Patched in Tegra support.

75 files changed, 4155 insertions, 8569 deletions

diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 4f7fe7270e3..36d7437ac05 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -69,7 +69,7 @@ config IPV6_OPTIMISTIC_DAD
 
 config INET6_AH
         tristate "IPv6: AH transformation"
-        select XFRM_ALGO
+        select XFRM
         select CRYPTO
         select CRYPTO_HMAC
         select CRYPTO_MD5
@@ -81,7 +81,7 @@ config INET6_AH
 
 config INET6_ESP
         tristate "IPv6: ESP transformation"
-        select XFRM_ALGO
+        select XFRM
         select CRYPTO
         select CRYPTO_AUTHENC
         select CRYPTO_HMAC
@@ -201,22 +201,6 @@ config IPV6_TUNNEL
 
           If unsure, say N.
 
-config IPV6_GRE
-        tristate "IPv6: GRE tunnel"
-        select IPV6_TUNNEL
-        ---help---
-          Tunneling means encapsulating data of one protocol type within
-          another protocol and sending it over a channel that understands the
-          encapsulating protocol. This particular tunneling driver implements
-          GRE (Generic Routing Encapsulation) and at this time allows
-          encapsulating of IPv4 or IPv6 over existing IPv6 infrastructure.
-          This driver is useful if the other endpoint is a Cisco router: Cisco
-          likes GRE much better than the other Linux tunneling driver ("IP
-          tunneling" above). In addition, GRE allows multicast redistribution
-          through the tunnel.
-
-          Saying M here will produce a module called ip6_gre. If unsure, say N.
-
 config IPV6_MULTIPLE_TABLES
         bool "IPv6: Multiple Routing Tables"
         depends on EXPERIMENTAL
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 4ea244891b5..686934acfac 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -7,11 +7,9 @@ obj-$(CONFIG_IPV6) += ipv6.o
 ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o \
                 addrlabel.o \
                 route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o udplite.o \
-                raw.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
+                raw.o protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
                 exthdrs.o datagram.o ip6_flowlabel.o inet6_connection_sock.o
 
-ipv6-offload := ip6_offload.o tcpv6_offload.o udp_offload.o exthdrs_offload.o
-
 ipv6-$(CONFIG_SYSCTL) = sysctl_net_ipv6.o
 ipv6-$(CONFIG_IPV6_MROUTE) += ip6mr.o
 
@@ -38,9 +36,7 @@ obj-$(CONFIG_NETFILTER)	+= netfilter/
 
 obj-$(CONFIG_IPV6_SIT) += sit.o
 obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
-obj-$(CONFIG_IPV6_GRE) += ip6_gre.o
 
 obj-y += addrconf_core.o exthdrs_core.o
-obj-$(CONFIG_INET) += output_core.o protocol.o $(ipv6-offload)
 
 obj-$(subst m,y,$(CONFIG_IPV6)) += inet6_hashtables.o
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 420e5632638..1587d0d9295 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -38,8 +38,6 @@
  *                                              status etc.
  */
 
-#define pr_fmt(fmt) "IPv6: " fmt
-
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
@@ -63,13 +61,11 @@
 #include <linux/delay.h>
 #include <linux/notifier.h>
 #include <linux/string.h>
-#include <linux/hash.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/snmp.h>
 
-#include <net/af_ieee802154.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/ndisc.h>
@@ -81,7 +77,6 @@
 #include <net/pkt_sched.h>
 #include <linux/if_tunnel.h>
 #include <linux/rtnetlink.h>
-#include <linux/netconf.h>
 
 #ifdef CONFIG_IPV6_PRIVACY
 #include <linux/random.h>
@@ -92,7 +87,6 @@
 
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-#include <linux/export.h>
 
 /* Set to 3 to get tracing... */
 #define ACONF_DEBUG 2
@@ -128,8 +122,8 @@ static inline void addrconf_sysctl_unregister(struct inet6_dev *idev)
 #endif
 
 #ifdef CONFIG_IPV6_PRIVACY
-static void __ipv6_regen_rndid(struct inet6_dev *idev);
-static void __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
+static int __ipv6_regen_rndid(struct inet6_dev *idev);
+static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr);
 static void ipv6_regen_rndid(unsigned long data);
 #endif
 
@@ -154,12 +148,7 @@ static void addrconf_type_change(struct net_device *dev,
                                  unsigned long event);
 static int addrconf_ifdown(struct net_device *dev, int how);
 
-static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
-                                                  int plen,
-                                                  const struct net_device *dev,
-                                                  u32 flags, u32 noflags);
-
-static void addrconf_dad_start(struct inet6_ifaddr *ifp);
+static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags);
 static void addrconf_dad_timer(unsigned long data);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
 static void addrconf_dad_run(struct inet6_dev *idev);
@@ -255,6 +244,12 @@ static inline bool addrconf_qdisc_ok(const struct net_device *dev)
         return !qdisc_tx_is_noop(dev);
 }
 
+/* Check if a route is valid prefix route */
+static inline int addrconf_is_prefix_route(const struct rt6_info *rt)
+{
+        return (rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0;
+}
+
 static void addrconf_del_timer(struct inet6_ifaddr *ifp)
 {
         if (del_timer(&ifp->timer))
@@ -330,19 +325,20 @@ void in6_dev_finish_destroy(struct inet6_dev *idev)
         WARN_ON(idev->mc_list != NULL);
 
 #ifdef NET_REFCNT_DEBUG
-        pr_debug("%s: %s\n", __func__, dev ? dev->name : "NIL");
+        printk(KERN_DEBUG "in6_dev_finish_destroy: %s\n", dev ? dev->name : "NIL");
 #endif
         dev_put(dev);
         if (!idev->dead) {
-                pr_warn("Freeing alive inet6 device %p\n", idev);
+                pr_warning("Freeing alive inet6 device %p\n", idev);
                 return;
         }
         snmp6_free_dev(idev);
         kfree_rcu(idev, rcu);
 }
+
 EXPORT_SYMBOL(in6_dev_finish_destroy);
 
-static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
+static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
 {
         struct inet6_dev *ndev;
 
@@ -375,7 +371,7 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
 
         if (snmp6_alloc_dev(ndev) < 0) {
                 ADBG((KERN_WARNING
-                        "%s: cannot allocate memory for statistics; dev=%s.\n",
+                        "%s(): cannot allocate memory for statistics; dev=%s.\n",
                         __func__, dev->name));
                 neigh_parms_release(&nd_tbl, ndev->nd_parms);
                 dev_put(dev);
@@ -385,7 +381,7 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
 
         if (snmp6_register_dev(ndev) < 0) {
                 ADBG((KERN_WARNING
-                        "%s: cannot create /proc/net/dev_snmp6/%s\n",
+                        "%s(): cannot create /proc/net/dev_snmp6/%s\n",
                         __func__, dev->name));
                 neigh_parms_release(&nd_tbl, ndev->nd_parms);
                 ndev->dead = 1;
@@ -401,9 +397,11 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
         if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
                 ndev->cnf.accept_dad = -1;
 
-#if IS_ENABLED(CONFIG_IPV6_SIT)
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
-                pr_info("%s: Disabled Multicast RS\n", dev->name);
+                printk(KERN_INFO
+                       "%s: Disabled Multicast RS\n",
+                       dev->name);
                 ndev->cnf.rtr_solicits = 0;
         }
 #endif
@@ -435,14 +433,10 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
         /* Join all-node multicast group */
         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
 
-        /* Join all-router multicast group if forwarding is set */
-        if (ndev->cnf.forwarding && (dev->flags & IFF_MULTICAST))
-                ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
-
         return ndev;
 }
 
-static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
+static struct inet6_dev * ipv6_find_idev(struct net_device *dev)
 {
         struct inet6_dev *idev;
 
@@ -460,149 +454,6 @@ static struct inet6_dev *ipv6_find_idev(struct net_device *dev)
         return idev;
 }
 
-static int inet6_netconf_msgsize_devconf(int type)
-{
-        int size =  NLMSG_ALIGN(sizeof(struct netconfmsg))
-                    + nla_total_size(4);        /* NETCONFA_IFINDEX */
-
-        /* type -1 is used for ALL */
-        if (type == -1 || type == NETCONFA_FORWARDING)
-                size += nla_total_size(4);
-#ifdef CONFIG_IPV6_MROUTE
-        if (type == -1 || type == NETCONFA_MC_FORWARDING)
-                size += nla_total_size(4);
-#endif
-
-        return size;
-}
-
-static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex,
-                                      struct ipv6_devconf *devconf, u32 portid,
-                                      u32 seq, int event, unsigned int flags,
-                                      int type)
-{
-        struct nlmsghdr  *nlh;
-        struct netconfmsg *ncm;
-
-        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct netconfmsg),
-                        flags);
-        if (nlh == NULL)
-                return -EMSGSIZE;
-
-        ncm = nlmsg_data(nlh);
-        ncm->ncm_family = AF_INET6;
-
-        if (nla_put_s32(skb, NETCONFA_IFINDEX, ifindex) < 0)
-                goto nla_put_failure;
-
-        /* type -1 is used for ALL */
-        if ((type == -1 || type == NETCONFA_FORWARDING) &&
-            nla_put_s32(skb, NETCONFA_FORWARDING, devconf->forwarding) < 0)
-                goto nla_put_failure;
-#ifdef CONFIG_IPV6_MROUTE
-        if ((type == -1 || type == NETCONFA_MC_FORWARDING) &&
-            nla_put_s32(skb, NETCONFA_MC_FORWARDING,
-                        devconf->mc_forwarding) < 0)
-                goto nla_put_failure;
-#endif
-        return nlmsg_end(skb, nlh);
-
-nla_put_failure:
-        nlmsg_cancel(skb, nlh);
-        return -EMSGSIZE;
-}
-
-void inet6_netconf_notify_devconf(struct net *net, int type, int ifindex,
-                                  struct ipv6_devconf *devconf)
-{
-        struct sk_buff *skb;
-        int err = -ENOBUFS;
-
-        skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_ATOMIC);
-        if (skb == NULL)
-                goto errout;
-
-        err = inet6_netconf_fill_devconf(skb, ifindex, devconf, 0, 0,
-                                         RTM_NEWNETCONF, 0, type);
-        if (err < 0) {
-                /* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
-                WARN_ON(err == -EMSGSIZE);
-                kfree_skb(skb);
-                goto errout;
-        }
-        rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_ATOMIC);
-        return;
-errout:
-        rtnl_set_sk_err(net, RTNLGRP_IPV6_NETCONF, err);
-}
-
-static const struct nla_policy devconf_ipv6_policy[NETCONFA_MAX+1] = {
-        [NETCONFA_IFINDEX]      = { .len = sizeof(int) },
-        [NETCONFA_FORWARDING]   = { .len = sizeof(int) },
-};
-
-static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
-                                     struct nlmsghdr *nlh,
-                                     void *arg)
-{
-        struct net *net = sock_net(in_skb->sk);
-        struct nlattr *tb[NETCONFA_MAX+1];
-        struct netconfmsg *ncm;
-        struct sk_buff *skb;
-        struct ipv6_devconf *devconf;
-        struct inet6_dev *in6_dev;
-        struct net_device *dev;
-        int ifindex;
-        int err;
-
-        err = nlmsg_parse(nlh, sizeof(*ncm), tb, NETCONFA_MAX,
-                          devconf_ipv6_policy);
-        if (err < 0)
-                goto errout;
-
-        err = EINVAL;
-        if (!tb[NETCONFA_IFINDEX])
-                goto errout;
-
-        ifindex = nla_get_s32(tb[NETCONFA_IFINDEX]);
-        switch (ifindex) {
-        case NETCONFA_IFINDEX_ALL:
-                devconf = net->ipv6.devconf_all;
-                break;
-        case NETCONFA_IFINDEX_DEFAULT:
-                devconf = net->ipv6.devconf_dflt;
-                break;
-        default:
-                dev = __dev_get_by_index(net, ifindex);
-                if (dev == NULL)
-                        goto errout;
-                in6_dev = __in6_dev_get(dev);
-                if (in6_dev == NULL)
-                        goto errout;
-                devconf = &in6_dev->cnf;
-                break;
-        }
-
-        err = -ENOBUFS;
-        skb = nlmsg_new(inet6_netconf_msgsize_devconf(-1), GFP_ATOMIC);
-        if (skb == NULL)
-                goto errout;
-
-        err = inet6_netconf_fill_devconf(skb, ifindex, devconf,
-                                         NETLINK_CB(in_skb).portid,
-                                         nlh->nlmsg_seq, RTM_NEWNETCONF, 0,
-                                         -1);
-        if (err < 0) {
-                /* -EMSGSIZE implies BUG in inet6_netconf_msgsize_devconf() */
-                WARN_ON(err == -EMSGSIZE);
-                kfree_skb(skb);
-                goto errout;
-        }
-        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
-errout:
-        return err;
-}
-
 #ifdef CONFIG_SYSCTL
 static void dev_forward_change(struct inet6_dev *idev)
 {
@@ -614,7 +465,7 @@ static void dev_forward_change(struct inet6_dev *idev)
         dev = idev->dev;
         if (idev->cnf.forwarding)
                 dev_disable_lro(dev);
-        if (dev->flags & IFF_MULTICAST) {
+        if (dev && (dev->flags & IFF_MULTICAST)) {
                 if (idev->cnf.forwarding)
                         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
                 else
@@ -629,8 +480,6 @@ static void dev_forward_change(struct inet6_dev *idev)
                 else
                         addrconf_leave_anycast(ifa);
         }
-        inet6_netconf_notify_devconf(dev_net(dev), NETCONFA_FORWARDING,
-                                     dev->ifindex, &idev->cnf);
 }
 
 
@@ -639,7 +488,8 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
         struct net_device *dev;
         struct inet6_dev *idev;
 
-        for_each_netdev(net, dev) {
+        rcu_read_lock();
+        for_each_netdev_rcu(net, dev) {
                 idev = __in6_dev_get(dev);
                 if (idev) {
                         int changed = (!idev->cnf.forwarding) ^ (!newf);
@@ -648,41 +498,32 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
                                 dev_forward_change(idev);
                 }
         }
+        rcu_read_unlock();
 }
 
-static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
+static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 {
         struct net *net;
-        int old;
-
-        if (!rtnl_trylock())
-                return restart_syscall();
 
         net = (struct net *)table->extra2;
-        old = *p;
-        *p = newf;
-
-        if (p == &net->ipv6.devconf_dflt->forwarding) {
-                if ((!newf) ^ (!old))
-                        inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
-                                                     NETCONFA_IFINDEX_DEFAULT,
-                                                     net->ipv6.devconf_dflt);
-                rtnl_unlock();
+        if (p == &net->ipv6.devconf_dflt->forwarding)
                 return 0;
+
+        if (!rtnl_trylock()) {
+                /* Restore the original values before restarting */
+                *p = old;
+                return restart_syscall();
         }
 
         if (p == &net->ipv6.devconf_all->forwarding) {
+                __s32 newf = net->ipv6.devconf_all->forwarding;
                 net->ipv6.devconf_dflt->forwarding = newf;
                 addrconf_forward_change(net, newf);
-                if ((!newf) ^ (!old))
-                        inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
-                                                     NETCONFA_IFINDEX_ALL,
-                                                     net->ipv6.devconf_all);
-        } else if ((!newf) ^ (!old))
+        } else if ((!*p) ^ (!old))
                 dev_forward_change((struct inet6_dev *)table->extra1);
         rtnl_unlock();
 
-        if (newf)
+        if (*p)
                 rt6_purge_dflt_routers(net);
         return 1;
 }
@@ -694,7 +535,7 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
         WARN_ON(!hlist_unhashed(&ifp->addr_lst));
 
 #ifdef NET_REFCNT_DEBUG
-        pr_debug("%s\n", __func__);
+        printk(KERN_DEBUG "inet6_ifa_finish_destroy\n");
 #endif
 
         in6_dev_put(ifp->idev);
@@ -703,10 +544,10 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
                 pr_notice("Timer is still running, when freeing ifa=%p\n", ifp);
 
         if (ifp->state != INET6_IFADDR_STATE_DEAD) {
-                pr_warn("Freeing alive inet6 address %p\n", ifp);
+                pr_warning("Freeing alive inet6 address %p\n", ifp);
                 return;
         }
-        ip6_rt_put(ifp->rt);
+        dst_release(&ifp->rt->dst);
 
         kfree_rcu(ifp, rcu);
 }
@@ -731,9 +572,15 @@ ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
         list_add_tail(&ifp->if_list, p);
 }
 
-static u32 inet6_addr_hash(const struct in6_addr *addr)
+static u32 ipv6_addr_hash(const struct in6_addr *addr)
 {
-        return hash_32(ipv6_addr_hash(addr), IN6_ADDR_HSIZE_SHIFT);
+        /*
+         * We perform the hash function over the last 64 bits of the address
+         * This will include the IEEE address token on links that support it.
+         */
+        return jhash_2words((__force u32)addr->s6_addr32[2],
+                            (__force u32)addr->s6_addr32[3], 0)
+                & (IN6_ADDR_HSIZE - 1);
 }
 
 /* On success it returns ifp with increased reference count */
@@ -782,13 +629,13 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
                 goto out;
         }
 
-        rt = addrconf_dst_alloc(idev, addr, false);
+        rt = addrconf_dst_alloc(idev, addr, 0);
         if (IS_ERR(rt)) {
                 err = PTR_ERR(rt);
                 goto out;
         }
 
-        ifa->addr = *addr;
+        ipv6_addr_copy(&ifa->addr, addr);
 
         spin_lock_init(&ifa->lock);
         spin_lock_init(&ifa->state_lock);
@@ -802,13 +649,23 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
 
         ifa->rt = rt;
 
+        /*
+         * part one of RFC 4429, section 3.3
+         * We should not configure an address as
+         * optimistic if we do not yet know the link
+         * layer address of our nexhop router
+         */
+
+        if (dst_get_neighbour_raw(&rt->dst) == NULL)
+                ifa->flags &= ~IFA_F_OPTIMISTIC;
+
         ifa->idev = idev;
         in6_dev_hold(idev);
         /* For caller */
         in6_ifa_hold(ifa);
 
         /* Add to big hash table */
-        hash = inet6_addr_hash(addr);
+        hash = ipv6_addr_hash(addr);
 
         hlist_add_head_rcu(&ifa->addr_lst, &inet6_addr_lst[hash]);
         spin_unlock(&addrconf_hash_lock);
@@ -940,23 +797,20 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
         if ((ifp->flags & IFA_F_PERMANENT) && onlink < 1) {
                 struct in6_addr prefix;
                 struct rt6_info *rt;
-
+                struct net *net = dev_net(ifp->idev->dev);
                 ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len);
+                rt = rt6_lookup(net, &prefix, NULL, ifp->idev->dev->ifindex, 1);
 
-                rt = addrconf_get_prefix_route(&prefix,
-                                               ifp->prefix_len,
-                                               ifp->idev->dev,
-                                               0, RTF_GATEWAY | RTF_DEFAULT);
-
-                if (rt) {
+                if (rt && addrconf_is_prefix_route(rt)) {
                         if (onlink == 0) {
                                 ip6_del_rt(rt);
                                 rt = NULL;
                         } else if (!(rt->rt6i_flags & RTF_EXPIRES)) {
-                                rt6_set_expires(rt, expires);
+                                rt->rt6i_expires = expires;
+                                rt->rt6i_flags |= RTF_EXPIRES;
                         }
                 }
-                ip6_rt_put(rt);
+                dst_release(&rt->dst);
         }
 
         /* clean up prefsrc entries */
@@ -991,7 +845,8 @@ retry:
         in6_dev_hold(idev);
         if (idev->cnf.use_tempaddr <= 0) {
                 write_unlock(&idev->lock);
-                pr_info("%s: use_tempaddr is disabled\n", __func__);
+                printk(KERN_INFO
+                        "ipv6_create_tempaddr(): use_tempaddr is disabled.\n");
                 in6_dev_put(idev);
                 ret = -1;
                 goto out;
@@ -1001,15 +856,24 @@ retry:
                 idev->cnf.use_tempaddr = -1;    /*XXX*/
                 spin_unlock_bh(&ifp->lock);
                 write_unlock(&idev->lock);
-                pr_warn("%s: regeneration time exceeded - disabled temporary address support\n",
-                        __func__);
+                printk(KERN_WARNING
+                        "ipv6_create_tempaddr(): regeneration time exceeded. disabled temporary address support.\n");
                 in6_dev_put(idev);
                 ret = -1;
                 goto out;
         }
         in6_ifa_hold(ifp);
         memcpy(addr.s6_addr, ifp->addr.s6_addr, 8);
-        __ipv6_try_regen_rndid(idev, tmpaddr);
+        if (__ipv6_try_regen_rndid(idev, tmpaddr) < 0) {
+                spin_unlock_bh(&ifp->lock);
+                write_unlock(&idev->lock);
+                printk(KERN_WARNING
+                        "ipv6_create_tempaddr(): regeneration of randomized interface id failed.\n");
+                in6_ifa_put(ifp);
+                in6_dev_put(idev);
+                ret = -1;
+                goto out;
+        }
         memcpy(&addr.s6_addr[8], idev->rndid, 8);
         age = (now - ifp->tstamp) / HZ;
         tmp_valid_lft = min_t(__u32,
@@ -1054,7 +918,8 @@ retry:
         if (!ift || IS_ERR(ift)) {
                 in6_ifa_put(ifp);
                 in6_dev_put(idev);
-                pr_info("%s: retry temporary address regeneration\n", __func__);
+                printk(KERN_INFO
+                        "ipv6_create_tempaddr(): retry temporary address regeneration.\n");
                 tmpaddr = &addr;
                 write_lock(&idev->lock);
                 goto retry;
@@ -1068,7 +933,7 @@ retry:
         ift->tstamp = tmp_tstamp;
         spin_unlock_bh(&ift->lock);
 
-        addrconf_dad_start(ift);
+        addrconf_dad_start(ift, 0);
         in6_ifa_put(ift);
         in6_dev_put(idev);
 out:
@@ -1227,10 +1092,8 @@ static int ipv6_get_saddr_eval(struct net *net,
                 break;
         case IPV6_SADDR_RULE_PREFIX:
                 /* Rule 8: Use longest matching prefix */
-                ret = ipv6_addr_diff(&score->ifa->addr, dst->addr);
-                if (ret > score->ifa->prefix_len)
-                        ret = score->ifa->prefix_len;
-                score->matchlen = ret;
+                score->matchlen = ret = ipv6_addr_diff(&score->ifa->addr,
+                                                       dst->addr);
                 break;
         default:
                 ret = 0;
@@ -1243,7 +1106,7 @@ out:
         return ret;
 }
 
-int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
+int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
                        const struct in6_addr *daddr, unsigned int prefs,
                        struct in6_addr *saddr)
 {
@@ -1364,7 +1227,7 @@ try_nextdev:
         if (!hiscore->ifa)
                 return -EADDRNOTAVAIL;
 
-        *saddr = hiscore->ifa->addr;
+        ipv6_addr_copy(saddr, &hiscore->ifa->addr);
         in6_ifa_put(hiscore->ifa);
         return 0;
 }
@@ -1385,7 +1248,7 @@ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
                 list_for_each_entry(ifp, &idev->addr_list, if_list) {
                         if (ifp->scope == IFA_LINK &&
                             !(ifp->flags & banned_flags)) {
-                                *addr = ifp->addr;
+                                ipv6_addr_copy(addr, &ifp->addr);
                                 err = 0;
                                 break;
                         }
@@ -1413,7 +1276,7 @@ int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
 {
         struct inet6_ifaddr *ifp;
         struct hlist_node *node;
-        unsigned int hash = inet6_addr_hash(addr);
+        unsigned int hash = ipv6_addr_hash(addr);
 
         rcu_read_lock_bh();
         hlist_for_each_entry_rcu(ifp, node, &inet6_addr_lst[hash], addr_lst) {
@@ -1436,7 +1299,7 @@ EXPORT_SYMBOL(ipv6_chk_addr);
 static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
                                struct net_device *dev)
 {
-        unsigned int hash = inet6_addr_hash(addr);
+        unsigned int hash = ipv6_addr_hash(addr);
         struct inet6_ifaddr *ifp;
         struct hlist_node *node;
 
@@ -1473,13 +1336,14 @@ int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
         rcu_read_unlock();
         return onlink;
 }
+
 EXPORT_SYMBOL(ipv6_chk_prefix);
 
 struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *addr,
                                      struct net_device *dev, int strict)
 {
         struct inet6_ifaddr *ifp, *result = NULL;
-        unsigned int hash = inet6_addr_hash(addr);
+        unsigned int hash = ipv6_addr_hash(addr);
         struct hlist_node *node;
 
         rcu_read_lock_bh();
@@ -1556,8 +1420,9 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                 return;
         }
 
-        net_info_ratelimited("%s: IPv6 duplicate address %pI6c detected!\n",
-                             ifp->idev->dev->name, &ifp->addr);
+        if (net_ratelimit())
+                printk(KERN_INFO "%s: IPv6 duplicate address %pI6c detected!\n",
+                        ifp->idev->dev->name, &ifp->addr);
 
         if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
                 struct in6_addr addr;
@@ -1570,7 +1435,7 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                         /* DAD failed for link-local based on MAC address */
                         idev->cnf.disable_ipv6 = 1;
 
-                        pr_info("%s: IPv6 being disabled!\n",
+                        printk(KERN_INFO "%s: IPv6 being disabled!\n",
                                 ifp->idev->dev->name);
                 }
         }
@@ -1655,21 +1520,13 @@ static int addrconf_ifid_eui48(u8 *eui, struct net_device *dev)
         return 0;
 }
 
-static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
-{
-        if (dev->addr_len != IEEE802154_ADDR_LEN)
-                return -1;
-        memcpy(eui, dev->dev_addr, 8);
-        return 0;
-}
-
 static int addrconf_ifid_arcnet(u8 *eui, struct net_device *dev)
 {
         /* XXX: inherit EUI-64 from other interface -- yoshfuji */
         if (dev->addr_len != ARCNET_ALEN)
                 return -1;
         memset(eui, 0, 7);
-        eui[7] = *(u8 *)dev->dev_addr;
+        eui[7] = *(u8*)dev->dev_addr;
         return 0;
 }
 
@@ -1716,6 +1573,7 @@ static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
         switch (dev->type) {
         case ARPHRD_ETHER:
         case ARPHRD_FDDI:
+        case ARPHRD_IEEE802_TR:
                 return addrconf_ifid_eui48(eui, dev);
         case ARPHRD_ARCNET:
                 return addrconf_ifid_arcnet(eui, dev);
@@ -1725,8 +1583,6 @@ static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
                 return addrconf_ifid_sit(eui, dev);
         case ARPHRD_IPGRE:
                 return addrconf_ifid_gre(eui, dev);
-        case ARPHRD_IEEE802154:
-                return addrconf_ifid_eui64(eui, dev);
         }
         return -1;
 }
@@ -1750,7 +1606,7 @@ static int ipv6_inherit_eui64(u8 *eui, struct inet6_dev *idev)
 
 #ifdef CONFIG_IPV6_PRIVACY
 /* (re)generation of randomized interface identifier (RFC 3041 3.2, 3.5) */
-static void __ipv6_regen_rndid(struct inet6_dev *idev)
+static int __ipv6_regen_rndid(struct inet6_dev *idev)
 {
 regen:
         get_random_bytes(idev->rndid, sizeof(idev->rndid));
@@ -1777,6 +1633,8 @@ regen:
                 if ((idev->rndid[2]|idev->rndid[3]|idev->rndid[4]|idev->rndid[5]|idev->rndid[6]|idev->rndid[7]) == 0x00)
                         goto regen;
         }
+
+        return 0;
 }
 
 static void ipv6_regen_rndid(unsigned long data)
@@ -1790,15 +1648,17 @@ static void ipv6_regen_rndid(unsigned long data)
         if (idev->dead)
                 goto out;
 
-        __ipv6_regen_rndid(idev);
+        if (__ipv6_regen_rndid(idev) < 0)
+                goto out;
 
         expires = jiffies +
                 idev->cnf.temp_prefered_lft * HZ -
                 idev->cnf.regen_max_retry * idev->cnf.dad_transmits * idev->nd_parms->retrans_time -
                 idev->cnf.max_desync_factor * HZ;
         if (time_before(expires, jiffies)) {
-                pr_warn("%s: too short regeneration interval; timer disabled for %s\n",
-                        __func__, idev->dev->name);
+                printk(KERN_WARNING
+                        "ipv6_regen_rndid(): too short regeneration interval; timer disabled for %s.\n",
+                        idev->dev->name);
                 goto out;
         }
 
@@ -1811,10 +1671,12 @@ out:
         in6_dev_put(idev);
 }
 
-static void  __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr)
-{
+static int __ipv6_try_regen_rndid(struct inet6_dev *idev, struct in6_addr *tmpaddr) {
+        int ret = 0;
+
         if (tmpaddr && memcmp(idev->rndid, &tmpaddr->s6_addr[8], 8) == 0)
-                __ipv6_regen_rndid(idev);
+                ret = __ipv6_regen_rndid(idev);
+        return ret;
 }
 #endif
 
@@ -1837,13 +1699,13 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
                 .fc_protocol = RTPROT_KERNEL,
         };
 
-        cfg.fc_dst = *pfx;
+        ipv6_addr_copy(&cfg.fc_dst, pfx);
 
         /* Prevent useless cloning on PtP SIT.
            This thing is done here expecting that the whole
            class of non-broadcast devices need not cloning.
          */
-#if IS_ENABLED(CONFIG_IPV6_SIT)
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
                 cfg.fc_flags |= RTF_NONEXTHOP;
 #endif
@@ -1851,40 +1713,6 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
         ip6_route_add(&cfg);
 }
 
-
-static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
-                                                  int plen,
-                                                  const struct net_device *dev,
-                                                  u32 flags, u32 noflags)
-{
-        struct fib6_node *fn;
-        struct rt6_info *rt = NULL;
-        struct fib6_table *table;
-
-        table = fib6_get_table(dev_net(dev), RT6_TABLE_PREFIX);
-        if (table == NULL)
-                return NULL;
-
-        read_lock_bh(&table->tb6_lock);
-        fn = fib6_locate(&table->tb6_root, pfx, plen, NULL, 0);
-        if (!fn)
-                goto out;
-        for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
-                if (rt->dst.dev->ifindex != dev->ifindex)
-                        continue;
-                if ((rt->rt6i_flags & flags) != flags)
-                        continue;
-                if ((rt->rt6i_flags & noflags) != 0)
-                        continue;
-                dst_hold(&rt->dst);
-                break;
-        }
-out:
-        read_unlock_bh(&table->tb6_lock);
-        return rt;
-}
-
-
 /* Create "default" multicast route to the interface */
 
 static void addrconf_add_mroute(struct net_device *dev)
@@ -1903,7 +1731,7 @@ static void addrconf_add_mroute(struct net_device *dev)
         ip6_route_add(&cfg);
 }
 
-#if IS_ENABLED(CONFIG_IPV6_SIT)
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void sit_route_add(struct net_device *dev)
 {
         struct fib6_config cfg = {
@@ -1920,6 +1748,14 @@ static void sit_route_add(struct net_device *dev)
 }
 #endif
 
+static void addrconf_add_lroute(struct net_device *dev)
+{
+        struct in6_addr addr;
+
+        ipv6_addr_set(&addr,  htonl(0xFE800000), 0, 0, 0);
+        addrconf_prefix_route(&addr, 64, dev, 0, 0);
+}
+
 static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
 {
         struct inet6_dev *idev;
@@ -1934,13 +1770,14 @@ static struct inet6_dev *addrconf_add_dev(struct net_device *dev)
                 return ERR_PTR(-EACCES);
 
         /* Add default multicast route */
-        if (!(dev->flags & IFF_LOOPBACK))
-                addrconf_add_mroute(dev);
+        addrconf_add_mroute(dev);
 
+        /* Add link local route */
+        addrconf_add_lroute(dev);
         return idev;
 }
 
-void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
+void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
 {
         struct prefix_info *pinfo;
         __u32 valid_lft;
@@ -1969,15 +1806,16 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
         prefered_lft = ntohl(pinfo->prefered);
 
         if (prefered_lft > valid_lft) {
-                net_warn_ratelimited("addrconf: prefix option has invalid lifetime\n");
+                if (net_ratelimit())
+                        printk(KERN_WARNING "addrconf: prefix option has invalid lifetime\n");
                 return;
         }
 
         in6_dev = in6_dev_get(dev);
 
         if (in6_dev == NULL) {
-                net_dbg_ratelimited("addrconf: device %s not configured\n",
-                                    dev->name);
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "addrconf: device %s not configured\n", dev->name);
                 return;
         }
 
@@ -2004,22 +1842,21 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
                 if (addrconf_finite_timeout(rt_expires))
                         rt_expires *= HZ;
 
-                rt = addrconf_get_prefix_route(&pinfo->prefix,
-                                               pinfo->prefix_len,
-                                               dev,
-                                               RTF_ADDRCONF | RTF_PREFIX_RT,
-                                               RTF_GATEWAY | RTF_DEFAULT);
+                rt = rt6_lookup(net, &pinfo->prefix, NULL,
+                                dev->ifindex, 1);
 
-                if (rt) {
+                if (rt && addrconf_is_prefix_route(rt)) {
                         /* Autoconf prefix route */
                         if (valid_lft == 0) {
                                 ip6_del_rt(rt);
                                 rt = NULL;
                         } else if (addrconf_finite_timeout(rt_expires)) {
                                 /* not infinity */
-                                rt6_set_expires(rt, jiffies + rt_expires);
+                                rt->rt6i_expires = jiffies + rt_expires;
+                                rt->rt6i_flags |= RTF_EXPIRES;
                         } else {
-                                rt6_clean_expires(rt);
+                                rt->rt6i_flags &= ~RTF_EXPIRES;
+                                rt->rt6i_expires = 0;
                         }
                 } else if (valid_lft) {
                         clock_t expires = 0;
@@ -2032,13 +1869,14 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
                         addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
                                               dev, expires, flags);
                 }
-                ip6_rt_put(rt);
+                if (rt)
+                        dst_release(&rt->dst);
         }
 
         /* Try to figure out our local address for this prefix */
 
         if (pinfo->autoconf && in6_dev->cnf.autoconf) {
-                struct inet6_ifaddr *ifp;
+                struct inet6_ifaddr * ifp;
                 struct in6_addr addr;
                 int create = 0, update_lft = 0;
 
@@ -2051,8 +1889,9 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len, bool sllao)
                         }
                         goto ok;
                 }
-                net_dbg_ratelimited("IPv6 addrconf: prefix with wrong length %d\n",
-                                    pinfo->prefix_len);
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "IPv6 addrconf: prefix with wrong length %d\n",
+                               pinfo->prefix_len);
                 in6_dev_put(in6_dev);
                 return;
 
@@ -2066,7 +1905,7 @@ ok:
 
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
                         if (in6_dev->cnf.optimistic_dad &&
-                            !net->ipv6.devconf_all->forwarding && sllao)
+                            !net->ipv6.devconf_all->forwarding)
                                 addr_flags = IFA_F_OPTIMISTIC;
 #endif
 
@@ -2086,7 +1925,7 @@ ok:
 
                         update_lft = create = 1;
                         ifp->cstamp = jiffies;
-                        addrconf_dad_start(ifp);
+                        addrconf_dad_start(ifp, RTF_ADDRCONF|RTF_PREFIX_RT);
                 }
 
                 if (ifp) {
@@ -2254,7 +2093,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
         if (dev == NULL)
                 goto err_exit;
 
-#if IS_ENABLED(CONFIG_IPV6_SIT)
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT) {
                 const struct net_device_ops *ops = dev->netdev_ops;
                 struct ifreq ifr;
@@ -2365,7 +2204,7 @@ static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *p
                  * that the Optimistic flag should not be set for
                  * manually configured addresses
                  */
-                addrconf_dad_start(ifp);
+                addrconf_dad_start(ifp, 0);
                 in6_ifa_put(ifp);
                 addrconf_verify(0);
                 return 0;
@@ -2418,7 +2257,7 @@ int addrconf_add_ifaddr(struct net *net, void __user *arg)
         struct in6_ifreq ireq;
         int err;
 
-        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
@@ -2437,7 +2276,7 @@ int addrconf_del_ifaddr(struct net *net, void __user *arg)
         struct in6_ifreq ireq;
         int err;
 
-        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
@@ -2465,7 +2304,7 @@ static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
         }
 }
 
-#if IS_ENABLED(CONFIG_IPV6_SIT)
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void sit_add_v4_addrs(struct inet6_dev *idev)
 {
         struct in6_addr addr;
@@ -2491,9 +2330,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
         }
 
         for_each_netdev(net, dev) {
-                struct in_device *in_dev = __in_dev_get_rtnl(dev);
+                struct in_device * in_dev = __in_dev_get_rtnl(dev);
                 if (in_dev && (dev->flags & IFF_UP)) {
-                        struct in_ifaddr *ifa;
+                        struct in_ifaddr * ifa;
 
                         int flag = scope;
 
@@ -2530,7 +2369,7 @@ static void init_loopback(struct net_device *dev)
         ASSERT_RTNL();
 
         if ((idev = ipv6_find_idev(dev)) == NULL) {
-                pr_debug("%s: add_dev failed\n", __func__);
+                printk(KERN_DEBUG "init loopback: add_dev failed\n");
                 return;
         }
 
@@ -2539,7 +2378,7 @@ static void init_loopback(struct net_device *dev)
 
 static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr *addr)
 {
-        struct inet6_ifaddr *ifp;
+        struct inet6_ifaddr * ifp;
         u32 addr_flags = IFA_F_PERMANENT;
 
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
@@ -2552,7 +2391,7 @@ static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr
         ifp = ipv6_add_addr(idev, addr, 64, IFA_LINK, addr_flags);
         if (!IS_ERR(ifp)) {
                 addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
-                addrconf_dad_start(ifp);
+                addrconf_dad_start(ifp, 0);
                 in6_ifa_put(ifp);
         }
 }
@@ -2560,15 +2399,15 @@ static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr
 static void addrconf_dev_config(struct net_device *dev)
 {
         struct in6_addr addr;
-        struct inet6_dev *idev;
+        struct inet6_dev    * idev;
 
         ASSERT_RTNL();
 
         if ((dev->type != ARPHRD_ETHER) &&
             (dev->type != ARPHRD_FDDI) &&
+            (dev->type != ARPHRD_IEEE802_TR) &&
             (dev->type != ARPHRD_ARCNET) &&
-            (dev->type != ARPHRD_INFINIBAND) &&
-            (dev->type != ARPHRD_IEEE802154)) {
+            (dev->type != ARPHRD_INFINIBAND)) {
                 /* Alas, we support only Ethernet autoconfiguration. */
                 return;
         }
@@ -2584,7 +2423,7 @@ static void addrconf_dev_config(struct net_device *dev)
                 addrconf_add_linklocal(idev, &addr);
 }
 
-#if IS_ENABLED(CONFIG_IPV6_SIT)
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
 static void addrconf_sit_config(struct net_device *dev)
 {
         struct inet6_dev *idev;
@@ -2598,7 +2437,7 @@ static void addrconf_sit_config(struct net_device *dev)
          */
 
         if ((idev = ipv6_find_idev(dev)) == NULL) {
-                pr_debug("%s: add_dev failed\n", __func__);
+                printk(KERN_DEBUG "init sit: add_dev failed\n");
                 return;
         }
 
@@ -2614,25 +2453,26 @@ static void addrconf_sit_config(struct net_device *dev)
 
         sit_add_v4_addrs(idev);
 
-        if (dev->flags&IFF_POINTOPOINT)
+        if (dev->flags&IFF_POINTOPOINT) {
                 addrconf_add_mroute(dev);
-        else
+                addrconf_add_lroute(dev);
+        } else
                 sit_route_add(dev);
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NET_IPGRE)
+#if defined(CONFIG_NET_IPGRE) || defined(CONFIG_NET_IPGRE_MODULE)
 static void addrconf_gre_config(struct net_device *dev)
 {
         struct inet6_dev *idev;
         struct in6_addr addr;
 
-        pr_info("%s(%s)\n", __func__, dev->name);
+        pr_info("ipv6: addrconf_gre_config(%s)\n", dev->name);
 
         ASSERT_RTNL();
 
         if ((idev = ipv6_find_idev(dev)) == NULL) {
-                pr_debug("%s: add_dev failed\n", __func__);
+                printk(KERN_DEBUG "init gre: add_dev failed\n");
                 return;
         }
 
@@ -2672,7 +2512,7 @@ static void ip6_tnl_add_linklocal(struct inet6_dev *idev)
                 if (!ipv6_inherit_linklocal(idev, link_dev))
                         return;
         }
-        pr_debug("init ip6-ip6: add_linklocal failed\n");
+        printk(KERN_DEBUG "init ip6-ip6: add_linklocal failed\n");
 }
 
 /*
@@ -2688,14 +2528,14 @@ static void addrconf_ip6_tnl_config(struct net_device *dev)
 
         idev = addrconf_add_dev(dev);
         if (IS_ERR(idev)) {
-                pr_debug("init ip6-ip6: add_dev failed\n");
+                printk(KERN_DEBUG "init ip6-ip6: add_dev failed\n");
                 return;
         }
         ip6_tnl_add_linklocal(idev);
 }
 
 static int addrconf_notify(struct notifier_block *this, unsigned long event,
-                           void *data)
+                           void * data)
 {
         struct net_device *dev = (struct net_device *) data;
         struct inet6_dev *idev = __in6_dev_get(dev);
@@ -2719,7 +2559,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                 if (event == NETDEV_UP) {
                         if (!addrconf_qdisc_ok(dev)) {
                                 /* device is not ready yet. */
-                                pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
+                                printk(KERN_INFO
+                                        "ADDRCONF(NETDEV_UP): %s: "
+                                        "link is not ready\n",
                                         dev->name);
                                 break;
                         }
@@ -2744,19 +2586,21 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                                 idev->if_flags |= IF_READY;
                         }
 
-                        pr_info("ADDRCONF(NETDEV_CHANGE): %s: link becomes ready\n",
-                                dev->name);
+                        printk(KERN_INFO
+                                        "ADDRCONF(NETDEV_CHANGE): %s: "
+                                        "link becomes ready\n",
+                                        dev->name);
 
                         run_pending = 1;
                 }
 
                 switch (dev->type) {
-#if IS_ENABLED(CONFIG_IPV6_SIT)
+#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
                 case ARPHRD_SIT:
                         addrconf_sit_config(dev);
                         break;
 #endif
-#if IS_ENABLED(CONFIG_NET_IPGRE)
+#if defined(CONFIG_NET_IPGRE) || defined(CONFIG_NET_IPGRE_MODULE)
                 case ARPHRD_IPGRE:
                         addrconf_gre_config(dev);
                         break;
@@ -2889,7 +2733,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                 idev->dead = 1;
 
                 /* protected by rtnl_lock */
-                RCU_INIT_POINTER(dev->ip6_ptr, NULL);
+                rcu_assign_pointer(dev->ip6_ptr, NULL);
 
                 /* Step 1.5: remove snmp6 entry */
                 snmp6_unregister_dev(idev);
@@ -2993,7 +2837,7 @@ static void addrconf_rs_timer(unsigned long data)
         if (idev->dead || !(idev->if_flags & IF_READY))
                 goto out;
 
-        if (!ipv6_accept_ra(idev))
+        if (idev->cnf.forwarding)
                 goto out;
 
         /* Announcement received after solicitation was sent */
@@ -3016,7 +2860,8 @@ static void addrconf_rs_timer(unsigned long data)
                  * Note: we do not support deprecated "all on-link"
                  * assumption any longer.
                  */
-                pr_debug("%s: no IPv6 routers present\n", idev->dev->name);
+                printk(KERN_DEBUG "%s: no IPv6 routers present\n",
+                       idev->dev->name);
         }
 
 out:
@@ -3041,7 +2886,7 @@ static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
         addrconf_mod_timer(ifp, AC_DAD, rand_num);
 }
 
-static void addrconf_dad_start(struct inet6_ifaddr *ifp)
+static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
 {
         struct inet6_dev *idev = ifp->idev;
         struct net_device *dev = idev->dev;
@@ -3151,11 +2996,12 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 
         ipv6_ifa_notify(RTM_NEWADDR, ifp);
 
-        /* If added prefix is link local and we are prepared to process
-           router advertisements, start sending router solicitations.
+        /* If added prefix is link local and forwarding is off,
+           start sending router solicitations.
          */
 
-        if (ipv6_accept_ra(ifp->idev) &&
+        if ((ifp->idev->cnf.forwarding == 0 ||
+             ifp->idev->cnf.forwarding == 2) &&
             ifp->idev->cnf.rtr_solicits > 0 &&
             (dev->flags&IFF_LOOPBACK) == 0 &&
             (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)) {
@@ -3193,40 +3039,20 @@ static void addrconf_dad_run(struct inet6_dev *idev)
 struct if6_iter_state {
         struct seq_net_private p;
         int bucket;
-        int offset;
 };
 
-static struct inet6_ifaddr *if6_get_first(struct seq_file *seq, loff_t pos)
+static struct inet6_ifaddr *if6_get_first(struct seq_file *seq)
 {
         struct inet6_ifaddr *ifa = NULL;
         struct if6_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
-        int p = 0;
 
-        /* initial bucket if pos is 0 */
-        if (pos == 0) {
-                state->bucket = 0;
-                state->offset = 0;
-        }
-
-        for (; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
+        for (state->bucket = 0; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
                 struct hlist_node *n;
                 hlist_for_each_entry_rcu_bh(ifa, n, &inet6_addr_lst[state->bucket],
-                                         addr_lst) {
-                        if (!net_eq(dev_net(ifa->idev->dev), net))
-                                continue;
-                        /* sync with offset */
-                        if (p < state->offset) {
-                                p++;
-                                continue;
-                        }
-                        state->offset++;
-                        return ifa;
-                }
-
-                /* prepare for next bucket */
-                state->offset = 0;
-                p = 0;
+                                         addr_lst)
+                        if (net_eq(dev_net(ifa->idev->dev), net))
+                                return ifa;
         }
         return NULL;
 }
@@ -3238,32 +3064,36 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
         struct net *net = seq_file_net(seq);
         struct hlist_node *n = &ifa->addr_lst;
 
-        hlist_for_each_entry_continue_rcu_bh(ifa, n, addr_lst) {
-                if (!net_eq(dev_net(ifa->idev->dev), net))
-                        continue;
-                state->offset++;
-                return ifa;
-        }
+        hlist_for_each_entry_continue_rcu_bh(ifa, n, addr_lst)
+                if (net_eq(dev_net(ifa->idev->dev), net))
+                        return ifa;
 
         while (++state->bucket < IN6_ADDR_HSIZE) {
-                state->offset = 0;
                 hlist_for_each_entry_rcu_bh(ifa, n,
                                      &inet6_addr_lst[state->bucket], addr_lst) {
-                        if (!net_eq(dev_net(ifa->idev->dev), net))
-                                continue;
-                        state->offset++;
-                        return ifa;
+                        if (net_eq(dev_net(ifa->idev->dev), net))
+                                return ifa;
                 }
         }
 
         return NULL;
 }
 
+static struct inet6_ifaddr *if6_get_idx(struct seq_file *seq, loff_t pos)
+{
+        struct inet6_ifaddr *ifa = if6_get_first(seq);
+
+        if (ifa)
+                while (pos && (ifa = if6_get_next(seq, ifa)) != NULL)
+                        --pos;
+        return pos ? NULL : ifa;
+}
+
 static void *if6_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(rcu_bh)
 {
         rcu_read_lock_bh();
-        return if6_get_first(seq, *pos);
+        return if6_get_idx(seq, *pos);
 }
 
 static void *if6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
@@ -3343,14 +3173,14 @@ void if6_proc_exit(void)
 }
 #endif  /* CONFIG_PROC_FS */
 
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 /* Check if address is a home address configured on any interface. */
 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
 {
         int ret = 0;
         struct inet6_ifaddr *ifp = NULL;
         struct hlist_node *n;
-        unsigned int hash = inet6_addr_hash(addr);
+        unsigned int hash = ipv6_addr_hash(addr);
 
         rcu_read_lock_bh();
         hlist_for_each_entry_rcu_bh(ifp, n, &inet6_addr_lst[hash], addr_lst) {
@@ -3683,12 +3513,12 @@ static inline int inet6_ifaddr_msgsize(void)
 }
 
 static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
-                             u32 portid, u32 seq, int event, unsigned int flags)
+                             u32 pid, u32 seq, int event, unsigned int flags)
 {
         struct nlmsghdr  *nlh;
         u32 preferred, valid;
 
-        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
         if (nlh == NULL)
                 return -EMSGSIZE;
 
@@ -3726,7 +3556,7 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
 }
 
 static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
-                                u32 portid, u32 seq, int event, u16 flags)
+                                u32 pid, u32 seq, int event, u16 flags)
 {
         struct nlmsghdr  *nlh;
         u8 scope = RT_SCOPE_UNIVERSE;
@@ -3735,7 +3565,7 @@ static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
         if (ipv6_addr_scope(&ifmca->mca_addr) & IFA_SITE)
                 scope = RT_SCOPE_SITE;
 
-        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
         if (nlh == NULL)
                 return -EMSGSIZE;
 
@@ -3751,7 +3581,7 @@ static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
 }
 
 static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
-                                u32 portid, u32 seq, int event, unsigned int flags)
+                                u32 pid, u32 seq, int event, unsigned int flags)
 {
         struct nlmsghdr  *nlh;
         u8 scope = RT_SCOPE_UNIVERSE;
@@ -3760,7 +3590,7 @@ static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
         if (ipv6_addr_scope(&ifaca->aca_addr) & IFA_SITE)
                 scope = RT_SCOPE_SITE;
 
-        nlh = nlmsg_put(skb, portid, seq, event, sizeof(struct ifaddrmsg), flags);
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
         if (nlh == NULL)
                 return -EMSGSIZE;
 
