct sock *sk)
         struct dst_entry *dst = __sk_dst_get(sk);
         int mss = tp->advmss;
 
-        if (dst && dst_metric(dst, RTAX_ADVMSS) < mss) {
-                mss = dst_metric(dst, RTAX_ADVMSS);
-                tp->advmss = mss;
+        if (dst) {
+                unsigned int metric = dst_metric_advmss(dst);
+
+                if (metric < mss) {
+                        mss = metric;
+                        tp->advmss = mss;
+                }
         }
 
         return (__u16)mss;
@@ -142,6 +152,7 @@ static void tcp_cwnd_restart(struct sock *sk, struct dst_entry *dst)
         tp->snd_cwnd_used = 0;
 }
 
+/* Congestion state accounting after a packet has been sent. */
 static void tcp_event_data_sent(struct tcp_sock *tp,
                                 struct sk_buff *skb, struct sock *sk)
 {
@@ -161,6 +172,7 @@ static void tcp_event_data_sent(struct tcp_sock *tp,
                 icsk->icsk_ack.pingpong = 1;
 }
 
+/* Account for an ACK we sent. */
 static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
 {
         tcp_dec_quickack_mode(sk, pkts);
@@ -176,7 +188,8 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
  */
 void tcp_select_initial_window(int __space, __u32 mss,
                                __u32 *rcv_wnd, __u32 *window_clamp,
-                               int wscale_ok, __u8 *rcv_wscale)
+                               int wscale_ok, __u8 *rcv_wscale,
+                               __u32 init_rcv_wnd)
 {
         unsigned int space = (__space < 0 ? 0 : __space);
 
@@ -215,23 +228,28 @@ void tcp_select_initial_window(int __space, __u32 mss,
                 }
         }
 
-        /* Set initial window to value enough for senders,
-         * following RFC2414. Senders, not following this RFC,
-         * will be satisfied with 2.
+        /* Set initial window to a value enough for senders starting with
+         * initial congestion window of TCP_DEFAULT_INIT_RCVWND. Place
+         * a limit on the initial window when mss is larger than 1460.
          */
         if (mss > (1 << *rcv_wscale)) {
-                int init_cwnd = 4;
-                if (mss > 1460 * 3)
-                        init_cwnd = 2;
-                else if (mss > 1460)
-                        init_cwnd = 3;
-                if (*rcv_wnd > init_cwnd * mss)
-                        *rcv_wnd = init_cwnd * mss;
+                int init_cwnd = TCP_DEFAULT_INIT_RCVWND;
+                if (mss > 1460)
+                        init_cwnd =
+                        max_t(u32, (1460 * TCP_DEFAULT_INIT_RCVWND) / mss, 2);
+                /* when initializing use the value from init_rcv_wnd
+                 * rather than the default from above
+                 */
+                if (init_rcv_wnd)
+                        *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
+                else
+                        *rcv_wnd = min(*rcv_wnd, init_cwnd * mss);
         }
 
         /* Set the clamp no higher than max representable value */
         (*window_clamp) = min(65535U << (*rcv_wscale), *window_clamp);
 }
+EXPORT_SYMBOL(tcp_select_initial_window);
 
 /* Chose a new window to advertise, update state in tcp_sock for the
  * socket, and return result with RFC1323 scaling applied.  The return
@@ -276,20 +294,22 @@ static u16 tcp_select_window(struct sock *sk)
         return new_win;
 }
 
+/* Packet ECN state for a SYN-ACK */
 static inline void TCP_ECN_send_synack(struct tcp_sock *tp, struct sk_buff *skb)
 {
-        TCP_SKB_CB(skb)->flags &= ~TCPCB_FLAG_CWR;
+        TCP_SKB_CB(skb)->flags &= ~TCPHDR_CWR;
         if (!(tp->ecn_flags & TCP_ECN_OK))
-                TCP_SKB_CB(skb)->flags &= ~TCPCB_FLAG_ECE;
+                TCP_SKB_CB(skb)->flags &= ~TCPHDR_ECE;
 }
 
+/* Packet ECN state for a SYN.  */
 static inline void TCP_ECN_send_syn(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
         tp->ecn_flags = 0;
         if (sysctl_tcp_ecn == 1) {
-                TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_ECE | TCPCB_FLAG_CWR;
+                TCP_SKB_CB(skb)->flags |= TCPHDR_ECE | TCPHDR_CWR;
                 tp->ecn_flags = TCP_ECN_OK;
         }
 }
@@ -301,6 +321,9 @@ TCP_ECN_make_synack(struct request_sock *req, struct tcphdr *th)
                 th->ece = 1;
 }
 
+/* Set up ECN state for a packet on a ESTABLISHED socket that is about to
+ * be sent.
+ */
 static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
                                 int tcp_header_len)
 {
@@ -330,6 +353,7 @@ static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
  */
 static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
 {
+        skb->ip_summed = CHECKSUM_PARTIAL;
         skb->csum = 0;
 
         TCP_SKB_CB(skb)->flags = flags;
@@ -340,7 +364,7 @@ static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
         skb_shinfo(skb)->gso_type = 0;
 
         TCP_SKB_CB(skb)->seq = seq;
-        if (flags & (TCPCB_FLAG_SYN | TCPCB_FLAG_FIN))
+        if (flags & (TCPHDR_SYN | TCPHDR_FIN))
                 seq++;
         TCP_SKB_CB(skb)->end_seq = seq;
 }
@@ -353,16 +377,52 @@ static inline int tcp_urg_mode(const struct tcp_sock *tp)
 #define OPTION_SACK_ADVERTISE   (1 << 0)
 #define OPTION_TS               (1 << 1)
 #define OPTION_MD5              (1 << 2)
+#define OPTION_WSCALE           (1 << 3)
+#define OPTION_COOKIE_EXTENSION (1 << 4)
 
 struct tcp_out_options {
         u8 options;             /* bit field of OPTION_* */
         u8 ws;                  /* window scale, 0 to disable */
         u8 num_sack_blocks;     /* number of SACK blocks to include */
+        u8 hash_size;           /* bytes in hash_location */
         u16 mss;                /* 0 to disable */
         __u32 tsval, tsecr;     /* need to include OPTION_TS */
+        __u8 *hash_location;    /* temporary pointer, overloaded */
 };
 
-/* Beware: Something in the Internet is very sensitive to the ordering of
+/* The sysctl int routines are generic, so check consistency here.
+ */
+static u8 tcp_cookie_size_check(u8 desired)
+{
+        int cookie_size;
+
+        if (desired > 0)
+                /* previously specified */
+                return desired;
+
+        cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
+        if (cookie_size <= 0)
+                /* no default specified */
+                return 0;
+
+        if (cookie_size <= TCP_COOKIE_MIN)
+                /* value too small, specify minimum */
+                return TCP_COOKIE_MIN;
+
+        if (cookie_size >= TCP_COOKIE_MAX)
+                /* value too large, specify maximum */
+                return TCP_COOKIE_MAX;
+
+        if (cookie_size & 1)
+                /* 8-bit multiple, illegal, fix it */
+                cookie_size++;
+
+        return (u8)cookie_size;
+}
+
+/* Write previously computed TCP options to the packet.
+ *
+ * Beware: Something in the Internet is very sensitive to the ordering of
  * TCP options, we learned this through the hard way, so be careful here.
  * Luckily we can at least blame others for their non-compliance but from
  * inter-operatibility perspective it seems that we're somewhat stuck with
@@ -374,17 +434,34 @@ struct tcp_out_options {
  * (but it may well be that other scenarios fail similarly).
  */
 static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
-                              const struct tcp_out_options *opts,
-                              __u8 **md5_hash) {
-        if (unlikely(OPTION_MD5 & opts->options)) {
-                *ptr++ = htonl((TCPOPT_NOP << 24) |
-                               (TCPOPT_NOP << 16) |
-                               (TCPOPT_MD5SIG << 8) |
-                               TCPOLEN_MD5SIG);
-                *md5_hash = (__u8 *)ptr;
+                              struct tcp_out_options *opts)
+{
+        u8 options = opts->options;     /* mungable copy */
+
+        /* Having both authentication and cookies for security is redundant,
+         * and there's certainly not enough room.  Instead, the cookie-less
+         * extension variant is proposed.
+         *
+         * Consider the pessimal case with authentication.  The options
+         * could look like:
+         *   COOKIE|MD5(20) + MSS(4) + SACK|TS(12) + WSCALE(4) == 40
+         */
+        if (unlikely(OPTION_MD5 & options)) {
+                if (unlikely(OPTION_COOKIE_EXTENSION & options)) {
+                        *ptr++ = htonl((TCPOPT_COOKIE << 24) |
+                                       (TCPOLEN_COOKIE_BASE << 16) |
+                                       (TCPOPT_MD5SIG << 8) |
+                                       TCPOLEN_MD5SIG);
+                } else {
+                        *ptr++ = htonl((TCPOPT_NOP << 24) |
+                                       (TCPOPT_NOP << 16) |
+                                       (TCPOPT_MD5SIG << 8) |
+                                       TCPOLEN_MD5SIG);
+                }
+                options &= ~OPTION_COOKIE_EXTENSION;
+                /* overload cookie hash location */
+                opts->hash_location = (__u8 *)ptr;
                 ptr += 4;
-        } else {
-                *md5_hash = NULL;
         }
 
         if (unlikely(opts->mss)) {
@@ -393,12 +470,13 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
                                opts->mss);
         }
 
-        if (likely(OPTION_TS & opts->options)) {
-                if (unlikely(OPTION_SACK_ADVERTISE & opts->options)) {
+        if (likely(OPTION_TS & options)) {
+                if (unlikely(OPTION_SACK_ADVERTISE & options)) {
                         *ptr++ = htonl((TCPOPT_SACK_PERM << 24) |
                                        (TCPOLEN_SACK_PERM << 16) |
                                        (TCPOPT_TIMESTAMP << 8) |
                                        TCPOLEN_TIMESTAMP);
+                        options &= ~OPTION_SACK_ADVERTISE;
                 } else {
                         *ptr++ = htonl((TCPOPT_NOP << 24) |
                                        (TCPOPT_NOP << 16) |
@@ -409,15 +487,52 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
                 *ptr++ = htonl(opts->tsecr);
         }
 
-        if (unlikely(OPTION_SACK_ADVERTISE & opts->options &&
-                     !(OPTION_TS & opts->options))) {
+        /* Specification requires after timestamp, so do it now.
+         *
+         * Consider the pessimal case without authentication.  The options
+         * could look like:
+         *   MSS(4) + SACK|TS(12) + COOKIE(20) + WSCALE(4) == 40
+         */
+        if (unlikely(OPTION_COOKIE_EXTENSION & options)) {
+                __u8 *cookie_copy = opts->hash_location;
+                u8 cookie_size = opts->hash_size;
+
+                /* 8-bit multiple handled in tcp_cookie_size_check() above,
+                 * and elsewhere.
+                 */
+                if (0x2 & cookie_size) {
+                        __u8 *p = (__u8 *)ptr;
+
+                        /* 16-bit multiple */
+                        *p++ = TCPOPT_COOKIE;
+                        *p++ = TCPOLEN_COOKIE_BASE + cookie_size;
+                        *p++ = *cookie_copy++;
+                        *p++ = *cookie_copy++;
+                        ptr++;
+                        cookie_size -= 2;
+                } else {
+                        /* 32-bit multiple */
+                        *ptr++ = htonl(((TCPOPT_NOP << 24) |
+                                        (TCPOPT_NOP << 16) |
+                                        (TCPOPT_COOKIE << 8) |
+                                        TCPOLEN_COOKIE_BASE) +
+                                       cookie_size);
+                }
+
+                if (cookie_size > 0) {
+                        memcpy(ptr, cookie_copy, cookie_size);
+                        ptr += (cookie_size / 4);
+                }
+        }
+
+        if (unlikely(OPTION_SACK_ADVERTISE & options)) {
                 *ptr++ = htonl((TCPOPT_NOP << 24) |
                                (TCPOPT_NOP << 16) |
                                (TCPOPT_SACK_PERM << 8) |
                                TCPOLEN_SACK_PERM);
         }
 
-        if (unlikely(opts->ws)) {
+        if (unlikely(OPTION_WSCALE & options)) {
                 *ptr++ = htonl((TCPOPT_NOP << 24) |
                                (TCPOPT_WINDOW << 16) |
                                (TCPOLEN_WINDOW << 8) |
@@ -445,17 +560,24 @@ static void tcp_options_write(__be32 *ptr, struct tcp_sock *tp,
         }
 }
 
+/* Compute TCP options for SYN packets. This is not the final
+ * network wire format yet.
+ */
 static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_out_options *opts,
                                 struct tcp_md5sig_key **md5) {
         struct tcp_sock *tp = tcp_sk(sk);
-        unsigned size = 0;
+        struct tcp_cookie_values *cvp = tp->cookie_values;
+        unsigned remaining = MAX_TCP_OPTION_SPACE;
+        u8 cookie_size = (!tp->rx_opt.cookie_out_never && cvp != NULL) ?
+                         tcp_cookie_size_check(cvp->cookie_desired) :
+                         0;
 
 #ifdef CONFIG_TCP_MD5SIG
         *md5 = tp->af_specific->md5_lookup(sk, sk);
         if (*md5) {
                 opts->options |= OPTION_MD5;
-                size += TCPOLEN_MD5SIG_ALIGNED;
+                remaining -= TCPOLEN_MD5SIG_ALIGNED;
         }
 #else
         *md5 = NULL;
@@ -471,76 +593,154 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
          * SACKs don't matter, we never delay an ACK when we have any of those
          * going out.  */
         opts->mss = tcp_advertise_mss(sk);
-        size += TCPOLEN_MSS_ALIGNED;
+        remaining -= TCPOLEN_MSS_ALIGNED;
 
         if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = tp->rx_opt.ts_recent;
-                size += TCPOLEN_TSTAMP_ALIGNED;
+                remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
         if (likely(sysctl_tcp_window_scaling)) {
                 opts->ws = tp->rx_opt.rcv_wscale;
-                if (likely(opts->ws))
-                        size += TCPOLEN_WSCALE_ALIGNED;
+                opts->options |= OPTION_WSCALE;
+                remaining -= TCPOLEN_WSCALE_ALIGNED;
         }
         if (likely(sysctl_tcp_sack)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
                 if (unlikely(!(OPTION_TS & opts->options)))
-                        size += TCPOLEN_SACKPERM_ALIGNED;
+                        remaining -= TCPOLEN_SACKPERM_ALIGNED;
         }
 
-        return size;
+        /* Note that timestamps are required by the specification.
+         *
+         * Odd numbers of bytes are prohibited by the specification, ensuring
+         * that the cookie is 16-bit aligned, and the resulting cookie pair is
+         * 32-bit aligned.
+         */
+        if (*md5 == NULL &&
+            (OPTION_TS & opts->options) &&
+            cookie_size > 0) {
+                int need = TCPOLEN_COOKIE_BASE + cookie_size;
+
+                if (0x2 & need) {
+                        /* 32-bit multiple */
+                        need += 2; /* NOPs */
+
+                        if (need > remaining) {
+                                /* try shrinking cookie to fit */
+                                cookie_size -= 2;
+                                need -= 4;
+                        }
+                }
+                while (need > remaining && TCP_COOKIE_MIN <= cookie_size) {
+                        cookie_size -= 4;
+                        need -= 4;
+                }
+                if (TCP_COOKIE_MIN <= cookie_size) {
+                        opts->options |= OPTION_COOKIE_EXTENSION;
+                        opts->hash_location = (__u8 *)&cvp->cookie_pair[0];
+                        opts->hash_size = cookie_size;
+
+                        /* Remember for future incarnations. */
+                        cvp->cookie_desired = cookie_size;
+
+                        if (cvp->cookie_desired != cvp->cookie_pair_size) {
+                                /* Currently use random bytes as a nonce,
+                                 * assuming these are completely unpredictable
+                                 * by hostile users of the same system.
+                                 */
+                                get_random_bytes(&cvp->cookie_pair[0],
+                                                 cookie_size);
+                                cvp->cookie_pair_size = cookie_size;
+                        }
+
+                        remaining -= need;
+                }
+        }
+        return MAX_TCP_OPTION_SPACE - remaining;
 }
 
+/* Set up TCP options for SYN-ACKs. */
 static unsigned tcp_synack_options(struct sock *sk,
                                    struct request_sock *req,
                                    unsigned mss, struct sk_buff *skb,
                                    struct tcp_out_options *opts,
-                                   struct tcp_md5sig_key **md5) {
-        unsigned size = 0;
+                                   struct tcp_md5sig_key **md5,
+                                   struct tcp_extend_values *xvp)
+{
         struct inet_request_sock *ireq = inet_rsk(req);
-        char doing_ts;
+        unsigned remaining = MAX_TCP_OPTION_SPACE;
+        u8 cookie_plus = (xvp != NULL && !xvp->cookie_out_never) ?
+                         xvp->cookie_plus :
+                         0;
 
 #ifdef CONFIG_TCP_MD5SIG
         *md5 = tcp_rsk(req)->af_specific->md5_lookup(sk, req);
         if (*md5) {
                 opts->options |= OPTION_MD5;
-                size += TCPOLEN_MD5SIG_ALIGNED;
+                remaining -= TCPOLEN_MD5SIG_ALIGNED;
+
+                /* We can't fit any SACK blocks in a packet with MD5 + TS
+                 * options. There was discussion about disabling SACK
+                 * rather than TS in order to fit in better with old,
+                 * buggy kernels, but that was deemed to be unnecessary.
+                 */
+                ireq->tstamp_ok &= !ireq->sack_ok;
         }
 #else
         *md5 = NULL;
 #endif
 
