36 files changed, 1137 insertions, 620 deletions

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 57737b8d1711..7d12c6a9b19b 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -174,12 +174,12 @@ static int inet_autobind(struct sock *sk)
         /* We may need to bind the socket. */
         lock_sock(sk);
         inet = inet_sk(sk);
-        if (!inet->num) {
+        if (!inet->inet_num) {
                 if (sk->sk_prot->get_port(sk, 0)) {
                         release_sock(sk);
                         return -EAGAIN;
                 }
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
         }
         release_sock(sk);
         return 0;
@@ -262,7 +262,8 @@ static inline int inet_netns_ok(struct net *net, int protocol)
  *      Create an inet socket.
  */
 
-static int inet_create(struct net *net, struct socket *sock, int protocol)
+static int inet_create(struct net *net, struct socket *sock, int protocol,
+                       int kern)
 {
         struct sock *sk;
         struct inet_protosw *answer;
@@ -325,7 +326,7 @@ lookup_protocol:
         }
 
         err = -EPERM;
-        if (answer->capability > 0 && !capable(answer->capability))
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                 goto out_rcu_unlock;
 
         err = -EAFNOSUPPORT;
@@ -354,7 +355,7 @@ lookup_protocol:
         inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
 
         if (SOCK_RAW == sock->type) {
-                inet->num = protocol;
+                inet->inet_num = protocol;
                 if (IPPROTO_RAW == protocol)
                         inet->hdrincl = 1;
         }
@@ -364,7 +365,7 @@ lookup_protocol:
         else
                 inet->pmtudisc = IP_PMTUDISC_WANT;
 
-        inet->id = 0;
+        inet->inet_id = 0;
 
         sock_init_data(sock, sk);
 
@@ -381,13 +382,13 @@ lookup_protocol:
 
         sk_refcnt_debug_inc(sk);
 
-        if (inet->num) {
+        if (inet->inet_num) {
                 /* It assumes that any protocol which allows
                  * the user to assign a number at socket
                  * creation time automatically
                  * shares.
                  */
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
                 /* Add to protocol hash chains. */
                 sk->sk_prot->hash(sk);
         }
@@ -494,27 +495,27 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
         /* Check these errors (active socket, double bind). */
         err = -EINVAL;
-        if (sk->sk_state != TCP_CLOSE || inet->num)
+        if (sk->sk_state != TCP_CLOSE || inet->inet_num)
                 goto out_release_sock;
 
-        inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
-                inet->saddr = 0;  /* Use device */
+                inet->inet_saddr = 0;  /* Use device */
 
         /* Make sure we are allowed to bind here. */
         if (sk->sk_prot->get_port(sk, snum)) {
-                inet->saddr = inet->rcv_saddr = 0;
+                inet->inet_saddr = inet->inet_rcv_saddr = 0;
                 err = -EADDRINUSE;
                 goto out_release_sock;
         }
 
-        if (inet->rcv_saddr)
+        if (inet->inet_rcv_saddr)
                 sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
         if (snum)
                 sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
-        inet->sport = htons(inet->num);
-        inet->daddr = 0;
-        inet->dport = 0;
+        inet->inet_sport = htons(inet->inet_num);
+        inet->inet_daddr = 0;
+        inet->inet_dport = 0;
         sk_dst_reset(sk);
         err = 0;
 out_release_sock:
@@ -532,7 +533,7 @@ int inet_dgram_connect(struct socket *sock, struct sockaddr * uaddr,
         if (uaddr->sa_family == AF_UNSPEC)
                 return sk->sk_prot->disconnect(sk, flags);
 
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
         return sk->sk_prot->connect(sk, (struct sockaddr *)uaddr, addr_len);
 }
@@ -685,21 +686,21 @@ int inet_getname(struct socket *sock, struct sockaddr *uaddr,
 {
         struct sock *sk         = sock->sk;
         struct inet_sock *inet  = inet_sk(sk);
-        struct sockaddr_in *sin = (struct sockaddr_in *)uaddr;
+        DECLARE_SOCKADDR(struct sockaddr_in *, sin, uaddr);
 
         sin->sin_family = AF_INET;
         if (peer) {
-                if (!inet->dport ||
+                if (!inet->inet_dport ||
                     (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)) &&
                      peer == 1))
                         return -ENOTCONN;
-                sin->sin_port = inet->dport;
-                sin->sin_addr.s_addr = inet->daddr;
+                sin->sin_port = inet->inet_dport;
+                sin->sin_addr.s_addr = inet->inet_daddr;
         } else {
-                __be32 addr = inet->rcv_saddr;
+                __be32 addr = inet->inet_rcv_saddr;
                 if (!addr)
-                        addr = inet->saddr;
-                sin->sin_port = inet->sport;
+                        addr = inet->inet_saddr;
+                sin->sin_port = inet->inet_sport;
                 sin->sin_addr.s_addr = addr;
         }
         memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
@@ -714,7 +715,7 @@ int inet_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         struct sock *sk = sock->sk;
 
         /* We may need to bind the socket. */
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
 
         return sk->sk_prot->sendmsg(iocb, sk, msg, size);
@@ -728,7 +729,7 @@ static ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset,
         struct sock *sk = sock->sk;
 
         /* We may need to bind the socket. */
-        if (!inet_sk(sk)->num && inet_autobind(sk))
+        if (!inet_sk(sk)->inet_num && inet_autobind(sk))
                 return -EAGAIN;
 
         if (sk->sk_prot->sendpage)
@@ -931,7 +932,7 @@ static const struct proto_ops inet_sockraw_ops = {
 #endif
 };
 
-static struct net_proto_family inet_family_ops = {
+static const struct net_proto_family inet_family_ops = {
         .family = PF_INET,
         .create = inet_create,
         .owner  = THIS_MODULE,
@@ -947,7 +948,6 @@ static struct inet_protosw inetsw_array[] =
                 .protocol =   IPPROTO_TCP,
                 .prot =       &tcp_prot,
                 .ops =        &inet_stream_ops,
-                .capability = -1,
                 .no_check =   0,
                 .flags =      INET_PROTOSW_PERMANENT |
                               INET_PROTOSW_ICSK,
@@ -958,7 +958,6 @@ static struct inet_protosw inetsw_array[] =
                 .protocol =   IPPROTO_UDP,
                 .prot =       &udp_prot,
                 .ops =        &inet_dgram_ops,
-                .capability = -1,
                 .no_check =   UDP_CSUM_DEFAULT,
                 .flags =      INET_PROTOSW_PERMANENT,
        },
@@ -969,7 +968,6 @@ static struct inet_protosw inetsw_array[] =
                .protocol =   IPPROTO_IP,        /* wild card */
                .prot =       &raw_prot,
                .ops =        &inet_sockraw_ops,
-               .capability = CAP_NET_RAW,
                .no_check =   UDP_CSUM_DEFAULT,
                .flags =      INET_PROTOSW_REUSE,
        }
@@ -1059,9 +1057,9 @@ static int inet_sk_reselect_saddr(struct sock *sk)
         struct inet_sock *inet = inet_sk(sk);
         int err;
         struct rtable *rt;
-        __be32 old_saddr = inet->saddr;
+        __be32 old_saddr = inet->inet_saddr;
         __be32 new_saddr;
-        __be32 daddr = inet->daddr;
+        __be32 daddr = inet->inet_daddr;
 
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
@@ -1071,7 +1069,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                                RT_CONN_FLAGS(sk),
                                sk->sk_bound_dev_if,
                                sk->sk_protocol,
-                               inet->sport, inet->dport, sk, 0);
+                               inet->inet_sport, inet->inet_dport, sk, 0);
         if (err)
                 return err;
 
@@ -1087,7 +1085,7 @@ static int inet_sk_reselect_saddr(struct sock *sk)
                        __func__, &old_saddr, &new_saddr);
         }
 
-        inet->saddr = inet->rcv_saddr = new_saddr;
+        inet->inet_saddr = inet->inet_rcv_saddr = new_saddr;
 
         /*
          * XXX The only one ugly spot where we need to
@@ -1113,7 +1111,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                 return 0;
 
         /* Reroute. */
-        daddr = inet->daddr;
+        daddr = inet->inet_daddr;
         if (inet->opt && inet->opt->srr)
                 daddr = inet->opt->faddr;
 {
@@ -1123,7 +1121,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                 .nl_u = {
                         .ip4_u = {
                                 .daddr  = daddr,
-                                .saddr  = inet->saddr,
+                                .saddr  = inet->inet_saddr,
                                 .tos    = RT_CONN_FLAGS(sk),
                         },
                 },
@@ -1131,8 +1129,8 @@ int inet_sk_rebuild_header(struct sock *sk)
                 .flags = inet_sk_flowi_flags(sk),
                 .uli_u = {
                         .ports = {
-                                .sport = inet->sport,
-                                .dport = inet->dport,
+                                .sport = inet->inet_sport,
+                                .dport = inet->inet_dport,
                         },
                 },
         };
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 5c662703eb1e..d07b0c1dd350 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -1,3 +1,4 @@
+#include <crypto/hash.h>
 #include <linux/err.h>
 #include <linux/module.h>
 #include <net/ip.h>
@@ -5,10 +6,67 @@
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
-#include <linux/spinlock.h>
+#include <linux/scatterlist.h>
 #include <net/icmp.h>
 #include <net/protocol.h>
 
+struct ah_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+
+#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+
+static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+                          unsigned int size)
+{
+        unsigned int len;
+
+        len = size + crypto_ahash_digestsize(ahash) +
+              (crypto_ahash_alignmask(ahash) &
+               ~(crypto_tfm_ctx_alignment() - 1));
+
+        len = ALIGN(len, crypto_tfm_ctx_alignment());
+
+        len += sizeof(struct ahash_request) + crypto_ahash_reqsize(ahash);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+
+        len += sizeof(struct scatterlist) * nfrags;
+
+        return kmalloc(len, GFP_ATOMIC);
+}
+
+static inline u8 *ah_tmp_auth(void *tmp, unsigned int offset)
+{
+        return tmp + offset;
+}
+
+static inline u8 *ah_tmp_icv(struct crypto_ahash *ahash, void *tmp,
+                             unsigned int offset)
+{
+        return PTR_ALIGN((u8 *)tmp + offset, crypto_ahash_alignmask(ahash) + 1);
+}
+
+static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash,
+                                               u8 *icv)
+{
+        struct ahash_request *req;
+
+        req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash),
+                                crypto_tfm_ctx_alignment());
+
+        ahash_request_set_tfm(req, ahash);
+
+        return req;
+}
+
+static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
+                                             struct ahash_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_ahash_reqsize(ahash),
+                             __alignof__(struct scatterlist));
+}
 
 /* Clear mutable options and find final destination to substitute
  * into IP header for icv calculation. Options are already checked
@@ -54,20 +112,72 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr)
         return 0;
 }
 
+static void ah_output_done(struct crypto_async_request *base, int err)
+{
+        u8 *icv;
+        struct iphdr *iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = skb_dst(skb)->xfrm;
+        struct ah_data *ahp = x->data;
+        struct iphdr *top_iph = ip_hdr(skb);
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int ihl = ip_hdrlen(skb);
+
+        iph = AH_SKB_CB(skb)->tmp;
+        icv = ah_tmp_icv(ahp->ahash, iph, ihl);
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+
+        top_iph->tos = iph->tos;
+        top_iph->ttl = iph->ttl;
+        top_iph->frag_off = iph->frag_off;
+        if (top_iph->ihl != 5) {
+                top_iph->daddr = iph->daddr;
+                memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
+        }
+
+        err = ah->nexthdr;
+
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
+
 static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
+        int nfrags;
+        int ihl;
+        u8 *icv;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
         struct iphdr *iph, *top_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        union {
-                struct iphdr    iph;
-                char            buf[60];
-        } tmp_iph;
+
+        ahp = x->data;
+        ahash = ahp->ahash;
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
 
         skb_push(skb, -skb_network_offset(skb));
+        ah = ip_auth_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
+        err = -ENOMEM;
+        iph = ah_alloc_tmp(ahash, nfrags, ihl);
+        if (!iph)
+                goto out;
+
+        icv = ah_tmp_icv(ahash, iph, ihl);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
         top_iph = ip_hdr(skb);
-        iph = &tmp_iph.iph;
 
         iph->tos = top_iph->tos;
         iph->ttl = top_iph->ttl;
@@ -78,10 +188,9 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 memcpy(iph+1, top_iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
                 err = ip_clear_mutable_options(top_iph, &top_iph->daddr);
                 if (err)
-                        goto error;
+                        goto out_free;
         }
 
-        ah = ip_auth_hdr(skb);
         ah->nexthdr = *skb_mac_header(skb);
         *skb_mac_header(skb) = IPPROTO_AH;
 
@@ -91,20 +200,31 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
         top_iph->ttl = 0;
         top_iph->check = 0;
 
-        ahp = x->data;
         ah->hdrlen  = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2;
 
         ah->reserved = 0;
         ah->spi = x->id.spi;
         ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
 
-        spin_lock_bh(&x->lock);
-        err = ah_mac_digest(ahp, skb, ah->auth_data);
-        memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
-        spin_unlock_bh(&x->lock);
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
 
-        if (err)
-                goto error;
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah_output_done, skb);
+
+        AH_SKB_CB(skb)->tmp = iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
+        }
+
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
 
         top_iph->tos = iph->tos;
         top_iph->ttl = iph->ttl;
@@ -114,28 +234,67 @@ static int ah_output(struct xfrm_state *x, struct sk_buff *skb)
                 memcpy(top_iph+1, iph+1, top_iph->ihl*4 - sizeof(struct iphdr));
         }
 
-        err = 0;
-
-error:
+out_free:
+        kfree(iph);
+out:
         return err;
 }
 
+static void ah_input_done(struct crypto_async_request *base, int err)
+{
+        u8 *auth_data;
+        u8 *icv;
+        struct iphdr *work_iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = xfrm_input_state(skb);
+        struct ah_data *ahp = x->data;
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int ihl = ip_hdrlen(skb);
+        int ah_hlen = (ah->hdrlen + 2) << 2;
+
+        work_iph = AH_SKB_CB(skb)->tmp;
+        auth_data = ah_tmp_auth(work_iph, ihl);
+        icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
+
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
+        if (err)
+                goto out;
+
+        skb->network_header += ah_hlen;
+        memcpy(skb_network_header(skb), work_iph, ihl);
+        __skb_pull(skb, ah_hlen + ihl);
+        skb_set_transport_header(skb, -ihl);
+
+        err = ah->nexthdr;
+out:
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_input_resume(skb, err);
+}
+
 static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int ah_hlen;
         int ihl;
         int nexthdr;
-        int err = -EINVAL;
-        struct iphdr *iph;
+        int nfrags;
+        u8 *auth_data;
+        u8 *icv;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
+        struct iphdr *iph, *work_iph;
         struct ip_auth_hdr *ah;
         struct ah_data *ahp;
-        char work_buf[60];
+        int err = -ENOMEM;
 
         if (!pskb_may_pull(skb, sizeof(*ah)))
                 goto out;
 
         ah = (struct ip_auth_hdr *)skb->data;
         ahp = x->data;
+        ahash = ahp->ahash;
+
         nexthdr = ah->nexthdr;
         ah_hlen = (ah->hdrlen + 2) << 2;
 
@@ -156,9 +315,24 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 
         ah = (struct ip_auth_hdr *)skb->data;
         iph = ip_hdr(skb);
+        ihl = ip_hdrlen(skb);
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
+
+        work_iph = ah_alloc_tmp(ahash, nfrags, ihl + ahp->icv_trunc_len);
+        if (!work_iph)
+                goto out;
+
+        auth_data = ah_tmp_auth(work_iph, ihl);
+        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
 
-        ihl = skb->data - skb_network_header(skb);
-        memcpy(work_buf, iph, ihl);
+        memcpy(work_iph, iph, ihl);
+        memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
 
         iph->ttl = 0;
         iph->tos = 0;
@@ -166,35 +340,44 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
         iph->check = 0;
         if (ihl > sizeof(*iph)) {
                 __be32 dummy;
-                if (ip_clear_mutable_options(iph, &dummy))
-                        goto out;
+                err = ip_clear_mutable_options(iph, &dummy);
+                if (err)
+                        goto out_free;
         }
 
-        spin_lock(&x->lock);
-        {
-                u8 auth_data[MAX_AH_AUTH_LEN];
+        skb_push(skb, ihl);
 
-                memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
-                skb_push(skb, ihl);
-                err = ah_mac_digest(ahp, skb, ah->auth_data);
-                if (err)
-                        goto unlock;
-                if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len))
-                        err = -EBADMSG;
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, 0, skb->len);
+
+        ahash_request_set_crypt(req, sg, icv, skb->len);
+        ahash_request_set_callback(req, 0, ah_input_done, skb);
+
+        AH_SKB_CB(skb)->tmp = work_iph;
+
+        err = crypto_ahash_digest(req);
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
         }
-unlock:
-        spin_unlock(&x->lock);
 
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
         if (err)
-                goto out;
+                goto out_free;
 
         skb->network_header += ah_hlen;
-        memcpy(skb_network_header(skb), work_buf, ihl);
-        skb->transport_header = skb->network_header;
+        memcpy(skb_network_header(skb), work_iph, ihl);
         __skb_pull(skb, ah_hlen + ihl);
+        skb_set_transport_header(skb, -ihl);
 
-        return nexthdr;
+        err = nexthdr;
 
+out_free:
+        kfree (work_iph);
 out:
         return err;
 }
@@ -222,7 +405,7 @@ static int ah_init_state(struct xfrm_state *x)
 {
         struct ah_data *ahp = NULL;
         struct xfrm_algo_desc *aalg_desc;
-        struct crypto_hash *tfm;
+        struct crypto_ahash *ahash;
 
         if (!x->aalg)
                 goto error;
@@ -231,31 +414,31 @@ static int ah_init_state(struct xfrm_state *x)
                 goto error;
 
         ahp = kzalloc(sizeof(*ahp), GFP_KERNEL);
-        if (ahp == NULL)
+        if (!ahp)
                 return -ENOMEM;
 
