152 files changed, 4368 insertions, 2298 deletions

diff --git a/net/802/tr.c b/net/802/tr.c
index 3f16b1720554..18c66475d8c3 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -76,7 +76,7 @@ static DEFINE_SPINLOCK(rif_lock);
 
 static struct timer_list rif_timer;
 
-int sysctl_tr_rif_timeout = 60*10*HZ;
+static int sysctl_tr_rif_timeout = 60*10*HZ;
 
 static inline unsigned long rif_hash(const unsigned char *addr)
 {
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 8059fa42b085..77f04e49a1a0 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -563,6 +563,7 @@ static int vlan_dev_stop(struct net_device *dev)
         struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
 
         dev_mc_unsync(real_dev, dev);
+        dev_unicast_unsync(real_dev, dev);
         if (dev->flags & IFF_ALLMULTI)
                 dev_set_allmulti(real_dev, -1);
         if (dev->flags & IFF_PROMISC)
@@ -634,9 +635,10 @@ static void vlan_dev_change_rx_flags(struct net_device *dev, int change)
                 dev_set_promiscuity(real_dev, dev->flags & IFF_PROMISC ? 1 : -1);
 }
 
-static void vlan_dev_set_multicast_list(struct net_device *vlan_dev)
+static void vlan_dev_set_rx_mode(struct net_device *vlan_dev)
 {
         dev_mc_sync(vlan_dev_info(vlan_dev)->real_dev, vlan_dev);
+        dev_unicast_sync(vlan_dev_info(vlan_dev)->real_dev, vlan_dev);
 }
 
 /*
@@ -702,7 +704,8 @@ void vlan_setup(struct net_device *dev)
         dev->open               = vlan_dev_open;
         dev->stop               = vlan_dev_stop;
         dev->set_mac_address    = vlan_dev_set_mac_address;
-        dev->set_multicast_list = vlan_dev_set_multicast_list;
+        dev->set_rx_mode        = vlan_dev_set_rx_mode;
+        dev->set_multicast_list = vlan_dev_set_rx_mode;
         dev->change_rx_flags    = vlan_dev_change_rx_flags;
         dev->do_ioctl           = vlan_dev_ioctl;
         dev->destructor         = free_netdev;
diff --git a/net/9p/conv.c b/net/9p/conv.c
index aa2aa9884f95..3fe35d532c87 100644
--- a/net/9p/conv.c
+++ b/net/9p/conv.c
@@ -128,11 +128,6 @@ static char *buf_put_stringn(struct cbuf *buf, const char *s, u16 slen)
         return ret;
 }
 
-static inline void buf_put_string(struct cbuf *buf, const char *s)
-{
-        buf_put_stringn(buf, s, strlen(s));
-}
-
 static u8 buf_get_int8(struct cbuf *buf)
 {
         u8 ret = 0;
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 1bc0e85f04a5..8fc64e3150a2 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1037,16 +1037,13 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         int err = 0;
 
         if (addr_len != sizeof(struct sockaddr_ax25) &&
-            addr_len != sizeof(struct full_sockaddr_ax25)) {
-                /* support for old structure may go away some time */
+            addr_len != sizeof(struct full_sockaddr_ax25))
+                /* support for old structure may go away some time
+                 * ax25_bind(): uses old (6 digipeater) socket structure.
+                 */
                 if ((addr_len < sizeof(struct sockaddr_ax25) + sizeof(ax25_address) * 6) ||
-                    (addr_len > sizeof(struct full_sockaddr_ax25))) {
+                    (addr_len > sizeof(struct full_sockaddr_ax25)))
                         return -EINVAL;
-        }
-
-                printk(KERN_WARNING "ax25_bind(): %s uses old (6 digipeater) socket structure.\n",
-                        current->comm);
-        }
 
         if (addr->fsa_ax25.sax25_family != AF_AX25)
                 return -EINVAL;
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 17f7fb720553..e13cf5ef144c 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -12,6 +12,8 @@
 #undef  BT_DBG
 #define BT_DBG(D...)
 #endif
+static struct workqueue_struct *btaddconn;
+static struct workqueue_struct *btdelconn;
 
 static inline char *typetostr(int type)
 {
@@ -279,6 +281,8 @@ static void add_conn(struct work_struct *work)
         struct hci_conn *conn = container_of(work, struct hci_conn, work);
         int i;
 
+        flush_workqueue(btdelconn);
+
         if (device_add(&conn->dev) < 0) {
                 BT_ERR("Failed to register connection device");
                 return;
@@ -313,7 +317,7 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 
         INIT_WORK(&conn->work, add_conn);
 
-        schedule_work(&conn->work);
+        queue_work(btaddconn, &conn->work);
 }
 
 static int __match_tty(struct device *dev, void *data)
@@ -349,7 +353,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn)
 
         INIT_WORK(&conn->work, del_conn);
 
-        schedule_work(&conn->work);
+        queue_work(btdelconn, &conn->work);
 }
 
 int hci_register_sysfs(struct hci_dev *hdev)
@@ -398,28 +402,54 @@ int __init bt_sysfs_init(void)
 {
         int err;
 
+        btaddconn = create_singlethread_workqueue("btaddconn");
+        if (!btaddconn) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        btdelconn = create_singlethread_workqueue("btdelconn");
+        if (!btdelconn) {
+                err = -ENOMEM;
+                goto out_del;
+        }
+
         bt_platform = platform_device_register_simple("bluetooth", -1, NULL, 0);
-        if (IS_ERR(bt_platform))
-                return PTR_ERR(bt_platform);
+        if (IS_ERR(bt_platform)) {
+                err = PTR_ERR(bt_platform);
+                goto out_platform;
+        }
 
         err = bus_register(&bt_bus);
-        if (err < 0) {
-                platform_device_unregister(bt_platform);
-                return err;
-        }
+        if (err < 0)
+                goto out_bus;
 
         bt_class = class_create(THIS_MODULE, "bluetooth");
         if (IS_ERR(bt_class)) {
-                bus_unregister(&bt_bus);
-                platform_device_unregister(bt_platform);
-                return PTR_ERR(bt_class);
+                err = PTR_ERR(bt_class);
+                goto out_class;
         }
 
         return 0;
+
+out_class:
+        bus_unregister(&bt_bus);
+out_bus:
+        platform_device_unregister(bt_platform);
+out_platform:
+        destroy_workqueue(btdelconn);
+out_del:
+        destroy_workqueue(btaddconn);
+out:
+        return err;
 }
 
 void bt_sysfs_cleanup(void)
 {
+        destroy_workqueue(btaddconn);
+
+        destroy_workqueue(btdelconn);
+
         class_destroy(bt_class);
 
         bus_unregister(&bt_bus);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 80014bab81b0..1c0efd8ad9f3 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -828,10 +828,6 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
         nf_bridge_pull_encap_header(skb);
         nf_bridge_save_header(skb);
 
-#if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
-        if (nf_bridge->netoutdev)
-                realoutdev = nf_bridge->netoutdev;
-#endif
         NF_HOOK(pf, NF_INET_POST_ROUTING, skb, NULL, realoutdev,
                 br_nf_dev_queue_xmit);
 
diff --git a/net/bridge/netfilter/ebt_802_3.c b/net/bridge/netfilter/ebt_802_3.c
index 41a78072cd0e..98534025360f 100644
--- a/net/bridge/netfilter/ebt_802_3.c
+++ b/net/bridge/netfilter/ebt_802_3.c
@@ -15,8 +15,8 @@
 static int ebt_filter_802_3(const struct sk_buff *skb, const struct net_device *in,
    const struct net_device *out, const void *data, unsigned int datalen)
 {
-        struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
-        struct ebt_802_3_hdr *hdr = ebt_802_3_hdr(skb);
+        const struct ebt_802_3_info *info = data;
+        const struct ebt_802_3_hdr *hdr = ebt_802_3_hdr(skb);
         __be16 type = hdr->llc.ui.ctrl & IS_UI ? hdr->llc.ui.type : hdr->llc.ni.type;
 
         if (info->bitmask & EBT_802_3_SAP) {
@@ -40,7 +40,7 @@ static struct ebt_match filter_802_3;
 static int ebt_802_3_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_802_3_info *info = (struct ebt_802_3_info *)data;
+        const struct ebt_802_3_info *info = data;
 
         if (datalen < sizeof(struct ebt_802_3_info))
                 return -EINVAL;
@@ -50,8 +50,7 @@ static int ebt_802_3_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_match filter_802_3 =
-{
+static struct ebt_match filter_802_3 __read_mostly = {
         .name           = EBT_802_3_MATCH,
         .match          = ebt_filter_802_3,
         .check          = ebt_802_3_check,
@@ -70,4 +69,5 @@ static void __exit ebt_802_3_fini(void)
 
 module_init(ebt_802_3_init);
 module_exit(ebt_802_3_fini);
+MODULE_DESCRIPTION("Ebtables: DSAP/SSAP field and SNAP type matching");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c
index 6436d30a550e..70b6dca5ea75 100644
--- a/net/bridge/netfilter/ebt_among.c
+++ b/net/bridge/netfilter/ebt_among.c
@@ -25,7 +25,7 @@ static int ebt_mac_wormhash_contains(const struct ebt_mac_wormhash *wh,
         const struct ebt_mac_wormhash_tuple *p;
         int start, limit, i;
         uint32_t cmp[2] = { 0, 0 };
-        int key = (const unsigned char) mac[5];
+        int key = ((const unsigned char *)mac)[5];
 
         memcpy(((char *) cmp) + 2, mac, 6);
         start = wh->table[key];
@@ -73,15 +73,18 @@ static int ebt_mac_wormhash_check_integrity(const struct ebt_mac_wormhash
 static int get_ip_dst(const struct sk_buff *skb, __be32 *addr)
 {
         if (eth_hdr(skb)->h_proto == htons(ETH_P_IP)) {
-                struct iphdr _iph, *ih;
+                const struct iphdr *ih;
+                struct iphdr _iph;
 
                 ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
                 if (ih == NULL)
                         return -1;
                 *addr = ih->daddr;
         } else if (eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) {
-                struct arphdr _arph, *ah;
-                __be32 buf, *bp;
+                const struct arphdr *ah;
+                struct arphdr _arph;
+                const __be32 *bp;
+                __be32 buf;
 
                 ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
                 if (ah == NULL ||
@@ -101,15 +104,18 @@ static int get_ip_dst(const struct sk_buff *skb, __be32 *addr)
 static int get_ip_src(const struct sk_buff *skb, __be32 *addr)
 {
         if (eth_hdr(skb)->h_proto == htons(ETH_P_IP)) {
-                struct iphdr _iph, *ih;
+                const struct iphdr *ih;
+                struct iphdr _iph;
 
                 ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
                 if (ih == NULL)
                         return -1;
                 *addr = ih->saddr;
         } else if (eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) {
-                struct arphdr _arph, *ah;
-                __be32 buf, *bp;
+                const struct arphdr *ah;
+                struct arphdr _arph;
+                const __be32 *bp;
+                __be32 buf;
 
                 ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
                 if (ah == NULL ||
@@ -130,7 +136,7 @@ static int ebt_filter_among(const struct sk_buff *skb,
                             const struct net_device *out, const void *data,
                             unsigned int datalen)
 {
-        struct ebt_among_info *info = (struct ebt_among_info *) data;
+        const struct ebt_among_info *info = data;
         const char *dmac, *smac;
         const struct ebt_mac_wormhash *wh_dst, *wh_src;
         __be32 dip = 0, sip = 0;
@@ -175,7 +181,7 @@ static int ebt_among_check(const char *tablename, unsigned int hookmask,
                            const struct ebt_entry *e, void *data,
                            unsigned int datalen)
 {
-        struct ebt_among_info *info = (struct ebt_among_info *) data;
+        const struct ebt_among_info *info = data;
         int expected_length = sizeof(struct ebt_among_info);
         const struct ebt_mac_wormhash *wh_dst, *wh_src;
         int err;
@@ -206,7 +212,7 @@ static int ebt_among_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_match filter_among = {
+static struct ebt_match filter_among __read_mostly = {
         .name           = EBT_AMONG_MATCH,
         .match          = ebt_filter_among,
         .check          = ebt_among_check,
@@ -225,4 +231,5 @@ static void __exit ebt_among_fini(void)
 
 module_init(ebt_among_init);
 module_exit(ebt_among_fini);
+MODULE_DESCRIPTION("Ebtables: Combined MAC/IP address list matching");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_arp.c b/net/bridge/netfilter/ebt_arp.c
index 18141392a9b4..7c535be75665 100644
--- a/net/bridge/netfilter/ebt_arp.c
+++ b/net/bridge/netfilter/ebt_arp.c
@@ -18,8 +18,9 @@
 static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in,
    const struct net_device *out, const void *data, unsigned int datalen)
 {
-        struct ebt_arp_info *info = (struct ebt_arp_info *)data;
-        struct arphdr _arph, *ah;
+        const struct ebt_arp_info *info = data;
+        const struct arphdr *ah;
+        struct arphdr _arph;
 
         ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
         if (ah == NULL)
@@ -35,7 +36,8 @@ static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in
                 return EBT_NOMATCH;
 
         if (info->bitmask & (EBT_ARP_SRC_IP | EBT_ARP_DST_IP | EBT_ARP_GRAT)) {
-                __be32 saddr, daddr, *sap, *dap;
+                const __be32 *sap, *dap;
+                __be32 saddr, daddr;
 
                 if (ah->ar_pln != sizeof(__be32) || ah->ar_pro != htons(ETH_P_IP))
                         return EBT_NOMATCH;
@@ -61,7 +63,8 @@ static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in
         }
 
         if (info->bitmask & (EBT_ARP_SRC_MAC | EBT_ARP_DST_MAC)) {
-                unsigned char _mac[ETH_ALEN], *mp;
+                const unsigned char *mp;
+                unsigned char _mac[ETH_ALEN];
                 uint8_t verdict, i;
 
                 if (ah->ar_hln != ETH_ALEN || ah->ar_hrd != htons(ARPHRD_ETHER))
@@ -100,7 +103,7 @@ static int ebt_filter_arp(const struct sk_buff *skb, const struct net_device *in
 static int ebt_arp_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_arp_info *info = (struct ebt_arp_info *)data;
+        const struct ebt_arp_info *info = data;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_arp_info)))
                 return -EINVAL;
@@ -113,8 +116,7 @@ static int ebt_arp_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_match filter_arp =
-{
+static struct ebt_match filter_arp __read_mostly = {
         .name           = EBT_ARP_MATCH,
         .match          = ebt_filter_arp,
         .check          = ebt_arp_check,
@@ -133,4 +135,5 @@ static void __exit ebt_arp_fini(void)
 
 module_init(ebt_arp_init);
 module_exit(ebt_arp_fini);
+MODULE_DESCRIPTION("Ebtables: ARP protocol packet match");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 48a80e423287..0c4279590fc7 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -19,10 +19,13 @@ static int ebt_target_reply(struct sk_buff *skb, unsigned int hooknr,
    const struct net_device *in, const struct net_device *out,
    const void *data, unsigned int datalen)
 {
-        struct ebt_arpreply_info *info = (struct ebt_arpreply_info *)data;
-        __be32 _sip, *siptr, _dip, *diptr;
-        struct arphdr _ah, *ap;
-        unsigned char _sha[ETH_ALEN], *shp;
+        struct ebt_arpreply_info *info = (void *)data;
+        const __be32 *siptr, *diptr;
+        __be32 _sip, _dip;
+        const struct arphdr *ap;
+        struct arphdr _ah;
+        const unsigned char *shp;
+        unsigned char _sha[ETH_ALEN];
 
         ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah);
         if (ap == NULL)
@@ -58,7 +61,7 @@ static int ebt_target_reply(struct sk_buff *skb, unsigned int hooknr,
 static int ebt_target_reply_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_arpreply_info *info = (struct ebt_arpreply_info *)data;
+        const struct ebt_arpreply_info *info = data;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_arpreply_info)))
                 return -EINVAL;
@@ -73,8 +76,7 @@ static int ebt_target_reply_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_target reply_target =
-{
+static struct ebt_target reply_target __read_mostly = {
         .name           = EBT_ARPREPLY_TARGET,
         .target         = ebt_target_reply,
         .check          = ebt_target_reply_check,
@@ -93,4 +95,5 @@ static void __exit ebt_arpreply_fini(void)
 
 module_init(ebt_arpreply_init);
 module_exit(ebt_arpreply_fini);
+MODULE_DESCRIPTION("Ebtables: ARP reply target");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index 74262e9a566a..e700cbf634c2 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -18,7 +18,7 @@ static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
    const struct net_device *in, const struct net_device *out,
    const void *data, unsigned int datalen)
 {
-        struct ebt_nat_info *info = (struct ebt_nat_info *)data;
+        const struct ebt_nat_info *info = data;
 
         if (skb_make_writable(skb, 0))
                 return NF_DROP;
@@ -30,7 +30,7 @@ static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
 static int ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_nat_info *info = (struct ebt_nat_info *)data;
+        const struct ebt_nat_info *info = data;
 
         if (BASE_CHAIN && info->target == EBT_RETURN)
                 return -EINVAL;
@@ -46,8 +46,7 @@ static int ebt_target_dnat_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_target dnat =
-{
+static struct ebt_target dnat __read_mostly = {
         .name           = EBT_DNAT_TARGET,
         .target         = ebt_target_dnat,
         .check          = ebt_target_dnat_check,
@@ -66,4 +65,5 @@ static void __exit ebt_dnat_fini(void)
 
 module_init(ebt_dnat_init);
 module_exit(ebt_dnat_fini);
+MODULE_DESCRIPTION("Ebtables: Destination MAC address translation");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
index 69f7f0ab9c76..65caa00dcf2a 100644
--- a/net/bridge/netfilter/ebt_ip.c
+++ b/net/bridge/netfilter/ebt_ip.c
@@ -28,9 +28,11 @@ static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
    const struct net_device *out, const void *data,
    unsigned int datalen)
 {
-        struct ebt_ip_info *info = (struct ebt_ip_info *)data;
-        struct iphdr _iph, *ih;
-        struct tcpudphdr _ports, *pptr;
+        const struct ebt_ip_info *info = data;
+        const struct iphdr *ih;
+        struct iphdr _iph;
+        const struct tcpudphdr *pptr;
+        struct tcpudphdr _ports;
 
         ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
         if (ih == NULL)
@@ -79,7 +81,7 @@ static int ebt_filter_ip(const struct sk_buff *skb, const struct net_device *in,
 static int ebt_ip_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_ip_info *info = (struct ebt_ip_info *)data;
+        const struct ebt_ip_info *info = data;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_ip_info)))
                 return -EINVAL;
@@ -105,8 +107,7 @@ static int ebt_ip_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_match filter_ip =
-{
+static struct ebt_match filter_ip __read_mostly = {
         .name           = EBT_IP_MATCH,
         .match          = ebt_filter_ip,
         .check          = ebt_ip_check,
@@ -125,4 +126,5 @@ static void __exit ebt_ip_fini(void)
 
 module_init(ebt_ip_init);
 module_exit(ebt_ip_fini);
+MODULE_DESCRIPTION("Ebtables: IPv4 protocol packet match");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_limit.c b/net/bridge/netfilter/ebt_limit.c
index d48fa5cb26cf..8cbdc01c253e 100644
--- a/net/bridge/netfilter/ebt_limit.c
+++ b/net/bridge/netfilter/ebt_limit.c
@@ -69,7 +69,7 @@ user2credits(u_int32_t user)
 static int ebt_limit_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_limit_info *info = (struct ebt_limit_info *)data;
+        struct ebt_limit_info *info = data;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_limit_info)))
                 return -EINVAL;
@@ -90,8 +90,7 @@ static int ebt_limit_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_match ebt_limit_reg =
-{
+static struct ebt_match ebt_limit_reg __read_mostly = {
         .name           = EBT_LIMIT_MATCH,
         .match          = ebt_limit_match,
         .check          = ebt_limit_check,
@@ -110,4 +109,5 @@ static void __exit ebt_limit_fini(void)
 
 module_init(ebt_limit_init);
 module_exit(ebt_limit_fini);
+MODULE_DESCRIPTION("Ebtables: Rate-limit match");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_log.c b/net/bridge/netfilter/ebt_log.c
index 3be9e9898553..0b209e4aad0a 100644
--- a/net/bridge/netfilter/ebt_log.c
+++ b/net/bridge/netfilter/ebt_log.c
@@ -24,7 +24,7 @@ static DEFINE_SPINLOCK(ebt_log_lock);
 static int ebt_log_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_log_info *info = (struct ebt_log_info *)data;
+        struct ebt_log_info *info = data;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_log_info)))
                 return -EINVAL;
@@ -50,7 +50,7 @@ struct arppayload
         unsigned char ip_dst[4];
 };
 
-static void print_MAC(unsigned char *p)
+static void print_MAC(const unsigned char *p)
 {
         int i;
 
@@ -84,7 +84,8 @@ ebt_log_packet(unsigned int pf, unsigned int hooknum,
 
         if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto ==
            htons(ETH_P_IP)){
-                struct iphdr _iph, *ih;
+                const struct iphdr *ih;
+                struct iphdr _iph;
 
                 ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
                 if (ih == NULL) {
@@ -99,7 +100,8 @@ ebt_log_packet(unsigned int pf, unsigned int hooknum,
                     ih->protocol == IPPROTO_UDPLITE ||
                     ih->protocol == IPPROTO_SCTP ||
                     ih->protocol == IPPROTO_DCCP) {
-                        struct tcpudphdr _ports, *pptr;
+                        const struct tcpudphdr *pptr;
+                        struct tcpudphdr _ports;
 
                         pptr = skb_header_pointer(skb, ih->ihl*4,
                                                   sizeof(_ports), &_ports);
@@ -116,7 +118,8 @@ ebt_log_packet(unsigned int pf, unsigned int hooknum,
         if ((bitmask & EBT_LOG_ARP) &&
             ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) ||
              (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) {
-                struct arphdr _arph, *ah;
+                const struct arphdr *ah;
+                struct arphdr _arph;
 
                 ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
                 if (ah == NULL) {
@@ -132,7 +135,8 @@ ebt_log_packet(unsigned int pf, unsigned int hooknum,
                 if (ah->ar_hrd == htons(1) &&
                     ah->ar_hln == ETH_ALEN &&
                     ah->ar_pln == sizeof(__be32)) {
-                        struct arppayload _arpp, *ap;
+                        const struct arppayload *ap;
+                        struct arppayload _arpp;
 
                         ap = skb_header_pointer(skb, sizeof(_arph),
                                                 sizeof(_arpp), &_arpp);
@@ -160,7 +164,7 @@ static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
    const struct net_device *in, const struct net_device *out,
    const void *data, unsigned int datalen)
 {
-        struct ebt_log_info *info = (struct ebt_log_info *)data;
+        const struct ebt_log_info *info = data;
         struct nf_loginfo li;
 
         li.type = NF_LOG_TYPE_LOG;
@@ -208,4 +212,5 @@ static void __exit ebt_log_fini(void)
 
 module_init(ebt_log_init);
 module_exit(ebt_log_fini);
+MODULE_DESCRIPTION("Ebtables: Packet logging to syslog");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_mark.c b/net/bridge/netfilter/ebt_mark.c
index 6cba54309c09..36723f47db0a 100644
--- a/net/bridge/netfilter/ebt_mark.c
+++ b/net/bridge/netfilter/ebt_mark.c
@@ -21,7 +21,7 @@ static int ebt_target_mark(struct sk_buff *skb, unsigned int hooknr,
    const struct net_device *in, const struct net_device *out,
    const void *data, unsigned int datalen)
 {
-        struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
+        const struct ebt_mark_t_info *info = data;
         int action = info->target & -16;
 
         if (action == MARK_SET_VALUE)
@@ -39,7 +39,7 @@ static int ebt_target_mark(struct sk_buff *skb, unsigned int hooknr,
 static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_mark_t_info *info = (struct ebt_mark_t_info *)data;
+        const struct ebt_mark_t_info *info = data;
         int tmp;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_t_info)))
@@ -57,8 +57,7 @@ static int ebt_target_mark_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_target mark_target =
-{
+static struct ebt_target mark_target __read_mostly = {
         .name           = EBT_MARK_TARGET,
         .target         = ebt_target_mark,
         .check          = ebt_target_mark_check,
@@ -77,4 +76,5 @@ static void __exit ebt_mark_fini(void)
 
 module_init(ebt_mark_init);
 module_exit(ebt_mark_fini);
+MODULE_DESCRIPTION("Ebtables: Packet mark modification");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_mark_m.c b/net/bridge/netfilter/ebt_mark_m.c
index 6b0d2169af74..9b0a4543861f 100644
--- a/net/bridge/netfilter/ebt_mark_m.c
+++ b/net/bridge/netfilter/ebt_mark_m.c
@@ -16,7 +16,7 @@ static int ebt_filter_mark(const struct sk_buff *skb,
    const struct net_device *in, const struct net_device *out, const void *data,
    unsigned int datalen)
 {
-        struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
+        const struct ebt_mark_m_info *info = data;
 
         if (info->bitmask & EBT_MARK_OR)
                 return !(!!(skb->mark & info->mask) ^ info->invert);
@@ -26,7 +26,7 @@ static int ebt_filter_mark(const struct sk_buff *skb,
 static int ebt_mark_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_mark_m_info *info = (struct ebt_mark_m_info *) data;
+        const struct ebt_mark_m_info *info = data;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_mark_m_info)))
                 return -EINVAL;
@@ -39,8 +39,7 @@ static int ebt_mark_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_match filter_mark =
-{
+static struct ebt_match filter_mark __read_mostly = {
         .name           = EBT_MARK_MATCH,
         .match          = ebt_filter_mark,
         .check          = ebt_mark_check,
@@ -59,4 +58,5 @@ static void __exit ebt_mark_m_fini(void)
 
 module_init(ebt_mark_m_init);
 module_exit(ebt_mark_m_fini);
+MODULE_DESCRIPTION("Ebtables: Packet mark match");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_pkttype.c b/net/bridge/netfilter/ebt_pkttype.c
index 4fffd70e4da7..676db32df3d1 100644
--- a/net/bridge/netfilter/ebt_pkttype.c
+++ b/net/bridge/netfilter/ebt_pkttype.c
@@ -18,7 +18,7 @@ static int ebt_filter_pkttype(const struct sk_buff *skb,
    const void *data,
    unsigned int datalen)
 {
-        struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
+        const struct ebt_pkttype_info *info = data;
 
         return (skb->pkt_type != info->pkt_type) ^ info->invert;
 }
@@ -26,7 +26,7 @@ static int ebt_filter_pkttype(const struct sk_buff *skb,
 static int ebt_pkttype_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_pkttype_info *info = (struct ebt_pkttype_info *)data;
+        const struct ebt_pkttype_info *info = data;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_pkttype_info)))
                 return -EINVAL;
@@ -36,8 +36,7 @@ static int ebt_pkttype_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_match filter_pkttype =
-{
+static struct ebt_match filter_pkttype __read_mostly = {
         .name           = EBT_PKTTYPE_MATCH,
         .match          = ebt_filter_pkttype,
         .check          = ebt_pkttype_check,
@@ -56,4 +55,5 @@ static void __exit ebt_pkttype_fini(void)
 
 module_init(ebt_pkttype_init);
 module_exit(ebt_pkttype_fini);
+MODULE_DESCRIPTION("Ebtables: Link layer packet type match");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index 422cb834cff9..bfdf2fb60b1f 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -19,7 +19,7 @@ static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
    const struct net_device *in, const struct net_device *out,
    const void *data, unsigned int datalen)
 {
-        struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
+        const struct ebt_redirect_info *info = data;
 
         if (skb_make_writable(skb, 0))
                 return NF_DROP;
@@ -36,7 +36,7 @@ static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
 static int ebt_target_redirect_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_redirect_info *info = (struct ebt_redirect_info *)data;
+        const struct ebt_redirect_info *info = data;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_redirect_info)))
                 return -EINVAL;
@@ -51,8 +51,7 @@ static int ebt_target_redirect_check(const char *tablename, unsigned int hookmas
         return 0;
 }
 
-static struct ebt_target redirect_target =
-{
+static struct ebt_target redirect_target __read_mostly = {
         .name           = EBT_REDIRECT_TARGET,
         .target         = ebt_target_redirect,
         .check          = ebt_target_redirect_check,
@@ -71,4 +70,5 @@ static void __exit ebt_redirect_fini(void)
 
 module_init(ebt_redirect_init);
 module_exit(ebt_redirect_fini);
+MODULE_DESCRIPTION("Ebtables: Packet redirection to localhost");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index 425ac920904d..e252dabbb143 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -20,7 +20,7 @@ static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
    const struct net_device *in, const struct net_device *out,
    const void *data, unsigned int datalen)
 {
-        struct ebt_nat_info *info = (struct ebt_nat_info *) data;
+        const struct ebt_nat_info *info = data;
 
         if (skb_make_writable(skb, 0))
                 return NF_DROP;
@@ -28,7 +28,8 @@ static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
         memcpy(eth_hdr(skb)->h_source, info->mac, ETH_ALEN);
         if (!(info->target & NAT_ARP_BIT) &&
             eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) {
-                struct arphdr _ah, *ap;
+                const struct arphdr *ap;
+                struct arphdr _ah;
 
                 ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah);
                 if (ap == NULL)
@@ -45,7 +46,7 @@ out:
 static int ebt_target_snat_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_nat_info *info = (struct ebt_nat_info *) data;
+        const struct ebt_nat_info *info = data;
         int tmp;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_nat_info)))
@@ -67,8 +68,7 @@ static int ebt_target_snat_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_target snat =
-{
+static struct ebt_target snat __read_mostly = {
         .name           = EBT_SNAT_TARGET,
         .target         = ebt_target_snat,
         .check          = ebt_target_snat_check,
@@ -87,4 +87,5 @@ static void __exit ebt_snat_fini(void)
 
 module_init(ebt_snat_init);
 module_exit(ebt_snat_fini);
+MODULE_DESCRIPTION("Ebtables: Source MAC address translation");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
index 31b77367319c..40f36d37607d 100644
--- a/net/bridge/netfilter/ebt_stp.c
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -40,10 +40,10 @@ struct stp_config_pdu {
 #define NR16(p) (p[0] << 8 | p[1])
 #define NR32(p) ((p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3])
 
-static int ebt_filter_config(struct ebt_stp_info *info,
-   struct stp_config_pdu *stpc)
+static int ebt_filter_config(const struct ebt_stp_info *info,
+   const struct stp_config_pdu *stpc)
 {
-        struct ebt_stp_config_info *c;
+        const struct ebt_stp_config_info *c;
         uint16_t v16;
         uint32_t v32;
         int verdict, i;
@@ -122,9 +122,10 @@ static int ebt_filter_config(struct ebt_stp_info *info,
 static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in,
    const struct net_device *out, const void *data, unsigned int datalen)
 {
-        struct ebt_stp_info *info = (struct ebt_stp_info *)data;
-        struct stp_header _stph, *sp;
-        uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
+        const struct ebt_stp_info *info = data;
+        const struct stp_header *sp;
+        struct stp_header _stph;
+        const uint8_t header[6] = {0x42, 0x42, 0x03, 0x00, 0x00, 0x00};
 
         sp = skb_header_pointer(skb, 0, sizeof(_stph), &_stph);
         if (sp == NULL)
@@ -140,7 +141,8 @@ static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in
 
         if (sp->type == BPDU_TYPE_CONFIG &&
             info->bitmask & EBT_STP_CONFIG_MASK) {
-                struct stp_config_pdu _stpc, *st;
+                const struct stp_config_pdu *st;
+                struct stp_config_pdu _stpc;
 
                 st = skb_header_pointer(skb, sizeof(_stph),
                                         sizeof(_stpc), &_stpc);
@@ -154,10 +156,10 @@ static int ebt_filter_stp(const struct sk_buff *skb, const struct net_device *in
 static int ebt_stp_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_stp_info *info = (struct ebt_stp_info *)data;
-        int len = EBT_ALIGN(sizeof(struct ebt_stp_info));
-        uint8_t bridge_ula[6] = { 0x01, 0x80, 0xc2, 0x00, 0x00, 0x00 };
-        uint8_t msk[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+        const struct ebt_stp_info *info = data;
+        const unsigned int len = EBT_ALIGN(sizeof(struct ebt_stp_info));
+        const uint8_t bridge_ula[6] = {0x01, 0x80, 0xc2, 0x00, 0x00, 0x00};
+        const uint8_t msk[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 
         if (info->bitmask & ~EBT_STP_MASK || info->invflags & ~EBT_STP_MASK ||
             !(info->bitmask & EBT_STP_MASK))
@@ -172,8 +174,7 @@ static int ebt_stp_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_match filter_stp =
-{
+static struct ebt_match filter_stp __read_mostly = {
         .name           = EBT_STP_MATCH,
         .match          = ebt_filter_stp,
         .check          = ebt_stp_check,
@@ -192,4 +193,5 @@ static void __exit ebt_stp_fini(void)
 
 module_init(ebt_stp_init);
 module_exit(ebt_stp_fini);
+MODULE_DESCRIPTION("Ebtables: Spanning Tree Protocol packet match");
 MODULE_LICENSE("GPL");
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index 8e7b00b68d38..2d4c9ef909fc 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -249,7 +249,7 @@ static void ebt_ulog(const struct sk_buff *skb, unsigned int hooknr,
    const struct net_device *in, const struct net_device *out,
    const void *data, unsigned int datalen)
 {
-        struct ebt_ulog_info *uloginfo = (struct ebt_ulog_info *)data;
+        const struct ebt_ulog_info *uloginfo = data;
 
         ebt_ulog_packet(hooknr, skb, in, out, uloginfo, NULL);
 }
@@ -258,7 +258,7 @@ static void ebt_ulog(const struct sk_buff *skb, unsigned int hooknr,
 static int ebt_ulog_check(const char *tablename, unsigned int hookmask,
    const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_ulog_info *uloginfo = (struct ebt_ulog_info *)data;
+        struct ebt_ulog_info *uloginfo = data;
 
         if (datalen != EBT_ALIGN(sizeof(struct ebt_ulog_info)) ||
             uloginfo->nlgroup > 31)
@@ -272,7 +272,7 @@ static int ebt_ulog_check(const char *tablename, unsigned int hookmask,
         return 0;
 }
 
-static struct ebt_watcher ulog = {
+static struct ebt_watcher ulog __read_mostly = {
         .name           = EBT_ULOG_WATCHER,
         .watcher        = ebt_ulog,
         .check          = ebt_ulog_check,
@@ -340,5 +340,4 @@ module_init(ebt_ulog_init);
 module_exit(ebt_ulog_fini);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Bart De Schuymer <bdschuym@pandora.be>");
-MODULE_DESCRIPTION("ebtables userspace logging module for bridged Ethernet"
-                   " frames");
+MODULE_DESCRIPTION("Ebtables: Packet logging to netlink using ULOG");
diff --git a/net/bridge/netfilter/ebt_vlan.c b/net/bridge/netfilter/ebt_vlan.c
index 0ddf7499d496..ab60b0dade80 100644
--- a/net/bridge/netfilter/ebt_vlan.c
+++ b/net/bridge/netfilter/ebt_vlan.c
@@ -31,8 +31,7 @@ static int debug;
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "debug=1 is turn on debug messages");
 MODULE_AUTHOR("Nick Fedchik <nick@fedchik.org.ua>");
-MODULE_DESCRIPTION("802.1Q match module (ebtables extension), v"
-                   MODULE_VERS);
+MODULE_DESCRIPTION("Ebtables: 802.1Q VLAN tag match");
 MODULE_LICENSE("GPL");
 
 
@@ -46,8 +45,9 @@ ebt_filter_vlan(const struct sk_buff *skb,
                 const struct net_device *out,
                 const void *data, unsigned int datalen)
 {
-        struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;
-        struct vlan_hdr _frame, *fp;
+        const struct ebt_vlan_info *info = data;
+        const struct vlan_hdr *fp;
+        struct vlan_hdr _frame;
 
         unsigned short TCI;     /* Whole TCI, given from parsed frame */
         unsigned short id;      /* VLAN ID, given from frame TCI */
@@ -91,7 +91,7 @@ ebt_check_vlan(const char *tablename,
                unsigned int hooknr,
                const struct ebt_entry *e, void *data, unsigned int datalen)
 {
-        struct ebt_vlan_info *info = (struct ebt_vlan_info *) data;
+        struct ebt_vlan_info *info = data;
 
         /* Parameters buffer overflow check */
         if (datalen != EBT_ALIGN(sizeof(struct ebt_vlan_info))) {
@@ -169,7 +169,7 @@ ebt_check_vlan(const char *tablename,
         return 0;
 }
 
-static struct ebt_match filter_vlan = {
+static struct ebt_match filter_vlan __read_mostly = {
         .name           = EBT_VLAN_MATCH,
         .match          = ebt_filter_vlan,
         .check          = ebt_check_vlan,
diff --git a/net/core/dev.c b/net/core/dev.c
index c9c593e1ba6f..edaff2720e10 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2962,6 +2962,102 @@ int dev_unicast_add(struct net_device *dev, void *addr, int alen)
 }
 EXPORT_SYMBOL(dev_unicast_add);
 
+int __dev_addr_sync(struct dev_addr_list **to, int *to_count,
+                    struct dev_addr_list **from, int *from_count)
+{
+        struct dev_addr_list *da, *next;
+        int err = 0;
+
+        da = *from;
+        while (da != NULL) {
+                next = da->next;
+                if (!da->da_synced) {
+                        err = __dev_addr_add(to, to_count,
+                                             da->da_addr, da->da_addrlen, 0);
+                        if (err < 0)
+                                break;
+                        da->da_synced = 1;
+                        da->da_users++;
+                } else if (da->da_users == 1) {
+                        __dev_addr_delete(to, to_count,
+                                          da->da_addr, da->da_addrlen, 0);
+                        __dev_addr_delete(from, from_count,
+                                          da->da_addr, da->da_addrlen, 0);
+                }
+                da = next;
+        }
+        return err;
+}
+
+void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
+                       struct dev_addr_list **from, int *from_count)
+{
+        struct dev_addr_list *da, *next;
+
+        da = *from;
+        while (da != NULL) {
+                next = da->next;
+                if (da->da_synced) {
+                        __dev_addr_delete(to, to_count,
+                                          da->da_addr, da->da_addrlen, 0);
+                        da->da_synced = 0;
+                        __dev_addr_delete(from, from_count,
+                                          da->da_addr, da->da_addrlen, 0);
+                }
+                da = next;
+        }
+}
+
+/**
+ *      dev_unicast_sync - Synchronize device's unicast list to another device
+ *      @to: destination device
+ *      @from: source device
+ *
+ *      Add newly added addresses to the destination device and release
+ *      addresses that have no users left. The source device must be
+ *      locked by netif_tx_lock_bh.
+ *
+ *      This function is intended to be called from the dev->set_rx_mode
+ *      function of layered software devices.
+ */
+int dev_unicast_sync(struct net_device *to, struct net_device *from)
+{
+        int err = 0;
+
+        netif_tx_lock_bh(to);
+        err = __dev_addr_sync(&to->uc_list, &to->uc_count,
+                              &from->uc_list, &from->uc_count);
+        if (!err)
+                __dev_set_rx_mode(to);
+        netif_tx_unlock_bh(to);
+        return err;
+}
+EXPORT_SYMBOL(dev_unicast_sync);
+
+/**
+ *      dev_unicast_unsync - Remove synchronized addresses from the destination
+ *                           device
+ *      @to: destination device
+ *      @from: source device
+ *
+ *      Remove all addresses that were added to the destination device by
+ *      dev_unicast_sync(). This function is intended to be called from the
+ *      dev->stop function of layered software devices.
+ */
+void dev_unicast_unsync(struct net_device *to, struct net_device *from)
+{
+        netif_tx_lock_bh(from);
+        netif_tx_lock_bh(to);
+
+        __dev_addr_unsync(&to->uc_list, &to->uc_count,
+                          &from->uc_list, &from->uc_count);
+        __dev_set_rx_mode(to);
+
+        netif_tx_unlock_bh(to);
+        netif_tx_unlock_bh(from);
+}
+EXPORT_SYMBOL(dev_unicast_unsync);
+
 static void __dev_addr_discard(struct dev_addr_list **list)
 {
         struct dev_addr_list *tmp;
diff --git a/net/core/dev_mcast.c b/net/core/dev_mcast.c
index cadbfbf7e7f5..cec582563e0d 100644
--- a/net/core/dev_mcast.c
+++ b/net/core/dev_mcast.c
@@ -113,32 +113,15 @@ int dev_mc_add(struct net_device *dev, void *addr, int alen, int glbl)
  *      locked by netif_tx_lock_bh.
  *
  *      This function is intended to be called from the dev->set_multicast_list
- *      function of layered software devices.
+ *      or dev->set_rx_mode function of layered software devices.
  */
 int dev_mc_sync(struct net_device *to, struct net_device *from)
 {
-        struct dev_addr_list *da, *next;
         int err = 0;
 
         netif_tx_lock_bh(to);
-        da = from->mc_list;
-        while (da != NULL) {
-                next = da->next;
-                if (!da->da_synced) {
-                        err = __dev_addr_add(&to->mc_list, &to->mc_count,
-                                             da->da_addr, da->da_addrlen, 0);
-                        if (err < 0)
-                                break;
-                        da->da_synced = 1;
-                        da->da_users++;
-                } else if (da->da_users == 1) {
-                        __dev_addr_delete(&to->mc_list, &to->mc_count,
-                                          da->da_addr, da->da_addrlen, 0);
-                        __dev_addr_delete(&from->mc_list, &from->mc_count,
-                                          da->da_addr, da->da_addrlen, 0);
-                }
-                da = next;
-        }
+        err = __dev_addr_sync(&to->mc_list, &to->mc_count,
+                              &from->mc_list, &from->mc_count);
         if (!err)
                 __dev_set_rx_mode(to);
         netif_tx_unlock_bh(to);
@@ -160,23 +143,11 @@ EXPORT_SYMBOL(dev_mc_sync);
  */
 void dev_mc_unsync(struct net_device *to, struct net_device *from)
 {
-        struct dev_addr_list *da, *next;
-
         netif_tx_lock_bh(from);
         netif_tx_lock_bh(to);
 
-        da = from->mc_list;
-        while (da != NULL) {
-                next = da->next;
-                if (da->da_synced) {
-                        __dev_addr_delete(&to->mc_list, &to->mc_count,
-                                          da->da_addr, da->da_addrlen, 0);
-                        da->da_synced = 0;
-                        __dev_addr_delete(&from->mc_list, &from->mc_count,
-                                          da->da_addr, da->da_addrlen, 0);
-                }
-                da = next;
-        }
+        __dev_addr_unsync(&to->mc_list, &to->mc_count,
+                          &from->mc_list, &from->mc_count);
         __dev_set_rx_mode(to);
 
         netif_tx_unlock_bh(to);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index eebccdbdbaca..bfcdfaebca5c 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -170,8 +170,6 @@
 
 #define VERSION  "pktgen v2.69: Packet Generator for packet performance testing.\n"
 
-/* The buckets are exponential in 'width' */
-#define LAT_BUCKETS_MAX 32
 #define IP_NAME_SZ 32
 #define MAX_MPLS_LABELS 16 /* This is the max label stack depth */
 #define MPLS_STACK_BOTTOM htonl(0x00000100)
@@ -2044,7 +2042,6 @@ static void spin(struct pktgen_dev *pkt_dev, __u64 spin_until_us)
         __u64 now;
 
         start = now = getCurUs();
-        printk(KERN_INFO "sleeping for %d\n", (int)(spin_until_us - now));
         while (now < spin_until_us) {
                 /* TODO: optimize sleeping behavior */
                 if (spin_until_us - now > jiffies_to_usecs(1) + 1)
diff --git a/net/core/sock.c b/net/core/sock.c
index 1c4b1cd16d65..433715fb141a 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -667,6 +667,13 @@ set_rcvbuf:
                 else
                         clear_bit(SOCK_PASSSEC, &sock->flags);
                 break;
+        case SO_MARK:
+                if (!capable(CAP_NET_ADMIN))
+                        ret = -EPERM;
+                else {
+                        sk->sk_mark = val;
+                }
+                break;
 
                 /* We implement the SO_SNDLOWAT etc to
                    not be settable (1003.1g 5.3) */
@@ -836,6 +843,10 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
         case SO_PEERSEC:
                 return security_socket_getpeersec_stream(sock, optval, optlen, len);
 
+        case SO_MARK:
+                v.val = sk->sk_mark;
+                break;
+
         default:
                 return -ENOPROTOOPT;
         }
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 9e38b0d6195c..c982ad88223d 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -218,7 +218,7 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info)
                 return;
         }
 
-        sk = inet_lookup(&dccp_hashinfo, iph->daddr, dh->dccph_dport,
+        sk = inet_lookup(&init_net, &dccp_hashinfo, iph->daddr, dh->dccph_dport,
                          iph->saddr, dh->dccph_sport, inet_iif(skb));
         if (sk == NULL) {
                 ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
@@ -436,7 +436,7 @@ static struct sock *dccp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
         if (req != NULL)
                 return dccp_check_req(sk, skb, req, prev);
 
-        nsk = inet_lookup_established(&dccp_hashinfo,
+        nsk = inet_lookup_established(&init_net, &dccp_hashinfo,
                                       iph->saddr, dh->dccph_sport,
                                       iph->daddr, dh->dccph_dport,
                                       inet_iif(skb));
@@ -817,7 +817,7 @@ static int dccp_v4_rcv(struct sk_buff *skb)
 
         /* Step 2:
          *      Look up flow ID in table and get corresponding socket */
-        sk = __inet_lookup(&dccp_hashinfo,
+        sk = __inet_lookup(&init_net, &dccp_hashinfo,
                            iph->saddr, dh->dccph_sport,
                            iph->daddr, dh->dccph_dport, inet_iif(skb));
         /*
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index f42b75ce7f5c..ed0a0053a797 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -101,8 +101,8 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         int err;
         __u64 seq;
 
-        sk = inet6_lookup(&dccp_hashinfo, &hdr->daddr, dh->dccph_dport,
-                          &hdr->saddr, dh->dccph_sport, inet6_iif(skb));
+        sk = inet6_lookup(&init_net, &dccp_hashinfo, &hdr->daddr, dh->dccph_dport,
+                        &hdr->saddr, dh->dccph_sport, inet6_iif(skb));
 
         if (sk == NULL) {
                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
@@ -366,7 +366,7 @@ static struct sock *dccp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
         if (req != NULL)
                 return dccp_check_req(sk, skb, req, prev);
 
-        nsk = __inet6_lookup_established(&dccp_hashinfo,
+        nsk = __inet6_lookup_established(&init_net, &dccp_hashinfo,
                                          &iph->saddr, dh->dccph_sport,
                                          &iph->daddr, ntohs(dh->dccph_dport),
                                          inet6_iif(skb));
@@ -797,7 +797,7 @@ static int dccp_v6_rcv(struct sk_buff *skb)
 
         /* Step 2:
          *      Look up flow ID in table and get corresponding socket */
-        sk = __inet6_lookup(&dccp_hashinfo, &ipv6_hdr(skb)->saddr,
+        sk = __inet6_lookup(&init_net, &dccp_hashinfo, &ipv6_hdr(skb)->saddr,
                             dh->dccph_sport,
                             &ipv6_hdr(skb)->daddr, ntohs(dh->dccph_dport),
                             inet6_iif(skb));
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 24e2b7294bf8..19880b086e71 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -343,6 +343,7 @@ config INET_ESP
         tristate "IP: ESP transformation"
         select XFRM
         select CRYPTO
+        select CRYPTO_AEAD
         select CRYPTO_HMAC
         select CRYPTO_MD5
         select CRYPTO_CBC
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index d76803a3dcae..9d4555ec0b59 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -300,7 +300,7 @@ static void ah_destroy(struct xfrm_state *x)
 }
 
 
-static struct xfrm_type ah_type =
+static const struct xfrm_type ah_type =
 {
         .description    = "AH4",
         .owner          = THIS_MODULE,
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 5976c598cc4b..8e17f65f4002 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -558,8 +558,9 @@ static inline int arp_fwd_proxy(struct in_device *in_dev, struct rtable *rt)
  */
 struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
                            struct net_device *dev, __be32 src_ip,
-                           unsigned char *dest_hw, unsigned char *src_hw,
-                           unsigned char *target_hw)
+                           const unsigned char *dest_hw,
+                           const unsigned char *src_hw,
+                           const unsigned char *target_hw)
 {
         struct sk_buff *skb;
         struct arphdr *arp;
@@ -672,8 +673,8 @@ void arp_xmit(struct sk_buff *skb)
  */
 void arp_send(int type, int ptype, __be32 dest_ip,
               struct net_device *dev, __be32 src_ip,
-              unsigned char *dest_hw, unsigned char *src_hw,
-              unsigned char *target_hw)
+              const unsigned char *dest_hw, const unsigned char *src_hw,
+              const unsigned char *target_hw)
 {
         struct sk_buff *skb;
 
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 21f71bf912d5..f282b26f63eb 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -64,7 +64,7 @@
 #include <net/rtnetlink.h>
 #include <net/net_namespace.h>
 
-struct ipv4_devconf ipv4_devconf = {
+static struct ipv4_devconf ipv4_devconf = {
         .data = {
                 [NET_IPV4_CONF_ACCEPT_REDIRECTS - 1] = 1,
                 [NET_IPV4_CONF_SEND_REDIRECTS - 1] = 1,
@@ -485,46 +485,41 @@ errout:
         return err;
 }
 
-static struct in_ifaddr *rtm_to_ifaddr(struct nlmsghdr *nlh)
+static struct in_ifaddr *rtm_to_ifaddr(struct net *net, struct nlmsghdr *nlh)
 {
         struct nlattr *tb[IFA_MAX+1];
         struct in_ifaddr *ifa;
         struct ifaddrmsg *ifm;
         struct net_device *dev;
         struct in_device *in_dev;
-        int err = -EINVAL;
+        int err;
 
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv4_policy);
         if (err < 0)
                 goto errout;
 
         ifm = nlmsg_data(nlh);
-        if (ifm->ifa_prefixlen > 32 || tb[IFA_LOCAL] == NULL) {
-                err = -EINVAL;
+        err = -EINVAL;
+        if (ifm->ifa_prefixlen > 32 || tb[IFA_LOCAL] == NULL)
                 goto errout;
-        }
 
-        dev = __dev_get_by_index(&init_net, ifm->ifa_index);
-        if (dev == NULL) {
-                err = -ENODEV;
+        dev = __dev_get_by_index(net, ifm->ifa_index);
+        err = -ENODEV;
+        if (dev == NULL)
                 goto errout;
-        }
 
         in_dev = __in_dev_get_rtnl(dev);
-        if (in_dev == NULL) {
-                err = -ENOBUFS;
+        err = -ENOBUFS;
+        if (in_dev == NULL)
                 goto errout;
-        }
 
         ifa = inet_alloc_ifa();
-        if (ifa == NULL) {
+        if (ifa == NULL)
                 /*
                  * A potential indev allocation can be left alive, it stays
                  * assigned to its device and is destroy with it.
                  */
-                err = -ENOBUFS;
                 goto errout;
-        }
 
         ipv4_devconf_setall(in_dev);
         in_dev_hold(in_dev);
@@ -568,7 +563,7 @@ static int inet_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg
         if (net != &init_net)
                 return -EINVAL;
 
-        ifa = rtm_to_ifaddr(nlh);
+        ifa = rtm_to_ifaddr(net, nlh);
         if (IS_ERR(ifa))
                 return PTR_ERR(ifa);
 
@@ -1182,7 +1177,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
 
         s_ip_idx = ip_idx = cb->args[1];
         idx = 0;
-        for_each_netdev(&init_net, dev) {
+        for_each_netdev(net, dev) {
                 if (idx < s_idx)
                         goto cont;
                 if (idx > s_idx)
@@ -1216,7 +1211,9 @@ static void rtmsg_ifa(int event, struct in_ifaddr* ifa, struct nlmsghdr *nlh,
         struct sk_buff *skb;
         u32 seq = nlh ? nlh->nlmsg_seq : 0;
         int err = -ENOBUFS;
+        struct net *net;
 
+        net = ifa->ifa_dev->dev->nd_net;
         skb = nlmsg_new(inet_nlmsg_size(), GFP_KERNEL);
         if (skb == NULL)
                 goto errout;
@@ -1228,10 +1225,10 @@ static void rtmsg_ifa(int event, struct in_ifaddr* ifa, struct nlmsghdr *nlh,
                 kfree_skb(skb);
                 goto errout;
         }
-        err = rtnl_notify(skb, &init_net, pid, RTNLGRP_IPV4_IFADDR, nlh, GFP_KERNEL);
+        err = rtnl_notify(skb, net, pid, RTNLGRP_IPV4_IFADDR, nlh, GFP_KERNEL);
 errout:
         if (err < 0)
-                rtnl_set_sk_err(&init_net, RTNLGRP_IPV4_IFADDR, err);
+                rtnl_set_sk_err(net, RTNLGRP_IPV4_IFADDR, err);
 }
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 28ea5c77ca23..258d17631b4b 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -1,27 +1,118 @@
+#include <crypto/aead.h>
+#include <crypto/authenc.h>
 #include <linux/err.h>
 #include <linux/module.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/esp.h>
 #include <linux/scatterlist.h>
-#include <linux/crypto.h>
 #include <linux/kernel.h>
 #include <linux/pfkeyv2.h>
-#include <linux/random.h>
+#include <linux/rtnetlink.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/in6.h>
 #include <net/icmp.h>
 #include <net/protocol.h>
 #include <net/udp.h>
 
+struct esp_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+
+#define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0]))
+
+/*
+ * Allocate an AEAD request structure with extra space for SG and IV.
+ *
+ * For alignment considerations the IV is placed at the front, followed
+ * by the request and finally the SG list.
+ *
+ * TODO: Use spare space in skb for this where possible.
+ */
+static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags)
+{
+        unsigned int len;
+
+        len = crypto_aead_ivsize(aead);
+        if (len) {
+                len += crypto_aead_alignmask(aead) &
+                       ~(crypto_tfm_ctx_alignment() - 1);
+                len = ALIGN(len, crypto_tfm_ctx_alignment());
+        }
+
+        len += sizeof(struct aead_givcrypt_request) + crypto_aead_reqsize(aead);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+
+        len += sizeof(struct scatterlist) * nfrags;
+
+        return kmalloc(len, GFP_ATOMIC);
+}
+
+static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp)
+{
+        return crypto_aead_ivsize(aead) ?
+               PTR_ALIGN((u8 *)tmp, crypto_aead_alignmask(aead) + 1) : tmp;
+}
+
+static inline struct aead_givcrypt_request *esp_tmp_givreq(
+        struct crypto_aead *aead, u8 *iv)
+{
+        struct aead_givcrypt_request *req;
+
+        req = (void *)PTR_ALIGN(iv + crypto_aead_ivsize(aead),
+                                crypto_tfm_ctx_alignment());
+        aead_givcrypt_set_tfm(req, aead);
+        return req;
+}
+
+static inline struct aead_request *esp_tmp_req(struct crypto_aead *aead, u8 *iv)
+{
+        struct aead_request *req;
+
+        req = (void *)PTR_ALIGN(iv + crypto_aead_ivsize(aead),
+                                crypto_tfm_ctx_alignment());
+        aead_request_set_tfm(req, aead);
+        return req;
+}
+
+static inline struct scatterlist *esp_req_sg(struct crypto_aead *aead,
+                                             struct aead_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_aead_reqsize(aead),
+                             __alignof__(struct scatterlist));
+}
+
+static inline struct scatterlist *esp_givreq_sg(
+        struct crypto_aead *aead, struct aead_givcrypt_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_aead_reqsize(aead),
+                             __alignof__(struct scatterlist));
+}
+
+static void esp_output_done(struct crypto_async_request *base, int err)
+{
+        struct sk_buff *skb = base->data;
+
+        kfree(ESP_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
+
 static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
         struct ip_esp_hdr *esph;
-        struct crypto_blkcipher *tfm;
-        struct blkcipher_desc desc;
+        struct crypto_aead *aead;
+        struct aead_givcrypt_request *req;
+        struct scatterlist *sg;
+        struct scatterlist *asg;
         struct esp_data *esp;
         struct sk_buff *trailer;
+        void *tmp;
+        u8 *iv;
         u8 *tail;
         int blksize;
         int clen;
@@ -36,18 +127,27 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         clen = skb->len;
 
         esp = x->data;
-        alen = esp->auth.icv_trunc_len;
-        tfm = esp->conf.tfm;
-        desc.tfm = tfm;
-        desc.flags = 0;
-        blksize = ALIGN(crypto_blkcipher_blocksize(tfm), 4);
+        aead = esp->aead;
+        alen = crypto_aead_authsize(aead);
+
+        blksize = ALIGN(crypto_aead_blocksize(aead), 4);
         clen = ALIGN(clen + 2, blksize);
-        if (esp->conf.padlen)
-                clen = ALIGN(clen, esp->conf.padlen);
+        if (esp->padlen)
+                clen = ALIGN(clen, esp->padlen);
+
+        if ((err = skb_cow_data(skb, clen - skb->len + alen, &trailer)) < 0)
+                goto error;
+        nfrags = err;
 
-        if ((nfrags = skb_cow_data(skb, clen-skb->len+alen, &trailer)) < 0)
+        tmp = esp_alloc_tmp(aead, nfrags + 1);
+        if (!tmp)
                 goto error;
 
+        iv = esp_tmp_iv(aead, tmp);
+        req = esp_tmp_givreq(aead, iv);
+        asg = esp_givreq_sg(aead, req);
+        sg = asg + 1;
+
         /* Fill padding... */
         tail = skb_tail_pointer(trailer);
         do {
@@ -56,28 +156,34 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
                         tail[i] = i + 1;
         } while (0);
         tail[clen - skb->len - 2] = (clen - skb->len) - 2;
-        pskb_put(skb, trailer, clen - skb->len);
+        tail[clen - skb->len - 1] = *skb_mac_header(skb);
+        pskb_put(skb, trailer, clen - skb->len + alen);
 
         skb_push(skb, -skb_network_offset(skb));
         esph = ip_esp_hdr(skb);
-        *(skb_tail_pointer(trailer) - 1) = *skb_mac_header(skb);
         *skb_mac_header(skb) = IPPROTO_ESP;
 
-        spin_lock_bh(&x->lock);
-
         /* this is non-NULL only with UDP Encapsulation */
         if (x->encap) {
                 struct xfrm_encap_tmpl *encap = x->encap;
                 struct udphdr *uh;
                 __be32 *udpdata32;
+                unsigned int sport, dport;
+                int encap_type;
+
+                spin_lock_bh(&x->lock);
+                sport = encap->encap_sport;
+                dport = encap->encap_dport;
+                encap_type = encap->encap_type;
+                spin_unlock_bh(&x->lock);
 
                 uh = (struct udphdr *)esph;
-                uh->source = encap->encap_sport;
-                uh->dest = encap->encap_dport;
-                uh->len = htons(skb->len + alen - skb_transport_offset(skb));
+                uh->source = sport;
+                uh->dest = dport;
+                uh->len = htons(skb->len - skb_transport_offset(skb));
                 uh->check = 0;
 
-                switch (encap->encap_type) {
+                switch (encap_type) {
                 default:
                 case UDP_ENCAP_ESPINUDP:
                         esph = (struct ip_esp_hdr *)(uh + 1);
@@ -95,131 +201,45 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
         esph->spi = x->id.spi;
         esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq);
 
-        if (esp->conf.ivlen) {
-                if (unlikely(!esp->conf.ivinitted)) {
-                        get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
-                        esp->conf.ivinitted = 1;
-                }
-                crypto_blkcipher_set_iv(tfm, esp->conf.ivec, esp->conf.ivlen);
-        }
-
-        do {
-                struct scatterlist *sg = &esp->sgbuf[0];
-
-                if (unlikely(nfrags > ESP_NUM_FAST_SG)) {
-                        sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);
-                        if (!sg)
-                                goto unlock;
-                }
-                sg_init_table(sg, nfrags);
-                skb_to_sgvec(skb, sg,
-                             esph->enc_data +
-                             esp->conf.ivlen -
-                             skb->data, clen);
-                err = crypto_blkcipher_encrypt(&desc, sg, sg, clen);
-                if (unlikely(sg != &esp->sgbuf[0]))
-                        kfree(sg);
-        } while (0);
-
-        if (unlikely(err))
-                goto unlock;
-
-        if (esp->conf.ivlen) {
-                memcpy(esph->enc_data, esp->conf.ivec, esp->conf.ivlen);
-                crypto_blkcipher_get_iv(tfm, esp->conf.ivec, esp->conf.ivlen);
-        }
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg,
+                     esph->enc_data + crypto_aead_ivsize(aead) - skb->data,
+                     clen + alen);
+        sg_init_one(asg, esph, sizeof(*esph));
+
+        aead_givcrypt_set_callback(req, 0, esp_output_done, skb);
+        aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
+        aead_givcrypt_set_assoc(req, asg, sizeof(*esph));
+        aead_givcrypt_set_giv(req, esph->enc_data, XFRM_SKB_CB(skb)->seq);
+
+        ESP_SKB_CB(skb)->tmp = tmp;
+        err = crypto_aead_givencrypt(req);
+        if (err == -EINPROGRESS)
+                goto error;
 
-        if (esp->auth.icv_full_len) {
-                err = esp_mac_digest(esp, skb, (u8 *)esph - skb->data,
-                                     sizeof(*esph) + esp->conf.ivlen + clen);
-                memcpy(pskb_put(skb, trailer, alen), esp->auth.work_icv, alen);
-        }
+        if (err == -EBUSY)
+                err = NET_XMIT_DROP;
 
-unlock:
-        spin_unlock_bh(&x->lock);
+        kfree(tmp);
 
 error:
         return err;
 }
 
-/*
- * Note: detecting truncated vs. non-truncated authentication data is very
- * expensive, so we only support truncated data, which is the recommended
- * and common case.
- */
-static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
+static int esp_input_done2(struct sk_buff *skb, int err)
 {
         struct iphdr *iph;
-        struct ip_esp_hdr *esph;
+        struct xfrm_state *x = xfrm_input_state(skb);
         struct esp_data *esp = x->data;
-        struct crypto_blkcipher *tfm = esp->conf.tfm;
-        struct blkcipher_desc desc = { .tfm = tfm };
-        struct sk_buff *trailer;
-        int blksize = ALIGN(crypto_blkcipher_blocksize(tfm), 4);
-        int alen = esp->auth.icv_trunc_len;
-        int elen = skb->len - sizeof(*esph) - esp->conf.ivlen - alen;
-        int nfrags;
+        struct crypto_aead *aead = esp->aead;
+        int alen = crypto_aead_authsize(aead);
+        int hlen = sizeof(struct ip_esp_hdr) + crypto_aead_ivsize(aead);
+        int elen = skb->len - hlen;
         int ihl;
         u8 nexthdr[2];
-        struct scatterlist *sg;
         int padlen;
-        int err = -EINVAL;
-
-        if (!pskb_may_pull(skb, sizeof(*esph)))
-                goto out;
-
-        if (elen <= 0 || (elen & (blksize-1)))
-                goto out;
-
-        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
-                goto out;
-        nfrags = err;
-
-        skb->ip_summed = CHECKSUM_NONE;
-
-        spin_lock(&x->lock);
-
-        /* If integrity check is required, do this. */
-        if (esp->auth.icv_full_len) {
-                u8 sum[alen];
 
-                err = esp_mac_digest(esp, skb, 0, skb->len - alen);
-                if (err)
-                        goto unlock;
-
-                if (skb_copy_bits(skb, skb->len - alen, sum, alen))
-                        BUG();
-
-                if (unlikely(memcmp(esp->auth.work_icv, sum, alen))) {
-                        err = -EBADMSG;
-                        goto unlock;
-                }
-        }
-
-        esph = (struct ip_esp_hdr *)skb->data;
-
-        /* Get ivec. This can be wrong, check against another impls. */
-        if (esp->conf.ivlen)
-                crypto_blkcipher_set_iv(tfm, esph->enc_data, esp->conf.ivlen);
-
-        sg = &esp->sgbuf[0];
-
-        if (unlikely(nfrags > ESP_NUM_FAST_SG)) {
-                err = -ENOMEM;
-                sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);
-                if (!sg)
-                        goto unlock;
-        }
-        sg_init_table(sg, nfrags);
-        skb_to_sgvec(skb, sg,
-                     sizeof(*esph) + esp->conf.ivlen,
-                     elen);
-        err = crypto_blkcipher_decrypt(&desc, sg, sg, elen);
-        if (unlikely(sg != &esp->sgbuf[0]))
-                kfree(sg);
-
-unlock:
-        spin_unlock(&x->lock);
+        kfree(ESP_SKB_CB(skb)->tmp);
 
         if (unlikely(err))
                 goto out;
@@ -229,15 +249,11 @@ unlock:
 
         err = -EINVAL;
         padlen = nexthdr[0];
-        if (padlen+2 >= elen)
+        if (padlen + 2 + alen >= elen)
                 goto out;
 
         /* ... check padding bits here. Silly. :-) */
 
-        /* RFC4303: Drop dummy packets without any error */
-        if (nexthdr[1] == IPPROTO_NONE)
-                goto out;
-
         iph = ip_hdr(skb);
         ihl = iph->ihl * 4;
 
@@ -279,10 +295,87 @@ unlock:
         }
 
         pskb_trim(skb, skb->len - alen - padlen - 2);
-        __skb_pull(skb, sizeof(*esph) + esp->conf.ivlen);
+        __skb_pull(skb, hlen);
         skb_set_transport_header(skb, -ihl);
 
-        return nexthdr[1];
+        err = nexthdr[1];
+
+        /* RFC4303: Drop dummy packets without any error */
+        if (err == IPPROTO_NONE)
+                err = -EINVAL;
+
+out:
+        return err;
+}
+
+static void esp_input_done(struct crypto_async_request *base, int err)
+{
+        struct sk_buff *skb = base->data;
+
+        xfrm_input_resume(skb, esp_input_done2(skb, err));
+}
+
+/*
+ * Note: detecting truncated vs. non-truncated authentication data is very
+ * expensive, so we only support truncated data, which is the recommended
+ * and common case.
+ */
+static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct ip_esp_hdr *esph;
+        struct esp_data *esp = x->data;
+        struct crypto_aead *aead = esp->aead;
+        struct aead_request *req;
+        struct sk_buff *trailer;
+        int elen = skb->len - sizeof(*esph) - crypto_aead_ivsize(aead);
+        int nfrags;
+        void *tmp;
+        u8 *iv;
+        struct scatterlist *sg;
+        struct scatterlist *asg;
+        int err = -EINVAL;
+
+        if (!pskb_may_pull(skb, sizeof(*esph)))
+                goto out;
+
+        if (elen <= 0)
+                goto out;
+
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
+
+        err = -ENOMEM;
+        tmp = esp_alloc_tmp(aead, nfrags + 1);
+        if (!tmp)
+                goto out;
+
+        ESP_SKB_CB(skb)->tmp = tmp;
+        iv = esp_tmp_iv(aead, tmp);
+        req = esp_tmp_req(aead, iv);
+        asg = esp_req_sg(aead, req);
+        sg = asg + 1;
+
+        skb->ip_summed = CHECKSUM_NONE;
+
+        esph = (struct ip_esp_hdr *)skb->data;
+
+        /* Get ivec. This can be wrong, check against another impls. */
+        iv = esph->enc_data;
+
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, sizeof(*esph) + crypto_aead_ivsize(aead), elen);
+        sg_init_one(asg, esph, sizeof(*esph));
+
+        aead_request_set_callback(req, 0, esp_input_done, skb);
+        aead_request_set_crypt(req, sg, sg, elen, iv);
+        aead_request_set_assoc(req, asg, sizeof(*esph));
+
+        err = crypto_aead_decrypt(req);
+        if (err == -EINPROGRESS)
+                goto out;
+
+        err = esp_input_done2(skb, err);
 
 out:
         return err;
@@ -291,11 +384,11 @@ out:
 static u32 esp4_get_mtu(struct xfrm_state *x, int mtu)
 {
         struct esp_data *esp = x->data;
-        u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
-        u32 align = max_t(u32, blksize, esp->conf.padlen);
+        u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
+        u32 align = max_t(u32, blksize, esp->padlen);
         u32 rem;
 