@@ -3801,7 +3631,7 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
                         if (++ip_idx < s_ip_idx)
                                 continue;
                         err = inet6_fill_ifaddr(skb, ifa,
-                                                NETLINK_CB(cb->skb).portid,
+                                                NETLINK_CB(cb->skb).pid,
                                                 cb->nlh->nlmsg_seq,
                                                 RTM_NEWADDR,
                                                 NLM_F_MULTI);
@@ -3817,7 +3647,7 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
                         if (ip_idx < s_ip_idx)
                                 continue;
                         err = inet6_fill_ifmcaddr(skb, ifmca,
-                                                  NETLINK_CB(cb->skb).portid,
+                                                  NETLINK_CB(cb->skb).pid,
                                                   cb->nlh->nlmsg_seq,
                                                   RTM_GETMULTICAST,
                                                   NLM_F_MULTI);
@@ -3832,7 +3662,7 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
                         if (ip_idx < s_ip_idx)
                                 continue;
                         err = inet6_fill_ifacaddr(skb, ifaca,
-                                                  NETLINK_CB(cb->skb).portid,
+                                                  NETLINK_CB(cb->skb).pid,
                                                   cb->nlh->nlmsg_seq,
                                                   RTM_GETANYCAST,
                                                   NLM_F_MULTI);
@@ -3916,7 +3746,7 @@ static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
         return inet6_dump_addr(skb, cb, type);
 }
 
-static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh,
+static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr* nlh,
                              void *arg)
 {
         struct net *net = sock_net(in_skb->sk);
@@ -3954,7 +3784,7 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                 goto errout_ifa;
         }
 
-        err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).portid,
+        err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).pid,
                                 nlh->nlmsg_seq, RTM_NEWADDR, 0);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in inet6_ifaddr_msgsize() */
@@ -3962,7 +3792,7 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh,
                 kfree_skb(skb);
                 goto errout_ifa;
         }
-        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
+        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid);
 errout_ifa:
         in6_ifa_put(ifa);
 errout:
@@ -4041,7 +3871,6 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
         array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
         array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
         array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
-        array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -4112,14 +3941,14 @@ static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev)
         struct nlattr *nla;
         struct ifla_cacheinfo ci;
 
-        if (nla_put_u32(skb, IFLA_INET6_FLAGS, idev->if_flags))
-                goto nla_put_failure;
+        NLA_PUT_U32(skb, IFLA_INET6_FLAGS, idev->if_flags);
+
         ci.max_reasm_len = IPV6_MAXPLEN;
         ci.tstamp = cstamp_delta(idev->tstamp);
         ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
         ci.retrans_time = jiffies_to_msecs(idev->nd_parms->retrans_time);
-        if (nla_put(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci))
-                goto nla_put_failure;
+        NLA_PUT(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci);
+
         nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
         if (nla == NULL)
                 goto nla_put_failure;
@@ -4165,14 +3994,14 @@ static int inet6_fill_link_af(struct sk_buff *skb, const struct net_device *dev)
 }
 
 static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
-                             u32 portid, u32 seq, int event, unsigned int flags)
+                             u32 pid, u32 seq, int event, unsigned int flags)
 {
         struct net_device *dev = idev->dev;
         struct ifinfomsg *hdr;
         struct nlmsghdr *nlh;
         void *protoinfo;
 
-        nlh = nlmsg_put(skb, portid, seq, event, sizeof(*hdr), flags);
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*hdr), flags);
         if (nlh == NULL)
                 return -EMSGSIZE;
 
@@ -4184,13 +4013,15 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
         hdr->ifi_flags = dev_get_flags(dev);
         hdr->ifi_change = 0;
 
-        if (nla_put_string(skb, IFLA_IFNAME, dev->name) ||
-            (dev->addr_len &&
-             nla_put(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr)) ||
-            nla_put_u32(skb, IFLA_MTU, dev->mtu) ||
-            (dev->ifindex != dev->iflink &&
-             nla_put_u32(skb, IFLA_LINK, dev->iflink)))
-                goto nla_put_failure;
+        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
+
+        if (dev->addr_len)
+                NLA_PUT(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr);
+
+        NLA_PUT_U32(skb, IFLA_MTU, dev->mtu);
+        if (dev->ifindex != dev->iflink)
+                NLA_PUT_U32(skb, IFLA_LINK, dev->iflink);
+
         protoinfo = nla_nest_start(skb, IFLA_PROTINFO);
         if (protoinfo == NULL)
                 goto nla_put_failure;
@@ -4230,7 +4061,7 @@ static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                         if (!idev)
                                 goto cont;
                         if (inet6_fill_ifinfo(skb, idev,
-                                              NETLINK_CB(cb->skb).portid,
+                                              NETLINK_CB(cb->skb).pid,
                                               cb->nlh->nlmsg_seq,
                                               RTM_NEWLINK, NLM_F_MULTI) <= 0)
                                 goto out;
@@ -4278,14 +4109,14 @@ static inline size_t inet6_prefix_nlmsg_size(void)
 }
 
 static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
-                             struct prefix_info *pinfo, u32 portid, u32 seq,
+                             struct prefix_info *pinfo, u32 pid, u32 seq,
                              int event, unsigned int flags)
 {
         struct prefixmsg *pmsg;
         struct nlmsghdr *nlh;
         struct prefix_cacheinfo ci;
 
-        nlh = nlmsg_put(skb, portid, seq, event, sizeof(*pmsg), flags);
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*pmsg), flags);
         if (nlh == NULL)
                 return -EMSGSIZE;
 
@@ -4303,12 +4134,12 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
         if (pinfo->autoconf)
                 pmsg->prefix_flags |= IF_PREFIX_AUTOCONF;
 
-        if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix))
-                goto nla_put_failure;
+        NLA_PUT(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix);
+
         ci.preferred_time = ntohl(pinfo->prefered);
         ci.valid_time = ntohl(pinfo->valid);
-        if (nla_put(skb, PREFIX_CACHEINFO, sizeof(ci), &ci))
-                goto nla_put_failure;
+        NLA_PUT(skb, PREFIX_CACHEINFO, sizeof(ci), &ci);
+
         return nlmsg_end(skb, nlh);
 
 nla_put_failure:
@@ -4387,17 +4218,9 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
         int *valp = ctl->data;
         int val = *valp;
         loff_t pos = *ppos;
-        ctl_table lctl;
         int ret;
 
-        /*
-         * ctl->data points to idev->cnf.forwarding, we should
-         * not modify it until we get the rtnl lock.
-         */
-        lctl = *ctl;
-        lctl.data = &val;
-
-        ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_fixup_forwarding(ctl, valp, val);
@@ -4435,27 +4258,26 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
         rcu_read_unlock();
 }
 
-static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
+static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
 {
         struct net *net;
-        int old;
-
-        if (!rtnl_trylock())
-                return restart_syscall();
 
         net = (struct net *)table->extra2;
-        old = *p;
-        *p = newf;
 
-        if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
-                rtnl_unlock();
+        if (p == &net->ipv6.devconf_dflt->disable_ipv6)
                 return 0;
+
+        if (!rtnl_trylock()) {
+                /* Restore the original values before restarting */
+                *p = old;
+                return restart_syscall();
         }
 
         if (p == &net->ipv6.devconf_all->disable_ipv6) {
+                __s32 newf = net->ipv6.devconf_all->disable_ipv6;
                 net->ipv6.devconf_dflt->disable_ipv6 = newf;
                 addrconf_disable_change(net, newf);
-        } else if ((!newf) ^ (!old))
+        } else if ((!*p) ^ (!old))
                 dev_disable_change((struct inet6_dev *)table->extra1);
 
         rtnl_unlock();
@@ -4469,17 +4291,9 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
         int *valp = ctl->data;
         int val = *valp;
         loff_t pos = *ppos;
-        ctl_table lctl;
         int ret;
 
-        /*
-         * ctl->data points to idev->cnf.disable_ipv6, we should
-         * not modify it until we get the rtnl lock.
-         */
-        lctl = *ctl;
-        lctl.data = &val;
-
-        ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_disable_ipv6(ctl, valp, val);
@@ -4492,6 +4306,7 @@ static struct addrconf_sysctl_table
 {
         struct ctl_table_header *sysctl_header;
         ctl_table addrconf_vars[DEVCONF_MAX+1];
+        char *dev_name;
 } addrconf_sysctl __read_mostly = {
         .sysctl_header = NULL,
         .addrconf_vars = {
@@ -4710,13 +4525,6 @@ static struct addrconf_sysctl_table
                         .proc_handler   = proc_dointvec
                 },
                 {
-                        .procname       = "ndisc_notify",
-                        .data           = &ipv6_devconf.ndisc_notify,
-                        .maxlen         = sizeof(int),
-                        .mode           = 0644,
-                        .proc_handler   = proc_dointvec
-                },
-                {
                         /* sentinel */
                 }
         },
@@ -4727,7 +4535,17 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
 {
         int i;
         struct addrconf_sysctl_table *t;
-        char path[sizeof("net/ipv6/conf/") + IFNAMSIZ];
+
+#define ADDRCONF_CTL_PATH_DEV   3
+
+        struct ctl_path addrconf_ctl_path[] = {
+                { .procname = "net", },
+                { .procname = "ipv6", },
+                { .procname = "conf", },
+                { /* to be set */ },
+                { },
+        };
+
 
         t = kmemdup(&addrconf_sysctl, sizeof(*t), GFP_KERNEL);
         if (t == NULL)
@@ -4739,15 +4557,27 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
                 t->addrconf_vars[i].extra2 = net;
         }
 
-        snprintf(path, sizeof(path), "net/ipv6/conf/%s", dev_name);
+        /*
+         * Make a copy of dev_name, because '.procname' is regarded as const
+         * by sysctl and we wouldn't want anyone to change it under our feet
+         * (see SIOCSIFNAME).
+         */
+        t->dev_name = kstrdup(dev_name, GFP_KERNEL);
+        if (!t->dev_name)
+                goto free;
+
+        addrconf_ctl_path[ADDRCONF_CTL_PATH_DEV].procname = t->dev_name;
 
-        t->sysctl_header = register_net_sysctl(net, path, t->addrconf_vars);
+        t->sysctl_header = register_net_sysctl_table(net, addrconf_ctl_path,
+                        t->addrconf_vars);
         if (t->sysctl_header == NULL)
-                goto free;
+                goto free_procname;
 
         p->sysctl = t;
         return 0;
 
+free_procname:
+        kfree(t->dev_name);
 free:
         kfree(t);
 out:
@@ -4764,6 +4594,7 @@ static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
         t = p->sysctl;
         p->sysctl = NULL;
         unregister_net_sysctl_table(t->sysctl_header);
+        kfree(t->dev_name);
         kfree(t);
 }
 
@@ -4882,8 +4713,8 @@ int __init addrconf_init(void)
 
         err = ipv6_addr_label_init();
         if (err < 0) {
-                pr_crit("%s: cannot initialize default policy table: %d\n",
-                        __func__, err);
+                printk(KERN_CRIT "IPv6 Addrconf:"
+                       " cannot initialize default policy table: %d.\n", err);
                 goto out;
         }
 
@@ -4941,8 +4772,6 @@ int __init addrconf_init(void)
                         inet6_dump_ifmcaddr, NULL);
         __rtnl_register(PF_INET6, RTM_GETANYCAST, NULL,
                         inet6_dump_ifacaddr, NULL);
-        __rtnl_register(PF_INET6, RTM_GETNETCONF, inet6_netconf_get_devconf,
-                        NULL, NULL);
 
         ipv6_addr_label_rtnl_register();
 
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index d051e5f4bf3..6b03826552e 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -3,14 +3,13 @@
  * not configured or static.
  */
 
-#include <linux/export.h>
 #include <net/ipv6.h>
 
 #define IPV6_ADDR_SCOPE_TYPE(scope)     ((scope) << 16)
 
-static inline unsigned int ipv6_addr_scope2type(unsigned int scope)
+static inline unsigned ipv6_addr_scope2type(unsigned scope)
 {
-        switch (scope) {
+        switch(scope) {
         case IPV6_ADDR_SCOPE_NODELOCAL:
                 return (IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_NODELOCAL) |
                         IPV6_ADDR_LOOPBACK);
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index ff76eecfd62..2d8ddba9ee5 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -57,7 +57,7 @@ struct net *ip6addrlbl_net(const struct ip6addrlbl_entry *lbl)
 }
 
 /*
- * Default policy table (RFC6724 + extensions)
+ * Default policy table (RFC3484 + extensions)
  *
  * prefix               addr_type       label
  * -------------------------------------------------------------------------
@@ -69,17 +69,13 @@ struct net *ip6addrlbl_net(const struct ip6addrlbl_entry *lbl)
  * fc00::/7             N/A             5               ULA (RFC 4193)
  * 2001::/32            N/A             6               Teredo (RFC 4380)
  * 2001:10::/28         N/A             7               ORCHID (RFC 4843)
- * fec0::/10            N/A             11              Site-local
- *                                                      (deprecated by RFC3879)
- * 3ffe::/16            N/A             12              6bone
  *
  * Note: 0xffffffff is used if we do not have any policies.
- * Note: Labels for ULA and 6to4 are different from labels listed in RFC6724.
  */
 
 #define IPV6_ADDR_LABEL_DEFAULT 0xffffffffUL
 
-static const __net_initconst struct ip6addrlbl_init_table
+static const __net_initdata struct ip6addrlbl_init_table
 {
         const struct in6_addr *prefix;
         int prefixlen;
@@ -92,18 +88,10 @@ static const __net_initconst struct ip6addrlbl_init_table
                 .prefix = &(struct in6_addr){{{ 0xfc }}},
                 .prefixlen = 7,
                 .label = 5,
-        },{     /* fec0::/10 */
-                .prefix = &(struct in6_addr){{{ 0xfe, 0xc0 }}},
-                .prefixlen = 10,
-                .label = 11,
         },{     /* 2002::/16 */
                 .prefix = &(struct in6_addr){{{ 0x20, 0x02 }}},
                 .prefixlen = 16,
                 .label = 2,
-        },{     /* 3ffe::/16 */
-                .prefix = &(struct in6_addr){{{ 0x3f, 0xfe }}},
-                .prefixlen = 16,
-                .label = 12,
         },{     /* 2001::/32 */
                 .prefix = &(struct in6_addr){{{ 0x20, 0x01 }}},
                 .prefixlen = 32,
@@ -141,7 +129,7 @@ static void ip6addrlbl_free_rcu(struct rcu_head *h)
         ip6addrlbl_free(container_of(h, struct ip6addrlbl_entry, rcu));
 }
 
-static bool ip6addrlbl_hold(struct ip6addrlbl_entry *p)
+static inline int ip6addrlbl_hold(struct ip6addrlbl_entry *p)
 {
         return atomic_inc_not_zero(&p->refcnt);
 }
@@ -153,20 +141,20 @@ static inline void ip6addrlbl_put(struct ip6addrlbl_entry *p)
 }
 
 /* Find label */
-static bool __ip6addrlbl_match(struct net *net,
-                               const struct ip6addrlbl_entry *p,
-                               const struct in6_addr *addr,
-                               int addrtype, int ifindex)
+static int __ip6addrlbl_match(struct net *net,
+                              struct ip6addrlbl_entry *p,
+                              const struct in6_addr *addr,
+                              int addrtype, int ifindex)
 {
         if (!net_eq(ip6addrlbl_net(p), net))
-                return false;
+                return 0;
         if (p->ifindex && p->ifindex != ifindex)
-                return false;
+                return 0;
         if (p->addrtype && p->addrtype != addrtype)
-                return false;
+                return 0;
         if (!ipv6_prefix_equal(addr, &p->prefix, p->prefixlen))
-                return false;
-        return true;
+                return 0;
+        return 1;
 }
 
 static struct ip6addrlbl_entry *__ipv6_addr_label(struct net *net,
@@ -362,7 +350,7 @@ static int __net_init ip6addrlbl_net_init(struct net *net)
         int err = 0;
         int i;
 
-        ADDRLABEL(KERN_DEBUG "%s\n", __func__);
+        ADDRLABEL(KERN_DEBUG "%s()\n", __func__);
 
         for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) {
                 int ret = ip6addrlbl_add(net,
@@ -468,8 +456,8 @@ static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh,
         return err;
 }
 
-static void ip6addrlbl_putmsg(struct nlmsghdr *nlh,
-                              int prefixlen, int ifindex, u32 lseq)
+static inline void ip6addrlbl_putmsg(struct nlmsghdr *nlh,
+                                     int prefixlen, int ifindex, u32 lseq)
 {
         struct ifaddrlblmsg *ifal = nlmsg_data(nlh);
         ifal->ifal_family = AF_INET6;
@@ -482,10 +470,10 @@ static void ip6addrlbl_putmsg(struct nlmsghdr *nlh,
 static int ip6addrlbl_fill(struct sk_buff *skb,
                            struct ip6addrlbl_entry *p,
                            u32 lseq,
-                           u32 portid, u32 seq, int event,
+                           u32 pid, u32 seq, int event,
                            unsigned int flags)
 {
-        struct nlmsghdr *nlh = nlmsg_put(skb, portid, seq, event,
+        struct nlmsghdr *nlh = nlmsg_put(skb, pid, seq, event,
                                          sizeof(struct ifaddrlblmsg), flags);
         if (!nlh)
                 return -EMSGSIZE;
@@ -515,7 +503,7 @@ static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb)
                     net_eq(ip6addrlbl_net(p), net)) {
                         if ((err = ip6addrlbl_fill(skb, p,
                                                    ip6addrlbl_table.seq,
-                                                   NETLINK_CB(cb->skb).portid,
+                                                   NETLINK_CB(cb->skb).pid,
                                                    cb->nlh->nlmsg_seq,
                                                    RTM_NEWADDRLABEL,
                                                    NLM_F_MULTI)) <= 0)
@@ -586,7 +574,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
         }
 
         err = ip6addrlbl_fill(skb, p, lseq,
-                              NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
+                              NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
                               RTM_NEWADDRLABEL, 0);
 
         ip6addrlbl_put(p);
@@ -597,7 +585,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
                 goto out;
         }
 
-        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
+        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid);
 out:
         return err;
 }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index b043c60429b..4252b3cc183 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -18,7 +18,6 @@
  *      2 of the License, or (at your option) any later version.
  */
 
-#define pr_fmt(fmt) "IPv6: " fmt
 
 #include <linux/module.h>
 #include <linux/capability.h>
@@ -61,8 +60,23 @@
 #endif
 
 #include <asm/uaccess.h>
+#include <asm/system.h>
 #include <linux/mroute6.h>
 
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+#include <linux/android_aid.h>
+
+static inline int current_has_network(void)
+{
+        return in_egroup_p(AID_INET) || capable(CAP_NET_RAW);
+}
+#else
+static inline int current_has_network(void)
+{
+        return 1;
+}
+#endif
+
 MODULE_AUTHOR("Cast of dozens");
 MODULE_DESCRIPTION("IPv6 protocol stack for Linux");
 MODULE_LICENSE("GPL");
@@ -78,7 +92,7 @@ struct ipv6_params ipv6_defaults = {
         .autoconf = 1,
 };
 
-static int disable_ipv6_mod;
+static int disable_ipv6_mod = 0;
 
 module_param_named(disable, disable_ipv6_mod, int, 0444);
 MODULE_PARM_DESC(disable, "Disable IPv6 module such that it is non-functional");
@@ -109,6 +123,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
         int try_loading_module = 0;
         int err;
 
+        if (!current_has_network())
+                return -EACCES;
+
         if (sock->type != SOCK_RAW &&
             sock->type != SOCK_DGRAM &&
             !inet_ehash_secret)
@@ -160,8 +177,7 @@ lookup_protocol:
         }
 
         err = -EPERM;
-        if (sock->type == SOCK_RAW && !kern &&
-            !ns_capable(net->user_ns, CAP_NET_RAW))
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                 goto out_rcu_unlock;
 
         sock->ops = answer->ops;
@@ -182,7 +198,7 @@ lookup_protocol:
         err = 0;
         sk->sk_no_check = answer_no_check;
         if (INET_PROTOSW_REUSE & answer_flags)
-                sk->sk_reuse = SK_CAN_REUSE;
+                sk->sk_reuse = 1;
 
         inet = inet_sk(sk);
         inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
@@ -215,7 +231,6 @@ lookup_protocol:
         inet->mc_ttl    = 1;
         inet->mc_index  = 0;
         inet->mc_list   = NULL;
-        inet->rcv_tos   = 0;
 
         if (ipv4_config.no_pmtu_disc)
                 inet->pmtudisc = IP_PMTUDISC_DONT;
@@ -258,7 +273,7 @@ out_rcu_unlock:
 /* bind for INET6 API */
 int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
-        struct sockaddr_in6 *addr = (struct sockaddr_in6 *)uaddr;
+        struct sockaddr_in6 *addr=(struct sockaddr_in6 *)uaddr;
         struct sock *sk = sock->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -283,7 +298,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 return -EINVAL;
 
         snum = ntohs(addr->sin6_port);
-        if (snum && snum < PROT_SOCK && !ns_capable(net->user_ns, CAP_NET_BIND_SERVICE))
+        if (snum && snum < PROT_SOCK && !capable(CAP_NET_BIND_SERVICE))
                 return -EACCES;
 
         lock_sock(sk);
@@ -349,7 +364,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                          */
                         v4addr = LOOPBACK4_IPV6;
                         if (!(addr_type & IPV6_ADDR_MULTICAST)) {
-                                if (!(inet->freebind || inet->transparent) &&
+                                if (!inet->transparent &&
                                     !ipv6_chk_addr(net, &addr->sin6_addr,
                                                    dev, 0)) {
                                         err = -EADDRNOTAVAIL;
@@ -363,10 +378,10 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         inet->inet_rcv_saddr = v4addr;
         inet->inet_saddr = v4addr;
 
-        np->rcv_saddr = addr->sin6_addr;
+        ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
 
         if (!(addr_type & IPV6_ADDR_MULTICAST))
-                np->saddr = addr->sin6_addr;
+                ipv6_addr_copy(&np->saddr, &addr->sin6_addr);
 
         /* Make sure we are allowed to bind here. */
         if (sk->sk_prot->get_port(sk, snum)) {
@@ -392,6 +407,7 @@ out_unlock:
         rcu_read_unlock();
         goto out;
 }
+
 EXPORT_SYMBOL(inet6_bind);
 
 int inet6_release(struct socket *sock)
@@ -409,6 +425,7 @@ int inet6_release(struct socket *sock)
 
         return inet_release(sock);
 }
+
 EXPORT_SYMBOL(inet6_release);
 
 void inet6_destroy_sock(struct sock *sk)
@@ -419,12 +436,10 @@ void inet6_destroy_sock(struct sock *sk)
 
         /* Release rx options */
 
-        skb = xchg(&np->pktoptions, NULL);
-        if (skb != NULL)
+        if ((skb = xchg(&np->pktoptions, NULL)) != NULL)
                 kfree_skb(skb);
 
-        skb = xchg(&np->rxpmtu, NULL);
-        if (skb != NULL)
+        if ((skb = xchg(&np->rxpmtu, NULL)) != NULL)
                 kfree_skb(skb);
 
         /* Free flowlabels */
@@ -432,10 +447,10 @@ void inet6_destroy_sock(struct sock *sk)
 
         /* Free tx options */
 
-        opt = xchg(&np->opt, NULL);
-        if (opt != NULL)
+        if ((opt = xchg(&np->opt, NULL)) != NULL)
                 sock_kfree_s(sk, opt, opt->tot_len);
 }
+
 EXPORT_SYMBOL_GPL(inet6_destroy_sock);
 
 /*
@@ -445,7 +460,7 @@ EXPORT_SYMBOL_GPL(inet6_destroy_sock);
 int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
                  int *uaddr_len, int peer)
 {
-        struct sockaddr_in6 *sin = (struct sockaddr_in6 *)uaddr;
+        struct sockaddr_in6 *sin=(struct sockaddr_in6 *)uaddr;
         struct sock *sk = sock->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -460,14 +475,14 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
                     peer == 1)
                         return -ENOTCONN;
                 sin->sin6_port = inet->inet_dport;
-                sin->sin6_addr = np->daddr;
+                ipv6_addr_copy(&sin->sin6_addr, &np->daddr);
                 if (np->sndflow)
                         sin->sin6_flowinfo = np->flow_label;
         } else {
                 if (ipv6_addr_any(&np->rcv_saddr))
-                        sin->sin6_addr = np->saddr;
+                        ipv6_addr_copy(&sin->sin6_addr, &np->saddr);
                 else
-                        sin->sin6_addr = np->rcv_saddr;
+                        ipv6_addr_copy(&sin->sin6_addr, &np->rcv_saddr);
 
                 sin->sin6_port = inet->inet_sport;
         }
@@ -476,14 +491,31 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
         *uaddr_len = sizeof(*sin);
         return 0;
 }
+
 EXPORT_SYMBOL(inet6_getname);
 
+int inet6_killaddr_ioctl(struct net *net, void __user *arg) {
+        struct in6_ifreq ireq;
+        struct sockaddr_in6 sin6;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EACCES;
+
+        if (copy_from_user(&ireq, arg, sizeof(struct in6_ifreq)))
+                return -EFAULT;
+
+        sin6.sin6_family = AF_INET6;
+        ipv6_addr_copy(&sin6.sin6_addr, &ireq.ifr6_addr);
+        return tcp_nuke_addr(net, (struct sockaddr *) &sin6);
+}
+
 int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         struct sock *sk = sock->sk;
         struct net *net = sock_net(sk);
 
-        switch (cmd) {
+        switch(cmd)
+        {
         case SIOCGSTAMP:
                 return sock_get_timestamp(sk, (struct timeval __user *)arg);
 
@@ -501,6 +533,8 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 return addrconf_del_ifaddr(net, (void __user *) arg);
         case SIOCSIFDSTADDR:
                 return addrconf_set_dstaddr(net, (void __user *) arg);
+        case SIOCKILLADDR:
+                return inet6_killaddr_ioctl(net, (void __user *) arg);
         default:
                 if (!sk->sk_prot->ioctl)
                         return -ENOIOCTLCMD;
@@ -509,6 +543,7 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         /*NOTREACHED*/
         return 0;
 }
+
 EXPORT_SYMBOL(inet6_ioctl);
 
 const struct proto_ops inet6_stream_ops = {
@@ -614,21 +649,25 @@ out:
         return ret;
 
 out_permanent:
-        pr_err("Attempt to override permanent protocol %d\n", protocol);
+        printk(KERN_ERR "Attempt to override permanent protocol %d.\n",
+               protocol);
         goto out;
 
 out_illegal:
-        pr_err("Ignoring attempt to register invalid socket type %d\n",
+        printk(KERN_ERR
+               "Ignoring attempt to register invalid socket type %d.\n",
                p->type);
         goto out;
 }
+
 EXPORT_SYMBOL(inet6_register_protosw);
 
 void
 inet6_unregister_protosw(struct inet_protosw *p)
 {
         if (INET_PROTOSW_PERMANENT & p->flags) {
-                pr_err("Attempt to unregister permanent protocol %d\n",
+                printk(KERN_ERR
+                       "Attempt to unregister permanent protocol %d.\n",
                        p->protocol);
         } else {
                 spin_lock_bh(&inetsw6_lock);
@@ -638,6 +677,7 @@ inet6_unregister_protosw(struct inet_protosw *p)
                 synchronize_net();
         }
 }
+
 EXPORT_SYMBOL(inet6_unregister_protosw);
 
 int inet6_sk_rebuild_header(struct sock *sk)
@@ -654,8 +694,8 @@ int inet6_sk_rebuild_header(struct sock *sk)
 
                 memset(&fl6, 0, sizeof(fl6));
                 fl6.flowi6_proto = sk->sk_protocol;
-                fl6.daddr = np->daddr;
-                fl6.saddr = np->saddr;
+                ipv6_addr_copy(&fl6.daddr, &np->daddr);
+                ipv6_addr_copy(&fl6.saddr, &np->saddr);
                 fl6.flowlabel = np->flow_label;
                 fl6.flowi6_oif = sk->sk_bound_dev_if;
                 fl6.flowi6_mark = sk->sk_mark;
@@ -677,12 +717,13 @@ int inet6_sk_rebuild_header(struct sock *sk)
 
         return 0;
 }
+
 EXPORT_SYMBOL_GPL(inet6_sk_rebuild_header);
 
-bool ipv6_opt_accepted(const struct sock *sk, const struct sk_buff *skb)
+int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb)
 {
-        const struct ipv6_pinfo *np = inet6_sk(sk);
-        const struct inet6_skb_parm *opt = IP6CB(skb);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct inet6_skb_parm *opt = IP6CB(skb);
 
         if (np->rxopt.all) {
                 if ((opt->hop && (np->rxopt.bits.hopopts ||
@@ -694,15 +735,259 @@ bool ipv6_opt_accepted(const struct sock *sk, const struct sk_buff *skb)
                      np->rxopt.bits.osrcrt)) ||
                     ((opt->dst1 || opt->dst0) &&
                      (np->rxopt.bits.dstopts || np->rxopt.bits.odstopts)))
-                        return true;
+                        return 1;
         }
-        return false;
+        return 0;
 }
+
 EXPORT_SYMBOL_GPL(ipv6_opt_accepted);
 
+static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto)
+{
+        const struct inet6_protocol *ops = NULL;
+
+        for (;;) {
+                struct ipv6_opt_hdr *opth;
+                int len;
+
+                if (proto != NEXTHDR_HOP) {
+                        ops = rcu_dereference(inet6_protos[proto]);
+
+                        if (unlikely(!ops))
+                                break;
+
+                        if (!(ops->flags & INET6_PROTO_GSO_EXTHDR))
+                                break;
+                }
+
+                if (unlikely(!pskb_may_pull(skb, 8)))
+                        break;
+
+                opth = (void *)skb->data;
+                len = ipv6_optlen(opth);
+
+                if (unlikely(!pskb_may_pull(skb, len)))
+                        break;
+
+                proto = opth->nexthdr;
+                __skb_pull(skb, len);
+        }
+
+        return proto;
+}
+
+static int ipv6_gso_send_check(struct sk_buff *skb)
+{
+        const struct ipv6hdr *ipv6h;
+        const struct inet6_protocol *ops;
+        int err = -EINVAL;
+
+        if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
+                goto out;
+
+        ipv6h = ipv6_hdr(skb);
+        __skb_pull(skb, sizeof(*ipv6h));
+        err = -EPROTONOSUPPORT;
+
+        rcu_read_lock();
+        ops = rcu_dereference(inet6_protos[
+                ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr)]);
+
+        if (likely(ops && ops->gso_send_check)) {
+                skb_reset_transport_header(skb);
+                err = ops->gso_send_check(skb);
+        }
+        rcu_read_unlock();
+
+out:
+        return err;
+}
+
+static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, u32 features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        struct ipv6hdr *ipv6h;
+        const struct inet6_protocol *ops;
+        int proto;
+        struct frag_hdr *fptr;
+        unsigned int unfrag_ip6hlen;
+        u8 *prevhdr;
+        int offset = 0;
+
+        if (!(features & NETIF_F_V6_CSUM))
+                features &= ~NETIF_F_SG;
+
+        if (unlikely(skb_shinfo(skb)->gso_type &
+                     ~(SKB_GSO_UDP |
+                       SKB_GSO_DODGY |
+                       SKB_GSO_TCP_ECN |
+                       SKB_GSO_TCPV6 |
+                       0)))
+                goto out;
+
+        if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
+                goto out;
+
+        ipv6h = ipv6_hdr(skb);
+        __skb_pull(skb, sizeof(*ipv6h));
+        segs = ERR_PTR(-EPROTONOSUPPORT);
+
+        proto = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
+        rcu_read_lock();
+        ops = rcu_dereference(inet6_protos[proto]);
+        if (likely(ops && ops->gso_segment)) {
+                skb_reset_transport_header(skb);
+                segs = ops->gso_segment(skb, features);
+        }
+        rcu_read_unlock();
+
+        if (IS_ERR(segs))
+                goto out;
+
+        for (skb = segs; skb; skb = skb->next) {
+                ipv6h = ipv6_hdr(skb);
+                ipv6h->payload_len = htons(skb->len - skb->mac_len -
+                                           sizeof(*ipv6h));
+                if (proto == IPPROTO_UDP) {
+                        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                        fptr = (struct frag_hdr *)(skb_network_header(skb) +
+                                unfrag_ip6hlen);
+                        fptr->frag_off = htons(offset);
+                        if (skb->next != NULL)
+                                fptr->frag_off |= htons(IP6_MF);
+                        offset += (ntohs(ipv6h->payload_len) -
+                                   sizeof(struct frag_hdr));
+                }
+        }
+
+out:
+        return segs;
+}
+
+struct ipv6_gro_cb {
+        struct napi_gro_cb napi;
+        int proto;
+};
+
+#define IPV6_GRO_CB(skb) ((struct ipv6_gro_cb *)(skb)->cb)
+
+static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
+                                         struct sk_buff *skb)
+{
+        const struct inet6_protocol *ops;
+        struct sk_buff **pp = NULL;
+        struct sk_buff *p;
+        struct ipv6hdr *iph;
+        unsigned int nlen;
+        unsigned int hlen;
+        unsigned int off;
+        int flush = 1;
+        int proto;
+        __wsum csum;
+
+        off = skb_gro_offset(skb);
+        hlen = off + sizeof(*iph);
+        iph = skb_gro_header_fast(skb, off);
+        if (skb_gro_header_hard(skb, hlen)) {
+                iph = skb_gro_header_slow(skb, hlen, off);
+                if (unlikely(!iph))
+                        goto out;
+        }
+
+        skb_gro_pull(skb, sizeof(*iph));
+        skb_set_transport_header(skb, skb_gro_offset(skb));
+
+        flush += ntohs(iph->payload_len) != skb_gro_len(skb);
+
+        rcu_read_lock();
+        proto = iph->nexthdr;
+        ops = rcu_dereference(inet6_protos[proto]);
+        if (!ops || !ops->gro_receive) {
+                __pskb_pull(skb, skb_gro_offset(skb));
+                proto = ipv6_gso_pull_exthdrs(skb, proto);
+                skb_gro_pull(skb, -skb_transport_offset(skb));
+                skb_reset_transport_header(skb);
+                __skb_push(skb, skb_gro_offset(skb));
+
+                ops = rcu_dereference(inet6_protos[proto]);
+                if (!ops || !ops->gro_receive)
+                        goto out_unlock;
+
+                iph = ipv6_hdr(skb);
+        }
+
+        IPV6_GRO_CB(skb)->proto = proto;
+
+        flush--;
+        nlen = skb_network_header_len(skb);
+
+        for (p = *head; p; p = p->next) {
+                struct ipv6hdr *iph2;
+
+                if (!NAPI_GRO_CB(p)->same_flow)
+                        continue;
+
+                iph2 = ipv6_hdr(p);
+
+                /* All fields must match except length. */
+                if (nlen != skb_network_header_len(p) ||
+                    memcmp(iph, iph2, offsetof(struct ipv6hdr, payload_len)) ||
+                    memcmp(&iph->nexthdr, &iph2->nexthdr,
+                           nlen - offsetof(struct ipv6hdr, nexthdr))) {
+                        NAPI_GRO_CB(p)->same_flow = 0;
+                        continue;
+                }
+
+                NAPI_GRO_CB(p)->flush |= flush;
+        }
+
+        NAPI_GRO_CB(skb)->flush |= flush;
+
+        csum = skb->csum;
+        skb_postpull_rcsum(skb, iph, skb_network_header_len(skb));
+
+        pp = ops->gro_receive(head, skb);
+
+        skb->csum = csum;
+
+out_unlock:
+        rcu_read_unlock();
+
+out:
+        NAPI_GRO_CB(skb)->flush |= flush;
+
+        return pp;
+}
+
+static int ipv6_gro_complete(struct sk_buff *skb)
+{
+        const struct inet6_protocol *ops;
+        struct ipv6hdr *iph = ipv6_hdr(skb);
+        int err = -ENOSYS;
+
+        iph->payload_len = htons(skb->len - skb_network_offset(skb) -
+                                 sizeof(*iph));
+
+        rcu_read_lock();
+        ops = rcu_dereference(inet6_protos[IPV6_GRO_CB(skb)->proto]);
+        if (WARN_ON(!ops || !ops->gro_complete))
+                goto out_unlock;
+
+        err = ops->gro_complete(skb);
+
+out_unlock:
+        rcu_read_unlock();
+
+        return err;
+}
+
 static struct packet_type ipv6_packet_type __read_mostly = {
         .type = cpu_to_be16(ETH_P_IPV6),
         .func = ipv6_rcv,
+        .gso_send_check = ipv6_gso_send_check,
+        .gso_segment = ipv6_gso_segment,
+        .gro_receive = ipv6_gro_receive,
+        .gro_complete = ipv6_gro_complete,
 };
 
 static int __init ipv6_packet_init(void)
@@ -734,9 +1019,9 @@ static int __net_init ipv6_init_mibs(struct net *net)
                           sizeof(struct icmpv6_mib),
                           __alignof__(struct icmpv6_mib)) < 0)
                 goto err_icmp_mib;
-        net->mib.icmpv6msg_statistics = kzalloc(sizeof(struct icmpv6msg_mib),
-                                                GFP_KERNEL);
-        if (!net->mib.icmpv6msg_statistics)
+        if (snmp_mib_init((void __percpu **)net->mib.icmpv6msg_statistics,
+                          sizeof(struct icmpv6msg_mib),
+                          __alignof__(struct icmpv6msg_mib)) < 0)
                 goto err_icmpmsg_mib;
         return 0;
 
@@ -757,7 +1042,7 @@ static void ipv6_cleanup_mibs(struct net *net)
         snmp_mib_free((void __percpu **)net->mib.udplite_stats_in6);
         snmp_mib_free((void __percpu **)net->mib.ipv6_statistics);
         snmp_mib_free((void __percpu **)net->mib.icmpv6_statistics);
-        kfree(net->mib.icmpv6msg_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmpv6msg_statistics);
 }
 
 static int __net_init inet6_net_init(struct net *net)
@@ -818,11 +1103,13 @@ static int __init inet6_init(void)
         BUILD_BUG_ON(sizeof(struct inet6_skb_parm) > sizeof(dummy_skb->cb));
 
         /* Register the socket-side information for inet6_create.  */
-        for (r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
+        for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
                 INIT_LIST_HEAD(r);
 
         if (disable_ipv6_mod) {
-                pr_info("Loaded, but administratively disabled, reboot required to enable\n");
+                printk(KERN_INFO
+                       "IPv6: Loaded, but administratively disabled, "
+                       "reboot required to enable\n");
                 goto out;
         }
 
@@ -857,8 +1144,11 @@ static int __init inet6_init(void)
         if (err)
                 goto out_sock_register_fail;
 
-        tcpv6_prot.sysctl_mem = init_net.ipv4.sysctl_tcp_mem;
-
+#ifdef CONFIG_SYSCTL
+        err = ipv6_static_sysctl_register();
+        if (err)
+                goto static_sysctl_fail;
+#endif
         /*
          *      ipngwg API draft makes clear that the correct semantics
          *      for TCP and UDP is to consider one TCP and UDP instance
@@ -983,6 +1273,10 @@ ipmr_fail:
 icmp_fail:
         unregister_pernet_subsys(&inet6_net_ops);
 register_pernet_fail:
+#ifdef CONFIG_SYSCTL
+        ipv6_static_sysctl_unregister();
+static_sysctl_fail:
+#endif
         sock_unregister(PF_INET6);
         rtnl_unregister_all(PF_INET6);
 out_sock_register_fail:
@@ -1009,6 +1303,9 @@ static void __exit inet6_exit(void)
         /* Disallow any further netlink messages */
         rtnl_unregister_all(PF_INET6);
 
+#ifdef CONFIG_SYSCTL
+        ipv6_sysctl_unregister();
+#endif
         udpv6_exit();
         udplitev6_exit();
         tcpv6_exit();
@@ -1036,6 +1333,9 @@ static void __exit inet6_exit(void)
         rawv6_exit();
 
         unregister_pernet_subsys(&inet6_net_ops);
+#ifdef CONFIG_SYSCTL
+        ipv6_static_sysctl_unregister();
+#endif
         proto_unregister(&rawv6_prot);
         proto_unregister(&udplitev6_prot);
         proto_unregister(&udpv6_prot);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index ecc35b93314..4c0f894d084 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -24,8 +24,6 @@
  *      This file is derived from net/ipv4/ah.c.
  */
 
-#define pr_fmt(fmt) "IPv6: " fmt
-
 #include <crypto/hash.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -35,7 +33,6 @@
 #include <linux/pfkeyv2.h>
 #include <linux/string.h>
 #include <linux/scatterlist.h>
-#include <net/ip6_route.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
@@ -44,7 +41,7 @@
 #define IPV6HDR_BASELEN 8
 
 struct tmp_ext {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 struct in6_addr saddr;
 #endif
                 struct in6_addr daddr;
@@ -114,7 +111,7 @@ static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
                              __alignof__(struct scatterlist));
 }
 
-static bool zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
+static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
 {
         u8 *opt = (u8 *)opthdr;
         int len = ipv6_optlen(opthdr);
@@ -128,7 +125,7 @@ static bool zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
 
                 switch (opt[off]) {
 
-                case IPV6_TLV_PAD1:
+                case IPV6_TLV_PAD0:
                         optlen = 1;
                         break;
                 default:
@@ -146,13 +143,13 @@ static bool zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
                 len -= optlen;
         }
         if (len == 0)
-                return true;
+                return 1;
 
 bad:
-        return false;
+        return 0;
 }
 
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 /**
  *      ipv6_rearrange_destopt - rearrange IPv6 destination options header
  *      @iph: IPv6 header
@@ -172,7 +169,7 @@ static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *des
 
                 switch (opt[off]) {
 
-                case IPV6_TLV_PAD1:
+                case IPV6_TLV_PAD0:
                         optlen = 1;
                         break;
                 default:
@@ -192,13 +189,13 @@ static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *des
 
                                 hao = (struct ipv6_destopt_hao *)&opt[off];
                                 if (hao->length != sizeof(hao->addr)) {
-                                        net_warn_ratelimited("destopt hao: invalid header length: %u\n",
-                                                             hao->length);
+                                        if (net_ratelimit())
+                                                printk(KERN_WARNING "destopt hao: invalid header length: %u\n", hao->length);
                                         goto bad;
                                 }
-                                final_addr = hao->addr;
-                                hao->addr = iph->saddr;
-                                iph->saddr = final_addr;
+                                ipv6_addr_copy(&final_addr, &hao->addr);
+                                ipv6_addr_copy(&hao->addr, &iph->saddr);
+                                ipv6_addr_copy(&iph->saddr, &final_addr);
                         }
                         break;
                 }
@@ -244,13 +241,13 @@ static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
         segments = rthdr->hdrlen >> 1;
 
         addrs = ((struct rt0_hdr *)rthdr)->addr;
-        final_addr = addrs[segments - 1];
+        ipv6_addr_copy(&final_addr, addrs + segments - 1);
 
         addrs += segments - segments_left;
         memmove(addrs + 1, addrs, (segments_left - 1) * sizeof(*addrs));
 
-        addrs[0] = iph->daddr;
-        iph->daddr = final_addr;
+        ipv6_addr_copy(addrs, &iph->daddr);
+        ipv6_addr_copy(&iph->daddr, &final_addr);
 }
 
 static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
@@ -320,7 +317,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
         memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
 
         if (extlen) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 memcpy(&top_iph->saddr, iph_ext, extlen);
 #else
                 memcpy(&top_iph->daddr, iph_ext, extlen);
@@ -385,7 +382,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
 
         if (extlen) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 memcpy(iph_ext, &top_iph->saddr, extlen);
 #else
                 memcpy(iph_ext, &top_iph->daddr, extlen);
@@ -434,7 +431,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
 
         if (extlen) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 memcpy(&top_iph->saddr, iph_ext, extlen);
 #else
                 memcpy(&top_iph->daddr, iph_ext, extlen);
@@ -613,18 +610,16 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct xfrm_state *x;
 
         if (type != ICMPV6_DEST_UNREACH &&
-            type != ICMPV6_PKT_TOOBIG &&
-            type != NDISC_REDIRECT)
+            type != ICMPV6_PKT_TOOBIG)
                 return;
 
         x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
         if (!x)
                 return;
 
-        if (type == NDISC_REDIRECT)
-                ip6_redirect(skb, net, 0, 0);
-        else
-                ip6_update_pmtu(skb, net, info, 0, 0);
+        NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/%pI6\n",
+                 ntohl(ah->spi), &iph->daddr);
+
         xfrm_state_put(x);
 }
 
@@ -664,9 +659,9 @@ static int ah6_init_state(struct xfrm_state *x)
 
         if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
             crypto_ahash_digestsize(ahash)) {
-                pr_info("AH: %s digestsize %u != %hu\n",
-                        x->aalg->alg_name, crypto_ahash_digestsize(ahash),
-                        aalg_desc->uinfo.auth.icv_fullbits/8);
+                printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
+                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
+                       aalg_desc->uinfo.auth.icv_fullbits/8);
                 goto error;
         }
 
@@ -732,12 +727,12 @@ static const struct inet6_protocol ah6_protocol = {
 static int __init ah6_init(void)
 {
         if (xfrm_register_type(&ah6_type, AF_INET6) < 0) {
-                pr_info("%s: can't add xfrm type\n", __func__);
+                printk(KERN_INFO "ipv6 ah init: can't add xfrm type\n");
                 return -EAGAIN;
         }
 
         if (inet6_add_protocol(&ah6_protocol, IPPROTO_AH) < 0) {
-                pr_info("%s: can't add protocol\n", __func__);
+                printk(KERN_INFO "ipv6 ah init: can't add protocol\n");
                 xfrm_unregister_type(&ah6_type, AF_INET6);
                 return -EAGAIN;
         }
@@ -748,10 +743,10 @@ static int __init ah6_init(void)
 static void __exit ah6_fini(void)
 {
         if (inet6_del_protocol(&ah6_protocol, IPPROTO_AH) < 0)
-                pr_info("%s: can't remove protocol\n", __func__);
+                printk(KERN_INFO "ipv6 ah close: can't remove protocol\n");
 
         if (xfrm_unregister_type(&ah6_type, AF_INET6) < 0)
-                pr_info("%s: can't remove xfrm type\n", __func__);
+                printk(KERN_INFO "ipv6 ah close: can't remove xfrm type\n");
 
 }
 
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 757a810d8f1..674255f5e6b 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -64,7 +64,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
         int     ishost = !net->ipv6.devconf_all->forwarding;
         int     err = 0;
 
-        if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
         if (ipv6_addr_is_multicast(addr))
                 return -EINVAL;
@@ -75,7 +75,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
         if (pac == NULL)
                 return -ENOMEM;
         pac->acl_next = NULL;
-        pac->acl_addr = *addr;
+        ipv6_addr_copy(&pac->acl_addr, addr);
 
         rcu_read_lock();
         if (ifindex == 0) {
@@ -83,8 +83,8 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 
                 rt = rt6_lookup(net, addr, NULL, 0, 0);
                 if (rt) {
-                        dev = rt->dst.dev;
-                        ip6_rt_put(rt);
+                        dev = rt->rt6i_dev;
+                        dst_release(&rt->dst);
                 } else if (ishost) {
                         err = -EADDRNOTAVAIL;
                         goto error;
@@ -189,9 +189,6 @@ void ipv6_sock_ac_close(struct sock *sk)
         struct net *net = sock_net(sk);
         int     prev_index;
 
-        if (!np->ipv6_ac_list)
-                return;
-
         write_lock_bh(&ipv6_sk_ac_lock);
         pac = np->ipv6_ac_list;
         np->ipv6_ac_list = NULL;
@@ -214,6 +211,35 @@ void ipv6_sock_ac_close(struct sock *sk)
         rcu_read_unlock();
 }
 
+#if 0
+/* The function is not used, which is funny. Apparently, author
+ * supposed to use it to filter out datagrams inside udp/raw but forgot.
+ *
+ * It is OK, anycasts are not special comparing to delivery to unicasts.
+ */
+
+int inet6_ac_check(struct sock *sk, struct in6_addr *addr, int ifindex)
+{
+        struct ipv6_ac_socklist *pac;
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        int     found;
+
+        found = 0;
+        read_lock(&ipv6_sk_ac_lock);
+        for (pac=np->ipv6_ac_list; pac; pac=pac->acl_next) {
+                if (ifindex && pac->acl_ifindex != ifindex)
+                        continue;
+                found = ipv6_addr_equal(&pac->acl_addr, addr);
+                if (found)
+                        break;
+        }
+        read_unlock(&ipv6_sk_ac_lock);
+
+        return found;
+}
+
+#endif
+
 static void aca_put(struct ifacaddr6 *ac)
 {
         if (atomic_dec_and_test(&ac->aca_refcnt)) {
@@ -263,14 +289,14 @@ int ipv6_dev_ac_inc(struct net_device *dev, const struct in6_addr *addr)
                 goto out;
         }
 
-        rt = addrconf_dst_alloc(idev, addr, true);
+        rt = addrconf_dst_alloc(idev, addr, 1);
         if (IS_ERR(rt)) {
                 kfree(aca);
                 err = PTR_ERR(rt);
                 goto out;
         }
 
-        aca->aca_addr = *addr;
+        ipv6_addr_copy(&aca->aca_addr, addr);
         aca->aca_idev = idev;
         aca->aca_rt = rt;
         aca->aca_users = 1;
@@ -345,7 +371,7 @@ static int ipv6_dev_ac_dec(struct net_device *dev, const struct in6_addr *addr)
  *      check if the interface has this anycast address
  *      called with rcu_read_lock()
  */
-static bool ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *addr)
+static int ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *addr)
 {
         struct inet6_dev *idev;
         struct ifacaddr6 *aca;
@@ -359,16 +385,16 @@ static bool ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *ad
                 read_unlock_bh(&idev->lock);
                 return aca != NULL;
         }
-        return false;
+        return 0;
 }
 