-        /* we can't fit any SACK blocks in a packet with MD5 + TS
-           options. There was discussion about disabling SACK rather than TS in
-           order to fit in better with old, buggy kernels, but that was deemed
-           to be unnecessary. */
-        doing_ts = ireq->tstamp_ok && !(*md5 && ireq->sack_ok);
-
+        /* We always send an MSS option. */
         opts->mss = mss;
-        size += TCPOLEN_MSS_ALIGNED;
+        remaining -= TCPOLEN_MSS_ALIGNED;
 
         if (likely(ireq->wscale_ok)) {
                 opts->ws = ireq->rcv_wscale;
-                if (likely(opts->ws))
-                        size += TCPOLEN_WSCALE_ALIGNED;
+                opts->options |= OPTION_WSCALE;
+                remaining -= TCPOLEN_WSCALE_ALIGNED;
         }
-        if (likely(doing_ts)) {
+        if (likely(ireq->tstamp_ok)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = req->ts_recent;
-                size += TCPOLEN_TSTAMP_ALIGNED;
+                remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
         if (likely(ireq->sack_ok)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
-                if (unlikely(!doing_ts))
-                        size += TCPOLEN_SACKPERM_ALIGNED;
+                if (unlikely(!ireq->tstamp_ok))
+                        remaining -= TCPOLEN_SACKPERM_ALIGNED;
         }
 
-        return size;
+        /* Similar rationale to tcp_syn_options() applies here, too.
+         * If the <SYN> options fit, the same options should fit now!
+         */
+        if (*md5 == NULL &&
+            ireq->tstamp_ok &&
+            cookie_plus > TCPOLEN_COOKIE_BASE) {
+                int need = cookie_plus; /* has TCPOLEN_COOKIE_BASE */
+
+                if (0x2 & need) {
+                        /* 32-bit multiple */
+                        need += 2; /* NOPs */
+                }
+                if (need <= remaining) {
+                        opts->options |= OPTION_COOKIE_EXTENSION;
+                        opts->hash_size = cookie_plus - TCPOLEN_COOKIE_BASE;
+                        remaining -= need;
+                } else {
+                        /* There's no error return, so flag it. */
+                        xvp->cookie_out_never = 1; /* true */
+                        opts->hash_size = 0;
+                }
+        }
+        return MAX_TCP_OPTION_SPACE - remaining;
 }
 
+/* Compute TCP options for ESTABLISHED sockets. This is not the
+ * final wire format yet.
+ */
 static unsigned tcp_established_options(struct sock *sk, struct sk_buff *skb,
                                         struct tcp_out_options *opts,
                                         struct tcp_md5sig_key **md5) {
@@ -601,7 +801,6 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         struct tcp_out_options opts;
         unsigned tcp_options_size, tcp_header_size;
         struct tcp_md5sig_key *md5;
-        __u8 *md5_hash_location;
         struct tcphdr *th;
         int err;
 
@@ -627,15 +826,18 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         tcb = TCP_SKB_CB(skb);
         memset(&opts, 0, sizeof(opts));
 
-        if (unlikely(tcb->flags & TCPCB_FLAG_SYN))
+        if (unlikely(tcb->flags & TCPHDR_SYN))
                 tcp_options_size = tcp_syn_options(sk, skb, &opts, &md5);
         else
                 tcp_options_size = tcp_established_options(sk, skb, &opts,
                                                            &md5);
         tcp_header_size = tcp_options_size + sizeof(struct tcphdr);
 
-        if (tcp_packets_in_flight(tp) == 0)
+        if (tcp_packets_in_flight(tp) == 0) {
                 tcp_ca_event(sk, CA_EVENT_TX_START);
+                skb->ooo_okay = 1;
+        } else
+                skb->ooo_okay = 0;
 
         skb_push(skb, tcp_header_size);
         skb_reset_transport_header(skb);
@@ -643,14 +845,14 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
         /* Build TCP header and checksum it. */
         th = tcp_hdr(skb);
-        th->source              = inet->sport;
-        th->dest                = inet->dport;
+        th->source              = inet->inet_sport;
+        th->dest                = inet->inet_dport;
         th->seq                 = htonl(tcb->seq);
         th->ack_seq             = htonl(tp->rcv_nxt);
         *(((__be16 *)th) + 6)   = htons(((tcp_header_size >> 2) << 12) |
                                         tcb->flags);
 
-        if (unlikely(tcb->flags & TCPCB_FLAG_SYN)) {
+        if (unlikely(tcb->flags & TCPHDR_SYN)) {
                 /* RFC1323: The window in SYN & SYN/ACK segments
                  * is never scaled.
                  */
@@ -667,36 +869,37 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                         th->urg_ptr = htons(tp->snd_up - tcb->seq);
                         th->urg = 1;
                 } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
-                        th->urg_ptr = 0xFFFF;
+                        th->urg_ptr = htons(0xFFFF);
                         th->urg = 1;
                 }
         }
 
-        tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
-        if (likely((tcb->flags & TCPCB_FLAG_SYN) == 0))
+        tcp_options_write((__be32 *)(th + 1), tp, &opts);
+        if (likely((tcb->flags & TCPHDR_SYN) == 0))
                 TCP_ECN_send(sk, skb, tcp_header_size);
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Calculate the MD5 hash, as we have all we need now */
         if (md5) {
-                sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
-                tp->af_specific->calc_md5_hash(md5_hash_location,
+                sk_nocaps_add(sk, NETIF_F_GSO_MASK);
+                tp->af_specific->calc_md5_hash(opts.hash_location,
                                                md5, sk, NULL, skb);
         }
 #endif
 
-        icsk->icsk_af_ops->send_check(sk, skb->len, skb);
+        icsk->icsk_af_ops->send_check(sk, skb);
 
-        if (likely(tcb->flags & TCPCB_FLAG_ACK))
+        if (likely(tcb->flags & TCPHDR_ACK))
                 tcp_event_ack_sent(sk, tcp_skb_pcount(skb));
 
         if (skb->len != tcp_header_size)
                 tcp_event_data_sent(tp, skb, sk);
 
         if (after(tcb->end_seq, tp->snd_nxt) || tcb->seq == tcb->end_seq)
-                TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
+                TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS,
+                              tcp_skb_pcount(skb));
 
-        err = icsk->icsk_af_ops->queue_xmit(skb, 0);
+        err = icsk->icsk_af_ops->queue_xmit(skb);
         if (likely(err <= 0))
                 return err;
 
@@ -705,7 +908,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         return net_xmit_eval(err);
 }
 
-/* This routine just queue's the buffer
+/* This routine just queues the buffer for sending.
  *
  * NOTE: probe0 timer is not checked, do not forget tcp_push_pending_frames,
  * otherwise socket can stall.
@@ -722,10 +925,12 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
         sk_mem_charge(sk, skb->truesize);
 }
 
+/* Initialize TSO segments for a packet. */
 static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
                                  unsigned int mss_now)
 {
-        if (skb->len <= mss_now || !sk_can_gso(sk)) {
+        if (skb->len <= mss_now || !sk_can_gso(sk) ||
+            skb->ip_summed == CHECKSUM_NONE) {
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
                  */
@@ -827,7 +1032,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
 
         /* PSH and FIN should only be set in the second packet. */
         flags = TCP_SKB_CB(skb)->flags;
-        TCP_SKB_CB(skb)->flags = flags & ~(TCPCB_FLAG_FIN | TCPCB_FLAG_PSH);
+        TCP_SKB_CB(skb)->flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
         TCP_SKB_CB(buff)->flags = flags;
         TCP_SKB_CB(buff)->sacked = TCP_SKB_CB(skb)->sacked;
 
@@ -908,6 +1113,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
         skb->len = skb->data_len;
 }
 
+/* Remove acked data from a packet in the transmit queue. */
 int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
 {
         if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
@@ -936,7 +1142,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
         return 0;
 }
 
-/* Not accounting for SACKs here. */
+/* Calculate MSS. Not accounting for SACKs here.  */
 int tcp_mtu_to_mss(struct sock *sk, int pmtu)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -980,6 +1186,7 @@ int tcp_mss_to_mtu(struct sock *sk, int mss)
         return mtu;
 }
 
+/* MTU probing init per socket */
 void tcp_mtup_init(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -991,6 +1198,7 @@ void tcp_mtup_init(struct sock *sk)
         icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, sysctl_tcp_base_mss);
         icsk->icsk_mtup.probe_size = 0;
 }
+EXPORT_SYMBOL(tcp_mtup_init);
 
 /* This function synchronize snd mss to current pmtu/exthdr set.
 
@@ -1034,6 +1242,7 @@ unsigned int tcp_sync_mss(struct sock *sk, u32 pmtu)
 
         return mss_now;
 }
+EXPORT_SYMBOL(tcp_sync_mss);
 
 /* Compute the current effective MSS, taking SACKs and IP options,
  * and even PMTU discovery events into account.
@@ -1130,8 +1339,7 @@ static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp,
         u32 in_flight, cwnd;
 
         /* Don't be strict about the congestion window for the final FIN.  */
-        if ((TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN) &&
-            tcp_skb_pcount(skb) == 1)
+        if ((TCP_SKB_CB(skb)->flags & TCPHDR_FIN) && tcp_skb_pcount(skb) == 1)
                 return 1;
 
         in_flight = tcp_packets_in_flight(tp);
@@ -1142,7 +1350,8 @@ static inline unsigned int tcp_cwnd_test(struct tcp_sock *tp,
         return 0;
 }
 
-/* This must be invoked the first time we consider transmitting
+/* Intialize TSO state of a skb.
+ * This must be invoked the first time we consider transmitting
  * SKB onto the wire.
  */
 static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
@@ -1157,6 +1366,7 @@ static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
         return tso_segs;
 }
 
+/* Minshall's variant of the Nagle send check. */
 static inline int tcp_minshall_check(const struct tcp_sock *tp)
 {
         return after(tp->snd_sml, tp->snd_una) &&
@@ -1174,9 +1384,9 @@ static inline int tcp_nagle_check(const struct tcp_sock *tp,
                                   const struct sk_buff *skb,
                                   unsigned mss_now, int nonagle)
 {
-        return (skb->len < mss_now &&
+        return skb->len < mss_now &&
                 ((nonagle & TCP_NAGLE_CORK) ||
-                 (!nonagle && tp->packets_out && tcp_minshall_check(tp))));
+                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
 }
 
 /* Return non-zero if the Nagle test allows this packet to be
@@ -1198,7 +1408,7 @@ static inline int tcp_nagle_test(struct tcp_sock *tp, struct sk_buff *skb,
          * Nagle can be ignored during F-RTO too (see RFC4138).
          */
         if (tcp_urg_mode(tp) || (tp->frto_counter == 2) ||
-            (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN))
+            (TCP_SKB_CB(skb)->flags & TCPHDR_FIN))
                 return 1;
 
         if (!tcp_nagle_check(tp, skb, cur_mss, nonagle))
@@ -1241,15 +1451,16 @@ static unsigned int tcp_snd_test(struct sock *sk, struct sk_buff *skb,
         return cwnd_quota;
 }
 
+/* Test if sending is allowed right now. */
 int tcp_may_send_now(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb = tcp_send_head(sk);
 
-        return (skb &&
+        return skb &&
                 tcp_snd_test(sk, skb, tcp_current_mss(sk),
                              (tcp_skb_is_last(sk, skb) ?
-                              tp->nonagle : TCP_NAGLE_PUSH)));
+                              tp->nonagle : TCP_NAGLE_PUSH));
 }
 
 /* Trim TSO SKB to LEN bytes, put the remaining data into a new packet
@@ -1260,7 +1471,7 @@ int tcp_may_send_now(struct sock *sk)
  * packet has never been sent out before (and thus is not cloned).
  */
 static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
-                        unsigned int mss_now)
+                        unsigned int mss_now, gfp_t gfp)
 {
         struct sk_buff *buff;
         int nlen = skb->len - len;
@@ -1270,7 +1481,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
         if (skb->len != skb->data_len)
                 return tcp_fragment(sk, skb, len, mss_now);
 
-        buff = sk_stream_alloc_skb(sk, 0, GFP_ATOMIC);
+        buff = sk_stream_alloc_skb(sk, 0, gfp);
         if (unlikely(buff == NULL))
                 return -ENOMEM;
 
@@ -1286,7 +1497,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
 
         /* PSH and FIN should only be set in the second packet. */
         flags = TCP_SKB_CB(skb)->flags;
-        TCP_SKB_CB(skb)->flags = flags & ~(TCPCB_FLAG_FIN | TCPCB_FLAG_PSH);
+        TCP_SKB_CB(skb)->flags = flags & ~(TCPHDR_FIN | TCPHDR_PSH);
         TCP_SKB_CB(buff)->flags = flags;
 
         /* This packet was never sent out yet, so no SACK bits. */
@@ -1316,8 +1527,9 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u32 send_win, cong_win, limit, in_flight;
+        int win_divisor;
 
-        if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN)
+        if (TCP_SKB_CB(skb)->flags & TCPHDR_FIN)
                 goto send_now;
 
         if (icsk->icsk_ca_state != TCP_CA_Open)
@@ -1347,13 +1559,14 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
         if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
                 goto send_now;
 
-        if (sysctl_tcp_tso_win_divisor) {
+        win_divisor = ACCESS_ONCE(sysctl_tcp_tso_win_divisor);
+        if (win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
 
                 /* If at least some fraction of a window is available,
                  * just use it.
                  */
-                chunk /= sysctl_tcp_tso_win_divisor;
+                chunk /= win_divisor;
                 if (limit >= chunk)
                         goto send_now;
         } else {
@@ -1377,6 +1590,10 @@ send_now:
 }
 
 /* Create a new MTU probe if we are ready.
+ * MTU probe is regularly attempting to increase the path MTU by
+ * deliberately sending larger packets.  This discovers routing
+ * changes resulting in larger path MTUs.
+ *
  * Returns 0 if we should wait to probe (no cwnd available),
  *         1 if a probe was sent,
  *         -1 otherwise
@@ -1439,7 +1656,7 @@ static int tcp_mtu_probe(struct sock *sk)
 
         TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(skb)->seq;
         TCP_SKB_CB(nskb)->end_seq = TCP_SKB_CB(skb)->seq + probe_size;
-        TCP_SKB_CB(nskb)->flags = TCPCB_FLAG_ACK;
+        TCP_SKB_CB(nskb)->flags = TCPHDR_ACK;
         TCP_SKB_CB(nskb)->sacked = 0;
         nskb->csum = 0;
         nskb->ip_summed = skb->ip_summed;
@@ -1464,7 +1681,7 @@ static int tcp_mtu_probe(struct sock *sk)
                         sk_wmem_free_skb(sk, skb);
                 } else {
                         TCP_SKB_CB(nskb)->flags |= TCP_SKB_CB(skb)->flags &
-                                                   ~(TCPCB_FLAG_FIN|TCPCB_FLAG_PSH);
+                                                   ~(TCPHDR_FIN|TCPHDR_PSH);
                         if (!skb_shinfo(skb)->nr_frags) {
                                 skb_pull(skb, copy);
                                 if (skb->ip_summed != CHECKSUM_PARTIAL)
@@ -1564,7 +1781,7 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                                                     cwnd_quota);
 
                 if (skb->len > limit &&
-                    unlikely(tso_fragment(sk, skb, limit, mss_now)))
+                    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
                         break;
 
                 TCP_SKB_CB(skb)->when = tcp_time_stamp;
@@ -1598,11 +1815,6 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
 void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
                                int nonagle)
 {
-        struct sk_buff *skb = tcp_send_head(sk);
-
-        if (!skb)
-                return;
-
         /* If we are closed, the bytes will have to remain here.
          * In time closedown will finish, we empty the write queue and
          * all will be happy.
@@ -1789,6 +2001,7 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb)
         sk_wmem_free_skb(sk, next_skb);
 }
 
+/* Check if coalescing SKBs is legal. */
 static int tcp_can_collapse(struct sock *sk, struct sk_buff *skb)
 {
         if (tcp_skb_pcount(skb) > 1)
@@ -1807,6 +2020,9 @@ static int tcp_can_collapse(struct sock *sk, struct sk_buff *skb)
         return 1;
 }
 
+/* Collapse packets in the retransmit queue to make to create
+ * less packets on the wire. This is only done on retransmission.
+ */
 static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
                                      int space)
 {
@@ -1816,7 +2032,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
 
         if (!sysctl_tcp_retrans_collapse)
                 return;
-        if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_SYN)
+        if (TCP_SKB_CB(skb)->flags & TCPHDR_SYN)
                 return;
 
         tcp_for_write_queue_from_safe(skb, tmp, sk) {
@@ -1885,8 +2101,8 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
          * case, when window is shrunk to zero. In this case
          * our retransmit serves as a zero window probe.
          */
-        if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp))
-            && TCP_SKB_CB(skb)->seq != tp->snd_una)
+        if (!before(TCP_SKB_CB(skb)->seq, tcp_wnd_end(tp)) &&
+            TCP_SKB_CB(skb)->seq != tp->snd_una)
                 return -EAGAIN;
 
         if (skb->len > cur_mss) {
@@ -1908,7 +2124,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
          * since it is cheap to do so and saves bytes on the network.
          */
         if (skb->len > 0 &&
-            (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN) &&
+            (TCP_SKB_CB(skb)->flags & TCPHDR_FIN) &&
             tp->snd_una == (TCP_SKB_CB(skb)->end_seq - 1)) {
                 if (!pskb_trim(skb, 0)) {
                         /* Reuse, even though it does some unnecessary work */
@@ -1956,6 +2172,9 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         return err;
 }
 