-        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
+        ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
+        if (IS_ERR(ahash))
                 goto error;
 
-        ahp->tfm = tfm;
-        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
-                               (x->aalg->alg_key_len + 7) / 8))
+        ahp->ahash = ahash;
+        if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
+                                (x->aalg->alg_key_len + 7) / 8))
                 goto error;
 
         /*
          * Lookup the algorithm description maintained by xfrm_algo,
          * verify crypto transform properties, and store information
          * we need for AH processing.  This lookup cannot fail here
-         * after a successful crypto_alloc_hash().
+         * after a successful crypto_alloc_ahash().
          */
         aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
         BUG_ON(!aalg_desc);
 
         if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-            crypto_hash_digestsize(tfm)) {
+            crypto_ahash_digestsize(ahash)) {
                 printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_hash_digestsize(tfm),
+                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
                        aalg_desc->uinfo.auth.icv_fullbits/8);
                 goto error;
         }
@@ -265,10 +448,6 @@ static int ah_init_state(struct xfrm_state *x)
 
         BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
 
-        ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
-        if (!ahp->work_icv)
-                goto error;
-
         x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
                                           ahp->icv_trunc_len);
         if (x->props.mode == XFRM_MODE_TUNNEL)
@@ -279,8 +458,7 @@ static int ah_init_state(struct xfrm_state *x)
 
 error:
         if (ahp) {
-                kfree(ahp->work_icv);
-                crypto_free_hash(ahp->tfm);
+                crypto_free_ahash(ahp->ahash);
                 kfree(ahp);
         }
         return -EINVAL;
@@ -293,8 +471,7 @@ static void ah_destroy(struct xfrm_state *x)
         if (!ahp)
                 return;
 
-        kfree(ahp->work_icv);
-        crypto_free_hash(ahp->tfm);
+        crypto_free_ahash(ahp->ahash);
         kfree(ahp);
 }
 
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 039cc1ffe977..1e029dc75455 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -2017,7 +2017,7 @@ req_setattr_failure:
  * values on failure.
  *
  */
-int cipso_v4_delopt(struct ip_options **opt_ptr)
+static int cipso_v4_delopt(struct ip_options **opt_ptr)
 {
         int hdr_delta = 0;
         struct ip_options *opt = *opt_ptr;
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 5e6c5a0f3fde..fb2465811b48 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -39,7 +39,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_dst_reset(sk);
 
         oif = sk->sk_bound_dev_if;
-        saddr = inet->saddr;
+        saddr = inet->inet_saddr;
         if (ipv4_is_multicast(usin->sin_addr.s_addr)) {
                 if (!oif)
                         oif = inet->mc_index;
@@ -49,7 +49,7 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         err = ip_route_connect(&rt, usin->sin_addr.s_addr, saddr,
                                RT_CONN_FLAGS(sk), oif,
                                sk->sk_protocol,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (err) {
                 if (err == -ENETUNREACH)
                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -60,14 +60,14 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 ip_rt_put(rt);
                 return -EACCES;
         }
-        if (!inet->saddr)
-                inet->saddr = rt->rt_src;       /* Update source address */
-        if (!inet->rcv_saddr)
-                inet->rcv_saddr = rt->rt_src;
-        inet->daddr = rt->rt_dst;
-        inet->dport = usin->sin_port;
+        if (!inet->inet_saddr)
+                inet->inet_saddr = rt->rt_src;  /* Update source address */
+        if (!inet->inet_rcv_saddr)
+                inet->inet_rcv_saddr = rt->rt_src;
+        inet->inet_daddr = rt->rt_dst;
+        inet->inet_dport = usin->sin_port;
         sk->sk_state = TCP_ESTABLISHED;
-        inet->id = jiffies;
+        inet->inet_id = jiffies;
 
         sk_dst_set(sk, &rt->u.dst);
         return(0);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 5df2f6a0b0f0..7620382058a0 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -140,11 +140,11 @@ void in_dev_finish_destroy(struct in_device *idev)
 #endif
         dev_put(dev);
         if (!idev->dead)
-                printk("Freeing alive in_device %p\n", idev);
-        else {
+                pr_err("Freeing alive in_device %p\n", idev);
+        else
                 kfree(idev);
-        }
 }
+EXPORT_SYMBOL(in_dev_finish_destroy);
 
 static struct in_device *inetdev_init(struct net_device *dev)
 {
@@ -159,7 +159,8 @@ static struct in_device *inetdev_init(struct net_device *dev)
                         sizeof(in_dev->cnf));
         in_dev->cnf.sysctl = NULL;
         in_dev->dev = dev;
-        if ((in_dev->arp_parms = neigh_parms_alloc(dev, &arp_tbl)) == NULL)
+        in_dev->arp_parms = neigh_parms_alloc(dev, &arp_tbl);
+        if (!in_dev->arp_parms)
                 goto out_kfree;
         if (IPV4_DEVCONF(in_dev->cnf, FORWARDING))
                 dev_disable_lro(dev);
@@ -405,13 +406,15 @@ struct in_device *inetdev_by_index(struct net *net, int ifindex)
 {
         struct net_device *dev;
         struct in_device *in_dev = NULL;
-        read_lock(&dev_base_lock);
-        dev = __dev_get_by_index(net, ifindex);
+
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, ifindex);
         if (dev)
                 in_dev = in_dev_get(dev);
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
         return in_dev;
 }
+EXPORT_SYMBOL(inetdev_by_index);
 
 /* Called only from RTNL semaphored context. No locks. */
 
@@ -557,7 +560,7 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
  *      Determine a default network mask, based on the IP address.
  */
 
-static __inline__ int inet_abc_len(__be32 addr)
+static inline int inet_abc_len(__be32 addr)
 {
         int rc = -1;    /* Something else, probably a multicast. */
 
@@ -646,13 +649,15 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         rtnl_lock();
 
         ret = -ENODEV;
-        if ((dev = __dev_get_by_name(net, ifr.ifr_name)) == NULL)
+        dev = __dev_get_by_name(net, ifr.ifr_name);
+        if (!dev)
                 goto done;
 
         if (colon)
                 *colon = ':';
 
-        if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
+        in_dev = __in_dev_get_rtnl(dev);
+        if (in_dev) {
                 if (tryaddrmatch) {
                         /* Matthias Andree */
                         /* compare label and address (4.4BSD style) */
@@ -720,7 +725,8 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 
                 if (!ifa) {
                         ret = -ENOBUFS;
-                        if ((ifa = inet_alloc_ifa()) == NULL)
+                        ifa = inet_alloc_ifa();
+                        if (!ifa)
                                 break;
                         if (colon)
                                 memcpy(ifa->ifa_label, ifr.ifr_name, IFNAMSIZ);
@@ -822,10 +828,10 @@ static int inet_gifconf(struct net_device *dev, char __user *buf, int len)
         struct ifreq ifr;
         int done = 0;
 
-        if (!in_dev || (ifa = in_dev->ifa_list) == NULL)
+        if (!in_dev)
                 goto out;
 
-        for (; ifa; ifa = ifa->ifa_next) {
+        for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
                 if (!buf) {
                         done += sizeof(ifr);
                         continue;
@@ -875,36 +881,33 @@ __be32 inet_select_addr(const struct net_device *dev, __be32 dst, int scope)
                 if (!addr)
                         addr = ifa->ifa_local;
         } endfor_ifa(in_dev);
-no_in_dev:
-        rcu_read_unlock();
 
         if (addr)
-                goto out;
+                goto out_unlock;
+no_in_dev:
 
         /* Not loopback addresses on loopback should be preferred
            in this case. It is importnat that lo is the first interface
            in dev_base list.
          */
-        read_lock(&dev_base_lock);
-        rcu_read_lock();
-        for_each_netdev(net, dev) {
-                if ((in_dev = __in_dev_get_rcu(dev)) == NULL)
+        for_each_netdev_rcu(net, dev) {
+                in_dev = __in_dev_get_rcu(dev);
+                if (!in_dev)
                         continue;
 
                 for_primary_ifa(in_dev) {
                         if (ifa->ifa_scope != RT_SCOPE_LINK &&
                             ifa->ifa_scope <= scope) {
                                 addr = ifa->ifa_local;
-                                goto out_unlock_both;
+                                goto out_unlock;
                         }
                 } endfor_ifa(in_dev);
         }
-out_unlock_both:
-        read_unlock(&dev_base_lock);
+out_unlock:
         rcu_read_unlock();
-out:
         return addr;
 }
+EXPORT_SYMBOL(inet_select_addr);
 
 static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
                               __be32 local, int scope)
@@ -940,7 +943,7 @@ static __be32 confirm_addr_indev(struct in_device *in_dev, __be32 dst,
                 }
         } endfor_ifa(in_dev);
 
-        return same? addr : 0;
+        return same ? addr : 0;
 }
 
 /*
@@ -961,17 +964,16 @@ __be32 inet_confirm_addr(struct in_device *in_dev,
                 return confirm_addr_indev(in_dev, dst, local, scope);
 
         net = dev_net(in_dev->dev);
-        read_lock(&dev_base_lock);
         rcu_read_lock();
-        for_each_netdev(net, dev) {
-                if ((in_dev = __in_dev_get_rcu(dev))) {
+        for_each_netdev_rcu(net, dev) {
+                in_dev = __in_dev_get_rcu(dev);
+                if (in_dev) {
                         addr = confirm_addr_indev(in_dev, dst, local, scope);
                         if (addr)
                                 break;
                 }
         }
         rcu_read_unlock();
-        read_unlock(&dev_base_lock);
 
         return addr;
 }
@@ -984,14 +986,16 @@ int register_inetaddr_notifier(struct notifier_block *nb)
 {
         return blocking_notifier_chain_register(&inetaddr_chain, nb);
 }
+EXPORT_SYMBOL(register_inetaddr_notifier);
 
 int unregister_inetaddr_notifier(struct notifier_block *nb)
 {
         return blocking_notifier_chain_unregister(&inetaddr_chain, nb);
 }
+EXPORT_SYMBOL(unregister_inetaddr_notifier);
 
-/* Rename ifa_labels for a device name change. Make some effort to preserve existing
- * alias numbering and to create unique labels if possible.
+/* Rename ifa_labels for a device name change. Make some effort to preserve
+ * existing alias numbering and to create unique labels if possible.
 */
 static void inetdev_changename(struct net_device *dev, struct in_device *in_dev)
 {
@@ -1010,11 +1014,10 @@ static void inetdev_changename(struct net_device *dev, struct in_device *in_dev)
                         sprintf(old, ":%d", named);
                         dot = old;
                 }
-                if (strlen(dot) + strlen(dev->name) < IFNAMSIZ) {
+                if (strlen(dot) + strlen(dev->name) < IFNAMSIZ)
                         strcat(ifa->ifa_label, dot);
-                } else {
+                else
                         strcpy(ifa->ifa_label + (IFNAMSIZ - strlen(dot) - 1), dot);
-                }
 skip:
                 rtmsg_ifa(RTM_NEWADDR, ifa, NULL, 0);
         }
@@ -1061,8 +1064,9 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 if (!inetdev_valid_mtu(dev->mtu))
                         break;
                 if (dev->flags & IFF_LOOPBACK) {
-                        struct in_ifaddr *ifa;
-                        if ((ifa = inet_alloc_ifa()) != NULL) {
+                        struct in_ifaddr *ifa = inet_alloc_ifa();
+
+                        if (ifa) {
                                 ifa->ifa_local =
                                   ifa->ifa_address = htonl(INADDR_LOOPBACK);
                                 ifa->ifa_prefixlen = 8;
@@ -1170,38 +1174,54 @@ nla_put_failure:
 static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
-        int idx, ip_idx;
+        int h, s_h;
+        int idx, s_idx;
+        int ip_idx, s_ip_idx;
         struct net_device *dev;
         struct in_device *in_dev;
         struct in_ifaddr *ifa;
-        int s_ip_idx, s_idx = cb->args[0];
+        struct hlist_head *head;
+        struct hlist_node *node;
 
-        s_ip_idx = ip_idx = cb->args[1];
-        idx = 0;
-        for_each_netdev(net, dev) {
-                if (idx < s_idx)
-                        goto cont;
-                if (idx > s_idx)
-                        s_ip_idx = 0;
-                if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
-                        goto cont;
-
-                for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
-                     ifa = ifa->ifa_next, ip_idx++) {
-                        if (ip_idx < s_ip_idx)
-                                continue;
-                        if (inet_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
+        s_h = cb->args[0];
+        s_idx = idx = cb->args[1];
+        s_ip_idx = ip_idx = cb->args[2];
+
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                rcu_read_lock();
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        if (idx > s_idx)
+                                s_ip_idx = 0;
+                        in_dev = __in_dev_get_rcu(dev);
+                        if (!in_dev)
+                                goto cont;
+
+                        for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
+                             ifa = ifa->ifa_next, ip_idx++) {
+                                if (ip_idx < s_ip_idx)
+                                        continue;
+                                if (inet_fill_ifaddr(skb, ifa,
+                                             NETLINK_CB(cb->skb).pid,
                                              cb->nlh->nlmsg_seq,
-                                             RTM_NEWADDR, NLM_F_MULTI) <= 0)
-                                goto done;
-                }
+                                             RTM_NEWADDR, NLM_F_MULTI) <= 0) {
+                                        rcu_read_unlock();
+                                        goto done;
+                                }
+                        }
 cont:
-                idx++;
+                        idx++;
+                }
+                rcu_read_unlock();
         }
 
 done:
-        cb->args[0] = idx;
-        cb->args[1] = ip_idx;
+        cb->args[0] = h;
+        cb->args[1] = idx;
+        cb->args[2] = ip_idx;
 
         return skb->len;
 }
@@ -1239,18 +1259,18 @@ static void devinet_copy_dflt_conf(struct net *net, int i)
 {
         struct net_device *dev;
 
-        read_lock(&dev_base_lock);
-        for_each_netdev(net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
                 struct in_device *in_dev;
-                rcu_read_lock();
+
                 in_dev = __in_dev_get_rcu(dev);
                 if (in_dev && !test_bit(i, in_dev->cnf.state))
                         in_dev->cnf.data[i] = net->ipv4.devconf_dflt->data[i];
-                rcu_read_unlock();
         }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
+/* called with RTNL locked */
 static void inet_forward_change(struct net *net)
 {
         struct net_device *dev;
@@ -1259,7 +1279,6 @@ static void inet_forward_change(struct net *net)
         IPV4_DEVCONF_ALL(net, ACCEPT_REDIRECTS) = !on;
         IPV4_DEVCONF_DFLT(net, FORWARDING) = on;
 
-        read_lock(&dev_base_lock);
         for_each_netdev(net, dev) {
                 struct in_device *in_dev;
                 if (on)
@@ -1270,7 +1289,6 @@ static void inet_forward_change(struct net *net)
                         IN_DEV_CONF_SET(in_dev, FORWARDING, on);
                 rcu_read_unlock();
         }
-        read_unlock(&dev_base_lock);
 }
 
 static int devinet_conf_proc(ctl_table *ctl, int write,
@@ -1680,8 +1698,3 @@ void __init devinet_init(void)
         rtnl_register(PF_INET, RTM_GETADDR, NULL, inet_dump_ifaddr);
 }
 
-EXPORT_SYMBOL(in_dev_finish_destroy);
-EXPORT_SYMBOL(inet_select_addr);
-EXPORT_SYMBOL(inetdev_by_index);
-EXPORT_SYMBOL(register_inetaddr_notifier);
-EXPORT_SYMBOL(unregister_inetaddr_notifier);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index aa00398be80e..816e2180bd60 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -125,7 +125,7 @@ void fib_select_default(struct net *net,
 #endif
         tb = fib_get_table(net, table);
         if (FIB_RES_GW(*res) && FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
-                tb->tb_select_default(tb, flp, res);
+                fib_table_select_default(tb, flp, res);
 }
 
 static void fib_flush(struct net *net)
@@ -139,7 +139,7 @@ static void fib_flush(struct net *net)
         for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
                 head = &net->ipv4.fib_table_hash[h];
                 hlist_for_each_entry(tb, node, head, tb_hlist)
-                        flushed += tb->tb_flush(tb);
+                        flushed += fib_table_flush(tb);
         }
 
         if (flushed)
@@ -162,7 +162,7 @@ struct net_device * ip_dev_find(struct net *net, __be32 addr)
 #endif
 
         local_table = fib_get_table(net, RT_TABLE_LOCAL);
-        if (!local_table || local_table->tb_lookup(local_table, &fl, &res))
+        if (!local_table || fib_table_lookup(local_table, &fl, &res))
                 return NULL;
         if (res.type != RTN_LOCAL)
                 goto out;
@@ -200,7 +200,7 @@ static inline unsigned __inet_dev_addr_type(struct net *net,
         local_table = fib_get_table(net, RT_TABLE_LOCAL);
         if (local_table) {
                 ret = RTN_UNICAST;
-                if (!local_table->tb_lookup(local_table, &fl, &res)) {
+                if (!fib_table_lookup(local_table, &fl, &res)) {
                         if (!dev || dev == res.fi->fib_dev)
                                 ret = res.type;
                         fib_res_put(&res);
@@ -476,13 +476,13 @@ int ip_rt_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                         if (cmd == SIOCDELRT) {
                                 tb = fib_get_table(net, cfg.fc_table);
                                 if (tb)
-                                        err = tb->tb_delete(tb, &cfg);
+                                        err = fib_table_delete(tb, &cfg);
                                 else
                                         err = -ESRCH;
                         } else {
                                 tb = fib_new_table(net, cfg.fc_table);
                                 if (tb)
-                                        err = tb->tb_insert(tb, &cfg);
+                                        err = fib_table_insert(tb, &cfg);
                                 else
                                         err = -ENOBUFS;
                         }
@@ -597,7 +597,7 @@ static int inet_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *ar
                 goto errout;
         }
 