 /*
  *      check if given interface (or any, if dev==0) has this anycast address
  */
-bool ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
-                         const struct in6_addr *addr)
+int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
+                        const struct in6_addr *addr)
 {
-        bool found = false;
+        int found = 0;
 
         rcu_read_lock();
         if (dev)
@@ -376,7 +402,7 @@ bool ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
         else
                 for_each_netdev_rcu(net, dev)
                         if (ipv6_chk_acast_dev(dev, addr)) {
-                                found = true;
+                                found = 1;
                                 break;
                         }
         rcu_read_unlock();
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 8edf2601065..b46e9f88ce3 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -22,7 +22,6 @@
 #include <linux/ipv6.h>
 #include <linux/route.h>
 #include <linux/slab.h>
-#include <linux/export.h>
 
 #include <net/ipv6.h>
 #include <net/ndisc.h>
@@ -34,9 +33,9 @@
 #include <linux/errqueue.h>
 #include <asm/uaccess.h>
 
-static bool ipv6_mapped_addr_any(const struct in6_addr *a)
+static inline int ipv6_mapped_addr_any(const struct in6_addr *a)
 {
-        return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0);
+        return (ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0));
 }
 
 int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
@@ -72,7 +71,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                         if (flowlabel == NULL)
                                 return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
+                        ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
                 }
         }
 
@@ -99,7 +98,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                 sin.sin_port = usin->sin6_port;
 
                 err = ip4_datagram_connect(sk,
-                                           (struct sockaddr *) &sin,
+                                           (struct sockaddr*) &sin,
                                            sizeof(sin));
 
 ipv4_connected:
@@ -144,7 +143,7 @@ ipv4_connected:
                 }
         }
 
-        np->daddr = *daddr;
+        ipv6_addr_copy(&np->daddr, daddr);
         np->flow_label = fl6.flowlabel;
 
         inet->inet_dport = usin->sin6_port;
@@ -155,8 +154,8 @@ ipv4_connected:
          */
 
         fl6.flowi6_proto = sk->sk_protocol;
-        fl6.daddr = np->daddr;
-        fl6.saddr = np->saddr;
+        ipv6_addr_copy(&fl6.daddr, &np->daddr);
+        ipv6_addr_copy(&fl6.saddr, &np->saddr);
         fl6.flowi6_oif = sk->sk_bound_dev_if;
         fl6.flowi6_mark = sk->sk_mark;
         fl6.fl6_dport = inet->inet_dport;
@@ -180,10 +179,10 @@ ipv4_connected:
         /* source address lookup done in ip6_dst_lookup */
 
         if (ipv6_addr_any(&np->saddr))
-                np->saddr = fl6.saddr;
+                ipv6_addr_copy(&np->saddr, &fl6.saddr);
 
         if (ipv6_addr_any(&np->rcv_saddr)) {
-                np->rcv_saddr = fl6.saddr;
+                ipv6_addr_copy(&np->rcv_saddr, &fl6.saddr);
                 inet->inet_rcv_saddr = LOOPBACK4_IPV6;
                 if (sk->sk_prot->rehash)
                         sk->sk_prot->rehash(sk);
@@ -203,7 +202,6 @@ out:
         fl6_sock_release(flowlabel);
         return err;
 }
-EXPORT_SYMBOL_GPL(ip6_datagram_connect);
 
 void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
                      __be16 port, u32 info, u8 *payload)
@@ -259,7 +257,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info)
         skb_put(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         iph = ipv6_hdr(skb);
-        iph->daddr = fl6->daddr;
+        ipv6_addr_copy(&iph->daddr, &fl6->daddr);
 
         serr = SKB_EXT_ERR(skb);
         serr->ee.ee_errno = err;
@@ -296,16 +294,20 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
         skb_put(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         iph = ipv6_hdr(skb);
-        iph->daddr = fl6->daddr;
+        ipv6_addr_copy(&iph->daddr, &fl6->daddr);
 
         mtu_info = IP6CBMTU(skb);
+        if (!mtu_info) {
+                kfree_skb(skb);
+                return;
+        }
 
         mtu_info->ip6m_mtu = mtu;
         mtu_info->ip6m_addr.sin6_family = AF_INET6;
         mtu_info->ip6m_addr.sin6_port = 0;
         mtu_info->ip6m_addr.sin6_flowinfo = 0;
         mtu_info->ip6m_addr.sin6_scope_id = fl6->flowi6_oif;
-        mtu_info->ip6m_addr.sin6_addr = ipv6_hdr(skb)->daddr;
+        ipv6_addr_copy(&mtu_info->ip6m_addr.sin6_addr, &ipv6_hdr(skb)->daddr);
 
         __skb_pull(skb, skb_tail_pointer(skb) - skb->data);
         skb_reset_transport_header(skb);
@@ -356,8 +358,8 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_port = serr->port;
                 sin->sin6_scope_id = 0;
                 if (skb->protocol == htons(ETH_P_IPV6)) {
-                        sin->sin6_addr =
-                                *(struct in6_addr *)(nh + serr->addr_offset);
+                        ipv6_addr_copy(&sin->sin6_addr,
+                                  (struct in6_addr *)(nh + serr->addr_offset));
                         if (np->sndflow)
                                 sin->sin6_flowinfo =
                                         (*(__be32 *)(nh + serr->addr_offset - 24) &
@@ -378,7 +380,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_flowinfo = 0;
                 sin->sin6_scope_id = 0;
                 if (skb->protocol == htons(ETH_P_IPV6)) {
-                        sin->sin6_addr = ipv6_hdr(skb)->saddr;
+                        ipv6_addr_copy(&sin->sin6_addr, &ipv6_hdr(skb)->saddr);
                         if (np->rxopt.all)
                                 datagram_recv_ctl(sk, msg, skb);
                         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
@@ -416,7 +418,6 @@ out_free_skb:
 out:
         return err;
 }
-EXPORT_SYMBOL_GPL(ipv6_recv_error);
 
 /*
  *      Handle IPV6_RECVPATHMTU
@@ -454,7 +455,7 @@ int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_flowinfo = 0;
                 sin->sin6_port = 0;
                 sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
-                sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr;
+                ipv6_addr_copy(&sin->sin6_addr, &mtu_info.ip6m_addr.sin6_addr);
         }
 
         put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);
@@ -478,7 +479,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
                 struct in6_pktinfo src_info;
 
                 src_info.ipi6_ifindex = opt->iif;
-                src_info.ipi6_addr = ipv6_hdr(skb)->daddr;
+                ipv6_addr_copy(&src_info.ipi6_addr, &ipv6_hdr(skb)->daddr);
                 put_cmsg(msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info);
         }
 
@@ -488,7 +489,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
         }
 
         if (np->rxopt.bits.rxtclass) {
-                int tclass = ipv6_tclass(ipv6_hdr(skb));
+                int tclass = (ntohl(*(__be32 *)ipv6_hdr(skb)) >> 20) & 0xff;
                 put_cmsg(msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
         }
 
@@ -518,10 +519,10 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
                 u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 
                 while (off <= opt->lastopt) {
-                        unsigned int len;
+                        unsigned len;
                         u8 *ptr = nh + off;
 
-                        switch (nexthdr) {
+                        switch(nexthdr) {
                         case IPPROTO_DSTOPTS:
                                 nexthdr = ptr[0];
                                 len = (ptr[1] + 1) << 3;
@@ -553,7 +554,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
                 struct in6_pktinfo src_info;
 
                 src_info.ipi6_ifindex = opt->iif;
-                src_info.ipi6_addr = ipv6_hdr(skb)->daddr;
+                ipv6_addr_copy(&src_info.ipi6_addr, &ipv6_hdr(skb)->daddr);
                 put_cmsg(msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
         }
         if (np->rxopt.bits.rxohlim) {
@@ -578,7 +579,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
         }
         if (np->rxopt.bits.rxorigdstaddr) {
                 struct sockaddr_in6 sin6;
-                __be16 *ports = (__be16 *) skb_transport_header(skb);
+                u16 *ports = (u16 *) skb_transport_header(skb);
 
                 if (skb_transport_offset(skb) + 4 <= skb->len) {
                         /* All current transport protocols have the port numbers in the
@@ -587,7 +588,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
                          */
 
                         sin6.sin6_family = AF_INET6;
-                        sin6.sin6_addr = ipv6_hdr(skb)->daddr;
+                        ipv6_addr_copy(&sin6.sin6_addr, &ipv6_hdr(skb)->daddr);
                         sin6.sin6_port = ports[1];
                         sin6.sin6_flowinfo = 0;
                         sin6.sin6_scope_id = 0;
@@ -657,12 +658,12 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
 
                         if (addr_type != IPV6_ADDR_ANY) {
                                 int strict = __ipv6_addr_src_scope(addr_type) <= IPV6_ADDR_SCOPE_LINKLOCAL;
-                                if (!(inet_sk(sk)->freebind || inet_sk(sk)->transparent) &&
+                                if (!inet_sk(sk)->transparent &&
                                     !ipv6_chk_addr(net, &src_info->ipi6_addr,
                                                    strict ? dev : NULL, 0))
                                         err = -EINVAL;
                                 else
-                                        fl6->saddr = src_info->ipi6_addr;
+                                        ipv6_addr_copy(&fl6->saddr, &src_info->ipi6_addr);
                         }
 
                         rcu_read_unlock();
@@ -701,7 +702,7 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
                                 err = -EINVAL;
                                 goto exit_f;
                         }
-                        if (!ns_capable(net->user_ns, CAP_NET_RAW)) {
+                        if (!capable(CAP_NET_RAW)) {
                                 err = -EPERM;
                                 goto exit_f;
                         }
@@ -721,7 +722,7 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
                                 err = -EINVAL;
                                 goto exit_f;
                         }
-                        if (!ns_capable(net->user_ns, CAP_NET_RAW)) {
+                        if (!capable(CAP_NET_RAW)) {
                                 err = -EPERM;
                                 goto exit_f;
                         }
@@ -746,7 +747,7 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
                                 err = -EINVAL;
                                 goto exit_f;
                         }
-                        if (!ns_capable(net->user_ns, CAP_NET_RAW)) {
+                        if (!capable(CAP_NET_RAW)) {
                                 err = -EPERM;
                                 goto exit_f;
                         }
@@ -769,7 +770,7 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
                         rthdr = (struct ipv6_rt_hdr *)CMSG_DATA(cmsg);
 
                         switch (rthdr->type) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         case IPV6_SRCRT_TYPE_2:
                                 if (rthdr->hdrlen != 2 ||
                                     rthdr->segments_left != 1) {
@@ -830,8 +831,9 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
                         int tc;
 
                         err = -EINVAL;
-                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
+                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
                                 goto exit_f;
+                        }
 
                         tc = *(int *)CMSG_DATA(cmsg);
                         if (tc < -1 || tc > 0xff)
@@ -848,8 +850,9 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
                         int df;
 
                         err = -EINVAL;
-                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
+                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
                                 goto exit_f;
+                        }
 
                         df = *(int *)CMSG_DATA(cmsg);
                         if (df < 0 || df > 1)
@@ -871,4 +874,3 @@ int datagram_send_ctl(struct net *net, struct sock *sk,
 exit_f:
         return err;
 }
-EXPORT_SYMBOL_GPL(datagram_send_ctl);
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 282f3723ee1..1ac7938dd9e 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -24,8 +24,6 @@
  *      This file is derived from net/ipv4/esp.c
  */
 
-#define pr_fmt(fmt) "IPv6: " fmt
-
 #include <crypto/aead.h>
 #include <crypto/authenc.h>
 #include <linux/err.h>
@@ -39,7 +37,6 @@
 #include <linux/random.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
-#include <net/ip6_route.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
@@ -167,6 +164,8 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         struct esp_data *esp = x->data;
 
         /* skb is pure payload to encrypt */
+        err = -ENOMEM;
+
         aead = esp->aead;
         alen = crypto_aead_authsize(aead);
 
@@ -201,10 +200,8 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         }
 
         tmp = esp_alloc_tmp(aead, nfrags + sglists, seqhilen);
-        if (!tmp) {
-                err = -ENOMEM;
+        if (!tmp)
                 goto error;
-        }
 
         seqhi = esp_tmp_seqhi(tmp);
         iv = esp_tmp_iv(aead, tmp, seqhilen);
@@ -414,15 +411,19 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
         struct esp_data *esp = x->data;
         u32 blksize = ALIGN(crypto_aead_blocksize(esp->aead), 4);
         u32 align = max_t(u32, blksize, esp->padlen);
-        unsigned int net_adj;
+        u32 rem;
 
-        if (x->props.mode != XFRM_MODE_TUNNEL)
-                net_adj = sizeof(struct ipv6hdr);
-        else
-                net_adj = 0;
+        mtu -= x->props.header_len + crypto_aead_authsize(esp->aead);
+        rem = mtu & (align - 1);
+        mtu &= ~(align - 1);
+
+        if (x->props.mode != XFRM_MODE_TUNNEL) {
+                u32 padsize = ((blksize - 1) & 7) + 1;
+                mtu -= blksize - padsize;
+                mtu += min_t(u32, blksize - padsize, rem);
+        }
 
-        return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
-                 net_adj) & ~(align - 1)) + (net_adj - 2);
+        return mtu - 2;
 }
 
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
@@ -434,19 +435,15 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct xfrm_state *x;
 
         if (type != ICMPV6_DEST_UNREACH &&
-            type != ICMPV6_PKT_TOOBIG &&
-            type != NDISC_REDIRECT)
+            type != ICMPV6_PKT_TOOBIG)
                 return;
 
         x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
                               esph->spi, IPPROTO_ESP, AF_INET6);
         if (!x)
                 return;
-
-        if (type == NDISC_REDIRECT)
-                ip6_redirect(skb, net, 0, 0);
-        else
-                ip6_update_pmtu(skb, net, info, 0, 0);
+        printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%pI6\n",
+                        ntohl(esph->spi), &iph->daddr);
         xfrm_state_put(x);
 }
 
@@ -654,11 +651,11 @@ static const struct inet6_protocol esp6_protocol = {
 static int __init esp6_init(void)
 {
         if (xfrm_register_type(&esp6_type, AF_INET6) < 0) {
-                pr_info("%s: can't add xfrm type\n", __func__);
+                printk(KERN_INFO "ipv6 esp init: can't add xfrm type\n");
                 return -EAGAIN;
         }
         if (inet6_add_protocol(&esp6_protocol, IPPROTO_ESP) < 0) {
-                pr_info("%s: can't add protocol\n", __func__);
+                printk(KERN_INFO "ipv6 esp init: can't add protocol\n");
                 xfrm_unregister_type(&esp6_type, AF_INET6);
                 return -EAGAIN;
         }
@@ -669,9 +666,9 @@ static int __init esp6_init(void)
 static void __exit esp6_fini(void)
 {
         if (inet6_del_protocol(&esp6_protocol, IPPROTO_ESP) < 0)
-                pr_info("%s: can't remove protocol\n", __func__);
+                printk(KERN_INFO "ipv6 esp close: can't remove protocol\n");
         if (xfrm_unregister_type(&esp6_type, AF_INET6) < 0)
-                pr_info("%s: can't remove xfrm type\n", __func__);
+                printk(KERN_INFO "ipv6 esp close: can't remove xfrm type\n");
 }
 
 module_init(esp6_init);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 473f628f9f2..79a485e8a70 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -30,7 +30,6 @@
 #include <linux/in6.h>
 #include <linux/icmpv6.h>
 #include <linux/slab.h>
-#include <linux/export.h>
 
 #include <net/dst.h>
 #include <net/sock.h>
@@ -43,23 +42,67 @@
 #include <net/ndisc.h>
 #include <net/ip6_route.h>
 #include <net/addrconf.h>
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 #include <net/xfrm.h>
 #endif
 
 #include <asm/uaccess.h>
 
+int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
+{
+        const unsigned char *nh = skb_network_header(skb);
+        int packet_len = skb->tail - skb->network_header;
+        struct ipv6_opt_hdr *hdr;
+        int len;
+
+        if (offset + 2 > packet_len)
+                goto bad;
+        hdr = (struct ipv6_opt_hdr *)(nh + offset);
+        len = ((hdr->hdrlen + 1) << 3);
+
+        if (offset + len > packet_len)
+                goto bad;
+
+        offset += 2;
+        len -= 2;
+
+        while (len > 0) {
+                int opttype = nh[offset];
+                int optlen;
+
+                if (opttype == type)
+                        return offset;
+
+                switch (opttype) {
+                case IPV6_TLV_PAD0:
+                        optlen = 1;
+                        break;
+                default:
+                        optlen = nh[offset + 1] + 2;
+                        if (optlen > len)
+                                goto bad;
+                        break;
+                }
+                offset += optlen;
+                len -= optlen;
+        }
+        /* not_found */
+ bad:
+        return -1;
+}
+EXPORT_SYMBOL_GPL(ipv6_find_tlv);
+
 /*
  *      Parsing tlv encoded headers.
  *
- *      Parsing function "func" returns true, if parsing succeed
- *      and false, if it failed.
+ *      Parsing function "func" returns 1, if parsing succeed
+ *      and 0, if it failed.
  *      It MUST NOT touch skb->h.
  */
 
 struct tlvtype_proc {
         int     type;
-        bool    (*func)(struct sk_buff *skb, int offset);
+        int     (*func)(struct sk_buff *skb, int offset);
 };
 
 /*********************
@@ -68,11 +111,11 @@ struct tlvtype_proc {
 
 /* An unknown option is detected, decide what to do */
 
-static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
+static int ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
 {
         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
         case 0: /* ignore */
-                return true;
+                return 1;
 
         case 1: /* drop packet */
                 break;
@@ -85,22 +128,21 @@ static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
                         break;
         case 2: /* send ICMP PARM PROB regardless and drop packet */
                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
-                return false;
+                return 0;
         }
 
         kfree_skb(skb);
-        return false;
+        return 0;
 }
 
 /* Parse tlv encoded option header (hop-by-hop or destination) */
 
-static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
+static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
 {
-        const struct tlvtype_proc *curr;
+        struct tlvtype_proc *curr;
         const unsigned char *nh = skb_network_header(skb);
         int off = skb_network_header_len(skb);
         int len = (skb_transport_header(skb)[1] + 1) << 3;
-        int padlen = 0;
 
         if (skb_transport_offset(skb) + len > skb_headlen(skb))
                 goto bad;
@@ -110,33 +152,13 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
 
         while (len > 0) {
                 int optlen = nh[off + 1] + 2;
-                int i;
 
                 switch (nh[off]) {
-                case IPV6_TLV_PAD1:
+                case IPV6_TLV_PAD0:
                         optlen = 1;
-                        padlen++;
-                        if (padlen > 7)
-                                goto bad;
                         break;
 
                 case IPV6_TLV_PADN:
-                        /* RFC 2460 states that the purpose of PadN is
-                         * to align the containing header to multiples
-                         * of 8. 7 is therefore the highest valid value.
-                         * See also RFC 4942, Section 2.1.9.5.
-                         */
-                        padlen += optlen;
-                        if (padlen > 7)
-                                goto bad;
-                        /* RFC 4942 recommends receiving hosts to
-                         * actively check PadN payload to contain
-                         * only zeroes.
-                         */
-                        for (i = 2; i < optlen; i++) {
-                                if (nh[off + i] != 0)
-                                        goto bad;
-                        }
                         break;
 
                 default: /* Other TLV code so scan list */
@@ -147,41 +169,33 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
                                         /* type specific length/alignment
                                            checks will be performed in the
                                            func(). */
-                                        if (curr->func(skb, off) == false)
-                                                return false;
+                                        if (curr->func(skb, off) == 0)
+                                                return 0;
                                         break;
                                 }
                         }
                         if (curr->type < 0) {
                                 if (ip6_tlvopt_unknown(skb, off) == 0)
-                                        return false;
+                                        return 0;
                         }
-                        padlen = 0;
                         break;
                 }
                 off += optlen;
                 len -= optlen;
         }
-        /* This case will not be caught by above check since its padding
-         * length is smaller than 7:
-         * 1 byte NH + 1 byte Length + 6 bytes Padding
-         */
-        if ((padlen == 6) && ((off - skb_network_header_len(skb)) == 8))
-                goto bad;
-
         if (len == 0)
-                return true;
+                return 1;
 bad:
         kfree_skb(skb);
-        return false;
+        return 0;
 }
 
 /*****************************
   Destination options header.
  *****************************/
 
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
-static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+static int ipv6_dest_hao(struct sk_buff *skb, int optoff)
 {
         struct ipv6_destopt_hao *hao;
         struct inet6_skb_parm *opt = IP6CB(skb);
@@ -228,23 +242,23 @@ static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
         if (skb->ip_summed == CHECKSUM_COMPLETE)
                 skb->ip_summed = CHECKSUM_NONE;
 
-        tmp_addr = ipv6h->saddr;
-        ipv6h->saddr = hao->addr;
-        hao->addr = tmp_addr;
+        ipv6_addr_copy(&tmp_addr, &ipv6h->saddr);
+        ipv6_addr_copy(&ipv6h->saddr, &hao->addr);
+        ipv6_addr_copy(&hao->addr, &tmp_addr);
 
         if (skb->tstamp.tv64 == 0)
                 __net_timestamp(skb);
 
-        return true;
+        return 1;
 
  discard:
         kfree_skb(skb);
-        return false;
+        return 0;
 }
 #endif
 
-static const struct tlvtype_proc tlvprocdestopt_lst[] = {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+static struct tlvtype_proc tlvprocdestopt_lst[] = {
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         {
                 .type   = IPV6_TLV_HAO,
                 .func   = ipv6_dest_hao,
@@ -256,29 +270,31 @@ static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 static int ipv6_destopt_rcv(struct sk_buff *skb)
 {
         struct inet6_skb_parm *opt = IP6CB(skb);
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         __u16 dstbuf;
 #endif
-        struct dst_entry *dst = skb_dst(skb);
+        struct dst_entry *dst;
 
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
             !pskb_may_pull(skb, (skb_transport_offset(skb) +
                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
-                IP6_INC_STATS_BH(dev_net(dst->dev), ip6_dst_idev(dst),
+                IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
                                  IPSTATS_MIB_INHDRERRORS);
                 kfree_skb(skb);
                 return -1;
         }
 
         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         dstbuf = opt->dst1;
 #endif
 
+        dst = dst_clone(skb_dst(skb));
         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
+                dst_release(dst);
                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
                 opt = IP6CB(skb);
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 opt->nhoff = dstbuf;
 #else
                 opt->nhoff = opt->dst1;
@@ -288,6 +304,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
 
         IP6_INC_STATS_BH(dev_net(dst->dev),
                          ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
+        dst_release(dst);
         return -1;
 }
 
@@ -334,7 +351,7 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb)
 looped_back:
         if (hdr->segments_left == 0) {
                 switch (hdr->type) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 case IPV6_SRCRT_TYPE_2:
                         /* Silently discard type 2 header unless it was
                          * processed by own
@@ -360,7 +377,7 @@ looped_back:
         }
 
         switch (hdr->type) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         case IPV6_SRCRT_TYPE_2:
                 if (accept_source_route < 0)
                         goto unknown_rh;
@@ -417,7 +434,7 @@ looped_back:
         addr += i - 1;
 
         switch (hdr->type) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         case IPV6_SRCRT_TYPE_2:
                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
@@ -446,9 +463,9 @@ looped_back:
                 return -1;
         }
 
-        daddr = *addr;
-        *addr = ipv6_hdr(skb)->daddr;
-        ipv6_hdr(skb)->daddr = daddr;
+        ipv6_addr_copy(&daddr, addr);
+        ipv6_addr_copy(addr, &ipv6_hdr(skb)->daddr);
+        ipv6_addr_copy(&ipv6_hdr(skb)->daddr, &daddr);
 
         skb_dst_drop(skb);
         ip6_route_input(skb);
@@ -484,12 +501,12 @@ unknown_rh:
 
 static const struct inet6_protocol rthdr_protocol = {
         .handler        =       ipv6_rthdr_rcv,
-        .flags          =       INET6_PROTO_NOPOLICY,
+        .flags          =       INET6_PROTO_NOPOLICY | INET6_PROTO_GSO_EXTHDR,
 };
 
 static const struct inet6_protocol destopt_protocol = {
         .handler        =       ipv6_destopt_rcv,
-        .flags          =       INET6_PROTO_NOPOLICY,
+        .flags          =       INET6_PROTO_NOPOLICY | INET6_PROTO_GSO_EXTHDR,
 };
 
 static const struct inet6_protocol nodata_protocol = {
@@ -515,10 +532,10 @@ int __init ipv6_exthdrs_init(void)
 
 out:
         return ret;
-out_destopt:
-        inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 out_rthdr:
         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
+out_destopt:
+        inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
         goto out;
 };
 
@@ -548,23 +565,23 @@ static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 
 /* Router Alert as of RFC 2711 */
 
-static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
+static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
 {
         const unsigned char *nh = skb_network_header(skb);
 
         if (nh[optoff + 1] == 2) {
                 IP6CB(skb)->ra = optoff;
-                return true;
+                return 1;
         }
         LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n",
                        nh[optoff + 1]);
         kfree_skb(skb);
-        return false;
+        return 0;
 }
 
 /* Jumbo payload */
 
-static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
+static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 {
         const unsigned char *nh = skb_network_header(skb);
         struct net *net = ipv6_skb_net(skb);
@@ -583,13 +600,13 @@ static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
                                  IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
-                return false;
+                return 0;
         }
         if (ipv6_hdr(skb)->payload_len) {
                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
                                  IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
-                return false;
+                return 0;
         }
 
         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
@@ -601,14 +618,14 @@ static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
                 goto drop;
 
-        return true;
+        return 1;
 
 drop:
         kfree_skb(skb);
-        return false;
+        return 0;
 }
 
-static const struct tlvtype_proc tlvprochopopt_lst[] = {
+static struct tlvtype_proc tlvprochopopt_lst[] = {
         {
                 .type   = IPV6_TLV_ROUTERALERT,
                 .func   = ipv6_hop_ra,
@@ -675,7 +692,7 @@ static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
                 memcpy(phdr->addr, ihdr->addr + 1,
                        (hops - 1) * sizeof(struct in6_addr));
 
-        phdr->addr[hops - 1] = **addr_p;
+        ipv6_addr_copy(phdr->addr + (hops - 1), *addr_p);
         *addr_p = ihdr->addr;
 
         phdr->rt_hdr.nexthdr = *proto;
@@ -707,6 +724,7 @@ void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
         if (opt->hopopt)
                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 }
+
 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
 
 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
@@ -722,19 +740,20 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 
         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
         if (opt2) {
-                long dif = (char *)opt2 - (char *)opt;
+                long dif = (char*)opt2 - (char*)opt;
                 memcpy(opt2, opt, opt->tot_len);
                 if (opt2->hopopt)
-                        *((char **)&opt2->hopopt) += dif;
+                        *((char**)&opt2->hopopt) += dif;
                 if (opt2->dst0opt)
-                        *((char **)&opt2->dst0opt) += dif;
+                        *((char**)&opt2->dst0opt) += dif;
                 if (opt2->dst1opt)
-                        *((char **)&opt2->dst1opt) += dif;
+                        *((char**)&opt2->dst1opt) += dif;
                 if (opt2->srcrt)
-                        *((char **)&opt2->srcrt) += dif;
+                        *((char**)&opt2->srcrt) += dif;
         }
         return opt2;
 }
+
 EXPORT_SYMBOL_GPL(ipv6_dup_options);
 
 static int ipv6_renew_option(void *ohdr,
@@ -747,14 +766,14 @@ static int ipv6_renew_option(void *ohdr,
                 if (ohdr) {
                         memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
                         *hdr = (struct ipv6_opt_hdr *)*p;
-                        *p += CMSG_ALIGN(ipv6_optlen(*hdr));
+                        *p += CMSG_ALIGN(ipv6_optlen(*(struct ipv6_opt_hdr **)hdr));
                 }
         } else {
                 if (newopt) {
                         if (copy_from_user(*p, newopt, newoptlen))
                                 return -EFAULT;
                         *hdr = (struct ipv6_opt_hdr *)*p;
-                        if (ipv6_optlen(*hdr) > newoptlen)
+                        if (ipv6_optlen(*(struct ipv6_opt_hdr **)hdr) > newoptlen)
                                 return -EINVAL;
                         *p += CMSG_ALIGN(newoptlen);
                 }
@@ -852,7 +871,6 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
 
         return opt;
 }
-EXPORT_SYMBOL_GPL(ipv6_fixup_options);
 
 /**
  * fl6_update_dst - update flowi destination address with info given
@@ -872,8 +890,9 @@ struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
         if (!opt || !opt->srcrt)
                 return NULL;
 
-        *orig = fl6->daddr;
-        fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
+        ipv6_addr_copy(orig, &fl6->daddr);
+        ipv6_addr_copy(&fl6->daddr, ((struct rt0_hdr *)opt->srcrt)->addr);
         return orig;
 }
+
 EXPORT_SYMBOL_GPL(fl6_update_dst);
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index c5e83fae4df..14ed0a955b5 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -2,14 +2,13 @@
  * IPv6 library code, needed by static components when full IPv6 support is
  * not configured or static.
  */
-#include <linux/export.h>
 #include <net/ipv6.h>
 
 /*
  * find out if nexthdr is a well-known extension header or a protocol
  */
 
-bool ipv6_ext_hdr(u8 nexthdr)
+int ipv6_ext_hdr(u8 nexthdr)
 {
         /*
          * find out if nexthdr is an extension header or a protocol
@@ -21,7 +20,6 @@ bool ipv6_ext_hdr(u8 nexthdr)
                  (nexthdr == NEXTHDR_NONE)      ||
                  (nexthdr == NEXTHDR_DEST);
 }
-EXPORT_SYMBOL(ipv6_ext_hdr);
 
 /*
  * Skip any extension headers. This is used by the ICMP module.
@@ -58,9 +56,6 @@ EXPORT_SYMBOL(ipv6_ext_hdr);
  *          it returns NULL.
  *        - First fragment header is skipped, not-first ones
  *          are considered as unparsable.
- *        - Reports the offset field of the final fragment header so it is
- *          possible to tell whether this is a first fragment, later fragment,
- *          or not fragmented.
  *        - ESP is unparsable for now and considered like
  *          normal payload protocol.
  *        - Note also special handling of AUTH header. Thanks to IPsec wizards.
@@ -68,13 +63,10 @@ EXPORT_SYMBOL(ipv6_ext_hdr);
  * --ANK (980726)
  */
 
-int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
-                     __be16 *frag_offp)
+int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp)
 {
         u8 nexthdr = *nexthdrp;
 
-        *frag_offp = 0;
-
         while (ipv6_ext_hdr(nexthdr)) {
                 struct ipv6_opt_hdr _hdr, *hp;
                 int hdrlen;
@@ -94,8 +86,7 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
                         if (fp == NULL)
                                 return -1;
 
-                        *frag_offp = *fp;
-                        if (ntohs(*frag_offp) & ~0x7)
+                        if (ntohs(*fp) & ~0x7)
                                 break;
                         hdrlen = 8;
                 } else if (nexthdr == NEXTHDR_AUTH)
@@ -110,172 +101,6 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
         *nexthdrp = nexthdr;
         return start;
 }
-EXPORT_SYMBOL(ipv6_skip_exthdr);
-
-int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
-{
-        const unsigned char *nh = skb_network_header(skb);
-        int packet_len = skb->tail - skb->network_header;
-        struct ipv6_opt_hdr *hdr;
-        int len;
-
-        if (offset + 2 > packet_len)
-                goto bad;
-        hdr = (struct ipv6_opt_hdr *)(nh + offset);
-        len = ((hdr->hdrlen + 1) << 3);
-
-        if (offset + len > packet_len)
-                goto bad;
-
-        offset += 2;
-        len -= 2;
-
-        while (len > 0) {
-                int opttype = nh[offset];
-                int optlen;
-
-                if (opttype == type)
-                        return offset;
-
-                switch (opttype) {
-                case IPV6_TLV_PAD1:
-                        optlen = 1;
-                        break;
-                default:
-                        optlen = nh[offset + 1] + 2;
-                        if (optlen > len)
-                                goto bad;
-                        break;
-                }
-                offset += optlen;
-                len -= optlen;
-        }
-        /* not_found */
- bad:
-        return -1;
-}
-EXPORT_SYMBOL_GPL(ipv6_find_tlv);
-
-/*
- * find the offset to specified header or the protocol number of last header
- * if target < 0. "last header" is transport protocol header, ESP, or
- * "No next header".
- *
- * Note that *offset is used as input/output parameter. an if it is not zero,
- * then it must be a valid offset to an inner IPv6 header. This can be used
- * to explore inner IPv6 header, eg. ICMPv6 error messages.
- *
- * If target header is found, its offset is set in *offset and return protocol
- * number. Otherwise, return -1.
- *
- * If the first fragment doesn't contain the final protocol header or
- * NEXTHDR_NONE it is considered invalid.
- *
- * Note that non-1st fragment is special case that "the protocol number
- * of last header" is "next header" field in Fragment header. In this case,
- * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
- * isn't NULL.
- *
- * if flags is not NULL and it's a fragment, then the frag flag
- * IP6_FH_F_FRAG will be set. If it's an AH header, the
- * IP6_FH_F_AUTH flag is set and target < 0, then this function will
- * stop at the AH header. If IP6_FH_F_SKIP_RH flag was passed, then this
- * function will skip all those routing headers, where segements_left was 0.
- */
-int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
-                  int target, unsigned short *fragoff, int *flags)
-{
-        unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
-        u8 nexthdr = ipv6_hdr(skb)->nexthdr;
-        unsigned int len;
-        bool found;
-
-        if (fragoff)
-                *fragoff = 0;
-
-        if (*offset) {
-                struct ipv6hdr _ip6, *ip6;
-
-                ip6 = skb_header_pointer(skb, *offset, sizeof(_ip6), &_ip6);
-                if (!ip6 || (ip6->version != 6)) {
-                        printk(KERN_ERR "IPv6 header not found\n");
-                        return -EBADMSG;
-                }
-                start = *offset + sizeof(struct ipv6hdr);
-                nexthdr = ip6->nexthdr;
-        }
-        len = skb->len - start;
-
-        do {
-                struct ipv6_opt_hdr _hdr, *hp;
-                unsigned int hdrlen;
-                found = (nexthdr == target);
-
-                if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
-                        if (target < 0)
-                                break;
-                        return -ENOENT;
-                }
-
-                hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
-                if (hp == NULL)
-                        return -EBADMSG;
-
-                if (nexthdr == NEXTHDR_ROUTING) {
-                        struct ipv6_rt_hdr _rh, *rh;
-
-                        rh = skb_header_pointer(skb, start, sizeof(_rh),
-                                                &_rh);
-                        if (rh == NULL)
-                                return -EBADMSG;
-
-                        if (flags && (*flags & IP6_FH_F_SKIP_RH) &&
-                            rh->segments_left == 0)
-                                found = false;
-                }
-
-                if (nexthdr == NEXTHDR_FRAGMENT) {
-                        unsigned short _frag_off;
-                        __be16 *fp;
-
-                        if (flags)      /* Indicate that this is a fragment */
-                                *flags |= IP6_FH_F_FRAG;
-                        fp = skb_header_pointer(skb,
-                                                start+offsetof(struct frag_hdr,
-                                                               frag_off),
-                                                sizeof(_frag_off),
-                                                &_frag_off);
-                        if (fp == NULL)
-                                return -EBADMSG;
-
-                        _frag_off = ntohs(*fp) & ~0x7;
-                        if (_frag_off) {
-                                if (target < 0 &&
-                                    ((!ipv6_ext_hdr(hp->nexthdr)) ||
-                                     hp->nexthdr == NEXTHDR_NONE)) {
-                                        if (fragoff)
-                                                *fragoff = _frag_off;
-                                        return hp->nexthdr;
-                                }
-                                return -ENOENT;
-                        }
-                        hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH) {
-                        if (flags && (*flags & IP6_FH_F_AUTH) && (target < 0))
-                                break;
-                        hdrlen = (hp->hdrlen + 2) << 2;
-                } else
-                        hdrlen = ipv6_optlen(hp);
-
-                if (!found) {
-                        nexthdr = hp->nexthdr;
-                        len -= hdrlen;
-                        start += hdrlen;
-                }
-        } while (!found);
-
-        *offset = start;
-        return nexthdr;
-}
-EXPORT_SYMBOL(ipv6_find_hdr);
 
+EXPORT_SYMBOL(ipv6_ext_hdr);
+EXPORT_SYMBOL(ipv6_skip_exthdr);
diff --git a/net/ipv6/exthdrs_offload.c b/net/ipv6/exthdrs_offload.c
deleted file mode 100644
index cf77f3abfd0..00000000000
--- a/net/ipv6/exthdrs_offload.c
+++ /dev/null
@@ -1,41 +0,0 @@
-/*
- *      IPV6 GSO/GRO offload support
- *      Linux INET6 implementation
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- *
- *      IPV6 Extension Header GSO/GRO support
- */
-#include <net/protocol.h>
-#include "ip6_offload.h"
-
-static const struct net_offload rthdr_offload = {
-        .flags          =       INET6_PROTO_GSO_EXTHDR,
-};
-
-static const struct net_offload dstopt_offload = {
-        .flags          =       INET6_PROTO_GSO_EXTHDR,
-};
-
-int __init ipv6_exthdrs_offload_init(void)
-{
-        int ret;
-
-        ret = inet6_add_offload(&rthdr_offload, IPPROTO_ROUTING);
-        if (!ret)
-                goto out;
-
-        ret = inet6_add_offload(&dstopt_offload, IPPROTO_DSTOPTS);
-        if (!ret)
-                goto out_rt;
-
-out:
-        return ret;
-
-out_rt:
-        inet_del_offload(&rthdr_offload, IPPROTO_ROUTING);
-        goto out;
-}
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 2e1a432867c..34d244df907 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -14,7 +14,6 @@
  */
 
 #include <linux/netdevice.h>
-#include <linux/export.h>
 
 #include <net/fib_rules.h>
 #include <net/ipv6.h>
@@ -22,7 +21,8 @@
 #include <net/ip6_route.h>
 #include <net/netlink.h>
 
-struct fib6_rule {
+struct fib6_rule
+{
         struct fib_rule         common;
         struct rt6key           src;
         struct rt6key           dst;
@@ -95,12 +95,12 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                         if (!ipv6_prefix_equal(&saddr, &r->src.addr,
                                                r->src.plen))
                                 goto again;
-                        flp6->saddr = saddr;
+                        ipv6_addr_copy(&flp6->saddr, &saddr);
                 }
                 goto out;
         }
 again:
-        ip6_rt_put(rt);
+        dst_release(&rt->dst);
         rt = NULL;
         goto out;
 
@@ -214,13 +214,14 @@ static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
         frh->src_len = rule6->src.plen;
         frh->tos = rule6->tclass;
 
-        if ((rule6->dst.plen &&
-             nla_put(skb, FRA_DST, sizeof(struct in6_addr),
-                     &rule6->dst.addr)) ||
-            (rule6->src.plen &&
-             nla_put(skb, FRA_SRC, sizeof(struct in6_addr),
-                     &rule6->src.addr)))
-                goto nla_put_failure;
+        if (rule6->dst.plen)
+                NLA_PUT(skb, FRA_DST, sizeof(struct in6_addr),
+                        &rule6->dst.addr);
+
+        if (rule6->src.plen)
+                NLA_PUT(skb, FRA_SRC, sizeof(struct in6_addr),
+                        &rule6->src.addr);
+
         return 0;
 
 nla_put_failure:
@@ -238,7 +239,7 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
                + nla_total_size(16); /* src */
 }
 
-static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
+static const struct fib_rules_ops __net_initdata fib6_rules_ops_template = {
         .family                 = AF_INET6,
         .rule_size              = sizeof(struct fib6_rule),
         .addr_size              = sizeof(struct in6_addr),
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index b4a9fd51dae..11900417b1c 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -29,8 +29,6 @@
  *      Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
  */
 
-#define pr_fmt(fmt) "IPv6: " fmt
-
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -68,6 +66,7 @@
 #include <net/inet_common.h>
 
 #include <asm/uaccess.h>
+#include <asm/system.h>
 
 /*
  *      The ICMP socket(s). This is the most convenient way to flow control
@@ -131,19 +130,18 @@ void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
  *      --ANK (980726)
  */
 
-static bool is_ineligible(const struct sk_buff *skb)
+static int is_ineligible(struct sk_buff *skb)
 {
         int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
         int len = skb->len - ptr;
         __u8 nexthdr = ipv6_hdr(skb)->nexthdr;
-        __be16 frag_off;
 
         if (len < 0)
-                return true;
+                return 1;
 
-        ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
+        ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr);
         if (ptr < 0)
-                return false;
+                return 0;
         if (nexthdr == IPPROTO_ICMPV6) {
                 u8 _type, *tp;
                 tp = skb_header_pointer(skb,
@@ -151,9 +149,9 @@ static bool is_ineligible(const struct sk_buff *skb)
                         sizeof(_type), &_type);
                 if (tp == NULL ||
                     !(*tp & ICMPV6_INFOMSG_MASK))
-                        return true;
+                        return 1;
         }
-        return false;
+        return 0;
 }
 
 /*
@@ -188,16 +186,14 @@ static inline bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
         } else {
                 struct rt6_info *rt = (struct rt6_info *)dst;
                 int tmo = net->ipv6.sysctl.icmpv6_time;
-                struct inet_peer *peer;
 
                 /* Give more bandwidth to wider prefixes. */
                 if (rt->rt6i_dst.plen < 128)
                         tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
 
-                peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
-                res = inet_peer_xrlim_allow(peer, tmo);
-                if (peer)
-                        inet_putpeer(peer);
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
+                res = inet_peer_xrlim_allow(rt->rt6i_peer, tmo);
         }
         dst_release(dst);
         return res;
@@ -210,14 +206,14 @@ static inline bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
  *      highest-order two bits set to 10
  */
 
-static bool opt_unrec(struct sk_buff *skb, __u32 offset)
+static __inline__ int opt_unrec(struct sk_buff *skb, __u32 offset)
 {
         u8 _optval, *op;
 
         offset += skb_network_offset(skb);
         op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
         if (op == NULL)
-                return true;
+                return 1;
         return (*op & 0xC0) == 0x80;
 }
 
@@ -280,7 +276,7 @@ static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, st
         return 0;
 }
 
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 static void mip6_addr_swap(struct sk_buff *skb)
 {
         struct ipv6hdr *iph = ipv6_hdr(skb);
@@ -294,9 +290,9 @@ static void mip6_addr_swap(struct sk_buff *skb)
                 if (likely(off >= 0)) {
                         hao = (struct ipv6_destopt_hao *)
                                         (skb_network_header(skb) + off);
-                        tmp = iph->saddr;
-                        iph->saddr = hao->addr;
-                        hao->addr = tmp;
+                        ipv6_addr_copy(&tmp, &iph->saddr);
+                        ipv6_addr_copy(&iph->saddr, &hao->addr);
+                        ipv6_addr_copy(&hao->addr, &tmp);
                 }
         }
 }
@@ -448,9 +444,9 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 
         memset(&fl6, 0, sizeof(fl6));
         fl6.flowi6_proto = IPPROTO_ICMPV6;
-        fl6.daddr = hdr->saddr;
+        ipv6_addr_copy(&fl6.daddr, &hdr->saddr);
         if (saddr)
-                fl6.saddr = *saddr;
+                ipv6_addr_copy(&fl6.saddr, saddr);
         fl6.flowi6_oif = iif;
         fl6.fl6_icmp_type = type;
         fl6.fl6_icmp_code = code;
@@ -471,8 +467,6 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
                 fl6.flowi6_oif = np->mcast_oif;
-        else if (!fl6.flowi6_oif)
-                fl6.flowi6_oif = np->ucast_oif;
 
         dst = icmpv6_route_lookup(net, skb, sk, &fl6);
         if (IS_ERR(dst))
@@ -496,27 +490,29 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
                 goto out_dst_release;
         }
 
-        rcu_read_lock();
-        idev = __in6_dev_get(skb->dev);
+        idev = in6_dev_get(skb->dev);
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg,
                               len + sizeof(struct icmp6hdr),
                               sizeof(struct icmp6hdr), hlimit,
-                              np->tclass, NULL, &fl6, (struct rt6_info *)dst,
+                              np->tclass, NULL, &fl6, (struct rt6_info*)dst,
                               MSG_DONTWAIT, np->dontfrag);
         if (err) {
                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
-        } else {
-                err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
-                                                 len + sizeof(struct icmp6hdr));
+                goto out_put;
         }
-        rcu_read_unlock();
+        err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, len + sizeof(struct icmp6hdr));
+
+out_put:
+        if (likely(idev != NULL))
+                in6_dev_put(idev);
 out_dst_release:
         dst_release(dst);
 out:
         icmpv6_xmit_unlock(sk);
 }
+
 EXPORT_SYMBOL(icmpv6_send);
 
 static void icmpv6_echo_reply(struct sk_buff *skb)
@@ -544,9 +540,9 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 
         memset(&fl6, 0, sizeof(fl6));
         fl6.flowi6_proto = IPPROTO_ICMPV6;
-        fl6.daddr = ipv6_hdr(skb)->saddr;
+        ipv6_addr_copy(&fl6.daddr, &ipv6_hdr(skb)->saddr);
         if (saddr)
-                fl6.saddr = *saddr;
+                ipv6_addr_copy(&fl6.saddr, saddr);
         fl6.flowi6_oif = skb->dev->ifindex;
         fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
@@ -558,8 +554,6 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
                 fl6.flowi6_oif = np->mcast_oif;
-        else if (!fl6.flowi6_oif)
-                fl6.flowi6_oif = np->ucast_oif;
 
         err = ip6_dst_lookup(sk, &dst, &fl6);
         if (err)
@@ -575,7 +569,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (hlimit < 0)
                 hlimit = ip6_dst_hoplimit(dst);
 
-        idev = __in6_dev_get(skb->dev);
+        idev = in6_dev_get(skb->dev);
 
         msg.skb = skb;
         msg.offset = 0;
@@ -583,26 +577,29 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
                                 sizeof(struct icmp6hdr), hlimit, np->tclass, NULL, &fl6,
-                                (struct rt6_info *)dst, MSG_DONTWAIT,
+                                (struct rt6_info*)dst, MSG_DONTWAIT,
                                 np->dontfrag);
 
         if (err) {
                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
-        } else {
-                err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
-                                                 skb->len + sizeof(struct icmp6hdr));
+                goto out_put;
         }
+        err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, skb->len + sizeof(struct icmp6hdr));
+
+out_put:
+        if (likely(idev != NULL))
+                in6_dev_put(idev);
         dst_release(dst);
 out:
         icmpv6_xmit_unlock(sk);
 }
 
-void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
+static void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
 {
         const struct inet6_protocol *ipprot;
         int inner_offset;
-        __be16 frag_off;
+        int hash;
         u8 nexthdr;
 
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
@@ -611,8 +608,7 @@ void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
         nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
         if (ipv6_ext_hdr(nexthdr)) {
                 /* now skip over extension headers */
-                inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
-                                                &nexthdr, &frag_off);
+                inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr);
                 if (inner_offset<0)
                         return;
         } else {
@@ -630,8 +626,10 @@ void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
            --ANK (980726)
          */
 
+        hash = nexthdr & (MAX_INET_PROTOS - 1);
+
         rcu_read_lock();
-        ipprot = rcu_dereference(inet6_protos[nexthdr]);
+        ipprot = rcu_dereference(inet6_protos[hash]);
         if (ipprot && ipprot->err_handler)
                 ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
         rcu_read_unlock();
@@ -648,6 +646,7 @@ static int icmpv6_rcv(struct sk_buff *skb)
         struct net_device *dev = skb->dev;
         struct inet6_dev *idev = __in6_dev_get(dev);
         const struct in6_addr *saddr, *daddr;
+        const struct ipv6hdr *orig_hdr;
         struct icmp6hdr *hdr;
         u8 type;
 
@@ -659,7 +658,7 @@ static int icmpv6_rcv(struct sk_buff *skb)
                                  XFRM_STATE_ICMP))
                         goto drop_no_count;
 
-                if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
+                if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(*orig_hdr)))
                         goto drop_no_count;
 
                 nh = skb_network_offset(skb);
@@ -720,6 +719,9 @@ static int icmpv6_rcv(struct sk_buff *skb)
                 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                         goto discard_it;
                 hdr = icmp6_hdr(skb);
+                orig_hdr = (struct ipv6hdr *) (hdr + 1);
+                rt6_pmtu_discovery(&orig_hdr->daddr, &orig_hdr->saddr, dev,
+                                   ntohl(hdr->icmp6_mtu));
 
                 /*
                  *      Drop through to notify
@@ -789,8 +791,8 @@ void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
                       int oif)
 {
         memset(fl6, 0, sizeof(*fl6));
-        fl6->saddr = *saddr;
-        fl6->daddr = *daddr;
+        ipv6_addr_copy(&fl6->saddr, saddr);
+        ipv6_addr_copy(&fl6->daddr, daddr);
         fl6->flowi6_proto       = IPPROTO_ICMPV6;
         fl6->fl6_icmp_type      = type;
         fl6->fl6_icmp_code      = 0;
@@ -817,7 +819,9 @@ static int __net_init icmpv6_sk_init(struct net *net)
                 err = inet_ctl_sock_create(&sk, PF_INET6,
                                            SOCK_RAW, IPPROTO_ICMPV6, net);
                 if (err < 0) {
-                        pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
+                        printk(KERN_ERR
+                               "Failed to initialize the ICMP6 control socket "
+                               "(err %d).\n",
                                err);
                         goto fail;
                 }
@@ -836,7 +840,8 @@ static int __net_init icmpv6_sk_init(struct net *net)
                 /* Enough space for 2 64K ICMP packets, including
                  * sk_buff struct overhead.
                  */
-                sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
+                sk->sk_sndbuf =
+                        (2 * ((64 * 1024) + sizeof(struct sk_buff)));
         }
         return 0;
 
