69 files changed, 3104 insertions, 1210 deletions

diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index dbc10d84161f..e682b48e0709 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -309,8 +309,33 @@ config NET_IPVTI
 
 config NET_UDP_TUNNEL
         tristate
+        select NET_IP_TUNNEL
         default n
 
+config NET_FOU
+        tristate "IP: Foo (IP protocols) over UDP"
+        select XFRM
+        select NET_UDP_TUNNEL
+        ---help---
+          Foo over UDP allows any IP protocol to be directly encapsulated
+          over UDP include tunnels (IPIP, GRE, SIT). By encapsulating in UDP
+          network mechanisms and optimizations for UDP (such as ECMP
+          and RSS) can be leveraged to provide better service.
+
+config GENEVE
+        tristate "Generic Network Virtualization Encapsulation (Geneve)"
+        depends on INET
+        select NET_UDP_TUNNEL
+        ---help---
+        This allows one to create Geneve virtual interfaces that provide
+        Layer 2 Networks over Layer 3 Networks. Geneve is often used
+        to tunnel virtual network infrastructure in virtualized environments.
+        For more information see:
+          http://tools.ietf.org/html/draft-gross-geneve-01
+
+          To compile this driver as a module, choose M here: the module
+
+
 config INET_AH
         tristate "IP: AH transformation"
         select XFRM_ALGO
@@ -560,6 +585,27 @@ config TCP_CONG_ILLINOIS
         For further details see:
           http://www.ews.uiuc.edu/~shaoliu/tcpillinois/index.html
 
+config TCP_CONG_DCTCP
+        tristate "DataCenter TCP (DCTCP)"
+        default n
+        ---help---
+        DCTCP leverages Explicit Congestion Notification (ECN) in the network to
+        provide multi-bit feedback to the end hosts. It is designed to provide:
+
+        - High burst tolerance (incast due to partition/aggregate),
+        - Low latency (short flows, queries),
+        - High throughput (continuous data updates, large file transfers) with
+          commodity, shallow-buffered switches.
+
+        All switches in the data center network running DCTCP must support
+        ECN marking and be configured for marking when reaching defined switch
+        buffer thresholds. The default ECN marking threshold heuristic for
+        DCTCP on switches is 20 packets (30KB) at 1Gbps, and 65 packets
+        (~100KB) at 10Gbps, but might need further careful tweaking.
+
+        For further details see:
+          http://simula.stanford.edu/~alizade/Site/DCTCP_files/dctcp-final.pdf
+
 choice
         prompt "Default TCP congestion control"
         default DEFAULT_CUBIC
@@ -588,9 +634,11 @@ choice
         config DEFAULT_WESTWOOD
                 bool "Westwood" if TCP_CONG_WESTWOOD=y
 
+        config DEFAULT_DCTCP
+                bool "DCTCP" if TCP_CONG_DCTCP=y
+
         config DEFAULT_RENO
                 bool "Reno"
-
 endchoice
 
 endif
@@ -610,6 +658,7 @@ config DEFAULT_TCP_CONG
         default "westwood" if DEFAULT_WESTWOOD
         default "veno" if DEFAULT_VENO
         default "reno" if DEFAULT_RENO
+        default "dctcp" if DEFAULT_DCTCP
         default "cubic"
 
 config TCP_MD5SIG
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index 8ee1cd4053ee..518c04ed666e 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -20,6 +20,7 @@ obj-$(CONFIG_IP_MULTIPLE_TABLES) += fib_rules.o
 obj-$(CONFIG_IP_MROUTE) += ipmr.o
 obj-$(CONFIG_NET_IPIP) += ipip.o
 gre-y := gre_demux.o
+obj-$(CONFIG_NET_FOU) += fou.o
 obj-$(CONFIG_NET_IPGRE_DEMUX) += gre.o
 obj-$(CONFIG_NET_IPGRE) += ip_gre.o
 obj-$(CONFIG_NET_UDP_TUNNEL) += udp_tunnel.o
@@ -42,6 +43,7 @@ obj-$(CONFIG_INET_UDP_DIAG) += udp_diag.o
 obj-$(CONFIG_NET_TCPPROBE) += tcp_probe.o
 obj-$(CONFIG_TCP_CONG_BIC) += tcp_bic.o
 obj-$(CONFIG_TCP_CONG_CUBIC) += tcp_cubic.o
+obj-$(CONFIG_TCP_CONG_DCTCP) += tcp_dctcp.o
 obj-$(CONFIG_TCP_CONG_WESTWOOD) += tcp_westwood.o
 obj-$(CONFIG_TCP_CONG_HSTCP) += tcp_highspeed.o
 obj-$(CONFIG_TCP_CONG_HYBLA) += tcp_hybla.o
@@ -54,6 +56,7 @@ obj-$(CONFIG_TCP_CONG_YEAH) += tcp_yeah.o
 obj-$(CONFIG_TCP_CONG_ILLINOIS) += tcp_illinois.o
 obj-$(CONFIG_MEMCG_KMEM) += tcp_memcontrol.o
 obj-$(CONFIG_NETLABEL) += cipso_ipv4.o
+obj-$(CONFIG_GENEVE) += geneve.o
 
 obj-$(CONFIG_XFRM) += xfrm4_policy.o xfrm4_state.o xfrm4_input.o \
                       xfrm4_output.o xfrm4_protocol.o
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index d156b3c5f363..92db7a69f2b9 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -418,10 +418,6 @@ int inet_release(struct socket *sock)
 }
 EXPORT_SYMBOL(inet_release);
 
-/* It is off by default, see below. */
-int sysctl_ip_nonlocal_bind __read_mostly;
-EXPORT_SYMBOL(sysctl_ip_nonlocal_bind);
-
 int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
         struct sockaddr_in *addr = (struct sockaddr_in *)uaddr;
@@ -461,7 +457,7 @@ int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
          *  is temporarily down)
          */
         err = -EADDRNOTAVAIL;
-        if (!sysctl_ip_nonlocal_bind &&
+        if (!net->ipv4.sysctl_ip_nonlocal_bind &&
             !(inet->freebind || inet->transparent) &&
             addr->sin_addr.s_addr != htonl(INADDR_ANY) &&
             chk_addr_ret != RTN_LOCAL &&
@@ -1201,40 +1197,6 @@ int inet_sk_rebuild_header(struct sock *sk)
 }
 EXPORT_SYMBOL(inet_sk_rebuild_header);
 
-static int inet_gso_send_check(struct sk_buff *skb)
-{
-        const struct net_offload *ops;
-        const struct iphdr *iph;
-        int proto;
-        int ihl;
-        int err = -EINVAL;
-
-        if (unlikely(!pskb_may_pull(skb, sizeof(*iph))))
-                goto out;
-
-        iph = ip_hdr(skb);
-        ihl = iph->ihl * 4;
-        if (ihl < sizeof(*iph))
-                goto out;
-
-        proto = iph->protocol;
-
-        /* Warning: after this point, iph might be no longer valid */
-        if (unlikely(!pskb_may_pull(skb, ihl)))
-                goto out;
-        __skb_pull(skb, ihl);
-
-        skb_reset_transport_header(skb);
-        err = -EPROTONOSUPPORT;
-
-        ops = rcu_dereference(inet_offloads[proto]);
-        if (likely(ops && ops->callbacks.gso_send_check))
-                err = ops->callbacks.gso_send_check(skb);
-
-out:
-        return err;
-}
-
 static struct sk_buff *inet_gso_segment(struct sk_buff *skb,
                                         netdev_features_t features)
 {
@@ -1407,6 +1369,9 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
          * immediately following this IP hdr.
          */
 
+        /* Note : No need to call skb_gro_postpull_rcsum() here,
+         * as we already checked checksum over ipv4 header was 0
+         */
         skb_gro_pull(skb, sizeof(*iph));
         skb_set_transport_header(skb, skb_gro_offset(skb));
 
@@ -1659,7 +1624,6 @@ static int ipv4_proc_init(void);
 static struct packet_offload ip_packet_offload __read_mostly = {
         .type = cpu_to_be16(ETH_P_IP),
         .callbacks = {
-                .gso_send_check = inet_gso_send_check,
                 .gso_segment = inet_gso_segment,
                 .gro_receive = inet_gro_receive,
                 .gro_complete = inet_gro_complete,
@@ -1668,8 +1632,9 @@ static struct packet_offload ip_packet_offload __read_mostly = {
 
 static const struct net_offload ipip_offload = {
         .callbacks = {
-                .gso_send_check = inet_gso_send_check,
                 .gso_segment    = inet_gso_segment,
+                .gro_receive    = inet_gro_receive,
+                .gro_complete   = inet_gro_complete,
         },
 };
 
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index a2afa89513a0..ac9a32ec3ee4 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -505,8 +505,6 @@ static int ah_init_state(struct xfrm_state *x)
         ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
         ahp->icv_trunc_len = x->aalg->alg_trunc_len/8;
 
-        BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
-
         if (x->props.flags & XFRM_STATE_ALIGN4)
                 x->props.header_len = XFRM_ALIGN4(sizeof(struct ip_auth_hdr) +
                                                   ahp->icv_trunc_len);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 1a9b99e04465..16acb59d665e 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -953,10 +953,11 @@ static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
 {
         const struct arphdr *arp;
 
+        /* do not tweak dropwatch on an ARP we will ignore */
         if (dev->flags & IFF_NOARP ||
             skb->pkt_type == PACKET_OTHERHOST ||
             skb->pkt_type == PACKET_LOOPBACK)
-                goto freeskb;
+                goto consumeskb;
 
         skb = skb_share_check(skb, GFP_ATOMIC);
         if (!skb)
@@ -974,6 +975,9 @@ static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
 
         return NF_HOOK(NFPROTO_ARP, NF_ARP_IN, skb, dev, NULL, arp_process);
 
+consumeskb:
+        consume_skb(skb);
+        return 0;
 freeskb:
         kfree_skb(skb);
 out_of_mem:
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 05b708bbdb0d..4715f25dfe03 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -246,7 +246,7 @@ static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
  * success, negative values on error.
  *
  */
-static int cipso_v4_cache_init(void)
+static int __init cipso_v4_cache_init(void)
 {
         u32 iter;
 
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 255aa9946fe7..23104a3f2924 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -243,7 +243,7 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
                                  u8 tos, int oif, struct net_device *dev,
                                  int rpf, struct in_device *idev, u32 *itag)
 {
-        int ret, no_addr, accept_local;
+        int ret, no_addr;
         struct fib_result res;
         struct flowi4 fl4;
         struct net *net;
@@ -258,16 +258,17 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
 
         no_addr = idev->ifa_list == NULL;
 
-        accept_local = IN_DEV_ACCEPT_LOCAL(idev);
         fl4.flowi4_mark = IN_DEV_SRC_VMARK(idev) ? skb->mark : 0;
 
         net = dev_net(dev);
         if (fib_lookup(net, &fl4, &res))
                 goto last_resort;
-        if (res.type != RTN_UNICAST) {
-                if (res.type != RTN_LOCAL || !accept_local)
-                        goto e_inval;
-        }
+        if (res.type != RTN_UNICAST &&
+            (res.type != RTN_LOCAL || !IN_DEV_ACCEPT_LOCAL(idev)))
+                goto e_inval;
+        if (!rpf && !fib_num_tclassid_users(dev_net(dev)) &&
+            (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev)))
+                goto last_resort;
         fib_combine_itag(itag, &res);
         dev_match = false;
 
@@ -321,6 +322,7 @@ int fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
         int r = secpath_exists(skb) ? 0 : IN_DEV_RPFILTER(idev);
 
         if (!r && !fib_num_tclassid_users(dev_net(dev)) &&
+            IN_DEV_ACCEPT_LOCAL(idev) &&
             (dev->ifindex != oif || !IN_DEV_TX_REDIRECTS(idev))) {
                 *itag = 0;
                 return 0;
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index b10cd43a4722..5b6efb3d2308 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -157,9 +157,12 @@ static void rt_fibinfo_free(struct rtable __rcu **rtp)
 
 static void free_nh_exceptions(struct fib_nh *nh)
 {
-        struct fnhe_hash_bucket *hash = nh->nh_exceptions;
+        struct fnhe_hash_bucket *hash;
         int i;
 
+        hash = rcu_dereference_protected(nh->nh_exceptions, 1);
+        if (!hash)
+                return;
         for (i = 0; i < FNHE_HASH_SIZE; i++) {
                 struct fib_nh_exception *fnhe;
 
@@ -205,8 +208,7 @@ static void free_fib_info_rcu(struct rcu_head *head)
         change_nexthops(fi) {
                 if (nexthop_nh->nh_dev)
                         dev_put(nexthop_nh->nh_dev);
-                if (nexthop_nh->nh_exceptions)
-                        free_nh_exceptions(nexthop_nh);
+                free_nh_exceptions(nexthop_nh);
                 rt_fibinfo_free_cpus(nexthop_nh->nh_pcpu_rth_output);
                 rt_fibinfo_free(&nexthop_nh->nh_rth_input);
         } endfor_nexthops(fi);
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
new file mode 100644
index 000000000000..efa70ad44906
--- /dev/null
+++ b/net/ipv4/fou.c
@@ -0,0 +1,514 @@
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/socket.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/udp.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <net/genetlink.h>
+#include <net/gue.h>
+#include <net/ip.h>
+#include <net/protocol.h>
+#include <net/udp.h>
+#include <net/udp_tunnel.h>
+#include <net/xfrm.h>
+#include <uapi/linux/fou.h>
+#include <uapi/linux/genetlink.h>
+
+static DEFINE_SPINLOCK(fou_lock);
+static LIST_HEAD(fou_list);
+
+struct fou {
+        struct socket *sock;
+        u8 protocol;
+        u16 port;
+        struct udp_offload udp_offloads;
+        struct list_head list;
+};
+
+struct fou_cfg {
+        u16 type;
+        u8 protocol;
+        struct udp_port_cfg udp_config;
+};
+
+static inline struct fou *fou_from_sock(struct sock *sk)
+{
+        return sk->sk_user_data;
+}
+
+static int fou_udp_encap_recv_deliver(struct sk_buff *skb,
+                                      u8 protocol, size_t len)
+{
+        struct iphdr *iph = ip_hdr(skb);
+
+        /* Remove 'len' bytes from the packet (UDP header and
+         * FOU header if present), modify the protocol to the one
+         * we found, and then call rcv_encap.
+         */
+        iph->tot_len = htons(ntohs(iph->tot_len) - len);
+        __skb_pull(skb, len);
+        skb_postpull_rcsum(skb, udp_hdr(skb), len);
+        skb_reset_transport_header(skb);
+
+        return -protocol;
+}
+
+static int fou_udp_recv(struct sock *sk, struct sk_buff *skb)
+{
+        struct fou *fou = fou_from_sock(sk);
+
+        if (!fou)
+                return 1;
+
+        return fou_udp_encap_recv_deliver(skb, fou->protocol,
+                                          sizeof(struct udphdr));
+}
+
+static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
+{
+        struct fou *fou = fou_from_sock(sk);
+        size_t len;
+        struct guehdr *guehdr;
+        struct udphdr *uh;
+
+        if (!fou)
+                return 1;
+
+        len = sizeof(struct udphdr) + sizeof(struct guehdr);
+        if (!pskb_may_pull(skb, len))
+                goto drop;
+
+        uh = udp_hdr(skb);
+        guehdr = (struct guehdr *)&uh[1];
+
+        len += guehdr->hlen << 2;
+        if (!pskb_may_pull(skb, len))
+                goto drop;
+
+        if (guehdr->version != 0)
+                goto drop;
+
+        if (guehdr->flags) {
+                /* No support yet */
+                goto drop;
+        }
+
+        return fou_udp_encap_recv_deliver(skb, guehdr->next_hdr, len);
+drop:
+        kfree_skb(skb);
+        return 0;
+}
+
+static struct sk_buff **fou_gro_receive(struct sk_buff **head,
+                                        struct sk_buff *skb)
+{
+        const struct net_offload *ops;
+        struct sk_buff **pp = NULL;
+        u8 proto = NAPI_GRO_CB(skb)->proto;
+        const struct net_offload **offloads;
+
+        rcu_read_lock();
+        offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
+        ops = rcu_dereference(offloads[proto]);
+        if (!ops || !ops->callbacks.gro_receive)
+                goto out_unlock;
+
+        pp = ops->callbacks.gro_receive(head, skb);
+
+out_unlock:
+        rcu_read_unlock();
+
+        return pp;
+}
+
+static int fou_gro_complete(struct sk_buff *skb, int nhoff)
+{
+        const struct net_offload *ops;
+        u8 proto = NAPI_GRO_CB(skb)->proto;
+        int err = -ENOSYS;
+        const struct net_offload **offloads;
+
+        rcu_read_lock();
+        offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
+        ops = rcu_dereference(offloads[proto]);
+        if (WARN_ON(!ops || !ops->callbacks.gro_complete))
+                goto out_unlock;
+
+        err = ops->callbacks.gro_complete(skb, nhoff);
+
+out_unlock:
+        rcu_read_unlock();
+
+        return err;
+}
+
+static struct sk_buff **gue_gro_receive(struct sk_buff **head,
+                                        struct sk_buff *skb)
+{
+        const struct net_offload **offloads;
+        const struct net_offload *ops;
+        struct sk_buff **pp = NULL;
+        struct sk_buff *p;
+        u8 proto;
+        struct guehdr *guehdr;
+        unsigned int hlen, guehlen;
+        unsigned int off;
+        int flush = 1;
+
+        off = skb_gro_offset(skb);
+        hlen = off + sizeof(*guehdr);
+        guehdr = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                guehdr = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!guehdr))
+                        goto out;
+        }
+
+        proto = guehdr->next_hdr;
+
+        rcu_read_lock();
+        offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
+        ops = rcu_dereference(offloads[proto]);
+        if (WARN_ON(!ops || !ops->callbacks.gro_receive))
+                goto out_unlock;
+
+        guehlen = sizeof(*guehdr) + (guehdr->hlen << 2);
+
+        hlen = off + guehlen;
+        if (skb_gro_header_hard(skb, hlen)) {
+                guehdr = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!guehdr))
+                        goto out_unlock;
+        }
+
+        flush = 0;
+
+        for (p = *head; p; p = p->next) {
+                const struct guehdr *guehdr2;
+
+                if (!NAPI_GRO_CB(p)->same_flow)
+                        continue;
+
+                guehdr2 = (struct guehdr *)(p->data + off);
+
+                /* Compare base GUE header to be equal (covers
+                 * hlen, version, next_hdr, and flags.
+                 */
+                if (guehdr->word != guehdr2->word) {
+                        NAPI_GRO_CB(p)->same_flow = 0;
+                        continue;
+                }
+
+                /* Compare optional fields are the same. */
+                if (guehdr->hlen && memcmp(&guehdr[1], &guehdr2[1],
+                                           guehdr->hlen << 2)) {
+                        NAPI_GRO_CB(p)->same_flow = 0;
+                        continue;
+                }
+        }
+
+        skb_gro_pull(skb, guehlen);
+
+        /* Adjusted NAPI_GRO_CB(skb)->csum after skb_gro_pull()*/
+        skb_gro_postpull_rcsum(skb, guehdr, guehlen);
+
+        pp = ops->callbacks.gro_receive(head, skb);
+
+out_unlock:
+        rcu_read_unlock();
+out:
+        NAPI_GRO_CB(skb)->flush |= flush;
+
+        return pp;
+}
+
+static int gue_gro_complete(struct sk_buff *skb, int nhoff)
+{
+        const struct net_offload **offloads;
+        struct guehdr *guehdr = (struct guehdr *)(skb->data + nhoff);
+        const struct net_offload *ops;
+        unsigned int guehlen;
+        u8 proto;
+        int err = -ENOENT;
+
+        proto = guehdr->next_hdr;
+
+        guehlen = sizeof(*guehdr) + (guehdr->hlen << 2);
+
+        rcu_read_lock();
+        offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
+        ops = rcu_dereference(offloads[proto]);
+        if (WARN_ON(!ops || !ops->callbacks.gro_complete))
+                goto out_unlock;
+
+        err = ops->callbacks.gro_complete(skb, nhoff + guehlen);
+
+out_unlock:
+        rcu_read_unlock();
+        return err;
+}
+
+static int fou_add_to_port_list(struct fou *fou)
+{
+        struct fou *fout;
+
+        spin_lock(&fou_lock);
+        list_for_each_entry(fout, &fou_list, list) {
+                if (fou->port == fout->port) {
+                        spin_unlock(&fou_lock);
+                        return -EALREADY;
+                }
+        }
+
+        list_add(&fou->list, &fou_list);
+        spin_unlock(&fou_lock);
+
+        return 0;
+}
+
+static void fou_release(struct fou *fou)
+{
+        struct socket *sock = fou->sock;
+        struct sock *sk = sock->sk;
+
+        udp_del_offload(&fou->udp_offloads);
+
+        list_del(&fou->list);
+
+        /* Remove hooks into tunnel socket */
+        sk->sk_user_data = NULL;
+
+        sock_release(sock);
+
+        kfree(fou);
+}
+
+static int fou_encap_init(struct sock *sk, struct fou *fou, struct fou_cfg *cfg)
+{
+        udp_sk(sk)->encap_rcv = fou_udp_recv;
+        fou->protocol = cfg->protocol;
+        fou->udp_offloads.callbacks.gro_receive = fou_gro_receive;
+        fou->udp_offloads.callbacks.gro_complete = fou_gro_complete;
+        fou->udp_offloads.port = cfg->udp_config.local_udp_port;
+        fou->udp_offloads.ipproto = cfg->protocol;
+
+        return 0;
+}
+
+static int gue_encap_init(struct sock *sk, struct fou *fou, struct fou_cfg *cfg)
+{
+        udp_sk(sk)->encap_rcv = gue_udp_recv;
+        fou->udp_offloads.callbacks.gro_receive = gue_gro_receive;
+        fou->udp_offloads.callbacks.gro_complete = gue_gro_complete;
+        fou->udp_offloads.port = cfg->udp_config.local_udp_port;
+
+        return 0;
+}
+
+static int fou_create(struct net *net, struct fou_cfg *cfg,
+                      struct socket **sockp)
+{
+        struct fou *fou = NULL;
+        int err;
+        struct socket *sock = NULL;
+        struct sock *sk;
+
+        /* Open UDP socket */
+        err = udp_sock_create(net, &cfg->udp_config, &sock);
+        if (err < 0)
+                goto error;
+
+        /* Allocate FOU port structure */
+        fou = kzalloc(sizeof(*fou), GFP_KERNEL);
+        if (!fou) {
+                err = -ENOMEM;
+                goto error;
+        }
+
+        sk = sock->sk;
+
+        fou->port = cfg->udp_config.local_udp_port;
+
+        /* Initial for fou type */
+        switch (cfg->type) {
+        case FOU_ENCAP_DIRECT:
+                err = fou_encap_init(sk, fou, cfg);
+                if (err)
+                        goto error;
+                break;
+        case FOU_ENCAP_GUE:
+                err = gue_encap_init(sk, fou, cfg);
+                if (err)
+                        goto error;
+                break;
+        default:
+                err = -EINVAL;
+                goto error;
+        }
+
+        udp_sk(sk)->encap_type = 1;
+        udp_encap_enable();
+
+        sk->sk_user_data = fou;
+        fou->sock = sock;
+
+        udp_set_convert_csum(sk, true);
+
+        sk->sk_allocation = GFP_ATOMIC;
+
+        if (cfg->udp_config.family == AF_INET) {
+                err = udp_add_offload(&fou->udp_offloads);
+                if (err)
+                        goto error;
+        }
+
+        err = fou_add_to_port_list(fou);
+        if (err)
+                goto error;
+
+        if (sockp)
+                *sockp = sock;
+
+        return 0;
+
+error:
+        kfree(fou);
+        if (sock)
+                sock_release(sock);
+
+        return err;
+}
+
+static int fou_destroy(struct net *net, struct fou_cfg *cfg)
+{
+        struct fou *fou;
+        u16 port = cfg->udp_config.local_udp_port;
+        int err = -EINVAL;
+
+        spin_lock(&fou_lock);
+        list_for_each_entry(fou, &fou_list, list) {
+                if (fou->port == port) {
+                        udp_del_offload(&fou->udp_offloads);
+                        fou_release(fou);
+                        err = 0;
+                        break;
+                }
+        }
+        spin_unlock(&fou_lock);
+
+        return err;
+}
+
+static struct genl_family fou_nl_family = {
+        .id             = GENL_ID_GENERATE,
+        .hdrsize        = 0,
+        .name           = FOU_GENL_NAME,
+        .version        = FOU_GENL_VERSION,
+        .maxattr        = FOU_ATTR_MAX,
+        .netnsok        = true,
+};
+
+static struct nla_policy fou_nl_policy[FOU_ATTR_MAX + 1] = {
+        [FOU_ATTR_PORT] = { .type = NLA_U16, },
+        [FOU_ATTR_AF] = { .type = NLA_U8, },
+        [FOU_ATTR_IPPROTO] = { .type = NLA_U8, },
+        [FOU_ATTR_TYPE] = { .type = NLA_U8, },
+};
+
+static int parse_nl_config(struct genl_info *info,
+                           struct fou_cfg *cfg)
+{
+        memset(cfg, 0, sizeof(*cfg));
+
+        cfg->udp_config.family = AF_INET;
+
+        if (info->attrs[FOU_ATTR_AF]) {
+                u8 family = nla_get_u8(info->attrs[FOU_ATTR_AF]);
+
+                if (family != AF_INET && family != AF_INET6)
+                        return -EINVAL;
+
+                cfg->udp_config.family = family;
+        }
+
+        if (info->attrs[FOU_ATTR_PORT]) {
+                u16 port = nla_get_u16(info->attrs[FOU_ATTR_PORT]);
+
+                cfg->udp_config.local_udp_port = port;
+        }
+
+        if (info->attrs[FOU_ATTR_IPPROTO])
+                cfg->protocol = nla_get_u8(info->attrs[FOU_ATTR_IPPROTO]);
+
+        if (info->attrs[FOU_ATTR_TYPE])
+                cfg->type = nla_get_u8(info->attrs[FOU_ATTR_TYPE]);
+
+        return 0;
+}
+
+static int fou_nl_cmd_add_port(struct sk_buff *skb, struct genl_info *info)
+{
+        struct fou_cfg cfg;
+        int err;
+
+        err = parse_nl_config(info, &cfg);
+        if (err)
+                return err;
+
+        return fou_create(&init_net, &cfg, NULL);
+}
+
+static int fou_nl_cmd_rm_port(struct sk_buff *skb, struct genl_info *info)
+{
+        struct fou_cfg cfg;
+
+        parse_nl_config(info, &cfg);
+
+        return fou_destroy(&init_net, &cfg);
+}
+
+static const struct genl_ops fou_nl_ops[] = {
+        {
+                .cmd = FOU_CMD_ADD,
+                .doit = fou_nl_cmd_add_port,
+                .policy = fou_nl_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = FOU_CMD_DEL,
+                .doit = fou_nl_cmd_rm_port,
+                .policy = fou_nl_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+};
+
+static int __init fou_init(void)
+{
+        int ret;
+
+        ret = genl_register_family_with_ops(&fou_nl_family,
+                                            fou_nl_ops);
+
+        return ret;
+}
+
+static void __exit fou_fini(void)
+{
+        struct fou *fou, *next;
+
+        genl_unregister_family(&fou_nl_family);
+
+        /* Close all the FOU sockets */
+
+        spin_lock(&fou_lock);
+        list_for_each_entry_safe(fou, next, &fou_list, list)
+                fou_release(fou);
+        spin_unlock(&fou_lock);
+}
+
+module_init(fou_init);
+module_exit(fou_fini);
+MODULE_AUTHOR("Tom Herbert <therbert@google.com>");
+MODULE_LICENSE("GPL");
diff --git a/net/ipv4/geneve.c b/net/ipv4/geneve.c
new file mode 100644
index 000000000000..065cd94c640c
--- /dev/null
+++ b/net/ipv4/geneve.c
@@ -0,0 +1,373 @@
+/*
+ * Geneve: Generic Network Virtualization Encapsulation
+ *
+ * Copyright (c) 2014 Nicira, Inc.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/errno.h>
+#include <linux/slab.h>
+#include <linux/skbuff.h>
+#include <linux/rculist.h>
+#include <linux/netdevice.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/udp.h>
+#include <linux/igmp.h>
+#include <linux/etherdevice.h>
+#include <linux/if_ether.h>
+#include <linux/if_vlan.h>
+#include <linux/hash.h>
+#include <linux/ethtool.h>
+#include <net/arp.h>
+#include <net/ndisc.h>
+#include <net/ip.h>
+#include <net/ip_tunnels.h>
+#include <net/icmp.h>
+#include <net/udp.h>
+#include <net/rtnetlink.h>
+#include <net/route.h>
+#include <net/dsfield.h>
+#include <net/inet_ecn.h>
+#include <net/net_namespace.h>
+#include <net/netns/generic.h>
+#include <net/geneve.h>
+#include <net/protocol.h>
+#include <net/udp_tunnel.h>
+#if IS_ENABLED(CONFIG_IPV6)
+#include <net/ipv6.h>
+#include <net/addrconf.h>
+#include <net/ip6_tunnel.h>
+#include <net/ip6_checksum.h>
+#endif
+
+#define PORT_HASH_BITS 8
+#define PORT_HASH_SIZE (1<<PORT_HASH_BITS)
+
+/* per-network namespace private data for this module */
+struct geneve_net {
+        struct hlist_head       sock_list[PORT_HASH_SIZE];
+        spinlock_t              sock_lock;   /* Protects sock_list */
+};
+
+static int geneve_net_id;
+
+static struct workqueue_struct *geneve_wq;
+
+static inline struct genevehdr *geneve_hdr(const struct sk_buff *skb)
+{
+        return (struct genevehdr *)(udp_hdr(skb) + 1);
+}
+
+static struct hlist_head *gs_head(struct net *net, __be16 port)
+{
+        struct geneve_net *gn = net_generic(net, geneve_net_id);
+
+        return &gn->sock_list[hash_32(ntohs(port), PORT_HASH_BITS)];
+}
+
+/* Find geneve socket based on network namespace and UDP port */
+static struct geneve_sock *geneve_find_sock(struct net *net, __be16 port)
+{
+        struct geneve_sock *gs;
+
+        hlist_for_each_entry_rcu(gs, gs_head(net, port), hlist) {
+                if (inet_sk(gs->sock->sk)->inet_sport == port)
+                        return gs;
+        }
+
+        return NULL;
+}
+
+static void geneve_build_header(struct genevehdr *geneveh,
+                                __be16 tun_flags, u8 vni[3],
+                                u8 options_len, u8 *options)
+{
+        geneveh->ver = GENEVE_VER;
+        geneveh->opt_len = options_len / 4;
+        geneveh->oam = !!(tun_flags & TUNNEL_OAM);
+        geneveh->critical = !!(tun_flags & TUNNEL_CRIT_OPT);
+        geneveh->rsvd1 = 0;
+        memcpy(geneveh->vni, vni, 3);
+        geneveh->proto_type = htons(ETH_P_TEB);
+        geneveh->rsvd2 = 0;
+
+        memcpy(geneveh->options, options, options_len);
+}
+
+/* Transmit a fully formated Geneve frame.
+ *
+ * When calling this function. The skb->data should point
+ * to the geneve header which is fully formed.
+ *
+ * This function will add other UDP tunnel headers.
+ */
+int geneve_xmit_skb(struct geneve_sock *gs, struct rtable *rt,
+                    struct sk_buff *skb, __be32 src, __be32 dst, __u8 tos,
+                    __u8 ttl, __be16 df, __be16 src_port, __be16 dst_port,
+                    __be16 tun_flags, u8 vni[3], u8 opt_len, u8 *opt,
+                    bool xnet)
+{
+        struct genevehdr *gnvh;
+        int min_headroom;
+        int err;
+
+        skb = udp_tunnel_handle_offloads(skb, !gs->sock->sk->sk_no_check_tx);
+
+        min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
+                        + GENEVE_BASE_HLEN + opt_len + sizeof(struct iphdr)
+                        + (vlan_tx_tag_present(skb) ? VLAN_HLEN : 0);
+
+        err = skb_cow_head(skb, min_headroom);
+        if (unlikely(err))
+                return err;
+
+        if (vlan_tx_tag_present(skb)) {
+                if (unlikely(!__vlan_put_tag(skb,
+                                             skb->vlan_proto,
+                                             vlan_tx_tag_get(skb)))) {
+                        err = -ENOMEM;
+                        return err;
+                }
+                skb->vlan_tci = 0;
+        }
+
+        gnvh = (struct genevehdr *)__skb_push(skb, sizeof(*gnvh) + opt_len);
+        geneve_build_header(gnvh, tun_flags, vni, opt_len, opt);
+
+        return udp_tunnel_xmit_skb(gs->sock, rt, skb, src, dst,
+                                   tos, ttl, df, src_port, dst_port, xnet);
+}
+EXPORT_SYMBOL_GPL(geneve_xmit_skb);
+
+static void geneve_notify_add_rx_port(struct geneve_sock *gs)
+{
+        struct sock *sk = gs->sock->sk;
+        sa_family_t sa_family = sk->sk_family;
+        int err;
+
+        if (sa_family == AF_INET) {
+                err = udp_add_offload(&gs->udp_offloads);
+                if (err)
+                        pr_warn("geneve: udp_add_offload failed with status %d\n",
+                                err);
+        }
+}
+
+/* Callback from net/ipv4/udp.c to receive packets */
+static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+{
+        struct genevehdr *geneveh;
+        struct geneve_sock *gs;
+        int opts_len;
+
+        /* Need Geneve and inner Ethernet header to be present */
+        if (unlikely(!pskb_may_pull(skb, GENEVE_BASE_HLEN)))
+                goto error;
+
+        /* Return packets with reserved bits set */
+        geneveh = geneve_hdr(skb);
+
+        if (unlikely(geneveh->ver != GENEVE_VER))
+                goto error;
+
+        if (unlikely(geneveh->proto_type != htons(ETH_P_TEB)))
+                goto error;
+
+        opts_len = geneveh->opt_len * 4;
+        if (iptunnel_pull_header(skb, GENEVE_BASE_HLEN + opts_len,
+                                 htons(ETH_P_TEB)))
+                goto drop;
+
+        gs = rcu_dereference_sk_user_data(sk);
+        if (!gs)
+                goto drop;
+
+        gs->rcv(gs, skb);
+        return 0;
+
+drop:
+        /* Consume bad packet */
+        kfree_skb(skb);
+        return 0;
+
+error:
+        /* Let the UDP layer deal with the skb */
+        return 1;
+}
+
+static void geneve_del_work(struct work_struct *work)
+{
+        struct geneve_sock *gs = container_of(work, struct geneve_sock,
+                                              del_work);
+
+        udp_tunnel_sock_release(gs->sock);
+        kfree_rcu(gs, rcu);
+}
+
+static struct socket *geneve_create_sock(struct net *net, bool ipv6,
+                                         __be16 port)
+{
+        struct socket *sock;
+        struct udp_port_cfg udp_conf;
+        int err;
+
+        memset(&udp_conf, 0, sizeof(udp_conf));
+
+        if (ipv6) {
+                udp_conf.family = AF_INET6;
+        } else {
+                udp_conf.family = AF_INET;
+                udp_conf.local_ip.s_addr = htonl(INADDR_ANY);
+        }
+
+        udp_conf.local_udp_port = port;
+
+        /* Open UDP socket */
+        err = udp_sock_create(net, &udp_conf, &sock);
+        if (err < 0)
+                return ERR_PTR(err);
+
+        return sock;
+}
+
+/* Create new listen socket if needed */
+static struct geneve_sock *geneve_socket_create(struct net *net, __be16 port,
+                                                geneve_rcv_t *rcv, void *data,
+                                                bool ipv6)
+{
+        struct geneve_net *gn = net_generic(net, geneve_net_id);
+        struct geneve_sock *gs;
+        struct socket *sock;
+        struct udp_tunnel_sock_cfg tunnel_cfg;
+
+        gs = kzalloc(sizeof(*gs), GFP_KERNEL);
+        if (!gs)
+                return ERR_PTR(-ENOMEM);
+
+        INIT_WORK(&gs->del_work, geneve_del_work);
+
+        sock = geneve_create_sock(net, ipv6, port);
+        if (IS_ERR(sock)) {
+                kfree(gs);
+                return ERR_CAST(sock);
+        }
+
+        gs->sock = sock;
+        atomic_set(&gs->refcnt, 1);
+        gs->rcv = rcv;
+        gs->rcv_data = data;
+
+        /* Initialize the geneve udp offloads structure */
+        gs->udp_offloads.port = port;
+        gs->udp_offloads.callbacks.gro_receive = NULL;
+        gs->udp_offloads.callbacks.gro_complete = NULL;
+
+        spin_lock(&gn->sock_lock);
+        hlist_add_head_rcu(&gs->hlist, gs_head(net, port));
+        geneve_notify_add_rx_port(gs);
+        spin_unlock(&gn->sock_lock);
+
+        /* Mark socket as an encapsulation socket */
+        tunnel_cfg.sk_user_data = gs;
+        tunnel_cfg.encap_type = 1;
+        tunnel_cfg.encap_rcv = geneve_udp_encap_recv;
+        tunnel_cfg.encap_destroy = NULL;
+        setup_udp_tunnel_sock(net, sock, &tunnel_cfg);
+
+        return gs;
+}
+
+struct geneve_sock *geneve_sock_add(struct net *net, __be16 port,
+                                    geneve_rcv_t *rcv, void *data,
+                                    bool no_share, bool ipv6)
+{
+        struct geneve_sock *gs;
+
+        gs = geneve_socket_create(net, port, rcv, data, ipv6);
+        if (!IS_ERR(gs))
+                return gs;
+
+        if (no_share)   /* Return error if sharing is not allowed. */
+                return ERR_PTR(-EINVAL);
+
+        gs = geneve_find_sock(net, port);
+        if (gs) {
+                if (gs->rcv == rcv)
+                        atomic_inc(&gs->refcnt);
+                else
+                        gs = ERR_PTR(-EBUSY);
+        } else {
+                gs = ERR_PTR(-EINVAL);
+        }
+
+        return gs;
+}
+EXPORT_SYMBOL_GPL(geneve_sock_add);
+
+void geneve_sock_release(struct geneve_sock *gs)
+{
+        if (!atomic_dec_and_test(&gs->refcnt))
+                return;
+
+        queue_work(geneve_wq, &gs->del_work);
+}
+EXPORT_SYMBOL_GPL(geneve_sock_release);
+
+static __net_init int geneve_init_net(struct net *net)
+{
+        struct geneve_net *gn = net_generic(net, geneve_net_id);
+        unsigned int h;
+
+        spin_lock_init(&gn->sock_lock);
+
+        for (h = 0; h < PORT_HASH_SIZE; ++h)
+                INIT_HLIST_HEAD(&gn->sock_list[h]);
+
+        return 0;
+}
+
+static struct pernet_operations geneve_net_ops = {
+        .init = geneve_init_net,
+        .exit = NULL,
+        .id   = &geneve_net_id,
+        .size = sizeof(struct geneve_net),
+};
+
+static int __init geneve_init_module(void)
+{
+        int rc;
+
+        geneve_wq = alloc_workqueue("geneve", 0, 0);
+        if (!geneve_wq)
+                return -ENOMEM;
+
+        rc = register_pernet_subsys(&geneve_net_ops);
+        if (rc)
+                return rc;
+
+        pr_info("Geneve driver\n");
+
+        return 0;
+}
+late_initcall(geneve_init_module);
+
+static void __exit geneve_cleanup_module(void)
+{
+        destroy_workqueue(geneve_wq);
+}
+module_exit(geneve_cleanup_module);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Jesse Gross <jesse@nicira.com>");
+MODULE_DESCRIPTION("Driver for GENEVE encapsulated traffic");
+MODULE_ALIAS_RTNL_LINK("geneve");
diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c
index 0485bf7f8f03..4a7b5b2a1ce3 100644
--- a/net/ipv4/gre_demux.c
+++ b/net/ipv4/gre_demux.c
@@ -98,7 +98,6 @@ EXPORT_SYMBOL_GPL(gre_build_header);
 static int parse_gre_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                             bool *csum_err)
 {
-        unsigned int ip_hlen = ip_hdrlen(skb);
         const struct gre_base_hdr *greh;
         __be32 *options;
         int hdr_len;
@@ -106,7 +105,7 @@ static int parse_gre_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         if (unlikely(!pskb_may_pull(skb, sizeof(struct gre_base_hdr))))
                 return -EINVAL;
 
