Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:

 1) BPF debugger and asm tool by Daniel Borkmann.

 2) Speed up create/bind in AF_PACKET, also from Daniel Borkmann.

 3) Correct reciprocal_divide and update users, from Hannes Frederic
    Sowa and Daniel Borkmann.

 4) Currently we only have a "set" operation for the hw timestamp socket
    ioctl, add a "get" operation to match.  From Ben Hutchings.

 5) Add better trace events for debugging driver datapath problems, also
    from Ben Hutchings.

 6) Implement auto corking in TCP, from Eric Dumazet.  Basically, if we
    have a small send and a previous packet is already in the qdisc or
    device queue, defer until TX completion or we get more data.

 7) Allow userspace to manage ipv6 temporary addresses, from Jiri Pirko.

 8) Add a qdisc bypass option for AF_PACKET sockets, from Daniel
    Borkmann.

 9) Share IP header compression code between Bluetooth and IEEE802154
    layers, from Jukka Rissanen.

10) Fix ipv6 router reachability probing, from Jiri Benc.

11) Allow packets to be captured on macvtap devices, from Vlad Yasevich.

12) Support tunneling in GRO layer, from Jerry Chu.

13) Allow bonding to be configured fully using netlink, from Scott
    Feldman.

14) Allow AF_PACKET users to obtain the VLAN TPID, just like they can
    already get the TCI.  From Atzm Watanabe.

15) New "Heavy Hitter" qdisc, from Terry Lam.

16) Significantly improve the IPSEC support in pktgen, from Fan Du.

17) Allow ipv4 tunnels to cache routes, just like sockets.  From Tom
    Herbert.

18) Add Proportional Integral Enhanced packet scheduler, from Vijay
    Subramanian.

19) Allow openvswitch to mmap'd netlink, from Thomas Graf.

20) Key TCP metrics blobs also by source address, not just destination
    address.  From Christoph Paasch.

21) Support 10G in generic phylib.  From Andy Fleming.

22) Try to short-circuit GRO flow compares using device provided RX
    hash, if provided.  From Tom Herbert.

The wireless and netfilter folks have been busy little bees too.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2064 commits)
  net/cxgb4: Fix referencing freed adapter
  ipv6: reallocate addrconf router for ipv6 address when lo device up
  fib_frontend: fix possible NULL pointer dereference
  rtnetlink: remove IFLA_BOND_SLAVE definition
  rtnetlink: remove check for fill_slave_info in rtnl_have_link_slave_info
  qlcnic: update version to 5.3.55
  qlcnic: Enhance logic to calculate msix vectors.
  qlcnic: Refactor interrupt coalescing code for all adapters.
  qlcnic: Update poll controller code path
  qlcnic: Interrupt code cleanup
  qlcnic: Enhance Tx timeout debugging.
  qlcnic: Use bool for rx_mac_learn.
  bonding: fix u64 division
  rtnetlink: add missing IFLA_BOND_AD_INFO_UNSPEC
  sfc: Use the correct maximum TX DMA ring size for SFC9100
  Add Shradha Shah as the sfc driver maintainer.
  net/vxlan: Share RX skb de-marking and checksum checks with ovs
  tulip: cleanup by using ARRAY_SIZE()
  ip_tunnel: clear IPCB in ip_tunnel_xmit() in case dst_link_failure() is called
  net/cxgb4: Don't retrieve stats during recovery
  ...

56 files changed, 1120 insertions, 933 deletions

diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index 4b81e91c80fe..f8c49ce5b283 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -11,7 +11,7 @@ obj-y     := route.o inetpeer.o protocol.o \
              tcp_offload.o datagram.o raw.o udp.o udplite.o \
              udp_offload.o arp.o icmp.o devinet.o af_inet.o igmp.o \
              fib_frontend.o fib_semantics.o fib_trie.o \
-             inet_fragment.o ping.o ip_tunnel_core.o
+             inet_fragment.o ping.o ip_tunnel_core.o gre_offload.o
 
 obj-$(CONFIG_NET_IP_TUNNEL) += ip_tunnel.o
 obj-$(CONFIG_SYSCTL) += sysctl_net_ipv4.o
@@ -19,7 +19,7 @@ obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_IP_MULTIPLE_TABLES) += fib_rules.o
 obj-$(CONFIG_IP_MROUTE) += ipmr.o
 obj-$(CONFIG_NET_IPIP) += ipip.o
-gre-y := gre_demux.o gre_offload.o
+gre-y := gre_demux.o
 obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o
 obj-$(CONFIG_NET_IPGRE) += ip_gre.o
 obj-$(CONFIG_NET_IPVTI) += ip_vti.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 70011e029ac1..ecd2c3f245ce 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -126,9 +126,6 @@
 static struct list_head inetsw[SOCK_MAX];
 static DEFINE_SPINLOCK(inetsw_lock);
 
-struct ipv4_config ipv4_config;
-EXPORT_SYMBOL(ipv4_config);
-
 /* New destruction routine */
 
 void inet_sock_destruct(struct sock *sk)
@@ -342,7 +339,7 @@ lookup_protocol:
                         inet->hdrincl = 1;
         }
 
-        if (ipv4_config.no_pmtu_disc)
+        if (net->ipv4.sysctl_ip_no_pmtu_disc)
                 inet->pmtudisc = IP_PMTUDISC_DONT;
         else
                 inet->pmtudisc = IP_PMTUDISC_WANT;
@@ -1133,7 +1130,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
         fl4 = &inet->cork.fl.u.ip4;
         rt = ip_route_connect(fl4, daddr, 0, RT_CONN_FLAGS(sk),
                               sk->sk_bound_dev_if, sk->sk_protocol,
-                              inet->inet_sport, inet->inet_dport, sk, false);
+                              inet->inet_sport, inet->inet_dport, sk);
         if (IS_ERR(rt))
                 return PTR_ERR(rt);
 
@@ -1377,8 +1374,12 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                 if (!NAPI_GRO_CB(p)->same_flow)
                         continue;
 
-                iph2 = ip_hdr(p);
-
+                iph2 = (struct iphdr *)(p->data + off);
+                /* The above works because, with the exception of the top
+                 * (inner most) layer, we only aggregate pkts with the same
+                 * hdr length so all the hdrs we'll need to verify will start
+                 * at the same offset.
+                 */
                 if ((iph->protocol ^ iph2->protocol) |
                     ((__force u32)iph->saddr ^ (__force u32)iph2->saddr) |
                     ((__force u32)iph->daddr ^ (__force u32)iph2->daddr)) {
@@ -1390,13 +1391,24 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
                 NAPI_GRO_CB(p)->flush |=
                         (iph->ttl ^ iph2->ttl) |
                         (iph->tos ^ iph2->tos) |
-                        (__force int)((iph->frag_off ^ iph2->frag_off) & htons(IP_DF)) |
-                        ((u16)(ntohs(iph2->id) + NAPI_GRO_CB(p)->count) ^ id);
+                        ((iph->frag_off ^ iph2->frag_off) & htons(IP_DF));
 
+                /* Save the IP ID check to be included later when we get to
+                 * the transport layer so only the inner most IP ID is checked.
+                 * This is because some GSO/TSO implementations do not
+                 * correctly increment the IP ID for the outer hdrs.
+                 */
+                NAPI_GRO_CB(p)->flush_id =
+                            ((u16)(ntohs(iph2->id) + NAPI_GRO_CB(p)->count) ^ id);
                 NAPI_GRO_CB(p)->flush |= flush;
         }
 
         NAPI_GRO_CB(skb)->flush |= flush;
+        skb_set_network_header(skb, off);
+        /* The above will be needed by the transport layer if there is one
+         * immediately following this IP hdr.
+         */
+
         skb_gro_pull(skb, sizeof(*iph));
         skb_set_transport_header(skb, skb_gro_offset(skb));
 
@@ -1411,10 +1423,10 @@ out:
         return pp;
 }
 
-static int inet_gro_complete(struct sk_buff *skb)
+static int inet_gro_complete(struct sk_buff *skb, int nhoff)
 {
-        __be16 newlen = htons(skb->len - skb_network_offset(skb));
-        struct iphdr *iph = ip_hdr(skb);
+        __be16 newlen = htons(skb->len - nhoff);
+        struct iphdr *iph = (struct iphdr *)(skb->data + nhoff);
         const struct net_offload *ops;
         int proto = iph->protocol;
         int err = -ENOSYS;
@@ -1427,7 +1439,11 @@ static int inet_gro_complete(struct sk_buff *skb)
         if (WARN_ON(!ops || !ops->callbacks.gro_complete))
                 goto out_unlock;
 
-        err = ops->callbacks.gro_complete(skb);
+        /* Only need to add sizeof(*iph) to get to the next hdr below
+         * because any hdr with option will have been flushed in
+         * inet_gro_receive().
+         */
+        err = ops->callbacks.gro_complete(skb, nhoff + sizeof(*iph));
 
 out_unlock:
         rcu_read_unlock();
@@ -1529,6 +1545,7 @@ static const struct net_protocol tcp_protocol = {
         .err_handler    =       tcp_v4_err,
         .no_policy      =       1,
         .netns_ok       =       1,
+        .icmp_strict_tag_validation = 1,
 };
 
 static const struct net_protocol udp_protocol = {
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 7808093cede6..1a9b99e04465 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -166,18 +166,20 @@ struct neigh_table arp_tbl = {
         .id             = "arp_cache",
         .parms          = {
                 .tbl                    = &arp_tbl,
-                .base_reachable_time    = 30 * HZ,
-                .retrans_time           = 1 * HZ,
-                .gc_staletime           = 60 * HZ,
                 .reachable_time         = 30 * HZ,
-                .delay_probe_time       = 5 * HZ,
-                .queue_len_bytes        = 64*1024,
-                .ucast_probes           = 3,
-                .mcast_probes           = 3,
-                .anycast_delay          = 1 * HZ,
-                .proxy_delay            = (8 * HZ) / 10,
-                .proxy_qlen             = 64,
-                .locktime               = 1 * HZ,
+                .data   = {
+                        [NEIGH_VAR_MCAST_PROBES] = 3,
+                        [NEIGH_VAR_UCAST_PROBES] = 3,
+                        [NEIGH_VAR_RETRANS_TIME] = 1 * HZ,
+                        [NEIGH_VAR_BASE_REACHABLE_TIME] = 30 * HZ,
+                        [NEIGH_VAR_DELAY_PROBE_TIME] = 5 * HZ,
+                        [NEIGH_VAR_GC_STALETIME] = 60 * HZ,
+                        [NEIGH_VAR_QUEUE_LEN_BYTES] = 64 * 1024,
+                        [NEIGH_VAR_PROXY_QLEN] = 64,
+                        [NEIGH_VAR_ANYCAST_DELAY] = 1 * HZ,
+                        [NEIGH_VAR_PROXY_DELAY] = (8 * HZ) / 10,
+                        [NEIGH_VAR_LOCKTIME] = 1 * HZ,
+                },
         },
         .gc_interval    = 30 * HZ,
         .gc_thresh1     = 128,
@@ -359,14 +361,14 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
         if (!saddr)
                 saddr = inet_select_addr(dev, target, RT_SCOPE_LINK);
 
-        probes -= neigh->parms->ucast_probes;
+        probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
         if (probes < 0) {
                 if (!(neigh->nud_state & NUD_VALID))
                         pr_debug("trying to ucast probe in NUD_INVALID\n");
                 neigh_ha_snapshot(dst_ha, neigh, dev);
                 dst_hw = dst_ha;
         } else {
-                probes -= neigh->parms->app_probes;
+                probes -= NEIGH_VAR(neigh->parms, APP_PROBES);
                 if (probes < 0) {
                         neigh_app_ns(neigh);
                         return;
@@ -379,6 +381,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
 
 static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
 {
+        struct net *net = dev_net(in_dev->dev);
         int scope;
 
         switch (IN_DEV_ARP_IGNORE(in_dev)) {
@@ -397,6 +400,7 @@ static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
         case 3: /* Do not reply for scope host addresses */
                 sip = 0;
                 scope = RT_SCOPE_LINK;
+                in_dev = NULL;
                 break;
         case 4: /* Reserved */
         case 5:
@@ -408,7 +412,7 @@ static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)
         default:
                 return 0;
         }
-        return !inet_confirm_addr(in_dev, sip, tip, scope);
+        return !inet_confirm_addr(net, in_dev, sip, tip, scope);
 }
 
 static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev)
@@ -728,6 +732,7 @@ static int arp_process(struct sk_buff *skb)
         int addr_type;
         struct neighbour *n;
         struct net *net = dev_net(dev);
+        bool is_garp = false;
 
         /* arp_rcv below verifies the ARP header and verifies the device
          * is ARP'able.
@@ -871,7 +876,7 @@ static int arp_process(struct sk_buff *skb)
 
                                 if (NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED ||
                                     skb->pkt_type == PACKET_HOST ||
-                                    in_dev->arp_parms->proxy_delay == 0) {
+                                    NEIGH_VAR(in_dev->arp_parms, PROXY_DELAY) == 0) {
                                         arp_send(ARPOP_REPLY, ETH_P_ARP, sip,
                                                  dev, tip, sha, dev->dev_addr,
                                                  sha);
@@ -894,10 +899,12 @@ static int arp_process(struct sk_buff *skb)
                    It is possible, that this option should be enabled for some
                    devices (strip is candidate)
                  */
+                is_garp = arp->ar_op == htons(ARPOP_REQUEST) && tip == sip &&
+                          inet_addr_type(net, sip) == RTN_UNICAST;
+
                 if (n == NULL &&
-                    (arp->ar_op == htons(ARPOP_REPLY) ||
-                     (arp->ar_op == htons(ARPOP_REQUEST) && tip == sip)) &&
-                    inet_addr_type(net, sip) == RTN_UNICAST)
+                    ((arp->ar_op == htons(ARPOP_REPLY)  &&
+                      inet_addr_type(net, sip) == RTN_UNICAST) || is_garp))
                         n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
         }
 
@@ -910,7 +917,10 @@ static int arp_process(struct sk_buff *skb)
                    agents are active. Taking the first reply prevents
                    arp trashing and chooses the fastest router.
                  */
-                override = time_after(jiffies, n->updated + n->parms->locktime);
+                override = time_after(jiffies,
+                                      n->updated +
+                                      NEIGH_VAR(n->parms, LOCKTIME)) ||
+                           is_garp;
 
                 /* Broadcast replies and request packets
                    do not assert neighbour reachability.
@@ -1107,7 +1117,7 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev)
         return err;
 }
 
-int arp_invalidate(struct net_device *dev, __be32 ip)
+static int arp_invalidate(struct net_device *dev, __be32 ip)
 {
         struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev);
         int err = -ENXIO;
@@ -1122,7 +1132,6 @@ int arp_invalidate(struct net_device *dev, __be32 ip)
 
         return err;
 }
-EXPORT_SYMBOL(arp_invalidate);
 
 static int arp_req_delete_public(struct net *net, struct arpreq *r,
                 struct net_device *dev)
@@ -1284,7 +1293,7 @@ void __init arp_init(void)
         dev_add_pack(&arp_packet_type);
         arp_proc_init();
 #ifdef CONFIG_SYSCTL
-        neigh_sysctl_register(NULL, &arp_tbl.parms, "ipv4", NULL);
+        neigh_sysctl_register(NULL, &arp_tbl.parms, NULL);
 #endif
         register_netdevice_notifier(&arp_netdev_notifier);
 }
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 667c1d4ca984..69e77c8ff285 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -31,8 +31,7 @@
  * the GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program;  if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program;  if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
@@ -1336,8 +1335,7 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
         secattr->flags |= NETLBL_SECATTR_MLS_LVL;
 
         if (tag_len > 4) {
-                secattr->attr.mls.cat =
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                 if (secattr->attr.mls.cat == NULL)
                         return -ENOMEM;
 
@@ -1432,8 +1430,7 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
         secattr->flags |= NETLBL_SECATTR_MLS_LVL;
 
         if (tag_len > 4) {
-                secattr->attr.mls.cat =
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                 if (secattr->attr.mls.cat == NULL)
                         return -ENOMEM;
 
@@ -1527,8 +1524,7 @@ static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
         secattr->flags |= NETLBL_SECATTR_MLS_LVL;
 
         if (tag_len > 4) {
-                secattr->attr.mls.cat =
-                                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
+                secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
                 if (secattr->attr.mls.cat == NULL)
                         return -ENOMEM;
 
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 19e36376d2a0..8b5134c582f1 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -53,7 +53,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         rt = ip_route_connect(fl4, usin->sin_addr.s_addr, saddr,
                               RT_CONN_FLAGS(sk), oif,
                               sk->sk_protocol,
-                              inet->inet_sport, usin->sin_port, sk, true);
+                              inet->inet_sport, usin->sin_port, sk);
         if (IS_ERR(rt)) {
                 err = PTR_ERR(rt);
                 if (err == -ENETUNREACH)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a1b5bcbd04ae..ac2dff3c2c1c 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -99,6 +99,7 @@ static const struct nla_policy ifa_ipv4_policy[IFA_MAX+1] = {
         [IFA_BROADCAST]         = { .type = NLA_U32 },
         [IFA_LABEL]             = { .type = NLA_STRING, .len = IFNAMSIZ - 1 },
         [IFA_CACHEINFO]         = { .len = sizeof(struct ifa_cacheinfo) },
+        [IFA_FLAGS]             = { .type = NLA_U32 },
 };
 
 #define IN4_ADDR_HSIZE_SHIFT    8
@@ -463,7 +464,7 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh,
         }
 
         if (!(ifa->ifa_flags & IFA_F_SECONDARY)) {
-                net_srandom(ifa->ifa_local);
+                prandom_seed((__force u32) ifa->ifa_local);
                 ifap = last_primary;
         }
 
@@ -473,7 +474,7 @@ static int __inet_insert_ifa(struct in_ifaddr *ifa, struct nlmsghdr *nlh,
         inet_hash_insert(dev_net(in_dev->dev), ifa);
 
         cancel_delayed_work(&check_lifetime_work);
-        schedule_delayed_work(&check_lifetime_work, 0);
+        queue_delayed_work(system_power_efficient_wq, &check_lifetime_work, 0);
 
         /* Send message first, then call notifier.
            Notifier will trigger FIB update, so that
@@ -500,6 +501,7 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
                 return -ENOBUFS;
         }
         ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
         if (ifa->ifa_dev != in_dev) {
                 WARN_ON(ifa->ifa_dev);
                 in_dev_hold(in_dev);
@@ -682,7 +684,8 @@ static void check_lifetime(struct work_struct *work)
         if (time_before(next_sched, now + ADDRCONF_TIMER_FUZZ_MAX))
                 next_sched = now + ADDRCONF_TIMER_FUZZ_MAX;
 
-        schedule_delayed_work(&check_lifetime_work, next_sched - now);
+        queue_delayed_work(system_power_efficient_wq, &check_lifetime_work,
+                        next_sched - now);
 }
 
 static void set_ifa_lifetime(struct in_ifaddr *ifa, __u32 valid_lft,
@@ -747,6 +750,7 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
                 goto errout;
 
         ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
         in_dev_hold(in_dev);
 
         if (tb[IFA_ADDRESS] == NULL)
@@ -755,7 +759,8 @@ static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh,
         INIT_HLIST_NODE(&ifa->hash);
         ifa->ifa_prefixlen = ifm->ifa_prefixlen;
         ifa->ifa_mask = inet_make_mask(ifm->ifa_prefixlen);
-        ifa->ifa_flags = ifm->ifa_flags;
+        ifa->ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) :
+                                         ifm->ifa_flags;
         ifa->ifa_scope = ifm->ifa_scope;
         ifa->ifa_dev = in_dev;
 
@@ -838,7 +843,8 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
                 ifa = ifa_existing;
                 set_ifa_lifetime(ifa, valid_lft, prefered_lft);
                 cancel_delayed_work(&check_lifetime_work);
-                schedule_delayed_work(&check_lifetime_work, 0);
+                queue_delayed_work(system_power_efficient_wq,
+                                &check_lifetime_work, 0);
                 rtmsg_ifa(RTM_NEWADDR, ifa, nlh, NETLINK_CB(skb).portid);
                 blocking_notifier_call_chain(&inetaddr_chain, NETDEV_UP, ifa);
         }
@@ -1236,22 +1242,21 @@ static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
 
 /*
  * Confirm that local IP address exists using wildcards:
- * - in_dev: only on this interface, 0=any interface
+ * - net: netns to check, cannot be NULL
+ * - in_dev: only on this interface, NULL=any interface
  * - dst: only in the same subnet as dst, 0=any dst
  * - local: address, 0=autoselect the local address
  * - scope: maximum allowed scope value for the local address
  */
-__be32 inet_confirm_addr(struct in_device *in_dev,
+__be32 inet_confirm_addr(struct net *net, struct in_device *in_dev,
                          __be32 dst, __be32 local, int scope)
 {
         __be32 addr = 0;
         struct net_device *dev;
-        struct net *net;
 