-        mtu -= x->props.header_len + esp->auth.icv_trunc_len;
+        mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
         rem = mtu & (align - 1);
         mtu &= ~(align - 1);
 
@@ -342,80 +435,143 @@ static void esp_destroy(struct xfrm_state *x)
         if (!esp)
                 return;
 
-        crypto_free_blkcipher(esp->conf.tfm);
-        esp->conf.tfm = NULL;
-        kfree(esp->conf.ivec);
-        esp->conf.ivec = NULL;
-        crypto_free_hash(esp->auth.tfm);
-        esp->auth.tfm = NULL;
-        kfree(esp->auth.work_icv);
-        esp->auth.work_icv = NULL;
+        crypto_free_aead(esp->aead);
         kfree(esp);
 }
 
-static int esp_init_state(struct xfrm_state *x)
+static int esp_init_aead(struct xfrm_state *x)
 {
-        struct esp_data *esp = NULL;
-        struct crypto_blkcipher *tfm;
-        u32 align;
+        struct esp_data *esp = x->data;
+        struct crypto_aead *aead;
+        int err;
+
+        aead = crypto_alloc_aead(x->aead->alg_name, 0, 0);
+        err = PTR_ERR(aead);
+        if (IS_ERR(aead))
+                goto error;
+
+        esp->aead = aead;
+
+        err = crypto_aead_setkey(aead, x->aead->alg_key,
+                                 (x->aead->alg_key_len + 7) / 8);
+        if (err)
+                goto error;
+
+        err = crypto_aead_setauthsize(aead, x->aead->alg_icv_len / 8);
+        if (err)
+                goto error;
+
+error:
+        return err;
+}
 
+static int esp_init_authenc(struct xfrm_state *x)
+{
+        struct esp_data *esp = x->data;
+        struct crypto_aead *aead;
+        struct crypto_authenc_key_param *param;
+        struct rtattr *rta;
+        char *key;
+        char *p;
+        char authenc_name[CRYPTO_MAX_ALG_NAME];
+        unsigned int keylen;
+        int err;
+
+        err = -EINVAL;
         if (x->ealg == NULL)
                 goto error;
 
-        esp = kzalloc(sizeof(*esp), GFP_KERNEL);
-        if (esp == NULL)
-                return -ENOMEM;
+        err = -ENAMETOOLONG;
+        if (snprintf(authenc_name, CRYPTO_MAX_ALG_NAME, "authenc(%s,%s)",
+                     x->aalg ? x->aalg->alg_name : "digest_null",
+                     x->ealg->alg_name) >= CRYPTO_MAX_ALG_NAME)
+                goto error;
+
+        aead = crypto_alloc_aead(authenc_name, 0, 0);
+        err = PTR_ERR(aead);
+        if (IS_ERR(aead))
+                goto error;
+
+        esp->aead = aead;
+
+        keylen = (x->aalg ? (x->aalg->alg_key_len + 7) / 8 : 0) +
+                 (x->ealg->alg_key_len + 7) / 8 + RTA_SPACE(sizeof(*param));
+        err = -ENOMEM;
+        key = kmalloc(keylen, GFP_KERNEL);
+        if (!key)
+                goto error;
+
+        p = key;
+        rta = (void *)p;
+        rta->rta_type = CRYPTO_AUTHENC_KEYA_PARAM;
+        rta->rta_len = RTA_LENGTH(sizeof(*param));
+        param = RTA_DATA(rta);
+        p += RTA_SPACE(sizeof(*param));
 
         if (x->aalg) {
                 struct xfrm_algo_desc *aalg_desc;
-                struct crypto_hash *hash;
 
-                hash = crypto_alloc_hash(x->aalg->alg_name, 0,
-                                         CRYPTO_ALG_ASYNC);
-                if (IS_ERR(hash))
-                        goto error;
-
-                esp->auth.tfm = hash;
-                if (crypto_hash_setkey(hash, x->aalg->alg_key,
-                                       (x->aalg->alg_key_len + 7) / 8))
-                        goto error;
+                memcpy(p, x->aalg->alg_key, (x->aalg->alg_key_len + 7) / 8);
+                p += (x->aalg->alg_key_len + 7) / 8;
 
                 aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
                 BUG_ON(!aalg_desc);
 
+                err = -EINVAL;
                 if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-                    crypto_hash_digestsize(hash)) {
+                    crypto_aead_authsize(aead)) {
                         NETDEBUG(KERN_INFO "ESP: %s digestsize %u != %hu\n",
                                  x->aalg->alg_name,
-                                 crypto_hash_digestsize(hash),
+                                 crypto_aead_authsize(aead),
                                  aalg_desc->uinfo.auth.icv_fullbits/8);
-                        goto error;
+                        goto free_key;
                 }
 
-                esp->auth.icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
-                esp->auth.icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
-
-                esp->auth.work_icv = kmalloc(esp->auth.icv_full_len, GFP_KERNEL);
-                if (!esp->auth.work_icv)
-                        goto error;
+                err = crypto_aead_setauthsize(
+                        aead, aalg_desc->uinfo.auth.icv_truncbits / 8);
+                if (err)
+                        goto free_key;
         }
 
-        tfm = crypto_alloc_blkcipher(x->ealg->alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
-                goto error;
-        esp->conf.tfm = tfm;
-        esp->conf.ivlen = crypto_blkcipher_ivsize(tfm);
-        esp->conf.padlen = 0;
-        if (esp->conf.ivlen) {
-                esp->conf.ivec = kmalloc(esp->conf.ivlen, GFP_KERNEL);
-                if (unlikely(esp->conf.ivec == NULL))
-                        goto error;
-                esp->conf.ivinitted = 0;
-        }
-        if (crypto_blkcipher_setkey(tfm, x->ealg->alg_key,
-                                    (x->ealg->alg_key_len + 7) / 8))
+        param->enckeylen = cpu_to_be32((x->ealg->alg_key_len + 7) / 8);
+        memcpy(p, x->ealg->alg_key, (x->ealg->alg_key_len + 7) / 8);
+
+        err = crypto_aead_setkey(aead, key, keylen);
+
+free_key:
+        kfree(key);
+
+error:
+        return err;
+}
+
+static int esp_init_state(struct xfrm_state *x)
+{
+        struct esp_data *esp;
+        struct crypto_aead *aead;
+        u32 align;
+        int err;
+
+        esp = kzalloc(sizeof(*esp), GFP_KERNEL);
+        if (esp == NULL)
+                return -ENOMEM;
+
+        x->data = esp;
+
+        if (x->aead)
+                err = esp_init_aead(x);
+        else
+                err = esp_init_authenc(x);
+
+        if (err)
                 goto error;
-        x->props.header_len = sizeof(struct ip_esp_hdr) + esp->conf.ivlen;
+
+        aead = esp->aead;
+
+        esp->padlen = 0;
+
+        x->props.header_len = sizeof(struct ip_esp_hdr) +
+                              crypto_aead_ivsize(aead);
         if (x->props.mode == XFRM_MODE_TUNNEL)
                 x->props.header_len += sizeof(struct iphdr);
         else if (x->props.mode == XFRM_MODE_BEET)
@@ -434,21 +590,17 @@ static int esp_init_state(struct xfrm_state *x)
                         break;
                 }
         }
-        x->data = esp;
-        align = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
-        if (esp->conf.padlen)
-                align = max_t(u32, align, esp->conf.padlen);
-        x->props.trailer_len = align + 1 + esp->auth.icv_trunc_len;
-        return 0;
+
+        align = ALIGN(crypto_aead_blocksize(aead), 4);
+        if (esp->padlen)
+                align = max_t(u32, align, esp->padlen);
+        x->props.trailer_len = align + 1 + crypto_aead_authsize(esp->aead);
 
 error:
-        x->data = esp;
-        esp_destroy(x);
-        x->data = NULL;
-        return -EINVAL;
+        return err;
 }
 
-static struct xfrm_type esp_type =
+static const struct xfrm_type esp_type =
 {
         .description    = "ESP4",
         .owner          = THIS_MODULE,
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index d28261826bc2..86ff2711fc95 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -808,7 +808,7 @@ static void fib_del_ifaddr(struct in_ifaddr *ifa)
                            First of all, we scan fib_info list searching
                            for stray nexthop entries, then ignite fib_flush.
                         */
-                        if (fib_sync_down(ifa->ifa_local, NULL, 0))
+                        if (fib_sync_down_addr(dev->nd_net, ifa->ifa_local))
                                 fib_flush(dev->nd_net);
                 }
         }
@@ -898,7 +898,7 @@ static void nl_fib_lookup_exit(struct net *net)
 
 static void fib_disable_ip(struct net_device *dev, int force)
 {
-        if (fib_sync_down(0, dev, force))
+        if (fib_sync_down_dev(dev, force))
                 fib_flush(dev->nd_net);
         rt_cache_flush(0);
         arp_ifdown(dev);
@@ -975,6 +975,7 @@ static struct notifier_block fib_netdev_notifier = {
 
 static int __net_init ip_fib_net_init(struct net *net)
 {
+        int err;
         unsigned int i;
 
         net->ipv4.fib_table_hash = kzalloc(
@@ -985,7 +986,14 @@ static int __net_init ip_fib_net_init(struct net *net)
         for (i = 0; i < FIB_TABLE_HASHSZ; i++)
                 INIT_HLIST_HEAD(&net->ipv4.fib_table_hash[i]);
 
-        return fib4_rules_init(net);
+        err = fib4_rules_init(net);
+        if (err < 0)
+                goto fail;
+        return 0;
+
+fail:
+        kfree(net->ipv4.fib_table_hash);
+        return err;
 }
 
 static void __net_exit ip_fib_net_exit(struct net *net)
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index a15b2f1b2721..76b9c684cccd 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -424,19 +424,43 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
 
         if (fa && fa->fa_tos == tos &&
             fa->fa_info->fib_priority == fi->fib_priority) {
-                struct fib_alias *fa_orig;
+                struct fib_alias *fa_first, *fa_match;
 
                 err = -EEXIST;
                 if (cfg->fc_nlflags & NLM_F_EXCL)
                         goto out;
 
+                /* We have 2 goals:
+                 * 1. Find exact match for type, scope, fib_info to avoid
+                 * duplicate routes
+                 * 2. Find next 'fa' (or head), NLM_F_APPEND inserts before it
+                 */
+                fa_match = NULL;
+                fa_first = fa;
+                fa = list_entry(fa->fa_list.prev, struct fib_alias, fa_list);
+                list_for_each_entry_continue(fa, &f->fn_alias, fa_list) {
+                        if (fa->fa_tos != tos)
+                                break;
+                        if (fa->fa_info->fib_priority != fi->fib_priority)
+                                break;
+                        if (fa->fa_type == cfg->fc_type &&
+                            fa->fa_scope == cfg->fc_scope &&
+                            fa->fa_info == fi) {
+                                fa_match = fa;
+                                break;
+                        }
+                }
+
                 if (cfg->fc_nlflags & NLM_F_REPLACE) {
                         struct fib_info *fi_drop;
                         u8 state;
 
-                        if (fi->fib_treeref > 1)
+                        fa = fa_first;
+                        if (fa_match) {
+                                if (fa == fa_match)
+                                        err = 0;
                                 goto out;
-
+                        }
                         write_lock_bh(&fib_hash_lock);
                         fi_drop = fa->fa_info;
                         fa->fa_info = fi;
@@ -459,20 +483,11 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
                  * uses the same scope, type, and nexthop
                  * information.
                  */
-                fa_orig = fa;
-                fa = list_entry(fa->fa_list.prev, struct fib_alias, fa_list);
-                list_for_each_entry_continue(fa, &f->fn_alias, fa_list) {
-                        if (fa->fa_tos != tos)
-                                break;
-                        if (fa->fa_info->fib_priority != fi->fib_priority)
-                                break;
-                        if (fa->fa_type == cfg->fc_type &&
-                            fa->fa_scope == cfg->fc_scope &&
-                            fa->fa_info == fi)
-                                goto out;
-                }
+                if (fa_match)
+                        goto out;
+
                 if (!(cfg->fc_nlflags & NLM_F_APPEND))
-                        fa = fa_orig;
+                        fa = fa_first;
         }
 
         err = -ENOENT;
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index c7912866d987..a13c84763d4c 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -229,6 +229,8 @@ static struct fib_info *fib_find_info(const struct fib_info *nfi)
         head = &fib_info_hash[hash];
 
         hlist_for_each_entry(fi, node, head, fib_hash) {
+                if (fi->fib_net != nfi->fib_net)
+                        continue;
                 if (fi->fib_nhs != nfi->fib_nhs)
                         continue;
                 if (nfi->fib_protocol == fi->fib_protocol &&
@@ -687,6 +689,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
         struct fib_info *fi = NULL;
         struct fib_info *ofi;
         int nhs = 1;
+        struct net *net = cfg->fc_nlinfo.nl_net;
 
         /* Fast check to catch the most weird cases */
         if (fib_props[cfg->fc_type].scope > cfg->fc_scope)
@@ -727,6 +730,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
                 goto failure;
         fib_info_cnt++;
 
+        fi->fib_net = net;
         fi->fib_protocol = cfg->fc_protocol;
         fi->fib_flags = cfg->fc_flags;
         fi->fib_priority = cfg->fc_priority;
@@ -798,8 +802,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
                 if (nhs != 1 || nh->nh_gw)
                         goto err_inval;
                 nh->nh_scope = RT_SCOPE_NOWHERE;
-                nh->nh_dev = dev_get_by_index(cfg->fc_nlinfo.nl_net,
-                                              fi->fib_nh->nh_oif);
+                nh->nh_dev = dev_get_by_index(net, fi->fib_nh->nh_oif);
                 err = -ENODEV;
                 if (nh->nh_dev == NULL)
                         goto failure;
@@ -813,8 +816,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
         if (fi->fib_prefsrc) {
                 if (cfg->fc_type != RTN_LOCAL || !cfg->fc_dst ||
                     fi->fib_prefsrc != cfg->fc_dst)
-                        if (inet_addr_type(cfg->fc_nlinfo.nl_net,
-                                           fi->fib_prefsrc) != RTN_LOCAL)
+                        if (inet_addr_type(net, fi->fib_prefsrc) != RTN_LOCAL)
                                 goto err_inval;
         }
 
@@ -1031,70 +1033,74 @@ nla_put_failure:
      referring to it.
    - device went down -> we must shutdown all nexthops going via it.
  */
-
-int fib_sync_down(__be32 local, struct net_device *dev, int force)
+int fib_sync_down_addr(struct net *net, __be32 local)
 {
         int ret = 0;
-        int scope = RT_SCOPE_NOWHERE;
-
-        if (force)
-                scope = -1;
+        unsigned int hash = fib_laddr_hashfn(local);
+        struct hlist_head *head = &fib_info_laddrhash[hash];
+        struct hlist_node *node;
+        struct fib_info *fi;
 
-        if (local && fib_info_laddrhash) {
-                unsigned int hash = fib_laddr_hashfn(local);
-                struct hlist_head *head = &fib_info_laddrhash[hash];
-                struct hlist_node *node;
-                struct fib_info *fi;
+        if (fib_info_laddrhash == NULL || local == 0)
+                return 0;
 
-                hlist_for_each_entry(fi, node, head, fib_lhash) {
-                        if (fi->fib_prefsrc == local) {
-                                fi->fib_flags |= RTNH_F_DEAD;
-                                ret++;
-                        }
+        hlist_for_each_entry(fi, node, head, fib_lhash) {
+                if (fi->fib_net != net)
+                        continue;
+                if (fi->fib_prefsrc == local) {
+                        fi->fib_flags |= RTNH_F_DEAD;
+                        ret++;
                 }
         }
+        return ret;
+}
 
-        if (dev) {
-                struct fib_info *prev_fi = NULL;
-                unsigned int hash = fib_devindex_hashfn(dev->ifindex);
-                struct hlist_head *head = &fib_info_devhash[hash];
-                struct hlist_node *node;
-                struct fib_nh *nh;
+int fib_sync_down_dev(struct net_device *dev, int force)
+{
+        int ret = 0;
+        int scope = RT_SCOPE_NOWHERE;
+        struct fib_info *prev_fi = NULL;
+        unsigned int hash = fib_devindex_hashfn(dev->ifindex);
+        struct hlist_head *head = &fib_info_devhash[hash];
+        struct hlist_node *node;
+        struct fib_nh *nh;
 
-                hlist_for_each_entry(nh, node, head, nh_hash) {
-                        struct fib_info *fi = nh->nh_parent;
-                        int dead;
+        if (force)
+                scope = -1;
 
-                        BUG_ON(!fi->fib_nhs);
-                        if (nh->nh_dev != dev || fi == prev_fi)
-                                continue;
-                        prev_fi = fi;
-                        dead = 0;
-                        change_nexthops(fi) {
-                                if (nh->nh_flags&RTNH_F_DEAD)
-                                        dead++;
-                                else if (nh->nh_dev == dev &&
-                                         nh->nh_scope != scope) {
-                                        nh->nh_flags |= RTNH_F_DEAD;
+        hlist_for_each_entry(nh, node, head, nh_hash) {
+                struct fib_info *fi = nh->nh_parent;
+                int dead;
+
+                BUG_ON(!fi->fib_nhs);
+                if (nh->nh_dev != dev || fi == prev_fi)
+                        continue;
+                prev_fi = fi;
+                dead = 0;
+                change_nexthops(fi) {
+                        if (nh->nh_flags&RTNH_F_DEAD)
+                                dead++;
+                        else if (nh->nh_dev == dev &&
+                                        nh->nh_scope != scope) {
+                                nh->nh_flags |= RTNH_F_DEAD;
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-                                        spin_lock_bh(&fib_multipath_lock);
-                                        fi->fib_power -= nh->nh_power;
-                                        nh->nh_power = 0;
-                                        spin_unlock_bh(&fib_multipath_lock);
+                                spin_lock_bh(&fib_multipath_lock);
+                                fi->fib_power -= nh->nh_power;
+                                nh->nh_power = 0;
+                                spin_unlock_bh(&fib_multipath_lock);
 #endif
-                                        dead++;
-                                }
+                                dead++;
+                        }
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-                                if (force > 1 && nh->nh_dev == dev) {
-                                        dead = fi->fib_nhs;
-                                        break;
-                                }
-#endif
-                        } endfor_nexthops(fi)
-                        if (dead == fi->fib_nhs) {
-                                fi->fib_flags |= RTNH_F_DEAD;
-                                ret++;
+                        if (force > 1 && nh->nh_dev == dev) {
+                                dead = fi->fib_nhs;
+                                break;
                         }
+#endif
+                } endfor_nexthops(fi)
+                if (dead == fi->fib_nhs) {
+                        fi->fib_flags |= RTNH_F_DEAD;
+                        ret++;
                 }
         }
 
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index f2f47033f31f..35851c96bdfb 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1205,20 +1205,45 @@ static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
          * and we need to allocate a new one of those as well.
          */
 
-        if (fa && fa->fa_info->fib_priority == fi->fib_priority) {
-                struct fib_alias *fa_orig;
+        if (fa && fa->fa_tos == tos &&
+            fa->fa_info->fib_priority == fi->fib_priority) {
+                struct fib_alias *fa_first, *fa_match;
 
                 err = -EEXIST;
                 if (cfg->fc_nlflags & NLM_F_EXCL)
                         goto out;
 
+                /* We have 2 goals:
+                 * 1. Find exact match for type, scope, fib_info to avoid
+                 * duplicate routes
+                 * 2. Find next 'fa' (or head), NLM_F_APPEND inserts before it
+                 */
+                fa_match = NULL;
+                fa_first = fa;
+                fa = list_entry(fa->fa_list.prev, struct fib_alias, fa_list);
+                list_for_each_entry_continue(fa, fa_head, fa_list) {
+                        if (fa->fa_tos != tos)
+                                break;
+                        if (fa->fa_info->fib_priority != fi->fib_priority)
+                                break;
+                        if (fa->fa_type == cfg->fc_type &&
+                            fa->fa_scope == cfg->fc_scope &&
+                            fa->fa_info == fi) {
+                                fa_match = fa;
+                                break;
+                        }
+                }
+
                 if (cfg->fc_nlflags & NLM_F_REPLACE) {
                         struct fib_info *fi_drop;
                         u8 state;
 
-                        if (fi->fib_treeref > 1)
+                        fa = fa_first;
+                        if (fa_match) {
+                                if (fa == fa_match)
+                                        err = 0;
                                 goto out;
-
+                        }
                         err = -ENOBUFS;
                         new_fa = kmem_cache_alloc(fn_alias_kmem, GFP_KERNEL);
                         if (new_fa == NULL)
@@ -1230,7 +1255,7 @@ static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
                         new_fa->fa_type = cfg->fc_type;
                         new_fa->fa_scope = cfg->fc_scope;
                         state = fa->fa_state;
-                        new_fa->fa_state &= ~FA_S_ACCESSED;
+                        new_fa->fa_state = state & ~FA_S_ACCESSED;
 
                         list_replace_rcu(&fa->fa_list, &new_fa->fa_list);
                         alias_free_mem_rcu(fa);
@@ -1247,20 +1272,11 @@ static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
                  * uses the same scope, type, and nexthop
                  * information.
                  */
-                fa_orig = fa;
-                list_for_each_entry(fa, fa_orig->fa_list.prev, fa_list) {
-                        if (fa->fa_tos != tos)
-                                break;
-                        if (fa->fa_info->fib_priority != fi->fib_priority)
-                                break;
-                        if (fa->fa_type == cfg->fc_type &&
-                            fa->fa_scope == cfg->fc_scope &&
-                            fa->fa_info == fi)
-                                goto out;
-                }
+                if (fa_match)
+                        goto out;
 
                 if (!(cfg->fc_nlflags & NLM_F_APPEND))
-                        fa = fa_orig;
+                        fa = fa_first;
         }
         err = -ENOENT;
         if (!(cfg->fc_nlflags & NLM_F_CREATE))
@@ -1600,9 +1616,8 @@ static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
         pr_debug("Deleting %08x/%d tos=%d t=%p\n", key, plen, tos, t);
 
         fa_to_delete = NULL;
-        fa_head = fa->fa_list.prev;
-
-        list_for_each_entry(fa, fa_head, fa_list) {
+        fa = list_entry(fa->fa_list.prev, struct fib_alias, fa_list);
+        list_for_each_entry_continue(fa, fa_head, fa_list) {
                 struct fib_info *fi = fa->fa_info;
 
                 if (fa->fa_tos != tos)
@@ -1743,6 +1758,19 @@ static struct leaf *trie_nextleaf(struct leaf *l)
         return leaf_walk_rcu(p, c);
 }
 
+static struct leaf *trie_leafindex(struct trie *t, int index)
+{
+        struct leaf *l = trie_firstleaf(t);
+
+        while (index-- > 0) {
+                l = trie_nextleaf(l);
+                if (!l)
+                        break;
+        }
+        return l;
+}
+
+
 /*
  * Caller must hold RTNL.
  */
@@ -1848,7 +1876,7 @@ static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah,
         struct fib_alias *fa;
         __be32 xkey = htonl(key);
 
-        s_i = cb->args[4];
+        s_i = cb->args[5];
         i = 0;
 
         /* rcu_read_lock is hold by caller */
@@ -1869,12 +1897,12 @@ static int fn_trie_dump_fa(t_key key, int plen, struct list_head *fah,
                                   plen,
                                   fa->fa_tos,
                                   fa->fa_info, NLM_F_MULTI) < 0) {
-                        cb->args[4] = i;
+                        cb->args[5] = i;
                         return -1;
                 }
                 i++;
         }
-        cb->args[4] = i;
+        cb->args[5] = i;
         return skb->len;
 }
 
@@ -1885,7 +1913,7 @@ static int fn_trie_dump_leaf(struct leaf *l, struct fib_table *tb,
         struct hlist_node *node;
         int i, s_i;
 
-        s_i = cb->args[3];
+        s_i = cb->args[4];
         i = 0;
 
         /* rcu_read_lock is hold by caller */
@@ -1896,19 +1924,19 @@ static int fn_trie_dump_leaf(struct leaf *l, struct fib_table *tb,
                 }
 
                 if (i > s_i)
-                        cb->args[4] = 0;
+                        cb->args[5] = 0;
 
                 if (list_empty(&li->falh))
                         continue;
 
                 if (fn_trie_dump_fa(l->key, li->plen, &li->falh, tb, skb, cb) < 0) {
-                        cb->args[3] = i;
+                        cb->args[4] = i;
                         return -1;
                 }
                 i++;
         }
 
-        cb->args[3] = i;
+        cb->args[4] = i;
         return skb->len;
 }
 
@@ -1918,35 +1946,37 @@ static int fn_trie_dump(struct fib_table *tb, struct sk_buff *skb,
         struct leaf *l;
         struct trie *t = (struct trie *) tb->tb_data;
         t_key key = cb->args[2];
+        int count = cb->args[3];
 
         rcu_read_lock();
         /* Dump starting at last key.
          * Note: 0.0.0.0/0 (ie default) is first key.
          */
-        if (!key)
+        if (count == 0)
                 l = trie_firstleaf(t);
         else {
+                /* Normally, continue from last key, but if that is missing
+                 * fallback to using slow rescan
+                 */
                 l = fib_find_node(t, key);
-                if (!l) {
-                        /* The table changed during the dump, rather than
-                         * giving partial data, just make application retry.
-                         */
-                        rcu_read_unlock();
-                        return -EBUSY;
-                }
+                if (!l)
+                        l = trie_leafindex(t, count);
         }
 
         while (l) {
                 cb->args[2] = l->key;
                 if (fn_trie_dump_leaf(l, tb, skb, cb) < 0) {
+                        cb->args[3] = count;
                         rcu_read_unlock();
                         return -1;
                 }
 
+                ++count;
                 l = trie_nextleaf(l);
-                memset(&cb->args[3], 0,
-                       sizeof(cb->args) - 3*sizeof(cb->args[0]));
+                memset(&cb->args[4], 0,
+                       sizeof(cb->args) - 4*sizeof(cb->args[0]));
         }
+        cb->args[3] = count;
         rcu_read_unlock();
 
         return skb->len;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 7801cceb2d1b..de5a41de191a 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -87,6 +87,7 @@ int inet_csk_get_port(struct inet_hashinfo *hashinfo,
         struct hlist_node *node;
         struct inet_bind_bucket *tb;
         int ret;
+        struct net *net = sk->sk_net;
 
         local_bh_disable();
         if (!snum) {
@@ -100,7 +101,7 @@ int inet_csk_get_port(struct inet_hashinfo *hashinfo,
                         head = &hashinfo->bhash[inet_bhashfn(rover, hashinfo->bhash_size)];
                         spin_lock(&head->lock);
                         inet_bind_bucket_for_each(tb, node, &head->chain)
-                                if (tb->port == rover)
+                                if (tb->ib_net == net && tb->port == rover)
                                         goto next;
                         break;
                 next:
@@ -127,7 +128,7 @@ int inet_csk_get_port(struct inet_hashinfo *hashinfo,
                 head = &hashinfo->bhash[inet_bhashfn(snum, hashinfo->bhash_size)];
                 spin_lock(&head->lock);
                 inet_bind_bucket_for_each(tb, node, &head->chain)
-                        if (tb->port == snum)
+                        if (tb->ib_net == net && tb->port == snum)
                                 goto tb_found;
         }
         tb = NULL;
@@ -147,7 +148,8 @@ tb_found:
         }
 tb_not_found:
         ret = 1;
-        if (!tb && (tb = inet_bind_bucket_create(hashinfo->bind_bucket_cachep, head, snum)) == NULL)
+        if (!tb && (tb = inet_bind_bucket_create(hashinfo->bind_bucket_cachep,
+                                        net, head, snum)) == NULL)
                 goto fail_unlock;
         if (hlist_empty(&tb->owners)) {
                 if (sk->sk_reuse && sk->sk_state != TCP_LISTEN)
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 605ed2cd7972..da97695e7096 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -259,20 +259,22 @@ static int inet_diag_get_exact(struct sk_buff *in_skb,
         const struct inet_diag_handler *handler;
 
         handler = inet_diag_lock_handler(nlh->nlmsg_type);
-        if (!handler)
-                return -ENOENT;
+        if (IS_ERR(handler)) {
+                err = PTR_ERR(handler);
+                goto unlock;
+        }
 
         hashinfo = handler->idiag_hashinfo;
         err = -EINVAL;
 
         if (req->idiag_family == AF_INET) {
-                sk = inet_lookup(hashinfo, req->id.idiag_dst[0],
+                sk = inet_lookup(&init_net, hashinfo, req->id.idiag_dst[0],
                                  req->id.idiag_dport, req->id.idiag_src[0],
                                  req->id.idiag_sport, req->id.idiag_if);
         }
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
         else if (req->idiag_family == AF_INET6) {
-                sk = inet6_lookup(hashinfo,
+                sk = inet6_lookup(&init_net, hashinfo,
                                   (struct in6_addr *)req->id.idiag_dst,
                                   req->id.idiag_dport,
                                   (struct in6_addr *)req->id.idiag_src,
@@ -708,8 +710,8 @@ static int inet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb)
         struct inet_hashinfo *hashinfo;
 
         handler = inet_diag_lock_handler(cb->nlh->nlmsg_type);
-        if (!handler)
-                goto no_handler;
+        if (IS_ERR(handler))
+                goto unlock;
 
         hashinfo = handler->idiag_hashinfo;
 
@@ -838,7 +840,6 @@ done:
         cb->args[2] = num;
 unlock:
         inet_diag_unlock_handler(handler);
-no_handler:
         return skb->len;
 }
 
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 619c63c6948a..48d45008f749 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -28,12 +28,14 @@
  * The bindhash mutex for snum's hash chain must be held here.
  */
 struct inet_bind_bucket *inet_bind_bucket_create(struct kmem_cache *cachep,
+                                                 struct net *net,
                                                  struct inet_bind_hashbucket *head,
                                                  const unsigned short snum)
 {
         struct inet_bind_bucket *tb = kmem_cache_alloc(cachep, GFP_ATOMIC);
 
         if (tb != NULL) {
+                tb->ib_net       = net;
                 tb->port      = snum;
                 tb->fastreuse = 0;
                 INIT_HLIST_HEAD(&tb->owners);
@@ -125,7 +127,8 @@ EXPORT_SYMBOL(inet_listen_wlock);
  * remote address for the connection. So always assume those are both
  * wildcarded during the search since they can never be otherwise.
  */
-static struct sock *inet_lookup_listener_slow(const struct hlist_head *head,
+static struct sock *inet_lookup_listener_slow(struct net *net,
+                                              const struct hlist_head *head,
                                               const __be32 daddr,
                                               const unsigned short hnum,
                                               const int dif)
@@ -137,7 +140,8 @@ static struct sock *inet_lookup_listener_slow(const struct hlist_head *head,
         sk_for_each(sk, node, head) {
                 const struct inet_sock *inet = inet_sk(sk);
 
-                if (inet->num == hnum && !ipv6_only_sock(sk)) {
+                if (sk->sk_net == net && inet->num == hnum &&
+                                !ipv6_only_sock(sk)) {
                         const __be32 rcv_saddr = inet->rcv_saddr;
                         int score = sk->sk_family == PF_INET ? 1 : 0;
 
@@ -163,7 +167,8 @@ static struct sock *inet_lookup_listener_slow(const struct hlist_head *head,
 }
 
 /* Optimize the common listener case. */
-struct sock *__inet_lookup_listener(struct inet_hashinfo *hashinfo,
+struct sock *__inet_lookup_listener(struct net *net,
+                                    struct inet_hashinfo *hashinfo,
                                     const __be32 daddr, const unsigned short hnum,
                                     const int dif)
 {
@@ -178,9 +183,9 @@ struct sock *__inet_lookup_listener(struct inet_hashinfo *hashinfo,
                 if (inet->num == hnum && !sk->sk_node.next &&
                     (!inet->rcv_saddr || inet->rcv_saddr == daddr) &&
                     (sk->sk_family == PF_INET || !ipv6_only_sock(sk)) &&
-                    !sk->sk_bound_dev_if)
+                    !sk->sk_bound_dev_if && sk->sk_net == net)
                         goto sherry_cache;
-                sk = inet_lookup_listener_slow(head, daddr, hnum, dif);
+                sk = inet_lookup_listener_slow(net, head, daddr, hnum, dif);
         }
         if (sk) {
 sherry_cache:
@@ -191,7 +196,8 @@ sherry_cache:
 }
 EXPORT_SYMBOL_GPL(__inet_lookup_listener);
 
-struct sock * __inet_lookup_established(struct inet_hashinfo *hashinfo,
+struct sock * __inet_lookup_established(struct net *net,
+                                  struct inet_hashinfo *hashinfo,
                                   const __be32 saddr, const __be16 sport,
                                   const __be32 daddr, const u16 hnum,
                                   const int dif)
@@ -210,13 +216,15 @@ struct sock * __inet_lookup_established(struct inet_hashinfo *hashinfo,
         prefetch(head->chain.first);
         read_lock(lock);
         sk_for_each(sk, node, &head->chain) {
-                if (INET_MATCH(sk, hash, acookie, saddr, daddr, ports, dif))
+                if (INET_MATCH(sk, net, hash, acookie,
+                                        saddr, daddr, ports, dif))
                         goto hit; /* You sunk my battleship! */
         }
 
         /* Must check for a TIME_WAIT'er before going to listener hash. */
         sk_for_each(sk, node, &head->twchain) {
-                if (INET_TW_MATCH(sk, hash, acookie, saddr, daddr, ports, dif))
+                if (INET_TW_MATCH(sk, net, hash, acookie,
+                                        saddr, daddr, ports, dif))
                         goto hit;
         }
         sk = NULL;
@@ -247,6 +255,7 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
         struct sock *sk2;
         const struct hlist_node *node;
         struct inet_timewait_sock *tw;
+        struct net *net = sk->sk_net;
 
         prefetch(head->chain.first);
         write_lock(lock);
@@ -255,7 +264,8 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
         sk_for_each(sk2, node, &head->twchain) {
                 tw = inet_twsk(sk2);
 
-                if (INET_TW_MATCH(sk2, hash, acookie, saddr, daddr, ports, dif)) {
+                if (INET_TW_MATCH(sk2, net, hash, acookie,
+                                        saddr, daddr, ports, dif)) {
                         if (twsk_unique(sk, sk2, twp))
                                 goto unique;
                         else
@@ -266,7 +276,8 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,
 
         /* And established part... */
         sk_for_each(sk2, node, &head->chain) {
-                if (INET_MATCH(sk2, hash, acookie, saddr, daddr, ports, dif))
+                if (INET_MATCH(sk2, net, hash, acookie,
+                                        saddr, daddr, ports, dif))
                         goto not_unique;
         }
 
@@ -348,17 +359,18 @@ void __inet_hash(struct inet_hashinfo *hashinfo, struct sock *sk)
 }
 EXPORT_SYMBOL_GPL(__inet_hash);
 
-/*
- * Bind a port for a connect operation and hash it.
- */
-int inet_hash_connect(struct inet_timewait_death_row *death_row,
-                      struct sock *sk)
+int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+                struct sock *sk,
+                int (*check_established)(struct inet_timewait_death_row *,
+                        struct sock *, __u16, struct inet_timewait_sock **),
+                void (*hash)(struct inet_hashinfo *, struct sock *))
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
         const unsigned short snum = inet_sk(sk)->num;
         struct inet_bind_hashbucket *head;
         struct inet_bind_bucket *tb;
         int ret;
+        struct net *net = sk->sk_net;
 
         if (!snum) {
                 int i, remaining, low, high, port;
@@ -381,19 +393,19 @@ int inet_hash_connect(struct inet_timewait_death_row *death_row,
                          * unique enough.
                          */
                         inet_bind_bucket_for_each(tb, node, &head->chain) {
-                                if (tb->port == port) {
+                                if (tb->ib_net == net && tb->port == port) {
                                         BUG_TRAP(!hlist_empty(&tb->owners));
                                         if (tb->fastreuse >= 0)
                                                 goto next_port;
-                                        if (!__inet_check_established(death_row,
-                                                                      sk, port,
-                                                                      &tw))
+                                        if (!check_established(death_row, sk,
+                                                                port, &tw))
                                                 goto ok;
                                         goto next_port;
                                 }
                         }
 
-                        tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep, head, port);
+                        tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep,
+                                        net, head, port);
                         if (!tb) {
                                 spin_unlock(&head->lock);
                                 break;
@@ -415,7 +427,7 @@ ok:
                 inet_bind_hash(sk, tb, port);
                 if (sk_unhashed(sk)) {
                         inet_sk(sk)->sport = htons(port);
-                        __inet_hash_nolisten(hinfo, sk);
+                        hash(hinfo, sk);
                 }
                 spin_unlock(&head->lock);
 
@@ -432,17 +444,28 @@ ok:
         tb  = inet_csk(sk)->icsk_bind_hash;
         spin_lock_bh(&head->lock);
         if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
-                __inet_hash_nolisten(hinfo, sk);
+                hash(hinfo, sk);
                 spin_unlock_bh(&head->lock);
                 return 0;
         } else {
                 spin_unlock(&head->lock);
                 /* No definite answer... Walk to established hash table */
-                ret = __inet_check_established(death_row, sk, snum, NULL);
+                ret = check_established(death_row, sk, snum, NULL);
 out:
                 local_bh_enable();
                 return ret;
         }
 }
+EXPORT_SYMBOL_GPL(__inet_hash_connect);
+
+/*
+ * Bind a port for a connect operation and hash it.
+ */
+int inet_hash_connect(struct inet_timewait_death_row *death_row,
+                      struct sock *sk)
+{
+        return __inet_hash_connect(death_row, sk,
+                        __inet_check_established, __inet_hash_nolisten);
+}
 
 EXPORT_SYMBOL_GPL(inet_hash_connect);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 18070ca65771..341779e685d9 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -168,6 +168,7 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
         }
 
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
 
         /* Send it out. */
         return ip_local_out(skb);
@@ -385,6 +386,7 @@ packet_routed:
                              (skb_shinfo(skb)->gso_segs ?: 1) - 1);
 
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
 
         return ip_local_out(skb);
 
@@ -476,6 +478,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
         if (skb_shinfo(skb)->frag_list) {
                 struct sk_buff *frag;
                 int first_len = skb_pagelen(skb);
+                int truesizes = 0;
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
@@ -499,7 +502,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
                                 sock_hold(skb->sk);
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
-                                skb->truesize -= frag->truesize;
+                                truesizes += frag->truesize;
                         }
                 }
 
@@ -510,6 +513,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
                 frag = skb_shinfo(skb)->frag_list;
                 skb_shinfo(skb)->frag_list = NULL;
                 skb->data_len = first_len - skb_headlen(skb);
+                skb->truesize -= truesizes;
                 skb->len = first_len;
                 iph->tot_len = htons(first_len);
                 iph->frag_off = htons(IP_MF);
@@ -1284,6 +1288,7 @@ int ip_push_pending_frames(struct sock *sk)
         iph->daddr = rt->rt_dst;
 
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
         skb->dst = dst_clone(&rt->u.dst);
 
         if (iph->protocol == IPPROTO_ICMP)
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index f4af99ad8fdb..ae1f45fc23b9 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -74,6 +74,7 @@ out:
 
 static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
 {
+        int nexthdr;
         int err = -ENOMEM;
         struct ip_comp_hdr *ipch;
 
@@ -84,13 +85,15 @@ static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
 
         /* Remove ipcomp header and decompress original payload */
         ipch = (void *)skb->data;
+        nexthdr = ipch->nexthdr;
+
         skb->transport_header = skb->network_header + sizeof(*ipch);
         __skb_pull(skb, sizeof(*ipch));
         err = ipcomp_decompress(x, skb);
         if (err)
                 goto out;
 
-        err = ipch->nexthdr;
+        err = nexthdr;
 
 out:
         return err;
@@ -434,7 +437,7 @@ error:
         goto out;
 }
 
-static struct xfrm_type ipcomp_type = {
+static const struct xfrm_type ipcomp_type = {
         .description    = "IPCOMP4",
         .owner          = THIS_MODULE,
         .proto          = IPPROTO_COMP,
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index b4a810c28ac8..a7591ce344d2 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -22,6 +22,7 @@
 #include <linux/mutex.h>
 #include <linux/err.h>
 #include <net/compat.h>
+#include <net/sock.h>
 #include <asm/uaccess.h>
 
 #include <linux/netfilter/x_tables.h>
@@ -850,7 +851,7 @@ static int compat_table_info(const struct xt_table_info *info,
 }
 #endif
 
-static int get_info(void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user, int *len, int compat)
 {
         char name[ARPT_TABLE_MAXNAMELEN];
         struct arpt_table *t;
@@ -870,7 +871,7 @@ static int get_info(void __user *user, int *len, int compat)
         if (compat)
                 xt_compat_lock(NF_ARP);
 #endif
-        t = try_then_request_module(xt_find_table_lock(NF_ARP, name),
+        t = try_then_request_module(xt_find_table_lock(net, NF_ARP, name),
                                     "arptable_%s", name);
         if (t && !IS_ERR(t)) {
                 struct arpt_getinfo info;
@@ -908,7 +909,8 @@ static int get_info(void __user *user, int *len, int compat)
         return ret;
 }
 
-static int get_entries(struct arpt_get_entries __user *uptr, int *len)
+static int get_entries(struct net *net, struct arpt_get_entries __user *uptr,
+                       int *len)
 {
         int ret;
         struct arpt_get_entries get;
@@ -926,7 +928,7 @@ static int get_entries(struct arpt_get_entries __user *uptr, int *len)
                 return -EINVAL;
         }
 
-        t = xt_find_table_lock(NF_ARP, get.name);
+        t = xt_find_table_lock(net, NF_ARP, get.name);
         if (t && !IS_ERR(t)) {
                 struct xt_table_info *private = t->private;
                 duprintf("t->private->number = %u\n",
@@ -947,7 +949,8 @@ static int get_entries(struct arpt_get_entries __user *uptr, int *len)
         return ret;
 }
 
-static int __do_replace(const char *name, unsigned int valid_hooks,
+static int __do_replace(struct net *net, const char *name,
+                        unsigned int valid_hooks,
                         struct xt_table_info *newinfo,
                         unsigned int num_counters,
                         void __user *counters_ptr)
@@ -966,7 +969,7 @@ static int __do_replace(const char *name, unsigned int valid_hooks,
                 goto out;
         }
 
-        t = try_then_request_module(xt_find_table_lock(NF_ARP, name),
+        t = try_then_request_module(xt_find_table_lock(net, NF_ARP, name),
                                     "arptable_%s", name);
         if (!t || IS_ERR(t)) {
                 ret = t ? PTR_ERR(t) : -ENOENT;
@@ -1019,7 +1022,7 @@ static int __do_replace(const char *name, unsigned int valid_hooks,
         return ret;
 }
 
-static int do_replace(void __user *user, unsigned int len)
+static int do_replace(struct net *net, void __user *user, unsigned int len)
 {
         int ret;
         struct arpt_replace tmp;
@@ -1053,7 +1056,7 @@ static int do_replace(void __user *user, unsigned int len)
 
         duprintf("arp_tables: Translated table\n");
 
-        ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+        ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
                            tmp.num_counters, tmp.counters);
         if (ret)
                 goto free_newinfo_untrans;
@@ -1080,7 +1083,8 @@ static inline int add_counter_to_entry(struct arpt_entry *e,
         return 0;
 }
 
-static int do_add_counters(void __user *user, unsigned int len, int compat)
+static int do_add_counters(struct net *net, void __user *user, unsigned int len,
+                           int compat)
 {
         unsigned int i;
         struct xt_counters_info tmp;
@@ -1132,7 +1136,7 @@ static int do_add_counters(void __user *user, unsigned int len, int compat)
                 goto free;
         }
 
-        t = xt_find_table_lock(NF_ARP, name);
+        t = xt_find_table_lock(net, NF_ARP, name);
         if (!t || IS_ERR(t)) {
                 ret = t ? PTR_ERR(t) : -ENOENT;
                 goto free;
@@ -1435,7 +1439,8 @@ struct compat_arpt_replace {
         struct compat_arpt_entry        entries[0];
 };
 
-static int compat_do_replace(void __user *user, unsigned int len)
+static int compat_do_replace(struct net *net, void __user *user,
+                             unsigned int len)
 {
         int ret;
         struct compat_arpt_replace tmp;
@@ -1471,7 +1476,7 @@ static int compat_do_replace(void __user *user, unsigned int len)
 
         duprintf("compat_do_replace: Translated table\n");
 
-        ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+        ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
                            tmp.num_counters, compat_ptr(tmp.counters));
         if (ret)
                 goto free_newinfo_untrans;
@@ -1494,11 +1499,11 @@ static int compat_do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user,
 
         switch (cmd) {
         case ARPT_SO_SET_REPLACE:
-                ret = compat_do_replace(user, len);
+                ret = compat_do_replace(sk->sk_net, user, len);
                 break;
 
         case ARPT_SO_SET_ADD_COUNTERS:
-                ret = do_add_counters(user, len, 1);
+                ret = do_add_counters(sk->sk_net, user, len, 1);
                 break;
 
         default:
@@ -1584,7 +1589,8 @@ struct compat_arpt_get_entries {
         struct compat_arpt_entry entrytable[0];
 };
 
-static int compat_get_entries(struct compat_arpt_get_entries __user *uptr,
+static int compat_get_entries(struct net *net,
+                              struct compat_arpt_get_entries __user *uptr,
                               int *len)
 {
         int ret;
@@ -1604,7 +1610,7 @@ static int compat_get_entries(struct compat_arpt_get_entries __user *uptr,
         }
 
         xt_compat_lock(NF_ARP);
-        t = xt_find_table_lock(NF_ARP, get.name);
+        t = xt_find_table_lock(net, NF_ARP, get.name);
         if (t && !IS_ERR(t)) {
                 struct xt_table_info *private = t->private;
                 struct xt_table_info info;
@@ -1641,10 +1647,10 @@ static int compat_do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user,
 
         switch (cmd) {
         case ARPT_SO_GET_INFO:
-                ret = get_info(user, len, 1);
+                ret = get_info(sk->sk_net, user, len, 1);
                 break;
         case ARPT_SO_GET_ENTRIES:
-                ret = compat_get_entries(user, len);
+                ret = compat_get_entries(sk->sk_net, user, len);
                 break;
         default:
                 ret = do_arpt_get_ctl(sk, cmd, user, len);
@@ -1662,11 +1668,11 @@ static int do_arpt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned
 
         switch (cmd) {
         case ARPT_SO_SET_REPLACE:
-                ret = do_replace(user, len);
+                ret = do_replace(sk->sk_net, user, len);
                 break;
 
         case ARPT_SO_SET_ADD_COUNTERS:
-                ret = do_add_counters(user, len, 0);
+                ret = do_add_counters(sk->sk_net, user, len, 0);
                 break;
 
         default:
@@ -1686,11 +1692,11 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
 
         switch (cmd) {
         case ARPT_SO_GET_INFO:
-                ret = get_info(user, len, 0);
+                ret = get_info(sk->sk_net, user, len, 0);
                 break;
 
         case ARPT_SO_GET_ENTRIES:
-                ret = get_entries(user, len);
+                ret = get_entries(sk->sk_net, user, len);
                 break;
 
         case ARPT_SO_GET_REVISION_TARGET: {
@@ -1719,19 +1725,21 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
         return ret;
 }
 
-int arpt_register_table(struct arpt_table *table,
-                        const struct arpt_replace *repl)
+struct arpt_table *arpt_register_table(struct net *net,
+                                       struct arpt_table *table,
+                                       const struct arpt_replace *repl)
 {
         int ret;
         struct xt_table_info *newinfo;
         struct xt_table_info bootstrap
                 = { 0, 0, 0, { 0 }, { 0 }, { } };
         void *loc_cpu_entry;
+        struct xt_table *new_table;
 
         newinfo = xt_alloc_table_info(repl->size);
         if (!newinfo) {
                 ret = -ENOMEM;
-                return ret;
+                goto out;
         }
 
         /* choose the copy on our node/cpu */
@@ -1745,24 +1753,27 @@ int arpt_register_table(struct arpt_table *table,
                               repl->underflow);
 
         duprintf("arpt_register_table: translate table gives %d\n", ret);
-        if (ret != 0) {
-                xt_free_table_info(newinfo);
-                return ret;
-        }
+        if (ret != 0)
+                goto out_free;
 
-        ret = xt_register_table(table, &bootstrap, newinfo);
-        if (ret != 0) {
-                xt_free_table_info(newinfo);
-                return ret;
+        new_table = xt_register_table(net, table, &bootstrap, newinfo);
+        if (IS_ERR(new_table)) {
+                ret = PTR_ERR(new_table);
+                goto out_free;
         }
+        return new_table;
 
-        return 0;
+out_free:
+        xt_free_table_info(newinfo);
+out:
+        return ERR_PTR(ret);
 }
 
 void arpt_unregister_table(struct arpt_table *table)
 {
         struct xt_table_info *private;
         void *loc_cpu_entry;
+        struct module *table_owner = table->me;
 
         private = xt_unregister_table(table);
 
@@ -1770,6 +1781,8 @@ void arpt_unregister_table(struct arpt_table *table)
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
         ARPT_ENTRY_ITERATE(loc_cpu_entry, private->size,
                            cleanup_entry, NULL);
+        if (private->number > private->initial_entries)
+                module_put(table_owner);
         xt_free_table_info(private);
 }
 
@@ -1809,11 +1822,26 @@ static struct nf_sockopt_ops arpt_sockopts = {
         .owner          = THIS_MODULE,
 };
 
+static int __net_init arp_tables_net_init(struct net *net)
+{
+        return xt_proto_init(net, NF_ARP);
+}
+
+static void __net_exit arp_tables_net_exit(struct net *net)
+{
+        xt_proto_fini(net, NF_ARP);
+}
+
+static struct pernet_operations arp_tables_net_ops = {
+        .init = arp_tables_net_init,
+        .exit = arp_tables_net_exit,
+};
+
 static int __init arp_tables_init(void)
 {
         int ret;
 
-        ret = xt_proto_init(NF_ARP);
+        ret = register_pernet_subsys(&arp_tables_net_ops);
         if (ret < 0)
                 goto err1;
 
@@ -1838,7 +1866,7 @@ err4:
 err3:
         xt_unregister_target(&arpt_standard_target);
 err2:
-        xt_proto_fini(NF_ARP);
+        unregister_pernet_subsys(&arp_tables_net_ops);
 err1:
         return ret;
 }
@@ -1848,7 +1876,7 @@ static void __exit arp_tables_fini(void)
         nf_unregister_sockopt(&arpt_sockopts);
         xt_unregister_target(&arpt_error_target);
         xt_unregister_target(&arpt_standard_target);
-        xt_proto_fini(NF_ARP);
+        unregister_pernet_subsys(&arp_tables_net_ops);
 }
 
 EXPORT_SYMBOL(arpt_register_table);
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 7201511d54d2..4e9c496a30c2 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -20,7 +20,7 @@ static struct
         struct arpt_replace repl;
         struct arpt_standard entries[3];
         struct arpt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "filter",
                 .valid_hooks = FILTER_VALID_HOOKS,
@@ -61,7 +61,7 @@ static unsigned int arpt_hook(unsigned int hook,
                               const struct net_device *out,
                               int (*okfn)(struct sk_buff *))
 {
-        return arpt_do_table(skb, hook, in, out, &packet_filter);
+        return arpt_do_table(skb, hook, in, out, init_net.ipv4.arptable_filter);
 }
 
 static struct nf_hook_ops arpt_ops[] __read_mostly = {
@@ -85,12 +85,31 @@ static struct nf_hook_ops arpt_ops[] __read_mostly = {
         },
 };
 
+static int __net_init arptable_filter_net_init(struct net *net)
+{
+        /* Register table */
+        net->ipv4.arptable_filter =
+                arpt_register_table(net, &packet_filter, &initial_table.repl);
+        if (IS_ERR(net->ipv4.arptable_filter))
+                return PTR_ERR(net->ipv4.arptable_filter);
+        return 0;
+}
+
+static void __net_exit arptable_filter_net_exit(struct net *net)
+{
+        arpt_unregister_table(net->ipv4.arptable_filter);
+}
+
+static struct pernet_operations arptable_filter_net_ops = {
+        .init = arptable_filter_net_init,
+        .exit = arptable_filter_net_exit,
+};
+
 static int __init arptable_filter_init(void)
 {
         int ret;
 
-        /* Register table */
-        ret = arpt_register_table(&packet_filter, &initial_table.repl);
+        ret = register_pernet_subsys(&arptable_filter_net_ops);
         if (ret < 0)
                 return ret;
 
@@ -100,14 +119,14 @@ static int __init arptable_filter_init(void)
         return ret;
 
 cleanup_table:
-        arpt_unregister_table(&packet_filter);
+        unregister_pernet_subsys(&arptable_filter_net_ops);
         return ret;
 }
 
 static void __exit arptable_filter_fini(void)
 {
         nf_unregister_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
-        arpt_unregister_table(&packet_filter);
+        unregister_pernet_subsys(&arptable_filter_net_ops);
 }
 
 module_init(arptable_filter_init);
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 5109839da222..6bda1102851b 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -512,6 +512,7 @@ static struct notifier_block ipq_nl_notifier = {
         .notifier_call  = ipq_rcv_nl_event,
 };
 
+#ifdef CONFIG_SYSCTL
 static struct ctl_table_header *ipq_sysctl_header;
 
 static ctl_table ipq_table[] = {
@@ -525,7 +526,9 @@ static ctl_table ipq_table[] = {
         },
         { .ctl_name = 0 }
 };
+#endif
 
+#ifdef CONFIG_PROC_FS
 static int ip_queue_show(struct seq_file *m, void *v)
 {
         read_lock_bh(&queue_lock);
@@ -562,6 +565,7 @@ static const struct file_operations ip_queue_proc_fops = {
         .release        = single_release,
         .owner          = THIS_MODULE,
 };
+#endif
 
 static const struct nf_queue_handler nfqh = {
         .name   = "ip_queue",
@@ -571,7 +575,7 @@ static const struct nf_queue_handler nfqh = {
 static int __init ip_queue_init(void)
 {
         int status = -ENOMEM;
-        struct proc_dir_entry *proc;
+        struct proc_dir_entry *proc __maybe_unused;
 
         netlink_register_notifier(&ipq_nl_notifier);
         ipqnl = netlink_kernel_create(&init_net, NETLINK_FIREWALL, 0,
@@ -581,6 +585,7 @@ static int __init ip_queue_init(void)
                 goto cleanup_netlink_notifier;
         }
 
+#ifdef CONFIG_PROC_FS
         proc = create_proc_entry(IPQ_PROC_FS_NAME, 0, init_net.proc_net);
         if (proc) {
                 proc->owner = THIS_MODULE;
@@ -589,10 +594,11 @@ static int __init ip_queue_init(void)
                 printk(KERN_ERR "ip_queue: failed to create proc entry\n");
                 goto cleanup_ipqnl;
         }
-
+#endif
         register_netdevice_notifier(&ipq_dev_notifier);
+#ifdef CONFIG_SYSCTL
         ipq_sysctl_header = register_sysctl_paths(net_ipv4_ctl_path, ipq_table);
-
+#endif
         status = nf_register_queue_handler(PF_INET, &nfqh);
         if (status < 0) {
                 printk(KERN_ERR "ip_queue: failed to register queue handler\n");
@@ -601,10 +607,12 @@ static int __init ip_queue_init(void)
         return status;
 
 cleanup_sysctl:
+#ifdef CONFIG_SYSCTL
         unregister_sysctl_table(ipq_sysctl_header);
+#endif
         unregister_netdevice_notifier(&ipq_dev_notifier);
         proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
-cleanup_ipqnl:
+cleanup_ipqnl: __maybe_unused
         netlink_kernel_release(ipqnl);
         mutex_lock(&ipqnl_mutex);
         mutex_unlock(&ipqnl_mutex);
@@ -620,7 +628,9 @@ static void __exit ip_queue_fini(void)
         synchronize_net();
         ipq_flush(NULL, 0);
 
+#ifdef CONFIG_SYSCTL
         unregister_sysctl_table(ipq_sysctl_header);
+#endif
         unregister_netdevice_notifier(&ipq_dev_notifier);
         proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
 
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 982b7f986291..600737f122d2 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -291,7 +291,7 @@ static void trace_packet(struct sk_buff *skb,
                          unsigned int hook,
                          const struct net_device *in,
                          const struct net_device *out,
-                         char *tablename,
+                         const char *tablename,
                          struct xt_table_info *private,
                          struct ipt_entry *e)
 {
@@ -1092,7 +1092,7 @@ static int compat_table_info(const struct xt_table_info *info,
 }
 #endif
 
-static int get_info(void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user, int *len, int compat)
 {
         char name[IPT_TABLE_MAXNAMELEN];
         struct xt_table *t;
@@ -1112,7 +1112,7 @@ static int get_info(void __user *user, int *len, int compat)
         if (compat)
                 xt_compat_lock(AF_INET);
 #endif
-        t = try_then_request_module(xt_find_table_lock(AF_INET, name),
+        t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
                                     "iptable_%s", name);
         if (t && !IS_ERR(t)) {
                 struct ipt_getinfo info;
@@ -1152,7 +1152,7 @@ static int get_info(void __user *user, int *len, int compat)
 }
 
 static int
-get_entries(struct ipt_get_entries __user *uptr, int *len)
+get_entries(struct net *net, struct ipt_get_entries __user *uptr, int *len)
 {
         int ret;
         struct ipt_get_entries get;
@@ -1170,7 +1170,7 @@ get_entries(struct ipt_get_entries __user *uptr, int *len)
                 return -EINVAL;
         }
 
-        t = xt_find_table_lock(AF_INET, get.name);
+        t = xt_find_table_lock(net, AF_INET, get.name);
         if (t && !IS_ERR(t)) {
                 struct xt_table_info *private = t->private;
                 duprintf("t->private->number = %u\n", private->number);
@@ -1191,7 +1191,7 @@ get_entries(struct ipt_get_entries __user *uptr, int *len)
 }
 
 static int
-__do_replace(const char *name, unsigned int valid_hooks,
+__do_replace(struct net *net, const char *name, unsigned int valid_hooks,
              struct xt_table_info *newinfo, unsigned int num_counters,
              void __user *counters_ptr)
 {
@@ -1208,7 +1208,7 @@ __do_replace(const char *name, unsigned int valid_hooks,
                 goto out;
         }
 
-        t = try_then_request_module(xt_find_table_lock(AF_INET, name),
+        t = try_then_request_module(xt_find_table_lock(net, AF_INET, name),
                                     "iptable_%s", name);
         if (!t || IS_ERR(t)) {
                 ret = t ? PTR_ERR(t) : -ENOENT;
@@ -1261,7 +1261,7 @@ __do_replace(const char *name, unsigned int valid_hooks,
 }
 
 static int
-do_replace(void __user *user, unsigned int len)
+do_replace(struct net *net, void __user *user, unsigned int len)
 {
         int ret;
         struct ipt_replace tmp;
@@ -1295,7 +1295,7 @@ do_replace(void __user *user, unsigned int len)
 
         duprintf("ip_tables: Translated table\n");
 
-        ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+        ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
                            tmp.num_counters, tmp.counters);
         if (ret)
                 goto free_newinfo_untrans;
@@ -1331,7 +1331,7 @@ add_counter_to_entry(struct ipt_entry *e,
 }
 
 static int
-do_add_counters(void __user *user, unsigned int len, int compat)
+do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)
 {
         unsigned int i;
         struct xt_counters_info tmp;
@@ -1383,7 +1383,7 @@ do_add_counters(void __user *user, unsigned int len, int compat)
                 goto free;
         }
 
-        t = xt_find_table_lock(AF_INET, name);
+        t = xt_find_table_lock(net, AF_INET, name);
         if (!t || IS_ERR(t)) {
                 ret = t ? PTR_ERR(t) : -ENOENT;
                 goto free;
@@ -1429,7 +1429,7 @@ struct compat_ipt_replace {
 
 static int
 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
-                          compat_uint_t *size, struct xt_counters *counters,
+                          unsigned int *size, struct xt_counters *counters,
                           unsigned int *i)
 {
         struct ipt_entry_target *t;
@@ -1476,7 +1476,7 @@ compat_find_calc_match(struct ipt_entry_match *m,
                        const char *name,
                        const struct ipt_ip *ip,
                        unsigned int hookmask,
-                       int *size, int *i)
+                       int *size, unsigned int *i)
 {
         struct xt_match *match;
 
@@ -1534,7 +1534,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
         struct ipt_entry_target *t;
         struct xt_target *target;
         unsigned int entry_offset;
-        int ret, off, h, j;
+        unsigned int j;
+        int ret, off, h;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
         if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
@@ -1647,7 +1648,8 @@ static int
 compat_check_entry(struct ipt_entry *e, const char *name,
                                      unsigned int *i)
 {
-        int j, ret;
+        unsigned int j;
+        int ret;
 
         j = 0;
         ret = IPT_MATCH_ITERATE(e, check_match, name, &e->ip,
@@ -1789,7 +1791,7 @@ out_unlock:
 }
 
 static int
-compat_do_replace(void __user *user, unsigned int len)
+compat_do_replace(struct net *net, void __user *user, unsigned int len)
 {
         int ret;
         struct compat_ipt_replace tmp;
@@ -1826,7 +1828,7 @@ compat_do_replace(void __user *user, unsigned int len)
 
         duprintf("compat_do_replace: Translated table\n");
 
-        ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+        ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
                            tmp.num_counters, compat_ptr(tmp.counters));
         if (ret)
                 goto free_newinfo_untrans;
@@ -1850,11 +1852,11 @@ compat_do_ipt_set_ctl(struct sock *sk,	int cmd, void __user *user,
 
         switch (cmd) {
         case IPT_SO_SET_REPLACE:
-                ret = compat_do_replace(user, len);
+                ret = compat_do_replace(sk->sk_net, user, len);
                 break;
 
         case IPT_SO_SET_ADD_COUNTERS:
-                ret = do_add_counters(user, len, 1);
+                ret = do_add_counters(sk->sk_net, user, len, 1);
                 break;
 
         default:
@@ -1903,7 +1905,8 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
 }
 
 static int
-compat_get_entries(struct compat_ipt_get_entries __user *uptr, int *len)
+compat_get_entries(struct net *net, struct compat_ipt_get_entries __user *uptr,
+                   int *len)
 {
         int ret;
         struct compat_ipt_get_entries get;
@@ -1924,7 +1927,7 @@ compat_get_entries(struct compat_ipt_get_entries __user *uptr, int *len)
         }
 
         xt_compat_lock(AF_INET);
-        t = xt_find_table_lock(AF_INET, get.name);
+        t = xt_find_table_lock(net, AF_INET, get.name);
         if (t && !IS_ERR(t)) {
                 struct xt_table_info *private = t->private;
                 struct xt_table_info info;
@@ -1960,10 +1963,10 @@ compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 
         switch (cmd) {
         case IPT_SO_GET_INFO:
-                ret = get_info(user, len, 1);
+                ret = get_info(sk->sk_net, user, len, 1);
                 break;
         case IPT_SO_GET_ENTRIES:
-                ret = compat_get_entries(user, len);
+                ret = compat_get_entries(sk->sk_net, user, len);
                 break;
         default:
                 ret = do_ipt_get_ctl(sk, cmd, user, len);
@@ -1982,11 +1985,11 @@ do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 
         switch (cmd) {
         case IPT_SO_SET_REPLACE:
-                ret = do_replace(user, len);
+                ret = do_replace(sk->sk_net, user, len);
                 break;
 
         case IPT_SO_SET_ADD_COUNTERS:
-                ret = do_add_counters(user, len, 0);
+                ret = do_add_counters(sk->sk_net, user, len, 0);
                 break;
 
         default:
@@ -2007,11 +2010,11 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 
         switch (cmd) {
         case IPT_SO_GET_INFO:
-                ret = get_info(user, len, 0);
+                ret = get_info(sk->sk_net, user, len, 0);
                 break;
 
         case IPT_SO_GET_ENTRIES:
-                ret = get_entries(user, len);
+                ret = get_entries(sk->sk_net, user, len);
                 break;
 
         case IPT_SO_GET_REVISION_MATCH:
@@ -2048,17 +2051,21 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         return ret;
 }
 
-int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
+struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
+                                    const struct ipt_replace *repl)
 {
         int ret;
         struct xt_table_info *newinfo;
         struct xt_table_info bootstrap
                 = { 0, 0, 0, { 0 }, { 0 }, { } };
         void *loc_cpu_entry;
+        struct xt_table *new_table;
 
         newinfo = xt_alloc_table_info(repl->size);
-        if (!newinfo)
-                return -ENOMEM;
+        if (!newinfo) {
+                ret = -ENOMEM;
+                goto out;
+        }
 
         /* choose the copy on our node/cpu, but dont care about preemption */
         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
@@ -2069,30 +2076,36 @@ int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
                               repl->num_entries,
                               repl->hook_entry,
                               repl->underflow);
-        if (ret != 0) {
-                xt_free_table_info(newinfo);
-                return ret;
-        }
+        if (ret != 0)
+                goto out_free;
 
-        ret = xt_register_table(table, &bootstrap, newinfo);
-        if (ret != 0) {
-                xt_free_table_info(newinfo);
-                return ret;
+        new_table = xt_register_table(net, table, &bootstrap, newinfo);
+        if (IS_ERR(new_table)) {
+                ret = PTR_ERR(new_table);
+                goto out_free;
         }
 
-        return 0;
+        return new_table;
+
+out_free:
+        xt_free_table_info(newinfo);
+out:
+        return ERR_PTR(ret);
 }
 
 void ipt_unregister_table(struct xt_table *table)
 {
         struct xt_table_info *private;
         void *loc_cpu_entry;
+        struct module *table_owner = table->me;
 
         private = xt_unregister_table(table);
 
         /* Decrease module usage counts and free resources */
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
         IPT_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
+        if (private->number > private->initial_entries)
+                module_put(table_owner);
         xt_free_table_info(private);
 }
 
@@ -2200,11 +2213,26 @@ static struct xt_match icmp_matchstruct __read_mostly = {
         .family         = AF_INET,
 };
 
+static int __net_init ip_tables_net_init(struct net *net)
+{
+        return xt_proto_init(net, AF_INET);
+}
+
+static void __net_exit ip_tables_net_exit(struct net *net)
+{
+        xt_proto_fini(net, AF_INET);
+}
+
+static struct pernet_operations ip_tables_net_ops = {
+        .init = ip_tables_net_init,
+        .exit = ip_tables_net_exit,
+};
+
 static int __init ip_tables_init(void)
 {
         int ret;
 
-        ret = xt_proto_init(AF_INET);
+        ret = register_pernet_subsys(&ip_tables_net_ops);
         if (ret < 0)
                 goto err1;
 
@@ -2234,7 +2262,7 @@ err4:
 err3:
         xt_unregister_target(&ipt_standard_target);
 err2:
-        xt_proto_fini(AF_INET);
+        unregister_pernet_subsys(&ip_tables_net_ops);
 err1:
         return ret;
 }
@@ -2247,7 +2275,7 @@ static void __exit ip_tables_fini(void)
         xt_unregister_target(&ipt_error_target);
         xt_unregister_target(&ipt_standard_target);
 
-        xt_proto_fini(AF_INET);
+        unregister_pernet_subsys(&ip_tables_net_ops);
 }
 
 EXPORT_SYMBOL(ipt_register_table);
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 1b31f7d14d46..c6cf84c77611 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -76,13 +76,6 @@ clusterip_config_put(struct clusterip_config *c)
                 kfree(c);
 }
 