-        err = tb->tb_delete(tb, &cfg);
+        err = fib_table_delete(tb, &cfg);
 errout:
         return err;
 }
@@ -619,7 +619,7 @@ static int inet_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh, void *ar
                 goto errout;
         }
 
-        err = tb->tb_insert(tb, &cfg);
+        err = fib_table_insert(tb, &cfg);
 errout:
         return err;
 }
@@ -650,7 +650,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                         if (dumped)
                                 memset(&cb->args[2], 0, sizeof(cb->args) -
                                                  2 * sizeof(cb->args[0]));
-                        if (tb->tb_dump(tb, skb, cb) < 0)
+                        if (fib_table_dump(tb, skb, cb) < 0)
                                 goto out;
                         dumped = 1;
 next:
@@ -704,9 +704,9 @@ static void fib_magic(int cmd, int type, __be32 dst, int dst_len, struct in_ifad
                 cfg.fc_scope = RT_SCOPE_HOST;
 
         if (cmd == RTM_NEWROUTE)
-                tb->tb_insert(tb, &cfg);
+                fib_table_insert(tb, &cfg);
         else
-                tb->tb_delete(tb, &cfg);
+                fib_table_delete(tb, &cfg);
 }
 
 void fib_add_ifaddr(struct in_ifaddr *ifa)
@@ -835,7 +835,7 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb )
                 local_bh_disable();
 
                 frn->tb_id = tb->tb_id;
-                frn->err = tb->tb_lookup(tb, &fl, &res);
+                frn->err = fib_table_lookup(tb, &fl, &res);
 
                 if (!frn->err) {
                         frn->prefixlen = res.prefixlen;
@@ -1012,7 +1012,7 @@ static void __net_exit ip_fib_net_exit(struct net *net)
                 head = &net->ipv4.fib_table_hash[i];
                 hlist_for_each_entry_safe(tb, node, tmp, head, tb_hlist) {
                         hlist_del(node);
-                        tb->tb_flush(tb);
+                        fib_table_flush(tb);
                         kfree(tb);
                 }
         }
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index ecd39454235c..14972017b9c2 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -242,8 +242,8 @@ fn_new_zone(struct fn_hash *table, int z)
         return fz;
 }
 
-static int
-fn_hash_lookup(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+int fib_table_lookup(struct fib_table *tb,
+                     const struct flowi *flp, struct fib_result *res)
 {
         int err;
         struct fn_zone *fz;
@@ -274,8 +274,8 @@ out:
         return err;
 }
 
-static void
-fn_hash_select_default(struct fib_table *tb, const struct flowi *flp, struct fib_result *res)
+void fib_table_select_default(struct fib_table *tb,
+                              const struct flowi *flp, struct fib_result *res)
 {
         int order, last_idx;
         struct hlist_node *node;
@@ -366,7 +366,7 @@ static struct fib_node *fib_find_node(struct fn_zone *fz, __be32 key)
         return NULL;
 }
 
-static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct fn_hash *table = (struct fn_hash *) tb->tb_data;
         struct fib_node *new_f = NULL;
@@ -544,8 +544,7 @@ out:
         return err;
 }
 
-
-static int fn_hash_delete(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct fn_hash *table = (struct fn_hash *)tb->tb_data;
         struct fib_node *f;
@@ -662,7 +661,7 @@ static int fn_flush_list(struct fn_zone *fz, int idx)
         return found;
 }
 
-static int fn_hash_flush(struct fib_table *tb)
+int fib_table_flush(struct fib_table *tb)
 {
         struct fn_hash *table = (struct fn_hash *) tb->tb_data;
         struct fn_zone *fz;
@@ -743,7 +742,8 @@ fn_hash_dump_zone(struct sk_buff *skb, struct netlink_callback *cb,
         return skb->len;
 }
 
-static int fn_hash_dump(struct fib_table *tb, struct sk_buff *skb, struct netlink_callback *cb)
+int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
+                   struct netlink_callback *cb)
 {
         int m, s_m;
         struct fn_zone *fz;
@@ -787,12 +787,7 @@ struct fib_table *fib_hash_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
-        tb->tb_lookup = fn_hash_lookup;
-        tb->tb_insert = fn_hash_insert;
-        tb->tb_delete = fn_hash_delete;
-        tb->tb_flush = fn_hash_flush;
-        tb->tb_select_default = fn_hash_select_default;
-        tb->tb_dump = fn_hash_dump;
+
         memset(tb->tb_data, 0, sizeof(struct fn_hash));
         return tb;
 }
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 92d9d97ec5e3..835262c2b867 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -94,7 +94,7 @@ static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp,
         if ((tbl = fib_get_table(rule->fr_net, rule->table)) == NULL)
                 goto errout;
 
-        err = tbl->tb_lookup(tbl, flp, (struct fib_result *) arg->result);
+        err = fib_table_lookup(tbl, flp, (struct fib_result *) arg->result);
         if (err > 0)
                 err = -EAGAIN;
 errout:
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 291bdf50a21f..af5d89792860 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1174,7 +1174,7 @@ done:
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct fib_alias *fa, *new_fa;
@@ -1373,8 +1373,8 @@ static int check_leaf(struct trie *t, struct leaf *l,
         return 1;
 }
 
-static int fn_trie_lookup(struct fib_table *tb, const struct flowi *flp,
-                          struct fib_result *res)
+int fib_table_lookup(struct fib_table *tb, const struct flowi *flp,
+                     struct fib_result *res)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         int ret;
@@ -1595,7 +1595,7 @@ static void trie_leaf_remove(struct trie *t, struct leaf *l)
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
+int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         u32 key, mask;
@@ -1786,7 +1786,7 @@ static struct leaf *trie_leafindex(struct trie *t, int index)
 /*
  * Caller must hold RTNL.
  */
-static int fn_trie_flush(struct fib_table *tb)
+int fib_table_flush(struct fib_table *tb)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         struct leaf *l, *ll = NULL;
@@ -1807,9 +1807,9 @@ static int fn_trie_flush(struct fib_table *tb)
         return found;
 }
 
-static void fn_trie_select_default(struct fib_table *tb,
-                                   const struct flowi *flp,
-                                   struct fib_result *res)
+void fib_table_select_default(struct fib_table *tb,
+                              const struct flowi *flp,
+                              struct fib_result *res)
 {
         struct trie *t = (struct trie *) tb->tb_data;
         int order, last_idx;
@@ -1952,8 +1952,8 @@ static int fn_trie_dump_leaf(struct leaf *l, struct fib_table *tb,
         return skb->len;
 }
 
-static int fn_trie_dump(struct fib_table *tb, struct sk_buff *skb,
-                        struct netlink_callback *cb)
+int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
+                   struct netlink_callback *cb)
 {
         struct leaf *l;
         struct trie *t = (struct trie *) tb->tb_data;
@@ -2020,12 +2020,6 @@ struct fib_table *fib_hash_table(u32 id)
 
         tb->tb_id = id;
         tb->tb_default = -1;
-        tb->tb_lookup = fn_trie_lookup;
-        tb->tb_insert = fn_trie_insert;
-        tb->tb_delete = fn_trie_delete;
-        tb->tb_flush = fn_trie_flush;
-        tb->tb_select_default = fn_trie_select_default;
-        tb->tb_dump = fn_trie_dump;
 
         t = (struct trie *) tb->tb_data;
         memset(t, 0, sizeof(*t));
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 5bc13fe816d1..fe11f60ce41b 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -501,15 +501,16 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         if (!(rt->rt_flags & RTCF_LOCAL)) {
                 struct net_device *dev = NULL;
 
+                rcu_read_lock();
                 if (rt->fl.iif &&
                         net->ipv4.sysctl_icmp_errors_use_inbound_ifaddr)
-                        dev = dev_get_by_index(net, rt->fl.iif);
+                        dev = dev_get_by_index_rcu(net, rt->fl.iif);
 
-                if (dev) {
+                if (dev)
                         saddr = inet_select_addr(dev, 0, RT_SCOPE_LINK);
-                        dev_put(dev);
-                } else
+                else
                         saddr = 0;
+                rcu_read_unlock();
         }
 
         tos = icmp_pointers[type].error ? ((iph->tos & IPTOS_TOS_MASK) |
@@ -1165,6 +1166,10 @@ static int __net_init icmp_sk_init(struct net *net)
                 sk->sk_sndbuf =
                         (2 * ((64 * 1024) + sizeof(struct sk_buff)));
 
+                /*
+                 * Speedup sock_wfree()
+                 */
+                sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
                 inet_sk(sk)->pmtudisc = IP_PMTUDISC_DONT;
         }
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index d41e5de79a82..6110c6d6e613 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2311,9 +2311,10 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
 
         state->in_dev = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct in_device *in_dev;
-                in_dev = in_dev_get(state->dev);
+
+                in_dev = __in_dev_get_rcu(state->dev);
                 if (!in_dev)
                         continue;
                 read_lock(&in_dev->mc_list_lock);
@@ -2323,7 +2324,6 @@ static inline struct ip_mc_list *igmp_mc_get_first(struct seq_file *seq)
                         break;
                 }
                 read_unlock(&in_dev->mc_list_lock);
-                in_dev_put(in_dev);
         }
         return im;
 }
@@ -2333,16 +2333,15 @@ static struct ip_mc_list *igmp_mc_get_next(struct seq_file *seq, struct ip_mc_li
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
         im = im->next;
         while (!im) {
-                if (likely(state->in_dev != NULL)) {
+                if (likely(state->in_dev != NULL))
                         read_unlock(&state->in_dev->mc_list_lock);
-                        in_dev_put(state->in_dev);
-                }
-                state->dev = next_net_device(state->dev);
+
+                state->dev = next_net_device_rcu(state->dev);
                 if (!state->dev) {
                         state->in_dev = NULL;
                         break;
                 }
-                state->in_dev = in_dev_get(state->dev);
+                state->in_dev = __in_dev_get_rcu(state->dev);
                 if (!state->in_dev)
                         continue;
                 read_lock(&state->in_dev->mc_list_lock);
@@ -2361,9 +2360,9 @@ static struct ip_mc_list *igmp_mc_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *igmp_mc_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(rcu)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return *pos ? igmp_mc_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
@@ -2379,16 +2378,15 @@ static void *igmp_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void igmp_mc_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(rcu)
 {
         struct igmp_mc_iter_state *state = igmp_mc_seq_private(seq);
         if (likely(state->in_dev != NULL)) {
                 read_unlock(&state->in_dev->mc_list_lock);
-                in_dev_put(state->in_dev);
                 state->in_dev = NULL;
         }
         state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int igmp_mc_seq_show(struct seq_file *seq, void *v)
@@ -2462,9 +2460,9 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
 
         state->idev = NULL;
         state->im = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                 struct in_device *idev;
-                idev = in_dev_get(state->dev);
+                idev = __in_dev_get_rcu(state->dev);
                 if (unlikely(idev == NULL))
                         continue;
                 read_lock(&idev->mc_list_lock);
@@ -2480,7 +2478,6 @@ static inline struct ip_sf_list *igmp_mcf_get_first(struct seq_file *seq)
                         spin_unlock_bh(&im->lock);
                 }
                 read_unlock(&idev->mc_list_lock);
-                in_dev_put(idev);
         }
         return psf;
 }
@@ -2494,16 +2491,15 @@ static struct ip_sf_list *igmp_mcf_get_next(struct seq_file *seq, struct ip_sf_l
                 spin_unlock_bh(&state->im->lock);
                 state->im = state->im->next;
                 while (!state->im) {
-                        if (likely(state->idev != NULL)) {
+                        if (likely(state->idev != NULL))
                                 read_unlock(&state->idev->mc_list_lock);
-                                in_dev_put(state->idev);
-                        }
-                        state->dev = next_net_device(state->dev);
+
+                        state->dev = next_net_device_rcu(state->dev);
                         if (!state->dev) {
                                 state->idev = NULL;
                                 goto out;
                         }
-                        state->idev = in_dev_get(state->dev);
+                        state->idev = __in_dev_get_rcu(state->dev);
                         if (!state->idev)
                                 continue;
                         read_lock(&state->idev->mc_list_lock);
@@ -2528,8 +2524,9 @@ static struct ip_sf_list *igmp_mcf_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *igmp_mcf_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(rcu)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
         return *pos ? igmp_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
 
@@ -2545,6 +2542,7 @@ static void *igmp_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
+        __releases(rcu)
 {
         struct igmp_mcf_iter_state *state = igmp_mcf_seq_private(seq);
         if (likely(state->im != NULL)) {
@@ -2553,11 +2551,10 @@ static void igmp_mcf_seq_stop(struct seq_file *seq, void *v)
         }
         if (likely(state->idev != NULL)) {
                 read_unlock(&state->idev->mc_list_lock);
-                in_dev_put(state->idev);
                 state->idev = NULL;
         }
         state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 
 static int igmp_mcf_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 537731b3bcb3..26fb50e91311 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -358,6 +358,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct ip_options *opt = inet_rsk(req)->opt;
         struct flowi fl = { .oif = sk->sk_bound_dev_if,
+                            .mark = sk->sk_mark,
                             .nl_u = { .ip4_u =
                                       { .daddr = ((opt && opt->srr) ?
                                                   opt->faddr :
@@ -367,7 +368,7 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
                             .proto = sk->sk_protocol,
                             .flags = inet_sk_flowi_flags(sk),
                             .uli_u = { .ports =
-                                       { .sport = inet_sk(sk)->sport,
+                                       { .sport = inet_sk(sk)->inet_sport,
                                          .dport = ireq->rmt_port } } };
         struct net *net = sock_net(sk);
 
@@ -574,9 +575,9 @@ struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req,
                 newsk->sk_state = TCP_SYN_RECV;
                 newicsk->icsk_bind_hash = NULL;
 
-                inet_sk(newsk)->dport = inet_rsk(req)->rmt_port;
-                inet_sk(newsk)->num = ntohs(inet_rsk(req)->loc_port);
-                inet_sk(newsk)->sport = inet_rsk(req)->loc_port;
+                inet_sk(newsk)->inet_dport = inet_rsk(req)->rmt_port;
+                inet_sk(newsk)->inet_num = ntohs(inet_rsk(req)->loc_port);
+                inet_sk(newsk)->inet_sport = inet_rsk(req)->loc_port;
                 newsk->sk_write_space = sk_stream_write_space;
 
                 newicsk->icsk_retransmits = 0;
@@ -607,8 +608,8 @@ void inet_csk_destroy_sock(struct sock *sk)
         /* It cannot be in hash table! */
         WARN_ON(!sk_unhashed(sk));
 
-        /* If it has not 0 inet_sk(sk)->num, it must be bound */
-        WARN_ON(inet_sk(sk)->num && !inet_csk(sk)->icsk_bind_hash);
+        /* If it has not 0 inet_sk(sk)->inet_num, it must be bound */
+        WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);
 
         sk->sk_prot->destroy(sk);
 
@@ -643,8 +644,8 @@ int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
          * after validation is complete.
          */
         sk->sk_state = TCP_LISTEN;
-        if (!sk->sk_prot->get_port(sk, inet->num)) {
-                inet->sport = htons(inet->num);
+        if (!sk->sk_prot->get_port(sk, inet->inet_num)) {
+                inet->inet_sport = htons(inet->inet_num);
 
                 sk_dst_reset(sk);
                 sk->sk_prot->hash(sk);
@@ -720,8 +721,8 @@ void inet_csk_addr2sockaddr(struct sock *sk, struct sockaddr *uaddr)
         const struct inet_sock *inet = inet_sk(sk);
 
         sin->sin_family         = AF_INET;
-        sin->sin_addr.s_addr    = inet->daddr;
-        sin->sin_port           = inet->dport;
+        sin->sin_addr.s_addr    = inet->inet_daddr;
+        sin->sin_port           = inet->inet_dport;
 }
 
 EXPORT_SYMBOL_GPL(inet_csk_addr2sockaddr);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index a706a47f4dbb..bdb78dd180ce 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -116,10 +116,10 @@ static int inet_csk_diag_fill(struct sock *sk,
         r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
         r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
 
-        r->id.idiag_sport = inet->sport;
-        r->id.idiag_dport = inet->dport;
-        r->id.idiag_src[0] = inet->rcv_saddr;
-        r->id.idiag_dst[0] = inet->daddr;
+        r->id.idiag_sport = inet->inet_sport;
+        r->id.idiag_dport = inet->inet_dport;
+        r->id.idiag_src[0] = inet->inet_rcv_saddr;
+        r->id.idiag_dst[0] = inet->inet_daddr;
 
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
         if (r->idiag_family == AF_INET6) {
@@ -504,11 +504,11 @@ static int inet_csk_diag_dump(struct sock *sk,
                 } else
 #endif
                 {
-                        entry.saddr = &inet->rcv_saddr;
-                        entry.daddr = &inet->daddr;
+                        entry.saddr = &inet->inet_rcv_saddr;
+                        entry.daddr = &inet->inet_daddr;
                 }
-                entry.sport = inet->num;
-                entry.dport = ntohs(inet->dport);
+                entry.sport = inet->inet_num;
+                entry.dport = ntohs(inet->inet_dport);
                 entry.userlocks = sk->sk_userlocks;
 
                 if (!inet_diag_bc_run(RTA_DATA(bc), RTA_PAYLOAD(bc), &entry))
@@ -584,7 +584,7 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
         if (tmo < 0)
                 tmo = 0;
 
-        r->id.idiag_sport = inet->sport;
+        r->id.idiag_sport = inet->inet_sport;
         r->id.idiag_dport = ireq->rmt_port;
         r->id.idiag_src[0] = ireq->loc_addr;
         r->id.idiag_dst[0] = ireq->rmt_addr;
@@ -639,7 +639,7 @@ static int inet_diag_dump_reqs(struct sk_buff *skb, struct sock *sk,
 
         if (cb->nlh->nlmsg_len > 4 + NLMSG_SPACE(sizeof(*r))) {
                 bc = (struct rtattr *)(r + 1);
-                entry.sport = inet->num;
+                entry.sport = inet->inet_num;
                 entry.userlocks = sk->sk_userlocks;
         }
 