@@ -876,7 +881,7 @@ int __init icmpv6_init(void)
         return 0;
 
 fail:
-        pr_err("Failed to register ICMP6 protocol\n");
+        printk(KERN_ERR "Failed to register ICMP6 protocol\n");
         unregister_pernet_subsys(&icmpv6_sk_ops);
         return err;
 }
@@ -945,6 +950,7 @@ int icmpv6_err_convert(u8 type, u8 code, int *err)
 
         return fatal;
 }
+
 EXPORT_SYMBOL(icmpv6_err_convert);
 
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 30647857a37..8a58e8cf664 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -28,7 +28,7 @@
 #include <net/inet6_connection_sock.h>
 
 int inet6_csk_bind_conflict(const struct sock *sk,
-                            const struct inet_bind_bucket *tb, bool relax)
+                            const struct inet_bind_bucket *tb)
 {
         const struct sock *sk2;
         const struct hlist_node *node;
@@ -55,26 +55,26 @@ int inet6_csk_bind_conflict(const struct sock *sk,
 EXPORT_SYMBOL_GPL(inet6_csk_bind_conflict);
 
 struct dst_entry *inet6_csk_route_req(struct sock *sk,
-                                      struct flowi6 *fl6,
                                       const struct request_sock *req)
 {
         struct inet6_request_sock *treq = inet6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct in6_addr *final_p, final;
         struct dst_entry *dst;
+        struct flowi6 fl6;
 
-        memset(fl6, 0, sizeof(*fl6));
-        fl6->flowi6_proto = IPPROTO_TCP;
-        fl6->daddr = treq->rmt_addr;
-        final_p = fl6_update_dst(fl6, np->opt, &final);
-        fl6->saddr = treq->loc_addr;
-        fl6->flowi6_oif = treq->iif;
-        fl6->flowi6_mark = sk->sk_mark;
-        fl6->fl6_dport = inet_rsk(req)->rmt_port;
-        fl6->fl6_sport = inet_rsk(req)->loc_port;
-        security_req_classify_flow(req, flowi6_to_flowi(fl6));
-
-        dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_TCP;
+        ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
+        final_p = fl6_update_dst(&fl6, np->opt, &final);
+        ipv6_addr_copy(&fl6.saddr, &treq->loc_addr);
+        fl6.flowi6_oif = sk->sk_bound_dev_if;
+        fl6.flowi6_mark = sk->sk_mark;
+        fl6.fl6_dport = inet_rsk(req)->rmt_port;
+        fl6.fl6_sport = inet_rsk(req)->loc_port;
+        security_req_classify_flow(req, flowi6_to_flowi(&fl6));
+
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
         if (IS_ERR(dst))
                 return NULL;
 
@@ -85,7 +85,7 @@ struct dst_entry *inet6_csk_route_req(struct sock *sk,
  * request_sock (formerly open request) hash tables.
  */
 static u32 inet6_synq_hash(const struct in6_addr *raddr, const __be16 rport,
-                           const u32 rnd, const u32 synq_hsize)
+                           const u32 rnd, const u16 synq_hsize)
 {
         u32 c;
 
@@ -157,7 +157,7 @@ void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) uaddr;
 
         sin6->sin6_family = AF_INET6;
-        sin6->sin6_addr = np->daddr;
+        ipv6_addr_copy(&sin6->sin6_addr, &np->daddr);
         sin6->sin6_port = inet_sk(sk)->inet_dport;
         /* We do not store received flowlabel for TCP */
         sin6->sin6_flowinfo = 0;
@@ -171,88 +171,82 @@ EXPORT_SYMBOL_GPL(inet6_csk_addr2sockaddr);
 
 static inline
 void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
-                           const struct in6_addr *daddr,
-                           const struct in6_addr *saddr)
+                           struct in6_addr *daddr, struct in6_addr *saddr)
 {
         __ip6_dst_store(sk, dst, daddr, saddr);
+
+#ifdef CONFIG_XFRM
+        {
+                struct rt6_info *rt = (struct rt6_info  *)dst;
+                rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
+        }
+#endif
 }
 
 static inline
 struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
 {
-        return __sk_dst_check(sk, cookie);
-}
-
-static struct dst_entry *inet6_csk_route_socket(struct sock *sk,
-                                                struct flowi6 *fl6)
-{
-        struct inet_sock *inet = inet_sk(sk);
-        struct ipv6_pinfo *np = inet6_sk(sk);
-        struct in6_addr *final_p, final;
         struct dst_entry *dst;
 
-        memset(fl6, 0, sizeof(*fl6));
-        fl6->flowi6_proto = sk->sk_protocol;
-        fl6->daddr = np->daddr;
-        fl6->saddr = np->saddr;
-        fl6->flowlabel = np->flow_label;
-        IP6_ECN_flow_xmit(sk, fl6->flowlabel);
-        fl6->flowi6_oif = sk->sk_bound_dev_if;
-        fl6->flowi6_mark = sk->sk_mark;
-        fl6->fl6_sport = inet->inet_sport;
-        fl6->fl6_dport = inet->inet_dport;
-        security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
+        dst = __sk_dst_check(sk, cookie);
 
-        final_p = fl6_update_dst(fl6, np->opt, &final);
-
-        dst = __inet6_csk_dst_check(sk, np->dst_cookie);
-        if (!dst) {
-                dst = ip6_dst_lookup_flow(sk, fl6, final_p, false);
-
-                if (!IS_ERR(dst))
-                        __inet6_csk_dst_store(sk, dst, NULL, NULL);
+#ifdef CONFIG_XFRM
+        if (dst) {
+                struct rt6_info *rt = (struct rt6_info *)dst;
+                if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
+                        __sk_dst_reset(sk);
+                        dst = NULL;
+                }
         }
+#endif
+
         return dst;
 }
 
 int inet6_csk_xmit(struct sk_buff *skb, struct flowi *fl_unused)
 {
         struct sock *sk = skb->sk;
+        struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct flowi6 fl6;
         struct dst_entry *dst;
-        int res;
-
-        dst = inet6_csk_route_socket(sk, &fl6);
-        if (IS_ERR(dst)) {
-                sk->sk_err_soft = -PTR_ERR(dst);
-                sk->sk_route_caps = 0;
-                kfree_skb(skb);
-                return PTR_ERR(dst);
-        }
+        struct in6_addr *final_p, final;
 
-        rcu_read_lock();
-        skb_dst_set_noref(skb, dst);
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_proto = sk->sk_protocol;
+        ipv6_addr_copy(&fl6.daddr, &np->daddr);
+        ipv6_addr_copy(&fl6.saddr, &np->saddr);
+        fl6.flowlabel = np->flow_label;
+        IP6_ECN_flow_xmit(sk, fl6.flowlabel);
+        fl6.flowi6_oif = sk->sk_bound_dev_if;
+        fl6.flowi6_mark = sk->sk_mark;
+        fl6.fl6_sport = inet->inet_sport;
+        fl6.fl6_dport = inet->inet_dport;
+        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 
-        /* Restore final destination back after routing done */
-        fl6.daddr = np->daddr;
+        final_p = fl6_update_dst(&fl6, np->opt, &final);
 
-        res = ip6_xmit(sk, skb, &fl6, np->opt, np->tclass);
-        rcu_read_unlock();
-        return res;
-}
-EXPORT_SYMBOL_GPL(inet6_csk_xmit);
+        dst = __inet6_csk_dst_check(sk, np->dst_cookie);
 
-struct dst_entry *inet6_csk_update_pmtu(struct sock *sk, u32 mtu)
-{
-        struct flowi6 fl6;
-        struct dst_entry *dst = inet6_csk_route_socket(sk, &fl6);
+        if (dst == NULL) {
+                dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
 
-        if (IS_ERR(dst))
-                return NULL;
-        dst->ops->update_pmtu(dst, sk, NULL, mtu);
+                if (IS_ERR(dst)) {
+                        sk->sk_err_soft = -PTR_ERR(dst);
+                        sk->sk_route_caps = 0;
+                        kfree_skb(skb);
+                        return PTR_ERR(dst);
+                }
+
+                __inet6_csk_dst_store(sk, dst, NULL, NULL);
+        }
+
+        skb_dst_set(skb, dst_clone(dst));
 
-        dst = inet6_csk_route_socket(sk, &fl6);
-        return IS_ERR(dst) ? NULL : dst;
+        /* Restore final destination back after routing done */
+        ipv6_addr_copy(&fl6.daddr, &np->daddr);
+
+        return ip6_xmit(sk, skb, &fl6, np->opt);
 }
-EXPORT_SYMBOL_GPL(inet6_csk_update_pmtu);
+
+EXPORT_SYMBOL_GPL(inet6_csk_xmit);
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index dea17fd28e5..73f1a00a96a 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -87,13 +87,11 @@ struct sock *__inet6_lookup_established(struct net *net,
         rcu_read_lock();
 begin:
         sk_nulls_for_each_rcu(sk, node, &head->chain) {
-                if (sk->sk_hash != hash)
-                        continue;
-                if (likely(INET6_MATCH(sk, net, saddr, daddr, ports, dif))) {
+                /* For IPV6 do the cheaper port and family tests first. */
+                if (INET6_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
                         if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt)))
                                 goto begintw;
-                        if (unlikely(!INET6_MATCH(sk, net, saddr, daddr,
-                                                  ports, dif))) {
+                        if (!INET6_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
                                 sock_put(sk);
                                 goto begin;
                         }
@@ -106,16 +104,12 @@ begin:
 begintw:
         /* Must check for a TIME_WAIT'er before going to listener hash. */
         sk_nulls_for_each_rcu(sk, node, &head->twchain) {
-                if (sk->sk_hash != hash)
-                        continue;
-                if (likely(INET6_TW_MATCH(sk, net, saddr, daddr,
-                                          ports, dif))) {
+                if (INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
                         if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt))) {
                                 sk = NULL;
                                 goto out;
                         }
-                        if (unlikely(!INET6_TW_MATCH(sk, net, saddr, daddr,
-                                                     ports, dif))) {
+                        if (!INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
                                 sock_put(sk);
                                 goto begintw;
                         }
@@ -242,12 +236,9 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
 
         /* Check TIME-WAIT sockets first. */
         sk_nulls_for_each(sk2, node, &head->twchain) {
-                if (sk2->sk_hash != hash)
-                        continue;
+                tw = inet_twsk(sk2);
 
-                if (likely(INET6_TW_MATCH(sk2, net, saddr, daddr,
-                                          ports, dif))) {
-                        tw = inet_twsk(sk2);
+                if (INET6_TW_MATCH(sk2, net, hash, saddr, daddr, ports, dif)) {
                         if (twsk_unique(sk, sk2, twp))
                                 goto unique;
                         else
@@ -258,9 +249,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
 
         /* And established part... */
         sk_nulls_for_each(sk2, node, &head->chain) {
-                if (sk2->sk_hash != hash)
-                        continue;
-                if (likely(INET6_MATCH(sk2, net, saddr, daddr, ports, dif)))
+                if (INET6_MATCH(sk2, net, hash, saddr, daddr, ports, dif))
                         goto not_unique;
         }
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 710cafd2e1a..320d91d20ad 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -18,9 +18,6 @@
  *                              routing table.
  *      Ville Nuorvala:         Fixed routing subtrees.
  */
-
-#define pr_fmt(fmt) "IPv6: " fmt
-
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/net.h>
@@ -31,6 +28,10 @@
 #include <linux/list.h>
 #include <linux/slab.h>
 
+#ifdef  CONFIG_PROC_FS
+#include <linux/proc_fs.h>
+#endif
+
 #include <net/ipv6.h>
 #include <net/ndisc.h>
 #include <net/addrconf.h>
@@ -41,7 +42,7 @@
 #define RT6_DEBUG 2
 
 #if RT6_DEBUG >= 3
-#define RT6_TRACE(x...) pr_debug(x)
+#define RT6_TRACE(x...) printk(KERN_DEBUG x)
 #else
 #define RT6_TRACE(x...) do { ; } while (0)
 #endif
@@ -193,11 +194,10 @@ static struct fib6_table *fib6_alloc_table(struct net *net, u32 id)
         struct fib6_table *table;
 
         table = kzalloc(sizeof(*table), GFP_ATOMIC);
-        if (table) {
+        if (table != NULL) {
                 table->tb6_id = id;
                 table->tb6_root.leaf = net->ipv6.ip6_null_entry;
                 table->tb6_root.fn_flags = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
-                inet_peer_base_init(&table->tb6_peers);
         }
 
         return table;
@@ -214,7 +214,7 @@ struct fib6_table *fib6_new_table(struct net *net, u32 id)
                 return tb;
 
         tb = fib6_alloc_table(net, id);
-        if (tb)
+        if (tb != NULL)
                 fib6_link_table(net, tb);
 
         return tb;
@@ -371,7 +371,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         s_e = cb->args[1];
 
         w = (void *)cb->args[2];
-        if (!w) {
+        if (w == NULL) {
                 /* New dump:
                  *
                  * 1. hook callback destructor.
@@ -383,7 +383,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                  * 2. allocate and initialize walker.
                  */
                 w = kzalloc(sizeof(*w), GFP_ATOMIC);
-                if (!w)
+                if (w == NULL)
                         return -ENOMEM;
                 w->func = fib6_dump_node;
                 cb->args[2] = (long)w;
@@ -429,8 +429,7 @@ out:
 
 static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
                                      int addrlen, int plen,
-                                     int offset, int allow_create,
-                                     int replace_required)
+                                     int offset)
 {
         struct fib6_node *fn, *in, *ln;
         struct fib6_node *pn = NULL;
@@ -452,16 +451,8 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
                  *      Prefix match
                  */
                 if (plen < fn->fn_bit ||
-                    !ipv6_prefix_equal(&key->addr, addr, fn->fn_bit)) {
-                        if (!allow_create) {
-                                if (replace_required) {
-                                        pr_warn("Can't replace route, no match found\n");
-                                        return ERR_PTR(-ENOENT);
-                                }
-                                pr_warn("NLM_F_CREATE should be set when creating new route\n");
-                        }
+                    !ipv6_prefix_equal(&key->addr, addr, fn->fn_bit))
                         goto insert_above;
-                }
 
                 /*
                  *      Exact match ?
@@ -469,7 +460,7 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
 
                 if (plen == fn->fn_bit) {
                         /* clean up an intermediate node */
-                        if (!(fn->fn_flags & RTN_RTINFO)) {
+                        if ((fn->fn_flags & RTN_RTINFO) == 0) {
                                 rt6_release(fn->leaf);
                                 fn->leaf = NULL;
                         }
@@ -490,22 +481,6 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
                 fn = dir ? fn->right: fn->left;
         } while (fn);
 
-        if (!allow_create) {
-                /* We should not create new node because
-                 * NLM_F_REPLACE was specified without NLM_F_CREATE
-                 * I assume it is safe to require NLM_F_CREATE when
-                 * REPLACE flag is used! Later we may want to remove the
-                 * check for replace_required, because according
-                 * to netlink specification, NLM_F_CREATE
-                 * MUST be specified if new route is created.
-                 * That would keep IPv6 consistent with IPv4
-                 */
-                if (replace_required) {
-                        pr_warn("Can't replace route, no match found\n");
-                        return ERR_PTR(-ENOENT);
-                }
-                pr_warn("NLM_F_CREATE should be set when creating new route\n");
-        }
         /*
          *      We walked to the bottom of tree.
          *      Create new leaf node without children.
@@ -513,8 +488,8 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
 
         ln = node_alloc();
 
-        if (!ln)
-                return ERR_PTR(-ENOMEM);
+        if (ln == NULL)
+                return NULL;
         ln->fn_bit = plen;
 
         ln->parent = pn;
@@ -556,12 +531,12 @@ insert_above:
                 in = node_alloc();
                 ln = node_alloc();
 
-                if (!in || !ln) {
+                if (in == NULL || ln == NULL) {
                         if (in)
                                 node_free(in);
                         if (ln)
                                 node_free(ln);
-                        return ERR_PTR(-ENOMEM);
+                        return NULL;
                 }
 
                 /*
@@ -610,8 +585,8 @@ insert_above:
 
                 ln = node_alloc();
 
-                if (!ln)
-                        return ERR_PTR(-ENOMEM);
+                if (ln == NULL)
+                        return NULL;
 
                 ln->fn_bit = plen;
 
@@ -643,15 +618,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
 {
         struct rt6_info *iter = NULL;
         struct rt6_info **ins;
-        int replace = (info->nlh &&
-                       (info->nlh->nlmsg_flags & NLM_F_REPLACE));
-        int add = (!info->nlh ||
-                   (info->nlh->nlmsg_flags & NLM_F_CREATE));
-        int found = 0;
 
         ins = &fn->leaf;
 
-        for (iter = fn->leaf; iter; iter = iter->dst.rt6_next) {
+        for (iter = fn->leaf; iter; iter=iter->dst.rt6_next) {
                 /*
                  *      Search for duplicates
                  */
@@ -660,43 +630,20 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                         /*
                          *      Same priority level
                          */
-                        if (info->nlh &&
-                            (info->nlh->nlmsg_flags & NLM_F_EXCL))
-                                return -EEXIST;
-                        if (replace) {
-                                found++;
-                                break;
-                        }
 
-                        if (iter->dst.dev == rt->dst.dev &&
+                        if (iter->rt6i_dev == rt->rt6i_dev &&
                             iter->rt6i_idev == rt->rt6i_idev &&
                             ipv6_addr_equal(&iter->rt6i_gateway,
                                             &rt->rt6i_gateway)) {
-                                if (rt->rt6i_nsiblings)
-                                        rt->rt6i_nsiblings = 0;
-                                if (!(iter->rt6i_flags & RTF_EXPIRES))
+                                if (!(iter->rt6i_flags&RTF_EXPIRES))
                                         return -EEXIST;
-                                if (!(rt->rt6i_flags & RTF_EXPIRES))
-                                        rt6_clean_expires(iter);
-                                else
-                                        rt6_set_expires(iter, rt->dst.expires);
+                                iter->rt6i_expires = rt->rt6i_expires;
+                                if (!(rt->rt6i_flags&RTF_EXPIRES)) {
+                                        iter->rt6i_flags &= ~RTF_EXPIRES;
+                                        iter->rt6i_expires = 0;
+                                }
                                 return -EEXIST;
                         }
-                        /* If we have the same destination and the same metric,
-                         * but not the same gateway, then the route we try to
-                         * add is sibling to this route, increment our counter
-                         * of siblings, and later we will add our route to the
-                         * list.
-                         * Only static routes (which don't have flag
-                         * RTF_EXPIRES) are used for ECMPv6.
-                         *
-                         * To avoid long list, we only had siblings if the
-                         * route have a gateway.
-                         */
-                        if (rt->rt6i_flags & RTF_GATEWAY &&
-                            !(rt->rt6i_flags & RTF_EXPIRES) &&
-                            !(iter->rt6i_flags & RTF_EXPIRES))
-                                rt->rt6i_nsiblings++;
                 }
 
                 if (iter->rt6i_metric > rt->rt6i_metric)
@@ -709,72 +656,20 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
         if (ins == &fn->leaf)
                 fn->rr_ptr = NULL;
 
-        /* Link this route to others same route. */
-        if (rt->rt6i_nsiblings) {
-                unsigned int rt6i_nsiblings;
-                struct rt6_info *sibling, *temp_sibling;
-
-                /* Find the first route that have the same metric */
-                sibling = fn->leaf;
-                while (sibling) {
-                        if (sibling->rt6i_metric == rt->rt6i_metric) {
-                                list_add_tail(&rt->rt6i_siblings,
-                                              &sibling->rt6i_siblings);
-                                break;
-                        }
-                        sibling = sibling->dst.rt6_next;
-                }
-                /* For each sibling in the list, increment the counter of
-                 * siblings. BUG() if counters does not match, list of siblings
-                 * is broken!
-                 */
-                rt6i_nsiblings = 0;
-                list_for_each_entry_safe(sibling, temp_sibling,
-                                         &rt->rt6i_siblings, rt6i_siblings) {
-                        sibling->rt6i_nsiblings++;
-                        BUG_ON(sibling->rt6i_nsiblings != rt->rt6i_nsiblings);
-                        rt6i_nsiblings++;
-                }
-                BUG_ON(rt6i_nsiblings != rt->rt6i_nsiblings);
-        }
-
         /*
          *      insert node
          */
-        if (!replace) {
-                if (!add)
-                        pr_warn("NLM_F_CREATE should be set when creating new route\n");
-
-add:
-                rt->dst.rt6_next = iter;
-                *ins = rt;
-                rt->rt6i_node = fn;
-                atomic_inc(&rt->rt6i_ref);
-                inet6_rt_notify(RTM_NEWROUTE, rt, info);
-                info->nl_net->ipv6.rt6_stats->fib_rt_entries++;
-
-                if (!(fn->fn_flags & RTN_RTINFO)) {
-                        info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
-                        fn->fn_flags |= RTN_RTINFO;
-                }
 
-        } else {
-                if (!found) {
-                        if (add)
-                                goto add;
-                        pr_warn("NLM_F_REPLACE set, but no existing node found!\n");
-                        return -ENOENT;
-                }
-                *ins = rt;
-                rt->rt6i_node = fn;
-                rt->dst.rt6_next = iter->dst.rt6_next;
-                atomic_inc(&rt->rt6i_ref);
-                inet6_rt_notify(RTM_NEWROUTE, rt, info);
-                rt6_release(iter);
-                if (!(fn->fn_flags & RTN_RTINFO)) {
-                        info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
-                        fn->fn_flags |= RTN_RTINFO;
-                }
+        rt->dst.rt6_next = iter;
+        *ins = rt;
+        rt->rt6i_node = fn;
+        atomic_inc(&rt->rt6i_ref);
+        inet6_rt_notify(RTM_NEWROUTE, rt, info);
+        info->nl_net->ipv6.rt6_stats->fib_rt_entries++;
+
+        if ((fn->fn_flags & RTN_RTINFO) == 0) {
+                info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
+                fn->fn_flags |= RTN_RTINFO;
         }
 
         return 0;
@@ -783,7 +678,7 @@ add:
 static __inline__ void fib6_start_gc(struct net *net, struct rt6_info *rt)
 {
         if (!timer_pending(&net->ipv6.ip6_fib_timer) &&
-            (rt->rt6i_flags & (RTF_EXPIRES | RTF_CACHE)))
+            (rt->rt6i_flags & (RTF_EXPIRES|RTF_CACHE)))
                 mod_timer(&net->ipv6.ip6_fib_timer,
                           jiffies + net->ipv6.sysctl.ip6_rt_gc_interval);
 }
@@ -805,26 +700,12 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
 {
         struct fib6_node *fn, *pn = NULL;
         int err = -ENOMEM;
-        int allow_create = 1;
-        int replace_required = 0;
-
-        if (info->nlh) {
-                if (!(info->nlh->nlmsg_flags & NLM_F_CREATE))
-                        allow_create = 0;
-                if (info->nlh->nlmsg_flags & NLM_F_REPLACE)
-                        replace_required = 1;
-        }
-        if (!allow_create && !replace_required)
-                pr_warn("RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE\n");
 
         fn = fib6_add_1(root, &rt->rt6i_dst.addr, sizeof(struct in6_addr),
-                        rt->rt6i_dst.plen, offsetof(struct rt6_info, rt6i_dst),
-                        allow_create, replace_required);
+                        rt->rt6i_dst.plen, offsetof(struct rt6_info, rt6i_dst));
 
-        if (IS_ERR(fn)) {
-                err = PTR_ERR(fn);
+        if (fn == NULL)
                 goto out;
-        }
 
         pn = fn;
 
@@ -832,7 +713,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
         if (rt->rt6i_src.plen) {
                 struct fib6_node *sn;
 
-                if (!fn->subtree) {
+                if (fn->subtree == NULL) {
                         struct fib6_node *sfn;
 
                         /*
@@ -847,7 +728,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
 
                         /* Create subtree root node */
                         sfn = node_alloc();
-                        if (!sfn)
+                        if (sfn == NULL)
                                 goto st_failure;
 
                         sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
@@ -859,16 +740,14 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
 
                         sn = fib6_add_1(sfn, &rt->rt6i_src.addr,
                                         sizeof(struct in6_addr), rt->rt6i_src.plen,
-                                        offsetof(struct rt6_info, rt6i_src),
-                                        allow_create, replace_required);
+                                        offsetof(struct rt6_info, rt6i_src));
 
-                        if (IS_ERR(sn)) {
+                        if (sn == NULL) {
                                 /* If it is failed, discard just allocated
                                    root, and then (in st_failure) stale node
                                    in main tree.
                                  */
                                 node_free(sfn);
-                                err = PTR_ERR(sn);
                                 goto st_failure;
                         }
 
@@ -878,16 +757,13 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
                 } else {
                         sn = fib6_add_1(fn->subtree, &rt->rt6i_src.addr,
                                         sizeof(struct in6_addr), rt->rt6i_src.plen,
-                                        offsetof(struct rt6_info, rt6i_src),
-                                        allow_create, replace_required);
+                                        offsetof(struct rt6_info, rt6i_src));
 
-                        if (IS_ERR(sn)) {
-                                err = PTR_ERR(sn);
+                        if (sn == NULL)
                                 goto st_failure;
-                        }
                 }
 
-                if (!fn->leaf) {
+                if (fn->leaf == NULL) {
                         fn->leaf = rt;
                         atomic_inc(&rt->rt6i_ref);
                 }
@@ -896,9 +772,10 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
 #endif
 
         err = fib6_add_rt2node(fn, rt, info);
-        if (!err) {
+
+        if (err == 0) {
                 fib6_start_gc(info->nl_net, rt);
-                if (!(rt->rt6i_flags & RTF_CACHE))
+                if (!(rt->rt6i_flags&RTF_CACHE))
                         fib6_prune_clones(info->nl_net, pn, rt);
         }
 
@@ -946,7 +823,7 @@ st_failure:
  */
 
 struct lookup_args {
-        int                     offset;         /* key offset on rt6_info       */
+        int             offset;         /* key offset on rt6_info       */
         const struct in6_addr   *addr;          /* search key                   */
 };
 
@@ -976,10 +853,11 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
                         fn = next;
                         continue;
                 }
+
                 break;
         }
 
-        while (fn) {
+        while(fn) {
                 if (FIB6_SUBTREE(fn) || fn->fn_flags & RTN_RTINFO) {
                         struct rt6key *key;
 
@@ -1026,7 +904,8 @@ struct fib6_node * fib6_lookup(struct fib6_node *root, const struct in6_addr *da
         };
 
         fn = fib6_lookup_1(root, daddr ? args : args + 1);
-        if (!fn || fn->fn_flags & RTN_TL_ROOT)
+
+        if (fn == NULL || fn->fn_flags & RTN_TL_ROOT)
                 fn = root;
 
         return fn;
@@ -1086,7 +965,7 @@ struct fib6_node * fib6_locate(struct fib6_node *root,
         }
 #endif
 
-        if (fn && fn->fn_flags & RTN_RTINFO)
+        if (fn && fn->fn_flags&RTN_RTINFO)
                 return fn;
 
         return NULL;
@@ -1100,13 +979,14 @@ struct fib6_node * fib6_locate(struct fib6_node *root,
 
 static struct rt6_info *fib6_find_prefix(struct net *net, struct fib6_node *fn)
 {
-        if (fn->fn_flags & RTN_ROOT)
+        if (fn->fn_flags&RTN_ROOT)
                 return net->ipv6.ip6_null_entry;
 
-        while (fn) {
-                if (fn->left)
+        while(fn) {
+                if(fn->left)
                         return fn->left->leaf;
-                if (fn->right)
+
+                if(fn->right)
                         return fn->right->leaf;
 
                 fn = FIB6_SUBTREE(fn);
@@ -1144,12 +1024,12 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 if (children == 3 || FIB6_SUBTREE(fn)
 #ifdef CONFIG_IPV6_SUBTREES
                     /* Subtree root (i.e. fn) may have one child */
-                    || (children && fn->fn_flags & RTN_ROOT)
+                    || (children && fn->fn_flags&RTN_ROOT)
 #endif
                     ) {
                         fn->leaf = fib6_find_prefix(net, fn);
 #if RT6_DEBUG >= 2
-                        if (!fn->leaf) {
+                        if (fn->leaf==NULL) {
                                 WARN_ON(!fn->leaf);
                                 fn->leaf = net->ipv6.ip6_null_entry;
                         }
@@ -1182,7 +1062,7 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
 
                 read_lock(&fib6_walker_lock);
                 FOR_WALKERS(w) {
-                        if (!child) {
+                        if (child == NULL) {
                                 if (w->root == fn) {
                                         w->root = w->node = NULL;
                                         RT6_TRACE("W %p adjusted by delroot 1\n", w);
@@ -1211,7 +1091,7 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 read_unlock(&fib6_walker_lock);
 
                 node_free(fn);
-                if (pn->fn_flags & RTN_RTINFO || FIB6_SUBTREE(pn))
+                if (pn->fn_flags&RTN_RTINFO || FIB6_SUBTREE(pn))
                         return pn;
 
                 rt6_release(pn->leaf);
@@ -1239,24 +1119,13 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         if (fn->rr_ptr == rt)
                 fn->rr_ptr = NULL;
 
-        /* Remove this entry from other siblings */
-        if (rt->rt6i_nsiblings) {
-                struct rt6_info *sibling, *next_sibling;
-
-                list_for_each_entry_safe(sibling, next_sibling,
-                                         &rt->rt6i_siblings, rt6i_siblings)
-                        sibling->rt6i_nsiblings--;
-                rt->rt6i_nsiblings = 0;
-                list_del_init(&rt->rt6i_siblings);
-        }
-
         /* Adjust walkers */
         read_lock(&fib6_walker_lock);
         FOR_WALKERS(w) {
                 if (w->state == FWS_C && w->leaf == rt) {
                         RT6_TRACE("walker %p adjusted by delroute\n", w);
                         w->leaf = rt->dst.rt6_next;
-                        if (!w->leaf)
+                        if (w->leaf == NULL)
                                 w->state = FWS_U;
                 }
         }
@@ -1265,7 +1134,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         rt->dst.rt6_next = NULL;
 
         /* If it was last route, expunge its radix tree node */
-        if (!fn->leaf) {
+        if (fn->leaf == NULL) {
                 fn->fn_flags &= ~RTN_RTINFO;
                 net->ipv6.rt6_stats->fib_route_nodes--;
                 fn = fib6_repair_tree(net, fn);
@@ -1279,7 +1148,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
                  * to still alive ones.
                  */
                 while (fn) {
-                        if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
+                        if (!(fn->fn_flags&RTN_RTINFO) && fn->leaf == rt) {
                                 fn->leaf = fib6_find_prefix(net, fn);
                                 atomic_inc(&fn->leaf->rt6i_ref);
                                 rt6_release(rt);
@@ -1306,17 +1175,17 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
                 return -ENOENT;
         }
 #endif
-        if (!fn || rt == net->ipv6.ip6_null_entry)
+        if (fn == NULL || rt == net->ipv6.ip6_null_entry)
                 return -ENOENT;
 
         WARN_ON(!(fn->fn_flags & RTN_RTINFO));
 
-        if (!(rt->rt6i_flags & RTF_CACHE)) {
+        if (!(rt->rt6i_flags&RTF_CACHE)) {
                 struct fib6_node *pn = fn;
 #ifdef CONFIG_IPV6_SUBTREES
                 /* clones of this route might be in another subtree */
                 if (rt->rt6i_src.plen) {
-                        while (!(pn->fn_flags & RTN_ROOT))
+                        while (!(pn->fn_flags&RTN_ROOT))
                                 pn = pn->parent;
                         pn = pn->parent;
                 }
@@ -1367,11 +1236,11 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
 
         for (;;) {
                 fn = w->node;
-                if (!fn)
+                if (fn == NULL)
                         return 0;
 
                 if (w->prune && fn != w->root &&
-                    fn->fn_flags & RTN_RTINFO && w->state < FWS_C) {
+                    fn->fn_flags&RTN_RTINFO && w->state < FWS_C) {
                         w->state = FWS_C;
                         w->leaf = fn->leaf;
                 }
@@ -1400,11 +1269,11 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                         w->state = FWS_C;
                         w->leaf = fn->leaf;
                 case FWS_C:
-                        if (w->leaf && fn->fn_flags & RTN_RTINFO) {
+                        if (w->leaf && fn->fn_flags&RTN_RTINFO) {
                                 int err;
 
-                                if (w->skip) {
-                                        w->skip--;
+                                if (w->count < w->skip) {
+                                        w->count++;
                                         continue;
                                 }
 
@@ -1474,8 +1343,7 @@ static int fib6_clean_node(struct fib6_walker_t *w)
                         res = fib6_del(rt, &info);
                         if (res) {
 #if RT6_DEBUG >= 2
-                                pr_debug("%s: del failed: rt=%p@%p err=%d\n",
-                                         __func__, rt, rt->rt6i_node, res);
+                                printk(KERN_DEBUG "fib6_clean_node: del failed: rt=%p@%p err=%d\n", rt, rt->rt6i_node, res);
 #endif
                                 continue;
                         }
@@ -1516,26 +1384,6 @@ static void fib6_clean_tree(struct net *net, struct fib6_node *root,
         fib6_walk(&c.w);
 }
 
-void fib6_clean_all_ro(struct net *net, int (*func)(struct rt6_info *, void *arg),
-                    int prune, void *arg)
-{
-        struct fib6_table *table;
-        struct hlist_node *node;
-        struct hlist_head *head;
-        unsigned int h;
-
-        rcu_read_lock();
-        for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
-                head = &net->ipv6.fib_table_hash[h];
-                hlist_for_each_entry_rcu(table, node, head, tb6_hlist) {
-                        read_lock_bh(&table->tb6_lock);
-                        fib6_clean_tree(net, &table->tb6_root,
-                                        func, prune, arg);
-                        read_unlock_bh(&table->tb6_lock);
-                }
-        }
-        rcu_read_unlock();
-}
 void fib6_clean_all(struct net *net, int (*func)(struct rt6_info *, void *arg),
                     int prune, void *arg)
 {
@@ -1595,8 +1443,8 @@ static int fib6_age(struct rt6_info *rt, void *arg)
          *      only if they are not in use now.
          */
 
-        if (rt->rt6i_flags & RTF_EXPIRES && rt->dst.expires) {
-                if (time_after(now, rt->dst.expires)) {
+        if (rt->rt6i_flags&RTF_EXPIRES && rt->rt6i_expires) {
+                if (time_after(now, rt->rt6i_expires)) {
                         RT6_TRACE("expiring %p\n", rt);
                         return -1;
                 }
@@ -1606,20 +1454,11 @@ static int fib6_age(struct rt6_info *rt, void *arg)
                     time_after_eq(now, rt->dst.lastuse + gc_args.timeout)) {
                         RT6_TRACE("aging clone %p\n", rt);
                         return -1;
-                } else if (rt->rt6i_flags & RTF_GATEWAY) {
-                        struct neighbour *neigh;
-                        __u8 neigh_flags = 0;
-
-                        neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway);
-                        if (neigh) {
-                                neigh_flags = neigh->flags;
-                                neigh_release(neigh);
-                        }
-                        if (!(neigh_flags & NTF_ROUTER)) {
-                                RT6_TRACE("purging route %p via non-router but gateway\n",
-                                          rt);
-                                return -1;
-                        }
+                } else if ((rt->rt6i_flags & RTF_GATEWAY) &&
+                           (!(dst_get_neighbour_raw(&rt->dst)->flags & NTF_ROUTER))) {
+                        RT6_TRACE("purging route %p via non-router but gateway\n",
+                                  rt);
+                        return -1;
                 }
                 gc_args.more++;
         }
@@ -1687,7 +1526,6 @@ static int __net_init fib6_net_init(struct net *net)
         net->ipv6.fib6_main_tbl->tb6_root.leaf = net->ipv6.ip6_null_entry;
         net->ipv6.fib6_main_tbl->tb6_root.fn_flags =
                 RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
-        inet_peer_base_init(&net->ipv6.fib6_main_tbl->tb6_peers);
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
         net->ipv6.fib6_local_tbl = kzalloc(sizeof(*net->ipv6.fib6_local_tbl),
@@ -1698,7 +1536,6 @@ static int __net_init fib6_net_init(struct net *net)
         net->ipv6.fib6_local_tbl->tb6_root.leaf = net->ipv6.ip6_null_entry;
         net->ipv6.fib6_local_tbl->tb6_root.fn_flags =
                 RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
-        inet_peer_base_init(&net->ipv6.fib6_local_tbl->tb6_peers);
 #endif
         fib6_tables_init(net);
 
@@ -1722,10 +1559,8 @@ static void fib6_net_exit(struct net *net)
         del_timer_sync(&net->ipv6.ip6_fib_timer);
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-        inetpeer_invalidate_tree(&net->ipv6.fib6_local_tbl->tb6_peers);
         kfree(net->ipv6.fib6_local_tbl);
 #endif
-        inetpeer_invalidate_tree(&net->ipv6.fib6_main_tbl->tb6_peers);
         kfree(net->ipv6.fib6_main_tbl);
         kfree(net->ipv6.fib_table_hash);
         kfree(net->ipv6.rt6_stats);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 29124b7a04c..54303945019 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -21,8 +21,6 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
-#include <linux/export.h>
-#include <linux/pid_namespace.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -92,8 +90,6 @@ static struct ip6_flowlabel *fl_lookup(struct net *net, __be32 label)
 static void fl_free(struct ip6_flowlabel *fl)
 {
         if (fl) {
-                if (fl->share == IPV6_FL_S_PROCESS)
-                        put_pid(fl->owner.pid);
                 release_net(fl->fl_net);
                 kfree(fl->opt);
         }
@@ -297,7 +293,6 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions * opt_space,
         opt_space->opt_flen = fopt->opt_flen;
         return opt_space;
 }
-EXPORT_SYMBOL_GPL(fl6_merge_options);
 
 static unsigned long check_linger(unsigned long ttl)
 {
@@ -390,17 +385,17 @@ fl_create(struct net *net, struct sock *sk, struct in6_flowlabel_req *freq,
                 err = -EINVAL;
                 goto done;
         }
-        fl->dst = freq->flr_dst;
+        ipv6_addr_copy(&fl->dst, &freq->flr_dst);
         atomic_set(&fl->users, 1);
         switch (fl->share) {
         case IPV6_FL_S_EXCL:
         case IPV6_FL_S_ANY:
                 break;
         case IPV6_FL_S_PROCESS:
-                fl->owner.pid = get_task_pid(current, PIDTYPE_PID);
+                fl->owner = current->pid;
                 break;
         case IPV6_FL_S_USER:
-                fl->owner.uid = current_euid();
+                fl->owner = current_euid();
                 break;
         default:
                 err = -EINVAL;
@@ -436,32 +431,32 @@ static int mem_check(struct sock *sk)
         return 0;
 }
 
-static bool ipv6_hdr_cmp(struct ipv6_opt_hdr *h1, struct ipv6_opt_hdr *h2)
+static int ipv6_hdr_cmp(struct ipv6_opt_hdr *h1, struct ipv6_opt_hdr *h2)
 {
         if (h1 == h2)
-                return false;
+                return 0;
         if (h1 == NULL || h2 == NULL)
-                return true;
+                return 1;
         if (h1->hdrlen != h2->hdrlen)
-                return true;
+                return 1;
         return memcmp(h1+1, h2+1, ((h1->hdrlen+1)<<3) - sizeof(*h1));
 }
 
-static bool ipv6_opt_cmp(struct ipv6_txoptions *o1, struct ipv6_txoptions *o2)
+static int ipv6_opt_cmp(struct ipv6_txoptions *o1, struct ipv6_txoptions *o2)
 {
         if (o1 == o2)
-                return false;
+                return 0;
         if (o1 == NULL || o2 == NULL)
-                return true;
+                return 1;
         if (o1->opt_nflen != o2->opt_nflen)
-                return true;
+                return 1;
         if (ipv6_hdr_cmp(o1->hopopt, o2->hopopt))
-                return true;
+                return 1;
         if (ipv6_hdr_cmp(o1->dst0opt, o2->dst0opt))
-                return true;
+                return 1;
         if (ipv6_hdr_cmp((struct ipv6_opt_hdr *)o1->srcrt, (struct ipv6_opt_hdr *)o2->srcrt))
-                return true;
-        return false;
+                return 1;
+        return 0;
 }
 
 static inline void fl_link(struct ipv6_pinfo *np, struct ipv6_fl_socklist *sfl,
@@ -519,8 +514,7 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
                 }
                 read_unlock_bh(&ip6_sk_fl_lock);
 
-                if (freq.flr_share == IPV6_FL_S_NONE &&
-                    ns_capable(net->user_ns, CAP_NET_ADMIN)) {
+                if (freq.flr_share == IPV6_FL_S_NONE && capable(CAP_NET_ADMIN)) {
                         fl = fl_lookup(net, freq.flr_label);
                         if (fl) {
                                 err = fl6_renew(fl, freq.flr_linger, freq.flr_expires);
@@ -565,10 +559,7 @@ recheck:
                                 err = -EPERM;
                                 if (fl1->share == IPV6_FL_S_EXCL ||
                                     fl1->share != fl->share ||
-                                    ((fl1->share == IPV6_FL_S_PROCESS) &&
-                                     (fl1->owner.pid == fl->owner.pid)) ||
-                                    ((fl1->share == IPV6_FL_S_USER) &&
-                                     uid_eq(fl1->owner.uid, fl->owner.uid)))
+                                    fl1->owner != fl->owner)
                                         goto release;
 
                                 err = -EINVAL;
@@ -628,7 +619,6 @@ done:
 
 struct ip6fl_iter_state {
         struct seq_net_private p;
-        struct pid_namespace *pid_ns;
         int bucket;
 };
 
@@ -707,7 +697,6 @@ static void ip6fl_seq_stop(struct seq_file *seq, void *v)
 
 static int ip6fl_seq_show(struct seq_file *seq, void *v)
 {
-        struct ip6fl_iter_state *state = ip6fl_seq_private(seq);
         if (v == SEQ_START_TOKEN)
                 seq_printf(seq, "%-5s %-1s %-6s %-6s %-6s %-8s %-32s %s\n",
                            "Label", "S", "Owner", "Users", "Linger", "Expires", "Dst", "Opt");
@@ -715,13 +704,9 @@ static int ip6fl_seq_show(struct seq_file *seq, void *v)
                 struct ip6_flowlabel *fl = v;
                 seq_printf(seq,
                            "%05X %-1d %-6d %-6d %-6ld %-8ld %pi6 %-4d\n",
-                           (unsigned int)ntohl(fl->label),
+                           (unsigned)ntohl(fl->label),
                            fl->share,
-                           ((fl->share == IPV6_FL_S_PROCESS) ?
-                            pid_nr_ns(fl->owner.pid, state->pid_ns) :
-                            ((fl->share == IPV6_FL_S_USER) ?
-                             from_kuid_munged(seq_user_ns(seq), fl->owner.uid) :
-                             0)),
+                           (unsigned)fl->owner,
                            atomic_read(&fl->users),
                            fl->linger/HZ,
                            (long)(fl->expires - jiffies)/HZ,
@@ -740,29 +725,8 @@ static const struct seq_operations ip6fl_seq_ops = {
 
 static int ip6fl_seq_open(struct inode *inode, struct file *file)
 {
-        struct seq_file *seq;
-        struct ip6fl_iter_state *state;
-        int err;
-
-        err = seq_open_net(inode, file, &ip6fl_seq_ops,
-                           sizeof(struct ip6fl_iter_state));
-
-        if (!err) {
-                seq = file->private_data;
-                state = ip6fl_seq_private(seq);
-                rcu_read_lock();
-                state->pid_ns = get_pid_ns(task_active_pid_ns(current));
-                rcu_read_unlock();
-        }
-        return err;
-}
-
-static int ip6fl_seq_release(struct inode *inode, struct file *file)
-{
-        struct seq_file *seq = file->private_data;
-        struct ip6fl_iter_state *state = ip6fl_seq_private(seq);
-        put_pid_ns(state->pid_ns);
-        return seq_release_net(inode, file);
+        return seq_open_net(inode, file, &ip6fl_seq_ops,
+                            sizeof(struct ip6fl_iter_state));
 }
 
 static const struct file_operations ip6fl_seq_fops = {
@@ -770,7 +734,7 @@ static const struct file_operations ip6fl_seq_fops = {
         .open           =       ip6fl_seq_open,
         .read           =       seq_read,
         .llseek         =       seq_lseek,
-        .release        =       ip6fl_seq_release,
+        .release        =       seq_release_net,
 };
 