-/* increase the count of entries(rules) using/referencing this config */
-static inline void
-clusterip_config_entry_get(struct clusterip_config *c)
-{
-        atomic_inc(&c->entries);
-}
-
 /* decrease the count of entries using/referencing this config.  If last
  * entry(rule) is removed, remove the config from lists, but don't free it
  * yet, since proc-files could still be holding references */
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index e3154a99c08a..68cbe3ca01ce 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -212,11 +212,11 @@ recent_mt(const struct sk_buff *skb, const struct net_device *in,
                 recent_entry_remove(t, e);
                 ret = !ret;
         } else if (info->check_set & (IPT_RECENT_CHECK | IPT_RECENT_UPDATE)) {
-                unsigned long t = jiffies - info->seconds * HZ;
+                unsigned long time = jiffies - info->seconds * HZ;
                 unsigned int i, hits = 0;
 
                 for (i = 0; i < e->nstamps; i++) {
-                        if (info->seconds && time_after(t, e->stamps[i]))
+                        if (info->seconds && time_after(time, e->stamps[i]))
                                 continue;
                         if (++hits >= info->hit_count) {
                                 ret = !ret;
@@ -320,6 +320,7 @@ struct recent_iter_state {
 };
 
 static void *recent_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(recent_lock)
 {
         struct recent_iter_state *st = seq->private;
         const struct recent_table *t = st->table;
@@ -352,6 +353,7 @@ static void *recent_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void recent_seq_stop(struct seq_file *s, void *v)
+        __releases(recent_lock)
 {
         spin_unlock_bh(&recent_lock);
 }
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 29bb4f9fbda0..69f3d7e6e96f 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -28,7 +28,7 @@ static struct
         struct ipt_replace repl;
         struct ipt_standard entries[3];
         struct ipt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "filter",
                 .valid_hooks = FILTER_VALID_HOOKS,
@@ -69,7 +69,7 @@ ipt_hook(unsigned int hook,
          const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(skb, hook, in, out, &packet_filter);
+        return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_filter);
 }
 
 static unsigned int
@@ -88,7 +88,7 @@ ipt_local_out_hook(unsigned int hook,
                 return NF_ACCEPT;
         }
 
-        return ipt_do_table(skb, hook, in, out, &packet_filter);
+        return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_filter);
 }
 
 static struct nf_hook_ops ipt_ops[] __read_mostly = {
@@ -119,6 +119,26 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
 static int forward = NF_ACCEPT;
 module_param(forward, bool, 0000);
 
+static int __net_init iptable_filter_net_init(struct net *net)
+{
+        /* Register table */
+        net->ipv4.iptable_filter =
+                ipt_register_table(net, &packet_filter, &initial_table.repl);
+        if (IS_ERR(net->ipv4.iptable_filter))
+                return PTR_ERR(net->ipv4.iptable_filter);
+        return 0;
+}
+
+static void __net_exit iptable_filter_net_exit(struct net *net)
+{
+        ipt_unregister_table(net->ipv4.iptable_filter);
+}
+
+static struct pernet_operations iptable_filter_net_ops = {
+        .init = iptable_filter_net_init,
+        .exit = iptable_filter_net_exit,
+};
+
 static int __init iptable_filter_init(void)
 {
         int ret;
@@ -131,8 +151,7 @@ static int __init iptable_filter_init(void)
         /* Entry 1 is the FORWARD hook */
         initial_table.entries[1].target.verdict = -forward - 1;
 
-        /* Register table */
-        ret = ipt_register_table(&packet_filter, &initial_table.repl);
+        ret = register_pernet_subsys(&iptable_filter_net_ops);
         if (ret < 0)
                 return ret;
 
@@ -144,14 +163,14 @@ static int __init iptable_filter_init(void)
         return ret;
 
  cleanup_table:
-        ipt_unregister_table(&packet_filter);
+        unregister_pernet_subsys(&iptable_filter_net_ops);
         return ret;
 }
 
 static void __exit iptable_filter_fini(void)
 {
         nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        ipt_unregister_table(&packet_filter);
+        unregister_pernet_subsys(&iptable_filter_net_ops);
 }
 
 module_init(iptable_filter_init);
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 5c4be202430c..c55a210853a7 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -33,7 +33,7 @@ static struct
         struct ipt_replace repl;
         struct ipt_standard entries[5];
         struct ipt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "mangle",
                 .valid_hooks = MANGLE_VALID_HOOKS,
@@ -80,7 +80,7 @@ ipt_route_hook(unsigned int hook,
          const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(skb, hook, in, out, &packet_mangler);
+        return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_mangle);
 }
 
 static unsigned int
@@ -112,7 +112,7 @@ ipt_local_hook(unsigned int hook,
         daddr = iph->daddr;
         tos = iph->tos;
 
-        ret = ipt_do_table(skb, hook, in, out, &packet_mangler);
+        ret = ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_mangle);
         /* Reroute for ANY change. */
         if (ret != NF_DROP && ret != NF_STOLEN && ret != NF_QUEUE) {
                 iph = ip_hdr(skb);
@@ -166,12 +166,31 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
         },
 };
 
+static int __net_init iptable_mangle_net_init(struct net *net)
+{
+        /* Register table */
+        net->ipv4.iptable_mangle =
+                ipt_register_table(net, &packet_mangler, &initial_table.repl);
+        if (IS_ERR(net->ipv4.iptable_mangle))
+                return PTR_ERR(net->ipv4.iptable_mangle);
+        return 0;
+}
+
+static void __net_exit iptable_mangle_net_exit(struct net *net)
+{
+        ipt_unregister_table(net->ipv4.iptable_mangle);
+}
+
+static struct pernet_operations iptable_mangle_net_ops = {
+        .init = iptable_mangle_net_init,
+        .exit = iptable_mangle_net_exit,
+};
+
 static int __init iptable_mangle_init(void)
 {
         int ret;
 
-        /* Register table */
-        ret = ipt_register_table(&packet_mangler, &initial_table.repl);
+        ret = register_pernet_subsys(&iptable_mangle_net_ops);
         if (ret < 0)
                 return ret;
 
@@ -183,14 +202,14 @@ static int __init iptable_mangle_init(void)
         return ret;
 
  cleanup_table:
-        ipt_unregister_table(&packet_mangler);
+        unregister_pernet_subsys(&iptable_mangle_net_ops);
         return ret;
 }
 
 static void __exit iptable_mangle_fini(void)
 {
         nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        ipt_unregister_table(&packet_mangler);
+        unregister_pernet_subsys(&iptable_mangle_net_ops);
 }
 
 module_init(iptable_mangle_init);
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index dc34aa274533..e41fe8ca4e1c 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -14,7 +14,7 @@ static struct
         struct ipt_replace repl;
         struct ipt_standard entries[2];
         struct ipt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "raw",
                 .valid_hooks = RAW_VALID_HOOKS,
@@ -52,7 +52,7 @@ ipt_hook(unsigned int hook,
          const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
-        return ipt_do_table(skb, hook, in, out, &packet_raw);
+        return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_raw);
 }
 
 static unsigned int
@@ -70,7 +70,7 @@ ipt_local_hook(unsigned int hook,
                                "packet.\n");
                 return NF_ACCEPT;
         }
-        return ipt_do_table(skb, hook, in, out, &packet_raw);
+        return ipt_do_table(skb, hook, in, out, init_net.ipv4.iptable_raw);
 }
 
 /* 'raw' is the very first table. */
@@ -91,12 +91,31 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
         },
 };
 
+static int __net_init iptable_raw_net_init(struct net *net)
+{
+        /* Register table */
+        net->ipv4.iptable_raw =
+                ipt_register_table(net, &packet_raw, &initial_table.repl);
+        if (IS_ERR(net->ipv4.iptable_raw))
+                return PTR_ERR(net->ipv4.iptable_raw);
+        return 0;
+}
+
+static void __net_exit iptable_raw_net_exit(struct net *net)
+{
+        ipt_unregister_table(net->ipv4.iptable_raw);
+}
+
+static struct pernet_operations iptable_raw_net_ops = {
+        .init = iptable_raw_net_init,
+        .exit = iptable_raw_net_exit,
+};
+
 static int __init iptable_raw_init(void)
 {
         int ret;
 
-        /* Register table */
-        ret = ipt_register_table(&packet_raw, &initial_table.repl);
+        ret = register_pernet_subsys(&iptable_raw_net_ops);
         if (ret < 0)
                 return ret;
 
@@ -108,14 +127,14 @@ static int __init iptable_raw_init(void)
         return ret;
 
  cleanup_table:
-        ipt_unregister_table(&packet_raw);
+        unregister_pernet_subsys(&iptable_raw_net_ops);
         return ret;
 }
 
 static void __exit iptable_raw_fini(void)
 {
         nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
-        ipt_unregister_table(&packet_raw);
+        unregister_pernet_subsys(&iptable_raw_net_ops);
 }
 
 module_init(iptable_raw_init);
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index ac3d61d8026e..a65b845c5f15 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -27,7 +27,8 @@
 static int ipv4_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
                              struct nf_conntrack_tuple *tuple)
 {
-        __be32 _addrs[2], *ap;
+        const __be32 *ap;
+        __be32 _addrs[2];
         ap = skb_header_pointer(skb, nhoff + offsetof(struct iphdr, saddr),
                                 sizeof(u_int32_t) * 2, _addrs);
         if (ap == NULL)
@@ -76,7 +77,8 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
 static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
                             unsigned int *dataoff, u_int8_t *protonum)
 {
-        struct iphdr _iph, *iph;
+        const struct iphdr *iph;
+        struct iphdr _iph;
 
         iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
         if (iph == NULL)
@@ -111,8 +113,8 @@ static unsigned int ipv4_conntrack_help(unsigned int hooknum,
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
-        struct nf_conn_help *help;
-        struct nf_conntrack_helper *helper;
+        const struct nf_conn_help *help;
+        const struct nf_conntrack_helper *helper;
 
         /* This is where we call the helper: as the packet goes out. */
         ct = nf_ct_get(skb, &ctinfo);
@@ -299,8 +301,8 @@ static ctl_table ip_ct_sysctl_table[] = {
 static int
 getorigdst(struct sock *sk, int optval, void __user *user, int *len)
 {
-        struct inet_sock *inet = inet_sk(sk);
-        struct nf_conntrack_tuple_hash *h;
+        const struct inet_sock *inet = inet_sk(sk);
+        const struct nf_conntrack_tuple_hash *h;
         struct nf_conntrack_tuple tuple;
 
         NF_CT_TUPLE_U_BLANK(&tuple);
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 543c02b74c96..089252e82c01 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -39,12 +39,14 @@ struct ct_iter_state {
 static struct hlist_node *ct_get_first(struct seq_file *seq)
 {
         struct ct_iter_state *st = seq->private;
+        struct hlist_node *n;
 
         for (st->bucket = 0;
              st->bucket < nf_conntrack_htable_size;
              st->bucket++) {
-                if (!hlist_empty(&nf_conntrack_hash[st->bucket]))
-                        return nf_conntrack_hash[st->bucket].first;
+                n = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+                if (n)
+                        return n;
         }
         return NULL;
 }
@@ -54,11 +56,11 @@ static struct hlist_node *ct_get_next(struct seq_file *seq,
 {
         struct ct_iter_state *st = seq->private;
 
-        head = head->next;
+        head = rcu_dereference(head->next);
         while (head == NULL) {
                 if (++st->bucket >= nf_conntrack_htable_size)
                         return NULL;
-                head = nf_conntrack_hash[st->bucket].first;
+                head = rcu_dereference(nf_conntrack_hash[st->bucket].first);
         }
         return head;
 }
@@ -74,8 +76,9 @@ static struct hlist_node *ct_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(RCU)
 {
-        read_lock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
         return ct_get_idx(seq, *pos);
 }
 
@@ -86,16 +89,17 @@ static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void ct_seq_stop(struct seq_file *s, void *v)
+        __releases(RCU)
 {
-        read_unlock_bh(&nf_conntrack_lock);
+        rcu_read_unlock();
 }
 
 static int ct_seq_show(struct seq_file *s, void *v)
 {
         const struct nf_conntrack_tuple_hash *hash = v;
         const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
-        struct nf_conntrack_l3proto *l3proto;
-        struct nf_conntrack_l4proto *l4proto;
+        const struct nf_conntrack_l3proto *l3proto;
+        const struct nf_conntrack_l4proto *l4proto;
 
         NF_CT_ASSERT(ct);
 
@@ -191,10 +195,12 @@ struct ct_expect_iter_state {
 static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
 {
         struct ct_expect_iter_state *st = seq->private;
+        struct hlist_node *n;
 
         for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {
-                if (!hlist_empty(&nf_ct_expect_hash[st->bucket]))
-                        return nf_ct_expect_hash[st->bucket].first;
+                n = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
+                if (n)
+                        return n;
         }
         return NULL;
 }
@@ -204,11 +210,11 @@ static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
 {
         struct ct_expect_iter_state *st = seq->private;
 
-        head = head->next;
+        head = rcu_dereference(head->next);
         while (head == NULL) {
                 if (++st->bucket >= nf_ct_expect_hsize)
                         return NULL;
-                head = nf_ct_expect_hash[st->bucket].first;
+                head = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
         }
         return head;
 }
@@ -224,8 +230,9 @@ static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *exp_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(RCU)
 {
-        read_lock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
         return ct_expect_get_idx(seq, *pos);
 }
 
@@ -236,14 +243,15 @@ static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void exp_seq_stop(struct seq_file *seq, void *v)
+        __releases(RCU)
 {
-        read_unlock_bh(&nf_conntrack_lock);
+        rcu_read_unlock();
 }
 
 static int exp_seq_show(struct seq_file *s, void *v)
 {
         struct nf_conntrack_expect *exp;
-        struct hlist_node *n = v;
+        const struct hlist_node *n = v;
 
         exp = hlist_entry(n, struct nf_conntrack_expect, hnode);
 
@@ -324,7 +332,7 @@ static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
 {
         unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
-        struct ip_conntrack_stat *st = v;
+        const struct ip_conntrack_stat *st = v;
 
         if (v == SEQ_START_TOKEN) {
                 seq_printf(seq, "entries  searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error  expect_new expect_create expect_delete\n");
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 4004a04c5510..6873fddb3529 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -26,7 +26,8 @@ static int icmp_pkt_to_tuple(const struct sk_buff *skb,
                              unsigned int dataoff,
                              struct nf_conntrack_tuple *tuple)
 {
-        struct icmphdr _hdr, *hp;
+        const struct icmphdr *hp;
+        struct icmphdr _hdr;
 
         hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
         if (hp == NULL)
@@ -100,7 +101,7 @@ static int icmp_packet(struct nf_conn *ct,
 }
 
 /* Called when a new connection for this protocol found. */
-static int icmp_new(struct nf_conn *conntrack,
+static int icmp_new(struct nf_conn *ct,
                     const struct sk_buff *skb, unsigned int dataoff)
 {
         static const u_int8_t valid_new[] = {
@@ -110,15 +111,15 @@ static int icmp_new(struct nf_conn *conntrack,
                 [ICMP_ADDRESS] = 1
         };
 
-        if (conntrack->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
-            || !valid_new[conntrack->tuplehash[0].tuple.dst.u.icmp.type]) {
+        if (ct->tuplehash[0].tuple.dst.u.icmp.type >= sizeof(valid_new)
+            || !valid_new[ct->tuplehash[0].tuple.dst.u.icmp.type]) {
                 /* Can't create a new ICMP `conn' with this. */
                 pr_debug("icmp: can't create new conn with type %u\n",
-                         conntrack->tuplehash[0].tuple.dst.u.icmp.type);
-                NF_CT_DUMP_TUPLE(&conntrack->tuplehash[0].tuple);
+                         ct->tuplehash[0].tuple.dst.u.icmp.type);
+                NF_CT_DUMP_TUPLE(&ct->tuplehash[0].tuple);
                 return 0;
         }
-        atomic_set(&conntrack->proto.icmp.count, 0);
+        atomic_set(&ct->proto.icmp.count, 0);
         return 1;
 }
 
@@ -129,8 +130,8 @@ icmp_error_message(struct sk_buff *skb,
                  unsigned int hooknum)
 {
         struct nf_conntrack_tuple innertuple, origtuple;
-        struct nf_conntrack_l4proto *innerproto;
-        struct nf_conntrack_tuple_hash *h;
+        const struct nf_conntrack_l4proto *innerproto;
+        const struct nf_conntrack_tuple_hash *h;
 
         NF_CT_ASSERT(skb->nfct == NULL);
 
@@ -176,7 +177,8 @@ static int
 icmp_error(struct sk_buff *skb, unsigned int dataoff,
            enum ip_conntrack_info *ctinfo, int pf, unsigned int hooknum)
 {
-        struct icmphdr _ih, *icmph;
+        const struct icmphdr *icmph;
+        struct icmphdr _ih;
 
         /* Not enough header? */
         icmph = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_ih), &_ih);
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index e53ae1ef8f5e..dd07362d2b8f 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -31,7 +31,7 @@
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 
-static DEFINE_RWLOCK(nf_nat_lock);
+static DEFINE_SPINLOCK(nf_nat_lock);
 
 static struct nf_conntrack_l3proto *l3proto __read_mostly;
 
@@ -154,8 +154,8 @@ find_appropriate_src(const struct nf_conntrack_tuple *tuple,
         struct nf_conn *ct;
         struct hlist_node *n;
 
-        read_lock_bh(&nf_nat_lock);
-        hlist_for_each_entry(nat, n, &bysource[h], bysource) {
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(nat, n, &bysource[h], bysource) {
                 ct = nat->ct;
                 if (same_src(ct, tuple)) {
                         /* Copy source part from reply tuple. */
@@ -164,12 +164,12 @@ find_appropriate_src(const struct nf_conntrack_tuple *tuple,
                         result->dst = tuple->dst;
 
                         if (in_range(result, range)) {
-                                read_unlock_bh(&nf_nat_lock);
+                                rcu_read_unlock();
                                 return 1;
                         }
                 }
         }
-        read_unlock_bh(&nf_nat_lock);
+        rcu_read_unlock();
         return 0;
 }
 
@@ -330,12 +330,12 @@ nf_nat_setup_info(struct nf_conn *ct,
                 unsigned int srchash;
 
                 srchash = hash_by_src(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-                write_lock_bh(&nf_nat_lock);
+                spin_lock_bh(&nf_nat_lock);
                 /* nf_conntrack_alter_reply might re-allocate exntension aera */
                 nat = nfct_nat(ct);
                 nat->ct = ct;
-                hlist_add_head(&nat->bysource, &bysource[srchash]);
-                write_unlock_bh(&nf_nat_lock);
+                hlist_add_head_rcu(&nat->bysource, &bysource[srchash]);
+                spin_unlock_bh(&nf_nat_lock);
         }
 
         /* It's done. */
@@ -521,14 +521,14 @@ int nf_nat_protocol_register(const struct nf_nat_protocol *proto)
 {
         int ret = 0;
 
-        write_lock_bh(&nf_nat_lock);
+        spin_lock_bh(&nf_nat_lock);
         if (nf_nat_protos[proto->protonum] != &nf_nat_unknown_protocol) {
                 ret = -EBUSY;
                 goto out;
         }
         rcu_assign_pointer(nf_nat_protos[proto->protonum], proto);
  out:
-        write_unlock_bh(&nf_nat_lock);
+        spin_unlock_bh(&nf_nat_lock);
         return ret;
 }
 EXPORT_SYMBOL(nf_nat_protocol_register);
@@ -536,10 +536,10 @@ EXPORT_SYMBOL(nf_nat_protocol_register);
 /* Noone stores the protocol anywhere; simply delete it. */
 void nf_nat_protocol_unregister(const struct nf_nat_protocol *proto)
 {
-        write_lock_bh(&nf_nat_lock);
+        spin_lock_bh(&nf_nat_lock);
         rcu_assign_pointer(nf_nat_protos[proto->protonum],
                            &nf_nat_unknown_protocol);
-        write_unlock_bh(&nf_nat_lock);
+        spin_unlock_bh(&nf_nat_lock);
         synchronize_rcu();
 }
 EXPORT_SYMBOL(nf_nat_protocol_unregister);
@@ -594,10 +594,10 @@ static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
 
         NF_CT_ASSERT(nat->ct->status & IPS_NAT_DONE_MASK);
 
-        write_lock_bh(&nf_nat_lock);
-        hlist_del(&nat->bysource);
+        spin_lock_bh(&nf_nat_lock);
+        hlist_del_rcu(&nat->bysource);
         nat->ct = NULL;
-        write_unlock_bh(&nf_nat_lock);
+        spin_unlock_bh(&nf_nat_lock);
 }
 
 static void nf_nat_move_storage(struct nf_conn *conntrack, void *old)
@@ -609,10 +609,10 @@ static void nf_nat_move_storage(struct nf_conn *conntrack, void *old)
         if (!ct || !(ct->status & IPS_NAT_DONE_MASK))
                 return;
 
-        write_lock_bh(&nf_nat_lock);
+        spin_lock_bh(&nf_nat_lock);
         hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource);
         new_nat->ct = ct;
-        write_unlock_bh(&nf_nat_lock);
+        spin_unlock_bh(&nf_nat_lock);
 }
 
 static struct nf_ct_ext_type nat_extend __read_mostly = {
@@ -646,17 +646,13 @@ static int __init nf_nat_init(void)
         }
 
         /* Sew in builtin protocols. */
-        write_lock_bh(&nf_nat_lock);
+        spin_lock_bh(&nf_nat_lock);
         for (i = 0; i < MAX_IP_NAT_PROTO; i++)
                 rcu_assign_pointer(nf_nat_protos[i], &nf_nat_unknown_protocol);
         rcu_assign_pointer(nf_nat_protos[IPPROTO_TCP], &nf_nat_protocol_tcp);
         rcu_assign_pointer(nf_nat_protos[IPPROTO_UDP], &nf_nat_protocol_udp);
         rcu_assign_pointer(nf_nat_protos[IPPROTO_ICMP], &nf_nat_protocol_icmp);
-        write_unlock_bh(&nf_nat_lock);
-
-        for (i = 0; i < nf_nat_htable_size; i++) {
-                INIT_HLIST_HEAD(&bysource[i]);
-        }
+        spin_unlock_bh(&nf_nat_lock);
 
         /* Initialize fake conntrack so that NAT will skip it */
         nf_conntrack_untracked.status |= IPS_NAT_DONE_MASK;
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index a121989fdad7..ee47bf28c825 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -32,7 +32,8 @@ static int set_addr(struct sk_buff *skb,
                 __be32 ip;
                 __be16 port;
         } __attribute__ ((__packed__)) buf;
-        struct tcphdr _tcph, *th;
+        const struct tcphdr *th;
+        struct tcphdr _tcph;
 
         buf.ip = ip;
         buf.port = port;
@@ -99,7 +100,7 @@ static int set_sig_addr(struct sk_buff *skb, struct nf_conn *ct,
                         unsigned char **data,
                         TransportAddress *taddr, int count)
 {
-        struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+        const struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
         int dir = CTINFO2DIR(ctinfo);
         int i;
         __be16 port;
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 4c0232842e75..ca57f47bbd25 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -44,8 +44,7 @@ adjust_tcp_sequence(u32 seq,
         struct nf_nat_seq *this_way, *other_way;
         struct nf_conn_nat *nat = nfct_nat(ct);
 
-        pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n",
-                 ntohl(seq), seq);
+        pr_debug("adjust_tcp_sequence: seq = %u, sizediff = %d\n", seq, seq);
 
         dir = CTINFO2DIR(ctinfo);
 
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index e63b944a2ebb..3a1e6d6afc0a 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -40,11 +40,11 @@ MODULE_ALIAS("ip_nat_pptp");
 static void pptp_nat_expected(struct nf_conn *ct,
                               struct nf_conntrack_expect *exp)
 {
-        struct nf_conn *master = ct->master;
+        const struct nf_conn *master = ct->master;
         struct nf_conntrack_expect *other_exp;
         struct nf_conntrack_tuple t;
-        struct nf_ct_pptp_master *ct_pptp_info;
-        struct nf_nat_pptp *nat_pptp_info;
+        const struct nf_ct_pptp_master *ct_pptp_info;
+        const struct nf_nat_pptp *nat_pptp_info;
         struct nf_nat_range range;
 
         ct_pptp_info = &nfct_help(master)->help.ct_pptp_info;
@@ -186,7 +186,7 @@ static void
 pptp_exp_gre(struct nf_conntrack_expect *expect_orig,
              struct nf_conntrack_expect *expect_reply)
 {
-        struct nf_conn *ct = expect_orig->master;
+        const struct nf_conn *ct = expect_orig->master;
         struct nf_ct_pptp_master *ct_pptp_info;
         struct nf_nat_pptp *nat_pptp_info;
 
@@ -217,7 +217,7 @@ pptp_inbound_pkt(struct sk_buff *skb,
                  struct PptpControlHeader *ctlh,
                  union pptp_ctrl_union *pptpReq)
 {
-        struct nf_nat_pptp *nat_pptp_info;
+        const struct nf_nat_pptp *nat_pptp_info;
         u_int16_t msg;
         __be16 new_pcid;
         unsigned int pcid_off;
diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index 9fa272e73113..a1e4da16da2e 100644
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -59,7 +59,7 @@ static int
 gre_unique_tuple(struct nf_conntrack_tuple *tuple,
                  const struct nf_nat_range *range,
                  enum nf_nat_manip_type maniptype,
-                 const struct nf_conn *conntrack)
+                 const struct nf_conn *ct)
 {
         static u_int16_t key;
         __be16 *keyptr;
@@ -67,7 +67,7 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
 
         /* If there is no master conntrack we are not PPTP,
            do not change tuples */
-        if (!conntrack->master)
+        if (!ct->master)
                 return 0;
 
         if (maniptype == IP_NAT_MANIP_SRC)
@@ -76,7 +76,7 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
                 keyptr = &tuple->dst.u.gre.key;
 
         if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {
-                pr_debug("%p: NATing GRE PPTP\n", conntrack);
+                pr_debug("%p: NATing GRE PPTP\n", ct);
                 min = 1;
                 range_size = 0xffff;
         } else {
@@ -88,11 +88,11 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
 
         for (i = 0; i < range_size; i++, key++) {
                 *keyptr = htons(min + key % range_size);
-                if (!nf_nat_used_tuple(tuple, conntrack))
+                if (!nf_nat_used_tuple(tuple, ct))
                         return 1;
         }
 
-        pr_debug("%p: no NAT mapping\n", conntrack);
+        pr_debug("%p: no NAT mapping\n", ct);
         return 0;
 }
 
@@ -104,7 +104,7 @@ gre_manip_pkt(struct sk_buff *skb, unsigned int iphdroff,
 {
         struct gre_hdr *greh;
         struct gre_hdr_pptp *pgreh;
-        struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
+        const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
         unsigned int hdroff = iphdroff + iph->ihl * 4;
 
         /* pgreh includes two optional 32bit fields which are not required
@@ -148,12 +148,12 @@ static const struct nf_nat_protocol gre = {
 #endif
 };
 
-int __init nf_nat_proto_gre_init(void)
+static int __init nf_nat_proto_gre_init(void)
 {
         return nf_nat_protocol_register(&gre);
 }
 
-void __exit nf_nat_proto_gre_fini(void)
+static void __exit nf_nat_proto_gre_fini(void)
 {
         nf_nat_protocol_unregister(&gre);
 }
diff --git a/net/ipv4/netfilter/nf_nat_proto_icmp.c b/net/ipv4/netfilter/nf_nat_proto_icmp.c
index a0e44c953cb6..03a02969aa57 100644
--- a/net/ipv4/netfilter/nf_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_icmp.c
@@ -57,7 +57,7 @@ icmp_manip_pkt(struct sk_buff *skb,
                const struct nf_conntrack_tuple *tuple,
                enum nf_nat_manip_type maniptype)
 {
-        struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
+        const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
         struct icmphdr *hdr;
         unsigned int hdroff = iphdroff + iph->ihl*4;
 
diff --git a/net/ipv4/netfilter/nf_nat_proto_tcp.c b/net/ipv4/netfilter/nf_nat_proto_tcp.c
index da23e9fbe679..ffd5d1589eca 100644
--- a/net/ipv4/netfilter/nf_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_tcp.c
@@ -93,7 +93,7 @@ tcp_manip_pkt(struct sk_buff *skb,
               const struct nf_conntrack_tuple *tuple,
               enum nf_nat_manip_type maniptype)
 {
-        struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
+        const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
         struct tcphdr *hdr;
         unsigned int hdroff = iphdroff + iph->ihl*4;
         __be32 oldip, newip;
diff --git a/net/ipv4/netfilter/nf_nat_proto_udp.c b/net/ipv4/netfilter/nf_nat_proto_udp.c
index 10df4db078af..4b8f49910ff2 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_udp.c
@@ -91,7 +91,7 @@ udp_manip_pkt(struct sk_buff *skb,
               const struct nf_conntrack_tuple *tuple,
               enum nf_nat_manip_type maniptype)
 {
-        struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
+        const struct iphdr *iph = (struct iphdr *)(skb->data + iphdroff);
         struct udphdr *hdr;
         unsigned int hdroff = iphdroff + iph->ihl*4;
         __be32 oldip, newip;
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 519182269e76..f8fda57ba20b 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -58,13 +58,14 @@ static struct
         .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
-static struct xt_table nat_table = {
+static struct xt_table __nat_table = {
         .name           = "nat",
         .valid_hooks    = NAT_VALID_HOOKS,
         .lock           = RW_LOCK_UNLOCKED,
         .me             = THIS_MODULE,
         .af             = AF_INET,
 };
+static struct xt_table *nat_table;
 
 /* Source NAT */
 static unsigned int ipt_snat_target(struct sk_buff *skb,
@@ -214,7 +215,7 @@ int nf_nat_rule_find(struct sk_buff *skb,
 {
         int ret;
 
-        ret = ipt_do_table(skb, hooknum, in, out, &nat_table);
+        ret = ipt_do_table(skb, hooknum, in, out, nat_table);
 
         if (ret == NF_ACCEPT) {
                 if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
@@ -248,9 +249,10 @@ int __init nf_nat_rule_init(void)
 {
         int ret;
 
-        ret = ipt_register_table(&nat_table, &nat_initial_table.repl);
-        if (ret != 0)
-                return ret;
+        nat_table = ipt_register_table(&init_net, &__nat_table,
+                                       &nat_initial_table.repl);
+        if (IS_ERR(nat_table))
+                return PTR_ERR(nat_table);
         ret = xt_register_target(&ipt_snat_reg);
         if (ret != 0)
                 goto unregister_table;
@@ -264,7 +266,7 @@ int __init nf_nat_rule_init(void)
  unregister_snat:
         xt_unregister_target(&ipt_snat_reg);
  unregister_table:
-        ipt_unregister_table(&nat_table);
+        ipt_unregister_table(nat_table);
 
         return ret;
 }
@@ -273,5 +275,5 @@ void nf_nat_rule_cleanup(void)
 {
         xt_unregister_target(&ipt_dnat_reg);
         xt_unregister_target(&ipt_snat_reg);
-        ipt_unregister_table(&nat_table);
+        ipt_unregister_table(nat_table);
 }
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index 606a170bf4ca..b4c8d4968bb2 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -35,9 +35,9 @@ struct addr_map {
         } addr[IP_CT_DIR_MAX];
 };
 
-static void addr_map_init(struct nf_conn *ct, struct addr_map *map)
+static void addr_map_init(const struct nf_conn *ct, struct addr_map *map)
 {
-        struct nf_conntrack_tuple *t;
+        const struct nf_conntrack_tuple *t;
         enum ip_conntrack_dir dir;
         unsigned int n;
 
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 07f2a49926d4..540ce6ae887c 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -260,7 +260,7 @@ static unsigned char asn1_eoc_decode(struct asn1_ctx *ctx, unsigned char *eoc)
 {
         unsigned char ch;
 
-        if (eoc == 0) {
+        if (eoc == NULL) {
                 if (!asn1_octet_decode(ctx, &ch))
                         return 0;
 
diff --git a/net/ipv4/netfilter/nf_nat_tftp.c b/net/ipv4/netfilter/nf_nat_tftp.c
index 1360a94766dd..b096e81500ae 100644
--- a/net/ipv4/netfilter/nf_nat_tftp.c
+++ b/net/ipv4/netfilter/nf_nat_tftp.c
@@ -24,7 +24,7 @@ static unsigned int help(struct sk_buff *skb,
                          enum ip_conntrack_info ctinfo,
                          struct nf_conntrack_expect *exp)
 {
-        struct nf_conn *ct = exp->master;
+        const struct nf_conn *ct = exp->master;
 
         exp->saved_proto.udp.port
                 = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.udp.port;
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 85c08696abbe..a3002fe65b7f 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -352,6 +352,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
         skb_reserve(skb, hh_len);
 
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
         skb->dst = dst_clone(&rt->u.dst);
 
         skb_reset_network_header(skb);
@@ -544,6 +545,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         {
                 struct flowi fl = { .oif = ipc.oif,
+                                    .mark = sk->sk_mark,
                                     .nl_u = { .ip4_u =
                                               { .daddr = daddr,
                                                 .saddr = saddr,
@@ -860,8 +862,7 @@ static struct sock *raw_get_first(struct seq_file *seq)
                 struct hlist_node *node;
 
                 sk_for_each(sk, node, &state->h->ht[state->bucket])
-                        if (sk->sk_net == state->p.net &&
-                                        sk->sk_family == state->family)
+                        if (sk->sk_net == state->p.net)
                                 goto found;
         }
         sk = NULL;
@@ -877,8 +878,7 @@ static struct sock *raw_get_next(struct seq_file *seq, struct sock *sk)
                 sk = sk_next(sk);
 try_again:
                 ;
-        } while (sk && sk->sk_net != state->p.net &&
-                        sk->sk_family != state->family);
+        } while (sk && sk->sk_net != state->p.net);
 
         if (!sk && ++state->bucket < RAW_HTABLE_SIZE) {
                 sk = sk_head(&state->h->ht[state->bucket]);
@@ -927,7 +927,7 @@ void raw_seq_stop(struct seq_file *seq, void *v)
 }
 EXPORT_SYMBOL_GPL(raw_seq_stop);
 
-static __inline__ char *get_raw_sock(struct sock *sp, char *tmpbuf, int i)
+static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
 {
         struct inet_sock *inet = inet_sk(sp);
         __be32 dest = inet->daddr,
@@ -935,33 +935,23 @@ static __inline__ char *get_raw_sock(struct sock *sp, char *tmpbuf, int i)
         __u16 destp = 0,
               srcp  = inet->num;
 
-        sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X"
+        seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
                 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d",
                 i, src, srcp, dest, destp, sp->sk_state,
                 atomic_read(&sp->sk_wmem_alloc),
                 atomic_read(&sp->sk_rmem_alloc),
                 0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
                 atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
-        return tmpbuf;
 }
 
-#define TMPSZ 128
-
 static int raw_seq_show(struct seq_file *seq, void *v)
 {
-        char tmpbuf[TMPSZ+1];
-
         if (v == SEQ_START_TOKEN)
-                seq_printf(seq, "%-*s\n", TMPSZ-1,
-                               "  sl  local_address rem_address   st tx_queue "
-                               "rx_queue tr tm->when retrnsmt   uid  timeout "
-                               "inode  drops");
-        else {
-                struct raw_iter_state *state = raw_seq_private(seq);
-
-                seq_printf(seq, "%-*s\n", TMPSZ-1,
-                           get_raw_sock(v, tmpbuf, state->bucket));
-        }
+                seq_printf(seq, "  sl  local_address rem_address   st tx_queue "
+                                "rx_queue tr tm->when retrnsmt   uid  timeout "
+                                "inode  drops\n");
+        else
+                raw_sock_seq_show(seq, v, raw_seq_private(seq)->bucket);
         return 0;
 }
 
@@ -972,27 +962,25 @@ static const struct seq_operations raw_seq_ops = {
         .show  = raw_seq_show,
 };
 
-int raw_seq_open(struct inode *ino, struct file *file, struct raw_hashinfo *h,
-                unsigned short family)
+int raw_seq_open(struct inode *ino, struct file *file,
+                 struct raw_hashinfo *h, const struct seq_operations *ops)
 {
         int err;
         struct raw_iter_state *i;
 
-        err = seq_open_net(ino, file, &raw_seq_ops,
-                        sizeof(struct raw_iter_state));
+        err = seq_open_net(ino, file, ops, sizeof(struct raw_iter_state));
         if (err < 0)
                 return err;
 
         i = raw_seq_private((struct seq_file *)file->private_data);
         i->h = h;
-        i->family = family;
         return 0;
 }
 EXPORT_SYMBOL_GPL(raw_seq_open);
 
 static int raw_v4_seq_open(struct inode *inode, struct file *file)
 {
-        return raw_seq_open(inode, file, &raw_v4_hashinfo, PF_INET);
+        return raw_seq_open(inode, file, &raw_v4_hashinfo, &raw_seq_ops);
 }
 
 static const struct file_operations raw_seq_fops = {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 896c768e41a2..8842ecb9be48 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -117,8 +117,6 @@
 
 #define RT_GC_TIMEOUT (300*HZ)
 
-static int ip_rt_min_delay              = 2 * HZ;
-static int ip_rt_max_delay              = 10 * HZ;
 static int ip_rt_max_size;
 static int ip_rt_gc_timeout             = RT_GC_TIMEOUT;
 static int ip_rt_gc_interval            = 60 * HZ;
@@ -133,12 +131,9 @@ static int ip_rt_mtu_expires		= 10 * 60 * HZ;
 static int ip_rt_min_pmtu               = 512 + 20 + 20;
 static int ip_rt_min_advmss             = 256;
 static int ip_rt_secret_interval        = 10 * 60 * HZ;
-static int ip_rt_flush_expected;
-static unsigned long rt_deadline;
 
 #define RTprint(a...)   printk(KERN_DEBUG a)
 
-static struct timer_list rt_flush_timer;
 static void rt_worker_func(struct work_struct *work);
 static DECLARE_DELAYED_WORK(expires_work, rt_worker_func);
 static struct timer_list rt_secret_timer;
@@ -169,6 +164,7 @@ static struct dst_ops ipv4_dst_ops = {
         .update_pmtu =          ip_rt_update_pmtu,
         .local_out =            ip_local_out,
         .entry_size =           sizeof(struct rtable),
+        .entries =              ATOMIC_INIT(0),
 };
 
 #define ECN_OR_COST(class)      TC_PRIO_##class
@@ -259,19 +255,16 @@ static inline void rt_hash_lock_init(void)
 static struct rt_hash_bucket    *rt_hash_table;
 static unsigned                 rt_hash_mask;
 static unsigned int             rt_hash_log;
-static unsigned int             rt_hash_rnd;
+static atomic_t                 rt_genid;
 
 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
 #define RT_CACHE_STAT_INC(field) \
         (__raw_get_cpu_var(rt_cache_stat).field++)
 
-static int rt_intern_hash(unsigned hash, struct rtable *rth,
-                                struct rtable **res);
-
 static unsigned int rt_hash_code(u32 daddr, u32 saddr)
 {
-        return (jhash_2words(daddr, saddr, rt_hash_rnd)
-                & rt_hash_mask);
+        return jhash_2words(daddr, saddr, atomic_read(&rt_genid))
+                & rt_hash_mask;
 }
 
 #define rt_hash(daddr, saddr, idx) \
@@ -281,27 +274,28 @@ static unsigned int rt_hash_code(u32 daddr, u32 saddr)
 #ifdef CONFIG_PROC_FS
 struct rt_cache_iter_state {
         int bucket;
+        int genid;
 };
 
-static struct rtable *rt_cache_get_first(struct seq_file *seq)
+static struct rtable *rt_cache_get_first(struct rt_cache_iter_state *st)
 {
         struct rtable *r = NULL;
-        struct rt_cache_iter_state *st = seq->private;
 
         for (st->bucket = rt_hash_mask; st->bucket >= 0; --st->bucket) {
                 rcu_read_lock_bh();
-                r = rt_hash_table[st->bucket].chain;
-                if (r)
-                        break;
+                r = rcu_dereference(rt_hash_table[st->bucket].chain);
+                while (r) {
+                        if (r->rt_genid == st->genid)
+                                return r;
+                        r = rcu_dereference(r->u.dst.rt_next);
+                }
                 rcu_read_unlock_bh();
         }
-        return rcu_dereference(r);
+        return r;
 }
 
-static struct rtable *rt_cache_get_next(struct seq_file *seq, struct rtable *r)
+static struct rtable *rt_cache_get_next(struct rt_cache_iter_state *st, struct rtable *r)
 {
-        struct rt_cache_iter_state *st = seq->private;
-
         r = r->u.dst.rt_next;
         while (!r) {
                 rcu_read_unlock_bh();
@@ -313,29 +307,38 @@ static struct rtable *rt_cache_get_next(struct seq_file *seq, struct rtable *r)
         return rcu_dereference(r);
 }
 
-static struct rtable *rt_cache_get_idx(struct seq_file *seq, loff_t pos)
+static struct rtable *rt_cache_get_idx(struct rt_cache_iter_state *st, loff_t pos)
 {
-        struct rtable *r = rt_cache_get_first(seq);
+        struct rtable *r = rt_cache_get_first(st);
 
         if (r)
-                while (pos && (r = rt_cache_get_next(seq, r)))
+                while (pos && (r = rt_cache_get_next(st, r))) {
+                        if (r->rt_genid != st->genid)
+                                continue;
                         --pos;
+                }
         return pos ? NULL : r;
 }
 
 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        return *pos ? rt_cache_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
+        struct rt_cache_iter_state *st = seq->private;
+
+        if (*pos)
+                return rt_cache_get_idx(st, *pos - 1);
+        st->genid = atomic_read(&rt_genid);
+        return SEQ_START_TOKEN;
 }
 
 static void *rt_cache_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct rtable *r = NULL;
+        struct rtable *r;
+        struct rt_cache_iter_state *st = seq->private;
 
         if (v == SEQ_START_TOKEN)
-                r = rt_cache_get_first(seq);
+                r = rt_cache_get_first(st);
         else
-                r = rt_cache_get_next(seq, v);
+                r = rt_cache_get_next(st, v);
         ++*pos;
         return r;
 }
@@ -708,6 +711,11 @@ static void rt_check_expire(void)
                         continue;
                 spin_lock_bh(rt_hash_lock_addr(i));
                 while ((rth = *rthp) != NULL) {
+                        if (rth->rt_genid != atomic_read(&rt_genid)) {
+                                *rthp = rth->u.dst.rt_next;
+                                rt_free(rth);
+                                continue;
+                        }
                         if (rth->u.dst.expires) {
                                 /* Entry is expired even if it is in use */
                                 if (time_before_eq(jiffies, rth->u.dst.expires)) {
@@ -732,83 +740,45 @@ static void rt_check_expire(void)
 
 /*
  * rt_worker_func() is run in process context.
- * If a whole flush was scheduled, it is done.
- * Else, we call rt_check_expire() to scan part of the hash table
+ * we call rt_check_expire() to scan part of the hash table
  */
 static void rt_worker_func(struct work_struct *work)
 {
-        if (ip_rt_flush_expected) {
-                ip_rt_flush_expected = 0;
-                rt_do_flush(1);
-        } else
-                rt_check_expire();
+        rt_check_expire();
         schedule_delayed_work(&expires_work, ip_rt_gc_interval);
 }
 
-/* This can run from both BH and non-BH contexts, the latter
- * in the case of a forced flush event.
+/*
+ * Pertubation of rt_genid by a small quantity [1..256]
+ * Using 8 bits of shuffling ensure we can call rt_cache_invalidate()
+ * many times (2^24) without giving recent rt_genid.
+ * Jenkins hash is strong enough that litle changes of rt_genid are OK.
  */
-static void rt_run_flush(unsigned long process_context)
+static void rt_cache_invalidate(void)
 {
-        rt_deadline = 0;
-
-        get_random_bytes(&rt_hash_rnd, 4);
+        unsigned char shuffle;
 
-        rt_do_flush(process_context);
+        get_random_bytes(&shuffle, sizeof(shuffle));
+        atomic_add(shuffle + 1U, &rt_genid);
 }
 
-static DEFINE_SPINLOCK(rt_flush_lock);
-
+/*
+ * delay < 0  : invalidate cache (fast : entries will be deleted later)
+ * delay >= 0 : invalidate & flush cache (can be long)
+ */
 void rt_cache_flush(int delay)
 {
-        unsigned long now = jiffies;
-        int user_mode = !in_softirq();
-
-        if (delay < 0)
-                delay = ip_rt_min_delay;
-
-        spin_lock_bh(&rt_flush_lock);
-
-        if (del_timer(&rt_flush_timer) && delay > 0 && rt_deadline) {
-                long tmo = (long)(rt_deadline - now);
-
-                /* If flush timer is already running
-                   and flush request is not immediate (delay > 0):
-
-                   if deadline is not achieved, prolongate timer to "delay",
-                   otherwise fire it at deadline time.
-                 */
-
-                if (user_mode && tmo < ip_rt_max_delay-ip_rt_min_delay)
-                        tmo = 0;
-
-                if (delay > tmo)
-                        delay = tmo;
-        }
-
-        if (delay <= 0) {
-                spin_unlock_bh(&rt_flush_lock);
-                rt_run_flush(user_mode);
-                return;
-        }
-
-        if (rt_deadline == 0)
-                rt_deadline = now + ip_rt_max_delay;
-
-        mod_timer(&rt_flush_timer, now+delay);
-        spin_unlock_bh(&rt_flush_lock);
+        rt_cache_invalidate();
+        if (delay >= 0)
+                rt_do_flush(!in_softirq());
 }
 
 /*
- * We change rt_hash_rnd and ask next rt_worker_func() invocation
- * to perform a flush in process context
+ * We change rt_genid and let gc do the cleanup
  */
 static void rt_secret_rebuild(unsigned long dummy)
 {
-        get_random_bytes(&rt_hash_rnd, 4);
-        ip_rt_flush_expected = 1;
-        cancel_delayed_work(&expires_work);
-        schedule_delayed_work(&expires_work, HZ/10);
+        rt_cache_invalidate();
         mod_timer(&rt_secret_timer, jiffies + ip_rt_secret_interval);
 }
 
@@ -885,7 +855,8 @@ static int rt_garbage_collect(struct dst_ops *ops)
                         rthp = &rt_hash_table[k].chain;
                         spin_lock_bh(rt_hash_lock_addr(k));
                         while ((rth = *rthp) != NULL) {
-                                if (!rt_may_expire(rth, tmo, expire)) {
+                                if (rth->rt_genid == atomic_read(&rt_genid) &&
+                                        !rt_may_expire(rth, tmo, expire)) {
                                         tmo >>= 1;
                                         rthp = &rth->u.dst.rt_next;
                                         continue;
@@ -966,6 +937,11 @@ restart:
 
         spin_lock_bh(rt_hash_lock_addr(hash));
         while ((rth = *rthp) != NULL) {
+                if (rth->rt_genid != atomic_read(&rt_genid)) {
+                        *rthp = rth->u.dst.rt_next;
+                        rt_free(rth);
+                        continue;
+                }
                 if (compare_keys(&rth->fl, &rt->fl) && compare_netns(rth, rt)) {
                         /* Put it first */
                         *rthp = rth->u.dst.rt_next;
@@ -1131,17 +1107,19 @@ void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
 
 static void rt_del(unsigned hash, struct rtable *rt)
 {
-        struct rtable **rthp;
+        struct rtable **rthp, *aux;
 
+        rthp = &rt_hash_table[hash].chain;
         spin_lock_bh(rt_hash_lock_addr(hash));
         ip_rt_put(rt);
-        for (rthp = &rt_hash_table[hash].chain; *rthp;
-             rthp = &(*rthp)->u.dst.rt_next)
-                if (*rthp == rt) {
-                        *rthp = rt->u.dst.rt_next;
-                        rt_free(rt);
-                        break;
+        while ((aux = *rthp) != NULL) {
+                if (aux == rt || (aux->rt_genid != atomic_read(&rt_genid))) {
+                        *rthp = aux->u.dst.rt_next;
+                        rt_free(aux);
+                        continue;
                 }
+                rthp = &aux->u.dst.rt_next;
+        }
         spin_unlock_bh(rt_hash_lock_addr(hash));
 }
 
@@ -1186,7 +1164,8 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                 if (rth->fl.fl4_dst != daddr ||
                                     rth->fl.fl4_src != skeys[i] ||
                                     rth->fl.oif != ikeys[k] ||
-                                    rth->fl.iif != 0) {
+                                    rth->fl.iif != 0 ||
+                                    rth->rt_genid != atomic_read(&rt_genid)) {
                                         rthp = &rth->u.dst.rt_next;
                                         continue;
                                 }
@@ -1224,7 +1203,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                 rt->u.dst.neighbour     = NULL;
                                 rt->u.dst.hh            = NULL;
                                 rt->u.dst.xfrm          = NULL;
-
+                                rt->rt_genid            = atomic_read(&rt_genid);
                                 rt->rt_flags            |= RTCF_REDIRECTED;
 
                                 /* Gateway is different ... */
@@ -1445,7 +1424,8 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
                             rth->rt_src  == iph->saddr &&
                             rth->fl.iif == 0 &&
                             !(dst_metric_locked(&rth->u.dst, RTAX_MTU)) &&
-                            rth->u.dst.dev->nd_net == net) {
+                            rth->u.dst.dev->nd_net == net &&
+                            rth->rt_genid == atomic_read(&rt_genid)) {
                                 unsigned short mtu = new_mtu;
 
                                 if (new_mtu < 68 || new_mtu >= old_mtu) {
@@ -1680,8 +1660,9 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         rth->fl.oif     = 0;
         rth->rt_gateway = daddr;
         rth->rt_spec_dst= spec_dst;
-        rth->rt_type    = RTN_MULTICAST;
+        rth->rt_genid   = atomic_read(&rt_genid);
         rth->rt_flags   = RTCF_MULTICAST;
+        rth->rt_type    = RTN_MULTICAST;
         if (our) {
                 rth->u.dst.input= ip_local_deliver;
                 rth->rt_flags |= RTCF_LOCAL;
@@ -1820,6 +1801,7 @@ static inline int __mkroute_input(struct sk_buff *skb,
 
         rth->u.dst.input = ip_forward;
         rth->u.dst.output = ip_output;
+        rth->rt_genid = atomic_read(&rt_genid);
 
         rt_set_nexthop(rth, res, itag);
 
@@ -1980,6 +1962,7 @@ local_input:
                 goto e_nobufs;
 
         rth->u.dst.output= ip_rt_bug;
+        rth->rt_genid = atomic_read(&rt_genid);
 
         atomic_set(&rth->u.dst.__refcnt, 1);
         rth->u.dst.flags= DST_HOST;
@@ -2071,7 +2054,8 @@ int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
                     rth->fl.oif == 0 &&
                     rth->fl.mark == skb->mark &&
                     rth->fl.fl4_tos == tos &&
-                    rth->u.dst.dev->nd_net == net) {
+                    rth->u.dst.dev->nd_net == net &&
+                    rth->rt_genid == atomic_read(&rt_genid)) {
                         dst_use(&rth->u.dst, jiffies);
                         RT_CACHE_STAT_INC(in_hit);
                         rcu_read_unlock();
@@ -2199,6 +2183,7 @@ static inline int __mkroute_output(struct rtable **result,
         rth->rt_spec_dst= fl->fl4_src;
 
         rth->u.dst.output=ip_output;
+        rth->rt_genid = atomic_read(&rt_genid);
 
         RT_CACHE_STAT_INC(out_slow_tot);
 
@@ -2471,7 +2456,8 @@ int __ip_route_output_key(struct net *net, struct rtable **rp,
                     rth->fl.mark == flp->mark &&
                     !((rth->fl.fl4_tos ^ flp->fl4_tos) &
                             (IPTOS_RT_MASK | RTO_ONLINK)) &&
-                    rth->u.dst.dev->nd_net == net) {
+                    rth->u.dst.dev->nd_net == net &&
+                    rth->rt_genid == atomic_read(&rt_genid)) {
                         dst_use(&rth->u.dst, jiffies);
                         RT_CACHE_STAT_INC(out_hit);
                         rcu_read_unlock_bh();
@@ -2498,6 +2484,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
         .check                  =       ipv4_dst_check,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
         .entry_size             =       sizeof(struct rtable),
+        .entries                =       ATOMIC_INIT(0),
 };
 
 
@@ -2525,6 +2512,7 @@ static int ipv4_dst_blackhole(struct rtable **rp, struct flowi *flp, struct sock
                 rt->idev = ort->idev;
                 if (rt->idev)
                         in_dev_hold(rt->idev);
+                rt->rt_genid = atomic_read(&rt_genid);
                 rt->rt_flags = ort->rt_flags;
                 rt->rt_type = ort->rt_type;
                 rt->rt_dst = ort->rt_dst;
@@ -2779,6 +2767,8 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
                      rt = rcu_dereference(rt->u.dst.rt_next), idx++) {
                         if (idx < s_idx)
                                 continue;
+                        if (rt->rt_genid != atomic_read(&rt_genid))
+                                continue;
                         skb->dst = dst_clone(&rt->u.dst);
                         if (rt_fill_info(skb, NETLINK_CB(cb->skb).pid,
                                          cb->nlh->nlmsg_seq, RTM_NEWROUTE,
@@ -2848,24 +2838,6 @@ ctl_table ipv4_route_table[] = {
                 .strategy       = &ipv4_sysctl_rtcache_flush_strategy,
         },
         {
-                .ctl_name       = NET_IPV4_ROUTE_MIN_DELAY,
-                .procname       = "min_delay",
-                .data           = &ip_rt_min_delay,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
-        },
-        {
-                .ctl_name       = NET_IPV4_ROUTE_MAX_DELAY,
-                .procname       = "max_delay",
-                .data           = &ip_rt_max_delay,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-                .strategy       = &sysctl_jiffies,
-        },
-        {
                 .ctl_name       = NET_IPV4_ROUTE_GC_THRESH,
                 .procname       = "gc_thresh",
                 .data           = &ipv4_dst_ops.gc_thresh,
@@ -3023,8 +2995,8 @@ int __init ip_rt_init(void)
 {
         int rc = 0;
 
-        rt_hash_rnd = (int) ((num_physpages ^ (num_physpages>>8)) ^
-                             (jiffies ^ (jiffies >> 7)));
+        atomic_set(&rt_genid, (int) ((num_physpages ^ (num_physpages>>8)) ^
+                             (jiffies ^ (jiffies >> 7))));
 
 #ifdef CONFIG_NET_CLS_ROUTE
         ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct));
@@ -3057,7 +3029,6 @@ int __init ip_rt_init(void)
         devinet_init();
         ip_fib_init();
 
-        setup_timer(&rt_flush_timer, rt_run_flush, 0);
         setup_timer(&rt_secret_timer, rt_secret_rebuild, 0);
 
         /* All the timers, started at system startup tend
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 82cdf23837e3..88286f35d1e2 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -185,7 +185,7 @@ static int strategy_allowed_congestion_control(ctl_table *table, int __user *nam
 
         tcp_get_available_congestion_control(tbl.data, tbl.maxlen);
         ret = sysctl_string(&tbl, name, nlen, oldval, oldlenp, newval, newlen);
-        if (ret == 0 && newval && newlen)
+        if (ret == 1 && newval && newlen)
                 ret = tcp_set_allowed_congestion_control(tbl.data);
         kfree(tbl.data);
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index fa2c85ca5bc3..19c449f62672 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2153,7 +2153,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int fast_rexmit)
                 tp->lost_skb_hint = skb;
                 tp->lost_cnt_hint = cnt;
 
-                if (tcp_is_fack(tp) ||
+                if (tcp_is_fack(tp) || tcp_is_reno(tp) ||
                     (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
                         cnt += tcp_skb_pcount(skb);
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 9aea88b8d4fc..77c1939a2b0d 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -369,8 +369,8 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                 return;
         }
 
-        sk = inet_lookup(&tcp_hashinfo, iph->daddr, th->dest, iph->saddr,
-                         th->source, inet_iif(skb));
+        sk = inet_lookup(skb->dev->nd_net, &tcp_hashinfo, iph->daddr, th->dest,
+                        iph->saddr, th->source, inet_iif(skb));
         if (!sk) {
                 ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
                 return;
@@ -1503,8 +1503,8 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
         if (req)
                 return tcp_check_req(sk, skb, req, prev);
 
-        nsk = inet_lookup_established(&tcp_hashinfo, iph->saddr, th->source,
-                                      iph->daddr, th->dest, inet_iif(skb));
+        nsk = inet_lookup_established(sk->sk_net, &tcp_hashinfo, iph->saddr,
+                        th->source, iph->daddr, th->dest, inet_iif(skb));
 
         if (nsk) {
                 if (nsk->sk_state != TCP_TIME_WAIT) {
@@ -1661,8 +1661,8 @@ int tcp_v4_rcv(struct sk_buff *skb)
         TCP_SKB_CB(skb)->flags   = iph->tos;
         TCP_SKB_CB(skb)->sacked  = 0;
 
-        sk = __inet_lookup(&tcp_hashinfo, iph->saddr, th->source,
-                           iph->daddr, th->dest, inet_iif(skb));
+        sk = __inet_lookup(skb->dev->nd_net, &tcp_hashinfo, iph->saddr,
+                        th->source, iph->daddr, th->dest, inet_iif(skb));
         if (!sk)
                 goto no_tcp_socket;
 
@@ -1735,7 +1735,8 @@ do_time_wait:
         }
         switch (tcp_timewait_state_process(inet_twsk(sk), skb, th)) {
         case TCP_TW_SYN: {
-                struct sock *sk2 = inet_lookup_listener(&tcp_hashinfo,
+                struct sock *sk2 = inet_lookup_listener(skb->dev->nd_net,
+                                                        &tcp_hashinfo,
                                                         iph->daddr, th->dest,
                                                         inet_iif(skb));
                 if (sk2) {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 89f0188885c7..ed750f9ceb07 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2564,5 +2564,4 @@ EXPORT_SYMBOL(tcp_connect);
 EXPORT_SYMBOL(tcp_make_synack);
 EXPORT_SYMBOL(tcp_simple_retransmit);
 EXPORT_SYMBOL(tcp_sync_mss);
-EXPORT_SYMBOL(sysctl_tcp_tso_win_divisor);
 EXPORT_SYMBOL(tcp_mtup_init);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 2fb8d731026b..7ea1b67b6de1 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -130,14 +130,14 @@ EXPORT_SYMBOL(sysctl_udp_wmem_min);
 atomic_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
 
-static inline int __udp_lib_lport_inuse(__u16 num,
+static inline int __udp_lib_lport_inuse(struct net *net, __u16 num,
                                         const struct hlist_head udptable[])
 {
         struct sock *sk;
         struct hlist_node *node;
 
         sk_for_each(sk, node, &udptable[num & (UDP_HTABLE_SIZE - 1)])
-                if (sk->sk_hash == num)
+                if (sk->sk_net == net && sk->sk_hash == num)
                         return 1;
         return 0;
 }
@@ -159,6 +159,7 @@ int __udp_lib_get_port(struct sock *sk, unsigned short snum,
         struct hlist_head *head;
         struct sock *sk2;
         int    error = 1;
+        struct net *net = sk->sk_net;
 
         write_lock_bh(&udp_hash_lock);
 
@@ -198,7 +199,7 @@ int __udp_lib_get_port(struct sock *sk, unsigned short snum,
                 /* 2nd pass: find hole in shortest hash chain */
                 rover = best;
                 for (i = 0; i < (1 << 16) / UDP_HTABLE_SIZE; i++) {
-                        if (! __udp_lib_lport_inuse(rover, udptable))
+                        if (! __udp_lib_lport_inuse(net, rover, udptable))
                                 goto gotit;
                         rover += UDP_HTABLE_SIZE;
                         if (rover > high)
@@ -218,6 +219,7 @@ gotit:
                 sk_for_each(sk2, node, head)
                         if (sk2->sk_hash == snum                             &&
                             sk2 != sk                                        &&
+                            sk2->sk_net == net                               &&
                             (!sk2->sk_reuse        || !sk->sk_reuse)         &&
                             (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
                              || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
@@ -261,9 +263,9 @@ static inline int udp_v4_get_port(struct sock *sk, unsigned short snum)
 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
  * harder than this. -DaveM
  */
-static struct sock *__udp4_lib_lookup(__be32 saddr, __be16 sport,
-                                      __be32 daddr, __be16 dport,
-                                      int dif, struct hlist_head udptable[])
+static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
+                __be16 sport, __be32 daddr, __be16 dport,
+                int dif, struct hlist_head udptable[])
 {
         struct sock *sk, *result = NULL;
         struct hlist_node *node;
@@ -274,7 +276,8 @@ static struct sock *__udp4_lib_lookup(__be32 saddr, __be16 sport,
         sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {
                 struct inet_sock *inet = inet_sk(sk);
 
-                if (sk->sk_hash == hnum && !ipv6_only_sock(sk)) {
+                if (sk->sk_net == net && sk->sk_hash == hnum &&
+                                !ipv6_only_sock(sk)) {
                         int score = (sk->sk_family == PF_INET ? 1 : 0);
                         if (inet->rcv_saddr) {
                                 if (inet->rcv_saddr != daddr)
@@ -361,8 +364,8 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct hlist_head udptable[])
         int harderr;
         int err;
 
-        sk = __udp4_lib_lookup(iph->daddr, uh->dest, iph->saddr, uh->source,
-                               skb->dev->ifindex, udptable                  );
+        sk = __udp4_lib_lookup(skb->dev->nd_net, iph->daddr, uh->dest,
+                        iph->saddr, uh->source, skb->dev->ifindex, udptable);
         if (sk == NULL) {
                 ICMP_INC_STATS_BH(ICMP_MIB_INERRORS);
                 return; /* No socket for error */
@@ -1185,8 +1188,8 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
         if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                 return __udp4_lib_mcast_deliver(skb, uh, saddr, daddr, udptable);
 
-        sk = __udp4_lib_lookup(saddr, uh->source, daddr, uh->dest,
-                               inet_iif(skb), udptable);
+        sk = __udp4_lib_lookup(skb->dev->nd_net, saddr, uh->source, daddr,
+                        uh->dest, inet_iif(skb), udptable);
 
         if (sk != NULL) {
                 int ret = 0;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 3783e3ee56a4..10ed70491434 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -247,6 +247,7 @@ static struct dst_ops xfrm4_dst_ops = {
         .local_out =            __ip_local_out,
         .gc_thresh =            1024,
         .entry_size =           sizeof(struct xfrm_dst),
+        .entries =              ATOMIC_INIT(0),
 };
 
 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index 326845195620..41f5982d2087 100644
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -38,7 +38,7 @@ static void ipip_destroy(struct xfrm_state *x)
 {
 }
 
-static struct xfrm_type ipip_type = {
+static const struct xfrm_type ipip_type = {
         .description    = "IPIP",
         .owner          = THIS_MODULE,
         .proto          = IPPROTO_IPIP,
@@ -50,7 +50,7 @@ static struct xfrm_type ipip_type = {
 
 static int xfrm_tunnel_rcv(struct sk_buff *skb)
 {
-        return xfrm4_rcv_spi(skb, IPPROTO_IP, ip_hdr(skb)->saddr);
+        return xfrm4_rcv_spi(skb, IPPROTO_IPIP, ip_hdr(skb)->saddr);
 }
 
 static int xfrm_tunnel_err(struct sk_buff *skb, u32 info)
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index eb0b8085949b..3ffb0323668c 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -85,6 +85,7 @@ config INET6_ESP
         depends on IPV6
         select XFRM
         select CRYPTO
+        select CRYPTO_AEAD
         select CRYPTO_HMAC
         select CRYPTO_MD5
         select CRYPTO_CBC
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index fb0d07a15e93..379c8e04c36c 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -515,7 +515,7 @@ static void ah6_destroy(struct xfrm_state *x)
         kfree(ahp);
 }
 
-static struct xfrm_type ah6_type =
+static const struct xfrm_type ah6_type =
 {
         .description    = "AH6",
         .owner          = THIS_MODULE,
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 5bd5292ad9fa..8e0f1428c716 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -24,33 +24,124 @@
  *      This file is derived from net/ipv4/esp.c
  */
 
+#include <crypto/aead.h>
+#include <crypto/authenc.h>
 #include <linux/err.h>
 #include <linux/module.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/esp.h>
 #include <linux/scatterlist.h>
-#include <linux/crypto.h>
 #include <linux/kernel.h>
 #include <linux/pfkeyv2.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <linux/icmpv6.h>
 
+struct esp_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+
+#define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0]))
+
+/*
+ * Allocate an AEAD request structure with extra space for SG and IV.
+ *
+ * For alignment considerations the IV is placed at the front, followed
+ * by the request and finally the SG list.
+ *
+ * TODO: Use spare space in skb for this where possible.
+ */
+static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags)
+{
+        unsigned int len;
+
+        len = crypto_aead_ivsize(aead);
+        if (len) {
+                len += crypto_aead_alignmask(aead) &
+                       ~(crypto_tfm_ctx_alignment() - 1);
+                len = ALIGN(len, crypto_tfm_ctx_alignment());
+        }
+
+        len += sizeof(struct aead_givcrypt_request) + crypto_aead_reqsize(aead);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+
+        len += sizeof(struct scatterlist) * nfrags;
+
+        return kmalloc(len, GFP_ATOMIC);
+}
+
+static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp)
+{
+        return crypto_aead_ivsize(aead) ?
+               PTR_ALIGN((u8 *)tmp, crypto_aead_alignmask(aead) + 1) : tmp;
+}
+
+static inline struct aead_givcrypt_request *esp_tmp_givreq(
+        struct crypto_aead *aead, u8 *iv)
+{
+        struct aead_givcrypt_request *req;
+
+        req = (void *)PTR_ALIGN(iv + crypto_aead_ivsize(aead),
+                                crypto_tfm_ctx_alignment());
+        aead_givcrypt_set_tfm(req, aead);
+        return req;
+}
+
+static inline struct aead_request *esp_tmp_req(struct crypto_aead *aead, u8 *iv)
+{
+        struct aead_request *req;
+
+        req = (void *)PTR_ALIGN(iv + crypto_aead_ivsize(aead),
+                                crypto_tfm_ctx_alignment());
+        aead_request_set_tfm(req, aead);
+        return req;
+}
+
+static inline struct scatterlist *esp_req_sg(struct crypto_aead *aead,
+                                             struct aead_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_aead_reqsize(aead),
+                             __alignof__(struct scatterlist));
+}
+
+static inline struct scatterlist *esp_givreq_sg(
+        struct crypto_aead *aead, struct aead_givcrypt_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_aead_reqsize(aead),
+                             __alignof__(struct scatterlist));
+}
+
+static void esp_output_done(struct crypto_async_request *base, int err)
+{
+        struct sk_buff *skb = base->data;
+
+        kfree(ESP_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
+
 static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err;
         struct ip_esp_hdr *esph;
-        struct crypto_blkcipher *tfm;
-        struct blkcipher_desc desc;
+        struct crypto_aead *aead;
+        struct aead_givcrypt_request *req;
+        struct scatterlist *sg;
+        struct scatterlist *asg;
         struct sk_buff *trailer;
+        void *tmp;
         int blksize;
         int clen;
         int alen;
         int nfrags;
+        u8 *iv;
         u8 *tail;
         struct esp_data *esp = x->data;
 
@@ -60,18 +151,26 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         /* Round to block size */
         clen = skb->len;
 
-        alen = esp->auth.icv_trunc_len;
-        tfm = esp->conf.tfm;
-        desc.tfm = tfm;
-        desc.flags = 0;
-        blksize = ALIGN(crypto_blkcipher_blocksize(tfm), 4);
+        aead = esp->aead;
+        alen = crypto_aead_authsize(aead);
+
+        blksize = ALIGN(crypto_aead_blocksize(aead), 4);
         clen = ALIGN(clen + 2, blksize);
-        if (esp->conf.padlen)
-                clen = ALIGN(clen, esp->conf.padlen);
+        if (esp->padlen)
+                clen = ALIGN(clen, esp->padlen);
 
-        if ((nfrags = skb_cow_data(skb, clen-skb->len+alen, &trailer)) < 0) {
+        if ((err = skb_cow_data(skb, clen - skb->len + alen, &trailer)) < 0)
                 goto error;
-        }
+        nfrags = err;
+
+        tmp = esp_alloc_tmp(aead, nfrags + 1);
+        if (!tmp)
+                goto error;
+
+        iv = esp_tmp_iv(aead, tmp);
+        req = esp_tmp_givreq(aead, iv);
+        asg = esp_givreq_sg(aead, req);
+        sg = asg + 1;
 