-        if (scope != RT_SCOPE_LINK)
+        if (in_dev != NULL)
                 return confirm_addr_indev(in_dev, dst, local, scope);
 
-        net = dev_net(in_dev->dev);
         rcu_read_lock();
         for_each_netdev_rcu(net, dev) {
                 in_dev = __in_dev_get_rcu(dev);
@@ -1382,6 +1387,8 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                                 memcpy(ifa->ifa_label, dev->name, IFNAMSIZ);
                                 set_ifa_lifetime(ifa, INFINITY_LIFE_TIME,
                                                  INFINITY_LIFE_TIME);
+                                ipv4_devconf_setall(in_dev);
+                                neigh_parms_data_state_setall(in_dev->arp_parms);
                                 inet_insert_ifa(ifa);
                         }
                 }
@@ -1435,7 +1442,8 @@ static size_t inet_nlmsg_size(void)
                + nla_total_size(4) /* IFA_ADDRESS */
                + nla_total_size(4) /* IFA_LOCAL */
                + nla_total_size(4) /* IFA_BROADCAST */
-               + nla_total_size(IFNAMSIZ); /* IFA_LABEL */
+               + nla_total_size(IFNAMSIZ) /* IFA_LABEL */
+               + nla_total_size(4);  /* IFA_FLAGS */
 }
 
 static inline u32 cstamp_delta(unsigned long cstamp)
@@ -1503,6 +1511,7 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
              nla_put_be32(skb, IFA_BROADCAST, ifa->ifa_broadcast)) ||
             (ifa->ifa_label[0] &&
              nla_put_string(skb, IFA_LABEL, ifa->ifa_label)) ||
+            nla_put_u32(skb, IFA_FLAGS, ifa->ifa_flags) ||
             put_cacheinfo(skb, ifa->ifa_cstamp, ifa->ifa_tstamp,
                           preferred, valid))
                 goto nla_put_failure;
@@ -1691,6 +1700,8 @@ static int inet_netconf_msgsize_devconf(int type)
                 size += nla_total_size(4);
         if (type == -1 || type == NETCONFA_MC_FORWARDING)
                 size += nla_total_size(4);
+        if (type == -1 || type == NETCONFA_PROXY_NEIGH)
+                size += nla_total_size(4);
 
         return size;
 }
@@ -1727,6 +1738,10 @@ static int inet_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
             nla_put_s32(skb, NETCONFA_MC_FORWARDING,
                         IPV4_DEVCONF(*devconf, MC_FORWARDING)) < 0)
                 goto nla_put_failure;
+        if ((type == -1 || type == NETCONFA_PROXY_NEIGH) &&
+            nla_put_s32(skb, NETCONFA_PROXY_NEIGH,
+                        IPV4_DEVCONF(*devconf, PROXY_ARP)) < 0)
+                goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
 
@@ -1764,6 +1779,7 @@ static const struct nla_policy devconf_ipv4_policy[NETCONFA_MAX+1] = {
         [NETCONFA_IFINDEX]      = { .len = sizeof(int) },
         [NETCONFA_FORWARDING]   = { .len = sizeof(int) },
         [NETCONFA_RP_FILTER]    = { .len = sizeof(int) },
+        [NETCONFA_PROXY_NEIGH]  = { .len = sizeof(int) },
 };
 
 static int inet_netconf_get_devconf(struct sk_buff *in_skb,
@@ -1945,6 +1961,19 @@ static void inet_forward_change(struct net *net)
         }
 }
 
+static int devinet_conf_ifindex(struct net *net, struct ipv4_devconf *cnf)
+{
+        if (cnf == net->ipv4.devconf_dflt)
+                return NETCONFA_IFINDEX_DEFAULT;
+        else if (cnf == net->ipv4.devconf_all)
+                return NETCONFA_IFINDEX_ALL;
+        else {
+                struct in_device *idev
+                        = container_of(cnf, struct in_device, cnf);
+                return idev->dev->ifindex;
+        }
+}
+
 static int devinet_conf_proc(struct ctl_table *ctl, int write,
                              void __user *buffer,
                              size_t *lenp, loff_t *ppos)
@@ -1957,6 +1986,7 @@ static int devinet_conf_proc(struct ctl_table *ctl, int write,
                 struct ipv4_devconf *cnf = ctl->extra1;
                 struct net *net = ctl->extra2;
                 int i = (int *)ctl->data - cnf->data;
+                int ifindex;
 
                 set_bit(i, cnf->state);
 
@@ -1966,23 +1996,19 @@ static int devinet_conf_proc(struct ctl_table *ctl, int write,
                     i == IPV4_DEVCONF_ROUTE_LOCALNET - 1)
                         if ((new_value == 0) && (old_value != 0))
                                 rt_cache_flush(net);
+
                 if (i == IPV4_DEVCONF_RP_FILTER - 1 &&
                     new_value != old_value) {
-                        int ifindex;
-
-                        if (cnf == net->ipv4.devconf_dflt)
-                                ifindex = NETCONFA_IFINDEX_DEFAULT;
-                        else if (cnf == net->ipv4.devconf_all)
-                                ifindex = NETCONFA_IFINDEX_ALL;
-                        else {
-                                struct in_device *idev =
-                                        container_of(cnf, struct in_device,
-                                                     cnf);
-                                ifindex = idev->dev->ifindex;
-                        }
+                        ifindex = devinet_conf_ifindex(net, cnf);
                         inet_netconf_notify_devconf(net, NETCONFA_RP_FILTER,
                                                     ifindex, cnf);
                 }
+                if (i == IPV4_DEVCONF_PROXY_ARP - 1 &&
+                    new_value != old_value) {
+                        ifindex = devinet_conf_ifindex(net, cnf);
+                        inet_netconf_notify_devconf(net, NETCONFA_PROXY_NEIGH,
+                                                    ifindex, cnf);
+                }
         }
 
         return ret;
@@ -2160,7 +2186,7 @@ static void __devinet_sysctl_unregister(struct ipv4_devconf *cnf)
 
 static void devinet_sysctl_register(struct in_device *idev)
 {
-        neigh_sysctl_register(idev->dev, idev->arp_parms, "ipv4", NULL);
+        neigh_sysctl_register(idev->dev, idev->arp_parms, NULL);
         __devinet_sysctl_register(dev_net(idev->dev), idev->dev->name,
                                         &idev->cnf);
 }
@@ -2298,7 +2324,7 @@ void __init devinet_init(void)
         register_gifconf(PF_INET, inet_gifconf);
         register_netdevice_notifier(&ip_netdev_notifier);
 
-        schedule_delayed_work(&check_lifetime_work, 0);
+        queue_delayed_work(system_power_efficient_wq, &check_lifetime_work, 0);
 
         rtnl_af_register(&inet_af_ops);
 
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index d846304b7b89..c7539e22868b 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1047,6 +1047,8 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
         }
 
         in_dev = __in_dev_get_rtnl(dev);
+        if (!in_dev)
+                return NOTIFY_DONE;
 
         switch (event) {
         case NETDEV_UP:
diff --git a/net/ipv4/fib_lookup.h b/net/ipv4/fib_lookup.h
index 388d113fd289..1e4f6600b31d 100644
--- a/net/ipv4/fib_lookup.h
+++ b/net/ipv4/fib_lookup.h
@@ -33,8 +33,6 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event, u32 tb_id,
 void rtmsg_fib(int event, __be32 key, struct fib_alias *fa, int dst_len,
                u32 tb_id, const struct nl_info *info, unsigned int nlm_flags);
 struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio);
-int fib_detect_death(struct fib_info *fi, int order,
-                     struct fib_info **last_resort, int *last_idx, int dflt);
 
 static inline void fib_result_assign(struct fib_result *res,
                                      struct fib_info *fi)
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index e63f47a4e651..b53f0bf84dca 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -426,8 +426,9 @@ struct fib_alias *fib_find_alias(struct list_head *fah, u8 tos, u32 prio)
         return NULL;
 }
 
-int fib_detect_death(struct fib_info *fi, int order,
-                     struct fib_info **last_resort, int *last_idx, int dflt)
+static int fib_detect_death(struct fib_info *fi, int order,
+                            struct fib_info **last_resort, int *last_idx,
+                            int dflt)
 {
         struct neighbour *n;
         int state = NUD_NONE;
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
index 5893e99e8299..1863422fb7d5 100644
--- a/net/ipv4/gre_demux.c
+++ b/net/ipv4/gre_demux.c
@@ -355,14 +355,7 @@ static int __init gre_init(void)
                 goto err_gre;
         }
 
-        if (gre_offload_init()) {
-                pr_err("can't add protocol offload\n");
-                goto err_gso;
-        }
-
         return 0;
-err_gso:
-        gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
 err_gre:
         inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
 err:
@@ -371,8 +364,6 @@ err:
 
 static void __exit gre_exit(void)
 {
-        gre_offload_exit();
-
         gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
         inet_del_protocol(&net_gre_protocol, IPPROTO_GRE);
 }
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index 2cd02f32f99f..f1d32280cb54 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/skbuff.h>
+#include <linux/init.h>
 #include <net/protocol.h>
 #include <net/gre.h>
 
@@ -26,7 +27,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         netdev_features_t enc_features;
-        int ghl = GRE_HEADER_SECTION;
+        int ghl;
         struct gre_base_hdr *greh;
         u16 mac_offset = skb->mac_header;
         int mac_len = skb->mac_len;
@@ -49,15 +50,11 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 
         greh = (struct gre_base_hdr *)skb_transport_header(skb);
 
-        if (greh->flags & GRE_KEY)
-                ghl += GRE_HEADER_SECTION;
-        if (greh->flags & GRE_SEQ)
-                ghl += GRE_HEADER_SECTION;
-        if (greh->flags & GRE_CSUM) {
-                ghl += GRE_HEADER_SECTION;
-                csum = true;
-        } else
-                csum = false;
+        ghl = skb_inner_network_header(skb) - skb_transport_header(skb);
+        if (unlikely(ghl < sizeof(*greh)))
+                goto out;
+
+        csum = !!(greh->flags & GRE_CSUM);
 
         if (unlikely(!pskb_may_pull(skb, ghl)))
                 goto out;
@@ -116,19 +113,175 @@ out:
         return segs;
 }
 
+/* Compute the whole skb csum in s/w and store it, then verify GRO csum
+ * starting from gro_offset.
+ */
+static __sum16 gro_skb_checksum(struct sk_buff *skb)
+{
+        __sum16 sum;
+
+        skb->csum = skb_checksum(skb, 0, skb->len, 0);
+        NAPI_GRO_CB(skb)->csum = csum_sub(skb->csum,
+                csum_partial(skb->data, skb_gro_offset(skb), 0));
+        sum = csum_fold(NAPI_GRO_CB(skb)->csum);
+        if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE)) {
+                if (unlikely(!sum))
+                        netdev_rx_csum_fault(skb->dev);
+        } else
+                skb->ip_summed = CHECKSUM_COMPLETE;
+
+        return sum;
+}
+
+static struct sk_buff **gre_gro_receive(struct sk_buff **head,
+                                        struct sk_buff *skb)
+{
+        struct sk_buff **pp = NULL;
+        struct sk_buff *p;
+        const struct gre_base_hdr *greh;
+        unsigned int hlen, grehlen;
+        unsigned int off;
+        int flush = 1;
+        struct packet_offload *ptype;
+        __be16 type;
+
+        off = skb_gro_offset(skb);
+        hlen = off + sizeof(*greh);
+        greh = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                greh = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!greh))
+                        goto out;
+        }
+
+        /* Only support version 0 and K (key), C (csum) flags. Note that
+         * although the support for the S (seq#) flag can be added easily
+         * for GRO, this is problematic for GSO hence can not be enabled
+         * here because a GRO pkt may end up in the forwarding path, thus
+         * requiring GSO support to break it up correctly.
+         */
+        if ((greh->flags & ~(GRE_KEY|GRE_CSUM)) != 0)
+                goto out;
+
+        type = greh->protocol;
+
+        rcu_read_lock();
+        ptype = gro_find_receive_by_type(type);
+        if (ptype == NULL)
+                goto out_unlock;
+
+        grehlen = GRE_HEADER_SECTION;
+
+        if (greh->flags & GRE_KEY)
+                grehlen += GRE_HEADER_SECTION;
+
+        if (greh->flags & GRE_CSUM)
+                grehlen += GRE_HEADER_SECTION;
+
+        hlen = off + grehlen;
+        if (skb_gro_header_hard(skb, hlen)) {
+                greh = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!greh))
+                        goto out_unlock;
+        }
+        if (greh->flags & GRE_CSUM) { /* Need to verify GRE csum first */
+                __sum16 csum = 0;
+
+                if (skb->ip_summed == CHECKSUM_COMPLETE)
+                        csum = csum_fold(NAPI_GRO_CB(skb)->csum);
+                /* Don't trust csum error calculated/reported by h/w */
+                if (skb->ip_summed == CHECKSUM_NONE || csum != 0)
+                        csum = gro_skb_checksum(skb);
+
+                /* GRE CSUM is the 1's complement of the 1's complement sum
+                 * of the GRE hdr plus payload so it should add up to 0xffff
+                 * (and 0 after csum_fold()) just like the IPv4 hdr csum.
+                 */
+                if (csum)
+                        goto out_unlock;
+        }
+        flush = 0;
+
+        for (p = *head; p; p = p->next) {
+                const struct gre_base_hdr *greh2;
+
+                if (!NAPI_GRO_CB(p)->same_flow)
+                        continue;
+
+                /* The following checks are needed to ensure only pkts
+                 * from the same tunnel are considered for aggregation.
+                 * The criteria for "the same tunnel" includes:
+                 * 1) same version (we only support version 0 here)
+                 * 2) same protocol (we only support ETH_P_IP for now)
+                 * 3) same set of flags
+                 * 4) same key if the key field is present.
+                 */
+                greh2 = (struct gre_base_hdr *)(p->data + off);
+
+                if (greh2->flags != greh->flags ||
+                    greh2->protocol != greh->protocol) {
+                        NAPI_GRO_CB(p)->same_flow = 0;
+                        continue;
+                }
+                if (greh->flags & GRE_KEY) {
+                        /* compare keys */
+                        if (*(__be32 *)(greh2+1) != *(__be32 *)(greh+1)) {
+                                NAPI_GRO_CB(p)->same_flow = 0;
+                                continue;
+                        }
+                }
+        }
+
+        skb_gro_pull(skb, grehlen);
+
+        /* Adjusted NAPI_GRO_CB(skb)->csum after skb_gro_pull()*/
+        skb_gro_postpull_rcsum(skb, greh, grehlen);
+
+        pp = ptype->callbacks.gro_receive(head, skb);
+
+out_unlock:
+        rcu_read_unlock();
+out:
+        NAPI_GRO_CB(skb)->flush |= flush;
+
+        return pp;
+}
+
+static int gre_gro_complete(struct sk_buff *skb, int nhoff)
+{
+        struct gre_base_hdr *greh = (struct gre_base_hdr *)(skb->data + nhoff);
+        struct packet_offload *ptype;
+        unsigned int grehlen = sizeof(*greh);
+        int err = -ENOENT;
+        __be16 type;
+
+        type = greh->protocol;
+        if (greh->flags & GRE_KEY)
+                grehlen += GRE_HEADER_SECTION;
+
+        if (greh->flags & GRE_CSUM)
+                grehlen += GRE_HEADER_SECTION;
+
+        rcu_read_lock();
+        ptype = gro_find_complete_by_type(type);
+        if (ptype != NULL)
+                err = ptype->callbacks.gro_complete(skb, nhoff + grehlen);
+
+        rcu_read_unlock();
+        return err;
+}
+
 static const struct net_offload gre_offload = {
         .callbacks = {
                 .gso_send_check = gre_gso_send_check,
                 .gso_segment = gre_gso_segment,
+                .gro_receive = gre_gro_receive,
+                .gro_complete = gre_gro_complete,
         },
 };
 
-int __init gre_offload_init(void)
+static int __init gre_offload_init(void)
 {
         return inet_add_offload(&gre_offload, IPPROTO_GRE);
 }
-
-void __exit gre_offload_exit(void)
-{
-        inet_del_offload(&gre_offload, IPPROTO_GRE);
-}
+device_initcall(gre_offload_init);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 5c0e8bc6e5ba..0134663fdbce 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -668,6 +668,16 @@ static void icmp_socket_deliver(struct sk_buff *skb, u32 info)
         rcu_read_unlock();
 }
 
+static bool icmp_tag_validation(int proto)
+{
+        bool ok;
+
+        rcu_read_lock();
+        ok = rcu_dereference(inet_protos[proto])->icmp_strict_tag_validation;
+        rcu_read_unlock();
+        return ok;
+}
+
 /*
  *      Handle ICMP_DEST_UNREACH, ICMP_TIME_EXCEED, ICMP_QUENCH, and
  *      ICMP_PARAMETERPROB.
@@ -705,10 +715,22 @@ static void icmp_unreach(struct sk_buff *skb)
                 case ICMP_PORT_UNREACH:
                         break;
                 case ICMP_FRAG_NEEDED:
-                        if (ipv4_config.no_pmtu_disc) {
+                        /* for documentation of the ip_no_pmtu_disc
+                         * values please see
+                         * Documentation/networking/ip-sysctl.txt
+                         */
+                        switch (net->ipv4.sysctl_ip_no_pmtu_disc) {
+                        default:
                                 LIMIT_NETDEBUG(KERN_INFO pr_fmt("%pI4: fragmentation needed and DF set\n"),
                                                &iph->daddr);
-                        } else {
+                                break;
+                        case 2:
+                                goto out;
+                        case 3:
+                                if (!icmp_tag_validation(iph->protocol))
+                                        goto out;
+                                /* fall through */
+                        case 0:
                                 info = ntohs(icmph->un.frag.mtu);
                                 if (!info)
                                         goto out;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 7defdc9ba167..97e4d1655d26 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -211,7 +211,7 @@ static void igmp_stop_timer(struct ip_mc_list *im)
 /* It must be called with locked im->lock */
 static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
 {
-        int tv = net_random() % max_delay;
+        int tv = prandom_u32() % max_delay;
 
         im->tm_running = 1;
         if (!mod_timer(&im->timer, jiffies+tv+2))
@@ -220,7 +220,7 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
 
 static void igmp_gq_start_timer(struct in_device *in_dev)
 {
-        int tv = net_random() % in_dev->mr_maxdelay;
+        int tv = prandom_u32() % in_dev->mr_maxdelay;
 
         in_dev->mr_gq_running = 1;
         if (!mod_timer(&in_dev->mr_gq_timer, jiffies+tv+2))
@@ -229,7 +229,7 @@ static void igmp_gq_start_timer(struct in_device *in_dev)
 
 static void igmp_ifc_start_timer(struct in_device *in_dev, int delay)
 {
-        int tv = net_random() % delay;
+        int tv = prandom_u32() % delay;
 
         if (!mod_timer(&in_dev->mr_ifc_timer, jiffies+tv+2))
                 in_dev_hold(in_dev);
@@ -310,7 +310,7 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted)
         struct ip_sf_list *psf;
         int scount = 0;
 
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                 if (!is_in(pmc, psf, type, gdeleted, sdeleted))
                         continue;
                 scount++;
@@ -463,7 +463,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,
         }
         first = 1;
         psf_prev = NULL;
-        for (psf=*psf_list; psf; psf=psf_next) {
+        for (psf = *psf_list; psf; psf = psf_next) {
                 __be32 *psrc;
 
                 psf_next = psf->sf_next;
@@ -520,7 +520,7 @@ empty_source:
                         return skb;
                 if (pmc->crcount || isquery) {
                         /* make sure we have room for group header */
-                        if (skb && AVAILABLE(skb)<sizeof(struct igmpv3_grec)) {
+                        if (skb && AVAILABLE(skb) < sizeof(struct igmpv3_grec)) {
                                 igmpv3_sendpack(skb);
                                 skb = NULL; /* add_grhead will get a new one */
                         }
@@ -576,7 +576,7 @@ static void igmpv3_clear_zeros(struct ip_sf_list **ppsf)
         struct ip_sf_list *psf_prev, *psf_next, *psf;
 
         psf_prev = NULL;
-        for (psf=*ppsf; psf; psf = psf_next) {
+        for (psf = *ppsf; psf; psf = psf_next) {
                 psf_next = psf->sf_next;
                 if (psf->sf_crcount == 0) {
                         if (psf_prev)
@@ -600,7 +600,7 @@ static void igmpv3_send_cr(struct in_device *in_dev)
 