-        greh = (struct gre_base_hdr *)(skb_network_header(skb) + ip_hlen);
+        greh = (struct gre_base_hdr *)skb_transport_header(skb);
         if (unlikely(greh->flags & (GRE_VERSION | GRE_ROUTING)))
                 return -EINVAL;
 
@@ -116,7 +115,7 @@ static int parse_gre_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
         if (!pskb_may_pull(skb, hdr_len))
                 return -EINVAL;
 
-        greh = (struct gre_base_hdr *)(skb_network_header(skb) + ip_hlen);
+        greh = (struct gre_base_hdr *)skb_transport_header(skb);
         tpi->proto = greh->protocol;
 
         options = (__be32 *)(greh + 1);
@@ -125,6 +124,10 @@ static int parse_gre_header(struct sk_buff *skb, struct tnl_ptk_info *tpi,
                         *csum_err = true;
                         return -EINVAL;
                 }
+
+                skb_checksum_try_convert(skb, IPPROTO_GRE, 0,
+                                         null_compute_pseudo);
+
                 options++;
         }
 
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index 6556263c8fa5..a77729503071 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -15,13 +15,6 @@
 #include <net/protocol.h>
 #include <net/gre.h>
 
-static int gre_gso_send_check(struct sk_buff *skb)
-{
-        if (!skb->encapsulation)
-                return -EINVAL;
-        return 0;
-}
-
 static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
                                        netdev_features_t features)
 {
@@ -46,6 +39,9 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
                                   SKB_GSO_IPIP)))
                 goto out;
 
+        if (!skb->encapsulation)
+                goto out;
+
         if (unlikely(!pskb_may_pull(skb, sizeof(*greh))))
                 goto out;
 
@@ -119,28 +115,6 @@ out:
         return segs;
 }
 
-/* Compute the whole skb csum in s/w and store it, then verify GRO csum
- * starting from gro_offset.
- */
-static __sum16 gro_skb_checksum(struct sk_buff *skb)
-{
-        __sum16 sum;
-
-        skb->csum = skb_checksum(skb, 0, skb->len, 0);
-        NAPI_GRO_CB(skb)->csum = csum_sub(skb->csum,
-                csum_partial(skb->data, skb_gro_offset(skb), 0));
-        sum = csum_fold(NAPI_GRO_CB(skb)->csum);
-        if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE)) {
-                if (unlikely(!sum) && !skb->csum_complete_sw)
-                        netdev_rx_csum_fault(skb->dev);
-        } else {
-                skb->ip_summed = CHECKSUM_COMPLETE;
-                skb->csum_complete_sw = 1;
-        }
-
-        return sum;
-}
-
 static struct sk_buff **gre_gro_receive(struct sk_buff **head,
                                         struct sk_buff *skb)
 {
@@ -192,22 +166,16 @@ static struct sk_buff **gre_gro_receive(struct sk_buff **head,
                 if (unlikely(!greh))
                         goto out_unlock;
         }
-        if (greh->flags & GRE_CSUM) { /* Need to verify GRE csum first */
-                __sum16 csum = 0;
-
-                if (skb->ip_summed == CHECKSUM_COMPLETE)
-                        csum = csum_fold(NAPI_GRO_CB(skb)->csum);
-                /* Don't trust csum error calculated/reported by h/w */
-                if (skb->ip_summed == CHECKSUM_NONE || csum != 0)
-                        csum = gro_skb_checksum(skb);
-
-                /* GRE CSUM is the 1's complement of the 1's complement sum
-                 * of the GRE hdr plus payload so it should add up to 0xffff
-                 * (and 0 after csum_fold()) just like the IPv4 hdr csum.
-                 */
-                if (csum)
+
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if ((greh->flags & GRE_CSUM) && !NAPI_GRO_CB(skb)->flush) {
+                if (skb_gro_checksum_simple_validate(skb))
                         goto out_unlock;
+
+                skb_gro_checksum_try_convert(skb, IPPROTO_GRE, 0,
+                                             null_compute_pseudo);
         }
+
         flush = 0;
 
         for (p = *head; p; p = p->next) {
@@ -284,7 +252,6 @@ static int gre_gro_complete(struct sk_buff *skb, int nhoff)
 
 static const struct net_offload gre_offload = {
         .callbacks = {
-                .gso_send_check = gre_gso_send_check,
                 .gso_segment = gre_gso_segment,
                 .gro_receive = gre_gro_receive,
                 .gro_complete = gre_gro_complete,
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index ea7d4afe8205..5882f584910e 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -231,12 +231,62 @@ static inline void icmp_xmit_unlock(struct sock *sk)
         spin_unlock_bh(&sk->sk_lock.slock);
 }
 
+int sysctl_icmp_msgs_per_sec __read_mostly = 1000;
+int sysctl_icmp_msgs_burst __read_mostly = 50;
+
+static struct {
+        spinlock_t      lock;
+        u32             credit;
+        u32             stamp;
+} icmp_global = {
+        .lock           = __SPIN_LOCK_UNLOCKED(icmp_global.lock),
+};
+
+/**
+ * icmp_global_allow - Are we allowed to send one more ICMP message ?
+ *
+ * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec.
+ * Returns false if we reached the limit and can not send another packet.
+ * Note: called with BH disabled
+ */
+bool icmp_global_allow(void)
+{
+        u32 credit, delta, incr = 0, now = (u32)jiffies;
+        bool rc = false;
+
+        /* Check if token bucket is empty and cannot be refilled
+         * without taking the spinlock.
+         */
+        if (!icmp_global.credit) {
+                delta = min_t(u32, now - icmp_global.stamp, HZ);
+                if (delta < HZ / 50)
+                        return false;
+        }
+
+        spin_lock(&icmp_global.lock);
+        delta = min_t(u32, now - icmp_global.stamp, HZ);
+        if (delta >= HZ / 50) {
+                incr = sysctl_icmp_msgs_per_sec * delta / HZ ;
+                if (incr)
+                        icmp_global.stamp = now;
+        }
+        credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
+        if (credit) {
+                credit--;
+                rc = true;
+        }
+        icmp_global.credit = credit;
+        spin_unlock(&icmp_global.lock);
+        return rc;
+}
+EXPORT_SYMBOL(icmp_global_allow);
+
 /*
  *      Send an ICMP frame.
  */
 
-static inline bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
-                                      struct flowi4 *fl4, int type, int code)
+static bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
+                               struct flowi4 *fl4, int type, int code)
 {
         struct dst_entry *dst = &rt->dst;
         bool rc = true;
@@ -253,8 +303,14 @@ static inline bool icmpv4_xrlim_allow(struct net *net, struct rtable *rt,
                 goto out;
 
         /* Limit if icmp type is enabled in ratemask. */
-        if ((1 << type) & net->ipv4.sysctl_icmp_ratemask) {
-                struct inet_peer *peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, 1);
+        if (!((1 << type) & net->ipv4.sysctl_icmp_ratemask))
+                goto out;
+
+        rc = false;
+        if (icmp_global_allow()) {
+                struct inet_peer *peer;
+
+                peer = inet_getpeer_v4(net->ipv4.peers, fl4->daddr, 1);
                 rc = inet_peer_xrlim_allow(peer,
                                            net->ipv4.sysctl_icmp_ratelimit);
                 if (peer)
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index f10eab462282..fb70e3ecc3e4 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -117,7 +117,7 @@
 #define IGMP_V2_Unsolicited_Report_Interval     (10*HZ)
 #define IGMP_V3_Unsolicited_Report_Interval     (1*HZ)
 #define IGMP_Query_Response_Interval            (10*HZ)
-#define IGMP_Unsolicited_Report_Count           2
+#define IGMP_Query_Robustness_Variable          2
 
 
 #define IGMP_Initial_Report_Delay               (1)
@@ -756,8 +756,7 @@ static void igmp_ifc_event(struct in_device *in_dev)
 {
         if (IGMP_V1_SEEN(in_dev) || IGMP_V2_SEEN(in_dev))
                 return;
-        in_dev->mr_ifc_count = in_dev->mr_qrv ? in_dev->mr_qrv :
-                IGMP_Unsolicited_Report_Count;
+        in_dev->mr_ifc_count = in_dev->mr_qrv ?: sysctl_igmp_qrv;
         igmp_ifc_start_timer(in_dev, 1);
 }
 
@@ -932,7 +931,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                         in_dev->mr_qrv = ih3->qrv;
                 if (!group) { /* general query */
                         if (ih3->nsrcs)
-                                return false;   /* no sources allowed */
+                                return true;    /* no sources allowed */
                         igmp_gq_start_timer(in_dev);
                         return false;
                 }
@@ -1086,8 +1085,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im)
         pmc->interface = im->interface;
         in_dev_hold(in_dev);
         pmc->multiaddr = im->multiaddr;
-        pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
-                IGMP_Unsolicited_Report_Count;
+        pmc->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
         pmc->sfmode = im->sfmode;
         if (pmc->sfmode == MCAST_INCLUDE) {
                 struct ip_sf_list *psf;
@@ -1226,8 +1224,7 @@ static void igmp_group_added(struct ip_mc_list *im)
         }
         /* else, v3 */
 
-        im->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
-                IGMP_Unsolicited_Report_Count;
+        im->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
         igmp_ifc_event(in_dev);
 #endif
 }
@@ -1322,7 +1319,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
         spin_lock_init(&im->lock);
 #ifdef CONFIG_IP_MULTICAST
         setup_timer(&im->timer, igmp_timer_expire, (unsigned long)im);
-        im->unsolicit_count = IGMP_Unsolicited_Report_Count;
+        im->unsolicit_count = sysctl_igmp_qrv;
 #endif
 
         im->next_rcu = in_dev->mc_list;
@@ -1460,7 +1457,7 @@ void ip_mc_init_dev(struct in_device *in_dev)
                         (unsigned long)in_dev);
         setup_timer(&in_dev->mr_ifc_timer, igmp_ifc_timer_expire,
                         (unsigned long)in_dev);
-        in_dev->mr_qrv = IGMP_Unsolicited_Report_Count;
+        in_dev->mr_qrv = sysctl_igmp_qrv;
 #endif
 
         spin_lock_init(&in_dev->mc_tomb_lock);
@@ -1474,6 +1471,9 @@ void ip_mc_up(struct in_device *in_dev)
 
         ASSERT_RTNL();
 
+#ifdef CONFIG_IP_MULTICAST
+        in_dev->mr_qrv = sysctl_igmp_qrv;
+#endif
         ip_mc_inc_group(in_dev, IGMP_ALL_HOSTS);
 
         for_each_pmc_rtnl(in_dev, pmc)
@@ -1540,7 +1540,9 @@ static struct in_device *ip_mc_find_dev(struct net *net, struct ip_mreqn *imr)
  */
 int sysctl_igmp_max_memberships __read_mostly = IP_MAX_MEMBERSHIPS;
 int sysctl_igmp_max_msf __read_mostly = IP_MAX_MSF;
-
+#ifdef CONFIG_IP_MULTICAST
+int sysctl_igmp_qrv __read_mostly = IGMP_Query_Robustness_Variable;
+#endif
 
 static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
         __be32 *psfsrc)
@@ -1575,8 +1577,7 @@ static int ip_mc_del1_src(struct ip_mc_list *pmc, int sfmode,
 #ifdef CONFIG_IP_MULTICAST
                 if (psf->sf_oldin &&
                     !IGMP_V1_SEEN(in_dev) && !IGMP_V2_SEEN(in_dev)) {
-                        psf->sf_crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
-                                IGMP_Unsolicited_Report_Count;
+                        psf->sf_crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
                         psf->sf_next = pmc->tomb;
                         pmc->tomb = psf;
                         rv = 1;
@@ -1639,8 +1640,7 @@ static int ip_mc_del_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
                 /* filter mode change */
                 pmc->sfmode = MCAST_INCLUDE;
 #ifdef CONFIG_IP_MULTICAST
-                pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
-                        IGMP_Unsolicited_Report_Count;
+                pmc->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
                 in_dev->mr_ifc_count = pmc->crcount;
                 for (psf = pmc->sources; psf; psf = psf->sf_next)
                         psf->sf_crcount = 0;
@@ -1818,8 +1818,7 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode,
 #ifdef CONFIG_IP_MULTICAST
                 /* else no filters; keep old mode for reports */
 
-                pmc->crcount = in_dev->mr_qrv ? in_dev->mr_qrv :
-                        IGMP_Unsolicited_Report_Count;
+                pmc->crcount = in_dev->mr_qrv ?: sysctl_igmp_qrv;
                 in_dev->mr_ifc_count = pmc->crcount;
                 for (psf = pmc->sources; psf; psf = psf->sf_next)
                         psf->sf_crcount = 0;
@@ -2539,7 +2538,7 @@ static int igmp_mc_seq_show(struct seq_file *seq, void *v)
                 querier = "NONE";
 #endif
 
-                if (rcu_dereference(state->in_dev->mc_list) == im) {
+                if (rcu_access_pointer(state->in_dev->mc_list) == im) {
                         seq_printf(seq, "%d\t%-10s: %5d %7s\n",
                                    state->dev->ifindex, state->dev->name, state->in_dev->mc_count, querier);
                 }
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 43116e8c8e13..9111a4e22155 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -229,7 +229,7 @@ begin:
                         }
                 } else if (score == hiscore && reuseport) {
                         matches++;
-                        if (((u64)phash * matches) >> 32 == 0)
+                        if (reciprocal_scale(phash, matches) == 0)
                                 result = sk;
                         phash = next_pseudo_random32(phash);
                 }
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index bd5f5928167d..241afd743d2c 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -72,29 +72,10 @@ void inet_peer_base_init(struct inet_peer_base *bp)
 {
         bp->root = peer_avl_empty_rcu;
         seqlock_init(&bp->lock);
-        bp->flush_seq = ~0U;
         bp->total = 0;
 }
 EXPORT_SYMBOL_GPL(inet_peer_base_init);
 
-static atomic_t v4_seq = ATOMIC_INIT(0);
-static atomic_t v6_seq = ATOMIC_INIT(0);
-
-static atomic_t *inetpeer_seq_ptr(int family)
-{
-        return (family == AF_INET ? &v4_seq : &v6_seq);
-}
-
-static inline void flush_check(struct inet_peer_base *base, int family)
-{
-        atomic_t *fp = inetpeer_seq_ptr(family);
-
-        if (unlikely(base->flush_seq != atomic_read(fp))) {
-                inetpeer_invalidate_tree(base);
-                base->flush_seq = atomic_read(fp);
-        }
-}
-
 #define PEER_MAXDEPTH 40 /* sufficient for about 2^27 nodes */
 
 /* Exported for sysctl_net_ipv4.  */
@@ -444,8 +425,6 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base,
         unsigned int sequence;
         int invalidated, gccnt = 0;
 
-        flush_check(base, daddr->family);
-
         /* Attempt a lockless lookup first.
          * Because of a concurrent writer, we might not find an existing entry.
          */
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 15f0e2bad7ad..2811cc18701a 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -790,7 +790,7 @@ static void __net_exit ip4_frags_ns_ctl_unregister(struct net *net)
         kfree(table);
 }
 
-static void ip4_frags_ctl_register(void)
+static void __init ip4_frags_ctl_register(void)
 {
         register_net_sysctl(&init_net, "net/ipv4", ip4_frags_ctl_table);
 }
@@ -804,7 +804,7 @@ static inline void ip4_frags_ns_ctl_unregister(struct net *net)
 {
 }
 
-static inline void ip4_frags_ctl_register(void)
+static inline void __init ip4_frags_ctl_register(void)
 {
 }
 #endif
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 9b842544aea3..12055fdbe716 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -239,7 +239,9 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
         tpi.seq = htonl(tunnel->o_seqno);
 
         /* Push GRE header. */
-        gre_build_header(skb, &tpi, tunnel->hlen);
+        gre_build_header(skb, &tpi, tunnel->tun_hlen);
+
+        skb_set_inner_protocol(skb, tpi.proto);
 
         ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol);
 }
@@ -310,7 +312,7 @@ out:
 static int ipgre_tunnel_ioctl(struct net_device *dev,
                               struct ifreq *ifr, int cmd)
 {
-        int err = 0;
+        int err;
         struct ip_tunnel_parm p;
 
         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
@@ -470,13 +472,18 @@ static void ipgre_tunnel_setup(struct net_device *dev)
 static void __gre_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel;
+        int t_hlen;
 
         tunnel = netdev_priv(dev);
-        tunnel->hlen = ip_gre_calc_hlen(tunnel->parms.o_flags);
+        tunnel->tun_hlen = ip_gre_calc_hlen(tunnel->parms.o_flags);
         tunnel->parms.iph.protocol = IPPROTO_GRE;
 
-        dev->needed_headroom    = LL_MAX_HEADER + sizeof(struct iphdr) + 4;
-        dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr) - 4;
+        tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
+
+        t_hlen = tunnel->hlen + sizeof(struct iphdr);
+
+        dev->needed_headroom    = LL_MAX_HEADER + t_hlen + 4;
+        dev->mtu                = ETH_DATA_LEN - t_hlen - 4;
 
         dev->features           |= GRE_FEATURES;
         dev->hw_features        |= GRE_FEATURES;
@@ -503,7 +510,7 @@ static int ipgre_tunnel_init(struct net_device *dev)
         memcpy(dev->broadcast, &iph->daddr, 4);
 
         dev->flags              = IFF_NOARP;
-        dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
+        netif_keep_dst(dev);
         dev->addr_len           = 4;
 
         if (iph->daddr) {
@@ -628,6 +635,40 @@ static void ipgre_netlink_parms(struct nlattr *data[], struct nlattr *tb[],
                 parms->iph.frag_off = htons(IP_DF);
 }
 
+/* This function returns true when ENCAP attributes are present in the nl msg */
+static bool ipgre_netlink_encap_parms(struct nlattr *data[],
+                                      struct ip_tunnel_encap *ipencap)
+{
+        bool ret = false;
+
+        memset(ipencap, 0, sizeof(*ipencap));
+
+        if (!data)
+                return ret;
+
+        if (data[IFLA_GRE_ENCAP_TYPE]) {
+                ret = true;
+                ipencap->type = nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]);
+        }
+
+        if (data[IFLA_GRE_ENCAP_FLAGS]) {
+                ret = true;
+                ipencap->flags = nla_get_u16(data[IFLA_GRE_ENCAP_FLAGS]);
+        }
+
+        if (data[IFLA_GRE_ENCAP_SPORT]) {
+                ret = true;
+                ipencap->sport = nla_get_u16(data[IFLA_GRE_ENCAP_SPORT]);
+        }
+
+        if (data[IFLA_GRE_ENCAP_DPORT]) {
+                ret = true;
+                ipencap->dport = nla_get_u16(data[IFLA_GRE_ENCAP_DPORT]);
+        }
+
+        return ret;
+}
+
 static int gre_tap_init(struct net_device *dev)
 {
         __gre_tunnel_init(dev);
@@ -657,6 +698,15 @@ static int ipgre_newlink(struct net *src_net, struct net_device *dev,
                          struct nlattr *tb[], struct nlattr *data[])
 {
         struct ip_tunnel_parm p;
+        struct ip_tunnel_encap ipencap;
+
+        if (ipgre_netlink_encap_parms(data, &ipencap)) {
+                struct ip_tunnel *t = netdev_priv(dev);
+                int err = ip_tunnel_encap_setup(t, &ipencap);
+
+                if (err < 0)
+                        return err;
+        }
 
         ipgre_netlink_parms(data, tb, &p);
         return ip_tunnel_newlink(dev, tb, &p);
@@ -666,6 +716,15 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
                             struct nlattr *data[])
 {
         struct ip_tunnel_parm p;
+        struct ip_tunnel_encap ipencap;
+
+        if (ipgre_netlink_encap_parms(data, &ipencap)) {
+                struct ip_tunnel *t = netdev_priv(dev);
+                int err = ip_tunnel_encap_setup(t, &ipencap);
+
+                if (err < 0)
+                        return err;
+        }
 
         ipgre_netlink_parms(data, tb, &p);
         return ip_tunnel_changelink(dev, tb, &p);
@@ -694,6 +753,14 @@ static size_t ipgre_get_size(const struct net_device *dev)
                 nla_total_size(1) +
                 /* IFLA_GRE_PMTUDISC */
                 nla_total_size(1) +
+                /* IFLA_GRE_ENCAP_TYPE */
+                nla_total_size(2) +
+                /* IFLA_GRE_ENCAP_FLAGS */
+                nla_total_size(2) +
+                /* IFLA_GRE_ENCAP_SPORT */
+                nla_total_size(2) +
+                /* IFLA_GRE_ENCAP_DPORT */
+                nla_total_size(2) +
                 0;
 }
 
@@ -714,6 +781,17 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
             nla_put_u8(skb, IFLA_GRE_PMTUDISC,
                        !!(p->iph.frag_off & htons(IP_DF))))
                 goto nla_put_failure;
+
+        if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE,
+                        t->encap.type) ||
+            nla_put_u16(skb, IFLA_GRE_ENCAP_SPORT,
+                        t->encap.sport) ||
+            nla_put_u16(skb, IFLA_GRE_ENCAP_DPORT,
+                        t->encap.dport) ||
+            nla_put_u16(skb, IFLA_GRE_ENCAP_FLAGS,
+                        t->encap.dport))
+                goto nla_put_failure;
+
         return 0;
 
 nla_put_failure:
@@ -731,6 +809,10 @@ static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = {
         [IFLA_GRE_TTL]          = { .type = NLA_U8 },
         [IFLA_GRE_TOS]          = { .type = NLA_U8 },
         [IFLA_GRE_PMTUDISC]     = { .type = NLA_U8 },
+        [IFLA_GRE_ENCAP_TYPE]   = { .type = NLA_U16 },
+        [IFLA_GRE_ENCAP_FLAGS]  = { .type = NLA_U16 },
+        [IFLA_GRE_ENCAP_SPORT]  = { .type = NLA_U16 },
+        [IFLA_GRE_ENCAP_DPORT]  = { .type = NLA_U16 },
 };
 
 static struct rtnl_link_ops ipgre_link_ops __read_mostly = {
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index ad382499bace..5b3d91be2db0 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -87,17 +87,15 @@ void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
  * NOTE: dopt cannot point to skb.
  */
 
-int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
+int __ip_options_echo(struct ip_options *dopt, struct sk_buff *skb,
+                      const struct ip_options *sopt)
 {
-        const struct ip_options *sopt;
         unsigned char *sptr, *dptr;
         int soffset, doffset;
         int     optlen;
 
         memset(dopt, 0, sizeof(struct ip_options));
 
-        sopt = &(IPCB(skb)->opt);
-
         if (sopt->optlen == 0)
                 return 0;
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 215af2b155cb..e35b71289156 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -516,7 +516,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
         hlen = iph->ihl * 4;
         mtu = mtu - hlen;       /* Size of data space */
-#ifdef CONFIG_BRIDGE_NETFILTER
+#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
         if (skb->nf_bridge)
                 mtu -= nf_bridge_mtu_reduction(skb);
 #endif
@@ -1522,8 +1522,10 @@ static DEFINE_PER_CPU(struct inet_sock, unicast_sock) = {
         .uc_ttl         = -1,
 };
 
-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
-                           __be32 saddr, const struct ip_reply_arg *arg,
+void ip_send_unicast_reply(struct net *net, struct sk_buff *skb,
+                           const struct ip_options *sopt,
+                           __be32 daddr, __be32 saddr,
+                           const struct ip_reply_arg *arg,
                            unsigned int len)
 {
         struct ip_options_data replyopts;
@@ -1534,7 +1536,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
         struct sock *sk;
         struct inet_sock *inet;
 