         /* Fill padding... */
         tail = skb_tail_pointer(trailer);
@@ -81,86 +180,113 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
                         tail[i] = i + 1;
         } while (0);
         tail[clen-skb->len - 2] = (clen - skb->len) - 2;
-        pskb_put(skb, trailer, clen - skb->len);
+        tail[clen - skb->len - 1] = *skb_mac_header(skb);
+        pskb_put(skb, trailer, clen - skb->len + alen);
 
         skb_push(skb, -skb_network_offset(skb));
         esph = ip_esp_hdr(skb);
-        *(skb_tail_pointer(trailer) - 1) = *skb_mac_header(skb);
         *skb_mac_header(skb) = IPPROTO_ESP;
 
         esph->spi = x->id.spi;
         esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq);
 
-        spin_lock_bh(&x->lock);
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg,
+                     esph->enc_data + crypto_aead_ivsize(aead) - skb->data,
+                     clen + alen);
+        sg_init_one(asg, esph, sizeof(*esph));
 
-        if (esp->conf.ivlen) {
-                if (unlikely(!esp->conf.ivinitted)) {
-                        get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
-                        esp->conf.ivinitted = 1;
-                }
-                crypto_blkcipher_set_iv(tfm, esp->conf.ivec, esp->conf.ivlen);
-        }
+        aead_givcrypt_set_callback(req, 0, esp_output_done, skb);
+        aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
+        aead_givcrypt_set_assoc(req, asg, sizeof(*esph));
+        aead_givcrypt_set_giv(req, esph->enc_data, XFRM_SKB_CB(skb)->seq);
 
-        do {
-                struct scatterlist *sg = &esp->sgbuf[0];
+        ESP_SKB_CB(skb)->tmp = tmp;
+        err = crypto_aead_givencrypt(req);
+        if (err == -EINPROGRESS)
+                goto error;
 
-                if (unlikely(nfrags > ESP_NUM_FAST_SG)) {
-                        sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);
-                        if (!sg)
-                                goto unlock;
-                }
-                sg_init_table(sg, nfrags);
-                skb_to_sgvec(skb, sg,
-                             esph->enc_data +
-                             esp->conf.ivlen -
-                             skb->data, clen);
-                err = crypto_blkcipher_encrypt(&desc, sg, sg, clen);
-                if (unlikely(sg != &esp->sgbuf[0]))
-                        kfree(sg);
-        } while (0);
+        if (err == -EBUSY)
+                err = NET_XMIT_DROP;
+
+        kfree(tmp);
+
+error:
+        return err;
+}
+
+static int esp_input_done2(struct sk_buff *skb, int err)
+{
+        struct xfrm_state *x = xfrm_input_state(skb);
+        struct esp_data *esp = x->data;
+        struct crypto_aead *aead = esp->aead;
+        int alen = crypto_aead_authsize(aead);
+        int hlen = sizeof(struct ip_esp_hdr) + crypto_aead_ivsize(aead);
+        int elen = skb->len - hlen;
+        int hdr_len = skb_network_header_len(skb);
+        int padlen;
+        u8 nexthdr[2];
+
+        kfree(ESP_SKB_CB(skb)->tmp);
 
         if (unlikely(err))
-                goto unlock;
+                goto out;
 
-        if (esp->conf.ivlen) {
-                memcpy(esph->enc_data, esp->conf.ivec, esp->conf.ivlen);
-                crypto_blkcipher_get_iv(tfm, esp->conf.ivec, esp->conf.ivlen);
-        }
+        if (skb_copy_bits(skb, skb->len - alen - 2, nexthdr, 2))
+                BUG();
 
-        if (esp->auth.icv_full_len) {
-                err = esp_mac_digest(esp, skb, (u8 *)esph - skb->data,
-                                     sizeof(*esph) + esp->conf.ivlen + clen);
-                memcpy(pskb_put(skb, trailer, alen), esp->auth.work_icv, alen);
+        err = -EINVAL;
+        padlen = nexthdr[0];
+        if (padlen + 2 + alen >= elen) {
+                LIMIT_NETDEBUG(KERN_WARNING "ipsec esp packet is garbage "
+                               "padlen=%d, elen=%d\n", padlen + 2, elen - alen);
+                goto out;
         }
 
-unlock:
-        spin_unlock_bh(&x->lock);
+        /* ... check padding bits here. Silly. :-) */
 
-error:
+        pskb_trim(skb, skb->len - alen - padlen - 2);
+        __skb_pull(skb, hlen);
+        skb_set_transport_header(skb, -hdr_len);
+
+        err = nexthdr[1];
+
+        /* RFC4303: Drop dummy packets without any error */
+        if (err == IPPROTO_NONE)
+                err = -EINVAL;
+
+out:
         return err;
 }
 
+static void esp_input_done(struct crypto_async_request *base, int err)
+{
+        struct sk_buff *skb = base->data;
+
+        xfrm_input_resume(skb, esp_input_done2(skb, err));
+}
+
 static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        struct ipv6hdr *iph;
         struct ip_esp_hdr *esph;
         struct esp_data *esp = x->data;
-        struct crypto_blkcipher *tfm = esp->conf.tfm;
-        struct blkcipher_desc desc = { .tfm = tfm };
+        struct crypto_aead *aead = esp->aead;
+        struct aead_request *req;
         struct sk_buff *trailer;
-        int blksize = ALIGN(crypto_blkcipher_blocksize(tfm), 4);
-        int alen = esp->auth.icv_trunc_len;
-        int elen = skb->len - sizeof(*esph) - esp->conf.ivlen - alen;
-        int hdr_len = skb_network_header_len(skb);
+        int elen = skb->len - sizeof(*esph) - crypto_aead_ivsize(aead);
         int nfrags;
         int ret = 0;
+        void *tmp;
+        u8 *iv;
+        struct scatterlist *sg;
+        struct scatterlist *asg;
 
         if (!pskb_may_pull(skb, sizeof(*esph))) {
                 ret = -EINVAL;
                 goto out;
         }
 
-        if (elen <= 0 || (elen & (blksize-1))) {
+        if (elen <= 0) {
                 ret = -EINVAL;
                 goto out;
         }
@@ -170,86 +296,38 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
                 goto out;
         }
 
-        skb->ip_summed = CHECKSUM_NONE;
-
-        spin_lock(&x->lock);
-
-        /* If integrity check is required, do this. */
-        if (esp->auth.icv_full_len) {
-                u8 sum[alen];
-
-                ret = esp_mac_digest(esp, skb, 0, skb->len - alen);
-                if (ret)
-                        goto unlock;
+        ret = -ENOMEM;
+        tmp = esp_alloc_tmp(aead, nfrags + 1);
+        if (!tmp)
+                goto out;
 
-                if (skb_copy_bits(skb, skb->len - alen, sum, alen))
-                        BUG();
+        ESP_SKB_CB(skb)->tmp = tmp;
+        iv = esp_tmp_iv(aead, tmp);
+        req = esp_tmp_req(aead, iv);
+        asg = esp_req_sg(aead, req);
+        sg = asg + 1;
 
-                if (unlikely(memcmp(esp->auth.work_icv, sum, alen))) {
-                        ret = -EBADMSG;
-                        goto unlock;
-                }
-        }
+        skb->ip_summed = CHECKSUM_NONE;
 
         esph = (struct ip_esp_hdr *)skb->data;
-        iph = ipv6_hdr(skb);
 
         /* Get ivec. This can be wrong, check against another impls. */
-        if (esp->conf.ivlen)
-                crypto_blkcipher_set_iv(tfm, esph->enc_data, esp->conf.ivlen);
-
-        {
-                struct scatterlist *sg = &esp->sgbuf[0];
-
-                if (unlikely(nfrags > ESP_NUM_FAST_SG)) {
-                        sg = kmalloc(sizeof(struct scatterlist)*nfrags, GFP_ATOMIC);
-                        if (!sg) {
-                                ret = -ENOMEM;
-                                goto unlock;
-                        }
-                }
-                sg_init_table(sg, nfrags);
-                skb_to_sgvec(skb, sg,
-                             sizeof(*esph) + esp->conf.ivlen,
-                             elen);
-                ret = crypto_blkcipher_decrypt(&desc, sg, sg, elen);
-                if (unlikely(sg != &esp->sgbuf[0]))
-                        kfree(sg);
-        }
+        iv = esph->enc_data;
 
-unlock:
-        spin_unlock(&x->lock);
+        sg_init_table(sg, nfrags);
+        skb_to_sgvec(skb, sg, sizeof(*esph) + crypto_aead_ivsize(aead), elen);
+        sg_init_one(asg, esph, sizeof(*esph));
 
-        if (unlikely(ret))
-                goto out;
-
-        {
-                u8 nexthdr[2];
-                u8 padlen;
-
-                if (skb_copy_bits(skb, skb->len-alen-2, nexthdr, 2))
-                        BUG();
-
-                padlen = nexthdr[0];
-                if (padlen+2 >= elen) {
-                        LIMIT_NETDEBUG(KERN_WARNING "ipsec esp packet is garbage padlen=%d, elen=%d\n", padlen+2, elen);
-                        ret = -EINVAL;
-                        goto out;
-                }
-                /* ... check padding bits here. Silly. :-) */
+        aead_request_set_callback(req, 0, esp_input_done, skb);
+        aead_request_set_crypt(req, sg, sg, elen, iv);
+        aead_request_set_assoc(req, asg, sizeof(*esph));
 
-                /* RFC4303: Drop dummy packets without any error */
-                if (nexthdr[1] == IPPROTO_NONE) {
-                        ret = -EINVAL;
-                        goto out;
-                }
+        ret = crypto_aead_decrypt(req);
+        if (ret == -EINPROGRESS)
+                goto out;
 
-                pskb_trim(skb, skb->len - alen - padlen - 2);
-                ret = nexthdr[1];
-        }
+        ret = esp_input_done2(skb, ret);
 
-        __skb_pull(skb, sizeof(*esph) + esp->conf.ivlen);
-        skb_set_transport_header(skb, -hdr_len);
 out:
         return ret;
 }
@@ -257,11 +335,11 @@ out:
 static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
 {
         struct esp_data *esp = x->data;
-        u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
-        u32 align = max_t(u32, blksize, esp->conf.padlen);
+        u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
+        u32 align = max_t(u32, blksize, esp->padlen);
         u32 rem;
 
-        mtu -= x->props.header_len + esp->auth.icv_trunc_len;
+        mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
         rem = mtu & (align - 1);
         mtu &= ~(align - 1);
 
@@ -300,81 +378,146 @@ static void esp6_destroy(struct xfrm_state *x)
         if (!esp)
                 return;
 
-        crypto_free_blkcipher(esp->conf.tfm);
-        esp->conf.tfm = NULL;
-        kfree(esp->conf.ivec);
-        esp->conf.ivec = NULL;
-        crypto_free_hash(esp->auth.tfm);
-        esp->auth.tfm = NULL;
-        kfree(esp->auth.work_icv);
-        esp->auth.work_icv = NULL;
+        crypto_free_aead(esp->aead);
         kfree(esp);
 }
 
-static int esp6_init_state(struct xfrm_state *x)
+static int esp_init_aead(struct xfrm_state *x)
+{
+        struct esp_data *esp = x->data;
+        struct crypto_aead *aead;
+        int err;
+
+        aead = crypto_alloc_aead(x->aead->alg_name, 0, 0);
+        err = PTR_ERR(aead);
+        if (IS_ERR(aead))
+                goto error;
+
+        esp->aead = aead;
+
+        err = crypto_aead_setkey(aead, x->aead->alg_key,
+                                 (x->aead->alg_key_len + 7) / 8);
+        if (err)
+                goto error;
+
+        err = crypto_aead_setauthsize(aead, x->aead->alg_icv_len / 8);
+        if (err)
+                goto error;
+
+error:
+        return err;
+}
+
+static int esp_init_authenc(struct xfrm_state *x)
 {
-        struct esp_data *esp = NULL;
-        struct crypto_blkcipher *tfm;
+        struct esp_data *esp = x->data;
+        struct crypto_aead *aead;
+        struct crypto_authenc_key_param *param;
+        struct rtattr *rta;
+        char *key;
+        char *p;
+        char authenc_name[CRYPTO_MAX_ALG_NAME];
+        unsigned int keylen;
+        int err;
 
+        err = -EINVAL;
         if (x->ealg == NULL)
                 goto error;
 
-        if (x->encap)
+        err = -ENAMETOOLONG;
+        if (snprintf(authenc_name, CRYPTO_MAX_ALG_NAME, "authenc(%s,%s)",
+                     x->aalg ? x->aalg->alg_name : "digest_null",
+                     x->ealg->alg_name) >= CRYPTO_MAX_ALG_NAME)
                 goto error;
 
-        esp = kzalloc(sizeof(*esp), GFP_KERNEL);
-        if (esp == NULL)
-                return -ENOMEM;
+        aead = crypto_alloc_aead(authenc_name, 0, 0);
+        err = PTR_ERR(aead);
+        if (IS_ERR(aead))
+                goto error;
+
+        esp->aead = aead;
+
+        keylen = (x->aalg ? (x->aalg->alg_key_len + 7) / 8 : 0) +
+                 (x->ealg->alg_key_len + 7) / 8 + RTA_SPACE(sizeof(*param));
+        err = -ENOMEM;
+        key = kmalloc(keylen, GFP_KERNEL);
+        if (!key)
+                goto error;
+
+        p = key;
+        rta = (void *)p;
+        rta->rta_type = CRYPTO_AUTHENC_KEYA_PARAM;
+        rta->rta_len = RTA_LENGTH(sizeof(*param));
+        param = RTA_DATA(rta);
+        p += RTA_SPACE(sizeof(*param));
 
         if (x->aalg) {
                 struct xfrm_algo_desc *aalg_desc;
-                struct crypto_hash *hash;
-
-                hash = crypto_alloc_hash(x->aalg->alg_name, 0,
-                                         CRYPTO_ALG_ASYNC);
-                if (IS_ERR(hash))
-                        goto error;
 
-                esp->auth.tfm = hash;
-                if (crypto_hash_setkey(hash, x->aalg->alg_key,
-                                       (x->aalg->alg_key_len + 7) / 8))
-                        goto error;
+                memcpy(p, x->aalg->alg_key, (x->aalg->alg_key_len + 7) / 8);
+                p += (x->aalg->alg_key_len + 7) / 8;
 
                 aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
                 BUG_ON(!aalg_desc);
 
+                err = -EINVAL;
                 if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-                    crypto_hash_digestsize(hash)) {
+                    crypto_aead_authsize(aead)) {
                         NETDEBUG(KERN_INFO "ESP: %s digestsize %u != %hu\n",
                                  x->aalg->alg_name,
-                                 crypto_hash_digestsize(hash),
+                                 crypto_aead_authsize(aead),
                                  aalg_desc->uinfo.auth.icv_fullbits/8);
-                        goto error;
+                        goto free_key;
                 }
 
-                esp->auth.icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
-                esp->auth.icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
-
-                esp->auth.work_icv = kmalloc(esp->auth.icv_full_len, GFP_KERNEL);
-                if (!esp->auth.work_icv)
-                        goto error;
-        }
-        tfm = crypto_alloc_blkcipher(x->ealg->alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (IS_ERR(tfm))
-                goto error;
-        esp->conf.tfm = tfm;
-        esp->conf.ivlen = crypto_blkcipher_ivsize(tfm);
-        esp->conf.padlen = 0;
-        if (esp->conf.ivlen) {
-                esp->conf.ivec = kmalloc(esp->conf.ivlen, GFP_KERNEL);
-                if (unlikely(esp->conf.ivec == NULL))
-                        goto error;
-                esp->conf.ivinitted = 0;
+                err = crypto_aead_setauthsize(
+                        aead, aalg_desc->uinfo.auth.icv_truncbits / 8);
+                if (err)
+                        goto free_key;
         }
-        if (crypto_blkcipher_setkey(tfm, x->ealg->alg_key,
-                                    (x->ealg->alg_key_len + 7) / 8))
+
+        param->enckeylen = cpu_to_be32((x->ealg->alg_key_len + 7) / 8);
+        memcpy(p, x->ealg->alg_key, (x->ealg->alg_key_len + 7) / 8);
+
+        err = crypto_aead_setkey(aead, key, keylen);
+
+free_key:
+        kfree(key);
+
+error:
+        return err;
+}
+
+static int esp6_init_state(struct xfrm_state *x)
+{
+        struct esp_data *esp;
+        struct crypto_aead *aead;
+        u32 align;
+        int err;
+
+        if (x->encap)
+                return -EINVAL;
+
+        esp = kzalloc(sizeof(*esp), GFP_KERNEL);
+        if (esp == NULL)
+                return -ENOMEM;
+
+        x->data = esp;
+
+        if (x->aead)
+                err = esp_init_aead(x);
+        else
+                err = esp_init_authenc(x);
+
+        if (err)
                 goto error;
-        x->props.header_len = sizeof(struct ip_esp_hdr) + esp->conf.ivlen;
+
+        aead = esp->aead;
+
+        esp->padlen = 0;
+
+        x->props.header_len = sizeof(struct ip_esp_hdr) +
+                              crypto_aead_ivsize(aead);
         switch (x->props.mode) {
         case XFRM_MODE_BEET:
         case XFRM_MODE_TRANSPORT:
@@ -385,17 +528,17 @@ static int esp6_init_state(struct xfrm_state *x)
         default:
                 goto error;
         }
-        x->data = esp;
-        return 0;
+
+        align = ALIGN(crypto_aead_blocksize(aead), 4);
+        if (esp->padlen)
+                align = max_t(u32, align, esp->padlen);
+        x->props.trailer_len = align + 1 + crypto_aead_authsize(esp->aead);
 
 error:
-        x->data = esp;
-        esp6_destroy(x);
-        x->data = NULL;
-        return -EINVAL;
+        return err;
 }
 
-static struct xfrm_type esp6_type =
+static const struct xfrm_type esp6_type =
 {
         .description    = "ESP6",
         .owner          = THIS_MODULE,
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index a66a7d8e2811..d325a9958909 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -54,7 +54,8 @@ EXPORT_SYMBOL(__inet6_hash);
  *
  * The sockhash lock must be held as a reader here.
  */
-struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
+struct sock *__inet6_lookup_established(struct net *net,
+                                        struct inet_hashinfo *hashinfo,
                                            const struct in6_addr *saddr,
                                            const __be16 sport,
                                            const struct in6_addr *daddr,
@@ -75,22 +76,13 @@ struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
         read_lock(lock);
         sk_for_each(sk, node, &head->chain) {
                 /* For IPV6 do the cheaper port and family tests first. */
-                if (INET6_MATCH(sk, hash, saddr, daddr, ports, dif))
+                if (INET6_MATCH(sk, net, hash, saddr, daddr, ports, dif))
                         goto hit; /* You sunk my battleship! */
         }
         /* Must check for a TIME_WAIT'er before going to listener hash. */
         sk_for_each(sk, node, &head->twchain) {
-                const struct inet_timewait_sock *tw = inet_twsk(sk);
-
-                if(*((__portpair *)&(tw->tw_dport))     == ports        &&
-                   sk->sk_family                == PF_INET6) {
-                        const struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
-
-                        if (ipv6_addr_equal(&tw6->tw_v6_daddr, saddr)   &&
-                            ipv6_addr_equal(&tw6->tw_v6_rcv_saddr, daddr)       &&
-                            (!sk->sk_bound_dev_if || sk->sk_bound_dev_if == dif))
-                                goto hit;
-                }
+                if (INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif))
+                        goto hit;
         }
         read_unlock(lock);
         return NULL;
@@ -102,9 +94,9 @@ hit:
 }
 EXPORT_SYMBOL(__inet6_lookup_established);
 
-struct sock *inet6_lookup_listener(struct inet_hashinfo *hashinfo,
-                                   const struct in6_addr *daddr,
-                                   const unsigned short hnum, const int dif)
+struct sock *inet6_lookup_listener(struct net *net,
+                struct inet_hashinfo *hashinfo, const struct in6_addr *daddr,
+                const unsigned short hnum, const int dif)
 {
         struct sock *sk;
         const struct hlist_node *node;
@@ -113,7 +105,8 @@ struct sock *inet6_lookup_listener(struct inet_hashinfo *hashinfo,
 
         read_lock(&hashinfo->lhash_lock);
         sk_for_each(sk, node, &hashinfo->listening_hash[inet_lhashfn(hnum)]) {
-                if (inet_sk(sk)->num == hnum && sk->sk_family == PF_INET6) {
+                if (sk->sk_net == net && inet_sk(sk)->num == hnum &&
+                                sk->sk_family == PF_INET6) {
                         const struct ipv6_pinfo *np = inet6_sk(sk);
 
                         score = 1;
@@ -145,7 +138,7 @@ struct sock *inet6_lookup_listener(struct inet_hashinfo *hashinfo,
 
 EXPORT_SYMBOL_GPL(inet6_lookup_listener);
 
-struct sock *inet6_lookup(struct inet_hashinfo *hashinfo,
+struct sock *inet6_lookup(struct net *net, struct inet_hashinfo *hashinfo,
                           const struct in6_addr *saddr, const __be16 sport,
                           const struct in6_addr *daddr, const __be16 dport,
                           const int dif)
@@ -153,7 +146,7 @@ struct sock *inet6_lookup(struct inet_hashinfo *hashinfo,
         struct sock *sk;
 
         local_bh_disable();
-        sk = __inet6_lookup(hashinfo, saddr, sport, daddr, ntohs(dport), dif);
+        sk = __inet6_lookup(net, hashinfo, saddr, sport, daddr, ntohs(dport), dif);
         local_bh_enable();
 
         return sk;
@@ -179,21 +172,16 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         struct sock *sk2;
         const struct hlist_node *node;
         struct inet_timewait_sock *tw;
+        struct net *net = sk->sk_net;
 
         prefetch(head->chain.first);
         write_lock(lock);
 
         /* Check TIME-WAIT sockets first. */
         sk_for_each(sk2, node, &head->twchain) {
-                const struct inet6_timewait_sock *tw6 = inet6_twsk(sk2);
-
                 tw = inet_twsk(sk2);
 
-                if(*((__portpair *)&(tw->tw_dport)) == ports             &&
-                   sk2->sk_family              == PF_INET6       &&
-                   ipv6_addr_equal(&tw6->tw_v6_daddr, saddr)     &&
-                   ipv6_addr_equal(&tw6->tw_v6_rcv_saddr, daddr) &&
-                   (!sk2->sk_bound_dev_if || sk2->sk_bound_dev_if == dif)) {
+                if (INET6_TW_MATCH(sk2, net, hash, saddr, daddr, ports, dif)) {
                         if (twsk_unique(sk, sk2, twp))
                                 goto unique;
                         else
@@ -204,7 +192,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
 
         /* And established part... */
         sk_for_each(sk2, node, &head->chain) {
-                if (INET6_MATCH(sk2, hash, saddr, daddr, ports, dif))
+                if (INET6_MATCH(sk2, net, hash, saddr, daddr, ports, dif))
                         goto not_unique;
         }
 
@@ -248,97 +236,8 @@ static inline u32 inet6_sk_port_offset(const struct sock *sk)
 int inet6_hash_connect(struct inet_timewait_death_row *death_row,
                        struct sock *sk)
 {
-        struct inet_hashinfo *hinfo = death_row->hashinfo;
-        const unsigned short snum = inet_sk(sk)->num;
-        struct inet_bind_hashbucket *head;
-        struct inet_bind_bucket *tb;
-        int ret;
-
-        if (snum == 0) {
-                int i, port, low, high, remaining;
-                static u32 hint;
-                const u32 offset = hint + inet6_sk_port_offset(sk);
-                struct hlist_node *node;
-                struct inet_timewait_sock *tw = NULL;
-
-                inet_get_local_port_range(&low, &high);
-                remaining = (high - low) + 1;
-
-                local_bh_disable();
-                for (i = 1; i <= remaining; i++) {
-                        port = low + (i + offset) % remaining;
-                        head = &hinfo->bhash[inet_bhashfn(port, hinfo->bhash_size)];
-                        spin_lock(&head->lock);
-
-                        /* Does not bother with rcv_saddr checks,
-                         * because the established check is already
-                         * unique enough.
-                         */
-                        inet_bind_bucket_for_each(tb, node, &head->chain) {
-                                if (tb->port == port) {
-                                        BUG_TRAP(!hlist_empty(&tb->owners));
-                                        if (tb->fastreuse >= 0)
-                                                goto next_port;
-                                        if (!__inet6_check_established(death_row,
-                                                                       sk, port,
-                                                                       &tw))
-                                                goto ok;
-                                        goto next_port;
-                                }
-                        }
-
-                        tb = inet_bind_bucket_create(hinfo->bind_bucket_cachep,
-                                                     head, port);
-                        if (!tb) {
-                                spin_unlock(&head->lock);
-                                break;
-                        }
-                        tb->fastreuse = -1;
-                        goto ok;
-
-                next_port:
-                        spin_unlock(&head->lock);
-                }
-                local_bh_enable();
-
-                return -EADDRNOTAVAIL;
-
-ok:
-                hint += i;
-
-                /* Head lock still held and bh's disabled */
-                inet_bind_hash(sk, tb, port);
-                if (sk_unhashed(sk)) {
-                        inet_sk(sk)->sport = htons(port);
-                        __inet6_hash(hinfo, sk);
-                }
-                spin_unlock(&head->lock);
-
-                if (tw) {
-                        inet_twsk_deschedule(tw, death_row);
-                        inet_twsk_put(tw);
-                }
-
-                ret = 0;
-                goto out;
-        }
-
-        head = &hinfo->bhash[inet_bhashfn(snum, hinfo->bhash_size)];
-        tb   = inet_csk(sk)->icsk_bind_hash;
-        spin_lock_bh(&head->lock);
-
-        if (sk_head(&tb->owners) == sk && sk->sk_bind_node.next == NULL) {
-                __inet6_hash(hinfo, sk);
-                spin_unlock_bh(&head->lock);
-                return 0;
-        } else {
-                spin_unlock(&head->lock);
-                /* No definite answer... Walk to established hash table */
-                ret = __inet6_check_established(death_row, sk, snum, NULL);
-out:
-                local_bh_enable();
-                return ret;
-        }
+        return __inet_hash_connect(death_row, sk,
+                        __inet6_check_established, __inet6_hash);
 }
 
 EXPORT_SYMBOL_GPL(inet6_hash_connect);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 15c4f6cee3e6..9ac6ca2521c3 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -257,6 +257,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         ipv6_addr_copy(&hdr->daddr, first_hop);
 
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
 
         mtu = dst_mtu(dst);
         if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) {
@@ -636,6 +637,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
         if (skb_shinfo(skb)->frag_list) {
                 int first_len = skb_pagelen(skb);
+                int truesizes = 0;
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
@@ -658,7 +660,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                                 sock_hold(skb->sk);
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
-                                skb->truesize -= frag->truesize;
+                                truesizes += frag->truesize;
                         }
                 }
 
@@ -689,6 +691,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
                 first_len = skb_pagelen(skb);
                 skb->data_len = first_len - skb_headlen(skb);
+                skb->truesize -= truesizes;
                 skb->len = first_len;
                 ipv6_hdr(skb)->payload_len = htons(first_len -
                                                    sizeof(struct ipv6hdr));
@@ -1437,6 +1440,7 @@ int ip6_push_pending_frames(struct sock *sk)
         ipv6_addr_copy(&hdr->daddr, final_dst);
 
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
 
         skb->dst = dst_clone(&rt->u.dst);
         IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index b276d04d6db5..b90039593a7f 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -64,6 +64,7 @@ static LIST_HEAD(ipcomp6_tfms_list);
 
 static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
 {
+        int nexthdr;
         int err = -ENOMEM;
         struct ip_comp_hdr *ipch;
         int plen, dlen;
@@ -79,6 +80,8 @@ static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
 
         /* Remove ipcomp header and decompress original payload */
         ipch = (void *)skb->data;
+        nexthdr = ipch->nexthdr;
+
         skb->transport_header = skb->network_header + sizeof(*ipch);
         __skb_pull(skb, sizeof(*ipch));
 
@@ -108,7 +111,7 @@ static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
         skb->truesize += dlen - plen;
         __skb_put(skb, dlen - plen);
         skb_copy_to_linear_data(skb, scratch, dlen);
-        err = ipch->nexthdr;
+        err = nexthdr;
 
 out_put_cpu:
         put_cpu();
@@ -450,7 +453,7 @@ error:
         goto out;
 }
 
-static struct xfrm_type ipcomp6_type =
+static const struct xfrm_type ipcomp6_type =
 {
         .description    = "IPCOMP6",
         .owner          = THIS_MODULE,
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 49d396620eac..cd8a5bda13cd 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -330,7 +330,7 @@ static void mip6_destopt_destroy(struct xfrm_state *x)
 {
 }
 
-static struct xfrm_type mip6_destopt_type =
+static const struct xfrm_type mip6_destopt_type =
 {
         .description    = "MIP6DESTOPT",
         .owner          = THIS_MODULE,
@@ -462,7 +462,7 @@ static void mip6_rthdr_destroy(struct xfrm_state *x)
 {
 }
 
-static struct xfrm_type mip6_rthdr_type =
+static const struct xfrm_type mip6_rthdr_type =
 {
         .description    = "MIP6RT",
         .owner          = THIS_MODULE,
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 56b4ea6d29ed..e869916b05f1 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -515,6 +515,7 @@ static struct notifier_block ipq_nl_notifier = {
         .notifier_call  = ipq_rcv_nl_event,
 };
 
+#ifdef CONFIG_SYSCTL
 static struct ctl_table_header *ipq_sysctl_header;
 
 static ctl_table ipq_table[] = {
@@ -528,7 +529,9 @@ static ctl_table ipq_table[] = {
         },
         { .ctl_name = 0 }
 };
+#endif
 
+#ifdef CONFIG_PROC_FS
 static int ip6_queue_show(struct seq_file *m, void *v)
 {
         read_lock_bh(&queue_lock);
@@ -565,6 +568,7 @@ static const struct file_operations ip6_queue_proc_fops = {
         .release        = single_release,
         .owner          = THIS_MODULE,
 };
+#endif
 
 static const struct nf_queue_handler nfqh = {
         .name   = "ip6_queue",
@@ -574,7 +578,7 @@ static const struct nf_queue_handler nfqh = {
 static int __init ip6_queue_init(void)
 {
         int status = -ENOMEM;
-        struct proc_dir_entry *proc;
+        struct proc_dir_entry *proc __maybe_unused;
 
         netlink_register_notifier(&ipq_nl_notifier);
         ipqnl = netlink_kernel_create(&init_net, NETLINK_IP6_FW, 0,
@@ -584,6 +588,7 @@ static int __init ip6_queue_init(void)
                 goto cleanup_netlink_notifier;
         }
 
+#ifdef CONFIG_PROC_FS
         proc = create_proc_entry(IPQ_PROC_FS_NAME, 0, init_net.proc_net);
         if (proc) {
                 proc->owner = THIS_MODULE;
@@ -592,10 +597,11 @@ static int __init ip6_queue_init(void)
                 printk(KERN_ERR "ip6_queue: failed to create proc entry\n");
                 goto cleanup_ipqnl;
         }
-
+#endif
         register_netdevice_notifier(&ipq_dev_notifier);
+#ifdef CONFIG_SYSCTL
         ipq_sysctl_header = register_sysctl_paths(net_ipv6_ctl_path, ipq_table);
-
+#endif
         status = nf_register_queue_handler(PF_INET6, &nfqh);
         if (status < 0) {
                 printk(KERN_ERR "ip6_queue: failed to register queue handler\n");
@@ -604,11 +610,13 @@ static int __init ip6_queue_init(void)
         return status;
 
 cleanup_sysctl:
+#ifdef CONFIG_SYSCTL
         unregister_sysctl_table(ipq_sysctl_header);
+#endif
         unregister_netdevice_notifier(&ipq_dev_notifier);
         proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
 
-cleanup_ipqnl:
+cleanup_ipqnl: __maybe_unused
         netlink_kernel_release(ipqnl);
         mutex_lock(&ipqnl_mutex);
         mutex_unlock(&ipqnl_mutex);
@@ -624,7 +632,9 @@ static void __exit ip6_queue_fini(void)
         synchronize_net();
         ipq_flush(NULL, 0);
 
+#ifdef CONFIG_SYSCTL
         unregister_sysctl_table(ipq_sysctl_header);
+#endif
         unregister_netdevice_notifier(&ipq_dev_notifier);
         proc_net_remove(&init_net, IPQ_PROC_FS_NAME);
 
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index dd7860fea61f..bf9bb6e55bb5 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -320,7 +320,7 @@ static void trace_packet(struct sk_buff *skb,
                          unsigned int hook,
                          const struct net_device *in,
                          const struct net_device *out,
-                         char *tablename,
+                         const char *tablename,
                          struct xt_table_info *private,
                          struct ip6t_entry *e)
 {
@@ -1118,7 +1118,7 @@ static int compat_table_info(const struct xt_table_info *info,
 }
 #endif
 
-static int get_info(void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user, int *len, int compat)
 {
         char name[IP6T_TABLE_MAXNAMELEN];
         struct xt_table *t;
@@ -1138,7 +1138,7 @@ static int get_info(void __user *user, int *len, int compat)
         if (compat)
                 xt_compat_lock(AF_INET6);
 #endif
-        t = try_then_request_module(xt_find_table_lock(AF_INET6, name),
+        t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
                                     "ip6table_%s", name);
         if (t && !IS_ERR(t)) {
                 struct ip6t_getinfo info;
@@ -1178,7 +1178,7 @@ static int get_info(void __user *user, int *len, int compat)
 }
 
 static int
-get_entries(struct ip6t_get_entries __user *uptr, int *len)
+get_entries(struct net *net, struct ip6t_get_entries __user *uptr, int *len)
 {
         int ret;
         struct ip6t_get_entries get;
@@ -1196,7 +1196,7 @@ get_entries(struct ip6t_get_entries __user *uptr, int *len)
                 return -EINVAL;
         }
 
-        t = xt_find_table_lock(AF_INET6, get.name);
+        t = xt_find_table_lock(net, AF_INET6, get.name);
         if (t && !IS_ERR(t)) {
                 struct xt_table_info *private = t->private;
                 duprintf("t->private->number = %u\n", private->number);
@@ -1217,7 +1217,7 @@ get_entries(struct ip6t_get_entries __user *uptr, int *len)
 }
 
 static int
-__do_replace(const char *name, unsigned int valid_hooks,
+__do_replace(struct net *net, const char *name, unsigned int valid_hooks,
              struct xt_table_info *newinfo, unsigned int num_counters,
              void __user *counters_ptr)
 {
@@ -1235,7 +1235,7 @@ __do_replace(const char *name, unsigned int valid_hooks,
                 goto out;
         }
 
-        t = try_then_request_module(xt_find_table_lock(AF_INET6, name),
+        t = try_then_request_module(xt_find_table_lock(net, AF_INET6, name),
                                     "ip6table_%s", name);
         if (!t || IS_ERR(t)) {
                 ret = t ? PTR_ERR(t) : -ENOENT;
@@ -1288,7 +1288,7 @@ __do_replace(const char *name, unsigned int valid_hooks,
 }
 
 static int
-do_replace(void __user *user, unsigned int len)
+do_replace(struct net *net, void __user *user, unsigned int len)
 {
         int ret;
         struct ip6t_replace tmp;
@@ -1322,7 +1322,7 @@ do_replace(void __user *user, unsigned int len)
 
         duprintf("ip_tables: Translated table\n");
 
-        ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+        ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
                            tmp.num_counters, tmp.counters);
         if (ret)
                 goto free_newinfo_untrans;
@@ -1358,7 +1358,8 @@ add_counter_to_entry(struct ip6t_entry *e,
 }
 
 static int
-do_add_counters(void __user *user, unsigned int len, int compat)
+do_add_counters(struct net *net, void __user *user, unsigned int len,
+                int compat)
 {
         unsigned int i;
         struct xt_counters_info tmp;
@@ -1410,7 +1411,7 @@ do_add_counters(void __user *user, unsigned int len, int compat)
                 goto free;
         }
 
-        t = xt_find_table_lock(AF_INET6, name);
+        t = xt_find_table_lock(net, AF_INET6, name);
         if (!t || IS_ERR(t)) {
                 ret = t ? PTR_ERR(t) : -ENOENT;
                 goto free;
@@ -1456,7 +1457,7 @@ struct compat_ip6t_replace {
 
 static int
 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
-                          compat_uint_t *size, struct xt_counters *counters,
+                          unsigned int *size, struct xt_counters *counters,
                           unsigned int *i)
 {
         struct ip6t_entry_target *t;
@@ -1503,7 +1504,7 @@ compat_find_calc_match(struct ip6t_entry_match *m,
                        const char *name,
                        const struct ip6t_ip6 *ipv6,
                        unsigned int hookmask,
-                       int *size, int *i)
+                       int *size, unsigned int *i)
 {
         struct xt_match *match;
 
@@ -1561,7 +1562,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
         struct ip6t_entry_target *t;
         struct xt_target *target;
         unsigned int entry_offset;
-        int ret, off, h, j;
+        unsigned int j;
+        int ret, off, h;
 
         duprintf("check_compat_entry_size_and_hooks %p\n", e);
         if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0
@@ -1673,7 +1675,8 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
 static int compat_check_entry(struct ip6t_entry *e, const char *name,
                                      unsigned int *i)
 {
-        int j, ret;
+        unsigned int j;
+        int ret;
 
         j = 0;
         ret = IP6T_MATCH_ITERATE(e, check_match, name, &e->ipv6,
@@ -1815,7 +1818,7 @@ out_unlock:
 }
 
 static int
-compat_do_replace(void __user *user, unsigned int len)
+compat_do_replace(struct net *net, void __user *user, unsigned int len)
 {
         int ret;
         struct compat_ip6t_replace tmp;
@@ -1852,7 +1855,7 @@ compat_do_replace(void __user *user, unsigned int len)
 
         duprintf("compat_do_replace: Translated table\n");
 
-        ret = __do_replace(tmp.name, tmp.valid_hooks, newinfo,
+        ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
                            tmp.num_counters, compat_ptr(tmp.counters));
         if (ret)
                 goto free_newinfo_untrans;
@@ -1876,11 +1879,11 @@ compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
 
         switch (cmd) {
         case IP6T_SO_SET_REPLACE:
-                ret = compat_do_replace(user, len);
+                ret = compat_do_replace(sk->sk_net, user, len);
                 break;
 
         case IP6T_SO_SET_ADD_COUNTERS:
-                ret = do_add_counters(user, len, 1);
+                ret = do_add_counters(sk->sk_net, user, len, 1);
                 break;
 
         default:
@@ -1929,7 +1932,8 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
 }
 
 static int
-compat_get_entries(struct compat_ip6t_get_entries __user *uptr, int *len)
+compat_get_entries(struct net *net, struct compat_ip6t_get_entries __user *uptr,
+                   int *len)
 {
         int ret;
         struct compat_ip6t_get_entries get;
@@ -1950,7 +1954,7 @@ compat_get_entries(struct compat_ip6t_get_entries __user *uptr, int *len)
         }
 
         xt_compat_lock(AF_INET6);
-        t = xt_find_table_lock(AF_INET6, get.name);
+        t = xt_find_table_lock(net, AF_INET6, get.name);
         if (t && !IS_ERR(t)) {
                 struct xt_table_info *private = t->private;
                 struct xt_table_info info;
@@ -1986,10 +1990,10 @@ compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 
         switch (cmd) {
         case IP6T_SO_GET_INFO:
-                ret = get_info(user, len, 1);
+                ret = get_info(sk->sk_net, user, len, 1);
                 break;
         case IP6T_SO_GET_ENTRIES:
-                ret = compat_get_entries(user, len);
+                ret = compat_get_entries(sk->sk_net, user, len);
                 break;
         default:
                 ret = do_ip6t_get_ctl(sk, cmd, user, len);
@@ -2008,11 +2012,11 @@ do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 
         switch (cmd) {
         case IP6T_SO_SET_REPLACE:
-                ret = do_replace(user, len);
+                ret = do_replace(sk->sk_net, user, len);
                 break;
 
         case IP6T_SO_SET_ADD_COUNTERS:
-                ret = do_add_counters(user, len, 0);
+                ret = do_add_counters(sk->sk_net, user, len, 0);
                 break;
 
         default:
@@ -2033,11 +2037,11 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 
         switch (cmd) {
         case IP6T_SO_GET_INFO:
-                ret = get_info(user, len, 0);
+                ret = get_info(sk->sk_net, user, len, 0);
                 break;
 
         case IP6T_SO_GET_ENTRIES:
-                ret = get_entries(user, len);
+                ret = get_entries(sk->sk_net, user, len);
                 break;
 
         case IP6T_SO_GET_REVISION_MATCH:
@@ -2074,17 +2078,21 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         return ret;
 }
 
-int ip6t_register_table(struct xt_table *table, const struct ip6t_replace *repl)
+struct xt_table *ip6t_register_table(struct net *net, struct xt_table *table,
+                                     const struct ip6t_replace *repl)
 {
         int ret;
         struct xt_table_info *newinfo;
         struct xt_table_info bootstrap
                 = { 0, 0, 0, { 0 }, { 0 }, { } };
         void *loc_cpu_entry;
+        struct xt_table *new_table;
 
         newinfo = xt_alloc_table_info(repl->size);
-        if (!newinfo)
-                return -ENOMEM;
+        if (!newinfo) {
+                ret = -ENOMEM;
+                goto out;
+        }
 
         /* choose the copy on our node/cpu, but dont care about preemption */
         loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
@@ -2095,30 +2103,35 @@ int ip6t_register_table(struct xt_table *table, const struct ip6t_replace *repl)
                               repl->num_entries,
                               repl->hook_entry,
                               repl->underflow);
-        if (ret != 0) {
-                xt_free_table_info(newinfo);
-                return ret;
-        }
+        if (ret != 0)
+                goto out_free;
 
-        ret = xt_register_table(table, &bootstrap, newinfo);
-        if (ret != 0) {
-                xt_free_table_info(newinfo);
-                return ret;
+        new_table = xt_register_table(net, table, &bootstrap, newinfo);
+        if (IS_ERR(new_table)) {
+                ret = PTR_ERR(new_table);
+                goto out_free;
         }
+        return new_table;
 
-        return 0;
+out_free:
+        xt_free_table_info(newinfo);
+out:
+        return ERR_PTR(ret);
 }
 
 void ip6t_unregister_table(struct xt_table *table)
 {
         struct xt_table_info *private;
         void *loc_cpu_entry;
+        struct module *table_owner = table->me;
 
         private = xt_unregister_table(table);
 
         /* Decrease module usage counts and free resources */
         loc_cpu_entry = private->entries[raw_smp_processor_id()];
         IP6T_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
+        if (private->number > private->initial_entries)
+                module_put(table_owner);
         xt_free_table_info(private);
 }
 
@@ -2225,11 +2238,26 @@ static struct xt_match icmp6_matchstruct __read_mostly = {
         .family         = AF_INET6,
 };
 
+static int __net_init ip6_tables_net_init(struct net *net)
+{
+        return xt_proto_init(net, AF_INET6);
+}
+
+static void __net_exit ip6_tables_net_exit(struct net *net)
+{
+        xt_proto_fini(net, AF_INET6);
+}
+
+static struct pernet_operations ip6_tables_net_ops = {
+        .init = ip6_tables_net_init,
+        .exit = ip6_tables_net_exit,
+};
+
 static int __init ip6_tables_init(void)
 {
         int ret;
 
-        ret = xt_proto_init(AF_INET6);
+        ret = register_pernet_subsys(&ip6_tables_net_ops);
         if (ret < 0)
                 goto err1;
 
@@ -2259,7 +2287,7 @@ err4:
 err3:
         xt_unregister_target(&ip6t_standard_target);
 err2:
-        xt_proto_fini(AF_INET6);
+        unregister_pernet_subsys(&ip6_tables_net_ops);
 err1:
         return ret;
 }
@@ -2271,7 +2299,8 @@ static void __exit ip6_tables_fini(void)
         xt_unregister_match(&icmp6_matchstruct);
         xt_unregister_target(&ip6t_error_target);
         xt_unregister_target(&ip6t_standard_target);
-        xt_proto_fini(AF_INET6);
+
+        unregister_pernet_subsys(&ip6_tables_net_ops);
 }
 
 /*
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 87d38d08aad0..2d9cd095a72c 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -26,7 +26,7 @@ static struct
         struct ip6t_replace repl;
         struct ip6t_standard entries[3];
         struct ip6t_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "filter",
                 .valid_hooks = FILTER_VALID_HOOKS,
@@ -67,7 +67,7 @@ ip6t_hook(unsigned int hook,
          const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(skb, hook, in, out, &packet_filter);
+        return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_filter);
 }
 
 static unsigned int
@@ -87,7 +87,7 @@ ip6t_local_out_hook(unsigned int hook,
         }
 #endif
 
-        return ip6t_do_table(skb, hook, in, out, &packet_filter);
+        return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_filter);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
@@ -118,6 +118,26 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
 static int forward = NF_ACCEPT;
 module_param(forward, bool, 0000);
 
+static int __net_init ip6table_filter_net_init(struct net *net)
+{
+        /* Register table */
+        net->ipv6.ip6table_filter =
+                ip6t_register_table(net, &packet_filter, &initial_table.repl);
+        if (IS_ERR(net->ipv6.ip6table_filter))
+                return PTR_ERR(net->ipv6.ip6table_filter);
+        return 0;
+}
+
+static void __net_exit ip6table_filter_net_exit(struct net *net)
+{
+        ip6t_unregister_table(net->ipv6.ip6table_filter);
+}
+
+static struct pernet_operations ip6table_filter_net_ops = {
+        .init = ip6table_filter_net_init,
+        .exit = ip6table_filter_net_exit,
+};
+
 static int __init ip6table_filter_init(void)
 {
         int ret;
@@ -130,8 +150,7 @@ static int __init ip6table_filter_init(void)
         /* Entry 1 is the FORWARD hook */
         initial_table.entries[1].target.verdict = -forward - 1;
 
-        /* Register table */
-        ret = ip6t_register_table(&packet_filter, &initial_table.repl);
+        ret = register_pernet_subsys(&ip6table_filter_net_ops);
         if (ret < 0)
                 return ret;
 
@@ -143,14 +162,14 @@ static int __init ip6table_filter_init(void)
         return ret;
 
  cleanup_table:
-        ip6t_unregister_table(&packet_filter);
+        unregister_pernet_subsys(&ip6table_filter_net_ops);
         return ret;
 }
 
 static void __exit ip6table_filter_fini(void)
 {
         nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
-        ip6t_unregister_table(&packet_filter);
+        unregister_pernet_subsys(&ip6table_filter_net_ops);
 }
 
 module_init(ip6table_filter_init);
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index d6082600bc5d..035343a90ffe 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -26,7 +26,7 @@ static struct
         struct ip6t_replace repl;
         struct ip6t_standard entries[5];
         struct ip6t_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "mangle",
                 .valid_hooks = MANGLE_VALID_HOOKS,
@@ -73,7 +73,7 @@ ip6t_route_hook(unsigned int hook,
          const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(skb, hook, in, out, &packet_mangler);
+        return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_mangle);
 }
 
 static unsigned int
@@ -108,7 +108,7 @@ ip6t_local_hook(unsigned int hook,
         /* flowlabel and prio (includes version, which shouldn't change either */
         flowlabel = *((u_int32_t *)ipv6_hdr(skb));
 
-        ret = ip6t_do_table(skb, hook, in, out, &packet_mangler);
+        ret = ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_mangle);
 
         if (ret != NF_DROP && ret != NF_STOLEN
                 && (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr))
@@ -158,12 +158,31 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
         },
 };
 
+static int __net_init ip6table_mangle_net_init(struct net *net)
+{
+        /* Register table */
+        net->ipv6.ip6table_mangle =
+                ip6t_register_table(net, &packet_mangler, &initial_table.repl);
+        if (IS_ERR(net->ipv6.ip6table_mangle))
+                return PTR_ERR(net->ipv6.ip6table_mangle);
+        return 0;
+}
+
+static void __net_exit ip6table_mangle_net_exit(struct net *net)
+{
+        ip6t_unregister_table(net->ipv6.ip6table_mangle);
+}
+
+static struct pernet_operations ip6table_mangle_net_ops = {
+        .init = ip6table_mangle_net_init,
+        .exit = ip6table_mangle_net_exit,
+};
+
 static int __init ip6table_mangle_init(void)
 {
         int ret;
 
-        /* Register table */
-        ret = ip6t_register_table(&packet_mangler, &initial_table.repl);
+        ret = register_pernet_subsys(&ip6table_mangle_net_ops);
         if (ret < 0)
                 return ret;
 
@@ -175,14 +194,14 @@ static int __init ip6table_mangle_init(void)
         return ret;
 
  cleanup_table:
-        ip6t_unregister_table(&packet_mangler);
+        unregister_pernet_subsys(&ip6table_mangle_net_ops);
         return ret;
 }
 
 static void __exit ip6table_mangle_fini(void)
 {
         nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
-        ip6t_unregister_table(&packet_mangler);
+        unregister_pernet_subsys(&ip6table_mangle_net_ops);
 }
 
 module_init(ip6table_mangle_init);
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index eccbaaa104af..5cd84203abfe 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -13,7 +13,7 @@ static struct
         struct ip6t_replace repl;
         struct ip6t_standard entries[2];
         struct ip6t_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "raw",
                 .valid_hooks = RAW_VALID_HOOKS,
@@ -51,7 +51,7 @@ ip6t_hook(unsigned int hook,
          const struct net_device *out,
          int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(skb, hook, in, out, &packet_raw);
+        return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_raw);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
@@ -71,12 +71,31 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
         },
 };
 
+static int __net_init ip6table_raw_net_init(struct net *net)
+{
+        /* Register table */
+        net->ipv6.ip6table_raw =
+                ip6t_register_table(net, &packet_raw, &initial_table.repl);
+        if (IS_ERR(net->ipv6.ip6table_raw))
+                return PTR_ERR(net->ipv6.ip6table_raw);
+        return 0;
+}
+
+static void __net_exit ip6table_raw_net_exit(struct net *net)
+{
+        ip6t_unregister_table(net->ipv6.ip6table_raw);
+}
+
+static struct pernet_operations ip6table_raw_net_ops = {
+        .init = ip6table_raw_net_init,
+        .exit = ip6table_raw_net_exit,
+};
+
 static int __init ip6table_raw_init(void)
 {
         int ret;
 
-        /* Register table */
-        ret = ip6t_register_table(&packet_raw, &initial_table.repl);
+        ret = register_pernet_subsys(&ip6table_raw_net_ops);
         if (ret < 0)
                 return ret;
 
@@ -88,14 +107,14 @@ static int __init ip6table_raw_init(void)
         return ret;
 
  cleanup_table:
-        ip6t_unregister_table(&packet_raw);
+        unregister_pernet_subsys(&ip6table_raw_net_ops);
         return ret;
 }
 
 static void __exit ip6table_raw_fini(void)
 {
         nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
-        ip6t_unregister_table(&packet_raw);
+        unregister_pernet_subsys(&ip6table_raw_net_ops);
 }
 
 module_init(ip6table_raw_init);
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 2d7b0246475d..3717bdf34f6e 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -30,7 +30,8 @@
 static int ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
                              struct nf_conntrack_tuple *tuple)
 {
-        u_int32_t _addrs[8], *ap;
+        const u_int32_t *ap;
+        u_int32_t _addrs[8];
 
         ap = skb_header_pointer(skb, nhoff + offsetof(struct ipv6hdr, saddr),
                                 sizeof(_addrs), _addrs);
@@ -146,8 +147,8 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
                                  int (*okfn)(struct sk_buff *))
 {
         struct nf_conn *ct;
-        struct nf_conn_help *help;
-        struct nf_conntrack_helper *helper;
+        const struct nf_conn_help *help;
+        const struct nf_conntrack_helper *helper;
         enum ip_conntrack_info ctinfo;
         unsigned int ret, protoff;
         unsigned int extoff = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index da924c6b5f06..0897d0f4c4a2 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -32,7 +32,8 @@ static int icmpv6_pkt_to_tuple(const struct sk_buff *skb,
                                unsigned int dataoff,
                                struct nf_conntrack_tuple *tuple)
 {
-        struct icmp6hdr _hdr, *hp;
+        const struct icmp6hdr *hp;
+        struct icmp6hdr _hdr;
 
         hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
         if (hp == NULL)
@@ -45,7 +46,7 @@ static int icmpv6_pkt_to_tuple(const struct sk_buff *skb,
 }
 
 /* Add 1; spaces filled with 0. */
-static u_int8_t invmap[] = {
+static const u_int8_t invmap[] = {
         [ICMPV6_ECHO_REQUEST - 128]     = ICMPV6_ECHO_REPLY + 1,
         [ICMPV6_ECHO_REPLY - 128]       = ICMPV6_ECHO_REQUEST + 1,
         [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_QUERY + 1,
@@ -101,24 +102,24 @@ static int icmpv6_packet(struct nf_conn *ct,
 }
 
 /* Called when a new connection for this protocol found. */
-static int icmpv6_new(struct nf_conn *conntrack,
+static int icmpv6_new(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff)
 {
-        static u_int8_t valid_new[] = {
+        static const u_int8_t valid_new[] = {
                 [ICMPV6_ECHO_REQUEST - 128] = 1,
                 [ICMPV6_NI_QUERY - 128] = 1
         };
-        int type = conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128;
+        int type = ct->tuplehash[0].tuple.dst.u.icmp.type - 128;
 
         if (type < 0 || type >= sizeof(valid_new) || !valid_new[type]) {
                 /* Can't create a new ICMPv6 `conn' with this. */
                 pr_debug("icmpv6: can't create new conn with type %u\n",
                          type + 128);
-                NF_CT_DUMP_TUPLE(&conntrack->tuplehash[0].tuple);
+                NF_CT_DUMP_TUPLE(&ct->tuplehash[0].tuple);
                 return 0;
         }
-        atomic_set(&conntrack->proto.icmp.count, 0);
+        atomic_set(&ct->proto.icmp.count, 0);
         return 1;
 }
 
@@ -129,8 +130,8 @@ icmpv6_error_message(struct sk_buff *skb,
                      unsigned int hooknum)
 {
         struct nf_conntrack_tuple intuple, origtuple;
-        struct nf_conntrack_tuple_hash *h;
-        struct nf_conntrack_l4proto *inproto;
+        const struct nf_conntrack_tuple_hash *h;
+        const struct nf_conntrack_l4proto *inproto;
 
         NF_CT_ASSERT(skb->nfct == NULL);
 
@@ -176,7 +177,8 @@ static int
 icmpv6_error(struct sk_buff *skb, unsigned int dataoff,
              enum ip_conntrack_info *ctinfo, int pf, unsigned int hooknum)
 {
-        struct icmp6hdr _ih, *icmp6h;
+        const struct icmp6hdr *icmp6h;
+        struct icmp6hdr _ih;
 
         icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
         if (icmp6h == NULL) {
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 022da6ce4c0f..2a0d698b24d5 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -39,6 +39,7 @@
 #include <net/rawv6.h>
 #include <net/ndisc.h>
 #include <net/addrconf.h>
+#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 #include <linux/sysctl.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
@@ -680,21 +681,6 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
         nf_conntrack_put_reasm(skb);
 }
 
-int nf_ct_frag6_kfree_frags(struct sk_buff *skb)
-{
-        struct sk_buff *s, *s2;
-
-        for (s = NFCT_FRAG6_CB(skb)->orig; s; s = s2) {
-
-                s2 = s->next;
-                kfree_skb(s);
-        }
-
-        kfree_skb(skb);
-
-        return 0;
-}
-
 int nf_ct_frag6_init(void)
 {
         nf_frags.hashfn = nf_hashfn;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 4d880551fe6a..8897ccf8086a 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -641,6 +641,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
         skb_reserve(skb, hh_len);
 
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
         skb->dst = dst_clone(&rt->u.dst);
 
         skb_put(skb, length);
@@ -767,6 +768,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
          */
         memset(&fl, 0, sizeof(fl));
 
+        fl.mark = sk->sk_mark;
+
         if (sin6) {
                 if (addr_len < SIN6_LEN_RFC2133)
                         return -EINVAL;
@@ -1259,7 +1262,7 @@ static const struct seq_operations raw6_seq_ops = {
 
 static int raw6_seq_open(struct inode *inode, struct file *file)
 {
-        return raw_seq_open(inode, file, &raw_v6_hashinfo, PF_INET6);
+        return raw_seq_open(inode, file, &raw_v6_hashinfo, &raw6_seq_ops);
 }
 
 static const struct file_operations raw6_seq_fops = {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 4004c5f0b8d7..513f72e3db0d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -107,6 +107,7 @@ static struct dst_ops ip6_dst_ops = {
         .update_pmtu            =       ip6_rt_update_pmtu,
         .local_out              =       ip6_local_out,
         .entry_size             =       sizeof(struct rt6_info),
+        .entries                =       ATOMIC_INIT(0),
 };
 
 static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
@@ -120,6 +121,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .check                  =       ip6_dst_check,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
         .entry_size             =       sizeof(struct rt6_info),
+        .entries                =       ATOMIC_INIT(0),
 };
 
 struct rt6_info ip6_null_entry = {
@@ -1907,7 +1909,7 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
          */
         if (rt->rt6i_dev == arg->dev &&
             !dst_metric_locked(&rt->u.dst, RTAX_MTU) &&
-            (dst_mtu(&rt->u.dst) > arg->mtu ||
+            (dst_mtu(&rt->u.dst) >= arg->mtu ||
              (dst_mtu(&rt->u.dst) < arg->mtu &&
               dst_mtu(&rt->u.dst) == idev->cnf.mtu6))) {
                 rt->u.dst.metrics[RTAX_MTU-1] = arg->mtu;
@@ -1960,6 +1962,7 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         cfg->fc_nlinfo.pid = NETLINK_CB(skb).pid;
         cfg->fc_nlinfo.nlh = nlh;
+        cfg->fc_nlinfo.nl_net = skb->sk->sk_net;
 
         if (tb[RTA_GATEWAY]) {
                 nla_memcpy(&cfg->fc_gateway, tb[RTA_GATEWAY], 16);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 00c08399837d..59d0029e93a7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -330,8 +330,8 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct tcp_sock *tp;
         __u32 seq;
 
-        sk = inet6_lookup(&tcp_hashinfo, &hdr->daddr, th->dest, &hdr->saddr,
-                          th->source, skb->dev->ifindex);
+        sk = inet6_lookup(skb->dev->nd_net, &tcp_hashinfo, &hdr->daddr,
+                        th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 
         if (sk == NULL) {
                 ICMP6_INC_STATS_BH(__in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
@@ -1208,9 +1208,9 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
         if (req)
                 return tcp_check_req(sk, skb, req, prev);
 
-        nsk = __inet6_lookup_established(&tcp_hashinfo, &ipv6_hdr(skb)->saddr,
-                                         th->source, &ipv6_hdr(skb)->daddr,
-                                         ntohs(th->dest), inet6_iif(skb));
+        nsk = __inet6_lookup_established(sk->sk_net, &tcp_hashinfo,
+                        &ipv6_hdr(skb)->saddr, th->source,
+                        &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
 
         if (nsk) {
                 if (nsk->sk_state != TCP_TIME_WAIT) {
@@ -1710,9 +1710,10 @@ static int tcp_v6_rcv(struct sk_buff *skb)
         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
         TCP_SKB_CB(skb)->sacked = 0;
 
-        sk = __inet6_lookup(&tcp_hashinfo, &ipv6_hdr(skb)->saddr, th->source,
-                            &ipv6_hdr(skb)->daddr, ntohs(th->dest),
-                            inet6_iif(skb));
+        sk = __inet6_lookup(skb->dev->nd_net, &tcp_hashinfo,
+                        &ipv6_hdr(skb)->saddr, th->source,
+                        &ipv6_hdr(skb)->daddr, ntohs(th->dest),
+                        inet6_iif(skb));
 
         if (!sk)
                 goto no_tcp_socket;
@@ -1792,7 +1793,7 @@ do_time_wait:
         {
                 struct sock *sk2;
 
-                sk2 = inet6_lookup_listener(&tcp_hashinfo,
+                sk2 = inet6_lookup_listener(skb->dev->nd_net, &tcp_hashinfo,
                                             &ipv6_hdr(skb)->daddr,
                                             ntohs(th->dest), inet6_iif(skb));
                 if (sk2 != NULL) {
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index bd4b9df8f614..53739de829db 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -56,7 +56,8 @@ static inline int udp_v6_get_port(struct sock *sk, unsigned short snum)
         return udp_get_port(sk, snum, ipv6_rcv_saddr_equal);
 }
 
-static struct sock *__udp6_lib_lookup(struct in6_addr *saddr, __be16 sport,
+static struct sock *__udp6_lib_lookup(struct net *net,
+                                      struct in6_addr *saddr, __be16 sport,
                                       struct in6_addr *daddr, __be16 dport,
                                       int dif, struct hlist_head udptable[])
 {
@@ -69,7 +70,8 @@ static struct sock *__udp6_lib_lookup(struct in6_addr *saddr, __be16 sport,
         sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {
                 struct inet_sock *inet = inet_sk(sk);
 
-                if (sk->sk_hash == hnum && sk->sk_family == PF_INET6) {
+                if (sk->sk_net == net && sk->sk_hash == hnum &&
+                                sk->sk_family == PF_INET6) {
                         struct ipv6_pinfo *np = inet6_sk(sk);
                         int score = 0;
                         if (inet->dport) {
@@ -233,7 +235,7 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct sock *sk;
         int err;
 
-        sk = __udp6_lib_lookup(daddr, uh->dest,
+        sk = __udp6_lib_lookup(skb->dev->nd_net, daddr, uh->dest,
                                saddr, uh->source, inet6_iif(skb), udptable);
         if (sk == NULL)
                 return;
@@ -478,7 +480,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
          * check socket cache ... must talk to Alan about his plans
          * for sock caches... i'll skip this for now.
          */
-        sk = __udp6_lib_lookup(saddr, uh->source,
+        sk = __udp6_lib_lookup(skb->dev->nd_net, saddr, uh->source,
                                daddr, uh->dest, inet6_iif(skb), udptable);
 
         if (sk == NULL) {
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index c25a6b527fc4..7d20199ee1f3 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -272,6 +272,7 @@ static struct dst_ops xfrm6_dst_ops = {
         .local_out =            __ip6_local_out,
         .gc_thresh =            1024,
         .entry_size =           sizeof(struct xfrm_dst),
+        .entries =              ATOMIC_INIT(0),
 };
 
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index fae90ff31087..639fe8a6ff1e 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -319,7 +319,7 @@ static void xfrm6_tunnel_destroy(struct xfrm_state *x)
         xfrm6_tunnel_free_spi((xfrm_address_t *)&x->props.saddr);
 }
 
-static struct xfrm_type xfrm6_tunnel_type = {
+static const struct xfrm_type xfrm6_tunnel_type = {
         .description    = "IP6IP6",
         .owner          = THIS_MODULE,
         .proto          = IPPROTO_IPV6,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 89e1e3070ec1..d44c87269bcb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -340,9 +340,42 @@ static u32 ieee80211_rx_load_stats(struct ieee80211_local *local,
         return load;
 }
 
+static ieee80211_txrx_result
+ieee80211_rx_h_verify_ip_alignment(struct ieee80211_txrx_data *rx)
+{
+        int hdrlen;
+
+        /*
+         * Drivers are required to align the payload data in a way that
+         * guarantees that the contained IP header is aligned to a four-
+         * byte boundary. In the case of regular frames, this simply means
+         * aligning the payload to a four-byte boundary (because either
+         * the IP header is directly contained, or IV/RFC1042 headers that
+         * have a length divisible by four are in front of it.
+         *
+         * With A-MSDU frames, however, the payload data address must
+         * yield two modulo four because there are 14-byte 802.3 headers
+         * within the A-MSDU frames that push the IP header further back
+         * to a multiple of four again. Thankfully, the specs were sane
+         * enough this time around to require padding each A-MSDU subframe
+         * to a length that is a multiple of four.
+         *
+         * Padding like atheros hardware adds which is inbetween the 802.11
+         * header and the payload is not supported, the driver is required
+         * to move the 802.11 header further back in that case.
+         */
+        hdrlen = ieee80211_get_hdrlen(rx->fc);
+        if (rx->flags & IEEE80211_TXRXD_RX_AMSDU)
+                hdrlen += ETH_HLEN;
+        WARN_ON_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3);
+
+        return TXRX_CONTINUE;
+}
+
 ieee80211_rx_handler ieee80211_rx_pre_handlers[] =
 {
         ieee80211_rx_h_parse_qos,
+        ieee80211_rx_h_verify_ip_alignment,
         NULL
 };
 
@@ -1679,7 +1712,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         struct ieee80211_sub_if_data *prev = NULL;
         struct sk_buff *skb_new;
         u8 *bssid;
-        int hdrlen;
 
         hdr = (struct ieee80211_hdr *) skb->data;
         memset(&rx, 0, sizeof(rx));
@@ -1691,18 +1723,6 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         rx.fc = le16_to_cpu(hdr->frame_control);
         type = rx.fc & IEEE80211_FCTL_FTYPE;
 
-        /*
-         * Drivers are required to align the payload data to a four-byte
-         * boundary, so the last two bits of the address where it starts
-         * may not be set. The header is required to be directly before
-         * the payload data, padding like atheros hardware adds which is
-         * inbetween the 802.11 header and the payload is not supported,
-         * the driver is required to move the 802.11 header further back
-         * in that case.
-         */
-        hdrlen = ieee80211_get_hdrlen(rx.fc);
-        WARN_ON_ONCE(((unsigned long)(skb->data + hdrlen)) & 3);
-
         if (type == IEEE80211_FTYPE_DATA || type == IEEE80211_FTYPE_MGMT)
                 local->dot11ReceivedFragmentCount++;
 
@@ -1952,7 +1972,7 @@ static u8 ieee80211_rx_reorder_ampdu(struct ieee80211_local *local,
                 goto end_reorder;
 
         /* null data frames are excluded */
-        if (unlikely(fc & IEEE80211_STYPE_QOS_NULLFUNC))
+        if (unlikely(fc & IEEE80211_STYPE_NULLFUNC))
                 goto end_reorder;
 
         /* new un-ordered ampdu frame - process it */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 078fff0335ad..327e847d2702 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -40,7 +40,7 @@
 
 #define NF_CONNTRACK_VERSION    "0.5.0"
 
-DEFINE_RWLOCK(nf_conntrack_lock);
+DEFINE_SPINLOCK(nf_conntrack_lock);
 EXPORT_SYMBOL_GPL(nf_conntrack_lock);
 
 /* nf_conntrack_standalone needs this */
@@ -73,15 +73,19 @@ static unsigned int nf_conntrack_hash_rnd;
 static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
                                   unsigned int size, unsigned int rnd)
 {
-        unsigned int a, b;
-
-        a = jhash2(tuple->src.u3.all, ARRAY_SIZE(tuple->src.u3.all),
-                   (tuple->src.l3num << 16) | tuple->dst.protonum);
-        b = jhash2(tuple->dst.u3.all, ARRAY_SIZE(tuple->dst.u3.all),
-                   ((__force __u16)tuple->src.u.all << 16) |
-                    (__force __u16)tuple->dst.u.all);
-
-        return ((u64)jhash_2words(a, b, rnd) * size) >> 32;
+        unsigned int n;
+        u_int32_t h;
+
+        /* The direction must be ignored, so we hash everything up to the
+         * destination ports (which is a multiple of 4) and treat the last
+         * three bytes manually.
+         */
+        n = (sizeof(tuple->src) + sizeof(tuple->dst.u3)) / sizeof(u32);
+        h = jhash2((u32 *)tuple, n,
+                   rnd ^ (((__force __u16)tuple->dst.u.all << 16) |
+                          tuple->dst.protonum));
+
+        return ((u64)h * size) >> 32;
 }
 
 static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
@@ -166,8 +170,8 @@ static void
 clean_from_lists(struct nf_conn *ct)
 {
         pr_debug("clean_from_lists(%p)\n", ct);
-        hlist_del(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
-        hlist_del(&ct->tuplehash[IP_CT_DIR_REPLY].hnode);
+        hlist_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode);
+        hlist_del_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnode);
 