         /* deleted MCA's */
         pmc_prev = NULL;
-        for (pmc=in_dev->mc_tomb; pmc; pmc=pmc_next) {
+        for (pmc = in_dev->mc_tomb; pmc; pmc = pmc_next) {
                 pmc_next = pmc->next;
                 if (pmc->sfmode == MCAST_INCLUDE) {
                         type = IGMPV3_BLOCK_OLD_SOURCES;
@@ -764,7 +764,7 @@ static void igmp_ifc_event(struct in_device *in_dev)
 
 static void igmp_timer_expire(unsigned long data)
 {
-        struct ip_mc_list *im=(struct ip_mc_list *)data;
+        struct ip_mc_list *im = (struct ip_mc_list *)data;
         struct in_device *in_dev = im->interface;
 
         spin_lock(&im->lock);
@@ -794,10 +794,10 @@ static int igmp_xmarksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
         int i, scount;
 
         scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                 if (scount == nsrcs)
                         break;
-                for (i=0; i<nsrcs; i++) {
+                for (i = 0; i < nsrcs; i++) {
                         /* skip inactive filters */
                         if (psf->sf_count[MCAST_INCLUDE] ||
                             pmc->sfcount[MCAST_EXCLUDE] !=
@@ -825,10 +825,10 @@ static int igmp_marksources(struct ip_mc_list *pmc, int nsrcs, __be32 *srcs)
 
         /* mark INCLUDE-mode sources */
         scount = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                 if (scount == nsrcs)
                         break;
-                for (i=0; i<nsrcs; i++)
+                for (i = 0; i < nsrcs; i++)
                         if (srcs[i] == psf->sf_inaddr) {
                                 psf->sf_gsresp = 1;
                                 scount++;
@@ -1103,7 +1103,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
                 pmc->tomb = im->tomb;
                 pmc->sources = im->sources;
                 im->tomb = im->sources = NULL;
-                for (psf=pmc->sources; psf; psf=psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                         psf->sf_crcount = pmc->crcount;
         }
         spin_unlock_bh(&im->lock);
@@ -1121,7 +1121,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
 
         spin_lock_bh(&in_dev->mc_tomb_lock);
         pmc_prev = NULL;
-        for (pmc=in_dev->mc_tomb; pmc; pmc=pmc->next) {
+        for (pmc = in_dev->mc_tomb; pmc; pmc = pmc->next) {
                 if (pmc->multiaddr == multiaddr)
                         break;
                 pmc_prev = pmc;
@@ -1134,7 +1134,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, __be32 multiaddr)
         }
         spin_unlock_bh(&in_dev->mc_tomb_lock);
         if (pmc) {
-                for (psf=pmc->tomb; psf; psf=psf_next) {
+                for (psf = pmc->tomb; psf; psf = psf_next) {
                         psf_next = psf->sf_next;
                         kfree(psf);
                 }
@@ -1167,7 +1167,7 @@ static void igmpv3_clear_delrec(struct in_device *in_dev)
                 psf = pmc->tomb;
                 pmc->tomb = NULL;
                 spin_unlock_bh(&pmc->lock);
-                for (; psf; psf=psf_next) {
+                for (; psf; psf = psf_next) {
                         psf_next = psf->sf_next;
                         kfree(psf);
                 }
@@ -1557,7 +1557,7 @@ static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
         int rv = 0;
 
         psf_prev = NULL;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                 if (psf->sf_inaddr == *psfsrc)
                         break;
                 psf_prev = psf;
@@ -1630,7 +1630,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                 pmc->sfcount[sfmode]--;
         }
         err = 0;
-        for (i=0; i<sfcount; i++) {
+        for (i = 0; i < sfcount; i++) {
                 int rv = ip_mc_del1_src(pmc, sfmode, &psfsrc[i]);
 
                 changerec |= rv > 0;
@@ -1650,7 +1650,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                 pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
                         IGMP_Unsolicited_Report_Count;
                 in_dev->mr_ifc_count = pmc->crcount;
-                for (psf=pmc->sources; psf; psf = psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                         psf->sf_crcount = 0;
                 igmp_ifc_event(pmc->interface);
         } else if (sf_setstate(pmc) || changerec) {
@@ -1671,7 +1671,7 @@ static int ip_mc_add1_src(struct ip_mc_list *pmc, int sfmode,
         struct ip_sf_list *psf, *psf_prev;
 
         psf_prev = NULL;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                 if (psf->sf_inaddr == *psfsrc)
                         break;
                 psf_prev = psf;
@@ -1699,7 +1699,7 @@ static void sf_markstate(struct ip_mc_list *pmc)
         struct ip_sf_list *psf;
         int mca_xcount = pmc->sfcount[MCAST_EXCLUDE];
 
-        for (psf=pmc->sources; psf; psf=psf->sf_next)
+        for (psf = pmc->sources; psf; psf = psf->sf_next)
                 if (pmc->sfcount[MCAST_EXCLUDE]) {
                         psf->sf_oldin = mca_xcount ==
                                 psf->sf_count[MCAST_EXCLUDE] &&
@@ -1716,7 +1716,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
         int new_in, rv;
 
         rv = 0;
-        for (psf=pmc->sources; psf; psf=psf->sf_next) {
+        for (psf = pmc->sources; psf; psf = psf->sf_next) {
                 if (pmc->sfcount[MCAST_EXCLUDE]) {
                         new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
                                 !psf->sf_count[MCAST_INCLUDE];
@@ -1726,7 +1726,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                         if (!psf->sf_oldin) {
                                 struct ip_sf_list *prev = NULL;
 
-                                for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next) {
+                                for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next) {
                                         if (dpsf->sf_inaddr == psf->sf_inaddr)
                                                 break;
                                         prev = dpsf;
@@ -1748,7 +1748,7 @@ static int sf_setstate(struct ip_mc_list *pmc)
                          * add or update "delete" records if an active filter
                          * is now inactive
                          */
-                        for (dpsf=pmc->tomb; dpsf; dpsf=dpsf->sf_next)
+                        for (dpsf = pmc->tomb; dpsf; dpsf = dpsf->sf_next)
                                 if (dpsf->sf_inaddr == psf->sf_inaddr)
                                         break;
                         if (!dpsf) {
@@ -1800,7 +1800,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
         if (!delta)
                 pmc->sfcount[sfmode]++;
         err = 0;
-        for (i=0; i<sfcount; i++) {
+        for (i = 0; i < sfcount; i++) {
                 err = ip_mc_add1_src(pmc, sfmode, &psfsrc[i]);
                 if (err)
                         break;
@@ -1810,7 +1810,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 
                 if (!delta)
                         pmc->sfcount[sfmode]--;
-                for (j=0; j<i; j++)
+                for (j = 0; j < i; j++)
                         (void) ip_mc_del1_src(pmc, sfmode, &psfsrc[j]);
         } else if (isexclude != (pmc->sfcount[MCAST_EXCLUDE] != 0)) {
 #ifdef CONFIG_IP_MULTICAST
@@ -1829,7 +1829,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                 pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
                         IGMP_Unsolicited_Report_Count;
                 in_dev->mr_ifc_count = pmc->crcount;
-                for (psf=pmc->sources; psf; psf = psf->sf_next)
+                for (psf = pmc->sources; psf; psf = psf->sf_next)
                         psf->sf_crcount = 0;
                 igmp_ifc_event(in_dev);
         } else if (sf_setstate(pmc)) {
@@ -1844,12 +1844,12 @@ static void ip_mc_clear_src(struct ip_mc_list *pmc)
 {
         struct ip_sf_list *psf, *nextpsf;
 
-        for (psf=pmc->tomb; psf; psf=nextpsf) {
+        for (psf = pmc->tomb; psf; psf = nextpsf) {
                 nextpsf = psf->sf_next;
                 kfree(psf);
         }
         pmc->tomb = NULL;
-        for (psf=pmc->sources; psf; psf=nextpsf) {
+        for (psf = pmc->sources; psf; psf = nextpsf) {
                 nextpsf = psf->sf_next;
                 kfree(psf);
         }
@@ -2043,7 +2043,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 if (!psl)
                         goto done;      /* err = -EADDRNOTAVAIL */
                 rv = !0;
-                for (i=0; i<psl->sl_count; i++) {
+                for (i = 0; i < psl->sl_count; i++) {
                         rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
                                 sizeof(__be32));
                         if (rv == 0)
@@ -2062,7 +2062,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 ip_mc_del_src(in_dev, &mreqs->imr_multiaddr, omode, 1,
                         &mreqs->imr_sourceaddr, 1);
 
-                for (j=i+1; j<psl->sl_count; j++)
+                for (j = i+1; j < psl->sl_count; j++)
                         psl->sl_addr[j-1] = psl->sl_addr[j];
                 psl->sl_count--;
                 err = 0;
@@ -2088,7 +2088,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 newpsl->sl_max = count;
                 newpsl->sl_count = count - IP_SFBLOCK;
                 if (psl) {
-                        for (i=0; i<psl->sl_count; i++)
+                        for (i = 0; i < psl->sl_count; i++)
                                 newpsl->sl_addr[i] = psl->sl_addr[i];
                         /* decrease mem now to avoid the memleak warning */
                         atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
@@ -2098,7 +2098,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
                 psl = newpsl;
         }
         rv = 1; /* > 0 for insert logic below if sl_count is 0 */
-        for (i=0; i<psl->sl_count; i++) {
+        for (i = 0; i < psl->sl_count; i++) {
                 rv = memcmp(&psl->sl_addr[i], &mreqs->imr_sourceaddr,
                         sizeof(__be32));
                 if (rv == 0)
@@ -2106,7 +2106,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
         }
         if (rv == 0)            /* address already there is an error */
                 goto done;
-        for (j=psl->sl_count-1; j>=i; j--)
+        for (j = psl->sl_count-1; j >= i; j--)
                 psl->sl_addr[j+1] = psl->sl_addr[j];
         psl->sl_addr[i] = mreqs->imr_sourceaddr;
         psl->sl_count++;
@@ -2305,7 +2305,7 @@ int ip_mc_gsfget(struct sock *sk, struct group_filter *gsf,
             copy_to_user(optval, gsf, GROUP_FILTER_SIZE(0))) {
                 return -EFAULT;
         }
-        for (i=0; i<copycount; i++) {
+        for (i = 0; i < copycount; i++) {
                 struct sockaddr_storage ss;
 
                 psin = (struct sockaddr_in *)&ss;
@@ -2350,7 +2350,7 @@ int ip_mc_sf_allow(struct sock *sk, __be32 loc_addr, __be32 rmt_addr, int dif)
         if (!psl)
                 goto unlock;
 
-        for (i=0; i<psl->sl_count; i++) {
+        for (i = 0; i < psl->sl_count; i++) {
                 if (psl->sl_addr[i] == rmt_addr)
                         break;
         }
@@ -2423,7 +2423,7 @@ int ip_check_mc_rcu(struct in_device *in_dev, __be32 mc_addr, __be32 src_addr, u
                 rv = 1;
         } else if (im) {
                 if (src_addr) {
-                        for (psf=im->sources; psf; psf=psf->sf_next) {
+                        for (psf = im->sources; psf; psf = psf->sf_next) {
                                 if (psf->sf_inaddr == src_addr)
                                         break;
                         }
@@ -2762,6 +2762,7 @@ static struct pernet_operations igmp_net_ops = {
         .init = igmp_net_init,
         .exit = igmp_net_exit,
 };
+#endif
 
 static int igmp_netdev_event(struct notifier_block *this,
                              unsigned long event, void *ptr)
@@ -2785,8 +2786,9 @@ static struct notifier_block igmp_notifier = {
         .notifier_call = igmp_netdev_event,
 };
 
-int __init igmp_mc_proc_init(void)
+int __init igmp_mc_init(void)
 {
+#if defined(CONFIG_PROC_FS)
         int err;
 
         err = register_pernet_subsys(&igmp_net_ops);
@@ -2800,5 +2802,7 @@ int __init igmp_mc_proc_init(void)
 reg_notif_fail:
         unregister_pernet_subsys(&igmp_net_ops);
         return err;
-}
+#else
+        return register_netdevice_notifier(&igmp_notifier);
 #endif
+}
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index fc0e649cc002..0d1e2cb877ec 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -109,7 +109,7 @@ int inet_csk_get_port(struct sock *sk, unsigned short snum)
 again:
                 inet_get_local_port_range(net, &low, &high);
                 remaining = (high - low) + 1;
-                smallest_rover = rover = net_random() % remaining + low;
+                smallest_rover = rover = prandom_u32() % remaining + low;
 
                 smallest_size = -1;
                 do {
diff --git a/net/ipv4/inet_lro.c b/net/ipv4/inet_lro.c
index 1975f52933c5..f17ea49b28fb 100644
--- a/net/ipv4/inet_lro.c
+++ b/net/ipv4/inet_lro.c
@@ -230,29 +230,6 @@ static void lro_add_packet(struct net_lro_desc *lro_desc, struct sk_buff *skb,
         lro_desc->last_skb = skb;
 }
 
-static void lro_add_frags(struct net_lro_desc *lro_desc,
-                          int len, int hlen, int truesize,
-                          struct skb_frag_struct *skb_frags,
-                          struct iphdr *iph, struct tcphdr *tcph)
-{
-        struct sk_buff *skb = lro_desc->parent;
-        int tcp_data_len = TCP_PAYLOAD_LENGTH(iph, tcph);
-
-        lro_add_common(lro_desc, iph, tcph, tcp_data_len);
-
-        skb->truesize += truesize;
-
-        skb_frags[0].page_offset += hlen;
-        skb_frag_size_sub(&skb_frags[0], hlen);
-
-        while (tcp_data_len > 0) {
-                *(lro_desc->next_frag) = *skb_frags;
-                tcp_data_len -= skb_frag_size(skb_frags);
-                lro_desc->next_frag++;
-                skb_frags++;
-                skb_shinfo(skb)->nr_frags++;
-        }
-}
 
 static int lro_check_tcp_conn(struct net_lro_desc *lro_desc,
                               struct iphdr *iph,
@@ -371,128 +348,6 @@ out:
         return 1;
 }
 
-
-static struct sk_buff *lro_gen_skb(struct net_lro_mgr *lro_mgr,
-                                   struct skb_frag_struct *frags,
-                                   int len, int true_size,
-                                   void *mac_hdr,
-                                   int hlen, __wsum sum,
-                                   u32 ip_summed)
-{
-        struct sk_buff *skb;
-        struct skb_frag_struct *skb_frags;
-        int data_len = len;
-        int hdr_len = min(len, hlen);
-
-        skb = netdev_alloc_skb(lro_mgr->dev, hlen + lro_mgr->frag_align_pad);
-        if (!skb)
-                return NULL;
-
-        skb_reserve(skb, lro_mgr->frag_align_pad);
-        skb->len = len;
-        skb->data_len = len - hdr_len;
-        skb->truesize += true_size;
-        skb->tail += hdr_len;
-
-        memcpy(skb->data, mac_hdr, hdr_len);
-
-        skb_frags = skb_shinfo(skb)->frags;
-        while (data_len > 0) {
-                *skb_frags = *frags;
-                data_len -= skb_frag_size(frags);
-                skb_frags++;
-                frags++;
-                skb_shinfo(skb)->nr_frags++;
-        }
-
-        skb_shinfo(skb)->frags[0].page_offset += hdr_len;
-        skb_frag_size_sub(&skb_shinfo(skb)->frags[0], hdr_len);
-
-        skb->ip_summed = ip_summed;
-        skb->csum = sum;
-        skb->protocol = eth_type_trans(skb, lro_mgr->dev);
-        return skb;
-}
-
-static struct sk_buff *__lro_proc_segment(struct net_lro_mgr *lro_mgr,
-                                          struct skb_frag_struct *frags,
-                                          int len, int true_size,
-                                          void *priv, __wsum sum)
-{
-        struct net_lro_desc *lro_desc;
-        struct iphdr *iph;
-        struct tcphdr *tcph;
-        struct sk_buff *skb;
-        u64 flags;
-        void *mac_hdr;
-        int mac_hdr_len;
-        int hdr_len = LRO_MAX_PG_HLEN;
-        int vlan_hdr_len = 0;
-
-        if (!lro_mgr->get_frag_header ||
-            lro_mgr->get_frag_header(frags, (void *)&mac_hdr, (void *)&iph,
-                                     (void *)&tcph, &flags, priv)) {
-                mac_hdr = skb_frag_address(frags);
-                goto out1;
-        }
-
-        if (!(flags & LRO_IPV4) || !(flags & LRO_TCP))
-                goto out1;
-
-        hdr_len = (int)((void *)(tcph) + TCP_HDR_LEN(tcph) - mac_hdr);
-        mac_hdr_len = (int)((void *)(iph) - mac_hdr);
-
-        lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
-        if (!lro_desc)
-                goto out1;
-
-        if (!lro_desc->active) { /* start new lro session */
-                if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, NULL))
-                        goto out1;
-
-                skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-                                  hdr_len, 0, lro_mgr->ip_summed_aggr);
-                if (!skb)
-                        goto out;
-
-                if ((skb->protocol == htons(ETH_P_8021Q)) &&
-                    !(lro_mgr->features & LRO_F_EXTRACT_VLAN_ID))
-                        vlan_hdr_len = VLAN_HLEN;
-
-                iph = (void *)(skb->data + vlan_hdr_len);
-                tcph = (void *)((u8 *)skb->data + vlan_hdr_len
-                                + IP_HDR_LEN(iph));
-
-                lro_init_desc(lro_desc, skb, iph, tcph);
-                LRO_INC_STATS(lro_mgr, aggregated);
-                return NULL;
-        }
-
-        if (lro_desc->tcp_next_seq != ntohl(tcph->seq))
-                goto out2;
-
-        if (lro_tcp_ip_check(iph, tcph, len - mac_hdr_len, lro_desc))
-                goto out2;
-
-        lro_add_frags(lro_desc, len, hdr_len, true_size, frags, iph, tcph);
-        LRO_INC_STATS(lro_mgr, aggregated);
-
-        if ((skb_shinfo(lro_desc->parent)->nr_frags >= lro_mgr->max_aggr) ||
-            lro_desc->parent->len > (0xFFFF - lro_mgr->dev->mtu))
-                lro_flush(lro_mgr, lro_desc);
-
-        return NULL;
-
-out2: /* send aggregated packets to the stack */
-        lro_flush(lro_mgr, lro_desc);
-
-out1:  /* Original packet has to be posted to the stack */
-        skb = lro_gen_skb(lro_mgr, frags, len, true_size, mac_hdr,
-                          hdr_len, sum, lro_mgr->ip_summed);
-out:
-        return skb;
-}
-
 void lro_receive_skb(struct net_lro_mgr *lro_mgr,
                      struct sk_buff *skb,
                      void *priv)
@@ -506,23 +361,6 @@ void lro_receive_skb(struct net_lro_mgr *lro_mgr,
 }
 EXPORT_SYMBOL(lro_receive_skb);
 
-void lro_receive_frags(struct net_lro_mgr *lro_mgr,
-                       struct skb_frag_struct *frags,
-                       int len, int true_size, void *priv, __wsum sum)
-{
-        struct sk_buff *skb;
-
-        skb = __lro_proc_segment(lro_mgr, frags, len, true_size, priv, sum);
-        if (!skb)
-                return;
-
-        if (lro_mgr->features & LRO_F_NAPI)
-                netif_receive_skb(skb);
-        else
-                netif_rx(skb);
-}
-EXPORT_SYMBOL(lro_receive_frags);
-
 void lro_flush_all(struct net_lro_mgr *lro_mgr)
 {
         int i;
@@ -534,14 +372,3 @@ void lro_flush_all(struct net_lro_mgr *lro_mgr)
         }
 }
 EXPORT_SYMBOL(lro_flush_all);
-
-void lro_flush_pkt(struct net_lro_mgr *lro_mgr,
-                  struct iphdr *iph, struct tcphdr *tcph)
-{
-        struct net_lro_desc *lro_desc;
-
-        lro_desc = lro_get_desc(lro_mgr, lro_mgr->lro_arr, iph, tcph);
-        if (lro_desc->active)
-                lro_flush(lro_mgr, lro_desc);
-}
-EXPORT_SYMBOL(lro_flush_pkt);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 33d5537881ed..48f424465112 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -109,13 +109,6 @@ static inline void flush_check(struct inet_peer_base *base, int family)
         }
 }
 
-void inetpeer_invalidate_family(int family)
-{
-        atomic_t *fp = inetpeer_seq_ptr(family);
-
-        atomic_inc(fp);
-}
-
 #define PEER_MAXDEPTH 40 /* sufficient for about 2^27 nodes */
 