-        if (ip_options_echo(&replyopts.opt.opt, skb))
+        if (__ip_options_echo(&replyopts.opt.opt, skb, sopt))
                 return;
 
         ipc.addr = daddr;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 5cb830c78990..c373a9ad4555 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -303,7 +303,7 @@ int ip_ra_control(struct sock *sk, unsigned char on,
                         }
                         /* dont let ip_call_ra_chain() use sk again */
                         ra->sk = NULL;
-                        rcu_assign_pointer(*rap, ra->next);
+                        RCU_INIT_POINTER(*rap, ra->next);
                         spin_unlock_bh(&ip_ra_lock);
 
                         if (ra->destructor)
@@ -325,7 +325,7 @@ int ip_ra_control(struct sock *sk, unsigned char on,
         new_ra->sk = sk;
         new_ra->destructor = destructor;
 
-        new_ra->next = ra;
+        RCU_INIT_POINTER(new_ra->next, ra);
         rcu_assign_pointer(*rap, new_ra);
         sock_hold(sk);
         spin_unlock_bh(&ip_ra_lock);
@@ -405,7 +405,7 @@ void ip_local_error(struct sock *sk, int err, __be32 daddr, __be16 port, u32 inf
 int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
 {
         struct sock_exterr_skb *serr;
-        struct sk_buff *skb, *skb2;
+        struct sk_buff *skb;
         DECLARE_SOCKADDR(struct sockaddr_in *, sin, msg->msg_name);
         struct {
                 struct sock_extended_err ee;
@@ -415,7 +415,7 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
         int copied;
 
         err = -EAGAIN;
-        skb = skb_dequeue(&sk->sk_error_queue);
+        skb = sock_dequeue_err_skb(sk);
         if (skb == NULL)
                 goto out;
 
@@ -462,17 +462,6 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
         msg->msg_flags |= MSG_ERRQUEUE;
         err = copied;
 
-        /* Reset and regenerate socket error */
-        spin_lock_bh(&sk->sk_error_queue.lock);
-        sk->sk_err = 0;
-        skb2 = skb_peek(&sk->sk_error_queue);
-        if (skb2 != NULL) {
-                sk->sk_err = SKB_EXT_ERR(skb2)->ee.ee_errno;
-                spin_unlock_bh(&sk->sk_error_queue.lock);
-                sk->sk_error_report(sk);
-        } else
-                spin_unlock_bh(&sk->sk_error_queue.lock);
-
 out_free_skb:
         kfree_skb(skb);
 out:
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index bda4bb8ae260..0bb8e141eacc 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -55,6 +55,8 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
+#include <net/udp.h>
+#include <net/gue.h>
 
 #if IS_ENABLED(CONFIG_IPV6)
 #include <net/ipv6.h>
@@ -487,6 +489,103 @@ drop:
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_rcv);
 
+static int ip_encap_hlen(struct ip_tunnel_encap *e)
+{
+        switch (e->type) {
+        case TUNNEL_ENCAP_NONE:
+                return 0;
+        case TUNNEL_ENCAP_FOU:
+                return sizeof(struct udphdr);
+        case TUNNEL_ENCAP_GUE:
+                return sizeof(struct udphdr) + sizeof(struct guehdr);
+        default:
+                return -EINVAL;
+        }
+}
+
+int ip_tunnel_encap_setup(struct ip_tunnel *t,
+                          struct ip_tunnel_encap *ipencap)
+{
+        int hlen;
+
+        memset(&t->encap, 0, sizeof(t->encap));
+
+        hlen = ip_encap_hlen(ipencap);
+        if (hlen < 0)
+                return hlen;
+
+        t->encap.type = ipencap->type;
+        t->encap.sport = ipencap->sport;
+        t->encap.dport = ipencap->dport;
+        t->encap.flags = ipencap->flags;
+
+        t->encap_hlen = hlen;
+        t->hlen = t->encap_hlen + t->tun_hlen;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(ip_tunnel_encap_setup);
+
+static int fou_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,
+                            size_t hdr_len, u8 *protocol, struct flowi4 *fl4)
+{
+        struct udphdr *uh;
+        __be16 sport;
+        bool csum = !!(e->flags & TUNNEL_ENCAP_FLAG_CSUM);
+        int type = csum ? SKB_GSO_UDP_TUNNEL_CSUM : SKB_GSO_UDP_TUNNEL;
+
+        skb = iptunnel_handle_offloads(skb, csum, type);
+
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        /* Get length and hash before making space in skb */
+
+        sport = e->sport ? : udp_flow_src_port(dev_net(skb->dev),
+                                               skb, 0, 0, false);
+
+        skb_push(skb, hdr_len);
+
+        skb_reset_transport_header(skb);
+        uh = udp_hdr(skb);
+
+        if (e->type == TUNNEL_ENCAP_GUE) {
+                struct guehdr *guehdr = (struct guehdr *)&uh[1];
+
+                guehdr->version = 0;
+                guehdr->hlen = 0;
+                guehdr->flags = 0;
+                guehdr->next_hdr = *protocol;
+        }
+
+        uh->dest = e->dport;
+        uh->source = sport;
+        uh->len = htons(skb->len);
+        uh->check = 0;
+        udp_set_csum(!(e->flags & TUNNEL_ENCAP_FLAG_CSUM), skb,
+                     fl4->saddr, fl4->daddr, skb->len);
+
+        *protocol = IPPROTO_UDP;
+
+        return 0;
+}
+
+int ip_tunnel_encap(struct sk_buff *skb, struct ip_tunnel *t,
+                    u8 *protocol, struct flowi4 *fl4)
+{
+        switch (t->encap.type) {
+        case TUNNEL_ENCAP_NONE:
+                return 0;
+        case TUNNEL_ENCAP_FOU:
+        case TUNNEL_ENCAP_GUE:
+                return fou_build_header(skb, &t->encap, t->encap_hlen,
+                                        protocol, fl4);
+        default:
+                return -EINVAL;
+        }
+}
+EXPORT_SYMBOL(ip_tunnel_encap);
+
 static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
                             struct rtable *rt, __be16 df)
 {
@@ -536,7 +635,7 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb,
 }
 
 void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
-                    const struct iphdr *tnl_params, const u8 protocol)
+                    const struct iphdr *tnl_params, u8 protocol)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         const struct iphdr *inner_iph;
@@ -617,6 +716,9 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
         init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
                          tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link);
 
+        if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0)
+                goto tx_error;
+
         rt = connected ? tunnel_rtable_get(tunnel, 0, &fl4.saddr) : NULL;
 
         if (!rt) {
@@ -670,7 +772,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                 df |= (inner_iph->frag_off&htons(IP_DF));
 
         max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
-                        + rt->dst.header_len;
+                        + rt->dst.header_len + ip_encap_hlen(&tunnel->encap);
         if (max_headroom > dev->needed_headroom)
                 dev->needed_headroom = max_headroom;
 
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index e453cb724a95..3e861011e4a3 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -364,7 +364,7 @@ static int vti_tunnel_init(struct net_device *dev)
         dev->iflink             = 0;
         dev->addr_len           = 4;
         dev->features           |= NETIF_F_LLTX;
-        dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
+        netif_keep_dst(dev);
 
         return ip_tunnel_init(dev);
 }
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 5bbef4fdcb43..648fa1490ea7 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -262,7 +262,8 @@ static int __init ic_open_devs(void)
         /* wait for a carrier on at least one device */
         start = jiffies;
         next_msg = start + msecs_to_jiffies(CONF_CARRIER_TIMEOUT/12);
-        while (jiffies - start < msecs_to_jiffies(CONF_CARRIER_TIMEOUT)) {
+        while (time_before(jiffies, start +
+                           msecs_to_jiffies(CONF_CARRIER_TIMEOUT))) {
                 int wait, elapsed;
 
                 for_each_netdev(&init_net, dev)
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 62eaa005e146..37096d64730e 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -224,6 +224,8 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         if (IS_ERR(skb))
                 goto out;
 
+        skb_set_inner_ipproto(skb, IPPROTO_IPIP);
+
         ip_tunnel_xmit(skb, dev, tiph, tiph->protocol);
         return NETDEV_TX_OK;
 
@@ -287,7 +289,7 @@ static void ipip_tunnel_setup(struct net_device *dev)
         dev->iflink             = 0;
         dev->addr_len           = 4;
         dev->features           |= NETIF_F_LLTX;
-        dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
+        netif_keep_dst(dev);
 
         dev->features           |= IPIP_FEATURES;
         dev->hw_features        |= IPIP_FEATURES;
@@ -301,7 +303,8 @@ static int ipip_tunnel_init(struct net_device *dev)
         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
 
-        tunnel->hlen = 0;
+        tunnel->tun_hlen = 0;
+        tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
         tunnel->parms.iph.protocol = IPPROTO_IPIP;
         return ip_tunnel_init(dev);
 }
@@ -340,10 +343,53 @@ static void ipip_netlink_parms(struct nlattr *data[],
                 parms->iph.frag_off = htons(IP_DF);
 }
 
+/* This function returns true when ENCAP attributes are present in the nl msg */
+static bool ipip_netlink_encap_parms(struct nlattr *data[],
+                                     struct ip_tunnel_encap *ipencap)
+{
+        bool ret = false;
+
+        memset(ipencap, 0, sizeof(*ipencap));
+
+        if (!data)
+                return ret;
+
+        if (data[IFLA_IPTUN_ENCAP_TYPE]) {
+                ret = true;
+                ipencap->type = nla_get_u16(data[IFLA_IPTUN_ENCAP_TYPE]);
+        }
+
+        if (data[IFLA_IPTUN_ENCAP_FLAGS]) {
+                ret = true;
+                ipencap->flags = nla_get_u16(data[IFLA_IPTUN_ENCAP_FLAGS]);
+        }
+
+        if (data[IFLA_IPTUN_ENCAP_SPORT]) {
+                ret = true;
+                ipencap->sport = nla_get_u16(data[IFLA_IPTUN_ENCAP_SPORT]);
+        }
+
+        if (data[IFLA_IPTUN_ENCAP_DPORT]) {
+                ret = true;
+                ipencap->dport = nla_get_u16(data[IFLA_IPTUN_ENCAP_DPORT]);
+        }
+
+        return ret;
+}
+
 static int ipip_newlink(struct net *src_net, struct net_device *dev,
                         struct nlattr *tb[], struct nlattr *data[])
 {
         struct ip_tunnel_parm p;
+        struct ip_tunnel_encap ipencap;
+
+        if (ipip_netlink_encap_parms(data, &ipencap)) {
+                struct ip_tunnel *t = netdev_priv(dev);
+                int err = ip_tunnel_encap_setup(t, &ipencap);
+
+                if (err < 0)
+                        return err;
+        }
 
         ipip_netlink_parms(data, &p);
         return ip_tunnel_newlink(dev, tb, &p);
@@ -353,6 +399,15 @@ static int ipip_changelink(struct net_device *dev, struct nlattr *tb[],
                            struct nlattr *data[])
 {
         struct ip_tunnel_parm p;
+        struct ip_tunnel_encap ipencap;
+
+        if (ipip_netlink_encap_parms(data, &ipencap)) {
+                struct ip_tunnel *t = netdev_priv(dev);
+                int err = ip_tunnel_encap_setup(t, &ipencap);
+
+                if (err < 0)
+                        return err;
+        }
 
         ipip_netlink_parms(data, &p);
 
@@ -378,6 +433,14 @@ static size_t ipip_get_size(const struct net_device *dev)
                 nla_total_size(1) +
                 /* IFLA_IPTUN_PMTUDISC */
                 nla_total_size(1) +
+                /* IFLA_IPTUN_ENCAP_TYPE */
+                nla_total_size(2) +
+                /* IFLA_IPTUN_ENCAP_FLAGS */
+                nla_total_size(2) +
+                /* IFLA_IPTUN_ENCAP_SPORT */
+                nla_total_size(2) +
+                /* IFLA_IPTUN_ENCAP_DPORT */
+                nla_total_size(2) +
                 0;
 }
 
@@ -394,6 +457,17 @@ static int ipip_fill_info(struct sk_buff *skb, const struct net_device *dev)
             nla_put_u8(skb, IFLA_IPTUN_PMTUDISC,
                        !!(parm->iph.frag_off & htons(IP_DF))))
                 goto nla_put_failure;
+
+        if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE,
+                        tunnel->encap.type) ||
+            nla_put_u16(skb, IFLA_IPTUN_ENCAP_SPORT,
+                        tunnel->encap.sport) ||
+            nla_put_u16(skb, IFLA_IPTUN_ENCAP_DPORT,
+                        tunnel->encap.dport) ||
+            nla_put_u16(skb, IFLA_IPTUN_ENCAP_FLAGS,
+                        tunnel->encap.dport))
+                goto nla_put_failure;
+
         return 0;
 
 nla_put_failure:
@@ -407,6 +481,10 @@ static const struct nla_policy ipip_policy[IFLA_IPTUN_MAX + 1] = {
         [IFLA_IPTUN_TTL]                = { .type = NLA_U8 },
         [IFLA_IPTUN_TOS]                = { .type = NLA_U8 },
         [IFLA_IPTUN_PMTUDISC]           = { .type = NLA_U8 },
+        [IFLA_IPTUN_ENCAP_TYPE]         = { .type = NLA_U16 },
+        [IFLA_IPTUN_ENCAP_FLAGS]        = { .type = NLA_U16 },
+        [IFLA_IPTUN_ENCAP_SPORT]        = { .type = NLA_U16 },
+        [IFLA_IPTUN_ENCAP_DPORT]        = { .type = NLA_U16 },
 };
 
 static struct rtnl_link_ops ipip_link_ops __read_mostly = {
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 7cbcaf4f0194..4c019d5c3f57 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -61,18 +61,13 @@ config NFT_CHAIN_ROUTE_IPV4
           fields such as the source, destination, type of service and
           the packet mark.
 
-config NFT_CHAIN_NAT_IPV4
-        depends on NF_TABLES_IPV4
-        depends on NF_NAT_IPV4 && NFT_NAT
-        tristate "IPv4 nf_tables nat chain support"
-        help
-          This option enables the "nat" chain for IPv4 in nf_tables. This
-          chain type is used to perform Network Address Translation (NAT)
-          packet transformations such as the source, destination address and
-          source and destination ports.
+config NF_REJECT_IPV4
+        tristate "IPv4 packet rejection"
+        default m if NETFILTER_ADVANCED=n
 
 config NFT_REJECT_IPV4
         depends on NF_TABLES_IPV4
+        select NF_REJECT_IPV4
         default NFT_REJECT
         tristate
 
@@ -94,6 +89,30 @@ config NF_NAT_IPV4
 
 if NF_NAT_IPV4
 
+config NFT_CHAIN_NAT_IPV4
+        depends on NF_TABLES_IPV4
+        tristate "IPv4 nf_tables nat chain support"
+        help
+          This option enables the "nat" chain for IPv4 in nf_tables. This
+          chain type is used to perform Network Address Translation (NAT)
+          packet transformations such as the source, destination address and
+          source and destination ports.
+
+config NF_NAT_MASQUERADE_IPV4
+        tristate "IPv4 masquerade support"
+        help
+          This is the kernel functionality to provide NAT in the masquerade
+          flavour (automatic source address selection).
+
+config NFT_MASQ_IPV4
+        tristate "IPv4 masquerading support for nf_tables"
+        depends on NF_TABLES_IPV4
+        depends on NFT_MASQ
+        select NF_NAT_MASQUERADE_IPV4
+        help
+          This is the expression that provides IPv4 masquerading support for
+          nf_tables.
+
 config NF_NAT_SNMP_BASIC
         tristate "Basic SNMP-ALG support"
         depends on NF_CONNTRACK_SNMP
@@ -194,6 +213,7 @@ config IP_NF_FILTER
 config IP_NF_TARGET_REJECT
         tristate "REJECT target support"
         depends on IP_NF_FILTER
+        select NF_REJECT_IPV4
         default m if NETFILTER_ADVANCED=n
         help
           The REJECT target allows a filtering rule to specify that an ICMP
@@ -234,6 +254,7 @@ if IP_NF_NAT
 
 config IP_NF_TARGET_MASQUERADE
         tristate "MASQUERADE target support"
+        select NF_NAT_MASQUERADE_IPV4
         default m if NETFILTER_ADVANCED=n
         help
           Masquerading is a special case of NAT: all outgoing connections are
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index edf4af32e9f2..f4cef5af0969 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -23,10 +23,14 @@ obj-$(CONFIG_NF_DEFRAG_IPV4) += nf_defrag_ipv4.o
 obj-$(CONFIG_NF_LOG_ARP) += nf_log_arp.o
 obj-$(CONFIG_NF_LOG_IPV4) += nf_log_ipv4.o
 
+# reject
+obj-$(CONFIG_NF_REJECT_IPV4) += nf_reject_ipv4.o
+
 # NAT helpers (nf_conntrack)
 obj-$(CONFIG_NF_NAT_H323) += nf_nat_h323.o
 obj-$(CONFIG_NF_NAT_PPTP) += nf_nat_pptp.o
 obj-$(CONFIG_NF_NAT_SNMP_BASIC) += nf_nat_snmp_basic.o
+obj-$(CONFIG_NF_NAT_MASQUERADE_IPV4) += nf_nat_masquerade_ipv4.o
 
 # NAT protocols (nf_nat)
 obj-$(CONFIG_NF_NAT_PROTO_GRE) += nf_nat_proto_gre.o
@@ -35,6 +39,7 @@ obj-$(CONFIG_NF_TABLES_IPV4) += nf_tables_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_ROUTE_IPV4) += nft_chain_route_ipv4.o
 obj-$(CONFIG_NFT_CHAIN_NAT_IPV4) += nft_chain_nat_ipv4.o
 obj-$(CONFIG_NFT_REJECT_IPV4) += nft_reject_ipv4.o
+obj-$(CONFIG_NFT_MASQ_IPV4) += nft_masq_ipv4.o
 obj-$(CONFIG_NF_TABLES_ARP) += nf_tables_arp.o
 
 # generic IP tables 
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 2510c02c2d21..e90f83a3415b 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -285,7 +285,7 @@ clusterip_hashfn(const struct sk_buff *skb,
         }
 
         /* node numbers are 1..n, not 0..n */
-        return (((u64)hashval * config->num_total_nodes) >> 32) + 1;
+        return reciprocal_scale(hashval, config->num_total_nodes) + 1;
 }
 
 static inline int
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 00352ce0f0de..da7f02a0b868 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -22,6 +22,7 @@
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/x_tables.h>
 #include <net/netfilter/nf_nat.h>
+#include <net/netfilter/ipv4/nf_nat_masquerade.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -46,103 +47,17 @@ static int masquerade_tg_check(const struct xt_tgchk_param *par)
 static unsigned int
 masquerade_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        struct nf_conn *ct;
-        struct nf_conn_nat *nat;
-        enum ip_conntrack_info ctinfo;
-        struct nf_nat_range newrange;
+        struct nf_nat_range range;
         const struct nf_nat_ipv4_multi_range_compat *mr;
-        const struct rtable *rt;
-        __be32 newsrc, nh;
-
-        NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING);
-
-        ct = nf_ct_get(skb, &ctinfo);
-        nat = nfct_nat(ct);
-
-        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
-                            ctinfo == IP_CT_RELATED_REPLY));
-
-        /* Source address is 0.0.0.0 - locally generated packet that is
-         * probably not supposed to be masqueraded.
-         */
-        if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip == 0)
-                return NF_ACCEPT;
 
         mr = par->targinfo;
-        rt = skb_rtable(skb);
-        nh = rt_nexthop(rt, ip_hdr(skb)->daddr);
-        newsrc = inet_select_addr(par->out, nh, RT_SCOPE_UNIVERSE);
-        if (!newsrc) {
-                pr_info("%s ate my IP address\n", par->out->name);
-                return NF_DROP;
-        }
-
-        nat->masq_index = par->out->ifindex;
-
-        /* Transfer from original range. */
-        memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
-        memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
-        newrange.flags       = mr->range[0].flags | NF_NAT_RANGE_MAP_IPS;
-        newrange.min_addr.ip = newsrc;
-        newrange.max_addr.ip = newsrc;
-        newrange.min_proto   = mr->range[0].min;
-        newrange.max_proto   = mr->range[0].max;
+        range.flags = mr->range[0].flags;
+        range.min_proto = mr->range[0].min;
+        range.max_proto = mr->range[0].max;
 
-        /* Hand modified range to generic setup. */
-        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_SRC);
+        return nf_nat_masquerade_ipv4(skb, par->hooknum, &range, par->out);
 }
 
-static int
-device_cmp(struct nf_conn *i, void *ifindex)
-{
-        const struct nf_conn_nat *nat = nfct_nat(i);
-
-        if (!nat)
-                return 0;
-        if (nf_ct_l3num(i) != NFPROTO_IPV4)
-                return 0;
-        return nat->masq_index == (int)(long)ifindex;
-}
-
-static int masq_device_event(struct notifier_block *this,
-                             unsigned long event,
-                             void *ptr)
-{
-        const struct net_device *dev = netdev_notifier_info_to_dev(ptr);
-        struct net *net = dev_net(dev);
-
-        if (event == NETDEV_DOWN) {
-                /* Device was downed.  Search entire table for
-                   conntracks which were associated with that device,
-                   and forget them. */
-                NF_CT_ASSERT(dev->ifindex != 0);
-
-                nf_ct_iterate_cleanup(net, device_cmp,
-                                      (void *)(long)dev->ifindex, 0, 0);
-        }
-
-        return NOTIFY_DONE;
-}
-
-static int masq_inet_event(struct notifier_block *this,
-                           unsigned long event,
-                           void *ptr)
-{
-        struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
-        struct netdev_notifier_info info;
-
-        netdev_notifier_info_init(&info, dev);
-        return masq_device_event(this, event, &info);
-}
-
-static struct notifier_block masq_dev_notifier = {
-        .notifier_call  = masq_device_event,
-};
-
-static struct notifier_block masq_inet_notifier = {
-        .notifier_call  = masq_inet_event,
-};
-
 static struct xt_target masquerade_tg_reg __read_mostly = {
         .name           = "MASQUERADE",
         .family         = NFPROTO_IPV4,
@@ -160,12 +75,8 @@ static int __init masquerade_tg_init(void)
 
         ret = xt_register_target(&masquerade_tg_reg);
 
-        if (ret == 0) {
-                /* Register for device down reports */
-                register_netdevice_notifier(&masq_dev_notifier);
-                /* Register IP address change reports */
-                register_inetaddr_notifier(&masq_inet_notifier);
-        }
+        if (ret == 0)
+                nf_nat_masquerade_ipv4_register_notifier();
 
         return ret;
 }
@@ -173,8 +84,7 @@ static int __init masquerade_tg_init(void)
 static void __exit masquerade_tg_exit(void)
 {
         xt_unregister_target(&masquerade_tg_reg);
-        unregister_netdevice_notifier(&masq_dev_notifier);
-        unregister_inetaddr_notifier(&masq_inet_notifier);
+        nf_nat_masquerade_ipv4_unregister_notifier();
 }
 
 module_init(masquerade_tg_init);
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 5b6e0df4ccff..8f48f5517e33 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -20,7 +20,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv4/ipt_REJECT.h>
-#ifdef CONFIG_BRIDGE_NETFILTER
+#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 #include <linux/netfilter_bridge.h>
 #endif
 
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c
index f1787c04a4dd..6b67d7e9a75d 100644
--- a/net/ipv4/netfilter/iptable_nat.c
+++ b/net/ipv4/netfilter/iptable_nat.c
@@ -28,222 +28,57 @@ static const struct xt_table nf_nat_ipv4_table = {
         .af             = NFPROTO_IPV4,
 };
 
-static unsigned int alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
-{
-        /* Force range to this IP; let proto decide mapping for
-         * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
-         */
-        struct nf_nat_range range;
-
-        range.flags = 0;
-        pr_debug("Allocating NULL binding for %p (%pI4)\n", ct,
-                 HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
-                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip :
-                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
-
-        return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
-}
-
-static unsigned int nf_nat_rule_find(struct sk_buff *skb, unsigned int hooknum,
-                                     const struct net_device *in,
-                                     const struct net_device *out,
-                                     struct nf_conn *ct)
+static unsigned int iptable_nat_do_chain(const struct nf_hook_ops *ops,
+                                         struct sk_buff *skb,
+                                         const struct net_device *in,
+                                         const struct net_device *out,
+                                         struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
-        unsigned int ret;
 
-        ret = ipt_do_table(skb, hooknum, in, out, net->ipv4.nat_table);
-        if (ret == NF_ACCEPT) {
-                if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
-                        ret = alloc_null_binding(ct, hooknum);
-        }
-        return ret;
+        return ipt_do_table(skb, ops->hooknum, in, out, net->ipv4.nat_table);
 }
 
-static unsigned int
-nf_nat_ipv4_fn(const struct nf_hook_ops *ops,
-               struct sk_buff *skb,
-               const struct net_device *in,
-               const struct net_device *out,
-               int (*okfn)(struct sk_buff *))
+static unsigned int iptable_nat_ipv4_fn(const struct nf_hook_ops *ops,
+                                        struct sk_buff *skb,
+                                        const struct net_device *in,
+                                        const struct net_device *out,
+                                        int (*okfn)(struct sk_buff *))
 {
-        struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
-        struct nf_conn_nat *nat;
-        /* maniptype == SRC for postrouting. */
-        enum nf_nat_manip_type maniptype = HOOK2MANIP(ops->hooknum);
-
-        /* We never see fragments: conntrack defrags on pre-routing
-         * and local-out, and nf_nat_out protects post-routing.
-         */
-        NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
-
-        ct = nf_ct_get(skb, &ctinfo);
-        /* Can't track?  It's not due to stress, or conntrack would
-         * have dropped it.  Hence it's the user's responsibilty to
-         * packet filter it out, or implement conntrack/NAT for that
-         * protocol. 8) --RR
-         */
-        if (!ct)
-                return NF_ACCEPT;
-
-        /* Don't try to NAT if this packet is not conntracked */
-        if (nf_ct_is_untracked(ct))
-                return NF_ACCEPT;
-
-        nat = nf_ct_nat_ext_add(ct);
-        if (nat == NULL)
-                return NF_ACCEPT;
-
-        switch (ctinfo) {
-        case IP_CT_RELATED:
-        case IP_CT_RELATED_REPLY:
-                if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
-                        if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
-                                                           ops->hooknum))
-                                return NF_DROP;
-                        else
-                                return NF_ACCEPT;
-                }
-                /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
-        case IP_CT_NEW:
-                /* Seen it before?  This can happen for loopback, retrans,
-                 * or local packets.
-                 */
-                if (!nf_nat_initialized(ct, maniptype)) {
-                        unsigned int ret;
-
-                        ret = nf_nat_rule_find(skb, ops->hooknum, in, out, ct);
-                        if (ret != NF_ACCEPT)
-                                return ret;
-                } else {
-                        pr_debug("Already setup manip %s for ct %p\n",
-                                 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
-                                 ct);
-                        if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out))
-                                goto oif_changed;
-                }
-                break;
-
-        default:
-                /* ESTABLISHED */
-                NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
-                             ctinfo == IP_CT_ESTABLISHED_REPLY);
-                if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out))
-                        goto oif_changed;
-        }
-
-        return nf_nat_packet(ct, ctinfo, ops->hooknum, skb);
-
-oif_changed:
-        nf_ct_kill_acct(ct, ctinfo, skb);
-        return NF_DROP;
+        return nf_nat_ipv4_fn(ops, skb, in, out, iptable_nat_do_chain);
 }
 
-static unsigned int
-nf_nat_ipv4_in(const struct nf_hook_ops *ops,
-               struct sk_buff *skb,
-               const struct net_device *in,
-               const struct net_device *out,
-               int (*okfn)(struct sk_buff *))
+static unsigned int iptable_nat_ipv4_in(const struct nf_hook_ops *ops,
+                                        struct sk_buff *skb,
+                                        const struct net_device *in,
+                                        const struct net_device *out,
+                                        int (*okfn)(struct sk_buff *))
 {
-        unsigned int ret;
-        __be32 daddr = ip_hdr(skb)->daddr;
-
-        ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn);
-        if (ret != NF_DROP && ret != NF_STOLEN &&
-            daddr != ip_hdr(skb)->daddr)
-                skb_dst_drop(skb);
-
-        return ret;
+        return nf_nat_ipv4_in(ops, skb, in, out, iptable_nat_do_chain);
 }
 
-static unsigned int
-nf_nat_ipv4_out(const struct nf_hook_ops *ops,
-                struct sk_buff *skb,
-                const struct net_device *in,
-                const struct net_device *out,
-                int (*okfn)(struct sk_buff *))
+static unsigned int iptable_nat_ipv4_out(const struct nf_hook_ops *ops,
+                                         struct sk_buff *skb,
+                                         const struct net_device *in,
+                                         const struct net_device *out,
+                                         int (*okfn)(struct sk_buff *))
 {
-#ifdef CONFIG_XFRM
-        const struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
-        int err;
-#endif
-        unsigned int ret;
-
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr))
-                return NF_ACCEPT;
-
-        ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn);
-#ifdef CONFIG_XFRM
-        if (ret != NF_DROP && ret != NF_STOLEN &&
-            !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
-            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
-                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-
-                if ((ct->tuplehash[dir].tuple.src.u3.ip !=
-                     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
-                    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
-                     ct->tuplehash[dir].tuple.src.u.all !=
-                     ct->tuplehash[!dir].tuple.dst.u.all)) {
-                        err = nf_xfrm_me_harder(skb, AF_INET);
-                        if (err < 0)
-                                ret = NF_DROP_ERR(err);
-                }
-        }
-#endif
-        return ret;
+        return nf_nat_ipv4_out(ops, skb, in, out, iptable_nat_do_chain);
 }
 
-static unsigned int
-nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops,
-                     struct sk_buff *skb,
-                     const struct net_device *in,
-                     const struct net_device *out,
-                     int (*okfn)(struct sk_buff *))
+static unsigned int iptable_nat_ipv4_local_fn(const struct nf_hook_ops *ops,
+                                              struct sk_buff *skb,
+                                              const struct net_device *in,
+                                              const struct net_device *out,
+                                              int (*okfn)(struct sk_buff *))
 {
-        const struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
-        unsigned int ret;
-        int err;
-
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr) ||
-            ip_hdrlen(skb) < sizeof(struct iphdr))
-                return NF_ACCEPT;
-
-        ret = nf_nat_ipv4_fn(ops, skb, in, out, okfn);
-        if (ret != NF_DROP && ret != NF_STOLEN &&
-            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
-                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-
-                if (ct->tuplehash[dir].tuple.dst.u3.ip !=
-                    ct->tuplehash[!dir].tuple.src.u3.ip) {
-                        err = ip_route_me_harder(skb, RTN_UNSPEC);
-                        if (err < 0)
-                                ret = NF_DROP_ERR(err);
-                }
-#ifdef CONFIG_XFRM
-                else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
-                         ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
-                         ct->tuplehash[dir].tuple.dst.u.all !=
-                         ct->tuplehash[!dir].tuple.src.u.all) {
-                        err = nf_xfrm_me_harder(skb, AF_INET);
-                        if (err < 0)
-                                ret = NF_DROP_ERR(err);
-                }
-#endif
-        }
-        return ret;
+        return nf_nat_ipv4_local_fn(ops, skb, in, out, iptable_nat_do_chain);
 }
 
 static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
         /* Before packet filtering, change destination */
         {
-                .hook           = nf_nat_ipv4_in,
+                .hook           = iptable_nat_ipv4_in,
                 .owner          = THIS_MODULE,
                 .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_PRE_ROUTING,
@@ -251,7 +86,7 @@ static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
         },
         /* After packet filtering, change source */
         {
-                .hook           = nf_nat_ipv4_out,
+                .hook           = iptable_nat_ipv4_out,
                 .owner          = THIS_MODULE,
                 .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_POST_ROUTING,
@@ -259,7 +94,7 @@ static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
         },
         /* Before packet filtering, change destination */
         {
-                .hook           = nf_nat_ipv4_local_fn,
+                .hook           = iptable_nat_ipv4_local_fn,
                 .owner          = THIS_MODULE,
                 .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_OUT,
@@ -267,7 +102,7 @@ static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {
         },
         /* After packet filtering, change source */
         {
-                .hook           = nf_nat_ipv4_fn,
+                .hook           = iptable_nat_ipv4_fn,
                 .owner          = THIS_MODULE,
                 .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_IN,
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index 76bd1aef257f..7e5ca6f2d0cd 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -50,7 +50,7 @@ static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
                 zone = nf_ct_zone((struct nf_conn *)skb->nfct);
 #endif
 