+/* Check if we forward retransmits are possible in the current
+ * window/congestion state.
+ */
 static int tcp_can_forward_retransmit(struct sock *sk)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -2001,6 +2220,9 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
         int mib_idx;
         int fwd_rexmitting = 0;
 
+        if (!tp->packets_out)
+                return;
+
         if (!tp->lost_out)
                 tp->retransmit_high = tp->snd_una;
 
@@ -2094,13 +2316,14 @@ void tcp_send_fin(struct sock *sk)
         mss_now = tcp_current_mss(sk);
 
         if (tcp_send_head(sk) != NULL) {
-                TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_FIN;
+                TCP_SKB_CB(skb)->flags |= TCPHDR_FIN;
                 TCP_SKB_CB(skb)->end_seq++;
                 tp->write_seq++;
         } else {
                 /* Socket is locked, keep trying until memory is available. */
                 for (;;) {
-                        skb = alloc_skb_fclone(MAX_TCP_HEADER, GFP_KERNEL);
+                        skb = alloc_skb_fclone(MAX_TCP_HEADER,
+                                               sk->sk_allocation);
                         if (skb)
                                 break;
                         yield();
@@ -2110,7 +2333,7 @@ void tcp_send_fin(struct sock *sk)
                 skb_reserve(skb, MAX_TCP_HEADER);
                 /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
                 tcp_init_nondata_skb(skb, tp->write_seq,
-                                     TCPCB_FLAG_ACK | TCPCB_FLAG_FIN);
+                                     TCPHDR_ACK | TCPHDR_FIN);
                 tcp_queue_skb(sk, skb);
         }
         __tcp_push_pending_frames(sk, mss_now, TCP_NAGLE_OFF);
@@ -2135,7 +2358,7 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
         /* Reserve space for headers and prepare control bits. */
         skb_reserve(skb, MAX_TCP_HEADER);
         tcp_init_nondata_skb(skb, tcp_acceptable_seq(sk),
-                             TCPCB_FLAG_ACK | TCPCB_FLAG_RST);
+                             TCPHDR_ACK | TCPHDR_RST);
         /* Send it off. */
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
         if (tcp_transmit_skb(sk, skb, 0, priority))
@@ -2144,7 +2367,8 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
         TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTRSTS);
 }
 
-/* WARNING: This routine must only be called when we have already sent
+/* Send a crossed SYN-ACK during socket establishment.
+ * WARNING: This routine must only be called when we have already sent
  * a SYN packet that crossed the incoming SYN that caused this routine
  * to get called. If this assumption fails then the initial rcv_wnd
  * and rcv_wscale values will not be correct.
@@ -2154,11 +2378,11 @@ int tcp_send_synack(struct sock *sk)
         struct sk_buff *skb;
 
         skb = tcp_write_queue_head(sk);
-        if (skb == NULL || !(TCP_SKB_CB(skb)->flags & TCPCB_FLAG_SYN)) {
+        if (skb == NULL || !(TCP_SKB_CB(skb)->flags & TCPHDR_SYN)) {
                 printk(KERN_DEBUG "tcp_send_synack: wrong queue state\n");
                 return -EFAULT;
         }
-        if (!(TCP_SKB_CB(skb)->flags & TCPCB_FLAG_ACK)) {
+        if (!(TCP_SKB_CB(skb)->flags & TCPHDR_ACK)) {
                 if (skb_cloned(skb)) {
                         struct sk_buff *nskb = skb_copy(skb, GFP_ATOMIC);
                         if (nskb == NULL)
@@ -2172,30 +2396,33 @@ int tcp_send_synack(struct sock *sk)
                         skb = nskb;
                 }
 
-                TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_ACK;
+                TCP_SKB_CB(skb)->flags |= TCPHDR_ACK;
                 TCP_ECN_send_synack(tcp_sk(sk), skb);
         }
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
         return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
 }
 
-/*
- * Prepare a SYN-ACK.
- */
+/* Prepare a SYN-ACK. */
 struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
-                                struct request_sock *req)
+                                struct request_sock *req,
+                                struct request_values *rvp)
 {
+        struct tcp_out_options opts;
+        struct tcp_extend_values *xvp = tcp_xv(rvp);
         struct inet_request_sock *ireq = inet_rsk(req);
         struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_cookie_values *cvp = tp->cookie_values;
         struct tcphdr *th;
-        int tcp_header_size;
-        struct tcp_out_options opts;
         struct sk_buff *skb;
         struct tcp_md5sig_key *md5;
-        __u8 *md5_hash_location;
+        int tcp_header_size;
         int mss;
+        int s_data_desired = 0;
 
-        skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
+        if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
+                s_data_desired = cvp->s_data_desired;
+        skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
         if (skb == NULL)
                 return NULL;
 
@@ -2204,7 +2431,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 
         skb_dst_set(skb, dst_clone(dst));
 
-        mss = dst_metric(dst, RTAX_ADVMSS);
+        mss = dst_metric_advmss(dst);
         if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < mss)
                 mss = tp->rx_opt.user_mss;
 
@@ -2212,13 +2439,20 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                 __u8 rcv_wscale;
                 /* Set this up on the first call only */
                 req->window_clamp = tp->window_clamp ? : dst_metric(dst, RTAX_WINDOW);
+
+                /* limit the window selection if the user enforce a smaller rx buffer */
+                if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
+                    (req->window_clamp > tcp_full_space(sk) || req->window_clamp == 0))
+                        req->window_clamp = tcp_full_space(sk);
+
                 /* tcp_full_space because it is guaranteed to be the first packet */
                 tcp_select_initial_window(tcp_full_space(sk),
                         mss - (ireq->tstamp_ok ? TCPOLEN_TSTAMP_ALIGNED : 0),
                         &req->rcv_wnd,
                         &req->window_clamp,
                         ireq->wscale_ok,
-                        &rcv_wscale);
+                        &rcv_wscale,
+                        dst_metric(dst, RTAX_INITRWND));
                 ireq->rcv_wscale = rcv_wscale;
         }
 
@@ -2230,8 +2464,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 #endif
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
         tcp_header_size = tcp_synack_options(sk, req, mss,
-                                             skb, &opts, &md5) +
-                          sizeof(struct tcphdr);
+                                             skb, &opts, &md5, xvp)
+                        + sizeof(*th);
 
         skb_push(skb, tcp_header_size);
         skb_reset_transport_header(skb);
@@ -2247,30 +2481,64 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
          * not even correctly set)
          */
         tcp_init_nondata_skb(skb, tcp_rsk(req)->snt_isn,
-                             TCPCB_FLAG_SYN | TCPCB_FLAG_ACK);
+                             TCPHDR_SYN | TCPHDR_ACK);
+
+        if (OPTION_COOKIE_EXTENSION & opts.options) {
+                if (s_data_desired) {
+                        u8 *buf = skb_put(skb, s_data_desired);
+
+                        /* copy data directly from the listening socket. */
+                        memcpy(buf, cvp->s_data_payload, s_data_desired);
+                        TCP_SKB_CB(skb)->end_seq += s_data_desired;
+                }
+
+                if (opts.hash_size > 0) {
+                        __u32 workspace[SHA_WORKSPACE_WORDS];
+                        u32 *mess = &xvp->cookie_bakery[COOKIE_DIGEST_WORDS];
+                        u32 *tail = &mess[COOKIE_MESSAGE_WORDS-1];
+
+                        /* Secret recipe depends on the Timestamp, (future)
+                         * Sequence and Acknowledgment Numbers, Initiator
+                         * Cookie, and others handled by IP variant caller.
+                         */
+                        *tail-- ^= opts.tsval;
+                        *tail-- ^= tcp_rsk(req)->rcv_isn + 1;
+                        *tail-- ^= TCP_SKB_CB(skb)->seq + 1;
+
+                        /* recommended */
+                        *tail-- ^= (((__force u32)th->dest << 16) | (__force u32)th->source);
+                        *tail-- ^= (u32)(unsigned long)cvp; /* per sockopt */
+
+                        sha_transform((__u32 *)&xvp->cookie_bakery[0],
+                                      (char *)mess,
+                                      &workspace[0]);
+                        opts.hash_location =
+                                (__u8 *)&xvp->cookie_bakery[0];
+                }
+        }
+
         th->seq = htonl(TCP_SKB_CB(skb)->seq);
         th->ack_seq = htonl(tcp_rsk(req)->rcv_isn + 1);
 
         /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
         th->window = htons(min(req->rcv_wnd, 65535U));
-        tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
+        tcp_options_write((__be32 *)(th + 1), tp, &opts);
         th->doff = (tcp_header_size >> 2);
-        TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
+        TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS, tcp_skb_pcount(skb));
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Okay, we have all we need - do the md5 hash if needed */
         if (md5) {
-                tp->af_specific->calc_md5_hash(md5_hash_location,
+                tcp_rsk(req)->af_specific->calc_md5_hash(opts.hash_location,
                                                md5, NULL, req, skb);
         }
 #endif
 
         return skb;
 }
+EXPORT_SYMBOL(tcp_make_synack);
 
-/*
- * Do all connect socket setups that can be done AF independent.
- */
+/* Do all connect socket setups that can be done AF independent. */
 static void tcp_connect_init(struct sock *sk)
 {
         struct dst_entry *dst = __sk_dst_get(sk);
@@ -2297,18 +2565,24 @@ static void tcp_connect_init(struct sock *sk)
 
         if (!tp->window_clamp)
                 tp->window_clamp = dst_metric(dst, RTAX_WINDOW);
-        tp->advmss = dst_metric(dst, RTAX_ADVMSS);
+        tp->advmss = dst_metric_advmss(dst);
         if (tp->rx_opt.user_mss && tp->rx_opt.user_mss < tp->advmss)
                 tp->advmss = tp->rx_opt.user_mss;
 
         tcp_initialize_rcv_mss(sk);
 
+        /* limit the window selection if the user enforce a smaller rx buffer */
+        if (sk->sk_userlocks & SOCK_RCVBUF_LOCK &&
+            (tp->window_clamp > tcp_full_space(sk) || tp->window_clamp == 0))
+                tp->window_clamp = tcp_full_space(sk);
+
         tcp_select_initial_window(tcp_full_space(sk),
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
                                   &tp->rcv_wnd,
                                   &tp->window_clamp,
                                   sysctl_tcp_window_scaling,
-                                  &rcv_wscale);
+                                  &rcv_wscale,
+                                  dst_metric(dst, RTAX_INITRWND));
 
         tp->rx_opt.rcv_wscale = rcv_wscale;
         tp->rcv_ssthresh = tp->rcv_wnd;
@@ -2329,13 +2603,12 @@ static void tcp_connect_init(struct sock *sk)
         tcp_clear_retrans(tp);
 }
 
-/*
- * Build a SYN and send it off.
- */
+/* Build a SYN and send it off. */
 int tcp_connect(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *buff;
+        int err;
 
         tcp_connect_init(sk);
 
@@ -2347,7 +2620,7 @@ int tcp_connect(struct sock *sk)
         skb_reserve(buff, MAX_TCP_HEADER);
 
         tp->snd_nxt = tp->write_seq;
-        tcp_init_nondata_skb(buff, tp->write_seq++, TCPCB_FLAG_SYN);
+        tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
         TCP_ECN_send_syn(sk, buff);
 
         /* Send it off. */
@@ -2358,7 +2631,9 @@ int tcp_connect(struct sock *sk)
         sk->sk_wmem_queued += buff->truesize;
         sk_mem_charge(sk, buff->truesize);
         tp->packets_out += tcp_skb_pcount(buff);
-        tcp_transmit_skb(sk, buff, 1, GFP_KERNEL);
+        err = tcp_transmit_skb(sk, buff, 1, sk->sk_allocation);
+        if (err == -ECONNREFUSED)
+                return err;
 
         /* We change tp->snd_nxt after the tcp_transmit_skb() call
          * in order to make this packet get counted in tcpOutSegs.
@@ -2372,6 +2647,7 @@ int tcp_connect(struct sock *sk)
                                   inet_csk(sk)->icsk_rto, TCP_RTO_MAX);
         return 0;
 }
+EXPORT_SYMBOL(tcp_connect);
 
 /* Send out a delayed ack, the caller does the policy checking
  * to see if we should even be here.  See tcp_input.c:tcp_ack_snd_check()
@@ -2453,7 +2729,7 @@ void tcp_send_ack(struct sock *sk)
 
         /* Reserve space for headers and prepare control bits. */
         skb_reserve(buff, MAX_TCP_HEADER);
-        tcp_init_nondata_skb(buff, tcp_acceptable_seq(sk), TCPCB_FLAG_ACK);
+        tcp_init_nondata_skb(buff, tcp_acceptable_seq(sk), TCPHDR_ACK);
 
         /* Send it off, this clears delayed acks for us. */
         TCP_SKB_CB(buff)->when = tcp_time_stamp;
@@ -2487,11 +2763,12 @@ static int tcp_xmit_probe_skb(struct sock *sk, int urgent)
          * end to send an ack.  Don't queue or clone SKB, just
          * send it.
          */
-        tcp_init_nondata_skb(skb, tp->snd_una - !urgent, TCPCB_FLAG_ACK);
+        tcp_init_nondata_skb(skb, tp->snd_una - !urgent, TCPHDR_ACK);
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
         return tcp_transmit_skb(sk, skb, 0, GFP_ATOMIC);
 }
 
+/* Initiate keepalive or window probe from timer. */
 int tcp_write_wakeup(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -2516,13 +2793,13 @@ int tcp_write_wakeup(struct sock *sk)
                 if (seg_size < TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq ||
                     skb->len > mss) {
                         seg_size = min(seg_size, mss);
-                        TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
+                        TCP_SKB_CB(skb)->flags |= TCPHDR_PSH;
                         if (tcp_fragment(sk, skb, seg_size, mss))
                                 return -1;
                 } else if (!tcp_skb_pcount(skb))
                         tcp_set_skb_tso_segs(sk, skb, mss);
 
-                TCP_SKB_CB(skb)->flags |= TCPCB_FLAG_PSH;
+                TCP_SKB_CB(skb)->flags |= TCPHDR_PSH;
                 TCP_SKB_CB(skb)->when = tcp_time_stamp;
                 err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
                 if (!err)
@@ -2575,10 +2852,3 @@ void tcp_send_probe0(struct sock *sk)
                                           TCP_RTO_MAX);
         }
 }
-
-EXPORT_SYMBOL(tcp_select_initial_window);
-EXPORT_SYMBOL(tcp_connect);
-EXPORT_SYMBOL(tcp_make_synack);
-EXPORT_SYMBOL(tcp_simple_retransmit);
-EXPORT_SYMBOL(tcp_sync_mss);
-EXPORT_SYMBOL(tcp_mtup_init);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 59f5b5e7c566..85ee7eb7e38e 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -22,6 +22,7 @@
 #include <linux/kprobes.h>
 #include <linux/socket.h>
 #include <linux/tcp.h>
+#include <linux/slab.h>
 #include <linux/proc_fs.h>
 #include <linux/module.h>
 #include <linux/ktime.h>
@@ -39,9 +40,9 @@ static int port __read_mostly = 0;
 MODULE_PARM_DESC(port, "Port to match (0=all)");
 module_param(port, int, 0);
 
-static int bufsize __read_mostly = 4096;
+static unsigned int bufsize __read_mostly = 4096;
 MODULE_PARM_DESC(bufsize, "Log buffer size in packets (4096)");
-module_param(bufsize, int, 0);
+module_param(bufsize, uint, 0);
 
 static int full __read_mostly;
 MODULE_PARM_DESC(full, "Full log (1=every ack packet received,  0=only cwnd changes)");
@@ -75,12 +76,12 @@ static struct {
 
 static inline int tcp_probe_used(void)
 {
-        return (tcp_probe.head - tcp_probe.tail) % bufsize;
+        return (tcp_probe.head - tcp_probe.tail) & (bufsize - 1);
 }
 
 static inline int tcp_probe_avail(void)
 {
-        return bufsize - tcp_probe_used();
+        return bufsize - tcp_probe_used() - 1;
 }
 
 /*
@@ -94,8 +95,9 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
         const struct inet_sock *inet = inet_sk(sk);
 
         /* Only update if port matches */
-        if ((port == 0 || ntohs(inet->dport) == port || ntohs(inet->sport) == port)
-            && (full || tp->snd_cwnd != tcp_probe.lastcwnd)) {
+        if ((port == 0 || ntohs(inet->inet_dport) == port ||
+             ntohs(inet->inet_sport) == port) &&
+            (full || tp->snd_cwnd != tcp_probe.lastcwnd)) {
 
                 spin_lock(&tcp_probe.lock);
                 /* If log fills, just silently drop */
@@ -103,10 +105,10 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         struct tcp_log *p = tcp_probe.log + tcp_probe.head;
 