         /* Destroy all pending expectations */
         nf_ct_remove_expectations(ct);
@@ -199,7 +203,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
 
         rcu_read_unlock();
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
         /* Expectations will have been removed in clean_from_lists,
          * except TFTP can create an expectation on the first packet,
          * before connection is in the list, so we need to clean here,
@@ -213,7 +217,7 @@ destroy_conntrack(struct nf_conntrack *nfct)
         }
 
         NF_CT_STAT_INC(delete);
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
 
         if (ct->master)
                 nf_ct_put(ct->master);
@@ -236,26 +240,24 @@ static void death_by_timeout(unsigned long ul_conntrack)
                 rcu_read_unlock();
         }
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
         /* Inside lock so preempt is disabled on module removal path.
          * Otherwise we can get spurious warnings. */
         NF_CT_STAT_INC(delete_list);
         clean_from_lists(ct);
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
         nf_ct_put(ct);
 }
 
 struct nf_conntrack_tuple_hash *
-__nf_conntrack_find(const struct nf_conntrack_tuple *tuple,
-                    const struct nf_conn *ignored_conntrack)
+__nf_conntrack_find(const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_tuple_hash *h;
         struct hlist_node *n;
         unsigned int hash = hash_conntrack(tuple);
 
-        hlist_for_each_entry(h, n, &nf_conntrack_hash[hash], hnode) {
-                if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
-                    nf_ct_tuple_equal(tuple, &h->tuple)) {
+        hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
+                if (nf_ct_tuple_equal(tuple, &h->tuple)) {
                         NF_CT_STAT_INC(found);
                         return h;
                 }
@@ -271,12 +273,16 @@ struct nf_conntrack_tuple_hash *
 nf_conntrack_find_get(const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_tuple_hash *h;
+        struct nf_conn *ct;
 
-        read_lock_bh(&nf_conntrack_lock);
-        h = __nf_conntrack_find(tuple, NULL);
-        if (h)
-                atomic_inc(&nf_ct_tuplehash_to_ctrack(h)->ct_general.use);
-        read_unlock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
+        h = __nf_conntrack_find(tuple);
+        if (h) {
+                ct = nf_ct_tuplehash_to_ctrack(h);
+                if (unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
+                        h = NULL;
+        }
+        rcu_read_unlock();
 
         return h;
 }
@@ -286,10 +292,10 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
                                        unsigned int hash,
                                        unsigned int repl_hash)
 {
-        hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
-                       &nf_conntrack_hash[hash]);
-        hlist_add_head(&ct->tuplehash[IP_CT_DIR_REPLY].hnode,
-                       &nf_conntrack_hash[repl_hash]);
+        hlist_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
+                           &nf_conntrack_hash[hash]);
+        hlist_add_head_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnode,
+                           &nf_conntrack_hash[repl_hash]);
 }
 
 void nf_conntrack_hash_insert(struct nf_conn *ct)
@@ -299,9 +305,9 @@ void nf_conntrack_hash_insert(struct nf_conn *ct)
         hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
         repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
         __nf_conntrack_hash_insert(ct, hash, repl_hash);
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
 
@@ -338,7 +344,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
         pr_debug("Confirming conntrack %p\n", ct);
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
 
         /* See if there's one in the list already, including reverse:
            NAT could have grabbed it without realizing, since we're
@@ -364,7 +370,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
         atomic_inc(&ct->ct_general.use);
         set_bit(IPS_CONFIRMED_BIT, &ct->status);
         NF_CT_STAT_INC(insert);
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
         help = nfct_help(ct);
         if (help && help->helper)
                 nf_conntrack_event_cache(IPCT_HELPER, skb);
@@ -379,7 +385,7 @@ __nf_conntrack_confirm(struct sk_buff *skb)
 
 out:
         NF_CT_STAT_INC(insert_failed);
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
         return NF_DROP;
 }
 EXPORT_SYMBOL_GPL(__nf_conntrack_confirm);
@@ -391,12 +397,22 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
                          const struct nf_conn *ignored_conntrack)
 {
         struct nf_conntrack_tuple_hash *h;
+        struct hlist_node *n;
+        unsigned int hash = hash_conntrack(tuple);
 
-        read_lock_bh(&nf_conntrack_lock);
-        h = __nf_conntrack_find(tuple, ignored_conntrack);
-        read_unlock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash], hnode) {
+                if (nf_ct_tuplehash_to_ctrack(h) != ignored_conntrack &&
+                    nf_ct_tuple_equal(tuple, &h->tuple)) {
+                        NF_CT_STAT_INC(found);
+                        rcu_read_unlock();
+                        return 1;
+                }
+                NF_CT_STAT_INC(searched);
+        }
+        rcu_read_unlock();
 
-        return h != NULL;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);
 
@@ -404,7 +420,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_tuple_taken);
 
 /* There's a small race here where we may free a just-assured
    connection.  Too bad: we're in trouble anyway. */
-static int early_drop(unsigned int hash)
+static noinline int early_drop(unsigned int hash)
 {
         /* Use oldest entry, which is roughly LRU */
         struct nf_conntrack_tuple_hash *h;
@@ -413,21 +429,23 @@ static int early_drop(unsigned int hash)
         unsigned int i, cnt = 0;
         int dropped = 0;
 
-        read_lock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
         for (i = 0; i < nf_conntrack_htable_size; i++) {
-                hlist_for_each_entry(h, n, &nf_conntrack_hash[hash], hnode) {
+                hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[hash],
+                                         hnode) {
                         tmp = nf_ct_tuplehash_to_ctrack(h);
                         if (!test_bit(IPS_ASSURED_BIT, &tmp->status))
                                 ct = tmp;
                         cnt++;
                 }
+
+                if (ct && unlikely(!atomic_inc_not_zero(&ct->ct_general.use)))
+                        ct = NULL;
                 if (ct || cnt >= NF_CT_EVICTION_RANGE)
                         break;
                 hash = (hash + 1) % nf_conntrack_htable_size;
         }
-        if (ct)
-                atomic_inc(&ct->ct_general.use);
-        read_unlock_bh(&nf_conntrack_lock);
+        rcu_read_unlock();
 
         if (!ct)
                 return dropped;
@@ -444,7 +462,7 @@ static int early_drop(unsigned int hash)
 struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
                                    const struct nf_conntrack_tuple *repl)
 {
-        struct nf_conn *conntrack = NULL;
+        struct nf_conn *ct = NULL;
 
         if (unlikely(!nf_conntrack_hash_rnd_initted)) {
                 get_random_bytes(&nf_conntrack_hash_rnd, 4);
@@ -454,8 +472,8 @@ struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
         /* We don't want any race condition at early drop stage */
         atomic_inc(&nf_conntrack_count);
 
-        if (nf_conntrack_max
-            && atomic_read(&nf_conntrack_count) > nf_conntrack_max) {
+        if (nf_conntrack_max &&
+            unlikely(atomic_read(&nf_conntrack_count) > nf_conntrack_max)) {
                 unsigned int hash = hash_conntrack(orig);
                 if (!early_drop(hash)) {
                         atomic_dec(&nf_conntrack_count);
@@ -467,30 +485,37 @@ struct nf_conn *nf_conntrack_alloc(const struct nf_conntrack_tuple *orig,
                 }
         }
 
-        conntrack = kmem_cache_zalloc(nf_conntrack_cachep, GFP_ATOMIC);
-        if (conntrack == NULL) {
+        ct = kmem_cache_zalloc(nf_conntrack_cachep, GFP_ATOMIC);
+        if (ct == NULL) {
                 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
                 atomic_dec(&nf_conntrack_count);
                 return ERR_PTR(-ENOMEM);
         }
 
-        atomic_set(&conntrack->ct_general.use, 1);
-        conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
-        conntrack->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
+        atomic_set(&ct->ct_general.use, 1);
+        ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
+        ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
         /* Don't set timer yet: wait for confirmation */
-        setup_timer(&conntrack->timeout, death_by_timeout,
-                    (unsigned long)conntrack);
+        setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
+        INIT_RCU_HEAD(&ct->rcu);
 
-        return conntrack;
+        return ct;
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
 
-void nf_conntrack_free(struct nf_conn *conntrack)
+static void nf_conntrack_free_rcu(struct rcu_head *head)
 {
-        nf_ct_ext_free(conntrack);
-        kmem_cache_free(nf_conntrack_cachep, conntrack);
+        struct nf_conn *ct = container_of(head, struct nf_conn, rcu);
+
+        nf_ct_ext_free(ct);
+        kmem_cache_free(nf_conntrack_cachep, ct);
         atomic_dec(&nf_conntrack_count);
 }
+
+void nf_conntrack_free(struct nf_conn *ct)
+{
+        call_rcu(&ct->rcu, nf_conntrack_free_rcu);
+}
 EXPORT_SYMBOL_GPL(nf_conntrack_free);
 
 /* Allocate a new conntrack: we return -ENOMEM if classification
@@ -502,7 +527,7 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
                struct sk_buff *skb,
                unsigned int dataoff)
 {
-        struct nf_conn *conntrack;
+        struct nf_conn *ct;
         struct nf_conn_help *help;
         struct nf_conntrack_tuple repl_tuple;
         struct nf_conntrack_expect *exp;
@@ -512,46 +537,46 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
                 return NULL;
         }
 
-        conntrack = nf_conntrack_alloc(tuple, &repl_tuple);
-        if (conntrack == NULL || IS_ERR(conntrack)) {
+        ct = nf_conntrack_alloc(tuple, &repl_tuple);
+        if (ct == NULL || IS_ERR(ct)) {
                 pr_debug("Can't allocate conntrack.\n");
-                return (struct nf_conntrack_tuple_hash *)conntrack;
+                return (struct nf_conntrack_tuple_hash *)ct;
         }
 
-        if (!l4proto->new(conntrack, skb, dataoff)) {
-                nf_conntrack_free(conntrack);
+        if (!l4proto->new(ct, skb, dataoff)) {
+                nf_conntrack_free(ct);
                 pr_debug("init conntrack: can't track with proto module\n");
                 return NULL;
         }
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
         exp = nf_ct_find_expectation(tuple);
         if (exp) {
                 pr_debug("conntrack: expectation arrives ct=%p exp=%p\n",
-                         conntrack, exp);
+                         ct, exp);
                 /* Welcome, Mr. Bond.  We've been expecting you... */
-                __set_bit(IPS_EXPECTED_BIT, &conntrack->status);
-                conntrack->master = exp->master;
+                __set_bit(IPS_EXPECTED_BIT, &ct->status);
+                ct->master = exp->master;
                 if (exp->helper) {
-                        help = nf_ct_helper_ext_add(conntrack, GFP_ATOMIC);
+                        help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
                         if (help)
                                 rcu_assign_pointer(help->helper, exp->helper);
                 }
 
 #ifdef CONFIG_NF_CONNTRACK_MARK
-                conntrack->mark = exp->master->mark;
+                ct->mark = exp->master->mark;
 #endif
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
-                conntrack->secmark = exp->master->secmark;
+                ct->secmark = exp->master->secmark;
 #endif
-                nf_conntrack_get(&conntrack->master->ct_general);
+                nf_conntrack_get(&ct->master->ct_general);
                 NF_CT_STAT_INC(expect_new);
         } else {
                 struct nf_conntrack_helper *helper;
 
                 helper = __nf_ct_helper_find(&repl_tuple);
                 if (helper) {
-                        help = nf_ct_helper_ext_add(conntrack, GFP_ATOMIC);
+                        help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
                         if (help)
                                 rcu_assign_pointer(help->helper, helper);
                 }
@@ -559,18 +584,17 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
         }
 
         /* Overload tuple linked list to put us in unconfirmed list. */
-        hlist_add_head(&conntrack->tuplehash[IP_CT_DIR_ORIGINAL].hnode,
-                       &unconfirmed);
+        hlist_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnode, &unconfirmed);
 
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
 
         if (exp) {
                 if (exp->expectfn)
-                        exp->expectfn(conntrack, exp);
+                        exp->expectfn(ct, exp);
                 nf_ct_expect_put(exp);
         }
 
-        return &conntrack->tuplehash[IP_CT_DIR_ORIGINAL];
+        return &ct->tuplehash[IP_CT_DIR_ORIGINAL];
 }
 
 /* On success, returns conntrack ptr, sets skb->nfct and ctinfo */
@@ -729,7 +753,6 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,
         struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_helper *helper;
 
-        write_lock_bh(&nf_conntrack_lock);
         /* Should be unconfirmed, so not in hash table yet */
         NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
 
@@ -738,8 +761,9 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,
 
         ct->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply;
         if (ct->master || (help && help->expecting != 0))
-                goto out;
+                return;
 
+        rcu_read_lock();
         helper = __nf_ct_helper_find(newreply);
         if (helper == NULL) {
                 if (help)
@@ -757,7 +781,7 @@ void nf_conntrack_alter_reply(struct nf_conn *ct,
 
         rcu_assign_pointer(help->helper, helper);
 out:
-        write_unlock_bh(&nf_conntrack_lock);
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_alter_reply);
 
@@ -773,13 +797,11 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
         NF_CT_ASSERT(ct->timeout.data == (unsigned long)ct);
         NF_CT_ASSERT(skb);
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
 
         /* Only update if this is not a fixed timeout */
-        if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status)) {
-                write_unlock_bh(&nf_conntrack_lock);
-                return;
-        }
+        if (test_bit(IPS_FIXED_TIMEOUT_BIT, &ct->status))
+                goto acct;
 
         /* If not in hash table, timer will not be active yet */
         if (!nf_ct_is_confirmed(ct)) {
@@ -799,6 +821,7 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
                 }
         }
 
+acct:
 #ifdef CONFIG_NF_CT_ACCT
         if (do_acct) {
                 ct->counters[CTINFO2DIR(ctinfo)].packets++;
@@ -811,7 +834,7 @@ void __nf_ct_refresh_acct(struct nf_conn *ct,
         }
 #endif
 
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
 
         /* must be unlocked when calling event cache */
         if (event)
@@ -879,14 +902,6 @@ static void nf_conntrack_attach(struct sk_buff *nskb, struct sk_buff *skb)
         nf_conntrack_get(nskb->nfct);
 }
 
-static inline int
-do_iter(const struct nf_conntrack_tuple_hash *i,
-        int (*iter)(struct nf_conn *i, void *data),
-        void *data)
-{
-        return iter(nf_ct_tuplehash_to_ctrack(i), data);
-}
-
 /* Bring out ya dead! */
 static struct nf_conn *
 get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
@@ -896,7 +911,7 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
         struct nf_conn *ct;
         struct hlist_node *n;
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
         for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
                 hlist_for_each_entry(h, n, &nf_conntrack_hash[*bucket], hnode) {
                         ct = nf_ct_tuplehash_to_ctrack(h);
@@ -909,11 +924,11 @@ get_next_corpse(int (*iter)(struct nf_conn *i, void *data),
                 if (iter(ct, data))
                         set_bit(IPS_DYING_BIT, &ct->status);
         }
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
         return NULL;
 found:
         atomic_inc(&ct->ct_general.use);
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
         return ct;
 }
 
@@ -939,7 +954,7 @@ static int kill_all(struct nf_conn *i, void *data)
         return 1;
 }
 
-void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced, int size)
+void nf_ct_free_hashtable(struct hlist_head *hash, int vmalloced, unsigned int size)
 {
         if (vmalloced)
                 vfree(hash);
@@ -988,7 +1003,7 @@ void nf_conntrack_cleanup(void)
         nf_conntrack_expect_fini();
 }
 
-struct hlist_head *nf_ct_alloc_hashtable(int *sizep, int *vmalloced)
+struct hlist_head *nf_ct_alloc_hashtable(unsigned int *sizep, int *vmalloced)
 {
         struct hlist_head *hash;
         unsigned int size, i;
@@ -1015,8 +1030,8 @@ EXPORT_SYMBOL_GPL(nf_ct_alloc_hashtable);
 
 int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
 {
-        int i, bucket, hashsize, vmalloced;
-        int old_vmalloced, old_size;
+        int i, bucket, vmalloced, old_vmalloced;
+        unsigned int hashsize, old_size;
         int rnd;
         struct hlist_head *hash, *old_hash;
         struct nf_conntrack_tuple_hash *h;
@@ -1025,7 +1040,7 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
         if (!nf_conntrack_htable_size)
                 return param_set_uint(val, kp);
 
-        hashsize = simple_strtol(val, NULL, 0);
+        hashsize = simple_strtoul(val, NULL, 0);
         if (!hashsize)
                 return -EINVAL;
 
@@ -1037,12 +1052,17 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
          * use a newrandom seed */
         get_random_bytes(&rnd, 4);
 
-        write_lock_bh(&nf_conntrack_lock);
+        /* Lookups in the old hash might happen in parallel, which means we
+         * might get false negatives during connection lookup. New connections
+         * created because of a false negative won't make it into the hash
+         * though since that required taking the lock.
+         */
+        spin_lock_bh(&nf_conntrack_lock);
         for (i = 0; i < nf_conntrack_htable_size; i++) {
                 while (!hlist_empty(&nf_conntrack_hash[i])) {
                         h = hlist_entry(nf_conntrack_hash[i].first,
                                         struct nf_conntrack_tuple_hash, hnode);
-                        hlist_del(&h->hnode);
+                        hlist_del_rcu(&h->hnode);
                         bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
                         hlist_add_head(&h->hnode, &hash[bucket]);
                 }
@@ -1055,7 +1075,7 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
         nf_conntrack_vmalloc = vmalloced;
         nf_conntrack_hash = hash;
         nf_conntrack_hash_rnd = rnd;
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
 
         nf_ct_free_hashtable(old_hash, old_vmalloced, old_size);
         return 0;
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index e0cd9d00aa61..e06bf0028bb1 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -50,7 +50,7 @@ void nf_ct_unlink_expect(struct nf_conntrack_expect *exp)
         NF_CT_ASSERT(master_help);
         NF_CT_ASSERT(!timer_pending(&exp->timeout));
 
-        hlist_del(&exp->hnode);
+        hlist_del_rcu(&exp->hnode);
         nf_ct_expect_count--;
 
         hlist_del(&exp->lnode);
@@ -65,9 +65,9 @@ static void nf_ct_expectation_timed_out(unsigned long ul_expect)
 {
         struct nf_conntrack_expect *exp = (void *)ul_expect;
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
         nf_ct_unlink_expect(exp);
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
         nf_ct_expect_put(exp);
 }
 
@@ -97,7 +97,7 @@ __nf_ct_expect_find(const struct nf_conntrack_tuple *tuple)
                 return NULL;
 
         h = nf_ct_expect_dst_hash(tuple);
-        hlist_for_each_entry(i, n, &nf_ct_expect_hash[h], hnode) {
+        hlist_for_each_entry_rcu(i, n, &nf_ct_expect_hash[h], hnode) {
                 if (nf_ct_tuple_mask_cmp(tuple, &i->tuple, &i->mask))
                         return i;
         }
@@ -111,11 +111,11 @@ nf_ct_expect_find_get(const struct nf_conntrack_tuple *tuple)
 {
         struct nf_conntrack_expect *i;
 
-        read_lock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
         i = __nf_ct_expect_find(tuple);
-        if (i)
-                atomic_inc(&i->use);
-        read_unlock_bh(&nf_conntrack_lock);
+        if (i && !atomic_inc_not_zero(&i->use))
+                i = NULL;
+        rcu_read_unlock();
 
         return i;
 }
@@ -201,12 +201,12 @@ static inline int expect_matches(const struct nf_conntrack_expect *a,
 /* Generally a bad idea to call this: could have matched already. */
 void nf_ct_unexpect_related(struct nf_conntrack_expect *exp)
 {
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
         if (del_timer(&exp->timeout)) {
                 nf_ct_unlink_expect(exp);
                 nf_ct_expect_put(exp);
         }
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
 }
 EXPORT_SYMBOL_GPL(nf_ct_unexpect_related);
 
@@ -223,6 +223,7 @@ struct nf_conntrack_expect *nf_ct_expect_alloc(struct nf_conn *me)
 
         new->master = me;
         atomic_set(&new->use, 1);
+        INIT_RCU_HEAD(&new->rcu);
         return new;
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_alloc);
@@ -278,10 +279,18 @@ void nf_ct_expect_init(struct nf_conntrack_expect *exp, int family,
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_init);
 
+static void nf_ct_expect_free_rcu(struct rcu_head *head)
+{
+        struct nf_conntrack_expect *exp;
+
+        exp = container_of(head, struct nf_conntrack_expect, rcu);
+        kmem_cache_free(nf_ct_expect_cachep, exp);
+}
+
 void nf_ct_expect_put(struct nf_conntrack_expect *exp)
 {
         if (atomic_dec_and_test(&exp->use))
-                kmem_cache_free(nf_ct_expect_cachep, exp);
+                call_rcu(&exp->rcu, nf_ct_expect_free_rcu);
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_put);
 
@@ -295,7 +304,7 @@ static void nf_ct_expect_insert(struct nf_conntrack_expect *exp)
         hlist_add_head(&exp->lnode, &master_help->expectations);
         master_help->expecting++;
 
-        hlist_add_head(&exp->hnode, &nf_ct_expect_hash[h]);
+        hlist_add_head_rcu(&exp->hnode, &nf_ct_expect_hash[h]);
         nf_ct_expect_count++;
 
         setup_timer(&exp->timeout, nf_ct_expectation_timed_out,
@@ -346,7 +355,7 @@ int nf_ct_expect_related(struct nf_conntrack_expect *expect)
 
         NF_CT_ASSERT(master_help);
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
         if (!master_help->helper) {
                 ret = -ESHUTDOWN;
                 goto out;
@@ -381,7 +390,7 @@ int nf_ct_expect_related(struct nf_conntrack_expect *expect)
         nf_ct_expect_event(IPEXP_NEW, expect);
         ret = 0;
 out:
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
         return ret;
 }
 EXPORT_SYMBOL_GPL(nf_ct_expect_related);
@@ -394,10 +403,12 @@ struct ct_expect_iter_state {
 static struct hlist_node *ct_expect_get_first(struct seq_file *seq)
 {
         struct ct_expect_iter_state *st = seq->private;
+        struct hlist_node *n;
 
         for (st->bucket = 0; st->bucket < nf_ct_expect_hsize; st->bucket++) {
-                if (!hlist_empty(&nf_ct_expect_hash[st->bucket]))
-                        return nf_ct_expect_hash[st->bucket].first;
+                n = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
+                if (n)
+                        return n;
         }
         return NULL;
 }
@@ -407,11 +418,11 @@ static struct hlist_node *ct_expect_get_next(struct seq_file *seq,
 {
         struct ct_expect_iter_state *st = seq->private;
 
-        head = head->next;
+        head = rcu_dereference(head->next);
         while (head == NULL) {
                 if (++st->bucket >= nf_ct_expect_hsize)
                         return NULL;
-                head = nf_ct_expect_hash[st->bucket].first;
+                head = rcu_dereference(nf_ct_expect_hash[st->bucket].first);
         }
         return head;
 }
@@ -427,8 +438,9 @@ static struct hlist_node *ct_expect_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *exp_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(RCU)
 {
-        read_lock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
         return ct_expect_get_idx(seq, *pos);
 }
 
@@ -439,8 +451,9 @@ static void *exp_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void exp_seq_stop(struct seq_file *seq, void *v)
+        __releases(RCU)
 {
-        read_unlock_bh(&nf_conntrack_lock);
+        rcu_read_unlock();
 }
 
 static int exp_seq_show(struct seq_file *s, void *v)
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index ff66fba514fd..867882313e49 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -87,7 +87,7 @@ typedef struct field_t {
         unsigned char ub;
         unsigned short attr;
         unsigned short offset;
-        struct field_t *fields;
+        const struct field_t *fields;
 } field_t;
 
 /* Bit Stream */
@@ -96,7 +96,7 @@ typedef struct {
         unsigned char *beg;
         unsigned char *end;
         unsigned char *cur;
-        unsigned bit;
+        unsigned int bit;
 } bitstr_t;
 
 /* Tool Functions */
@@ -104,29 +104,29 @@ typedef struct {
 #define INC_BITS(bs,b) if(((bs)->bit+=(b))>7){(bs)->cur+=(bs)->bit>>3;(bs)->bit&=7;}
 #define BYTE_ALIGN(bs) if((bs)->bit){(bs)->cur++;(bs)->bit=0;}
 #define CHECK_BOUND(bs,n) if((bs)->cur+(n)>(bs)->end)return(H323_ERROR_BOUND)
-static unsigned get_len(bitstr_t * bs);
-static unsigned get_bit(bitstr_t * bs);
-static unsigned get_bits(bitstr_t * bs, unsigned b);
-static unsigned get_bitmap(bitstr_t * bs, unsigned b);
-static unsigned get_uint(bitstr_t * bs, int b);
+static unsigned int get_len(bitstr_t *bs);
+static unsigned int get_bit(bitstr_t *bs);
+static unsigned int get_bits(bitstr_t *bs, unsigned int b);
+static unsigned int get_bitmap(bitstr_t *bs, unsigned int b);
+static unsigned int get_uint(bitstr_t *bs, int b);
 
 /* Decoder Functions */
-static int decode_nul(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_bool(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_oid(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_int(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_enum(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_bitstr(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_numstr(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_bmpstr(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_seq(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level);
-static int decode_choice(bitstr_t * bs, field_t * f, char *base, int level);
+static int decode_nul(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_bool(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_oid(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_int(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_enum(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_bitstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_numstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_octstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_bmpstr(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_seq(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_seqof(bitstr_t *bs, const struct field_t *f, char *base, int level);
+static int decode_choice(bitstr_t *bs, const struct field_t *f, char *base, int level);
 
 /* Decoder Functions Vector */
-typedef int (*decoder_t) (bitstr_t *, field_t *, char *, int);
-static decoder_t Decoders[] = {
+typedef int (*decoder_t)(bitstr_t *, const struct field_t *, char *, int);
+static const decoder_t Decoders[] = {
         decode_nul,
         decode_bool,
         decode_oid,
@@ -150,9 +150,9 @@ static decoder_t Decoders[] = {
  * Functions
  ****************************************************************************/
 /* Assume bs is aligned && v < 16384 */
-unsigned get_len(bitstr_t * bs)
+static unsigned int get_len(bitstr_t *bs)
 {
-        unsigned v;
+        unsigned int v;
 
         v = *bs->cur++;
 
@@ -166,9 +166,9 @@ unsigned get_len(bitstr_t * bs)
 }
 
 /****************************************************************************/
-unsigned get_bit(bitstr_t * bs)
+static unsigned int get_bit(bitstr_t *bs)
 {
-        unsigned b = (*bs->cur) & (0x80 >> bs->bit);
+        unsigned int b = (*bs->cur) & (0x80 >> bs->bit);
 
         INC_BIT(bs);
 
@@ -177,9 +177,9 @@ unsigned get_bit(bitstr_t * bs)
 
 /****************************************************************************/
 /* Assume b <= 8 */
-unsigned get_bits(bitstr_t * bs, unsigned b)
+static unsigned int get_bits(bitstr_t *bs, unsigned int b)
 {
-        unsigned v, l;
+        unsigned int v, l;
 
         v = (*bs->cur) & (0xffU >> bs->bit);
         l = b + bs->bit;
@@ -203,9 +203,9 @@ unsigned get_bits(bitstr_t * bs, unsigned b)
 
 /****************************************************************************/
 /* Assume b <= 32 */
-unsigned get_bitmap(bitstr_t * bs, unsigned b)
+static unsigned int get_bitmap(bitstr_t *bs, unsigned int b)
 {
-        unsigned v, l, shift, bytes;
+        unsigned int v, l, shift, bytes;
 
         if (!b)
                 return 0;
@@ -213,18 +213,18 @@ unsigned get_bitmap(bitstr_t * bs, unsigned b)
         l = bs->bit + b;
 
         if (l < 8) {
-                v = (unsigned) (*bs->cur) << (bs->bit + 24);
+                v = (unsigned int)(*bs->cur) << (bs->bit + 24);
                 bs->bit = l;
         } else if (l == 8) {
-                v = (unsigned) (*bs->cur++) << (bs->bit + 24);
+                v = (unsigned int)(*bs->cur++) << (bs->bit + 24);
                 bs->bit = 0;
         } else {
                 for (bytes = l >> 3, shift = 24, v = 0; bytes;
                      bytes--, shift -= 8)
-                        v |= (unsigned) (*bs->cur++) << shift;
+                        v |= (unsigned int)(*bs->cur++) << shift;
 
                 if (l < 32) {
-                        v |= (unsigned) (*bs->cur) << shift;
+                        v |= (unsigned int)(*bs->cur) << shift;
                         v <<= bs->bit;
                 } else if (l > 32) {
                         v <<= bs->bit;
@@ -242,9 +242,9 @@ unsigned get_bitmap(bitstr_t * bs, unsigned b)
 /****************************************************************************
  * Assume bs is aligned and sizeof(unsigned int) == 4
  ****************************************************************************/
-unsigned get_uint(bitstr_t * bs, int b)
+static unsigned int get_uint(bitstr_t *bs, int b)
 {
-        unsigned v = 0;
+        unsigned int v = 0;
 
         switch (b) {
         case 4:
@@ -264,7 +264,8 @@ unsigned get_uint(bitstr_t * bs, int b)
 }
 
 /****************************************************************************/
-int decode_nul(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_nul(bitstr_t *bs, const struct field_t *f,
+                      char *base, int level)
 {
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
 
@@ -272,7 +273,8 @@ int decode_nul(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int decode_bool(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_bool(bitstr_t *bs, const struct field_t *f,
+                       char *base, int level)
 {
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
 
@@ -283,7 +285,8 @@ int decode_bool(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int decode_oid(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_oid(bitstr_t *bs, const struct field_t *f,
+                      char *base, int level)
 {
         int len;
 
@@ -299,9 +302,10 @@ int decode_oid(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int decode_int(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_int(bitstr_t *bs, const struct field_t *f,
+                      char *base, int level)
 {
-        unsigned len;
+        unsigned int len;
 
         PRINT("%*.s%s", level * TAB_SIZE, " ", f->name);
 
@@ -318,9 +322,9 @@ int decode_int(bitstr_t * bs, field_t * f, char *base, int level)
                 len = get_bits(bs, 2) + 1;
                 BYTE_ALIGN(bs);
                 if (base && (f->attr & DECODE)) {       /* timeToLive */
-                        unsigned v = get_uint(bs, len) + f->lb;
+                        unsigned int v = get_uint(bs, len) + f->lb;
                         PRINT(" = %u", v);
-                        *((unsigned *) (base + f->offset)) = v;
+                        *((unsigned int *)(base + f->offset)) = v;
                 }
                 bs->cur += len;
                 break;
@@ -342,7 +346,8 @@ int decode_int(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int decode_enum(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_enum(bitstr_t *bs, const struct field_t *f,
+                       char *base, int level)
 {
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
 
@@ -357,9 +362,10 @@ int decode_enum(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int decode_bitstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_bitstr(bitstr_t *bs, const struct field_t *f,
+                         char *base, int level)
 {
-        unsigned len;
+        unsigned int len;
 
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
 
@@ -390,9 +396,10 @@ int decode_bitstr(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int decode_numstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_numstr(bitstr_t *bs, const struct field_t *f,
+                         char *base, int level)
 {
-        unsigned len;
+        unsigned int len;
 
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
 
@@ -407,9 +414,10 @@ int decode_numstr(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_octstr(bitstr_t *bs, const struct field_t *f,
+                         char *base, int level)
 {
-        unsigned len;
+        unsigned int len;
 
         PRINT("%*.s%s", level * TAB_SIZE, " ", f->name);
 
@@ -424,7 +432,7 @@ int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level)
                                              bs->cur[0], bs->cur[1],
                                              bs->cur[2], bs->cur[3],
                                              bs->cur[4] * 256 + bs->cur[5]));
-                                *((unsigned *) (base + f->offset)) =
+                                *((unsigned int *)(base + f->offset)) =
                                     bs->cur - bs->buf;
                         }
                 }
@@ -455,9 +463,10 @@ int decode_octstr(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int decode_bmpstr(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_bmpstr(bitstr_t *bs, const struct field_t *f,
+                         char *base, int level)
 {
-        unsigned len;
+        unsigned int len;
 
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
 
@@ -480,11 +489,12 @@ int decode_bmpstr(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_seq(bitstr_t *bs, const struct field_t *f,
+                      char *base, int level)
 {
-        unsigned ext, bmp, i, opt, len = 0, bmp2, bmp2_len;
+        unsigned int ext, bmp, i, opt, len = 0, bmp2, bmp2_len;
         int err;
-        field_t *son;
+        const struct field_t *son;
         unsigned char *beg = NULL;
 
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
@@ -498,7 +508,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
         /* Get fields bitmap */
         bmp = get_bitmap(bs, f->sz);
         if (base)
-                *(unsigned *) base = bmp;
+                *(unsigned int *)base = bmp;
 
         /* Decode the root components */
         for (i = opt = 0, son = f->fields; i < f->lb; i++, son++) {
@@ -550,7 +560,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
         bmp2 = get_bitmap(bs, bmp2_len);
         bmp |= bmp2 >> f->sz;
         if (base)
-                *(unsigned *) base = bmp;
+                *(unsigned int *)base = bmp;
         BYTE_ALIGN(bs);
 
         /* Decode the extension components */
@@ -596,11 +606,12 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_seqof(bitstr_t *bs, const struct field_t *f,
+                        char *base, int level)
 {
-        unsigned count, effective_count = 0, i, len = 0;
+        unsigned int count, effective_count = 0, i, len = 0;
         int err;
-        field_t *son;
+        const struct field_t *son;
         unsigned char *beg = NULL;
 
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
@@ -636,8 +647,8 @@ int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
         /* Write Count */
         if (base) {
                 effective_count = count > f->ub ? f->ub : count;
-                *(unsigned *) base = effective_count;
-                base += sizeof(unsigned);
+                *(unsigned int *)base = effective_count;
+                base += sizeof(unsigned int);
         }
 
         /* Decode nested field */
@@ -685,11 +696,12 @@ int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
 
 
 /****************************************************************************/
-int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
+static int decode_choice(bitstr_t *bs, const struct field_t *f,
+                         char *base, int level)
 {
-        unsigned type, ext, len = 0;
+        unsigned int type, ext, len = 0;
         int err;
-        field_t *son;
+        const struct field_t *son;
         unsigned char *beg = NULL;
 
         PRINT("%*.s%s\n", level * TAB_SIZE, " ", f->name);
@@ -710,7 +722,7 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
 
         /* Write Type */
         if (base)
-                *(unsigned *) base = type;
+                *(unsigned int *)base = type;
 
         /* Check Range */
         if (type >= f->ub) {    /* Newer version? */
@@ -754,9 +766,9 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
 }
 
 /****************************************************************************/
-int DecodeRasMessage(unsigned char *buf, size_t sz, RasMessage * ras)
+int DecodeRasMessage(unsigned char *buf, size_t sz, RasMessage *ras)
 {
-        static field_t ras_message = {
+        static const struct field_t ras_message = {
                 FNAME("RasMessage") CHOICE, 5, 24, 32, DECODE | EXT,
                 0, _RasMessage
         };
@@ -771,9 +783,9 @@ int DecodeRasMessage(unsigned char *buf, size_t sz, RasMessage * ras)
 
 /****************************************************************************/
 static int DecodeH323_UserInformation(unsigned char *buf, unsigned char *beg,
-                                      size_t sz, H323_UserInformation * uuie)
+                                      size_t sz, H323_UserInformation *uuie)
 {
-        static field_t h323_userinformation = {
+        static const struct field_t h323_userinformation = {
                 FNAME("H323-UserInformation") SEQ, 1, 2, 2, DECODE | EXT,
                 0, _H323_UserInformation
         };
@@ -792,7 +804,7 @@ int DecodeMultimediaSystemControlMessage(unsigned char *buf, size_t sz,
                                          MultimediaSystemControlMessage *
                                          mscm)
 {
-        static field_t multimediasystemcontrolmessage = {
+        static const struct field_t multimediasystemcontrolmessage = {
                 FNAME("MultimediaSystemControlMessage") CHOICE, 2, 4, 4,
                 DECODE | EXT, 0, _MultimediaSystemControlMessage
         };
@@ -807,7 +819,7 @@ int DecodeMultimediaSystemControlMessage(unsigned char *buf, size_t sz,
 }
 
 /****************************************************************************/
-int DecodeQ931(unsigned char *buf, size_t sz, Q931 * q931)
+int DecodeQ931(unsigned char *buf, size_t sz, Q931 *q931)
 {
         unsigned char *p = buf;
         int len;
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 872c1aa3124c..62137879e6aa 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -114,7 +114,8 @@ static int get_tpkt_data(struct sk_buff *skb, unsigned int protoff,
 {
         struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
         int dir = CTINFO2DIR(ctinfo);
-        struct tcphdr _tcph, *th;
+        const struct tcphdr *th;
+        struct tcphdr _tcph;
         int tcpdatalen;
         int tcpdataoff;
         unsigned char *tpkt;
@@ -212,11 +213,11 @@ static int get_tpkt_data(struct sk_buff *skb, unsigned int protoff,
 }
 
 /****************************************************************************/
-static int get_h245_addr(struct nf_conn *ct, unsigned char *data,
+static int get_h245_addr(struct nf_conn *ct, const unsigned char *data,
                          H245_TransportAddress *taddr,
                          union nf_inet_addr *addr, __be16 *port)
 {
-        unsigned char *p;
+        const unsigned char *p;
         int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
         int len;
 
@@ -625,7 +626,7 @@ int get_h225_addr(struct nf_conn *ct, unsigned char *data,
                   TransportAddress *taddr,
                   union nf_inet_addr *addr, __be16 *port)
 {
-        unsigned char *p;
+        const unsigned char *p;
         int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
         int len;
 
@@ -704,9 +705,8 @@ static int expect_h245(struct sk_buff *skb, struct nf_conn *ct,
 
 /* If the calling party is on the same side of the forward-to party,
  * we don't need to track the second call */
-static int callforward_do_filter(union nf_inet_addr *src,
-                                 union nf_inet_addr *dst,
-                                 int family)
+static int callforward_do_filter(const union nf_inet_addr *src,
+                                 const union nf_inet_addr *dst, int family)
 {
         const struct nf_afinfo *afinfo;
         struct flowi fl1, fl2;
@@ -1185,7 +1185,8 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = {
 static unsigned char *get_udp_data(struct sk_buff *skb, unsigned int protoff,
                                    int *datalen)
 {
-        struct udphdr _uh, *uh;
+        const struct udphdr *uh;
+        struct udphdr _uh;
         int dataoff;
 
         uh = skb_header_pointer(skb, protoff, sizeof(_uh), &_uh);
@@ -1415,7 +1416,7 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
                 nf_ct_refresh(ct, skb, info->timeout * HZ);
 
                 /* Set expect timeout */
-                read_lock_bh(&nf_conntrack_lock);
+                spin_lock_bh(&nf_conntrack_lock);
                 exp = find_expect(ct, &ct->tuplehash[dir].tuple.dst.u3,
                                   info->sig_port[!dir]);
                 if (exp) {
@@ -1425,7 +1426,7 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
                         NF_CT_DUMP_TUPLE(&exp->tuple);
                         set_expect_timeout(exp, info->timeout);
                 }
-                read_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_lock);
         }
 
         return 0;
@@ -1468,7 +1469,7 @@ static int process_arq(struct sk_buff *skb, struct nf_conn *ct,
                        enum ip_conntrack_info ctinfo,
                        unsigned char **data, AdmissionRequest *arq)
 {
-        struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
+        const struct nf_ct_h323_master *info = &nfct_help(ct)->help.ct_h323_info;
         int dir = CTINFO2DIR(ctinfo);
         __be16 port;
         union nf_inet_addr addr;
diff --git a/net/netfilter/nf_conntrack_h323_types.c b/net/netfilter/nf_conntrack_h323_types.c
index 3a21fdf1a265..d880f3523c1d 100644
--- a/net/netfilter/nf_conntrack_h323_types.c
+++ b/net/netfilter/nf_conntrack_h323_types.c
@@ -5,22 +5,22 @@
  * This source code is licensed under General Public License version 2.
  */
 
-static field_t _TransportAddress_ipAddress[] = {        /* SEQUENCE */
+static const struct field_t _TransportAddress_ipAddress[] = {   /* SEQUENCE */
         {FNAME("ip") OCTSTR, FIXD, 4, 0, DECODE,
          offsetof(TransportAddress_ipAddress, ip), NULL},
         {FNAME("port") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _TransportAddress_ipSourceRoute_route[] = {      /* SEQUENCE OF */
+static const struct field_t _TransportAddress_ipSourceRoute_route[] = { /* SEQUENCE OF */
         {FNAME("item") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
 };
 
-static field_t _TransportAddress_ipSourceRoute_routing[] = {    /* CHOICE */
+static const struct field_t _TransportAddress_ipSourceRoute_routing[] = {       /* CHOICE */
         {FNAME("strict") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("loose") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _TransportAddress_ipSourceRoute[] = {    /* SEQUENCE */
+static const struct field_t _TransportAddress_ipSourceRoute[] = {       /* SEQUENCE */
         {FNAME("ip") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
         {FNAME("port") INT, WORD, 0, 0, SKIP, 0, NULL},
         {FNAME("route") SEQOF, SEMI, 0, 0, SKIP, 0,
@@ -29,37 +29,37 @@ static field_t _TransportAddress_ipSourceRoute[] = {	/* SEQUENCE */
          _TransportAddress_ipSourceRoute_routing},
 };
 
-static field_t _TransportAddress_ipxAddress[] = {       /* SEQUENCE */
+static const struct field_t _TransportAddress_ipxAddress[] = {  /* SEQUENCE */
         {FNAME("node") OCTSTR, FIXD, 6, 0, SKIP, 0, NULL},
         {FNAME("netnum") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
         {FNAME("port") OCTSTR, FIXD, 2, 0, SKIP, 0, NULL},
 };
 
-static field_t _TransportAddress_ip6Address[] = {       /* SEQUENCE */
+static const struct field_t _TransportAddress_ip6Address[] = {  /* SEQUENCE */
         {FNAME("ip") OCTSTR, FIXD, 16, 0, DECODE,
          offsetof(TransportAddress_ip6Address, ip), NULL},
         {FNAME("port") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H221NonStandard[] = {   /* SEQUENCE */
+static const struct field_t _H221NonStandard[] = {      /* SEQUENCE */
         {FNAME("t35CountryCode") INT, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("t35Extension") INT, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("manufacturerCode") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _NonStandardIdentifier[] = {     /* CHOICE */
+static const struct field_t _NonStandardIdentifier[] = {        /* CHOICE */
         {FNAME("object") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("h221NonStandard") SEQ, 0, 3, 3, SKIP | EXT, 0,
          _H221NonStandard},
 };
 
-static field_t _NonStandardParameter[] = {      /* SEQUENCE */
+static const struct field_t _NonStandardParameter[] = { /* SEQUENCE */
         {FNAME("nonStandardIdentifier") CHOICE, 1, 2, 2, SKIP | EXT, 0,
          _NonStandardIdentifier},
         {FNAME("data") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _TransportAddress[] = {  /* CHOICE */
+static const struct field_t _TransportAddress[] = {     /* CHOICE */
         {FNAME("ipAddress") SEQ, 0, 2, 2, DECODE,
          offsetof(TransportAddress, ipAddress), _TransportAddress_ipAddress},
         {FNAME("ipSourceRoute") SEQ, 0, 4, 4, SKIP | EXT, 0,
@@ -75,7 +75,7 @@ static field_t _TransportAddress[] = {	/* CHOICE */
          _NonStandardParameter},
 };
 
-static field_t _AliasAddress[] = {      /* CHOICE */
+static const struct field_t _AliasAddress[] = { /* CHOICE */
         {FNAME("dialedDigits") NUMDGT, 7, 1, 0, SKIP, 0, NULL},
         {FNAME("h323-ID") BMPSTR, BYTE, 1, 0, SKIP, 0, NULL},
         {FNAME("url-ID") IA5STR, WORD, 1, 0, SKIP, 0, NULL},
@@ -85,78 +85,78 @@ static field_t _AliasAddress[] = {	/* CHOICE */
         {FNAME("mobileUIM") CHOICE, 1, 2, 2, SKIP | EXT, 0, NULL},
 };
 
-static field_t _Setup_UUIE_sourceAddress[] = {  /* SEQUENCE OF */
+static const struct field_t _Setup_UUIE_sourceAddress[] = {     /* SEQUENCE OF */
         {FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
 };
 
-static field_t _VendorIdentifier[] = {  /* SEQUENCE */
+static const struct field_t _VendorIdentifier[] = {     /* SEQUENCE */
         {FNAME("vendor") SEQ, 0, 3, 3, SKIP | EXT, 0, _H221NonStandard},
         {FNAME("productId") OCTSTR, BYTE, 1, 0, SKIP | OPT, 0, NULL},
         {FNAME("versionId") OCTSTR, BYTE, 1, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _GatekeeperInfo[] = {    /* SEQUENCE */
+static const struct field_t _GatekeeperInfo[] = {       /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
 };
 
-static field_t _H310Caps[] = {  /* SEQUENCE */
+static const struct field_t _H310Caps[] = {     /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H320Caps[] = {  /* SEQUENCE */
+static const struct field_t _H320Caps[] = {     /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H321Caps[] = {  /* SEQUENCE */
+static const struct field_t _H321Caps[] = {     /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H322Caps[] = {  /* SEQUENCE */
+static const struct field_t _H322Caps[] = {     /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H323Caps[] = {  /* SEQUENCE */
+static const struct field_t _H323Caps[] = {     /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H324Caps[] = {  /* SEQUENCE */
+static const struct field_t _H324Caps[] = {     /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _VoiceCaps[] = { /* SEQUENCE */
+static const struct field_t _VoiceCaps[] = {    /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _T120OnlyCaps[] = {      /* SEQUENCE */
+static const struct field_t _T120OnlyCaps[] = { /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("dataRatesSupported") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("supportedPrefixes") SEQOF, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _SupportedProtocols[] = {        /* CHOICE */
+static const struct field_t _SupportedProtocols[] = {   /* CHOICE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP, 0,
          _NonStandardParameter},
         {FNAME("h310") SEQ, 1, 1, 3, SKIP | EXT, 0, _H310Caps},
@@ -171,29 +171,29 @@ static field_t _SupportedProtocols[] = {	/* CHOICE */
         {FNAME("t38FaxAnnexbOnly") SEQ, 2, 5, 5, SKIP | EXT, 0, NULL},
 };
 
-static field_t _GatewayInfo_protocol[] = {      /* SEQUENCE OF */
+static const struct field_t _GatewayInfo_protocol[] = { /* SEQUENCE OF */
         {FNAME("item") CHOICE, 4, 9, 11, SKIP | EXT, 0, _SupportedProtocols},
 };
 
-static field_t _GatewayInfo[] = {       /* SEQUENCE */
+static const struct field_t _GatewayInfo[] = {  /* SEQUENCE */
         {FNAME("protocol") SEQOF, SEMI, 0, 0, SKIP | OPT, 0,
          _GatewayInfo_protocol},
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
 };
 
-static field_t _McuInfo[] = {   /* SEQUENCE */
+static const struct field_t _McuInfo[] = {      /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("protocol") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _TerminalInfo[] = {      /* SEQUENCE */
+static const struct field_t _TerminalInfo[] = { /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
 };
 
-static field_t _EndpointType[] = {      /* SEQUENCE */
+static const struct field_t _EndpointType[] = { /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("vendor") SEQ, 2, 3, 3, SKIP | EXT | OPT, 0,
@@ -210,19 +210,19 @@ static field_t _EndpointType[] = {	/* SEQUENCE */
          0, NULL},
 };
 
-static field_t _Setup_UUIE_destinationAddress[] = {     /* SEQUENCE OF */
+static const struct field_t _Setup_UUIE_destinationAddress[] = {        /* SEQUENCE OF */
         {FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
 };
 
-static field_t _Setup_UUIE_destExtraCallInfo[] = {      /* SEQUENCE OF */
+static const struct field_t _Setup_UUIE_destExtraCallInfo[] = { /* SEQUENCE OF */
         {FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
 };
 
-static field_t _Setup_UUIE_destExtraCRV[] = {   /* SEQUENCE OF */
+static const struct field_t _Setup_UUIE_destExtraCRV[] = {      /* SEQUENCE OF */
         {FNAME("item") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _Setup_UUIE_conferenceGoal[] = { /* CHOICE */
+static const struct field_t _Setup_UUIE_conferenceGoal[] = {    /* CHOICE */
         {FNAME("create") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("join") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("invite") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -231,12 +231,12 @@ static field_t _Setup_UUIE_conferenceGoal[] = {	/* CHOICE */
          0, NULL},
 };
 
-static field_t _Q954Details[] = {       /* SEQUENCE */
+static const struct field_t _Q954Details[] = {  /* SEQUENCE */
         {FNAME("conferenceCalling") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("threePartyService") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _QseriesOptions[] = {    /* SEQUENCE */
+static const struct field_t _QseriesOptions[] = {       /* SEQUENCE */
         {FNAME("q932Full") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("q951Full") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("q952Full") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -247,32 +247,32 @@ static field_t _QseriesOptions[] = {	/* SEQUENCE */
         {FNAME("q954Info") SEQ, 0, 2, 2, SKIP | EXT, 0, _Q954Details},
 };
 
-static field_t _CallType[] = {  /* CHOICE */
+static const struct field_t _CallType[] = {     /* CHOICE */
         {FNAME("pointToPoint") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("oneToN") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("nToOne") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("nToN") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H245_NonStandardIdentifier_h221NonStandard[] = {        /* SEQUENCE */
+static const struct field_t _H245_NonStandardIdentifier_h221NonStandard[] = {   /* SEQUENCE */
         {FNAME("t35CountryCode") INT, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("t35Extension") INT, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("manufacturerCode") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H245_NonStandardIdentifier[] = {        /* CHOICE */
+static const struct field_t _H245_NonStandardIdentifier[] = {   /* CHOICE */
         {FNAME("object") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("h221NonStandard") SEQ, 0, 3, 3, SKIP, 0,
          _H245_NonStandardIdentifier_h221NonStandard},
 };
 
-static field_t _H245_NonStandardParameter[] = { /* SEQUENCE */
+static const struct field_t _H245_NonStandardParameter[] = {    /* SEQUENCE */
         {FNAME("nonStandardIdentifier") CHOICE, 1, 2, 2, SKIP, 0,
          _H245_NonStandardIdentifier},
         {FNAME("data") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H261VideoCapability[] = {       /* SEQUENCE */
+static const struct field_t _H261VideoCapability[] = {  /* SEQUENCE */
         {FNAME("qcifMPI") INT, 2, 1, 0, SKIP | OPT, 0, NULL},
         {FNAME("cifMPI") INT, 2, 1, 0, SKIP | OPT, 0, NULL},
         {FNAME("temporalSpatialTradeOffCapability") BOOL, FIXD, 0, 0, SKIP, 0,
@@ -282,7 +282,7 @@ static field_t _H261VideoCapability[] = {	/* SEQUENCE */
         {FNAME("videoBadMBsCap") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H262VideoCapability[] = {       /* SEQUENCE */
+static const struct field_t _H262VideoCapability[] = {  /* SEQUENCE */
         {FNAME("profileAndLevel-SPatML") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("profileAndLevel-MPatLL") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("profileAndLevel-MPatML") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -304,7 +304,7 @@ static field_t _H262VideoCapability[] = {	/* SEQUENCE */
         {FNAME("videoBadMBsCap") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H263VideoCapability[] = {       /* SEQUENCE */
+static const struct field_t _H263VideoCapability[] = {  /* SEQUENCE */
         {FNAME("sqcifMPI") INT, 5, 1, 0, SKIP | OPT, 0, NULL},
         {FNAME("qcifMPI") INT, 5, 1, 0, SKIP | OPT, 0, NULL},
         {FNAME("cifMPI") INT, 5, 1, 0, SKIP | OPT, 0, NULL},
@@ -330,7 +330,7 @@ static field_t _H263VideoCapability[] = {	/* SEQUENCE */
         {FNAME("h263Options") SEQ, 5, 29, 31, SKIP | EXT | OPT, 0, NULL},
 };
 
-static field_t _IS11172VideoCapability[] = {    /* SEQUENCE */
+static const struct field_t _IS11172VideoCapability[] = {       /* SEQUENCE */
         {FNAME("constrainedBitstream") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("videoBitRate") INT, CONS, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("vbvBufferSize") INT, CONS, 0, 0, SKIP | OPT, 0, NULL},
@@ -341,7 +341,7 @@ static field_t _IS11172VideoCapability[] = {	/* SEQUENCE */
         {FNAME("videoBadMBsCap") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _VideoCapability[] = {   /* CHOICE */
+static const struct field_t _VideoCapability[] = {      /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
          _H245_NonStandardParameter},
         {FNAME("h261VideoCapability") SEQ, 2, 5, 6, SKIP | EXT, 0,
@@ -355,12 +355,12 @@ static field_t _VideoCapability[] = {	/* CHOICE */
         {FNAME("genericVideoCapability") SEQ, 5, 6, 6, SKIP | EXT, 0, NULL},
 };
 
-static field_t _AudioCapability_g7231[] = {     /* SEQUENCE */
+static const struct field_t _AudioCapability_g7231[] = {        /* SEQUENCE */
         {FNAME("maxAl-sduAudioFrames") INT, BYTE, 1, 0, SKIP, 0, NULL},
         {FNAME("silenceSuppression") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _IS11172AudioCapability[] = {    /* SEQUENCE */
+static const struct field_t _IS11172AudioCapability[] = {       /* SEQUENCE */
         {FNAME("audioLayer1") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("audioLayer2") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("audioLayer3") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -372,7 +372,7 @@ static field_t _IS11172AudioCapability[] = {	/* SEQUENCE */
         {FNAME("bitRate") INT, WORD, 1, 0, SKIP, 0, NULL},
 };
 
-static field_t _IS13818AudioCapability[] = {    /* SEQUENCE */
+static const struct field_t _IS13818AudioCapability[] = {       /* SEQUENCE */
         {FNAME("audioLayer1") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("audioLayer2") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("audioLayer3") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -396,7 +396,7 @@ static field_t _IS13818AudioCapability[] = {	/* SEQUENCE */
         {FNAME("bitRate") INT, WORD, 1, 0, SKIP, 0, NULL},
 };
 
-static field_t _AudioCapability[] = {   /* CHOICE */
+static const struct field_t _AudioCapability[] = {      /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
          _H245_NonStandardParameter},
         {FNAME("g711Alaw64k") INT, BYTE, 1, 0, SKIP, 0, NULL},
@@ -424,7 +424,7 @@ static field_t _AudioCapability[] = {	/* CHOICE */
         {FNAME("g729Extensions") SEQ, 1, 8, 8, SKIP | EXT, 0, NULL},
 };
 
-static field_t _DataProtocolCapability[] = {    /* CHOICE */
+static const struct field_t _DataProtocolCapability[] = {       /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
          _H245_NonStandardParameter},
         {FNAME("v14buffered") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -442,7 +442,7 @@ static field_t _DataProtocolCapability[] = {	/* CHOICE */
         {FNAME("udp") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _T84Profile_t84Restricted[] = {  /* SEQUENCE */
+static const struct field_t _T84Profile_t84Restricted[] = {     /* SEQUENCE */
         {FNAME("qcif") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("cif") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("ccir601Seq") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -464,25 +464,25 @@ static field_t _T84Profile_t84Restricted[] = {	/* SEQUENCE */
         {FNAME("digPhotoHighProg") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _T84Profile[] = {        /* CHOICE */
+static const struct field_t _T84Profile[] = {   /* CHOICE */
         {FNAME("t84Unrestricted") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("t84Restricted") SEQ, 0, 19, 19, SKIP | EXT, 0,
          _T84Profile_t84Restricted},
 };
 
-static field_t _DataApplicationCapability_application_t84[] = { /* SEQUENCE */
+static const struct field_t _DataApplicationCapability_application_t84[] = {    /* SEQUENCE */
         {FNAME("t84Protocol") CHOICE, 3, 7, 14, SKIP | EXT, 0,
          _DataProtocolCapability},
         {FNAME("t84Profile") CHOICE, 1, 2, 2, SKIP, 0, _T84Profile},
 };
 
-static field_t _DataApplicationCapability_application_nlpid[] = {       /* SEQUENCE */
+static const struct field_t _DataApplicationCapability_application_nlpid[] = {  /* SEQUENCE */
         {FNAME("nlpidProtocol") CHOICE, 3, 7, 14, SKIP | EXT, 0,
          _DataProtocolCapability},
         {FNAME("nlpidData") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _DataApplicationCapability_application[] = {     /* CHOICE */
+static const struct field_t _DataApplicationCapability_application[] = {        /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
          _H245_NonStandardParameter},
         {FNAME("t120") CHOICE, 3, 7, 14, DECODE | EXT,
@@ -509,20 +509,20 @@ static field_t _DataApplicationCapability_application[] = {	/* CHOICE */
         {FNAME("genericDataCapability") SEQ, 5, 6, 6, SKIP | EXT, 0, NULL},
 };
 
-static field_t _DataApplicationCapability[] = { /* SEQUENCE */
+static const struct field_t _DataApplicationCapability[] = {    /* SEQUENCE */
         {FNAME("application") CHOICE, 4, 10, 14, DECODE | EXT,
          offsetof(DataApplicationCapability, application),
          _DataApplicationCapability_application},
         {FNAME("maxBitRate") INT, CONS, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _EncryptionMode[] = {    /* CHOICE */
+static const struct field_t _EncryptionMode[] = {       /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
          _H245_NonStandardParameter},
         {FNAME("h233Encryption") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _DataType[] = {  /* CHOICE */
+static const struct field_t _DataType[] = {     /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
          _H245_NonStandardParameter},
         {FNAME("nullData") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -538,7 +538,7 @@ static field_t _DataType[] = {	/* CHOICE */
         {FNAME("multiplexedStream") SEQ, 0, 2, 2, SKIP | EXT, 0, NULL},
 };
 
-static field_t _H222LogicalChannelParameters[] = {      /* SEQUENCE */
+static const struct field_t _H222LogicalChannelParameters[] = { /* SEQUENCE */
         {FNAME("resourceID") INT, WORD, 0, 0, SKIP, 0, NULL},
         {FNAME("subChannelID") INT, WORD, 0, 0, SKIP, 0, NULL},
         {FNAME("pcr-pid") INT, WORD, 0, 0, SKIP | OPT, 0, NULL},
@@ -546,12 +546,12 @@ static field_t _H222LogicalChannelParameters[] = {	/* SEQUENCE */
         {FNAME("streamDescriptors") OCTSTR, SEMI, 0, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _H223LogicalChannelParameters_adaptationLayerType_al3[] = {      /* SEQUENCE */
+static const struct field_t _H223LogicalChannelParameters_adaptationLayerType_al3[] = { /* SEQUENCE */
         {FNAME("controlFieldOctets") INT, 2, 0, 0, SKIP, 0, NULL},
         {FNAME("sendBufferSize") INT, CONS, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H223LogicalChannelParameters_adaptationLayerType[] = {  /* CHOICE */
+static const struct field_t _H223LogicalChannelParameters_adaptationLayerType[] = {     /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0,
          _H245_NonStandardParameter},
         {FNAME("al1Framed") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -565,53 +565,53 @@ static field_t _H223LogicalChannelParameters_adaptationLayerType[] = {	/* CHOICE
         {FNAME("al3M") SEQ, 0, 5, 6, SKIP | EXT, 0, NULL},
 };
 
-static field_t _H223LogicalChannelParameters[] = {      /* SEQUENCE */
+static const struct field_t _H223LogicalChannelParameters[] = { /* SEQUENCE */
         {FNAME("adaptationLayerType") CHOICE, 3, 6, 9, SKIP | EXT, 0,
          _H223LogicalChannelParameters_adaptationLayerType},
         {FNAME("segmentableFlag") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CRCLength[] = { /* CHOICE */
+static const struct field_t _CRCLength[] = {    /* CHOICE */
         {FNAME("crc8bit") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("crc16bit") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("crc32bit") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _V76HDLCParameters[] = { /* SEQUENCE */
+static const struct field_t _V76HDLCParameters[] = {    /* SEQUENCE */
         {FNAME("crcLength") CHOICE, 2, 3, 3, SKIP | EXT, 0, _CRCLength},
         {FNAME("n401") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("loopbackTestProcedure") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _V76LogicalChannelParameters_suspendResume[] = { /* CHOICE */
+static const struct field_t _V76LogicalChannelParameters_suspendResume[] = {    /* CHOICE */
         {FNAME("noSuspendResume") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("suspendResumewAddress") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("suspendResumewoAddress") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _V76LogicalChannelParameters_mode_eRM_recovery[] = {     /* CHOICE */
+static const struct field_t _V76LogicalChannelParameters_mode_eRM_recovery[] = {        /* CHOICE */
         {FNAME("rej") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("sREJ") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("mSREJ") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _V76LogicalChannelParameters_mode_eRM[] = {      /* SEQUENCE */
+static const struct field_t _V76LogicalChannelParameters_mode_eRM[] = { /* SEQUENCE */
         {FNAME("windowSize") INT, 7, 1, 0, SKIP, 0, NULL},
         {FNAME("recovery") CHOICE, 2, 3, 3, SKIP | EXT, 0,
          _V76LogicalChannelParameters_mode_eRM_recovery},
 };
 
-static field_t _V76LogicalChannelParameters_mode[] = {  /* CHOICE */
+static const struct field_t _V76LogicalChannelParameters_mode[] = {     /* CHOICE */
         {FNAME("eRM") SEQ, 0, 2, 2, SKIP | EXT, 0,
          _V76LogicalChannelParameters_mode_eRM},
         {FNAME("uNERM") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _V75Parameters[] = {     /* SEQUENCE */
+static const struct field_t _V75Parameters[] = {        /* SEQUENCE */
         {FNAME("audioHeaderPresent") BOOL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _V76LogicalChannelParameters[] = {       /* SEQUENCE */
+static const struct field_t _V76LogicalChannelParameters[] = {  /* SEQUENCE */
         {FNAME("hdlcParameters") SEQ, 0, 3, 3, SKIP | EXT, 0,
          _V76HDLCParameters},
         {FNAME("suspendResume") CHOICE, 2, 3, 3, SKIP | EXT, 0,
@@ -622,38 +622,38 @@ static field_t _V76LogicalChannelParameters[] = {	/* SEQUENCE */
         {FNAME("v75Parameters") SEQ, 0, 1, 1, SKIP | EXT, 0, _V75Parameters},
 };
 
-static field_t _H2250LogicalChannelParameters_nonStandard[] = { /* SEQUENCE OF */
+static const struct field_t _H2250LogicalChannelParameters_nonStandard[] = {    /* SEQUENCE OF */
         {FNAME("item") SEQ, 0, 2, 2, SKIP, 0, _H245_NonStandardParameter},
 };
 
-static field_t _UnicastAddress_iPAddress[] = {  /* SEQUENCE */
+static const struct field_t _UnicastAddress_iPAddress[] = {     /* SEQUENCE */
         {FNAME("network") OCTSTR, FIXD, 4, 0, DECODE,
          offsetof(UnicastAddress_iPAddress, network), NULL},
         {FNAME("tsapIdentifier") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _UnicastAddress_iPXAddress[] = { /* SEQUENCE */
+static const struct field_t _UnicastAddress_iPXAddress[] = {    /* SEQUENCE */
         {FNAME("node") OCTSTR, FIXD, 6, 0, SKIP, 0, NULL},
         {FNAME("netnum") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
         {FNAME("tsapIdentifier") OCTSTR, FIXD, 2, 0, SKIP, 0, NULL},
 };
 
-static field_t _UnicastAddress_iP6Address[] = { /* SEQUENCE */
+static const struct field_t _UnicastAddress_iP6Address[] = {    /* SEQUENCE */
         {FNAME("network") OCTSTR, FIXD, 16, 0, DECODE,
          offsetof(UnicastAddress_iP6Address, network), NULL},
         {FNAME("tsapIdentifier") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _UnicastAddress_iPSourceRouteAddress_routing[] = {       /* CHOICE */
+static const struct field_t _UnicastAddress_iPSourceRouteAddress_routing[] = {  /* CHOICE */
         {FNAME("strict") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("loose") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _UnicastAddress_iPSourceRouteAddress_route[] = { /* SEQUENCE OF */
+static const struct field_t _UnicastAddress_iPSourceRouteAddress_route[] = {    /* SEQUENCE OF */
         {FNAME("item") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
 };
 
-static field_t _UnicastAddress_iPSourceRouteAddress[] = {       /* SEQUENCE */
+static const struct field_t _UnicastAddress_iPSourceRouteAddress[] = {  /* SEQUENCE */
         {FNAME("routing") CHOICE, 1, 2, 2, SKIP, 0,
          _UnicastAddress_iPSourceRouteAddress_routing},
         {FNAME("network") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
@@ -662,7 +662,7 @@ static field_t _UnicastAddress_iPSourceRouteAddress[] = {	/* SEQUENCE */
          _UnicastAddress_iPSourceRouteAddress_route},
 };
 
-static field_t _UnicastAddress[] = {    /* CHOICE */
+static const struct field_t _UnicastAddress[] = {       /* CHOICE */
         {FNAME("iPAddress") SEQ, 0, 2, 2, DECODE | EXT,
          offsetof(UnicastAddress, iPAddress), _UnicastAddress_iPAddress},
         {FNAME("iPXAddress") SEQ, 0, 3, 3, SKIP | EXT, 0,
@@ -676,17 +676,17 @@ static field_t _UnicastAddress[] = {	/* CHOICE */
         {FNAME("nonStandardAddress") SEQ, 0, 2, 2, SKIP, 0, NULL},
 };
 
-static field_t _MulticastAddress_iPAddress[] = {        /* SEQUENCE */
+static const struct field_t _MulticastAddress_iPAddress[] = {   /* SEQUENCE */
         {FNAME("network") OCTSTR, FIXD, 4, 0, SKIP, 0, NULL},
         {FNAME("tsapIdentifier") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _MulticastAddress_iP6Address[] = {       /* SEQUENCE */
+static const struct field_t _MulticastAddress_iP6Address[] = {  /* SEQUENCE */
         {FNAME("network") OCTSTR, FIXD, 16, 0, SKIP, 0, NULL},
         {FNAME("tsapIdentifier") INT, WORD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _MulticastAddress[] = {  /* CHOICE */
+static const struct field_t _MulticastAddress[] = {     /* CHOICE */
         {FNAME("iPAddress") SEQ, 0, 2, 2, SKIP | EXT, 0,
          _MulticastAddress_iPAddress},
         {FNAME("iP6Address") SEQ, 0, 2, 2, SKIP | EXT, 0,
@@ -695,14 +695,14 @@ static field_t _MulticastAddress[] = {	/* CHOICE */
         {FNAME("nonStandardAddress") SEQ, 0, 2, 2, SKIP, 0, NULL},
 };
 
-static field_t _H245_TransportAddress[] = {     /* CHOICE */
+static const struct field_t _H245_TransportAddress[] = {        /* CHOICE */
         {FNAME("unicastAddress") CHOICE, 3, 5, 7, DECODE | EXT,
          offsetof(H245_TransportAddress, unicastAddress), _UnicastAddress},
         {FNAME("multicastAddress") CHOICE, 1, 2, 4, SKIP | EXT, 0,
          _MulticastAddress},
 };
 
-static field_t _H2250LogicalChannelParameters[] = {     /* SEQUENCE */
+static const struct field_t _H2250LogicalChannelParameters[] = {        /* SEQUENCE */
         {FNAME("nonStandard") SEQOF, SEMI, 0, 0, SKIP | OPT, 0,
          _H2250LogicalChannelParameters_nonStandard},
         {FNAME("sessionID") INT, BYTE, 0, 0, SKIP, 0, NULL},
@@ -728,7 +728,7 @@ static field_t _H2250LogicalChannelParameters[] = {	/* SEQUENCE */
         {FNAME("source") SEQ, 0, 2, 2, SKIP | EXT | OPT, 0, NULL},
 };
 