-#ifdef CONFIG_BRIDGE_NETFILTER
+#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
         if (skb->nf_bridge &&
             skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
                 return IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone;
diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
index 14f5ccd06337..fc37711e11f3 100644
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -254,6 +254,205 @@ int nf_nat_icmp_reply_translation(struct sk_buff *skb,
 }
 EXPORT_SYMBOL_GPL(nf_nat_icmp_reply_translation);
 
+unsigned int
+nf_nat_ipv4_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,
+               const struct net_device *in, const struct net_device *out,
+               unsigned int (*do_chain)(const struct nf_hook_ops *ops,
+                                        struct sk_buff *skb,
+                                        const struct net_device *in,
+                                        const struct net_device *out,
+                                        struct nf_conn *ct))
+{
+        struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+        struct nf_conn_nat *nat;
+        /* maniptype == SRC for postrouting. */
+        enum nf_nat_manip_type maniptype = HOOK2MANIP(ops->hooknum);
+
+        /* We never see fragments: conntrack defrags on pre-routing
+         * and local-out, and nf_nat_out protects post-routing.
+         */
+        NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
+
+        ct = nf_ct_get(skb, &ctinfo);
+        /* Can't track?  It's not due to stress, or conntrack would
+         * have dropped it.  Hence it's the user's responsibilty to
+         * packet filter it out, or implement conntrack/NAT for that
+         * protocol. 8) --RR
+         */
+        if (!ct)
+                return NF_ACCEPT;
+
+        /* Don't try to NAT if this packet is not conntracked */
+        if (nf_ct_is_untracked(ct))
+                return NF_ACCEPT;
+
+        nat = nf_ct_nat_ext_add(ct);
+        if (nat == NULL)
+                return NF_ACCEPT;
+
+        switch (ctinfo) {
+        case IP_CT_RELATED:
+        case IP_CT_RELATED_REPLY:
+                if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
+                        if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
+                                                           ops->hooknum))
+                                return NF_DROP;
+                        else
+                                return NF_ACCEPT;
+                }
+                /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
+        case IP_CT_NEW:
+                /* Seen it before?  This can happen for loopback, retrans,
+                 * or local packets.
+                 */
+                if (!nf_nat_initialized(ct, maniptype)) {
+                        unsigned int ret;
+
+                        ret = do_chain(ops, skb, in, out, ct);
+                        if (ret != NF_ACCEPT)
+                                return ret;
+
+                        if (nf_nat_initialized(ct, HOOK2MANIP(ops->hooknum)))
+                                break;
+
+                        ret = nf_nat_alloc_null_binding(ct, ops->hooknum);
+                        if (ret != NF_ACCEPT)
+                                return ret;
+                } else {
+                        pr_debug("Already setup manip %s for ct %p\n",
+                                 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
+                                 ct);
+                        if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out))
+                                goto oif_changed;
+                }
+                break;
+
+        default:
+                /* ESTABLISHED */
+                NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
+                             ctinfo == IP_CT_ESTABLISHED_REPLY);
+                if (nf_nat_oif_changed(ops->hooknum, ctinfo, nat, out))
+                        goto oif_changed;
+        }
+
+        return nf_nat_packet(ct, ctinfo, ops->hooknum, skb);
+
+oif_changed:
+        nf_ct_kill_acct(ct, ctinfo, skb);
+        return NF_DROP;
+}
+EXPORT_SYMBOL_GPL(nf_nat_ipv4_fn);
+
+unsigned int
+nf_nat_ipv4_in(const struct nf_hook_ops *ops, struct sk_buff *skb,
+               const struct net_device *in, const struct net_device *out,
+               unsigned int (*do_chain)(const struct nf_hook_ops *ops,
+                                         struct sk_buff *skb,
+                                         const struct net_device *in,
+                                         const struct net_device *out,
+                                         struct nf_conn *ct))
+{
+        unsigned int ret;
+        __be32 daddr = ip_hdr(skb)->daddr;
+
+        ret = nf_nat_ipv4_fn(ops, skb, in, out, do_chain);
+        if (ret != NF_DROP && ret != NF_STOLEN &&
+            daddr != ip_hdr(skb)->daddr)
+                skb_dst_drop(skb);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(nf_nat_ipv4_in);
+
+unsigned int
+nf_nat_ipv4_out(const struct nf_hook_ops *ops, struct sk_buff *skb,
+                const struct net_device *in, const struct net_device *out,
+                unsigned int (*do_chain)(const struct nf_hook_ops *ops,
+                                          struct sk_buff *skb,
+                                          const struct net_device *in,
+                                          const struct net_device *out,
+                                          struct nf_conn *ct))
+{
+#ifdef CONFIG_XFRM
+        const struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+        int err;
+#endif
+        unsigned int ret;
+
+        /* root is playing with raw sockets. */
+        if (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr))
+                return NF_ACCEPT;
+
+        ret = nf_nat_ipv4_fn(ops, skb, in, out, do_chain);
+#ifdef CONFIG_XFRM
+        if (ret != NF_DROP && ret != NF_STOLEN &&
+            !(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
+            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
+                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+
+                if ((ct->tuplehash[dir].tuple.src.u3.ip !=
+                     ct->tuplehash[!dir].tuple.dst.u3.ip) ||
+                    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
+                     ct->tuplehash[dir].tuple.src.u.all !=
+                     ct->tuplehash[!dir].tuple.dst.u.all)) {
+                        err = nf_xfrm_me_harder(skb, AF_INET);
+                        if (err < 0)
+                                ret = NF_DROP_ERR(err);
+                }
+        }
+#endif
+        return ret;
+}
+EXPORT_SYMBOL_GPL(nf_nat_ipv4_out);
+
+unsigned int
+nf_nat_ipv4_local_fn(const struct nf_hook_ops *ops, struct sk_buff *skb,
+                     const struct net_device *in, const struct net_device *out,
+                     unsigned int (*do_chain)(const struct nf_hook_ops *ops,
+                                               struct sk_buff *skb,
+                                               const struct net_device *in,
+                                               const struct net_device *out,
+                                               struct nf_conn *ct))
+{
+        const struct nf_conn *ct;
+        enum ip_conntrack_info ctinfo;
+        unsigned int ret;
+        int err;
+
+        /* root is playing with raw sockets. */
+        if (skb->len < sizeof(struct iphdr) ||
+            ip_hdrlen(skb) < sizeof(struct iphdr))
+                return NF_ACCEPT;
+
+        ret = nf_nat_ipv4_fn(ops, skb, in, out, do_chain);
+        if (ret != NF_DROP && ret != NF_STOLEN &&
+            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
+                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+
+                if (ct->tuplehash[dir].tuple.dst.u3.ip !=
+                    ct->tuplehash[!dir].tuple.src.u3.ip) {
+                        err = ip_route_me_harder(skb, RTN_UNSPEC);
+                        if (err < 0)
+                                ret = NF_DROP_ERR(err);
+                }
+#ifdef CONFIG_XFRM
+                else if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) &&
+                         ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMP &&
+                         ct->tuplehash[dir].tuple.dst.u.all !=
+                         ct->tuplehash[!dir].tuple.src.u.all) {
+                        err = nf_xfrm_me_harder(skb, AF_INET);
+                        if (err < 0)
+                                ret = NF_DROP_ERR(err);
+                }
+#endif
+        }
+        return ret;
+}
+EXPORT_SYMBOL_GPL(nf_nat_ipv4_local_fn);
+
 static int __init nf_nat_l3proto_ipv4_init(void)
 {
         int err;
diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
new file mode 100644
index 000000000000..c6eb42100e9a
--- /dev/null
+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
@@ -0,0 +1,153 @@
+/* (C) 1999-2001 Paul `Rusty' Russell
+ * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/atomic.h>
+#include <linux/inetdevice.h>
+#include <linux/ip.h>
+#include <linux/timer.h>
+#include <linux/netfilter.h>
+#include <net/protocol.h>
+#include <net/ip.h>
+#include <net/checksum.h>
+#include <net/route.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/netfilter/x_tables.h>
+#include <net/netfilter/nf_nat.h>
+#include <net/netfilter/ipv4/nf_nat_masquerade.h>
+
+unsigned int
+nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
+                       const struct nf_nat_range *range,
+                       const struct net_device *out)
+{
+        struct nf_conn *ct;
+        struct nf_conn_nat *nat;
+        enum ip_conntrack_info ctinfo;
+        struct nf_nat_range newrange;
+        const struct rtable *rt;
+        __be32 newsrc, nh;
+
+        NF_CT_ASSERT(hooknum == NF_INET_POST_ROUTING);
+
+        ct = nf_ct_get(skb, &ctinfo);
+        nat = nfct_nat(ct);
+
+        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
+                            ctinfo == IP_CT_RELATED_REPLY));
+
+        /* Source address is 0.0.0.0 - locally generated packet that is
+         * probably not supposed to be masqueraded.
+         */
+        if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip == 0)
+                return NF_ACCEPT;
+
+        rt = skb_rtable(skb);
+        nh = rt_nexthop(rt, ip_hdr(skb)->daddr);
+        newsrc = inet_select_addr(out, nh, RT_SCOPE_UNIVERSE);
+        if (!newsrc) {
+                pr_info("%s ate my IP address\n", out->name);
+                return NF_DROP;
+        }
+
+        nat->masq_index = out->ifindex;
+
+        /* Transfer from original range. */
+        memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
+        memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
+        newrange.flags       = range->flags | NF_NAT_RANGE_MAP_IPS;
+        newrange.min_addr.ip = newsrc;
+        newrange.max_addr.ip = newsrc;
+        newrange.min_proto   = range->min_proto;
+        newrange.max_proto   = range->max_proto;
+
+        /* Hand modified range to generic setup. */
+        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_SRC);
+}
+EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4);
+
+static int device_cmp(struct nf_conn *i, void *ifindex)
+{
+        const struct nf_conn_nat *nat = nfct_nat(i);
+
+        if (!nat)
+                return 0;
+        if (nf_ct_l3num(i) != NFPROTO_IPV4)
+                return 0;
+        return nat->masq_index == (int)(long)ifindex;
+}
+
+static int masq_device_event(struct notifier_block *this,
+                             unsigned long event,
+                             void *ptr)
+{
+        const struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct net *net = dev_net(dev);
+
+        if (event == NETDEV_DOWN) {
+                /* Device was downed.  Search entire table for
+                 * conntracks which were associated with that device,
+                 * and forget them.
+                 */
+                NF_CT_ASSERT(dev->ifindex != 0);
+
+                nf_ct_iterate_cleanup(net, device_cmp,
+                                      (void *)(long)dev->ifindex, 0, 0);
+        }
+
+        return NOTIFY_DONE;
+}
+
+static int masq_inet_event(struct notifier_block *this,
+                           unsigned long event,
+                           void *ptr)
+{
+        struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
+        struct netdev_notifier_info info;
+
+        netdev_notifier_info_init(&info, dev);
+        return masq_device_event(this, event, &info);
+}
+
+static struct notifier_block masq_dev_notifier = {
+        .notifier_call  = masq_device_event,
+};
+
+static struct notifier_block masq_inet_notifier = {
+        .notifier_call  = masq_inet_event,
+};
+
+static atomic_t masquerade_notifier_refcount = ATOMIC_INIT(0);
+
+void nf_nat_masquerade_ipv4_register_notifier(void)
+{
+        /* check if the notifier was already set */
+        if (atomic_inc_return(&masquerade_notifier_refcount) > 1)
+                return;
+
+        /* Register for device down reports */
+        register_netdevice_notifier(&masq_dev_notifier);
+        /* Register IP address change reports */
+        register_inetaddr_notifier(&masq_inet_notifier);
+}
+EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_register_notifier);
+
+void nf_nat_masquerade_ipv4_unregister_notifier(void)
+{
+        /* check if the notifier still has clients */
+        if (atomic_dec_return(&masquerade_notifier_refcount) > 0)
+                return;
+
+        unregister_netdevice_notifier(&masq_dev_notifier);
+        unregister_inetaddr_notifier(&masq_inet_notifier);
+}
+EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_unregister_notifier);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
new file mode 100644
index 000000000000..b023b4eb1a96
--- /dev/null
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -0,0 +1,127 @@
+/* (C) 1999-2001 Paul `Rusty' Russell
+ * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <net/ip.h>
+#include <net/tcp.h>
+#include <net/route.h>
+#include <net/dst.h>
+#include <linux/netfilter_ipv4.h>
+
+/* Send RST reply */
+void nf_send_reset(struct sk_buff *oldskb, int hook)
+{
+        struct sk_buff *nskb;
+        const struct iphdr *oiph;
+        struct iphdr *niph;
+        const struct tcphdr *oth;
+        struct tcphdr _otcph, *tcph;
+
+        /* IP header checks: fragment. */
+        if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
+                return;
+
+        oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb),
+                                 sizeof(_otcph), &_otcph);
+        if (oth == NULL)
+                return;
+
+        /* No RST for RST. */
+        if (oth->rst)
+                return;
+
+        if (skb_rtable(oldskb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
+                return;
+
+        /* Check checksum */
+        if (nf_ip_checksum(oldskb, hook, ip_hdrlen(oldskb), IPPROTO_TCP))
+                return;
+        oiph = ip_hdr(oldskb);
+
+        nskb = alloc_skb(sizeof(struct iphdr) + sizeof(struct tcphdr) +
+                         LL_MAX_HEADER, GFP_ATOMIC);
+        if (!nskb)
+                return;
+
+        skb_reserve(nskb, LL_MAX_HEADER);
+
+        skb_reset_network_header(nskb);
+        niph = (struct iphdr *)skb_put(nskb, sizeof(struct iphdr));
+        niph->version   = 4;
+        niph->ihl       = sizeof(struct iphdr) / 4;
+        niph->tos       = 0;
+        niph->id        = 0;
+        niph->frag_off  = htons(IP_DF);
+        niph->protocol  = IPPROTO_TCP;
+        niph->check     = 0;
+        niph->saddr     = oiph->daddr;
+        niph->daddr     = oiph->saddr;
+
+        skb_reset_transport_header(nskb);
+        tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
+        memset(tcph, 0, sizeof(*tcph));
+        tcph->source    = oth->dest;
+        tcph->dest      = oth->source;
+        tcph->doff      = sizeof(struct tcphdr) / 4;
+
+        if (oth->ack)
+                tcph->seq = oth->ack_seq;
+        else {
+                tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
+                                      oldskb->len - ip_hdrlen(oldskb) -
+                                      (oth->doff << 2));
+                tcph->ack = 1;
+        }
+
+        tcph->rst       = 1;
+        tcph->check = ~tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
+                                    niph->daddr, 0);
+        nskb->ip_summed = CHECKSUM_PARTIAL;
+        nskb->csum_start = (unsigned char *)tcph - nskb->head;
+        nskb->csum_offset = offsetof(struct tcphdr, check);
+
+        /* ip_route_me_harder expects skb->dst to be set */
+        skb_dst_set_noref(nskb, skb_dst(oldskb));
+
+        nskb->protocol = htons(ETH_P_IP);
+        if (ip_route_me_harder(nskb, RTN_UNSPEC))
+                goto free_nskb;
+
+        niph->ttl       = ip4_dst_hoplimit(skb_dst(nskb));
+
+        /* "Never happens" */
+        if (nskb->len > dst_mtu(skb_dst(nskb)))
+                goto free_nskb;
+
+        nf_ct_attach(nskb, oldskb);
+
+#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
+        /* If we use ip_local_out for bridged traffic, the MAC source on
+         * the RST will be ours, instead of the destination's.  This confuses
+         * some routers/firewalls, and they drop the packet.  So we need to
+         * build the eth header using the original destination's MAC as the
+         * source, and send the RST packet directly.
+         */
+        if (oldskb->nf_bridge) {
+                struct ethhdr *oeth = eth_hdr(oldskb);
+                nskb->dev = oldskb->nf_bridge->physindev;
+                niph->tot_len = htons(nskb->len);
+                ip_send_check(niph);
+                if (dev_hard_header(nskb, nskb->dev, ntohs(nskb->protocol),
+                                    oeth->h_source, oeth->h_dest, nskb->len) < 0)
+                        goto free_nskb;
+                dev_queue_xmit(nskb);
+        } else
+#endif
+                ip_local_out(nskb);
+
+        return;
+
+ free_nskb:
+        kfree_skb(nskb);
+}
+EXPORT_SYMBOL_GPL(nf_send_reset);
diff --git a/net/ipv4/netfilter/nft_chain_nat_ipv4.c b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
index 3964157d826c..df547bf50078 100644
--- a/net/ipv4/netfilter/nft_chain_nat_ipv4.c
+++ b/net/ipv4/netfilter/nft_chain_nat_ipv4.c
@@ -26,136 +26,53 @@
 #include <net/netfilter/nf_nat_l3proto.h>
 #include <net/ip.h>
 
-/*
- * NAT chains
- */
-
-static unsigned int nf_nat_fn(const struct nf_hook_ops *ops,
-                              struct sk_buff *skb,
-                              const struct net_device *in,
-                              const struct net_device *out,
-                              int (*okfn)(struct sk_buff *))
+static unsigned int nft_nat_do_chain(const struct nf_hook_ops *ops,
+                                      struct sk_buff *skb,
+                                      const struct net_device *in,
+                                      const struct net_device *out,
+                                      struct nf_conn *ct)
 {
-        enum ip_conntrack_info ctinfo;
-        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
-        struct nf_conn_nat *nat;
-        enum nf_nat_manip_type maniptype = HOOK2MANIP(ops->hooknum);
         struct nft_pktinfo pkt;
-        unsigned int ret;
-
-        if (ct == NULL || nf_ct_is_untracked(ct))
-                return NF_ACCEPT;
-
-        NF_CT_ASSERT(!(ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)));
-
-        nat = nf_ct_nat_ext_add(ct);
-        if (nat == NULL)
-                return NF_ACCEPT;
-
-        switch (ctinfo) {
-        case IP_CT_RELATED:
-        case IP_CT_RELATED + IP_CT_IS_REPLY:
-                if (ip_hdr(skb)->protocol == IPPROTO_ICMP) {
-                        if (!nf_nat_icmp_reply_translation(skb, ct, ctinfo,
-                                                           ops->hooknum))
-                                return NF_DROP;
-                        else
-                                return NF_ACCEPT;
-                }
-                /* Fall through */
-        case IP_CT_NEW:
-                if (nf_nat_initialized(ct, maniptype))
-                        break;
 
-                nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
+        nft_set_pktinfo_ipv4(&pkt, ops, skb, in, out);
 
-                ret = nft_do_chain(&pkt, ops);
-                if (ret != NF_ACCEPT)
-                        return ret;
-                if (!nf_nat_initialized(ct, maniptype)) {
-                        ret = nf_nat_alloc_null_binding(ct, ops->hooknum);
-                        if (ret != NF_ACCEPT)
-                                return ret;
-                }
-        default:
-                break;
-        }
-
-        return nf_nat_packet(ct, ctinfo, ops->hooknum, skb);
+        return nft_do_chain(&pkt, ops);
 }
 
-static unsigned int nf_nat_prerouting(const struct nf_hook_ops *ops,
-                                      struct sk_buff *skb,
-                                      const struct net_device *in,
-                                      const struct net_device *out,
-                                      int (*okfn)(struct sk_buff *))
+static unsigned int nft_nat_ipv4_fn(const struct nf_hook_ops *ops,
+                                    struct sk_buff *skb,
+                                    const struct net_device *in,
+                                    const struct net_device *out,
+                                    int (*okfn)(struct sk_buff *))
 {
-        __be32 daddr = ip_hdr(skb)->daddr;
-        unsigned int ret;
-
-        ret = nf_nat_fn(ops, skb, in, out, okfn);
-        if (ret != NF_DROP && ret != NF_STOLEN &&
-            ip_hdr(skb)->daddr != daddr) {
-                skb_dst_drop(skb);
-        }
-        return ret;
+        return nf_nat_ipv4_fn(ops, skb, in, out, nft_nat_do_chain);
 }
 
-static unsigned int nf_nat_postrouting(const struct nf_hook_ops *ops,
-                                       struct sk_buff *skb,
-                                       const struct net_device *in,
-                                       const struct net_device *out,
-                                       int (*okfn)(struct sk_buff *))
+static unsigned int nft_nat_ipv4_in(const struct nf_hook_ops *ops,
+                                    struct sk_buff *skb,
+                                    const struct net_device *in,
+                                    const struct net_device *out,
+                                    int (*okfn)(struct sk_buff *))
 {
-        enum ip_conntrack_info ctinfo __maybe_unused;
-        const struct nf_conn *ct __maybe_unused;
-        unsigned int ret;
-
-        ret = nf_nat_fn(ops, skb, in, out, okfn);
-#ifdef CONFIG_XFRM
-        if (ret != NF_DROP && ret != NF_STOLEN &&
-            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
-                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-
-                if (ct->tuplehash[dir].tuple.src.u3.ip !=
-                    ct->tuplehash[!dir].tuple.dst.u3.ip ||
-                    ct->tuplehash[dir].tuple.src.u.all !=
-                    ct->tuplehash[!dir].tuple.dst.u.all)
-                        return nf_xfrm_me_harder(skb, AF_INET) == 0 ?
-                                                                ret : NF_DROP;
-        }
-#endif
-        return ret;
+        return nf_nat_ipv4_in(ops, skb, in, out, nft_nat_do_chain);
 }
 
-static unsigned int nf_nat_output(const struct nf_hook_ops *ops,
-                                  struct sk_buff *skb,
-                                  const struct net_device *in,
-                                  const struct net_device *out,
-                                  int (*okfn)(struct sk_buff *))
+static unsigned int nft_nat_ipv4_out(const struct nf_hook_ops *ops,
+                                     struct sk_buff *skb,
+                                     const struct net_device *in,
+                                     const struct net_device *out,
+                                     int (*okfn)(struct sk_buff *))
 {
-        enum ip_conntrack_info ctinfo;
-        const struct nf_conn *ct;
-        unsigned int ret;
-
-        ret = nf_nat_fn(ops, skb, in, out, okfn);
-        if (ret != NF_DROP && ret != NF_STOLEN &&
-            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
-                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
+        return nf_nat_ipv4_out(ops, skb, in, out, nft_nat_do_chain);
+}
 
-                if (ct->tuplehash[dir].tuple.dst.u3.ip !=
-                    ct->tuplehash[!dir].tuple.src.u3.ip) {
-                        if (ip_route_me_harder(skb, RTN_UNSPEC))
-                                ret = NF_DROP;
-                }
-#ifdef CONFIG_XFRM
-                else if (ct->tuplehash[dir].tuple.dst.u.all !=
-                         ct->tuplehash[!dir].tuple.src.u.all)
-                        if (nf_xfrm_me_harder(skb, AF_INET))
-                                ret = NF_DROP;
-#endif
-        }
-        return ret;
+static unsigned int nft_nat_ipv4_local_fn(const struct nf_hook_ops *ops,
+                                          struct sk_buff *skb,
+                                          const struct net_device *in,
+                                          const struct net_device *out,
+                                          int (*okfn)(struct sk_buff *))
+{
+        return nf_nat_ipv4_local_fn(ops, skb, in, out, nft_nat_do_chain);
 }
 
 static const struct nf_chain_type nft_chain_nat_ipv4 = {
@@ -168,10 +85,10 @@ static const struct nf_chain_type nft_chain_nat_ipv4 = {
                           (1 << NF_INET_LOCAL_OUT) |
                           (1 << NF_INET_LOCAL_IN),
         .hooks          = {
-                [NF_INET_PRE_ROUTING]   = nf_nat_prerouting,
-                [NF_INET_POST_ROUTING]  = nf_nat_postrouting,
-                [NF_INET_LOCAL_OUT]     = nf_nat_output,
-                [NF_INET_LOCAL_IN]      = nf_nat_fn,
+                [NF_INET_PRE_ROUTING]   = nft_nat_ipv4_in,
+                [NF_INET_POST_ROUTING]  = nft_nat_ipv4_out,
+                [NF_INET_LOCAL_OUT]     = nft_nat_ipv4_local_fn,
+                [NF_INET_LOCAL_IN]      = nft_nat_ipv4_fn,
         },
 };
 
diff --git a/net/ipv4/netfilter/nft_masq_ipv4.c b/net/ipv4/netfilter/nft_masq_ipv4.c
new file mode 100644
index 000000000000..1c636d6b5b50
--- /dev/null
+++ b/net/ipv4/netfilter/nft_masq_ipv4.c
@@ -0,0 +1,77 @@
+/*
+ * Copyright (c) 2014 Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/netlink.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <net/netfilter/nf_tables.h>
+#include <net/netfilter/nft_masq.h>
+#include <net/netfilter/ipv4/nf_nat_masquerade.h>
+
+static void nft_masq_ipv4_eval(const struct nft_expr *expr,
+                               struct nft_data data[NFT_REG_MAX + 1],
+                               const struct nft_pktinfo *pkt)
+{
+        struct nft_masq *priv = nft_expr_priv(expr);
+        struct nf_nat_range range;
+        unsigned int verdict;
+
+        range.flags = priv->flags;
+
+        verdict = nf_nat_masquerade_ipv4(pkt->skb, pkt->ops->hooknum,
+                                         &range, pkt->out);
+
+        data[NFT_REG_VERDICT].verdict = verdict;
+}
+
+static struct nft_expr_type nft_masq_ipv4_type;
+static const struct nft_expr_ops nft_masq_ipv4_ops = {
+        .type           = &nft_masq_ipv4_type,
+        .size           = NFT_EXPR_SIZE(sizeof(struct nft_masq)),
+        .eval           = nft_masq_ipv4_eval,
+        .init           = nft_masq_init,
+        .dump           = nft_masq_dump,
+};
+
+static struct nft_expr_type nft_masq_ipv4_type __read_mostly = {
+        .family         = NFPROTO_IPV4,
+        .name           = "masq",
+        .ops            = &nft_masq_ipv4_ops,
+        .policy         = nft_masq_policy,
+        .maxattr        = NFTA_MASQ_MAX,
+        .owner          = THIS_MODULE,
+};
+
+static int __init nft_masq_ipv4_module_init(void)
+{
+        int ret;
+
+        ret = nft_register_expr(&nft_masq_ipv4_type);
+        if (ret < 0)
+                return ret;
+
+        nf_nat_masquerade_ipv4_register_notifier();
+
+        return ret;
+}
+
+static void __exit nft_masq_ipv4_module_exit(void)
+{
+        nft_unregister_expr(&nft_masq_ipv4_type);
+        nf_nat_masquerade_ipv4_unregister_notifier();
+}
+
+module_init(nft_masq_ipv4_module_init);
+module_exit(nft_masq_ipv4_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>");
+MODULE_ALIAS_NFT_AF_EXPR(AF_INET, "masq");
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
index e79718a382f2..ed33299c56d1 100644
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -16,7 +16,6 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter/nf_tables.h>
 #include <net/netfilter/nf_tables.h>
-#include <net/icmp.h>
 #include <net/netfilter/ipv4/nf_reject.h>
 #include <net/netfilter/nft_reject.h>
 
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index a3c59a077a5f..57f7c9804139 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -311,7 +311,7 @@ static int ping_check_bind_addr(struct sock *sk, struct inet_sock *isk,
                 if (addr->sin_addr.s_addr == htonl(INADDR_ANY))
                         chk_addr_ret = RTN_LOCAL;
 
-                if ((sysctl_ip_nonlocal_bind == 0 &&
+                if ((net->ipv4.sysctl_ip_nonlocal_bind == 0 &&
                     isk->freebind == 0 && isk->transparent == 0 &&
                      chk_addr_ret != RTN_LOCAL) ||
                     chk_addr_ret == RTN_MULTICAST ||
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index 46d6a1c923a8..4b7c0ec65251 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -30,6 +30,7 @@
 
 const struct net_protocol __rcu *inet_protos[MAX_INET_PROTOS] __read_mostly;
 const struct net_offload __rcu *inet_offloads[MAX_INET_PROTOS] __read_mostly;
+EXPORT_SYMBOL(inet_offloads);
 
 int inet_add_protocol(const struct net_protocol *prot, unsigned char protocol)
 {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index cbadb942c332..793c0bb8c4fd 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -596,12 +596,12 @@ static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
 
 static inline u32 fnhe_hashfun(__be32 daddr)
 {
+        static u32 fnhe_hashrnd __read_mostly;
         u32 hval;
 
-        hval = (__force u32) daddr;
-        hval ^= (hval >> 11) ^ (hval >> 22);
-
-        return hval & (FNHE_HASH_SIZE - 1);
+        net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
+        hval = jhash_1word((__force u32) daddr, fnhe_hashrnd);
+        return hash_32(hval, FNHE_HASH_SHIFT);
 }
 
 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
@@ -628,12 +628,12 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
 
         spin_lock_bh(&fnhe_lock);
 
-        hash = nh->nh_exceptions;
+        hash = rcu_dereference(nh->nh_exceptions);
         if (!hash) {
                 hash = kzalloc(FNHE_HASH_SIZE * sizeof(*hash), GFP_ATOMIC);
                 if (!hash)
                         goto out_unlock;
-                nh->nh_exceptions = hash;
+                rcu_assign_pointer(nh->nh_exceptions, hash);
         }
 
         hash += hval;
@@ -1242,7 +1242,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
 
 static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
 {
-        struct fnhe_hash_bucket *hash = nh->nh_exceptions;
+        struct fnhe_hash_bucket *hash = rcu_dereference(nh->nh_exceptions);
         struct fib_nh_exception *fnhe;
         u32 hval;
 
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index c0c75688896e..0431a8f3c8f4 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -25,7 +25,7 @@
 
 extern int sysctl_tcp_syncookies;
 
-static u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
+static u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS] __read_mostly;
 
 #define COOKIEBITS 24   /* Upper bits store count */
 #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index a9fde0eef77c..b3c53c8b331e 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -286,13 +286,6 @@ static struct ctl_table ipv4_table[] = {
                 .extra2         = &ip_ttl_max,
         },
         {
-                .procname       = "ip_nonlocal_bind",
-                .data           = &sysctl_ip_nonlocal_bind,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec
-        },
-        {
                 .procname       = "tcp_syn_retries",
                 .data           = &sysctl_tcp_syn_retries,
                 .maxlen         = sizeof(int),
@@ -450,6 +443,16 @@ static struct ctl_table ipv4_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
+#ifdef CONFIG_IP_MULTICAST
+        {
+                .procname       = "igmp_qrv",
+                .data           = &sysctl_igmp_qrv,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one
+        },
+#endif
         {
                 .procname       = "inet_peer_threshold",
                 .data           = &inet_peer_threshold,
@@ -719,6 +722,22 @@ static struct ctl_table ipv4_table[] = {
                 .extra2         = &one,
         },
         {
+                .procname       = "icmp_msgs_per_sec",
+                .data           = &sysctl_icmp_msgs_per_sec,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+        },
+        {
+                .procname       = "icmp_msgs_burst",
+                .data           = &sysctl_icmp_msgs_burst,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &zero,
+        },
+        {
                 .procname       = "udp_mem",
                 .data           = &sysctl_udp_mem,
                 .maxlen         = sizeof(sysctl_udp_mem),
@@ -830,6 +849,13 @@ static struct ctl_table ipv4_net_table[] = {
                 .proc_handler   = proc_dointvec,
         },
         {
+                .procname       = "ip_nonlocal_bind",
+                .data           = &init_net.ipv4.sysctl_ip_nonlocal_bind,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
                 .procname       = "fwmark_reflect",
                 .data           = &init_net.ipv4.sysctl_fwmark_reflect,
                 .maxlen         = sizeof(int),
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 8ee43ae90396..461003d258ba 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -404,7 +404,7 @@ void tcp_init_sock(struct sock *sk)
 
         tp->reordering = sysctl_tcp_reordering;
         tcp_enable_early_retrans(tp);
-        icsk->icsk_ca_ops = &tcp_init_congestion_ops;
+        tcp_assign_congestion_control(sk);
 
         tp->tsoffset = 0;
 