 static int __net_init ip6_flowlabel_proc_init(struct net *net)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
deleted file mode 100644
index c727e471275..00000000000
--- a/net/ipv6/ip6_gre.c
+++ /dev/null
@@ -1,1754 +0,0 @@
-/*
- *      GRE over IPv6 protocol decoder.
- *
- *      Authors: Dmitry Kozlov (xeb@mail.ru)
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- *
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include <linux/capability.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/slab.h>
-#include <linux/uaccess.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/in.h>
-#include <linux/tcp.h>
-#include <linux/udp.h>
-#include <linux/if_arp.h>
-#include <linux/mroute.h>
-#include <linux/init.h>
-#include <linux/in6.h>
-#include <linux/inetdevice.h>
-#include <linux/igmp.h>
-#include <linux/netfilter_ipv4.h>
-#include <linux/etherdevice.h>
-#include <linux/if_ether.h>
-#include <linux/hash.h>
-#include <linux/if_tunnel.h>
-#include <linux/ip6_tunnel.h>
-
-#include <net/sock.h>
-#include <net/ip.h>
-#include <net/icmp.h>
-#include <net/protocol.h>
-#include <net/addrconf.h>
-#include <net/arp.h>
-#include <net/checksum.h>
-#include <net/dsfield.h>
-#include <net/inet_ecn.h>
-#include <net/xfrm.h>
-#include <net/net_namespace.h>
-#include <net/netns/generic.h>
-#include <net/rtnetlink.h>
-
-#include <net/ipv6.h>
-#include <net/ip6_fib.h>
-#include <net/ip6_route.h>
-#include <net/ip6_tunnel.h>
-
-
-static bool log_ecn_error = true;
-module_param(log_ecn_error, bool, 0644);
-MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
-
-#define IPV6_TCLASS_MASK (IPV6_FLOWINFO_MASK & ~IPV6_FLOWLABEL_MASK)
-#define IPV6_TCLASS_SHIFT 20
-
-#define HASH_SIZE_SHIFT  5
-#define HASH_SIZE (1 << HASH_SIZE_SHIFT)
-
-static int ip6gre_net_id __read_mostly;
-struct ip6gre_net {
-        struct ip6_tnl __rcu *tunnels[4][HASH_SIZE];
-
-        struct net_device *fb_tunnel_dev;
-};
-
-static struct rtnl_link_ops ip6gre_link_ops __read_mostly;
-static int ip6gre_tunnel_init(struct net_device *dev);
-static void ip6gre_tunnel_setup(struct net_device *dev);
-static void ip6gre_tunnel_link(struct ip6gre_net *ign, struct ip6_tnl *t);
-static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu);
-
-/* Tunnel hash table */
-
-/*
-   4 hash tables:
-
-   3: (remote,local)
-   2: (remote,*)
-   1: (*,local)
-   0: (*,*)
-
-   We require exact key match i.e. if a key is present in packet
-   it will match only tunnel with the same key; if it is not present,
-   it will match only keyless tunnel.
-
-   All keysless packets, if not matched configured keyless tunnels
-   will match fallback tunnel.
- */
-
-#define HASH_KEY(key) (((__force u32)key^((__force u32)key>>4))&(HASH_SIZE - 1))
-static u32 HASH_ADDR(const struct in6_addr *addr)
-{
-        u32 hash = ipv6_addr_hash(addr);
-
-        return hash_32(hash, HASH_SIZE_SHIFT);
-}
-
-#define tunnels_r_l     tunnels[3]
-#define tunnels_r       tunnels[2]
-#define tunnels_l       tunnels[1]
-#define tunnels_wc      tunnels[0]
-
-static struct rtnl_link_stats64 *ip6gre_get_stats64(struct net_device *dev,
-                struct rtnl_link_stats64 *tot)
-{
-        int i;
-
-        for_each_possible_cpu(i) {
-                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
-                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
-                unsigned int start;
-
-                do {
-                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
-                        rx_packets = tstats->rx_packets;
-                        tx_packets = tstats->tx_packets;
-                        rx_bytes = tstats->rx_bytes;
-                        tx_bytes = tstats->tx_bytes;
-                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
-
-                tot->rx_packets += rx_packets;
-                tot->tx_packets += tx_packets;
-                tot->rx_bytes   += rx_bytes;
-                tot->tx_bytes   += tx_bytes;
-        }
-
-        tot->multicast = dev->stats.multicast;
-        tot->rx_crc_errors = dev->stats.rx_crc_errors;
-        tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
-        tot->rx_length_errors = dev->stats.rx_length_errors;
-        tot->rx_frame_errors = dev->stats.rx_frame_errors;
-        tot->rx_errors = dev->stats.rx_errors;
-
-        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
-        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
-        tot->tx_dropped = dev->stats.tx_dropped;
-        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
-        tot->tx_errors = dev->stats.tx_errors;
-
-        return tot;
-}
-
-/* Given src, dst and key, find appropriate for input tunnel. */
-
-static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
-                const struct in6_addr *remote, const struct in6_addr *local,
-                __be32 key, __be16 gre_proto)
-{
-        struct net *net = dev_net(dev);
-        int link = dev->ifindex;
-        unsigned int h0 = HASH_ADDR(remote);
-        unsigned int h1 = HASH_KEY(key);
-        struct ip6_tnl *t, *cand = NULL;
-        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
-        int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
-                       ARPHRD_ETHER : ARPHRD_IP6GRE;
-        int score, cand_score = 4;
-
-        for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) {
-                if (!ipv6_addr_equal(local, &t->parms.laddr) ||
-                    !ipv6_addr_equal(remote, &t->parms.raddr) ||
-                    key != t->parms.i_key ||
-                    !(t->dev->flags & IFF_UP))
-                        continue;
-
-                if (t->dev->type != ARPHRD_IP6GRE &&
-                    t->dev->type != dev_type)
-                        continue;
-
-                score = 0;
-                if (t->parms.link != link)
-                        score |= 1;
-                if (t->dev->type != dev_type)
-                        score |= 2;
-                if (score == 0)
-                        return t;
-
-                if (score < cand_score) {
-                        cand = t;
-                        cand_score = score;
-                }
-        }
-
-        for_each_ip_tunnel_rcu(t, ign->tunnels_r[h0 ^ h1]) {
-                if (!ipv6_addr_equal(remote, &t->parms.raddr) ||
-                    key != t->parms.i_key ||
-                    !(t->dev->flags & IFF_UP))
-                        continue;
-
-                if (t->dev->type != ARPHRD_IP6GRE &&
-                    t->dev->type != dev_type)
-                        continue;
-
-                score = 0;
-                if (t->parms.link != link)
-                        score |= 1;
-                if (t->dev->type != dev_type)
-                        score |= 2;
-                if (score == 0)
-                        return t;
-
-                if (score < cand_score) {
-                        cand = t;
-                        cand_score = score;
-                }
-        }
-
-        for_each_ip_tunnel_rcu(t, ign->tunnels_l[h1]) {
-                if ((!ipv6_addr_equal(local, &t->parms.laddr) &&
-                          (!ipv6_addr_equal(local, &t->parms.raddr) ||
-                                 !ipv6_addr_is_multicast(local))) ||
-                    key != t->parms.i_key ||
-                    !(t->dev->flags & IFF_UP))
-                        continue;
-
-                if (t->dev->type != ARPHRD_IP6GRE &&
-                    t->dev->type != dev_type)
-                        continue;
-
-                score = 0;
-                if (t->parms.link != link)
-                        score |= 1;
-                if (t->dev->type != dev_type)
-                        score |= 2;
-                if (score == 0)
-                        return t;
-
-                if (score < cand_score) {
-                        cand = t;
-                        cand_score = score;
-                }
-        }
-
-        for_each_ip_tunnel_rcu(t, ign->tunnels_wc[h1]) {
-                if (t->parms.i_key != key ||
-                    !(t->dev->flags & IFF_UP))
-                        continue;
-
-                if (t->dev->type != ARPHRD_IP6GRE &&
-                    t->dev->type != dev_type)
-                        continue;
-
-                score = 0;
-                if (t->parms.link != link)
-                        score |= 1;
-                if (t->dev->type != dev_type)
-                        score |= 2;
-                if (score == 0)
-                        return t;
-
-                if (score < cand_score) {
-                        cand = t;
-                        cand_score = score;
-                }
-        }
-
-        if (cand != NULL)
-                return cand;
-
-        dev = ign->fb_tunnel_dev;
-        if (dev->flags & IFF_UP)
-                return netdev_priv(dev);
-
-        return NULL;
-}
-
-static struct ip6_tnl __rcu **__ip6gre_bucket(struct ip6gre_net *ign,
-                const struct __ip6_tnl_parm *p)
-{
-        const struct in6_addr *remote = &p->raddr;
-        const struct in6_addr *local = &p->laddr;
-        unsigned int h = HASH_KEY(p->i_key);
-        int prio = 0;
-
-        if (!ipv6_addr_any(local))
-                prio |= 1;
-        if (!ipv6_addr_any(remote) && !ipv6_addr_is_multicast(remote)) {
-                prio |= 2;
-                h ^= HASH_ADDR(remote);
-        }
-
-        return &ign->tunnels[prio][h];
-}
-
-static inline struct ip6_tnl __rcu **ip6gre_bucket(struct ip6gre_net *ign,
-                const struct ip6_tnl *t)
-{
-        return __ip6gre_bucket(ign, &t->parms);
-}
-
-static void ip6gre_tunnel_link(struct ip6gre_net *ign, struct ip6_tnl *t)
-{
-        struct ip6_tnl __rcu **tp = ip6gre_bucket(ign, t);
-
-        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
-        rcu_assign_pointer(*tp, t);
-}
-
-static void ip6gre_tunnel_unlink(struct ip6gre_net *ign, struct ip6_tnl *t)
-{
-        struct ip6_tnl __rcu **tp;
-        struct ip6_tnl *iter;
-
-        for (tp = ip6gre_bucket(ign, t);
-             (iter = rtnl_dereference(*tp)) != NULL;
-             tp = &iter->next) {
-                if (t == iter) {
-                        rcu_assign_pointer(*tp, t->next);
-                        break;
-                }
-        }
-}
-
-static struct ip6_tnl *ip6gre_tunnel_find(struct net *net,
-                                           const struct __ip6_tnl_parm *parms,
-                                           int type)
-{
-        const struct in6_addr *remote = &parms->raddr;
-        const struct in6_addr *local = &parms->laddr;
-        __be32 key = parms->i_key;
-        int link = parms->link;
-        struct ip6_tnl *t;
-        struct ip6_tnl __rcu **tp;
-        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
-
-        for (tp = __ip6gre_bucket(ign, parms);
-             (t = rtnl_dereference(*tp)) != NULL;
-             tp = &t->next)
-                if (ipv6_addr_equal(local, &t->parms.laddr) &&
-                    ipv6_addr_equal(remote, &t->parms.raddr) &&
-                    key == t->parms.i_key &&
-                    link == t->parms.link &&
-                    type == t->dev->type)
-                        break;
-
-        return t;
-}
-
-static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net,
-                const struct __ip6_tnl_parm *parms, int create)
-{
-        struct ip6_tnl *t, *nt;
-        struct net_device *dev;
-        char name[IFNAMSIZ];
-        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
-
-        t = ip6gre_tunnel_find(net, parms, ARPHRD_IP6GRE);
-        if (t || !create)
-                return t;
-
-        if (parms->name[0])
-                strlcpy(name, parms->name, IFNAMSIZ);
-        else
-                strcpy(name, "ip6gre%d");
-
-        dev = alloc_netdev(sizeof(*t), name, ip6gre_tunnel_setup);
-        if (!dev)
-                return NULL;
-
-        dev_net_set(dev, net);
-
-        nt = netdev_priv(dev);
-        nt->parms = *parms;
-        dev->rtnl_link_ops = &ip6gre_link_ops;
-
-        nt->dev = dev;
-        ip6gre_tnl_link_config(nt, 1);
-
-        if (register_netdevice(dev) < 0)
-                goto failed_free;
-
-        /* Can use a lockless transmit, unless we generate output sequences */
-        if (!(nt->parms.o_flags & GRE_SEQ))
-                dev->features |= NETIF_F_LLTX;
-
-        dev_hold(dev);
-        ip6gre_tunnel_link(ign, nt);
-        return nt;
-
-failed_free:
-        free_netdev(dev);
-        return NULL;
-}
-
-static void ip6gre_tunnel_uninit(struct net_device *dev)
-{
-        struct net *net = dev_net(dev);
-        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
-
-        ip6gre_tunnel_unlink(ign, netdev_priv(dev));
-        dev_put(dev);
-}
-
-
-static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                u8 type, u8 code, int offset, __be32 info)
-{
-        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data;
-        __be16 *p = (__be16 *)(skb->data + offset);
-        int grehlen = offset + 4;
-        struct ip6_tnl *t;
-        __be16 flags;
-
-        flags = p[0];
-        if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
-                if (flags&(GRE_VERSION|GRE_ROUTING))
-                        return;
-                if (flags&GRE_KEY) {
-                        grehlen += 4;
-                        if (flags&GRE_CSUM)
-                                grehlen += 4;
-                }
-        }
-
-        /* If only 8 bytes returned, keyed message will be dropped here */
-        if (!pskb_may_pull(skb, grehlen))
-                return;
-        ipv6h = (const struct ipv6hdr *)skb->data;
-        p = (__be16 *)(skb->data + offset);
-
-        t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr,
-                                flags & GRE_KEY ?
-                                *(((__be32 *)p) + (grehlen / 4) - 1) : 0,
-                                p[1]);
-        if (t == NULL)
-                return;
-
-        switch (type) {
-                __u32 teli;
-                struct ipv6_tlv_tnl_enc_lim *tel;
-                __u32 mtu;
-        case ICMPV6_DEST_UNREACH:
-                net_warn_ratelimited("%s: Path to destination invalid or inactive!\n",
-                                     t->parms.name);
-                break;
-        case ICMPV6_TIME_EXCEED:
-                if (code == ICMPV6_EXC_HOPLIMIT) {
-                        net_warn_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
-                                             t->parms.name);
-                }
-                break;
-        case ICMPV6_PARAMPROB:
-                teli = 0;
-                if (code == ICMPV6_HDR_FIELD)
-                        teli = ip6_tnl_parse_tlv_enc_lim(skb, skb->data);
-
-                if (teli && teli == info - 2) {
-                        tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
-                        if (tel->encap_limit == 0) {
-                                net_warn_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
-                                                     t->parms.name);
-                        }
-                } else {
-                        net_warn_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
-                                             t->parms.name);
-                }
-                break;
-        case ICMPV6_PKT_TOOBIG:
-                mtu = info - offset;
-                if (mtu < IPV6_MIN_MTU)
-                        mtu = IPV6_MIN_MTU;
-                t->dev->mtu = mtu;
-                break;
-        }
-
-        if (time_before(jiffies, t->err_time + IP6TUNNEL_ERR_TIMEO))
-                t->err_count++;
-        else
-                t->err_count = 1;
-        t->err_time = jiffies;
-}
-
-static int ip6gre_rcv(struct sk_buff *skb)
-{
-        const struct ipv6hdr *ipv6h;
-        u8     *h;
-        __be16    flags;
-        __sum16   csum = 0;
-        __be32 key = 0;
-        u32    seqno = 0;
-        struct ip6_tnl *tunnel;
-        int    offset = 4;
-        __be16 gre_proto;
-        int err;
-
-        if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
-                goto drop;
-
-        ipv6h = ipv6_hdr(skb);
-        h = skb->data;
-        flags = *(__be16 *)h;
-
-        if (flags&(GRE_CSUM|GRE_KEY|GRE_ROUTING|GRE_SEQ|GRE_VERSION)) {
-                /* - Version must be 0.
-                   - We do not support routing headers.
-                 */
-                if (flags&(GRE_VERSION|GRE_ROUTING))
-                        goto drop;
-
-                if (flags&GRE_CSUM) {
-                        switch (skb->ip_summed) {
-                        case CHECKSUM_COMPLETE:
-                                csum = csum_fold(skb->csum);
-                                if (!csum)
-                                        break;
-                                /* fall through */
-                        case CHECKSUM_NONE:
-                                skb->csum = 0;
-                                csum = __skb_checksum_complete(skb);
-                                skb->ip_summed = CHECKSUM_COMPLETE;
-                        }
-                        offset += 4;
-                }
-                if (flags&GRE_KEY) {
-                        key = *(__be32 *)(h + offset);
-                        offset += 4;
-                }
-                if (flags&GRE_SEQ) {
-                        seqno = ntohl(*(__be32 *)(h + offset));
-                        offset += 4;
-                }
-        }
-
-        gre_proto = *(__be16 *)(h + 2);
-
-        tunnel = ip6gre_tunnel_lookup(skb->dev,
-                                          &ipv6h->saddr, &ipv6h->daddr, key,
-                                          gre_proto);
-        if (tunnel) {
-                struct pcpu_tstats *tstats;
-
-                if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
-                        goto drop;
-
-                if (!ip6_tnl_rcv_ctl(tunnel, &ipv6h->daddr, &ipv6h->saddr)) {
-                        tunnel->dev->stats.rx_dropped++;
-                        goto drop;
-                }
-
-                secpath_reset(skb);
-
-                skb->protocol = gre_proto;
-                /* WCCP version 1 and 2 protocol decoding.
-                 * - Change protocol to IP
-                 * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
-                 */
-                if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) {
-                        skb->protocol = htons(ETH_P_IP);
-                        if ((*(h + offset) & 0xF0) != 0x40)
-                                offset += 4;
-                }
-
-                skb->mac_header = skb->network_header;
-                __pskb_pull(skb, offset);
-                skb_postpull_rcsum(skb, skb_transport_header(skb), offset);
-                skb->pkt_type = PACKET_HOST;
-
-                if (((flags&GRE_CSUM) && csum) ||
-                    (!(flags&GRE_CSUM) && tunnel->parms.i_flags&GRE_CSUM)) {
-                        tunnel->dev->stats.rx_crc_errors++;
-                        tunnel->dev->stats.rx_errors++;
-                        goto drop;
-                }
-                if (tunnel->parms.i_flags&GRE_SEQ) {
-                        if (!(flags&GRE_SEQ) ||
-                            (tunnel->i_seqno &&
-                                        (s32)(seqno - tunnel->i_seqno) < 0)) {
-                                tunnel->dev->stats.rx_fifo_errors++;
-                                tunnel->dev->stats.rx_errors++;
-                                goto drop;
-                        }
-                        tunnel->i_seqno = seqno + 1;
-                }
-
-                /* Warning: All skb pointers will be invalidated! */
-                if (tunnel->dev->type == ARPHRD_ETHER) {
-                        if (!pskb_may_pull(skb, ETH_HLEN)) {
-                                tunnel->dev->stats.rx_length_errors++;
-                                tunnel->dev->stats.rx_errors++;
-                                goto drop;
-                        }
-
-                        ipv6h = ipv6_hdr(skb);
-                        skb->protocol = eth_type_trans(skb, tunnel->dev);
-                        skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
-                }
-
-                __skb_tunnel_rx(skb, tunnel->dev);
-
-                skb_reset_network_header(skb);
-
-                err = IP6_ECN_decapsulate(ipv6h, skb);
-                if (unlikely(err)) {
-                        if (log_ecn_error)
-                                net_info_ratelimited("non-ECT from %pI6 with dsfield=%#x\n",
-                                                     &ipv6h->saddr,
-                                                     ipv6_get_dsfield(ipv6h));
-                        if (err > 1) {
-                                ++tunnel->dev->stats.rx_frame_errors;
-                                ++tunnel->dev->stats.rx_errors;
-                                goto drop;
-                        }
-                }
-
-                tstats = this_cpu_ptr(tunnel->dev->tstats);
-                u64_stats_update_begin(&tstats->syncp);
-                tstats->rx_packets++;
-                tstats->rx_bytes += skb->len;
-                u64_stats_update_end(&tstats->syncp);
-
-                netif_rx(skb);
-
-                return 0;
-        }
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
-
-drop:
-        kfree_skb(skb);
-        return 0;
-}
-
-struct ipv6_tel_txoption {
-        struct ipv6_txoptions ops;
-        __u8 dst_opt[8];
-};
-
-static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
-{
-        memset(opt, 0, sizeof(struct ipv6_tel_txoption));
-
-        opt->dst_opt[2] = IPV6_TLV_TNL_ENCAP_LIMIT;
-        opt->dst_opt[3] = 1;
-        opt->dst_opt[4] = encap_limit;
-        opt->dst_opt[5] = IPV6_TLV_PADN;
-        opt->dst_opt[6] = 1;
-
-        opt->ops.dst0opt = (struct ipv6_opt_hdr *) opt->dst_opt;
-        opt->ops.opt_nflen = 8;
-}
-
-static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
-                         struct net_device *dev,
-                         __u8 dsfield,
-                         struct flowi6 *fl6,
-                         int encap_limit,
-                         __u32 *pmtu)
-{
-        struct net *net = dev_net(dev);
-        struct ip6_tnl *tunnel = netdev_priv(dev);
-        struct net_device *tdev;    /* Device to other host */
-        struct ipv6hdr  *ipv6h;     /* Our new IP header */
-        unsigned int max_headroom;  /* The extra header space needed */
-        int    gre_hlen;
-        struct ipv6_tel_txoption opt;
-        int    mtu;
-        struct dst_entry *dst = NULL, *ndst = NULL;
-        struct net_device_stats *stats = &tunnel->dev->stats;
-        int err = -1;
-        u8 proto;
-        int pkt_len;
-        struct sk_buff *new_skb;
-
-        if (dev->type == ARPHRD_ETHER)
-                IPCB(skb)->flags = 0;
-
-        if (dev->header_ops && dev->type == ARPHRD_IP6GRE) {
-                gre_hlen = 0;
-                ipv6h = (struct ipv6hdr *)skb->data;
-                fl6->daddr = ipv6h->daddr;
-        } else {
-                gre_hlen = tunnel->hlen;
-                fl6->daddr = tunnel->parms.raddr;
-        }
-
-        if (!fl6->flowi6_mark)
-                dst = ip6_tnl_dst_check(tunnel);
-
-        if (!dst) {
-                ndst = ip6_route_output(net, NULL, fl6);
-
-                if (ndst->error)
-                        goto tx_err_link_failure;
-                ndst = xfrm_lookup(net, ndst, flowi6_to_flowi(fl6), NULL, 0);
-                if (IS_ERR(ndst)) {
-                        err = PTR_ERR(ndst);
-                        ndst = NULL;
-                        goto tx_err_link_failure;
-                }
-                dst = ndst;
-        }
-
-        tdev = dst->dev;
-
-        if (tdev == dev) {
-                stats->collisions++;
-                net_warn_ratelimited("%s: Local routing loop detected!\n",
-                                     tunnel->parms.name);
-                goto tx_err_dst_release;
-        }
-
-        mtu = dst_mtu(dst) - sizeof(*ipv6h);
-        if (encap_limit >= 0) {
-                max_headroom += 8;
-                mtu -= 8;
-        }
-        if (mtu < IPV6_MIN_MTU)
-                mtu = IPV6_MIN_MTU;
-        if (skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
-        if (skb->len > mtu) {
-                *pmtu = mtu;
-                err = -EMSGSIZE;
-                goto tx_err_dst_release;
-        }
-
-        if (tunnel->err_count > 0) {
-                if (time_before(jiffies,
-                                tunnel->err_time + IP6TUNNEL_ERR_TIMEO)) {
-                        tunnel->err_count--;
-
-                        dst_link_failure(skb);
-                } else
-                        tunnel->err_count = 0;
-        }
-
-        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + dst->header_len;
-
-        if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
-            (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
-                new_skb = skb_realloc_headroom(skb, max_headroom);
-                if (max_headroom > dev->needed_headroom)
-                        dev->needed_headroom = max_headroom;
-                if (!new_skb)
-                        goto tx_err_dst_release;
-
-                if (skb->sk)
-                        skb_set_owner_w(new_skb, skb->sk);
-                consume_skb(skb);
-                skb = new_skb;
-        }
-
-        skb_dst_drop(skb);
-
-        if (fl6->flowi6_mark) {
-                skb_dst_set(skb, dst);
-                ndst = NULL;
-        } else {
-                skb_dst_set_noref(skb, dst);
-        }
-
-        proto = NEXTHDR_GRE;
-        if (encap_limit >= 0) {
-                init_tel_txopt(&opt, encap_limit);
-                ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
-        }
-
-        skb_push(skb, gre_hlen);
-        skb_reset_network_header(skb);
-        skb_set_transport_header(skb, sizeof(*ipv6h));
-
-        /*
-         *      Push down and install the IP header.
-         */
-        ipv6h = ipv6_hdr(skb);
-        *(__be32 *)ipv6h = fl6->flowlabel | htonl(0x60000000);
-        dsfield = INET_ECN_encapsulate(0, dsfield);
-        ipv6_change_dsfield(ipv6h, ~INET_ECN_MASK, dsfield);
-        ipv6h->hop_limit = tunnel->parms.hop_limit;
-        ipv6h->nexthdr = proto;
-        ipv6h->saddr = fl6->saddr;
-        ipv6h->daddr = fl6->daddr;
-
-        ((__be16 *)(ipv6h + 1))[0] = tunnel->parms.o_flags;
-        ((__be16 *)(ipv6h + 1))[1] = (dev->type == ARPHRD_ETHER) ?
-                                   htons(ETH_P_TEB) : skb->protocol;
-
-        if (tunnel->parms.o_flags&(GRE_KEY|GRE_CSUM|GRE_SEQ)) {
-                __be32 *ptr = (__be32 *)(((u8 *)ipv6h) + tunnel->hlen - 4);
-
-                if (tunnel->parms.o_flags&GRE_SEQ) {
-                        ++tunnel->o_seqno;
-                        *ptr = htonl(tunnel->o_seqno);
-                        ptr--;
-                }
-                if (tunnel->parms.o_flags&GRE_KEY) {
-                        *ptr = tunnel->parms.o_key;
-                        ptr--;
-                }
-                if (tunnel->parms.o_flags&GRE_CSUM) {
-                        *ptr = 0;
-                        *(__sum16 *)ptr = ip_compute_csum((void *)(ipv6h+1),
-                                skb->len - sizeof(struct ipv6hdr));
-                }
-        }
-
-        nf_reset(skb);
-        pkt_len = skb->len;
-        err = ip6_local_out(skb);
-
-        if (net_xmit_eval(err) == 0) {
-                struct pcpu_tstats *tstats = this_cpu_ptr(tunnel->dev->tstats);
-
-                tstats->tx_bytes += pkt_len;
-                tstats->tx_packets++;
-        } else {
-                stats->tx_errors++;
-                stats->tx_aborted_errors++;
-        }
-
-        if (ndst)
-                ip6_tnl_dst_store(tunnel, ndst);
-
-        return 0;
-tx_err_link_failure:
-        stats->tx_carrier_errors++;
-        dst_link_failure(skb);
-tx_err_dst_release:
-        dst_release(ndst);
-        return err;
-}
-
-static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev)
-{
-        struct ip6_tnl *t = netdev_priv(dev);
-        const struct iphdr  *iph = ip_hdr(skb);
-        int encap_limit = -1;
-        struct flowi6 fl6;
-        __u8 dsfield;
-        __u32 mtu;
-        int err;
-
-        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
-                encap_limit = t->parms.encap_limit;
-
-        memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
-        fl6.flowi6_proto = IPPROTO_IPIP;
-
-        dsfield = ipv4_get_dsfield(iph);
-
-        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
-                                          & IPV6_TCLASS_MASK;
-        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
-                fl6.flowi6_mark = skb->mark;
-
-        err = ip6gre_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
-        if (err != 0) {
-                /* XXX: send ICMP error even if DF is not set. */
-                if (err == -EMSGSIZE)
-                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
-                                  htonl(mtu));
-                return -1;
-        }
-
-        return 0;
-}
-
-static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev)
-{
-        struct ip6_tnl *t = netdev_priv(dev);
-        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
-        int encap_limit = -1;
-        __u16 offset;
-        struct flowi6 fl6;
-        __u8 dsfield;
-        __u32 mtu;
-        int err;
-
-        if (ipv6_addr_equal(&t->parms.raddr, &ipv6h->saddr))
-                return -1;
-
-        offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
-        if (offset > 0) {
-                struct ipv6_tlv_tnl_enc_lim *tel;
-                tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
-                if (tel->encap_limit == 0) {
-                        icmpv6_send(skb, ICMPV6_PARAMPROB,
-                                    ICMPV6_HDR_FIELD, offset + 2);
-                        return -1;
-                }
-                encap_limit = tel->encap_limit - 1;
-        } else if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
-                encap_limit = t->parms.encap_limit;
-
-        memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
-        fl6.flowi6_proto = IPPROTO_IPV6;
-
-        dsfield = ipv6_get_dsfield(ipv6h);
-        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
-        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
-                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
-        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
-                fl6.flowi6_mark = skb->mark;
-
-        err = ip6gre_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
-        if (err != 0) {
-                if (err == -EMSGSIZE)
-                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
-                return -1;
-        }
-
-        return 0;
-}
-
-/**
- * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
- *   @t: the outgoing tunnel device
- *   @hdr: IPv6 header from the incoming packet
- *
- * Description:
- *   Avoid trivial tunneling loop by checking that tunnel exit-point
- *   doesn't match source of incoming packet.
- *
- * Return:
- *   1 if conflict,
- *   0 else
- **/
-
-static inline bool ip6gre_tnl_addr_conflict(const struct ip6_tnl *t,
-        const struct ipv6hdr *hdr)
-{
-        return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
-}
-
-static int ip6gre_xmit_other(struct sk_buff *skb, struct net_device *dev)
-{
-        struct ip6_tnl *t = netdev_priv(dev);
-        int encap_limit = -1;
-        struct flowi6 fl6;
-        __u32 mtu;
-        int err;
-
-        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
-                encap_limit = t->parms.encap_limit;
-
-        memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
-        fl6.flowi6_proto = skb->protocol;
-
-        err = ip6gre_xmit2(skb, dev, 0, &fl6, encap_limit, &mtu);
-
-        return err;
-}
-
-static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
-        struct net_device *dev)
-{
-        struct ip6_tnl *t = netdev_priv(dev);
-        struct net_device_stats *stats = &t->dev->stats;
-        int ret;
-
-        if (!ip6_tnl_xmit_ctl(t))
-                return -1;
-
-        switch (skb->protocol) {
-        case htons(ETH_P_IP):
-                ret = ip6gre_xmit_ipv4(skb, dev);
-                break;
-        case htons(ETH_P_IPV6):
-                ret = ip6gre_xmit_ipv6(skb, dev);
-                break;
-        default:
-                ret = ip6gre_xmit_other(skb, dev);
-                break;
-        }
-
-        if (ret < 0)
-                goto tx_err;
-
-        return NETDEV_TX_OK;
-
-tx_err:
-        stats->tx_errors++;
-        stats->tx_dropped++;
-        kfree_skb(skb);
-        return NETDEV_TX_OK;
-}
-
-static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
-{
-        struct net_device *dev = t->dev;
-        struct __ip6_tnl_parm *p = &t->parms;
-        struct flowi6 *fl6 = &t->fl.u.ip6;
-        int addend = sizeof(struct ipv6hdr) + 4;
-
-        if (dev->type != ARPHRD_ETHER) {
-                memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
-                memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
-        }
-
-        /* Set up flowi template */
-        fl6->saddr = p->laddr;
-        fl6->daddr = p->raddr;
-        fl6->flowi6_oif = p->link;
-        fl6->flowlabel = 0;
-
-        if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS))
-                fl6->flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
-        if (!(p->flags&IP6_TNL_F_USE_ORIG_FLOWLABEL))
-                fl6->flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;
-
-        p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV|IP6_TNL_F_CAP_PER_PACKET);
-        p->flags |= ip6_tnl_get_cap(t, &p->laddr, &p->raddr);
-
-        if (p->flags&IP6_TNL_F_CAP_XMIT &&
-                        p->flags&IP6_TNL_F_CAP_RCV && dev->type != ARPHRD_ETHER)
-                dev->flags |= IFF_POINTOPOINT;
-        else
-                dev->flags &= ~IFF_POINTOPOINT;
-
-        dev->iflink = p->link;
-
-        /* Precalculate GRE options length */
-        if (t->parms.o_flags&(GRE_CSUM|GRE_KEY|GRE_SEQ)) {
-                if (t->parms.o_flags&GRE_CSUM)
-                        addend += 4;
-                if (t->parms.o_flags&GRE_KEY)
-                        addend += 4;
-                if (t->parms.o_flags&GRE_SEQ)
-                        addend += 4;
-        }
-
-        if (p->flags & IP6_TNL_F_CAP_XMIT) {
-                int strict = (ipv6_addr_type(&p->raddr) &
-                              (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));
-
-                struct rt6_info *rt = rt6_lookup(dev_net(dev),
-                                                 &p->raddr, &p->laddr,
-                                                 p->link, strict);
-
-                if (rt == NULL)
-                        return;
-
-                if (rt->dst.dev) {
-                        dev->hard_header_len = rt->dst.dev->hard_header_len + addend;
-
-                        if (set_mtu) {
-                                dev->mtu = rt->dst.dev->mtu - addend;
-                                if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
-                                        dev->mtu -= 8;
-
-                                if (dev->mtu < IPV6_MIN_MTU)
-                                        dev->mtu = IPV6_MIN_MTU;
-                        }
-                }
-                ip6_rt_put(rt);
-        }
-
-        t->hlen = addend;
-}
-
-static int ip6gre_tnl_change(struct ip6_tnl *t,
-        const struct __ip6_tnl_parm *p, int set_mtu)
-{
-        t->parms.laddr = p->laddr;
-        t->parms.raddr = p->raddr;
-        t->parms.flags = p->flags;
-        t->parms.hop_limit = p->hop_limit;
-        t->parms.encap_limit = p->encap_limit;
-        t->parms.flowinfo = p->flowinfo;
-        t->parms.link = p->link;
-        t->parms.proto = p->proto;
-        t->parms.i_key = p->i_key;
-        t->parms.o_key = p->o_key;
-        t->parms.i_flags = p->i_flags;
-        t->parms.o_flags = p->o_flags;
-        ip6_tnl_dst_reset(t);
-        ip6gre_tnl_link_config(t, set_mtu);
-        return 0;
-}
-
-static void ip6gre_tnl_parm_from_user(struct __ip6_tnl_parm *p,
-        const struct ip6_tnl_parm2 *u)
-{
-        p->laddr = u->laddr;
-        p->raddr = u->raddr;
-        p->flags = u->flags;
-        p->hop_limit = u->hop_limit;
-        p->encap_limit = u->encap_limit;
-        p->flowinfo = u->flowinfo;
-        p->link = u->link;
-        p->i_key = u->i_key;
-        p->o_key = u->o_key;
-        p->i_flags = u->i_flags;
-        p->o_flags = u->o_flags;
-        memcpy(p->name, u->name, sizeof(u->name));
-}
-
-static void ip6gre_tnl_parm_to_user(struct ip6_tnl_parm2 *u,
-        const struct __ip6_tnl_parm *p)
-{
-        u->proto = IPPROTO_GRE;
-        u->laddr = p->laddr;
-        u->raddr = p->raddr;
-        u->flags = p->flags;
-        u->hop_limit = p->hop_limit;
-        u->encap_limit = p->encap_limit;
-        u->flowinfo = p->flowinfo;
-        u->link = p->link;
-        u->i_key = p->i_key;
-        u->o_key = p->o_key;
-        u->i_flags = p->i_flags;
-        u->o_flags = p->o_flags;
-        memcpy(u->name, p->name, sizeof(u->name));
-}
-
-static int ip6gre_tunnel_ioctl(struct net_device *dev,
-        struct ifreq *ifr, int cmd)
-{
-        int err = 0;
-        struct ip6_tnl_parm2 p;
-        struct __ip6_tnl_parm p1;
-        struct ip6_tnl *t;
-        struct net *net = dev_net(dev);
-        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
-
-        switch (cmd) {
-        case SIOCGETTUNNEL:
-                t = NULL;
-                if (dev == ign->fb_tunnel_dev) {
-                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
-                                err = -EFAULT;
-                                break;
-                        }
-                        ip6gre_tnl_parm_from_user(&p1, &p);
-                        t = ip6gre_tunnel_locate(net, &p1, 0);
-                }
-                if (t == NULL)
-                        t = netdev_priv(dev);
-                ip6gre_tnl_parm_to_user(&p, &t->parms);
-                if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
-                        err = -EFAULT;
-                break;
-
-        case SIOCADDTUNNEL:
-        case SIOCCHGTUNNEL:
-                err = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
-                        goto done;
-
-                err = -EFAULT;
-                if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
-                        goto done;
-
-                err = -EINVAL;
-                if ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING))
-                        goto done;
-
-                if (!(p.i_flags&GRE_KEY))
-                        p.i_key = 0;
-                if (!(p.o_flags&GRE_KEY))
-                        p.o_key = 0;
-
-                ip6gre_tnl_parm_from_user(&p1, &p);
-                t = ip6gre_tunnel_locate(net, &p1, cmd == SIOCADDTUNNEL);
-
-                if (dev != ign->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
-                        if (t != NULL) {
-                                if (t->dev != dev) {
-                                        err = -EEXIST;
-                                        break;
-                                }
-                        } else {
-                                t = netdev_priv(dev);
-
-                                ip6gre_tunnel_unlink(ign, t);
-                                synchronize_net();
-                                ip6gre_tnl_change(t, &p1, 1);
-                                ip6gre_tunnel_link(ign, t);
-                                netdev_state_change(dev);
-                        }
-                }
-
-                if (t) {
-                        err = 0;
-
-                        ip6gre_tnl_parm_to_user(&p, &t->parms);
-                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
-                                err = -EFAULT;
-                } else
-                        err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
-                break;
-
-        case SIOCDELTUNNEL:
-                err = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
-                        goto done;
-
-                if (dev == ign->fb_tunnel_dev) {
-                        err = -EFAULT;
-                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
-                                goto done;
-                        err = -ENOENT;
-                        ip6gre_tnl_parm_from_user(&p1, &p);
-                        t = ip6gre_tunnel_locate(net, &p1, 0);
-                        if (t == NULL)
-                                goto done;
-                        err = -EPERM;
-                        if (t == netdev_priv(ign->fb_tunnel_dev))
-                                goto done;
-                        dev = t->dev;
-                }
-                unregister_netdevice(dev);
-                err = 0;
-                break;
-
-        default:
-                err = -EINVAL;
-        }
-
-done:
-        return err;
-}
-
-static int ip6gre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
-{
-        struct ip6_tnl *tunnel = netdev_priv(dev);
-        if (new_mtu < 68 ||
-            new_mtu > 0xFFF8 - dev->hard_header_len - tunnel->hlen)
-                return -EINVAL;
-        dev->mtu = new_mtu;
-        return 0;
-}
-
-static int ip6gre_header(struct sk_buff *skb, struct net_device *dev,
-                        unsigned short type,
-                        const void *daddr, const void *saddr, unsigned int len)
-{
-        struct ip6_tnl *t = netdev_priv(dev);
-        struct ipv6hdr *ipv6h = (struct ipv6hdr *)skb_push(skb, t->hlen);
-        __be16 *p = (__be16 *)(ipv6h+1);
-
-        *(__be32 *)ipv6h = t->fl.u.ip6.flowlabel | htonl(0x60000000);
-        ipv6h->hop_limit = t->parms.hop_limit;
-        ipv6h->nexthdr = NEXTHDR_GRE;
-        ipv6h->saddr = t->parms.laddr;
-        ipv6h->daddr = t->parms.raddr;
-
-        p[0]            = t->parms.o_flags;
-        p[1]            = htons(type);
-
-        /*
-         *      Set the source hardware address.
-         */
-
-        if (saddr)
-                memcpy(&ipv6h->saddr, saddr, sizeof(struct in6_addr));
-        if (daddr)
-                memcpy(&ipv6h->daddr, daddr, sizeof(struct in6_addr));
-        if (!ipv6_addr_any(&ipv6h->daddr))
-                return t->hlen;
-
-        return -t->hlen;
-}
-
-static const struct header_ops ip6gre_header_ops = {
-        .create = ip6gre_header,
-};
-
-static const struct net_device_ops ip6gre_netdev_ops = {
-        .ndo_init               = ip6gre_tunnel_init,
-        .ndo_uninit             = ip6gre_tunnel_uninit,
-        .ndo_start_xmit         = ip6gre_tunnel_xmit,
-        .ndo_do_ioctl           = ip6gre_tunnel_ioctl,
-        .ndo_change_mtu         = ip6gre_tunnel_change_mtu,
-        .ndo_get_stats64        = ip6gre_get_stats64,
-};
-
-static void ip6gre_dev_free(struct net_device *dev)
-{
-        free_percpu(dev->tstats);
-        free_netdev(dev);
-}
-
-static void ip6gre_tunnel_setup(struct net_device *dev)
-{
-        struct ip6_tnl *t;
-
-        dev->netdev_ops = &ip6gre_netdev_ops;
-        dev->destructor = ip6gre_dev_free;
-
-        dev->type = ARPHRD_IP6GRE;
-        dev->hard_header_len = LL_MAX_HEADER + sizeof(struct ipv6hdr) + 4;
-        dev->mtu = ETH_DATA_LEN - sizeof(struct ipv6hdr) - 4;
-        t = netdev_priv(dev);
-        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
-                dev->mtu -= 8;
-        dev->flags |= IFF_NOARP;
-        dev->iflink = 0;
-        dev->addr_len = sizeof(struct in6_addr);
-        dev->features |= NETIF_F_NETNS_LOCAL;
-        dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
-}
-
-static int ip6gre_tunnel_init(struct net_device *dev)
-{
-        struct ip6_tnl *tunnel;
-
-        tunnel = netdev_priv(dev);
-
-        tunnel->dev = dev;
-        strcpy(tunnel->parms.name, dev->name);
-
-        memcpy(dev->dev_addr, &tunnel->parms.laddr, sizeof(struct in6_addr));
-        memcpy(dev->broadcast, &tunnel->parms.raddr, sizeof(struct in6_addr));
-
-        if (ipv6_addr_any(&tunnel->parms.raddr))
-                dev->header_ops = &ip6gre_header_ops;
-
-        dev->tstats = alloc_percpu(struct pcpu_tstats);
-        if (!dev->tstats)
-                return -ENOMEM;
-
-        return 0;
-}
-
-static void ip6gre_fb_tunnel_init(struct net_device *dev)
-{
-        struct ip6_tnl *tunnel = netdev_priv(dev);
-
-        tunnel->dev = dev;
-        strcpy(tunnel->parms.name, dev->name);
-
-        tunnel->hlen            = sizeof(struct ipv6hdr) + 4;
-
-        dev_hold(dev);
-}
-
-
-static struct inet6_protocol ip6gre_protocol __read_mostly = {
-        .handler     = ip6gre_rcv,
-        .err_handler = ip6gre_err,
-        .flags       = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
-};
-
-static void ip6gre_destroy_tunnels(struct ip6gre_net *ign,
-        struct list_head *head)
-{
-        int prio;
-
-        for (prio = 0; prio < 4; prio++) {
-                int h;
-                for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip6_tnl *t;
-
-                        t = rtnl_dereference(ign->tunnels[prio][h]);
-
-                        while (t != NULL) {
-                                unregister_netdevice_queue(t->dev, head);
-                                t = rtnl_dereference(t->next);
-                        }
-                }
-        }
-}
-
-static int __net_init ip6gre_init_net(struct net *net)
-{
-        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
-        int err;
-
-        ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6gre0",
-                                           ip6gre_tunnel_setup);
-        if (!ign->fb_tunnel_dev) {
-                err = -ENOMEM;
-                goto err_alloc_dev;
-        }
-        dev_net_set(ign->fb_tunnel_dev, net);
-
-        ip6gre_fb_tunnel_init(ign->fb_tunnel_dev);
-        ign->fb_tunnel_dev->rtnl_link_ops = &ip6gre_link_ops;
-
-        err = register_netdev(ign->fb_tunnel_dev);
-        if (err)
-                goto err_reg_dev;
-
-        rcu_assign_pointer(ign->tunnels_wc[0],
-                           netdev_priv(ign->fb_tunnel_dev));
-        return 0;
-
-err_reg_dev:
-        ip6gre_dev_free(ign->fb_tunnel_dev);
-err_alloc_dev:
-        return err;
-}
-
-static void __net_exit ip6gre_exit_net(struct net *net)
-{
-        struct ip6gre_net *ign;
-        LIST_HEAD(list);
-
-        ign = net_generic(net, ip6gre_net_id);
-        rtnl_lock();
-        ip6gre_destroy_tunnels(ign, &list);
-        unregister_netdevice_many(&list);
-        rtnl_unlock();
-}
-
-static struct pernet_operations ip6gre_net_ops = {
-        .init = ip6gre_init_net,
-        .exit = ip6gre_exit_net,
-        .id   = &ip6gre_net_id,
-        .size = sizeof(struct ip6gre_net),
-};
-
-static int ip6gre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
-{
-        __be16 flags;
-
-        if (!data)
-                return 0;
-
-        flags = 0;
-        if (data[IFLA_GRE_IFLAGS])
-                flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]);
-        if (data[IFLA_GRE_OFLAGS])
-                flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]);
-        if (flags & (GRE_VERSION|GRE_ROUTING))
-                return -EINVAL;
-
-        return 0;
-}
-
-static int ip6gre_tap_validate(struct nlattr *tb[], struct nlattr *data[])
-{
-        struct in6_addr daddr;
-
-        if (tb[IFLA_ADDRESS]) {
-                if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
-                        return -EINVAL;
-                if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
-                        return -EADDRNOTAVAIL;
-        }
-
-        if (!data)
-                goto out;
-
-        if (data[IFLA_GRE_REMOTE]) {
-                nla_memcpy(&daddr, data[IFLA_GRE_REMOTE], sizeof(struct in6_addr));
-                if (ipv6_addr_any(&daddr))
-                        return -EINVAL;
-        }
-
-out:
-        return ip6gre_tunnel_validate(tb, data);
-}
-
-
-static void ip6gre_netlink_parms(struct nlattr *data[],
-                                struct __ip6_tnl_parm *parms)
-{
-        memset(parms, 0, sizeof(*parms));
-
-        if (!data)
-                return;
-
-        if (data[IFLA_GRE_LINK])
-                parms->link = nla_get_u32(data[IFLA_GRE_LINK]);
-
-        if (data[IFLA_GRE_IFLAGS])
-                parms->i_flags = nla_get_be16(data[IFLA_GRE_IFLAGS]);
-
-        if (data[IFLA_GRE_OFLAGS])
-                parms->o_flags = nla_get_be16(data[IFLA_GRE_OFLAGS]);
-
-        if (data[IFLA_GRE_IKEY])
-                parms->i_key = nla_get_be32(data[IFLA_GRE_IKEY]);
-
-        if (data[IFLA_GRE_OKEY])
-                parms->o_key = nla_get_be32(data[IFLA_GRE_OKEY]);
-
-        if (data[IFLA_GRE_LOCAL])
-                nla_memcpy(&parms->laddr, data[IFLA_GRE_LOCAL], sizeof(struct in6_addr));
-
-        if (data[IFLA_GRE_REMOTE])
-                nla_memcpy(&parms->raddr, data[IFLA_GRE_REMOTE], sizeof(struct in6_addr));
-
-        if (data[IFLA_GRE_TTL])
-                parms->hop_limit = nla_get_u8(data[IFLA_GRE_TTL]);
-
-        if (data[IFLA_GRE_ENCAP_LIMIT])
-                parms->encap_limit = nla_get_u8(data[IFLA_GRE_ENCAP_LIMIT]);
-
-        if (data[IFLA_GRE_FLOWINFO])
-                parms->flowinfo = nla_get_u32(data[IFLA_GRE_FLOWINFO]);
-
-        if (data[IFLA_GRE_FLAGS])
-                parms->flags = nla_get_u32(data[IFLA_GRE_FLAGS]);
-}
-
-static int ip6gre_tap_init(struct net_device *dev)
-{
-        struct ip6_tnl *tunnel;
-
-        tunnel = netdev_priv(dev);
-
-        tunnel->dev = dev;
-        strcpy(tunnel->parms.name, dev->name);
-
-        ip6gre_tnl_link_config(tunnel, 1);
-
-        dev->tstats = alloc_percpu(struct pcpu_tstats);
-        if (!dev->tstats)
-                return -ENOMEM;
-
-        return 0;
-}
-
-static const struct net_device_ops ip6gre_tap_netdev_ops = {
-        .ndo_init = ip6gre_tap_init,
-        .ndo_uninit = ip6gre_tunnel_uninit,
-        .ndo_start_xmit = ip6gre_tunnel_xmit,
-        .ndo_set_mac_address = eth_mac_addr,
-        .ndo_validate_addr = eth_validate_addr,
-        .ndo_change_mtu = ip6gre_tunnel_change_mtu,
-        .ndo_get_stats64 = ip6gre_get_stats64,
-};
-
-static void ip6gre_tap_setup(struct net_device *dev)
-{
-
-        ether_setup(dev);
-
-        dev->netdev_ops = &ip6gre_tap_netdev_ops;
-        dev->destructor = ip6gre_dev_free;
-
-        dev->iflink = 0;
-        dev->features |= NETIF_F_NETNS_LOCAL;
-}
-
-static int ip6gre_newlink(struct net *src_net, struct net_device *dev,
-        struct nlattr *tb[], struct nlattr *data[])
-{
-        struct ip6_tnl *nt;
-        struct net *net = dev_net(dev);
-        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
-        int err;
-
-        nt = netdev_priv(dev);
-        ip6gre_netlink_parms(data, &nt->parms);
-
-        if (ip6gre_tunnel_find(net, &nt->parms, dev->type))
-                return -EEXIST;
-
-        if (dev->type == ARPHRD_ETHER && !tb[IFLA_ADDRESS])
-                eth_hw_addr_random(dev);
-
-        nt->dev = dev;
-        ip6gre_tnl_link_config(nt, !tb[IFLA_MTU]);
-
-        /* Can use a lockless transmit, unless we generate output sequences */
-        if (!(nt->parms.o_flags & GRE_SEQ))
-                dev->features |= NETIF_F_LLTX;
-
-        err = register_netdevice(dev);
-        if (err)
-                goto out;
-
-        dev_hold(dev);
-        ip6gre_tunnel_link(ign, nt);
-
-out:
-        return err;
-}
-
-static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
-                            struct nlattr *data[])
-{
-        struct ip6_tnl *t, *nt;
-        struct net *net = dev_net(dev);
-        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
-        struct __ip6_tnl_parm p;
-
-        if (dev == ign->fb_tunnel_dev)
-                return -EINVAL;
-
-        nt = netdev_priv(dev);
-        ip6gre_netlink_parms(data, &p);
-
-        t = ip6gre_tunnel_locate(net, &p, 0);
-
-        if (t) {
-                if (t->dev != dev)
-                        return -EEXIST;
-        } else {
-                t = nt;
-
-                ip6gre_tunnel_unlink(ign, t);
-                ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
-                ip6gre_tunnel_link(ign, t);
-                netdev_state_change(dev);
-        }
-
-        return 0;
-}
-
-static size_t ip6gre_get_size(const struct net_device *dev)
-{
-        return
-                /* IFLA_GRE_LINK */
-                nla_total_size(4) +
-                /* IFLA_GRE_IFLAGS */
-                nla_total_size(2) +
-                /* IFLA_GRE_OFLAGS */
-                nla_total_size(2) +
-                /* IFLA_GRE_IKEY */
-                nla_total_size(4) +
-                /* IFLA_GRE_OKEY */
-                nla_total_size(4) +
-                /* IFLA_GRE_LOCAL */
-                nla_total_size(sizeof(struct in6_addr)) +
-                /* IFLA_GRE_REMOTE */
-                nla_total_size(sizeof(struct in6_addr)) +
-                /* IFLA_GRE_TTL */
-                nla_total_size(1) +
-                /* IFLA_GRE_TOS */
-                nla_total_size(1) +
-                /* IFLA_GRE_ENCAP_LIMIT */
-                nla_total_size(1) +
-                /* IFLA_GRE_FLOWINFO */
-                nla_total_size(4) +
-                /* IFLA_GRE_FLAGS */
-                nla_total_size(4) +
-                0;
-}
-
-static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
-{
-        struct ip6_tnl *t = netdev_priv(dev);
-        struct __ip6_tnl_parm *p = &t->parms;
-
-        if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
-            nla_put_be16(skb, IFLA_GRE_IFLAGS, p->i_flags) ||
-            nla_put_be16(skb, IFLA_GRE_OFLAGS, p->o_flags) ||
-            nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
-            nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
-            nla_put(skb, IFLA_GRE_LOCAL, sizeof(struct in6_addr), &p->laddr) ||
-            nla_put(skb, IFLA_GRE_REMOTE, sizeof(struct in6_addr), &p->raddr) ||
-            nla_put_u8(skb, IFLA_GRE_TTL, p->hop_limit) ||
-            /*nla_put_u8(skb, IFLA_GRE_TOS, t->priority) ||*/
-            nla_put_u8(skb, IFLA_GRE_ENCAP_LIMIT, p->encap_limit) ||
-            nla_put_be32(skb, IFLA_GRE_FLOWINFO, p->flowinfo) ||
-            nla_put_u32(skb, IFLA_GRE_FLAGS, p->flags))
-                goto nla_put_failure;
-        return 0;
-
-nla_put_failure:
-        return -EMSGSIZE;
-}
-
-static const struct nla_policy ip6gre_policy[IFLA_GRE_MAX + 1] = {
-        [IFLA_GRE_LINK]        = { .type = NLA_U32 },
-        [IFLA_GRE_IFLAGS]      = { .type = NLA_U16 },
-        [IFLA_GRE_OFLAGS]      = { .type = NLA_U16 },
-        [IFLA_GRE_IKEY]        = { .type = NLA_U32 },
-        [IFLA_GRE_OKEY]        = { .type = NLA_U32 },
-        [IFLA_GRE_LOCAL]       = { .len = FIELD_SIZEOF(struct ipv6hdr, saddr) },
-        [IFLA_GRE_REMOTE]      = { .len = FIELD_SIZEOF(struct ipv6hdr, daddr) },
-        [IFLA_GRE_TTL]         = { .type = NLA_U8 },
-        [IFLA_GRE_ENCAP_LIMIT] = { .type = NLA_U8 },
-        [IFLA_GRE_FLOWINFO]    = { .type = NLA_U32 },
-        [IFLA_GRE_FLAGS]       = { .type = NLA_U32 },
-};
-
-static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
-        .kind           = "ip6gre",
-        .maxtype        = IFLA_GRE_MAX,
-        .policy         = ip6gre_policy,
-        .priv_size      = sizeof(struct ip6_tnl),
-        .setup          = ip6gre_tunnel_setup,
-        .validate       = ip6gre_tunnel_validate,
-        .newlink        = ip6gre_newlink,
-        .changelink     = ip6gre_changelink,
-        .get_size       = ip6gre_get_size,
-        .fill_info      = ip6gre_fill_info,
-};
-
-static struct rtnl_link_ops ip6gre_tap_ops __read_mostly = {
-        .kind           = "ip6gretap",
-        .maxtype        = IFLA_GRE_MAX,
-        .policy         = ip6gre_policy,
-        .priv_size      = sizeof(struct ip6_tnl),
-        .setup          = ip6gre_tap_setup,
-        .validate       = ip6gre_tap_validate,
-        .newlink        = ip6gre_newlink,
-        .changelink     = ip6gre_changelink,
-        .get_size       = ip6gre_get_size,
-        .fill_info      = ip6gre_fill_info,
-};
-
-/*
- *      And now the modules code and kernel interface.
- */
-
-static int __init ip6gre_init(void)
-{
-        int err;
-
-        pr_info("GRE over IPv6 tunneling driver\n");
-
-        err = register_pernet_device(&ip6gre_net_ops);
-        if (err < 0)
-                return err;
-
-        err = inet6_add_protocol(&ip6gre_protocol, IPPROTO_GRE);
-        if (err < 0) {
-                pr_info("%s: can't add protocol\n", __func__);
-                goto add_proto_failed;
-        }
-
-        err = rtnl_link_register(&ip6gre_link_ops);
-        if (err < 0)
-                goto rtnl_link_failed;
-
-        err = rtnl_link_register(&ip6gre_tap_ops);
-        if (err < 0)
-                goto tap_ops_failed;
-
-out:
-        return err;
-
-tap_ops_failed:
-        rtnl_link_unregister(&ip6gre_link_ops);
-rtnl_link_failed:
-        inet6_del_protocol(&ip6gre_protocol, IPPROTO_GRE);
-add_proto_failed:
-        unregister_pernet_device(&ip6gre_net_ops);
-        goto out;
-}
-
-static void __exit ip6gre_fini(void)
-{
-        rtnl_link_unregister(&ip6gre_tap_ops);
-        rtnl_link_unregister(&ip6gre_link_ops);
-        inet6_del_protocol(&ip6gre_protocol, IPPROTO_GRE);
-        unregister_pernet_device(&ip6gre_net_ops);
-}
-
-module_init(ip6gre_init);
-module_exit(ip6gre_fini);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("D. Kozlov (xeb@mail.ru)");
-MODULE_DESCRIPTION("GRE over IPv6 tunneling device");
-MODULE_ALIAS_RTNL_LINK("ip6gre");
-MODULE_ALIAS_NETDEV("ip6gre0");
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index a52d864d562..027c7ff6f1e 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -47,16 +47,9 @@
 