 /* Exported for sysctl_net_ipv4.  */
@@ -227,7 +220,7 @@ static int addr_compare(const struct inetpeer_addr *a,
         stackptr = _stack;                                      \
         *stackptr++ = &_base->root;                             \
         for (u = rcu_deref_locked(_base->root, _base);          \
-             u != peer_avl_empty; ) {                           \
+             u != peer_avl_empty;) {                            \
                 int cmp = addr_compare(_daddr, &u->daddr);      \
                 if (cmp == 0)                                   \
                         break;                                  \
@@ -282,7 +275,7 @@ static struct inet_peer *lookup_rcu(const struct inetpeer_addr *daddr,
         *stackptr++ = &start->avl_left;                         \
         v = &start->avl_left;                                   \
         for (u = rcu_deref_locked(*v, base);                    \
-             u->avl_right != peer_avl_empty_rcu; ) {            \
+             u->avl_right != peer_avl_empty_rcu;) {             \
                 v = &u->avl_right;                              \
                 *stackptr++ = v;                                \
                 u = rcu_deref_locked(*v, base);                 \
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 694de3b7aebf..e9f1217a8afd 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -54,6 +54,7 @@ static int ip_forward_finish(struct sk_buff *skb)
 
 int ip_forward(struct sk_buff *skb)
 {
+        u32 mtu;
         struct iphdr *iph;      /* Our header */
         struct rtable *rt;      /* Route we use */
         struct ip_options *opt  = &(IPCB(skb)->opt);
@@ -88,11 +89,13 @@ int ip_forward(struct sk_buff *skb)
         if (opt->is_strictroute && rt->rt_uses_gateway)
                 goto sr_failed;
 
-        if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) &&
+        IPCB(skb)->flags |= IPSKB_FORWARDED;
+        mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
+        if (unlikely(skb->len > mtu && !skb_is_gso(skb) &&
                      (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
                 IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS);
                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
-                          htonl(dst_mtu(&rt->dst)));
+                          htonl(mtu));
                 goto drop;
         }
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 2481993a4970..c10a3ce5cbff 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -704,7 +704,7 @@ struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
                         memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
                         if (ip_defrag(skb, user))
                                 return NULL;
-                        skb->rxhash = 0;
+                        skb_clear_hash(skb);
                 }
         }
         return skb;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index e560ef34cf4b..e7a92fdb36f6 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -278,7 +278,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
         return NETDEV_TX_OK;
 
 free_skb:
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 out:
         dev->stats.tx_dropped++;
         return NETDEV_TX_OK;
@@ -301,7 +301,7 @@ static netdev_tx_t gre_tap_xmit(struct sk_buff *skb,
         return NETDEV_TX_OK;
 
 free_skb:
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 out:
         dev->stats.tx_dropped++;
         return NETDEV_TX_OK;
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index ec7264514a82..f4ab72e19af9 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -167,7 +167,7 @@ int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
                 soffset -= 4;
                 if (soffset > 3) {
                         memcpy(&faddr, &start[soffset-1], 4);
-                        for (soffset-=4, doffset=4; soffset > 3; soffset-=4, doffset+=4)
+                        for (soffset -= 4, doffset = 4; soffset > 3; soffset -= 4, doffset += 4)
                                 memcpy(&dptr[doffset-1], &start[soffset-1], 4);
                         /*
                          * RFC1812 requires to fix illegal source routes.
@@ -227,7 +227,7 @@ void ip_options_fragment(struct sk_buff *skb)
                         continue;
                 }
                 optlen = optptr[1];
-                if (optlen<2 || optlen>l)
+                if (optlen < 2 || optlen > l)
                   return;
                 if (!IPOPT_COPIED(*optptr))
                         memset(optptr, IPOPT_NOOP, optlen);
@@ -275,27 +275,27 @@ int ip_options_compile(struct net *net,
 
         for (l = opt->optlen; l > 0; ) {
                 switch (*optptr) {
-                      case IPOPT_END:
-                        for (optptr++, l--; l>0; optptr++, l--) {
+                case IPOPT_END:
+                        for (optptr++, l--; l > 0; optptr++, l--) {
                                 if (*optptr != IPOPT_END) {
                                         *optptr = IPOPT_END;
                                         opt->is_changed = 1;
                                 }
                         }
                         goto eol;
-                      case IPOPT_NOOP:
+                case IPOPT_NOOP:
                         l--;
                         optptr++;
                         continue;
                 }
                 optlen = optptr[1];
-                if (optlen<2 || optlen>l) {
+                if (optlen < 2 || optlen > l) {
                         pp_ptr = optptr;
                         goto error;
                 }
                 switch (*optptr) {
-                      case IPOPT_SSRR:
-                      case IPOPT_LSRR:
+                case IPOPT_SSRR:
+                case IPOPT_LSRR:
                         if (optlen < 3) {
                                 pp_ptr = optptr + 1;
                                 goto error;
@@ -321,7 +321,7 @@ int ip_options_compile(struct net *net,
                         opt->is_strictroute = (optptr[0] == IPOPT_SSRR);
                         opt->srr = optptr - iph;
                         break;
-                      case IPOPT_RR:
+                case IPOPT_RR:
                         if (opt->rr) {
                                 pp_ptr = optptr;
                                 goto error;
@@ -349,7 +349,7 @@ int ip_options_compile(struct net *net,
                         }
                         opt->rr = optptr - iph;
                         break;
-                      case IPOPT_TIMESTAMP:
+                case IPOPT_TIMESTAMP:
                         if (opt->ts) {
                                 pp_ptr = optptr;
                                 goto error;
@@ -369,13 +369,13 @@ int ip_options_compile(struct net *net,
                                         goto error;
                                 }
                                 switch (optptr[3]&0xF) {
-                                      case IPOPT_TS_TSONLY:
+                                case IPOPT_TS_TSONLY:
                                         if (skb)
                                                 timeptr = &optptr[optptr[2]-1];
                                         opt->ts_needtime = 1;
                                         optptr[2] += 4;
                                         break;
-                                      case IPOPT_TS_TSANDADDR:
+                                case IPOPT_TS_TSANDADDR:
                                         if (optptr[2]+7 > optptr[1]) {
                                                 pp_ptr = optptr + 2;
                                                 goto error;
@@ -389,7 +389,7 @@ int ip_options_compile(struct net *net,
                                         opt->ts_needtime = 1;
                                         optptr[2] += 8;
                                         break;
-                                      case IPOPT_TS_PRESPEC:
+                                case IPOPT_TS_PRESPEC:
                                         if (optptr[2]+7 > optptr[1]) {
                                                 pp_ptr = optptr + 2;
                                                 goto error;
@@ -405,7 +405,7 @@ int ip_options_compile(struct net *net,
                                         opt->ts_needtime = 1;
                                         optptr[2] += 8;
                                         break;
-                                      default:
+                                default:
                                         if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) {
                                                 pp_ptr = optptr + 3;
                                                 goto error;
@@ -433,7 +433,7 @@ int ip_options_compile(struct net *net,
                         }
                         opt->ts = optptr - iph;
                         break;
-                      case IPOPT_RA:
+                case IPOPT_RA:
                         if (optlen < 4) {
                                 pp_ptr = optptr + 1;
                                 goto error;
@@ -441,7 +441,7 @@ int ip_options_compile(struct net *net,
                         if (optptr[2] == 0 && optptr[3] == 0)
                                 opt->router_alert = optptr - iph;
                         break;
-                      case IPOPT_CIPSO:
+                case IPOPT_CIPSO:
                         if ((!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) || opt->cipso) {
                                 pp_ptr = optptr;
                                 goto error;
@@ -452,9 +452,9 @@ int ip_options_compile(struct net *net,
                                 goto error;
                         }
                         break;
-                      case IPOPT_SEC:
-                      case IPOPT_SID:
-                      default:
+                case IPOPT_SEC:
+                case IPOPT_SID:
+                default:
                         if (!skb && !ns_capable(net->user_ns, CAP_NET_RAW)) {
                                 pp_ptr = optptr;
                                 goto error;
@@ -572,7 +572,7 @@ void ip_forward_options(struct sk_buff *skb)
 
                 optptr = raw + opt->srr;
 
-                for ( srrptr=optptr[2], srrspace = optptr[1];
+                for ( srrptr = optptr[2], srrspace = optptr[1];
                      srrptr <= srrspace;
                      srrptr += 4
                      ) {
@@ -628,7 +628,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
         if (rt->rt_type != RTN_LOCAL)
                 return -EINVAL;
 
-        for (srrptr=optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) {
+        for (srrptr = optptr[2], srrspace = optptr[1]; srrptr <= srrspace; srrptr += 4) {
                 if (srrptr + 3 > srrspace) {
                         icmp_send(skb, ICMP_PARAMETERPROB, 0, htonl((opt->srr+2)<<24));
                         return -EINVAL;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index df184616493f..8971780aec7c 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -449,6 +449,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         __be16 not_last_frag;
         struct rtable *rt = skb_rtable(skb);
         int err = 0;
+        bool forwarding = IPCB(skb)->flags & IPSKB_FORWARDED;
 
         dev = rt->dst.dev;
 
@@ -458,12 +459,13 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
         iph = ip_hdr(skb);
 
+        mtu = ip_dst_mtu_maybe_forward(&rt->dst, forwarding);
         if (unlikely(((iph->frag_off & htons(IP_DF)) && !skb->local_df) ||
                      (IPCB(skb)->frag_max_size &&
-                      IPCB(skb)->frag_max_size > dst_mtu(&rt->dst)))) {
+                      IPCB(skb)->frag_max_size > mtu))) {
                 IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
-                          htonl(ip_skb_dst_mtu(skb)));
+                          htonl(mtu));
                 kfree_skb(skb);
                 return -EMSGSIZE;
         }
@@ -473,7 +475,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
          */
 
         hlen = iph->ihl * 4;
-        mtu = dst_mtu(&rt->dst) - hlen; /* Size of data space */
+        mtu = mtu - hlen;       /* Size of data space */
 #ifdef CONFIG_BRIDGE_NETFILTER
         if (skb->nf_bridge)
                 mtu -= nf_bridge_mtu_reduction(skb);
@@ -1551,7 +1553,7 @@ void __init ip_init(void)
         ip_rt_init();
         inet_initpeers();
 
-#if defined(CONFIG_IP_MULTICAST) && defined(CONFIG_PROC_FS)
-        igmp_mc_proc_init();
+#if defined(CONFIG_IP_MULTICAST)
+        igmp_mc_init();
 #endif
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index ddf32a6bc415..580dd96666e0 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -56,7 +56,6 @@
 /*
  *      SOL_IP control messages.
  */
-#define PKTINFO_SKB_CB(__skb) ((struct in_pktinfo *)((__skb)->cb))
 
 static void ip_cmsg_recv_pktinfo(struct msghdr *msg, struct sk_buff *skb)
 {
@@ -390,7 +389,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
         struct sock_exterr_skb *serr;
         struct sk_buff *skb, *skb2;
-        struct sockaddr_in *sin;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
         struct {
                 struct sock_extended_err ee;
                 struct sockaddr_in       offender;
@@ -416,7 +415,6 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 
         serr = SKB_EXT_ERR(skb);
 
-        sin = (struct sockaddr_in *)msg->msg_name;
         if (sin) {
                 sin->sin_family = AF_INET;
                 sin->sin_addr.s_addr = *(__be32 *)(skb_network_header(skb) +
@@ -1051,14 +1049,15 @@ e_inval:
  *
  * To support IP_CMSG_PKTINFO option, we store rt_iif and specific
  * destination in skb->cb[] before dst drop.
- * This way, receiver doesnt make cache line misses to read rtable.
+ * This way, receiver doesn't make cache line misses to read rtable.
  */
 void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
 {
         struct in_pktinfo *pktinfo = PKTINFO_SKB_CB(skb);
+        bool prepare = (inet_sk(sk)->cmsg_flags & IP_CMSG_PKTINFO) ||
+                       ipv6_sk_rxinfo(sk);
 
-        if ((inet_sk(sk)->cmsg_flags & IP_CMSG_PKTINFO) &&
-            skb_rtable(skb)) {
+        if (prepare && skb_rtable(skb)) {
                 pktinfo->ipi_ifindex = inet_iif(skb);
                 pktinfo->ipi_spec_dst.s_addr = fib_compute_spec_dst(skb);
         } else {
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 90ff9570d7d4..c0e3cb72ad70 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -61,13 +61,69 @@
 #include <net/ip6_route.h>
 #endif
 
-static unsigned int ip_tunnel_hash(struct ip_tunnel_net *itn,
-                                   __be32 key, __be32 remote)
+static unsigned int ip_tunnel_hash(__be32 key, __be32 remote)
 {
         return hash_32((__force u32)key ^ (__force u32)remote,
                          IP_TNL_HASH_BITS);
 }
 
+static void __tunnel_dst_set(struct ip_tunnel_dst *idst,
+                             struct dst_entry *dst)
+{
+        struct dst_entry *old_dst;
+
+        if (dst) {
+                if (dst->flags & DST_NOCACHE)
+                        dst = NULL;
+                else
+                        dst_clone(dst);
+        }
+        old_dst = xchg((__force struct dst_entry **)&idst->dst, dst);
+        dst_release(old_dst);
+}
+
+static void tunnel_dst_set(struct ip_tunnel *t, struct dst_entry *dst)
+{
+        __tunnel_dst_set(this_cpu_ptr(t->dst_cache), dst);
+}
+
+static void tunnel_dst_reset(struct ip_tunnel *t)
+{
+        tunnel_dst_set(t, NULL);
+}
+
+static void tunnel_dst_reset_all(struct ip_tunnel *t)
+{
+        int i;
+
+        for_each_possible_cpu(i)
+                __tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL);
+}
+
+static struct dst_entry *tunnel_dst_get(struct ip_tunnel *t)
+{
+        struct dst_entry *dst;
+
+        rcu_read_lock();
+        dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst);
+        if (dst)
+                dst_hold(dst);
+        rcu_read_unlock();
+        return dst;
+}
+
+static struct dst_entry *tunnel_dst_check(struct ip_tunnel *t, u32 cookie)
+{
+        struct dst_entry *dst = tunnel_dst_get(t);
+
+        if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
+                tunnel_dst_reset(t);
+                return NULL;
+        }
+
+        return dst;
+}
+
 /* Often modified stats are per cpu, other are shared (netdev->stats) */
 struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
                                                 struct rtnl_link_stats64 *tot)
@@ -75,7 +131,8 @@ struct rtnl_link_stats64 *ip_tunnel_get_stats64(struct net_device *dev,
         int i;
 
         for_each_possible_cpu(i) {
-                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
+                const struct pcpu_sw_netstats *tstats =
+                                                   per_cpu_ptr(dev->tstats, i);
                 u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
                 unsigned int start;
 
@@ -146,7 +203,7 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
         struct ip_tunnel *t, *cand = NULL;
         struct hlist_head *head;
 
-        hash = ip_tunnel_hash(itn, key, remote);
+        hash = ip_tunnel_hash(key, remote);
         head = &itn->tunnels[hash];
 
         hlist_for_each_entry_rcu(t, head, hash_node) {
@@ -178,7 +235,7 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn,
                         cand = t;
         }
 
-        hash = ip_tunnel_hash(itn, key, 0);
+        hash = ip_tunnel_hash(key, 0);
         head = &itn->tunnels[hash];
 
         hlist_for_each_entry_rcu(t, head, hash_node) {
@@ -234,7 +291,7 @@ static struct hlist_head *ip_bucket(struct ip_tunnel_net *itn,
         else
                 remote = 0;
 
-        h = ip_tunnel_hash(itn, parms->i_key, remote);
+        h = ip_tunnel_hash(parms->i_key, remote);
         return &itn->tunnels[h];
 }
 
@@ -318,11 +375,10 @@ failed:
         return ERR_PTR(err);
 }
 
-static inline struct rtable *ip_route_output_tunnel(struct net *net,
-                                                    struct flowi4 *fl4,
-                                                    int proto,
-                                                    __be32 daddr, __be32 saddr,
-                                                    __be32 key, __u8 tos, int oif)
+static inline void init_tunnel_flow(struct flowi4 *fl4,
+                                    int proto,
+                                    __be32 daddr, __be32 saddr,
+                                    __be32 key, __u8 tos, int oif)
 {
         memset(fl4, 0, sizeof(*fl4));
         fl4->flowi4_oif = oif;
@@ -331,7 +387,6 @@ static inline struct rtable *ip_route_output_tunnel(struct net *net,
         fl4->flowi4_tos = tos;
         fl4->flowi4_proto = proto;
         fl4->fl4_gre_key = key;
-        return ip_route_output_key(net, fl4);
 }
 
 static int ip_tunnel_bind_dev(struct net_device *dev)
@@ -350,14 +405,14 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
                 struct flowi4 fl4;
                 struct rtable *rt;
 
-                rt = ip_route_output_tunnel(tunnel->net, &fl4,
-                                            tunnel->parms.iph.protocol,
-                                            iph->daddr, iph->saddr,
-                                            tunnel->parms.o_key,
-                                            RT_TOS(iph->tos),
-                                            tunnel->parms.link);
+                init_tunnel_flow(&fl4, iph->protocol, iph->daddr,
+                                 iph->saddr, tunnel->parms.o_key,
+                                 RT_TOS(iph->tos), tunnel->parms.link);
+                rt = ip_route_output_key(tunnel->net, &fl4);
+
                 if (!IS_ERR(rt)) {
                         tdev = rt->dst.dev;
+                        tunnel_dst_set(tunnel, &rt->dst);
                         ip_rt_put(rt);
                 }
                 if (dev->type != ARPHRD_ETHER)
@@ -405,7 +460,7 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
 int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
                   const struct tnl_ptk_info *tpi, bool log_ecn_error)
 {
-        struct pcpu_tstats *tstats;
+        struct pcpu_sw_netstats *tstats;
         const struct iphdr *iph = ip_hdr(skb);
         int err;
 
@@ -528,10 +583,11 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
         struct flowi4 fl4;
         u8     tos, ttl;
         __be16 df;
-        struct rtable *rt;              /* Route to the other host */
+        struct rtable *rt = NULL;       /* Route to the other host */
         unsigned int max_headroom;      /* The extra header space needed */
         __be32 dst;
         int err;
+        bool connected = true;
 
         inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
 
@@ -581,27 +637,39 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 #endif
                 else
                         goto tx_error;
+
+                connected = false;
         }
 
         tos = tnl_params->tos;
         if (tos & 0x1) {
                 tos &= ~0x1;
-                if (skb->protocol == htons(ETH_P_IP))
+                if (skb->protocol == htons(ETH_P_IP)) {
                         tos = inner_iph->tos;
-                else if (skb->protocol == htons(ETH_P_IPV6))
+                        connected = false;
+                } else if (skb->protocol == htons(ETH_P_IPV6)) {
                         tos = ipv6_get_dsfield((const struct ipv6hdr *)inner_iph);
+                        connected = false;
+                }
         }
 
-        rt = ip_route_output_tunnel(tunnel->net, &fl4,
-                                    protocol,
-                                    dst, tnl_params->saddr,
-                                    tunnel->parms.o_key,
-                                    RT_TOS(tos),
-                                    tunnel->parms.link);
-        if (IS_ERR(rt)) {
-                dev->stats.tx_carrier_errors++;
-                goto tx_error;
+        init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
+                         tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link);
+
+        if (connected)
+                rt = (struct rtable *)tunnel_dst_check(tunnel, 0);
+
+        if (!rt) {
+                rt = ip_route_output_key(tunnel->net, &fl4);
+
+                if (IS_ERR(rt)) {
+                        dev->stats.tx_carrier_errors++;
+                        goto tx_error;
+                }
+                if (connected)
+                        tunnel_dst_set(tunnel, &rt->dst);
         }
+
         if (rt->dst.dev == dev) {
                 ip_rt_put(rt);
                 dev->stats.collisions++;
@@ -618,6 +686,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                                 tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
                         tunnel->err_count--;
 
+                        memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
                         dst_link_failure(skb);
                 } else
                         tunnel->err_count = 0;
@@ -647,7 +716,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 
         if (skb_cow_head(skb, dev->needed_headroom)) {
                 dev->stats.tx_dropped++;
-                dev_kfree_skb(skb);
+                kfree_skb(skb);
                 return;
         }
 
@@ -663,7 +732,7 @@ tx_error_icmp:
 #endif
 tx_error:
         dev->stats.tx_errors++;
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_xmit);
 
@@ -696,6 +765,7 @@ static void ip_tunnel_update(struct ip_tunnel_net *itn,
                 if (set_mtu)
                         dev->mtu = mtu;
         }
+        tunnel_dst_reset_all(t);
         netdev_state_change(dev);
 }
 