@@ -608,7 +608,7 @@ static inline bool forced_push(const struct tcp_sock *tp)
         return after(tp->write_seq, tp->pushed_seq + (tp->max_window >> 1));
 }
 
-static inline void skb_entail(struct sock *sk, struct sk_buff *skb)
+static void skb_entail(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
@@ -617,7 +617,7 @@ static inline void skb_entail(struct sock *sk, struct sk_buff *skb)
         tcb->seq     = tcb->end_seq = tp->write_seq;
         tcb->tcp_flags = TCPHDR_ACK;
         tcb->sacked  = 0;
-        skb_header_release(skb);
+        __skb_header_release(skb);
         tcp_add_write_queue_tail(sk, skb);
         sk->sk_wmem_queued += skb->truesize;
         sk_mem_charge(sk, skb->truesize);
@@ -962,7 +962,7 @@ new_segment:
                 skb->ip_summed = CHECKSUM_PARTIAL;
                 tp->write_seq += copy;
                 TCP_SKB_CB(skb)->end_seq += copy;
-                skb_shinfo(skb)->gso_segs = 0;
+                tcp_skb_pcount_set(skb, 0);
 
                 if (!copied)
                         TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_PSH;
@@ -1260,7 +1260,7 @@ new_segment:
 
                         tp->write_seq += copy;
                         TCP_SKB_CB(skb)->end_seq += copy;
-                        skb_shinfo(skb)->gso_segs = 0;
+                        tcp_skb_pcount_set(skb, 0);
 
                         from += copy;
                         copied += copy;
@@ -1476,9 +1476,9 @@ static struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
 
         while ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) {
                 offset = seq - TCP_SKB_CB(skb)->seq;
-                if (tcp_hdr(skb)->syn)
+                if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
                         offset--;
-                if (offset < skb->len || tcp_hdr(skb)->fin) {
+                if (offset < skb->len || (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)) {
                         *off = offset;
                         return skb;
                 }
@@ -1551,7 +1551,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                         if (offset + 1 != skb->len)
                                 continue;
                 }
-                if (tcp_hdr(skb)->fin) {
+                if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) {
                         sk_eat_skb(sk, skb);
                         ++seq;
                         break;
@@ -1665,11 +1665,11 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                 break;
 
                         offset = *seq - TCP_SKB_CB(skb)->seq;
-                        if (tcp_hdr(skb)->syn)
+                        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)
                                 offset--;
                         if (offset < skb->len)
                                 goto found_ok_skb;
-                        if (tcp_hdr(skb)->fin)
+                        if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
                                 goto found_fin_ok;
                         WARN(!(flags & MSG_PEEK),
                              "recvmsg bug 2: copied %X seq %X rcvnxt %X fl %X\n",
@@ -1857,7 +1857,7 @@ skip_copy:
                 if (used + offset < skb->len)
                         continue;
 
-                if (tcp_hdr(skb)->fin)
+                if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
                         goto found_fin_ok;
                 if (!(flags & MSG_PEEK))
                         sk_eat_skb(sk, skb);
@@ -2044,8 +2044,10 @@ void tcp_close(struct sock *sk, long timeout)
          *  reader process may not have drained the data yet!
          */
         while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq -
-                          tcp_hdr(skb)->fin;
+                u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
+
+                if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
+                        len--;
                 data_was_unread += len;
                 __kfree_skb(skb);
         }
@@ -2572,7 +2574,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 break;
 #endif
         case TCP_USER_TIMEOUT:
-                /* Cap the max timeout in ms TCP will retry/retrans
+                /* Cap the max time in ms TCP will retry or probe the window
                  * before giving up and aborting (ETIMEDOUT) a connection.
                  */
                 if (val < 0)
@@ -3051,7 +3053,7 @@ static int __init set_thash_entries(char *str)
 }
 __setup("thash_entries=", set_thash_entries);
 
-static void tcp_init_mem(void)
+static void __init tcp_init_mem(void)
 {
         unsigned long limit = nr_free_buffer_pages() / 8;
         limit = max(limit, 128UL);
@@ -3137,8 +3139,6 @@ void __init tcp_init(void)
                 tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
 
         tcp_metrics_init();
-
-        tcp_register_congestion_control(&tcp_reno);
-
+        BUG_ON(tcp_register_congestion_control(&tcp_reno) != 0);
         tcp_tasklet_init();
 }
diff --git a/net/ipv4/tcp_bic.c b/net/ipv4/tcp_bic.c
index d5de69bc04f5..bb395d46a389 100644
--- a/net/ipv4/tcp_bic.c
+++ b/net/ipv4/tcp_bic.c
@@ -17,7 +17,6 @@
 #include <linux/module.h>
 #include <net/tcp.h>
 
-
 #define BICTCP_BETA_SCALE    1024       /* Scale factor beta calculation
                                          * max_cwnd = snd_cwnd * beta
                                          */
@@ -46,11 +45,10 @@ MODULE_PARM_DESC(initial_ssthresh, "initial value of slow start threshold");
 module_param(smooth_part, int, 0644);
 MODULE_PARM_DESC(smooth_part, "log(B/(B*Smin))/log(B/(B-1))+B, # of RTT from Wmax-B to Wmax");
 
-
 /* BIC TCP Parameters */
 struct bictcp {
         u32     cnt;            /* increase cwnd by 1 after ACKs */
-        u32     last_max_cwnd;  /* last maximum snd_cwnd */
+        u32     last_max_cwnd;  /* last maximum snd_cwnd */
         u32     loss_cwnd;      /* congestion window at last loss */
         u32     last_cwnd;      /* the last snd_cwnd */
         u32     last_time;      /* time when updated last_cwnd */
@@ -103,7 +101,7 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
 
         /* binary increase */
         if (cwnd < ca->last_max_cwnd) {
-                __u32   dist = (ca->last_max_cwnd - cwnd)
+                __u32   dist = (ca->last_max_cwnd - cwnd)
                         / BICTCP_B;
 
                 if (dist > max_increment)
@@ -154,7 +152,6 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
                 bictcp_update(ca, tp->snd_cwnd);
                 tcp_cong_avoid_ai(tp, ca->cnt);
         }
-
 }
 
 /*
@@ -177,7 +174,6 @@ static u32 bictcp_recalc_ssthresh(struct sock *sk)
 
         ca->loss_cwnd = tp->snd_cwnd;
 
-
         if (tp->snd_cwnd <= low_window)
                 return max(tp->snd_cwnd >> 1U, 2U);
         else
@@ -188,6 +184,7 @@ static u32 bictcp_undo_cwnd(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct bictcp *ca = inet_csk_ca(sk);
+
         return max(tp->snd_cwnd, ca->loss_cwnd);
 }
 
@@ -206,12 +203,12 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt)
 
         if (icsk->icsk_ca_state == TCP_CA_Open) {
                 struct bictcp *ca = inet_csk_ca(sk);
+
                 cnt -= ca->delayed_ack >> ACK_RATIO_SHIFT;
                 ca->delayed_ack += cnt;
         }
 }
 
-
 static struct tcp_congestion_ops bictcp __read_mostly = {
         .init           = bictcp_init,
         .ssthresh       = bictcp_recalc_ssthresh,
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 7b09d8b49fa5..b1c5970d47a1 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -74,24 +74,34 @@ void tcp_unregister_congestion_control(struct tcp_congestion_ops *ca)
 EXPORT_SYMBOL_GPL(tcp_unregister_congestion_control);
 
 /* Assign choice of congestion control. */
-void tcp_init_congestion_control(struct sock *sk)
+void tcp_assign_congestion_control(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_congestion_ops *ca;
 
-        /* if no choice made yet assign the current value set as default */
-        if (icsk->icsk_ca_ops == &tcp_init_congestion_ops) {
-                rcu_read_lock();
-                list_for_each_entry_rcu(ca, &tcp_cong_list, list) {
-                        if (try_module_get(ca->owner)) {
-                                icsk->icsk_ca_ops = ca;
-                                break;
-                        }
-
-                        /* fallback to next available */
+        rcu_read_lock();
+        list_for_each_entry_rcu(ca, &tcp_cong_list, list) {
+                if (likely(try_module_get(ca->owner))) {
+                        icsk->icsk_ca_ops = ca;
+                        goto out;
                 }
-                rcu_read_unlock();
+                /* Fallback to next available. The last really
+                 * guaranteed fallback is Reno from this list.
+                 */
         }
+out:
+        rcu_read_unlock();
+
+        /* Clear out private data before diag gets it and
+         * the ca has not been initialized.
+         */
+        if (ca->get_info)
+                memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));
+}
+
+void tcp_init_congestion_control(struct sock *sk)
+{
+        const struct inet_connection_sock *icsk = inet_csk(sk);
 
         if (icsk->icsk_ca_ops->init)
                 icsk->icsk_ca_ops->init(sk);
@@ -142,7 +152,6 @@ static int __init tcp_congestion_default(void)
 }
 late_initcall(tcp_congestion_default);
 
-
 /* Build string with list of available congestion control values */
 void tcp_get_available_congestion_control(char *buf, size_t maxlen)
 {
@@ -154,7 +163,6 @@ void tcp_get_available_congestion_control(char *buf, size_t maxlen)
                 offs += snprintf(buf + offs, maxlen - offs,
                                  "%s%s",
                                  offs == 0 ? "" : " ", ca->name);
-
         }
         rcu_read_unlock();
 }
@@ -186,7 +194,6 @@ void tcp_get_allowed_congestion_control(char *buf, size_t maxlen)
                 offs += snprintf(buf + offs, maxlen - offs,
                                  "%s%s",
                                  offs == 0 ? "" : " ", ca->name);
-
         }
         rcu_read_unlock();
 }
@@ -230,7 +237,6 @@ out:
         return ret;
 }
 
-
 /* Change congestion control for socket */
 int tcp_set_congestion_control(struct sock *sk, const char *name)
 {
@@ -285,15 +291,13 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
  * ABC caps N to 2. Slow start exits when cwnd grows over ssthresh and
  * returns the leftover acks to adjust cwnd in congestion avoidance mode.
  */
-int tcp_slow_start(struct tcp_sock *tp, u32 acked)
+void tcp_slow_start(struct tcp_sock *tp, u32 acked)
 {
         u32 cwnd = tp->snd_cwnd + acked;
 
         if (cwnd > tp->snd_ssthresh)
                 cwnd = tp->snd_ssthresh + 1;
-        acked -= cwnd - tp->snd_cwnd;
         tp->snd_cwnd = min(cwnd, tp->snd_cwnd_clamp);
-        return acked;
 }
 EXPORT_SYMBOL_GPL(tcp_slow_start);
 
@@ -337,6 +341,7 @@ EXPORT_SYMBOL_GPL(tcp_reno_cong_avoid);
 u32 tcp_reno_ssthresh(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
+
         return max(tp->snd_cwnd >> 1U, 2U);
 }
 EXPORT_SYMBOL_GPL(tcp_reno_ssthresh);
@@ -348,15 +353,3 @@ struct tcp_congestion_ops tcp_reno = {
         .ssthresh       = tcp_reno_ssthresh,
         .cong_avoid     = tcp_reno_cong_avoid,
 };
-
-/* Initial congestion control used (until SYN)
- * really reno under another name so we can tell difference
- * during tcp_set_default_congestion_control
- */
-struct tcp_congestion_ops tcp_init_congestion_ops  = {
-        .name           = "",
-        .owner          = THIS_MODULE,
-        .ssthresh       = tcp_reno_ssthresh,
-        .cong_avoid     = tcp_reno_cong_avoid,
-};
-EXPORT_SYMBOL_GPL(tcp_init_congestion_ops);
diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
index a9bd8a4828a9..20de0118c98e 100644
--- a/net/ipv4/tcp_cubic.c
+++ b/net/ipv4/tcp_cubic.c
@@ -82,12 +82,13 @@ MODULE_PARM_DESC(hystart_ack_delta, "spacing between ack's indicating train (mse
 /* BIC TCP Parameters */
 struct bictcp {
         u32     cnt;            /* increase cwnd by 1 after ACKs */
-        u32     last_max_cwnd;  /* last maximum snd_cwnd */
+        u32     last_max_cwnd;  /* last maximum snd_cwnd */
         u32     loss_cwnd;      /* congestion window at last loss */
         u32     last_cwnd;      /* the last snd_cwnd */
         u32     last_time;      /* time when updated last_cwnd */
         u32     bic_origin_point;/* origin point of bic function */
-        u32     bic_K;          /* time to origin point from the beginning of the current epoch */
+        u32     bic_K;          /* time to origin point
+                                   from the beginning of the current epoch */
         u32     delay_min;      /* min delay (msec << 3) */
         u32     epoch_start;    /* beginning of an epoch */
         u32     ack_cnt;        /* number of acks */
@@ -219,7 +220,7 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
         ca->last_time = tcp_time_stamp;
 
         if (ca->epoch_start == 0) {
-                ca->epoch_start = tcp_time_stamp;       /* record the beginning of an epoch */
+                ca->epoch_start = tcp_time_stamp;       /* record beginning */
                 ca->ack_cnt = 1;                        /* start counting */
                 ca->tcp_cwnd = cwnd;                    /* syn with cubic */
 
@@ -263,9 +264,9 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
 
         /* c/rtt * (t-K)^3 */
         delta = (cube_rtt_scale * offs * offs * offs) >> (10+3*BICTCP_HZ);
-        if (t < ca->bic_K)                                      /* below origin*/
+        if (t < ca->bic_K)                            /* below origin*/
                 bic_target = ca->bic_origin_point - delta;
-        else                                                    /* above origin*/
+        else                                          /* above origin*/
                 bic_target = ca->bic_origin_point + delta;
 
         /* cubic function - calc bictcp_cnt*/
@@ -285,13 +286,14 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
         /* TCP Friendly */
         if (tcp_friendliness) {
                 u32 scale = beta_scale;
+
                 delta = (cwnd * scale) >> 3;
                 while (ca->ack_cnt > delta) {           /* update tcp cwnd */
                         ca->ack_cnt -= delta;
                         ca->tcp_cwnd++;
                 }
 
-                if (ca->tcp_cwnd > cwnd){       /* if bic is slower than tcp */
+                if (ca->tcp_cwnd > cwnd) {      /* if bic is slower than tcp */
                         delta = ca->tcp_cwnd - cwnd;
                         max_cnt = cwnd / delta;
                         if (ca->cnt > max_cnt)
@@ -320,7 +322,6 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
                 bictcp_update(ca, tp->snd_cwnd);
                 tcp_cong_avoid_ai(tp, ca->cnt);
         }
-
 }
 
 static u32 bictcp_recalc_ssthresh(struct sock *sk)
@@ -452,7 +453,8 @@ static int __init cubictcp_register(void)
          * based on SRTT of 100ms
          */
 
-        beta_scale = 8*(BICTCP_BETA_SCALE+beta)/ 3 / (BICTCP_BETA_SCALE - beta);
+        beta_scale = 8*(BICTCP_BETA_SCALE+beta) / 3
+                / (BICTCP_BETA_SCALE - beta);
 
         cube_rtt_scale = (bic_scale * 10);      /* 1024*c/rtt */
 
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
new file mode 100644
index 000000000000..b504371af742
--- /dev/null
+++ b/net/ipv4/tcp_dctcp.c
@@ -0,0 +1,344 @@
+/* DataCenter TCP (DCTCP) congestion control.
+ *
+ * http://simula.stanford.edu/~alizade/Site/DCTCP.html
+ *
+ * This is an implementation of DCTCP over Reno, an enhancement to the
+ * TCP congestion control algorithm designed for data centers. DCTCP
+ * leverages Explicit Congestion Notification (ECN) in the network to
+ * provide multi-bit feedback to the end hosts. DCTCP's goal is to meet
+ * the following three data center transport requirements:
+ *
+ *  - High burst tolerance (incast due to partition/aggregate)
+ *  - Low latency (short flows, queries)
+ *  - High throughput (continuous data updates, large file transfers)
+ *    with commodity shallow buffered switches
+ *
+ * The algorithm is described in detail in the following two papers:
+ *
+ * 1) Mohammad Alizadeh, Albert Greenberg, David A. Maltz, Jitendra Padhye,
+ *    Parveen Patel, Balaji Prabhakar, Sudipta Sengupta, and Murari Sridharan:
+ *      "Data Center TCP (DCTCP)", Data Center Networks session
+ *      Proc. ACM SIGCOMM, New Delhi, 2010.
+ *   http://simula.stanford.edu/~alizade/Site/DCTCP_files/dctcp-final.pdf
+ *
+ * 2) Mohammad Alizadeh, Adel Javanmard, and Balaji Prabhakar:
+ *      "Analysis of DCTCP: Stability, Convergence, and Fairness"
+ *      Proc. ACM SIGMETRICS, San Jose, 2011.
+ *   http://simula.stanford.edu/~alizade/Site/DCTCP_files/dctcp_analysis-full.pdf
+ *
+ * Initial prototype from Abdul Kabbani, Masato Yasuda and Mohammad Alizadeh.
+ *
+ * Authors:
+ *
+ *      Daniel Borkmann <dborkman@redhat.com>
+ *      Florian Westphal <fw@strlen.de>
+ *      Glenn Judd <glenn.judd@morganstanley.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or (at
+ * your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/mm.h>
+#include <net/tcp.h>
+#include <linux/inet_diag.h>
+
+#define DCTCP_MAX_ALPHA 1024U
+
+struct dctcp {
+        u32 acked_bytes_ecn;
+        u32 acked_bytes_total;
+        u32 prior_snd_una;
+        u32 prior_rcv_nxt;
+        u32 dctcp_alpha;
+        u32 next_seq;
+        u32 ce_state;
+        u32 delayed_ack_reserved;
+};
+
+static unsigned int dctcp_shift_g __read_mostly = 4; /* g = 1/2^4 */
+module_param(dctcp_shift_g, uint, 0644);
+MODULE_PARM_DESC(dctcp_shift_g, "parameter g for updating dctcp_alpha");
+
+static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA;
+module_param(dctcp_alpha_on_init, uint, 0644);
+MODULE_PARM_DESC(dctcp_alpha_on_init, "parameter for initial alpha value");
+
+static unsigned int dctcp_clamp_alpha_on_loss __read_mostly;
+module_param(dctcp_clamp_alpha_on_loss, uint, 0644);
+MODULE_PARM_DESC(dctcp_clamp_alpha_on_loss,
+                 "parameter for clamping alpha on loss");
+
+static struct tcp_congestion_ops dctcp_reno;
+
+static void dctcp_reset(const struct tcp_sock *tp, struct dctcp *ca)
+{
+        ca->next_seq = tp->snd_nxt;
+
+        ca->acked_bytes_ecn = 0;
+        ca->acked_bytes_total = 0;
+}
+
+static void dctcp_init(struct sock *sk)
+{
+        const struct tcp_sock *tp = tcp_sk(sk);
+
+        if ((tp->ecn_flags & TCP_ECN_OK) ||
+            (sk->sk_state == TCP_LISTEN ||
+             sk->sk_state == TCP_CLOSE)) {
+                struct dctcp *ca = inet_csk_ca(sk);
+
+                ca->prior_snd_una = tp->snd_una;
+                ca->prior_rcv_nxt = tp->rcv_nxt;
+
+                ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
+
+                ca->delayed_ack_reserved = 0;
+                ca->ce_state = 0;
+
+                dctcp_reset(tp, ca);
+                return;
+        }
+
+        /* No ECN support? Fall back to Reno. Also need to clear
+         * ECT from sk since it is set during 3WHS for DCTCP.
+         */
+        inet_csk(sk)->icsk_ca_ops = &dctcp_reno;
+        INET_ECN_dontxmit(sk);
+}
+
+static u32 dctcp_ssthresh(struct sock *sk)
+{
+        const struct dctcp *ca = inet_csk_ca(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        return max(tp->snd_cwnd - ((tp->snd_cwnd * ca->dctcp_alpha) >> 11U), 2U);
+}
+
+/* Minimal DCTP CE state machine:
+ *
+ * S:   0 <- last pkt was non-CE
+ *      1 <- last pkt was CE
+ */
+
+static void dctcp_ce_state_0_to_1(struct sock *sk)
+{
+        struct dctcp *ca = inet_csk_ca(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        /* State has changed from CE=0 to CE=1 and delayed
+         * ACK has not sent yet.
+         */
+        if (!ca->ce_state && ca->delayed_ack_reserved) {
+                u32 tmp_rcv_nxt;
+
+                /* Save current rcv_nxt. */
+                tmp_rcv_nxt = tp->rcv_nxt;
+
+                /* Generate previous ack with CE=0. */
+                tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
+                tp->rcv_nxt = ca->prior_rcv_nxt;
+
+                tcp_send_ack(sk);
+
+                /* Recover current rcv_nxt. */
+                tp->rcv_nxt = tmp_rcv_nxt;
+        }
+
+        ca->prior_rcv_nxt = tp->rcv_nxt;
+        ca->ce_state = 1;
+
+        tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
+}
+
+static void dctcp_ce_state_1_to_0(struct sock *sk)
+{
+        struct dctcp *ca = inet_csk_ca(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        /* State has changed from CE=1 to CE=0 and delayed
+         * ACK has not sent yet.
+         */
+        if (ca->ce_state && ca->delayed_ack_reserved) {
+                u32 tmp_rcv_nxt;
+
+                /* Save current rcv_nxt. */
+                tmp_rcv_nxt = tp->rcv_nxt;
+
+                /* Generate previous ack with CE=1. */
+                tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
+                tp->rcv_nxt = ca->prior_rcv_nxt;
+
+                tcp_send_ack(sk);
+
+                /* Recover current rcv_nxt. */
+                tp->rcv_nxt = tmp_rcv_nxt;
+        }
+
+        ca->prior_rcv_nxt = tp->rcv_nxt;
+        ca->ce_state = 0;
+
+        tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
+}
+
+static void dctcp_update_alpha(struct sock *sk, u32 flags)
+{
+        const struct tcp_sock *tp = tcp_sk(sk);
+        struct dctcp *ca = inet_csk_ca(sk);
+        u32 acked_bytes = tp->snd_una - ca->prior_snd_una;
+
+        /* If ack did not advance snd_una, count dupack as MSS size.
+         * If ack did update window, do not count it at all.
+         */
+        if (acked_bytes == 0 && !(flags & CA_ACK_WIN_UPDATE))
+                acked_bytes = inet_csk(sk)->icsk_ack.rcv_mss;
+        if (acked_bytes) {
+                ca->acked_bytes_total += acked_bytes;
+                ca->prior_snd_una = tp->snd_una;
+
+                if (flags & CA_ACK_ECE)
+                        ca->acked_bytes_ecn += acked_bytes;
+        }
+
+        /* Expired RTT */
+        if (!before(tp->snd_una, ca->next_seq)) {
+                /* For avoiding denominator == 1. */
+                if (ca->acked_bytes_total == 0)
+                        ca->acked_bytes_total = 1;
+
+                /* alpha = (1 - g) * alpha + g * F */
+                ca->dctcp_alpha = ca->dctcp_alpha -
+                                  (ca->dctcp_alpha >> dctcp_shift_g) +
+                                  (ca->acked_bytes_ecn << (10U - dctcp_shift_g)) /
+                                  ca->acked_bytes_total;
+
+                if (ca->dctcp_alpha > DCTCP_MAX_ALPHA)
+                        /* Clamp dctcp_alpha to max. */
+                        ca->dctcp_alpha = DCTCP_MAX_ALPHA;
+
+                dctcp_reset(tp, ca);
+        }
+}
+
+static void dctcp_state(struct sock *sk, u8 new_state)
+{
+        if (dctcp_clamp_alpha_on_loss && new_state == TCP_CA_Loss) {
+                struct dctcp *ca = inet_csk_ca(sk);
+
+                /* If this extension is enabled, we clamp dctcp_alpha to
+                 * max on packet loss; the motivation is that dctcp_alpha
+                 * is an indicator to the extend of congestion and packet
+                 * loss is an indicator of extreme congestion; setting
+                 * this in practice turned out to be beneficial, and
+                 * effectively assumes total congestion which reduces the
+                 * window by half.
+                 */
+                ca->dctcp_alpha = DCTCP_MAX_ALPHA;
+        }
+}
+
+static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev)
+{
+        struct dctcp *ca = inet_csk_ca(sk);
+
+        switch (ev) {
+        case CA_EVENT_DELAYED_ACK:
+                if (!ca->delayed_ack_reserved)
+                        ca->delayed_ack_reserved = 1;
+                break;
+        case CA_EVENT_NON_DELAYED_ACK:
+                if (ca->delayed_ack_reserved)
+                        ca->delayed_ack_reserved = 0;
+                break;
+        default:
+                /* Don't care for the rest. */
+                break;
+        }
+}
+
+static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
+{
+        switch (ev) {
+        case CA_EVENT_ECN_IS_CE:
+                dctcp_ce_state_0_to_1(sk);
+                break;
+        case CA_EVENT_ECN_NO_CE:
+                dctcp_ce_state_1_to_0(sk);
+                break;
+        case CA_EVENT_DELAYED_ACK:
+        case CA_EVENT_NON_DELAYED_ACK:
+                dctcp_update_ack_reserved(sk, ev);
+                break;
+        default:
+                /* Don't care for the rest. */
+                break;
+        }
+}
+
+static void dctcp_get_info(struct sock *sk, u32 ext, struct sk_buff *skb)
+{
+        const struct dctcp *ca = inet_csk_ca(sk);
+
+        /* Fill it also in case of VEGASINFO due to req struct limits.
+         * We can still correctly retrieve it later.
+         */
+        if (ext & (1 << (INET_DIAG_DCTCPINFO - 1)) ||
+            ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
+                struct tcp_dctcp_info info;
+
+                memset(&info, 0, sizeof(info));
+                if (inet_csk(sk)->icsk_ca_ops != &dctcp_reno) {
+                        info.dctcp_enabled = 1;
+                        info.dctcp_ce_state = (u16) ca->ce_state;
+                        info.dctcp_alpha = ca->dctcp_alpha;
+                        info.dctcp_ab_ecn = ca->acked_bytes_ecn;
+                        info.dctcp_ab_tot = ca->acked_bytes_total;
+                }
+
+                nla_put(skb, INET_DIAG_DCTCPINFO, sizeof(info), &info);
+        }
+}
+
+static struct tcp_congestion_ops dctcp __read_mostly = {
+        .init           = dctcp_init,
+        .in_ack_event   = dctcp_update_alpha,
+        .cwnd_event     = dctcp_cwnd_event,
+        .ssthresh       = dctcp_ssthresh,
+        .cong_avoid     = tcp_reno_cong_avoid,
+        .set_state      = dctcp_state,
+        .get_info       = dctcp_get_info,
+        .flags          = TCP_CONG_NEEDS_ECN,
+        .owner          = THIS_MODULE,
+        .name           = "dctcp",
+};
+
+static struct tcp_congestion_ops dctcp_reno __read_mostly = {
+        .ssthresh       = tcp_reno_ssthresh,
+        .cong_avoid     = tcp_reno_cong_avoid,
+        .get_info       = dctcp_get_info,
+        .owner          = THIS_MODULE,
+        .name           = "dctcp-reno",
+};
+
+static int __init dctcp_register(void)
+{
+        BUILD_BUG_ON(sizeof(struct dctcp) > ICSK_CA_PRIV_SIZE);
+        return tcp_register_congestion_control(&dctcp);
+}
+
+static void __exit dctcp_unregister(void)
+{
+        tcp_unregister_congestion_control(&dctcp);
+}
+
+module_init(dctcp_register);
+module_exit(dctcp_unregister);
+
+MODULE_AUTHOR("Daniel Borkmann <dborkman@redhat.com>");
+MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
+MODULE_AUTHOR("Glenn Judd <glenn.judd@morganstanley.com>");
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("DataCenter TCP (DCTCP)");
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index ed3f2ad42e0f..0d73f9ddb55b 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -9,7 +9,6 @@
  *      2 of the License, or (at your option) any later version.
  */
 
-
 #include <linux/module.h>
 #include <linux/inet_diag.h>
 
@@ -35,13 +34,13 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
 }
 
 static void tcp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
-                struct inet_diag_req_v2 *r, struct nlattr *bc)
+                          struct inet_diag_req_v2 *r, struct nlattr *bc)
 {
         inet_diag_dump_icsk(&tcp_hashinfo, skb, cb, r, bc);
 }
 
 static int tcp_diag_dump_one(struct sk_buff *in_skb, const struct nlmsghdr *nlh,
-                struct inet_diag_req_v2 *req)
+                             struct inet_diag_req_v2 *req)
 {
         return inet_diag_dump_one_icsk(&tcp_hashinfo, in_skb, nlh, req);
 }
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 9771563ab564..815c85e3b1e0 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -115,7 +115,7 @@ static bool tcp_fastopen_cookie_gen(struct request_sock *req,
 
                 if (__tcp_fastopen_cookie_gen(&ip6h->saddr, &tmp)) {
                         struct in6_addr *buf = (struct in6_addr *) tmp.val;
-                        int i = 4;
+                        int i;
 
                         for (i = 0; i < 4; i++)
                                 buf->s6_addr32[i] ^= ip6h->daddr.s6_addr32[i];
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index 1c4908280d92..882c08aae2f5 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -9,7 +9,6 @@
 #include <linux/module.h>
 #include <net/tcp.h>
 