@@ -732,7 +732,7 @@ static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
                                         continue;
                                 }
 
-                                if (r->id.idiag_sport != inet->sport &&
+                                if (r->id.idiag_sport != inet->inet_sport &&
                                     r->id.idiag_sport)
                                         goto next_listen;
 
@@ -774,7 +774,7 @@ skip_listen_ht:
         if (!(r->idiag_states & ~(TCPF_LISTEN | TCPF_SYN_RECV)))
                 goto unlock;
 
-        for (i = s_i; i < hashinfo->ehash_size; i++) {
+        for (i = s_i; i <= hashinfo->ehash_mask; i++) {
                 struct inet_ehash_bucket *head = &hashinfo->ehash[i];
                 spinlock_t *lock = inet_ehash_lockp(hashinfo, i);
                 struct sock *sk;
@@ -797,10 +797,10 @@ skip_listen_ht:
                                 goto next_normal;
                         if (!(r->idiag_states & (1 << sk->sk_state)))
                                 goto next_normal;
-                        if (r->id.idiag_sport != inet->sport &&
+                        if (r->id.idiag_sport != inet->inet_sport &&
                             r->id.idiag_sport)
                                 goto next_normal;
-                        if (r->id.idiag_dport != inet->dport &&
+                        if (r->id.idiag_dport != inet->inet_dport &&
                             r->id.idiag_dport)
                                 goto next_normal;
                         if (inet_csk_diag_dump(sk, skb, cb) < 0) {
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 625cc5f64c94..47ad7aab51e3 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -64,7 +64,7 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
 
         atomic_inc(&hashinfo->bsockets);
 
-        inet_sk(sk)->num = snum;
+        inet_sk(sk)->inet_num = snum;
         sk_add_bind_node(sk, &tb->owners);
         tb->num_owners++;
         inet_csk(sk)->icsk_bind_hash = tb;
@@ -76,7 +76,7 @@ void inet_bind_hash(struct sock *sk, struct inet_bind_bucket *tb,
 static void __inet_put_port(struct sock *sk)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
-        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(sk)->num,
+        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(sk)->inet_num,
                         hashinfo->bhash_size);
         struct inet_bind_hashbucket *head = &hashinfo->bhash[bhash];
         struct inet_bind_bucket *tb;
@@ -88,7 +88,7 @@ static void __inet_put_port(struct sock *sk)
         __sk_del_bind_node(sk);
         tb->num_owners--;
         inet_csk(sk)->icsk_bind_hash = NULL;
-        inet_sk(sk)->num = 0;
+        inet_sk(sk)->inet_num = 0;
         inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb);
         spin_unlock(&head->lock);
 }
@@ -105,7 +105,7 @@ EXPORT_SYMBOL(inet_put_port);
 void __inet_inherit_port(struct sock *sk, struct sock *child)
 {
         struct inet_hashinfo *table = sk->sk_prot->h.hashinfo;
-        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(child)->num,
+        const int bhash = inet_bhashfn(sock_net(sk), inet_sk(child)->inet_num,
                         table->bhash_size);
         struct inet_bind_hashbucket *head = &table->bhash[bhash];
         struct inet_bind_bucket *tb;
@@ -126,9 +126,9 @@ static inline int compute_score(struct sock *sk, struct net *net,
         int score = -1;
         struct inet_sock *inet = inet_sk(sk);
 
-        if (net_eq(sock_net(sk), net) && inet->num == hnum &&
+        if (net_eq(sock_net(sk), net) && inet->inet_num == hnum &&
                         !ipv6_only_sock(sk)) {
-                __be32 rcv_saddr = inet->rcv_saddr;
+                __be32 rcv_saddr = inet->inet_rcv_saddr;
                 score = sk->sk_family == PF_INET ? 1 : 0;
                 if (rcv_saddr) {
                         if (rcv_saddr != daddr)
@@ -209,7 +209,7 @@ struct sock * __inet_lookup_established(struct net *net,
          * have wildcards anyways.
          */
         unsigned int hash = inet_ehashfn(net, daddr, hnum, saddr, sport);
-        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        unsigned int slot = hash & hashinfo->ehash_mask;
         struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
         rcu_read_lock();
@@ -273,13 +273,14 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
         struct inet_sock *inet = inet_sk(sk);
-        __be32 daddr = inet->rcv_saddr;
-        __be32 saddr = inet->daddr;
+        __be32 daddr = inet->inet_rcv_saddr;
+        __be32 saddr = inet->inet_daddr;
         int dif = sk->sk_bound_dev_if;
         INET_ADDR_COOKIE(acookie, saddr, daddr)
-        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->inet_dport, lport);
         struct net *net = sock_net(sk);
-        unsigned int hash = inet_ehashfn(net, daddr, lport, saddr, inet->dport);
+        unsigned int hash = inet_ehashfn(net, daddr, lport,
+                                         saddr, inet->inet_dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
@@ -312,8 +313,8 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 unique:
         /* Must record num and sport now. Otherwise we will see
          * in hash table socket with a funny identity. */
-        inet->num = lport;
-        inet->sport = htons(lport);
+        inet->inet_num = lport;
+        inet->inet_sport = htons(lport);
         sk->sk_hash = hash;
         WARN_ON(!sk_unhashed(sk));
         __sk_nulls_add_node_rcu(sk, &head->chain);
@@ -341,8 +342,9 @@ not_unique:
 static inline u32 inet_sk_port_offset(const struct sock *sk)
 {
         const struct inet_sock *inet = inet_sk(sk);
-        return secure_ipv4_port_ephemeral(inet->rcv_saddr, inet->daddr,
-                                          inet->dport);
+        return secure_ipv4_port_ephemeral(inet->inet_rcv_saddr,
+                                          inet->inet_daddr,
+                                          inet->inet_dport);
 }
 
 void __inet_hash_nolisten(struct sock *sk)
@@ -424,7 +426,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                 void (*hash)(struct sock *sk))
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
-        const unsigned short snum = inet_sk(sk)->num;
+        const unsigned short snum = inet_sk(sk)->inet_num;
         struct inet_bind_hashbucket *head;
         struct inet_bind_bucket *tb;
         int ret;
@@ -485,7 +487,7 @@ ok:
                 /* Head lock still held and bh's disabled */
                 inet_bind_hash(sk, tb, port);
                 if (sk_unhashed(sk)) {
-                        inet_sk(sk)->sport = htons(port);
+                        inet_sk(sk)->inet_sport = htons(port);
                         hash(sk);
                 }
                 spin_unlock(&head->lock);
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 13f0781f35cd..1f5d508bb18b 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -86,7 +86,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
            Note, that any socket with inet->num != 0 MUST be bound in
            binding cache, even if it is closed.
          */
-        bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->num,
+        bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), inet->inet_num,
                         hashinfo->bhash_size)];
         spin_lock(&bhead->lock);
         tw->tw_tb = icsk->icsk_bind_hash;
@@ -124,14 +124,14 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat
                 kmemcheck_annotate_bitfield(tw, flags);
 
                 /* Give us an identity. */
-                tw->tw_daddr        = inet->daddr;
-                tw->tw_rcv_saddr    = inet->rcv_saddr;
+                tw->tw_daddr        = inet->inet_daddr;
+                tw->tw_rcv_saddr    = inet->inet_rcv_saddr;
                 tw->tw_bound_dev_if = sk->sk_bound_dev_if;
-                tw->tw_num          = inet->num;
+                tw->tw_num          = inet->inet_num;
                 tw->tw_state        = TCP_TIME_WAIT;
                 tw->tw_substate     = state;
-                tw->tw_sport        = inet->sport;
-                tw->tw_dport        = inet->dport;
+                tw->tw_sport        = inet->inet_sport;
+                tw->tw_dport        = inet->inet_dport;
                 tw->tw_family       = sk->sk_family;
                 tw->tw_reuse        = sk->sk_reuse;
                 tw->tw_hash         = sk->sk_hash;
@@ -430,7 +430,7 @@ void inet_twsk_purge(struct net *net, struct inet_hashinfo *hashinfo,
         int h;
 
         local_bh_disable();
-        for (h = 0; h < (hashinfo->ehash_size); h++) {
+        for (h = 0; h <= hashinfo->ehash_mask; h++) {
                 struct inet_ehash_bucket *head =
                         inet_ehash_bucket(hashinfo, h);
                 spinlock_t *lock = inet_ehash_lockp(hashinfo, h);
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index b1fbe18feb5a..6bcfe52a9c87 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -67,9 +67,6 @@
  *              ip_id_count: idlock
  */
 
-/* Exported for inet_getid inline function.  */
-DEFINE_SPINLOCK(inet_peer_idlock);
-
 static struct kmem_cache *peer_cachep __read_mostly;
 
 #define node_height(x) x->avl_height
@@ -390,7 +387,7 @@ struct inet_peer *inet_getpeer(__be32 daddr, int create)
         n->v4daddr = daddr;
         atomic_set(&n->refcnt, 1);
         atomic_set(&n->rid, 0);
-        n->ip_id_count = secure_ip_id(daddr);
+        atomic_set(&n->ip_id_count, secure_ip_id(daddr));
         n->tcp_ts_stamp = 0;
 
         write_lock_bh(&peer_pool_lock);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 575f9bd51ccd..b007f8af6e1f 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -206,10 +206,11 @@ static void ip_expire(unsigned long arg)
                 struct sk_buff *head = qp->q.fragments;
 
                 /* Send an ICMP "Fragment Reassembly Timeout" message. */
-                if ((head->dev = dev_get_by_index(net, qp->iif)) != NULL) {
+                rcu_read_lock();
+                head->dev = dev_get_by_index_rcu(net, qp->iif);
+                if (head->dev)
                         icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
-                        dev_put(head->dev);
-                }
+                rcu_read_unlock();
         }
 out:
         spin_unlock(&qp->q.lock);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 143333852624..a7de9e3a8f18 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -156,8 +156,13 @@ struct ipgre_net {
 #define tunnels_r       tunnels[2]
 #define tunnels_l       tunnels[1]
 #define tunnels_wc      tunnels[0]
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipgre_lock);
 
-static DEFINE_RWLOCK(ipgre_lock);
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
 /* Given src, dst and key, find appropriate for input tunnel. */
 
@@ -175,7 +180,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                        ARPHRD_ETHER : ARPHRD_IPGRE;
         int score, cand_score = 4;
 
-        for (t = ign->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_r_l[h0 ^ h1]) {
                 if (local != t->parms.iph.saddr ||
                     remote != t->parms.iph.daddr ||
                     key != t->parms.i_key ||
@@ -200,7 +205,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_r[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_r[h0 ^ h1]) {
                 if (remote != t->parms.iph.daddr ||
                     key != t->parms.i_key ||
                     !(t->dev->flags & IFF_UP))
@@ -224,7 +229,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_l[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_l[h1]) {
                 if ((local != t->parms.iph.saddr &&
                      (local != t->parms.iph.daddr ||
                       !ipv4_is_multicast(local))) ||
@@ -250,7 +255,7 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
                 }
         }
 
-        for (t = ign->tunnels_wc[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ign->tunnels_wc[h1]) {
                 if (t->parms.i_key != key ||
                     !(t->dev->flags & IFF_UP))
                         continue;
@@ -276,8 +281,9 @@ static struct ip_tunnel * ipgre_tunnel_lookup(struct net_device *dev,
         if (cand != NULL)
                 return cand;
 
-        if (ign->fb_tunnel_dev->flags & IFF_UP)
-                return netdev_priv(ign->fb_tunnel_dev);
+        dev = ign->fb_tunnel_dev;
+        if (dev->flags & IFF_UP)
+                return netdev_priv(dev);
 
         return NULL;
 }
@@ -311,10 +317,10 @@ static void ipgre_tunnel_link(struct ipgre_net *ign, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipgre_bucket(ign, t);
 
+        spin_lock_bh(&ipgre_lock);
         t->next = *tp;
-        write_lock_bh(&ipgre_lock);
-        *tp = t;
-        write_unlock_bh(&ipgre_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipgre_lock);
 }
 
 static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
@@ -323,9 +329,9 @@ static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
 
         for (tp = ipgre_bucket(ign, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipgre_lock);
+                        spin_lock_bh(&ipgre_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipgre_lock);
+                        spin_unlock_bh(&ipgre_lock);
                         break;
                 }
         }
@@ -476,7 +482,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 break;
         }
 
-        read_lock(&ipgre_lock);
+        rcu_read_lock();
         t = ipgre_tunnel_lookup(skb->dev, iph->daddr, iph->saddr,
                                 flags & GRE_KEY ?
                                 *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
@@ -494,7 +500,7 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipgre_lock);
+        rcu_read_unlock();
         return;
 }
 
@@ -573,7 +579,7 @@ static int ipgre_rcv(struct sk_buff *skb)
 
         gre_proto = *(__be16 *)(h + 2);
 
-        read_lock(&ipgre_lock);
+        rcu_read_lock();
         if ((tunnel = ipgre_tunnel_lookup(skb->dev,
                                           iph->saddr, iph->daddr, key,
                                           gre_proto))) {
@@ -647,13 +653,13 @@ static int ipgre_rcv(struct sk_buff *skb)
                 ipgre_ecn_decapsulate(iph, skb);
 
                 netif_rx(skb);
-                read_unlock(&ipgre_lock);
+                rcu_read_unlock();
                 return(0);
         }
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 
 drop:
-        read_unlock(&ipgre_lock);
+        rcu_read_unlock();
 drop_nolock:
         kfree_skb(skb);
         return(0);
@@ -662,7 +668,8 @@ drop_nolock:
 static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *old_iph = ip_hdr(skb);
         struct iphdr  *tiph;
         u8     tos;
@@ -810,7 +817,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -1283,16 +1290,19 @@ static const struct net_protocol ipgre_protocol = {
         .netns_ok       =       1,
 };
 
-static void ipgre_destroy_tunnels(struct ipgre_net *ign)
+static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
 {
         int prio;
 
         for (prio = 0; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = ign->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = ign->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
@@ -1340,10 +1350,12 @@ err_alloc:
 static void ipgre_exit_net(struct net *net)
 {
         struct ipgre_net *ign;
+        LIST_HEAD(list);
 
         ign = net_generic(net, ipgre_net_id);
         rtnl_lock();
-        ipgre_destroy_tunnels(ign);
+        ipgre_destroy_tunnels(ign, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
         kfree(ign);
 }
@@ -1471,7 +1483,7 @@ static void ipgre_tap_setup(struct net_device *dev)
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
-static int ipgre_newlink(struct net_device *dev, struct nlattr *tb[],
+static int ipgre_newlink(struct net *src_net, struct net_device *dev, struct nlattr *tb[],
                          struct nlattr *data[])
 {
         struct ip_tunnel *nt;
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 6c98b43badf4..fdf51badc8e5 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -161,7 +161,7 @@ int ip_call_ra_chain(struct sk_buff *skb)
                 /* If socket is bound to an interface, only report
                  * the packet if it came  from that interface.
                  */
-                if (sk && inet_sk(sk)->num == protocol &&
+                if (sk && inet_sk(sk)->inet_num == protocol &&
                     (!sk->sk_bound_dev_if ||
                      sk->sk_bound_dev_if == dev->ifindex) &&
                     sock_net(sk) == dev_net(dev)) {
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index f9895180f481..322b40864ac0 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -329,7 +329,7 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                 __be32 daddr;
 
                 /* Use correct destination address if we have options. */
-                daddr = inet->daddr;
+                daddr = inet->inet_daddr;
                 if(opt && opt->srr)
                         daddr = opt->faddr;
 
@@ -338,13 +338,13 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                                             .mark = sk->sk_mark,
                                             .nl_u = { .ip4_u =
                                                       { .daddr = daddr,
-                                                        .saddr = inet->saddr,
+                                                        .saddr = inet->inet_saddr,
                                                         .tos = RT_CONN_FLAGS(sk) } },
                                             .proto = sk->sk_protocol,
                                             .flags = inet_sk_flowi_flags(sk),
                                             .uli_u = { .ports =
-                                                       { .sport = inet->sport,
-                                                         .dport = inet->dport } } };
+                                                       { .sport = inet->inet_sport,
+                                                         .dport = inet->inet_dport } } };
 
                         /* If this fails, retransmit mechanism of transport layer will
                          * keep trying until route appears or the connection times
@@ -379,7 +379,7 @@ packet_routed:
 
         if (opt && opt->optlen) {
                 iph->ihl += opt->optlen >> 2;
-                ip_options_build(skb, opt, inet->daddr, rt, 0);
+                ip_options_build(skb, opt, inet->inet_daddr, rt, 0);
         }
 
         ip_select_ident_more(iph, &rt->u.dst, sk,
@@ -846,7 +846,8 @@ int ip_append_data(struct sock *sk,
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
 
         if (inet->cork.length + length > 0xFFFF - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport, mtu-exthdrlen);
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport,
+                               mtu-exthdrlen);
                 return -EMSGSIZE;
         }
 
@@ -1100,7 +1101,7 @@ ssize_t	ip_append_page(struct sock *sk, struct page *page,
         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen;
 
         if (inet->cork.length + size > 0xFFFF - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport, mtu);
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport, mtu);
                 return -EMSGSIZE;
         }
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index e982b5c1ee17..cafad9baff03 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -245,7 +245,7 @@ int ip_ra_control(struct sock *sk, unsigned char on,
 {
         struct ip_ra_chain *ra, *new_ra, **rap;
 