@@ -811,6 +881,7 @@ static void ip_tunnel_dev_free(struct net_device *dev)
         struct ip_tunnel *tunnel = netdev_priv(dev);
 
         gro_cells_destroy(&tunnel->gro_cells);
+        free_percpu(tunnel->dst_cache);
         free_percpu(dev->tstats);
         free_netdev(dev);
 }
@@ -979,18 +1050,25 @@ int ip_tunnel_init(struct net_device *dev)
         int i, err;
 
         dev->destructor = ip_tunnel_dev_free;
-        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
 
         for_each_possible_cpu(i) {
-                struct pcpu_tstats *ipt_stats;
+                struct pcpu_sw_netstats *ipt_stats;
                 ipt_stats = per_cpu_ptr(dev->tstats, i);
                 u64_stats_init(&ipt_stats->syncp);
         }
 
+        tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
+        if (!tunnel->dst_cache) {
+                free_percpu(dev->tstats);
+                return -ENOMEM;
+        }
+
         err = gro_cells_init(&tunnel->gro_cells, dev);
         if (err) {
+                free_percpu(tunnel->dst_cache);
                 free_percpu(dev->tstats);
                 return err;
         }
@@ -1015,6 +1093,8 @@ void ip_tunnel_uninit(struct net_device *dev)
         /* fb_tunnel_dev will be unregisted in net-exit call. */
         if (itn->fb_tunnel_dev != dev)
                 ip_tunnel_del(netdev_priv(dev));
+
+        tunnel_dst_reset_all(tunnel);
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_uninit);
 
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 42ffbc8d65c6..6156f4ef5e91 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -56,7 +56,7 @@ int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
 
         skb_scrub_packet(skb, xnet);
 
-        skb->rxhash = 0;
+        skb_clear_hash(skb);
         skb_dst_set(skb, &rt->dst);
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
@@ -107,8 +107,7 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto)
 
         nf_reset(skb);
         secpath_reset(skb);
-        if (!skb->l4_rxhash)
-                skb->rxhash = 0;
+        skb_clear_hash_if_not_l4(skb);
         skb_dst_drop(skb);
         skb->vlan_tci = 0;
         skb_set_queue_mapping(skb, 0);
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 52b802a0cd8c..48eafae51769 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -60,7 +60,7 @@ static int vti_rcv(struct sk_buff *skb)
         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
                                   iph->saddr, iph->daddr, 0);
         if (tunnel != NULL) {
-                struct pcpu_tstats *tstats;
+                struct pcpu_sw_netstats *tstats;
                 u32 oldmark = skb->mark;
                 int ret;
 
@@ -162,7 +162,7 @@ tx_error_icmp:
         dst_link_failure(skb);
 tx_error:
         dev->stats.tx_errors++;
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
         return NETDEV_TX_OK;
 }
 
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index fe3e9f7f1f0b..812b18351462 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -228,7 +228,7 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         return NETDEV_TX_OK;
 
 tx_error:
-        dev_kfree_skb(skb);
+        kfree_skb(skb);
 out:
         dev->stats.tx_errors++;
         return NETDEV_TX_OK;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 1672409f5ba5..b9b3472975ba 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -428,6 +428,7 @@ struct net_device *ipmr_new_tunnel(struct net *net, struct vifctl *v)
                                 goto failure;
 
                         ipv4_devconf_setall(in_dev);
+                        neigh_parms_data_state_setall(in_dev->arp_parms);
                         IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
 
                         if (dev_open(dev))
@@ -520,6 +521,7 @@ static struct net_device *ipmr_reg_vif(struct net *net, struct mr_table *mrt)
         }
 
         ipv4_devconf_setall(in_dev);
+        neigh_parms_data_state_setall(in_dev->arp_parms);
         IPV4_DEVCONF(in_dev->cnf, RP_FILTER) = 0;
         rcu_read_unlock();
 
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 40d56073cd19..81c6910cfa92 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -39,23 +39,33 @@ config NF_CONNTRACK_PROC_COMPAT
 config NF_TABLES_IPV4
         depends on NF_TABLES
         tristate "IPv4 nf_tables support"
-
-config NFT_REJECT_IPV4
-        depends on NF_TABLES_IPV4
-        tristate "nf_tables IPv4 reject support"
+        help
+          This option enables the IPv4 support for nf_tables.
 
 config NFT_CHAIN_ROUTE_IPV4
         depends on NF_TABLES_IPV4
         tristate "IPv4 nf_tables route chain support"
+        help
+          This option enables the "route" chain for IPv4 in nf_tables. This
+          chain type is used to force packet re-routing after mangling header
+          fields such as the source, destination, type of service and
+          the packet mark.
 
 config NFT_CHAIN_NAT_IPV4
         depends on NF_TABLES_IPV4
         depends on NF_NAT_IPV4 && NFT_NAT
         tristate "IPv4 nf_tables nat chain support"
+        help
+          This option enables the "nat" chain for IPv4 in nf_tables. This
+          chain type is used to perform Network Address Translation (NAT)
+          packet transformations such as the source, destination address and
+          source and destination ports.
 
 config NF_TABLES_ARP
         depends on NF_TABLES
         tristate "ARP nf_tables support"
+        help
+          This option enables the ARP support for nf_tables.
 
 config IP_NF_IPTABLES
         tristate "IP tables support (required for filtering/masq/NAT)"
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index 19df72b7ba88..c16be9d58420 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -28,7 +28,6 @@ obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o
 obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
 
 obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o
-obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o
 obj-$(CONFIG_NF_TABLES_ARP) += nf_tables_arp.o
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index b969131ad1c1..5b6e0df4ccff 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -17,10 +17,6 @@
 #include <linux/udp.h>
 #include <linux/icmp.h>
 #include <net/icmp.h>
-#include <net/ip.h>
-#include <net/tcp.h>
-#include <net/route.h>
-#include <net/dst.h>
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv4/ipt_REJECT.h>
@@ -28,128 +24,12 @@
 #include <linux/netfilter_bridge.h>
 #endif
 
+#include <net/netfilter/ipv4/nf_reject.h>
+
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("Xtables: packet \"rejection\" target for IPv4");
 
-/* Send RST reply */
-static void send_reset(struct sk_buff *oldskb, int hook)
-{
-        struct sk_buff *nskb;
-        const struct iphdr *oiph;
-        struct iphdr *niph;
-        const struct tcphdr *oth;
-        struct tcphdr _otcph, *tcph;
-
-        /* IP header checks: fragment. */
-        if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
-                return;
-
-        oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb),
-                                 sizeof(_otcph), &_otcph);
-        if (oth == NULL)
-                return;
-
-        /* No RST for RST. */
-        if (oth->rst)
-                return;
-
-        if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
-                return;
-
-        /* Check checksum */
-        if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
-                return;
-        oiph = ip_hdr(oldskb);
-
-        nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
-                         LL_MAX_HEADER, GFP_ATOMIC);
-        if (!nskb)
-                return;
-
-        skb_reserve(nskb, LL_MAX_HEADER);
-
-        skb_reset_network_header(nskb);
-        niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr));
-        niph->version   = 4;
-        niph->ihl       = sizeof(struct iphdr) / 4;
-        niph->tos       = 0;
-        niph->id        = 0;
-        niph->frag_off  = htons(IP_DF);
-        niph->protocol  = IPPROTO_TCP;
-        niph->check     = 0;
-        niph->saddr     = oiph->daddr;
-        niph->daddr     = oiph->saddr;
-
-        skb_reset_transport_header(nskb);
-        tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
-        memset(tcph, 0, sizeof(*tcph));
-        tcph->source    = oth->dest;
-        tcph->dest      = oth->source;
-        tcph->doff      = sizeof(struct tcphdr) / 4;
-
-        if (oth->ack)
-                tcph->seq = oth->ack_seq;
-        else {
-                tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
-                                      oldskb->len - ip_hdrlen(oldskb) -
-                                      (oth->doff << 2));
-                tcph->ack = 1;
-        }
-
-        tcph->rst       = 1;
-        tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
-                                    niph->daddr, 0);
-        nskb->ip_summed = CHECKSUM_PARTIAL;
-        nskb->csum_start = (unsigned char *)tcph - nskb->head;
-        nskb->csum_offset = offsetof(struct tcphdr, check);
-
-        /* ip_route_me_harder expects skb->dst to be set */
-        skb_dst_set_noref(nskb, skb_dst(oldskb));
-
-        nskb->protocol = htons(ETH_P_IP);
-        if (ip_route_me_harder(nskb, RTN_UNSPEC))
-                goto free_nskb;
-
-        niph->ttl       = ip4_dst_hoplimit(skb_dst(nskb));
-
-        /* "Never happens" */
-        if (nskb->len > dst_mtu(skb_dst(nskb)))
-                goto free_nskb;
-
-        nf_ct_attach(nskb, oldskb);
-
-#ifdef CONFIG_BRIDGE_NETFILTER
-        /* If we use ip_local_out for bridged traffic, the MAC source on
-         * the RST will be ours, instead of the destination's.  This confuses
-         * some routers/firewalls, and they drop the packet.  So we need to
-         * build the eth header using the original destination's MAC as the
-         * source, and send the RST packet directly.
-         */
-        if (oldskb->nf_bridge) {
-                struct ethhdr *oeth = eth_hdr(oldskb);
-                nskb->dev = oldskb->nf_bridge->physindev;
-                niph->tot_len = htons(nskb->len);
-                ip_send_check(niph);
-                if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol),
-                                    oeth->h_source, oeth->h_dest, nskb->len) < 0)
-                        goto free_nskb;
-                dev_queue_xmit(nskb);
-        } else
-#endif
-                ip_local_out(nskb);
-
-        return;
-
- free_nskb:
-        kfree_skb(nskb);
-}
-
-static inline void send_unreach(struct sk_buff *skb_in, int code)
-{
-        icmp_send(skb_in, ICMP_DEST_UNREACH, code, 0);
-}
-
 static unsigned int
 reject_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
@@ -157,28 +37,28 @@ reject_tg(struct sk_buff *skb, const struct xt_action_param *par)
 
         switch (reject->with) {
         case IPT_ICMP_NET_UNREACHABLE:
-                send_unreach(skb, ICMP_NET_UNREACH);
+                nf_send_unreach(skb, ICMP_NET_UNREACH);
                 break;
         case IPT_ICMP_HOST_UNREACHABLE:
-                send_unreach(skb, ICMP_HOST_UNREACH);
+                nf_send_unreach(skb, ICMP_HOST_UNREACH);
                 break;
         case IPT_ICMP_PROT_UNREACHABLE:
-                send_unreach(skb, ICMP_PROT_UNREACH);
+                nf_send_unreach(skb, ICMP_PROT_UNREACH);
                 break;
         case IPT_ICMP_PORT_UNREACHABLE:
-                send_unreach(skb, ICMP_PORT_UNREACH);
+                nf_send_unreach(skb, ICMP_PORT_UNREACH);
                 break;
         case IPT_ICMP_NET_PROHIBITED:
-                send_unreach(skb, ICMP_NET_ANO);
+                nf_send_unreach(skb, ICMP_NET_ANO);
                 break;
         case IPT_ICMP_HOST_PROHIBITED:
-                send_unreach(skb, ICMP_HOST_ANO);
+                nf_send_unreach(skb, ICMP_HOST_ANO);
                 break;
         case IPT_ICMP_ADMIN_PROHIBITED:
-                send_unreach(skb, ICMP_PKT_FILTERED);
+                nf_send_unreach(skb, ICMP_PKT_FILTERED);
                 break;
         case IPT_TCP_RESET:
-                send_reset(skb, par->hooknum);
+                nf_send_reset(skb, par->hooknum);
         case IPT_ICMP_ECHOREPLY:
                 /* Doesn't happen. */
                 break;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index ecd8bec411c9..8127dc802865 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -548,9 +548,3 @@ static void __exit nf_conntrack_l3proto_ipv4_fini(void)
 
 module_init(nf_conntrack_l3proto_ipv4_init);
 module_exit(nf_conntrack_l3proto_ipv4_fini);
-
-void need_ipv4_conntrack(void)
-{
-        return;
-}
-EXPORT_SYMBOL_GPL(need_ipv4_conntrack);
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 5f011cc89cd9..d551e31b416e 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -34,8 +34,7 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  * Author: James Morris <jmorris@intercode.com.au>
  *
@@ -462,14 +461,14 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx,
         }
 
         if (subid < 40) {
-                optr [0] = 0;
-                optr [1] = subid;
+                optr[0] = 0;
+                optr[1] = subid;
         } else if (subid < 80) {
-                optr [0] = 1;
-                optr [1] = subid - 40;
+                optr[0] = 1;
+                optr[1] = subid - 40;
         } else {
-                optr [0] = 2;
-                optr [1] = subid - 80;
+                optr[0] = 2;
+                optr[1] = subid - 80;
         }
 
         *len = 2;
diff --git a/net/ipv4/netfilter/nf_tables_arp.c b/net/ipv4/netfilter/nf_tables_arp.c
index 3e67ef1c676f..19412a4063fb 100644
--- a/net/ipv4/netfilter/nf_tables_arp.c
+++ b/net/ipv4/netfilter/nf_tables_arp.c
@@ -14,10 +14,30 @@
 #include <linux/netfilter_arp.h>
 #include <net/netfilter/nf_tables.h>
 
+static unsigned int
+nft_do_chain_arp(const struct nf_hook_ops *ops,
+                  struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  int (*okfn)(struct sk_buff *))
+{
+        struct nft_pktinfo pkt;
+
+        nft_set_pktinfo(&pkt, ops, skb, in, out);
+
+        return nft_do_chain(&pkt, ops);
+}
+
 static struct nft_af_info nft_af_arp __read_mostly = {
         .family         = NFPROTO_ARP,
         .nhooks         = NF_ARP_NUMHOOKS,
         .owner          = THIS_MODULE,
+        .nops           = 1,
+        .hooks          = {
+                [NF_ARP_IN]             = nft_do_chain_arp,
+                [NF_ARP_OUT]            = nft_do_chain_arp,
+                [NF_ARP_FORWARD]        = nft_do_chain_arp,
+        },
 };
 
 static int nf_tables_arp_init_net(struct net *net)
@@ -48,32 +68,14 @@ static struct pernet_operations nf_tables_arp_net_ops = {
         .exit   = nf_tables_arp_exit_net,
 };
 
-static unsigned int
-nft_do_chain_arp(const struct nf_hook_ops *ops,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
-{
-        struct nft_pktinfo pkt;
-
-        nft_set_pktinfo(&pkt, ops, skb, in, out);
-
-        return nft_do_chain_pktinfo(&pkt, ops);
-}
-
-static struct nf_chain_type filter_arp = {
-        .family         = NFPROTO_ARP,
+static const struct nf_chain_type filter_arp = {
         .name           = "filter",
         .type           = NFT_CHAIN_T_DEFAULT,
+        .family         = NFPROTO_ARP,
+        .owner          = THIS_MODULE,
         .hook_mask      = (1 << NF_ARP_IN) |
                           (1 << NF_ARP_OUT) |
                           (1 << NF_ARP_FORWARD),
-        .fn             = {
-                [NF_ARP_IN]             = nft_do_chain_arp,
-                [NF_ARP_OUT]            = nft_do_chain_arp,
-                [NF_ARP_FORWARD]        = nft_do_chain_arp,
-        },
 };
 
 static int __init nf_tables_arp_init(void)
diff --git a/net/ipv4/netfilter/nf_tables_ipv4.c b/net/ipv4/netfilter/nf_tables_ipv4.c
index 0f4cbfeb19bd..6820c8c40842 100644
--- a/net/ipv4/netfilter/nf_tables_ipv4.c
+++ b/net/ipv4/netfilter/nf_tables_ipv4.c
@@ -18,14 +18,25 @@
 #include <net/ip.h>
 #include <net/netfilter/nf_tables_ipv4.h>
 
+static unsigned int nft_do_chain_ipv4(const struct nf_hook_ops *ops,
+                                      struct sk_buff *skb,
+                                      const struct net_device *in,
+                                      const struct net_device *out,
+                                      int (*okfn)(struct sk_buff *))
+{
+        struct nft_pktinfo pkt;
+
+        nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
+
+        return nft_do_chain(&pkt, ops);
+}
+
 static unsigned int nft_ipv4_output(const struct nf_hook_ops *ops,
                                     struct sk_buff *skb,
                                     const struct net_device *in,
                                     const struct net_device *out,
                                     int (*okfn)(struct sk_buff *))
 {
-        struct nft_pktinfo pkt;
-
         if (unlikely(skb->len < sizeof(struct iphdr) ||
                      ip_hdr(skb)->ihl < sizeof(struct iphdr) / 4)) {
                 if (net_ratelimit())
@@ -33,19 +44,24 @@ static unsigned int nft_ipv4_output(const struct nf_hook_ops *ops,
                                 "packet\n");
                 return NF_ACCEPT;
         }
-        nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
 
-        return nft_do_chain_pktinfo(&pkt, ops);
+        return nft_do_chain_ipv4(ops, skb, in, out, okfn);
 }
 
-static struct nft_af_info nft_af_ipv4 __read_mostly = {
+struct nft_af_info nft_af_ipv4 __read_mostly = {
         .family         = NFPROTO_IPV4,
         .nhooks         = NF_INET_NUMHOOKS,
         .owner          = THIS_MODULE,
+        .nops           = 1,
         .hooks          = {
+                [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
                 [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
+                [NF_INET_FORWARD]       = nft_do_chain_ipv4,
+                [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv4,
+                [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
         },
 };
+EXPORT_SYMBOL_GPL(nft_af_ipv4);
 
 static int nf_tables_ipv4_init_net(struct net *net)
 {
@@ -75,42 +91,28 @@ static struct pernet_operations nf_tables_ipv4_net_ops = {
         .exit   = nf_tables_ipv4_exit_net,
 };
 
-static unsigned int
-nft_do_chain_ipv4(const struct nf_hook_ops *ops,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
-{
-        struct nft_pktinfo pkt;
-
-        nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
-
-        return nft_do_chain_pktinfo(&pkt, ops);
-}
-
-static struct nf_chain_type filter_ipv4 = {
-        .family         = NFPROTO_IPV4,
+static const struct nf_chain_type filter_ipv4 = {
         .name           = "filter",
         .type           = NFT_CHAIN_T_DEFAULT,
+        .family         = NFPROTO_IPV4,
+        .owner          = THIS_MODULE,
         .hook_mask      = (1 << NF_INET_LOCAL_IN) |
                           (1 << NF_INET_LOCAL_OUT) |
                           (1 << NF_INET_FORWARD) |
                           (1 << NF_INET_PRE_ROUTING) |
                           (1 << NF_INET_POST_ROUTING),
-        .fn             = {
-                [NF_INET_LOCAL_IN]      = nft_do_chain_ipv4,
-                [NF_INET_LOCAL_OUT]     = nft_ipv4_output,
-                [NF_INET_FORWARD]       = nft_do_chain_ipv4,
-                [NF_INET_PRE_ROUTING]   = nft_do_chain_ipv4,
-                [NF_INET_POST_ROUTING]  = nft_do_chain_ipv4,
-        },
 };
 
 static int __init nf_tables_ipv4_init(void)
 {
+        int ret;
+
         nft_register_chain_type(&filter_ipv4);
-        return register_pernet_subsys(&nf_tables_ipv4_net_ops);
+        ret = register_pernet_subsys(&nf_tables_ipv4_net_ops);
+        if (ret < 0)
+                nft_unregister_chain_type(&filter_ipv4);
+
+        return ret;
 }
 
 static void __exit nf_tables_ipv4_exit(void)
diff --git a/net/ipv4/netfilter/nft_chain_nat_ipv4.c b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
index cf2c792cd971..b5b256d45e67 100644
--- a/net/ipv4/netfilter/nft_chain_nat_ipv4.c
+++ b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
@@ -75,7 +75,7 @@ static unsigned int nf_nat_fn(const struct nf_hook_ops *ops,
 
                 nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
 
-                ret = nft_do_chain_pktinfo(&pkt, ops);
+                ret = nft_do_chain(&pkt, ops);
                 if (ret != NF_ACCEPT)
                         return ret;
                 if (!nf_nat_initialized(ct, maniptype)) {
@@ -164,21 +164,21 @@ static unsigned int nf_nat_output(const struct nf_hook_ops *ops,
         return ret;
 }
 