-
 /* From AIMD tables from RFC 3649 appendix B,
  * with fixed-point MD scaled <<8.
  */
@@ -17,78 +16,78 @@ static const struct hstcp_aimd_val {
         unsigned int cwnd;
         unsigned int md;
 } hstcp_aimd_vals[] = {
- {     38,  128, /*  0.50 */ },
- {    118,  112, /*  0.44 */ },
- {    221,  104, /*  0.41 */ },
- {    347,   98, /*  0.38 */ },
- {    495,   93, /*  0.37 */ },
- {    663,   89, /*  0.35 */ },
- {    851,   86, /*  0.34 */ },
- {   1058,   83, /*  0.33 */ },
- {   1284,   81, /*  0.32 */ },
- {   1529,   78, /*  0.31 */ },
- {   1793,   76, /*  0.30 */ },
- {   2076,   74, /*  0.29 */ },
- {   2378,   72, /*  0.28 */ },
- {   2699,   71, /*  0.28 */ },
- {   3039,   69, /*  0.27 */ },
- {   3399,   68, /*  0.27 */ },
- {   3778,   66, /*  0.26 */ },
- {   4177,   65, /*  0.26 */ },
- {   4596,   64, /*  0.25 */ },
- {   5036,   62, /*  0.25 */ },
- {   5497,   61, /*  0.24 */ },
- {   5979,   60, /*  0.24 */ },
- {   6483,   59, /*  0.23 */ },
- {   7009,   58, /*  0.23 */ },
- {   7558,   57, /*  0.22 */ },
- {   8130,   56, /*  0.22 */ },
- {   8726,   55, /*  0.22 */ },
- {   9346,   54, /*  0.21 */ },
- {   9991,   53, /*  0.21 */ },
- {  10661,   52, /*  0.21 */ },
- {  11358,   52, /*  0.20 */ },
- {  12082,   51, /*  0.20 */ },
- {  12834,   50, /*  0.20 */ },
- {  13614,   49, /*  0.19 */ },
- {  14424,   48, /*  0.19 */ },
- {  15265,   48, /*  0.19 */ },
- {  16137,   47, /*  0.19 */ },
- {  17042,   46, /*  0.18 */ },
- {  17981,   45, /*  0.18 */ },
- {  18955,   45, /*  0.18 */ },
- {  19965,   44, /*  0.17 */ },
- {  21013,   43, /*  0.17 */ },
- {  22101,   43, /*  0.17 */ },
- {  23230,   42, /*  0.17 */ },
- {  24402,   41, /*  0.16 */ },
- {  25618,   41, /*  0.16 */ },
- {  26881,   40, /*  0.16 */ },
- {  28193,   39, /*  0.16 */ },
- {  29557,   39, /*  0.15 */ },
- {  30975,   38, /*  0.15 */ },
- {  32450,   38, /*  0.15 */ },
- {  33986,   37, /*  0.15 */ },
- {  35586,   36, /*  0.14 */ },
- {  37253,   36, /*  0.14 */ },
- {  38992,   35, /*  0.14 */ },
- {  40808,   35, /*  0.14 */ },
- {  42707,   34, /*  0.13 */ },
- {  44694,   33, /*  0.13 */ },
- {  46776,   33, /*  0.13 */ },
- {  48961,   32, /*  0.13 */ },
- {  51258,   32, /*  0.13 */ },
- {  53677,   31, /*  0.12 */ },
- {  56230,   30, /*  0.12 */ },
- {  58932,   30, /*  0.12 */ },
- {  61799,   29, /*  0.12 */ },
- {  64851,   28, /*  0.11 */ },
- {  68113,   28, /*  0.11 */ },
- {  71617,   27, /*  0.11 */ },
- {  75401,   26, /*  0.10 */ },
- {  79517,   26, /*  0.10 */ },
- {  84035,   25, /*  0.10 */ },
- {  89053,   24, /*  0.10 */ },
+        {     38,  128, /*  0.50 */ },
+        {    118,  112, /*  0.44 */ },
+        {    221,  104, /*  0.41 */ },
+        {    347,   98, /*  0.38 */ },
+        {    495,   93, /*  0.37 */ },
+        {    663,   89, /*  0.35 */ },
+        {    851,   86, /*  0.34 */ },
+        {   1058,   83, /*  0.33 */ },
+        {   1284,   81, /*  0.32 */ },
+        {   1529,   78, /*  0.31 */ },
+        {   1793,   76, /*  0.30 */ },
+        {   2076,   74, /*  0.29 */ },
+        {   2378,   72, /*  0.28 */ },
+        {   2699,   71, /*  0.28 */ },
+        {   3039,   69, /*  0.27 */ },
+        {   3399,   68, /*  0.27 */ },
+        {   3778,   66, /*  0.26 */ },
+        {   4177,   65, /*  0.26 */ },
+        {   4596,   64, /*  0.25 */ },
+        {   5036,   62, /*  0.25 */ },
+        {   5497,   61, /*  0.24 */ },
+        {   5979,   60, /*  0.24 */ },
+        {   6483,   59, /*  0.23 */ },
+        {   7009,   58, /*  0.23 */ },
+        {   7558,   57, /*  0.22 */ },
+        {   8130,   56, /*  0.22 */ },
+        {   8726,   55, /*  0.22 */ },
+        {   9346,   54, /*  0.21 */ },
+        {   9991,   53, /*  0.21 */ },
+        {  10661,   52, /*  0.21 */ },
+        {  11358,   52, /*  0.20 */ },
+        {  12082,   51, /*  0.20 */ },
+        {  12834,   50, /*  0.20 */ },
+        {  13614,   49, /*  0.19 */ },
+        {  14424,   48, /*  0.19 */ },
+        {  15265,   48, /*  0.19 */ },
+        {  16137,   47, /*  0.19 */ },
+        {  17042,   46, /*  0.18 */ },
+        {  17981,   45, /*  0.18 */ },
+        {  18955,   45, /*  0.18 */ },
+        {  19965,   44, /*  0.17 */ },
+        {  21013,   43, /*  0.17 */ },
+        {  22101,   43, /*  0.17 */ },
+        {  23230,   42, /*  0.17 */ },
+        {  24402,   41, /*  0.16 */ },
+        {  25618,   41, /*  0.16 */ },
+        {  26881,   40, /*  0.16 */ },
+        {  28193,   39, /*  0.16 */ },
+        {  29557,   39, /*  0.15 */ },
+        {  30975,   38, /*  0.15 */ },
+        {  32450,   38, /*  0.15 */ },
+        {  33986,   37, /*  0.15 */ },
+        {  35586,   36, /*  0.14 */ },
+        {  37253,   36, /*  0.14 */ },
+        {  38992,   35, /*  0.14 */ },
+        {  40808,   35, /*  0.14 */ },
+        {  42707,   34, /*  0.13 */ },
+        {  44694,   33, /*  0.13 */ },
+        {  46776,   33, /*  0.13 */ },
+        {  48961,   32, /*  0.13 */ },
+        {  51258,   32, /*  0.13 */ },
+        {  53677,   31, /*  0.12 */ },
+        {  56230,   30, /*  0.12 */ },
+        {  58932,   30, /*  0.12 */ },
+        {  61799,   29, /*  0.12 */ },
+        {  64851,   28, /*  0.11 */ },
+        {  68113,   28, /*  0.11 */ },
+        {  71617,   27, /*  0.11 */ },
+        {  75401,   26, /*  0.10 */ },
+        {  79517,   26, /*  0.10 */ },
+        {  84035,   25, /*  0.10 */ },
+        {  89053,   24, /*  0.10 */ },
 };
 
 #define HSTCP_AIMD_MAX  ARRAY_SIZE(hstcp_aimd_vals)
diff --git a/net/ipv4/tcp_htcp.c b/net/ipv4/tcp_htcp.c
index 031361311a8b..58469fff6c18 100644
--- a/net/ipv4/tcp_htcp.c
+++ b/net/ipv4/tcp_htcp.c
@@ -98,7 +98,8 @@ static inline void measure_rtt(struct sock *sk, u32 srtt)
         }
 }
 
-static void measure_achieved_throughput(struct sock *sk, u32 pkts_acked, s32 rtt)
+static void measure_achieved_throughput(struct sock *sk,
+                                        u32 pkts_acked, s32 rtt)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         const struct tcp_sock *tp = tcp_sk(sk);
@@ -148,8 +149,8 @@ static inline void htcp_beta_update(struct htcp *ca, u32 minRTT, u32 maxRTT)
         if (use_bandwidth_switch) {
                 u32 maxB = ca->maxB;
                 u32 old_maxB = ca->old_maxB;
-                ca->old_maxB = ca->maxB;
 
+                ca->old_maxB = ca->maxB;
                 if (!between(5 * maxB, 4 * old_maxB, 6 * old_maxB)) {
                         ca->beta = BETA_MIN;
                         ca->modeswitch = 0;
@@ -270,6 +271,7 @@ static void htcp_state(struct sock *sk, u8 new_state)
         case TCP_CA_Open:
                 {
                         struct htcp *ca = inet_csk_ca(sk);
+
                         if (ca->undo_last_cong) {
                                 ca->last_cong = jiffies;
                                 ca->undo_last_cong = 0;
diff --git a/net/ipv4/tcp_hybla.c b/net/ipv4/tcp_hybla.c
index d8f8f05a4951..f963b274f2b0 100644
--- a/net/ipv4/tcp_hybla.c
+++ b/net/ipv4/tcp_hybla.c
@@ -29,7 +29,6 @@ static int rtt0 = 25;
 module_param(rtt0, int, 0644);
 MODULE_PARM_DESC(rtt0, "reference rout trip time (ms)");
 
-
 /* This is called to refresh values for hybla parameters */
 static inline void hybla_recalc_param (struct sock *sk)
 {
diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c
index 5999b3972e64..1d5a30a90adf 100644
--- a/net/ipv4/tcp_illinois.c
+++ b/net/ipv4/tcp_illinois.c
@@ -284,7 +284,7 @@ static void tcp_illinois_cong_avoid(struct sock *sk, u32 ack, u32 acked)
                 delta = (tp->snd_cwnd_cnt * ca->alpha) >> ALPHA_SHIFT;
                 if (delta >= tp->snd_cwnd) {
                         tp->snd_cwnd = min(tp->snd_cwnd + delta / tp->snd_cwnd,
-                                           (u32) tp->snd_cwnd_clamp);
+                                           (u32)tp->snd_cwnd_clamp);
                         tp->snd_cwnd_cnt = 0;
                 }
         }
@@ -299,7 +299,6 @@ static u32 tcp_illinois_ssthresh(struct sock *sk)
         return max(tp->snd_cwnd - ((tp->snd_cwnd * ca->beta) >> BETA_SHIFT), 2U);
 }
 
-
 /* Extract info for Tcp socket info provided via netlink. */
 static void tcp_illinois_info(struct sock *sk, u32 ext,
                               struct sk_buff *skb)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0185eea59342..00a41499d52c 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -200,28 +200,25 @@ static inline bool tcp_in_quickack_mode(const struct sock *sk)
         return icsk->icsk_ack.quick && !icsk->icsk_ack.pingpong;
 }
 
-static inline void TCP_ECN_queue_cwr(struct tcp_sock *tp)
+static void tcp_ecn_queue_cwr(struct tcp_sock *tp)
 {
         if (tp->ecn_flags & TCP_ECN_OK)
                 tp->ecn_flags |= TCP_ECN_QUEUE_CWR;
 }
 
-static inline void TCP_ECN_accept_cwr(struct tcp_sock *tp, const struct sk_buff *skb)
+static void tcp_ecn_accept_cwr(struct tcp_sock *tp, const struct sk_buff *skb)
 {
         if (tcp_hdr(skb)->cwr)
                 tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
 }
 
-static inline void TCP_ECN_withdraw_cwr(struct tcp_sock *tp)
+static void tcp_ecn_withdraw_cwr(struct tcp_sock *tp)
 {
         tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
 }
 
-static inline void TCP_ECN_check_ce(struct tcp_sock *tp, const struct sk_buff *skb)
+static void __tcp_ecn_check_ce(struct tcp_sock *tp, const struct sk_buff *skb)
 {
-        if (!(tp->ecn_flags & TCP_ECN_OK))
-                return;
-
         switch (TCP_SKB_CB(skb)->ip_dsfield & INET_ECN_MASK) {
         case INET_ECN_NOT_ECT:
                 /* Funny extension: if ECT is not set on a segment,
@@ -232,30 +229,43 @@ static inline void TCP_ECN_check_ce(struct tcp_sock *tp, const struct sk_buff *s
                         tcp_enter_quickack_mode((struct sock *)tp);
                 break;
         case INET_ECN_CE:
+                if (tcp_ca_needs_ecn((struct sock *)tp))
+                        tcp_ca_event((struct sock *)tp, CA_EVENT_ECN_IS_CE);
+
                 if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) {
                         /* Better not delay acks, sender can have a very low cwnd */
                         tcp_enter_quickack_mode((struct sock *)tp);
                         tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
                 }
-                /* fallinto */
+                tp->ecn_flags |= TCP_ECN_SEEN;
+                break;
         default:
+                if (tcp_ca_needs_ecn((struct sock *)tp))
+                        tcp_ca_event((struct sock *)tp, CA_EVENT_ECN_NO_CE);
                 tp->ecn_flags |= TCP_ECN_SEEN;
+                break;
         }
 }
 
-static inline void TCP_ECN_rcv_synack(struct tcp_sock *tp, const struct tcphdr *th)
+static void tcp_ecn_check_ce(struct tcp_sock *tp, const struct sk_buff *skb)
+{
+        if (tp->ecn_flags & TCP_ECN_OK)
+                __tcp_ecn_check_ce(tp, skb);
+}
+
+static void tcp_ecn_rcv_synack(struct tcp_sock *tp, const struct tcphdr *th)
 {
         if ((tp->ecn_flags & TCP_ECN_OK) && (!th->ece || th->cwr))
                 tp->ecn_flags &= ~TCP_ECN_OK;
 }
 
-static inline void TCP_ECN_rcv_syn(struct tcp_sock *tp, const struct tcphdr *th)
+static void tcp_ecn_rcv_syn(struct tcp_sock *tp, const struct tcphdr *th)
 {
         if ((tp->ecn_flags & TCP_ECN_OK) && (!th->ece || !th->cwr))
                 tp->ecn_flags &= ~TCP_ECN_OK;
 }
 
-static bool TCP_ECN_rcv_ecn_echo(const struct tcp_sock *tp, const struct tcphdr *th)
+static bool tcp_ecn_rcv_ecn_echo(const struct tcp_sock *tp, const struct tcphdr *th)
 {
         if (th->ece && !th->syn && (tp->ecn_flags & TCP_ECN_OK))
                 return true;
@@ -652,7 +662,7 @@ static void tcp_event_data_recv(struct sock *sk, struct sk_buff *skb)
         }
         icsk->icsk_ack.lrcvtime = now;
 
-        TCP_ECN_check_ce(tp, skb);
+        tcp_ecn_check_ce(tp, skb);
 
         if (skb->len >= 128)
                 tcp_grow_window(sk, skb);
@@ -1294,9 +1304,9 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
         TCP_SKB_CB(prev)->end_seq += shifted;
         TCP_SKB_CB(skb)->seq += shifted;
 
-        skb_shinfo(prev)->gso_segs += pcount;
-        BUG_ON(skb_shinfo(skb)->gso_segs < pcount);
-        skb_shinfo(skb)->gso_segs -= pcount;
+        tcp_skb_pcount_add(prev, pcount);
+        BUG_ON(tcp_skb_pcount(skb) < pcount);
+        tcp_skb_pcount_add(skb, -pcount);
 
         /* When we're adding to gso_segs == 1, gso_size will be zero,
          * in theory this shouldn't be necessary but as long as DSACK
@@ -1309,7 +1319,7 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
         }
 
         /* CHECKME: To clear or not to clear? Mimics normal skb currently */
-        if (skb_shinfo(skb)->gso_segs <= 1) {
+        if (tcp_skb_pcount(skb) <= 1) {
                 skb_shinfo(skb)->gso_size = 0;
                 skb_shinfo(skb)->gso_type = 0;
         }
@@ -1887,21 +1897,21 @@ static inline void tcp_reset_reno_sack(struct tcp_sock *tp)
         tp->sacked_out = 0;
 }
 
-static void tcp_clear_retrans_partial(struct tcp_sock *tp)
+void tcp_clear_retrans(struct tcp_sock *tp)
 {
         tp->retrans_out = 0;
         tp->lost_out = 0;
-
         tp->undo_marker = 0;
         tp->undo_retrans = -1;
+        tp->fackets_out = 0;
+        tp->sacked_out = 0;
 }
 
-void tcp_clear_retrans(struct tcp_sock *tp)
+static inline void tcp_init_undo(struct tcp_sock *tp)
 {
-        tcp_clear_retrans_partial(tp);
-
-        tp->fackets_out = 0;
-        tp->sacked_out = 0;
+        tp->undo_marker = tp->snd_una;
+        /* Retransmission still in flight may cause DSACKs later. */
+        tp->undo_retrans = tp->retrans_out ? : -1;
 }
 
 /* Enter Loss state. If we detect SACK reneging, forget all SACK information
@@ -1924,18 +1934,18 @@ void tcp_enter_loss(struct sock *sk)
                 tp->prior_ssthresh = tcp_current_ssthresh(sk);
                 tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh(sk);
                 tcp_ca_event(sk, CA_EVENT_LOSS);
+                tcp_init_undo(tp);
         }
         tp->snd_cwnd       = 1;
         tp->snd_cwnd_cnt   = 0;
         tp->snd_cwnd_stamp = tcp_time_stamp;
 
-        tcp_clear_retrans_partial(tp);
+        tp->retrans_out = 0;
+        tp->lost_out = 0;
 
         if (tcp_is_reno(tp))
                 tcp_reset_reno_sack(tp);
 
-        tp->undo_marker = tp->snd_una;
-
         skb = tcp_write_queue_head(sk);
         is_reneg = skb && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED);
         if (is_reneg) {
@@ -1949,9 +1959,6 @@ void tcp_enter_loss(struct sock *sk)
                 if (skb == tcp_send_head(sk))
                         break;
 
-                if (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_RETRANS)
-                        tp->undo_marker = 0;
-
                 TCP_SKB_CB(skb)->sacked &= (~TCPCB_TAGBITS)|TCPCB_SACKED_ACKED;
                 if (!(TCP_SKB_CB(skb)->sacked&TCPCB_SACKED_ACKED) || is_reneg) {
                         TCP_SKB_CB(skb)->sacked &= ~TCPCB_SACKED_ACKED;
@@ -1971,7 +1978,7 @@ void tcp_enter_loss(struct sock *sk)
                                        sysctl_tcp_reordering);
         tcp_set_ca_state(sk, TCP_CA_Loss);
         tp->high_seq = tp->snd_nxt;
-        TCP_ECN_queue_cwr(tp);
+        tcp_ecn_queue_cwr(tp);
 
         /* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous
          * loss recovery is underway except recurring timeout(s) on
@@ -2363,7 +2370,7 @@ static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)
 
                 if (tp->prior_ssthresh > tp->snd_ssthresh) {
                         tp->snd_ssthresh = tp->prior_ssthresh;
-                        TCP_ECN_withdraw_cwr(tp);
+                        tcp_ecn_withdraw_cwr(tp);
                 }
         } else {
                 tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh);
@@ -2493,7 +2500,7 @@ static void tcp_init_cwnd_reduction(struct sock *sk)
         tp->prr_delivered = 0;
         tp->prr_out = 0;
         tp->snd_ssthresh = inet_csk(sk)->icsk_ca_ops->ssthresh(sk);
-        TCP_ECN_queue_cwr(tp);
+        tcp_ecn_queue_cwr(tp);
 }
 
 static void tcp_cwnd_reduction(struct sock *sk, const int prior_unsacked,
@@ -2670,8 +2677,7 @@ static void tcp_enter_recovery(struct sock *sk, bool ece_ack)
         NET_INC_STATS_BH(sock_net(sk), mib_idx);
 
         tp->prior_ssthresh = 0;
-        tp->undo_marker = tp->snd_una;
-        tp->undo_retrans = tp->retrans_out ? : -1;
+        tcp_init_undo(tp);
 
         if (inet_csk(sk)->icsk_ca_state < TCP_CA_CWR) {
                 if (!ece_ack)
@@ -2970,7 +2976,8 @@ void tcp_rearm_rto(struct sock *sk)
                 if (icsk->icsk_pending == ICSK_TIME_EARLY_RETRANS ||
                     icsk->icsk_pending == ICSK_TIME_LOSS_PROBE) {
                         struct sk_buff *skb = tcp_write_queue_head(sk);
-                        const u32 rto_time_stamp = TCP_SKB_CB(skb)->when + rto;
+                        const u32 rto_time_stamp =
+                                tcp_skb_timestamp(skb) + rto;
                         s32 delta = (s32)(rto_time_stamp - tcp_time_stamp);
                         /* delta may not be positive if the socket is locked
                          * when the retrans timer fires and is rescheduled.
@@ -3210,9 +3217,10 @@ static void tcp_ack_probe(struct sock *sk)
                  * This function is not for random using!
                  */
         } else {
+                unsigned long when = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);
+
                 inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
-                                          min(icsk->icsk_rto << icsk->icsk_backoff, TCP_RTO_MAX),
-                                          TCP_RTO_MAX);
+                                          when, TCP_RTO_MAX);
         }
 }
 
@@ -3363,6 +3371,14 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag)
         }
 }
 
+static inline void tcp_in_ack_event(struct sock *sk, u32 flags)
+{
+        const struct inet_connection_sock *icsk = inet_csk(sk);
+
+        if (icsk->icsk_ca_ops->in_ack_event)
+                icsk->icsk_ca_ops->in_ack_event(sk, flags);
+}
+
 /* This routine deals with incoming acks, but not outgoing ones. */
 static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
 {
@@ -3422,10 +3438,12 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                 tp->snd_una = ack;
                 flag |= FLAG_WIN_UPDATE;
 
-                tcp_ca_event(sk, CA_EVENT_FAST_ACK);
+                tcp_in_ack_event(sk, CA_ACK_WIN_UPDATE);
 
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPHPACKS);
         } else {
+                u32 ack_ev_flags = CA_ACK_SLOWPATH;
+
                 if (ack_seq != TCP_SKB_CB(skb)->end_seq)
                         flag |= FLAG_DATA;
                 else
@@ -3437,10 +3455,15 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
                         flag |= tcp_sacktag_write_queue(sk, skb, prior_snd_una,
                                                         &sack_rtt_us);
 
-                if (TCP_ECN_rcv_ecn_echo(tp, tcp_hdr(skb)))
+                if (tcp_ecn_rcv_ecn_echo(tp, tcp_hdr(skb))) {
                         flag |= FLAG_ECE;
+                        ack_ev_flags |= CA_ACK_ECE;
+                }
+
+                if (flag & FLAG_WIN_UPDATE)
+                        ack_ev_flags |= CA_ACK_WIN_UPDATE;
 
-                tcp_ca_event(sk, CA_EVENT_SLOW_ACK);
+                tcp_in_ack_event(sk, ack_ev_flags);
         }
 
         /* We passed data and got it acked, remove any soft error
@@ -4062,6 +4085,44 @@ static void tcp_sack_remove(struct tcp_sock *tp)
         tp->rx_opt.num_sacks = num_sacks;
 }
 
+/**
+ * tcp_try_coalesce - try to merge skb to prior one
+ * @sk: socket
+ * @to: prior buffer
+ * @from: buffer to add in queue
+ * @fragstolen: pointer to boolean
+ *
+ * Before queueing skb @from after @to, try to merge them
+ * to reduce overall memory use and queue lengths, if cost is small.
+ * Packets in ofo or receive queues can stay a long time.
+ * Better try to coalesce them right now to avoid future collapses.
+ * Returns true if caller should free @from instead of queueing it
+ */
+static bool tcp_try_coalesce(struct sock *sk,
+                             struct sk_buff *to,
+                             struct sk_buff *from,
+                             bool *fragstolen)
+{
+        int delta;
+
+        *fragstolen = false;
+
+        /* Its possible this segment overlaps with prior segment in queue */
+        if (TCP_SKB_CB(from)->seq != TCP_SKB_CB(to)->end_seq)
+                return false;
+
+        if (!skb_try_coalesce(to, from, fragstolen, &delta))
+                return false;
+
+        atomic_add(delta, &sk->sk_rmem_alloc);
+        sk_mem_charge(sk, delta);
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRCVCOALESCE);
+        TCP_SKB_CB(to)->end_seq = TCP_SKB_CB(from)->end_seq;
+        TCP_SKB_CB(to)->ack_seq = TCP_SKB_CB(from)->ack_seq;
+        TCP_SKB_CB(to)->tcp_flags |= TCP_SKB_CB(from)->tcp_flags;
+        return true;
+}
+
 /* This one checks to see if we can put data from the
  * out_of_order queue into the receive_queue.
  */
@@ -4069,7 +4130,8 @@ static void tcp_ofo_queue(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         __u32 dsack_high = tp->rcv_nxt;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *tail;
+        bool fragstolen, eaten;
 
         while ((skb = skb_peek(&tp->out_of_order_queue)) != NULL) {
                 if (after(TCP_SKB_CB(skb)->seq, tp->rcv_nxt))
@@ -4082,9 +4144,9 @@ static void tcp_ofo_queue(struct sock *sk)
                         tcp_dsack_extend(sk, TCP_SKB_CB(skb)->seq, dsack);
                 }
 
+                __skb_unlink(skb, &tp->out_of_order_queue);
                 if (!after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt)) {
                         SOCK_DEBUG(sk, "ofo packet was already received\n");
-                        __skb_unlink(skb, &tp->out_of_order_queue);
                         __kfree_skb(skb);
                         continue;
                 }
@@ -4092,11 +4154,15 @@ static void tcp_ofo_queue(struct sock *sk)
                            tp->rcv_nxt, TCP_SKB_CB(skb)->seq,
                            TCP_SKB_CB(skb)->end_seq);
 
-                __skb_unlink(skb, &tp->out_of_order_queue);
-                __skb_queue_tail(&sk->sk_receive_queue, skb);
+                tail = skb_peek_tail(&sk->sk_receive_queue);
+                eaten = tail && tcp_try_coalesce(sk, tail, skb, &fragstolen);
                 tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
-                if (tcp_hdr(skb)->fin)
+                if (!eaten)
+                        __skb_queue_tail(&sk->sk_receive_queue, skb);
+                if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
                         tcp_fin(sk);
+                if (eaten)
+                        kfree_skb_partial(skb, fragstolen);
         }
 }
 
@@ -4123,53 +4189,13 @@ static int tcp_try_rmem_schedule(struct sock *sk, struct sk_buff *skb,
         return 0;
 }
 
-/**
- * tcp_try_coalesce - try to merge skb to prior one
- * @sk: socket
- * @to: prior buffer
- * @from: buffer to add in queue
- * @fragstolen: pointer to boolean
- *
- * Before queueing skb @from after @to, try to merge them
- * to reduce overall memory use and queue lengths, if cost is small.
- * Packets in ofo or receive queues can stay a long time.
- * Better try to coalesce them right now to avoid future collapses.
- * Returns true if caller should free @from instead of queueing it
- */
-static bool tcp_try_coalesce(struct sock *sk,
-                             struct sk_buff *to,
-                             struct sk_buff *from,
-                             bool *fragstolen)
-{
-        int delta;
-
-        *fragstolen = false;
-
-        if (tcp_hdr(from)->fin)
-                return false;
-
-        /* Its possible this segment overlaps with prior segment in queue */
-        if (TCP_SKB_CB(from)->seq != TCP_SKB_CB(to)->end_seq)
-                return false;
-
-        if (!skb_try_coalesce(to, from, fragstolen, &delta))
-                return false;
-
-        atomic_add(delta, &sk->sk_rmem_alloc);
-        sk_mem_charge(sk, delta);
-        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRCVCOALESCE);
-        TCP_SKB_CB(to)->end_seq = TCP_SKB_CB(from)->end_seq;
-        TCP_SKB_CB(to)->ack_seq = TCP_SKB_CB(from)->ack_seq;
-        return true;
-}
-
 static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb1;
         u32 seq, end_seq;
 
-        TCP_ECN_check_ce(tp, skb);
+        tcp_ecn_check_ce(tp, skb);
 
         if (unlikely(tcp_try_rmem_schedule(sk, skb, skb->truesize))) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPOFODROP);
@@ -4308,24 +4334,19 @@ static int __must_check tcp_queue_rcv(struct sock *sk, struct sk_buff *skb, int
 
 int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size)
 {
-        struct sk_buff *skb = NULL;
-        struct tcphdr *th;
+        struct sk_buff *skb;
         bool fragstolen;
 
         if (size == 0)
                 return 0;
 
-        skb = alloc_skb(size + sizeof(*th), sk->sk_allocation);
+        skb = alloc_skb(size, sk->sk_allocation);
         if (!skb)
                 goto err;
 
-        if (tcp_try_rmem_schedule(sk, skb, size + sizeof(*th)))
+        if (tcp_try_rmem_schedule(sk, skb, skb->truesize))
                 goto err_free;
 
-        th = (struct tcphdr *)skb_put(skb, sizeof(*th));
-        skb_reset_transport_header(skb);
-        memset(th, 0, sizeof(*th));
-
         if (memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size))
                 goto err_free;
 
@@ -4333,7 +4354,7 @@ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size)
         TCP_SKB_CB(skb)->end_seq = TCP_SKB_CB(skb)->seq + size;
         TCP_SKB_CB(skb)->ack_seq = tcp_sk(sk)->snd_una - 1;
 
-        if (tcp_queue_rcv(sk, skb, sizeof(*th), &fragstolen)) {
+        if (tcp_queue_rcv(sk, skb, 0, &fragstolen)) {
                 WARN_ON_ONCE(fragstolen); /* should not happen */
                 __kfree_skb(skb);
         }
@@ -4347,7 +4368,6 @@ err:
 
 static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 {
-        const struct tcphdr *th = tcp_hdr(skb);
         struct tcp_sock *tp = tcp_sk(sk);
         int eaten = -1;
         bool fragstolen = false;
@@ -4356,9 +4376,9 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
                 goto drop;
 
         skb_dst_drop(skb);
-        __skb_pull(skb, th->doff * 4);
+        __skb_pull(skb, tcp_hdr(skb)->doff * 4);
 
-        TCP_ECN_accept_cwr(tp, skb);
+        tcp_ecn_accept_cwr(tp, skb);
 
         tp->rx_opt.dsack = 0;
 
@@ -4400,7 +4420,7 @@ queue_and_out:
                 tp->rcv_nxt = TCP_SKB_CB(skb)->end_seq;
                 if (skb->len)
                         tcp_event_data_recv(sk, skb);
-                if (th->fin)
+                if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
                         tcp_fin(sk);
 
                 if (!skb_queue_empty(&tp->out_of_order_queue)) {
@@ -4515,7 +4535,7 @@ restart:
                  * - bloated or contains data before "start" or
                  *   overlaps to the next one.
                  */
-                if (!tcp_hdr(skb)->syn && !tcp_hdr(skb)->fin &&
+                if (!(TCP_SKB_CB(skb)->tcp_flags & (TCPHDR_SYN | TCPHDR_FIN)) &&
                     (tcp_win_from_space(skb->truesize) > skb->len ||
                      before(TCP_SKB_CB(skb)->seq, start))) {
                         end_of_skbs = false;
@@ -4534,30 +4554,18 @@ restart:
                 /* Decided to skip this, advance start seq. */
                 start = TCP_SKB_CB(skb)->end_seq;
         }
-        if (end_of_skbs || tcp_hdr(skb)->syn || tcp_hdr(skb)->fin)
+        if (end_of_skbs ||
+            (TCP_SKB_CB(skb)->tcp_flags & (TCPHDR_SYN | TCPHDR_FIN)))
                 return;
 
         while (before(start, end)) {
+                int copy = min_t(int, SKB_MAX_ORDER(0, 0), end - start);
                 struct sk_buff *nskb;
-                unsigned int header = skb_headroom(skb);
-                int copy = SKB_MAX_ORDER(header, 0);
 
-                /* Too big header? This can happen with IPv6. */
-                if (copy < 0)
-                        return;
-                if (end - start < copy)
-                        copy = end - start;
-                nskb = alloc_skb(copy + header, GFP_ATOMIC);
+                nskb = alloc_skb(copy, GFP_ATOMIC);
                 if (!nskb)
                         return;
 
-                skb_set_mac_header(nskb, skb_mac_header(skb) - skb->head);
-                skb_set_network_header(nskb, (skb_network_header(skb) -
-                                              skb->head));
-                skb_set_transport_header(nskb, (skb_transport_header(skb) -
-                                                skb->head));
-                skb_reserve(nskb, header);
-                memcpy(nskb->head, skb->head, header);
                 memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
                 TCP_SKB_CB(nskb)->seq = TCP_SKB_CB(nskb)->end_seq = start;
                 __skb_queue_before(list, skb, nskb);
@@ -4581,8 +4589,7 @@ restart:
                                 skb = tcp_collapse_one(sk, skb, list);
                                 if (!skb ||
                                     skb == tail ||
-                                    tcp_hdr(skb)->syn ||
-                                    tcp_hdr(skb)->fin)
+                                    (TCP_SKB_CB(skb)->tcp_flags & (TCPHDR_SYN | TCPHDR_FIN)))
                                         return;
                         }
                 }
@@ -5386,7 +5393,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                  *    state to ESTABLISHED..."
                  */
 
-                TCP_ECN_rcv_synack(tp, th);
+                tcp_ecn_rcv_synack(tp, th);
 
                 tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
                 tcp_ack(sk, skb, FLAG_SLOWPATH);
@@ -5505,7 +5512,7 @@ discard:
                 tp->snd_wl1    = TCP_SKB_CB(skb)->seq;
                 tp->max_window = tp->snd_wnd;
 