                         p->tstamp = ktime_get();
-                        p->saddr = inet->saddr;
-                        p->sport = inet->sport;
-                        p->daddr = inet->daddr;
-                        p->dport = inet->dport;
+                        p->saddr = inet->inet_saddr;
+                        p->sport = inet->inet_sport;
+                        p->daddr = inet->inet_daddr;
+                        p->dport = inet->inet_dport;
                         p->length = skb->len;
                         p->snd_nxt = tp->snd_nxt;
                         p->snd_una = tp->snd_una;
@@ -115,7 +117,7 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         p->ssthresh = tcp_current_ssthresh(sk);
                         p->srtt = tp->srtt >> 3;
 
-                        tcp_probe.head = (tcp_probe.head + 1) % bufsize;
+                        tcp_probe.head = (tcp_probe.head + 1) & (bufsize - 1);
                 }
                 tcp_probe.lastcwnd = tp->snd_cwnd;
                 spin_unlock(&tcp_probe.lock);
@@ -148,11 +150,11 @@ static int tcpprobe_open(struct inode * inode, struct file * file)
 static int tcpprobe_sprint(char *tbuf, int n)
 {
         const struct tcp_log *p
-                = tcp_probe.log + tcp_probe.tail % bufsize;
+                = tcp_probe.log + tcp_probe.tail;
         struct timespec tv
                 = ktime_to_timespec(ktime_sub(p->tstamp, tcp_probe.start));
 
-        return snprintf(tbuf, n,
+        return scnprintf(tbuf, n,
                         "%lu.%09lu %pI4:%u %pI4:%u %d %#x %#x %u %u %u %u\n",
                         (unsigned long) tv.tv_sec,
                         (unsigned long) tv.tv_nsec,
@@ -172,7 +174,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
                 return -EINVAL;
 
         while (cnt < len) {
-                char tbuf[128];
+                char tbuf[164];
                 int width;
 
                 /* Wait for data in buffer */
@@ -191,7 +193,7 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
                 width = tcpprobe_sprint(tbuf, sizeof(tbuf));
 
                 if (cnt + width < len)
-                        tcp_probe.tail = (tcp_probe.tail + 1) % bufsize;
+                        tcp_probe.tail = (tcp_probe.tail + 1) & (bufsize - 1);
 
                 spin_unlock_bh(&tcp_probe.lock);
 
@@ -212,6 +214,7 @@ static const struct file_operations tcpprobe_fops = {
         .owner   = THIS_MODULE,
         .open    = tcpprobe_open,
         .read    = tcpprobe_read,
+        .llseek  = noop_llseek,
 };
 
 static __init int tcpprobe_init(void)
@@ -221,9 +224,10 @@ static __init int tcpprobe_init(void)
         init_waitqueue_head(&tcp_probe.wait);
         spin_lock_init(&tcp_probe.lock);
 
-        if (bufsize < 0)
+        if (bufsize == 0)
                 return -EINVAL;
 
+        bufsize = roundup_pow_of_two(bufsize);
         tcp_probe.log = kcalloc(bufsize, sizeof(struct tcp_log), GFP_KERNEL);
         if (!tcp_probe.log)
                 goto err0;
@@ -235,7 +239,7 @@ static __init int tcpprobe_init(void)
         if (ret)
                 goto err1;
 
-        pr_info("TCP probe registered (port=%d)\n", port);
+        pr_info("TCP probe registered (port=%d) bufsize=%u\n", port, bufsize);
         return 0;
  err1:
         proc_net_remove(&init_net, procname);
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index b144a26359bc..74a6aa003657 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -19,6 +19,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/gfp.h>
 #include <net/tcp.h>
 
 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
@@ -29,6 +30,7 @@ int sysctl_tcp_keepalive_intvl __read_mostly = TCP_KEEPALIVE_INTVL;
 int sysctl_tcp_retries1 __read_mostly = TCP_RETR1;
 int sysctl_tcp_retries2 __read_mostly = TCP_RETR2;
 int sysctl_tcp_orphan_retries __read_mostly;
+int sysctl_tcp_thin_linear_timeouts __read_mostly;
 
 static void tcp_write_timer(unsigned long);
 static void tcp_delack_timer(unsigned long);
@@ -39,7 +41,6 @@ void tcp_init_xmit_timers(struct sock *sk)
         inet_csk_init_xmit_timers(sk, &tcp_write_timer, &tcp_delack_timer,
                                   &tcp_keepalive_timer);
 }
-
 EXPORT_SYMBOL(tcp_init_xmit_timers);
 
 static void tcp_write_err(struct sock *sk)
@@ -65,18 +66,18 @@ static void tcp_write_err(struct sock *sk)
 static int tcp_out_of_resources(struct sock *sk, int do_reset)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        int orphans = percpu_counter_read_positive(&tcp_orphan_count);
+        int shift = 0;
 
         /* If peer does not open window for long time, or did not transmit
          * anything for long time, penalize it. */
         if ((s32)(tcp_time_stamp - tp->lsndtime) > 2*TCP_RTO_MAX || !do_reset)
-                orphans <<= 1;
+                shift++;
 
         /* If some dubious ICMP arrived, penalize even more. */
         if (sk->sk_err_soft)
-                orphans <<= 1;
+                shift++;
 
-        if (tcp_too_many_orphans(sk, orphans)) {
+        if (tcp_too_many_orphans(sk, shift)) {
                 if (net_ratelimit())
                         printk(KERN_INFO "Out of socket memory\n");
 
@@ -132,22 +133,57 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
         }
 }
 
+/* This function calculates a "timeout" which is equivalent to the timeout of a
+ * TCP connection after "boundary" unsuccessful, exponentially backed-off
+ * retransmissions with an initial RTO of TCP_RTO_MIN or TCP_TIMEOUT_INIT if
+ * syn_set flag is set.
+ */
+static bool retransmits_timed_out(struct sock *sk,
+                                  unsigned int boundary,
+                                  unsigned int timeout,
+                                  bool syn_set)
+{
+        unsigned int linear_backoff_thresh, start_ts;
+        unsigned int rto_base = syn_set ? TCP_TIMEOUT_INIT : TCP_RTO_MIN;
+
+        if (!inet_csk(sk)->icsk_retransmits)
+                return false;
+
+        if (unlikely(!tcp_sk(sk)->retrans_stamp))
+                start_ts = TCP_SKB_CB(tcp_write_queue_head(sk))->when;
+        else
+                start_ts = tcp_sk(sk)->retrans_stamp;
+
+        if (likely(timeout == 0)) {
+                linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
+
+                if (boundary <= linear_backoff_thresh)
+                        timeout = ((2 << boundary) - 1) * rto_base;
+                else
+                        timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
+                                (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
+        }
+        return (tcp_time_stamp - start_ts) >= timeout;
+}
+
 /* A write timeout has occurred. Process the after effects. */
 static int tcp_write_timeout(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         int retry_until;
+        bool do_reset, syn_set = 0;
 
         if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 if (icsk->icsk_retransmits)
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(sk);
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
+                syn_set = 1;
         } else {
-                if (icsk->icsk_retransmits >= sysctl_tcp_retries1) {
+                if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0, 0)) {
                         /* Black hole detection */
                         tcp_mtu_probing(icsk, sk);
 
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(sk);
                 }
 
                 retry_until = sysctl_tcp_retries2;
@@ -155,13 +191,16 @@ static int tcp_write_timeout(struct sock *sk)
                         const int alive = (icsk->icsk_rto < TCP_RTO_MAX);
 
                         retry_until = tcp_orphan_retries(sk, alive);
+                        do_reset = alive ||
+                                !retransmits_timed_out(sk, retry_until, 0, 0);
 
-                        if (tcp_out_of_resources(sk, alive || icsk->icsk_retransmits < retry_until))
+                        if (tcp_out_of_resources(sk, do_reset))
                                 return 1;
                 }
         }
 
-        if (icsk->icsk_retransmits >= retry_until) {
+        if (retransmits_timed_out(sk, retry_until,
+                                  syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
                 /* Has it gone just too far? */
                 tcp_write_err(sk);
                 return 1;
@@ -279,7 +318,7 @@ static void tcp_probe_timer(struct sock *sk)
  *      The TCP retransmit timer.
  */
 
-static void tcp_retransmit_timer(struct sock *sk)
+void tcp_retransmit_timer(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
@@ -300,15 +339,15 @@ static void tcp_retransmit_timer(struct sock *sk)
                 struct inet_sock *inet = inet_sk(sk);
                 if (sk->sk_family == AF_INET) {
                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI4:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &inet->daddr, ntohs(inet->dport),
-                               inet->num, tp->snd_una, tp->snd_nxt);
+                               &inet->inet_daddr, ntohs(inet->inet_dport),
+                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                 }
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (sk->sk_family == AF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI6:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &np->daddr, ntohs(inet->dport),
-                               inet->num, tp->snd_una, tp->snd_nxt);
+                               &np->daddr, ntohs(inet->inet_dport),
+                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                 }
 #endif
 #endif
@@ -328,18 +367,19 @@ static void tcp_retransmit_timer(struct sock *sk)
         if (icsk->icsk_retransmits == 0) {
                 int mib_idx;
 
-                if (icsk->icsk_ca_state == TCP_CA_Disorder) {
-                        if (tcp_is_sack(tp))
-                                mib_idx = LINUX_MIB_TCPSACKFAILURES;
-                        else
-                                mib_idx = LINUX_MIB_TCPRENOFAILURES;
-                } else if (icsk->icsk_ca_state == TCP_CA_Recovery) {
+                if (icsk->icsk_ca_state == TCP_CA_Recovery) {
                         if (tcp_is_sack(tp))
                                 mib_idx = LINUX_MIB_TCPSACKRECOVERYFAIL;
                         else
                                 mib_idx = LINUX_MIB_TCPRENORECOVERYFAIL;
                 } else if (icsk->icsk_ca_state == TCP_CA_Loss) {
                         mib_idx = LINUX_MIB_TCPLOSSFAILURES;
+                } else if ((icsk->icsk_ca_state == TCP_CA_Disorder) ||
+                           tp->sacked_out) {
+                        if (tcp_is_sack(tp))
+                                mib_idx = LINUX_MIB_TCPSACKFAILURES;
+                        else
+                                mib_idx = LINUX_MIB_TCPRENOFAILURES;
                 } else {
                         mib_idx = LINUX_MIB_TCPTIMEOUTS;
                 }
@@ -383,9 +423,27 @@ static void tcp_retransmit_timer(struct sock *sk)
         icsk->icsk_retransmits++;
 
 out_reset_timer:
-        icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
+        /* If stream is thin, use linear timeouts. Since 'icsk_backoff' is
+         * used to reset timer, set to 0. Recalculate 'icsk_rto' as this
+         * might be increased if the stream oscillates between thin and thick,
+         * thus the old value might already be too high compared to the value
+         * set by 'tcp_set_rto' in tcp_input.c which resets the rto without
+         * backoff. Limit to TCP_THIN_LINEAR_RETRIES before initiating
+         * exponential backoff behaviour to avoid continue hammering
+         * linear-timeout retransmissions into a black hole
+         */
+        if (sk->sk_state == TCP_ESTABLISHED &&
+            (tp->thin_lto || sysctl_tcp_thin_linear_timeouts) &&
+            tcp_stream_is_thin(tp) &&
+            icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) {
+                icsk->icsk_backoff = 0;
+                icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX);
+        } else {
+                /* Use normal (exponential) backoff */
+                icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
+        }
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-        if (icsk->icsk_retransmits > sysctl_tcp_retries1)
+        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0, 0))
                 __sk_dst_reset(sk);
 
 out:;
@@ -442,6 +500,12 @@ static void tcp_synack_timer(struct sock *sk)
                                    TCP_TIMEOUT_INIT, TCP_RTO_MAX);
 }
 
+void tcp_syn_ack_timeout(struct sock *sk, struct request_sock *req)
+{
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEOUTS);
+}
+EXPORT_SYMBOL(tcp_syn_ack_timeout);
+
 void tcp_set_keepalive(struct sock *sk, int val)
 {
         if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
@@ -459,7 +523,7 @@ static void tcp_keepalive_timer (unsigned long data)
         struct sock *sk = (struct sock *) data;
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        __u32 elapsed;
+        u32 elapsed;
 
         /* Only process if socket is not in use. */
         bh_lock_sock(sk);
@@ -496,11 +560,17 @@ static void tcp_keepalive_timer (unsigned long data)
         if (tp->packets_out || tcp_send_head(sk))
                 goto resched;
 
-        elapsed = tcp_time_stamp - tp->rcv_tstamp;
+        elapsed = keepalive_time_elapsed(tp);
 
         if (elapsed >= keepalive_time_when(tp)) {
-                if ((!tp->keepalive_probes && icsk->icsk_probes_out >= sysctl_tcp_keepalive_probes) ||
-                     (tp->keepalive_probes && icsk->icsk_probes_out >= tp->keepalive_probes)) {
+                /* If the TCP_USER_TIMEOUT option is enabled, use that
+                 * to determine when to timeout instead.
+                 */
+                if ((icsk->icsk_user_timeout != 0 &&
+                    elapsed >= icsk->icsk_user_timeout &&
+                    icsk->icsk_probes_out > 0) ||
+                    (icsk->icsk_user_timeout == 0 &&
+                    icsk->icsk_probes_out >= keepalive_probes(tp))) {
                         tcp_send_active_reset(sk, GFP_ATOMIC);
                         tcp_write_err(sk);
                         goto out;
diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
index e9bbff746488..38bc0b52d745 100644
--- a/net/ipv4/tcp_veno.c
+++ b/net/ipv4/tcp_veno.c
@@ -6,7 +6,7 @@
  *    "TCP Veno: TCP Enhancement for Transmission over Wireless Access Networks."
  *    IEEE Journal on Selected Areas in Communication,
  *    Feb. 2003.
- *      See http://www.ntu.edu.sg/home5/ZHOU0022/papers/CPFu03a.pdf
+ *      See http://www.ie.cuhk.edu.hk/fileadmin/staff_upload/soung/Journal/J3.pdf
  */
 
 #include <linux/mm.h>
@@ -165,9 +165,8 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
                                  * every other rtt.
                                  */
                                 if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
-                                        if (veno->inc
-                                            && tp->snd_cwnd <
-                                            tp->snd_cwnd_clamp) {
+                                        if (veno->inc &&
+                                            tp->snd_cwnd < tp->snd_cwnd_clamp) {
                                                 tp->snd_cwnd++;
                                                 veno->inc = 0;
                                         } else
diff --git a/net/ipv4/tcp_westwood.c b/net/ipv4/tcp_westwood.c
index 20151d6a6241..a534dda5456e 100644
--- a/net/ipv4/tcp_westwood.c
+++ b/net/ipv4/tcp_westwood.c
@@ -80,7 +80,7 @@ static void tcp_westwood_init(struct sock *sk)
  */
 static inline u32 westwood_do_filter(u32 a, u32 b)
 {
-        return (((7 * a) + b) >> 3);
+        return ((7 * a) + b) >> 3;
 }
 
 static void westwood_filter(struct westwood *w, u32 delta)
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index 66b6821b984e..a0f240358892 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -157,8 +157,8 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
 
                         if (queue > TCP_YEAH_ALPHA ||
                             rtt - yeah->vegas.baseRTT > (yeah->vegas.baseRTT / TCP_YEAH_PHY)) {
-                                if (queue > TCP_YEAH_ALPHA
-                                    && tp->snd_cwnd > yeah->reno_count) {
+                                if (queue > TCP_YEAH_ALPHA &&
+                                    tp->snd_cwnd > yeah->reno_count) {
                                         u32 reduction = min(queue / TCP_YEAH_GAMMA ,
                                                             tp->snd_cwnd >> TCP_YEAH_EPSILON);
 
diff --git a/net/ipv4/tunnel4.c b/net/ipv4/tunnel4.c
index cb1f0e83830b..ac3b3ee4b07c 100644
--- a/net/ipv4/tunnel4.c
+++ b/net/ipv4/tunnel4.c
@@ -8,37 +8,43 @@
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/icmp.h>
 #include <net/ip.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
-static struct xfrm_tunnel *tunnel4_handlers;
-static struct xfrm_tunnel *tunnel64_handlers;
+static struct xfrm_tunnel __rcu *tunnel4_handlers __read_mostly;
+static struct xfrm_tunnel __rcu *tunnel64_handlers __read_mostly;
 static DEFINE_MUTEX(tunnel4_mutex);
 
-static inline struct xfrm_tunnel **fam_handlers(unsigned short family)
+static inline struct xfrm_tunnel __rcu **fam_handlers(unsigned short family)
 {
         return (family == AF_INET) ? &tunnel4_handlers : &tunnel64_handlers;
 }
 
 int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family)
 {
-        struct xfrm_tunnel **pprev;
+        struct xfrm_tunnel __rcu **pprev;
+        struct xfrm_tunnel *t;
+
         int ret = -EEXIST;
         int priority = handler->priority;
 
         mutex_lock(&tunnel4_mutex);
 
-        for (pprev = fam_handlers(family); *pprev; pprev = &(*pprev)->next) {
-                if ((*pprev)->priority > priority)
+        for (pprev = fam_handlers(family);
+             (t = rcu_dereference_protected(*pprev,
+                        lockdep_is_held(&tunnel4_mutex))) != NULL;
+             pprev = &t->next) {
+                if (t->priority > priority)
                         break;
-                if ((*pprev)->priority == priority)
+                if (t->priority == priority)
                         goto err;
         }
 
         handler->next = *pprev;
-        *pprev = handler;
+        rcu_assign_pointer(*pprev, handler);
 
         ret = 0;
 