-static field_t _OpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters[] = {    /* CHOICE */
+static const struct field_t _OpenLogicalChannel_forwardLogicalChannelParameters_multiplexParameters[] = {       /* CHOICE */
         {FNAME("h222LogicalChannelParameters") SEQ, 3, 5, 5, SKIP | EXT, 0,
          _H222LogicalChannelParameters},
         {FNAME("h223LogicalChannelParameters") SEQ, 0, 2, 2, SKIP | EXT, 0,
@@ -742,7 +742,7 @@ static field_t _OpenLogicalChannel_forwardLogicalChannelParameters_multiplexPara
         {FNAME("none") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _OpenLogicalChannel_forwardLogicalChannelParameters[] = {        /* SEQUENCE */
+static const struct field_t _OpenLogicalChannel_forwardLogicalChannelParameters[] = {   /* SEQUENCE */
         {FNAME("portNumber") INT, WORD, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("dataType") CHOICE, 3, 6, 9, DECODE | EXT,
          offsetof(OpenLogicalChannel_forwardLogicalChannelParameters,
@@ -756,7 +756,7 @@ static field_t _OpenLogicalChannel_forwardLogicalChannelParameters[] = {	/* SEQU
         {FNAME("replacementFor") INT, WORD, 1, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _OpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters[] = {    /* CHOICE */
+static const struct field_t _OpenLogicalChannel_reverseLogicalChannelParameters_multiplexParameters[] = {       /* CHOICE */
         {FNAME("h223LogicalChannelParameters") SEQ, 0, 2, 2, SKIP | EXT, 0,
          _H223LogicalChannelParameters},
         {FNAME("v76LogicalChannelParameters") SEQ, 0, 5, 5, SKIP | EXT, 0,
@@ -767,7 +767,7 @@ static field_t _OpenLogicalChannel_reverseLogicalChannelParameters_multiplexPara
           h2250LogicalChannelParameters), _H2250LogicalChannelParameters},
 };
 
-static field_t _OpenLogicalChannel_reverseLogicalChannelParameters[] = {        /* SEQUENCE */
+static const struct field_t _OpenLogicalChannel_reverseLogicalChannelParameters[] = {   /* SEQUENCE */
         {FNAME("dataType") CHOICE, 3, 6, 9, SKIP | EXT, 0, _DataType},
         {FNAME("multiplexParameters") CHOICE, 1, 2, 3, DECODE | EXT | OPT,
          offsetof(OpenLogicalChannel_reverseLogicalChannelParameters,
@@ -778,23 +778,23 @@ static field_t _OpenLogicalChannel_reverseLogicalChannelParameters[] = {	/* SEQU
         {FNAME("replacementFor") INT, WORD, 1, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _NetworkAccessParameters_distribution[] = {      /* CHOICE */
+static const struct field_t _NetworkAccessParameters_distribution[] = { /* CHOICE */
         {FNAME("unicast") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("multicast") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _Q2931Address_address[] = {      /* CHOICE */
+static const struct field_t _Q2931Address_address[] = { /* CHOICE */
         {FNAME("internationalNumber") NUMSTR, 4, 1, 0, SKIP, 0, NULL},
         {FNAME("nsapAddress") OCTSTR, 5, 1, 0, SKIP, 0, NULL},
 };
 
-static field_t _Q2931Address[] = {      /* SEQUENCE */
+static const struct field_t _Q2931Address[] = { /* SEQUENCE */
         {FNAME("address") CHOICE, 1, 2, 2, SKIP | EXT, 0,
          _Q2931Address_address},
         {FNAME("subaddress") OCTSTR, 5, 1, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _NetworkAccessParameters_networkAddress[] = {    /* CHOICE */
+static const struct field_t _NetworkAccessParameters_networkAddress[] = {       /* CHOICE */
         {FNAME("q2931Address") SEQ, 1, 2, 2, SKIP | EXT, 0, _Q2931Address},
         {FNAME("e164Address") NUMDGT, 7, 1, 0, SKIP, 0, NULL},
         {FNAME("localAreaAddress") CHOICE, 1, 2, 2, DECODE | EXT,
@@ -802,7 +802,7 @@ static field_t _NetworkAccessParameters_networkAddress[] = {	/* CHOICE */
          _H245_TransportAddress},
 };
 
-static field_t _NetworkAccessParameters[] = {   /* SEQUENCE */
+static const struct field_t _NetworkAccessParameters[] = {      /* SEQUENCE */
         {FNAME("distribution") CHOICE, 1, 2, 2, SKIP | EXT | OPT, 0,
          _NetworkAccessParameters_distribution},
         {FNAME("networkAddress") CHOICE, 2, 3, 3, DECODE | EXT,
@@ -814,7 +814,7 @@ static field_t _NetworkAccessParameters[] = {	/* SEQUENCE */
          NULL},
 };
 
-static field_t _OpenLogicalChannel[] = {        /* SEQUENCE */
+static const struct field_t _OpenLogicalChannel[] = {   /* SEQUENCE */
         {FNAME("forwardLogicalChannelNumber") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("forwardLogicalChannelParameters") SEQ, 1, 3, 5, DECODE | EXT,
          offsetof(OpenLogicalChannel, forwardLogicalChannelParameters),
@@ -829,13 +829,13 @@ static field_t _OpenLogicalChannel[] = {	/* SEQUENCE */
         {FNAME("encryptionSync") SEQ, 2, 4, 4, STOP | EXT | OPT, 0, NULL},
 };
 
-static field_t _Setup_UUIE_fastStart[] = {      /* SEQUENCE OF */
+static const struct field_t _Setup_UUIE_fastStart[] = { /* SEQUENCE OF */
         {FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
          sizeof(OpenLogicalChannel), _OpenLogicalChannel}
         ,
 };
 
-static field_t _Setup_UUIE[] = {        /* SEQUENCE */
+static const struct field_t _Setup_UUIE[] = {   /* SEQUENCE */
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("h245Address") CHOICE, 3, 7, 7, DECODE | EXT | OPT,
          offsetof(Setup_UUIE, h245Address), _TransportAddress},
@@ -894,13 +894,13 @@ static field_t _Setup_UUIE[] = {	/* SEQUENCE */
          NULL},
 };
 
-static field_t _CallProceeding_UUIE_fastStart[] = {     /* SEQUENCE OF */
+static const struct field_t _CallProceeding_UUIE_fastStart[] = {        /* SEQUENCE OF */
         {FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
          sizeof(OpenLogicalChannel), _OpenLogicalChannel}
         ,
 };
 
-static field_t _CallProceeding_UUIE[] = {       /* SEQUENCE */
+static const struct field_t _CallProceeding_UUIE[] = {  /* SEQUENCE */
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("destinationInfo") SEQ, 6, 8, 10, SKIP | EXT, 0,
          _EndpointType},
@@ -920,13 +920,13 @@ static field_t _CallProceeding_UUIE[] = {	/* SEQUENCE */
         {FNAME("featureSet") SEQ, 3, 4, 4, SKIP | EXT | OPT, 0, NULL},
 };
 
-static field_t _Connect_UUIE_fastStart[] = {    /* SEQUENCE OF */
+static const struct field_t _Connect_UUIE_fastStart[] = {       /* SEQUENCE OF */
         {FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
          sizeof(OpenLogicalChannel), _OpenLogicalChannel}
         ,
 };
 
-static field_t _Connect_UUIE[] = {      /* SEQUENCE */
+static const struct field_t _Connect_UUIE[] = { /* SEQUENCE */
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("h245Address") CHOICE, 3, 7, 7, DECODE | EXT | OPT,
          offsetof(Connect_UUIE, h245Address), _TransportAddress},
@@ -954,13 +954,13 @@ static field_t _Connect_UUIE[] = {	/* SEQUENCE */
         {FNAME("featureSet") SEQ, 3, 4, 4, SKIP | EXT | OPT, 0, NULL},
 };
 
-static field_t _Alerting_UUIE_fastStart[] = {   /* SEQUENCE OF */
+static const struct field_t _Alerting_UUIE_fastStart[] = {      /* SEQUENCE OF */
         {FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
          sizeof(OpenLogicalChannel), _OpenLogicalChannel}
         ,
 };
 
-static field_t _Alerting_UUIE[] = {     /* SEQUENCE */
+static const struct field_t _Alerting_UUIE[] = {        /* SEQUENCE */
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("destinationInfo") SEQ, 6, 8, 10, SKIP | EXT, 0,
          _EndpointType},
@@ -986,7 +986,7 @@ static field_t _Alerting_UUIE[] = {	/* SEQUENCE */
         {FNAME("featureSet") SEQ, 3, 4, 4, SKIP | EXT | OPT, 0, NULL},
 };
 
-static field_t _Information_UUIE[] = {  /* SEQUENCE */
+static const struct field_t _Information_UUIE[] = {     /* SEQUENCE */
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("callIdentifier") SEQ, 0, 1, 1, SKIP | EXT, 0, NULL},
         {FNAME("tokens") SEQOF, SEMI, 0, 0, SKIP | OPT, 0, NULL},
@@ -996,7 +996,7 @@ static field_t _Information_UUIE[] = {	/* SEQUENCE */
         {FNAME("circuitInfo") SEQ, 3, 3, 3, SKIP | EXT | OPT, 0, NULL},
 };
 
-static field_t _ReleaseCompleteReason[] = {     /* CHOICE */
+static const struct field_t _ReleaseCompleteReason[] = {        /* CHOICE */
         {FNAME("noBandwidth") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("gatekeeperResources") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("unreachableDestination") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -1022,7 +1022,7 @@ static field_t _ReleaseCompleteReason[] = {	/* CHOICE */
         {FNAME("tunnelledSignallingRejected") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _ReleaseComplete_UUIE[] = {      /* SEQUENCE */
+static const struct field_t _ReleaseComplete_UUIE[] = { /* SEQUENCE */
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("reason") CHOICE, 4, 12, 22, SKIP | EXT | OPT, 0,
          _ReleaseCompleteReason},
@@ -1039,11 +1039,11 @@ static field_t _ReleaseComplete_UUIE[] = {	/* SEQUENCE */
         {FNAME("featureSet") SEQ, 3, 4, 4, SKIP | EXT | OPT, 0, NULL},
 };
 
-static field_t _Facility_UUIE_alternativeAliasAddress[] = {     /* SEQUENCE OF */
+static const struct field_t _Facility_UUIE_alternativeAliasAddress[] = {        /* SEQUENCE OF */
         {FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
 };
 
-static field_t _FacilityReason[] = {    /* CHOICE */
+static const struct field_t _FacilityReason[] = {       /* CHOICE */
         {FNAME("routeCallToGatekeeper") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("callForwarded") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("routeCallToMC") NUL, FIXD, 0, 0, SKIP, 0, NULL},
@@ -1057,13 +1057,13 @@ static field_t _FacilityReason[] = {	/* CHOICE */
         {FNAME("transportedInformation") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _Facility_UUIE_fastStart[] = {   /* SEQUENCE OF */
+static const struct field_t _Facility_UUIE_fastStart[] = {      /* SEQUENCE OF */
         {FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
          sizeof(OpenLogicalChannel), _OpenLogicalChannel}
         ,
 };
 
-static field_t _Facility_UUIE[] = {     /* SEQUENCE */
+static const struct field_t _Facility_UUIE[] = {        /* SEQUENCE */
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("alternativeAddress") CHOICE, 3, 7, 7, DECODE | EXT | OPT,
          offsetof(Facility_UUIE, alternativeAddress), _TransportAddress},
@@ -1094,17 +1094,17 @@ static field_t _Facility_UUIE[] = {	/* SEQUENCE */
          NULL},
 };
 
-static field_t _CallIdentifier[] = {    /* SEQUENCE */
+static const struct field_t _CallIdentifier[] = {       /* SEQUENCE */
         {FNAME("guid") OCTSTR, FIXD, 16, 0, SKIP, 0, NULL},
 };
 
-static field_t _SecurityServiceMode[] = {       /* CHOICE */
+static const struct field_t _SecurityServiceMode[] = {  /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0, _NonStandardParameter},
         {FNAME("none") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("default") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _SecurityCapabilities[] = {      /* SEQUENCE */
+static const struct field_t _SecurityCapabilities[] = { /* SEQUENCE */
         {FNAME("nonStandard") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("encryption") CHOICE, 2, 3, 3, SKIP | EXT, 0,
@@ -1115,30 +1115,30 @@ static field_t _SecurityCapabilities[] = {	/* SEQUENCE */
          _SecurityServiceMode},
 };
 
-static field_t _H245Security[] = {      /* CHOICE */
+static const struct field_t _H245Security[] = { /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 2, 2, SKIP, 0, _NonStandardParameter},
         {FNAME("noSecurity") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("tls") SEQ, 1, 4, 4, SKIP | EXT, 0, _SecurityCapabilities},
         {FNAME("ipsec") SEQ, 1, 4, 4, SKIP | EXT, 0, _SecurityCapabilities},
 };
 
-static field_t _DHset[] = {     /* SEQUENCE */
+static const struct field_t _DHset[] = {        /* SEQUENCE */
         {FNAME("halfkey") BITSTR, WORD, 0, 0, SKIP, 0, NULL},
         {FNAME("modSize") BITSTR, WORD, 0, 0, SKIP, 0, NULL},
         {FNAME("generator") BITSTR, WORD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _TypedCertificate[] = {  /* SEQUENCE */
+static const struct field_t _TypedCertificate[] = {     /* SEQUENCE */
         {FNAME("type") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("certificate") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _H235_NonStandardParameter[] = { /* SEQUENCE */
+static const struct field_t _H235_NonStandardParameter[] = {    /* SEQUENCE */
         {FNAME("nonStandardIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("data") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _ClearToken[] = {        /* SEQUENCE */
+static const struct field_t _ClearToken[] = {   /* SEQUENCE */
         {FNAME("tokenOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("timeStamp") INT, CONS, 1, 0, SKIP | OPT, 0, NULL},
         {FNAME("password") BMPSTR, 7, 1, 0, SKIP | OPT, 0, NULL},
@@ -1154,120 +1154,120 @@ static field_t _ClearToken[] = {	/* SEQUENCE */
         {FNAME("sendersID") BMPSTR, 7, 1, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _Progress_UUIE_tokens[] = {      /* SEQUENCE OF */
+static const struct field_t _Progress_UUIE_tokens[] = { /* SEQUENCE OF */
         {FNAME("item") SEQ, 8, 9, 11, SKIP | EXT, 0, _ClearToken},
 };
 
-static field_t _Params[] = {    /* SEQUENCE */
+static const struct field_t _Params[] = {       /* SEQUENCE */
         {FNAME("ranInt") INT, UNCO, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("iv8") OCTSTR, FIXD, 8, 0, SKIP | OPT, 0, NULL},
         {FNAME("iv16") OCTSTR, FIXD, 16, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _CryptoH323Token_cryptoEPPwdHash_token[] = {     /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoEPPwdHash_token[] = {        /* SEQUENCE */
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("hash") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoH323Token_cryptoEPPwdHash[] = {   /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoEPPwdHash[] = {      /* SEQUENCE */
         {FNAME("alias") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
         {FNAME("timeStamp") INT, CONS, 1, 0, SKIP, 0, NULL},
         {FNAME("token") SEQ, 0, 3, 3, SKIP, 0,
          _CryptoH323Token_cryptoEPPwdHash_token},
 };
 
-static field_t _CryptoH323Token_cryptoGKPwdHash_token[] = {     /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoGKPwdHash_token[] = {        /* SEQUENCE */
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("hash") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoH323Token_cryptoGKPwdHash[] = {   /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoGKPwdHash[] = {      /* SEQUENCE */
         {FNAME("gatekeeperId") BMPSTR, 7, 1, 0, SKIP, 0, NULL},
         {FNAME("timeStamp") INT, CONS, 1, 0, SKIP, 0, NULL},
         {FNAME("token") SEQ, 0, 3, 3, SKIP, 0,
          _CryptoH323Token_cryptoGKPwdHash_token},
 };
 
-static field_t _CryptoH323Token_cryptoEPPwdEncr[] = {   /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoEPPwdEncr[] = {      /* SEQUENCE */
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("encryptedData") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoH323Token_cryptoGKPwdEncr[] = {   /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoGKPwdEncr[] = {      /* SEQUENCE */
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("encryptedData") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoH323Token_cryptoEPCert[] = {      /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoEPCert[] = { /* SEQUENCE */
         {FNAME("toBeSigned") SEQ, 8, 9, 11, SKIP | OPEN | EXT, 0, NULL},
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("signature") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoH323Token_cryptoGKCert[] = {      /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoGKCert[] = { /* SEQUENCE */
         {FNAME("toBeSigned") SEQ, 8, 9, 11, SKIP | OPEN | EXT, 0, NULL},
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("signature") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoH323Token_cryptoFastStart[] = {   /* SEQUENCE */
+static const struct field_t _CryptoH323Token_cryptoFastStart[] = {      /* SEQUENCE */
         {FNAME("toBeSigned") SEQ, 8, 9, 11, SKIP | OPEN | EXT, 0, NULL},
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("signature") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoToken_cryptoEncryptedToken_token[] = {    /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoEncryptedToken_token[] = {       /* SEQUENCE */
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("encryptedData") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoToken_cryptoEncryptedToken[] = {  /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoEncryptedToken[] = {     /* SEQUENCE */
         {FNAME("tokenOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("token") SEQ, 0, 3, 3, SKIP, 0,
          _CryptoToken_cryptoEncryptedToken_token},
 };
 
-static field_t _CryptoToken_cryptoSignedToken_token[] = {       /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoSignedToken_token[] = {  /* SEQUENCE */
         {FNAME("toBeSigned") SEQ, 8, 9, 11, SKIP | OPEN | EXT, 0, NULL},
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("signature") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoToken_cryptoSignedToken[] = {     /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoSignedToken[] = {        /* SEQUENCE */
         {FNAME("tokenOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("token") SEQ, 0, 4, 4, SKIP, 0,
          _CryptoToken_cryptoSignedToken_token},
 };
 
-static field_t _CryptoToken_cryptoHashedToken_token[] = {       /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoHashedToken_token[] = {  /* SEQUENCE */
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("hash") BITSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoToken_cryptoHashedToken[] = {     /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoHashedToken[] = {        /* SEQUENCE */
         {FNAME("tokenOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("hashedVals") SEQ, 8, 9, 11, SKIP | EXT, 0, _ClearToken},
         {FNAME("token") SEQ, 0, 3, 3, SKIP, 0,
          _CryptoToken_cryptoHashedToken_token},
 };
 
-static field_t _CryptoToken_cryptoPwdEncr[] = { /* SEQUENCE */
+static const struct field_t _CryptoToken_cryptoPwdEncr[] = {    /* SEQUENCE */
         {FNAME("algorithmOID") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("paramS") SEQ, 2, 2, 3, SKIP | EXT, 0, _Params},
         {FNAME("encryptedData") OCTSTR, SEMI, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _CryptoToken[] = {       /* CHOICE */
+static const struct field_t _CryptoToken[] = {  /* CHOICE */
         {FNAME("cryptoEncryptedToken") SEQ, 0, 2, 2, SKIP, 0,
          _CryptoToken_cryptoEncryptedToken},
         {FNAME("cryptoSignedToken") SEQ, 0, 2, 2, SKIP, 0,
@@ -1278,7 +1278,7 @@ static field_t _CryptoToken[] = {	/* CHOICE */
          _CryptoToken_cryptoPwdEncr},
 };
 
-static field_t _CryptoH323Token[] = {   /* CHOICE */
+static const struct field_t _CryptoH323Token[] = {      /* CHOICE */
         {FNAME("cryptoEPPwdHash") SEQ, 0, 3, 3, SKIP, 0,
          _CryptoH323Token_cryptoEPPwdHash},
         {FNAME("cryptoGKPwdHash") SEQ, 0, 3, 3, SKIP, 0,
@@ -1297,17 +1297,17 @@ static field_t _CryptoH323Token[] = {	/* CHOICE */
          _CryptoToken},
 };
 
-static field_t _Progress_UUIE_cryptoTokens[] = {        /* SEQUENCE OF */
+static const struct field_t _Progress_UUIE_cryptoTokens[] = {   /* SEQUENCE OF */
         {FNAME("item") CHOICE, 3, 8, 8, SKIP | EXT, 0, _CryptoH323Token},
 };
 
-static field_t _Progress_UUIE_fastStart[] = {   /* SEQUENCE OF */
+static const struct field_t _Progress_UUIE_fastStart[] = {      /* SEQUENCE OF */
         {FNAME("item") SEQ, 1, 3, 5, DECODE | OPEN | EXT,
          sizeof(OpenLogicalChannel), _OpenLogicalChannel}
         ,
 };
 
-static field_t _Progress_UUIE[] = {     /* SEQUENCE */
+static const struct field_t _Progress_UUIE[] = {        /* SEQUENCE */
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("destinationInfo") SEQ, 6, 8, 10, SKIP | EXT, 0,
          _EndpointType},
@@ -1328,7 +1328,7 @@ static field_t _Progress_UUIE[] = {	/* SEQUENCE */
         {FNAME("fastConnectRefused") NUL, FIXD, 0, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _H323_UU_PDU_h323_message_body[] = {     /* CHOICE */
+static const struct field_t _H323_UU_PDU_h323_message_body[] = {        /* CHOICE */
         {FNAME("setup") SEQ, 7, 13, 39, DECODE | EXT,
          offsetof(H323_UU_PDU_h323_message_body, setup), _Setup_UUIE},
         {FNAME("callProceeding") SEQ, 1, 3, 12, DECODE | EXT,
@@ -1352,7 +1352,7 @@ static field_t _H323_UU_PDU_h323_message_body[] = {	/* CHOICE */
         {FNAME("notify") SEQ, 2, 4, 4, SKIP | EXT, 0, NULL},
 };
 
-static field_t _RequestMessage[] = {    /* CHOICE */
+static const struct field_t _RequestMessage[] = {       /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 1, 1, STOP | EXT, 0, NULL},
         {FNAME("masterSlaveDetermination") SEQ, 0, 2, 2, STOP | EXT, 0, NULL},
         {FNAME("terminalCapabilitySet") SEQ, 3, 5, 5, STOP | EXT, 0, NULL},
@@ -1372,7 +1372,7 @@ static field_t _RequestMessage[] = {	/* CHOICE */
          NULL},
 };
 
-static field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters[] = { /* CHOICE */
+static const struct field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexParameters[] = {    /* CHOICE */
         {FNAME("h222LogicalChannelParameters") SEQ, 3, 5, 5, SKIP | EXT, 0,
          _H222LogicalChannelParameters},
         {FNAME("h2250LogicalChannelParameters") SEQ, 10, 11, 14, DECODE | EXT,
@@ -1381,7 +1381,7 @@ static field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters_multiplexP
           h2250LogicalChannelParameters), _H2250LogicalChannelParameters},
 };
 
-static field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters[] = {     /* SEQUENCE */
+static const struct field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters[] = {        /* SEQUENCE */
         {FNAME("reverseLogicalChannelNumber") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("portNumber") INT, WORD, 0, 0, SKIP | OPT, 0, NULL},
         {FNAME("multiplexParameters") CHOICE, 0, 1, 2, DECODE | EXT | OPT,
@@ -1391,11 +1391,11 @@ static field_t _OpenLogicalChannelAck_reverseLogicalChannelParameters[] = {	/* S
         {FNAME("replacementFor") INT, WORD, 1, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _H2250LogicalChannelAckParameters_nonStandard[] = {      /* SEQUENCE OF */
+static const struct field_t _H2250LogicalChannelAckParameters_nonStandard[] = { /* SEQUENCE OF */
         {FNAME("item") SEQ, 0, 2, 2, SKIP, 0, _H245_NonStandardParameter},
 };
 
-static field_t _H2250LogicalChannelAckParameters[] = {  /* SEQUENCE */
+static const struct field_t _H2250LogicalChannelAckParameters[] = {     /* SEQUENCE */
         {FNAME("nonStandard") SEQOF, SEMI, 0, 0, SKIP | OPT, 0,
          _H2250LogicalChannelAckParameters_nonStandard},
         {FNAME("sessionID") INT, 8, 1, 0, SKIP | OPT, 0, NULL},
@@ -1410,14 +1410,14 @@ static field_t _H2250LogicalChannelAckParameters[] = {	/* SEQUENCE */
         {FNAME("portNumber") INT, WORD, 0, 0, SKIP | OPT, 0, NULL},
 };
 
-static field_t _OpenLogicalChannelAck_forwardMultiplexAckParameters[] = {       /* CHOICE */
+static const struct field_t _OpenLogicalChannelAck_forwardMultiplexAckParameters[] = {  /* CHOICE */
         {FNAME("h2250LogicalChannelAckParameters") SEQ, 5, 5, 7, DECODE | EXT,
          offsetof(OpenLogicalChannelAck_forwardMultiplexAckParameters,
                   h2250LogicalChannelAckParameters),
          _H2250LogicalChannelAckParameters},
 };
 
-static field_t _OpenLogicalChannelAck[] = {     /* SEQUENCE */
+static const struct field_t _OpenLogicalChannelAck[] = {        /* SEQUENCE */
         {FNAME("forwardLogicalChannelNumber") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("reverseLogicalChannelParameters") SEQ, 2, 3, 4,
          DECODE | EXT | OPT, offsetof(OpenLogicalChannelAck,
@@ -1433,7 +1433,7 @@ static field_t _OpenLogicalChannelAck[] = {	/* SEQUENCE */
         {FNAME("encryptionSync") SEQ, 2, 4, 4, STOP | EXT | OPT, 0, NULL},
 };
 
-static field_t _ResponseMessage[] = {   /* CHOICE */
+static const struct field_t _ResponseMessage[] = {      /* CHOICE */
         {FNAME("nonStandard") SEQ, 0, 1, 1, STOP | EXT, 0, NULL},
         {FNAME("masterSlaveDeterminationAck") SEQ, 0, 1, 1, STOP | EXT, 0,
          NULL},
@@ -1469,7 +1469,7 @@ static field_t _ResponseMessage[] = {	/* CHOICE */
         {FNAME("logicalChannelRateReject") SEQ, 1, 4, 4, STOP | EXT, 0, NULL},
 };
 
-static field_t _MultimediaSystemControlMessage[] = {    /* CHOICE */
+static const struct field_t _MultimediaSystemControlMessage[] = {       /* CHOICE */
         {FNAME("request") CHOICE, 4, 11, 15, DECODE | EXT,
          offsetof(MultimediaSystemControlMessage, request), _RequestMessage},
         {FNAME("response") CHOICE, 5, 19, 24, DECODE | EXT,
@@ -1479,14 +1479,14 @@ static field_t _MultimediaSystemControlMessage[] = {	/* CHOICE */
         {FNAME("indication") CHOICE, 4, 14, 23, STOP | EXT, 0, NULL},
 };
 
-static field_t _H323_UU_PDU_h245Control[] = {   /* SEQUENCE OF */
+static const struct field_t _H323_UU_PDU_h245Control[] = {      /* SEQUENCE OF */
         {FNAME("item") CHOICE, 2, 4, 4, DECODE | OPEN | EXT,
          sizeof(MultimediaSystemControlMessage),
          _MultimediaSystemControlMessage}
         ,
 };
 
-static field_t _H323_UU_PDU[] = {       /* SEQUENCE */
+static const struct field_t _H323_UU_PDU[] = {  /* SEQUENCE */
         {FNAME("h323-message-body") CHOICE, 3, 7, 13, DECODE | EXT,
          offsetof(H323_UU_PDU, h323_message_body),
          _H323_UU_PDU_h323_message_body},
@@ -1507,13 +1507,13 @@ static field_t _H323_UU_PDU[] = {	/* SEQUENCE */
         {FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
 };
 
-static field_t _H323_UserInformation[] = {      /* SEQUENCE */
+static const struct field_t _H323_UserInformation[] = { /* SEQUENCE */
         {FNAME("h323-uu-pdu") SEQ, 1, 2, 11, DECODE | EXT,
          offsetof(H323_UserInformation, h323_uu_pdu), _H323_UU_PDU},
         {FNAME("user-data") SEQ, 0, 2, 2, STOP | EXT | OPT, 0, NULL},
 };
 
-static field_t _GatekeeperRequest[] = { /* SEQUENCE */
+static const struct field_t _GatekeeperRequest[] = {    /* SEQUENCE */
         {FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
@@ -1537,7 +1537,7 @@ static field_t _GatekeeperRequest[] = {	/* SEQUENCE */
         {FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
 };
 
-static field_t _GatekeeperConfirm[] = { /* SEQUENCE */
+static const struct field_t _GatekeeperConfirm[] = {    /* SEQUENCE */
         {FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
@@ -1557,23 +1557,23 @@ static field_t _GatekeeperConfirm[] = {	/* SEQUENCE */
         {FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
 };
 
-static field_t _RegistrationRequest_callSignalAddress[] = {     /* SEQUENCE OF */
+static const struct field_t _RegistrationRequest_callSignalAddress[] = {        /* SEQUENCE OF */
         {FNAME("item") CHOICE, 3, 7, 7, DECODE | EXT,
          sizeof(TransportAddress), _TransportAddress}
         ,
 };
 
-static field_t _RegistrationRequest_rasAddress[] = {    /* SEQUENCE OF */
+static const struct field_t _RegistrationRequest_rasAddress[] = {       /* SEQUENCE OF */
         {FNAME("item") CHOICE, 3, 7, 7, DECODE | EXT,
          sizeof(TransportAddress), _TransportAddress}
         ,
 };
 
-static field_t _RegistrationRequest_terminalAlias[] = { /* SEQUENCE OF */
+static const struct field_t _RegistrationRequest_terminalAlias[] = {    /* SEQUENCE OF */
         {FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
 };
 
-static field_t _RegistrationRequest[] = {       /* SEQUENCE */
+static const struct field_t _RegistrationRequest[] = {  /* SEQUENCE */
         {FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
@@ -1621,17 +1621,17 @@ static field_t _RegistrationRequest[] = {	/* SEQUENCE */
         {FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
 };
 
-static field_t _RegistrationConfirm_callSignalAddress[] = {     /* SEQUENCE OF */
+static const struct field_t _RegistrationConfirm_callSignalAddress[] = {        /* SEQUENCE OF */
         {FNAME("item") CHOICE, 3, 7, 7, DECODE | EXT,
          sizeof(TransportAddress), _TransportAddress}
         ,
 };
 
-static field_t _RegistrationConfirm_terminalAlias[] = { /* SEQUENCE OF */
+static const struct field_t _RegistrationConfirm_terminalAlias[] = {    /* SEQUENCE OF */
         {FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
 };
 
-static field_t _RegistrationConfirm[] = {       /* SEQUENCE */
+static const struct field_t _RegistrationConfirm[] = {  /* SEQUENCE */
         {FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("protocolIdentifier") OID, BYTE, 0, 0, SKIP, 0, NULL},
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
@@ -1667,13 +1667,13 @@ static field_t _RegistrationConfirm[] = {	/* SEQUENCE */
         {FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
 };
 
-static field_t _UnregistrationRequest_callSignalAddress[] = {   /* SEQUENCE OF */
+static const struct field_t _UnregistrationRequest_callSignalAddress[] = {      /* SEQUENCE OF */
         {FNAME("item") CHOICE, 3, 7, 7, DECODE | EXT,
          sizeof(TransportAddress), _TransportAddress}
         ,
 };
 
-static field_t _UnregistrationRequest[] = {     /* SEQUENCE */
+static const struct field_t _UnregistrationRequest[] = {        /* SEQUENCE */
         {FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("callSignalAddress") SEQOF, SEMI, 0, 10, DECODE,
          offsetof(UnregistrationRequest, callSignalAddress),
@@ -1694,24 +1694,24 @@ static field_t _UnregistrationRequest[] = {	/* SEQUENCE */
         {FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
 };
 
-static field_t _CallModel[] = { /* CHOICE */
+static const struct field_t _CallModel[] = {    /* CHOICE */
         {FNAME("direct") NUL, FIXD, 0, 0, SKIP, 0, NULL},
         {FNAME("gatekeeperRouted") NUL, FIXD, 0, 0, SKIP, 0, NULL},
 };
 
-static field_t _AdmissionRequest_destinationInfo[] = {  /* SEQUENCE OF */
+static const struct field_t _AdmissionRequest_destinationInfo[] = {     /* SEQUENCE OF */
         {FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
 };
 
-static field_t _AdmissionRequest_destExtraCallInfo[] = {        /* SEQUENCE OF */
+static const struct field_t _AdmissionRequest_destExtraCallInfo[] = {   /* SEQUENCE OF */
         {FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
 };
 
-static field_t _AdmissionRequest_srcInfo[] = {  /* SEQUENCE OF */
+static const struct field_t _AdmissionRequest_srcInfo[] = {     /* SEQUENCE OF */
         {FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
 };
 
-static field_t _AdmissionRequest[] = {  /* SEQUENCE */
+static const struct field_t _AdmissionRequest[] = {     /* SEQUENCE */
         {FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("callType") CHOICE, 2, 4, 4, SKIP | EXT, 0, _CallType},
         {FNAME("callModel") CHOICE, 1, 2, 2, SKIP | EXT | OPT, 0, _CallModel},
@@ -1755,7 +1755,7 @@ static field_t _AdmissionRequest[] = {	/* SEQUENCE */
         {FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
 };
 
-static field_t _AdmissionConfirm[] = {  /* SEQUENCE */
+static const struct field_t _AdmissionConfirm[] = {     /* SEQUENCE */
         {FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("bandWidth") INT, CONS, 0, 0, SKIP, 0, NULL},
         {FNAME("callModel") CHOICE, 1, 2, 2, SKIP | EXT, 0, _CallModel},
@@ -1790,11 +1790,11 @@ static field_t _AdmissionConfirm[] = {	/* SEQUENCE */
         {FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
 };
 
-static field_t _LocationRequest_destinationInfo[] = {   /* SEQUENCE OF */
+static const struct field_t _LocationRequest_destinationInfo[] = {      /* SEQUENCE OF */
         {FNAME("item") CHOICE, 1, 2, 7, SKIP | EXT, 0, _AliasAddress},
 };
 
-static field_t _LocationRequest[] = {   /* SEQUENCE */
+static const struct field_t _LocationRequest[] = {      /* SEQUENCE */
         {FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("endpointIdentifier") BMPSTR, 7, 1, 0, SKIP | OPT, 0, NULL},
         {FNAME("destinationInfo") SEQOF, SEMI, 0, 0, SKIP, 0,
@@ -1818,7 +1818,7 @@ static field_t _LocationRequest[] = {	/* SEQUENCE */
         {FNAME("circuitInfo") SEQ, 3, 3, 3, STOP | EXT | OPT, 0, NULL},
 };
 
-static field_t _LocationConfirm[] = {   /* SEQUENCE */
+static const struct field_t _LocationConfirm[] = {      /* SEQUENCE */
         {FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
         {FNAME("callSignalAddress") CHOICE, 3, 7, 7, DECODE | EXT,
          offsetof(LocationConfirm, callSignalAddress), _TransportAddress},
@@ -1844,13 +1844,13 @@ static field_t _LocationConfirm[] = {	/* SEQUENCE */
         {FNAME("serviceControl") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
 };
 
-static field_t _InfoRequestResponse_callSignalAddress[] = {     /* SEQUENCE OF */
+static const struct field_t _InfoRequestResponse_callSignalAddress[] = {        /* SEQUENCE OF */
         {FNAME("item") CHOICE, 3, 7, 7, DECODE | EXT,
          sizeof(TransportAddress), _TransportAddress}
         ,
 };
 
-static field_t _InfoRequestResponse[] = {       /* SEQUENCE */
+static const struct field_t _InfoRequestResponse[] = {  /* SEQUENCE */
         {FNAME("nonStandardData") SEQ, 0, 2, 2, SKIP | OPT, 0,
          _NonStandardParameter},
         {FNAME("requestSeqNum") INT, WORD, 1, 0, SKIP, 0, NULL},
@@ -1873,7 +1873,7 @@ static field_t _InfoRequestResponse[] = {	/* SEQUENCE */
         {FNAME("genericData") SEQOF, SEMI, 0, 0, STOP | OPT, 0, NULL},
 };
 
-static field_t _RasMessage[] = {        /* CHOICE */
+static const struct field_t _RasMessage[] = {   /* CHOICE */
         {FNAME("gatekeeperRequest") SEQ, 4, 8, 18, DECODE | EXT,
          offsetof(RasMessage, gatekeeperRequest), _GatekeeperRequest},
         {FNAME("gatekeeperConfirm") SEQ, 2, 5, 14, DECODE | EXT,
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 96aa637c0932..b1fd21cc1dbc 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -28,6 +28,7 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_extend.h>
 
+static DEFINE_MUTEX(nf_ct_helper_mutex);
 static struct hlist_head *nf_ct_helper_hash __read_mostly;
 static unsigned int nf_ct_helper_hsize __read_mostly;
 static unsigned int nf_ct_helper_count __read_mostly;
@@ -54,42 +55,13 @@ __nf_ct_helper_find(const struct nf_conntrack_tuple *tuple)
                 return NULL;
 
         h = helper_hash(tuple);
-        hlist_for_each_entry(helper, n, &nf_ct_helper_hash[h], hnode) {
+        hlist_for_each_entry_rcu(helper, n, &nf_ct_helper_hash[h], hnode) {
                 if (nf_ct_tuple_src_mask_cmp(tuple, &helper->tuple, &mask))
                         return helper;
         }
         return NULL;
 }
-
-struct nf_conntrack_helper *
-nf_ct_helper_find_get(const struct nf_conntrack_tuple *tuple)
-{
-        struct nf_conntrack_helper *helper;
-
-        /* need nf_conntrack_lock to assure that helper exists until
-         * try_module_get() is called */
-        read_lock_bh(&nf_conntrack_lock);
-
-        helper = __nf_ct_helper_find(tuple);
-        if (helper) {
-                /* need to increase module usage count to assure helper will
-                 * not go away while the caller is e.g. busy putting a
-                 * conntrack in the hash that uses the helper */
-                if (!try_module_get(helper->me))
-                        helper = NULL;
-        }
-
-        read_unlock_bh(&nf_conntrack_lock);
-
-        return helper;
-}
-EXPORT_SYMBOL_GPL(nf_ct_helper_find_get);
-
-void nf_ct_helper_put(struct nf_conntrack_helper *helper)
-{
-        module_put(helper->me);
-}
-EXPORT_SYMBOL_GPL(nf_ct_helper_put);
+EXPORT_SYMBOL_GPL(__nf_ct_helper_find);
 
 struct nf_conntrack_helper *
 __nf_conntrack_helper_find_byname(const char *name)
@@ -99,7 +71,7 @@ __nf_conntrack_helper_find_byname(const char *name)
         unsigned int i;
 
         for (i = 0; i < nf_ct_helper_hsize; i++) {
-                hlist_for_each_entry(h, n, &nf_ct_helper_hash[i], hnode) {
+                hlist_for_each_entry_rcu(h, n, &nf_ct_helper_hash[i], hnode) {
                         if (!strcmp(h->name, name))
                                 return h;
                 }
@@ -140,10 +112,10 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
 
         BUG_ON(me->timeout == 0);
 
-        write_lock_bh(&nf_conntrack_lock);
-        hlist_add_head(&me->hnode, &nf_ct_helper_hash[h]);
+        mutex_lock(&nf_ct_helper_mutex);
+        hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]);
         nf_ct_helper_count++;
-        write_unlock_bh(&nf_conntrack_lock);
+        mutex_unlock(&nf_ct_helper_mutex);
 
         return 0;
 }
@@ -156,10 +128,17 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
         struct hlist_node *n, *next;
         unsigned int i;
 
-        /* Need write lock here, to delete helper. */
-        write_lock_bh(&nf_conntrack_lock);
-        hlist_del(&me->hnode);
+        mutex_lock(&nf_ct_helper_mutex);
+        hlist_del_rcu(&me->hnode);
         nf_ct_helper_count--;
+        mutex_unlock(&nf_ct_helper_mutex);
+
+        /* Make sure every nothing is still using the helper unless its a
+         * connection in the hash.
+         */
+        synchronize_rcu();
+
+        spin_lock_bh(&nf_conntrack_lock);
 
         /* Get rid of expectations */
         for (i = 0; i < nf_ct_expect_hsize; i++) {
@@ -181,10 +160,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me)
                 hlist_for_each_entry(h, n, &nf_conntrack_hash[i], hnode)
                         unhelp(h, me);
         }
-        write_unlock_bh(&nf_conntrack_lock);
-
-        /* Someone could be still looking at the helper in a bh. */
-        synchronize_net();
+        spin_unlock_bh(&nf_conntrack_lock);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister);
 
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index dfaed4ba83cd..c336b07a0d4c 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -23,7 +23,7 @@
 
 #define MAX_PORTS 8
 static unsigned short ports[MAX_PORTS];
-static int ports_c;
+static unsigned int ports_c;
 static unsigned int max_dcc_channels = 8;
 static unsigned int dcc_timeout __read_mostly = 300;
 /* This is slow, but it's simple. --RR */
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 38141f104db7..4a1b42b2b7a5 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -491,11 +491,6 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
                     && ctnetlink_dump_helpinfo(skb, ct) < 0)
                         goto nla_put_failure;
 
-#ifdef CONFIG_NF_CONNTRACK_MARK
-                if ((events & IPCT_MARK || ct->mark)
-                    && ctnetlink_dump_mark(skb, ct) < 0)
-                        goto nla_put_failure;
-#endif
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
                 if ((events & IPCT_SECMARK || ct->secmark)
                     && ctnetlink_dump_secmark(skb, ct) < 0)
@@ -516,6 +511,12 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
                         goto nla_put_failure;
         }
 
+#ifdef CONFIG_NF_CONNTRACK_MARK
+        if ((events & IPCT_MARK || ct->mark)
+            && ctnetlink_dump_mark(skb, ct) < 0)
+                goto nla_put_failure;
+#endif
+
         nlh->nlmsg_len = skb->tail - b;
         nfnetlink_send(skb, 0, group, 0);
         return NOTIFY_DONE;
@@ -545,12 +546,12 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct nfgenmsg *nfmsg = NLMSG_DATA(cb->nlh);
         u_int8_t l3proto = nfmsg->nfgen_family;
 
-        read_lock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
         last = (struct nf_conn *)cb->args[1];
         for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
 restart:
-                hlist_for_each_entry(h, n, &nf_conntrack_hash[cb->args[0]],
-                                     hnode) {
+                hlist_for_each_entry_rcu(h, n, &nf_conntrack_hash[cb->args[0]],
+                                         hnode) {
                         if (NF_CT_DIRECTION(h) != IP_CT_DIR_ORIGINAL)
                                 continue;
                         ct = nf_ct_tuplehash_to_ctrack(h);
@@ -568,7 +569,8 @@ restart:
                                                 cb->nlh->nlmsg_seq,
                                                 IPCTNL_MSG_CT_NEW,
                                                 1, ct) < 0) {
-                                nf_conntrack_get(&ct->ct_general);
+                                if (!atomic_inc_not_zero(&ct->ct_general.use))
+                                        continue;
                                 cb->args[1] = (unsigned long)ct;
                                 goto out;
                         }
@@ -584,7 +586,7 @@ restart:
                 }
         }
 out:
-        read_unlock_bh(&nf_conntrack_lock);
+        rcu_read_unlock();
         if (last)
                 nf_ct_put(last);
 
@@ -1167,11 +1169,12 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
 #endif
 
-        helper = nf_ct_helper_find_get(rtuple);
+        rcu_read_lock();
+        helper = __nf_ct_helper_find(rtuple);
         if (helper) {
                 help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
                 if (help == NULL) {
-                        nf_ct_helper_put(helper);
+                        rcu_read_unlock();
                         err = -ENOMEM;
                         goto err;
                 }
@@ -1187,9 +1190,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
 
         add_timer(&ct->timeout);
         nf_conntrack_hash_insert(ct);
-
-        if (helper)
-                nf_ct_helper_put(helper);
+        rcu_read_unlock();
 
         return 0;
 
@@ -1220,11 +1221,11 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         return err;
         }
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
         if (cda[CTA_TUPLE_ORIG])
-                h = __nf_conntrack_find(&otuple, NULL);
+                h = __nf_conntrack_find(&otuple);
         else if (cda[CTA_TUPLE_REPLY])
-                h = __nf_conntrack_find(&rtuple, NULL);
+                h = __nf_conntrack_find(&rtuple);
 
         if (h == NULL) {
                 struct nf_conntrack_tuple master;
@@ -1237,9 +1238,9 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                                     CTA_TUPLE_MASTER,
                                                     u3);
                         if (err < 0)
-                                return err;
+                                goto out_unlock;
 
-                        master_h = __nf_conntrack_find(&master, NULL);
+                        master_h = __nf_conntrack_find(&master);
                         if (master_h == NULL) {
                                 err = -ENOENT;
                                 goto out_unlock;
@@ -1248,7 +1249,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         atomic_inc(&master_ct->ct_general.use);
                 }
 
-                write_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_lock);
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE)
                         err = ctnetlink_create_conntrack(cda,
@@ -1281,7 +1282,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         }
 
 out_unlock:
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
         return err;
 }
 
@@ -1472,7 +1473,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct hlist_node *n;
         u_int8_t l3proto = nfmsg->nfgen_family;
 
-        read_lock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
         last = (struct nf_conntrack_expect *)cb->args[1];
         for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) {
 restart:
@@ -1489,7 +1490,8 @@ restart:
                                                     cb->nlh->nlmsg_seq,
                                                     IPCTNL_MSG_EXP_NEW,
                                                     1, exp) < 0) {
-                                atomic_inc(&exp->use);
+                                if (!atomic_inc_not_zero(&exp->use))
+                                        continue;
                                 cb->args[1] = (unsigned long)exp;
                                 goto out;
                         }
@@ -1500,7 +1502,7 @@ restart:
                 }
         }
 out:
-        read_unlock_bh(&nf_conntrack_lock);
+        rcu_read_unlock();
         if (last)
                 nf_ct_expect_put(last);
 
@@ -1613,10 +1615,10 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                 struct nf_conn_help *m_help;
 
                 /* delete all expectations for this helper */
-                write_lock_bh(&nf_conntrack_lock);
+                spin_lock_bh(&nf_conntrack_lock);
                 h = __nf_conntrack_helper_find_byname(name);
                 if (!h) {
-                        write_unlock_bh(&nf_conntrack_lock);
+                        spin_unlock_bh(&nf_conntrack_lock);
                         return -EINVAL;
                 }
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
@@ -1631,10 +1633,10 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                                 }
                         }
                 }
-                write_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_lock);
         } else {
                 /* This basically means we have to flush everything*/
-                write_lock_bh(&nf_conntrack_lock);
+                spin_lock_bh(&nf_conntrack_lock);
                 for (i = 0; i < nf_ct_expect_hsize; i++) {
                         hlist_for_each_entry_safe(exp, n, next,
                                                   &nf_ct_expect_hash[i],
@@ -1645,7 +1647,7 @@ ctnetlink_del_expect(struct sock *ctnl, struct sk_buff *skb,
                                 }
                         }
                 }
-                write_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_lock);
         }
 
         return 0;
@@ -1731,11 +1733,11 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 return err;
 
-        write_lock_bh(&nf_conntrack_lock);
+        spin_lock_bh(&nf_conntrack_lock);
         exp = __nf_ct_expect_find(&tuple);
 
         if (!exp) {
-                write_unlock_bh(&nf_conntrack_lock);
+                spin_unlock_bh(&nf_conntrack_lock);
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE)
                         err = ctnetlink_create_expect(cda, u3);
@@ -1745,7 +1747,7 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
         err = -EEXIST;
         if (!(nlh->nlmsg_flags & NLM_F_EXCL))
                 err = ctnetlink_change_expect(exp, cda);
-        write_unlock_bh(&nf_conntrack_lock);
+        spin_unlock_bh(&nf_conntrack_lock);
 
         return err;
 }
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 099b6df3e2b5..b5cb8e831230 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -67,7 +67,7 @@ EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_expectfn);
 
 #ifdef DEBUG
 /* PptpControlMessageType names */
-const char *pptp_msg_name[] = {
+const char *const pptp_msg_name[] = {
         "UNKNOWN_MESSAGE",
         "START_SESSION_REQUEST",
         "START_SESSION_REPLY",
@@ -136,7 +136,7 @@ static void pptp_expectfn(struct nf_conn *ct,
 
 static int destroy_sibling_or_exp(const struct nf_conntrack_tuple *t)
 {
-        struct nf_conntrack_tuple_hash *h;
+        const struct nf_conntrack_tuple_hash *h;
         struct nf_conntrack_expect *exp;
         struct nf_conn *sibling;
 
@@ -168,7 +168,7 @@ static int destroy_sibling_or_exp(const struct nf_conntrack_tuple *t)
 /* timeout GRE data connections */
 static void pptp_destroy_siblings(struct nf_conn *ct)
 {
-        struct nf_conn_help *help = nfct_help(ct);
+        const struct nf_conn_help *help = nfct_help(ct);
         struct nf_conntrack_tuple t;
 
         nf_ct_gre_keymap_destroy(ct);
@@ -497,9 +497,11 @@ conntrack_pptp_help(struct sk_buff *skb, unsigned int protoff,
 
 {
         int dir = CTINFO2DIR(ctinfo);
-        struct nf_ct_pptp_master *info = &nfct_help(ct)->help.ct_pptp_info;
-        struct tcphdr _tcph, *tcph;
-        struct pptp_pkt_hdr _pptph, *pptph;
+        const struct nf_ct_pptp_master *info = &nfct_help(ct)->help.ct_pptp_info;
+        const struct tcphdr *tcph;
+        struct tcphdr _tcph;
+        const struct pptp_pkt_hdr *pptph;
+        struct pptp_pkt_hdr _pptph;
         struct PptpControlHeader _ctlh, *ctlh;
         union pptp_ctrl_union _pptpReq, *pptpReq;
         unsigned int tcplen = skb->len - protoff;
diff --git a/net/netfilter/nf_conntrack_proto_generic.c b/net/netfilter/nf_conntrack_proto_generic.c
index 22c5dcb6306a..55458915575f 100644
--- a/net/netfilter/nf_conntrack_proto_generic.c
+++ b/net/netfilter/nf_conntrack_proto_generic.c
@@ -41,19 +41,19 @@ static int generic_print_tuple(struct seq_file *s,
 }
 
 /* Returns verdict for packet, or -1 for invalid. */
-static int packet(struct nf_conn *conntrack,
+static int packet(struct nf_conn *ct,
                   const struct sk_buff *skb,
                   unsigned int dataoff,
                   enum ip_conntrack_info ctinfo,
                   int pf,
                   unsigned int hooknum)
 {
-        nf_ct_refresh_acct(conntrack, ctinfo, skb, nf_ct_generic_timeout);
+        nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_generic_timeout);
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
-static int new(struct nf_conn *conntrack, const struct sk_buff *skb,
+static int new(struct nf_conn *ct, const struct sk_buff *skb,
                unsigned int dataoff)
 {
         return 1;
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index 4a185f6aa65a..e10024a1b666 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -161,9 +161,11 @@ static int gre_pkt_to_tuple(const struct sk_buff *skb,
                            unsigned int dataoff,
                            struct nf_conntrack_tuple *tuple)
 {
-        struct gre_hdr_pptp _pgrehdr, *pgrehdr;
+        const struct gre_hdr_pptp *pgrehdr;
+        struct gre_hdr_pptp _pgrehdr;
         __be16 srckey;
-        struct gre_hdr _grehdr, *grehdr;
+        const struct gre_hdr *grehdr;
+        struct gre_hdr _grehdr;
 
         /* first only delinearize old RFC1701 GRE header */
         grehdr = skb_header_pointer(skb, dataoff, sizeof(_grehdr), &_grehdr);
diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
index 21d29e782baf..f9a08370dbb3 100644
--- a/net/netfilter/nf_conntrack_proto_sctp.c
+++ b/net/netfilter/nf_conntrack_proto_sctp.c
@@ -25,7 +25,7 @@
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
 
-/* Protects conntrack->proto.sctp */
+/* Protects ct->proto.sctp */
 static DEFINE_RWLOCK(sctp_lock);
 
 /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
@@ -624,7 +624,7 @@ static struct nf_conntrack_l4proto nf_conntrack_l4proto_sctp6 __read_mostly = {
 #endif
 };
 
-int __init nf_conntrack_proto_sctp_init(void)
+static int __init nf_conntrack_proto_sctp_init(void)
 {
         int ret;
 
@@ -647,7 +647,7 @@ int __init nf_conntrack_proto_sctp_init(void)
         return ret;
 }
 
-void __exit nf_conntrack_proto_sctp_fini(void)
+static void __exit nf_conntrack_proto_sctp_fini(void)
 {
         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp6);
         nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_sctp4);
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 64c9b910419c..3e0cccae5636 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -26,7 +26,7 @@
 #include <net/netfilter/nf_conntrack_ecache.h>
 #include <net/netfilter/nf_log.h>
 
-/* Protects conntrack->proto.tcp */
+/* Protects ct->proto.tcp */
 static DEFINE_RWLOCK(tcp_lock);
 
 /* "Be conservative in what you do,
@@ -46,7 +46,7 @@ static int nf_ct_tcp_max_retrans __read_mostly = 3;
   /* FIXME: Examine ipfilter's timeouts and conntrack transitions more
      closely.  They're more complex. --RR */
 
-static const char *tcp_conntrack_names[] = {
+static const char *const tcp_conntrack_names[] = {
         "NONE",
         "SYN_SENT",
         "SYN_RECV",
@@ -261,7 +261,8 @@ static int tcp_pkt_to_tuple(const struct sk_buff *skb,
                             unsigned int dataoff,
                             struct nf_conntrack_tuple *tuple)
 {
-        struct tcphdr _hdr, *hp;
+        const struct tcphdr *hp;
+        struct tcphdr _hdr;
 
         /* Actually only need first 8 bytes. */
         hp = skb_header_pointer(skb, dataoff, 8, &_hdr);
@@ -292,13 +293,12 @@ static int tcp_print_tuple(struct seq_file *s,
 }
 
 /* Print out the private part of the conntrack. */
-static int tcp_print_conntrack(struct seq_file *s,
-                               const struct nf_conn *conntrack)
+static int tcp_print_conntrack(struct seq_file *s, const struct nf_conn *ct)
 {
         enum tcp_conntrack state;
 
         read_lock_bh(&tcp_lock);
-        state = conntrack->proto.tcp.state;
+        state = ct->proto.tcp.state;
         read_unlock_bh(&tcp_lock);
 
         return seq_printf(s, "%s ", tcp_conntrack_names[state]);
@@ -344,7 +344,7 @@ static unsigned int get_conntrack_index(const struct tcphdr *tcph)
 static inline __u32 segment_seq_plus_len(__u32 seq,
                                          size_t len,
                                          unsigned int dataoff,
-                                         struct tcphdr *tcph)
+                                         const struct tcphdr *tcph)
 {
         /* XXX Should I use payload length field in IP/IPv6 header ?
          * - YK */
@@ -363,11 +363,11 @@ static inline __u32 segment_seq_plus_len(__u32 seq,
  */
 static void tcp_options(const struct sk_buff *skb,
                         unsigned int dataoff,
-                        struct tcphdr *tcph,
+                        const struct tcphdr *tcph,
                         struct ip_ct_tcp_state *state)
 {
         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
-        unsigned char *ptr;
+        const unsigned char *ptr;
         int length = (tcph->doff*4) - sizeof(struct tcphdr);
 
         if (!length)
@@ -418,10 +418,10 @@ static void tcp_options(const struct sk_buff *skb,
 }
 
 static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
-                     struct tcphdr *tcph, __u32 *sack)
+                     const struct tcphdr *tcph, __u32 *sack)
 {
         unsigned char buff[(15 * 4) - sizeof(struct tcphdr)];
-        unsigned char *ptr;
+        const unsigned char *ptr;
         int length = (tcph->doff*4) - sizeof(struct tcphdr);
         __u32 tmp;
 
@@ -478,18 +478,18 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
         }
 }
 
-static int tcp_in_window(struct nf_conn *ct,
+static int tcp_in_window(const struct nf_conn *ct,
                          struct ip_ct_tcp *state,
                          enum ip_conntrack_dir dir,
                          unsigned int index,
                          const struct sk_buff *skb,
                          unsigned int dataoff,
-                         struct tcphdr *tcph,
+                         const struct tcphdr *tcph,
                          int pf)
 {
         struct ip_ct_tcp_state *sender = &state->seen[dir];
         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
-        struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
+        const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
         __u32 seq, ack, sack, end, win, swin;
         int res;
 
@@ -687,14 +687,14 @@ static int tcp_in_window(struct nf_conn *ct,
 #ifdef CONFIG_NF_NAT_NEEDED
 /* Update sender->td_end after NAT successfully mangled the packet */
 /* Caller must linearize skb at tcp header. */
-void nf_conntrack_tcp_update(struct sk_buff *skb,
+void nf_conntrack_tcp_update(const struct sk_buff *skb,
                              unsigned int dataoff,
-                             struct nf_conn *conntrack,
+                             struct nf_conn *ct,
                              int dir)
 {
-        struct tcphdr *tcph = (void *)skb->data + dataoff;
-        struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[dir];
-        struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[!dir];
+        const struct tcphdr *tcph = (const void *)skb->data + dataoff;
+        const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
+        const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
         __u32 end;
 
         end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
@@ -703,9 +703,9 @@ void nf_conntrack_tcp_update(struct sk_buff *skb,
         /*
          * We have to worry for the ack in the reply packet only...
          */
-        if (after(end, conntrack->proto.tcp.seen[dir].td_end))
-                conntrack->proto.tcp.seen[dir].td_end = end;
-        conntrack->proto.tcp.last_end = end;
+        if (after(end, ct->proto.tcp.seen[dir].td_end))
+                ct->proto.tcp.seen[dir].td_end = end;
+        ct->proto.tcp.last_end = end;
         write_unlock_bh(&tcp_lock);
         pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
@@ -727,7 +727,7 @@ EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
 #define TH_CWR  0x80
 
 /* table of valid flag combinations - PUSH, ECE and CWR are always valid */
-static u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
+static const u8 tcp_valid_flags[(TH_FIN|TH_SYN|TH_RST|TH_ACK|TH_URG) + 1] =
 {
         [TH_SYN]                        = 1,
         [TH_SYN|TH_URG]                 = 1,
@@ -747,7 +747,8 @@ static int tcp_error(struct sk_buff *skb,
                      int pf,
                      unsigned int hooknum)
 {
-        struct tcphdr _tcph, *th;
+        const struct tcphdr *th;
+        struct tcphdr _tcph;
         unsigned int tcplen = skb->len - dataoff;
         u_int8_t tcpflags;
 
@@ -794,7 +795,7 @@ static int tcp_error(struct sk_buff *skb,
 }
 
 /* Returns verdict for packet, or -1 for invalid. */
-static int tcp_packet(struct nf_conn *conntrack,
+static int tcp_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
@@ -804,7 +805,8 @@ static int tcp_packet(struct nf_conn *conntrack,
         struct nf_conntrack_tuple *tuple;
         enum tcp_conntrack new_state, old_state;
         enum ip_conntrack_dir dir;
-        struct tcphdr *th, _tcph;
+        const struct tcphdr *th;
+        struct tcphdr _tcph;
         unsigned long timeout;
         unsigned int index;
 
@@ -812,26 +814,24 @@ static int tcp_packet(struct nf_conn *conntrack,
         BUG_ON(th == NULL);
 
         write_lock_bh(&tcp_lock);
-        old_state = conntrack->proto.tcp.state;
+        old_state = ct->proto.tcp.state;
         dir = CTINFO2DIR(ctinfo);
         index = get_conntrack_index(th);
         new_state = tcp_conntracks[dir][index][old_state];
-        tuple = &conntrack->tuplehash[dir].tuple;
+        tuple = &ct->tuplehash[dir].tuple;
 
         switch (new_state) {
         case TCP_CONNTRACK_SYN_SENT:
                 if (old_state < TCP_CONNTRACK_TIME_WAIT)
                         break;
-                if ((conntrack->proto.tcp.seen[!dir].flags &
-                        IP_CT_TCP_FLAG_CLOSE_INIT)
-                    || (conntrack->proto.tcp.last_dir == dir
-                        && conntrack->proto.tcp.last_index == TCP_RST_SET)) {
+                if ((ct->proto.tcp.seen[!dir].flags & IP_CT_TCP_FLAG_CLOSE_INIT)
+                    || (ct->proto.tcp.last_dir == dir
+                        && ct->proto.tcp.last_index == TCP_RST_SET)) {
                         /* Attempt to reopen a closed/aborted connection.
                          * Delete this connection and look up again. */
                         write_unlock_bh(&tcp_lock);
-                        if (del_timer(&conntrack->timeout))
-                                conntrack->timeout.function((unsigned long)
-                                                            conntrack);
+                        if (del_timer(&ct->timeout))
+                                ct->timeout.function((unsigned long)ct);
                         return -NF_REPEAT;
                 }
                 /* Fall through */
@@ -843,10 +843,9 @@ static int tcp_packet(struct nf_conn *conntrack,
                  * c) ACK in reply direction after initial SYN in original.
                  */
                 if (index == TCP_SYNACK_SET
-                    && conntrack->proto.tcp.last_index == TCP_SYN_SET
-                    && conntrack->proto.tcp.last_dir != dir
-                    && ntohl(th->ack_seq) ==
-                             conntrack->proto.tcp.last_end) {
+                    && ct->proto.tcp.last_index == TCP_SYN_SET
+                    && ct->proto.tcp.last_dir != dir
+                    && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
                         /* This SYN/ACK acknowledges a SYN that we earlier
                          * ignored as invalid. This means that the client and
                          * the server are both in sync, while the firewall is
@@ -858,15 +857,14 @@ static int tcp_packet(struct nf_conn *conntrack,
                         if (LOG_INVALID(IPPROTO_TCP))
                                 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                           "nf_ct_tcp: killing out of sync session ");
-                        if (del_timer(&conntrack->timeout))
-                                conntrack->timeout.function((unsigned long)
-                                                            conntrack);
+                        if (del_timer(&ct->timeout))
+                                ct->timeout.function((unsigned long)ct);
                         return -NF_DROP;
                 }
-                conntrack->proto.tcp.last_index = index;
-                conntrack->proto.tcp.last_dir = dir;
-                conntrack->proto.tcp.last_seq = ntohl(th->seq);
-                conntrack->proto.tcp.last_end =
+                ct->proto.tcp.last_index = index;
+                ct->proto.tcp.last_dir = dir;
+                ct->proto.tcp.last_seq = ntohl(th->seq);
+                ct->proto.tcp.last_end =
                     segment_seq_plus_len(ntohl(th->seq), skb->len, dataoff, th);
 
                 write_unlock_bh(&tcp_lock);
@@ -885,11 +883,11 @@ static int tcp_packet(struct nf_conn *conntrack,
                 return -NF_ACCEPT;
         case TCP_CONNTRACK_CLOSE:
                 if (index == TCP_RST_SET
-                    && ((test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)
-                         && conntrack->proto.tcp.last_index == TCP_SYN_SET)
-                        || (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
-                            && conntrack->proto.tcp.last_index == TCP_ACK_SET))
-                    && ntohl(th->ack_seq) == conntrack->proto.tcp.last_end) {
+                    && ((test_bit(IPS_SEEN_REPLY_BIT, &ct->status)
+                         && ct->proto.tcp.last_index == TCP_SYN_SET)
+                        || (!test_bit(IPS_ASSURED_BIT, &ct->status)
+                            && ct->proto.tcp.last_index == TCP_ACK_SET))
+                    && ntohl(th->ack_seq) == ct->proto.tcp.last_end) {
                         /* RST sent to invalid SYN or ACK we had let through
                          * at a) and c) above:
                          *
@@ -907,15 +905,15 @@ static int tcp_packet(struct nf_conn *conntrack,
                 break;
         }
 
-        if (!tcp_in_window(conntrack, &conntrack->proto.tcp, dir, index,
+        if (!tcp_in_window(ct, &ct->proto.tcp, dir, index,
                            skb, dataoff, th, pf)) {
                 write_unlock_bh(&tcp_lock);
                 return -NF_ACCEPT;
         }
      in_window:
         /* From now on we have got in-window packets */
-        conntrack->proto.tcp.last_index = index;
-        conntrack->proto.tcp.last_dir = dir;
+        ct->proto.tcp.last_index = index;
+        ct->proto.tcp.last_dir = dir;
 
         pr_debug("tcp_conntracks: ");
         NF_CT_DUMP_TUPLE(tuple);
@@ -924,12 +922,12 @@ static int tcp_packet(struct nf_conn *conntrack,
                  (th->fin ? 1 : 0), (th->rst ? 1 : 0),
                  old_state, new_state);
 
-        conntrack->proto.tcp.state = new_state;
+        ct->proto.tcp.state = new_state;
         if (old_state != new_state
             && (new_state == TCP_CONNTRACK_FIN_WAIT
                 || new_state == TCP_CONNTRACK_CLOSE))
-                conntrack->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
-        timeout = conntrack->proto.tcp.retrans >= nf_ct_tcp_max_retrans
+                ct->proto.tcp.seen[dir].flags |= IP_CT_TCP_FLAG_CLOSE_INIT;
+        timeout = ct->proto.tcp.retrans >= nf_ct_tcp_max_retrans
                   && tcp_timeouts[new_state] > nf_ct_tcp_timeout_max_retrans
                   ? nf_ct_tcp_timeout_max_retrans : tcp_timeouts[new_state];
         write_unlock_bh(&tcp_lock);
@@ -938,41 +936,41 @@ static int tcp_packet(struct nf_conn *conntrack,
         if (new_state != old_state)
                 nf_conntrack_event_cache(IPCT_PROTOINFO, skb);
 
-        if (!test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
+        if (!test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
                 /* If only reply is a RST, we can consider ourselves not to
                    have an established connection: this is a fairly common
                    problem case, so we can delete the conntrack
                    immediately.  --RR */
                 if (th->rst) {
-                        if (del_timer(&conntrack->timeout))
-                                conntrack->timeout.function((unsigned long)
-                                                            conntrack);
+                        if (del_timer(&ct->timeout))
+                                ct->timeout.function((unsigned long)ct);
                         return NF_ACCEPT;
                 }
-        } else if (!test_bit(IPS_ASSURED_BIT, &conntrack->status)
+        } else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
                    && (old_state == TCP_CONNTRACK_SYN_RECV
                        || old_state == TCP_CONNTRACK_ESTABLISHED)
                    && new_state == TCP_CONNTRACK_ESTABLISHED) {
                 /* Set ASSURED if we see see valid ack in ESTABLISHED
                    after SYN_RECV or a valid answer for a picked up
                    connection. */
-                set_bit(IPS_ASSURED_BIT, &conntrack->status);
+                set_bit(IPS_ASSURED_BIT, &ct->status);
                 nf_conntrack_event_cache(IPCT_STATUS, skb);
         }
-        nf_ct_refresh_acct(conntrack, ctinfo, skb, timeout);
+        nf_ct_refresh_acct(ct, ctinfo, skb, timeout);
 