-        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num == IPPROTO_RAW)
+        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num == IPPROTO_RAW)
                 return -EINVAL;
 
         new_ra = on ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
@@ -480,7 +480,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         case IP_OPTIONS:
         {
                 struct ip_options *opt = NULL;
-                if (optlen > 40 || optlen < 0)
+                if (optlen > 40)
                         goto e_inval;
                 err = ip_options_get_from_user(sock_net(sk), &opt,
                                                optval, optlen);
@@ -492,7 +492,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                         if (sk->sk_family == PF_INET ||
                             (!((1 << sk->sk_state) &
                                (TCPF_LISTEN | TCPF_CLOSE)) &&
-                             inet->daddr != LOOPBACK4_IPV6)) {
+                             inet->inet_daddr != LOOPBACK4_IPV6)) {
 #endif
                                 if (inet->opt)
                                         icsk->icsk_ext_hdr_len -= inet->opt->optlen;
@@ -575,7 +575,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                 inet->hdrincl = val ? 1 : 0;
                 break;
         case IP_MTU_DISCOVER:
-                if (val < 0 || val > 3)
+                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
                         goto e_inval;
                 inet->pmtudisc = val;
                 break;
@@ -1180,8 +1180,8 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
                 if (inet->cmsg_flags & IP_CMSG_PKTINFO) {
                         struct in_pktinfo info;
 
-                        info.ipi_addr.s_addr = inet->rcv_saddr;
-                        info.ipi_spec_dst.s_addr = inet->rcv_saddr;
+                        info.ipi_addr.s_addr = inet->inet_rcv_saddr;
+                        info.ipi_spec_dst.s_addr = inet->inet_rcv_saddr;
                         info.ipi_ifindex = inet->mc_index;
                         put_cmsg(&msg, SOL_IP, IP_PKTINFO, sizeof(info), &info);
                 }
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index ae40ed1ba560..c5b1f71c3cd8 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -134,7 +134,13 @@ static void ipip_fb_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_setup(struct net_device *dev);
 
-static DEFINE_RWLOCK(ipip_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipip_lock);
+
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
                 __be32 remote, __be32 local)
@@ -144,20 +150,21 @@ static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
         struct ip_tunnel *t;
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
-        for (t = ipn->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(ipn->tunnels_r_l[h0 ^ h1])
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        for (t = ipn->tunnels_r[h0]; t; t = t->next) {
+
+        for_each_ip_tunnel_rcu(ipn->tunnels_r[h0])
                 if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        for (t = ipn->tunnels_l[h1]; t; t = t->next) {
+
+        for_each_ip_tunnel_rcu(ipn->tunnels_l[h1])
                 if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
                         return t;
-        }
-        if ((t = ipn->tunnels_wc[0]) != NULL && (t->dev->flags&IFF_UP))
+
+        t = rcu_dereference(ipn->tunnels_wc[0]);
+        if (t && (t->dev->flags&IFF_UP))
                 return t;
         return NULL;
 }
@@ -193,9 +200,9 @@ static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
 
         for (tp = ipip_bucket(ipn, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipip_lock);
+                        spin_lock_bh(&ipip_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipip_lock);
+                        spin_unlock_bh(&ipip_lock);
                         break;
                 }
         }
@@ -205,10 +212,10 @@ static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipip_bucket(ipn, t);
 
+        spin_lock_bh(&ipip_lock);
         t->next = *tp;
-        write_lock_bh(&ipip_lock);
-        *tp = t;
-        write_unlock_bh(&ipip_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipip_lock);
 }
 
 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
@@ -267,9 +274,9 @@ static void ipip_tunnel_uninit(struct net_device *dev)
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 
         if (dev == ipn->fb_tunnel_dev) {
-                write_lock_bh(&ipip_lock);
+                spin_lock_bh(&ipip_lock);
                 ipn->tunnels_wc[0] = NULL;
-                write_unlock_bh(&ipip_lock);
+                spin_unlock_bh(&ipip_lock);
         } else
                 ipip_tunnel_unlink(ipn, netdev_priv(dev));
         dev_put(dev);
@@ -318,7 +325,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
 
         err = -ENOENT;
 
-        read_lock(&ipip_lock);
+        rcu_read_lock();
         t = ipip_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
         if (t == NULL || t->parms.iph.daddr == 0)
                 goto out;
@@ -333,7 +340,7 @@ static int ipip_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipip_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -351,11 +358,11 @@ static int ipip_rcv(struct sk_buff *skb)
         struct ip_tunnel *tunnel;
         const struct iphdr *iph = ip_hdr(skb);
 
-        read_lock(&ipip_lock);
+        rcu_read_lock();
         if ((tunnel = ipip_tunnel_lookup(dev_net(skb->dev),
                                         iph->saddr, iph->daddr)) != NULL) {
                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                        read_unlock(&ipip_lock);
+                        rcu_read_unlock();
                         kfree_skb(skb);
                         return 0;
                 }
@@ -374,10 +381,10 @@ static int ipip_rcv(struct sk_buff *skb)
                 nf_reset(skb);
                 ipip_ecn_decapsulate(iph, skb);
                 netif_rx(skb);
-                read_unlock(&ipip_lock);
+                rcu_read_unlock();
                 return 0;
         }
-        read_unlock(&ipip_lock);
+        rcu_read_unlock();
 
         return -1;
 }
@@ -390,7 +397,8 @@ static int ipip_rcv(struct sk_buff *skb)
 static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *tiph = &tunnel->parms.iph;
         u8     tos = tunnel->parms.iph.tos;
         __be16 df = tiph->frag_off;
@@ -480,7 +488,7 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -748,16 +756,19 @@ static struct xfrm_tunnel ipip_handler = {
 static const char banner[] __initconst =
         KERN_INFO "IPv4 over IPv4 tunneling driver\n";
 
-static void ipip_destroy_tunnels(struct ipip_net *ipn)
+static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
 {
         int prio;
 
         for (prio = 1; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = ipn->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = ipn->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
@@ -810,11 +821,13 @@ err_alloc:
 static void ipip_exit_net(struct net *net)
 {
         struct ipip_net *ipn;
+        LIST_HEAD(list);
 
         ipn = net_generic(net, ipip_net_id);
         rtnl_lock();
-        ipip_destroy_tunnels(ipn);
-        unregister_netdevice(ipn->fb_tunnel_dev);
+        ipip_destroy_tunnels(ipn, &list);
+        unregister_netdevice_queue(ipn->fb_tunnel_dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
         kfree(ipn);
 }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 99508d66a642..54596f73eff5 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -275,7 +275,8 @@ failure:
  *      @notify: Set to 1, if the caller is a notifier_call
  */
 
-static int vif_delete(struct net *net, int vifi, int notify)
+static int vif_delete(struct net *net, int vifi, int notify,
+                      struct list_head *head)
 {
         struct vif_device *v;
         struct net_device *dev;
@@ -319,7 +320,7 @@ static int vif_delete(struct net *net, int vifi, int notify)
         }
 
         if (v->flags&(VIFF_TUNNEL|VIFF_REGISTER) && !notify)
-                unregister_netdevice(dev);
+                unregister_netdevice_queue(dev, head);
 
         dev_put(dev);
         return 0;
@@ -469,8 +470,18 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                         return err;
                 }
                 break;
+
+        case VIFF_USE_IFINDEX:
         case 0:
-                dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+                if (vifc->vifc_flags == VIFF_USE_IFINDEX) {
+                        dev = dev_get_by_index(net, vifc->vifc_lcl_ifindex);
+                        if (dev && dev->ip_ptr == NULL) {
+                                dev_put(dev);
+                                return -EADDRNOTAVAIL;
+                        }
+                } else
+                        dev = ip_dev_find(net, vifc->vifc_lcl_addr.s_addr);
+
                 if (!dev)
                         return -EADDRNOTAVAIL;
                 err = dev_set_allmulti(dev, 1);
@@ -862,14 +873,16 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
 static void mroute_clean_tables(struct net *net)
 {
         int i;
+        LIST_HEAD(list);
 
         /*
          *      Shut down all active vif entries
          */
         for (i = 0; i < net->ipv4.maxvif; i++) {
                 if (!(net->ipv4.vif_table[i].flags&VIFF_STATIC))
-                        vif_delete(net, i, 0);
+                        vif_delete(net, i, 0, &list);
         }
+        unregister_netdevice_many(&list);
 
         /*
          *      Wipe the cache
@@ -948,7 +961,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
         switch (optname) {
         case MRT_INIT:
                 if (sk->sk_type != SOCK_RAW ||
-                    inet_sk(sk)->num != IPPROTO_IGMP)
+                    inet_sk(sk)->inet_num != IPPROTO_IGMP)
                         return -EOPNOTSUPP;
                 if (optlen != sizeof(int))
                         return -ENOPROTOOPT;
@@ -985,7 +998,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
                 if (optname == MRT_ADD_VIF) {
                         ret = vif_add(net, &vif, sk == net->ipv4.mroute_sk);
                 } else {
-                        ret = vif_delete(net, vif.vifc_vifi, 0);
+                        ret = vif_delete(net, vif.vifc_vifi, 0, NULL);
                 }
                 rtnl_unlock();
                 return ret;
@@ -1148,6 +1161,7 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
         struct net *net = dev_net(dev);
         struct vif_device *v;
         int ct;
+        LIST_HEAD(list);
 
         if (!net_eq(dev_net(dev), net))
                 return NOTIFY_DONE;
@@ -1157,8 +1171,9 @@ static int ipmr_device_event(struct notifier_block *this, unsigned long event, v
         v = &net->ipv4.vif_table[0];
         for (ct = 0; ct < net->ipv4.maxvif; ct++, v++) {
                 if (v->dev == dev)
-                        vif_delete(net, ct, 1);
+                        vif_delete(net, ct, 1, &list);
         }
+        unregister_netdevice_many(&list);
         return NOTIFY_DONE;
 }
 
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index aa95bb82ee6c..9cd423ffafa8 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -255,10 +255,10 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
         struct nf_conntrack_tuple tuple;
 
         memset(&tuple, 0, sizeof(tuple));
-        tuple.src.u3.ip = inet->rcv_saddr;
-        tuple.src.u.tcp.port = inet->sport;
-        tuple.dst.u3.ip = inet->daddr;
-        tuple.dst.u.tcp.port = inet->dport;
+        tuple.src.u3.ip = inet->inet_rcv_saddr;
+        tuple.src.u.tcp.port = inet->inet_sport;
+        tuple.dst.u3.ip = inet->inet_daddr;
+        tuple.dst.u.tcp.port = inet->inet_dport;
         tuple.src.l3num = PF_INET;
         tuple.dst.protonum = sk->sk_protocol;
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index ab996f9c0fe0..ce154b47f1da 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -87,7 +87,7 @@ void raw_hash_sk(struct sock *sk)
         struct raw_hashinfo *h = sk->sk_prot->h.raw_hash;
         struct hlist_head *head;
 
-        head = &h->ht[inet_sk(sk)->num & (RAW_HTABLE_SIZE - 1)];
+        head = &h->ht[inet_sk(sk)->inet_num & (RAW_HTABLE_SIZE - 1)];
 
         write_lock_bh(&h->lock);
         sk_add_node(sk, head);
@@ -115,9 +115,9 @@ static struct sock *__raw_v4_lookup(struct net *net, struct sock *sk,
         sk_for_each_from(sk, node) {
                 struct inet_sock *inet = inet_sk(sk);
 
-                if (net_eq(sock_net(sk), net) && inet->num == num       &&
-                    !(inet->daddr && inet->daddr != raddr)              &&
-                    !(inet->rcv_saddr && inet->rcv_saddr != laddr)      &&
+                if (net_eq(sock_net(sk), net) && inet->inet_num == num  &&
+                    !(inet->inet_daddr && inet->inet_daddr != raddr)    &&
+                    !(inet->inet_rcv_saddr && inet->inet_rcv_saddr != laddr) &&
                     !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
                         goto found; /* gotcha */
         }
@@ -292,7 +292,6 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
         /* Charge it to the socket. */
 
         if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
@@ -327,7 +326,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
         int err;
 
         if (length > rt->u.dst.dev->mtu) {
-                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->dport,
+                ip_local_error(sk, EMSGSIZE, rt->rt_dst, inet->inet_dport,
                                rt->u.dst.dev->mtu);
                 return -EMSGSIZE;
         }
@@ -500,10 +499,10 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 err = -EDESTADDRREQ;
                 if (sk->sk_state != TCP_ESTABLISHED)
                         goto out;
-                daddr = inet->daddr;
+                daddr = inet->inet_daddr;
         }
 
-        ipc.addr = inet->saddr;
+        ipc.addr = inet->inet_saddr;
         ipc.opt = NULL;
         ipc.shtx.flags = 0;
         ipc.oif = sk->sk_bound_dev_if;
@@ -645,9 +644,9 @@ static int raw_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr->sin_addr.s_addr && chk_addr_ret != RTN_LOCAL &&
             chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
                 goto out;
-        inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
         if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
-                inet->saddr = 0;  /* Use device */
+                inet->inet_saddr = 0;  /* Use device */
         sk_dst_reset(sk);
         ret = 0;
 out:    return ret;
@@ -692,7 +691,7 @@ static int raw_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (err)
                 goto done;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (sin) {
@@ -717,7 +716,7 @@ static int raw_init(struct sock *sk)
 {
         struct raw_sock *rp = raw_sk(sk);
 
-        if (inet_sk(sk)->num == IPPROTO_ICMP)
+        if (inet_sk(sk)->inet_num == IPPROTO_ICMP)
                 memset(&rp->filter, 0, sizeof(rp->filter));
         return 0;
 }
@@ -754,7 +753,7 @@ static int do_raw_setsockopt(struct sock *sk, int level, int optname,
                           char __user *optval, unsigned int optlen)
 {
         if (optname == ICMP_FILTER) {
-                if (inet_sk(sk)->num != IPPROTO_ICMP)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
                         return -EOPNOTSUPP;
                 else
                         return raw_seticmpfilter(sk, optval, optlen);
@@ -784,7 +783,7 @@ static int do_raw_getsockopt(struct sock *sk, int level, int optname,
                           char __user *optval, int __user *optlen)
 {
         if (optname == ICMP_FILTER) {
-                if (inet_sk(sk)->num != IPPROTO_ICMP)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMP)
                         return -EOPNOTSUPP;
                 else
                         return raw_geticmpfilter(sk, optval, optlen);
@@ -943,10 +942,10 @@ EXPORT_SYMBOL_GPL(raw_seq_stop);
 static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
 {
         struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr,
-               src = inet->rcv_saddr;
+        __be32 dest = inet->inet_daddr,
+               src = inet->inet_rcv_saddr;
         __u16 destp = 0,
-              srcp  = inet->num;
+              srcp  = inet->inet_num;
 
         seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 5b1050a5d874..4284ceef7945 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1628,9 +1628,6 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
         __be32  daddr = iph->daddr;
         unsigned short est_mtu = 0;
 
-        if (ipv4_config.no_pmtu_disc)
-                return 0;
-
         for (k = 0; k < 2; k++) {
                 for (i = 0; i < 2; i++) {
                         unsigned hash = rt_hash(daddr, skeys[i], ikeys[k],
@@ -2855,7 +2852,7 @@ static int rt_fill_info(struct net *net,
         error = rt->u.dst.error;
         expires = rt->u.dst.expires ? rt->u.dst.expires - jiffies : 0;
         if (rt->peer) {
-                id = rt->peer->ip_id_count;
+                id = atomic_read(&rt->peer->ip_id_count) & 0xffff;
                 if (rt->peer->tcp_ts_stamp) {
                         ts = rt->peer->tcp_ts;
                         tsage = get_seconds() - rt->peer->tcp_ts_stamp;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index a6e0e077ac33..3146cc401748 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -276,13 +276,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, 0);
-
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
-
         ret = NULL;
         req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
         if (!req)
@@ -298,12 +291,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
         ireq->ecn_ok            = 0;
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
 
         /* We throwed the options of the initial SYN away, so we hope
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
@@ -333,7 +320,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
          * no easy way to do this.
          */
         {
-                struct flowi fl = { .nl_u = { .ip4_u =
+                struct flowi fl = { .mark = sk->sk_mark,
+                                    .nl_u = { .ip4_u =
                                               { .daddr = ((opt && opt->srr) ?
                                                           opt->faddr :
                                                           ireq->rmt_addr),
@@ -351,6 +339,20 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, 0, &rt->u.dst);
+
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
+
         /* Try to redo what tcp_v4_send_synack did. */
         req->window_clamp = tp->window_clamp ? :dst_metric(&rt->u.dst, RTAX_WINDOW);
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f1813bc71088..524f9760193b 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2042,7 +2042,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         __skb_queue_purge(&sk->sk_async_wait_queue);
 #endif
 
-        inet->dport = 0;
+        inet->inet_dport = 0;
 
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
@@ -2066,7 +2066,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
 