@@ -47,18 +53,21 @@ err:
 
         return ret;
 }
-
 EXPORT_SYMBOL(xfrm4_tunnel_register);
 
 int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family)
 {
-        struct xfrm_tunnel **pprev;
+        struct xfrm_tunnel __rcu **pprev;
+        struct xfrm_tunnel *t;
         int ret = -ENOENT;
 
         mutex_lock(&tunnel4_mutex);
 
-        for (pprev = fam_handlers(family); *pprev; pprev = &(*pprev)->next) {
-                if (*pprev == handler) {
+        for (pprev = fam_handlers(family);
+             (t = rcu_dereference_protected(*pprev,
+                        lockdep_is_held(&tunnel4_mutex))) != NULL;
+             pprev = &t->next) {
+                if (t == handler) {
                         *pprev = handler->next;
                         ret = 0;
                         break;
@@ -71,9 +80,13 @@ int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family)
 
         return ret;
 }
-
 EXPORT_SYMBOL(xfrm4_tunnel_deregister);
 
+#define for_each_tunnel_rcu(head, handler)              \
+        for (handler = rcu_dereference(head);           \
+             handler != NULL;                           \
+             handler = rcu_dereference(handler->next))  \
+        
 static int tunnel4_rcv(struct sk_buff *skb)
 {
         struct xfrm_tunnel *handler;
@@ -81,7 +94,7 @@ static int tunnel4_rcv(struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                 goto drop;
 
-        for (handler = tunnel4_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel4_handlers, handler)
                 if (!handler->handler(skb))
                         return 0;
 
@@ -100,7 +113,7 @@ static int tunnel64_rcv(struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                 goto drop;
 
-        for (handler = tunnel64_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel64_handlers, handler)
                 if (!handler->handler(skb))
                         return 0;
 
@@ -116,7 +129,7 @@ static void tunnel4_err(struct sk_buff *skb, u32 info)
 {
         struct xfrm_tunnel *handler;
 
-        for (handler = tunnel4_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel4_handlers, handler)
                 if (!handler->err_handler(skb, info))
                         break;
 }
@@ -126,13 +139,13 @@ static void tunnel64_err(struct sk_buff *skb, u32 info)
 {
         struct xfrm_tunnel *handler;
 
-        for (handler = tunnel64_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel64_handlers, handler)
                 if (!handler->err_handler(skb, info))
                         break;
 }
 #endif
 
-static struct net_protocol tunnel4_protocol = {
+static const struct net_protocol tunnel4_protocol = {
         .handler        =       tunnel4_rcv,
         .err_handler    =       tunnel4_err,
         .no_policy      =       1,
@@ -140,7 +153,7 @@ static struct net_protocol tunnel4_protocol = {
 };
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-static struct net_protocol tunnel64_protocol = {
+static const struct net_protocol tunnel64_protocol = {
         .handler        =       tunnel64_rcv,
         .err_handler    =       tunnel64_err,
         .no_policy      =       1,
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 80e3812837ad..8157b17959ee 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -95,6 +95,7 @@
 #include <linux/mm.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <net/tcp_states.h>
 #include <linux/skbuff.h>
 #include <linux/proc_fs.h>
@@ -106,42 +107,45 @@
 #include <net/xfrm.h>
 #include "udp_impl.h"
 
-struct udp_table udp_table;
+struct udp_table udp_table __read_mostly;
 EXPORT_SYMBOL(udp_table);
 
-int sysctl_udp_mem[3] __read_mostly;
-int sysctl_udp_rmem_min __read_mostly;
-int sysctl_udp_wmem_min __read_mostly;
-
+long sysctl_udp_mem[3] __read_mostly;
 EXPORT_SYMBOL(sysctl_udp_mem);
+
+int sysctl_udp_rmem_min __read_mostly;
 EXPORT_SYMBOL(sysctl_udp_rmem_min);
+
+int sysctl_udp_wmem_min __read_mostly;
 EXPORT_SYMBOL(sysctl_udp_wmem_min);
 
-atomic_t udp_memory_allocated;
+atomic_long_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
 
-#define PORTS_PER_CHAIN (65536 / UDP_HTABLE_SIZE)
+#define MAX_UDP_PORTS 65536
+#define PORTS_PER_CHAIN (MAX_UDP_PORTS / UDP_HTABLE_SIZE_MIN)
 
 static int udp_lib_lport_inuse(struct net *net, __u16 num,
                                const struct udp_hslot *hslot,
                                unsigned long *bitmap,
                                struct sock *sk,
                                int (*saddr_comp)(const struct sock *sk1,
-                                                 const struct sock *sk2))
+                                                 const struct sock *sk2),
+                               unsigned int log)
 {
         struct sock *sk2;
         struct hlist_nulls_node *node;
 
         sk_nulls_for_each(sk2, node, &hslot->head)
-                if (net_eq(sock_net(sk2), net)                  &&
-                    sk2 != sk                                   &&
-                    (bitmap || sk2->sk_hash == num)             &&
-                    (!sk2->sk_reuse || !sk->sk_reuse)           &&
-                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
-                        || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
+                if (net_eq(sock_net(sk2), net) &&
+                    sk2 != sk &&
+                    (bitmap || udp_sk(sk2)->udp_port_hash == num) &&
+                    (!sk2->sk_reuse || !sk->sk_reuse) &&
+                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if ||
+                     sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
                     (*saddr_comp)(sk, sk2)) {
                         if (bitmap)
-                                __set_bit(sk2->sk_hash / UDP_HTABLE_SIZE,
+                                __set_bit(udp_sk(sk2)->udp_port_hash >> log,
                                           bitmap);
                         else
                                 return 1;
@@ -149,18 +153,51 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
         return 0;
 }
 
+/*
+ * Note: we still hold spinlock of primary hash chain, so no other writer
+ * can insert/delete a socket with local_port == num
+ */
+static int udp_lib_lport_inuse2(struct net *net, __u16 num,
+                               struct udp_hslot *hslot2,
+                               struct sock *sk,
+                               int (*saddr_comp)(const struct sock *sk1,
+                                                 const struct sock *sk2))
+{
+        struct sock *sk2;
+        struct hlist_nulls_node *node;
+        int res = 0;
+
+        spin_lock(&hslot2->lock);
+        udp_portaddr_for_each_entry(sk2, node, &hslot2->head)
+                if (net_eq(sock_net(sk2), net) &&
+                    sk2 != sk &&
+                    (udp_sk(sk2)->udp_port_hash == num) &&
+                    (!sk2->sk_reuse || !sk->sk_reuse) &&
+                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if ||
+                     sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
+                    (*saddr_comp)(sk, sk2)) {
+                        res = 1;
+                        break;
+                }
+        spin_unlock(&hslot2->lock);
+        return res;
+}
+
 /**
  *  udp_lib_get_port  -  UDP/-Lite port lookup for IPv4 and IPv6
  *
  *  @sk:          socket struct in question
  *  @snum:        port number to look up
  *  @saddr_comp:  AF-dependent comparison of bound local IP addresses
+ *  @hash2_nulladdr: AF-dependant hash value in secondary hash chains,
+ *                   with NULL address
  */
 int udp_lib_get_port(struct sock *sk, unsigned short snum,
                        int (*saddr_comp)(const struct sock *sk1,
-                                         const struct sock *sk2 )    )
+                                         const struct sock *sk2),
+                     unsigned int hash2_nulladdr)
 {
-        struct udp_hslot *hslot;
+        struct udp_hslot *hslot, *hslot2;
         struct udp_table *udptable = sk->sk_prot->h.udp_table;
         int    error = 1;
         struct net *net = sock_net(sk);
@@ -179,13 +216,14 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 /*
                  * force rand to be an odd multiple of UDP_HTABLE_SIZE
                  */
-                rand = (rand | 1) * UDP_HTABLE_SIZE;
-                for (last = first + UDP_HTABLE_SIZE; first != last; first++) {
-                        hslot = &udptable->hash[udp_hashfn(net, first)];
+                rand = (rand | 1) * (udptable->mask + 1);
+                last = first + udptable->mask + 1;
+                do {
+                        hslot = udp_hashslot(udptable, net, first);
                         bitmap_zero(bitmap, PORTS_PER_CHAIN);
                         spin_lock_bh(&hslot->lock);
                         udp_lib_lport_inuse(net, snum, hslot, bitmap, sk,
-                                            saddr_comp);
+                                            saddr_comp, udptable->log);
 
                         snum = first;
                         /*
@@ -195,25 +233,60 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                          */
                         do {
                                 if (low <= snum && snum <= high &&
-                                    !test_bit(snum / UDP_HTABLE_SIZE, bitmap))
+                                    !test_bit(snum >> udptable->log, bitmap) &&
+                                    !inet_is_reserved_local_port(snum))
                                         goto found;
                                 snum += rand;
                         } while (snum != first);
                         spin_unlock_bh(&hslot->lock);
-                }
+                } while (++first != last);
                 goto fail;
         } else {
-                hslot = &udptable->hash[udp_hashfn(net, snum)];
+                hslot = udp_hashslot(udptable, net, snum);
                 spin_lock_bh(&hslot->lock);
-                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk, saddr_comp))
+                if (hslot->count > 10) {
+                        int exist;
+                        unsigned int slot2 = udp_sk(sk)->udp_portaddr_hash ^ snum;
+
+                        slot2          &= udptable->mask;
+                        hash2_nulladdr &= udptable->mask;
+
+                        hslot2 = udp_hashslot2(udptable, slot2);
+                        if (hslot->count < hslot2->count)
+                                goto scan_primary_hash;
+
+                        exist = udp_lib_lport_inuse2(net, snum, hslot2,
+                                                     sk, saddr_comp);
+                        if (!exist && (hash2_nulladdr != slot2)) {
+                                hslot2 = udp_hashslot2(udptable, hash2_nulladdr);
+                                exist = udp_lib_lport_inuse2(net, snum, hslot2,
+                                                             sk, saddr_comp);
+                        }
+                        if (exist)
+                                goto fail_unlock;
+                        else
+                                goto found;
+                }
+scan_primary_hash:
+                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk,
+                                        saddr_comp, 0))
                         goto fail_unlock;
         }
 found:
-        inet_sk(sk)->num = snum;
-        sk->sk_hash = snum;
+        inet_sk(sk)->inet_num = snum;
+        udp_sk(sk)->udp_port_hash = snum;
+        udp_sk(sk)->udp_portaddr_hash ^= snum;
         if (sk_unhashed(sk)) {
                 sk_nulls_add_node_rcu(sk, &hslot->head);
+                hslot->count++;
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+
+                hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
+                spin_lock(&hslot2->lock);
+                hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
+                                         &hslot2->head);
+                hslot2->count++;
+                spin_unlock(&hslot2->lock);
         }
         error = 0;
 fail_unlock:
@@ -221,19 +294,33 @@ fail_unlock:
 fail:
         return error;
 }
+EXPORT_SYMBOL(udp_lib_get_port);
 
 static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
 {
         struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
 
-        return  ( !ipv6_only_sock(sk2)  &&
-                  (!inet1->rcv_saddr || !inet2->rcv_saddr ||
-                   inet1->rcv_saddr == inet2->rcv_saddr      ));
+        return  (!ipv6_only_sock(sk2)  &&
+                 (!inet1->inet_rcv_saddr || !inet2->inet_rcv_saddr ||
+                   inet1->inet_rcv_saddr == inet2->inet_rcv_saddr));
+}
+
+static unsigned int udp4_portaddr_hash(struct net *net, __be32 saddr,
+                                       unsigned int port)
+{
+        return jhash_1word((__force u32)saddr, net_hash_mix(net)) ^ port;
 }
 
 int udp_v4_get_port(struct sock *sk, unsigned short snum)
 {
-        return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal);
+        unsigned int hash2_nulladdr =
+                udp4_portaddr_hash(sock_net(sk), htonl(INADDR_ANY), snum);
+        unsigned int hash2_partial =
+                udp4_portaddr_hash(sock_net(sk), inet_sk(sk)->inet_rcv_saddr, 0);
+
+        /* precompute partial secondary hash */
+        udp_sk(sk)->udp_portaddr_hash = hash2_partial;
+        return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal, hash2_nulladdr);
 }
 
 static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
@@ -242,23 +329,23 @@ static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
 {
         int score = -1;
 
-        if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
+        if (net_eq(sock_net(sk), net) && udp_sk(sk)->udp_port_hash == hnum &&
                         !ipv6_only_sock(sk)) {
                 struct inet_sock *inet = inet_sk(sk);
 
                 score = (sk->sk_family == PF_INET ? 1 : 0);
-                if (inet->rcv_saddr) {
-                        if (inet->rcv_saddr != daddr)
+                if (inet->inet_rcv_saddr) {
+                        if (inet->inet_rcv_saddr != daddr)
                                 return -1;
                         score += 2;
                 }
-                if (inet->daddr) {
-                        if (inet->daddr != saddr)
+                if (inet->inet_daddr) {
+                        if (inet->inet_daddr != saddr)
                                 return -1;
                         score += 2;
                 }
-                if (inet->dport) {
-                        if (inet->dport != sport)
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
                                 return -1;
                         score += 2;
                 }
@@ -271,6 +358,89 @@ static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
         return score;
 }
 
+/*
+ * In this second variant, we check (daddr, dport) matches (inet_rcv_sadd, inet_num)
+ */
+#define SCORE2_MAX (1 + 2 + 2 + 2)
+static inline int compute_score2(struct sock *sk, struct net *net,
+                                 __be32 saddr, __be16 sport,
+                                 __be32 daddr, unsigned int hnum, int dif)
+{
+        int score = -1;
+
+        if (net_eq(sock_net(sk), net) && !ipv6_only_sock(sk)) {
+                struct inet_sock *inet = inet_sk(sk);
+
+                if (inet->inet_rcv_saddr != daddr)
+                        return -1;
+                if (inet->inet_num != hnum)
+                        return -1;
+
+                score = (sk->sk_family == PF_INET ? 1 : 0);
+                if (inet->inet_daddr) {
+                        if (inet->inet_daddr != saddr)
+                                return -1;
+                        score += 2;
+                }
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
+                                return -1;
+                        score += 2;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
+                                return -1;
+                        score += 2;
+                }
+        }
+        return score;
+}
+
+
+/* called with read_rcu_lock() */
+static struct sock *udp4_lib_lookup2(struct net *net,
+                __be32 saddr, __be16 sport,
+                __be32 daddr, unsigned int hnum, int dif,
+                struct udp_hslot *hslot2, unsigned int slot2)
+{
+        struct sock *sk, *result;
+        struct hlist_nulls_node *node;
+        int score, badness;
+
+begin:
+        result = NULL;
+        badness = -1;
+        udp_portaddr_for_each_entry_rcu(sk, node, &hslot2->head) {
+                score = compute_score2(sk, net, saddr, sport,
+                                      daddr, hnum, dif);
+                if (score > badness) {
+                        result = sk;
+                        badness = score;
+                        if (score == SCORE2_MAX)
+                                goto exact_match;
+                }
+        }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != slot2)
+                goto begin;
+
+        if (result) {
+exact_match:
+                if (unlikely(!atomic_inc_not_zero_hint(&result->sk_refcnt, 2)))
+                        result = NULL;
+                else if (unlikely(compute_score2(result, net, saddr, sport,
+                                  daddr, hnum, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
+                }
+        }
+        return result;
+}
+
 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
  * harder than this. -DaveM
  */
@@ -281,11 +451,35 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
         struct sock *sk, *result;
         struct hlist_nulls_node *node;
         unsigned short hnum = ntohs(dport);
-        unsigned int hash = udp_hashfn(net, hnum);
-        struct udp_hslot *hslot = &udptable->hash[hash];
+        unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
+        struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
         int score, badness;
 
         rcu_read_lock();
+        if (hslot->count > 10) {
+                hash2 = udp4_portaddr_hash(net, daddr, hnum);
+                slot2 = hash2 & udptable->mask;
+                hslot2 = &udptable->hash2[slot2];
+                if (hslot->count < hslot2->count)
+                        goto begin;
+
+                result = udp4_lib_lookup2(net, saddr, sport,
+                                          daddr, hnum, dif,
+                                          hslot2, slot2);
+                if (!result) {
+                        hash2 = udp4_portaddr_hash(net, htonl(INADDR_ANY), hnum);
+                        slot2 = hash2 & udptable->mask;
+                        hslot2 = &udptable->hash2[slot2];
+                        if (hslot->count < hslot2->count)
+                                goto begin;
+
+                        result = udp4_lib_lookup2(net, saddr, sport,
+                                                  htonl(INADDR_ANY), hnum, dif,
+                                                  hslot2, slot2);
+                }
+                rcu_read_unlock();
+                return result;
+        }
 begin:
         result = NULL;
         badness = -1;
@@ -302,11 +496,11 @@ begin:
          * not the expected one, we must restart lookup.
          * We probably met an item that was moved to another chain.
          */
-        if (get_nulls_value(node) != hash)
+        if (get_nulls_value(node) != slot)
                 goto begin;
 
         if (result) {
-                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                if (unlikely(!atomic_inc_not_zero_hint(&result->sk_refcnt, 2)))
                         result = NULL;
                 else if (unlikely(compute_score(result, net, saddr, hnum, sport,
                                   daddr, dport, dif) < badness)) {
@@ -352,12 +546,13 @@ static inline struct sock *udp_v4_mcast_next(struct net *net, struct sock *sk,
         sk_nulls_for_each_from(s, node) {
                 struct inet_sock *inet = inet_sk(s);
 