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
-static int tcp_new(struct nf_conn *conntrack,
+static int tcp_new(struct nf_conn *ct,
                    const struct sk_buff *skb,
                    unsigned int dataoff)
 {
         enum tcp_conntrack new_state;
-        struct tcphdr *th, _tcph;
-        struct ip_ct_tcp_state *sender = &conntrack->proto.tcp.seen[0];
-        struct ip_ct_tcp_state *receiver = &conntrack->proto.tcp.seen[1];
+        const struct tcphdr *th;
+        struct tcphdr _tcph;
+        const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[0];
+        const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[1];
 
         th = skb_header_pointer(skb, dataoff, sizeof(_tcph), &_tcph);
         BUG_ON(th == NULL);
@@ -990,17 +988,17 @@ static int tcp_new(struct nf_conn *conntrack,
 
         if (new_state == TCP_CONNTRACK_SYN_SENT) {
                 /* SYN packet */
-                conntrack->proto.tcp.seen[0].td_end =
+                ct->proto.tcp.seen[0].td_end =
                         segment_seq_plus_len(ntohl(th->seq), skb->len,
                                              dataoff, th);
-                conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
-                if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
-                        conntrack->proto.tcp.seen[0].td_maxwin = 1;
-                conntrack->proto.tcp.seen[0].td_maxend =
-                        conntrack->proto.tcp.seen[0].td_end;
-
-                tcp_options(skb, dataoff, th, &conntrack->proto.tcp.seen[0]);
-                conntrack->proto.tcp.seen[1].flags = 0;
+                ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
+                if (ct->proto.tcp.seen[0].td_maxwin == 0)
+                        ct->proto.tcp.seen[0].td_maxwin = 1;
+                ct->proto.tcp.seen[0].td_maxend =
+                        ct->proto.tcp.seen[0].td_end;
+
+                tcp_options(skb, dataoff, th, &ct->proto.tcp.seen[0]);
+                ct->proto.tcp.seen[1].flags = 0;
         } else if (nf_ct_tcp_loose == 0) {
                 /* Don't try to pick up connections. */
                 return 0;
@@ -1010,32 +1008,32 @@ static int tcp_new(struct nf_conn *conntrack,
                  * its history is lost for us.
                  * Let's try to use the data from the packet.
                  */
-                conntrack->proto.tcp.seen[0].td_end =
+                ct->proto.tcp.seen[0].td_end =
                         segment_seq_plus_len(ntohl(th->seq), skb->len,
                                              dataoff, th);
-                conntrack->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
-                if (conntrack->proto.tcp.seen[0].td_maxwin == 0)
-                        conntrack->proto.tcp.seen[0].td_maxwin = 1;
-                conntrack->proto.tcp.seen[0].td_maxend =
-                        conntrack->proto.tcp.seen[0].td_end +
-                        conntrack->proto.tcp.seen[0].td_maxwin;
-                conntrack->proto.tcp.seen[0].td_scale = 0;
+                ct->proto.tcp.seen[0].td_maxwin = ntohs(th->window);
+                if (ct->proto.tcp.seen[0].td_maxwin == 0)
+                        ct->proto.tcp.seen[0].td_maxwin = 1;
+                ct->proto.tcp.seen[0].td_maxend =
+                        ct->proto.tcp.seen[0].td_end +
+                        ct->proto.tcp.seen[0].td_maxwin;
+                ct->proto.tcp.seen[0].td_scale = 0;
 
                 /* We assume SACK and liberal window checking to handle
                  * window scaling */
-                conntrack->proto.tcp.seen[0].flags =
-                conntrack->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
-                                                     IP_CT_TCP_FLAG_BE_LIBERAL;
+                ct->proto.tcp.seen[0].flags =
+                ct->proto.tcp.seen[1].flags = IP_CT_TCP_FLAG_SACK_PERM |
+                                              IP_CT_TCP_FLAG_BE_LIBERAL;
         }
 
-        conntrack->proto.tcp.seen[1].td_end = 0;
-        conntrack->proto.tcp.seen[1].td_maxend = 0;
-        conntrack->proto.tcp.seen[1].td_maxwin = 1;
-        conntrack->proto.tcp.seen[1].td_scale = 0;
+        ct->proto.tcp.seen[1].td_end = 0;
+        ct->proto.tcp.seen[1].td_maxend = 0;
+        ct->proto.tcp.seen[1].td_maxwin = 1;
+        ct->proto.tcp.seen[1].td_scale = 0;
 
         /* tcp_packet will set them */
-        conntrack->proto.tcp.state = TCP_CONNTRACK_NONE;
-        conntrack->proto.tcp.last_index = TCP_NONE_SET;
+        ct->proto.tcp.state = TCP_CONNTRACK_NONE;
+        ct->proto.tcp.last_index = TCP_NONE_SET;
 
         pr_debug("tcp_new: sender end=%u maxend=%u maxwin=%u scale=%i "
                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
@@ -1098,16 +1096,16 @@ static const struct nla_policy tcp_nla_policy[CTA_PROTOINFO_TCP_MAX+1] = {
 
 static int nlattr_to_tcp(struct nlattr *cda[], struct nf_conn *ct)
 {
-        struct nlattr *attr = cda[CTA_PROTOINFO_TCP];
+        struct nlattr *pattr = cda[CTA_PROTOINFO_TCP];
         struct nlattr *tb[CTA_PROTOINFO_TCP_MAX+1];
         int err;
 
         /* updates could not contain anything about the private
          * protocol info, in that case skip the parsing */
-        if (!attr)
+        if (!pattr)
                 return 0;
 
-        err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, attr, tcp_nla_policy);
+        err = nla_parse_nested(tb, CTA_PROTOINFO_TCP_MAX, pattr, tcp_nla_policy);
         if (err < 0)
                 return err;
 
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 384875411082..b8a35cc06416 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -30,7 +30,8 @@ static int udp_pkt_to_tuple(const struct sk_buff *skb,
                              unsigned int dataoff,
                              struct nf_conntrack_tuple *tuple)
 {
-        struct udphdr _hdr, *hp;
+        const struct udphdr *hp;
+        struct udphdr _hdr;
 
         /* Actually only need first 8 bytes. */
         hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
@@ -61,7 +62,7 @@ static int udp_print_tuple(struct seq_file *s,
 }
 
 /* Returns verdict for packet, and may modify conntracktype */
-static int udp_packet(struct nf_conn *conntrack,
+static int udp_packet(struct nf_conn *ct,
                       const struct sk_buff *skb,
                       unsigned int dataoff,
                       enum ip_conntrack_info ctinfo,
@@ -70,20 +71,19 @@ static int udp_packet(struct nf_conn *conntrack,
 {
         /* If we've seen traffic both ways, this is some kind of UDP
            stream.  Extend timeout. */
-        if (test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
-                nf_ct_refresh_acct(conntrack, ctinfo, skb,
-                                   nf_ct_udp_timeout_stream);
+        if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
+                nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout_stream);
                 /* Also, more likely to be important, and not a probe */
-                if (!test_and_set_bit(IPS_ASSURED_BIT, &conntrack->status))
+                if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
                         nf_conntrack_event_cache(IPCT_STATUS, skb);
         } else
-                nf_ct_refresh_acct(conntrack, ctinfo, skb, nf_ct_udp_timeout);
+                nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udp_timeout);
 
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
-static int udp_new(struct nf_conn *conntrack, const struct sk_buff *skb,
+static int udp_new(struct nf_conn *ct, const struct sk_buff *skb,
                    unsigned int dataoff)
 {
         return 1;
@@ -95,7 +95,8 @@ static int udp_error(struct sk_buff *skb, unsigned int dataoff,
                      unsigned int hooknum)
 {
         unsigned int udplen = skb->len - dataoff;
-        struct udphdr _hdr, *hdr;
+        const struct udphdr *hdr;
+        struct udphdr _hdr;
 
         /* Header is too small? */
         hdr = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
diff --git a/net/netfilter/nf_conntrack_proto_udplite.c b/net/netfilter/nf_conntrack_proto_udplite.c
index 070056d9bcd6..9dd03c7aeac6 100644
--- a/net/netfilter/nf_conntrack_proto_udplite.c
+++ b/net/netfilter/nf_conntrack_proto_udplite.c
@@ -31,7 +31,8 @@ static int udplite_pkt_to_tuple(const struct sk_buff *skb,
                                 unsigned int dataoff,
                                 struct nf_conntrack_tuple *tuple)
 {
-        struct udphdr _hdr, *hp;
+        const struct udphdr *hp;
+        struct udphdr _hdr;
 
         hp = skb_header_pointer(skb, dataoff, sizeof(_hdr), &_hdr);
         if (hp == NULL)
@@ -60,7 +61,7 @@ static int udplite_print_tuple(struct seq_file *s,
 }
 
 /* Returns verdict for packet, and may modify conntracktype */
-static int udplite_packet(struct nf_conn *conntrack,
+static int udplite_packet(struct nf_conn *ct,
                           const struct sk_buff *skb,
                           unsigned int dataoff,
                           enum ip_conntrack_info ctinfo,
@@ -69,21 +70,20 @@ static int udplite_packet(struct nf_conn *conntrack,
 {
         /* If we've seen traffic both ways, this is some kind of UDP
            stream.  Extend timeout. */
-        if (test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)) {
-                nf_ct_refresh_acct(conntrack, ctinfo, skb,
+        if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) {
+                nf_ct_refresh_acct(ct, ctinfo, skb,
                                    nf_ct_udplite_timeout_stream);
                 /* Also, more likely to be important, and not a probe */
-                if (!test_and_set_bit(IPS_ASSURED_BIT, &conntrack->status))
+                if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
                         nf_conntrack_event_cache(IPCT_STATUS, skb);
         } else
-                nf_ct_refresh_acct(conntrack, ctinfo, skb,
-                                   nf_ct_udplite_timeout);
+                nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_udplite_timeout);
 
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
-static int udplite_new(struct nf_conn *conntrack, const struct sk_buff *skb,
+static int udplite_new(struct nf_conn *ct, const struct sk_buff *skb,
                        unsigned int dataoff)
 {
         return 1;
@@ -95,7 +95,8 @@ static int udplite_error(struct sk_buff *skb, unsigned int dataoff,
                          unsigned int hooknum)
 {
         unsigned int udplen = skb->len - dataoff;
-        struct udphdr _hdr, *hdr;
+        const struct udphdr *hdr;
+        struct udphdr _hdr;
         unsigned int cscov;
 
         /* Header is too small? */
diff --git a/net/netfilter/nf_conntrack_sane.c b/net/netfilter/nf_conntrack_sane.c
index b5a16c6e21c2..a70051d741a7 100644
--- a/net/netfilter/nf_conntrack_sane.c
+++ b/net/netfilter/nf_conntrack_sane.c
@@ -62,8 +62,9 @@ static int help(struct sk_buff *skb,
                 enum ip_conntrack_info ctinfo)
 {
         unsigned int dataoff, datalen;
-        struct tcphdr _tcph, *th;
-        char *sb_ptr;
+        const struct tcphdr *th;
+        struct tcphdr _tcph;
+        void *sb_ptr;
         int ret = NF_ACCEPT;
         int dir = CTINFO2DIR(ctinfo);
         struct nf_ct_sane_master *ct_sane_info;
@@ -99,7 +100,7 @@ static int help(struct sk_buff *skb,
                 if (datalen != sizeof(struct sane_request))
                         goto out;
 
-                req = (struct sane_request *)sb_ptr;
+                req = sb_ptr;
                 if (req->RPC_code != htonl(SANE_NET_START)) {
                         /* Not an interesting command */
                         ct_sane_info->state = SANE_STATE_NORMAL;
@@ -123,7 +124,7 @@ static int help(struct sk_buff *skb,
                 goto out;
         }
 
-        reply = (struct sane_reply_net_start *)sb_ptr;
+        reply = sb_ptr;
         if (reply->status != htonl(SANE_STATUS_SUCCESS)) {
                 /* saned refused the command */
                 pr_debug("nf_ct_sane: unsuccessful SANE_STATUS = %u\n",
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 47d8947cf263..c521c891d351 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -28,7 +28,7 @@ MODULE_ALIAS("ip_conntrack_sip");
 
 #define MAX_PORTS       8
 static unsigned short ports[MAX_PORTS];
-static int ports_c;
+static unsigned int ports_c;
 module_param_array(ports, ushort, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "port numbers of SIP servers");
 
@@ -48,10 +48,10 @@ unsigned int (*nf_nat_sdp_hook)(struct sk_buff *skb,
                                 const char *dptr) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_sdp_hook);
 
-static int digits_len(struct nf_conn *, const char *, const char *, int *);
-static int epaddr_len(struct nf_conn *, const char *, const char *, int *);
-static int skp_digits_len(struct nf_conn *, const char *, const char *, int *);
-static int skp_epaddr_len(struct nf_conn *, const char *, const char *, int *);
+static int digits_len(const struct nf_conn *, const char *, const char *, int *);
+static int epaddr_len(const struct nf_conn *, const char *, const char *, int *);
+static int skp_digits_len(const struct nf_conn *, const char *, const char *, int *);
+static int skp_epaddr_len(const struct nf_conn *, const char *, const char *, int *);
 
 struct sip_header_nfo {
         const char      *lname;
@@ -61,7 +61,7 @@ struct sip_header_nfo {
         size_t          snlen;
         size_t          ln_strlen;
         int             case_sensitive;
-        int             (*match_len)(struct nf_conn *, const char *,
+        int             (*match_len)(const struct nf_conn *, const char *,
                                      const char *, int *);
 };
 
@@ -225,7 +225,7 @@ const char *ct_sip_search(const char *needle, const char *haystack,
 }
 EXPORT_SYMBOL_GPL(ct_sip_search);
 
-static int digits_len(struct nf_conn *ct, const char *dptr,
+static int digits_len(const struct nf_conn *ct, const char *dptr,
                       const char *limit, int *shift)
 {
         int len = 0;
@@ -237,7 +237,7 @@ static int digits_len(struct nf_conn *ct, const char *dptr,
 }
 
 /* get digits length, skipping blank spaces. */
-static int skp_digits_len(struct nf_conn *ct, const char *dptr,
+static int skp_digits_len(const struct nf_conn *ct, const char *dptr,
                           const char *limit, int *shift)
 {
         for (; dptr <= limit && *dptr == ' '; dptr++)
@@ -246,8 +246,9 @@ static int skp_digits_len(struct nf_conn *ct, const char *dptr,
         return digits_len(ct, dptr, limit, shift);
 }
 
-static int parse_addr(struct nf_conn *ct, const char *cp, const char **endp,
-                      union nf_inet_addr *addr, const char *limit)
+static int parse_addr(const struct nf_conn *ct, const char *cp,
+                      const char **endp, union nf_inet_addr *addr,
+                      const char *limit)
 {
         const char *end;
         int family = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num;
@@ -272,7 +273,7 @@ static int parse_addr(struct nf_conn *ct, const char *cp, const char **endp,
 }
 
 /* skip ip address. returns its length. */
-static int epaddr_len(struct nf_conn *ct, const char *dptr,
+static int epaddr_len(const struct nf_conn *ct, const char *dptr,
                       const char *limit, int *shift)
 {
         union nf_inet_addr addr;
@@ -292,7 +293,7 @@ static int epaddr_len(struct nf_conn *ct, const char *dptr,
 }
 
 /* get address length, skiping user info. */
-static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
+static int skp_epaddr_len(const struct nf_conn *ct, const char *dptr,
                           const char *limit, int *shift)
 {
         const char *start = dptr;
@@ -319,7 +320,7 @@ static int skp_epaddr_len(struct nf_conn *ct, const char *dptr,
 }
 
 /* Returns 0 if not found, -1 error parsing. */
-int ct_sip_get_info(struct nf_conn *ct,
+int ct_sip_get_info(const struct nf_conn *ct,
                     const char *dptr, size_t dlen,
                     unsigned int *matchoff,
                     unsigned int *matchlen,
@@ -407,7 +408,7 @@ static int sip_help(struct sk_buff *skb,
         unsigned int dataoff, datalen;
         const char *dptr;
         int ret = NF_ACCEPT;
-        int matchoff, matchlen;
+        unsigned int matchoff, matchlen;
         u_int16_t port;
         enum sip_header_pos pos;
         typeof(nf_nat_sip_hook) nf_nat_sip;
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 696074a037c1..e88e96af613d 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -31,8 +31,8 @@ MODULE_LICENSE("GPL");
 #ifdef CONFIG_PROC_FS
 int
 print_tuple(struct seq_file *s, const struct nf_conntrack_tuple *tuple,
-            struct nf_conntrack_l3proto *l3proto,
-            struct nf_conntrack_l4proto *l4proto)
+            const struct nf_conntrack_l3proto *l3proto,
+            const struct nf_conntrack_l4proto *l4proto)
 {
         return l3proto->print_tuple(s, tuple) || l4proto->print_tuple(s, tuple);
 }
@@ -58,12 +58,14 @@ struct ct_iter_state {
 static struct hlist_node *ct_get_first(struct seq_file *seq)
 {
         struct ct_iter_state *st = seq->private;
+        struct hlist_node *n;
 
         for (st->bucket = 0;
              st->bucket < nf_conntrack_htable_size;
              st->bucket++) {
-                if (!hlist_empty(&nf_conntrack_hash[st->bucket]))
-                        return nf_conntrack_hash[st->bucket].first;
+                n = rcu_dereference(nf_conntrack_hash[st->bucket].first);
+                if (n)
+                        return n;
         }
         return NULL;
 }
@@ -73,11 +75,11 @@ static struct hlist_node *ct_get_next(struct seq_file *seq,
 {
         struct ct_iter_state *st = seq->private;
 
-        head = head->next;
+        head = rcu_dereference(head->next);
         while (head == NULL) {
                 if (++st->bucket >= nf_conntrack_htable_size)
                         return NULL;
-                head = nf_conntrack_hash[st->bucket].first;
+                head = rcu_dereference(nf_conntrack_hash[st->bucket].first);
         }
         return head;
 }
@@ -93,8 +95,9 @@ static struct hlist_node *ct_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *ct_seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(RCU)
 {
-        read_lock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
         return ct_get_idx(seq, *pos);
 }
 
@@ -105,79 +108,80 @@ static void *ct_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void ct_seq_stop(struct seq_file *s, void *v)
+        __releases(RCU)
 {
-        read_unlock_bh(&nf_conntrack_lock);
+        rcu_read_unlock();
 }
 
 /* return 0 on success, 1 in case of error */
 static int ct_seq_show(struct seq_file *s, void *v)
 {
         const struct nf_conntrack_tuple_hash *hash = v;
-        const struct nf_conn *conntrack = nf_ct_tuplehash_to_ctrack(hash);
-        struct nf_conntrack_l3proto *l3proto;
-        struct nf_conntrack_l4proto *l4proto;
+        const struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
+        const struct nf_conntrack_l3proto *l3proto;
+        const struct nf_conntrack_l4proto *l4proto;
 
-        NF_CT_ASSERT(conntrack);
+        NF_CT_ASSERT(ct);
 
         /* we only want to print DIR_ORIGINAL */
         if (NF_CT_DIRECTION(hash))
                 return 0;
 
-        l3proto = __nf_ct_l3proto_find(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
+        l3proto = __nf_ct_l3proto_find(ct->tuplehash[IP_CT_DIR_ORIGINAL]
                                        .tuple.src.l3num);
 
         NF_CT_ASSERT(l3proto);
-        l4proto = __nf_ct_l4proto_find(conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
+        l4proto = __nf_ct_l4proto_find(ct->tuplehash[IP_CT_DIR_ORIGINAL]
                                    .tuple.src.l3num,
-                                   conntrack->tuplehash[IP_CT_DIR_ORIGINAL]
+                                   ct->tuplehash[IP_CT_DIR_ORIGINAL]
                                    .tuple.dst.protonum);
         NF_CT_ASSERT(l4proto);
 
         if (seq_printf(s, "%-8s %u %-8s %u %ld ",
                        l3proto->name,
-                       conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num,
+                       ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.l3num,
                        l4proto->name,
-                       conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum,
-                       timer_pending(&conntrack->timeout)
-                       ? (long)(conntrack->timeout.expires - jiffies)/HZ : 0) != 0)
+                       ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum,
+                       timer_pending(&ct->timeout)
+                       ? (long)(ct->timeout.expires - jiffies)/HZ : 0) != 0)
                 return -ENOSPC;
 
-        if (l4proto->print_conntrack && l4proto->print_conntrack(s, conntrack))
+        if (l4proto->print_conntrack && l4proto->print_conntrack(s, ct))
                 return -ENOSPC;
 
-        if (print_tuple(s, &conntrack->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+        if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
                         l3proto, l4proto))
                 return -ENOSPC;
 
-        if (seq_print_counters(s, &conntrack->counters[IP_CT_DIR_ORIGINAL]))
+        if (seq_print_counters(s, &ct->counters[IP_CT_DIR_ORIGINAL]))
                 return -ENOSPC;
 
-        if (!(test_bit(IPS_SEEN_REPLY_BIT, &conntrack->status)))
+        if (!(test_bit(IPS_SEEN_REPLY_BIT, &ct->status)))
                 if (seq_printf(s, "[UNREPLIED] "))
                         return -ENOSPC;
 
-        if (print_tuple(s, &conntrack->tuplehash[IP_CT_DIR_REPLY].tuple,
+        if (print_tuple(s, &ct->tuplehash[IP_CT_DIR_REPLY].tuple,
                         l3proto, l4proto))
                 return -ENOSPC;
 
-        if (seq_print_counters(s, &conntrack->counters[IP_CT_DIR_REPLY]))
+        if (seq_print_counters(s, &ct->counters[IP_CT_DIR_REPLY]))
                 return -ENOSPC;
 
-        if (test_bit(IPS_ASSURED_BIT, &conntrack->status))
+        if (test_bit(IPS_ASSURED_BIT, &ct->status))
                 if (seq_printf(s, "[ASSURED] "))
                         return -ENOSPC;
 
 #if defined(CONFIG_NF_CONNTRACK_MARK)
-        if (seq_printf(s, "mark=%u ", conntrack->mark))
+        if (seq_printf(s, "mark=%u ", ct->mark))
                 return -ENOSPC;
 #endif
 
 #ifdef CONFIG_NF_CONNTRACK_SECMARK
-        if (seq_printf(s, "secmark=%u ", conntrack->secmark))
+        if (seq_printf(s, "secmark=%u ", ct->secmark))
                 return -ENOSPC;
 #endif
 
-        if (seq_printf(s, "use=%u\n", atomic_read(&conntrack->ct_general.use)))
+        if (seq_printf(s, "use=%u\n", atomic_read(&ct->ct_general.use)))
                 return -ENOSPC;
 
         return 0;
@@ -242,7 +246,7 @@ static void ct_cpu_seq_stop(struct seq_file *seq, void *v)
 static int ct_cpu_seq_show(struct seq_file *seq, void *v)
 {
         unsigned int nr_conntracks = atomic_read(&nf_conntrack_count);
-        struct ip_conntrack_stat *st = v;
+        const struct ip_conntrack_stat *st = v;
 
         if (v == SEQ_START_TOKEN) {
                 seq_printf(seq, "entries  searched found new invalid ignore delete delete_list insert insert_failed drop early_drop icmp_error  expect_new expect_create expect_delete\n");
@@ -380,7 +384,7 @@ static ctl_table nf_ct_netfilter_table[] = {
         { .ctl_name = 0 }
 };
 
-struct ctl_path nf_ct_path[] = {
+static struct ctl_path nf_ct_path[] = {
         { .procname = "net", .ctl_name = CTL_NET, },
         { }
 };
diff --git a/net/netfilter/nf_conntrack_tftp.c b/net/netfilter/nf_conntrack_tftp.c
index e894aa1ff3ad..bd2e800f23cc 100644
--- a/net/netfilter/nf_conntrack_tftp.c
+++ b/net/netfilter/nf_conntrack_tftp.c
@@ -25,7 +25,7 @@ MODULE_ALIAS("ip_conntrack_tftp");
 
 #define MAX_PORTS 8
 static unsigned short ports[MAX_PORTS];
-static int ports_c;
+static unsigned int ports_c;
 module_param_array(ports, ushort, &ports_c, 0400);
 MODULE_PARM_DESC(ports, "Port numbers of TFTP servers");
 
@@ -39,7 +39,8 @@ static int tftp_help(struct sk_buff *skb,
                      struct nf_conn *ct,
                      enum ip_conntrack_info ctinfo)
 {
-        struct tftphdr _tftph, *tfh;
+        const struct tftphdr *tfh;
+        struct tftphdr _tftph;
         struct nf_conntrack_expect *exp;
         struct nf_conntrack_tuple *tuple;
         unsigned int ret = NF_ACCEPT;
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index 4f5f2885fcac..cec9976aecbf 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -103,6 +103,7 @@ EXPORT_SYMBOL(nf_log_packet);
 
 #ifdef CONFIG_PROC_FS
 static void *seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(RCU)
 {
         rcu_read_lock();
 
@@ -123,6 +124,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void seq_stop(struct seq_file *s, void *v)
+        __releases(RCU)
 {
         rcu_read_unlock();
 }
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 5013cb97ce2b..7efa40d47393 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -467,7 +467,7 @@ __build_packet_message(struct nfulnl_instance *inst,
                 read_lock_bh(&skb->sk->sk_callback_lock);
                 if (skb->sk->sk_socket && skb->sk->sk_socket->file) {
                         __be32 uid = htonl(skb->sk->sk_socket->file->f_uid);
-                        __be32 gid = htons(skb->sk->sk_socket->file->f_gid);
+                        __be32 gid = htonl(skb->sk->sk_socket->file->f_gid);
                         /* need to unlock here since NLA_PUT may goto */
                         read_unlock_bh(&skb->sk->sk_callback_lock);
                         NLA_PUT_BE32(inst->skb, NFULA_UID, uid);
@@ -866,6 +866,7 @@ static struct hlist_node *get_idx(struct iter_state *st, loff_t pos)
 }
 
 static void *seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(instances_lock)
 {
         read_lock_bh(&instances_lock);
         return get_idx(seq->private, *pos);
@@ -878,6 +879,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void seq_stop(struct seq_file *s, void *v)
+        __releases(instances_lock)
 {
         read_unlock_bh(&instances_lock);
 }
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 51476f82bb54..a48b20fe9cd6 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -360,7 +360,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
 
         if (data_len) {
                 struct nlattr *nla;
-                int size = nla_attr_size(data_len);
+                int sz = nla_attr_size(data_len);
 
                 if (skb_tailroom(skb) < nla_total_size(data_len)) {
                         printk(KERN_WARNING "nf_queue: no tailroom!\n");
@@ -369,7 +369,7 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
 
                 nla = (struct nlattr *)skb_put(skb, nla_total_size(data_len));
                 nla->nla_type = NFQA_PAYLOAD;
-                nla->nla_len = size;
+                nla->nla_len = sz;
 
                 if (skb_copy_bits(entskb, 0, nla_data(nla), data_len))
                         BUG();
@@ -845,6 +845,7 @@ static struct hlist_node *get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *seq_start(struct seq_file *seq, loff_t *pos)
+        __acquires(instances_lock)
 {
         spin_lock(&instances_lock);
         return get_idx(seq, *pos);
@@ -857,6 +858,7 @@ static void *seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void seq_stop(struct seq_file *s, void *v)
+        __releases(instances_lock)
 {
         spin_unlock(&instances_lock);
 }
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8d4fca96a4a7..a6792089fcf9 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -44,7 +44,6 @@ struct xt_af {
         struct mutex mutex;
         struct list_head match;
         struct list_head target;
-        struct list_head tables;
 #ifdef CONFIG_COMPAT
         struct mutex compat_mutex;
         struct compat_delta *compat_offsets;
@@ -59,12 +58,6 @@ static struct xt_af *xt;
 #define duprintf(format, args...)
 #endif
 
-enum {
-        TABLE,
-        TARGET,
-        MATCH,
-};
-
 static const char *xt_prefix[NPROTO] = {
         [AF_INET]       = "ip",
         [AF_INET6]      = "ip6",
@@ -400,7 +393,7 @@ int xt_compat_match_offset(struct xt_match *match)
 EXPORT_SYMBOL_GPL(xt_compat_match_offset);
 
 int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
-                              int *size)
+                              unsigned int *size)
 {
         struct xt_match *match = m->u.kernel.match;
         struct compat_xt_entry_match *cm = (struct compat_xt_entry_match *)m;
@@ -427,7 +420,7 @@ int xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
 EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
 
 int xt_compat_match_to_user(struct xt_entry_match *m, void __user **dstptr,
-                            int *size)
+                            unsigned int *size)
 {
         struct xt_match *match = m->u.kernel.match;
         struct compat_xt_entry_match __user *cm = *dstptr;
@@ -494,7 +487,7 @@ int xt_compat_target_offset(struct xt_target *target)
 EXPORT_SYMBOL_GPL(xt_compat_target_offset);
 
 void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
-                                int *size)
+                                unsigned int *size)
 {
         struct xt_target *target = t->u.kernel.target;
         struct compat_xt_entry_target *ct = (struct compat_xt_entry_target *)t;
@@ -520,7 +513,7 @@ void xt_compat_target_from_user(struct xt_entry_target *t, void **dstptr,
 EXPORT_SYMBOL_GPL(xt_compat_target_from_user);
 
 int xt_compat_target_to_user(struct xt_entry_target *t, void __user **dstptr,
-                             int *size)
+                             unsigned int *size)
 {
         struct xt_target *target = t->u.kernel.target;
         struct compat_xt_entry_target __user *ct = *dstptr;
@@ -597,14 +590,14 @@ void xt_free_table_info(struct xt_table_info *info)
 EXPORT_SYMBOL(xt_free_table_info);
 
 /* Find table by name, grabs mutex & ref.  Returns ERR_PTR() on error. */
-struct xt_table *xt_find_table_lock(int af, const char *name)
+struct xt_table *xt_find_table_lock(struct net *net, int af, const char *name)
 {
         struct xt_table *t;
 
         if (mutex_lock_interruptible(&xt[af].mutex) != 0)
                 return ERR_PTR(-EINTR);
 
-        list_for_each_entry(t, &xt[af].tables, list)
+        list_for_each_entry(t, &net->xt.tables[af], list)
                 if (strcmp(t->name, name) == 0 && try_module_get(t->me))
                         return t;
         mutex_unlock(&xt[af].mutex);
@@ -660,20 +653,27 @@ xt_replace_table(struct xt_table *table,
 }
 EXPORT_SYMBOL_GPL(xt_replace_table);
 
-int xt_register_table(struct xt_table *table,
-                      struct xt_table_info *bootstrap,
-                      struct xt_table_info *newinfo)
+struct xt_table *xt_register_table(struct net *net, struct xt_table *table,
+                                   struct xt_table_info *bootstrap,
+                                   struct xt_table_info *newinfo)
 {
         int ret;
         struct xt_table_info *private;
         struct xt_table *t;
 
+        /* Don't add one object to multiple lists. */
+        table = kmemdup(table, sizeof(struct xt_table), GFP_KERNEL);
+        if (!table) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
         ret = mutex_lock_interruptible(&xt[table->af].mutex);
         if (ret != 0)
-                return ret;
+                goto out_free;
 
         /* Don't autoload: we'd eat our tail... */
-        list_for_each_entry(t, &xt[table->af].tables, list) {
+        list_for_each_entry(t, &net->xt.tables[table->af], list) {
                 if (strcmp(t->name, table->name) == 0) {
                         ret = -EEXIST;
                         goto unlock;
@@ -692,12 +692,16 @@ int xt_register_table(struct xt_table *table,
         /* save number of initial entries */
         private->initial_entries = private->number;
 
-        list_add(&table->list, &xt[table->af].tables);
+        list_add(&table->list, &net->xt.tables[table->af]);
+        mutex_unlock(&xt[table->af].mutex);
+        return table;
 
-        ret = 0;
  unlock:
         mutex_unlock(&xt[table->af].mutex);
-        return ret;
+out_free:
+        kfree(table);
+out:
+        return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(xt_register_table);
 
@@ -709,130 +713,204 @@ void *xt_unregister_table(struct xt_table *table)
         private = table->private;
         list_del(&table->list);
         mutex_unlock(&xt[table->af].mutex);
+        kfree(table);
 
         return private;
 }
 EXPORT_SYMBOL_GPL(xt_unregister_table);
 
 #ifdef CONFIG_PROC_FS
-static struct list_head *xt_get_idx(struct list_head *list, struct seq_file *seq, loff_t pos)
+struct xt_names_priv {
+        struct seq_net_private p;
+        int af;
+};
+static void *xt_table_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        struct list_head *head = list->next;
+        struct xt_names_priv *priv = seq->private;
+        struct net *net = priv->p.net;
+        int af = priv->af;
 
-        if (!head || list_empty(list))
-                return NULL;
+        mutex_lock(&xt[af].mutex);
+        return seq_list_start(&net->xt.tables[af], *pos);
+}
 
-        while (pos && (head = head->next)) {
-                if (head == list)
-                        return NULL;
-                pos--;
-        }
-        return pos ? NULL : head;
-}
-
-static struct list_head *type2list(u_int16_t af, u_int16_t type)
-{
-        struct list_head *list;
-
-        switch (type) {
-        case TARGET:
-                list = &xt[af].target;
-                break;
-        case MATCH:
-                list = &xt[af].match;
-                break;
-        case TABLE:
-                list = &xt[af].tables;
-                break;
-        default:
-                list = NULL;
-                break;
-        }
+static void *xt_table_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct xt_names_priv *priv = seq->private;
+        struct net *net = priv->p.net;
+        int af = priv->af;
 
-        return list;
+        return seq_list_next(v, &net->xt.tables[af], pos);
 }
 
-static void *xt_tgt_seq_start(struct seq_file *seq, loff_t *pos)
+static void xt_table_seq_stop(struct seq_file *seq, void *v)
 {
-        struct proc_dir_entry *pde = (struct proc_dir_entry *) seq->private;
-        u_int16_t af = (unsigned long)pde->data & 0xffff;
-        u_int16_t type = (unsigned long)pde->data >> 16;
-        struct list_head *list;
+        struct xt_names_priv *priv = seq->private;
+        int af = priv->af;
 
-        if (af >= NPROTO)
-                return NULL;
+        mutex_unlock(&xt[af].mutex);
+}
 
-        list = type2list(af, type);
-        if (!list)
-                return NULL;
+static int xt_table_seq_show(struct seq_file *seq, void *v)
+{
+        struct xt_table *table = list_entry(v, struct xt_table, list);
 
-        if (mutex_lock_interruptible(&xt[af].mutex) != 0)
-                return NULL;
+        if (strlen(table->name))
+                return seq_printf(seq, "%s\n", table->name);
+        else
+                return 0;
+}
+
+static const struct seq_operations xt_table_seq_ops = {
+        .start  = xt_table_seq_start,
+        .next   = xt_table_seq_next,
+        .stop   = xt_table_seq_stop,
+        .show   = xt_table_seq_show,
+};
 
-        return xt_get_idx(list, seq, *pos);
+static int xt_table_open(struct inode *inode, struct file *file)
+{
+        int ret;
+        struct xt_names_priv *priv;
+
+        ret = seq_open_net(inode, file, &xt_table_seq_ops,
+                           sizeof(struct xt_names_priv));
+        if (!ret) {
+                priv = ((struct seq_file *)file->private_data)->private;
+                priv->af = (unsigned long)PDE(inode)->data;
+        }
+        return ret;
 }
 
-static void *xt_tgt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+static const struct file_operations xt_table_ops = {
+        .owner   = THIS_MODULE,
+        .open    = xt_table_open,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = seq_release,
+};
+
+static void *xt_match_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        struct proc_dir_entry *pde = seq->private;
-        u_int16_t af = (unsigned long)pde->data & 0xffff;
-        u_int16_t type = (unsigned long)pde->data >> 16;
-        struct list_head *list;
+        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+        u_int16_t af = (unsigned long)pde->data;
 
-        if (af >= NPROTO)
-                return NULL;
+        mutex_lock(&xt[af].mutex);
+        return seq_list_start(&xt[af].match, *pos);
+}
 
-        list = type2list(af, type);
-        if (!list)
-                return NULL;
+static void *xt_match_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+        u_int16_t af = (unsigned long)pde->data;
 
-        (*pos)++;
-        return xt_get_idx(list, seq, *pos);
+        return seq_list_next(v, &xt[af].match, pos);
 }
 
-static void xt_tgt_seq_stop(struct seq_file *seq, void *v)
+static void xt_match_seq_stop(struct seq_file *seq, void *v)
 {
         struct proc_dir_entry *pde = seq->private;
-        u_int16_t af = (unsigned long)pde->data & 0xffff;
+        u_int16_t af = (unsigned long)pde->data;
 
         mutex_unlock(&xt[af].mutex);
 }
 
-static int xt_name_seq_show(struct seq_file *seq, void *v)
+static int xt_match_seq_show(struct seq_file *seq, void *v)
 {
-        char *name = (char *)v + sizeof(struct list_head);
+        struct xt_match *match = list_entry(v, struct xt_match, list);
 
-        if (strlen(name))
-                return seq_printf(seq, "%s\n", name);
+        if (strlen(match->name))
+                return seq_printf(seq, "%s\n", match->name);
         else
                 return 0;
 }
 
-static const struct seq_operations xt_tgt_seq_ops = {
-        .start  = xt_tgt_seq_start,
-        .next   = xt_tgt_seq_next,
-        .stop   = xt_tgt_seq_stop,
-        .show   = xt_name_seq_show,
+static const struct seq_operations xt_match_seq_ops = {
+        .start  = xt_match_seq_start,
+        .next   = xt_match_seq_next,
+        .stop   = xt_match_seq_stop,
+        .show   = xt_match_seq_show,
 };
 
-static int xt_tgt_open(struct inode *inode, struct file *file)
+static int xt_match_open(struct inode *inode, struct file *file)
 {
         int ret;
 
-        ret = seq_open(file, &xt_tgt_seq_ops);
+        ret = seq_open(file, &xt_match_seq_ops);
         if (!ret) {
                 struct seq_file *seq = file->private_data;
-                struct proc_dir_entry *pde = PDE(inode);
 
-                seq->private = pde;
+                seq->private = PDE(inode);
         }
+        return ret;
+}
+
+static const struct file_operations xt_match_ops = {
+        .owner   = THIS_MODULE,
+        .open    = xt_match_open,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = seq_release,
+};
+
+static void *xt_target_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+        u_int16_t af = (unsigned long)pde->data;
+
+        mutex_lock(&xt[af].mutex);
+        return seq_list_start(&xt[af].target, *pos);
+}
+
+static void *xt_target_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        struct proc_dir_entry *pde = (struct proc_dir_entry *)seq->private;
+        u_int16_t af = (unsigned long)pde->data;
+
+        return seq_list_next(v, &xt[af].target, pos);
+}
+
+static void xt_target_seq_stop(struct seq_file *seq, void *v)
+{
+        struct proc_dir_entry *pde = seq->private;
+        u_int16_t af = (unsigned long)pde->data;
+
+        mutex_unlock(&xt[af].mutex);
+}
 
+static int xt_target_seq_show(struct seq_file *seq, void *v)
+{
+        struct xt_target *target = list_entry(v, struct xt_target, list);
+
+        if (strlen(target->name))
+                return seq_printf(seq, "%s\n", target->name);
+        else
+                return 0;
+}
+
+static const struct seq_operations xt_target_seq_ops = {
+        .start  = xt_target_seq_start,
+        .next   = xt_target_seq_next,
+        .stop   = xt_target_seq_stop,
+        .show   = xt_target_seq_show,
+};
+
+static int xt_target_open(struct inode *inode, struct file *file)
+{
+        int ret;
+
+        ret = seq_open(file, &xt_target_seq_ops);
+        if (!ret) {
+                struct seq_file *seq = file->private_data;
+
+                seq->private = PDE(inode);
+        }
         return ret;
 }
 
-static const struct file_operations xt_file_ops = {
+static const struct file_operations xt_target_ops = {
         .owner   = THIS_MODULE,
-        .open    = xt_tgt_open,
+        .open    = xt_target_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
         .release = seq_release,
@@ -844,7 +922,7 @@ static const struct file_operations xt_file_ops = {
 
 #endif /* CONFIG_PROC_FS */
 
-int xt_proto_init(int af)
+int xt_proto_init(struct net *net, int af)
 {
 #ifdef CONFIG_PROC_FS
         char buf[XT_FUNCTION_MAXNAMELEN];
@@ -858,25 +936,25 @@ int xt_proto_init(int af)
 #ifdef CONFIG_PROC_FS
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_TABLES, sizeof(buf));
-        proc = proc_net_fops_create(&init_net, buf, 0440, &xt_file_ops);
+        proc = proc_net_fops_create(net, buf, 0440, &xt_table_ops);
         if (!proc)
                 goto out;
-        proc->data = (void *) ((unsigned long) af | (TABLE << 16));
+        proc->data = (void *)(unsigned long)af;
 
 
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_MATCHES, sizeof(buf));
-        proc = proc_net_fops_create(&init_net, buf, 0440, &xt_file_ops);
+        proc = proc_net_fops_create(net, buf, 0440, &xt_match_ops);
         if (!proc)
                 goto out_remove_tables;
-        proc->data = (void *) ((unsigned long) af | (MATCH << 16));
+        proc->data = (void *)(unsigned long)af;
 
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_TARGETS, sizeof(buf));
-        proc = proc_net_fops_create(&init_net, buf, 0440, &xt_file_ops);
+        proc = proc_net_fops_create(net, buf, 0440, &xt_target_ops);
         if (!proc)
                 goto out_remove_matches;
-        proc->data = (void *) ((unsigned long) af | (TARGET << 16));
+        proc->data = (void *)(unsigned long)af;
 #endif
 
         return 0;
@@ -885,42 +963,54 @@ int xt_proto_init(int af)
 out_remove_matches:
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_MATCHES, sizeof(buf));
-        proc_net_remove(&init_net, buf);
+        proc_net_remove(net, buf);
 
 out_remove_tables:
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_TABLES, sizeof(buf));
-        proc_net_remove(&init_net, buf);
+        proc_net_remove(net, buf);
 out:
         return -1;
 #endif
 }
 EXPORT_SYMBOL_GPL(xt_proto_init);
 
-void xt_proto_fini(int af)
+void xt_proto_fini(struct net *net, int af)
 {
 #ifdef CONFIG_PROC_FS
         char buf[XT_FUNCTION_MAXNAMELEN];
 
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_TABLES, sizeof(buf));
-        proc_net_remove(&init_net, buf);
+        proc_net_remove(net, buf);
 
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_TARGETS, sizeof(buf));
-        proc_net_remove(&init_net, buf);
+        proc_net_remove(net, buf);
 
         strlcpy(buf, xt_prefix[af], sizeof(buf));
         strlcat(buf, FORMAT_MATCHES, sizeof(buf));
-        proc_net_remove(&init_net, buf);
+        proc_net_remove(net, buf);
 #endif /*CONFIG_PROC_FS*/
 }
 EXPORT_SYMBOL_GPL(xt_proto_fini);
 
+static int __net_init xt_net_init(struct net *net)
+{
+        int i;
+
+        for (i = 0; i < NPROTO; i++)
+                INIT_LIST_HEAD(&net->xt.tables[i]);
+        return 0;
+}
+
+static struct pernet_operations xt_net_ops = {
+        .init = xt_net_init,
+};
 
 static int __init xt_init(void)
 {
-        int i;
+        int i, rv;
 
         xt = kmalloc(sizeof(struct xt_af) * NPROTO, GFP_KERNEL);
         if (!xt)
@@ -934,13 +1024,16 @@ static int __init xt_init(void)
 #endif
                 INIT_LIST_HEAD(&xt[i].target);
                 INIT_LIST_HEAD(&xt[i].match);
-                INIT_LIST_HEAD(&xt[i].tables);
         }
-        return 0;
+        rv = register_pernet_subsys(&xt_net_ops);
+        if (rv < 0)
+                kfree(xt);
+        return rv;
 }
 
 static void __exit xt_fini(void)
 {
+        unregister_pernet_subsys(&xt_net_ops);
         kfree(xt);
 }
 
diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c
index 60e3767cc71d..217e2b686322 100644
--- a/net/netfilter/xt_TCPMSS.c
+++ b/net/netfilter/xt_TCPMSS.c
@@ -13,7 +13,10 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <linux/tcp.h>
+#include <net/dst.h>
+#include <net/flow.h>
 #include <net/ipv6.h>
+#include <net/route.h>
 #include <net/tcp.h>
 
 #include <linux/netfilter_ipv4/ip_tables.h>
@@ -41,6 +44,7 @@ optlen(const u_int8_t *opt, unsigned int offset)
 static int
 tcpmss_mangle_packet(struct sk_buff *skb,
                      const struct xt_tcpmss_info *info,
+                     unsigned int in_mtu,
                      unsigned int tcphoff,
                      unsigned int minlen)
 {
@@ -76,7 +80,13 @@ tcpmss_mangle_packet(struct sk_buff *skb,
                                        dst_mtu(skb->dst));
                         return -1;
                 }
-                newmss = dst_mtu(skb->dst) - minlen;
+                if (in_mtu <= minlen) {
+                        if (net_ratelimit())
+                                printk(KERN_ERR "xt_TCPMSS: unknown or "
+                                       "invalid path-MTU (%u)\n", in_mtu);
+                        return -1;
+                }
+                newmss = min(dst_mtu(skb->dst), in_mtu) - minlen;
         } else
                 newmss = info->mss;
 
@@ -137,6 +147,28 @@ tcpmss_mangle_packet(struct sk_buff *skb,
         return TCPOLEN_MSS;
 }
 
+static u_int32_t tcpmss_reverse_mtu4(const struct iphdr *iph)
+{
+        struct flowi fl = {
+                .fl4_dst = iph->saddr,
+        };
+        const struct nf_afinfo *ai;
+        struct rtable *rt = NULL;
+        u_int32_t mtu     = ~0U;
+
+        rcu_read_lock();
+        ai = nf_get_afinfo(AF_INET);
+        if (ai != NULL)
+                ai->route((struct dst_entry **)&rt, &fl);
+        rcu_read_unlock();
+
+        if (rt != NULL) {
+                mtu = dst_mtu(&rt->u.dst);
+                dst_release(&rt->u.dst);
+        }
+        return mtu;
+}
+
 static unsigned int
 tcpmss_tg4(struct sk_buff *skb, const struct net_device *in,
            const struct net_device *out, unsigned int hooknum,
@@ -146,7 +178,8 @@ tcpmss_tg4(struct sk_buff *skb, const struct net_device *in,
         __be16 newlen;
         int ret;
 
-        ret = tcpmss_mangle_packet(skb, targinfo, iph->ihl * 4,
+        ret = tcpmss_mangle_packet(skb, targinfo, tcpmss_reverse_mtu4(iph),
+                                   iph->ihl * 4,
                                    sizeof(*iph) + sizeof(struct tcphdr));
         if (ret < 0)
                 return NF_DROP;
@@ -160,6 +193,28 @@ tcpmss_tg4(struct sk_buff *skb, const struct net_device *in,
 }
 
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+static u_int32_t tcpmss_reverse_mtu6(const struct ipv6hdr *iph)
+{
+        struct flowi fl = {
+                .fl6_dst = iph->saddr,
+        };
+        const struct nf_afinfo *ai;
+        struct rtable *rt = NULL;
+        u_int32_t mtu     = ~0U;
+
+        rcu_read_lock();
+        ai = nf_get_afinfo(AF_INET6);
+        if (ai != NULL)
+                ai->route((struct dst_entry **)&rt, &fl);
+        rcu_read_unlock();
+
+        if (rt != NULL) {
+                mtu = dst_mtu(&rt->u.dst);
+                dst_release(&rt->u.dst);
+        }
+        return mtu;
+}
+
 static unsigned int
 tcpmss_tg6(struct sk_buff *skb, const struct net_device *in,
            const struct net_device *out, unsigned int hooknum,
@@ -174,7 +229,8 @@ tcpmss_tg6(struct sk_buff *skb, const struct net_device *in,
         tcphoff = ipv6_skip_exthdr(skb, sizeof(*ipv6h), &nexthdr);
         if (tcphoff < 0)
                 return NF_DROP;
-        ret = tcpmss_mangle_packet(skb, targinfo, tcphoff,
+        ret = tcpmss_mangle_packet(skb, targinfo, tcpmss_reverse_mtu6(ipv6h),
+                                   tcphoff,
                                    sizeof(*ipv6h) + sizeof(struct tcphdr));
         if (ret < 0)
                 return NF_DROP;
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index e00ecd974fa3..3b0111933f60 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -120,11 +120,11 @@ static int count_them(struct xt_connlimit_data *data,
         else
                 hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
 
-        read_lock_bh(&nf_conntrack_lock);
+        rcu_read_lock();
 
         /* check the saved connections */
         list_for_each_entry_safe(conn, tmp, hash, list) {
-                found    = __nf_conntrack_find(&conn->tuple, NULL);
+                found    = __nf_conntrack_find(&conn->tuple);
                 found_ct = NULL;
 
                 if (found != NULL)
@@ -163,7 +163,7 @@ static int count_them(struct xt_connlimit_data *data,
                         ++matches;
         }
 
-        read_unlock_bh(&nf_conntrack_lock);
+        rcu_read_unlock();
 
         if (addit) {
                 /* save the new connection in our list */
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index e92190eafcc5..85330856a29c 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -4,7 +4,6 @@
  *
  *      (C) 2001  Marc Boucher (marc@mbsi.ca).
  *      Copyright © CC Computer Consultants GmbH, 2007 - 2008
- *      Jan Engelhardt <jengelh@computergmbh.de>
  *
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License version 2 as
@@ -20,6 +19,7 @@
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
 MODULE_DESCRIPTION("Xtables: connection tracking state match");
 MODULE_ALIAS("ipt_conntrack");
 MODULE_ALIAS("ip6t_conntrack");
@@ -166,6 +166,44 @@ conntrack_mt_repldst(const struct nf_conn *ct,
                &info->repldst_addr, &info->repldst_mask, family);
 }
 
+static inline bool
+ct_proto_port_check(const struct xt_conntrack_mtinfo1 *info,
+                    const struct nf_conn *ct)
+{
+        const struct nf_conntrack_tuple *tuple;
+
+        tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+        if ((info->match_flags & XT_CONNTRACK_PROTO) &&
+            (tuple->dst.protonum == info->l4proto) ^
+            !(info->invert_flags & XT_CONNTRACK_PROTO))
+                return false;
+
+        /* Shortcut to match all recognized protocols by using ->src.all. */
+        if ((info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) &&
+            (tuple->src.u.all == info->origsrc_port) ^
+            !(info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT))
+                return false;
+
+        if ((info->match_flags & XT_CONNTRACK_ORIGDST_PORT) &&
+            (tuple->dst.u.all == info->origdst_port) ^
+            !(info->invert_flags & XT_CONNTRACK_ORIGDST_PORT))
+                return false;
+
+        tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+
+        if ((info->match_flags & XT_CONNTRACK_REPLSRC_PORT) &&
+            (tuple->src.u.all == info->replsrc_port) ^
+            !(info->invert_flags & XT_CONNTRACK_REPLSRC_PORT))
+                return false;
+
+        if ((info->match_flags & XT_CONNTRACK_REPLDST_PORT) &&
+            (tuple->dst.u.all == info->repldst_port) ^
+            !(info->invert_flags & XT_CONNTRACK_REPLDST_PORT))
+                return false;
+
+        return true;
+}
+
 static bool
 conntrack_mt(const struct sk_buff *skb, const struct net_device *in,
              const struct net_device *out, const struct xt_match *match,
@@ -200,10 +238,9 @@ conntrack_mt(const struct sk_buff *skb, const struct net_device *in,
 
         if (ct == NULL)
                 return info->match_flags & XT_CONNTRACK_STATE;
-
-        if ((info->match_flags & XT_CONNTRACK_PROTO) &&
-            ((ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum ==
-            info->l4proto) ^ !(info->invert_flags & XT_CONNTRACK_PROTO)))
+        if ((info->match_flags & XT_CONNTRACK_DIRECTION) &&
+            (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) ^
+            !!(info->invert_flags & XT_CONNTRACK_DIRECTION))
                 return false;
 
         if (info->match_flags & XT_CONNTRACK_ORIGSRC)
@@ -226,6 +263,9 @@ conntrack_mt(const struct sk_buff *skb, const struct net_device *in,
                     !(info->invert_flags & XT_CONNTRACK_REPLDST))
                         return false;
 
+        if (!ct_proto_port_check(info, ct))
+                return false;
+
         if ((info->match_flags & XT_CONNTRACK_STATUS) &&
             (!!(info->status_mask & ct->status) ^
             !(info->invert_flags & XT_CONNTRACK_STATUS)))
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index d479ca980115..744c7f2ab0b1 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -1,9 +1,9 @@
-/* iptables match extension to limit the number of packets per second
- * seperately for each hashbucket (sourceip/sourceport/dstip/dstport)
+/*
+ *      xt_hashlimit - Netfilter module to limit the number of packets per time
+ *      seperately for each hashbucket (sourceip/sourceport/dstip/dstport)
  *
- * (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
- *
- * $Id: ipt_hashlimit.c 3244 2004-10-20 16:24:29Z laforge@netfilter.org $
+ *      (C) 2003-2004 by Harald Welte <laforge@netfilter.org>
+ *      Copyright © CC Computer Consultants GmbH, 2007 - 2008
  *
  * Development of this code was funded by Astaro AG, http://www.astaro.com/
  */
@@ -35,6 +35,7 @@
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
 MODULE_DESCRIPTION("Xtables: per hash-bucket rate-limit match");
 MODULE_ALIAS("ipt_hashlimit");
 MODULE_ALIAS("ip6t_hashlimit");
@@ -57,7 +58,7 @@ struct dsthash_dst {
                         __be32 dst[4];
                 } ip6;
 #endif
-        } addr;
+        };
         __be16 src_port;
         __be16 dst_port;
 };
@@ -81,7 +82,7 @@ struct xt_hashlimit_htable {
         atomic_t use;
         int family;
 
-        struct hashlimit_cfg cfg;       /* config */
+        struct hashlimit_cfg1 cfg;      /* config */
 
         /* used internally */
         spinlock_t lock;                /* lock for list_head */
@@ -184,7 +185,7 @@ dsthash_free(struct xt_hashlimit_htable *ht, struct dsthash_ent *ent)
 }
 static void htable_gc(unsigned long htlong);
 
-static int htable_create(struct xt_hashlimit_info *minfo, int family)
+static int htable_create_v0(struct xt_hashlimit_info *minfo, int family)
 {
         struct xt_hashlimit_htable *hinfo;
         unsigned int size;
@@ -210,7 +211,18 @@ static int htable_create(struct xt_hashlimit_info *minfo, int family)
         minfo->hinfo = hinfo;
 
         /* copy match config into hashtable config */
-        memcpy(&hinfo->cfg, &minfo->cfg, sizeof(hinfo->cfg));
+        hinfo->cfg.mode        = minfo->cfg.mode;
+        hinfo->cfg.avg         = minfo->cfg.avg;
+        hinfo->cfg.burst       = minfo->cfg.burst;
+        hinfo->cfg.max         = minfo->cfg.max;
+        hinfo->cfg.gc_interval = minfo->cfg.gc_interval;
+        hinfo->cfg.expire      = minfo->cfg.expire;
+
+        if (family == AF_INET)
+                hinfo->cfg.srcmask = hinfo->cfg.dstmask = 32;
+        else
+                hinfo->cfg.srcmask = hinfo->cfg.dstmask = 128;
+
         hinfo->cfg.size = size;
         if (!hinfo->cfg.max)
                 hinfo->cfg.max = 8 * hinfo->cfg.size;
@@ -246,6 +258,70 @@ static int htable_create(struct xt_hashlimit_info *minfo, int family)
         return 0;
 }
 
+static int htable_create(struct xt_hashlimit_mtinfo1 *minfo,
+                         unsigned int family)
+{
+        struct xt_hashlimit_htable *hinfo;
+        unsigned int size;
+        unsigned int i;
+
+        if (minfo->cfg.size) {
+                size = minfo->cfg.size;
+        } else {
+                size = (num_physpages << PAGE_SHIFT) / 16384 /
+                       sizeof(struct list_head);
+                if (num_physpages > 1024 * 1024 * 1024 / PAGE_SIZE)
+                        size = 8192;
+                if (size < 16)
+                        size = 16;
+        }
+        /* FIXME: don't use vmalloc() here or anywhere else -HW */
+        hinfo = vmalloc(sizeof(struct xt_hashlimit_htable) +
+                        sizeof(struct list_head) * size);
+        if (hinfo == NULL) {
+                printk(KERN_ERR "xt_hashlimit: unable to create hashtable\n");
+                return -1;
+        }
+        minfo->hinfo = hinfo;
+
+        /* copy match config into hashtable config */
+        memcpy(&hinfo->cfg, &minfo->cfg, sizeof(hinfo->cfg));
+        hinfo->cfg.size = size;
+        if (hinfo->cfg.max == 0)
+                hinfo->cfg.max = 8 * hinfo->cfg.size;
+        else if (hinfo->cfg.max < hinfo->cfg.size)
+                hinfo->cfg.max = hinfo->cfg.size;
+
+        for (i = 0; i < hinfo->cfg.size; i++)
+                INIT_HLIST_HEAD(&hinfo->hash[i]);
+
+        atomic_set(&hinfo->use, 1);
+        hinfo->count = 0;
+        hinfo->family = family;
+        hinfo->rnd_initialized = 0;
+        spin_lock_init(&hinfo->lock);
+
+        hinfo->pde = create_proc_entry(minfo->name, 0,
+                                       family == AF_INET ? hashlimit_procdir4 :
+                                                           hashlimit_procdir6);
+        if (hinfo->pde == NULL) {
+                vfree(hinfo);
+                return -1;
+        }
+        hinfo->pde->proc_fops = &dl_file_ops;
+        hinfo->pde->data = hinfo;
+
+        setup_timer(&hinfo->timer, htable_gc, (unsigned long)hinfo);
+        hinfo->timer.expires = jiffies + msecs_to_jiffies(hinfo->cfg.gc_interval);
+        add_timer(&hinfo->timer);
+
+        spin_lock_bh(&hashlimit_lock);
+        hlist_add_head(&hinfo->node, &hashlimit_htables);
+        spin_unlock_bh(&hashlimit_lock);
+
+        return 0;
+}
+
 static bool select_all(const struct xt_hashlimit_htable *ht,
                        const struct dsthash_ent *he)
 {
@@ -388,6 +464,48 @@ static inline void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now)
         dh->rateinfo.prev = now;
 }
 
+static inline __be32 maskl(__be32 a, unsigned int l)
+{
+        return htonl(ntohl(a) & ~(~(u_int32_t)0 >> l));
+}
+
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+static void hashlimit_ipv6_mask(__be32 *i, unsigned int p)
+{
+        switch (p) {
+        case 0:
+                i[0] = i[1] = 0;
+                i[2] = i[3] = 0;
+                break;
+        case 1 ... 31:
+                i[0] = maskl(i[0], p);
+                i[1] = i[2] = i[3] = 0;
+                break;
+        case 32:
+                i[1] = i[2] = i[3] = 0;
+                break;
+        case 33 ... 63:
+                i[1] = maskl(i[1], p - 32);
+                i[2] = i[3] = 0;
+                break;
+        case 64:
+                i[2] = i[3] = 0;
+                break;
+        case 65 ... 95:
+                i[2] = maskl(i[2], p - 64);
+                i[3] = 0;
+        case 96:
+                i[3] = 0;
+                break;
+        case 97 ... 127:
+                i[3] = maskl(i[3], p - 96);
+                break;
+        case 128:
+                break;
+        }
+}
+#endif
+
 static int
 hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
                    struct dsthash_dst *dst,
@@ -401,9 +519,11 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
         switch (hinfo->family) {
         case AF_INET:
                 if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP)
-                        dst->addr.ip.dst = ip_hdr(skb)->daddr;
+                        dst->ip.dst = maskl(ip_hdr(skb)->daddr,
+                                      hinfo->cfg.dstmask);
                 if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SIP)
-                        dst->addr.ip.src = ip_hdr(skb)->saddr;
+                        dst->ip.src = maskl(ip_hdr(skb)->saddr,
+                                      hinfo->cfg.srcmask);
 
                 if (!(hinfo->cfg.mode &
                       (XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))
@@ -412,12 +532,16 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
                 break;
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
         case AF_INET6:
-                if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP)
-                        memcpy(&dst->addr.ip6.dst, &ipv6_hdr(skb)->daddr,
-                               sizeof(dst->addr.ip6.dst));
-                if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SIP)
-                        memcpy(&dst->addr.ip6.src, &ipv6_hdr(skb)->saddr,
-                               sizeof(dst->addr.ip6.src));
+                if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_DIP) {
+                        memcpy(&dst->ip6.dst, &ipv6_hdr(skb)->daddr,
+                               sizeof(dst->ip6.dst));
+                        hashlimit_ipv6_mask(dst->ip6.dst, hinfo->cfg.dstmask);
+                }
+                if (hinfo->cfg.mode & XT_HASHLIMIT_HASH_SIP) {
+                        memcpy(&dst->ip6.src, &ipv6_hdr(skb)->saddr,
+                               sizeof(dst->ip6.src));
+                        hashlimit_ipv6_mask(dst->ip6.src, hinfo->cfg.srcmask);
+                }
 
                 if (!(hinfo->cfg.mode &
                       (XT_HASHLIMIT_HASH_DPT | XT_HASHLIMIT_HASH_SPT)))
@@ -457,10 +581,10 @@ hashlimit_init_dst(const struct xt_hashlimit_htable *hinfo,
 }
 
 static bool
-hashlimit_mt(const struct sk_buff *skb, const struct net_device *in,
-             const struct net_device *out, const struct xt_match *match,
-             const void *matchinfo, int offset, unsigned int protoff,
-             bool *hotdrop)
+hashlimit_mt_v0(const struct sk_buff *skb, const struct net_device *in,
+                const struct net_device *out, const struct xt_match *match,
+                const void *matchinfo, int offset, unsigned int protoff,
+                bool *hotdrop)
 {
         const struct xt_hashlimit_info *r =
                 ((const struct xt_hashlimit_info *)matchinfo)->u.master;
@@ -512,9 +636,62 @@ hotdrop:
 }
 
 static bool
-hashlimit_mt_check(const char *tablename, const void *inf,
-                   const struct xt_match *match, void *matchinfo,
-                   unsigned int hook_mask)
+hashlimit_mt(const struct sk_buff *skb, const struct net_device *in,
+             const struct net_device *out, const struct xt_match *match,
+             const void *matchinfo, int offset, unsigned int protoff,
+             bool *hotdrop)
+{
+        const struct xt_hashlimit_mtinfo1 *info = matchinfo;
+        struct xt_hashlimit_htable *hinfo = info->hinfo;
+        unsigned long now = jiffies;
+        struct dsthash_ent *dh;
+        struct dsthash_dst dst;
+
+        if (hashlimit_init_dst(hinfo, &dst, skb, protoff) < 0)
+                goto hotdrop;
+
+        spin_lock_bh(&hinfo->lock);
+        dh = dsthash_find(hinfo, &dst);
+        if (dh == NULL) {
+                dh = dsthash_alloc_init(hinfo, &dst);
+                if (dh == NULL) {
+                        spin_unlock_bh(&hinfo->lock);
+                        goto hotdrop;
+                }
+
+                dh->expires = jiffies + msecs_to_jiffies(hinfo->cfg.expire);
+                dh->rateinfo.prev = jiffies;
+                dh->rateinfo.credit = user2credits(hinfo->cfg.avg *
+                                      hinfo->cfg.burst);
+                dh->rateinfo.credit_cap = user2credits(hinfo->cfg.avg *
+                                          hinfo->cfg.burst);
+                dh->rateinfo.cost = user2credits(hinfo->cfg.avg);
+        } else {
+                /* update expiration timeout */
+                dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
+                rateinfo_recalc(dh, now);
+        }
+
+        if (dh->rateinfo.credit >= dh->rateinfo.cost) {
+                /* below the limit */
+                dh->rateinfo.credit -= dh->rateinfo.cost;
+                spin_unlock_bh(&hinfo->lock);
+                return !(info->cfg.mode & XT_HASHLIMIT_INVERT);
+        }
+
+        spin_unlock_bh(&hinfo->lock);
+        /* default match is underlimit - so over the limit, we need to invert */
+        return info->cfg.mode & XT_HASHLIMIT_INVERT;
+
+ hotdrop:
+        *hotdrop = true;
+        return false;
+}
+
+static bool
+hashlimit_mt_check_v0(const char *tablename, const void *inf,
+                      const struct xt_match *match, void *matchinfo,
+                      unsigned int hook_mask)
 {
         struct xt_hashlimit_info *r = matchinfo;
 
@@ -546,7 +723,7 @@ hashlimit_mt_check(const char *tablename, const void *inf,
          * create duplicate proc files. -HW */
         mutex_lock(&hlimit_mutex);
         r->hinfo = htable_find_get(r->name, match->family);
-        if (!r->hinfo && htable_create(r, match->family) != 0) {
+        if (!r->hinfo && htable_create_v0(r, match->family) != 0) {
                 mutex_unlock(&hlimit_mutex);
                 return false;
         }
@@ -557,14 +734,68 @@ hashlimit_mt_check(const char *tablename, const void *inf,
         return true;
 }
 
+static bool
+hashlimit_mt_check(const char *tablename, const void *inf,
+                   const struct xt_match *match, void *matchinfo,
+                   unsigned int hook_mask)
+{
+        struct xt_hashlimit_mtinfo1 *info = matchinfo;
+
+        /* Check for overflow. */
+        if (info->cfg.burst == 0 ||
+            user2credits(info->cfg.avg * info->cfg.burst) <
+            user2credits(info->cfg.avg)) {
+                printk(KERN_ERR "xt_hashlimit: overflow, try lower: %u/%u\n",
+                       info->cfg.avg, info->cfg.burst);
+                return false;
+        }
+        if (info->cfg.gc_interval == 0 || info->cfg.expire == 0)
+                return false;
+        if (info->name[sizeof(info->name)-1] != '\0')
+                return false;
+        if (match->family == AF_INET) {
+                if (info->cfg.srcmask > 32 || info->cfg.dstmask > 32)
+                        return false;
+        } else {
+                if (info->cfg.srcmask > 128 || info->cfg.dstmask > 128)
+                        return false;
+        }
+
+        /* This is the best we've got: We cannot release and re-grab lock,
+         * since checkentry() is called before x_tables.c grabs xt_mutex.
+         * We also cannot grab the hashtable spinlock, since htable_create will
+         * call vmalloc, and that can sleep.  And we cannot just re-search
+         * the list of htable's in htable_create(), since then we would
+         * create duplicate proc files. -HW */
+        mutex_lock(&hlimit_mutex);
+        info->hinfo = htable_find_get(info->name, match->family);
+        if (!info->hinfo && htable_create(info, match->family) != 0) {
+                mutex_unlock(&hlimit_mutex);
+                return false;
+        }
+        mutex_unlock(&hlimit_mutex);
+
+        /* Ugly hack: For SMP, we only want to use one set */
+        info->master = info;
+        return true;
+}
+
 static void
-hashlimit_mt_destroy(const struct xt_match *match, void *matchinfo)
+hashlimit_mt_destroy_v0(const struct xt_match *match, void *matchinfo)
 {
         const struct xt_hashlimit_info *r = matchinfo;
 
         htable_put(r->hinfo);
 }
 
+static void
+hashlimit_mt_destroy(const struct xt_match *match, void *matchinfo)
+{
+        const struct xt_hashlimit_mtinfo1 *info = matchinfo;
+
+        htable_put(info->hinfo);
+}
+
 #ifdef CONFIG_COMPAT
 struct compat_xt_hashlimit_info {
         char name[IFNAMSIZ];
@@ -592,38 +823,60 @@ static int hashlimit_mt_compat_to_user(void __user *dst, void *src)
 static struct xt_match hashlimit_mt_reg[] __read_mostly = {
         {
                 .name           = "hashlimit",
+                .revision       = 0,
                 .family         = AF_INET,
-                .match          = hashlimit_mt,
+                .match          = hashlimit_mt_v0,
                 .matchsize      = sizeof(struct xt_hashlimit_info),
 #ifdef CONFIG_COMPAT
                 .compatsize     = sizeof(struct compat_xt_hashlimit_info),
                 .compat_from_user = hashlimit_mt_compat_from_user,
                 .compat_to_user = hashlimit_mt_compat_to_user,
 #endif
-                .checkentry     = hashlimit_mt_check,
-                .destroy        = hashlimit_mt_destroy,
+                .checkentry     = hashlimit_mt_check_v0,
+                .destroy        = hashlimit_mt_destroy_v0,
                 .me             = THIS_MODULE
         },
+        {
+                .name           = "hashlimit",
+                .revision       = 1,
+                .family         = AF_INET,
+                .match          = hashlimit_mt,
+                .matchsize      = sizeof(struct xt_hashlimit_mtinfo1),
+                .checkentry     = hashlimit_mt_check,
+                .destroy        = hashlimit_mt_destroy,
+                .me             = THIS_MODULE,
+        },
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
         {
                 .name           = "hashlimit",
                 .family         = AF_INET6,
-                .match          = hashlimit_mt,
+                .match          = hashlimit_mt_v0,
                 .matchsize      = sizeof(struct xt_hashlimit_info),
 #ifdef CONFIG_COMPAT
                 .compatsize     = sizeof(struct compat_xt_hashlimit_info),
                 .compat_from_user = hashlimit_mt_compat_from_user,
                 .compat_to_user = hashlimit_mt_compat_to_user,
 #endif
-                .checkentry     = hashlimit_mt_check,
-                .destroy        = hashlimit_mt_destroy,
+                .checkentry     = hashlimit_mt_check_v0,
+                .destroy        = hashlimit_mt_destroy_v0,
                 .me             = THIS_MODULE
         },
+        {
+                .name           = "hashlimit",
+                .revision       = 1,
+                .family         = AF_INET6,
+                .match          = hashlimit_mt,
+                .matchsize      = sizeof(struct xt_hashlimit_mtinfo1),
+                .checkentry     = hashlimit_mt_check,
+                .destroy        = hashlimit_mt_destroy,
+                .me             = THIS_MODULE,
+        },
 #endif
 };
 