-static struct nf_chain_type nft_chain_nat_ipv4 = {
-        .family         = NFPROTO_IPV4,
+static const struct nf_chain_type nft_chain_nat_ipv4 = {
         .name           = "nat",
         .type           = NFT_CHAIN_T_NAT,
+        .family         = NFPROTO_IPV4,
+        .owner          = THIS_MODULE,
         .hook_mask      = (1 << NF_INET_PRE_ROUTING) |
                           (1 << NF_INET_POST_ROUTING) |
                           (1 << NF_INET_LOCAL_OUT) |
                           (1 << NF_INET_LOCAL_IN),
-        .fn             = {
+        .hooks          = {
                 [NF_INET_PRE_ROUTING]   = nf_nat_prerouting,
                 [NF_INET_POST_ROUTING]  = nf_nat_postrouting,
                 [NF_INET_LOCAL_OUT]     = nf_nat_output,
                 [NF_INET_LOCAL_IN]      = nf_nat_fn,
         },
-        .me             = THIS_MODULE,
 };
 
 static int __init nft_chain_nat_init(void)
diff --git a/net/ipv4/netfilter/nft_chain_route_ipv4.c b/net/ipv4/netfilter/nft_chain_route_ipv4.c
index 4e6bf9a3d7aa..125b66766c0a 100644
--- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
+++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
@@ -47,7 +47,7 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,
         daddr = iph->daddr;
         tos = iph->tos;
 
-        ret = nft_do_chain_pktinfo(&pkt, ops);
+        ret = nft_do_chain(&pkt, ops);
         if (ret != NF_DROP && ret != NF_QUEUE) {
                 iph = ip_hdr(skb);
 
@@ -61,15 +61,15 @@ static unsigned int nf_route_table_hook(const struct nf_hook_ops *ops,
         return ret;
 }
 
-static struct nf_chain_type nft_chain_route_ipv4 = {
-        .family         = NFPROTO_IPV4,
+static const struct nf_chain_type nft_chain_route_ipv4 = {
         .name           = "route",
         .type           = NFT_CHAIN_T_ROUTE,
+        .family         = NFPROTO_IPV4,
+        .owner          = THIS_MODULE,
         .hook_mask      = (1 << NF_INET_LOCAL_OUT),
-        .fn             = {
+        .hooks          = {
                 [NF_INET_LOCAL_OUT]     = nf_route_table_hook,
         },
-        .me             = THIS_MODULE,
 };
 
 static int __init nft_chain_route_init(void)
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
deleted file mode 100644
index 4a5e94ac314a..000000000000
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ /dev/null
@@ -1,123 +0,0 @@
-/*
- * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * Development of this code funded by Astaro AG (http://www.astaro.com/)
- */
-
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/netlink.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter/nf_tables.h>
-#include <net/netfilter/nf_tables.h>
-#include <net/icmp.h>
-
-struct nft_reject {
-        enum nft_reject_types   type:8;
-        u8                      icmp_code;
-};
-
-static void nft_reject_eval(const struct nft_expr *expr,
-                              struct nft_data data[NFT_REG_MAX + 1],
-                              const struct nft_pktinfo *pkt)
-{
-        struct nft_reject *priv = nft_expr_priv(expr);
-
-        switch (priv->type) {
-        case NFT_REJECT_ICMP_UNREACH:
-                icmp_send(pkt->skb, ICMP_DEST_UNREACH, priv->icmp_code, 0);
-                break;
-        case NFT_REJECT_TCP_RST:
-                break;
-        }
-
-        data[NFT_REG_VERDICT].verdict = NF_DROP;
-}
-
-static const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
-        [NFTA_REJECT_TYPE]              = { .type = NLA_U32 },
-        [NFTA_REJECT_ICMP_CODE]         = { .type = NLA_U8 },
-};
-
-static int nft_reject_init(const struct nft_ctx *ctx,
-                           const struct nft_expr *expr,
-                           const struct nlattr * const tb[])
-{
-        struct nft_reject *priv = nft_expr_priv(expr);
-
-        if (tb[NFTA_REJECT_TYPE] == NULL)
-                return -EINVAL;
-
-        priv->type = ntohl(nla_get_be32(tb[NFTA_REJECT_TYPE]));
-        switch (priv->type) {
-        case NFT_REJECT_ICMP_UNREACH:
-                if (tb[NFTA_REJECT_ICMP_CODE] == NULL)
-                        return -EINVAL;
-                priv->icmp_code = nla_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
-        case NFT_REJECT_TCP_RST:
-                break;
-        default:
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static int nft_reject_dump(struct sk_buff *skb, const struct nft_expr *expr)
-{
-        const struct nft_reject *priv = nft_expr_priv(expr);
-
-        if (nla_put_be32(skb, NFTA_REJECT_TYPE, htonl(priv->type)))
-                goto nla_put_failure;
-
-        switch (priv->type) {
-        case NFT_REJECT_ICMP_UNREACH:
-                if (nla_put_u8(skb, NFTA_REJECT_ICMP_CODE, priv->icmp_code))
-                        goto nla_put_failure;
-                break;
-        }
-
-        return 0;
-
-nla_put_failure:
-        return -1;
-}
-
-static struct nft_expr_type nft_reject_type;
-static const struct nft_expr_ops nft_reject_ops = {
-        .type           = &nft_reject_type,
-        .size           = NFT_EXPR_SIZE(sizeof(struct nft_reject)),
-        .eval           = nft_reject_eval,
-        .init           = nft_reject_init,
-        .dump           = nft_reject_dump,
-};
-
-static struct nft_expr_type nft_reject_type __read_mostly = {
-        .name           = "reject",
-        .ops            = &nft_reject_ops,
-        .policy         = nft_reject_policy,
-        .maxattr        = NFTA_REJECT_MAX,
-        .owner          = THIS_MODULE,
-};
-
-static int __init nft_reject_module_init(void)
-{
-        return nft_register_expr(&nft_reject_type);
-}
-
-static void __exit nft_reject_module_exit(void)
-{
-        nft_unregister_expr(&nft_reject_type);
-}
-
-module_init(nft_reject_module_init);
-module_exit(nft_reject_module_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS_NFT_EXPR("reject");
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 242e7f4ed6f4..2d11c094296e 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -53,8 +53,12 @@
 #include <net/transp_v6.h>
 #endif
 
+struct ping_table {
+        struct hlist_nulls_head hash[PING_HTABLE_SIZE];
+        rwlock_t                lock;
+};
 
-struct ping_table ping_table;
+static struct ping_table ping_table;
 struct pingv6_ops pingv6_ops;
 EXPORT_SYMBOL_GPL(pingv6_ops);
 
@@ -316,6 +320,9 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                 if (addr_len < sizeof(*addr))
                         return -EINVAL;
 
+                if (addr->sin6_family != AF_INET6)
+                        return -EINVAL;
+
                 pr_debug("ping_check_bind_addr(sk=%p,addr=%pI6c,port=%d)\n",
                          sk, addr->sin6_addr.s6_addr, ntohs(addr->sin6_port));
 
@@ -668,8 +675,8 @@ int ping_common_sendmsg(int family, struct msghdr *msg, size_t len,
 }
 EXPORT_SYMBOL_GPL(ping_common_sendmsg);
 
-int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
-                    size_t len)
+static int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+                           size_t len)
 {
         struct net *net = sock_net(sk);
         struct flowi4 fl4;
@@ -696,7 +703,7 @@ int ping_v4_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          */
 
         if (msg->msg_name) {
-                struct sockaddr_in *usin = (struct sockaddr_in *)msg->msg_name;
+                DECLARE_SOCKADDR(struct sockaddr_in *, usin, msg->msg_name);
                 if (msg->msg_namelen < sizeof(*usin))
                         return -EINVAL;
                 if (usin->sin_family != AF_INET)
@@ -869,7 +876,7 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         /* Copy the address and add cmsg data. */
         if (family == AF_INET) {
-                struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
+                DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
 
                 if (sin) {
                         sin->sin_family = AF_INET;
@@ -886,8 +893,7 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         } else if (family == AF_INET6) {
                 struct ipv6_pinfo *np = inet6_sk(sk);
                 struct ipv6hdr *ip6 = ipv6_hdr(skb);
-                struct sockaddr_in6 *sin6 =
-                        (struct sockaddr_in6 *)msg->msg_name;
+                DECLARE_SOCKADDR(struct sockaddr_in6 *, sin6, msg->msg_name);
 
                 if (sin6) {
                         sin6->sin6_family = AF_INET6;
@@ -903,7 +909,12 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 }
 
                 if (inet6_sk(sk)->rxopt.all)
-                        pingv6_ops.ip6_datagram_recv_ctl(sk, msg, skb);
+                        pingv6_ops.ip6_datagram_recv_common_ctl(sk, msg, skb);
+                if (skb->protocol == htons(ETH_P_IPV6) &&
+                    inet6_sk(sk)->rxopt.all)
+                        pingv6_ops.ip6_datagram_recv_specific_ctl(sk, msg, skb);
+                else if (skb->protocol == htons(ETH_P_IP) && isk->cmsg_flags)
+                        ip_cmsg_recv(msg, skb);
 #endif
         } else {
                 BUG();
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 4a0335854b89..a6c8a80ec9d6 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -279,6 +279,7 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPFastOpenCookieReqd", LINUX_MIB_TCPFASTOPENCOOKIEREQD),
         SNMP_MIB_ITEM("TCPSpuriousRtxHostQueues", LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES),
         SNMP_MIB_ITEM("BusyPollRxPackets", LINUX_MIB_BUSYPOLLRXPACKETS),
+        SNMP_MIB_ITEM("TCPAutoCorking", LINUX_MIB_TCPAUTOCORKING),
         SNMP_MIB_SENTINEL
 };
 
@@ -332,22 +333,22 @@ static void icmp_put(struct seq_file *seq)
         atomic_long_t *ptr = net->mib.icmpmsg_statistics->mibs;
 
         seq_puts(seq, "\nIcmp: InMsgs InErrors InCsumErrors");
-        for (i=0; icmpmibmap[i].name != NULL; i++)
+        for (i = 0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " In%s", icmpmibmap[i].name);
         seq_printf(seq, " OutMsgs OutErrors");
-        for (i=0; icmpmibmap[i].name != NULL; i++)
+        for (i = 0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " Out%s", icmpmibmap[i].name);
         seq_printf(seq, "\nIcmp: %lu %lu %lu",
                 snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_INMSGS),
                 snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_INERRORS),
                 snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_CSUMERRORS));
-        for (i=0; icmpmibmap[i].name != NULL; i++)
+        for (i = 0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
                            atomic_long_read(ptr + icmpmibmap[i].index));
         seq_printf(seq, " %lu %lu",
                 snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_OUTMSGS),
                 snmp_fold_field((void __percpu **) net->mib.icmp_statistics, ICMP_MIB_OUTERRORS));
-        for (i=0; icmpmibmap[i].name != NULL; i++)
+        for (i = 0; icmpmibmap[i].name != NULL; i++)
                 seq_printf(seq, " %lu",
                            atomic_long_read(ptr + (icmpmibmap[i].index | 0x100)));
 }
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 23c3e5b5bb53..c04518f4850a 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -493,7 +493,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          */
 
         if (msg->msg_namelen) {
-                struct sockaddr_in *usin = (struct sockaddr_in *)msg->msg_name;
+                DECLARE_SOCKADDR(struct sockaddr_in *, usin, msg->msg_name);
                 err = -EINVAL;
                 if (msg->msg_namelen < sizeof(*usin))
                         goto out;
@@ -575,7 +575,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos,
                            RT_SCOPE_UNIVERSE,
                            inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
-                           inet_sk_flowi_flags(sk) | FLOWI_FLAG_CAN_SLEEP |
+                           inet_sk_flowi_flags(sk) |
                             (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0),
                            daddr, saddr, 0, 0);
 
@@ -690,7 +690,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         struct inet_sock *inet = inet_sk(sk);
         size_t copied = 0;
         int err = -EOPNOTSUPP;
-        struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
         struct sk_buff *skb;
 
         if (flags & MSG_OOB)
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index f8da28278014..25071b48921c 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -112,9 +112,6 @@
 #define RT_FL_TOS(oldflp4) \
         ((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
 
-/* IPv4 datagram length is stored into 16bit field (tot_len) */
-#define IP_MAX_MTU      0xFFFF
-
 #define RT_GC_TIMEOUT (300*HZ)
 
 static int ip_rt_max_size;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index b95331e6c077..f2ed13c2125f 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -121,7 +121,7 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, __be32 saddr, __be32 daddr,
         cookie -= cookie_hash(saddr, daddr, sport, dport, 0, 0) + sseq;
 
         /* Cookie is now reduced to (count * 2^24) ^ (hash % 2^24) */
-        diff = (count - (cookie >> COOKIEBITS)) & ((__u32) - 1 >> COOKIEBITS);
+        diff = (count - (cookie >> COOKIEBITS)) & ((__u32) -1 >> COOKIEBITS);
         if (diff >= MAX_SYNCOOKIE_AGE)
                 return (__u32)-1;
 
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 3d69ec8dac57..44eba052b43d 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -286,13 +286,6 @@ static struct ctl_table ipv4_table[] = {
                 .extra2         = &ip_ttl_max,
         },
         {
-                .procname       = "ip_no_pmtu_disc",
-                .data           = &ipv4_config.no_pmtu_disc,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                 .procname       = "ip_nonlocal_bind",
                 .data           = &sysctl_ip_nonlocal_bind,
                 .maxlen         = sizeof(int),
@@ -707,7 +700,7 @@ static struct ctl_table ipv4_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
-        {
+        {
                 .procname       = "tcp_thin_dupack",
                 .data           = &sysctl_tcp_thin_dupack,
                 .maxlen         = sizeof(int),
@@ -733,6 +726,15 @@ static struct ctl_table ipv4_table[] = {
                 .extra2         = &gso_max_segs,
         },
         {
+                .procname       = "tcp_autocorking",
+                .data           = &sysctl_tcp_autocorking,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+                .extra2         = &one,
+        },
+        {
                 .procname       = "udp_mem",
                 .data           = &sysctl_udp_mem,
                 .maxlen         = sizeof(sysctl_udp_mem),
@@ -822,6 +824,20 @@ static struct ctl_table ipv4_net_table[] = {
                 .mode           = 0644,
                 .proc_handler   = ipv4_local_port_range,
         },
+        {
+                .procname       = "ip_no_pmtu_disc",
+                .data           = &init_net.ipv4.sysctl_ip_no_pmtu_disc,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "ip_forward_use_pmtu",
+                .data           = &init_net.ipv4.sysctl_ip_fwd_use_pmtu,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
         { }
 };
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 82de78603686..4475b3bb494d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -285,6 +285,8 @@ int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
 
 int sysctl_tcp_min_tso_segs __read_mostly = 2;
 
+int sysctl_tcp_autocorking __read_mostly = 1;
+
 struct percpu_counter tcp_orphan_count;
 EXPORT_SYMBOL_GPL(tcp_orphan_count);
 
@@ -379,7 +381,7 @@ void tcp_init_sock(struct sock *sk)
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
 
-        skb_queue_head_init(&tp->out_of_order_queue);
+        __skb_queue_head_init(&tp->out_of_order_queue);
         tcp_init_xmit_timers(sk);
         tcp_prequeue_init(tp);
         INIT_LIST_HEAD(&tp->tsq_node);
@@ -619,19 +621,58 @@ static inline void tcp_mark_urg(struct tcp_sock *tp, int flags)
                 tp->snd_up = tp->write_seq;
 }
 
-static inline void tcp_push(struct sock *sk, int flags, int mss_now,
-                            int nonagle)
+/* If a not yet filled skb is pushed, do not send it if
+ * we have data packets in Qdisc or NIC queues :
+ * Because TX completion will happen shortly, it gives a chance
+ * to coalesce future sendmsg() payload into this skb, without
+ * need for a timer, and with no latency trade off.
+ * As packets containing data payload have a bigger truesize
+ * than pure acks (dataless) packets, the last checks prevent
+ * autocorking if we only have an ACK in Qdisc/NIC queues,
+ * or if TX completion was delayed after we processed ACK packet.
+ */
+static bool tcp_should_autocork(struct sock *sk, struct sk_buff *skb,
+                                int size_goal)
 {
-        if (tcp_send_head(sk)) {
-                struct tcp_sock *tp = tcp_sk(sk);
+        return skb->len < size_goal &&
+               sysctl_tcp_autocorking &&
+               skb != tcp_write_queue_head(sk) &&
+               atomic_read(&sk->sk_wmem_alloc) > skb->truesize;
+}
+
+static void tcp_push(struct sock *sk, int flags, int mss_now,
+                     int nonagle, int size_goal)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct sk_buff *skb;
 
-                if (!(flags & MSG_MORE) || forced_push(tp))
-                        tcp_mark_push(tp, tcp_write_queue_tail(sk));
+        if (!tcp_send_head(sk))
+                return;
+
+        skb = tcp_write_queue_tail(sk);
+        if (!(flags & MSG_MORE) || forced_push(tp))
+                tcp_mark_push(tp, skb);
+
+        tcp_mark_urg(tp, flags);
+
+        if (tcp_should_autocork(sk, skb, size_goal)) {
 
-                tcp_mark_urg(tp, flags);
-                __tcp_push_pending_frames(sk, mss_now,
-                                          (flags & MSG_MORE) ? TCP_NAGLE_CORK : nonagle);
+                /* avoid atomic op if TSQ_THROTTLED bit is already set */
+                if (!test_bit(TSQ_THROTTLED, &tp->tsq_flags)) {
+                        NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPAUTOCORKING);
+                        set_bit(TSQ_THROTTLED, &tp->tsq_flags);
+                }
+                /* It is possible TX completion already happened
+                 * before we set TSQ_THROTTLED.
+                 */
+                if (atomic_read(&sk->sk_wmem_alloc) > skb->truesize)
+                        return;
         }
+
+        if (flags & MSG_MORE)
+                nonagle = TCP_NAGLE_CORK;
+
+        __tcp_push_pending_frames(sk, mss_now, nonagle);
 }
 
 static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
@@ -934,7 +975,8 @@ new_segment:
 wait_for_sndbuf:
                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                tcp_push(sk, flags & ~MSG_MORE, mss_now,
+                         TCP_NAGLE_PUSH, size_goal);
 
                 if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                         goto do_error;
@@ -944,7 +986,7 @@ wait_for_memory:
 
 out:
         if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
-                tcp_push(sk, flags, mss_now, tp->nonagle);
+                tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
         return copied;
 
 do_error:
@@ -1225,7 +1267,8 @@ wait_for_sndbuf:
                         set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
                         if (copied)
-                                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
+                                tcp_push(sk, flags & ~MSG_MORE, mss_now,
+                                         TCP_NAGLE_PUSH, size_goal);
 
                         if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
                                 goto do_error;
@@ -1236,7 +1279,7 @@ wait_for_memory:
 
 out:
         if (copied)
-                tcp_push(sk, flags, mss_now, tp->nonagle);
+                tcp_push(sk, flags, mss_now, tp->nonagle, size_goal);
         release_sock(sk);
         return copied + copied_syn;
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c53b7f35c51d..65cf90e063d5 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -766,7 +766,7 @@ static void tcp_update_pacing_rate(struct sock *sk)
 /* Calculate rto without backoff.  This is the second half of Van Jacobson's
  * routine referred to above.
  */
-void tcp_set_rto(struct sock *sk)
+static void tcp_set_rto(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         /* Old crap is replaced with new one. 8)
@@ -3686,7 +3686,7 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th)
                 int opcode = *ptr++;
                 int opsize;
 
-                switch(opcode) {
+                switch (opcode) {
                 case TCPOPT_EOL:
                         return NULL;
                 case TCPOPT_NOP:
@@ -4046,7 +4046,7 @@ static void tcp_sack_remove(struct tcp_sock *tp)
                         WARN_ON(before(tp->rcv_nxt, sp->end_seq));
 
                         /* Zap this SACK, by moving forward any other SACKS. */
-                        for (i=this_sack+1; i < num_sacks; i++)
+                        for (i = this_sack+1; i < num_sacks; i++)
                                 tp->selective_acks[i-1] = tp->selective_acks[i];
                         num_sacks--;
                         continue;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 067213924751..3cf976510497 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -173,7 +173,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         rt = ip_route_connect(fl4, nexthop, inet->inet_saddr,
                               RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                               IPPROTO_TCP,
-                              orig_sport, orig_dport, sk, true);
+                              orig_sport, orig_dport, sk);
         if (IS_ERR(rt)) {
                 err = PTR_ERR(rt);
                 if (err == -ENETUNREACH)
@@ -827,7 +827,7 @@ static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct flowi4 fl4;
         int err = -1;
-        struct sk_buff * skb;
+        struct sk_buff *skb;
 
         /* First, grab a route. */
         if (!dst && (dst = inet_csk_route_req(sk, &fl4, req)) == NULL)
@@ -1668,7 +1668,6 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         }
         sk_setup_caps(newsk, dst);
 
-        tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
         newtp->advmss = dst_metric_advmss(dst);
         if (tcp_sk(sk)->rx_opt.user_mss &&
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 098b3a29f6f3..d547075d8300 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -22,7 +22,8 @@
 
 int sysctl_tcp_nometrics_save __read_mostly;
 