-                if (!net_eq(sock_net(s), net)                           ||
-                    s->sk_hash != hnum                                  ||
-                    (inet->daddr && inet->daddr != rmt_addr)            ||
-                    (inet->dport != rmt_port && inet->dport)            ||
-                    (inet->rcv_saddr && inet->rcv_saddr != loc_addr)    ||
-                    ipv6_only_sock(s)                                   ||
+                if (!net_eq(sock_net(s), net) ||
+                    udp_sk(s)->udp_port_hash != hnum ||
+                    (inet->inet_daddr && inet->inet_daddr != rmt_addr) ||
+                    (inet->inet_dport != rmt_port && inet->inet_dport) ||
+                    (inet->inet_rcv_saddr &&
+                     inet->inet_rcv_saddr != loc_addr) ||
+                    ipv6_only_sock(s) ||
                     (s->sk_bound_dev_if && s->sk_bound_dev_if != dif))
                         continue;
                 if (!ip_mc_sf_allow(s, loc_addr, rmt_addr, dif))
@@ -383,8 +578,8 @@ found:
 void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
 {
         struct inet_sock *inet;
-        struct iphdr *iph = (struct iphdr*)skb->data;
-        struct udphdr *uh = (struct udphdr*)(skb->data+(iph->ihl<<2));
+        struct iphdr *iph = (struct iphdr *)skb->data;
+        struct udphdr *uh = (struct udphdr *)(skb->data+(iph->ihl<<2));
         const int type = icmp_hdr(skb)->type;
         const int code = icmp_hdr(skb)->code;
         struct sock *sk;
@@ -438,9 +633,9 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
         if (!inet->recverr) {
                 if (!harderr || sk->sk_state != TCP_ESTABLISHED)
                         goto out;
-        } else {
-                ip_icmp_error(sk, skb, err, uh->dest, info, (u8*)(uh+1));
-        }
+        } else
+                ip_icmp_error(sk, skb, err, uh->dest, info, (u8 *)(uh+1));
+
         sk->sk_err = err;
         sk->sk_error_report(sk);
 out:
@@ -474,7 +669,7 @@ EXPORT_SYMBOL(udp_flush_pending_frames);
  *              (checksum field must be zeroed out)
  */
 static void udp4_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
-                                 __be32 src, __be32 dst, int len      )
+                                 __be32 src, __be32 dst, int len)
 {
         unsigned int offset;
         struct udphdr *uh = udp_hdr(skb);
@@ -545,7 +740,7 @@ static int udp_push_pending_frames(struct sock *sk)
 
         } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
 
-                udp4_hwcsum_outgoing(sk, skb, fl->fl4_src,fl->fl4_dst, up->len);
+                udp4_hwcsum_outgoing(sk, skb, fl->fl4_src, fl->fl4_dst, up->len);
                 goto send;
 
         } else                                           /*   `normal' UDP    */
@@ -553,18 +748,24 @@ static int udp_push_pending_frames(struct sock *sk)
 
         /* add protocol-dependent pseudo-header */
         uh->check = csum_tcpudp_magic(fl->fl4_src, fl->fl4_dst, up->len,
-                                      sk->sk_protocol, csum             );
+                                      sk->sk_protocol, csum);
         if (uh->check == 0)
                 uh->check = CSUM_MANGLED_0;
 
 send:
         err = ip_push_pending_frames(sk);
+        if (err) {
+                if (err == -ENOBUFS && !inet->recverr) {
+                        UDP_INC_STATS_USER(sock_net(sk),
+                                           UDP_MIB_SNDBUFERRORS, is_udplite);
+                        err = 0;
+                }
+        } else
+                UDP_INC_STATS_USER(sock_net(sk),
+                                   UDP_MIB_OUTDATAGRAMS, is_udplite);
 out:
         up->len = 0;
         up->pending = 0;
-        if (!err)
-                UDP_INC_STATS_USER(sock_net(sk),
-                                UDP_MIB_OUTDATAGRAMS, is_udplite);
         return err;
 }
 
@@ -592,11 +793,11 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *      Check the flags.
          */
 
-        if (msg->msg_flags&MSG_OOB)     /* Mirror BSD error message compatibility */
+        if (msg->msg_flags & MSG_OOB) /* Mirror BSD error message compatibility */
                 return -EOPNOTSUPP;
 
         ipc.opt = NULL;
-        ipc.shtx.flags = 0;
+        ipc.tx_flags = 0;
 
         if (up->pending) {
                 /*
@@ -619,7 +820,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *      Get and verify the address.
          */
         if (msg->msg_name) {
-                struct sockaddr_in * usin = (struct sockaddr_in*)msg->msg_name;
+                struct sockaddr_in * usin = (struct sockaddr_in *)msg->msg_name;
                 if (msg->msg_namelen < sizeof(*usin))
                         return -EINVAL;
                 if (usin->sin_family != AF_INET) {
@@ -634,17 +835,17 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         } else {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
-                daddr = inet->daddr;
-                dport = inet->dport;
+                daddr = inet->inet_daddr;
+                dport = inet->inet_dport;
                 /* Open fast path for connected socket.
                    Route will not be used, if at least one option is set.
                  */
                 connected = 1;
         }
-        ipc.addr = inet->saddr;
+        ipc.addr = inet->inet_saddr;
 
         ipc.oif = sk->sk_bound_dev_if;
-        err = sock_tx_timestamp(msg, sk, &ipc.shtx);
+        err = sock_tx_timestamp(sk, &ipc.tx_flags);
         if (err)
                 return err;
         if (msg->msg_controllen) {
@@ -684,19 +885,18 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         }
 
         if (connected)
-                rt = (struct rtable*)sk_dst_check(sk, 0);
+                rt = (struct rtable *)sk_dst_check(sk, 0);
 
         if (rt == NULL) {
                 struct flowi fl = { .oif = ipc.oif,
-                                    .nl_u = { .ip4_u =
-                                              { .daddr = faddr,
-                                                .saddr = saddr,
-                                                .tos = tos } },
+                                    .mark = sk->sk_mark,
+                                    .fl4_dst = faddr,
+                                    .fl4_src = saddr,
+                                    .fl4_tos = tos,
                                     .proto = sk->sk_protocol,
                                     .flags = inet_sk_flowi_flags(sk),
-                                    .uli_u = { .ports =
-                                               { .sport = inet->sport,
-                                                 .dport = dport } } };
+                                    .fl_ip_sport = inet->inet_sport,
+                                    .fl_ip_dport = dport };
                 struct net *net = sock_net(sk);
 
                 security_sk_classify_flow(sk, &fl);
@@ -712,7 +912,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                     !sock_flag(sk, SOCK_BROADCAST))
                         goto out;
                 if (connected)
-                        sk_dst_set(sk, dst_clone(&rt->u.dst));
+                        sk_dst_set(sk, dst_clone(&rt->dst));
         }
 
         if (msg->msg_flags&MSG_CONFIRM)
@@ -739,7 +939,7 @@ back_from_confirm:
         inet->cork.fl.fl4_dst = daddr;
         inet->cork.fl.fl_ip_dport = dport;
         inet->cork.fl.fl4_src = saddr;
-        inet->cork.fl.fl_ip_sport = inet->sport;
+        inet->cork.fl.fl_ip_sport = inet->inet_sport;
         up->pending = AF_INET;
 
 do_append_data:
@@ -776,12 +976,13 @@ out:
         return err;
 
 do_confirm:
-        dst_confirm(&rt->u.dst);
+        dst_confirm(&rt->dst);
         if (!(msg->msg_flags&MSG_PROBE) || len)
                 goto back_from_confirm;
         err = 0;
         goto out;
 }
+EXPORT_SYMBOL(udp_sendmsg);
 
 int udp_sendpage(struct sock *sk, struct page *page, int offset,
                  size_t size, int flags)
@@ -831,6 +1032,44 @@ out:
         return ret;
 }
 
+
+/**
+ *      first_packet_length     - return length of first packet in receive queue
+ *      @sk: socket
+ *
+ *      Drops all bad checksum frames, until a valid one is found.
+ *      Returns the length of found skb, or 0 if none is found.
+ */
+static unsigned int first_packet_length(struct sock *sk)
+{
+        struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue;
+        struct sk_buff *skb;
+        unsigned int res;
+
+        __skb_queue_head_init(&list_kill);
+
+        spin_lock_bh(&rcvq->lock);
+        while ((skb = skb_peek(rcvq)) != NULL &&
+                udp_lib_checksum_complete(skb)) {
+                UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
+                                 IS_UDPLITE(sk));
+                atomic_inc(&sk->sk_drops);
+                __skb_unlink(skb, rcvq);
+                __skb_queue_tail(&list_kill, skb);
+        }
+        res = skb ? skb->len : 0;
+        spin_unlock_bh(&rcvq->lock);
+
+        if (!skb_queue_empty(&list_kill)) {
+                bool slow = lock_sock_fast(sk);
+
+                __skb_queue_purge(&list_kill);
+                sk_mem_reclaim_partial(sk);
+                unlock_sock_fast(sk, slow);
+        }
+        return res;
+}
+
 /*
  *      IOCTL requests applicable to the UDP protocol
  */
@@ -847,21 +1086,16 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 
         case SIOCINQ:
         {
-                struct sk_buff *skb;
-                unsigned long amount;
+                unsigned int amount = first_packet_length(sk);
 
-                amount = 0;
-                spin_lock_bh(&sk->sk_receive_queue.lock);
-                skb = skb_peek(&sk->sk_receive_queue);
-                if (skb != NULL) {
+                if (amount)
                         /*
                          * We will only return the amount
                          * of this packet since that is all
                          * that will be read.
                          */
-                        amount = skb->len - sizeof(struct udphdr);
-                }
-                spin_unlock_bh(&sk->sk_receive_queue.lock);
+                        amount -= sizeof(struct udphdr);
+
                 return put_user(amount, (int __user *)arg);
         }
 
@@ -871,6 +1105,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 
         return 0;
 }
+EXPORT_SYMBOL(udp_ioctl);
 
 /*
  *      This should be easy, if there is something there we
@@ -883,16 +1118,17 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct inet_sock *inet = inet_sk(sk);
         struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
         struct sk_buff *skb;
-        unsigned int ulen, copied;
+        unsigned int ulen;
         int peeked;
         int err;
         int is_udplite = IS_UDPLITE(sk);
+        bool slow;
 
         /*
          *      Check any passed addresses
          */
         if (addr_len)
-                *addr_len=sizeof(*sin);
+                *addr_len = sizeof(*sin);
 
         if (flags & MSG_ERRQUEUE)
                 return ip_recv_error(sk, msg, len);
@@ -904,10 +1140,9 @@ try_again:
                 goto out;
 
         ulen = skb->len - sizeof(struct udphdr);
-        copied = len;
-        if (copied > ulen)
-                copied = ulen;
-        else if (copied < ulen)
+        if (len > ulen)
+                len = ulen;
+        else if (len < ulen)
                 msg->msg_flags |= MSG_TRUNC;
 
         /*
@@ -916,16 +1151,18 @@ try_again:
          * coverage checksum (UDP-Lite), do it before the copy.
          */
 
-        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+        if (len < ulen || UDP_SKB_CB(skb)->partial_cov) {
                 if (udp_lib_checksum_complete(skb))
                         goto csum_copy_err;
         }
 
         if (skb_csum_unnecessary(skb))
                 err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, copied       );
+                                              msg->msg_iov, len);
         else {
-                err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
+                err = skb_copy_and_csum_datagram_iovec(skb,
+                                                       sizeof(struct udphdr),
+                                                       msg->msg_iov);
 
                 if (err == -EINVAL)
                         goto csum_copy_err;
@@ -938,11 +1175,10 @@ try_again:
                 UDP_INC_STATS_USER(sock_net(sk),
                                 UDP_MIB_INDATAGRAMS, is_udplite);
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
-        if (sin)
-        {
+        if (sin) {
                 sin->sin_family = AF_INET;
                 sin->sin_port = udp_hdr(skb)->source;
                 sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
@@ -951,22 +1187,20 @@ try_again:
         if (inet->cmsg_flags)
                 ip_cmsg_recv(msg, skb);
 
-        err = copied;
+        err = len;
         if (flags & MSG_TRUNC)
                 err = ulen;
 
 out_free:
-        lock_sock(sk);
-        skb_free_datagram(sk, skb);
-        release_sock(sk);
+        skb_free_datagram_locked(sk, skb);
 out:
         return err;
 
 csum_copy_err:
-        lock_sock(sk);
+        slow = lock_sock_fast(sk);
         if (!skb_kill_datagram(sk, skb, flags))
                 UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
-        release_sock(sk);
+        unlock_sock_fast(sk, slow);
 
         if (noblock)
                 return -EAGAIN;
@@ -982,58 +1216,113 @@ int udp_disconnect(struct sock *sk, int flags)
          */
 
         sk->sk_state = TCP_CLOSE;
-        inet->daddr = 0;
-        inet->dport = 0;
+        inet->inet_daddr = 0;
+        inet->inet_dport = 0;
+        sock_rps_save_rxhash(sk, 0);
         sk->sk_bound_dev_if = 0;
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
 
         if (!(sk->sk_userlocks & SOCK_BINDPORT_LOCK)) {
                 sk->sk_prot->unhash(sk);
-                inet->sport = 0;
+                inet->inet_sport = 0;
         }
         sk_dst_reset(sk);
         return 0;
 }
+EXPORT_SYMBOL(udp_disconnect);
 
 void udp_lib_unhash(struct sock *sk)
 {
         if (sk_hashed(sk)) {
                 struct udp_table *udptable = sk->sk_prot->h.udp_table;
-                unsigned int hash = udp_hashfn(sock_net(sk), sk->sk_hash);
-                struct udp_hslot *hslot = &udptable->hash[hash];
+                struct udp_hslot *hslot, *hslot2;
+
+                hslot  = udp_hashslot(udptable, sock_net(sk),
+                                      udp_sk(sk)->udp_port_hash);
+                hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
 
                 spin_lock_bh(&hslot->lock);
                 if (sk_nulls_del_node_init_rcu(sk)) {
-                        inet_sk(sk)->num = 0;
+                        hslot->count--;
+                        inet_sk(sk)->inet_num = 0;
                         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+
+                        spin_lock(&hslot2->lock);
+                        hlist_nulls_del_init_rcu(&udp_sk(sk)->udp_portaddr_node);
+                        hslot2->count--;
+                        spin_unlock(&hslot2->lock);
                 }
                 spin_unlock_bh(&hslot->lock);
         }
 }
 EXPORT_SYMBOL(udp_lib_unhash);
 
+/*
+ * inet_rcv_saddr was changed, we must rehash secondary hash
+ */
+void udp_lib_rehash(struct sock *sk, u16 newhash)
+{
+        if (sk_hashed(sk)) {
+                struct udp_table *udptable = sk->sk_prot->h.udp_table;
+                struct udp_hslot *hslot, *hslot2, *nhslot2;
+
+                hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
+                nhslot2 = udp_hashslot2(udptable, newhash);
+                udp_sk(sk)->udp_portaddr_hash = newhash;
+                if (hslot2 != nhslot2) {
+                        hslot = udp_hashslot(udptable, sock_net(sk),
+                                             udp_sk(sk)->udp_port_hash);
+                        /* we must lock primary chain too */
+                        spin_lock_bh(&hslot->lock);
+
+                        spin_lock(&hslot2->lock);
+                        hlist_nulls_del_init_rcu(&udp_sk(sk)->udp_portaddr_node);
+                        hslot2->count--;
+                        spin_unlock(&hslot2->lock);
+
+                        spin_lock(&nhslot2->lock);
+                        hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
+                                                 &nhslot2->head);
+                        nhslot2->count++;
+                        spin_unlock(&nhslot2->lock);
+
+                        spin_unlock_bh(&hslot->lock);
+                }
+        }
+}
+EXPORT_SYMBOL(udp_lib_rehash);
+
+static void udp_v4_rehash(struct sock *sk)
+{
+        u16 new_hash = udp4_portaddr_hash(sock_net(sk),
+                                          inet_sk(sk)->inet_rcv_saddr,
+                                          inet_sk(sk)->inet_num);
+        udp_lib_rehash(sk, new_hash);
+}
+
 static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
-        int is_udplite = IS_UDPLITE(sk);
         int rc;
 
-        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
+        if (inet_sk(sk)->inet_daddr)
+                sock_rps_save_rxhash(sk, skb->rxhash);
+
+        rc = ip_queue_rcv_skb(sk, skb);
+        if (rc < 0) {
+                int is_udplite = IS_UDPLITE(sk);
+
                 /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM) {
+                if (rc == -ENOMEM)
                         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
                                          is_udplite);
-                        atomic_inc(&sk->sk_drops);
-                }
-                goto drop;
+                UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+                kfree_skb(skb);
+                return -1;
         }
 
         return 0;
 
-drop:
-        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
-        kfree_skb(skb);
-        return -1;
 }
 
 /* returns:
@@ -1044,7 +1333,7 @@ drop:
  * Note that in the success and error cases, the skb is assumed to
  * have either been requeued or freed.
  */
-int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         struct udp_sock *up = udp_sk(sk);
         int rc;
@@ -1122,71 +1411,112 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                 }
         }
 
-        if (sk->sk_filter) {
+        if (rcu_dereference_raw(sk->sk_filter)) {
                 if (udp_lib_checksum_complete(skb))
                         goto drop;
         }
 
+
+        if (sk_rcvqueues_full(sk, skb))
+                goto drop;
+
         rc = 0;
 