-        WARN_ON(inet->num && !icsk->icsk_bind_hash);
+        WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
@@ -2903,11 +2903,10 @@ void __init tcp_init(void)
                                         (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
-                                        &tcp_hashinfo.ehash_size,
                                         NULL,
+                                        &tcp_hashinfo.ehash_mask,
                                         thash_entries ? 0 : 512 * 1024);
-        tcp_hashinfo.ehash_size = 1 << tcp_hashinfo.ehash_size;
-        for (i = 0; i < tcp_hashinfo.ehash_size; i++) {
+        for (i = 0; i <= tcp_hashinfo.ehash_mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].chain, i);
                 INIT_HLIST_NULLS_HEAD(&tcp_hashinfo.ehash[i].twchain, i);
         }
@@ -2916,7 +2915,7 @@ void __init tcp_init(void)
         tcp_hashinfo.bhash =
                 alloc_large_system_hash("TCP bind",
                                         sizeof(struct inet_bind_hashbucket),
-                                        tcp_hashinfo.ehash_size,
+                                        tcp_hashinfo.ehash_mask + 1,
                                         (totalram_pages >= 128 * 1024) ?
                                         13 : 15,
                                         0,
@@ -2971,8 +2970,8 @@ void __init tcp_init(void)
         sysctl_tcp_rmem[2] = max(87380, max_share);
 
         printk(KERN_INFO "TCP: Hash tables configured "
-               "(established %d bind %d)\n",
-               tcp_hashinfo.ehash_size, tcp_hashinfo.bhash_size);
+               "(established %u bind %u)\n",
+               tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
 
         tcp_register_congestion_control(&tcp_reno);
 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index d86784be7ab3..cc306ac6eb51 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -140,7 +140,7 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb)
                  * "len" is invariant segment length, including TCP header.
                  */
                 len += skb->data - skb_transport_header(skb);
-                if (len >= TCP_MIN_RCVMSS + sizeof(struct tcphdr) ||
+                if (len >= TCP_MSS_DEFAULT + sizeof(struct tcphdr) ||
                     /* If PSH is not set, packet should be
                      * full sized, provided peer TCP is not badly broken.
                      * This observation (if it is correct 8)) allows
@@ -411,7 +411,7 @@ void tcp_initialize_rcv_mss(struct sock *sk)
         unsigned int hint = min_t(unsigned int, tp->advmss, tp->mss_cache);
 
         hint = min(hint, tp->rcv_wnd / 2);
-        hint = min(hint, TCP_MIN_RCVMSS);
+        hint = min(hint, TCP_MSS_DEFAULT);
         hint = max(hint, TCP_MIN_MSS);
 
         inet_csk(sk)->icsk_ack.rcv_mss = hint;
@@ -2300,7 +2300,7 @@ static inline int tcp_fackets_out(struct tcp_sock *tp)
  * they differ. Since neither occurs due to loss, TCP should really
  * ignore them.
  */
-static inline int tcp_dupack_heurestics(struct tcp_sock *tp)
+static inline int tcp_dupack_heuristics(struct tcp_sock *tp)
 {
         return tcp_is_fack(tp) ? tp->fackets_out : tp->sacked_out + 1;
 }
@@ -2425,7 +2425,7 @@ static int tcp_time_to_recover(struct sock *sk)
                 return 1;
 
         /* Not-A-Trick#2 : Classic rule... */
-        if (tcp_dupack_heurestics(tp) > tp->reordering)
+        if (tcp_dupack_heuristics(tp) > tp->reordering)
                 return 1;
 
         /* Trick#3 : when we use RFC2988 timer restart, fast
@@ -3698,7 +3698,7 @@ old_ack:
  * the fast version below fails.
  */
 void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
-                       int estab)
+                       int estab,  struct dst_entry *dst)
 {
         unsigned char *ptr;
         struct tcphdr *th = tcp_hdr(skb);
@@ -3737,7 +3737,8 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_WINDOW:
                                 if (opsize == TCPOLEN_WINDOW && th->syn &&
-                                    !estab && sysctl_tcp_window_scaling) {
+                                    !estab && sysctl_tcp_window_scaling &&
+                                    !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)) {
                                         __u8 snd_wscale = *(__u8 *)ptr;
                                         opt_rx->wscale_ok = 1;
                                         if (snd_wscale > 14) {
@@ -3753,7 +3754,8 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                         case TCPOPT_TIMESTAMP:
                                 if ((opsize == TCPOLEN_TIMESTAMP) &&
                                     ((estab && opt_rx->tstamp_ok) ||
-                                     (!estab && sysctl_tcp_timestamps))) {
+                                     (!estab && sysctl_tcp_timestamps &&
+                                      !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP)))) {
                                         opt_rx->saw_tstamp = 1;
                                         opt_rx->rcv_tsval = get_unaligned_be32(ptr);
                                         opt_rx->rcv_tsecr = get_unaligned_be32(ptr + 4);
@@ -3761,7 +3763,8 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_SACK_PERM:
                                 if (opsize == TCPOLEN_SACK_PERM && th->syn &&
-                                    !estab && sysctl_tcp_sack) {
+                                    !estab && sysctl_tcp_sack &&
+                                    !dst_feature(dst, RTAX_FEATURE_NO_SACK)) {
                                         opt_rx->sack_ok = 1;
                                         tcp_sack_reset(opt_rx);
                                 }
@@ -3820,7 +3823,7 @@ static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
                 if (tcp_parse_aligned_timestamp(tp, th))
                         return 1;
         }
-        tcp_parse_options(skb, &tp->rx_opt, 1);
+        tcp_parse_options(skb, &tp->rx_opt, 1, NULL);
         return 1;
 }
 
@@ -4075,8 +4078,10 @@ static inline int tcp_sack_extend(struct tcp_sack_block *sp, u32 seq,
 static void tcp_dsack_set(struct sock *sk, u32 seq, u32 end_seq)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        struct dst_entry *dst = __sk_dst_get(sk);
 
-        if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
+        if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
+            !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
                 int mib_idx;
 
                 if (before(seq, tp->rcv_nxt))
@@ -4105,13 +4110,15 @@ static void tcp_dsack_extend(struct sock *sk, u32 seq, u32 end_seq)
 static void tcp_send_dupack(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        struct dst_entry *dst = __sk_dst_get(sk);
 
         if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
             before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_DELAYEDACKLOST);
                 tcp_enter_quickack_mode(sk);
 
-                if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
+                if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
+                    !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
                         u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
                         if (after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))
@@ -5364,8 +5371,9 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
         int saved_clamp = tp->rx_opt.mss_clamp;
+        struct dst_entry *dst = __sk_dst_get(sk);
 
-        tcp_parse_options(skb, &tp->rx_opt, 0);
+        tcp_parse_options(skb, &tp->rx_opt, 0, dst);
 
         if (th->ack) {
                 /* rfc793:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 7cda24b53f61..df18ce04f41e 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -165,10 +165,10 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 nexthop = inet->opt->faddr;
         }
 
-        tmp = ip_route_connect(&rt, nexthop, inet->saddr,
+        tmp = ip_route_connect(&rt, nexthop, inet->inet_saddr,
                                RT_CONN_FLAGS(sk), sk->sk_bound_dev_if,
                                IPPROTO_TCP,
-                               inet->sport, usin->sin_port, sk, 1);
+                               inet->inet_sport, usin->sin_port, sk, 1);
         if (tmp < 0) {
                 if (tmp == -ENETUNREACH)
                         IP_INC_STATS_BH(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
@@ -183,11 +183,11 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (!inet->opt || !inet->opt->srr)
                 daddr = rt->rt_dst;
 
-        if (!inet->saddr)
-                inet->saddr = rt->rt_src;
-        inet->rcv_saddr = inet->saddr;
+        if (!inet->inet_saddr)
+                inet->inet_saddr = rt->rt_src;
+        inet->inet_rcv_saddr = inet->inet_saddr;
 
-        if (tp->rx_opt.ts_recent_stamp && inet->daddr != daddr) {
+        if (tp->rx_opt.ts_recent_stamp && inet->inet_daddr != daddr) {
                 /* Reset inherited state */
                 tp->rx_opt.ts_recent       = 0;
                 tp->rx_opt.ts_recent_stamp = 0;
@@ -204,20 +204,20 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                  * when trying new connection.
                  */
                 if (peer != NULL &&
-                    peer->tcp_ts_stamp + TCP_PAWS_MSL >= get_seconds()) {
+                    (u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
                         tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
                         tp->rx_opt.ts_recent = peer->tcp_ts;
                 }
         }
 
-        inet->dport = usin->sin_port;
-        inet->daddr = daddr;
+        inet->inet_dport = usin->sin_port;
+        inet->inet_daddr = daddr;
 
         inet_csk(sk)->icsk_ext_hdr_len = 0;
         if (inet->opt)
                 inet_csk(sk)->icsk_ext_hdr_len = inet->opt->optlen;
 
-        tp->rx_opt.mss_clamp = 536;
+        tp->rx_opt.mss_clamp = TCP_MSS_DEFAULT;
 
         /* Socket identity is still unknown (sport may be zero).
          * However we set state to SYN-SENT and not releasing socket
@@ -230,7 +230,7 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 goto failure;
 
         err = ip_route_newports(&rt, IPPROTO_TCP,
-                                inet->sport, inet->dport, sk);
+                                inet->inet_sport, inet->inet_dport, sk);
         if (err)
                 goto failure;
 
@@ -239,12 +239,12 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         sk_setup_caps(sk, &rt->u.dst);
 
         if (!tp->write_seq)
-                tp->write_seq = secure_tcp_sequence_number(inet->saddr,
-                                                           inet->daddr,
-                                                           inet->sport,
+                tp->write_seq = secure_tcp_sequence_number(inet->inet_saddr,
+                                                           inet->inet_daddr,
+                                                           inet->inet_sport,
                                                            usin->sin_port);
 
-        inet->id = tp->write_seq ^ jiffies;
+        inet->inet_id = tp->write_seq ^ jiffies;
 
         err = tcp_connect(sk);
         rt = NULL;
@@ -261,7 +261,7 @@ failure:
         tcp_set_state(sk, TCP_CLOSE);
         ip_rt_put(rt);
         sk->sk_route_caps = 0;
-        inet->dport = 0;
+        inet->inet_dport = 0;
         return err;
 }
 
@@ -520,12 +520,13 @@ void tcp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb)
         struct tcphdr *th = tcp_hdr(skb);
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                th->check = ~tcp_v4_check(len, inet->saddr,
-                                          inet->daddr, 0);
+                th->check = ~tcp_v4_check(len, inet->inet_saddr,
+                                          inet->inet_daddr, 0);
                 skb->csum_start = skb_transport_header(skb) - skb->head;
                 skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
-                th->check = tcp_v4_check(len, inet->saddr, inet->daddr,
+                th->check = tcp_v4_check(len, inet->inet_saddr,
+                                         inet->inet_daddr,
                                          csum_partial(th,
                                                       th->doff << 2,
                                                       skb->csum));
@@ -848,7 +849,7 @@ static struct tcp_md5sig_key *
 struct tcp_md5sig_key *tcp_v4_md5_lookup(struct sock *sk,
                                          struct sock *addr_sk)
 {
-        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->daddr);
+        return tcp_v4_md5_do_lookup(sk, inet_sk(addr_sk)->inet_daddr);
 }
 
 EXPORT_SYMBOL(tcp_v4_md5_lookup);
@@ -923,7 +924,7 @@ EXPORT_SYMBOL(tcp_v4_md5_do_add);
 static int tcp_v4_md5_add_func(struct sock *sk, struct sock *addr_sk,
                                u8 *newkey, u8 newkeylen)
 {
-        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->daddr,
+        return tcp_v4_md5_do_add(sk, inet_sk(addr_sk)->inet_daddr,
                                  newkey, newkeylen);
 }
 
@@ -1089,8 +1090,8 @@ int tcp_v4_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
         __be32 saddr, daddr;
 
         if (sk) {
-                saddr = inet_sk(sk)->saddr;
-                daddr = inet_sk(sk)->daddr;
+                saddr = inet_sk(sk)->inet_saddr;
+                daddr = inet_sk(sk)->inet_daddr;
         } else if (req) {
                 saddr = inet_rsk(req)->loc_addr;
                 daddr = inet_rsk(req)->rmt_addr;
@@ -1256,11 +1257,21 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv4_ops;
 #endif
 
+        ireq = inet_rsk(req);
+        ireq->loc_addr = daddr;
+        ireq->rmt_addr = saddr;
+        ireq->no_srccheck = inet_sk(sk)->transparent;
+        ireq->opt = tcp_v4_save_options(sk, skb);
+
+        dst = inet_csk_route_req(sk, req);
+        if(!dst)
+                goto drop_and_free;
+
         tcp_clear_options(&tmp_opt);
-        tmp_opt.mss_clamp = 536;
+        tmp_opt.mss_clamp = TCP_MSS_DEFAULT;
         tmp_opt.user_mss  = tcp_sk(sk)->rx_opt.user_mss;
 
-        tcp_parse_options(skb, &tmp_opt, 0);
+        tcp_parse_options(skb, &tmp_opt, 0, dst);
 
         if (want_cookie && !tmp_opt.saw_tstamp)
                 tcp_clear_options(&tmp_opt);
@@ -1269,14 +1280,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 
         tcp_openreq_init(req, &tmp_opt, skb);
 
-        ireq = inet_rsk(req);
-        ireq->loc_addr = daddr;
-        ireq->rmt_addr = saddr;
-        ireq->no_srccheck = inet_sk(sk)->transparent;
-        ireq->opt = tcp_v4_save_options(sk, skb);
-
         if (security_inet_conn_request(sk, skb, req))
-                goto drop_and_free;
+                goto drop_and_release;
 
         if (!want_cookie)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
@@ -1301,10 +1306,9 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                  */
                 if (tmp_opt.saw_tstamp &&
                     tcp_death_row.sysctl_tw_recycle &&
-                    (dst = inet_csk_route_req(sk, req)) != NULL &&
                     (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
                     peer->v4daddr == saddr) {
-                        if (get_seconds() < peer->tcp_ts_stamp + TCP_PAWS_MSL &&
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
                             (s32)(peer->tcp_ts - req->ts_recent) >
                                                         TCP_PAWS_WINDOW) {
                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
@@ -1380,9 +1384,9 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newtp                 = tcp_sk(newsk);
         newinet               = inet_sk(newsk);
         ireq                  = inet_rsk(req);
-        newinet->daddr        = ireq->rmt_addr;
-        newinet->rcv_saddr    = ireq->loc_addr;
-        newinet->saddr        = ireq->loc_addr;
+        newinet->inet_daddr   = ireq->rmt_addr;
+        newinet->inet_rcv_saddr = ireq->loc_addr;
+        newinet->inet_saddr           = ireq->loc_addr;
         newinet->opt          = ireq->opt;
         ireq->opt             = NULL;
         newinet->mc_index     = inet_iif(skb);
@@ -1390,7 +1394,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
         if (newinet->opt)
                 inet_csk(newsk)->icsk_ext_hdr_len = newinet->opt->optlen;
-        newinet->id = newtp->write_seq ^ jiffies;
+        newinet->inet_id = newtp->write_seq ^ jiffies;
 
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
@@ -1403,7 +1407,8 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Copy over the MD5 key from the original socket */
-        if ((key = tcp_v4_md5_do_lookup(sk, newinet->daddr)) != NULL) {
+        key = tcp_v4_md5_do_lookup(sk, newinet->inet_daddr);
+        if (key != NULL) {
                 /*
                  * We're using one, so create a matching key
                  * on the newsk structure. If we fail to get
@@ -1412,7 +1417,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  */
                 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
                 if (newkey != NULL)
-                        tcp_v4_md5_do_add(newsk, newinet->daddr,
+                        tcp_v4_md5_do_add(newsk, newinet->inet_daddr,
                                           newkey, key->keylen);
                 newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
@@ -1711,8 +1716,8 @@ int tcp_v4_remember_stamp(struct sock *sk)
         struct inet_peer *peer = NULL;
         int release_it = 0;
 
-        if (!rt || rt->rt_dst != inet->daddr) {
-                peer = inet_getpeer(inet->daddr, 1);
+        if (!rt || rt->rt_dst != inet->inet_daddr) {
+                peer = inet_getpeer(inet->inet_daddr, 1);
                 release_it = 1;
         } else {
                 if (!rt->peer)
@@ -1722,9 +1727,9 @@ int tcp_v4_remember_stamp(struct sock *sk)
 
         if (peer) {
                 if ((s32)(peer->tcp_ts - tp->rx_opt.ts_recent) <= 0 ||
-                    (peer->tcp_ts_stamp + TCP_PAWS_MSL < get_seconds() &&
-                     peer->tcp_ts_stamp <= tp->rx_opt.ts_recent_stamp)) {
-                        peer->tcp_ts_stamp = tp->rx_opt.ts_recent_stamp;
+                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
+                     peer->tcp_ts_stamp <= (u32)tp->rx_opt.ts_recent_stamp)) {
+                        peer->tcp_ts_stamp = (u32)tp->rx_opt.ts_recent_stamp;
                         peer->tcp_ts = tp->rx_opt.ts_recent;
                 }
                 if (release_it)
@@ -1743,9 +1748,9 @@ int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
                 const struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
 
                 if ((s32)(peer->tcp_ts - tcptw->tw_ts_recent) <= 0 ||
-                    (peer->tcp_ts_stamp + TCP_PAWS_MSL < get_seconds() &&
-                     peer->tcp_ts_stamp <= tcptw->tw_ts_recent_stamp)) {
-                        peer->tcp_ts_stamp = tcptw->tw_ts_recent_stamp;
+                    ((u32)get_seconds() - peer->tcp_ts_stamp > TCP_PAWS_MSL &&
+                     peer->tcp_ts_stamp <= (u32)tcptw->tw_ts_recent_stamp)) {
+                        peer->tcp_ts_stamp = (u32)tcptw->tw_ts_recent_stamp;
                         peer->tcp_ts       = tcptw->tw_ts_recent;
                 }
                 inet_putpeer(peer);
@@ -1810,7 +1815,7 @@ static int tcp_v4_init_sock(struct sock *sk)
          */
         tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
         tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache = 536;
+        tp->mss_cache = TCP_MSS_DEFAULT;
 
         tp->reordering = sysctl_tcp_reordering;
         icsk->icsk_ca_ops = &tcp_init_congestion_ops;
@@ -2000,7 +2005,7 @@ static void *established_get_first(struct seq_file *seq)
         struct net *net = seq_file_net(seq);
         void *rc = NULL;
 
-        for (st->bucket = 0; st->bucket < tcp_hashinfo.ehash_size; ++st->bucket) {
+        for (st->bucket = 0; st->bucket <= tcp_hashinfo.ehash_mask; ++st->bucket) {
                 struct sock *sk;
                 struct hlist_nulls_node *node;
                 struct inet_timewait_sock *tw;
@@ -2061,10 +2066,10 @@ get_tw:
                 st->state = TCP_SEQ_STATE_ESTABLISHED;
 