-static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *addr,
+static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *saddr,
+                                                   const struct inetpeer_addr *daddr,
                                                    struct net *net, unsigned int hash);
 
 struct tcp_fastopen_metrics {
@@ -34,7 +35,8 @@ struct tcp_fastopen_metrics {
 
 struct tcp_metrics_block {
         struct tcp_metrics_block __rcu  *tcpm_next;
-        struct inetpeer_addr            tcpm_addr;
+        struct inetpeer_addr            tcpm_saddr;
+        struct inetpeer_addr            tcpm_daddr;
         unsigned long                   tcpm_stamp;
         u32                             tcpm_ts;
         u32                             tcpm_ts_stamp;
@@ -145,7 +147,8 @@ static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst
 #define TCP_METRICS_RECLAIM_PTR         (struct tcp_metrics_block *) 0x1UL
 
 static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
-                                          struct inetpeer_addr *addr,
+                                          struct inetpeer_addr *saddr,
+                                          struct inetpeer_addr *daddr,
                                           unsigned int hash)
 {
         struct tcp_metrics_block *tm;
@@ -158,7 +161,7 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
         /* While waiting for the spin-lock the cache might have been populated
          * with this entry and so we have to check again.
          */
-        tm = __tcp_get_metrics(addr, net, hash);
+        tm = __tcp_get_metrics(saddr, daddr, net, hash);
         if (tm == TCP_METRICS_RECLAIM_PTR) {
                 reclaim = true;
                 tm = NULL;
@@ -183,7 +186,8 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
                 if (!tm)
                         goto out_unlock;
         }
-        tm->tcpm_addr = *addr;
+        tm->tcpm_saddr = *saddr;
+        tm->tcpm_daddr = *daddr;
 
         tcpm_suck_dst(tm, dst, true);
 
@@ -206,7 +210,8 @@ static struct tcp_metrics_block *tcp_get_encode(struct tcp_metrics_block *tm, in
         return NULL;
 }
 
-static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *addr,
+static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *saddr,
+                                                   const struct inetpeer_addr *daddr,
                                                    struct net *net, unsigned int hash)
 {
         struct tcp_metrics_block *tm;
@@ -214,7 +219,8 @@ static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *a
 
         for (tm = rcu_dereference(net->ipv4.tcp_metrics_hash[hash].chain); tm;
              tm = rcu_dereference(tm->tcpm_next)) {
-                if (addr_same(&tm->tcpm_addr, addr))
+                if (addr_same(&tm->tcpm_saddr, saddr) &&
+                    addr_same(&tm->tcpm_daddr, daddr))
                         break;
                 depth++;
         }
@@ -225,19 +231,22 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(struct request_sock *req,
                                                        struct dst_entry *dst)
 {
         struct tcp_metrics_block *tm;
-        struct inetpeer_addr addr;
+        struct inetpeer_addr saddr, daddr;
         unsigned int hash;
         struct net *net;
 
-        addr.family = req->rsk_ops->family;
-        switch (addr.family) {
+        saddr.family = req->rsk_ops->family;
+        daddr.family = req->rsk_ops->family;
+        switch (daddr.family) {
         case AF_INET:
-                addr.addr.a4 = inet_rsk(req)->ir_rmt_addr;
-                hash = (__force unsigned int) addr.addr.a4;
+                saddr.addr.a4 = inet_rsk(req)->ir_loc_addr;
+                daddr.addr.a4 = inet_rsk(req)->ir_rmt_addr;
+                hash = (__force unsigned int) daddr.addr.a4;
                 break;
 #if IS_ENABLED(CONFIG_IPV6)
         case AF_INET6:
-                *(struct in6_addr *)addr.addr.a6 = inet_rsk(req)->ir_v6_rmt_addr;
+                *(struct in6_addr *)saddr.addr.a6 = inet_rsk(req)->ir_v6_loc_addr;
+                *(struct in6_addr *)daddr.addr.a6 = inet_rsk(req)->ir_v6_rmt_addr;
                 hash = ipv6_addr_hash(&inet_rsk(req)->ir_v6_rmt_addr);
                 break;
 #endif
@@ -250,7 +259,8 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(struct request_sock *req,
 
         for (tm = rcu_dereference(net->ipv4.tcp_metrics_hash[hash].chain); tm;
              tm = rcu_dereference(tm->tcpm_next)) {
-                if (addr_same(&tm->tcpm_addr, &addr))
+                if (addr_same(&tm->tcpm_saddr, &saddr) &&
+                    addr_same(&tm->tcpm_daddr, &daddr))
                         break;
         }
         tcpm_check_stamp(tm, dst);
@@ -260,32 +270,44 @@ static struct tcp_metrics_block *__tcp_get_metrics_req(struct request_sock *req,
 static struct tcp_metrics_block *__tcp_get_metrics_tw(struct inet_timewait_sock *tw)
 {
         struct tcp_metrics_block *tm;
-        struct inetpeer_addr addr;
+        struct inetpeer_addr saddr, daddr;
         unsigned int hash;
         struct net *net;
 
-        addr.family = tw->tw_family;
-        switch (addr.family) {
-        case AF_INET:
-                addr.addr.a4 = tw->tw_daddr;
-                hash = (__force unsigned int) addr.addr.a4;
-                break;
+        if (tw->tw_family == AF_INET) {
+                saddr.family = AF_INET;
+                saddr.addr.a4 = tw->tw_rcv_saddr;
+                daddr.family = AF_INET;
+                daddr.addr.a4 = tw->tw_daddr;
+                hash = (__force unsigned int) daddr.addr.a4;
+        }
 #if IS_ENABLED(CONFIG_IPV6)
-        case AF_INET6:
-                *(struct in6_addr *)addr.addr.a6 = tw->tw_v6_daddr;
-                hash = ipv6_addr_hash(&tw->tw_v6_daddr);
-                break;
+        else if (tw->tw_family == AF_INET6) {
+                if (ipv6_addr_v4mapped(&tw->tw_v6_daddr)) {
+                        saddr.family = AF_INET;
+                        saddr.addr.a4 = tw->tw_rcv_saddr;
+                        daddr.family = AF_INET;
+                        daddr.addr.a4 = tw->tw_daddr;
+                        hash = (__force unsigned int) daddr.addr.a4;
+                } else {
+                        saddr.family = AF_INET6;
+                        *(struct in6_addr *)saddr.addr.a6 = tw->tw_v6_rcv_saddr;
+                        daddr.family = AF_INET6;
+                        *(struct in6_addr *)daddr.addr.a6 = tw->tw_v6_daddr;
+                        hash = ipv6_addr_hash(&tw->tw_v6_daddr);
+                }
+        }
 #endif
-        default:
+        else
                 return NULL;
-        }
 
         net = twsk_net(tw);
         hash = hash_32(hash, net->ipv4.tcp_metrics_hash_log);
 
         for (tm = rcu_dereference(net->ipv4.tcp_metrics_hash[hash].chain); tm;
              tm = rcu_dereference(tm->tcpm_next)) {
-                if (addr_same(&tm->tcpm_addr, &addr))
+                if (addr_same(&tm->tcpm_saddr, &saddr) &&
+                    addr_same(&tm->tcpm_daddr, &daddr))
                         break;
         }
         return tm;
@@ -296,34 +318,45 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
                                                  bool create)
 {
         struct tcp_metrics_block *tm;
-        struct inetpeer_addr addr;
+        struct inetpeer_addr saddr, daddr;
         unsigned int hash;
         struct net *net;
 
-        addr.family = sk->sk_family;
-        switch (addr.family) {
-        case AF_INET:
-                addr.addr.a4 = inet_sk(sk)->inet_daddr;
-                hash = (__force unsigned int) addr.addr.a4;
-                break;
+        if (sk->sk_family == AF_INET) {
+                saddr.family = AF_INET;
+                saddr.addr.a4 = inet_sk(sk)->inet_saddr;
+                daddr.family = AF_INET;
+                daddr.addr.a4 = inet_sk(sk)->inet_daddr;
+                hash = (__force unsigned int) daddr.addr.a4;
+        }
 #if IS_ENABLED(CONFIG_IPV6)
-        case AF_INET6:
-                *(struct in6_addr *)addr.addr.a6 = sk->sk_v6_daddr;
-                hash = ipv6_addr_hash(&sk->sk_v6_daddr);
-                break;
+        else if (sk->sk_family == AF_INET6) {
+                if (ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
+                        saddr.family = AF_INET;
+                        saddr.addr.a4 = inet_sk(sk)->inet_saddr;
+                        daddr.family = AF_INET;
+                        daddr.addr.a4 = inet_sk(sk)->inet_daddr;
+                        hash = (__force unsigned int) daddr.addr.a4;
+                } else {
+                        saddr.family = AF_INET6;
+                        *(struct in6_addr *)saddr.addr.a6 = sk->sk_v6_rcv_saddr;
+                        daddr.family = AF_INET6;
+                        *(struct in6_addr *)daddr.addr.a6 = sk->sk_v6_daddr;
+                        hash = ipv6_addr_hash(&sk->sk_v6_daddr);
+                }
+        }
 #endif
-        default:
+        else
                 return NULL;
-        }
 
         net = dev_net(dst->dev);
         hash = hash_32(hash, net->ipv4.tcp_metrics_hash_log);
 
-        tm = __tcp_get_metrics(&addr, net, hash);
+        tm = __tcp_get_metrics(&saddr, &daddr, net, hash);
         if (tm == TCP_METRICS_RECLAIM_PTR)
                 tm = NULL;
         if (!tm && create)
-                tm = tcpm_new(dst, &addr, hash);
+                tm = tcpm_new(dst, &saddr, &daddr, hash);
         else
                 tcpm_check_stamp(tm, dst);
 
@@ -737,15 +770,21 @@ static int tcp_metrics_fill_info(struct sk_buff *msg,
         struct nlattr *nest;
         int i;
 
-        switch (tm->tcpm_addr.family) {
+        switch (tm->tcpm_daddr.family) {
         case AF_INET:
                 if (nla_put_be32(msg, TCP_METRICS_ATTR_ADDR_IPV4,
-                                tm->tcpm_addr.addr.a4) < 0)
+                                tm->tcpm_daddr.addr.a4) < 0)
+                        goto nla_put_failure;
+                if (nla_put_be32(msg, TCP_METRICS_ATTR_SADDR_IPV4,
+                                tm->tcpm_saddr.addr.a4) < 0)
                         goto nla_put_failure;
                 break;
         case AF_INET6:
                 if (nla_put(msg, TCP_METRICS_ATTR_ADDR_IPV6, 16,
-                            tm->tcpm_addr.addr.a6) < 0)
+                            tm->tcpm_daddr.addr.a6) < 0)
+                        goto nla_put_failure;
+                if (nla_put(msg, TCP_METRICS_ATTR_SADDR_IPV6, 16,
+                            tm->tcpm_saddr.addr.a6) < 0)
                         goto nla_put_failure;
                 break;
         default:
@@ -868,44 +907,66 @@ done:
         return skb->len;
 }
 
-static int parse_nl_addr(struct genl_info *info, struct inetpeer_addr *addr,
-                         unsigned int *hash, int optional)
+static int __parse_nl_addr(struct genl_info *info, struct inetpeer_addr *addr,
+                           unsigned int *hash, int optional, int v4, int v6)
 {
         struct nlattr *a;
 
-        a = info->attrs[TCP_METRICS_ATTR_ADDR_IPV4];
+        a = info->attrs[v4];
         if (a) {
                 addr->family = AF_INET;
                 addr->addr.a4 = nla_get_be32(a);
-                *hash = (__force unsigned int) addr->addr.a4;
+                if (hash)
+                        *hash = (__force unsigned int) addr->addr.a4;
                 return 0;
         }
-        a = info->attrs[TCP_METRICS_ATTR_ADDR_IPV6];
+        a = info->attrs[v6];
         if (a) {
                 if (nla_len(a) != sizeof(struct in6_addr))
                         return -EINVAL;
                 addr->family = AF_INET6;
                 memcpy(addr->addr.a6, nla_data(a), sizeof(addr->addr.a6));
-                *hash = ipv6_addr_hash((struct in6_addr *) addr->addr.a6);
+                if (hash)
+                        *hash = ipv6_addr_hash((struct in6_addr *) addr->addr.a6);
                 return 0;
         }
         return optional ? 1 : -EAFNOSUPPORT;
 }
 
+static int parse_nl_addr(struct genl_info *info, struct inetpeer_addr *addr,
+                         unsigned int *hash, int optional)
+{
+        return __parse_nl_addr(info, addr, hash, optional,
+                               TCP_METRICS_ATTR_ADDR_IPV4,
+                               TCP_METRICS_ATTR_ADDR_IPV6);
+}
+
+static int parse_nl_saddr(struct genl_info *info, struct inetpeer_addr *addr)
+{
+        return __parse_nl_addr(info, addr, NULL, 0,
+                               TCP_METRICS_ATTR_SADDR_IPV4,
+                               TCP_METRICS_ATTR_SADDR_IPV6);
+}
+
 static int tcp_metrics_nl_cmd_get(struct sk_buff *skb, struct genl_info *info)
 {
         struct tcp_metrics_block *tm;
-        struct inetpeer_addr addr;
+        struct inetpeer_addr saddr, daddr;
         unsigned int hash;
         struct sk_buff *msg;
         struct net *net = genl_info_net(info);
         void *reply;
         int ret;
+        bool src = true;
 
-        ret = parse_nl_addr(info, &addr, &hash, 0);
+        ret = parse_nl_addr(info, &daddr, &hash, 0);
         if (ret < 0)
                 return ret;
 
+        ret = parse_nl_saddr(info, &saddr);
+        if (ret < 0)
+                src = false;
+
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
         if (!msg)
                 return -ENOMEM;
@@ -920,7 +981,8 @@ static int tcp_metrics_nl_cmd_get(struct sk_buff *skb, struct genl_info *info)
         rcu_read_lock();
         for (tm = rcu_dereference(net->ipv4.tcp_metrics_hash[hash].chain); tm;
              tm = rcu_dereference(tm->tcpm_next)) {
-                if (addr_same(&tm->tcpm_addr, &addr)) {
+                if (addr_same(&tm->tcpm_daddr, &daddr) &&
+                    (!src || addr_same(&tm->tcpm_saddr, &saddr))) {
                         ret = tcp_metrics_fill_info(msg, tm);
                         break;
                 }
@@ -975,32 +1037,38 @@ static int tcp_metrics_nl_cmd_del(struct sk_buff *skb, struct genl_info *info)
         struct tcpm_hash_bucket *hb;
         struct tcp_metrics_block *tm;
         struct tcp_metrics_block __rcu **pp;
-        struct inetpeer_addr addr;
+        struct inetpeer_addr saddr, daddr;
         unsigned int hash;
         struct net *net = genl_info_net(info);
         int ret;
+        bool src = true, found = false;
 
-        ret = parse_nl_addr(info, &addr, &hash, 1);
+        ret = parse_nl_addr(info, &daddr, &hash, 1);
         if (ret < 0)
                 return ret;
         if (ret > 0)
                 return tcp_metrics_flush_all(net);
+        ret = parse_nl_saddr(info, &saddr);
+        if (ret < 0)
+                src = false;
 
         hash = hash_32(hash, net->ipv4.tcp_metrics_hash_log);
         hb = net->ipv4.tcp_metrics_hash + hash;
         pp = &hb->chain;
         spin_lock_bh(&tcp_metrics_lock);
-        for (tm = deref_locked_genl(*pp); tm;
-             pp = &tm->tcpm_next, tm = deref_locked_genl(*pp)) {
-                if (addr_same(&tm->tcpm_addr, &addr)) {
+        for (tm = deref_locked_genl(*pp); tm; tm = deref_locked_genl(*pp)) {
+                if (addr_same(&tm->tcpm_daddr, &daddr) &&
+                    (!src || addr_same(&tm->tcpm_saddr, &saddr))) {
                         *pp = tm->tcpm_next;
-                        break;
+                        kfree_rcu(tm, rcu_head);
+                        found = true;
+                } else {
+                        pp = &tm->tcpm_next;
                 }
         }
         spin_unlock_bh(&tcp_metrics_lock);
-        if (!tm)
+        if (!found)
                 return -ESRCH;
-        kfree_rcu(tm, rcu_head);
         return 0;
 }
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 97b684159861..7a436c517e44 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -297,6 +297,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                         tw->tw_v6_daddr = sk->sk_v6_daddr;
                         tw->tw_v6_rcv_saddr = sk->sk_v6_rcv_saddr;
                         tw->tw_tclass = np->tclass;
+                        tw->tw_flowlabel = np->flow_label >> 12;
                         tw->tw_ipv6only = np->ipv6only;
                 }
 #endif
@@ -425,7 +426,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
 
                 tcp_set_ca_state(newsk, TCP_CA_Open);
                 tcp_init_xmit_timers(newsk);
-                skb_queue_head_init(&newtp->out_of_order_queue);
+                __skb_queue_head_init(&newtp->out_of_order_queue);
                 newtp->write_seq = newtp->pushed_seq = treq->snt_isn + 1;
 
                 newtp->rx_opt.saw_tstamp = 0;
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index 05606353c7e7..b92b81718ca4 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -138,7 +138,6 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb,
 out:
         return segs;
 }
-EXPORT_SYMBOL(tcp_gso_segment);
 
 struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
@@ -197,7 +196,8 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         goto out_check_final;
 
 found:
-        flush = NAPI_GRO_CB(p)->flush;
+        /* Include the IP ID check below from the inner most IP hdr */
+        flush = NAPI_GRO_CB(p)->flush | NAPI_GRO_CB(p)->flush_id;
         flush |= (__force int)(flags & TCP_FLAG_CWR);
         flush |= (__force int)((flags ^ tcp_flag_word(th2)) &
                   ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH));
@@ -230,17 +230,16 @@ out_check_final:
                 pp = head;
 
 out:
-        NAPI_GRO_CB(skb)->flush |= flush;
+        NAPI_GRO_CB(skb)->flush |= (flush != 0);
 
         return pp;
 }
-EXPORT_SYMBOL(tcp_gro_receive);
 
 int tcp_gro_complete(struct sk_buff *skb)
 {
         struct tcphdr *th = tcp_hdr(skb);
 
-        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_start = (unsigned char *)th - skb->head;
         skb->csum_offset = offsetof(struct tcphdr, check);
         skb->ip_summed = CHECKSUM_PARTIAL;
 
@@ -272,6 +271,7 @@ static int tcp_v4_gso_send_check(struct sk_buff *skb)
 
 static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
+        /* Use the IP hdr immediately proceeding for this transport */
         const struct iphdr *iph = skb_gro_network_header(skb);
         __wsum wsum;
 
@@ -279,7 +279,7 @@ static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *
         if (NAPI_GRO_CB(skb)->flush)
                 goto skip_csum;
 
-        wsum = skb->csum;
+        wsum = NAPI_GRO_CB(skb)->csum;
 
         switch (skb->ip_summed) {
         case CHECKSUM_NONE:
@@ -303,13 +303,13 @@ skip_csum:
         return tcp_gro_receive(head, skb);
 }
 
-static int tcp4_gro_complete(struct sk_buff *skb)
+static int tcp4_gro_complete(struct sk_buff *skb, int thoff)
 {
         const struct iphdr *iph = ip_hdr(skb);
         struct tcphdr *th = tcp_hdr(skb);
 
-        th->check = ~tcp_v4_check(skb->len - skb_transport_offset(skb),
-                                  iph->saddr, iph->daddr, 0);
+        th->check = ~tcp_v4_check(skb->len - thoff, iph->saddr,
+                                  iph->daddr, 0);
         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
 
         return tcp_gro_complete(skb);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7820f3a7dd70..03d26b85eab8 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -363,15 +363,17 @@ static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
  */
 static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
 {
+        struct skb_shared_info *shinfo = skb_shinfo(skb);
+
         skb->ip_summed = CHECKSUM_PARTIAL;
         skb->csum = 0;
 
         TCP_SKB_CB(skb)->tcp_flags = flags;
         TCP_SKB_CB(skb)->sacked = 0;
 
-        skb_shinfo(skb)->gso_segs = 1;
-        skb_shinfo(skb)->gso_size = 0;
-        skb_shinfo(skb)->gso_type = 0;
+        shinfo->gso_segs = 1;
+        shinfo->gso_size = 0;
+        shinfo->gso_type = 0;
 