 /* PROC stuff */
 static void *dl_seq_start(struct seq_file *s, loff_t *pos)
+        __acquires(htable->lock)
 {
         struct proc_dir_entry *pde = s->private;
         struct xt_hashlimit_htable *htable = pde->data;
@@ -656,6 +909,7 @@ static void *dl_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void dl_seq_stop(struct seq_file *s, void *v)
+        __releases(htable->lock)
 {
         struct proc_dir_entry *pde = s->private;
         struct xt_hashlimit_htable *htable = pde->data;
@@ -676,9 +930,9 @@ static int dl_seq_real_show(struct dsthash_ent *ent, int family,
                 return seq_printf(s, "%ld %u.%u.%u.%u:%u->"
                                      "%u.%u.%u.%u:%u %u %u %u\n",
                                  (long)(ent->expires - jiffies)/HZ,
-                                 NIPQUAD(ent->dst.addr.ip.src),
+                                 NIPQUAD(ent->dst.ip.src),
                                  ntohs(ent->dst.src_port),
-                                 NIPQUAD(ent->dst.addr.ip.dst),
+                                 NIPQUAD(ent->dst.ip.dst),
                                  ntohs(ent->dst.dst_port),
                                  ent->rateinfo.credit, ent->rateinfo.credit_cap,
                                  ent->rateinfo.cost);
@@ -687,9 +941,9 @@ static int dl_seq_real_show(struct dsthash_ent *ent, int family,
                 return seq_printf(s, "%ld " NIP6_FMT ":%u->"
                                      NIP6_FMT ":%u %u %u %u\n",
                                  (long)(ent->expires - jiffies)/HZ,
-                                 NIP6(*(struct in6_addr *)&ent->dst.addr.ip6.src),
+                                 NIP6(*(struct in6_addr *)&ent->dst.ip6.src),
                                  ntohs(ent->dst.src_port),
-                                 NIP6(*(struct in6_addr *)&ent->dst.addr.ip6.dst),
+                                 NIP6(*(struct in6_addr *)&ent->dst.ip6.dst),
                                  ntohs(ent->dst.dst_port),
                                  ent->rateinfo.credit, ent->rateinfo.credit_cap,
                                  ent->rateinfo.cost);
diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index dbea0e0893f3..01035fc0e140 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -101,7 +101,7 @@ iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
         int r;
 
         for (i = 0; i < 4; ++i) {
-                r = a->s6_addr32[i] - b->s6_addr32[i];
+                r = (__force u32)a->s6_addr32[i] - (__force u32)b->s6_addr32[i];
                 if (r != 0)
                         return r;
         }
diff --git a/net/netfilter/xt_owner.c b/net/netfilter/xt_owner.c
index d382f9cc38b0..9059c16144c3 100644
--- a/net/netfilter/xt_owner.c
+++ b/net/netfilter/xt_owner.c
@@ -4,8 +4,8 @@
  *
  * (C) 2000 Marc Boucher <marc@mbsi.ca>
  *
- * Copyright © CC Computer Consultants GmbH, 2007
- * Contact: <jengelh@computergmbh.de>
+ * Copyright © CC Computer Consultants GmbH, 2007 - 2008
+ * <jengelh@computergmbh.de>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -102,13 +102,15 @@ owner_mt(const struct sk_buff *skb, const struct net_device *in,
                        (XT_OWNER_UID | XT_OWNER_GID)) == 0;
 
         if (info->match & XT_OWNER_UID)
-                if ((filp->f_uid != info->uid) ^
-                    !!(info->invert & XT_OWNER_UID))
+                if ((filp->f_uid >= info->uid_min &&
+                    filp->f_uid <= info->uid_max) ^
+                    !(info->invert & XT_OWNER_UID))
                         return false;
 
         if (info->match & XT_OWNER_GID)
-                if ((filp->f_gid != info->gid) ^
-                    !!(info->invert & XT_OWNER_GID))
+                if ((filp->f_gid >= info->gid_min &&
+                    filp->f_gid <= info->gid_max) ^
+                    !(info->invert & XT_OWNER_GID))
                         return false;
 
         return true;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 6b178e1247b5..ff9fb6ba0c5c 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1344,6 +1344,22 @@ static void netlink_data_ready(struct sock *sk, int len)
  *      queueing.
  */
 
+static void __netlink_release(struct sock *sk)
+{
+        /*
+         * Last sock_put should drop referrence to sk->sk_net. It has already
+         * been dropped in netlink_kernel_create. Taking referrence to stopping
+         * namespace is not an option.
+         * Take referrence to a socket to remove it from netlink lookup table
+         * _alive_ and after that destroy it in the context of init_net.
+         */
+
+        sock_hold(sk);
+        sock_release(sk->sk_socket);
+        sk->sk_net = get_net(&init_net);
+        sock_put(sk);
+}
+
 struct sock *
 netlink_kernel_create(struct net *net, int unit, unsigned int groups,
                       void (*input)(struct sk_buff *skb),
@@ -1362,8 +1378,18 @@ netlink_kernel_create(struct net *net, int unit, unsigned int groups,
         if (sock_create_lite(PF_NETLINK, SOCK_DGRAM, unit, &sock))
                 return NULL;
 
-        if (__netlink_create(net, sock, cb_mutex, unit) < 0)
-                goto out_sock_release;
+        /*
+         * We have to just have a reference on the net from sk, but don't
+         * get_net it. Besides, we cannot get and then put the net here.
+         * So we create one inside init_net and the move it to net.
+         */
+
+        if (__netlink_create(&init_net, sock, cb_mutex, unit) < 0)
+                goto out_sock_release_nosk;
+
+        sk = sock->sk;
+        put_net(sk->sk_net);
+        sk->sk_net = net;
 
         if (groups < 32)
                 groups = 32;
@@ -1372,7 +1398,6 @@ netlink_kernel_create(struct net *net, int unit, unsigned int groups,
         if (!listeners)
                 goto out_sock_release;
 
-        sk = sock->sk;
         sk->sk_data_ready = netlink_data_ready;
         if (input)
                 nlk_sk(sk)->netlink_rcv = input;
@@ -1395,14 +1420,14 @@ netlink_kernel_create(struct net *net, int unit, unsigned int groups,
                 nl_table[unit].registered++;
         }
         netlink_table_ungrab();
-
-        /* Do not hold an extra referrence to a namespace as this socket is
-         * internal to a namespace and does not prevent it to stop. */
-        put_net(net);
         return sk;
 
 out_sock_release:
         kfree(listeners);
+        __netlink_release(sk);
+        return NULL;
+
+out_sock_release_nosk:
         sock_release(sock);
         return NULL;
 }
@@ -1415,18 +1440,7 @@ netlink_kernel_release(struct sock *sk)
         if (sk == NULL || sk->sk_socket == NULL)
                 return;
 
-        /*
-         * Last sock_put should drop referrence to sk->sk_net. It has already
-         * been dropped in netlink_kernel_create. Taking referrence to stopping
-         * namespace is not an option.
-         * Take referrence to a socket to remove it from netlink lookup table
-         * _alive_ and after that destroy it in the context of init_net.
-         */
-        sock_hold(sk);
-        sock_release(sk->sk_socket);
-
-        sk->sk_net = get_net(&init_net);
-        sock_put(sk);
+        __netlink_release(sk);
 }
 EXPORT_SYMBOL(netlink_kernel_release);
 
diff --git a/net/rfkill/rfkill-input.c b/net/rfkill/rfkill-input.c
index d1e9d68f8ba0..e4b051dbed61 100644
--- a/net/rfkill/rfkill-input.c
+++ b/net/rfkill/rfkill-input.c
@@ -84,6 +84,7 @@ static void rfkill_schedule_toggle(struct rfkill_task *task)
 static DEFINE_RFKILL_TASK(rfkill_wlan, RFKILL_TYPE_WLAN);
 static DEFINE_RFKILL_TASK(rfkill_bt, RFKILL_TYPE_BLUETOOTH);
 static DEFINE_RFKILL_TASK(rfkill_uwb, RFKILL_TYPE_UWB);
+static DEFINE_RFKILL_TASK(rfkill_wimax, RFKILL_TYPE_WIMAX);
 
 static void rfkill_event(struct input_handle *handle, unsigned int type,
                         unsigned int code, int down)
@@ -99,6 +100,9 @@ static void rfkill_event(struct input_handle *handle, unsigned int type,
                 case KEY_UWB:
                         rfkill_schedule_toggle(&rfkill_uwb);
                         break;
+                case KEY_WIMAX:
+                        rfkill_schedule_toggle(&rfkill_wimax);
+                        break;
                 default:
                         break;
                 }
@@ -159,6 +163,11 @@ static const struct input_device_id rfkill_ids[] = {
                 .evbit = { BIT_MASK(EV_KEY) },
                 .keybit = { [BIT_WORD(KEY_UWB)] = BIT_MASK(KEY_UWB) },
         },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(KEY_WIMAX)] = BIT_MASK(KEY_WIMAX) },
+        },
         { }
 };
 
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index d06d338812e9..6562f868e82f 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -126,6 +126,9 @@ static ssize_t rfkill_type_show(struct device *dev,
         case RFKILL_TYPE_UWB:
                 type = "ultrawideband";
                 break;
+        case RFKILL_TYPE_WIMAX:
+                type = "wimax";
+                break;
         default:
                 BUG();
         }
diff --git a/net/rxrpc/ar-call.c b/net/rxrpc/ar-call.c
index 3c04b00dab74..d9231245a79a 100644
--- a/net/rxrpc/ar-call.c
+++ b/net/rxrpc/ar-call.c
@@ -15,7 +15,7 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
-const char *rxrpc_call_states[] = {
+const char *const rxrpc_call_states[] = {
         [RXRPC_CALL_CLIENT_SEND_REQUEST]        = "ClSndReq",
         [RXRPC_CALL_CLIENT_AWAIT_REPLY]         = "ClAwtRpl",
         [RXRPC_CALL_CLIENT_RECV_REPLY]          = "ClRcvRpl",
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 58aaf892238e..1aaa2e804b0d 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -565,9 +565,9 @@ extern void __exit rxrpc_destroy_all_peers(void);
 /*
  * ar-proc.c
  */
-extern const char *rxrpc_call_states[];
-extern struct file_operations rxrpc_call_seq_fops;
-extern struct file_operations rxrpc_connection_seq_fops;
+extern const char *const rxrpc_call_states[];
+extern const struct file_operations rxrpc_call_seq_fops;
+extern const struct file_operations rxrpc_connection_seq_fops;
 
 /*
  * ar-recvmsg.c
diff --git a/net/rxrpc/ar-proc.c b/net/rxrpc/ar-proc.c
index 2e83ce325d15..83eda247fe48 100644
--- a/net/rxrpc/ar-proc.c
+++ b/net/rxrpc/ar-proc.c
@@ -14,7 +14,7 @@
 #include <net/af_rxrpc.h>
 #include "ar-internal.h"
 
-static const char *rxrpc_conn_states[] = {
+static const char *const rxrpc_conn_states[] = {
         [RXRPC_CONN_UNUSED]             = "Unused  ",
         [RXRPC_CONN_CLIENT]             = "Client  ",
         [RXRPC_CONN_SERVER_UNSECURED]   = "SvUnsec ",
@@ -98,7 +98,7 @@ static int rxrpc_call_seq_open(struct inode *inode, struct file *file)
         return seq_open(file, &rxrpc_call_seq_ops);
 }
 
-struct file_operations rxrpc_call_seq_fops = {
+const struct file_operations rxrpc_call_seq_fops = {
         .owner          = THIS_MODULE,
         .open           = rxrpc_call_seq_open,
         .read           = seq_read,
@@ -183,7 +183,7 @@ static int rxrpc_connection_seq_open(struct inode *inode, struct file *file)
         return seq_open(file, &rxrpc_connection_seq_ops);
 }
 
-struct file_operations rxrpc_connection_seq_fops = {
+const struct file_operations rxrpc_connection_seq_fops = {
         .owner          = THIS_MODULE,
         .open           = rxrpc_connection_seq_open,
         .read           = seq_read,
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 87af7c913d81..82adfe6447d7 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -198,7 +198,7 @@ config NET_SCH_NETEM
 
 config NET_SCH_INGRESS
         tristate "Ingress Qdisc"
-        depends on NET_CLS_ACT || NETFILTER
+        depends on NET_CLS_ACT
         ---help---
           Say Y here if you want to use classifiers for incoming packets.
           If unsure, say Y.
@@ -307,6 +307,17 @@ config NET_CLS_RSVP6
           To compile this code as a module, choose M here: the
           module will be called cls_rsvp6.
 
+config NET_CLS_FLOW
+        tristate "Flow classifier"
+        select NET_CLS
+        ---help---
+          If you say Y here, you will be able to classify packets based on
+          a configurable combination of packet keys. This is mostly useful
+          in combination with SFQ.
+
+          To compile this code as a module, choose M here: the
+          module will be called cls_flow.
+
 config NET_EMATCH
         bool "Extended Matches"
         select NET_CLS
diff --git a/net/sched/Makefile b/net/sched/Makefile
index 81ecbe8e7dce..1d2b0f7df848 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -35,6 +35,7 @@ obj-$(CONFIG_NET_CLS_RSVP)	+= cls_rsvp.o
 obj-$(CONFIG_NET_CLS_TCINDEX)   += cls_tcindex.o
 obj-$(CONFIG_NET_CLS_RSVP6)     += cls_rsvp6.o
 obj-$(CONFIG_NET_CLS_BASIC)     += cls_basic.o
+obj-$(CONFIG_NET_CLS_FLOW)      += cls_flow.o
 obj-$(CONFIG_NET_EMATCH)        += ematch.o
 obj-$(CONFIG_NET_EMATCH_CMP)    += em_cmp.o
 obj-$(CONFIG_NET_EMATCH_NBYTE)  += em_nbyte.o
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 3377ca0d0a0c..0fbedcabf111 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -482,7 +482,7 @@ EXPORT_SYMBOL(tcf_exts_destroy);
 
 int tcf_exts_validate(struct tcf_proto *tp, struct nlattr **tb,
                   struct nlattr *rate_tlv, struct tcf_exts *exts,
-                  struct tcf_ext_map *map)
+                  const struct tcf_ext_map *map)
 {
         memset(exts, 0, sizeof(*exts));
 
@@ -535,7 +535,7 @@ void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst,
 EXPORT_SYMBOL(tcf_exts_change);
 
 int tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts,
-              struct tcf_ext_map *map)
+                  const struct tcf_ext_map *map)
 {
 #ifdef CONFIG_NET_CLS_ACT
         if (map->action && exts->action) {
@@ -571,7 +571,7 @@ EXPORT_SYMBOL(tcf_exts_dump);
 
 
 int tcf_exts_dump_stats(struct sk_buff *skb, struct tcf_exts *exts,
-                        struct tcf_ext_map *map)
+                        const struct tcf_ext_map *map)
 {
 #ifdef CONFIG_NET_CLS_ACT
         if (exts->action)
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index bfb4342ea88c..956915c217d6 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -35,7 +35,7 @@ struct basic_filter
         struct list_head        link;
 };
 
-static struct tcf_ext_map basic_ext_map = {
+static const struct tcf_ext_map basic_ext_map = {
         .action = TCA_BASIC_ACT,
         .police = TCA_BASIC_POLICE
 };
diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c
new file mode 100644
index 000000000000..5a7f6a3060fc
--- /dev/null
+++ b/net/sched/cls_flow.c
@@ -0,0 +1,660 @@
+/*
+ * net/sched/cls_flow.c         Generic flow classifier
+ *
+ * Copyright (c) 2007, 2008 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/list.h>
+#include <linux/jhash.h>
+#include <linux/random.h>
+#include <linux/pkt_cls.h>
+#include <linux/skbuff.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+
+#include <net/pkt_cls.h>
+#include <net/ip.h>
+#include <net/route.h>
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#include <net/netfilter/nf_conntrack.h>
+#endif
+
+struct flow_head {
+        struct list_head        filters;
+};
+
+struct flow_filter {
+        struct list_head        list;
+        struct tcf_exts         exts;
+        struct tcf_ematch_tree  ematches;
+        u32                     handle;
+
+        u32                     nkeys;
+        u32                     keymask;
+        u32                     mode;
+        u32                     mask;
+        u32                     xor;
+        u32                     rshift;
+        u32                     addend;
+        u32                     divisor;
+        u32                     baseclass;
+};
+
+static u32 flow_hashrnd __read_mostly;
+static int flow_hashrnd_initted __read_mostly;
+
+static const struct tcf_ext_map flow_ext_map = {
+        .action = TCA_FLOW_ACT,
+        .police = TCA_FLOW_POLICE,
+};
+
+static inline u32 addr_fold(void *addr)
+{
+        unsigned long a = (unsigned long)addr;
+
+        return (a & 0xFFFFFFFF) ^ (BITS_PER_LONG > 32 ? a >> 32 : 0);
+}
+
+static u32 flow_get_src(const struct sk_buff *skb)
+{
+        switch (skb->protocol) {
+        case __constant_htons(ETH_P_IP):
+                return ntohl(ip_hdr(skb)->saddr);
+        case __constant_htons(ETH_P_IPV6):
+                return ntohl(ipv6_hdr(skb)->saddr.s6_addr32[3]);
+        default:
+                return addr_fold(skb->sk);
+        }
+}
+
+static u32 flow_get_dst(const struct sk_buff *skb)
+{
+        switch (skb->protocol) {
+        case __constant_htons(ETH_P_IP):
+                return ntohl(ip_hdr(skb)->daddr);
+        case __constant_htons(ETH_P_IPV6):
+                return ntohl(ipv6_hdr(skb)->daddr.s6_addr32[3]);
+        default:
+                return addr_fold(skb->dst) ^ (__force u16)skb->protocol;
+        }
+}
+
+static u32 flow_get_proto(const struct sk_buff *skb)
+{
+        switch (skb->protocol) {
+        case __constant_htons(ETH_P_IP):
+                return ip_hdr(skb)->protocol;
+        case __constant_htons(ETH_P_IPV6):
+                return ipv6_hdr(skb)->nexthdr;
+        default:
+                return 0;
+        }
+}
+
+static int has_ports(u8 protocol)
+{
+        switch (protocol) {
+        case IPPROTO_TCP:
+        case IPPROTO_UDP:
+        case IPPROTO_UDPLITE:
+        case IPPROTO_SCTP:
+        case IPPROTO_DCCP:
+        case IPPROTO_ESP:
+                return 1;
+        default:
+                return 0;
+        }
+}
+
+static u32 flow_get_proto_src(const struct sk_buff *skb)
+{
+        u32 res = 0;
+
+        switch (skb->protocol) {
+        case __constant_htons(ETH_P_IP): {
+                struct iphdr *iph = ip_hdr(skb);
+
+                if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
+                    has_ports(iph->protocol))
+                        res = ntohs(*(__be16 *)((void *)iph + iph->ihl * 4));
+                break;
+        }
+        case __constant_htons(ETH_P_IPV6): {
+                struct ipv6hdr *iph = ipv6_hdr(skb);
+
+                if (has_ports(iph->nexthdr))
+                        res = ntohs(*(__be16 *)&iph[1]);
+                break;
+        }
+        default:
+                res = addr_fold(skb->sk);
+        }
+
+        return res;
+}
+
+static u32 flow_get_proto_dst(const struct sk_buff *skb)
+{
+        u32 res = 0;
+
+        switch (skb->protocol) {
+        case __constant_htons(ETH_P_IP): {
+                struct iphdr *iph = ip_hdr(skb);
+
+                if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
+                    has_ports(iph->protocol))
+                        res = ntohs(*(__be16 *)((void *)iph + iph->ihl * 4 + 2));
+                break;
+        }
+        case __constant_htons(ETH_P_IPV6): {
+                struct ipv6hdr *iph = ipv6_hdr(skb);
+
+                if (has_ports(iph->nexthdr))
+                        res = ntohs(*(__be16 *)((void *)&iph[1] + 2));
+                break;
+        }
+        default:
+                res = addr_fold(skb->dst) ^ (__force u16)skb->protocol;
+        }
+
+        return res;
+}
+
+static u32 flow_get_iif(const struct sk_buff *skb)
+{
+        return skb->iif;
+}
+
+static u32 flow_get_priority(const struct sk_buff *skb)
+{
+        return skb->priority;
+}
+
+static u32 flow_get_mark(const struct sk_buff *skb)
+{
+        return skb->mark;
+}
+
+static u32 flow_get_nfct(const struct sk_buff *skb)
+{
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+        return addr_fold(skb->nfct);
+#else
+        return 0;
+#endif
+}
+
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#define CTTUPLE(skb, member)                                            \
+({                                                                      \
+        enum ip_conntrack_info ctinfo;                                  \
+        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);                   \
+        if (ct == NULL)                                                 \
+                goto fallback;                                          \
+        ct->tuplehash[CTINFO2DIR(ctinfo)].tuple.member;                 \
+})
+#else
+#define CTTUPLE(skb, member)                                            \
+({                                                                      \
+        goto fallback;                                                  \
+        0;                                                              \
+})
+#endif
+
+static u32 flow_get_nfct_src(const struct sk_buff *skb)
+{
+        switch (skb->protocol) {
+        case __constant_htons(ETH_P_IP):
+                return ntohl(CTTUPLE(skb, src.u3.ip));
+        case __constant_htons(ETH_P_IPV6):
+                return ntohl(CTTUPLE(skb, src.u3.ip6[3]));
+        }
+fallback:
+        return flow_get_src(skb);
+}
+
+static u32 flow_get_nfct_dst(const struct sk_buff *skb)
+{
+        switch (skb->protocol) {
+        case __constant_htons(ETH_P_IP):
+                return ntohl(CTTUPLE(skb, dst.u3.ip));
+        case __constant_htons(ETH_P_IPV6):
+                return ntohl(CTTUPLE(skb, dst.u3.ip6[3]));
+        }
+fallback:
+        return flow_get_dst(skb);
+}
+
+static u32 flow_get_nfct_proto_src(const struct sk_buff *skb)
+{
+        return ntohs(CTTUPLE(skb, src.u.all));
+fallback:
+        return flow_get_proto_src(skb);
+}
+
+static u32 flow_get_nfct_proto_dst(const struct sk_buff *skb)
+{
+        return ntohs(CTTUPLE(skb, dst.u.all));
+fallback:
+        return flow_get_proto_dst(skb);
+}
+
+static u32 flow_get_rtclassid(const struct sk_buff *skb)
+{
+#ifdef CONFIG_NET_CLS_ROUTE
+        if (skb->dst)
+                return skb->dst->tclassid;
+#endif
+        return 0;
+}
+
+static u32 flow_get_skuid(const struct sk_buff *skb)
+{
+        if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file)
+                return skb->sk->sk_socket->file->f_uid;
+        return 0;
+}
+
+static u32 flow_get_skgid(const struct sk_buff *skb)
+{
+        if (skb->sk && skb->sk->sk_socket && skb->sk->sk_socket->file)
+                return skb->sk->sk_socket->file->f_gid;
+        return 0;
+}
+
+static u32 flow_key_get(const struct sk_buff *skb, int key)
+{
+        switch (key) {
+        case FLOW_KEY_SRC:
+                return flow_get_src(skb);
+        case FLOW_KEY_DST:
+                return flow_get_dst(skb);
+        case FLOW_KEY_PROTO:
+                return flow_get_proto(skb);
+        case FLOW_KEY_PROTO_SRC:
+                return flow_get_proto_src(skb);
+        case FLOW_KEY_PROTO_DST:
+                return flow_get_proto_dst(skb);
+        case FLOW_KEY_IIF:
+                return flow_get_iif(skb);
+        case FLOW_KEY_PRIORITY:
+                return flow_get_priority(skb);
+        case FLOW_KEY_MARK:
+                return flow_get_mark(skb);
+        case FLOW_KEY_NFCT:
+                return flow_get_nfct(skb);
+        case FLOW_KEY_NFCT_SRC:
+                return flow_get_nfct_src(skb);
+        case FLOW_KEY_NFCT_DST:
+                return flow_get_nfct_dst(skb);
+        case FLOW_KEY_NFCT_PROTO_SRC:
+                return flow_get_nfct_proto_src(skb);
+        case FLOW_KEY_NFCT_PROTO_DST:
+                return flow_get_nfct_proto_dst(skb);
+        case FLOW_KEY_RTCLASSID:
+                return flow_get_rtclassid(skb);
+        case FLOW_KEY_SKUID:
+                return flow_get_skuid(skb);
+        case FLOW_KEY_SKGID:
+                return flow_get_skgid(skb);
+        default:
+                WARN_ON(1);
+                return 0;
+        }
+}
+
+static int flow_classify(struct sk_buff *skb, struct tcf_proto *tp,
+                         struct tcf_result *res)
+{
+        struct flow_head *head = tp->root;
+        struct flow_filter *f;
+        u32 keymask;
+        u32 classid;
+        unsigned int n, key;
+        int r;
+
+        list_for_each_entry(f, &head->filters, list) {
+                u32 keys[f->nkeys];
+
+                if (!tcf_em_tree_match(skb, &f->ematches, NULL))
+                        continue;
+
+                keymask = f->keymask;
+
+                for (n = 0; n < f->nkeys; n++) {
+                        key = ffs(keymask) - 1;
+                        keymask &= ~(1 << key);
+                        keys[n] = flow_key_get(skb, key);
+                }
+
+                if (f->mode == FLOW_MODE_HASH)
+                        classid = jhash2(keys, f->nkeys, flow_hashrnd);
+                else {
+                        classid = keys[0];
+                        classid = (classid & f->mask) ^ f->xor;
+                        classid = (classid >> f->rshift) + f->addend;
+                }
+
+                if (f->divisor)
+                        classid %= f->divisor;
+
+                res->class   = 0;
+                res->classid = TC_H_MAKE(f->baseclass, f->baseclass + classid);
+
+                r = tcf_exts_exec(skb, &f->exts, res);
+                if (r < 0)
+                        continue;
+                return r;
+        }
+        return -1;
+}
+
+static const struct nla_policy flow_policy[TCA_FLOW_MAX + 1] = {
+        [TCA_FLOW_KEYS]         = { .type = NLA_U32 },
+        [TCA_FLOW_MODE]         = { .type = NLA_U32 },
+        [TCA_FLOW_BASECLASS]    = { .type = NLA_U32 },
+        [TCA_FLOW_RSHIFT]       = { .type = NLA_U32 },
+        [TCA_FLOW_ADDEND]       = { .type = NLA_U32 },
+        [TCA_FLOW_MASK]         = { .type = NLA_U32 },
+        [TCA_FLOW_XOR]          = { .type = NLA_U32 },
+        [TCA_FLOW_DIVISOR]      = { .type = NLA_U32 },
+        [TCA_FLOW_ACT]          = { .type = NLA_NESTED },
+        [TCA_FLOW_POLICE]       = { .type = NLA_NESTED },
+        [TCA_FLOW_EMATCHES]     = { .type = NLA_NESTED },
+};
+
+static int flow_change(struct tcf_proto *tp, unsigned long base,
+                       u32 handle, struct nlattr **tca,
+                       unsigned long *arg)
+{
+        struct flow_head *head = tp->root;
+        struct flow_filter *f;
+        struct nlattr *opt = tca[TCA_OPTIONS];
+        struct nlattr *tb[TCA_FLOW_MAX + 1];
+        struct tcf_exts e;
+        struct tcf_ematch_tree t;
+        unsigned int nkeys = 0;
+        u32 baseclass = 0;
+        u32 keymask = 0;
+        u32 mode;
+        int err;
+
+        if (opt == NULL)
+                return -EINVAL;
+
+        err = nla_parse_nested(tb, TCA_FLOW_MAX, opt, flow_policy);
+        if (err < 0)
+                return err;
+
+        if (tb[TCA_FLOW_BASECLASS]) {
+                baseclass = nla_get_u32(tb[TCA_FLOW_BASECLASS]);
+                if (TC_H_MIN(baseclass) == 0)
+                        return -EINVAL;
+        }
+
+        if (tb[TCA_FLOW_KEYS]) {
+                keymask = nla_get_u32(tb[TCA_FLOW_KEYS]);
+                if (fls(keymask) - 1 > FLOW_KEY_MAX)
+                        return -EOPNOTSUPP;
+
+                nkeys = hweight32(keymask);
+                if (nkeys == 0)
+                        return -EINVAL;
+        }
+
+        err = tcf_exts_validate(tp, tb, tca[TCA_RATE], &e, &flow_ext_map);
+        if (err < 0)
+                return err;
+
+        err = tcf_em_tree_validate(tp, tb[TCA_FLOW_EMATCHES], &t);
+        if (err < 0)
+                goto err1;
+
+        f = (struct flow_filter *)*arg;
+        if (f != NULL) {
+                err = -EINVAL;
+                if (f->handle != handle && handle)
+                        goto err2;
+
+                mode = f->mode;
+                if (tb[TCA_FLOW_MODE])
+                        mode = nla_get_u32(tb[TCA_FLOW_MODE]);
+                if (mode != FLOW_MODE_HASH && nkeys > 1)
+                        goto err2;
+        } else {
+                err = -EINVAL;
+                if (!handle)
+                        goto err2;
+                if (!tb[TCA_FLOW_KEYS])
+                        goto err2;
+
+                mode = FLOW_MODE_MAP;
+                if (tb[TCA_FLOW_MODE])
+                        mode = nla_get_u32(tb[TCA_FLOW_MODE]);
+                if (mode != FLOW_MODE_HASH && nkeys > 1)
+                        goto err2;
+
+                if (TC_H_MAJ(baseclass) == 0)
+                        baseclass = TC_H_MAKE(tp->q->handle, baseclass);
+                if (TC_H_MIN(baseclass) == 0)
+                        baseclass = TC_H_MAKE(baseclass, 1);
+
+                err = -ENOBUFS;
+                f = kzalloc(sizeof(*f), GFP_KERNEL);
+                if (f == NULL)
+                        goto err2;
+
+                f->handle = handle;
+                f->mask   = ~0U;
+        }
+
+        tcf_exts_change(tp, &f->exts, &e);
+        tcf_em_tree_change(tp, &f->ematches, &t);
+
+        tcf_tree_lock(tp);
+
+        if (tb[TCA_FLOW_KEYS]) {
+                f->keymask = keymask;
+                f->nkeys   = nkeys;
+        }
+
+        f->mode = mode;
+
+        if (tb[TCA_FLOW_MASK])
+                f->mask = nla_get_u32(tb[TCA_FLOW_MASK]);
+        if (tb[TCA_FLOW_XOR])
+                f->xor = nla_get_u32(tb[TCA_FLOW_XOR]);
+        if (tb[TCA_FLOW_RSHIFT])
+                f->rshift = nla_get_u32(tb[TCA_FLOW_RSHIFT]);
+        if (tb[TCA_FLOW_ADDEND])
+                f->addend = nla_get_u32(tb[TCA_FLOW_ADDEND]);
+
+        if (tb[TCA_FLOW_DIVISOR])
+                f->divisor = nla_get_u32(tb[TCA_FLOW_DIVISOR]);
+        if (baseclass)
+                f->baseclass = baseclass;
+
+        if (*arg == 0)
+                list_add_tail(&f->list, &head->filters);
+
+        tcf_tree_unlock(tp);
+
+        *arg = (unsigned long)f;
+        return 0;
+
+err2:
+        tcf_em_tree_destroy(tp, &t);
+err1:
+        tcf_exts_destroy(tp, &e);
+        return err;
+}
+
+static void flow_destroy_filter(struct tcf_proto *tp, struct flow_filter *f)
+{
+        tcf_exts_destroy(tp, &f->exts);
+        tcf_em_tree_destroy(tp, &f->ematches);
+        kfree(f);
+}
+
+static int flow_delete(struct tcf_proto *tp, unsigned long arg)
+{
+        struct flow_filter *f = (struct flow_filter *)arg;
+
+        tcf_tree_lock(tp);
+        list_del(&f->list);
+        tcf_tree_unlock(tp);
+        flow_destroy_filter(tp, f);
+        return 0;
+}
+
+static int flow_init(struct tcf_proto *tp)
+{
+        struct flow_head *head;
+
+        if (!flow_hashrnd_initted) {
+                get_random_bytes(&flow_hashrnd, 4);
+                flow_hashrnd_initted = 1;
+        }
+
+        head = kzalloc(sizeof(*head), GFP_KERNEL);
+        if (head == NULL)
+                return -ENOBUFS;
+        INIT_LIST_HEAD(&head->filters);
+        tp->root = head;
+        return 0;
+}
+
+static void flow_destroy(struct tcf_proto *tp)
+{
+        struct flow_head *head = tp->root;
+        struct flow_filter *f, *next;
+
+        list_for_each_entry_safe(f, next, &head->filters, list) {
+                list_del(&f->list);
+                flow_destroy_filter(tp, f);
+        }
+        kfree(head);
+}
+
+static unsigned long flow_get(struct tcf_proto *tp, u32 handle)
+{
+        struct flow_head *head = tp->root;
+        struct flow_filter *f;
+
+        list_for_each_entry(f, &head->filters, list)
+                if (f->handle == handle)
+                        return (unsigned long)f;
+        return 0;
+}
+
+static void flow_put(struct tcf_proto *tp, unsigned long f)
+{
+        return;
+}
+
+static int flow_dump(struct tcf_proto *tp, unsigned long fh,
+                     struct sk_buff *skb, struct tcmsg *t)
+{
+        struct flow_filter *f = (struct flow_filter *)fh;
+        struct nlattr *nest;
+
+        if (f == NULL)
+                return skb->len;
+
+        t->tcm_handle = f->handle;
+
+        nest = nla_nest_start(skb, TCA_OPTIONS);
+        if (nest == NULL)
+                goto nla_put_failure;
+
+        NLA_PUT_U32(skb, TCA_FLOW_KEYS, f->keymask);
+        NLA_PUT_U32(skb, TCA_FLOW_MODE, f->mode);
+
+        if (f->mask != ~0 || f->xor != 0) {
+                NLA_PUT_U32(skb, TCA_FLOW_MASK, f->mask);
+                NLA_PUT_U32(skb, TCA_FLOW_XOR, f->xor);
+        }
+        if (f->rshift)
+                NLA_PUT_U32(skb, TCA_FLOW_RSHIFT, f->rshift);
+        if (f->addend)
+                NLA_PUT_U32(skb, TCA_FLOW_ADDEND, f->addend);
+
+        if (f->divisor)
+                NLA_PUT_U32(skb, TCA_FLOW_DIVISOR, f->divisor);
+        if (f->baseclass)
+                NLA_PUT_U32(skb, TCA_FLOW_BASECLASS, f->baseclass);
+
+        if (tcf_exts_dump(skb, &f->exts, &flow_ext_map) < 0)
+                goto nla_put_failure;
+
+        if (f->ematches.hdr.nmatches &&
+            tcf_em_tree_dump(skb, &f->ematches, TCA_FLOW_EMATCHES) < 0)
+                goto nla_put_failure;
+
+        nla_nest_end(skb, nest);
+
+        if (tcf_exts_dump_stats(skb, &f->exts, &flow_ext_map) < 0)
+                goto nla_put_failure;
+
+        return skb->len;
+
+nla_put_failure:
+        nlmsg_trim(skb, nest);
+        return -1;
+}
+
+static void flow_walk(struct tcf_proto *tp, struct tcf_walker *arg)
+{
+        struct flow_head *head = tp->root;
+        struct flow_filter *f;
+
+        list_for_each_entry(f, &head->filters, list) {
+                if (arg->count < arg->skip)
+                        goto skip;
+                if (arg->fn(tp, (unsigned long)f, arg) < 0) {
+                        arg->stop = 1;
+                        break;
+                }
+skip:
+                arg->count++;
+        }
+}
+
+static struct tcf_proto_ops cls_flow_ops __read_mostly = {
+        .kind           = "flow",
+        .classify       = flow_classify,
+        .init           = flow_init,
+        .destroy        = flow_destroy,
+        .change         = flow_change,
+        .delete         = flow_delete,
+        .get            = flow_get,
+        .put            = flow_put,
+        .dump           = flow_dump,
+        .walk           = flow_walk,
+        .owner          = THIS_MODULE,
+};
+
+static int __init cls_flow_init(void)
+{
+        return register_tcf_proto_ops(&cls_flow_ops);
+}
+
+static void __exit cls_flow_exit(void)
+{
+        unregister_tcf_proto_ops(&cls_flow_ops);
+}
+
+module_init(cls_flow_init);
+module_exit(cls_flow_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
+MODULE_DESCRIPTION("TC flow classifier");
diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c
index 436a6e7c438e..b0f90e593af0 100644
--- a/net/sched/cls_fw.c
+++ b/net/sched/cls_fw.c
@@ -47,7 +47,7 @@ struct fw_filter
         struct tcf_exts         exts;
 };
 
-static struct tcf_ext_map fw_ext_map = {
+static const struct tcf_ext_map fw_ext_map = {
         .action = TCA_FW_ACT,
         .police = TCA_FW_POLICE
 };
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index f7e7d3955d28..784dcb870b98 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -62,7 +62,7 @@ struct route4_filter
 
 #define ROUTE4_FAILURE ((struct route4_filter*)(-1L))
 
-static struct tcf_ext_map route_ext_map = {
+static const struct tcf_ext_map route_ext_map = {
         .police = TCA_ROUTE4_POLICE,
         .action = TCA_ROUTE4_ACT
 };
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index ee60b2d1705d..7a7bff5ded24 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -55,7 +55,7 @@ struct tcindex_data {
         int fall_through;       /* 0: only classify if explicit match */
 };
 
-static struct tcf_ext_map tcindex_ext_map = {
+static const struct tcf_ext_map tcindex_ext_map = {
         .police = TCA_TCINDEX_POLICE,
         .action = TCA_TCINDEX_ACT
 };
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index e8a775689123..b18fa95ef248 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -82,7 +82,7 @@ struct tc_u_common
         u32                     hgenerator;
 };
 
-static struct tcf_ext_map u32_ext_map = {
+static const struct tcf_ext_map u32_ext_map = {
         .action = TCA_U32_ACT,
         .police = TCA_U32_POLICE
 };
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 3f72d528273c..274b1ddb160c 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -12,18 +12,10 @@
 #include <linux/list.h>
 #include <linux/skbuff.h>
 #include <linux/rtnetlink.h>
-#include <linux/netfilter_ipv4.h>
-#include <linux/netfilter_ipv6.h>
-#include <linux/netfilter.h>
 #include <net/netlink.h>
 #include <net/pkt_sched.h>
 
 
-/* Thanks to Doron Oz for this hack */
-#if !defined(CONFIG_NET_CLS_ACT) && defined(CONFIG_NETFILTER)
-static int nf_registered;
-#endif
-
 struct ingress_qdisc_data {
         struct tcf_proto        *filter_list;
 };
@@ -84,11 +76,6 @@ static int ingress_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         result = tc_classify(skb, p->filter_list, &res);
 
-        /*
-         * Unlike normal "enqueue" functions, ingress_enqueue returns a
-         * firewall FW_* code.
-         */
-#ifdef CONFIG_NET_CLS_ACT
         sch->bstats.packets++;
         sch->bstats.bytes += skb->len;
         switch (result) {
@@ -107,71 +94,10 @@ static int ingress_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 result = TC_ACT_OK;
                 break;
         }
-#else
-        result = NF_ACCEPT;
-        sch->bstats.packets++;
-        sch->bstats.bytes += skb->len;
-#endif
 
         return result;
 }
 
-#if !defined(CONFIG_NET_CLS_ACT) && defined(CONFIG_NETFILTER)
-static unsigned int ing_hook(unsigned int hook, struct sk_buff *skb,
-                             const struct net_device *indev,
-                             const struct net_device *outdev,
-                             int (*okfn)(struct sk_buff *))
-{
-
-        struct Qdisc *q;
-        struct net_device *dev = skb->dev;
-        int fwres = NF_ACCEPT;
-
-        if (dev->qdisc_ingress) {
-                spin_lock(&dev->ingress_lock);
-                if ((q = dev->qdisc_ingress) != NULL)
-                        fwres = q->enqueue(skb, q);
-                spin_unlock(&dev->ingress_lock);
-        }
-
-        return fwres;
-}
-
-/* after ipt_filter */
-static struct nf_hook_ops ing_ops[] __read_mostly = {
-        {
-                .hook           = ing_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET,
-                .hooknum        = NF_INET_PRE_ROUTING,
-                .priority       = NF_IP_PRI_FILTER + 1,
-        },
-        {
-                .hook           = ing_hook,
-                .owner          = THIS_MODULE,
-                .pf             = PF_INET6,
-                .hooknum        = NF_INET_PRE_ROUTING,
-                .priority       = NF_IP6_PRI_FILTER + 1,
-        },
-};
-#endif
-
-static int ingress_init(struct Qdisc *sch, struct nlattr *opt)
-{
-#if !defined(CONFIG_NET_CLS_ACT) && defined(CONFIG_NETFILTER)
-        printk("Ingress scheduler: Classifier actions prefered over netfilter\n");
-
-        if (!nf_registered) {
-                if (nf_register_hooks(ing_ops, ARRAY_SIZE(ing_ops)) < 0) {
-                        printk("ingress qdisc registration error \n");
-                        return -EINVAL;
-                }
-                nf_registered++;
-        }
-#endif
-        return 0;
-}
-
 /* ------------------------------------------------------------- */
 
 static void ingress_destroy(struct Qdisc *sch)
@@ -213,7 +139,6 @@ static struct Qdisc_ops ingress_qdisc_ops __read_mostly = {
         .id             =       "ingress",
         .priv_size      =       sizeof(struct ingress_qdisc_data),
         .enqueue        =       ingress_enqueue,
-        .init           =       ingress_init,
         .destroy        =       ingress_destroy,
         .dump           =       ingress_dump,
         .owner          =       THIS_MODULE,
@@ -227,10 +152,6 @@ static int __init ingress_module_init(void)
 static void __exit ingress_module_exit(void)
 {
         unregister_qdisc(&ingress_qdisc_ops);
-#if !defined(CONFIG_NET_CLS_ACT) && defined(CONFIG_NETFILTER)
-        if (nf_registered)
-                nf_unregister_hooks(ing_ops, ARRAY_SIZE(ing_ops));
-#endif
 }
 
 module_init(ingress_module_init)
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 91af539ab6e6..a20e2ef7704b 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -95,6 +95,7 @@ struct sfq_sched_data
         int             limit;
 
 /* Variables */
+        struct tcf_proto *filter_list;
         struct timer_list perturb_timer;
         u32             perturbation;
         sfq_index       tail;           /* Index of current slot in round */
@@ -155,6 +156,39 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
         return sfq_fold_hash(q, h, h2);
 }
 
+static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,
+                                 int *qerr)
+{
+        struct sfq_sched_data *q = qdisc_priv(sch);
+        struct tcf_result res;
+        int result;
+
+        if (TC_H_MAJ(skb->priority) == sch->handle &&
+            TC_H_MIN(skb->priority) > 0 &&
+            TC_H_MIN(skb->priority) <= SFQ_HASH_DIVISOR)
+                return TC_H_MIN(skb->priority);
+
+        if (!q->filter_list)
+                return sfq_hash(q, skb) + 1;
+
+        *qerr = NET_XMIT_BYPASS;
+        result = tc_classify(skb, q->filter_list, &res);
+        if (result >= 0) {
+#ifdef CONFIG_NET_CLS_ACT
+                switch (result) {
+                case TC_ACT_STOLEN:
+                case TC_ACT_QUEUED:
+                        *qerr = NET_XMIT_SUCCESS;
+                case TC_ACT_SHOT:
+                        return 0;
+                }
+#endif
+                if (TC_H_MIN(res.classid) <= SFQ_HASH_DIVISOR)
+                        return TC_H_MIN(res.classid);
+        }
+        return 0;
+}
+
 static inline void sfq_link(struct sfq_sched_data *q, sfq_index x)
 {
         sfq_index p, n;
@@ -245,8 +279,18 @@ static int
 sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct sfq_sched_data *q = qdisc_priv(sch);
-        unsigned hash = sfq_hash(q, skb);
+        unsigned int hash;
         sfq_index x;
+        int ret;
+
+        hash = sfq_classify(skb, sch, &ret);
+        if (hash == 0) {
+                if (ret == NET_XMIT_BYPASS)
+                        sch->qstats.drops++;
+                kfree_skb(skb);
+                return ret;
+        }
+        hash--;
 
         x = q->ht[hash];
         if (x == SFQ_DEPTH) {
@@ -289,8 +333,18 @@ static int
 sfq_requeue(struct sk_buff *skb, struct Qdisc *sch)
 {
         struct sfq_sched_data *q = qdisc_priv(sch);
-        unsigned hash = sfq_hash(q, skb);
+        unsigned int hash;
         sfq_index x;
+        int ret;
+
+        hash = sfq_classify(skb, sch, &ret);
+        if (hash == 0) {
+                if (ret == NET_XMIT_BYPASS)
+                        sch->qstats.drops++;
+                kfree_skb(skb);
+                return ret;
+        }
+        hash--;
 
         x = q->ht[hash];
         if (x == SFQ_DEPTH) {
@@ -465,6 +519,8 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt)
 static void sfq_destroy(struct Qdisc *sch)
 {
         struct sfq_sched_data *q = qdisc_priv(sch);
+
+        tcf_destroy_chain(q->filter_list);
         del_timer(&q->perturb_timer);
 }
 
@@ -490,9 +546,79 @@ nla_put_failure:
         return -1;
 }
 
+static int sfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
+                            struct nlattr **tca, unsigned long *arg)
+{
+        return -EOPNOTSUPP;
+}
+
+static unsigned long sfq_get(struct Qdisc *sch, u32 classid)
+{
+        return 0;
+}
+
+static struct tcf_proto **sfq_find_tcf(struct Qdisc *sch, unsigned long cl)
+{
+        struct sfq_sched_data *q = qdisc_priv(sch);
+
+        if (cl)
+                return NULL;
+        return &q->filter_list;
+}
+
+static int sfq_dump_class(struct Qdisc *sch, unsigned long cl,
+                          struct sk_buff *skb, struct tcmsg *tcm)
+{
+        tcm->tcm_handle |= TC_H_MIN(cl);
+        return 0;
+}
+
+static int sfq_dump_class_stats(struct Qdisc *sch, unsigned long cl,
+                                struct gnet_dump *d)
+{
+        struct sfq_sched_data *q = qdisc_priv(sch);
+        sfq_index idx = q->ht[cl-1];
+        struct gnet_stats_queue qs = { .qlen = q->qs[idx].qlen };
+        struct tc_sfq_xstats xstats = { .allot = q->allot[idx] };
+
+        if (gnet_stats_copy_queue(d, &qs) < 0)
+                return -1;
+        return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
+}
+
+static void sfq_walk(struct Qdisc *sch, struct qdisc_walker *arg)
+{
+        struct sfq_sched_data *q = qdisc_priv(sch);
+        unsigned int i;
+
+        if (arg->stop)
+                return;
+
+        for (i = 0; i < SFQ_HASH_DIVISOR; i++) {
+                if (q->ht[i] == SFQ_DEPTH ||
+                    arg->count < arg->skip) {
+                        arg->count++;
+                        continue;
+                }
+                if (arg->fn(sch, i + 1, arg) < 0) {
+                        arg->stop = 1;
+                        break;
+                }
+                arg->count++;
+        }
+}
+
+static const struct Qdisc_class_ops sfq_class_ops = {
+        .get            =       sfq_get,
+        .change         =       sfq_change_class,
+        .tcf_chain      =       sfq_find_tcf,
+        .dump           =       sfq_dump_class,
+        .dump_stats     =       sfq_dump_class_stats,
+        .walk           =       sfq_walk,
+};
+
 static struct Qdisc_ops sfq_qdisc_ops __read_mostly = {
-        .next           =       NULL,
-        .cl_ops         =       NULL,
+        .cl_ops         =       &sfq_class_ops,
         .id             =       "sfq",
         .priv_size      =       sizeof(struct sfq_sched_data),
         .enqueue        =       sfq_enqueue,
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 1411c7b1fbdc..0444fd0f0d22 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -71,7 +71,7 @@ struct teql_sched_data
 
 #define NEXT_SLAVE(q) (((struct teql_sched_data*)qdisc_priv(q))->next)
 
-#define FMASK (IFF_BROADCAST|IFF_POINTOPOINT|IFF_BROADCAST)
+#define FMASK (IFF_BROADCAST|IFF_POINTOPOINT)
 
 /* "teql*" qdisc routines */
 
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index dd98763c8b00..77383e9b3988 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2056,7 +2056,7 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
                 break;
 
         case SCTP_PARAM_HMAC_ALGO:
-                if (!sctp_auth_enable)
+                if (sctp_auth_enable)
                         break;
                 /* Fall Through */
 fallthrough:
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 07fad7ccf832..339ca4a8e89e 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1652,7 +1652,7 @@ static int __init x25_init(void)
 
         register_netdevice_notifier(&x25_dev_notifier);
 
-        printk(KERN_INFO "X.25 for Linux. Version 0.2 for Linux 2.1.15\n");
+        printk(KERN_INFO "X.25 for Linux Version 0.2\n");
 
 #ifdef CONFIG_SYSCTL
         x25_register_sysctl();
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index b5c5347aed66..6cc15250de69 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -28,6 +28,105 @@
  * that instantiated crypto transforms have correct parameters for IPsec
  * purposes.
  */
+static struct xfrm_algo_desc aead_list[] = {
+{
+        .name = "rfc4106(gcm(aes))",
+
+        .uinfo = {
+                .aead = {
+                        .icv_truncbits = 64,
+                }
+        },
+
+        .desc = {
+                .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV8,
+                .sadb_alg_ivlen = 8,
+                .sadb_alg_minbits = 128,
+                .sadb_alg_maxbits = 256
+        }
+},
+{
+        .name = "rfc4106(gcm(aes))",
+
+        .uinfo = {
+                .aead = {
+                        .icv_truncbits = 96,
+                }
+        },
+
+        .desc = {
+                .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV12,
+                .sadb_alg_ivlen = 8,
+                .sadb_alg_minbits = 128,
+                .sadb_alg_maxbits = 256
+        }
+},
+{
+        .name = "rfc4106(gcm(aes))",
+
+        .uinfo = {
+                .aead = {
+                        .icv_truncbits = 128,
+                }
+        },
+
+        .desc = {
+                .sadb_alg_id = SADB_X_EALG_AES_GCM_ICV16,
+                .sadb_alg_ivlen = 8,
+                .sadb_alg_minbits = 128,
+                .sadb_alg_maxbits = 256
+        }
+},
+{
+        .name = "rfc4309(ccm(aes))",
+
+        .uinfo = {
+                .aead = {
+                        .icv_truncbits = 64,
+                }
+        },
+
+        .desc = {
+                .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV8,
+                .sadb_alg_ivlen = 8,
+                .sadb_alg_minbits = 128,
+                .sadb_alg_maxbits = 256
+        }
+},
+{
+        .name = "rfc4309(ccm(aes))",
+
+        .uinfo = {
+                .aead = {
+                        .icv_truncbits = 96,
+                }
+        },
+
+        .desc = {
+                .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV12,
+                .sadb_alg_ivlen = 8,
+                .sadb_alg_minbits = 128,
+                .sadb_alg_maxbits = 256
+        }
+},
+{
+        .name = "rfc4309(ccm(aes))",
+
+        .uinfo = {
+                .aead = {
+                        .icv_truncbits = 128,
+                }
+        },
+
+        .desc = {
+                .sadb_alg_id = SADB_X_EALG_AES_CCM_ICV16,
+                .sadb_alg_ivlen = 8,
+                .sadb_alg_minbits = 128,
+                .sadb_alg_maxbits = 256
+        }
+},
+};
+
 static struct xfrm_algo_desc aalg_list[] = {
 {
         .name = "hmac(digest_null)",
@@ -332,6 +431,11 @@ static struct xfrm_algo_desc calg_list[] = {
 },
 };
 
+static inline int aead_entries(void)
+{
+        return ARRAY_SIZE(aead_list);
+}
+
 static inline int aalg_entries(void)
 {
         return ARRAY_SIZE(aalg_list);
@@ -354,25 +458,32 @@ struct xfrm_algo_list {
         u32 mask;
 };
 
+static const struct xfrm_algo_list xfrm_aead_list = {
+        .algs = aead_list,
+        .entries = ARRAY_SIZE(aead_list),
+        .type = CRYPTO_ALG_TYPE_AEAD,
+        .mask = CRYPTO_ALG_TYPE_MASK,
+};
+
 static const struct xfrm_algo_list xfrm_aalg_list = {
         .algs = aalg_list,
         .entries = ARRAY_SIZE(aalg_list),
         .type = CRYPTO_ALG_TYPE_HASH,
-        .mask = CRYPTO_ALG_TYPE_HASH_MASK | CRYPTO_ALG_ASYNC,
+        .mask = CRYPTO_ALG_TYPE_HASH_MASK,
 };
 
 static const struct xfrm_algo_list xfrm_ealg_list = {
         .algs = ealg_list,
         .entries = ARRAY_SIZE(ealg_list),
         .type = CRYPTO_ALG_TYPE_BLKCIPHER,
-        .mask = CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_ASYNC,
+        .mask = CRYPTO_ALG_TYPE_BLKCIPHER_MASK,
 };
 
 static const struct xfrm_algo_list xfrm_calg_list = {
         .algs = calg_list,
         .entries = ARRAY_SIZE(calg_list),
         .type = CRYPTO_ALG_TYPE_COMPRESS,
-        .mask = CRYPTO_ALG_TYPE_MASK | CRYPTO_ALG_ASYNC,
+        .mask = CRYPTO_ALG_TYPE_MASK,
 };
 
 static struct xfrm_algo_desc *xfrm_find_algo(
@@ -461,6 +572,33 @@ struct xfrm_algo_desc *xfrm_calg_get_byname(char *name, int probe)
 }
 EXPORT_SYMBOL_GPL(xfrm_calg_get_byname);
 
+struct xfrm_aead_name {
+        const char *name;
+        int icvbits;
+};
+
+static int xfrm_aead_name_match(const struct xfrm_algo_desc *entry,
+                                const void *data)
+{
+        const struct xfrm_aead_name *aead = data;
+        const char *name = aead->name;
+
+        return aead->icvbits == entry->uinfo.aead.icv_truncbits && name &&
+               !strcmp(name, entry->name);
+}
+
+struct xfrm_algo_desc *xfrm_aead_get_byname(char *name, int icv_len, int probe)
+{
+        struct xfrm_aead_name data = {
+                .name = name,
+                .icvbits = icv_len,
+        };
+
+        return xfrm_find_algo(&xfrm_aead_list, xfrm_aead_name_match, &data,
+                              probe);
+}
+EXPORT_SYMBOL_GPL(xfrm_aead_get_byname);
+
 struct xfrm_algo_desc *xfrm_aalg_get_byidx(unsigned int idx)
 {
         if (idx >= aalg_entries())
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 039e7019c48a..4d6ebc633a94 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -81,7 +81,6 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)
         *seq = *(__be32*)(skb_transport_header(skb) + offset_seq);
         return 0;
 }
-EXPORT_SYMBOL(xfrm_parse_spi);
 
 int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)
 {
@@ -160,12 +159,12 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
                 }
 
                 if ((x->encap ? x->encap->encap_type : 0) != encap_type) {
-                        XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEINVALID);
+                        XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEMISMATCH);
                         goto drop_unlock;
                 }
 
                 if (x->props.replay_window && xfrm_replay_check(x, skb, seq)) {
-                        XFRM_INC_STATS(LINUX_MIB_XFRMINSEQOUTOFWINDOW);
+                        XFRM_INC_STATS(LINUX_MIB_XFRMINSTATESEQERROR);
                         goto drop_unlock;
                 }
 
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index f4a1047a5573..fc690368325f 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -64,6 +64,7 @@ static int xfrm_output_one(struct sk_buff *skb, int err)
                 if (x->type->flags & XFRM_TYPE_REPLAY_PROT) {
                         XFRM_SKB_CB(skb)->seq = ++x->replay.oseq;
                         if (unlikely(x->replay.oseq == 0)) {
+                                XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATESEQERROR);
                                 x->replay.oseq--;
                                 xfrm_audit_state_replay_overflow(x, skb);
                                 err = -EOVERFLOW;
diff --git a/net/xfrm/xfrm_proc.c b/net/xfrm/xfrm_proc.c
index 31d035415ecd..2b0db13f0cda 100644
--- a/net/xfrm/xfrm_proc.c
+++ b/net/xfrm/xfrm_proc.c
@@ -22,7 +22,7 @@ static struct snmp_mib xfrm_mib_list[] = {
         SNMP_MIB_ITEM("XfrmInNoStates", LINUX_MIB_XFRMINNOSTATES),
         SNMP_MIB_ITEM("XfrmInStateProtoError", LINUX_MIB_XFRMINSTATEPROTOERROR),
         SNMP_MIB_ITEM("XfrmInStateModeError", LINUX_MIB_XFRMINSTATEMODEERROR),
-        SNMP_MIB_ITEM("XfrmInSeqOutOfWindow", LINUX_MIB_XFRMINSEQOUTOFWINDOW),
+        SNMP_MIB_ITEM("XfrmInStateSeqError", LINUX_MIB_XFRMINSTATESEQERROR),
         SNMP_MIB_ITEM("XfrmInStateExpired", LINUX_MIB_XFRMINSTATEEXPIRED),
         SNMP_MIB_ITEM("XfrmInStateMismatch", LINUX_MIB_XFRMINSTATEMISMATCH),
         SNMP_MIB_ITEM("XfrmInStateInvalid", LINUX_MIB_XFRMINSTATEINVALID),
@@ -36,6 +36,7 @@ static struct snmp_mib xfrm_mib_list[] = {
         SNMP_MIB_ITEM("XfrmOutNoStates", LINUX_MIB_XFRMOUTNOSTATES),
         SNMP_MIB_ITEM("XfrmOutStateProtoError", LINUX_MIB_XFRMOUTSTATEPROTOERROR),
         SNMP_MIB_ITEM("XfrmOutStateModeError", LINUX_MIB_XFRMOUTSTATEMODEERROR),
+        SNMP_MIB_ITEM("XfrmOutStateSeqError", LINUX_MIB_XFRMOUTSTATESEQERROR),
         SNMP_MIB_ITEM("XfrmOutStateExpired", LINUX_MIB_XFRMOUTSTATEEXPIRED),
         SNMP_MIB_ITEM("XfrmOutPolBlock", LINUX_MIB_XFRMOUTPOLBLOCK),
         SNMP_MIB_ITEM("XfrmOutPolDead", LINUX_MIB_XFRMOUTPOLDEAD),
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 3003503d0c94..3ff76e84d548 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -216,10 +216,10 @@ static void xfrm_state_unlock_afinfo(struct xfrm_state_afinfo *afinfo)
         write_unlock_bh(&xfrm_state_afinfo_lock);
 }
 
-int xfrm_register_type(struct xfrm_type *type, unsigned short family)
+int xfrm_register_type(const struct xfrm_type *type, unsigned short family)
 {
         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
-        struct xfrm_type **typemap;
+        const struct xfrm_type **typemap;
         int err = 0;
 
         if (unlikely(afinfo == NULL))
@@ -235,10 +235,10 @@ int xfrm_register_type(struct xfrm_type *type, unsigned short family)
 }
 EXPORT_SYMBOL(xfrm_register_type);
 
-int xfrm_unregister_type(struct xfrm_type *type, unsigned short family)
+int xfrm_unregister_type(const struct xfrm_type *type, unsigned short family)
 {
         struct xfrm_state_afinfo *afinfo = xfrm_state_lock_afinfo(family);
-        struct xfrm_type **typemap;
+        const struct xfrm_type **typemap;
         int err = 0;
 
         if (unlikely(afinfo == NULL))
@@ -254,11 +254,11 @@ int xfrm_unregister_type(struct xfrm_type *type, unsigned short family)
 }
 EXPORT_SYMBOL(xfrm_unregister_type);
 
-static struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
+static const struct xfrm_type *xfrm_get_type(u8 proto, unsigned short family)
 {
         struct xfrm_state_afinfo *afinfo;
-        struct xfrm_type **typemap;
-        struct xfrm_type *type;
+        const struct xfrm_type **typemap;
+        const struct xfrm_type *type;
         int modload_attempted = 0;
 
 retry:
@@ -281,7 +281,7 @@ retry:
         return type;
 }
 
-static void xfrm_put_type(struct xfrm_type *type)
+static void xfrm_put_type(const struct xfrm_type *type)
 {
         module_put(type->owner);
 }
@@ -1645,7 +1645,6 @@ err:
         xfrm_audit_state_replay(x, skb, net_seq);
         return -EINVAL;
 }
-EXPORT_SYMBOL(xfrm_replay_check);
 
 void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
 {
@@ -1667,7 +1666,6 @@ void xfrm_replay_advance(struct xfrm_state *x, __be32 net_seq)
         if (xfrm_aevent_is_on())
                 xfrm_replay_notify(x, XFRM_REPLAY_UPDATE);
 }
-EXPORT_SYMBOL(xfrm_replay_advance);
 
 static LIST_HEAD(xfrm_km_list);
 static DEFINE_RWLOCK(xfrm_km_lock);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index e0ccdf267813..78338079b7f5 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -31,6 +31,11 @@
 #include <linux/in6.h>
 #endif
 
+static inline int aead_len(struct xfrm_algo_aead *alg)
+{
+        return sizeof(*alg) + ((alg->alg_key_len + 7) / 8);
+}
+
 static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
 {
         struct nlattr *rt = attrs[type];
@@ -68,6 +73,22 @@ static int verify_one_alg(struct nlattr **attrs, enum xfrm_attr_type_t type)
         return 0;
 }
 
+static int verify_aead(struct nlattr **attrs)
+{
+        struct nlattr *rt = attrs[XFRMA_ALG_AEAD];
+        struct xfrm_algo_aead *algp;
+
+        if (!rt)
+                return 0;
+
+        algp = nla_data(rt);
+        if (nla_len(rt) < aead_len(algp))
+                return -EINVAL;
+
+        algp->alg_name[CRYPTO_MAX_ALG_NAME - 1] = '\0';
+        return 0;
+}
+
 static void verify_one_addr(struct nlattr **attrs, enum xfrm_attr_type_t type,
                            xfrm_address_t **addrp)
 {
@@ -119,20 +140,28 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
         switch (p->id.proto) {
         case IPPROTO_AH:
                 if (!attrs[XFRMA_ALG_AUTH]      ||
+                    attrs[XFRMA_ALG_AEAD]       ||
                     attrs[XFRMA_ALG_CRYPT]      ||
                     attrs[XFRMA_ALG_COMP])
                         goto out;
                 break;
 
         case IPPROTO_ESP:
-                if ((!attrs[XFRMA_ALG_AUTH] &&
-                     !attrs[XFRMA_ALG_CRYPT])   ||
-                    attrs[XFRMA_ALG_COMP])
+                if (attrs[XFRMA_ALG_COMP])
+                        goto out;
+                if (!attrs[XFRMA_ALG_AUTH] &&
+                    !attrs[XFRMA_ALG_CRYPT] &&
+                    !attrs[XFRMA_ALG_AEAD])
+                        goto out;
+                if ((attrs[XFRMA_ALG_AUTH] ||
+                     attrs[XFRMA_ALG_CRYPT]) &&
+                    attrs[XFRMA_ALG_AEAD])
                         goto out;
                 break;
 
         case IPPROTO_COMP:
                 if (!attrs[XFRMA_ALG_COMP]      ||
+                    attrs[XFRMA_ALG_AEAD]       ||
                     attrs[XFRMA_ALG_AUTH]       ||
                     attrs[XFRMA_ALG_CRYPT])
                         goto out;
@@ -143,6 +172,7 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
         case IPPROTO_ROUTING:
                 if (attrs[XFRMA_ALG_COMP]       ||
                     attrs[XFRMA_ALG_AUTH]       ||
+                    attrs[XFRMA_ALG_AEAD]       ||
                     attrs[XFRMA_ALG_CRYPT]      ||
                     attrs[XFRMA_ENCAP]          ||
                     attrs[XFRMA_SEC_CTX]        ||
@@ -155,6 +185,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
                 goto out;
         }
 
+        if ((err = verify_aead(attrs)))
+                goto out;
         if ((err = verify_one_alg(attrs, XFRMA_ALG_AUTH)))
                 goto out;
         if ((err = verify_one_alg(attrs, XFRMA_ALG_CRYPT)))
@@ -208,6 +240,31 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
         return 0;
 }
 
+static int attach_aead(struct xfrm_algo_aead **algpp, u8 *props,
+                       struct nlattr *rta)
+{
+        struct xfrm_algo_aead *p, *ualg;
+        struct xfrm_algo_desc *algo;
+
+        if (!rta)
+                return 0;
+
+        ualg = nla_data(rta);
+
+        algo = xfrm_aead_get_byname(ualg->alg_name, ualg->alg_icv_len, 1);
+        if (!algo)
+                return -ENOSYS;
+        *props = algo->desc.sadb_alg_id;
+
+        p = kmemdup(ualg, aead_len(ualg), GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
+
+        strcpy(p->alg_name, algo->name);
+        *algpp = p;
+        return 0;
+}
+
 static inline int xfrm_user_sec_ctx_size(struct xfrm_sec_ctx *xfrm_ctx)
 {
         int len = 0;
@@ -286,6 +343,9 @@ static struct xfrm_state *xfrm_state_construct(struct xfrm_usersa_info *p,
 
         copy_from_user_state(x, p);
 
+        if ((err = attach_aead(&x->aead, &x->props.ealgo,
+                               attrs[XFRMA_ALG_AEAD])))
+                goto error;
         if ((err = attach_one_algo(&x->aalg, &x->props.aalgo,
                                    xfrm_aalg_get_byname,
                                    attrs[XFRMA_ALG_AUTH])))
@@ -510,6 +570,8 @@ static int copy_to_user_state_extra(struct xfrm_state *x,
         if (x->lastused)
                 NLA_PUT_U64(skb, XFRMA_LASTUSED, x->lastused);
 
+        if (x->aead)
+                NLA_PUT(skb, XFRMA_ALG_AEAD, aead_len(x->aead), x->aead);
         if (x->aalg)
                 NLA_PUT(skb, XFRMA_ALG_AUTH, xfrm_alg_len(x->aalg), x->aalg);
         if (x->ealg)
@@ -1808,6 +1870,7 @@ static const int xfrm_msg_min[XFRM_NR_MSGTYPES] = {
 #undef XMSGSIZE
 
 static const struct nla_policy xfrma_policy[XFRMA_MAX+1] = {
+        [XFRMA_ALG_AEAD]        = { .len = sizeof(struct xfrm_algo_aead) },
         [XFRMA_ALG_AUTH]        = { .len = sizeof(struct xfrm_algo) },
         [XFRMA_ALG_CRYPT]       = { .len = sizeof(struct xfrm_algo) },
         [XFRMA_ALG_COMP]        = { .len = sizeof(struct xfrm_algo) },
@@ -1972,6 +2035,8 @@ static int xfrm_notify_sa_flush(struct km_event *c)
 static inline size_t xfrm_sa_len(struct xfrm_state *x)
 {
         size_t l = 0;
+        if (x->aead)
+                l += nla_total_size(aead_len(x->aead));
         if (x->aalg)
                 l += nla_total_size(xfrm_alg_len(x->aalg));
         if (x->ealg)