 
 
-int ip6_rcv_finish(struct sk_buff *skb)
+inline int ip6_rcv_finish( struct sk_buff *skb)
 {
-        if (sysctl_ip_early_demux && !skb_dst(skb)) {
-                const struct inet6_protocol *ipprot;
-
-                ipprot = rcu_dereference(inet6_protos[ipv6_hdr(skb)->nexthdr]);
-                if (ipprot && ipprot->early_demux)
-                        ipprot->early_demux(skb);
-        }
-        if (!skb_dst(skb))
+        if (skb_dst(skb) == NULL)
                 ip6_route_input(skb);
 
         return dst_input(skb);
@@ -118,14 +111,6 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
             ipv6_addr_loopback(&hdr->daddr))
                 goto err;
 
-        /*
-         * RFC4291 2.7
-         * Multicast addresses must not be used as source addresses in IPv6
-         * packets or appear in any Routing header.
-         */
-        if (ipv6_addr_is_multicast(&hdr->saddr))
-                goto err;
-
         skb->transport_header = skb->network_header + sizeof(*hdr);
         IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
 
@@ -175,12 +160,12 @@ drop:
 
 static int ip6_input_finish(struct sk_buff *skb)
 {
-        struct net *net = dev_net(skb_dst(skb)->dev);
         const struct inet6_protocol *ipprot;
-        struct inet6_dev *idev;
         unsigned int nhoff;
-        int nexthdr;
-        bool raw;
+        int nexthdr, raw;
+        u8 hash;
+        struct inet6_dev *idev;
+        struct net *net = dev_net(skb_dst(skb)->dev);
 
         /*
          *      Parse extension headers
@@ -195,7 +180,9 @@ resubmit:
         nexthdr = skb_network_header(skb)[nhoff];
 
         raw = raw6_local_deliver(skb, nexthdr);
-        if ((ipprot = rcu_dereference(inet6_protos[nexthdr])) != NULL) {
+
+        hash = nexthdr & (MAX_INET_PROTOS - 1);
+        if ((ipprot = rcu_dereference(inet6_protos[hash])) != NULL) {
                 int ret;
 
                 if (ipprot->flags & INET6_PROTO_FINAL) {
@@ -256,7 +243,7 @@ int ip6_input(struct sk_buff *skb)
 int ip6_mc_input(struct sk_buff *skb)
 {
         const struct ipv6hdr *hdr;
-        bool deliver;
+        int deliver;
 
         IP6_UPD_PO_STATS_BH(dev_net(skb_dst(skb)->dev),
                          ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INMCAST,
@@ -285,21 +272,20 @@ int ip6_mc_input(struct sk_buff *skb)
                         u8 *ptr = skb_network_header(skb) + opt->ra;
                         struct icmp6hdr *icmp6;
                         u8 nexthdr = hdr->nexthdr;
-                        __be16 frag_off;
                         int offset;
 
                         /* Check if the value of Router Alert
                          * is for MLD (0x0000).
                          */
                         if ((ptr[2] | ptr[3]) == 0) {
-                                deliver = false;
+                                deliver = 0;
 
                                 if (!ipv6_ext_hdr(nexthdr)) {
                                         /* BUG */
                                         goto out;
                                 }
                                 offset = ipv6_skip_exthdr(skb, sizeof(*hdr),
-                                                          &nexthdr, &frag_off);
+                                                          &nexthdr);
                                 if (offset < 0)
                                         goto out;
 
@@ -317,7 +303,7 @@ int ip6_mc_input(struct sk_buff *skb)
                                 case ICMPV6_MGM_REPORT:
                                 case ICMPV6_MGM_REDUCTION:
                                 case ICMPV6_MLD2_REPORT:
-                                        deliver = true;
+                                        deliver = 1;
                                         break;
                                 }
                                 goto out;
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
deleted file mode 100644
index f26f0da7f09..00000000000
--- a/net/ipv6/ip6_offload.c
+++ /dev/null
@@ -1,282 +0,0 @@
-/*
- *      IPV6 GSO/GRO offload support
- *      Linux INET6 implementation
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-
-#include <linux/kernel.h>
-#include <linux/socket.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/printk.h>
-
-#include <net/protocol.h>
-#include <net/ipv6.h>
-
-#include "ip6_offload.h"
-
-static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto)
-{
-        const struct net_offload *ops = NULL;
-
-        for (;;) {
-                struct ipv6_opt_hdr *opth;
-                int len;
-
-                if (proto != NEXTHDR_HOP) {
-                        ops = rcu_dereference(inet6_offloads[proto]);
-
-                        if (unlikely(!ops))
-                                break;
-
-                        if (!(ops->flags & INET6_PROTO_GSO_EXTHDR))
-                                break;
-                }
-
-                if (unlikely(!pskb_may_pull(skb, 8)))
-                        break;
-
-                opth = (void *)skb->data;
-                len = ipv6_optlen(opth);
-
-                if (unlikely(!pskb_may_pull(skb, len)))
-                        break;
-
-                proto = opth->nexthdr;
-                __skb_pull(skb, len);
-        }
-
-        return proto;
-}
-
-static int ipv6_gso_send_check(struct sk_buff *skb)
-{
-        const struct ipv6hdr *ipv6h;
-        const struct net_offload *ops;
-        int err = -EINVAL;
-
-        if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
-                goto out;
-
-        ipv6h = ipv6_hdr(skb);
-        __skb_pull(skb, sizeof(*ipv6h));
-        err = -EPROTONOSUPPORT;
-
-        rcu_read_lock();
-        ops = rcu_dereference(inet6_offloads[
-                ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr)]);
-
-        if (likely(ops && ops->callbacks.gso_send_check)) {
-                skb_reset_transport_header(skb);
-                err = ops->callbacks.gso_send_check(skb);
-        }
-        rcu_read_unlock();
-
-out:
-        return err;
-}
-
-static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
-        netdev_features_t features)
-{
-        struct sk_buff *segs = ERR_PTR(-EINVAL);
-        struct ipv6hdr *ipv6h;
-        const struct net_offload *ops;
-        int proto;
-        struct frag_hdr *fptr;
-        unsigned int unfrag_ip6hlen;
-        u8 *prevhdr;
-        int offset = 0;
-
-        if (!(features & NETIF_F_V6_CSUM))
-                features &= ~NETIF_F_SG;
-
-        if (unlikely(skb_shinfo(skb)->gso_type &
-                     ~(SKB_GSO_UDP |
-                       SKB_GSO_DODGY |
-                       SKB_GSO_TCP_ECN |
-                       SKB_GSO_TCPV6 |
-                       0)))
-                goto out;
-
-        if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
-                goto out;
-
-        ipv6h = ipv6_hdr(skb);
-        __skb_pull(skb, sizeof(*ipv6h));
-        segs = ERR_PTR(-EPROTONOSUPPORT);
-
-        proto = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
-        rcu_read_lock();
-        ops = rcu_dereference(inet6_offloads[proto]);
-        if (likely(ops && ops->callbacks.gso_segment)) {
-                skb_reset_transport_header(skb);
-                segs = ops->callbacks.gso_segment(skb, features);
-        }
-        rcu_read_unlock();
-
-        if (IS_ERR(segs))
-                goto out;
-
-        for (skb = segs; skb; skb = skb->next) {
-                ipv6h = ipv6_hdr(skb);
-                ipv6h->payload_len = htons(skb->len - skb->mac_len -
-                                           sizeof(*ipv6h));
-                if (proto == IPPROTO_UDP) {
-                        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
-                        fptr = (struct frag_hdr *)(skb_network_header(skb) +
-                                unfrag_ip6hlen);
-                        fptr->frag_off = htons(offset);
-                        if (skb->next != NULL)
-                                fptr->frag_off |= htons(IP6_MF);
-                        offset += (ntohs(ipv6h->payload_len) -
-                                   sizeof(struct frag_hdr));
-                }
-        }
-
-out:
-        return segs;
-}
-
-static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
-                                         struct sk_buff *skb)
-{
-        const struct net_offload *ops;
-        struct sk_buff **pp = NULL;
-        struct sk_buff *p;
-        struct ipv6hdr *iph;
-        unsigned int nlen;
-        unsigned int hlen;
-        unsigned int off;
-        int flush = 1;
-        int proto;
-        __wsum csum;
-
-        off = skb_gro_offset(skb);
-        hlen = off + sizeof(*iph);
-        iph = skb_gro_header_fast(skb, off);
-        if (skb_gro_header_hard(skb, hlen)) {
-                iph = skb_gro_header_slow(skb, hlen, off);
-                if (unlikely(!iph))
-                        goto out;
-        }
-
-        skb_gro_pull(skb, sizeof(*iph));
-        skb_set_transport_header(skb, skb_gro_offset(skb));
-
-        flush += ntohs(iph->payload_len) != skb_gro_len(skb);
-
-        rcu_read_lock();
-        proto = iph->nexthdr;
-        ops = rcu_dereference(inet6_offloads[proto]);
-        if (!ops || !ops->callbacks.gro_receive) {
-                __pskb_pull(skb, skb_gro_offset(skb));
-                proto = ipv6_gso_pull_exthdrs(skb, proto);
-                skb_gro_pull(skb, -skb_transport_offset(skb));
-                skb_reset_transport_header(skb);
-                __skb_push(skb, skb_gro_offset(skb));
-
-                ops = rcu_dereference(inet6_offloads[proto]);
-                if (!ops || !ops->callbacks.gro_receive)
-                        goto out_unlock;
-
-                iph = ipv6_hdr(skb);
-        }
-
-        NAPI_GRO_CB(skb)->proto = proto;
-
-        flush--;
-        nlen = skb_network_header_len(skb);
-
-        for (p = *head; p; p = p->next) {
-                const struct ipv6hdr *iph2;
-                __be32 first_word; /* <Version:4><Traffic_Class:8><Flow_Label:20> */
-
-                if (!NAPI_GRO_CB(p)->same_flow)
-                        continue;
-
-                iph2 = ipv6_hdr(p);
-                first_word = *(__be32 *)iph ^ *(__be32 *)iph2 ;
-
-                /* All fields must match except length and Traffic Class. */
-                if (nlen != skb_network_header_len(p) ||
-                    (first_word & htonl(0xF00FFFFF)) ||
-                    memcmp(&iph->nexthdr, &iph2->nexthdr,
-                           nlen - offsetof(struct ipv6hdr, nexthdr))) {
-                        NAPI_GRO_CB(p)->same_flow = 0;
-                        continue;
-                }
-                /* flush if Traffic Class fields are different */
-                NAPI_GRO_CB(p)->flush |= !!(first_word & htonl(0x0FF00000));
-                NAPI_GRO_CB(p)->flush |= flush;
-        }
-
-        NAPI_GRO_CB(skb)->flush |= flush;
-
-        csum = skb->csum;
-        skb_postpull_rcsum(skb, iph, skb_network_header_len(skb));
-
-        pp = ops->callbacks.gro_receive(head, skb);
-
-        skb->csum = csum;
-
-out_unlock:
-        rcu_read_unlock();
-
-out:
-        NAPI_GRO_CB(skb)->flush |= flush;
-
-        return pp;
-}
-
-static int ipv6_gro_complete(struct sk_buff *skb)
-{
-        const struct net_offload *ops;
-        struct ipv6hdr *iph = ipv6_hdr(skb);
-        int err = -ENOSYS;
-
-        iph->payload_len = htons(skb->len - skb_network_offset(skb) -
-                                 sizeof(*iph));
-
-        rcu_read_lock();
-        ops = rcu_dereference(inet6_offloads[NAPI_GRO_CB(skb)->proto]);
-        if (WARN_ON(!ops || !ops->callbacks.gro_complete))
-                goto out_unlock;
-
-        err = ops->callbacks.gro_complete(skb);
-
-out_unlock:
-        rcu_read_unlock();
-
-        return err;
-}
-
-static struct packet_offload ipv6_packet_offload __read_mostly = {
-        .type = cpu_to_be16(ETH_P_IPV6),
-        .callbacks = {
-                .gso_send_check = ipv6_gso_send_check,
-                .gso_segment = ipv6_gso_segment,
-                .gro_receive = ipv6_gro_receive,
-                .gro_complete = ipv6_gro_complete,
-        },
-};
-
-static int __init ipv6_offload_init(void)
-{
-
-        if (tcpv6_offload_init() < 0)
-                pr_crit("%s: Cannot add TCP protocol offload\n", __func__);
-        if (udp_offload_init() < 0)
-                pr_crit("%s: Cannot add UDP protocol offload\n", __func__);
-        if (ipv6_exthdrs_offload_init() < 0)
-                pr_crit("%s: Cannot add EXTHDRS protocol offload\n", __func__);
-
-        dev_add_offload(&ipv6_packet_offload);
-        return 0;
-}
-
-fs_initcall(ipv6_offload_init);
diff --git a/net/ipv6/ip6_offload.h b/net/ipv6/ip6_offload.h
deleted file mode 100644
index 2e155c651b3..00000000000
--- a/net/ipv6/ip6_offload.h
+++ /dev/null
@@ -1,18 +0,0 @@
-/*
- *      IPV6 GSO/GRO offload support
- *      Linux INET6 implementation
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- */
-
-#ifndef __ip6_offload_h
-#define __ip6_offload_h
-
-int ipv6_exthdrs_offload_init(void);
-int udp_offload_init(void);
-int tcpv6_offload_init(void);
-
-#endif
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5552d13ae92..55a35c1dede 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -83,12 +83,24 @@ int ip6_local_out(struct sk_buff *skb)
 }
 EXPORT_SYMBOL_GPL(ip6_local_out);
 
+/* dev_loopback_xmit for use with netfilter. */
+static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
+{
+        skb_reset_mac_header(newskb);
+        __skb_pull(newskb, skb_network_offset(newskb));
+        newskb->pkt_type = PACKET_LOOPBACK;
+        newskb->ip_summed = CHECKSUM_UNNECESSARY;
+        WARN_ON(!skb_dst(newskb));
+
+        netif_rx_ni(newskb);
+        return 0;
+}
+
 static int ip6_finish_output2(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *dev = dst->dev;
         struct neighbour *neigh;
-        struct rt6_info *rt;
 
         skb->protocol = htons(ETH_P_IPV6);
         skb->dev = dev;
@@ -109,7 +121,7 @@ static int ip6_finish_output2(struct sk_buff *skb)
                         if (newskb)
                                 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
                                         newskb, NULL, newskb->dev,
-                                        dev_loopback_xmit);
+                                        ip6_dev_loopback_xmit);
 
                         if (ipv6_hdr(skb)->hop_limit == 0) {
                                 IP6_INC_STATS(dev_net(dev), idev,
@@ -123,11 +135,15 @@ static int ip6_finish_output2(struct sk_buff *skb)
                                 skb->len);
         }
 
-        rt = (struct rt6_info *) dst;
-        neigh = rt->n;
-        if (neigh)
-                return dst_neigh_output(dst, neigh, skb);
+        rcu_read_lock();
+        neigh = dst_get_neighbour(dst);
+        if (neigh) {
+                int res = neigh_output(neigh, skb);
 
+                rcu_read_unlock();
+                return res;
+        }
+        rcu_read_unlock();
         IP6_INC_STATS_BH(dev_net(dst->dev),
                          ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
         kfree_skb(skb);
@@ -164,7 +180,7 @@ int ip6_output(struct sk_buff *skb)
  */
 
 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
-             struct ipv6_txoptions *opt, int tclass)
+             struct ipv6_txoptions *opt)
 {
         struct net *net = sock_net(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -174,6 +190,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
         u8  proto = fl6->flowi6_proto;
         int seg_len = skb->len;
         int hlimit = -1;
+        int tclass = 0;
         u32 mtu;
 
         if (opt) {
@@ -194,7 +211,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
                                 kfree_skb(skb);
                                 return -ENOBUFS;
                         }
-                        consume_skb(skb);
+                        kfree_skb(skb);
                         skb = skb2;
                         skb_set_owner_w(skb, sk);
                 }
@@ -211,8 +228,10 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
         /*
          *      Fill in the IPv6 header
          */
-        if (np)
+        if (np) {
+                tclass = np->tclass;
                 hlimit = np->hop_limit;
+        }
         if (hlimit < 0)
                 hlimit = ip6_dst_hoplimit(dst);
 
@@ -222,8 +241,8 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
         hdr->nexthdr = proto;
         hdr->hop_limit = hlimit;
 
-        hdr->saddr = fl6->saddr;
-        hdr->daddr = *first_hop;
+        ipv6_addr_copy(&hdr->saddr, &fl6->saddr);
+        ipv6_addr_copy(&hdr->daddr, first_hop);
 
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
@@ -236,7 +255,8 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
                                dst->dev, dst_output);
         }
 
-        net_dbg_ratelimited("IPv6: sending pkt_too_big to self\n");
+        if (net_ratelimit())
+                printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
         skb->dev = dst->dev;
         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
@@ -273,8 +293,8 @@ int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
         hdr->nexthdr = proto;
         hdr->hop_limit = np->hop_limit;
 
-        hdr->saddr = *saddr;
-        hdr->daddr = *daddr;
+        ipv6_addr_copy(&hdr->saddr, saddr);
+        ipv6_addr_copy(&hdr->daddr, daddr);
 
         return 0;
 }
@@ -312,11 +332,10 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
 {
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         u8 nexthdr = hdr->nexthdr;
-        __be16 frag_off;
         int offset;
 
         if (ipv6_ext_hdr(nexthdr)) {
-                offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
+                offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr);
                 if (offset < 0)
                         return 0;
         } else
@@ -371,6 +390,7 @@ int ip6_forward(struct sk_buff *skb)
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct inet6_skb_parm *opt = IP6CB(skb);
         struct net *net = dev_net(dst->dev);
+        struct neighbour *n;
         u32 mtu;
 
         if (net->ipv6.devconf_all->forwarding == 0)
@@ -445,9 +465,9 @@ int ip6_forward(struct sk_buff *skb)
            send redirects to source routed frames.
            We don't send redirects to frames decapsulated from IPsec.
          */
-        if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
+        n = dst_get_neighbour(dst);
+        if (skb->dev == dst->dev && n && opt->srcrt == 0 && !skb_sec_path(skb)) {
                 struct in6_addr *target = NULL;
-                struct inet_peer *peer;
                 struct rt6_info *rt;
 
                 /*
@@ -456,20 +476,19 @@ int ip6_forward(struct sk_buff *skb)
                  */
 
                 rt = (struct rt6_info *) dst;
-                if (rt->rt6i_flags & RTF_GATEWAY)
-                        target = &rt->rt6i_gateway;
+                if ((rt->rt6i_flags & RTF_GATEWAY))
+                        target = (struct in6_addr*)&n->primary_key;
                 else
                         target = &hdr->daddr;
 
-                peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
 
                 /* Limit redirects both by destination (here)
                    and by source (inside ndisc_send_redirect)
                  */
-                if (inet_peer_xrlim_allow(peer, 1*HZ))
-                        ndisc_send_redirect(skb, target);
-                if (peer)
-                        inet_putpeer(peer);
+                if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
+                        ndisc_send_redirect(skb, n, target);
         } else {
                 int addrtype = ipv6_addr_type(&hdr->saddr);
 
@@ -488,8 +507,7 @@ int ip6_forward(struct sk_buff *skb)
         if (mtu < IPV6_MIN_MTU)
                 mtu = IPV6_MIN_MTU;
 
-        if ((!skb->local_df && skb->len > mtu && !skb_is_gso(skb)) ||
-            (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)) {
+        if (skb->len > mtu && !skb_is_gso(skb)) {
                 /* Again, force OUTPUT device used as source address */
                 skb->dev = dst->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
@@ -513,7 +531,6 @@ int ip6_forward(struct sk_buff *skb)
         hdr->hop_limit--;
 
         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
-        IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
         return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
                        ip6_forward_finish);
 
@@ -538,12 +555,77 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->tc_index = from->tc_index;
 #endif
         nf_copy(to, from);
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
+#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
+    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
         to->nf_trace = from->nf_trace;
 #endif
         skb_copy_secmark(to, from);
 }
 
+int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+{
+        u16 offset = sizeof(struct ipv6hdr);
+        struct ipv6_opt_hdr *exthdr =
+                                (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
+        unsigned int packet_len = skb->tail - skb->network_header;
+        int found_rhdr = 0;
+        *nexthdr = &ipv6_hdr(skb)->nexthdr;
+
+        while (offset + 1 <= packet_len) {
+
+                switch (**nexthdr) {
+
+                case NEXTHDR_HOP:
+                        break;
+                case NEXTHDR_ROUTING:
+                        found_rhdr = 1;
+                        break;
+                case NEXTHDR_DEST:
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+                        if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
+                                break;
+#endif
+                        if (found_rhdr)
+                                return offset;
+                        break;
+                default :
+                        return offset;
+                }
+
+                offset += ipv6_optlen(exthdr);
+                *nexthdr = &exthdr->nexthdr;
+                exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
+                                                 offset);
+        }
+
+        return offset;
+}
+
+void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
+{
+        static atomic_t ipv6_fragmentation_id;
+        int old, new;
+
+        if (rt && !(rt->dst.flags & DST_NOPEER)) {
+                struct inet_peer *peer;
+
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
+                peer = rt->rt6i_peer;
+                if (peer) {
+                        fhdr->identification = htonl(inet_getid(peer, 0));
+                        return;
+                }
+        }
+        do {
+                old = atomic_read(&ipv6_fragmentation_id);
+                new = old + 1;
+                if (!new)
+                        new = 1;
+        } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
+        fhdr->identification = htonl(new);
+}
+
 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
         struct sk_buff *frag;
@@ -552,7 +634,6 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
         unsigned int mtu, hlen, left, len;
-        int hroom, troom;
         __be32 frag_id = 0;
         int ptr, offset = 0, err=0;
         u8 *prevhdr, nexthdr = 0;
@@ -566,12 +647,7 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         /* We must not fragment if the socket is set to force MTU discovery
          * or if the skb it not generated by a local socket.
          */
-        if (unlikely(!skb->local_df && skb->len > mtu) ||
-                     (IP6CB(skb)->frag_max_size &&
-                      IP6CB(skb)->frag_max_size > mtu)) {
-                if (skb->sk && dst_allfrag(skb_dst(skb)))
-                        sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
-
+        if (!skb->local_df && skb->len > mtu) {
                 skb->dev = skb_dst(skb)->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
@@ -690,7 +766,7 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 if (err == 0) {
                         IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
                                       IPSTATS_MIB_FRAGOKS);
-                        ip6_rt_put(rt);
+                        dst_release(&rt->dst);
                         return 0;
                 }
 
@@ -702,7 +778,7 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
                               IPSTATS_MIB_FRAGFAILS);
-                ip6_rt_put(rt);
+                dst_release(&rt->dst);
                 return err;
 
 slow_path_clean:
@@ -716,10 +792,6 @@ slow_path_clean:
         }
 
 slow_path:
-        if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
-            skb_checksum_help(skb))
-                goto fail;
-
         left = skb->len - hlen;         /* Space per frame */
         ptr = hlen;                     /* Where to start from */
 
@@ -728,8 +800,6 @@ slow_path:
          */
 
         *prevhdr = NEXTHDR_FRAGMENT;
-        hroom = LL_RESERVED_SPACE(rt->dst.dev);
-        troom = rt->dst.dev->needed_tailroom;
 
         /*
          *      Keep copying data until we run out.
@@ -748,8 +818,7 @@ slow_path:
                  *      Allocate buffer.
                  */
 
-                if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
-                                      hroom + troom, GFP_ATOMIC)) == NULL) {
+                if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_ALLOCATED_SPACE(rt->dst.dev), GFP_ATOMIC)) == NULL) {
                         NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
                                       IPSTATS_MIB_FRAGFAILS);
@@ -762,7 +831,7 @@ slow_path:
                  */
 
                 ip6_copy_metadata(frag, skb);
-                skb_reserve(frag, hroom);
+                skb_reserve(frag, LL_RESERVED_SPACE(rt->dst.dev));
                 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
                 skb_reset_network_header(frag);
                 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
@@ -820,7 +889,7 @@ slow_path:
         }
         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
                       IPSTATS_MIB_FRAGOKS);
-        consume_skb(skb);
+        kfree_skb(skb);
         return err;
 
 fail:
@@ -884,7 +953,6 @@ static int ip6_dst_lookup_tail(struct sock *sk,
         struct net *net = sock_net(sk);
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
         struct neighbour *n;
-        struct rt6_info *rt;
 #endif
         int err;
 
@@ -912,13 +980,14 @@ static int ip6_dst_lookup_tail(struct sock *sk,
          * dst entry and replace it instead with the
          * dst entry of the nexthop router
          */
-        rt = (struct rt6_info *) *dst;
-        n = rt->n;
+        rcu_read_lock();
+        n = dst_get_neighbour(*dst);
         if (n && !(n->nud_state & NUD_VALID)) {
                 struct inet6_ifaddr *ifp;
                 struct flowi6 fl_gw6;
                 int redirect;
 
+                rcu_read_unlock();
                 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
                                       (*dst)->dev, 1);
 
@@ -938,6 +1007,8 @@ static int ip6_dst_lookup_tail(struct sock *sk,
                         if ((err = (*dst)->error))
                                 goto out_err_release;
                 }
+        } else {
+                rcu_read_unlock();
         }
 #endif
 
@@ -991,7 +1062,7 @@ struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
         if (err)
                 return ERR_PTR(err);
         if (final_dst)
-                fl6->daddr = *final_dst;
+                ipv6_addr_copy(&fl6->daddr, final_dst);
         if (can_sleep)
                 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
 
@@ -1027,7 +1098,7 @@ struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
         if (err)
                 return ERR_PTR(err);
         if (final_dst)
-                fl6->daddr = *final_dst;
+                ipv6_addr_copy(&fl6->daddr, final_dst);
         if (can_sleep)
                 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
 
@@ -1055,7 +1126,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                         hh_len + fragheaderlen + transhdrlen + 20,
                         (flags & MSG_DONTWAIT), &err);
                 if (skb == NULL)
-                        return err;
+                        return -ENOMEM;
 
                 /* reserve space for Hardware header */
                 skb_reserve(skb, hh_len);
@@ -1110,29 +1181,6 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
 }
 
-static void ip6_append_data_mtu(int *mtu,
-                                int *maxfraglen,
-                                unsigned int fragheaderlen,
-                                struct sk_buff *skb,
-                                struct rt6_info *rt)
-{
-        if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
-                if (skb == NULL) {
-                        /* first fragment, reserve header_len */
-                        *mtu = *mtu - rt->dst.header_len;
-
-                } else {
-                        /*
-                         * this fragment is not first, the headers
-                         * space is regarded as data space.
-                         */
-                        *mtu = dst_mtu(rt->dst.path);
-                }
-                *maxfraglen = ((*mtu - fragheaderlen) & ~7)
-                              + fragheaderlen - sizeof(struct frag_hdr);
-        }
-}
-
 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int offset, int len, int odd, struct sk_buff *skb),
         void *from, int length, int transhdrlen,
@@ -1142,15 +1190,15 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet_cork *cork;
-        struct sk_buff *skb, *skb_prev = NULL;
+        struct sk_buff *skb;
         unsigned int maxfraglen, fragheaderlen;
         int exthdrlen;
-        int dst_exthdrlen;
         int hh_len;
         int mtu;
         int copy;
         int err;
         int offset = 0;
+        int csummode = CHECKSUM_NONE;
         __u8 tx_flags = 0;
 
         if (flags&MSG_PROBE)
@@ -1199,12 +1247,8 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 inet->cork.fl.u.ip6 = *fl6;
                 np->cork.hop_limit = hlimit;
                 np->cork.tclass = tclass;
-                if (rt->dst.flags & DST_XFRM_TUNNEL)
-                        mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
-                              rt->dst.dev->mtu : dst_mtu(&rt->dst);
-                else
-                        mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
-                              rt->dst.dev->mtu : dst_mtu(rt->dst.path);
+                mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
+                      rt->dst.dev->mtu : dst_mtu(rt->dst.path);
                 if (np->frag_size < mtu) {
                         if (np->frag_size)
                                 mtu = np->frag_size;
@@ -1213,17 +1257,18 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 if (dst_allfrag(rt->dst.path))
                         cork->flags |= IPCORK_ALLFRAG;
                 cork->length = 0;
-                exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
+                sk->sk_sndmsg_page = NULL;
+                sk->sk_sndmsg_off = 0;
+                exthdrlen = rt->dst.header_len + (opt ? opt->opt_flen : 0) -
+                            rt->rt6i_nfheader_len;
                 length += exthdrlen;
                 transhdrlen += exthdrlen;
-                dst_exthdrlen = rt->dst.header_len;
         } else {
                 rt = (struct rt6_info *)cork->dst;
                 fl6 = &inet->cork.fl.u.ip6;
                 opt = np->cork.opt;
                 transhdrlen = 0;
                 exthdrlen = 0;
-                dst_exthdrlen = 0;
                 mtu = cork->fragsize;
         }
 
@@ -1298,45 +1343,38 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                         unsigned int fraglen;
                         unsigned int fraggap;
                         unsigned int alloclen;
+                        struct sk_buff *skb_prev;
 alloc_new_skb:
+                        skb_prev = skb;
+
                         /* There's no room in the current skb */
-                        if (skb)
-                                fraggap = skb->len - maxfraglen;
+                        if (skb_prev)
+                                fraggap = skb_prev->len - maxfraglen;
                         else
                                 fraggap = 0;
-                        /* update mtu and maxfraglen if necessary */
-                        if (skb == NULL || skb_prev == NULL)
-                                ip6_append_data_mtu(&mtu, &maxfraglen,
-                                                    fragheaderlen, skb, rt);
-
-                        skb_prev = skb;
 
                         /*
                          * If remaining data exceeds the mtu,
                          * we know we need more fragment(s).
                          */
                         datalen = length + fraggap;
-
                         if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
-                                datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
+                                datalen = maxfraglen - fragheaderlen;
+
+                        fraglen = datalen + fragheaderlen;
                         if ((flags & MSG_MORE) &&
                             !(rt->dst.dev->features&NETIF_F_SG))
                                 alloclen = mtu;
                         else
                                 alloclen = datalen + fragheaderlen;
 
-                        alloclen += dst_exthdrlen;
-
-                        if (datalen != length + fraggap) {
-                                /*
-                                 * this is not the last fragment, the trailer
-                                 * space is regarded as data space.
-                                 */
-                                datalen += rt->dst.trailer_len;
-                        }
-
-                        alloclen += rt->dst.trailer_len;
-                        fraglen = datalen + fragheaderlen;
+                        /*
+                         * The last fragment gets additional space at tail.
+                         * Note: we overallocate on fragments with MSG_MODE
+                         * because we have no idea if we're the last one.
+                         */
+                        if (datalen == length + fraggap)
+                                alloclen += rt->dst.trailer_len;
 
                         /*
                          * We just reserve space for fragment header.
@@ -1370,11 +1408,10 @@ alloc_new_skb:
                         /*
                          *      Fill in the control structures
                          */
-                        skb->ip_summed = CHECKSUM_NONE;
+                        skb->ip_summed = csummode;
                         skb->csum = 0;
-                        /* reserve for fragmentation and ipsec header */
-                        skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
-                                    dst_exthdrlen);
+                        /* reserve for fragmentation */
+                        skb_reserve(skb, hh_len+sizeof(struct frag_hdr));
 
                         if (sk->sk_type == SOCK_DGRAM)
                                 skb_shinfo(skb)->tx_flags = tx_flags;
@@ -1397,7 +1434,6 @@ alloc_new_skb:
                                 pskb_trim_unique(skb_prev, maxfraglen);
                         }
                         copy = datalen - transhdrlen - fraggap;
-
                         if (copy < 0) {
                                 err = -EINVAL;
                                 kfree_skb(skb);
@@ -1412,7 +1448,7 @@ alloc_new_skb:
                         length -= datalen - fraggap;
                         transhdrlen = 0;
                         exthdrlen = 0;
-                        dst_exthdrlen = 0;
+                        csummode = CHECKSUM_NONE;
 
                         /*
                          * Put the packet on the pending queue
@@ -1436,31 +1472,46 @@ alloc_new_skb:
                         }
                 } else {
                         int i = skb_shinfo(skb)->nr_frags;
-                        struct page_frag *pfrag = sk_page_frag(sk);
-
-                        err = -ENOMEM;
-                        if (!sk_page_frag_refill(sk, pfrag))
-                                goto error;
-
-                        if (!skb_can_coalesce(skb, i, pfrag->page,
-                                              pfrag->offset)) {
-                                err = -EMSGSIZE;
-                                if (i == MAX_SKB_FRAGS)
+                        skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
+                        struct page *page = sk->sk_sndmsg_page;
+                        int off = sk->sk_sndmsg_off;
+                        unsigned int left;
+
+                        if (page && (left = PAGE_SIZE - off) > 0) {
+                                if (copy >= left)
+                                        copy = left;
+                                if (page != frag->page) {
+                                        if (i == MAX_SKB_FRAGS) {
+                                                err = -EMSGSIZE;
+                                                goto error;
+                                        }
+                                        get_page(page);
+                                        skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
+                                        frag = &skb_shinfo(skb)->frags[i];
+                                }
+                        } else if(i < MAX_SKB_FRAGS) {
+                                if (copy > PAGE_SIZE)
+                                        copy = PAGE_SIZE;
+                                page = alloc_pages(sk->sk_allocation, 0);
+                                if (page == NULL) {
+                                        err = -ENOMEM;
                                         goto error;
+                                }
+                                sk->sk_sndmsg_page = page;
+                                sk->sk_sndmsg_off = 0;
 
-                                __skb_fill_page_desc(skb, i, pfrag->page,
-                                                     pfrag->offset, 0);
-                                skb_shinfo(skb)->nr_frags = ++i;
-                                get_page(pfrag->page);
+                                skb_fill_page_desc(skb, i, page, 0, 0);
+                                frag = &skb_shinfo(skb)->frags[i];
+                        } else {
+                                err = -EMSGSIZE;
+                                goto error;
                         }
-                        copy = min_t(int, copy, pfrag->size - pfrag->offset);
-                        if (getfrag(from,
-                                    page_address(pfrag->page) + pfrag->offset,
-                                    offset, copy, skb->len, skb) < 0)
-                                goto error_efault;
-
-                        pfrag->offset += copy;
-                        skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
+                        if (getfrag(from, page_address(frag->page)+frag->page_offset+frag->size, offset, copy, skb->len, skb) < 0) {
+                                err = -EFAULT;
+                                goto error;
+                        }
+                        sk->sk_sndmsg_off += copy;
+                        frag->size += copy;
                         skb->len += copy;
                         skb->data_len += copy;
                         skb->truesize += copy;
@@ -1469,17 +1520,12 @@ alloc_new_skb:
                 offset += copy;
                 length -= copy;
         }
-
         return 0;
-
-error_efault:
-        err = -EFAULT;
 error:
         cork->length -= length;
         IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
         return err;
 }
-EXPORT_SYMBOL_GPL(ip6_append_data);
 
 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
 {
@@ -1537,7 +1583,7 @@ int ip6_push_pending_frames(struct sock *sk)
         if (np->pmtudisc < IPV6_PMTUDISC_DO)
                 skb->local_df = 1;
 
-        *final_dst = fl6->daddr;
+        ipv6_addr_copy(final_dst, &fl6->daddr);
         __skb_pull(skb, skb_network_header_len(skb));
         if (opt && opt->opt_flen)
                 ipv6_push_frag_opts(skb, opt, &proto);
@@ -1553,8 +1599,8 @@ int ip6_push_pending_frames(struct sock *sk)
 
         hdr->hop_limit = np->cork.hop_limit;
         hdr->nexthdr = proto;
-        hdr->saddr = fl6->saddr;
-        hdr->daddr = *final_dst;
+        ipv6_addr_copy(&hdr->saddr, &fl6->saddr);
+        ipv6_addr_copy(&hdr->daddr, final_dst);
 
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
@@ -1583,7 +1629,6 @@ error:
         IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
         goto out;
 }
-EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
 
 void ip6_flush_pending_frames(struct sock *sk)
 {
@@ -1598,4 +1643,3 @@ void ip6_flush_pending_frames(struct sock *sk)
 
         ip6_cork_release(inet_sk(sk), inet6_sk(sk));
 }
-EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index a14f28b280f..4e6922f1c68 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -18,8 +18,6 @@
  *
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/module.h>
 #include <linux/capability.h>
 #include <linux/errno.h>
@@ -40,7 +38,6 @@
 #include <linux/rtnetlink.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/slab.h>
-#include <linux/hash.h>
 
 #include <asm/uaccess.h>
 #include <linux/atomic.h>
@@ -63,7 +60,7 @@ MODULE_LICENSE("GPL");
 MODULE_ALIAS_NETDEV("ip6tnl0");
 
 #ifdef IP6_TNL_DEBUG
-#define IP6_TNL_TRACE(x...) pr_debug("%s:" x "\n", __func__)
+#define IP6_TNL_TRACE(x...) printk(KERN_DEBUG "%s:" x "\n", __func__)
 #else
 #define IP6_TNL_TRACE(x...) do {;} while(0)
 #endif
@@ -71,23 +68,14 @@ MODULE_ALIAS_NETDEV("ip6tnl0");
 #define IPV6_TCLASS_MASK (IPV6_FLOWINFO_MASK & ~IPV6_FLOWLABEL_MASK)
 #define IPV6_TCLASS_SHIFT 20
 
-#define HASH_SIZE_SHIFT  5
-#define HASH_SIZE (1 << HASH_SIZE_SHIFT)
-
-static bool log_ecn_error = true;
-module_param(log_ecn_error, bool, 0644);
-MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
+#define HASH_SIZE  32
 
-static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
-{
-        u32 hash = ipv6_addr_hash(addr1) ^ ipv6_addr_hash(addr2);
-
-        return hash_32(hash, HASH_SIZE_SHIFT);
-}
+#define HASH(addr) ((__force u32)((addr)->s6_addr32[0] ^ (addr)->s6_addr32[1] ^ \
+                     (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
+                    (HASH_SIZE - 1))
 
 static int ip6_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_setup(struct net_device *dev);
-static struct rtnl_link_ops ip6_link_ops __read_mostly;
 
 static int ip6_tnl_net_id __read_mostly;
 struct ip6_tnl_net {
@@ -99,6 +87,14 @@ struct ip6_tnl_net {
         struct ip6_tnl __rcu **tnls[2];
 };
 
+/* often modified stats are per cpu, other are shared (netdev->stats) */
+struct pcpu_tstats {
+        unsigned long   rx_packets;
+        unsigned long   rx_bytes;
+        unsigned long   tx_packets;
+        unsigned long   tx_bytes;
+};
+
 static struct net_device_stats *ip6_get_stats(struct net_device *dev)
 {
         struct pcpu_tstats sum = { 0 };
@@ -123,7 +119,7 @@ static struct net_device_stats *ip6_get_stats(struct net_device *dev)
  * Locking : hash tables are protected by RCU and RTNL
  */
 
-struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
+static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 {
         struct dst_entry *dst = t->dst_cache;
 
@@ -136,23 +132,20 @@ struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 
         return dst;
 }
-EXPORT_SYMBOL_GPL(ip6_tnl_dst_check);
 
-void ip6_tnl_dst_reset(struct ip6_tnl *t)
+static inline void ip6_tnl_dst_reset(struct ip6_tnl *t)
 {
         dst_release(t->dst_cache);
         t->dst_cache = NULL;
 }
-EXPORT_SYMBOL_GPL(ip6_tnl_dst_reset);
 
-void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
+static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
 {
         struct rt6_info *rt = (struct rt6_info *) dst;
         t->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
         dst_release(t->dst_cache);
         t->dst_cache = dst;
 }
-EXPORT_SYMBOL_GPL(ip6_tnl_dst_store);
 
 /**
  * ip6_tnl_lookup - fetch tunnel matching the end-point addresses
@@ -171,11 +164,12 @@ EXPORT_SYMBOL_GPL(ip6_tnl_dst_store);
 static struct ip6_tnl *
 ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_addr *local)
 {
-        unsigned int hash = HASH(remote, local);
+        unsigned int h0 = HASH(remote);
+        unsigned int h1 = HASH(local);
         struct ip6_tnl *t;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
-        for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
+        for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[h0 ^ h1]) {
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
                     ipv6_addr_equal(remote, &t->parms.raddr) &&
                     (t->dev->flags & IFF_UP))
@@ -200,16 +194,16 @@ ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_
  **/
 
 static struct ip6_tnl __rcu **
-ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct __ip6_tnl_parm *p)
+ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct ip6_tnl_parm *p)
 {
         const struct in6_addr *remote = &p->raddr;
         const struct in6_addr *local = &p->laddr;
-        unsigned int h = 0;
+        unsigned h = 0;
         int prio = 0;
 
         if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
                 prio = 1;
-                h = HASH(remote, local);
+                h = HASH(remote) ^ HASH(local);
         }
         return &ip6n->tnls[prio][h];
 }
@@ -255,35 +249,8 @@ static void ip6_dev_free(struct net_device *dev)
         free_netdev(dev);
 }
 
-static int ip6_tnl_create2(struct net_device *dev)
-{
-        struct ip6_tnl *t = netdev_priv(dev);
-        struct net *net = dev_net(dev);
-        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        int err;
-
-        t = netdev_priv(dev);
-        err = ip6_tnl_dev_init(dev);
-        if (err < 0)
-                goto out;
-
-        err = register_netdevice(dev);
-        if (err < 0)
-                goto out;
-
-        strcpy(t->parms.name, dev->name);
-        dev->rtnl_link_ops = &ip6_link_ops;
-
-        dev_hold(dev);
-        ip6_tnl_link(ip6n, t);
-        return 0;
-
-out:
-        return err;
-}
-
 /**
- * ip6_tnl_create - create a new tunnel
+ * ip6_tnl_create() - create a new tunnel
  *   @p: tunnel parameters
  *   @pt: pointer to new tunnel
  *
@@ -294,12 +261,13 @@ out:
  *   created tunnel or NULL
  **/
 
-static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
+static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
 {
         struct net_device *dev;
         struct ip6_tnl *t;
         char name[IFNAMSIZ];
         int err;
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
         if (p->name[0])
                 strlcpy(name, p->name, IFNAMSIZ);
@@ -314,10 +282,17 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
 
         t = netdev_priv(dev);
         t->parms = *p;
-        err = ip6_tnl_create2(dev);
+        err = ip6_tnl_dev_init(dev);
         if (err < 0)
                 goto failed_free;
 
+        if ((err = register_netdevice(dev)) < 0)
+                goto failed_free;
+
+        strcpy(t->parms.name, dev->name);
+
+        dev_hold(dev);
+        ip6_tnl_link(ip6n, t);
         return t;
 
 failed_free:
@@ -341,7 +316,7 @@ failed:
  **/
 
 static struct ip6_tnl *ip6_tnl_locate(struct net *net,
-                struct __ip6_tnl_parm *p, int create)
+                struct ip6_tnl_parm *p, int create)
 {
         const struct in6_addr *remote = &p->raddr;
         const struct in6_addr *local = &p->laddr;
@@ -377,7 +352,7 @@ ip6_tnl_dev_uninit(struct net_device *dev)
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
         if (dev == ip6n->fb_tnl_dev)
-                RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
+                rcu_assign_pointer(ip6n->tnls_wc[0], NULL);
         else
                 ip6_tnl_unlink(ip6n, t);
         ip6_tnl_dst_reset(t);
@@ -393,7 +368,8 @@ ip6_tnl_dev_uninit(struct net_device *dev)
  *   else index to encapsulation limit
  **/
 
-__u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
+static __u16
+parse_tlv_tnl_enc_lim(struct sk_buff *skb, __u8 * raw)
 {
         const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
         __u8 nexthdr = ipv6h->nexthdr;
@@ -443,7 +419,6 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
         }
         return 0;
 }
-EXPORT_SYMBOL(ip6_tnl_parse_tlv_enc_lim);
 
 /**
  * ip6_tnl_err - tunnel error handler
@@ -485,32 +460,41 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
                 struct ipv6_tlv_tnl_enc_lim *tel;
                 __u32 mtu;
         case ICMPV6_DEST_UNREACH:
-                net_warn_ratelimited("%s: Path to destination invalid or inactive!\n",
-                                     t->parms.name);
+                if (net_ratelimit())
+                        printk(KERN_WARNING
+                               "%s: Path to destination invalid "
+                               "or inactive!\n", t->parms.name);
                 rel_msg = 1;
                 break;
         case ICMPV6_TIME_EXCEED:
                 if ((*code) == ICMPV6_EXC_HOPLIMIT) {
-                        net_warn_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
-                                             t->parms.name);
+                        if (net_ratelimit())
+                                printk(KERN_WARNING
+                                       "%s: Too small hop limit or "
+                                       "routing loop in tunnel!\n",
+                                       t->parms.name);
                         rel_msg = 1;
                 }
                 break;
         case ICMPV6_PARAMPROB:
                 teli = 0;
                 if ((*code) == ICMPV6_HDR_FIELD)
-                        teli = ip6_tnl_parse_tlv_enc_lim(skb, skb->data);
+                        teli = parse_tlv_tnl_enc_lim(skb, skb->data);
 
                 if (teli && teli == *info - 2) {
                         tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
                         if (tel->encap_limit == 0) {
-                                net_warn_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
-                                                     t->parms.name);
+                                if (net_ratelimit())
+                                        printk(KERN_WARNING
+                                               "%s: Too small encapsulation "
+                                               "limit or routing loop in "
+                                               "tunnel!\n", t->parms.name);
                                 rel_msg = 1;
                         }
-                } else {
-                        net_warn_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
-                                             t->parms.name);
+                } else if (net_ratelimit()) {
+                        printk(KERN_WARNING
+                               "%s: Recipient unable to parse tunneled "
+                               "packet!\n ", t->parms.name);
                 }
                 break;
         case ICMPV6_PKT_TOOBIG:
@@ -573,9 +557,6 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 rel_type = ICMP_DEST_UNREACH;
                 rel_code = ICMP_FRAG_NEEDED;
                 break;
-        case NDISC_REDIRECT:
-                rel_type = ICMP_REDIRECT;
-                rel_code = ICMP_REDIR_HOST;
         default:
                 return 0;
         }
@@ -632,10 +613,8 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 if (rel_info > dst_mtu(skb_dst(skb2)))
                         goto out;
 
-                skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), NULL, skb2, rel_info);
+                skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), rel_info);
         }
-        if (rel_type == ICMP_REDIRECT)
-                skb_dst(skb2)->ops->redirect(skb_dst(skb2), NULL, skb2);
 
         icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
 
@@ -674,12 +653,13 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr,
                                 NULL, 0, 0);
 
-                if (rt && rt->dst.dev)
-                        skb2->dev = rt->dst.dev;
+                if (rt && rt->rt6i_dev)
+                        skb2->dev = rt->rt6i_dev;
 
                 icmpv6_send(skb2, rel_type, rel_code, rel_info);
 
-                ip6_rt_put(rt);
+                if (rt)
+                        dst_release(&rt->dst);
 
                 kfree_skb(skb2);
         }
@@ -687,77 +667,51 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         return 0;
 }
 
-static int ip4ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
-                                       const struct ipv6hdr *ipv6h,
-                                       struct sk_buff *skb)
+static void ip4ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
+                                        const struct ipv6hdr *ipv6h,
+                                        struct sk_buff *skb)
 {
         __u8 dsfield = ipv6_get_dsfield(ipv6h) & ~INET_ECN_MASK;
 
         if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
                 ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, dsfield);
 
-        return IP6_ECN_decapsulate(ipv6h, skb);
+        if (INET_ECN_is_ce(dsfield))
+                IP_ECN_set_ce(ip_hdr(skb));
 }
 