-                TCP_ECN_rcv_syn(tp, th);
+                tcp_ecn_rcv_syn(tp, th);
 
                 tcp_mtup_init(sk);
                 tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
@@ -5835,6 +5842,40 @@ static inline void pr_drop_req(struct request_sock *req, __u16 port, int family)
 #endif
 }
 
+/* RFC3168 : 6.1.1 SYN packets must not have ECT/ECN bits set
+ *
+ * If we receive a SYN packet with these bits set, it means a
+ * network is playing bad games with TOS bits. In order to
+ * avoid possible false congestion notifications, we disable
+ * TCP ECN negociation.
+ *
+ * Exception: tcp_ca wants ECN. This is required for DCTCP
+ * congestion control; it requires setting ECT on all packets,
+ * including SYN. We inverse the test in this case: If our
+ * local socket wants ECN, but peer only set ece/cwr (but not
+ * ECT in IP header) its probably a non-DCTCP aware sender.
+ */
+static void tcp_ecn_create_request(struct request_sock *req,
+                                   const struct sk_buff *skb,
+                                   const struct sock *listen_sk)
+{
+        const struct tcphdr *th = tcp_hdr(skb);
+        const struct net *net = sock_net(listen_sk);
+        bool th_ecn = th->ece && th->cwr;
+        bool ect, need_ecn;
+
+        if (!th_ecn)
+                return;
+
+        ect = !INET_ECN_is_not_ect(TCP_SKB_CB(skb)->ip_dsfield);
+        need_ecn = tcp_ca_needs_ecn(listen_sk);
+
+        if (!ect && !need_ecn && net->ipv4.sysctl_tcp_ecn)
+                inet_rsk(req)->ecn_ok = 1;
+        else if (ect && need_ecn)
+                inet_rsk(req)->ecn_ok = 1;
+}
+
 int tcp_conn_request(struct request_sock_ops *rsk_ops,
                      const struct tcp_request_sock_ops *af_ops,
                      struct sock *sk, struct sk_buff *skb)
@@ -5843,7 +5884,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
         struct request_sock *req;
         struct tcp_sock *tp = tcp_sk(sk);
         struct dst_entry *dst = NULL;
-        __u32 isn = TCP_SKB_CB(skb)->when;
+        __u32 isn = TCP_SKB_CB(skb)->tcp_tw_isn;
         bool want_cookie = false, fastopen;
         struct flowi fl;
         struct tcp_fastopen_cookie foc = { .len = -1 };
@@ -5895,7 +5936,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
                 goto drop_and_free;
 
         if (!want_cookie || tmp_opt.tstamp_ok)
-                TCP_ECN_create_request(req, skb, sock_net(sk));
+                tcp_ecn_create_request(req, skb, sk);
 
         if (want_cookie) {
                 isn = cookie_init_sequence(af_ops, sk, skb, &req->mss);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index fbea536cf5c0..552e87e3c269 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -89,7 +89,6 @@ int sysctl_tcp_tw_reuse __read_mostly;
 int sysctl_tcp_low_latency __read_mostly;
 EXPORT_SYMBOL(sysctl_tcp_low_latency);
 
-
 #ifdef CONFIG_TCP_MD5SIG
 static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
                                __be32 daddr, __be32 saddr, const struct tcphdr *th);
@@ -430,15 +429,16 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
                         break;
 
                 icsk->icsk_backoff--;
-                inet_csk(sk)->icsk_rto = (tp->srtt_us ? __tcp_set_rto(tp) :
-                        TCP_TIMEOUT_INIT) << icsk->icsk_backoff;
-                tcp_bound_rto(sk);
+                icsk->icsk_rto = tp->srtt_us ? __tcp_set_rto(tp) :
+                                               TCP_TIMEOUT_INIT;
+                icsk->icsk_rto = inet_csk_rto_backoff(icsk, TCP_RTO_MAX);
 
                 skb = tcp_write_queue_head(sk);
                 BUG_ON(!skb);
 
-                remaining = icsk->icsk_rto - min(icsk->icsk_rto,
-                                tcp_time_stamp - TCP_SKB_CB(skb)->when);
+                remaining = icsk->icsk_rto -
+                            min(icsk->icsk_rto,
+                                tcp_time_stamp - tcp_skb_timestamp(skb));
 
                 if (remaining) {
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
@@ -680,8 +680,9 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
 
         net = dev_net(skb_dst(skb)->dev);
         arg.tos = ip_hdr(skb)->tos;
-        ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr,
-                              ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len);
+        ip_send_unicast_reply(net, skb, &TCP_SKB_CB(skb)->header.h4.opt,
+                              ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
+                              &arg, arg.iov[0].iov_len);
 
         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
@@ -763,8 +764,9 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
         if (oif)
                 arg.bound_dev_if = oif;
         arg.tos = tos;
-        ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr,
-                              ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len);
+        ip_send_unicast_reply(net, skb, &TCP_SKB_CB(skb)->header.h4.opt,
+                              ip_hdr(skb)->saddr, ip_hdr(skb)->daddr,
+                              &arg, arg.iov[0].iov_len);
 
         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
 }
@@ -883,18 +885,16 @@ EXPORT_SYMBOL(tcp_syn_flood_action);
  */
 static struct ip_options_rcu *tcp_v4_save_options(struct sk_buff *skb)
 {
-        const struct ip_options *opt = &(IPCB(skb)->opt);
+        const struct ip_options *opt = &TCP_SKB_CB(skb)->header.h4.opt;
         struct ip_options_rcu *dopt = NULL;
 
         if (opt && opt->optlen) {
                 int opt_size = sizeof(*dopt) + opt->optlen;
 
                 dopt = kmalloc(opt_size, GFP_ATOMIC);
-                if (dopt) {
-                        if (ip_options_echo(&dopt->opt, skb)) {
-                                kfree(dopt);
-                                dopt = NULL;
-                        }
+                if (dopt && __ip_options_echo(&dopt->opt, skb, opt)) {
+                        kfree(dopt);
+                        dopt = NULL;
                 }
         }
         return dopt;
@@ -1268,7 +1268,7 @@ struct request_sock_ops tcp_request_sock_ops __read_mostly = {
         .send_ack       =       tcp_v4_reqsk_send_ack,
         .destructor     =       tcp_v4_reqsk_destructor,
         .send_reset     =       tcp_v4_send_reset,
-        .syn_ack_timeout =      tcp_syn_ack_timeout,
+        .syn_ack_timeout =      tcp_syn_ack_timeout,
 };
 
 static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
@@ -1428,7 +1428,7 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
 
 #ifdef CONFIG_SYN_COOKIES
         if (!th->syn)
-                sk = cookie_v4_check(sk, skb, &(IPCB(skb)->opt));
+                sk = cookie_v4_check(sk, skb, &TCP_SKB_CB(skb)->header.h4.opt);
 #endif
         return sk;
 }
@@ -1558,7 +1558,17 @@ bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
             skb_queue_len(&tp->ucopy.prequeue) == 0)
                 return false;
 
-        skb_dst_force(skb);
+        /* Before escaping RCU protected region, we need to take care of skb
+         * dst. Prequeue is only enabled for established sockets.
+         * For such sockets, we might need the skb dst only to set sk->sk_rx_dst
+         * Instead of doing full sk_rx_dst validity here, let's perform
+         * an optimistic check.
+         */
+        if (likely(sk->sk_rx_dst))
+                skb_dst_drop(skb);
+        else
+                skb_dst_force(skb);
+
         __skb_queue_tail(&tp->ucopy.prequeue, skb);
         tp->ucopy.memory += skb->truesize;
         if (tp->ucopy.memory > sk->sk_rcvbuf) {
@@ -1623,11 +1633,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
 
         th = tcp_hdr(skb);
         iph = ip_hdr(skb);
+        /* This is tricky : We move IPCB at its correct location into TCP_SKB_CB()
+         * barrier() makes sure compiler wont play fool^Waliasing games.
+         */
+        memmove(&TCP_SKB_CB(skb)->header.h4, IPCB(skb),
+                sizeof(struct inet_skb_parm));
+        barrier();
+
         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
                                     skb->len - th->doff * 4);
         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
-        TCP_SKB_CB(skb)->when    = 0;
+        TCP_SKB_CB(skb)->tcp_flags = tcp_flag_byte(th);
+        TCP_SKB_CB(skb)->tcp_tw_isn = 0;
         TCP_SKB_CB(skb)->ip_dsfield = ipv4_get_dsfield(iph);
         TCP_SKB_CB(skb)->sacked  = 0;
 
@@ -1754,9 +1772,11 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
 
-        dst_hold(dst);
-        sk->sk_rx_dst = dst;
-        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+        if (dst) {
+                dst_hold(dst);
+                sk->sk_rx_dst = dst;
+                inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+        }
 }
 EXPORT_SYMBOL(inet_sk_rx_dst_set);
 
@@ -2167,7 +2187,7 @@ int tcp_seq_open(struct inode *inode, struct file *file)
 
         s = ((struct seq_file *)file->private_data)->private;
         s->family               = afinfo->family;
-        s->last_pos             = 0;
+        s->last_pos             = 0;
         return 0;
 }
 EXPORT_SYMBOL(tcp_seq_open);
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 1649988bd1b6..63d2680b65db 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -232,7 +232,7 @@ kill:
                 u32 isn = tcptw->tw_snd_nxt + 65535 + 2;
                 if (isn == 0)
                         isn++;
-                TCP_SKB_CB(skb)->when = isn;
+                TCP_SKB_CB(skb)->tcp_tw_isn = isn;
                 return TCP_TW_SYN;
         }
 
@@ -393,8 +393,8 @@ void tcp_openreq_init_rwin(struct request_sock *req,
 }
 EXPORT_SYMBOL(tcp_openreq_init_rwin);
 
-static inline void TCP_ECN_openreq_child(struct tcp_sock *tp,
-                                         struct request_sock *req)
+static void tcp_ecn_openreq_child(struct tcp_sock *tp,
+                                  const struct request_sock *req)
 {
         tp->ecn_flags = inet_rsk(req)->ecn_ok ? TCP_ECN_OK : 0;
 }
@@ -451,9 +451,8 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 newtp->snd_cwnd = TCP_INIT_CWND;
                 newtp->snd_cwnd_cnt = 0;
 
-                if (newicsk->icsk_ca_ops != &tcp_init_congestion_ops &&
-                    !try_module_get(newicsk->icsk_ca_ops->owner))
-                        newicsk->icsk_ca_ops = &tcp_init_congestion_ops;
+                if (!try_module_get(newicsk->icsk_ca_ops->owner))
+                        tcp_assign_congestion_control(newsk);
 
                 tcp_set_ca_state(newsk, TCP_CA_Open);
                 tcp_init_xmit_timers(newsk);
@@ -508,7 +507,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 if (skb->len >= TCP_MSS_DEFAULT + newtp->tcp_header_len)
                         newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
                 newtp->rx_opt.mss_clamp = req->mss;
-                TCP_ECN_openreq_child(newtp, req);
+                tcp_ecn_openreq_child(newtp, req);
                 newtp->fastopen_rsk = NULL;
                 newtp->syn_data_acked = 0;
 
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index bc1b83cb8309..5b90f2f447a5 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -29,6 +29,28 @@ static void tcp_gso_tstamp(struct sk_buff *skb, unsigned int ts_seq,
         }
 }
 
+struct sk_buff *tcp4_gso_segment(struct sk_buff *skb,
+                                 netdev_features_t features)
+{
+        if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
+                return ERR_PTR(-EINVAL);
+
+        if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
+                const struct iphdr *iph = ip_hdr(skb);
+                struct tcphdr *th = tcp_hdr(skb);
+
+                /* Set up checksum pseudo header, usually expect stack to
+                 * have done this already.
+                 */
+
+                th->check = 0;
+                skb->ip_summed = CHECKSUM_PARTIAL;
+                __tcp_v4_send_check(skb, iph->saddr, iph->daddr);
+        }
+
+        return tcp_gso_segment(skb, features);
+}
+
 struct sk_buff *tcp_gso_segment(struct sk_buff *skb,
                                 netdev_features_t features)
 {
@@ -44,9 +66,6 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb,
         __sum16 newcheck;
         bool ooo_okay, copy_destructor;
 
-        if (!pskb_may_pull(skb, sizeof(*th)))
-                goto out;
-
         th = tcp_hdr(skb);
         thlen = th->doff * 4;
         if (thlen < sizeof(*th))
@@ -269,54 +288,16 @@ int tcp_gro_complete(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(tcp_gro_complete);
 
-static int tcp_v4_gso_send_check(struct sk_buff *skb)
-{
-        const struct iphdr *iph;
-        struct tcphdr *th;
-
-        if (!pskb_may_pull(skb, sizeof(*th)))
-                return -EINVAL;
-
-        iph = ip_hdr(skb);
-        th = tcp_hdr(skb);
-
-        th->check = 0;
-        skb->ip_summed = CHECKSUM_PARTIAL;
-        __tcp_v4_send_check(skb, iph->saddr, iph->daddr);
-        return 0;
-}
-
 static struct sk_buff **tcp4_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 {
-        /* Use the IP hdr immediately proceeding for this transport */
-        const struct iphdr *iph = skb_gro_network_header(skb);
-        __wsum wsum;
-
         /* Don't bother verifying checksum if we're going to flush anyway. */
-        if (NAPI_GRO_CB(skb)->flush)
-                goto skip_csum;
-
-        wsum = NAPI_GRO_CB(skb)->csum;
-
-        switch (skb->ip_summed) {
-        case CHECKSUM_NONE:
-                wsum = skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb),
-                                    0);
-
-                /* fall through */
-
-        case CHECKSUM_COMPLETE:
-                if (!tcp_v4_check(skb_gro_len(skb), iph->saddr, iph->daddr,
-                                  wsum)) {
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        break;
-                }
-
+        if (!NAPI_GRO_CB(skb)->flush &&
+            skb_gro_checksum_validate(skb, IPPROTO_TCP,
+                                      inet_gro_compute_pseudo)) {
                 NAPI_GRO_CB(skb)->flush = 1;
                 return NULL;
         }
 
-skip_csum:
         return tcp_gro_receive(head, skb);
 }
 
@@ -334,8 +315,7 @@ static int tcp4_gro_complete(struct sk_buff *skb, int thoff)
 
 static const struct net_offload tcpv4_offload = {
         .callbacks = {
-                .gso_send_check =       tcp_v4_gso_send_check,
-                .gso_segment    =       tcp_gso_segment,
+                .gso_segment    =       tcp4_gso_segment,
                 .gro_receive    =       tcp4_gro_receive,
                 .gro_complete   =       tcp4_gro_complete,
         },
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5a7c41fbc6d3..8d4eac793700 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -318,36 +318,47 @@ static u16 tcp_select_window(struct sock *sk)
 }
 
 /* Packet ECN state for a SYN-ACK */
-static inline void TCP_ECN_send_synack(const struct tcp_sock *tp, struct sk_buff *skb)
+static void tcp_ecn_send_synack(struct sock *sk, struct sk_buff *skb)
 {
+        const struct tcp_sock *tp = tcp_sk(sk);
+
         TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_CWR;
         if (!(tp->ecn_flags & TCP_ECN_OK))
                 TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_ECE;
+        else if (tcp_ca_needs_ecn(sk))
+                INET_ECN_xmit(sk);
 }
 
 /* Packet ECN state for a SYN.  */
-static inline void TCP_ECN_send_syn(struct sock *sk, struct sk_buff *skb)
+static void tcp_ecn_send_syn(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
         tp->ecn_flags = 0;
-        if (sock_net(sk)->ipv4.sysctl_tcp_ecn == 1) {
+        if (sock_net(sk)->ipv4.sysctl_tcp_ecn == 1 ||
+            tcp_ca_needs_ecn(sk)) {
                 TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ECE | TCPHDR_CWR;
                 tp->ecn_flags = TCP_ECN_OK;
+                if (tcp_ca_needs_ecn(sk))
+                        INET_ECN_xmit(sk);
         }
 }
 
-static __inline__ void
-TCP_ECN_make_synack(const struct request_sock *req, struct tcphdr *th)
+static void
+tcp_ecn_make_synack(const struct request_sock *req, struct tcphdr *th,
+                    struct sock *sk)
 {
-        if (inet_rsk(req)->ecn_ok)
+        if (inet_rsk(req)->ecn_ok) {
                 th->ece = 1;
+                if (tcp_ca_needs_ecn(sk))
+                        INET_ECN_xmit(sk);
+        }
 }
 
 /* Set up ECN state for a packet on a ESTABLISHED socket that is about to
  * be sent.
  */
-static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
+static void tcp_ecn_send(struct sock *sk, struct sk_buff *skb,
                                 int tcp_header_len)
 {
         struct tcp_sock *tp = tcp_sk(sk);
@@ -362,7 +373,7 @@ static inline void TCP_ECN_send(struct sock *sk, struct sk_buff *skb,
                                 tcp_hdr(skb)->cwr = 1;
                                 skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
                         }
-                } else {
+                } else if (!tcp_ca_needs_ecn(sk)) {
                         /* ACK or retransmitted segment: clear ECT|CE */
                         INET_ECN_dontxmit(sk);
                 }
@@ -384,7 +395,7 @@ static void tcp_init_nondata_skb(struct sk_buff *skb, u32 seq, u8 flags)
         TCP_SKB_CB(skb)->tcp_flags = flags;
         TCP_SKB_CB(skb)->sacked = 0;
 
-        shinfo->gso_segs = 1;
+        tcp_skb_pcount_set(skb, 1);
         shinfo->gso_size = 0;
         shinfo->gso_type = 0;
 
@@ -550,7 +561,7 @@ static unsigned int tcp_syn_options(struct sock *sk, struct sk_buff *skb,
 
         if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
                 opts->options |= OPTION_TS;
-                opts->tsval = TCP_SKB_CB(skb)->when + tp->tsoffset;
+                opts->tsval = tcp_skb_timestamp(skb) + tp->tsoffset;
                 opts->tsecr = tp->rx_opt.ts_recent;
                 remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
@@ -618,7 +629,7 @@ static unsigned int tcp_synack_options(struct sock *sk,
         }
         if (likely(ireq->tstamp_ok)) {
                 opts->options |= OPTION_TS;
-                opts->tsval = TCP_SKB_CB(skb)->when;
+                opts->tsval = tcp_skb_timestamp(skb);
                 opts->tsecr = req->ts_recent;
                 remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
@@ -647,7 +658,6 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
                                         struct tcp_out_options *opts,
                                         struct tcp_md5sig_key **md5)
 {
-        struct tcp_skb_cb *tcb = skb ? TCP_SKB_CB(skb) : NULL;
         struct tcp_sock *tp = tcp_sk(sk);
         unsigned int size = 0;
         unsigned int eff_sacks;
@@ -666,7 +676,7 @@ static unsigned int tcp_established_options(struct sock *sk, struct sk_buff *skb
 
         if (likely(tp->rx_opt.tstamp_ok)) {
                 opts->options |= OPTION_TS;
-                opts->tsval = tcb ? tcb->when + tp->tsoffset : 0;
+                opts->tsval = skb ? tcp_skb_timestamp(skb) + tp->tsoffset : 0;
                 opts->tsecr = tp->rx_opt.ts_recent;
                 size += TCPOLEN_TSTAMP_ALIGNED;
         }
@@ -886,8 +896,6 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                         skb = skb_clone(skb, gfp_mask);
                 if (unlikely(!skb))
                         return -ENOBUFS;
-                /* Our usage of tstamp should remain private */
-                skb->tstamp.tv64 = 0;
         }
 
         inet = inet_sk(sk);
@@ -952,7 +960,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
         tcp_options_write((__be32 *)(th + 1), tp, &opts);
         if (likely((tcb->tcp_flags & TCPHDR_SYN) == 0))
-                TCP_ECN_send(sk, skb, tcp_header_size);
+                tcp_ecn_send(sk, skb, tcp_header_size);
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Calculate the MD5 hash, as we have all we need now */
@@ -975,7 +983,18 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                 TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS,
                               tcp_skb_pcount(skb));
 
+        /* OK, its time to fill skb_shinfo(skb)->gso_segs */
+        skb_shinfo(skb)->gso_segs = tcp_skb_pcount(skb);
+
+        /* Our usage of tstamp should remain private */
+        skb->tstamp.tv64 = 0;
+
+        /* Cleanup our debris for IP stacks */
+        memset(skb->cb, 0, max(sizeof(struct inet_skb_parm),
+                               sizeof(struct inet6_skb_parm)));
+
         err = icsk->icsk_af_ops->queue_xmit(sk, skb, &inet->cork.fl);
+
         if (likely(err <= 0))
                 return err;
 
@@ -995,7 +1014,7 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 
         /* Advance write_seq and place onto the write_queue. */
         tp->write_seq = TCP_SKB_CB(skb)->end_seq;
-        skb_header_release(skb);
+        __skb_header_release(skb);
         tcp_add_write_queue_tail(sk, skb);
         sk->sk_wmem_queued += skb->truesize;
         sk_mem_charge(sk, skb->truesize);
@@ -1014,11 +1033,11 @@ static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
                  */
-                shinfo->gso_segs = 1;
+                tcp_skb_pcount_set(skb, 1);
                 shinfo->gso_size = 0;
                 shinfo->gso_type = 0;
         } else {
-                shinfo->gso_segs = DIV_ROUND_UP(skb->len, mss_now);
+                tcp_skb_pcount_set(skb, DIV_ROUND_UP(skb->len, mss_now));
                 shinfo->gso_size = mss_now;
                 shinfo->gso_type = sk->sk_gso_type;
         }
@@ -1146,10 +1165,6 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
 
         buff->ip_summed = skb->ip_summed;
 
-        /* Looks stupid, but our code really uses when of
-         * skbs, which it never sent before. --ANK
-         */
-        TCP_SKB_CB(buff)->when = TCP_SKB_CB(skb)->when;
         buff->tstamp = skb->tstamp;
         tcp_fragment_tstamp(skb, buff);
 
@@ -1171,7 +1186,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
         }
 
         /* Link BUFF into the send queue. */
-        skb_header_release(buff);
+        __skb_header_release(buff);
         tcp_insert_write_queue_after(skb, buff, sk);
 
         return 0;
@@ -1675,7 +1690,7 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
         tcp_set_skb_tso_segs(sk, buff, mss_now);
 
         /* Link BUFF into the send queue. */
-        skb_header_release(buff);
+        __skb_header_release(buff);
         tcp_insert_write_queue_after(skb, buff, sk);
 
         return 0;
@@ -1874,8 +1889,8 @@ static int tcp_mtu_probe(struct sock *sk)
         tcp_init_tso_segs(sk, nskb, nskb->len);
 
         /* We're ready to send.  If this fails, the probe will
-         * be resegmented into mss-sized pieces by tcp_write_xmit(). */
-        TCP_SKB_CB(nskb)->when = tcp_time_stamp;
+         * be resegmented into mss-sized pieces by tcp_write_xmit().
+         */
         if (!tcp_transmit_skb(sk, nskb, 1, GFP_ATOMIC)) {
                 /* Decrement cwnd here because we are sending
                  * effectively two packets. */
@@ -1935,8 +1950,8 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                 BUG_ON(!tso_segs);
 
                 if (unlikely(tp->repair) && tp->repair_queue == TCP_SEND_QUEUE) {
-                        /* "when" is used as a start point for the retransmit timer */
-                        TCP_SKB_CB(skb)->when = tcp_time_stamp;
+                        /* "skb_mstamp" is used as a start point for the retransmit timer */
+                        skb_mstamp_get(&skb->skb_mstamp);
                         goto repair; /* Skip network transmission */
                 }
 
@@ -2000,8 +2015,6 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                     unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
                         break;
 
-                TCP_SKB_CB(skb)->when = tcp_time_stamp;
-
                 if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp)))
                         break;
 
@@ -2097,10 +2110,7 @@ bool tcp_schedule_loss_probe(struct sock *sk)
 static bool skb_still_in_host_queue(const struct sock *sk,
                                     const struct sk_buff *skb)
 {
-        const struct sk_buff *fclone = skb + 1;
-
-        if (unlikely(skb->fclone == SKB_FCLONE_ORIG &&
-                     fclone->fclone == SKB_FCLONE_CLONE)) {
+        if (unlikely(skb_fclone_busy(skb))) {
                 NET_INC_STATS_BH(sock_net(sk),
                                  LINUX_MIB_TCPSPURIOUS_RTX_HOSTQUEUES);
                 return true;
@@ -2499,7 +2509,6 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
         /* Make a copy, if the first transmission SKB clone we made
          * is still in somebody's hands, else make a clone.
          */
-        TCP_SKB_CB(skb)->when = tcp_time_stamp;
 
         /* make sure skb->data is aligned on arches that require it
          * and check if ack-trimming & collapsing extended the headroom
@@ -2544,7 +2553,7 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
 
                 /* Save stamp of the first retransmit. */
                 if (!tp->retrans_stamp)
-                        tp->retrans_stamp = TCP_SKB_CB(skb)->when;
+                        tp->retrans_stamp = tcp_skb_timestamp(skb);
 
                 /* snd_nxt is stored to detect loss of retransmitted segment,
                  * see tcp_input.c tcp_sacktag_write_queue().
@@ -2752,7 +2761,6 @@ void tcp_send_active_reset(struct sock *sk, gfp_t priority)
         tcp_init_nondata_skb(skb, tcp_acceptable_seq(sk),
                              TCPHDR_ACK | TCPHDR_RST);
         /* Send it off. */
-        TCP_SKB_CB(skb)->when = tcp_time_stamp;
         if (tcp_transmit_skb(sk, skb, 0, priority))
                 NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTFAILED);
 
@@ -2780,7 +2788,7 @@ int tcp_send_synack(struct sock *sk)
                         if (nskb == NULL)
                                 return -ENOMEM;
                         tcp_unlink_write_queue(skb, sk);
-                        skb_header_release(nskb);
+                        __skb_header_release(nskb);
                         __tcp_add_write_queue_head(sk, nskb);
                         sk_wmem_free_skb(sk, skb);
                         sk->sk_wmem_queued += nskb->truesize;
@@ -2789,9 +2797,8 @@ int tcp_send_synack(struct sock *sk)
                 }
 
                 TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_ACK;
-                TCP_ECN_send_synack(tcp_sk(sk), skb);
+                tcp_ecn_send_synack(sk, skb);
         }
-        TCP_SKB_CB(skb)->when = tcp_time_stamp;
         return tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
 }
 
@@ -2835,10 +2842,10 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         memset(&opts, 0, sizeof(opts));
 #ifdef CONFIG_SYN_COOKIES
         if (unlikely(req->cookie_ts))
-                TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
+                skb->skb_mstamp.stamp_jiffies = cookie_init_timestamp(req);
         else
 #endif
-        TCP_SKB_CB(skb)->when = tcp_time_stamp;
+        skb_mstamp_get(&skb->skb_mstamp);
         tcp_header_size = tcp_synack_options(sk, req, mss, skb, &opts, &md5,
                                              foc) + sizeof(*th);
 
@@ -2849,7 +2856,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         memset(th, 0, sizeof(struct tcphdr));
         th->syn = 1;
         th->ack = 1;
-        TCP_ECN_make_synack(req, th);
+        tcp_ecn_make_synack(req, th, sk);
         th->source = htons(ireq->ir_num);
         th->dest = ireq->ir_rmt_port;
         /* Setting of flags are superfluous here for callers (and ECE is
@@ -2956,7 +2963,7 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb)
         struct tcp_skb_cb *tcb = TCP_SKB_CB(skb);
 
         tcb->end_seq += skb->len;
-        skb_header_release(skb);
+        __skb_header_release(skb);
         __tcp_add_write_queue_tail(sk, skb);
         sk->sk_wmem_queued += skb->truesize;
         sk_mem_charge(sk, skb->truesize);
@@ -3086,9 +3093,9 @@ int tcp_connect(struct sock *sk)
         skb_reserve(buff, MAX_TCP_HEADER);
 
         tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
-        tp->retrans_stamp = TCP_SKB_CB(buff)->when = tcp_time_stamp;
+        tp->retrans_stamp = tcp_time_stamp;
         tcp_connect_queue_skb(sk, buff);
-        TCP_ECN_send_syn(sk, buff);
+        tcp_ecn_send_syn(sk, buff);
 
         /* Send off SYN; include data in Fast Open. */
         err = tp->fastopen_req ? tcp_send_syn_data(sk, buff) :
@@ -3120,6 +3127,8 @@ void tcp_send_delayed_ack(struct sock *sk)
         int ato = icsk->icsk_ack.ato;
         unsigned long timeout;
 
+        tcp_ca_event(sk, CA_EVENT_DELAYED_ACK);
+
         if (ato > TCP_DELACK_MIN) {
                 const struct tcp_sock *tp = tcp_sk(sk);
                 int max_ato = HZ / 2;
@@ -3176,6 +3185,8 @@ void tcp_send_ack(struct sock *sk)
         if (sk->sk_state == TCP_CLOSE)
                 return;
 
+        tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK);
+
         /* We are not putting this on the write queue, so
          * tcp_transmit_skb() will set the ownership to this
          * sock.
@@ -3194,9 +3205,10 @@ void tcp_send_ack(struct sock *sk)
         tcp_init_nondata_skb(buff, tcp_acceptable_seq(sk), TCPHDR_ACK);
 
         /* Send it off, this clears delayed acks for us. */
-        TCP_SKB_CB(buff)->when = tcp_time_stamp;
+        skb_mstamp_get(&buff->skb_mstamp);
         tcp_transmit_skb(sk, buff, 0, sk_gfp_atomic(sk, GFP_ATOMIC));
 }
+EXPORT_SYMBOL_GPL(tcp_send_ack);
 
 /* This routine sends a packet with an out of date sequence
  * number. It assumes the other end will try to ack it.
@@ -3226,7 +3238,7 @@ static int tcp_xmit_probe_skb(struct sock *sk, int urgent)
          * send it.
          */
         tcp_init_nondata_skb(skb, tp->snd_una - !urgent, TCPHDR_ACK);
-        TCP_SKB_CB(skb)->when = tcp_time_stamp;
+        skb_mstamp_get(&skb->skb_mstamp);
         return tcp_transmit_skb(sk, skb, 0, GFP_ATOMIC);
 }
 
@@ -3270,7 +3282,6 @@ int tcp_write_wakeup(struct sock *sk)
                         tcp_set_skb_tso_segs(sk, skb, mss);
 
                 TCP_SKB_CB(skb)->tcp_flags |= TCPHDR_PSH;
-                TCP_SKB_CB(skb)->when = tcp_time_stamp;
                 err = tcp_transmit_skb(sk, skb, 1, GFP_ATOMIC);
                 if (!err)
                         tcp_event_new_data_sent(sk, skb);
@@ -3289,6 +3300,7 @@ void tcp_send_probe0(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
+        unsigned long probe_max;
         int err;
 
         err = tcp_write_wakeup(sk);
@@ -3304,9 +3316,7 @@ void tcp_send_probe0(struct sock *sk)
                 if (icsk->icsk_backoff < sysctl_tcp_retries2)
                         icsk->icsk_backoff++;
                 icsk->icsk_probes_out++;
-                inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
-                                          min(icsk->icsk_rto << icsk->icsk_backoff, TCP_RTO_MAX),
-                                          TCP_RTO_MAX);
+                probe_max = TCP_RTO_MAX;
         } else {
                 /* If packet was not sent due to local congestion,
                  * do not backoff and do not remember icsk_probes_out.
@@ -3316,11 +3326,11 @@ void tcp_send_probe0(struct sock *sk)
                  */
                 if (!icsk->icsk_probes_out)
                         icsk->icsk_probes_out = 1;
-                inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
-                                          min(icsk->icsk_rto << icsk->icsk_backoff,
-                                              TCP_RESOURCE_PROBE_INTERVAL),
-                                          TCP_RTO_MAX);
+                probe_max = TCP_RESOURCE_PROBE_INTERVAL;
         }
+        inet_csk_reset_xmit_timer(sk, ICSK_TIME_PROBE0,
+                                  inet_csk_rto_backoff(icsk, probe_max),
+                                  TCP_RTO_MAX);
 }
 
 int tcp_rtx_synack(struct sock *sk, struct request_sock *req)
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 3b66610d4156..ebf5ff57526e 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -83,7 +83,6 @@ static struct {
         struct tcp_log  *log;
 } tcp_probe;
 