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 rc = __udp_queue_rcv_skb(sk, skb);
-        else
-                sk_add_backlog(sk, skb);
+        else if (sk_add_backlog(sk, skb)) {
+                bh_unlock_sock(sk);
+                goto drop;
+        }
         bh_unlock_sock(sk);
 
         return rc;
 
 drop:
         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+        atomic_inc(&sk->sk_drops);
         kfree_skb(skb);
         return -1;
 }
 
+
+static void flush_stack(struct sock **stack, unsigned int count,
+                        struct sk_buff *skb, unsigned int final)
+{
+        unsigned int i;
+        struct sk_buff *skb1 = NULL;
+        struct sock *sk;
+
+        for (i = 0; i < count; i++) {
+                sk = stack[i];
+                if (likely(skb1 == NULL))
+                        skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
+
+                if (!skb1) {
+                        atomic_inc(&sk->sk_drops);
+                        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
+                                         IS_UDPLITE(sk));
+                        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
+                                         IS_UDPLITE(sk));
+                }
+
+                if (skb1 && udp_queue_rcv_skb(sk, skb1) <= 0)
+                        skb1 = NULL;
+        }
+        if (unlikely(skb1))
+                kfree_skb(skb1);
+}
+
 /*
  *      Multicasts and broadcasts go to each listener.
  *
- *      Note: called only from the BH handler context,
- *      so we don't need to lock the hashes.
+ *      Note: called only from the BH handler context.
  */
 static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                                     struct udphdr  *uh,
                                     __be32 saddr, __be32 daddr,
                                     struct udp_table *udptable)
 {
-        struct sock *sk;
-        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
+        struct sock *sk, *stack[256 / sizeof(struct sock *)];
+        struct udp_hslot *hslot = udp_hashslot(udptable, net, ntohs(uh->dest));
         int dif;
+        unsigned int i, count = 0;
 
         spin_lock(&hslot->lock);
         sk = sk_nulls_head(&hslot->head);
         dif = skb->dev->ifindex;
         sk = udp_v4_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
-        if (sk) {
-                struct sock *sknext = NULL;
+        while (sk) {
+                stack[count++] = sk;
+                sk = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
+                                       daddr, uh->source, saddr, dif);
+                if (unlikely(count == ARRAY_SIZE(stack))) {
+                        if (!sk)
+                                break;
+                        flush_stack(stack, count, skb, ~0);
+                        count = 0;
+                }
+        }
+        /*
+         * before releasing chain lock, we must take a reference on sockets
+         */
+        for (i = 0; i < count; i++)
+                sock_hold(stack[i]);
 
-                do {
-                        struct sk_buff *skb1 = skb;
-
-                        sknext = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
-                                                   daddr, uh->source, saddr,
-                                                   dif);
-                        if (sknext)
-                                skb1 = skb_clone(skb, GFP_ATOMIC);
-
-                        if (skb1) {
-                                int ret = udp_queue_rcv_skb(sk, skb1);
-                                if (ret > 0)
-                                        /* we should probably re-process instead
-                                         * of dropping packets here. */
-                                        kfree_skb(skb1);
-                        }
-                        sk = sknext;
-                } while (sknext);
-        } else
-                consume_skb(skb);
         spin_unlock(&hslot->lock);
+
+        /*
+         * do the slow work with no lock held
+         */
+        if (count) {
+                flush_stack(stack, count, skb, count - 1);
+
+                for (i = 0; i < count; i++)
+                        sock_put(stack[i]);
+        } else {
+                kfree_skb(skb);
+        }
         return 0;
 }
 
@@ -1214,7 +1544,7 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
         if (uh->check == 0) {
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         } else if (skb->ip_summed == CHECKSUM_COMPLETE) {
-               if (!csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
+                if (!csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
                                       proto, skb->csum))
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
@@ -1250,6 +1580,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
         uh   = udp_hdr(skb);
         ulen = ntohs(uh->len);
+        saddr = ip_hdr(skb)->saddr;
+        daddr = ip_hdr(skb)->daddr;
+
         if (ulen > skb->len)
                 goto short_packet;
 
@@ -1263,9 +1596,6 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (udp4_csum_init(skb, uh, proto))
                 goto csum_error;
 
-        saddr = ip_hdr(skb)->saddr;
-        daddr = ip_hdr(skb)->daddr;
-
         if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                 return __udp4_lib_mcast_deliver(net, skb, uh,
                                 saddr, daddr, udptable);
@@ -1338,16 +1668,16 @@ int udp_rcv(struct sk_buff *skb)
 
 void udp_destroy_sock(struct sock *sk)
 {
-        lock_sock(sk);
+        bool slow = lock_sock_fast(sk);
         udp_flush_pending_frames(sk);
-        release_sock(sk);
+        unlock_sock_fast(sk, slow);
 }
 
 /*
  *      Socket option code for UDP
  */
 int udp_lib_setsockopt(struct sock *sk, int level, int optname,
-                       char __user *optval, int optlen,
+                       char __user *optval, unsigned int optlen,
                        int (*push_pending_frames)(struct sock *))
 {
         struct udp_sock *up = udp_sk(sk);
@@ -1355,7 +1685,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
         int err = 0;
         int is_udplite = IS_UDPLITE(sk);
 
-        if (optlen<sizeof(int))
+        if (optlen < sizeof(int))
                 return -EINVAL;
 
         if (get_user(val, (int __user *)optval))
@@ -1399,8 +1729,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
                         return -ENOPROTOOPT;
                 if (val != 0 && val < 8) /* Illegal coverage: use default (8) */
                         val = 8;
-                else if (val > USHORT_MAX)
-                        val = USHORT_MAX;
+                else if (val > USHRT_MAX)
+                        val = USHRT_MAX;
                 up->pcslen = val;
                 up->pcflag |= UDPLITE_SEND_CC;
                 break;
@@ -1413,8 +1743,8 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
                         return -ENOPROTOOPT;
                 if (val != 0 && val < 8) /* Avoid silly minimal values.       */
                         val = 8;
-                else if (val > USHORT_MAX)
-                        val = USHORT_MAX;
+                else if (val > USHRT_MAX)
+                        val = USHRT_MAX;
                 up->pcrlen = val;
                 up->pcflag |= UDPLITE_RECV_CC;
                 break;
@@ -1426,9 +1756,10 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
 
         return err;
 }
+EXPORT_SYMBOL(udp_lib_setsockopt);
 
 int udp_setsockopt(struct sock *sk, int level, int optname,
-                   char __user *optval, int optlen)
+                   char __user *optval, unsigned int optlen)
 {
         if (level == SOL_UDP  ||  level == SOL_UDPLITE)
                 return udp_lib_setsockopt(sk, level, optname, optval, optlen,
@@ -1438,7 +1769,7 @@ int udp_setsockopt(struct sock *sk, int level, int optname,
 
 #ifdef CONFIG_COMPAT
 int compat_udp_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
+                          char __user *optval, unsigned int optlen)
 {
         if (level == SOL_UDP  ||  level == SOL_UDPLITE)
                 return udp_lib_setsockopt(sk, level, optname, optval, optlen,
@@ -1453,7 +1784,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
         struct udp_sock *up = udp_sk(sk);
         int val, len;
 
-        if (get_user(len,optlen))
+        if (get_user(len, optlen))
                 return -EFAULT;
 
         len = min_t(unsigned int, len, sizeof(int));
@@ -1486,10 +1817,11 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
 
         if (put_user(len, optlen))
                 return -EFAULT;
-        if (copy_to_user(optval, &val,len))
+        if (copy_to_user(optval, &val, len))
                 return -EFAULT;
         return 0;
 }
+EXPORT_SYMBOL(udp_lib_getsockopt);
 
 int udp_getsockopt(struct sock *sk, int level, int optname,
                    char __user *optval, int __user *optlen)
@@ -1525,33 +1857,16 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
         unsigned int mask = datagram_poll(file, sock, wait);
         struct sock *sk = sock->sk;
-        int     is_lite = IS_UDPLITE(sk);
 
         /* Check for false positives due to checksum errors */
-        if ( (mask & POLLRDNORM) &&
-             !(file->f_flags & O_NONBLOCK) &&
-             !(sk->sk_shutdown & RCV_SHUTDOWN)){
-                struct sk_buff_head *rcvq = &sk->sk_receive_queue;
-                struct sk_buff *skb;
-
-                spin_lock_bh(&rcvq->lock);
-                while ((skb = skb_peek(rcvq)) != NULL &&
-                       udp_lib_checksum_complete(skb)) {
-                        UDP_INC_STATS_BH(sock_net(sk),
-                                        UDP_MIB_INERRORS, is_lite);
-                        __skb_unlink(skb, rcvq);
-                        kfree_skb(skb);
-                }
-                spin_unlock_bh(&rcvq->lock);
-
-                /* nothing to see, move along */
-                if (skb == NULL)
-                        mask &= ~(POLLIN | POLLRDNORM);
-        }
+        if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
+            !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
+                mask &= ~(POLLIN | POLLRDNORM);
 
         return mask;
 
 }
+EXPORT_SYMBOL(udp_poll);
 
 struct proto udp_prot = {
         .name              = "UDP",
@@ -1569,6 +1884,7 @@ struct proto udp_prot = {
         .backlog_rcv       = __udp_queue_rcv_skb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
+        .rehash            = udp_v4_rehash,
         .get_port          = udp_v4_get_port,
         .memory_allocated  = &udp_memory_allocated,
         .sysctl_mem        = sysctl_udp_mem,
@@ -1581,7 +1897,9 @@ struct proto udp_prot = {
         .compat_setsockopt = compat_udp_setsockopt,
         .compat_getsockopt = compat_udp_getsockopt,
 #endif
+        .clear_sk          = sk_prot_clear_portaddr_nulls,
 };
+EXPORT_SYMBOL(udp_prot);
 
 /* ------------------------------------------------------------------------ */
 #ifdef CONFIG_PROC_FS
@@ -1592,9 +1910,14 @@ static struct sock *udp_get_first(struct seq_file *seq, int start)
         struct udp_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
 
-        for (state->bucket = start; state->bucket < UDP_HTABLE_SIZE; ++state->bucket) {
+        for (state->bucket = start; state->bucket <= state->udp_table->mask;
+             ++state->bucket) {
                 struct hlist_nulls_node *node;
                 struct udp_hslot *hslot = &state->udp_table->hash[state->bucket];
+
+                if (hlist_nulls_empty(&hslot->head))
+                        continue;
+
                 spin_lock_bh(&hslot->lock);
                 sk_nulls_for_each(sk, node, &hslot->head) {
                         if (!net_eq(sock_net(sk), net))
@@ -1619,7 +1942,7 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
         } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
 
         if (!sk) {
-                if (state->bucket < UDP_HTABLE_SIZE)
+                if (state->bucket <= state->udp_table->mask)
                         spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
                 return udp_get_first(seq, state->bucket + 1);
         }
@@ -1639,7 +1962,7 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
 static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct udp_iter_state *state = seq->private;
-        state->bucket = UDP_HTABLE_SIZE;
+        state->bucket = MAX_UDP_PORTS;
 
         return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
@@ -1661,7 +1984,7 @@ static void udp_seq_stop(struct seq_file *seq, void *v)
 {
         struct udp_iter_state *state = seq->private;
 
-        if (state->bucket < UDP_HTABLE_SIZE)
+        if (state->bucket <= state->udp_table->mask)
                 spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
 }
 
@@ -1703,23 +2026,25 @@ int udp_proc_register(struct net *net, struct udp_seq_afinfo *afinfo)
                 rc = -ENOMEM;
         return rc;
 }
+EXPORT_SYMBOL(udp_proc_register);
 
 void udp_proc_unregister(struct net *net, struct udp_seq_afinfo *afinfo)
 {
         proc_net_remove(net, afinfo->name);
 }
+EXPORT_SYMBOL(udp_proc_unregister);
 
 /* ------------------------------------------------------------------------ */
 static void udp4_format_sock(struct sock *sp, struct seq_file *f,
                 int bucket, int *len)
 {
         struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr;
-        __be32 src  = inet->rcv_saddr;
-        __u16 destp       = ntohs(inet->dport);
-        __u16 srcp        = ntohs(inet->sport);
+        __be32 dest = inet->inet_daddr;
+        __be32 src  = inet->inet_rcv_saddr;
+        __u16 destp       = ntohs(inet->inet_dport);
+        __u16 srcp        = ntohs(inet->inet_sport);
 
-        seq_printf(f, "%4d: %08X:%04X %08X:%04X"
+        seq_printf(f, "%5d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d%n",
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
@@ -1741,7 +2066,7 @@ int udp4_seq_show(struct seq_file *seq, void *v)
                 int len;
 
                 udp4_format_sock(v, seq, state->bucket, &len);
-                seq_printf(seq, "%*s\n", 127 - len ,"");
+                seq_printf(seq, "%*s\n", 127 - len, "");
         }
         return 0;
 }
@@ -1759,12 +2084,12 @@ static struct udp_seq_afinfo udp4_seq_afinfo = {
         },
 };
 
-static int udp4_proc_init_net(struct net *net)
+static int __net_init udp4_proc_init_net(struct net *net)
 {
         return udp_proc_register(net, &udp4_seq_afinfo);
 }
 
-static void udp4_proc_exit_net(struct net *net)
+static void __net_exit udp4_proc_exit_net(struct net *net)
 {
         udp_proc_unregister(net, &udp4_seq_afinfo);
 }
@@ -1785,21 +2110,60 @@ void udp4_proc_exit(void)
 }
 #endif /* CONFIG_PROC_FS */
 
-void __init udp_table_init(struct udp_table *table)
+static __initdata unsigned long uhash_entries;
+static int __init set_uhash_entries(char *str)
 {
-        int i;
+        if (!str)
+                return 0;
+        uhash_entries = simple_strtoul(str, &str, 0);
+        if (uhash_entries && uhash_entries < UDP_HTABLE_SIZE_MIN)
+                uhash_entries = UDP_HTABLE_SIZE_MIN;
+        return 1;
+}
+__setup("uhash_entries=", set_uhash_entries);
 
-        for (i = 0; i < UDP_HTABLE_SIZE; i++) {
+void __init udp_table_init(struct udp_table *table, const char *name)
+{
+        unsigned int i;
+
+        if (!CONFIG_BASE_SMALL)
+                table->hash = alloc_large_system_hash(name,
+                        2 * sizeof(struct udp_hslot),
+                        uhash_entries,
+                        21, /* one slot per 2 MB */
+                        0,
+                        &table->log,
+                        &table->mask,
+                        64 * 1024);
+        /*
+         * Make sure hash table has the minimum size
+         */
+        if (CONFIG_BASE_SMALL || table->mask < UDP_HTABLE_SIZE_MIN - 1) {
+                table->hash = kmalloc(UDP_HTABLE_SIZE_MIN *
+                                      2 * sizeof(struct udp_hslot), GFP_KERNEL);
+                if (!table->hash)
+                        panic(name);
+                table->log = ilog2(UDP_HTABLE_SIZE_MIN);
+                table->mask = UDP_HTABLE_SIZE_MIN - 1;
+        }
+        table->hash2 = table->hash + (table->mask + 1);
+        for (i = 0; i <= table->mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&table->hash[i].head, i);
+                table->hash[i].count = 0;
                 spin_lock_init(&table->hash[i].lock);
         }
+        for (i = 0; i <= table->mask; i++) {
+                INIT_HLIST_NULLS_HEAD(&table->hash2[i].head, i);
+                table->hash2[i].count = 0;
+                spin_lock_init(&table->hash2[i].lock);
+        }
 }
 
 void __init udp_init(void)
 {
         unsigned long nr_pages, limit;
 
-        udp_table_init(&udp_table);
+        udp_table_init(&udp_table, "UDP");
         /* Set the pressure threshold up by the same strategy of TCP. It is a
          * fraction of global memory that is up to 1/2 at 256 MB, decreasing
          * toward zero with the amount of memory, with a floor of 128 pages.
@@ -1816,16 +2180,64 @@ void __init udp_init(void)
         sysctl_udp_wmem_min = SK_MEM_QUANTUM;
 }
 
-EXPORT_SYMBOL(udp_disconnect);
-EXPORT_SYMBOL(udp_ioctl);
-EXPORT_SYMBOL(udp_prot);
-EXPORT_SYMBOL(udp_sendmsg);
-EXPORT_SYMBOL(udp_lib_getsockopt);
-EXPORT_SYMBOL(udp_lib_setsockopt);
-EXPORT_SYMBOL(udp_poll);
-EXPORT_SYMBOL(udp_lib_get_port);
+int udp4_ufo_send_check(struct sk_buff *skb)
+{
+        const struct iphdr *iph;
+        struct udphdr *uh;
+
+        if (!pskb_may_pull(skb, sizeof(*uh)))
+                return -EINVAL;
+
+        iph = ip_hdr(skb);
+        uh = udp_hdr(skb);
+
+        uh->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
+                                       IPPROTO_UDP, 0);
+        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_offset = offsetof(struct udphdr, check);
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        return 0;
+}
+
+struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb, int features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        unsigned int mss;
+        int offset;
+        __wsum csum;
+
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
+
+        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
+                /* Packet is from an untrusted source, reset gso_segs. */
+                int type = skb_shinfo(skb)->gso_type;
+
+                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY) ||
+                             !(type & (SKB_GSO_UDP))))
+                        goto out;
+
+                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
+
+                segs = NULL;
+                goto out;
+        }
+
+        /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
+         * do checksum of UDP packets sent as multiple IP fragments.
+         */
+        offset = skb_checksum_start_offset(skb);
+        csum = skb_checksum(skb, offset, skb->len - offset, 0);
+        offset += skb->csum_offset;
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+        skb->ip_summed = CHECKSUM_NONE;
+
+        /* Fragment the skb. IP headers of the fragments are updated in
+         * inet_gso_segment()
+         */
+        segs = skb_segment(skb, features);
+out:
+        return segs;
+}
 