-static int ip6ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
-                                       const struct ipv6hdr *ipv6h,
-                                       struct sk_buff *skb)
+static void ip6ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
+                                        const struct ipv6hdr *ipv6h,
+                                        struct sk_buff *skb)
 {
         if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
                 ipv6_copy_dscp(ipv6_get_dsfield(ipv6h), ipv6_hdr(skb));
 
-        return IP6_ECN_decapsulate(ipv6h, skb);
-}
-
-__u32 ip6_tnl_get_cap(struct ip6_tnl *t,
-                             const struct in6_addr *laddr,
-                             const struct in6_addr *raddr)
-{
-        struct __ip6_tnl_parm *p = &t->parms;
-        int ltype = ipv6_addr_type(laddr);
-        int rtype = ipv6_addr_type(raddr);
-        __u32 flags = 0;
-
-        if (ltype == IPV6_ADDR_ANY || rtype == IPV6_ADDR_ANY) {
-                flags = IP6_TNL_F_CAP_PER_PACKET;
-        } else if (ltype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
-                   rtype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
-                   !((ltype|rtype) & IPV6_ADDR_LOOPBACK) &&
-                   (!((ltype|rtype) & IPV6_ADDR_LINKLOCAL) || p->link)) {
-                if (ltype&IPV6_ADDR_UNICAST)
-                        flags |= IP6_TNL_F_CAP_XMIT;
-                if (rtype&IPV6_ADDR_UNICAST)
-                        flags |= IP6_TNL_F_CAP_RCV;
-        }
-        return flags;
+        if (INET_ECN_is_ce(ipv6_get_dsfield(ipv6h)))
+                IP6_ECN_set_ce(ipv6_hdr(skb));
 }
-EXPORT_SYMBOL(ip6_tnl_get_cap);
 
 /* called with rcu_read_lock() */
-int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
-                                  const struct in6_addr *laddr,
-                                  const struct in6_addr *raddr)
+static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
 {
-        struct __ip6_tnl_parm *p = &t->parms;
+        struct ip6_tnl_parm *p = &t->parms;
         int ret = 0;
         struct net *net = dev_net(t->dev);
 
-        if ((p->flags & IP6_TNL_F_CAP_RCV) ||
-            ((p->flags & IP6_TNL_F_CAP_PER_PACKET) &&
-             (ip6_tnl_get_cap(t, laddr, raddr) & IP6_TNL_F_CAP_RCV))) {
+        if (p->flags & IP6_TNL_F_CAP_RCV) {
                 struct net_device *ldev = NULL;
 
                 if (p->link)
                         ldev = dev_get_by_index_rcu(net, p->link);
 
-                if ((ipv6_addr_is_multicast(laddr) ||
-                     likely(ipv6_chk_addr(net, laddr, ldev, 0))) &&
-                    likely(!ipv6_chk_addr(net, raddr, NULL, 0)))
+                if ((ipv6_addr_is_multicast(&p->laddr) ||
+                     likely(ipv6_chk_addr(net, &p->laddr, ldev, 0))) &&
+                    likely(!ipv6_chk_addr(net, &p->raddr, NULL, 0)))
                         ret = 1;
+
         }
         return ret;
 }
-EXPORT_SYMBOL_GPL(ip6_tnl_rcv_ctl);
 
 /**
  * ip6_tnl_rcv - decapsulate IPv6 packet and retransmit it locally
@@ -770,13 +724,12 @@ EXPORT_SYMBOL_GPL(ip6_tnl_rcv_ctl);
 
 static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                        __u8 ipproto,
-                       int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
-                                                   const struct ipv6hdr *ipv6h,
-                                                   struct sk_buff *skb))
+                       void (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
+                                                    const struct ipv6hdr *ipv6h,
+                                                    struct sk_buff *skb))
 {
         struct ip6_tnl *t;
         const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
-        int err;
 
         rcu_read_lock();
 
@@ -794,7 +747,7 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                         goto discard;
                 }
 
-                if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr)) {
+                if (!ip6_tnl_rcv_ctl(t)) {
                         t->dev->stats.rx_dropped++;
                         rcu_read_unlock();
                         goto discard;
@@ -806,26 +759,14 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                 skb->pkt_type = PACKET_HOST;
                 memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
 
-                __skb_tunnel_rx(skb, t->dev);
-
-                err = dscp_ecn_decapsulate(t, ipv6h, skb);
-                if (unlikely(err)) {
-                        if (log_ecn_error)
-                                net_info_ratelimited("non-ECT from %pI6 with dsfield=%#x\n",
-                                                     &ipv6h->saddr,
-                                                     ipv6_get_dsfield(ipv6h));
-                        if (err > 1) {
-                                ++t->dev->stats.rx_frame_errors;
-                                ++t->dev->stats.rx_errors;
-                                rcu_read_unlock();
-                                goto discard;
-                        }
-                }
-
                 tstats = this_cpu_ptr(t->dev->tstats);
                 tstats->rx_packets++;
                 tstats->rx_bytes += skb->len;
 
+                __skb_tunnel_rx(skb, t->dev);
+
+                dscp_ecn_decapsulate(t, ipv6h, skb);
+
                 netif_rx(skb);
 
                 rcu_read_unlock();
@@ -884,15 +825,15 @@ static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
  *   0 else
  **/
 
-static inline bool
+static inline int
 ip6_tnl_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
 {
         return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
 }
 
-int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
+static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
 {
-        struct __ip6_tnl_parm *p = &t->parms;
+        struct ip6_tnl_parm *p = &t->parms;
         int ret = 0;
         struct net *net = dev_net(t->dev);
 
@@ -904,20 +845,21 @@ int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
                         ldev = dev_get_by_index_rcu(net, p->link);
 
                 if (unlikely(!ipv6_chk_addr(net, &p->laddr, ldev, 0)))
-                        pr_warn("%s xmit: Local address not yet configured!\n",
-                                p->name);
+                        printk(KERN_WARNING
+                               "%s xmit: Local address not yet configured!\n",
+                               p->name);
                 else if (!ipv6_addr_is_multicast(&p->raddr) &&
                          unlikely(ipv6_chk_addr(net, &p->raddr, NULL, 0)))
-                        pr_warn("%s xmit: Routing loop! Remote address found on this node!\n",
-                                p->name);
+                        printk(KERN_WARNING
+                               "%s xmit: Routing loop! "
+                               "Remote address found on this node!\n",
+                               p->name);
                 else
                         ret = 1;
                 rcu_read_unlock();
         }
         return ret;
 }
-EXPORT_SYMBOL_GPL(ip6_tnl_xmit_ctl);
-
 /**
  * ip6_tnl_xmit2 - encapsulate packet and send
  *   @skb: the outgoing socket buffer
@@ -949,7 +891,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         struct net_device_stats *stats = &t->dev->stats;
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         struct ipv6_tel_txoption opt;
-        struct dst_entry *dst = NULL, *ndst = NULL;
+        struct dst_entry *dst;
         struct net_device *tdev;
         int mtu;
         unsigned int max_headroom = sizeof(struct ipv6hdr);
@@ -957,28 +899,29 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         int err = -1;
         int pkt_len;
 
-        if (!fl6->flowi6_mark)
-                dst = ip6_tnl_dst_check(t);
-        if (!dst) {
-                ndst = ip6_route_output(net, NULL, fl6);
+        if ((dst = ip6_tnl_dst_check(t)) != NULL)
+                dst_hold(dst);
+        else {
+                dst = ip6_route_output(net, NULL, fl6);
 
-                if (ndst->error)
+                if (dst->error)
                         goto tx_err_link_failure;
-                ndst = xfrm_lookup(net, ndst, flowi6_to_flowi(fl6), NULL, 0);
-                if (IS_ERR(ndst)) {
-                        err = PTR_ERR(ndst);
-                        ndst = NULL;
+                dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), NULL, 0);
+                if (IS_ERR(dst)) {
+                        err = PTR_ERR(dst);
+                        dst = NULL;
                         goto tx_err_link_failure;
                 }
-                dst = ndst;
         }
 
         tdev = dst->dev;
 
         if (tdev == dev) {
                 stats->collisions++;
-                net_warn_ratelimited("%s: Local routing loop detected!\n",
-                                     t->parms.name);
+                if (net_ratelimit())
+                        printk(KERN_WARNING
+                               "%s: Local routing loop detected!\n",
+                               t->parms.name);
                 goto tx_err_dst_release;
         }
         mtu = dst_mtu(dst) - sizeof (*ipv6h);
@@ -989,7 +932,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         if (mtu < IPV6_MIN_MTU)
                 mtu = IPV6_MIN_MTU;
         if (skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
         if (skb->len > mtu) {
                 *pmtu = mtu;
                 err = -EMSGSIZE;
@@ -1010,16 +953,12 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
 
                 if (skb->sk)
                         skb_set_owner_w(new_skb, skb->sk);
-                consume_skb(skb);
+                kfree_skb(skb);
                 skb = new_skb;
         }
         skb_dst_drop(skb);
-        if (fl6->flowi6_mark) {
-                skb_dst_set(skb, dst);
-                ndst = NULL;
-        } else {
-                skb_dst_set_noref(skb, dst);
-        }
+        skb_dst_set(skb, dst_clone(dst));
+
         skb->transport_header = skb->network_header;
 
         proto = fl6->flowi6_proto;
@@ -1035,8 +974,8 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         ipv6_change_dsfield(ipv6h, ~INET_ECN_MASK, dsfield);
         ipv6h->hop_limit = t->parms.hop_limit;
         ipv6h->nexthdr = proto;
-        ipv6h->saddr = fl6->saddr;
-        ipv6h->daddr = fl6->daddr;
+        ipv6_addr_copy(&ipv6h->saddr, &fl6->saddr);
+        ipv6_addr_copy(&ipv6h->daddr, &fl6->daddr);
         nf_reset(skb);
         pkt_len = skb->len;
         err = ip6_local_out(skb);
@@ -1050,14 +989,13 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 stats->tx_errors++;
                 stats->tx_aborted_errors++;
         }
-        if (ndst)
-                ip6_tnl_dst_store(t, ndst);
+        ip6_tnl_dst_store(t, dst);
         return 0;
 tx_err_link_failure:
         stats->tx_carrier_errors++;
         dst_link_failure(skb);
 tx_err_dst_release:
-        dst_release(ndst);
+        dst_release(dst);
         return err;
 }
 
@@ -1084,11 +1022,9 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 
         dsfield = ipv4_get_dsfield(iph);
 
-        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
+        if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
                 fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
                                           & IPV6_TCLASS_MASK;
-        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
-                fl6.flowi6_mark = skb->mark;
 
         err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
         if (err != 0) {
@@ -1118,7 +1054,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
             !ip6_tnl_xmit_ctl(t) || ip6_tnl_addr_conflict(t, ipv6h))
                 return -1;
 
-        offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
+        offset = parse_tlv_tnl_enc_lim(skb, skb_network_header(skb));
         if (offset > 0) {
                 struct ipv6_tlv_tnl_enc_lim *tel;
                 tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
@@ -1135,12 +1071,10 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         fl6.flowi6_proto = IPPROTO_IPV6;
 
         dsfield = ipv6_get_dsfield(ipv6h);
-        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
+        if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
                 fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
-        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
+        if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL))
                 fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
-        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
-                fl6.flowi6_mark = skb->mark;
 
         err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
         if (err != 0) {
@@ -1182,18 +1116,37 @@ tx_err:
         return NETDEV_TX_OK;
 }
 
+static void ip6_tnl_set_cap(struct ip6_tnl *t)
+{
+        struct ip6_tnl_parm *p = &t->parms;
+        int ltype = ipv6_addr_type(&p->laddr);
+        int rtype = ipv6_addr_type(&p->raddr);
+
+        p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV);
+
+        if (ltype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
+            rtype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
+            !((ltype|rtype) & IPV6_ADDR_LOOPBACK) &&
+            (!((ltype|rtype) & IPV6_ADDR_LINKLOCAL) || p->link)) {
+                if (ltype&IPV6_ADDR_UNICAST)
+                        p->flags |= IP6_TNL_F_CAP_XMIT;
+                if (rtype&IPV6_ADDR_UNICAST)
+                        p->flags |= IP6_TNL_F_CAP_RCV;
+        }
+}
+
 static void ip6_tnl_link_config(struct ip6_tnl *t)
 {
         struct net_device *dev = t->dev;
-        struct __ip6_tnl_parm *p = &t->parms;
+        struct ip6_tnl_parm *p = &t->parms;
         struct flowi6 *fl6 = &t->fl.u.ip6;
 
         memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
         memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
 
         /* Set up flowi template */
-        fl6->saddr = p->laddr;
-        fl6->daddr = p->raddr;
+        ipv6_addr_copy(&fl6->saddr, &p->laddr);
+        ipv6_addr_copy(&fl6->daddr, &p->raddr);
         fl6->flowi6_oif = p->link;
         fl6->flowlabel = 0;
 
@@ -1202,8 +1155,7 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
         if (!(p->flags&IP6_TNL_F_USE_ORIG_FLOWLABEL))
                 fl6->flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;
 
-        p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV|IP6_TNL_F_CAP_PER_PACKET);
-        p->flags |= ip6_tnl_get_cap(t, &p->laddr, &p->raddr);
+        ip6_tnl_set_cap(t);
 
         if (p->flags&IP6_TNL_F_CAP_XMIT && p->flags&IP6_TNL_F_CAP_RCV)
                 dev->flags |= IFF_POINTOPOINT;
@@ -1223,18 +1175,18 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
                 if (rt == NULL)
                         return;
 
-                if (rt->dst.dev) {
-                        dev->hard_header_len = rt->dst.dev->hard_header_len +
+                if (rt->rt6i_dev) {
+                        dev->hard_header_len = rt->rt6i_dev->hard_header_len +
                                 sizeof (struct ipv6hdr);
 
-                        dev->mtu = rt->dst.dev->mtu - sizeof (struct ipv6hdr);
+                        dev->mtu = rt->rt6i_dev->mtu - sizeof (struct ipv6hdr);
                         if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                                 dev->mtu-=8;
 
                         if (dev->mtu < IPV6_MIN_MTU)
                                 dev->mtu = IPV6_MIN_MTU;
                 }
-                ip6_rt_put(rt);
+                dst_release(&rt->dst);
         }
 }
 
@@ -1248,10 +1200,10 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
  **/
 
 static int
-ip6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p)
+ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
 {
-        t->parms.laddr = p->laddr;
-        t->parms.raddr = p->raddr;
+        ipv6_addr_copy(&t->parms.laddr, &p->laddr);
+        ipv6_addr_copy(&t->parms.raddr, &p->raddr);
         t->parms.flags = p->flags;
         t->parms.hop_limit = p->hop_limit;
         t->parms.encap_limit = p->encap_limit;
@@ -1263,48 +1215,6 @@ ip6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p)
         return 0;
 }
 
-static int ip6_tnl_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
-{
-        struct net *net = dev_net(t->dev);
-        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        int err;
-
-        ip6_tnl_unlink(ip6n, t);
-        synchronize_net();
-        err = ip6_tnl_change(t, p);
-        ip6_tnl_link(ip6n, t);
-        netdev_state_change(t->dev);
-        return err;
-}
-
-static void
-ip6_tnl_parm_from_user(struct __ip6_tnl_parm *p, const struct ip6_tnl_parm *u)
-{
-        p->laddr = u->laddr;
-        p->raddr = u->raddr;
-        p->flags = u->flags;
-        p->hop_limit = u->hop_limit;
-        p->encap_limit = u->encap_limit;
-        p->flowinfo = u->flowinfo;
-        p->link = u->link;
-        p->proto = u->proto;
-        memcpy(p->name, u->name, sizeof(u->name));
-}
-
-static void
-ip6_tnl_parm_to_user(struct ip6_tnl_parm *u, const struct __ip6_tnl_parm *p)
-{
-        u->laddr = p->laddr;
-        u->raddr = p->raddr;
-        u->flags = p->flags;
-        u->hop_limit = p->hop_limit;
-        u->encap_limit = p->encap_limit;
-        u->flowinfo = p->flowinfo;
-        u->link = p->link;
-        u->proto = p->proto;
-        memcpy(u->name, p->name, sizeof(u->name));
-}
-
 /**
  * ip6_tnl_ioctl - configure ipv6 tunnels from userspace
  *   @dev: virtual device associated with tunnel
@@ -1338,7 +1248,6 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
         int err = 0;
         struct ip6_tnl_parm p;
-        struct __ip6_tnl_parm p1;
         struct ip6_tnl *t = NULL;
         struct net *net = dev_net(dev);
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
@@ -1350,14 +1259,11 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                                 err = -EFAULT;
                                 break;
                         }
-                        ip6_tnl_parm_from_user(&p1, &p);
-                        t = ip6_tnl_locate(net, &p1, 0);
-                } else {
-                        memset(&p, 0, sizeof(p));
+                        t = ip6_tnl_locate(net, &p, 0);
                 }
                 if (t == NULL)
                         t = netdev_priv(dev);
-                ip6_tnl_parm_to_user(&p, &t->parms);
+                memcpy(&p, &t->parms, sizeof (p));
                 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof (p))) {
                         err = -EFAULT;
                 }
@@ -1365,7 +1271,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case SIOCADDTUNNEL:
         case SIOCCHGTUNNEL:
                 err = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
                         break;
                 err = -EFAULT;
                 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
@@ -1374,8 +1280,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 if (p.proto != IPPROTO_IPV6 && p.proto != IPPROTO_IPIP &&
                     p.proto != 0)
                         break;
-                ip6_tnl_parm_from_user(&p1, &p);
-                t = ip6_tnl_locate(net, &p1, cmd == SIOCADDTUNNEL);
+                t = ip6_tnl_locate(net, &p, cmd == SIOCADDTUNNEL);
                 if (dev != ip6n->fb_tnl_dev && cmd == SIOCCHGTUNNEL) {
                         if (t != NULL) {
                                 if (t->dev != dev) {
@@ -1385,12 +1290,15 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         } else
                                 t = netdev_priv(dev);
 
-                        err = ip6_tnl_update(t, &p1);
+                        ip6_tnl_unlink(ip6n, t);
+                        synchronize_net();
+                        err = ip6_tnl_change(t, &p);
+                        ip6_tnl_link(ip6n, t);
+                        netdev_state_change(dev);
                 }
                 if (t) {
                         err = 0;
-                        ip6_tnl_parm_to_user(&p, &t->parms);
-                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof (p)))
                                 err = -EFAULT;
 
                 } else
@@ -1398,7 +1306,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                 break;
         case SIOCDELTUNNEL:
                 err = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
                         break;
 
                 if (dev == ip6n->fb_tnl_dev) {
@@ -1406,9 +1314,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
                                 break;
                         err = -ENOENT;
-                        ip6_tnl_parm_from_user(&p1, &p);
-                        t = ip6_tnl_locate(net, &p1, 0);
-                        if (t == NULL)
+                        if ((t = ip6_tnl_locate(net, &p, 0)) == NULL)
                                 break;
                         err = -EPERM;
                         if (t->dev == ip6n->fb_tnl_dev)
@@ -1534,171 +1440,10 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
 
         t->parms.proto = IPPROTO_IPV6;
         dev_hold(dev);
-
-        ip6_tnl_link_config(t);
-
         rcu_assign_pointer(ip6n->tnls_wc[0], t);
         return 0;
 }
 
-static int ip6_tnl_validate(struct nlattr *tb[], struct nlattr *data[])
-{
-        u8 proto;
-
-        if (!data)
-                return 0;
-
-        proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
-        if (proto != IPPROTO_IPV6 &&
-            proto != IPPROTO_IPIP &&
-            proto != 0)
-                return -EINVAL;
-
-        return 0;
-}
-
-static void ip6_tnl_netlink_parms(struct nlattr *data[],
-                                  struct __ip6_tnl_parm *parms)
-{
-        memset(parms, 0, sizeof(*parms));
-
-        if (!data)
-                return;
-
-        if (data[IFLA_IPTUN_LINK])
-                parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);
-
-        if (data[IFLA_IPTUN_LOCAL])
-                nla_memcpy(&parms->laddr, data[IFLA_IPTUN_LOCAL],
-                           sizeof(struct in6_addr));
-
-        if (data[IFLA_IPTUN_REMOTE])
-                nla_memcpy(&parms->raddr, data[IFLA_IPTUN_REMOTE],
-                           sizeof(struct in6_addr));
-
-        if (data[IFLA_IPTUN_TTL])
-                parms->hop_limit = nla_get_u8(data[IFLA_IPTUN_TTL]);
-
-        if (data[IFLA_IPTUN_ENCAP_LIMIT])
-                parms->encap_limit = nla_get_u8(data[IFLA_IPTUN_ENCAP_LIMIT]);
-
-        if (data[IFLA_IPTUN_FLOWINFO])
-                parms->flowinfo = nla_get_be32(data[IFLA_IPTUN_FLOWINFO]);
-
-        if (data[IFLA_IPTUN_FLAGS])
-                parms->flags = nla_get_u32(data[IFLA_IPTUN_FLAGS]);
-
-        if (data[IFLA_IPTUN_PROTO])
-                parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
-}
-
-static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
-                           struct nlattr *tb[], struct nlattr *data[])
-{
-        struct net *net = dev_net(dev);
-        struct ip6_tnl *nt;
-
-        nt = netdev_priv(dev);
-        ip6_tnl_netlink_parms(data, &nt->parms);
-
-        if (ip6_tnl_locate(net, &nt->parms, 0))
-                return -EEXIST;
-
-        return ip6_tnl_create2(dev);
-}
-
-static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
-                              struct nlattr *data[])
-{
-        struct ip6_tnl *t;
-        struct __ip6_tnl_parm p;
-        struct net *net = dev_net(dev);
-        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-
-        if (dev == ip6n->fb_tnl_dev)
-                return -EINVAL;
-
-        ip6_tnl_netlink_parms(data, &p);
-
-        t = ip6_tnl_locate(net, &p, 0);
-
-        if (t) {
-                if (t->dev != dev)
-                        return -EEXIST;
-        } else
-                t = netdev_priv(dev);
-
-        return ip6_tnl_update(t, &p);
-}
-
-static size_t ip6_tnl_get_size(const struct net_device *dev)
-{
-        return
-                /* IFLA_IPTUN_LINK */
-                nla_total_size(4) +
-                /* IFLA_IPTUN_LOCAL */
-                nla_total_size(sizeof(struct in6_addr)) +
-                /* IFLA_IPTUN_REMOTE */
-                nla_total_size(sizeof(struct in6_addr)) +
-                /* IFLA_IPTUN_TTL */
-                nla_total_size(1) +
-                /* IFLA_IPTUN_ENCAP_LIMIT */
-                nla_total_size(1) +
-                /* IFLA_IPTUN_FLOWINFO */
-                nla_total_size(4) +
-                /* IFLA_IPTUN_FLAGS */
-                nla_total_size(4) +
-                /* IFLA_IPTUN_PROTO */
-                nla_total_size(1) +
-                0;
-}
-
-static int ip6_tnl_fill_info(struct sk_buff *skb, const struct net_device *dev)
-{
-        struct ip6_tnl *tunnel = netdev_priv(dev);
-        struct __ip6_tnl_parm *parm = &tunnel->parms;
-
-        if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
-            nla_put(skb, IFLA_IPTUN_LOCAL, sizeof(struct in6_addr),
-                    &parm->raddr) ||
-            nla_put(skb, IFLA_IPTUN_REMOTE, sizeof(struct in6_addr),
-                    &parm->laddr) ||
-            nla_put_u8(skb, IFLA_IPTUN_TTL, parm->hop_limit) ||
-            nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
-            nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
-            nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
-            nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto))
-                goto nla_put_failure;
-        return 0;
-
-nla_put_failure:
-        return -EMSGSIZE;
-}
-
-static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
-        [IFLA_IPTUN_LINK]               = { .type = NLA_U32 },
-        [IFLA_IPTUN_LOCAL]              = { .len = sizeof(struct in6_addr) },
-        [IFLA_IPTUN_REMOTE]             = { .len = sizeof(struct in6_addr) },
-        [IFLA_IPTUN_TTL]                = { .type = NLA_U8 },
-        [IFLA_IPTUN_ENCAP_LIMIT]        = { .type = NLA_U8 },
-        [IFLA_IPTUN_FLOWINFO]           = { .type = NLA_U32 },
-        [IFLA_IPTUN_FLAGS]              = { .type = NLA_U32 },
-        [IFLA_IPTUN_PROTO]              = { .type = NLA_U8 },
-};
-
-static struct rtnl_link_ops ip6_link_ops __read_mostly = {
-        .kind           = "ip6tnl",
-        .maxtype        = IFLA_IPTUN_MAX,
-        .policy         = ip6_tnl_policy,
-        .priv_size      = sizeof(struct ip6_tnl),
-        .setup          = ip6_tnl_dev_setup,
-        .validate       = ip6_tnl_validate,
-        .newlink        = ip6_tnl_newlink,
-        .changelink     = ip6_tnl_changelink,
-        .get_size       = ip6_tnl_get_size,
-        .fill_info      = ip6_tnl_fill_info,
-};
-
 static struct xfrm6_tunnel ip4ip6_handler __read_mostly = {
         .handler        = ip4ip6_rcv,
         .err_handler    = ip4ip6_err,
@@ -1798,23 +1543,18 @@ static int __init ip6_tunnel_init(void)
 
         err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET);
         if (err < 0) {
-                pr_err("%s: can't register ip4ip6\n", __func__);
+                printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n");
                 goto out_ip4ip6;
         }
 
         err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6);
         if (err < 0) {
-                pr_err("%s: can't register ip6ip6\n", __func__);
+                printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n");
                 goto out_ip6ip6;
         }
-        err = rtnl_link_register(&ip6_link_ops);
-        if (err < 0)
-                goto rtnl_link_failed;
 
         return 0;
 
-rtnl_link_failed:
-        xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6);
 out_ip6ip6:
         xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
 out_ip4ip6:
@@ -1829,12 +1569,11 @@ out_pernet:
 
 static void __exit ip6_tunnel_cleanup(void)
 {
-        rtnl_link_unregister(&ip6_link_ops);
         if (xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET))
-                pr_info("%s: can't deregister ip4ip6\n", __func__);
+                printk(KERN_INFO "ip6_tunnel close: can't deregister ip4ip6\n");
 
         if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
-                pr_info("%s: can't deregister ip6ip6\n", __func__);
+                printk(KERN_INFO "ip6_tunnel close: can't deregister ip6ip6\n");
 
         unregister_pernet_device(&ip6_tnl_net_ops);
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 26dcdec9e3a..def0538e241 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -16,6 +16,7 @@
  *
  */
 
+#include <asm/system.h>
 #include <asm/uaccess.h>
 #include <linux/types.h>
 #include <linux/sched.h>
@@ -50,9 +51,7 @@
 #include <linux/pim.h>
 #include <net/addrconf.h>
 #include <linux/netfilter_ipv6.h>
-#include <linux/export.h>
 #include <net/ip6_checksum.h>
-#include <linux/netconf.h>
 
 struct mr6_table {
         struct list_head        list;
@@ -67,8 +66,8 @@ struct mr6_table {
         struct mif_device       vif6_table[MAXMIFS];
         int                     maxvif;
         atomic_t                cache_resolve_queue_len;
-        bool                    mroute_do_assert;
-        bool                    mroute_do_pim;
+        int                     mroute_do_assert;
+        int                     mroute_do_pim;
 #ifdef CONFIG_IPV6_PIMSM_V2
         int                     mroute_reg_vif_num;
 #endif
@@ -116,8 +115,6 @@ static int ip6mr_cache_report(struct mr6_table *mrt, struct sk_buff *pkt,
                               mifi_t mifi, int assert);
 static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
                                struct mfc6_cache *c, struct rtmsg *rtm);
-static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc,
-                              int cmd);
 static int ip6mr_rtm_dumproute(struct sk_buff *skb,
                                struct netlink_callback *cb);
 static void mroute_clean_tables(struct mr6_table *mrt);
@@ -208,7 +205,7 @@ static int ip6mr_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
         return 0;
 }
 
-static const struct fib_rules_ops __net_initconst ip6mr_rules_ops_template = {
+static const struct fib_rules_ops __net_initdata ip6mr_rules_ops_template = {
         .family         = RTNL_FAMILY_IP6MR,
         .rule_size      = sizeof(struct ip6mr_rule),
         .addr_size      = sizeof(struct in6_addr),
@@ -808,12 +805,8 @@ static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head)
         dev_set_allmulti(dev, -1);
 
         in6_dev = __in6_dev_get(dev);
-        if (in6_dev) {
+        if (in6_dev)
                 in6_dev->cnf.mc_forwarding--;
-                inet6_netconf_notify_devconf(dev_net(dev),
-                                             NETCONFA_MC_FORWARDING,
-                                             dev->ifindex, &in6_dev->cnf);
-        }
 
         if (v->flags & MIFF_REGISTER)
                 unregister_netdevice_queue(dev, head);
@@ -845,7 +838,7 @@ static void ip6mr_destroy_unres(struct mr6_table *mrt, struct mfc6_cache *c)
                         nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
                         skb_trim(skb, nlh->nlmsg_len);
                         ((struct nlmsgerr *)NLMSG_DATA(nlh))->error = -ETIMEDOUT;
-                        rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
+                        rtnl_unicast(skb, net, NETLINK_CB(skb).pid);
                 } else
                         kfree_skb(skb);
         }
@@ -872,7 +865,6 @@ static void ipmr_do_expire_process(struct mr6_table *mrt)
                 }
 
                 list_del(&c->list);
-                mr6_netlink_event(mrt, c, RTM_DELROUTE);
                 ip6mr_destroy_unres(mrt, c);
         }
 
@@ -966,12 +958,8 @@ static int mif6_add(struct net *net, struct mr6_table *mrt,
         }
 
         in6_dev = __in6_dev_get(dev);
-        if (in6_dev) {
+        if (in6_dev)
                 in6_dev->cnf.mc_forwarding++;
-                inet6_netconf_notify_devconf(dev_net(dev),
-                                             NETCONFA_MC_FORWARDING,
-                                             dev->ifindex, &in6_dev->cnf);
-        }
 
         /*
          *      Fill in the VIF structures
@@ -1064,7 +1052,7 @@ static void ip6mr_cache_resolve(struct net *net, struct mr6_table *mrt,
                                 skb_trim(skb, nlh->nlmsg_len);
                                 ((struct nlmsgerr *)NLMSG_DATA(nlh))->error = -EMSGSIZE;
                         }
-                        rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
+                        rtnl_unicast(skb, net, NETLINK_CB(skb).pid);
                 } else
                         ip6_mr_forward(net, mrt, skb, c);
         }
@@ -1116,8 +1104,8 @@ static int ip6mr_cache_report(struct mr6_table *mrt, struct sk_buff *pkt,
                 msg->im6_msgtype = MRT6MSG_WHOLEPKT;
                 msg->im6_mif = mrt->mroute_reg_vif_num;
                 msg->im6_pad = 0;
-                msg->im6_src = ipv6_hdr(pkt)->saddr;
-                msg->im6_dst = ipv6_hdr(pkt)->daddr;
+                ipv6_addr_copy(&msg->im6_src, &ipv6_hdr(pkt)->saddr);
+                ipv6_addr_copy(&msg->im6_dst, &ipv6_hdr(pkt)->daddr);
 
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
         } else
@@ -1142,8 +1130,8 @@ static int ip6mr_cache_report(struct mr6_table *mrt, struct sk_buff *pkt,
         msg->im6_msgtype = assert;
         msg->im6_mif = mifi;
         msg->im6_pad = 0;
-        msg->im6_src = ipv6_hdr(pkt)->saddr;
-        msg->im6_dst = ipv6_hdr(pkt)->daddr;
+        ipv6_addr_copy(&msg->im6_src, &ipv6_hdr(pkt)->saddr);
+        ipv6_addr_copy(&msg->im6_dst, &ipv6_hdr(pkt)->daddr);
 
         skb_dst_set(skb, dst_clone(skb_dst(pkt)));
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1159,7 +1147,8 @@ static int ip6mr_cache_report(struct mr6_table *mrt, struct sk_buff *pkt,
          */
         ret = sock_queue_rcv_skb(mrt->mroute6_sk, skb);
         if (ret < 0) {
-                net_warn_ratelimited("mroute6: pending queue full, dropping entries\n");
+                if (net_ratelimit())
+                        printk(KERN_WARNING "mroute6: pending queue full, dropping entries.\n");
                 kfree_skb(skb);
         }
 
@@ -1223,7 +1212,6 @@ ip6mr_cache_unresolved(struct mr6_table *mrt, mifi_t mifi, struct sk_buff *skb)
 
                 atomic_inc(&mrt->cache_resolve_queue_len);
                 list_add(&c->list, &mrt->mfc6_unres_queue);
-                mr6_netlink_event(mrt, c, RTM_NEWROUTE);
 
                 ipmr_do_expire_process(mrt);
         }
@@ -1261,7 +1249,6 @@ static int ip6mr_mfc_delete(struct mr6_table *mrt, struct mf6cctl *mfc)
                         list_del(&c->list);
                         write_unlock_bh(&mrt_lock);
 
-                        mr6_netlink_event(mrt, c, RTM_DELROUTE);
                         ip6mr_cache_free(c);
                         return 0;
                 }
@@ -1364,7 +1351,7 @@ int __init ip6_mr_init(void)
                 goto reg_notif_fail;
 #ifdef CONFIG_IPV6_PIMSM_V2
         if (inet6_add_protocol(&pim6_protocol, IPPROTO_PIM) < 0) {
-                pr_err("%s: can't add PIM protocol\n", __func__);
+                printk(KERN_ERR "ip6_mr_init: can't add PIM protocol\n");
                 err = -EAGAIN;
                 goto add_proto_fail;
         }
@@ -1426,7 +1413,6 @@ static int ip6mr_mfc_add(struct net *net, struct mr6_table *mrt,
                 if (!mrtsock)
                         c->mfc_flags |= MFC_STATIC;
                 write_unlock_bh(&mrt_lock);
-                mr6_netlink_event(mrt, c, RTM_NEWROUTE);
                 return 0;
         }
 
@@ -1471,7 +1457,6 @@ static int ip6mr_mfc_add(struct net *net, struct mr6_table *mrt,
                 ip6mr_cache_resolve(net, mrt, uc, c);
                 ip6mr_cache_free(uc);
         }
-        mr6_netlink_event(mrt, c, RTM_NEWROUTE);
         return 0;
 }
 
@@ -1505,7 +1490,6 @@ static void mroute_clean_tables(struct mr6_table *mrt)
                         list_del(&c->list);
                         write_unlock_bh(&mrt_lock);
 
-                        mr6_netlink_event(mrt, c, RTM_DELROUTE);
                         ip6mr_cache_free(c);
                 }
         }
@@ -1514,7 +1498,6 @@ static void mroute_clean_tables(struct mr6_table *mrt)
                 spin_lock_bh(&mfc_unres_lock);
                 list_for_each_entry_safe(c, next, &mrt->mfc6_unres_queue, list) {
                         list_del(&c->list);
-                        mr6_netlink_event(mrt, c, RTM_DELROUTE);
                         ip6mr_destroy_unres(mrt, c);
                 }
                 spin_unlock_bh(&mfc_unres_lock);
@@ -1531,9 +1514,6 @@ static int ip6mr_sk_init(struct mr6_table *mrt, struct sock *sk)
         if (likely(mrt->mroute6_sk == NULL)) {
                 mrt->mroute6_sk = sk;
                 net->ipv6.devconf_all->mc_forwarding++;
-                inet6_netconf_notify_devconf(net, NETCONFA_MC_FORWARDING,
-                                             NETCONFA_IFINDEX_ALL,
-                                             net->ipv6.devconf_all);
         }
         else
                 err = -EADDRINUSE;
@@ -1556,10 +1536,6 @@ int ip6mr_sk_done(struct sock *sk)
                         write_lock_bh(&mrt_lock);
                         mrt->mroute6_sk = NULL;
                         net->ipv6.devconf_all->mc_forwarding--;
-                        inet6_netconf_notify_devconf(net,
-                                                     NETCONFA_MC_FORWARDING,
-                                                     NETCONFA_IFINDEX_ALL,
-                                                     net->ipv6.devconf_all);
                         write_unlock_bh(&mrt_lock);
 
                         mroute_clean_tables(mrt);
@@ -1608,7 +1584,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
                 return -ENOENT;
 
         if (optname != MRT6_INIT) {
-                if (sk != mrt->mroute6_sk && !ns_capable(net->user_ns, CAP_NET_ADMIN))
+                if (sk != mrt->mroute6_sk && !capable(CAP_NET_ADMIN))
                         return -EACCES;
         }
 
@@ -1671,12 +1647,9 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
         case MRT6_ASSERT:
         {
                 int v;
-
-                if (optlen != sizeof(v))
-                        return -EINVAL;
                 if (get_user(v, (int __user *)optval))
                         return -EFAULT;
-                mrt->mroute_do_assert = v;
+                mrt->mroute_do_assert = !!v;
                 return 0;
         }
 
@@ -1684,9 +1657,6 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
         case MRT6_PIM:
         {
                 int v;
-
-                if (optlen != sizeof(v))
-                        return -EINVAL;
                 if (get_user(v, (int __user *)optval))
                         return -EFAULT;
                 v = !!v;
@@ -1917,8 +1887,6 @@ static inline int ip6mr_forward2_finish(struct sk_buff *skb)
 {
         IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
                          IPSTATS_MIB_OUTFORWDATAGRAMS);
-        IP6_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
-                         IPSTATS_MIB_OUTOCTETS, skb->len);
         return dst_output(skb);
 }
 
@@ -1957,10 +1925,8 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
         };
 
         dst = ip6_route_output(net, NULL, &fl6);
-        if (dst->error) {
-                dst_release(dst);
+        if (!dst)
                 goto out_free;
-        }
 
         skb_dst_drop(skb);
         skb_dst_set(skb, dst);
@@ -2128,45 +2094,37 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
 {
         int ct;
         struct rtnexthop *nhp;
-        struct nlattr *mp_attr;
-        struct rta_mfc_stats mfcs;
+        u8 *b = skb_tail_pointer(skb);
+        struct rtattr *mp_head;
 
         /* If cache is unresolved, don't try to parse IIF and OIF */
         if (c->mf6c_parent >= MAXMIFS)
                 return -ENOENT;
 
-        if (MIF_EXISTS(mrt, c->mf6c_parent) &&
-            nla_put_u32(skb, RTA_IIF, mrt->vif6_table[c->mf6c_parent].dev->ifindex) < 0)
-                return -EMSGSIZE;
-        mp_attr = nla_nest_start(skb, RTA_MULTIPATH);
-        if (mp_attr == NULL)
-                return -EMSGSIZE;
+        if (MIF_EXISTS(mrt, c->mf6c_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &mrt->vif6_table[c->mf6c_parent].dev->ifindex);
+
+        mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
 
         for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
                 if (MIF_EXISTS(mrt, ct) && c->mfc_un.res.ttls[ct] < 255) {
-                        nhp = nla_reserve_nohdr(skb, sizeof(*nhp));
-                        if (nhp == NULL) {
-                                nla_nest_cancel(skb, mp_attr);
-                                return -EMSGSIZE;
-                        }
-
+                        if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
+                                goto rtattr_failure;
+                        nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
                         nhp->rtnh_flags = 0;
                         nhp->rtnh_hops = c->mfc_un.res.ttls[ct];
                         nhp->rtnh_ifindex = mrt->vif6_table[ct].dev->ifindex;
                         nhp->rtnh_len = sizeof(*nhp);
                 }
         }
-
-        nla_nest_end(skb, mp_attr);
-
-        mfcs.mfcs_packets = c->mfc_un.res.pkt;
-        mfcs.mfcs_bytes = c->mfc_un.res.bytes;
-        mfcs.mfcs_wrong_if = c->mfc_un.res.wrong_if;
-        if (nla_put(skb, RTA_MFC_STATS, sizeof(mfcs), &mfcs) < 0)
-                return -EMSGSIZE;
-
+        mp_head->rta_type = RTA_MULTIPATH;
+        mp_head->rta_len = skb_tail_pointer(skb) - (u8 *)mp_head;
         rtm->rtm_type = RTN_MULTICAST;
         return 1;
+
+rtattr_failure:
+        nlmsg_trim(skb, b);
+        return -EMSGSIZE;
 }
 
 int ip6mr_get_route(struct net *net,
@@ -2222,8 +2180,8 @@ int ip6mr_get_route(struct net *net,
                 iph->payload_len = 0;
                 iph->nexthdr = IPPROTO_NONE;
                 iph->hop_limit = 0;
-                iph->saddr = rt->rt6i_src.addr;
-                iph->daddr = rt->rt6i_dst.addr;
+                ipv6_addr_copy(&iph->saddr, &rt->rt6i_src.addr);
+                ipv6_addr_copy(&iph->daddr, &rt->rt6i_dst.addr);
 
                 err = ip6mr_cache_unresolved(mrt, vif, skb2);
                 read_unlock(&mrt_lock);
@@ -2240,38 +2198,30 @@ int ip6mr_get_route(struct net *net,
 }
 
 static int ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
-                             u32 portid, u32 seq, struct mfc6_cache *c, int cmd)
+                             u32 pid, u32 seq, struct mfc6_cache *c)
 {
         struct nlmsghdr *nlh;
         struct rtmsg *rtm;
-        int err;
 
-        nlh = nlmsg_put(skb, portid, seq, cmd, sizeof(*rtm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, pid, seq, RTM_NEWROUTE, sizeof(*rtm), NLM_F_MULTI);
         if (nlh == NULL)
                 return -EMSGSIZE;
 
         rtm = nlmsg_data(nlh);
-        rtm->rtm_family   = RTNL_FAMILY_IP6MR;
+        rtm->rtm_family   = RTNL_FAMILY_IPMR;
         rtm->rtm_dst_len  = 128;
         rtm->rtm_src_len  = 128;
         rtm->rtm_tos      = 0;
         rtm->rtm_table    = mrt->id;
-        if (nla_put_u32(skb, RTA_TABLE, mrt->id))
-                goto nla_put_failure;
-        rtm->rtm_type = RTN_MULTICAST;
+        NLA_PUT_U32(skb, RTA_TABLE, mrt->id);
         rtm->rtm_scope    = RT_SCOPE_UNIVERSE;
-        if (c->mfc_flags & MFC_STATIC)
-                rtm->rtm_protocol = RTPROT_STATIC;
-        else
-                rtm->rtm_protocol = RTPROT_MROUTED;
+        rtm->rtm_protocol = RTPROT_UNSPEC;
         rtm->rtm_flags    = 0;
 
-        if (nla_put(skb, RTA_SRC, 16, &c->mf6c_origin) ||
-            nla_put(skb, RTA_DST, 16, &c->mf6c_mcastgrp))
-                goto nla_put_failure;
-        err = __ip6mr_fill_mroute(mrt, skb, c, rtm);
-        /* do not break the dump if cache is unresolved */
-        if (err < 0 && err != -ENOENT)
+        NLA_PUT(skb, RTA_SRC, 16, &c->mf6c_origin);
+        NLA_PUT(skb, RTA_DST, 16, &c->mf6c_mcastgrp);
+
+        if (__ip6mr_fill_mroute(mrt, skb, c, rtm) < 0)
                 goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
@@ -2281,52 +2231,6 @@ nla_put_failure:
         return -EMSGSIZE;
 }
 
-static int mr6_msgsize(bool unresolved, int maxvif)
-{
-        size_t len =
-                NLMSG_ALIGN(sizeof(struct rtmsg))
-                + nla_total_size(4)     /* RTA_TABLE */
-                + nla_total_size(sizeof(struct in6_addr))       /* RTA_SRC */
-                + nla_total_size(sizeof(struct in6_addr))       /* RTA_DST */
-                ;
-
-        if (!unresolved)
-                len = len
-                      + nla_total_size(4)       /* RTA_IIF */
-                      + nla_total_size(0)       /* RTA_MULTIPATH */
-                      + maxvif * NLA_ALIGN(sizeof(struct rtnexthop))
-                                                /* RTA_MFC_STATS */
-                      + nla_total_size(sizeof(struct rta_mfc_stats))
-                ;
-
-        return len;
-}
-
-static void mr6_netlink_event(struct mr6_table *mrt, struct mfc6_cache *mfc,
-                              int cmd)
-{
-        struct net *net = read_pnet(&mrt->net);
-        struct sk_buff *skb;
-        int err = -ENOBUFS;
-
-        skb = nlmsg_new(mr6_msgsize(mfc->mf6c_parent >= MAXMIFS, mrt->maxvif),
-                        GFP_ATOMIC);
-        if (skb == NULL)
-                goto errout;
-
-        err = ip6mr_fill_mroute(mrt, skb, 0, 0, mfc, cmd);
-        if (err < 0)
-                goto errout;
-
-        rtnl_notify(skb, net, 0, RTNLGRP_IPV6_MROUTE, NULL, GFP_ATOMIC);
-        return;
-
-errout:
-        kfree_skb(skb);
-        if (err < 0)
-                rtnl_set_sk_err(net, RTNLGRP_IPV6_MROUTE, err);
-}
-
 static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
 {
         struct net *net = sock_net(skb->sk);
@@ -2351,31 +2255,15 @@ static int ip6mr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
                                 if (e < s_e)
                                         goto next_entry;
                                 if (ip6mr_fill_mroute(mrt, skb,
-                                                      NETLINK_CB(cb->skb).portid,
+                                                      NETLINK_CB(cb->skb).pid,
                                                       cb->nlh->nlmsg_seq,
-                                                      mfc, RTM_NEWROUTE) < 0)
+                                                      mfc) < 0)
                                         goto done;
 next_entry:
                                 e++;
                         }
                         e = s_e = 0;
                 }
-                spin_lock_bh(&mfc_unres_lock);
-                list_for_each_entry(mfc, &mrt->mfc6_unres_queue, list) {
-                        if (e < s_e)
-                                goto next_entry2;
-                        if (ip6mr_fill_mroute(mrt, skb,
-                                              NETLINK_CB(cb->skb).portid,
-                                              cb->nlh->nlmsg_seq,
-                                              mfc, RTM_NEWROUTE) < 0) {
-                                spin_unlock_bh(&mfc_unres_lock);
-                                goto done;
-                        }
-next_entry2:
-                        e++;
-                }
-                spin_unlock_bh(&mfc_unres_lock);
-                e = s_e = 0;
                 s_h = 0;
 next_table:
                 t++;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 7af5aee75d9..bba658d9a03 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -30,9 +30,6 @@
  *  The decompression of IP datagram MUST be done after the reassembly,
  *  AH/ESP processing.
  */
-
-#define pr_fmt(fmt) "IPv6: " fmt
-
 #include <linux/module.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
@@ -46,7 +43,6 @@
 #include <linux/list.h>
 #include <linux/vmalloc.h>
 #include <linux/rtnetlink.h>
-#include <net/ip6_route.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
@@ -64,9 +60,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 (struct ip_comp_hdr *)(skb->data + offset);
         struct xfrm_state *x;
 
-        if (type != ICMPV6_DEST_UNREACH &&
-            type != ICMPV6_PKT_TOOBIG &&
-            type != NDISC_REDIRECT)
+        if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG)
                 return;
 
         spi = htonl(ntohs(ipcomph->cpi));
@@ -75,10 +69,8 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (!x)
                 return;
 
-        if (type == NDISC_REDIRECT)
-                ip6_redirect(skb, net, 0, 0);
-        else
-                ip6_update_pmtu(skb, net, info, 0, 0);
+        printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%pI6\n",
+                        spi, &iph->daddr);
         xfrm_state_put(x);
 }
 
@@ -198,11 +190,11 @@ static const struct inet6_protocol ipcomp6_protocol =
 static int __init ipcomp6_init(void)
 {
         if (xfrm_register_type(&ipcomp6_type, AF_INET6) < 0) {
-                pr_info("%s: can't add xfrm type\n", __func__);
+                printk(KERN_INFO "ipcomp6 init: can't add xfrm type\n");
                 return -EAGAIN;
         }
         if (inet6_add_protocol(&ipcomp6_protocol, IPPROTO_COMP) < 0) {
-                pr_info("%s: can't add protocol\n", __func__);
+                printk(KERN_INFO "ipcomp6 init: can't add protocol\n");
                 xfrm_unregister_type(&ipcomp6_type, AF_INET6);
                 return -EAGAIN;
         }
@@ -212,9 +204,9 @@ static int __init ipcomp6_init(void)
 static void __exit ipcomp6_fini(void)
 {
         if (inet6_del_protocol(&ipcomp6_protocol, IPPROTO_COMP) < 0)
-                pr_info("%s: can't remove protocol\n", __func__);
+                printk(KERN_INFO "ipv6 ipcomp close: can't remove protocol\n");
         if (xfrm_unregister_type(&ipcomp6_type, AF_INET6) < 0)
-                pr_info("%s: can't remove xfrm type\n", __func__);
+                printk(KERN_INFO "ipv6 ipcomp close: can't remove xfrm type\n");
 }
 
 module_init(ipcomp6_init);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index ee94d31c9d4..2fbda5fc4cc 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -343,8 +343,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 break;
 
         case IPV6_TRANSPARENT:
-                if (valbool && !ns_capable(net->user_ns, CAP_NET_ADMIN) &&
-                    !ns_capable(net->user_ns, CAP_NET_RAW)) {
+                if (!capable(CAP_NET_ADMIN)) {
                         retv = -EPERM;
                         break;
                 }
@@ -382,7 +381,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 
                 /* hop-by-hop / destination options are privileged option */
                 retv = -EPERM;
-                if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
+                if (optname != IPV6_RTHDR && !capable(CAP_NET_RAW))
                         break;
 
                 opt = ipv6_renew_options(sk, np->opt, optname,
@@ -398,7 +397,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 if (optname == IPV6_RTHDR && opt && opt->srcrt) {
                         struct ipv6_rt_hdr *rthdr = opt->srcrt;
                         switch (rthdr->type) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         case IPV6_SRCRT_TYPE_2:
                                 if (rthdr->hdrlen != 2 ||
                                     rthdr->segments_left != 1)
@@ -436,7 +435,7 @@ sticky_done:
                         goto e_inval;
 
                 np->sticky_pktinfo.ipi6_ifindex = pkt.ipi6_ifindex;
-                np->sticky_pktinfo.ipi6_addr = pkt.ipi6_addr;
+                ipv6_addr_copy(&np->sticky_pktinfo.ipi6_addr, &pkt.ipi6_addr);
                 retv = 0;
                 break;
         }
@@ -504,7 +503,7 @@ done:
                         goto e_inval;
                 if (val > 255 || val < -1)
                         goto e_inval;
-                np->mcast_hops = (val == -1 ? IPV6_DEFAULT_MCASTHOPS : val);
+                np->mcast_hops = val;
                 retv = 0;
                 break;
 