         TCP_SKB_CB(skb)->seq = seq;
         if (flags & (TCPHDR_SYN | TCPHDR_FIN))
@@ -406,7 +408,7 @@ struct tcp_out_options {
  * Beware: Something in the Internet is very sensitive to the ordering of
  * TCP options, we learned this through the hard way, so be careful here.
  * Luckily we can at least blame others for their non-compliance but from
- * inter-operatibility perspective it seems that we're somewhat stuck with
+ * inter-operability perspective it seems that we're somewhat stuck with
  * the ordering which we have been using if we want to keep working with
  * those broken things (not that it currently hurts anybody as there isn't
  * particular reason why the ordering would need to be changed).
@@ -679,7 +681,7 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
  *
  * Its important tcp_wfree() can be replaced by sock_wfree() in the event skb
  * needs to be reallocated in a driver.
- * The invariant being skb->truesize substracted from sk->sk_wmem_alloc
+ * The invariant being skb->truesize subtracted from sk->sk_wmem_alloc
  *
  * Since transmit from skb destructor is forbidden, we use a tasklet
  * to process all sockets that eventually need to send more skbs.
@@ -699,9 +701,9 @@ static void tcp_tsq_handler(struct sock *sk)
                 tcp_write_xmit(sk, tcp_current_mss(sk), 0, 0, GFP_ATOMIC);
 }
 /*
- * One tasklest per cpu tries to send more skbs.
+ * One tasklet per cpu tries to send more skbs.
  * We run in tasklet context but need to disable irqs when
- * transfering tsq->head because tcp_wfree() might
+ * transferring tsq->head because tcp_wfree() might
  * interrupt us (non NAPI drivers)
  */
 static void tcp_tasklet_func(unsigned long data)
@@ -795,7 +797,7 @@ void __init tcp_tasklet_init(void)
 
 /*
  * Write buffer destructor automatically called from kfree_skb.
- * We cant xmit new skbs from this context, as we might already
+ * We can't xmit new skbs from this context, as we might already
  * hold qdisc lock.
  */
 void tcp_wfree(struct sk_buff *skb)
@@ -986,6 +988,8 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                                  unsigned int mss_now)
 {
+        struct skb_shared_info *shinfo = skb_shinfo(skb);
+
         /* Make sure we own this skb before messing gso_size/gso_segs */
         WARN_ON_ONCE(skb_cloned(skb));
 
@@ -993,13 +997,13 @@ static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
                  */
-                skb_shinfo(skb)->gso_segs = 1;
-                skb_shinfo(skb)->gso_size = 0;
-                skb_shinfo(skb)->gso_type = 0;
+                shinfo->gso_segs = 1;
+                shinfo->gso_size = 0;
+                shinfo->gso_type = 0;
         } else {
-                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
-                skb_shinfo(skb)->gso_size = mss_now;
-                skb_shinfo(skb)->gso_type = sk->sk_gso_type;
+                shinfo->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
+                shinfo->gso_size = mss_now;
+                shinfo->gso_type = sk->sk_gso_type;
         }
 }
 
@@ -1146,6 +1150,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
  */
 static void __pskb_trim_head(struct sk_buff *skb, int len)
 {
+        struct skb_shared_info *shinfo;
         int i, k, eat;
 
         eat = min_t(int, len, skb_headlen(skb));
@@ -1157,23 +1162,24 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
         }
         eat = len;
         k = 0;
-        for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                int size = skb_frag_size(&skb_shinfo(skb)->frags[i]);
+        shinfo = skb_shinfo(skb);
+        for (i = 0; i < shinfo->nr_frags; i++) {
+                int size = skb_frag_size(&shinfo->frags[i]);
 
                 if (size <= eat) {
                         skb_frag_unref(skb, i);
                         eat -= size;
                 } else {
-                        skb_shinfo(skb)->frags[k] = skb_shinfo(skb)->frags[i];
+                        shinfo->frags[k] = shinfo->frags[i];
                         if (eat) {
-                                skb_shinfo(skb)->frags[k].page_offset += eat;
-                                skb_frag_size_sub(&skb_shinfo(skb)->frags[k], eat);
+                                shinfo->frags[k].page_offset += eat;
+                                skb_frag_size_sub(&shinfo->frags[k], eat);
                                 eat = 0;
                         }
                         k++;
                 }
         }
-        skb_shinfo(skb)->nr_frags = k;
+        shinfo->nr_frags = k;
 
         skb_reset_tail_pointer(skb);
         skb->data_len -= len;
@@ -1378,23 +1384,51 @@ static void tcp_cwnd_validate(struct sock *sk)
         }
 }
 
-/* Returns the portion of skb which can be sent right away without
- * introducing MSS oddities to segment boundaries. In rare cases where
- * mss_now != mss_cache, we will request caller to create a small skb
- * per input skb which could be mostly avoided here (if desired).
- *
- * We explicitly want to create a request for splitting write queue tail
- * to a small skb for Nagle purposes while avoiding unnecessary modulos,
- * thus all the complexity (cwnd_len is always MSS multiple which we
- * return whenever allowed by the other factors). Basically we need the
- * modulo only when the receiver window alone is the limiting factor or
- * when we would be allowed to send the split-due-to-Nagle skb fully.
+/* Minshall's variant of the Nagle send check. */
+static bool tcp_minshall_check(const struct tcp_sock *tp)
+{
+        return after(tp->snd_sml, tp->snd_una) &&
+                !after(tp->snd_sml, tp->snd_nxt);
+}
+
+/* Update snd_sml if this skb is under mss
+ * Note that a TSO packet might end with a sub-mss segment
+ * The test is really :
+ * if ((skb->len % mss) != 0)
+ *        tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
+ * But we can avoid doing the divide again given we already have
+ *  skb_pcount = skb->len / mss_now
+ */
+static void tcp_minshall_update(struct tcp_sock *tp, unsigned int mss_now,
+                                const struct sk_buff *skb)
+{
+        if (skb->len < tcp_skb_pcount(skb) * mss_now)
+                tp->snd_sml = TCP_SKB_CB(skb)->end_seq;
+}
+
+/* Return false, if packet can be sent now without violation Nagle's rules:
+ * 1. It is full sized. (provided by caller in %partial bool)
+ * 2. Or it contains FIN. (already checked by caller)
+ * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
+ * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
+ *    With Minshall's modification: all sent small packets are ACKed.
  */
-static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_buff *skb,
-                                        unsigned int mss_now, unsigned int max_segs)
+static bool tcp_nagle_check(bool partial, const struct tcp_sock *tp,
+                            unsigned int mss_now, int nonagle)
+{
+        return partial &&
+                ((nonagle & TCP_NAGLE_CORK) ||
+                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
+}
+/* Returns the portion of skb which can be sent right away */
+static unsigned int tcp_mss_split_point(const struct sock *sk,
+                                        const struct sk_buff *skb,
+                                        unsigned int mss_now,
+                                        unsigned int max_segs,
+                                        int nonagle)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
-        u32 needed, window, max_len;
+        u32 partial, needed, window, max_len;
 
         window = tcp_wnd_end(tp) - TCP_SKB_CB(skb)->seq;
         max_len = mss_now * max_segs;
@@ -1407,7 +1441,15 @@ static unsigned int tcp_mss_split_point(const struct sock *sk, const struct sk_b
         if (max_len <= needed)
                 return max_len;
 
-        return needed - needed % mss_now;
+        partial = needed % mss_now;
+        /* If last segment is not a full MSS, check if Nagle rules allow us
+         * to include this last segment in this skb.
+         * Otherwise, we'll split the skb at last MSS boundary
+         */
+        if (tcp_nagle_check(partial != 0, tp, mss_now, nonagle))
+                return needed - partial;
+
+        return needed;
 }
 
 /* Can at least one segment of SKB be sent right now, according to the
@@ -1447,28 +1489,6 @@ static int tcp_init_tso_segs(const struct sock *sk, struct sk_buff *skb,
         return tso_segs;
 }
 
-/* Minshall's variant of the Nagle send check. */
-static inline bool tcp_minshall_check(const struct tcp_sock *tp)
-{
-        return after(tp->snd_sml, tp->snd_una) &&
-                !after(tp->snd_sml, tp->snd_nxt);
-}
-
-/* Return false, if packet can be sent now without violation Nagle's rules:
- * 1. It is full sized.
- * 2. Or it contains FIN. (already checked by caller)
- * 3. Or TCP_CORK is not set, and TCP_NODELAY is set.
- * 4. Or TCP_CORK is not set, and all sent packets are ACKed.
- *    With Minshall's modification: all sent small packets are ACKed.
- */
-static inline bool tcp_nagle_check(const struct tcp_sock *tp,
-                                  const struct sk_buff *skb,
-                                  unsigned int mss_now, int nonagle)
-{
-        return skb->len < mss_now &&
-                ((nonagle & TCP_NAGLE_CORK) ||
-                 (!nonagle && tp->packets_out && tcp_minshall_check(tp)));
-}
 
 /* Return true if the Nagle test allows this packet to be
  * sent now.
@@ -1489,7 +1509,7 @@ static inline bool tcp_nagle_test(const struct tcp_sock *tp, const struct sk_buf
         if (tcp_urg_mode(tp) || (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
                 return true;
 
-        if (!tcp_nagle_check(tp, skb, cur_mss, nonagle))
+        if (!tcp_nagle_check(skb->len < cur_mss, tp, cur_mss, nonagle))
                 return true;
 
         return false;
@@ -1892,7 +1912,8 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                         limit = tcp_mss_split_point(sk, skb, mss_now,
                                                     min_t(unsigned int,
                                                           cwnd_quota,
-                                                          sk->sk_gso_max_segs));
+                                                          sk->sk_gso_max_segs),
+                                                    nonagle);
 
                 if (skb->len > limit &&
                     unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
@@ -2756,7 +2777,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 EXPORT_SYMBOL(tcp_make_synack);
 
 /* Do all connect socket setups that can be done AF independent. */
-void tcp_connect_init(struct sock *sk)
+static void tcp_connect_init(struct sock *sk)
 {
         const struct dst_entry *dst = __sk_dst_get(sk);
         struct tcp_sock *tp = tcp_sk(sk);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 8b97d71e193b..1f2d37613c9e 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -38,7 +38,7 @@ MODULE_DESCRIPTION("TCP cwnd snooper");
 MODULE_LICENSE("GPL");
 MODULE_VERSION("1.1");
 
-static int port __read_mostly = 0;
+static int port __read_mostly;
 MODULE_PARM_DESC(port, "Port to match (0=all)");
 module_param(port, int, 0);
 
@@ -46,7 +46,7 @@ static unsigned int bufsize __read_mostly = 4096;
 MODULE_PARM_DESC(bufsize, "Log buffer size in packets (4096)");
 module_param(bufsize, uint, 0);
 
-static unsigned int fwmark __read_mostly = 0;
+static unsigned int fwmark __read_mostly;
 MODULE_PARM_DESC(fwmark, "skb mark to match (0=no mark)");
 module_param(fwmark, uint, 0);
 
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index a347a078ee07..1a8d271f994d 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -3,7 +3,7 @@
  *   YeAH TCP
  *
  * For further details look at:
- *    http://wil.cs.caltech.edu/pfldnet2007/paper/YeAH_TCP.pdf
+ *   https://web.archive.org/web/20080316215752/http://wil.cs.caltech.edu/pfldnet2007/paper/YeAH_TCP.pdf
  *
  */
 #include <linux/mm.h>
@@ -15,13 +15,13 @@
 
 #include "tcp_vegas.h"
 
-#define TCP_YEAH_ALPHA       80 //lin number of packets queued at the bottleneck
-#define TCP_YEAH_GAMMA        1 //lin fraction of queue to be removed per rtt
-#define TCP_YEAH_DELTA        3 //log minimum fraction of cwnd to be removed on loss
-#define TCP_YEAH_EPSILON      1 //log maximum fraction to be removed on early decongestion
-#define TCP_YEAH_PHY          8 //lin maximum delta from base
-#define TCP_YEAH_RHO         16 //lin minimum number of consecutive rtt to consider competition on loss
-#define TCP_YEAH_ZETA        50 //lin minimum number of state switchs to reset reno_count
+#define TCP_YEAH_ALPHA       80 /* number of packets queued at the bottleneck */
+#define TCP_YEAH_GAMMA        1 /* fraction of queue to be removed per rtt */
+#define TCP_YEAH_DELTA        3 /* log minimum fraction of cwnd to be removed on loss */
+#define TCP_YEAH_EPSILON      1 /* log maximum fraction to be removed on early decongestion */
+#define TCP_YEAH_PHY          8 /* maximum delta from base */
+#define TCP_YEAH_RHO         16 /* minimum number of consecutive rtt to consider competition on loss */
+#define TCP_YEAH_ZETA        50 /* minimum number of state switches to reset reno_count */
 
 #define TCP_SCALABLE_AI_CNT      100U
 
@@ -214,9 +214,9 @@ static u32 tcp_yeah_ssthresh(struct sock *sk) {
         if (yeah->doing_reno_now < TCP_YEAH_RHO) {
                 reduction = yeah->lastQ;
 
-                reduction = min( reduction, max(tp->snd_cwnd>>1, 2U) );
+                reduction = min(reduction, max(tp->snd_cwnd>>1, 2U));
 
-                reduction = max( reduction, tp->snd_cwnd >> TCP_YEAH_DELTA);
+                reduction = max(reduction, tp->snd_cwnd >> TCP_YEAH_DELTA);
         } else
                 reduction = max(tp->snd_cwnd>>1, 2U);
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index a7e4729e974b..77bd16fa9f34 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -223,7 +223,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 inet_get_local_port_range(net, &low, &high);
                 remaining = (high - low) + 1;
 
-                rand = net_random();
+                rand = prandom_u32();
                 first = (((u64)rand * remaining) >> 32) + low;
                 /*
                  * force rand to be an odd multiple of UDP_HTABLE_SIZE
@@ -902,7 +902,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *      Get and verify the address.
          */
         if (msg->msg_name) {
-                struct sockaddr_in *usin = (struct sockaddr_in *)msg->msg_name;
+                DECLARE_SOCKADDR(struct sockaddr_in *, usin, msg->msg_name);
                 if (msg->msg_namelen < sizeof(*usin))
                         return -EINVAL;
                 if (usin->sin_family != AF_INET) {
@@ -986,7 +986,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 fl4 = &fl4_stack;
                 flowi4_init_output(fl4, ipc.oif, sk->sk_mark, tos,
                                    RT_SCOPE_UNIVERSE, sk->sk_protocol,
-                                   inet_sk_flowi_flags(sk)|FLOWI_FLAG_CAN_SLEEP,
+                                   inet_sk_flowi_flags(sk),
                                    faddr, saddr, dport, inet->inet_sport);
 
                 security_sk_classify_flow(sk, flowi4_to_flowi(fl4));
@@ -1226,7 +1226,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 size_t len, int noblock, int flags, int *addr_len)
 {
         struct inet_sock *inet = inet_sk(sk);
-        struct sockaddr_in *sin = (struct sockaddr_in *)msg->msg_name;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
         struct sk_buff *skb;
         unsigned int ulen, copied;
         int peeked, off = 0;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 79c62bdcd3c5..25f5cee3a08a 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -14,6 +14,15 @@
 #include <net/udp.h>
 #include <net/protocol.h>
 
+static DEFINE_SPINLOCK(udp_offload_lock);
+static struct udp_offload_priv __rcu *udp_offload_base __read_mostly;
+
+struct udp_offload_priv {
+        struct udp_offload      *offload;
+        struct rcu_head         rcu;
+        struct udp_offload_priv __rcu *next;
+};
+
 static int udp4_ufo_send_check(struct sk_buff *skb)
 {
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
@@ -89,10 +98,144 @@ out:
         return segs;
 }
 
+int udp_add_offload(struct udp_offload *uo)
+{
+        struct udp_offload_priv __rcu **head = &udp_offload_base;
+        struct udp_offload_priv *new_offload = kzalloc(sizeof(*new_offload), GFP_KERNEL);
+
+        if (!new_offload)
+                return -ENOMEM;
+
+        new_offload->offload = uo;
+
+        spin_lock(&udp_offload_lock);
+        rcu_assign_pointer(new_offload->next, rcu_dereference(*head));
+        rcu_assign_pointer(*head, new_offload);
+        spin_unlock(&udp_offload_lock);
+
+        return 0;
+}
+EXPORT_SYMBOL(udp_add_offload);
+
+static void udp_offload_free_routine(struct rcu_head *head)
+{
+        struct udp_offload_priv *ou_priv = container_of(head, struct udp_offload_priv, rcu);
+        kfree(ou_priv);
+}
+
+void udp_del_offload(struct udp_offload *uo)
+{
+        struct udp_offload_priv __rcu **head = &udp_offload_base;
+        struct udp_offload_priv *uo_priv;
+
+        spin_lock(&udp_offload_lock);
+
+        uo_priv = rcu_dereference(*head);
+        for (; uo_priv != NULL;
+                uo_priv = rcu_dereference(*head)) {
+
+                if (uo_priv->offload == uo) {
+                        rcu_assign_pointer(*head, rcu_dereference(uo_priv->next));
+                        goto unlock;
+                }
+                head = &uo_priv->next;
+        }
+        pr_warn("udp_del_offload: didn't find offload for port %d\n", ntohs(uo->port));
+unlock:
+        spin_unlock(&udp_offload_lock);
+        if (uo_priv != NULL)
+                call_rcu(&uo_priv->rcu, udp_offload_free_routine);
+}
+EXPORT_SYMBOL(udp_del_offload);
+
+static struct sk_buff **udp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
+{
+        struct udp_offload_priv *uo_priv;
+        struct sk_buff *p, **pp = NULL;
+        struct udphdr *uh, *uh2;
+        unsigned int hlen, off;
+        int flush = 1;
+
+        if (NAPI_GRO_CB(skb)->udp_mark ||
+            (!skb->encapsulation && skb->ip_summed != CHECKSUM_COMPLETE))
+                goto out;
+
+        /* mark that this skb passed once through the udp gro layer */
+        NAPI_GRO_CB(skb)->udp_mark = 1;
+
+        off  = skb_gro_offset(skb);
+        hlen = off + sizeof(*uh);
+        uh   = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                uh = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!uh))
+                        goto out;
+        }
+
+        rcu_read_lock();
+        uo_priv = rcu_dereference(udp_offload_base);
+        for (; uo_priv != NULL; uo_priv = rcu_dereference(uo_priv->next)) {
+                if (uo_priv->offload->port == uh->dest &&
+                    uo_priv->offload->callbacks.gro_receive)
+                        goto unflush;
+        }
+        goto out_unlock;
+
+unflush:
+        flush = 0;
+
+        for (p = *head; p; p = p->next) {
+                if (!NAPI_GRO_CB(p)->same_flow)
+                        continue;
+
+                uh2 = (struct udphdr   *)(p->data + off);
+                if ((*(u32 *)&uh->source != *(u32 *)&uh2->source)) {
+                        NAPI_GRO_CB(p)->same_flow = 0;
+                        continue;
+                }
+        }
+
+        skb_gro_pull(skb, sizeof(struct udphdr)); /* pull encapsulating udp header */
+        pp = uo_priv->offload->callbacks.gro_receive(head, skb);
+
+out_unlock:
+        rcu_read_unlock();
+out:
+        NAPI_GRO_CB(skb)->flush |= flush;
+        return pp;
+}
+
+static int udp_gro_complete(struct sk_buff *skb, int nhoff)
+{
+        struct udp_offload_priv *uo_priv;
+        __be16 newlen = htons(skb->len - nhoff);
+        struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);
+        int err = -ENOSYS;
+
+        uh->len = newlen;
+
+        rcu_read_lock();
+
+        uo_priv = rcu_dereference(udp_offload_base);
+        for (; uo_priv != NULL; uo_priv = rcu_dereference(uo_priv->next)) {
+                if (uo_priv->offload->port == uh->dest &&
+                    uo_priv->offload->callbacks.gro_complete)
+                        break;
+        }
+
+        if (uo_priv != NULL)
+                err = uo_priv->offload->callbacks.gro_complete(skb, nhoff + sizeof(struct udphdr));
+
+        rcu_read_unlock();
+        return err;
+}
+
 static const struct net_offload udpv4_offload = {
         .callbacks = {
                 .gso_send_check = udp4_ufo_send_check,
                 .gso_segment = udp4_ufo_fragment,
+                .gro_receive  = udp_gro_receive,
+                .gro_complete = udp_gro_complete,
         },
 };
 
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index e3db3f915114..71acd0014f2d 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -48,7 +48,7 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
                 hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4);
 
         skb_set_network_header(skb, -x->props.header_len -
-                                    hdrlen + (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
+                                    hdrlen + (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
         if (x->sel.family != AF_INET6)
                 skb->network_header += IPV4_BEET_PHMAXLEN;
         skb->mac_header = skb->network_header +
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 0b2a0641526a..542074c00c78 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -16,7 +16,7 @@
 
 static int xfrm4_init_flags(struct xfrm_state *x)
 {
-        if (ipv4_config.no_pmtu_disc)
+        if (xs_net(x)->ipv4.sysctl_ip_no_pmtu_disc)
                 x->props.flags |= XFRM_STATE_NOPMTUDISC;
         return 0;
 }