-
 static inline int tcp_probe_used(void)
 {
         return (tcp_probe.head - tcp_probe.tail) & (bufsize - 1);
@@ -101,7 +100,6 @@ static inline int tcp_probe_avail(void)
                 si4.sin_addr.s_addr = inet->inet_##mem##addr;   \
         } while (0)                                             \
 
-
 /*
  * Hook inserted to be called before each receive packet.
  * Note: arguments must match tcp_rcv_established()!
@@ -194,8 +192,8 @@ static int tcpprobe_sprint(char *tbuf, int n)
 
         return scnprintf(tbuf, n,
                         "%lu.%09lu %pISpc %pISpc %d %#x %#x %u %u %u %u %u\n",
-                        (unsigned long) tv.tv_sec,
-                        (unsigned long) tv.tv_nsec,
+                        (unsigned long)tv.tv_sec,
+                        (unsigned long)tv.tv_nsec,
                         &p->src, &p->dst, p->length, p->snd_nxt, p->snd_una,
                         p->snd_cwnd, p->ssthresh, p->snd_wnd, p->srtt, p->rcv_wnd);
 }
diff --git a/net/ipv4/tcp_scalable.c b/net/ipv4/tcp_scalable.c
index 8250949b8853..6824afb65d93 100644
--- a/net/ipv4/tcp_scalable.c
+++ b/net/ipv4/tcp_scalable.c
@@ -31,10 +31,10 @@ static void tcp_scalable_cong_avoid(struct sock *sk, u32 ack, u32 acked)
 static u32 tcp_scalable_ssthresh(struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
+
         return max(tp->snd_cwnd - (tp->snd_cwnd>>TCP_SCALABLE_MD_SCALE), 2U);
 }
 
-
 static struct tcp_congestion_ops tcp_scalable __read_mostly = {
         .ssthresh       = tcp_scalable_ssthresh,
         .cong_avoid     = tcp_scalable_cong_avoid,
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index df90cd1ce37f..9b21ae8b2e31 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -52,7 +52,7 @@ static void tcp_write_err(struct sock *sk)
  *    limit.
  * 2. If we have strong memory pressure.
  */
-static int tcp_out_of_resources(struct sock *sk, int do_reset)
+static int tcp_out_of_resources(struct sock *sk, bool do_reset)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int shift = 0;
@@ -72,7 +72,7 @@ static int tcp_out_of_resources(struct sock *sk, int do_reset)
                 if ((s32)(tcp_time_stamp - tp->lsndtime) <= TCP_TIMEWAIT_LEN ||
                     /*  2. Window is closed. */
                     (!tp->snd_wnd && !tp->packets_out))
-                        do_reset = 1;
+                        do_reset = true;
                 if (do_reset)
                         tcp_send_active_reset(sk, GFP_ATOMIC);
                 tcp_done(sk);
@@ -135,10 +135,9 @@ static bool retransmits_timed_out(struct sock *sk,
         if (!inet_csk(sk)->icsk_retransmits)
                 return false;
 
-        if (unlikely(!tcp_sk(sk)->retrans_stamp))
-                start_ts = TCP_SKB_CB(tcp_write_queue_head(sk))->when;
-        else
-                start_ts = tcp_sk(sk)->retrans_stamp;
+        start_ts = tcp_sk(sk)->retrans_stamp;
+        if (unlikely(!start_ts))
+                start_ts = tcp_skb_timestamp(tcp_write_queue_head(sk));
 
         if (likely(timeout == 0)) {
                 linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
@@ -181,7 +180,7 @@ static int tcp_write_timeout(struct sock *sk)
 
                 retry_until = sysctl_tcp_retries2;
                 if (sock_flag(sk, SOCK_DEAD)) {
-                        const int alive = (icsk->icsk_rto < TCP_RTO_MAX);
+                        const int alive = icsk->icsk_rto < TCP_RTO_MAX;
 
                         retry_until = tcp_orphan_retries(sk, alive);
                         do_reset = alive ||
@@ -271,40 +270,41 @@ static void tcp_probe_timer(struct sock *sk)
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         int max_probes;
+        u32 start_ts;
 
         if (tp->packets_out || !tcp_send_head(sk)) {
                 icsk->icsk_probes_out = 0;
                 return;
         }
 
-        /* *WARNING* RFC 1122 forbids this
-         *
-         * It doesn't AFAIK, because we kill the retransmit timer -AK
-         *
-         * FIXME: We ought not to do it, Solaris 2.5 actually has fixing
-         * this behaviour in Solaris down as a bug fix. [AC]
-         *
-         * Let me to explain. icsk_probes_out is zeroed by incoming ACKs
-         * even if they advertise zero window. Hence, connection is killed only
-         * if we received no ACKs for normal connection timeout. It is not killed
-         * only because window stays zero for some time, window may be zero
-         * until armageddon and even later. We are in full accordance
-         * with RFCs, only probe timer combines both retransmission timeout
-         * and probe timeout in one bottle.                             --ANK
+        /* RFC 1122 4.2.2.17 requires the sender to stay open indefinitely as
+         * long as the receiver continues to respond probes. We support this by
+         * default and reset icsk_probes_out with incoming ACKs. But if the
+         * socket is orphaned or the user specifies TCP_USER_TIMEOUT, we
+         * kill the socket when the retry count and the time exceeds the
+         * corresponding system limit. We also implement similar policy when
+         * we use RTO to probe window in tcp_retransmit_timer().
          */
-        max_probes = sysctl_tcp_retries2;
+        start_ts = tcp_skb_timestamp(tcp_send_head(sk));
+        if (!start_ts)
+                skb_mstamp_get(&tcp_send_head(sk)->skb_mstamp);
+        else if (icsk->icsk_user_timeout &&
+                 (s32)(tcp_time_stamp - start_ts) > icsk->icsk_user_timeout)
+                goto abort;
 
+        max_probes = sysctl_tcp_retries2;
         if (sock_flag(sk, SOCK_DEAD)) {
-                const int alive = ((icsk->icsk_rto << icsk->icsk_backoff) < TCP_RTO_MAX);
+                const int alive = inet_csk_rto_backoff(icsk, TCP_RTO_MAX) < TCP_RTO_MAX;
 
                 max_probes = tcp_orphan_retries(sk, alive);
-
-                if (tcp_out_of_resources(sk, alive || icsk->icsk_probes_out <= max_probes))
+                if (!alive && icsk->icsk_backoff >= max_probes)
+                        goto abort;
+                if (tcp_out_of_resources(sk, true))
                         return;
         }
 
         if (icsk->icsk_probes_out > max_probes) {
-                tcp_write_err(sk);
+abort:          tcp_write_err(sk);
         } else {
                 /* Only send another probe if we didn't close things up. */
                 tcp_send_probe0(sk);
diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
index b40ad897f945..a6afde666ab1 100644
--- a/net/ipv4/tcp_vegas.c
+++ b/net/ipv4/tcp_vegas.c
@@ -51,7 +51,6 @@ MODULE_PARM_DESC(beta, "upper bound of packets in network");
 module_param(gamma, int, 0644);
 MODULE_PARM_DESC(gamma, "limit on increase (scale by 2)");
 
-
 /* There are several situations when we must "re-start" Vegas:
  *
  *  o when a connection is established
@@ -133,7 +132,6 @@ EXPORT_SYMBOL_GPL(tcp_vegas_pkts_acked);
 
 void tcp_vegas_state(struct sock *sk, u8 ca_state)
 {
-
         if (ca_state == TCP_CA_Open)
                 vegas_enable(sk);
         else
@@ -285,7 +283,6 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked)
         /* Use normal slow start */
         else if (tp->snd_cwnd <= tp->snd_ssthresh)
                 tcp_slow_start(tp, acked);
-
 }
 
 /* Extract info for Tcp socket info provided via netlink. */
diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
index 8276977d2c85..a4d2d2d88dca 100644
--- a/net/ipv4/tcp_veno.c
+++ b/net/ipv4/tcp_veno.c
@@ -175,7 +175,6 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 acked)
                                 } else
                                         tp->snd_cwnd_cnt++;
                         }
-
                 }
                 if (tp->snd_cwnd < 2)
                         tp->snd_cwnd = 2;
diff --git a/net/ipv4/tcp_westwood.c b/net/ipv4/tcp_westwood.c
index b94a04ae2ed5..bb63fba47d47 100644
--- a/net/ipv4/tcp_westwood.c
+++ b/net/ipv4/tcp_westwood.c
@@ -42,7 +42,6 @@ struct westwood {
         u8     reset_rtt_min;    /* Reset RTT min to next RTT sample*/
 };
 
-
 /* TCP Westwood functions and constants */
 #define TCP_WESTWOOD_RTT_MIN   (HZ/20)  /* 50ms */
 #define TCP_WESTWOOD_INIT_RTT  (20*HZ)  /* maybe too conservative?! */
@@ -153,7 +152,6 @@ static inline void update_rtt_min(struct westwood *w)
                 w->rtt_min = min(w->rtt, w->rtt_min);
 }
 
-
 /*
  * @westwood_fast_bw
  * It is called when we are in fast path. In particular it is called when
@@ -208,7 +206,6 @@ static inline u32 westwood_acked_count(struct sock *sk)
         return w->cumul_ack;
 }
 
-
 /*
  * TCP Westwood
  * Here limit is evaluated as Bw estimation*RTTmin (for obtaining it
@@ -219,47 +216,51 @@ static u32 tcp_westwood_bw_rttmin(const struct sock *sk)
 {
         const struct tcp_sock *tp = tcp_sk(sk);
         const struct westwood *w = inet_csk_ca(sk);
+
         return max_t(u32, (w->bw_est * w->rtt_min) / tp->mss_cache, 2);
 }
 
+static void tcp_westwood_ack(struct sock *sk, u32 ack_flags)
+{
+        if (ack_flags & CA_ACK_SLOWPATH) {
+                struct westwood *w = inet_csk_ca(sk);
+
+                westwood_update_window(sk);
+                w->bk += westwood_acked_count(sk);
+
+                update_rtt_min(w);
+                return;
+        }
+
+        westwood_fast_bw(sk);
+}
+
 static void tcp_westwood_event(struct sock *sk, enum tcp_ca_event event)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct westwood *w = inet_csk_ca(sk);
 
         switch (event) {
-        case CA_EVENT_FAST_ACK:
-                westwood_fast_bw(sk);
-                break;
-
         case CA_EVENT_COMPLETE_CWR:
                 tp->snd_cwnd = tp->snd_ssthresh = tcp_westwood_bw_rttmin(sk);
                 break;
-
         case CA_EVENT_LOSS:
                 tp->snd_ssthresh = tcp_westwood_bw_rttmin(sk);
                 /* Update RTT_min when next ack arrives */
                 w->reset_rtt_min = 1;
                 break;
-
-        case CA_EVENT_SLOW_ACK:
-                westwood_update_window(sk);
-                w->bk += westwood_acked_count(sk);
-                update_rtt_min(w);
-                break;
-
         default:
                 /* don't care */
                 break;
         }
 }
 
-
 /* Extract info for Tcp socket info provided via netlink. */
 static void tcp_westwood_info(struct sock *sk, u32 ext,
                               struct sk_buff *skb)
 {
         const struct westwood *ca = inet_csk_ca(sk);
+
         if (ext & (1 << (INET_DIAG_VEGASINFO - 1))) {
                 struct tcpvegas_info info = {
                         .tcpv_enabled = 1,
@@ -271,12 +272,12 @@ static void tcp_westwood_info(struct sock *sk, u32 ext,
         }
 }
 
-
 static struct tcp_congestion_ops tcp_westwood __read_mostly = {
         .init           = tcp_westwood_init,
         .ssthresh       = tcp_reno_ssthresh,
         .cong_avoid     = tcp_reno_cong_avoid,
         .cwnd_event     = tcp_westwood_event,
+        .in_ack_event   = tcp_westwood_ack,
         .get_info       = tcp_westwood_info,
         .pkts_acked     = tcp_westwood_pkts_acked,
 
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index 599b79b8eac0..cd7273218598 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -54,10 +54,8 @@ static void tcp_yeah_init(struct sock *sk)
         /* Ensure the MD arithmetic works.  This is somewhat pedantic,
          * since I don't think we will see a cwnd this large. :) */
         tp->snd_cwnd_clamp = min_t(u32, tp->snd_cwnd_clamp, 0xffffffff/128);
-
 }
 
-
 static void tcp_yeah_pkts_acked(struct sock *sk, u32 pkts_acked, s32 rtt_us)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
@@ -84,7 +82,7 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)
                 /* Scalable */
 
                 tp->snd_cwnd_cnt += yeah->pkts_acked;
-                if (tp->snd_cwnd_cnt > min(tp->snd_cwnd, TCP_SCALABLE_AI_CNT)){
+                if (tp->snd_cwnd_cnt > min(tp->snd_cwnd, TCP_SCALABLE_AI_CNT)) {
                         if (tp->snd_cwnd < tp->snd_cwnd_clamp)
                                 tp->snd_cwnd++;
                         tp->snd_cwnd_cnt = 0;
@@ -120,7 +118,6 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)
          */
 
         if (after(ack, yeah->vegas.beg_snd_nxt)) {
-
                 /* We do the Vegas calculations only if we got enough RTT
                  * samples that we can be reasonably sure that we got
                  * at least one RTT sample that wasn't from a delayed ACK.
@@ -189,7 +186,6 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)
                         }
 
                         yeah->lastQ = queue;
-
                 }
 
                 /* Save the extent of the current window so we can use this
@@ -205,7 +201,8 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)
         }
 }
 
-static u32 tcp_yeah_ssthresh(struct sock *sk) {
+static u32 tcp_yeah_ssthresh(struct sock *sk)
+{
         const struct tcp_sock *tp = tcp_sk(sk);
         struct yeah *yeah = inet_csk_ca(sk);
         u32 reduction;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index f57c0e4c2326..cd0db5471bb5 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -99,6 +99,7 @@
 #include <linux/slab.h>
 #include <net/tcp_states.h>
 #include <linux/skbuff.h>
+#include <linux/netdevice.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <net/net_namespace.h>
@@ -224,7 +225,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                 remaining = (high - low) + 1;
 
                 rand = prandom_u32();
-                first = (((u64)rand * remaining) >> 32) + low;
+                first = reciprocal_scale(rand, remaining) + low;
                 /*
                  * force rand to be an odd multiple of UDP_HTABLE_SIZE
                  */
@@ -448,7 +449,7 @@ begin:
                         }
                 } else if (score == badness && reuseport) {
                         matches++;
-                        if (((u64)hash * matches) >> 32 == 0)
+                        if (reciprocal_scale(hash, matches) == 0)
                                 result = sk;
                         hash = next_pseudo_random32(hash);
                 }
@@ -529,7 +530,7 @@ begin:
                         }
                 } else if (score == badness && reuseport) {
                         matches++;
-                        if (((u64)hash * matches) >> 32 == 0)
+                        if (reciprocal_scale(hash, matches) == 0)
                                 result = sk;
                         hash = next_pseudo_random32(hash);
                 }
@@ -1787,6 +1788,10 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (sk != NULL) {
                 int ret;
 
+                if (udp_sk(sk)->convert_csum && uh->check && !IS_UDPLITE(sk))
+                        skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
+                                                 inet_compute_pseudo);
+
                 ret = udp_queue_rcv_skb(sk, skb);
                 sock_put(sk);
 
@@ -1967,7 +1972,7 @@ void udp_v4_early_demux(struct sk_buff *skb)
                 return;
 
         skb->sk = sk;
-        skb->destructor = sock_edemux;
+        skb->destructor = sock_efree;
         dst = sk->sk_rx_dst;
 
         if (dst)
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 59035bc3008d..507310ef4b56 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -25,30 +25,11 @@ struct udp_offload_priv {
         struct udp_offload_priv __rcu *next;
 };
 
-static int udp4_ufo_send_check(struct sk_buff *skb)
-{
-        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
-                return -EINVAL;
-
-        if (likely(!skb->encapsulation)) {
-                const struct iphdr *iph;
-                struct udphdr *uh;
-
-                iph = ip_hdr(skb);
-                uh = udp_hdr(skb);
-
-                uh->check = ~csum_tcpudp_magic(iph->saddr, iph->daddr, skb->len,
-                                IPPROTO_UDP, 0);
-                skb->csum_start = skb_transport_header(skb) - skb->head;
-                skb->csum_offset = offsetof(struct udphdr, check);
-                skb->ip_summed = CHECKSUM_PARTIAL;
-        }
-
-        return 0;
-}
-
-struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
-                                       netdev_features_t features)
+static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
+        netdev_features_t features,
+        struct sk_buff *(*gso_inner_segment)(struct sk_buff *skb,
+                                             netdev_features_t features),
+        __be16 new_protocol)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         u16 mac_offset = skb->mac_header;
@@ -70,7 +51,7 @@ struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
         skb_reset_mac_header(skb);
         skb_set_network_header(skb, skb_inner_network_offset(skb));
         skb->mac_len = skb_inner_network_offset(skb);
-        skb->protocol = htons(ETH_P_TEB);
+        skb->protocol = new_protocol;
 
         need_csum = !!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM);
         if (need_csum)
@@ -78,7 +59,7 @@ struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
 
         /* segment inner packet. */
         enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
-        segs = skb_mac_gso_segment(skb, enc_features);
+        segs = gso_inner_segment(skb, enc_features);
         if (IS_ERR_OR_NULL(segs)) {
                 skb_gso_error_unwind(skb, protocol, tnl_hlen, mac_offset,
                                      mac_len);
@@ -123,21 +104,63 @@ out:
         return segs;
 }
 
+struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
+                                       netdev_features_t features,
+                                       bool is_ipv6)
+{
+        __be16 protocol = skb->protocol;
+        const struct net_offload **offloads;
+        const struct net_offload *ops;
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        struct sk_buff *(*gso_inner_segment)(struct sk_buff *skb,
+                                             netdev_features_t features);
+
+        rcu_read_lock();
+
+        switch (skb->inner_protocol_type) {
+        case ENCAP_TYPE_ETHER:
+                protocol = skb->inner_protocol;
+                gso_inner_segment = skb_mac_gso_segment;
+                break;
+        case ENCAP_TYPE_IPPROTO:
+                offloads = is_ipv6 ? inet6_offloads : inet_offloads;
+                ops = rcu_dereference(offloads[skb->inner_ipproto]);
+                if (!ops || !ops->callbacks.gso_segment)
+                        goto out_unlock;
+                gso_inner_segment = ops->callbacks.gso_segment;
+                break;
+        default:
+                goto out_unlock;
+        }
+
+        segs = __skb_udp_tunnel_segment(skb, features, gso_inner_segment,
+                                        protocol);
+
+out_unlock:
+        rcu_read_unlock();
+
+        return segs;
+}
+
 static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
                                          netdev_features_t features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         unsigned int mss;
-        int offset;
         __wsum csum;
+        struct udphdr *uh;
+        struct iphdr *iph;
 
         if (skb->encapsulation &&
             (skb_shinfo(skb)->gso_type &
              (SKB_GSO_UDP_TUNNEL|SKB_GSO_UDP_TUNNEL_CSUM))) {
-                segs = skb_udp_tunnel_segment(skb, features);
+                segs = skb_udp_tunnel_segment(skb, features, false);
                 goto out;
         }
 
+        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
+                goto out;
+
         mss = skb_shinfo(skb)->gso_size;
         if (unlikely(skb->len <= mss))
                 goto out;
@@ -165,10 +188,16 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
          * HW cannot do checksum of UDP packets sent as multiple
          * IP fragments.
          */
-        offset = skb_checksum_start_offset(skb);
-        csum = skb_checksum(skb, offset, skb->len - offset, 0);
-        offset += skb->csum_offset;
-        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+
+        uh = udp_hdr(skb);
+        iph = ip_hdr(skb);
+
+        uh->check = 0;
+        csum = skb_checksum(skb, 0, skb->len, 0);
+        uh->check = udp_v4_check(skb->len, iph->saddr, iph->daddr, csum);
+        if (uh->check == 0)
+                uh->check = CSUM_MANGLED_0;
+
         skb->ip_summed = CHECKSUM_NONE;
 
         /* Fragment the skb. IP headers of the fragments are updated in
@@ -228,30 +257,24 @@ unlock:
 }
 EXPORT_SYMBOL(udp_del_offload);
 
-static struct sk_buff **udp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
+struct sk_buff **udp_gro_receive(struct sk_buff **head, struct sk_buff *skb,
+                                 struct udphdr *uh)
 {
         struct udp_offload_priv *uo_priv;
         struct sk_buff *p, **pp = NULL;
-        struct udphdr *uh, *uh2;
-        unsigned int hlen, off;
+        struct udphdr *uh2;
+        unsigned int off = skb_gro_offset(skb);
         int flush = 1;
 
         if (NAPI_GRO_CB(skb)->udp_mark ||
-            (!skb->encapsulation && skb->ip_summed != CHECKSUM_COMPLETE))
+            (skb->ip_summed != CHECKSUM_PARTIAL &&
+             NAPI_GRO_CB(skb)->csum_cnt == 0 &&
+             !NAPI_GRO_CB(skb)->csum_valid))
                 goto out;
 
         /* mark that this skb passed once through the udp gro layer */
         NAPI_GRO_CB(skb)->udp_mark = 1;
 
-        off  = skb_gro_offset(skb);
-        hlen = off + sizeof(*uh);
-        uh   = skb_gro_header_fast(skb, off);
-        if (skb_gro_header_hard(skb, hlen)) {
-                uh = skb_gro_header_slow(skb, hlen, off);
-                if (unlikely(!uh))
-                        goto out;
-        }
-
         rcu_read_lock();
         uo_priv = rcu_dereference(udp_offload_base);
         for (; uo_priv != NULL; uo_priv = rcu_dereference(uo_priv->next)) {
@@ -269,7 +292,12 @@ unflush:
                         continue;
 
                 uh2 = (struct udphdr   *)(p->data + off);
-                if ((*(u32 *)&uh->source != *(u32 *)&uh2->source)) {
+
+                /* Match ports and either checksums are either both zero
+                 * or nonzero.
+                 */
+                if ((*(u32 *)&uh->source != *(u32 *)&uh2->source) ||
+                    (!uh->check ^ !uh2->check)) {
                         NAPI_GRO_CB(p)->same_flow = 0;
                         continue;
                 }
@@ -277,6 +305,7 @@ unflush:
 
         skb_gro_pull(skb, sizeof(struct udphdr)); /* pull encapsulating udp header */
         skb_gro_postpull_rcsum(skb, uh, sizeof(struct udphdr));
+        NAPI_GRO_CB(skb)->proto = uo_priv->offload->ipproto;
         pp = uo_priv->offload->callbacks.gro_receive(head, skb);
 
 out_unlock:
@@ -286,7 +315,34 @@ out:
         return pp;
 }
 
-static int udp_gro_complete(struct sk_buff *skb, int nhoff)
+static struct sk_buff **udp4_gro_receive(struct sk_buff **head,
+                                         struct sk_buff *skb)
+{
+        struct udphdr *uh = udp_gro_udphdr(skb);
+
+        if (unlikely(!uh))
+                goto flush;
+
+        /* Don't bother verifying checksum if we're going to flush anyway. */
+        if (NAPI_GRO_CB(skb)->flush)
+                goto skip;
+
+        if (skb_gro_checksum_validate_zero_check(skb, IPPROTO_UDP, uh->check,
+                                                 inet_gro_compute_pseudo))
+                goto flush;
+        else if (uh->check)
+                skb_gro_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
+                                             inet_gro_compute_pseudo);
+skip:
+        NAPI_GRO_CB(skb)->is_ipv6 = 0;
+        return udp_gro_receive(head, skb, uh);
+
+flush:
+        NAPI_GRO_CB(skb)->flush = 1;
+        return NULL;
+}
+
+int udp_gro_complete(struct sk_buff *skb, int nhoff)
 {
         struct udp_offload_priv *uo_priv;
         __be16 newlen = htons(skb->len - nhoff);
@@ -304,19 +360,32 @@ static int udp_gro_complete(struct sk_buff *skb, int nhoff)
                         break;
         }
 
-        if (uo_priv != NULL)
+        if (uo_priv != NULL) {
+                NAPI_GRO_CB(skb)->proto = uo_priv->offload->ipproto;
                 err = uo_priv->offload->callbacks.gro_complete(skb, nhoff + sizeof(struct udphdr));
+        }
 
         rcu_read_unlock();
         return err;
 }
 
+static int udp4_gro_complete(struct sk_buff *skb, int nhoff)
+{
+        const struct iphdr *iph = ip_hdr(skb);
+        struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);
+
+        if (uh->check)
+                uh->check = ~udp_v4_check(skb->len - nhoff, iph->saddr,
+                                          iph->daddr, 0);
+
+        return udp_gro_complete(skb, nhoff);
+}
+
 static const struct net_offload udpv4_offload = {
         .callbacks = {
-                .gso_send_check = udp4_ufo_send_check,
                 .gso_segment = udp4_ufo_fragment,
-                .gro_receive  = udp_gro_receive,
-                .gro_complete = udp_gro_complete,
+                .gro_receive  = udp4_gro_receive,
+                .gro_complete = udp4_gro_complete,
         },
 };
 
diff --git a/net/ipv4/udp_tunnel.c b/net/ipv4/udp_tunnel.c
index 61ec1a65207e..1671263e5fa0 100644
--- a/net/ipv4/udp_tunnel.c
+++ b/net/ipv4/udp_tunnel.c
@@ -8,83 +8,40 @@
 #include <net/udp_tunnel.h>
 #include <net/net_namespace.h>
 
-int udp_sock_create(struct net *net, struct udp_port_cfg *cfg,
-                    struct socket **sockp)
+int udp_sock_create4(struct net *net, struct udp_port_cfg *cfg,
+                     struct socket **sockp)
 {
-        int err = -EINVAL;
+        int err;
         struct socket *sock = NULL;
+        struct sockaddr_in udp_addr;
 
-#if IS_ENABLED(CONFIG_IPV6)
-        if (cfg->family == AF_INET6) {
-                struct sockaddr_in6 udp6_addr;
+        err = sock_create_kern(AF_INET, SOCK_DGRAM, 0, &sock);
+        if (err < 0)
+                goto error;
 
-                err = sock_create_kern(AF_INET6, SOCK_DGRAM, 0, &sock);
-                if (err < 0)
-                        goto error;
-
-                sk_change_net(sock->sk, net);
-
-                udp6_addr.sin6_family = AF_INET6;
-                memcpy(&udp6_addr.sin6_addr, &cfg->local_ip6,
-                       sizeof(udp6_addr.sin6_addr));
-                udp6_addr.sin6_port = cfg->local_udp_port;
-                err = kernel_bind(sock, (struct sockaddr *)&udp6_addr,
-                                  sizeof(udp6_addr));
-                if (err < 0)
-                        goto error;
-
-                if (cfg->peer_udp_port) {
-                        udp6_addr.sin6_family = AF_INET6;
-                        memcpy(&udp6_addr.sin6_addr, &cfg->peer_ip6,
-                               sizeof(udp6_addr.sin6_addr));
-                        udp6_addr.sin6_port = cfg->peer_udp_port;
-                        err = kernel_connect(sock,
-                                             (struct sockaddr *)&udp6_addr,
-                                             sizeof(udp6_addr), 0);
-                }
-                if (err < 0)
-                        goto error;
+        sk_change_net(sock->sk, net);
 
-                udp_set_no_check6_tx(sock->sk, !cfg->use_udp6_tx_checksums);
-                udp_set_no_check6_rx(sock->sk, !cfg->use_udp6_rx_checksums);
-        } else
-#endif
-        if (cfg->family == AF_INET) {
-                struct sockaddr_in udp_addr;
-
-                err = sock_create_kern(AF_INET, SOCK_DGRAM, 0, &sock);
-                if (err < 0)
-                        goto error;
-
-                sk_change_net(sock->sk, net);
+        udp_addr.sin_family = AF_INET;
+        udp_addr.sin_addr = cfg->local_ip;
+        udp_addr.sin_port = cfg->local_udp_port;
+        err = kernel_bind(sock, (struct sockaddr *)&udp_addr,
+                          sizeof(udp_addr));
+        if (err < 0)
+                goto error;
 
+        if (cfg->peer_udp_port) {
                 udp_addr.sin_family = AF_INET;
-                udp_addr.sin_addr = cfg->local_ip;
-                udp_addr.sin_port = cfg->local_udp_port;
-                err = kernel_bind(sock, (struct sockaddr *)&udp_addr,
-                                  sizeof(udp_addr));
+                udp_addr.sin_addr = cfg->peer_ip;
+                udp_addr.sin_port = cfg->peer_udp_port;
+                err = kernel_connect(sock, (struct sockaddr *)&udp_addr,
+                                     sizeof(udp_addr), 0);
                 if (err < 0)
                         goto error;
-
-                if (cfg->peer_udp_port) {
-                        udp_addr.sin_family = AF_INET;
-                        udp_addr.sin_addr = cfg->peer_ip;
-                        udp_addr.sin_port = cfg->peer_udp_port;
-                        err = kernel_connect(sock,
-                                             (struct sockaddr *)&udp_addr,
-                                             sizeof(udp_addr), 0);
-                        if (err < 0)
-                                goto error;
-                }
-
-                sock->sk->sk_no_check_tx = !cfg->use_udp_checksums;
-        } else {
-                return -EPFNOSUPPORT;
         }
 
+        sock->sk->sk_no_check_tx = !cfg->use_udp_checksums;
 
         *sockp = sock;
-
         return 0;
 
 error:
@@ -95,6 +52,57 @@ error:
         *sockp = NULL;
         return err;
 }
-EXPORT_SYMBOL(udp_sock_create);
+EXPORT_SYMBOL(udp_sock_create4);
+
+void setup_udp_tunnel_sock(struct net *net, struct socket *sock,
+                           struct udp_tunnel_sock_cfg *cfg)
+{
+        struct sock *sk = sock->sk;
+
+        /* Disable multicast loopback */
+        inet_sk(sk)->mc_loop = 0;
+
+        /* Enable CHECKSUM_UNNECESSARY to CHECKSUM_COMPLETE conversion */
+        udp_set_convert_csum(sk, true);
+
+        rcu_assign_sk_user_data(sk, cfg->sk_user_data);
+
+        udp_sk(sk)->encap_type = cfg->encap_type;
+        udp_sk(sk)->encap_rcv = cfg->encap_rcv;
+        udp_sk(sk)->encap_destroy = cfg->encap_destroy;
+
+        udp_tunnel_encap_enable(sock);
+}
+EXPORT_SYMBOL_GPL(setup_udp_tunnel_sock);
+
+int udp_tunnel_xmit_skb(struct socket *sock, struct rtable *rt,
+                        struct sk_buff *skb, __be32 src, __be32 dst,
+                        __u8 tos, __u8 ttl, __be16 df, __be16 src_port,
+                        __be16 dst_port, bool xnet)
+{
+        struct udphdr *uh;
+
+        __skb_push(skb, sizeof(*uh));
+        skb_reset_transport_header(skb);
+        uh = udp_hdr(skb);
+
+        uh->dest = dst_port;
+        uh->source = src_port;
+        uh->len = htons(skb->len);
+
+        udp_set_csum(sock->sk->sk_no_check_tx, skb, src, dst, skb->len);
+
+        return iptunnel_xmit(sock->sk, rt, skb, src, dst, IPPROTO_UDP,
+                             tos, ttl, df, xnet);
+}
+EXPORT_SYMBOL_GPL(udp_tunnel_xmit_skb);
+
+void udp_tunnel_sock_release(struct socket *sock)
+{
+        rcu_assign_sk_user_data(sock->sk, NULL);
+        kernel_sock_shutdown(sock, SHUT_RDWR);
+        sk_release_kernel(sock->sk);
+}
+EXPORT_SYMBOL_GPL(udp_tunnel_sock_release);
 
 MODULE_LICENSE("GPL");