                 /* Look for next non empty bucket */
-                while (++st->bucket < tcp_hashinfo.ehash_size &&
+                while (++st->bucket <= tcp_hashinfo.ehash_mask &&
                                 empty_bucket(st))
                         ;
-                if (st->bucket >= tcp_hashinfo.ehash_size)
+                if (st->bucket > tcp_hashinfo.ehash_mask)
                         return NULL;
 
                 spin_lock_bh(inet_ehash_lockp(&tcp_hashinfo, st->bucket));
@@ -2225,7 +2230,7 @@ static void get_openreq4(struct sock *sk, struct request_sock *req,
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p%n",
                 i,
                 ireq->loc_addr,
-                ntohs(inet_sk(sk)->sport),
+                ntohs(inet_sk(sk)->inet_sport),
                 ireq->rmt_addr,
                 ntohs(ireq->rmt_port),
                 TCP_SYN_RECV,
@@ -2248,10 +2253,10 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len)
         struct tcp_sock *tp = tcp_sk(sk);
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct inet_sock *inet = inet_sk(sk);
-        __be32 dest = inet->daddr;
-        __be32 src = inet->rcv_saddr;
-        __u16 destp = ntohs(inet->dport);
-        __u16 srcp = ntohs(inet->sport);
+        __be32 dest = inet->inet_daddr;
+        __be32 src = inet->inet_rcv_saddr;
+        __u16 destp = ntohs(inet->inet_dport);
+        __u16 srcp = ntohs(inet->inet_sport);
 
         if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
                 timer_active    = 1;
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 4c03598ed924..4be22280e6b3 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -100,9 +100,9 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
         struct tcp_options_received tmp_opt;
         int paws_reject = 0;
 
-        tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
-                tcp_parse_options(skb, &tmp_opt, 0);
+                tmp_opt.tstamp_ok = 1;
+                tcp_parse_options(skb, &tmp_opt, 1, NULL);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
@@ -476,7 +476,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 if (newtp->af_specific->md5_lookup(sk, newsk))
                         newtp->tcp_header_len += TCPOLEN_MD5SIG_ALIGNED;
 #endif
-                if (skb->len >= TCP_MIN_RCVMSS+newtp->tcp_header_len)
+                if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
                         newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
                 newtp->rx_opt.mss_clamp = req->mss;
                 TCP_ECN_openreq_child(newtp, req);
@@ -501,9 +501,9 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         struct tcp_options_received tmp_opt;
         struct sock *child;
 
-        tmp_opt.saw_tstamp = 0;
-        if (th->doff > (sizeof(struct tcphdr)>>2)) {
-                tcp_parse_options(skb, &tmp_opt, 0);
+        if ((th->doff > (sizeof(struct tcphdr)>>2)) && (req->ts_recent)) {
+                tmp_opt.tstamp_ok = 1;
+                tcp_parse_options(skb, &tmp_opt, 1, NULL);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent = req->ts_recent;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index fcd278a7080e..616c686ca253 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -464,6 +464,7 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_md5sig_key **md5) {
         struct tcp_sock *tp = tcp_sk(sk);
         unsigned size = 0;
+        struct dst_entry *dst = __sk_dst_get(sk);
 
 #ifdef CONFIG_TCP_MD5SIG
         *md5 = tp->af_specific->md5_lookup(sk, sk);
@@ -487,18 +488,22 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         opts->mss = tcp_advertise_mss(sk);
         size += TCPOLEN_MSS_ALIGNED;
 
-        if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
+        if (likely(sysctl_tcp_timestamps &&
+                   !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) &&
+                   *md5 == NULL)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = tp->rx_opt.ts_recent;
                 size += TCPOLEN_TSTAMP_ALIGNED;
         }
-        if (likely(sysctl_tcp_window_scaling)) {
+        if (likely(sysctl_tcp_window_scaling &&
+                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE))) {
                 opts->ws = tp->rx_opt.rcv_wscale;
                 opts->options |= OPTION_WSCALE;
                 size += TCPOLEN_WSCALE_ALIGNED;
         }
-        if (likely(sysctl_tcp_sack)) {
+        if (likely(sysctl_tcp_sack &&
+                   !dst_feature(dst, RTAX_FEATURE_NO_SACK))) {
                 opts->options |= OPTION_SACK_ADVERTISE;
                 if (unlikely(!(OPTION_TS & opts->options)))
                         size += TCPOLEN_SACKPERM_ALIGNED;
@@ -661,8 +666,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
         /* Build TCP header and checksum it. */
         th = tcp_hdr(skb);
-        th->source              = inet->sport;
-        th->dest                = inet->dport;
+        th->source              = inet->inet_sport;
+        th->dest                = inet->inet_dport;
         th->seq                 = htonl(tcb->seq);
         th->ack_seq             = htonl(tp->rcv_nxt);
         *(((__be16 *)th) + 6)   = htons(((tcp_header_size >> 2) << 12) |
@@ -2315,7 +2320,9 @@ static void tcp_connect_init(struct sock *sk)
          * See tcp_input.c:tcp_rcv_state_process case TCP_SYN_SENT.
          */
         tp->tcp_header_len = sizeof(struct tcphdr) +
-                (sysctl_tcp_timestamps ? TCPOLEN_TSTAMP_ALIGNED : 0);
+                (sysctl_tcp_timestamps &&
+                (!dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) ?
+                  TCPOLEN_TSTAMP_ALIGNED : 0));
 
 #ifdef CONFIG_TCP_MD5SIG
         if (tp->af_specific->md5_lookup(sk, sk) != NULL)
@@ -2341,7 +2348,8 @@ static void tcp_connect_init(struct sock *sk)
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
                                   &tp->rcv_wnd,
                                   &tp->window_clamp,
-                                  sysctl_tcp_window_scaling,
+                                  (sysctl_tcp_window_scaling &&
+                                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)),
                                   &rcv_wscale);
 
         tp->rx_opt.rcv_wscale = rcv_wscale;
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 59f5b5e7c566..7a3cc2ffad84 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -94,7 +94,8 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
         const struct inet_sock *inet = inet_sk(sk);
 
         /* Only update if port matches */
-        if ((port == 0 || ntohs(inet->dport) == port || ntohs(inet->sport) == port)
+        if ((port == 0 || ntohs(inet->inet_dport) == port ||
+             ntohs(inet->inet_sport) == port)
             && (full || tp->snd_cwnd != tcp_probe.lastcwnd)) {
 
                 spin_lock(&tcp_probe.lock);
@@ -103,10 +104,10 @@ static int jtcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         struct tcp_log *p = tcp_probe.log + tcp_probe.head;
 
                         p->tstamp = ktime_get();
-                        p->saddr = inet->saddr;
-                        p->sport = inet->sport;
-                        p->daddr = inet->daddr;
-                        p->dport = inet->dport;
+                        p->saddr = inet->inet_saddr;
+                        p->sport = inet->inet_sport;
+                        p->daddr = inet->inet_daddr;
+                        p->dport = inet->inet_dport;
                         p->length = skb->len;
                         p->snd_nxt = tp->snd_nxt;
                         p->snd_una = tp->snd_una;
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index cdb2ca7684d4..8353a538cd4c 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -141,14 +141,14 @@ static int tcp_write_timeout(struct sock *sk)
 
         if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 if (icsk->icsk_retransmits)
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
         } else {
                 if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
                         /* Black hole detection */
                         tcp_mtu_probing(icsk, sk);
 
-                        dst_negative_advice(&sk->sk_dst_cache);
+                        dst_negative_advice(&sk->sk_dst_cache, sk);
                 }
 
                 retry_until = sysctl_tcp_retries2;
@@ -303,15 +303,15 @@ void tcp_retransmit_timer(struct sock *sk)
                 struct inet_sock *inet = inet_sk(sk);
                 if (sk->sk_family == AF_INET) {
                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI4:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &inet->daddr, ntohs(inet->dport),
-                               inet->num, tp->snd_una, tp->snd_nxt);
+                               &inet->inet_daddr, ntohs(inet->inet_dport),
+                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                 }
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (sk->sk_family == AF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
                         LIMIT_NETDEBUG(KERN_DEBUG "TCP: Peer %pI6:%u/%u unexpectedly shrunk window %u:%u (repaired)\n",
-                               &np->daddr, ntohs(inet->dport),
-                               inet->num, tp->snd_una, tp->snd_nxt);
+                               &np->daddr, ntohs(inet->inet_dport),
+                               inet->inet_num, tp->snd_una, tp->snd_nxt);
                 }
 #endif
 #endif
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 0fa9f70e4b19..1eaf57567ebf 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -106,7 +106,7 @@
 #include <net/xfrm.h>
 #include "udp_impl.h"
 
-struct udp_table udp_table;
+struct udp_table udp_table __read_mostly;
 EXPORT_SYMBOL(udp_table);
 
 int sysctl_udp_mem[3] __read_mostly;
@@ -121,14 +121,16 @@ EXPORT_SYMBOL(sysctl_udp_wmem_min);
 atomic_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
 
-#define PORTS_PER_CHAIN (65536 / UDP_HTABLE_SIZE)
+#define MAX_UDP_PORTS 65536
+#define PORTS_PER_CHAIN (MAX_UDP_PORTS / UDP_HTABLE_SIZE_MIN)
 
 static int udp_lib_lport_inuse(struct net *net, __u16 num,
                                const struct udp_hslot *hslot,
                                unsigned long *bitmap,
                                struct sock *sk,
                                int (*saddr_comp)(const struct sock *sk1,
-                                                 const struct sock *sk2))
+                                                 const struct sock *sk2),
+                               unsigned int log)
 {
         struct sock *sk2;
         struct hlist_nulls_node *node;
@@ -136,13 +138,13 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
         sk_nulls_for_each(sk2, node, &hslot->head)
                 if (net_eq(sock_net(sk2), net)                  &&
                     sk2 != sk                                   &&
-                    (bitmap || sk2->sk_hash == num)             &&
+                    (bitmap || udp_sk(sk2)->udp_port_hash == num) &&
                     (!sk2->sk_reuse || !sk->sk_reuse)           &&
                     (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
                         || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
                     (*saddr_comp)(sk, sk2)) {
                         if (bitmap)
-                                __set_bit(sk2->sk_hash / UDP_HTABLE_SIZE,
+                                __set_bit(udp_sk(sk2)->udp_port_hash >> log,
                                           bitmap);
                         else
                                 return 1;
@@ -150,18 +152,51 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
         return 0;
 }
 
+/*
+ * Note: we still hold spinlock of primary hash chain, so no other writer
+ * can insert/delete a socket with local_port == num
+ */
+static int udp_lib_lport_inuse2(struct net *net, __u16 num,
+                               struct udp_hslot *hslot2,
+                               struct sock *sk,
+                               int (*saddr_comp)(const struct sock *sk1,
+                                                 const struct sock *sk2))
+{
+        struct sock *sk2;
+        struct hlist_nulls_node *node;
+        int res = 0;
+
+        spin_lock(&hslot2->lock);
+        udp_portaddr_for_each_entry(sk2, node, &hslot2->head)
+                if (net_eq(sock_net(sk2), net)                  &&
+                    sk2 != sk                                   &&
+                    (udp_sk(sk2)->udp_port_hash == num)         &&
+                    (!sk2->sk_reuse || !sk->sk_reuse)           &&
+                    (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
+                        || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
+                    (*saddr_comp)(sk, sk2)) {
+                        res = 1;
+                        break;
+                }
+        spin_unlock(&hslot2->lock);
+        return res;
+}
+
 /**
  *  udp_lib_get_port  -  UDP/-Lite port lookup for IPv4 and IPv6
  *
  *  @sk:          socket struct in question
  *  @snum:        port number to look up
  *  @saddr_comp:  AF-dependent comparison of bound local IP addresses
+ *  @hash2_nulladdr: AF-dependant hash value in secondary hash chains,
+ *                   with NULL address
  */
 int udp_lib_get_port(struct sock *sk, unsigned short snum,
                        int (*saddr_comp)(const struct sock *sk1,
-                                         const struct sock *sk2))
+                                         const struct sock *sk2),
+                     unsigned int hash2_nulladdr)
 {
-        struct udp_hslot *hslot;
+        struct udp_hslot *hslot, *hslot2;
         struct udp_table *udptable = sk->sk_prot->h.udp_table;
         int    error = 1;
         struct net *net = sock_net(sk);
@@ -180,13 +215,15 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 /*
                  * force rand to be an odd multiple of UDP_HTABLE_SIZE
                  */
-                rand = (rand | 1) * UDP_HTABLE_SIZE;
-                for (last = first + UDP_HTABLE_SIZE; first != last; first++) {
-                        hslot = &udptable->hash[udp_hashfn(net, first)];
+                rand = (rand | 1) * (udptable->mask + 1);
+                for (last = first + udptable->mask + 1;
+                     first != last;
+                     first++) {
+                        hslot = udp_hashslot(udptable, net, first);
                         bitmap_zero(bitmap, PORTS_PER_CHAIN);
                         spin_lock_bh(&hslot->lock);
                         udp_lib_lport_inuse(net, snum, hslot, bitmap, sk,
-                                            saddr_comp);
+                                            saddr_comp, udptable->log);
 
                         snum = first;
                         /*
@@ -196,7 +233,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                          */
                         do {
                                 if (low <= snum && snum <= high &&
-                                    !test_bit(snum / UDP_HTABLE_SIZE, bitmap))
+                                    !test_bit(snum >> udptable->log, bitmap))
                                         goto found;
                                 snum += rand;
                         } while (snum != first);
@@ -204,17 +241,51 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 }
                 goto fail;
         } else {
-                hslot = &udptable->hash[udp_hashfn(net, snum)];
+                hslot = udp_hashslot(udptable, net, snum);
                 spin_lock_bh(&hslot->lock);
-                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk, saddr_comp))
+                if (hslot->count > 10) {
+                        int exist;
+                        unsigned int slot2 = udp_sk(sk)->udp_portaddr_hash ^ snum;
+
+                        slot2          &= udptable->mask;
+                        hash2_nulladdr &= udptable->mask;
+
+                        hslot2 = udp_hashslot2(udptable, slot2);
+                        if (hslot->count < hslot2->count)
+                                goto scan_primary_hash;
+
+                        exist = udp_lib_lport_inuse2(net, snum, hslot2,
+                                                     sk, saddr_comp);
+                        if (!exist && (hash2_nulladdr != slot2)) {
+                                hslot2 = udp_hashslot2(udptable, hash2_nulladdr);
+                                exist = udp_lib_lport_inuse2(net, snum, hslot2,
+                                                             sk, saddr_comp);
+                        }
+                        if (exist)
+                                goto fail_unlock;
+                        else
+                                goto found;
+                }
+scan_primary_hash:
+                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk,
+                                        saddr_comp, 0))
                         goto fail_unlock;
         }
 found:
-        inet_sk(sk)->num = snum;
-        sk->sk_hash = snum;
+        inet_sk(sk)->inet_num = snum;
+        udp_sk(sk)->udp_port_hash = snum;
+        udp_sk(sk)->udp_portaddr_hash ^= snum;
         if (sk_unhashed(sk)) {
                 sk_nulls_add_node_rcu(sk, &hslot->head);
+                hslot->count++;
                 sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+
+                hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
+                spin_lock(&hslot2->lock);
+                hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
+                                         &hslot2->head);
+                hslot2->count++;
+                spin_unlock(&hslot2->lock);
         }
         error = 0;
 fail_unlock:
@@ -229,13 +300,26 @@ static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
         struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
 
         return  (!ipv6_only_sock(sk2)  &&
-                 (!inet1->rcv_saddr || !inet2->rcv_saddr ||
-                   inet1->rcv_saddr == inet2->rcv_saddr));
+                 (!inet1->inet_rcv_saddr || !inet2->inet_rcv_saddr ||
+                   inet1->inet_rcv_saddr == inet2->inet_rcv_saddr));
+}
+
+static unsigned int udp4_portaddr_hash(struct net *net, __be32 saddr,
+                                       unsigned int port)
+{
+        return jhash_1word(saddr, net_hash_mix(net)) ^ port;
 }
 
 int udp_v4_get_port(struct sock *sk, unsigned short snum)
 {
-        return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal);
+        unsigned int hash2_nulladdr =
+                udp4_portaddr_hash(sock_net(sk), INADDR_ANY, snum);
+        unsigned int hash2_partial =
+                udp4_portaddr_hash(sock_net(sk), inet_sk(sk)->inet_rcv_saddr, 0);
+
+        /* precompute partial secondary hash */
+        udp_sk(sk)->udp_portaddr_hash = hash2_partial;
+        return udp_lib_get_port(sk, snum, ipv4_rcv_saddr_equal, hash2_nulladdr);
 }
 
 static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
@@ -244,23 +328,23 @@ static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
 {
         int score = -1;
 
-        if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
+        if (net_eq(sock_net(sk), net) && udp_sk(sk)->udp_port_hash == hnum &&
                         !ipv6_only_sock(sk)) {
                 struct inet_sock *inet = inet_sk(sk);
 
                 score = (sk->sk_family == PF_INET ? 1 : 0);
-                if (inet->rcv_saddr) {
-                        if (inet->rcv_saddr != daddr)
+                if (inet->inet_rcv_saddr) {
+                        if (inet->inet_rcv_saddr != daddr)
                                 return -1;
                         score += 2;
                 }
-                if (inet->daddr) {
-                        if (inet->daddr != saddr)
+                if (inet->inet_daddr) {
+                        if (inet->inet_daddr != saddr)
                                 return -1;
                         score += 2;
                 }
-                if (inet->dport) {
-                        if (inet->dport != sport)
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
                                 return -1;
                         score += 2;
                 }
@@ -273,6 +357,89 @@ static inline int compute_score(struct sock *sk, struct net *net, __be32 saddr,
         return score;
 }
 