-#ifdef CONFIG_PROC_FS
-EXPORT_SYMBOL(udp_proc_register);
-EXPORT_SYMBOL(udp_proc_unregister);
-#endif
diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
index 9f4a6165f722..aaad650d47d9 100644
--- a/net/ipv4/udp_impl.h
+++ b/net/ipv4/udp_impl.h
@@ -11,13 +11,13 @@ extern void 	__udp4_lib_err(struct sk_buff *, u32, struct udp_table *);
 extern int      udp_v4_get_port(struct sock *sk, unsigned short snum);
 
 extern int      udp_setsockopt(struct sock *sk, int level, int optname,
-                               char __user *optval, int optlen);
+                               char __user *optval, unsigned int optlen);
 extern int      udp_getsockopt(struct sock *sk, int level, int optname,
                                char __user *optval, int __user *optlen);
 
 #ifdef CONFIG_COMPAT
 extern int      compat_udp_setsockopt(struct sock *sk, int level, int optname,
-                                      char __user *optval, int optlen);
+                                      char __user *optval, unsigned int optlen);
 extern int      compat_udp_getsockopt(struct sock *sk, int level, int optname,
                                       char __user *optval, int __user *optlen);
 #endif
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index c784891cb7e5..aee9963f7f5a 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -12,7 +12,7 @@
  */
 #include "udp_impl.h"
 
-struct udp_table        udplite_table;
+struct udp_table        udplite_table __read_mostly;
 EXPORT_SYMBOL(udplite_table);
 
 static int udplite_rcv(struct sk_buff *skb)
@@ -25,7 +25,7 @@ static void udplite_err(struct sk_buff *skb, u32 info)
         __udp4_lib_err(skb, info, &udplite_table);
 }
 
-static  struct net_protocol udplite_protocol = {
+static const struct net_protocol udplite_protocol = {
         .handler        = udplite_rcv,
         .err_handler    = udplite_err,
         .no_policy      = 1,
@@ -57,14 +57,15 @@ struct proto 	udplite_prot = {
         .compat_setsockopt = compat_udp_setsockopt,
         .compat_getsockopt = compat_udp_getsockopt,
 #endif
+        .clear_sk          = sk_prot_clear_portaddr_nulls,
 };
+EXPORT_SYMBOL(udplite_prot);
 
 static struct inet_protosw udplite4_protosw = {
         .type           =  SOCK_DGRAM,
         .protocol       =  IPPROTO_UDPLITE,
         .prot           =  &udplite_prot,
         .ops            =  &inet_dgram_ops,
-        .capability     = -1,
         .no_check       =  0,           /* must checksum (RFC 3828) */
         .flags          =  INET_PROTOSW_PERMANENT,
 };
@@ -82,12 +83,12 @@ static struct udp_seq_afinfo udplite4_seq_afinfo = {
         },
 };
 
-static int udplite4_proc_init_net(struct net *net)
+static int __net_init udplite4_proc_init_net(struct net *net)
 {
         return udp_proc_register(net, &udplite4_seq_afinfo);
 }
 
-static void udplite4_proc_exit_net(struct net *net)
+static void __net_exit udplite4_proc_exit_net(struct net *net)
 {
         udp_proc_unregister(net, &udplite4_seq_afinfo);
 }
@@ -110,7 +111,7 @@ static inline int udplite4_proc_init(void)
 
 void __init udplite4_register(void)
 {
-        udp_table_init(&udplite_table);
+        udp_table_init(&udplite_table, "UDP-Lite");
         if (proto_register(&udplite_prot, 1))
                 goto out_register_err;
 
@@ -128,5 +129,3 @@ out_unregister_proto:
 out_register_err:
         printk(KERN_CRIT "%s: Cannot add UDP-Lite protocol.\n", __func__);
 }
-
-EXPORT_SYMBOL(udplite_prot);
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index f9f922a0ba88..06814b6216dc 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -9,6 +9,7 @@
  *
  */
 
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/string.h>
 #include <linux/netfilter.h>
@@ -26,8 +27,8 @@ static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb)
         if (skb_dst(skb) == NULL) {
                 const struct iphdr *iph = ip_hdr(skb);
 
-                if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
-                                   skb->dev))
+                if (ip_route_input_noref(skb, iph->daddr, iph->saddr,
+                                         iph->tos, skb->dev))
                         goto drop;
         }
         return dst_input(skb);
@@ -60,7 +61,7 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)
         iph->tot_len = htons(skb->len);
         ip_send_check(iph);
 
-        NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
+        NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
                 xfrm4_rcv_encap_finish);
         return 0;
 }
@@ -162,5 +163,4 @@ int xfrm4_rcv(struct sk_buff *skb)
 {
         return xfrm4_rcv_spi(skb, ip_hdr(skb)->protocol, 0);
 }
-
 EXPORT_SYMBOL(xfrm4_rcv);
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 3444f3b34eca..534972e114ac 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -4,6 +4,7 @@
  * Copyright (c) 2004-2006 Herbert Xu <herbert@gondor.apana.org.au>
  */
 
+#include <linux/gfp.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -55,7 +56,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
                 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
         ip_select_ident(top_iph, dst->child, NULL);
 
-        top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT);
+        top_iph->ttl = ip4_dst_hoplimit(dst->child);
 
         top_iph->saddr = x->props.saddr.a4;
         top_iph->daddr = x->id.daddr.a4;
diff --git a/net/ipv4/xfrm4_output.c b/net/ipv4/xfrm4_output.c
index c908bd99bcba..571aa96a175c 100644
--- a/net/ipv4/xfrm4_output.c
+++ b/net/ipv4/xfrm4_output.c
@@ -86,7 +86,7 @@ static int xfrm4_output_finish(struct sk_buff *skb)
 
 int xfrm4_output(struct sk_buff *skb)
 {
-        return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb,
+        return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, skb,
                             NULL, skb_dst(skb)->dev, xfrm4_output_finish,
                             !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 60d918c96a4f..b057d40addec 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -11,11 +11,11 @@
 #include <linux/err.h>
 #include <linux/kernel.h>
 #include <linux/inetdevice.h>
+#include <linux/if_tunnel.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 
-static struct dst_ops xfrm4_dst_ops;
 static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
 
 static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos,
@@ -23,12 +23,8 @@ static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos,
                                           xfrm_address_t *daddr)
 {
         struct flowi fl = {
-                .nl_u = {
-                        .ip4_u = {
-                                .tos = tos,
-                                .daddr = daddr->a4,
-                        },
-                },
+                .fl4_dst = daddr->a4,
+                .fl4_tos = tos,
         };
         struct dst_entry *dst;
         struct rtable *rt;
@@ -38,7 +34,7 @@ static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos,
                 fl.fl4_src = saddr->a4;
 
         err = __ip_route_output_key(net, &rt, &fl);
-        dst = &rt->u.dst;
+        dst = &rt->dst;
         if (err)
                 dst = ERR_PTR(err);
         return dst;
@@ -60,30 +56,9 @@ static int xfrm4_get_saddr(struct net *net,
         return 0;
 }
 
-static struct dst_entry *
-__xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
-{
-        struct dst_entry *dst;
-
-        read_lock_bh(&policy->lock);
-        for (dst = policy->bundles; dst; dst = dst->next) {
-                struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-                if (xdst->u.rt.fl.oif == fl->oif &&     /*XXX*/
-                    xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
-                    xdst->u.rt.fl.fl4_src == fl->fl4_src &&
-                    xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
-                    xfrm_bundle_ok(policy, xdst, fl, AF_INET, 0)) {
-                        dst_clone(dst);
-                        break;
-                }
-        }
-        read_unlock_bh(&policy->lock);
-        return dst;
-}
-
 static int xfrm4_get_tos(struct flowi *fl)
 {
-        return fl->fl4_tos;
+        return IPTOS_RT_MASK & fl->fl4_tos; /* Strip ECN bits */
 }
 
 static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
@@ -92,19 +67,16 @@ static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
         return 0;
 }
 
-static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
+static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
+                          struct flowi *fl)
 {
         struct rtable *rt = (struct rtable *)xdst->route;
 
-        xdst->u.rt.fl = rt->fl;
+        xdst->u.rt.fl = *fl;
 
         xdst->u.dst.dev = dev;
         dev_hold(dev);
 
-        xdst->u.rt.idev = in_dev_get(dev);
-        if (!xdst->u.rt.idev)
-                return -ENODEV;
-
         xdst->u.rt.peer = rt->peer;
         if (rt->peer)
                 atomic_inc(&rt->peer->refcnt);
@@ -129,6 +101,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
         u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
 
         memset(fl, 0, sizeof(struct flowi));
+        fl->mark = skb->mark;
+
         if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
                 switch (iph->protocol) {
                 case IPPROTO_UDP:
@@ -136,7 +110,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
                 case IPPROTO_DCCP:
-                        if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
+                        if (xprth + 4 < skb->data ||
+                            pskb_may_pull(skb, xprth + 4 - skb->data)) {
                                 __be16 *ports = (__be16 *)xprth;
 
                                 fl->fl_ip_sport = ports[!!reverse];
@@ -176,6 +151,20 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
                                 fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
                         }
                         break;
+
+                case IPPROTO_GRE:
+                        if (pskb_may_pull(skb, xprth + 12 - skb->data)) {
+                                __be16 *greflags = (__be16 *)xprth;
+                                __be32 *gre_hdr = (__be32 *)xprth;
+
+                                if (greflags[0] & GRE_KEY) {
+                                        if (greflags[0] & GRE_CSUM)
+                                                gre_hdr++;
+                                        fl->fl_gre_key = gre_hdr[1];
+                                }
+                        }
+                        break;
+
                 default:
                         fl->fl_ipsec_spi = 0;
                         break;
@@ -189,8 +178,10 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
 
 static inline int xfrm4_garbage_collect(struct dst_ops *ops)
 {
-        xfrm4_policy_afinfo.garbage_collect(&init_net);
-        return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2);
+        struct net *net = container_of(ops, struct net, xfrm.xfrm4_dst_ops);
+
+        xfrm4_policy_afinfo.garbage_collect(net);
+        return (dst_entries_get_slow(ops) > ops->gc_thresh * 2);
 }
 
 static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
@@ -205,8 +196,6 @@ static void xfrm4_dst_destroy(struct dst_entry *dst)
 {
         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
 
-        if (likely(xdst->u.rt.idev))
-                in_dev_put(xdst->u.rt.idev);
         if (likely(xdst->u.rt.peer))
                 inet_putpeer(xdst->u.rt.peer);
         xfrm_dst_destroy(xdst);
@@ -215,27 +204,9 @@ static void xfrm4_dst_destroy(struct dst_entry *dst)
 static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
                              int unregister)
 {
-        struct xfrm_dst *xdst;
-
         if (!unregister)
                 return;
 
-        xdst = (struct xfrm_dst *)dst;
-        if (xdst->u.rt.idev->dev == dev) {
-                struct in_device *loopback_idev =
-                        in_dev_get(dev_net(dev)->loopback_dev);
-                BUG_ON(!loopback_idev);
-
-                do {
-                        in_dev_put(xdst->u.rt.idev);
-                        xdst->u.rt.idev = loopback_idev;
-                        in_dev_hold(loopback_idev);
-                        xdst = (struct xfrm_dst *)xdst->u.dst.child;
-                } while (xdst->u.dst.xfrm);
-
-                __in_dev_put(loopback_idev);
-        }
-
         xfrm_dst_ifdown(dst, dev);
 }
 
@@ -248,7 +219,6 @@ static struct dst_ops xfrm4_dst_ops = {
         .ifdown =               xfrm4_dst_ifdown,
         .local_out =            __ip_local_out,
         .gc_thresh =            1024,
-        .entries =              ATOMIC_INIT(0),
 };
 
 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
@@ -256,13 +226,27 @@ static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
         .dst_ops =              &xfrm4_dst_ops,
         .dst_lookup =           xfrm4_dst_lookup,
         .get_saddr =            xfrm4_get_saddr,
-        .find_bundle =          __xfrm4_find_bundle,
         .decode_session =       _decode_session4,
         .get_tos =              xfrm4_get_tos,
         .init_path =            xfrm4_init_path,
         .fill_dst =             xfrm4_fill_dst,
 };
 
+#ifdef CONFIG_SYSCTL
+static struct ctl_table xfrm4_policy_table[] = {
+        {
+                .procname       = "xfrm4_gc_thresh",
+                .data           = &init_net.xfrm.xfrm4_dst_ops.gc_thresh,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        { }
+};
+
+static struct ctl_table_header *sysctl_hdr;
+#endif
+
 static void __init xfrm4_policy_init(void)
 {
         xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
@@ -270,12 +254,33 @@ static void __init xfrm4_policy_init(void)
 
 static void __exit xfrm4_policy_fini(void)
 {
+#ifdef CONFIG_SYSCTL
+        if (sysctl_hdr)
+                unregister_net_sysctl_table(sysctl_hdr);
+#endif
         xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
 }
 
-void __init xfrm4_init(void)
+void __init xfrm4_init(int rt_max_size)
 {
+        /*
+         * Select a default value for the gc_thresh based on the main route
+         * table hash size.  It seems to me the worst case scenario is when
+         * we have ipsec operating in transport mode, in which we create a
+         * dst_entry per socket.  The xfrm gc algorithm starts trying to remove
+         * entries at gc_thresh, and prevents new allocations as 2*gc_thresh
+         * so lets set an initial xfrm gc_thresh value at the rt_max_size/2.
+         * That will let us store an ipsec connection per route table entry,
+         * and start cleaning when were 1/2 full
+         */
+        xfrm4_dst_ops.gc_thresh = rt_max_size/2;
+        dst_entries_init(&xfrm4_dst_ops);
+
         xfrm4_state_init();
         xfrm4_policy_init();
+#ifdef CONFIG_SYSCTL
+        sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv4_ctl_path,
+                                                xfrm4_policy_table);
+#endif
 }
 
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 1ef1366a0a03..47947624eccc 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -21,21 +21,25 @@ static int xfrm4_init_flags(struct xfrm_state *x)
 }
 
 static void
-__xfrm4_init_tempsel(struct xfrm_state *x, struct flowi *fl,
-                     struct xfrm_tmpl *tmpl,
-                     xfrm_address_t *daddr, xfrm_address_t *saddr)
+__xfrm4_init_tempsel(struct xfrm_selector *sel, struct flowi *fl)
+{
+        sel->daddr.a4 = fl->fl4_dst;
+        sel->saddr.a4 = fl->fl4_src;
+        sel->dport = xfrm_flowi_dport(fl);
+        sel->dport_mask = htons(0xffff);
+        sel->sport = xfrm_flowi_sport(fl);
+        sel->sport_mask = htons(0xffff);
+        sel->family = AF_INET;
+        sel->prefixlen_d = 32;
+        sel->prefixlen_s = 32;
+        sel->proto = fl->proto;
+        sel->ifindex = fl->oif;
+}
+
+static void
+xfrm4_init_temprop(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
+                   xfrm_address_t *daddr, xfrm_address_t *saddr)
 {
-        x->sel.daddr.a4 = fl->fl4_dst;
-        x->sel.saddr.a4 = fl->fl4_src;
-        x->sel.dport = xfrm_flowi_dport(fl);
-        x->sel.dport_mask = htons(0xffff);
-        x->sel.sport = xfrm_flowi_sport(fl);
-        x->sel.sport_mask = htons(0xffff);
-        x->sel.family = AF_INET;
-        x->sel.prefixlen_d = 32;
-        x->sel.prefixlen_s = 32;
-        x->sel.proto = fl->proto;
-        x->sel.ifindex = fl->oif;
         x->id = tmpl->id;
         if (x->id.daddr.a4 == 0)
                 x->id.daddr.a4 = daddr->a4;
@@ -70,6 +74,7 @@ static struct xfrm_state_afinfo xfrm4_state_afinfo = {
         .owner                  = THIS_MODULE,
         .init_flags             = xfrm4_init_flags,
         .init_tempsel           = __xfrm4_init_tempsel,
+        .init_temprop           = xfrm4_init_temprop,
         .output                 = xfrm4_output,
         .extract_input          = xfrm4_extract_input,
         .extract_output         = xfrm4_extract_output,
diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index 41f5982d2087..82806455e859 100644
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -58,14 +58,14 @@ static int xfrm_tunnel_err(struct sk_buff *skb, u32 info)
         return -ENOENT;
 }
 
-static struct xfrm_tunnel xfrm_tunnel_handler = {
+static struct xfrm_tunnel xfrm_tunnel_handler __read_mostly = {
         .handler        =       xfrm_tunnel_rcv,
         .err_handler    =       xfrm_tunnel_err,
         .priority       =       2,
 };
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
-static struct xfrm_tunnel xfrm64_tunnel_handler = {
+static struct xfrm_tunnel xfrm64_tunnel_handler __read_mostly = {
         .handler        =       xfrm_tunnel_rcv,
         .err_handler    =       xfrm_tunnel_err,
         .priority       =       2,