+/*
+ * In this second variant, we check (daddr, dport) matches (inet_rcv_sadd, inet_num)
+ */
+#define SCORE2_MAX (1 + 2 + 2 + 2)
+static inline int compute_score2(struct sock *sk, struct net *net,
+                                 __be32 saddr, __be16 sport,
+                                 __be32 daddr, unsigned int hnum, int dif)
+{
+        int score = -1;
+
+        if (net_eq(sock_net(sk), net) && !ipv6_only_sock(sk)) {
+                struct inet_sock *inet = inet_sk(sk);
+
+                if (inet->inet_rcv_saddr != daddr)
+                        return -1;
+                if (inet->inet_num != hnum)
+                        return -1;
+
+                score = (sk->sk_family == PF_INET ? 1 : 0);
+                if (inet->inet_daddr) {
+                        if (inet->inet_daddr != saddr)
+                                return -1;
+                        score += 2;
+                }
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
+                                return -1;
+                        score += 2;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
+                                return -1;
+                        score += 2;
+                }
+        }
+        return score;
+}
+
+
+/* called with read_rcu_lock() */
+static struct sock *udp4_lib_lookup2(struct net *net,
+                __be32 saddr, __be16 sport,
+                __be32 daddr, unsigned int hnum, int dif,
+                struct udp_hslot *hslot2, unsigned int slot2)
+{
+        struct sock *sk, *result;
+        struct hlist_nulls_node *node;
+        int score, badness;
+
+begin:
+        result = NULL;
+        badness = -1;
+        udp_portaddr_for_each_entry_rcu(sk, node, &hslot2->head) {
+                score = compute_score2(sk, net, saddr, sport,
+                                      daddr, hnum, dif);
+                if (score > badness) {
+                        result = sk;
+                        badness = score;
+                        if (score == SCORE2_MAX)
+                                goto exact_match;
+                }
+        }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != slot2)
+                goto begin;
+
+        if (result) {
+exact_match:
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score2(result, net, saddr, sport,
+                                  daddr, hnum, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
+                }
+        }
+        return result;
+}
+
 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
  * harder than this. -DaveM
  */
@@ -283,11 +450,35 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
         struct sock *sk, *result;
         struct hlist_nulls_node *node;
         unsigned short hnum = ntohs(dport);
-        unsigned int hash = udp_hashfn(net, hnum);
-        struct udp_hslot *hslot = &udptable->hash[hash];
+        unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
+        struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
         int score, badness;
 
         rcu_read_lock();
+        if (hslot->count > 10) {
+                hash2 = udp4_portaddr_hash(net, daddr, hnum);
+                slot2 = hash2 & udptable->mask;
+                hslot2 = &udptable->hash2[slot2];
+                if (hslot->count < hslot2->count)
+                        goto begin;
+
+                result = udp4_lib_lookup2(net, saddr, sport,
+                                          daddr, hnum, dif,
+                                          hslot2, slot2);
+                if (!result) {
+                        hash2 = udp4_portaddr_hash(net, INADDR_ANY, hnum);
+                        slot2 = hash2 & udptable->mask;
+                        hslot2 = &udptable->hash2[slot2];
+                        if (hslot->count < hslot2->count)
+                                goto begin;
+
+                        result = udp4_lib_lookup2(net, INADDR_ANY, sport,
+                                                  daddr, hnum, dif,
+                                                  hslot2, slot2);
+                }
+                rcu_read_unlock();
+                return result;
+        }
 begin:
         result = NULL;
         badness = -1;
@@ -304,7 +495,7 @@ begin:
          * not the expected one, we must restart lookup.
          * We probably met an item that was moved to another chain.
          */
-        if (get_nulls_value(node) != hash)
+        if (get_nulls_value(node) != slot)
                 goto begin;
 
         if (result) {
@@ -355,10 +546,11 @@ static inline struct sock *udp_v4_mcast_next(struct net *net, struct sock *sk,
                 struct inet_sock *inet = inet_sk(s);
 
                 if (!net_eq(sock_net(s), net)                           ||
-                    s->sk_hash != hnum                                  ||
-                    (inet->daddr && inet->daddr != rmt_addr)            ||
-                    (inet->dport != rmt_port && inet->dport)            ||
-                    (inet->rcv_saddr && inet->rcv_saddr != loc_addr)    ||
+                    udp_sk(s)->udp_port_hash != hnum                    ||
+                    (inet->inet_daddr && inet->inet_daddr != rmt_addr)  ||
+                    (inet->inet_dport != rmt_port && inet->inet_dport)  ||
+                    (inet->inet_rcv_saddr       &&
+                     inet->inet_rcv_saddr != loc_addr)                  ||
                     ipv6_only_sock(s)                                   ||
                     (s->sk_bound_dev_if && s->sk_bound_dev_if != dif))
                         continue;
@@ -642,14 +834,14 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         } else {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
-                daddr = inet->daddr;
-                dport = inet->dport;
+                daddr = inet->inet_daddr;
+                dport = inet->inet_dport;
                 /* Open fast path for connected socket.
                    Route will not be used, if at least one option is set.
                  */
                 connected = 1;
         }
-        ipc.addr = inet->saddr;
+        ipc.addr = inet->inet_saddr;
 
         ipc.oif = sk->sk_bound_dev_if;
         err = sock_tx_timestamp(msg, sk, &ipc.shtx);
@@ -704,7 +896,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                     .proto = sk->sk_protocol,
                                     .flags = inet_sk_flowi_flags(sk),
                                     .uli_u = { .ports =
-                                               { .sport = inet->sport,
+                                               { .sport = inet->inet_sport,
                                                  .dport = dport } } };
                 struct net *net = sock_net(sk);
 
@@ -748,7 +940,7 @@ back_from_confirm:
         inet->cork.fl.fl4_dst = daddr;
         inet->cork.fl.fl_ip_dport = dport;
         inet->cork.fl.fl4_src = saddr;
-        inet->cork.fl.fl_ip_sport = inet->sport;
+        inet->cork.fl.fl_ip_sport = inet->inet_sport;
         up->pending = AF_INET;
 
 do_append_data:
@@ -862,6 +1054,7 @@ static unsigned int first_packet_length(struct sock *sk)
                 udp_lib_checksum_complete(skb)) {
                 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
                                  IS_UDPLITE(sk));
+                atomic_inc(&sk->sk_drops);
                 __skb_unlink(skb, rcvq);
                 __skb_queue_tail(&list_kill, skb);
         }
@@ -982,7 +1175,7 @@ try_again:
                 UDP_INC_STATS_USER(sock_net(sk),
                                 UDP_MIB_INDATAGRAMS, is_udplite);
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         /* Copy the address. */
         if (sin) {
@@ -1023,15 +1216,15 @@ int udp_disconnect(struct sock *sk, int flags)
          */
 
         sk->sk_state = TCP_CLOSE;
-        inet->daddr = 0;
-        inet->dport = 0;
+        inet->inet_daddr = 0;
+        inet->inet_dport = 0;
         sk->sk_bound_dev_if = 0;
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
 
         if (!(sk->sk_userlocks & SOCK_BINDPORT_LOCK)) {
                 sk->sk_prot->unhash(sk);
-                inet->sport = 0;
+                inet->inet_sport = 0;
         }
         sk_dst_reset(sk);
         return 0;
@@ -1042,13 +1235,22 @@ void udp_lib_unhash(struct sock *sk)
 {
         if (sk_hashed(sk)) {
                 struct udp_table *udptable = sk->sk_prot->h.udp_table;
-                unsigned int hash = udp_hashfn(sock_net(sk), sk->sk_hash);
-                struct udp_hslot *hslot = &udptable->hash[hash];
+                struct udp_hslot *hslot, *hslot2;
+
+                hslot  = udp_hashslot(udptable, sock_net(sk),
+                                      udp_sk(sk)->udp_port_hash);
+                hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
 
                 spin_lock_bh(&hslot->lock);
                 if (sk_nulls_del_node_init_rcu(sk)) {
-                        inet_sk(sk)->num = 0;
+                        hslot->count--;
+                        inet_sk(sk)->inet_num = 0;
                         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
+
+                        spin_lock(&hslot2->lock);
+                        hlist_nulls_del_init_rcu(&udp_sk(sk)->udp_portaddr_node);
+                        hslot2->count--;
+                        spin_unlock(&hslot2->lock);
                 }
                 spin_unlock_bh(&hslot->lock);
         }
@@ -1057,25 +1259,22 @@ EXPORT_SYMBOL(udp_lib_unhash);
 
 static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
-        int is_udplite = IS_UDPLITE(sk);
-        int rc;
+        int rc = sock_queue_rcv_skb(sk, skb);
+
+        if (rc < 0) {
+                int is_udplite = IS_UDPLITE(sk);
 
-        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM) {
+                if (rc == -ENOMEM)
                         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
                                          is_udplite);
-                        atomic_inc(&sk->sk_drops);
-                }
-                goto drop;
+                UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+                kfree_skb(skb);
+                return -1;
         }
 
         return 0;
 
-drop:
-        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
-        kfree_skb(skb);
-        return -1;
 }
 
 /* returns:
@@ -1182,53 +1381,88 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
 drop:
         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+        atomic_inc(&sk->sk_drops);
         kfree_skb(skb);
         return -1;
 }
 
+
+static void flush_stack(struct sock **stack, unsigned int count,
+                        struct sk_buff *skb, unsigned int final)
+{
+        unsigned int i;
+        struct sk_buff *skb1 = NULL;
+        struct sock *sk;
+
+        for (i = 0; i < count; i++) {
+                sk = stack[i];
+                if (likely(skb1 == NULL))
+                        skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
+
+                if (!skb1) {
+                        atomic_inc(&sk->sk_drops);
+                        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
+                                         IS_UDPLITE(sk));
+                        UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
+                                         IS_UDPLITE(sk));
+                }
+
+                if (skb1 && udp_queue_rcv_skb(sk, skb1) <= 0)
+                        skb1 = NULL;
+        }
+        if (unlikely(skb1))
+                kfree_skb(skb1);
+}
+
 /*
  *      Multicasts and broadcasts go to each listener.
  *
- *      Note: called only from the BH handler context,
- *      so we don't need to lock the hashes.
+ *      Note: called only from the BH handler context.
  */
 static int __udp4_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                                     struct udphdr  *uh,
                                     __be32 saddr, __be32 daddr,
                                     struct udp_table *udptable)
 {
-        struct sock *sk;
-        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
+        struct sock *sk, *stack[256 / sizeof(struct sock *)];
+        struct udp_hslot *hslot = udp_hashslot(udptable, net, ntohs(uh->dest));
         int dif;
+        unsigned int i, count = 0;
 
         spin_lock(&hslot->lock);
         sk = sk_nulls_head(&hslot->head);
         dif = skb->dev->ifindex;
         sk = udp_v4_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
-        if (sk) {
-                struct sock *sknext = NULL;
-
-                do {
-                        struct sk_buff *skb1 = skb;
-
-                        sknext = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
-                                                   daddr, uh->source, saddr,
-                                                   dif);
-                        if (sknext)
-                                skb1 = skb_clone(skb, GFP_ATOMIC);
-
-                        if (skb1) {
-                                int ret = udp_queue_rcv_skb(sk, skb1);
-                                if (ret > 0)
-                                        /* we should probably re-process instead
-                                         * of dropping packets here. */
-                                        kfree_skb(skb1);
-                        }
-                        sk = sknext;
-                } while (sknext);
-        } else
-                consume_skb(skb);
+        while (sk) {
+                stack[count++] = sk;
+                sk = udp_v4_mcast_next(net, sk_nulls_next(sk), uh->dest,
+                                       daddr, uh->source, saddr, dif);
+                if (unlikely(count == ARRAY_SIZE(stack))) {
+                        if (!sk)
+                                break;
+                        flush_stack(stack, count, skb, ~0);
+                        count = 0;
+                }
+        }
+        /*
+         * before releasing chain lock, we must take a reference on sockets
+         */
+        for (i = 0; i < count; i++)
+                sock_hold(stack[i]);
+
         spin_unlock(&hslot->lock);
+
+        /*
+         * do the slow work with no lock held
+         */
+        if (count) {
+                flush_stack(stack, count, skb, count - 1);
+
+                for (i = 0; i < count; i++)
+                        sock_put(stack[i]);
+        } else {
+                kfree_skb(skb);
+        }
         return 0;
 }
 
@@ -1620,9 +1854,14 @@ static struct sock *udp_get_first(struct seq_file *seq, int start)
         struct udp_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
 
-        for (state->bucket = start; state->bucket < UDP_HTABLE_SIZE; ++state->bucket) {
+        for (state->bucket = start; state->bucket <= state->udp_table->mask;
+             ++state->bucket) {
                 struct hlist_nulls_node *node;
                 struct udp_hslot *hslot = &state->udp_table->hash[state->bucket];
+
+                if (hlist_nulls_empty(&hslot->head))
+                        continue;
+
                 spin_lock_bh(&hslot->lock);
                 sk_nulls_for_each(sk, node, &hslot->head) {
                         if (!net_eq(sock_net(sk), net))
@@ -1647,7 +1886,7 @@ static struct sock *udp_get_next(struct seq_file *seq, struct sock *sk)
         } while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
 
         if (!sk) {
-                if (state->bucket < UDP_HTABLE_SIZE)
+                if (state->bucket <= state->udp_table->mask)
                         spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
                 return udp_get_first(seq, state->bucket + 1);
         }
@@ -1667,7 +1906,7 @@ static struct sock *udp_get_idx(struct seq_file *seq, loff_t pos)
 static void *udp_seq_start(struct seq_file *seq, loff_t *pos)
 {
         struct udp_iter_state *state = seq->private;
-        state->bucket = UDP_HTABLE_SIZE;
+        state->bucket = MAX_UDP_PORTS;
 
         return *pos ? udp_get_idx(seq, *pos-1) : SEQ_START_TOKEN;
 }
@@ -1689,7 +1928,7 @@ static void udp_seq_stop(struct seq_file *seq, void *v)
 {
         struct udp_iter_state *state = seq->private;
 
-        if (state->bucket < UDP_HTABLE_SIZE)
+        if (state->bucket <= state->udp_table->mask)
                 spin_unlock_bh(&state->udp_table->hash[state->bucket].lock);
 }
 
@@ -1744,12 +1983,12 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
                 int bucket, int *len)
 {
         struct inet_sock *inet = inet_sk(sp);
-        __be32 dest = inet->daddr;
-        __be32 src  = inet->rcv_saddr;
-        __u16 destp       = ntohs(inet->dport);
-        __u16 srcp        = ntohs(inet->sport);
+        __be32 dest = inet->inet_daddr;
+        __be32 src  = inet->inet_rcv_saddr;
+        __u16 destp       = ntohs(inet->inet_dport);
+        __u16 srcp        = ntohs(inet->inet_sport);
 
-        seq_printf(f, "%4d: %08X:%04X %08X:%04X"
+        seq_printf(f, "%5d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d%n",
                 bucket, src, srcp, dest, destp, sp->sk_state,
                 sk_wmem_alloc_get(sp),
@@ -1815,21 +2054,60 @@ void udp4_proc_exit(void)
 }
 #endif /* CONFIG_PROC_FS */
 
-void __init udp_table_init(struct udp_table *table)
+static __initdata unsigned long uhash_entries;
+static int __init set_uhash_entries(char *str)
 {
-        int i;
+        if (!str)
+                return 0;
+        uhash_entries = simple_strtoul(str, &str, 0);
+        if (uhash_entries && uhash_entries < UDP_HTABLE_SIZE_MIN)
+                uhash_entries = UDP_HTABLE_SIZE_MIN;
+        return 1;
+}
+__setup("uhash_entries=", set_uhash_entries);
 
-        for (i = 0; i < UDP_HTABLE_SIZE; i++) {
+void __init udp_table_init(struct udp_table *table, const char *name)
+{
+        unsigned int i;
+
+        if (!CONFIG_BASE_SMALL)
+                table->hash = alloc_large_system_hash(name,
+                        2 * sizeof(struct udp_hslot),
+                        uhash_entries,
+                        21, /* one slot per 2 MB */
+                        0,
+                        &table->log,
+                        &table->mask,
+                        64 * 1024);
+        /*
+         * Make sure hash table has the minimum size
+         */
+        if (CONFIG_BASE_SMALL || table->mask < UDP_HTABLE_SIZE_MIN - 1) {
+                table->hash = kmalloc(UDP_HTABLE_SIZE_MIN *
+                                      2 * sizeof(struct udp_hslot), GFP_KERNEL);
+                if (!table->hash)
+                        panic(name);
+                table->log = ilog2(UDP_HTABLE_SIZE_MIN);
+                table->mask = UDP_HTABLE_SIZE_MIN - 1;
+        }
+        table->hash2 = table->hash + (table->mask + 1);
+        for (i = 0; i <= table->mask; i++) {
                 INIT_HLIST_NULLS_HEAD(&table->hash[i].head, i);
+                table->hash[i].count = 0;
                 spin_lock_init(&table->hash[i].lock);
         }
+        for (i = 0; i <= table->mask; i++) {
+                INIT_HLIST_NULLS_HEAD(&table->hash2[i].head, i);
+                table->hash2[i].count = 0;
+                spin_lock_init(&table->hash2[i].lock);
+        }
 }
 
 void __init udp_init(void)
 {
         unsigned long nr_pages, limit;
 
-        udp_table_init(&udp_table);
+        udp_table_init(&udp_table, "UDP");
         /* Set the pressure threshold up by the same strategy of TCP. It is a
          * fraction of global memory that is up to 1/2 at 256 MB, decreasing
          * toward zero with the amount of memory, with a floor of 128 pages.
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 95248d7f75ec..66f79513f4a5 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -12,7 +12,7 @@
  */
 #include "udp_impl.h"
 
-struct udp_table        udplite_table;
+struct udp_table        udplite_table __read_mostly;
 EXPORT_SYMBOL(udplite_table);
 
 static int udplite_rcv(struct sk_buff *skb)
@@ -64,7 +64,6 @@ static struct inet_protosw udplite4_protosw = {
         .protocol       =  IPPROTO_UDPLITE,
         .prot           =  &udplite_prot,
         .ops            =  &inet_dgram_ops,
-        .capability     = -1,
         .no_check       =  0,           /* must checksum (RFC 3828) */
         .flags          =  INET_PROTOSW_PERMANENT,
 };
@@ -110,7 +109,7 @@ static inline int udplite4_proc_init(void)
 
 void __init udplite4_register(void)
 {
-        udp_table_init(&udplite_table);
+        udp_table_init(&udplite_table, "UDP-Lite");
         if (proto_register(&udplite_prot, 1))
                 goto out_register_err;