@@ -517,36 +516,6 @@ done:
                 retv = 0;
                 break;
 
-        case IPV6_UNICAST_IF:
-        {
-                struct net_device *dev = NULL;
-                int ifindex;
-
-                if (optlen != sizeof(int))
-                        goto e_inval;
-
-                ifindex = (__force int)ntohl((__force __be32)val);
-                if (ifindex == 0) {
-                        np->ucast_oif = 0;
-                        retv = 0;
-                        break;
-                }
-
-                dev = dev_get_by_index(net, ifindex);
-                retv = -EADDRNOTAVAIL;
-                if (!dev)
-                        break;
-                dev_put(dev);
-
-                retv = -EINVAL;
-                if (sk->sk_bound_dev_if)
-                        break;
-
-                np->ucast_oif = ifindex;
-                retv = 0;
-                break;
-        }
-
         case IPV6_MULTICAST_IF:
                 if (sk->sk_type == SOCK_STREAM)
                         break;
@@ -679,6 +648,7 @@ done:
         }
         case MCAST_MSFILTER:
         {
+                extern int sysctl_mld_max_msf;
                 struct group_filter *gsf;
 
                 if (optlen < GROUP_FILTER_SIZE(0))
@@ -755,7 +725,7 @@ done:
         case IPV6_IPSEC_POLICY:
         case IPV6_XFRM_POLICY:
                 retv = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
                         break;
                 retv = xfrm_user_policy(sk, optname, optval, optlen);
                 break;
@@ -828,7 +798,6 @@ pref_skip_coa:
                 if (val < 0 || val > 255)
                         goto e_inval;
                 np->min_hopcount = val;
-                retv = 0;
                 break;
         case IPV6_DONTFRAG:
                 np->dontfrag = valbool;
@@ -944,7 +913,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
 }
 
 static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
-                    char __user *optval, int __user *optlen, unsigned int flags)
+                    char __user *optval, int __user *optlen, unsigned flags)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         int len;
@@ -1011,22 +980,20 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                                 struct in6_pktinfo src_info;
                                 src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif :
                                         np->sticky_pktinfo.ipi6_ifindex;
-                                src_info.ipi6_addr = np->mcast_oif ? np->daddr : np->sticky_pktinfo.ipi6_addr;
+                                np->mcast_oif? ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr) :
+                                        ipv6_addr_copy(&src_info.ipi6_addr, &(np->sticky_pktinfo.ipi6_addr));
                                 put_cmsg(&msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info);
                         }
                         if (np->rxopt.bits.rxhlim) {
                                 int hlim = np->mcast_hops;
                                 put_cmsg(&msg, SOL_IPV6, IPV6_HOPLIMIT, sizeof(hlim), &hlim);
                         }
-                        if (np->rxopt.bits.rxtclass) {
-                                int tclass = np->rcv_tclass;
-                                put_cmsg(&msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
-                        }
                         if (np->rxopt.bits.rxoinfo) {
                                 struct in6_pktinfo src_info;
                                 src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif :
                                         np->sticky_pktinfo.ipi6_ifindex;
-                                src_info.ipi6_addr = np->mcast_oif ? np->daddr : np->sticky_pktinfo.ipi6_addr;
+                                np->mcast_oif? ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr) :
+                                        ipv6_addr_copy(&src_info.ipi6_addr, &(np->sticky_pktinfo.ipi6_addr));
                                 put_cmsg(&msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
                         }
                         if (np->rxopt.bits.rxohlim) {
@@ -1195,10 +1162,6 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 val = np->mcast_oif;
                 break;
 
-        case IPV6_UNICAST_IF:
-                val = (__force int)htonl((__u32) np->ucast_oif);
-                break;
-
         case IPV6_MTU_DISCOVER:
                 val = np->pmtudisc;
                 break;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 28dfa5f3801..ee7839f4d6e 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -155,15 +155,15 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
                 return -ENOMEM;
 
         mc_lst->next = NULL;
-        mc_lst->addr = *addr;
+        ipv6_addr_copy(&mc_lst->addr, addr);
 
         rcu_read_lock();
         if (ifindex == 0) {
                 struct rt6_info *rt;
                 rt = rt6_lookup(net, addr, NULL, 0, 0);
                 if (rt) {
-                        dev = rt->dst.dev;
-                        ip6_rt_put(rt);
+                        dev = rt->rt6i_dev;
+                        dst_release(&rt->dst);
                 }
         } else
                 dev = dev_get_by_index_rcu(net, ifindex);
@@ -211,9 +211,6 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
         struct ipv6_mc_socklist __rcu **lnk;
         struct net *net = sock_net(sk);
 
-        if (!ipv6_addr_is_multicast(addr))
-                return -EINVAL;
-
         spin_lock(&ipv6_sk_mc_lock);
         for (lnk = &np->ipv6_mc_list;
              (mc_lst = rcu_dereference_protected(*lnk,
@@ -259,8 +256,9 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
                 struct rt6_info *rt = rt6_lookup(net, group, NULL, 0, 0);
 
                 if (rt) {
-                        dev = rt->dst.dev;
-                        ip6_rt_put(rt);
+                        dev = rt->rt6i_dev;
+                        dev_hold(dev);
+                        dst_release(&rt->dst);
                 }
         } else
                 dev = dev_get_by_index_rcu(net, ifindex);
@@ -284,9 +282,6 @@ void ipv6_sock_mc_close(struct sock *sk)
         struct ipv6_mc_socklist *mc_lst;
         struct net *net = sock_net(sk);
 
-        if (!rcu_access_pointer(np->ipv6_mc_list))
-                return;
-
         spin_lock(&ipv6_sk_mc_lock);
         while ((mc_lst = rcu_dereference_protected(np->ipv6_mc_list,
                                 lockdep_is_held(&ipv6_sk_mc_lock))) != NULL) {
@@ -612,13 +607,13 @@ done:
         return err;
 }
 
-bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
-                    const struct in6_addr *src_addr)
+int inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
+                   const struct in6_addr *src_addr)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct ipv6_mc_socklist *mc;
         struct ip6_sf_socklist *psl;
-        bool rv = true;
+        int rv = 1;
 
         rcu_read_lock();
         for_each_pmc_rcu(np, mc) {
@@ -627,7 +622,7 @@ bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
         }
         if (!mc) {
                 rcu_read_unlock();
-                return true;
+                return 1;
         }
         read_lock(&mc->sflock);
         psl = mc->sflist;
@@ -641,9 +636,9 @@ bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
                                 break;
                 }
                 if (mc->sfmode == MCAST_INCLUDE && i >= psl->sl_count)
-                        rv = false;
+                        rv = 0;
                 if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
-                        rv = false;
+                        rv = 0;
         }
         read_unlock(&mc->sflock);
         rcu_read_unlock();
@@ -863,7 +858,7 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
 
         setup_timer(&mc->mca_timer, igmp6_timer_handler, (unsigned long)mc);
 
-        mc->mca_addr = *addr;
+        ipv6_addr_copy(&mc->mca_addr, addr);
         mc->idev = idev; /* (reference taken) */
         mc->mca_users = 1;
         /* mca_stamp should be updated upon changes */
@@ -937,15 +932,15 @@ int ipv6_dev_mc_dec(struct net_device *dev, const struct in6_addr *addr)
 /*
  * identify MLD packets for MLD filter exceptions
  */
-bool ipv6_is_mld(struct sk_buff *skb, int nexthdr)
+int ipv6_is_mld(struct sk_buff *skb, int nexthdr)
 {
         struct icmp6hdr *pic;
 
         if (nexthdr != IPPROTO_ICMPV6)
-                return false;
+                return 0;
 
         if (!pskb_may_pull(skb, sizeof(struct icmp6hdr)))
-                return false;
+                return 0;
 
         pic = icmp6_hdr(skb);
 
@@ -954,22 +949,22 @@ bool ipv6_is_mld(struct sk_buff *skb, int nexthdr)
         case ICMPV6_MGM_REPORT:
         case ICMPV6_MGM_REDUCTION:
         case ICMPV6_MLD2_REPORT:
-                return true;
+                return 1;
         default:
                 break;
         }
-        return false;
+        return 0;
 }
 
 /*
  *      check if the interface/address pair is valid
  */
-bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
-                         const struct in6_addr *src_addr)
+int ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
+                        const struct in6_addr *src_addr)
 {
         struct inet6_dev *idev;
         struct ifmcaddr6 *mc;
-        bool rv = false;
+        int rv = 0;
 
         rcu_read_lock();
         idev = __in6_dev_get(dev);
@@ -996,7 +991,7 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
                                         rv = mc->mca_sfcount[MCAST_EXCLUDE] !=0;
                                 spin_unlock_bh(&mc->mca_lock);
                         } else
-                                rv = true; /* don't filter unspecified source */
+                                rv = 1; /* don't filter unspecified source */
                 }
                 read_unlock_bh(&idev->lock);
         }
@@ -1052,8 +1047,8 @@ static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
 }
 
 /* mark EXCLUDE-mode sources */
-static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
-                             const struct in6_addr *srcs)
+static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
+        const struct in6_addr *srcs)
 {
         struct ip6_sf_list *psf;
         int i, scount;
@@ -1067,7 +1062,7 @@ static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
                         if (psf->sf_count[MCAST_INCLUDE] ||
                             pmc->mca_sfcount[MCAST_EXCLUDE] !=
                             psf->sf_count[MCAST_EXCLUDE])
-                                break;
+                                continue;
                         if (ipv6_addr_equal(&srcs[i], &psf->sf_addr)) {
                                 scount++;
                                 break;
@@ -1076,12 +1071,12 @@ static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
         }
         pmc->mca_flags &= ~MAF_GSQUERY;
         if (scount == nsrcs)    /* all sources excluded */
-                return false;
-        return true;
+                return 0;
+        return 1;
 }
 
-static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
-                            const struct in6_addr *srcs)
+static int mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
+        const struct in6_addr *srcs)
 {
         struct ip6_sf_list *psf;
         int i, scount;
@@ -1105,10 +1100,10 @@ static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
         }
         if (!scount) {
                 pmc->mca_flags &= ~MAF_GSQUERY;
-                return false;
+                return 0;
         }
         pmc->mca_flags |= MAF_GSQUERY;
-        return true;
+        return 1;
 }
 
 /* called with rcu_read_lock() */
@@ -1282,17 +1277,17 @@ int igmp6_event_report(struct sk_buff *skb)
         return 0;
 }
 
-static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
-                  int gdeleted, int sdeleted)
+static int is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
+        int gdeleted, int sdeleted)
 {
         switch (type) {
         case MLD2_MODE_IS_INCLUDE:
         case MLD2_MODE_IS_EXCLUDE:
                 if (gdeleted || sdeleted)
-                        return false;
+                        return 0;
                 if (!((pmc->mca_flags & MAF_GSQUERY) && !psf->sf_gsresp)) {
                         if (pmc->mca_sfmode == MCAST_INCLUDE)
-                                return true;
+                                return 1;
                         /* don't include if this source is excluded
                          * in all filters
                          */
@@ -1301,29 +1296,29 @@ static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
                         return pmc->mca_sfcount[MCAST_EXCLUDE] ==
                                 psf->sf_count[MCAST_EXCLUDE];
                 }
-                return false;
+                return 0;
         case MLD2_CHANGE_TO_INCLUDE:
                 if (gdeleted || sdeleted)
-                        return false;
+                        return 0;
                 return psf->sf_count[MCAST_INCLUDE] != 0;
         case MLD2_CHANGE_TO_EXCLUDE:
                 if (gdeleted || sdeleted)
-                        return false;
+                        return 0;
                 if (pmc->mca_sfcount[MCAST_EXCLUDE] == 0 ||
                     psf->sf_count[MCAST_INCLUDE])
-                        return false;
+                        return 0;
                 return pmc->mca_sfcount[MCAST_EXCLUDE] ==
                         psf->sf_count[MCAST_EXCLUDE];
         case MLD2_ALLOW_NEW_SOURCES:
                 if (gdeleted || !psf->sf_crcount)
-                        return false;
+                        return 0;
                 return (pmc->mca_sfmode == MCAST_INCLUDE) ^ sdeleted;
         case MLD2_BLOCK_OLD_SOURCES:
                 if (pmc->mca_sfmode == MCAST_INCLUDE)
                         return gdeleted || (psf->sf_crcount && sdeleted);
                 return psf->sf_crcount && !gdeleted && !sdeleted;
         }
-        return false;
+        return 0;
 }
 
 static int
@@ -1348,15 +1343,13 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
         struct mld2_report *pmr;
         struct in6_addr addr_buf;
         const struct in6_addr *saddr;
-        int hlen = LL_RESERVED_SPACE(dev);
-        int tlen = dev->needed_tailroom;
         int err;
         u8 ra[8] = { IPPROTO_ICMPV6, 0,
                      IPV6_TLV_ROUTERALERT, 2, 0, 0,
                      IPV6_TLV_PADN, 0 };
 
         /* we assume size > sizeof(ra) here */
-        size += hlen + tlen;
+        size += LL_ALLOCATED_SPACE(dev);
         /* limit our allocations to order-0 page */
         size = min_t(int, size, SKB_MAX_ORDER(0, 0));
         skb = sock_alloc_send_skb(sk, size, 1, &err);
@@ -1364,7 +1357,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
         if (!skb)
                 return NULL;
 
-        skb_reserve(skb, hlen);
+        skb_reserve(skb, LL_RESERVED_SPACE(dev));
 
         if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
                 /* <draft-ietf-magma-mld-source-05.txt>:
@@ -1415,11 +1408,18 @@ static void mld_sendpack(struct sk_buff *skb)
                                            csum_partial(skb_transport_header(skb),
                                                         mldlen, 0));
 
+        dst = icmp6_dst_alloc(skb->dev, NULL, &ipv6_hdr(skb)->daddr);
+
+        if (!dst) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
         icmpv6_flow_init(net->ipv6.igmp_sk, &fl6, ICMPV6_MLD2_REPORT,
                          &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
                          skb->dev->ifindex);
-        dst = icmp6_dst_alloc(skb->dev, NULL, &fl6);
 
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
         err = 0;
         if (IS_ERR(dst)) {
                 err = PTR_ERR(dst);
@@ -1723,8 +1723,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         struct mld_msg *hdr;
         const struct in6_addr *snd_addr, *saddr;
         struct in6_addr addr_buf;
-        int hlen = LL_RESERVED_SPACE(dev);
-        int tlen = dev->needed_tailroom;
         int err, len, payload_len, full_len;
         u8 ra[8] = { IPPROTO_ICMPV6, 0,
                      IPV6_TLV_ROUTERALERT, 2, 0, 0,
@@ -1746,7 +1744,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                       IPSTATS_MIB_OUT, full_len);
         rcu_read_unlock();
 
-        skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err);
+        skb = sock_alloc_send_skb(sk, LL_ALLOCATED_SPACE(dev) + full_len, 1, &err);
 
         if (skb == NULL) {
                 rcu_read_lock();
@@ -1756,7 +1754,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                 return;
         }
 
-        skb_reserve(skb, hlen);
+        skb_reserve(skb, LL_RESERVED_SPACE(dev));
 
         if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
                 /* <draft-ietf-magma-mld-source-05.txt>:
@@ -1774,7 +1772,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         hdr = (struct mld_msg *) skb_put(skb, sizeof(struct mld_msg));
         memset(hdr, 0, sizeof(struct mld_msg));
         hdr->mld_type = type;
-        hdr->mld_mca = *addr;
+        ipv6_addr_copy(&hdr->mld_mca, addr);
 
         hdr->mld_cksum = csum_ipv6_magic(saddr, snd_addr, len,
                                          IPPROTO_ICMPV6,
@@ -1783,10 +1781,17 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         rcu_read_lock();
         idev = __in6_dev_get(skb->dev);
 
+        dst = icmp6_dst_alloc(skb->dev, NULL, &ipv6_hdr(skb)->daddr);
+        if (!dst) {
+                err = -ENOMEM;
+                goto err_out;
+        }
+
         icmpv6_flow_init(sk, &fl6, type,
                          &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
                          skb->dev->ifindex);
-        dst = icmp6_dst_alloc(skb->dev, NULL, &fl6);
+
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
         if (IS_ERR(dst)) {
                 err = PTR_ERR(dst);
                 goto err_out;
@@ -1909,7 +1914,7 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
  * Add multicast single-source filter to the interface list
  */
 static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
-        const struct in6_addr *psfsrc)
+        const struct in6_addr *psfsrc, int delta)
 {
         struct ip6_sf_list *psf, *psf_prev;
 
@@ -2040,7 +2045,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
                 pmc->mca_sfcount[sfmode]++;
         err = 0;
         for (i=0; i<sfcount; i++) {
-                err = ip6_mc_add1_src(pmc, sfmode, &psfsrc[i]);
+                err = ip6_mc_add1_src(pmc, sfmode, &psfsrc[i], delta);
                 if (err)
                         break;
         }
@@ -2050,7 +2055,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
                 if (!delta)
                         pmc->mca_sfcount[sfmode]--;
                 for (j=0; j<i; j++)
-                        ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
+                        (void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
         } else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
                 struct ip6_sf_list *psf;
 
@@ -2633,7 +2638,8 @@ static int __net_init igmp6_net_init(struct net *net)
         err = inet_ctl_sock_create(&net->ipv6.igmp_sk, PF_INET6,
                                    SOCK_RAW, IPPROTO_ICMPV6, net);
         if (err < 0) {
-                pr_err("Failed to initialize the IGMP6 control socket (err %d)\n",
+                printk(KERN_ERR
+                       "Failed to initialize the IGMP6 control socket (err %d).\n",
                        err);
                 goto out;
         }
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 0f9bdc5ee9f..43242e6e610 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -22,8 +22,6 @@
  *      Masahide NAKAMURA @USAGI
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/time.h>
@@ -46,7 +44,7 @@ static inline void *mip6_padn(__u8 *data, __u8 padlen)
         if (!data)
                 return NULL;
         if (padlen == 1) {
-                data[0] = IPV6_TLV_PAD1;
+                data[0] = IPV6_TLV_PAD0;
         } else if (padlen > 1) {
                 data[0] = IPV6_TLV_PADN;
                 data[1] = padlen - 2;
@@ -86,30 +84,28 @@ static int mip6_mh_len(int type)
 
 static int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
 {
-        struct ip6_mh _hdr;
-        const struct ip6_mh *mh;
+        struct ip6_mh *mh;
 
-        mh = skb_header_pointer(skb, skb_transport_offset(skb),
-                                sizeof(_hdr), &_hdr);
-        if (!mh)
+        if (!pskb_may_pull(skb, (skb_transport_offset(skb)) + 8) ||
+            !pskb_may_pull(skb, (skb_transport_offset(skb) +
+                                 ((skb_transport_header(skb)[1] + 1) << 3))))
                 return -1;
 
-        if (((mh->ip6mh_hdrlen + 1) << 3) > skb->len)
-                return -1;
+        mh = (struct ip6_mh *)skb_transport_header(skb);
 
         if (mh->ip6mh_hdrlen < mip6_mh_len(mh->ip6mh_type)) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH message too short: %d vs >=%d\n",
                                mh->ip6mh_hdrlen, mip6_mh_len(mh->ip6mh_type));
-                mip6_param_prob(skb, 0, offsetof(struct ip6_mh, ip6mh_hdrlen) +
-                                skb_network_header_len(skb));
+                mip6_param_prob(skb, 0, ((&mh->ip6mh_hdrlen) -
+                                         skb_network_header(skb)));
                 return -1;
         }
 
         if (mh->ip6mh_proto != IPPROTO_NONE) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH invalid payload proto = %d\n",
                                mh->ip6mh_proto);
-                mip6_param_prob(skb, 0, offsetof(struct ip6_mh, ip6mh_proto) +
-                                skb_network_header_len(skb));
+                mip6_param_prob(skb, 0, ((&mh->ip6mh_proto) -
+                                         skb_network_header(skb)));
                 return -1;
         }
 
@@ -199,8 +195,8 @@ static inline int mip6_report_rl_allow(struct timeval *stamp,
                 mip6_report_rl.stamp.tv_sec = stamp->tv_sec;
                 mip6_report_rl.stamp.tv_usec = stamp->tv_usec;
                 mip6_report_rl.iif = iif;
-                mip6_report_rl.src = *src;
-                mip6_report_rl.dst = *dst;
+                ipv6_addr_copy(&mip6_report_rl.src, src);
+                ipv6_addr_copy(&mip6_report_rl.dst, dst);
                 allow = 1;
         }
         spin_unlock_bh(&mip6_report_rl.lock);
@@ -311,12 +307,13 @@ static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
 static int mip6_destopt_init_state(struct xfrm_state *x)
 {
         if (x->id.spi) {
-                pr_info("%s: spi is not 0: %u\n", __func__, x->id.spi);
+                printk(KERN_INFO "%s: spi is not 0: %u\n", __func__,
+                       x->id.spi);
                 return -EINVAL;
         }
         if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
-                pr_info("%s: state's mode is not %u: %u\n",
-                        __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
+                printk(KERN_INFO "%s: state's mode is not %u: %u\n",
+                       __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
                 return -EINVAL;
         }
 
@@ -446,12 +443,13 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
 static int mip6_rthdr_init_state(struct xfrm_state *x)
 {
         if (x->id.spi) {
-                pr_info("%s: spi is not 0: %u\n", __func__, x->id.spi);
+                printk(KERN_INFO "%s: spi is not 0: %u\n", __func__,
+                       x->id.spi);
                 return -EINVAL;
         }
         if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
-                pr_info("%s: state's mode is not %u: %u\n",
-                        __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
+                printk(KERN_INFO "%s: state's mode is not %u: %u\n",
+                       __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
                 return -EINVAL;
         }
 
@@ -483,18 +481,18 @@ static const struct xfrm_type mip6_rthdr_type =
 
 static int __init mip6_init(void)
 {
-        pr_info("Mobile IPv6\n");
+        printk(KERN_INFO "Mobile IPv6\n");
 
         if (xfrm_register_type(&mip6_destopt_type, AF_INET6) < 0) {
-                pr_info("%s: can't add xfrm type(destopt)\n", __func__);
+                printk(KERN_INFO "%s: can't add xfrm type(destopt)\n", __func__);
                 goto mip6_destopt_xfrm_fail;
         }
         if (xfrm_register_type(&mip6_rthdr_type, AF_INET6) < 0) {
-                pr_info("%s: can't add xfrm type(rthdr)\n", __func__);
+                printk(KERN_INFO "%s: can't add xfrm type(rthdr)\n", __func__);
                 goto mip6_rthdr_xfrm_fail;
         }
         if (rawv6_mh_filter_register(mip6_mh_filter) < 0) {
-                pr_info("%s: can't add rawv6 mh filter\n", __func__);
+                printk(KERN_INFO "%s: can't add rawv6 mh filter\n", __func__);
                 goto mip6_rawv6_mh_fail;
         }
 
@@ -512,11 +510,11 @@ static int __init mip6_init(void)
 static void __exit mip6_fini(void)
 {
         if (rawv6_mh_filter_unregister(mip6_mh_filter) < 0)
-                pr_info("%s: can't remove rawv6 mh filter\n", __func__);
+                printk(KERN_INFO "%s: can't remove rawv6 mh filter\n", __func__);
         if (xfrm_unregister_type(&mip6_rthdr_type, AF_INET6) < 0)
-                pr_info("%s: can't remove xfrm type(rthdr)\n", __func__);
+                printk(KERN_INFO "%s: can't remove xfrm type(rthdr)\n", __func__);
         if (xfrm_unregister_type(&mip6_destopt_type, AF_INET6) < 0)
-                pr_info("%s: can't remove xfrm type(destopt)\n", __func__);
+                printk(KERN_INFO "%s: can't remove xfrm type(destopt)\n", __func__);
 }
 
 module_init(mip6_init);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 6574175795d..9da6e02eaae 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -15,7 +15,6 @@
 /*
  *      Changes:
  *
- *      Alexey I. Froloff               :       RFC6106 (DNSSL) support
  *      Pierre Ynard                    :       export userland ND options
  *                                              through netlink (RDNSS support)
  *      Lars Fenneberg                  :       fixed MTU setting on receipt
@@ -27,7 +26,27 @@
  *      YOSHIFUJI Hideaki @USAGI        :       Verify ND options properly
  */
 
-#define pr_fmt(fmt) "ICMPv6: " fmt
+/* Set to 3 to get tracing... */
+#define ND_DEBUG 1
+
+#define ND_PRINTK(fmt, args...) do { if (net_ratelimit()) { printk(fmt, ## args); } } while(0)
+#define ND_NOPRINTK(x...) do { ; } while(0)
+#define ND_PRINTK0 ND_PRINTK
+#define ND_PRINTK1 ND_NOPRINTK
+#define ND_PRINTK2 ND_NOPRINTK
+#define ND_PRINTK3 ND_NOPRINTK
+#if ND_DEBUG >= 1
+#undef ND_PRINTK1
+#define ND_PRINTK1 ND_PRINTK
+#endif
+#if ND_DEBUG >= 2
+#undef ND_PRINTK2
+#define ND_PRINTK2 ND_PRINTK
+#endif
+#if ND_DEBUG >= 3
+#undef ND_PRINTK3
+#define ND_PRINTK3 ND_PRINTK
+#endif
 
 #include <linux/module.h>
 #include <linux/errno.h>
@@ -72,18 +91,9 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 
-/* Set to 3 to get tracing... */
-#define ND_DEBUG 1
-
-#define ND_PRINTK(val, level, fmt, ...)                         \
-do {                                                            \
-        if (val <= ND_DEBUG)                                    \
-                net_##level##_ratelimited(fmt, ##__VA_ARGS__);  \
-} while (0)
-
 static u32 ndisc_hash(const void *pkey,
                       const struct net_device *dev,
-                      __u32 *hash_rnd);
+                      __u32 rnd);
 static int ndisc_constructor(struct neighbour *neigh);
 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
@@ -116,6 +126,7 @@ static const struct neigh_ops ndisc_direct_ops = {
 
 struct neigh_table nd_tbl = {
         .family =       AF_INET6,
+        .entry_size =   sizeof(struct neighbour) + sizeof(struct in6_addr),
         .key_len =      sizeof(struct in6_addr),
         .hash =         ndisc_hash,
         .constructor =  ndisc_constructor,
@@ -130,7 +141,7 @@ struct neigh_table nd_tbl = {
                 .gc_staletime           = 60 * HZ,
                 .reachable_time         = ND_REACHABLE_TIME,
                 .delay_probe_time       = 5 * HZ,
-                .queue_len_bytes        = 64*1024,
+                .queue_len              = 3,
                 .ucast_probes           = 3,
                 .mcast_probes           = 3,
                 .anycast_delay          = 1 * HZ,
@@ -143,6 +154,40 @@ struct neigh_table nd_tbl = {
         .gc_thresh3 =   1024,
 };
 
+/* ND options */
+struct ndisc_options {
+        struct nd_opt_hdr *nd_opt_array[__ND_OPT_ARRAY_MAX];
+#ifdef CONFIG_IPV6_ROUTE_INFO
+        struct nd_opt_hdr *nd_opts_ri;
+        struct nd_opt_hdr *nd_opts_ri_end;
+#endif
+        struct nd_opt_hdr *nd_useropts;
+        struct nd_opt_hdr *nd_useropts_end;
+};
+
+#define nd_opts_src_lladdr      nd_opt_array[ND_OPT_SOURCE_LL_ADDR]
+#define nd_opts_tgt_lladdr      nd_opt_array[ND_OPT_TARGET_LL_ADDR]
+#define nd_opts_pi              nd_opt_array[ND_OPT_PREFIX_INFO]
+#define nd_opts_pi_end          nd_opt_array[__ND_OPT_PREFIX_INFO_END]
+#define nd_opts_rh              nd_opt_array[ND_OPT_REDIRECT_HDR]
+#define nd_opts_mtu             nd_opt_array[ND_OPT_MTU]
+
+#define NDISC_OPT_SPACE(len) (((len)+2+7)&~7)
+
+/*
+ * Return the padding between the option length and the start of the
+ * link addr.  Currently only IP-over-InfiniBand needs this, although
+ * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
+ * also need a pad of 2.
+ */
+static int ndisc_addr_option_pad(unsigned short type)
+{
+        switch (type) {
+        case ARPHRD_INFINIBAND: return 2;
+        default:                return 0;
+        }
+}
+
 static inline int ndisc_opt_addr_space(struct net_device *dev)
 {
         return NDISC_OPT_SPACE(dev->addr_len + ndisc_addr_option_pad(dev->type));
@@ -151,8 +196,8 @@ static inline int ndisc_opt_addr_space(struct net_device *dev)
 static u8 *ndisc_fill_addr_option(u8 *opt, int type, void *data, int data_len,
                                   unsigned short addr_type)
 {
+        int space = NDISC_OPT_SPACE(data_len);
         int pad   = ndisc_addr_option_pad(addr_type);
-        int space = NDISC_OPT_SPACE(data_len + pad);
 
         opt[0] = type;
         opt[1] = space>>3;
@@ -184,8 +229,7 @@ static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
 
 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 {
-        return opt->nd_opt_type == ND_OPT_RDNSS ||
-                opt->nd_opt_type == ND_OPT_DNSSL;
+        return opt->nd_opt_type == ND_OPT_RDNSS;
 }
 
 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
@@ -199,8 +243,8 @@ static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
         return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 }
 
-struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
-                                          struct ndisc_options *ndopts)
+static struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
+                                                 struct ndisc_options *ndopts)
 {
         struct nd_opt_hdr *nd_opt = (struct nd_opt_hdr *)opt;
 
@@ -220,9 +264,10 @@ struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
                 case ND_OPT_MTU:
                 case ND_OPT_REDIRECT_HDR:
                         if (ndopts->nd_opt_array[nd_opt->nd_opt_type]) {
-                                ND_PRINTK(2, warn,
-                                          "%s: duplicated ND6 option found: type=%d\n",
-                                          __func__, nd_opt->nd_opt_type);
+                                ND_PRINTK2(KERN_WARNING
+                                           "%s(): duplicated ND6 option found: type=%d\n",
+                                           __func__,
+                                           nd_opt->nd_opt_type);
                         } else {
                                 ndopts->nd_opt_array[nd_opt->nd_opt_type] = nd_opt;
                         }
@@ -250,11 +295,10 @@ struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
                                  * to accommodate future extension to the
                                  * protocol.
                                  */
-                                ND_PRINTK(2, notice,
-                                          "%s: ignored unsupported option; type=%d, len=%d\n",
-                                          __func__,
-                                          nd_opt->nd_opt_type,
-                                          nd_opt->nd_opt_len);
+                                ND_PRINTK2(KERN_NOTICE
+                                           "%s(): ignored unsupported option; type=%d, len=%d\n",
+                                           __func__,
+                                           nd_opt->nd_opt_type, nd_opt->nd_opt_len);
                         }
                 }
                 opt_len -= l;
@@ -263,6 +307,17 @@ struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
         return ndopts;
 }
 
+static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
+                                      struct net_device *dev)
+{
+        u8 *lladdr = (u8 *)(p + 1);
+        int lladdrlen = p->nd_opt_len << 3;
+        int prepad = ndisc_addr_option_pad(dev->type);
+        if (lladdrlen != NDISC_OPT_SPACE(dev->addr_len + prepad))
+                return NULL;
+        return lladdr + prepad;
+}
+
 int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 {
         switch (dev->type) {
@@ -271,6 +326,9 @@ int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev,
         case ARPHRD_FDDI:
                 ipv6_eth_mc_map(addr, buf);
                 return 0;
+        case ARPHRD_IEEE802_TR:
+                ipv6_tr_mc_map(addr,buf);
+                return 0;
         case ARPHRD_ARCNET:
                 ipv6_arcnet_mc_map(addr, buf);
                 return 0;
@@ -292,9 +350,16 @@ EXPORT_SYMBOL(ndisc_mc_map);
 
 static u32 ndisc_hash(const void *pkey,
                       const struct net_device *dev,
-                      __u32 *hash_rnd)
+                      __u32 hash_rnd)
 {
-        return ndisc_hashfn(pkey, dev, hash_rnd);
+        const u32 *p32 = pkey;
+        u32 addr_hash, i;
+
+        addr_hash = 0;
+        for (i = 0; i < (sizeof(struct in6_addr) / sizeof(u32)); i++)
+                addr_hash ^= *p32++;
+
+        return jhash_2words(addr_hash, dev->ifindex, hash_rnd);
 }
 
 static int ndisc_constructor(struct neighbour *neigh)
@@ -303,16 +368,19 @@ static int ndisc_constructor(struct neighbour *neigh)
         struct net_device *dev = neigh->dev;
         struct inet6_dev *in6_dev;
         struct neigh_parms *parms;
-        bool is_multicast = ipv6_addr_is_multicast(addr);
+        int is_multicast = ipv6_addr_is_multicast(addr);
 
+        rcu_read_lock();
         in6_dev = in6_dev_get(dev);
         if (in6_dev == NULL) {
+                rcu_read_unlock();
                 return -EINVAL;
         }
 
         parms = in6_dev->nd_parms;
         __neigh_parms_put(neigh->parms);
         neigh->parms = neigh_parms_clone(parms);
+        rcu_read_unlock();
 
         neigh->type = is_multicast ? RTN_MULTICAST : RTN_UNICAST;
         if (!dev->header_ops) {
@@ -370,19 +438,17 @@ static void pndisc_destructor(struct pneigh_entry *n)
         ipv6_dev_mc_dec(dev, &maddr);
 }
 
-static struct sk_buff *ndisc_build_skb(struct net_device *dev,
-                                       const struct in6_addr *daddr,
-                                       const struct in6_addr *saddr,
-                                       struct icmp6hdr *icmp6h,
-                                       const struct in6_addr *target,
-                                       int llinfo)
+struct sk_buff *ndisc_build_skb(struct net_device *dev,
+                                const struct in6_addr *daddr,
+                                const struct in6_addr *saddr,
+                                struct icmp6hdr *icmp6h,
+                                const struct in6_addr *target,
+                                int llinfo)
 {
         struct net *net = dev_net(dev);
         struct sock *sk = net->ipv6.ndisc_sk;
         struct sk_buff *skb;
         struct icmp6hdr *hdr;
-        int hlen = LL_RESERVED_SPACE(dev);
-        int tlen = dev->needed_tailroom;
         int len;
         int err;
         u8 *opt;
@@ -396,15 +462,16 @@ static struct sk_buff *ndisc_build_skb(struct net_device *dev,
 
         skb = sock_alloc_send_skb(sk,
                                   (MAX_HEADER + sizeof(struct ipv6hdr) +
-                                   len + hlen + tlen),
+                                   len + LL_ALLOCATED_SPACE(dev)),
                                   1, &err);
         if (!skb) {
-                ND_PRINTK(0, err, "ND: %s failed to allocate an skb, err=%d\n",
-                          __func__, err);
+                ND_PRINTK0(KERN_ERR
+                           "ICMPv6 ND: %s() failed to allocate an skb, err=%d.\n",
+                           __func__, err);
                 return NULL;
         }
 
-        skb_reserve(skb, hlen);
+        skb_reserve(skb, LL_RESERVED_SPACE(dev));
         ip6_nd_hdr(sk, skb, dev, saddr, daddr, IPPROTO_ICMPV6, len);
 
         skb->transport_header = skb->tail;
@@ -415,7 +482,7 @@ static struct sk_buff *ndisc_build_skb(struct net_device *dev,
 
         opt = skb_transport_header(skb) + sizeof(struct icmp6hdr);
         if (target) {
-                *(struct in6_addr *)opt = *target;
+                ipv6_addr_copy((struct in6_addr *)opt, target);
                 opt += sizeof(*target);
         }
 
@@ -431,11 +498,14 @@ static struct sk_buff *ndisc_build_skb(struct net_device *dev,
         return skb;
 }
 
-static void ndisc_send_skb(struct sk_buff *skb, struct net_device *dev,
-                           struct neighbour *neigh,
-                           const struct in6_addr *daddr,
-                           const struct in6_addr *saddr,
-                           struct icmp6hdr *icmp6h)
+EXPORT_SYMBOL(ndisc_build_skb);
+
+void ndisc_send_skb(struct sk_buff *skb,
+                    struct net_device *dev,
+                    struct neighbour *neigh,
+                    const struct in6_addr *daddr,
+                    const struct in6_addr *saddr,
+                    struct icmp6hdr *icmp6h)
 {
         struct flowi6 fl6;
         struct dst_entry *dst;
@@ -448,7 +518,14 @@ static void ndisc_send_skb(struct sk_buff *skb, struct net_device *dev,
         type = icmp6h->icmp6_type;
 
         icmpv6_flow_init(sk, &fl6, type, saddr, daddr, dev->ifindex);
-        dst = icmp6_dst_alloc(dev, neigh, &fl6);
+
+        dst = icmp6_dst_alloc(dev, neigh, daddr);
+        if (!dst) {
+                kfree_skb(skb);
+                return;
+        }
+
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
         if (IS_ERR(dst)) {
                 kfree_skb(skb);
                 return;
@@ -456,8 +533,7 @@ static void ndisc_send_skb(struct sk_buff *skb, struct net_device *dev,
 
         skb_dst_set(skb, dst);
 
-        rcu_read_lock();
-        idev = __in6_dev_get(dst->dev);
+        idev = in6_dev_get(dst->dev);
         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 
         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
@@ -467,9 +543,12 @@ static void ndisc_send_skb(struct sk_buff *skb, struct net_device *dev,
                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
         }
 
-        rcu_read_unlock();
+        if (likely(idev != NULL))
+                in6_dev_put(idev);
 }
 
+EXPORT_SYMBOL(ndisc_send_skb);
+
 /*
  *      Send a Neighbour Discover packet
  */
@@ -530,6 +609,7 @@ static void ndisc_send_unsol_na(struct net_device *dev)
 {
         struct inet6_dev *idev;
         struct inet6_ifaddr *ifa;
+        struct in6_addr mcaddr;
 
         idev = in6_dev_get(dev);
         if (!idev)
@@ -537,7 +617,8 @@ static void ndisc_send_unsol_na(struct net_device *dev)
 
         read_lock_bh(&idev->lock);
         list_for_each_entry(ifa, &idev->addr_list, if_list) {
-                ndisc_send_na(dev, NULL, &in6addr_linklocal_allnodes, &ifa->addr,
+                addrconf_addr_solict_mult(&ifa->addr, &mcaddr);
+                ndisc_send_na(dev, NULL, &mcaddr, &ifa->addr,
                               /*router=*/ !!idev->cnf.forwarding,
                               /*solicited=*/ false, /*override=*/ true,
                               /*inc_opt=*/ true);
@@ -629,9 +710,8 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 
         if ((probes -= neigh->parms->ucast_probes) < 0) {
                 if (!(neigh->nud_state & NUD_VALID)) {
-                        ND_PRINTK(1, dbg,
-                                  "%s: trying to ucast probe in NUD_INVALID: %pI6\n",
-                                  __func__, target);
+                        ND_PRINTK1(KERN_DEBUG "%s(): trying to ucast probe in NUD_INVALID: %pI6\n",
+                                   __func__, target);
                 }
                 ndisc_send_ns(dev, neigh, target, target, saddr);
         } else if ((probes -= neigh->parms->app_probes) < 0) {
@@ -673,11 +753,12 @@ static void ndisc_recv_ns(struct sk_buff *skb)
         struct inet6_dev *idev = NULL;
         struct neighbour *neigh;
         int dad = ipv6_addr_any(saddr);
-        bool inc;
+        int inc;
         int is_router = -1;
 
         if (ipv6_addr_is_multicast(&msg->target)) {
-                ND_PRINTK(2, warn, "NS: multicast target address\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 NS: multicast target address");
                 return;
         }
 
@@ -690,20 +771,22 @@ static void ndisc_recv_ns(struct sk_buff *skb)
               daddr->s6_addr32[1] == htonl(0x00000000) &&
               daddr->s6_addr32[2] == htonl(0x00000001) &&
               daddr->s6_addr [12] == 0xff )) {
-                ND_PRINTK(2, warn, "NS: bad DAD packet (wrong destination)\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 NS: bad DAD packet (wrong destination)\n");
                 return;
         }
 
         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
-                ND_PRINTK(2, warn, "NS: invalid ND options\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 NS: invalid ND options\n");
                 return;
         }
 
         if (ndopts.nd_opts_src_lladdr) {
                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr, dev);
                 if (!lladdr) {
-                        ND_PRINTK(2, warn,
-                                  "NS: invalid link-layer address length\n");
+                        ND_PRINTK2(KERN_WARNING
+                                   "ICMPv6 NS: invalid link-layer address length\n");
                         return;
                 }
 
@@ -713,8 +796,8 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                  *      in the message.
                  */
                 if (dad) {
-                        ND_PRINTK(2, warn,
-                                  "NS: bad DAD packet (link-layer address option)\n");
+                        ND_PRINTK2(KERN_WARNING
+                                   "ICMPv6 NS: bad DAD packet (link-layer address option)\n");
                         return;
                 }
         }
@@ -726,6 +809,20 @@ static void ndisc_recv_ns(struct sk_buff *skb)
 
                 if (ifp->flags & (IFA_F_TENTATIVE|IFA_F_OPTIMISTIC)) {
                         if (dad) {
+                                if (dev->type == ARPHRD_IEEE802_TR) {
+                                        const unsigned char *sadr;
+                                        sadr = skb_mac_header(skb);
+                                        if (((sadr[8] ^ dev->dev_addr[0]) & 0x7f) == 0 &&
+                                            sadr[9] == dev->dev_addr[1] &&
+                                            sadr[10] == dev->dev_addr[2] &&
+                                            sadr[11] == dev->dev_addr[3] &&
+                                            sadr[12] == dev->dev_addr[4] &&
+                                            sadr[13] == dev->dev_addr[5]) {
+                                                /* looped-back to us */
+                                                goto out;
+                                        }
+                                }
+
                                 /*
                                  * We are colliding with another node
                                  * who is doing DAD
@@ -832,30 +929,34 @@ static void ndisc_recv_na(struct sk_buff *skb)
         struct neighbour *neigh;
 
         if (skb->len < sizeof(struct nd_msg)) {
-                ND_PRINTK(2, warn, "NA: packet too short\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 NA: packet too short\n");
                 return;
         }
 
         if (ipv6_addr_is_multicast(&msg->target)) {
-                ND_PRINTK(2, warn, "NA: target address is multicast\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 NA: target address is multicast.\n");
                 return;
         }
 
         if (ipv6_addr_is_multicast(daddr) &&
             msg->icmph.icmp6_solicited) {
-                ND_PRINTK(2, warn, "NA: solicited NA is multicasted\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 NA: solicited NA is multicasted.\n");
                 return;
         }
 
         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
-                ND_PRINTK(2, warn, "NS: invalid ND option\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 NS: invalid ND option\n");
                 return;
         }
         if (ndopts.nd_opts_tgt_lladdr) {
                 lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr, dev);
                 if (!lladdr) {
-                        ND_PRINTK(2, warn,
-                                  "NA: invalid link-layer address length\n");
+                        ND_PRINTK2(KERN_WARNING
+                                   "ICMPv6 NA: invalid link-layer address length\n");
                         return;
                 }
         }
@@ -876,9 +977,9 @@ static void ndisc_recv_na(struct sk_buff *skb)
                    unsolicited advertisement.
                  */
                 if (skb->pkt_type != PACKET_LOOPBACK)
-                        ND_PRINTK(1, warn,
-                                  "NA: someone advertises our address %pI6 on %s!\n",
-                                  &ifp->addr, ifp->idev->dev->name);
+                        ND_PRINTK1(KERN_WARNING
+                           "ICMPv6 NA: someone advertises our address %pI6 on %s!\n",
+                           &ifp->addr, ifp->idev->dev->name);
                 in6_ifa_put(ifp);
                 return;
         }
@@ -899,7 +1000,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
                     net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
                     pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
-                        /* XXX: idev->cnf.proxy_ndp */
+                        /* XXX: idev->cnf.prixy_ndp */
                         goto out;
                 }
 
@@ -938,9 +1039,10 @@ static void ndisc_recv_rs(struct sk_buff *skb)
         if (skb->len < sizeof(*rs_msg))
                 return;
 
-        idev = __in6_dev_get(skb->dev);
+        idev = in6_dev_get(skb->dev);
         if (!idev) {
-                ND_PRINTK(1, err, "RS: can't find in6 device\n");
+                if (net_ratelimit())
+                        ND_PRINTK1("ICMP6 RS: can't find in6 device\n");
                 return;
         }
 
@@ -957,7 +1059,8 @@ static void ndisc_recv_rs(struct sk_buff *skb)
 
         /* Parse ND options */
         if (!ndisc_parse_options(rs_msg->opt, ndoptlen, &ndopts)) {
-                ND_PRINTK(2, notice, "NS: invalid ND option, ignored\n");
+                if (net_ratelimit())
+                        ND_PRINTK2("ICMP6 NS: invalid ND option, ignored\n");
                 goto out;
         }
 
@@ -977,7 +1080,7 @@ static void ndisc_recv_rs(struct sk_buff *skb)
                 neigh_release(neigh);
         }
 out:
-        return;
+        in6_dev_put(idev);
 }
 
 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
@@ -1012,9 +1115,8 @@ static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
 
         memcpy(ndmsg + 1, opt, opt->nd_opt_len << 3);
 
-        if (nla_put(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
-                    &ipv6_hdr(ra)->saddr))
-                goto nla_put_failure;
+        NLA_PUT(skb, NDUSEROPT_SRCADDR, sizeof(struct in6_addr),
+                &ipv6_hdr(ra)->saddr);
         nlmsg_end(skb, nlh);
 
         rtnl_notify(skb, net, 0, RTNLGRP_ND_USEROPT, NULL, GFP_ATOMIC);
@@ -1027,6 +1129,18 @@ errout:
         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
 }
 
+static inline int accept_ra(struct inet6_dev *in6_dev)
+{
+        /*
+         * If forwarding is enabled, RA are not accepted unless the special
+         * hybrid mode (accept_ra=2) is enabled.
+         */
+        if (in6_dev->cnf.forwarding && in6_dev->cnf.accept_ra < 2)
+                return 0;
+
+        return in6_dev->cnf.accept_ra;
+}
+
 static void ndisc_router_discovery(struct sk_buff *skb)
 {
         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
@@ -1043,17 +1157,20 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
 
         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
-                ND_PRINTK(2, warn, "RA: source address is not link-local\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 RA: source address is not link-local.\n");
                 return;
         }
         if (optlen < 0) {
-                ND_PRINTK(2, warn, "RA: packet too short\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 RA: packet too short\n");
                 return;
         }
 
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
         if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
-                ND_PRINTK(2, warn, "RA: from host or unauthorized router\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 RA: from host or unauthorized router\n");
                 return;
         }
 #endif
@@ -1062,19 +1179,22 @@ static void ndisc_router_discovery(struct sk_buff *skb)
          *      set the RA_RECV flag in the interface
          */
 
-        in6_dev = __in6_dev_get(skb->dev);
+        in6_dev = in6_dev_get(skb->dev);
         if (in6_dev == NULL) {
-                ND_PRINTK(0, err, "RA: can't find inet6 device for %s\n",
-                          skb->dev->name);
+                ND_PRINTK0(KERN_ERR
+                           "ICMPv6 RA: can't find inet6 device for %s.\n",
+                           skb->dev->name);
                 return;
         }
 
         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
-                ND_PRINTK(2, warn, "RA: invalid ND options\n");
+                in6_dev_put(in6_dev);
+                ND_PRINTK2(KERN_WARNING
+                           "ICMP6 RA: invalid ND options\n");
                 return;
         }
 
-        if (!ipv6_accept_ra(in6_dev))
+        if (!accept_ra(in6_dev))
                 goto skip_linkparms;
 
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
@@ -1105,9 +1225,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         if (!in6_dev->cnf.accept_ra_defrtr)
                 goto skip_defrtr;
 
-        if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
-                goto skip_defrtr;
-
         lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
 
 #ifdef CONFIG_IPV6_ROUTER_PREF
@@ -1120,38 +1237,35 @@ static void ndisc_router_discovery(struct sk_buff *skb)
 
         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
 
-        if (rt) {
-                neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
-                if (!neigh) {
-                        ND_PRINTK(0, err,
-                                  "RA: %s got default router without neighbour\n",
-                                  __func__);
-                        ip6_rt_put(rt);
-                        return;
-                }
-        }
+        if (rt)
+                neigh = dst_get_neighbour(&rt->dst);
+
         if (rt && lifetime == 0) {
+                neigh_clone(neigh);
                 ip6_del_rt(rt);
                 rt = NULL;
         }
 
         if (rt == NULL && lifetime) {
-                ND_PRINTK(3, dbg, "RA: adding default router\n");
+                ND_PRINTK3(KERN_DEBUG
+                           "ICMPv6 RA: adding default router.\n");
 
                 rt = rt6_add_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev, pref);
                 if (rt == NULL) {
-                        ND_PRINTK(0, err,
-                                  "RA: %s failed to add default route\n",
-                                  __func__);
+                        ND_PRINTK0(KERN_ERR
+                                   "ICMPv6 RA: %s() failed to add default route.\n",
+                                   __func__);
+                        in6_dev_put(in6_dev);
                         return;
                 }
 
-                neigh = dst_neigh_lookup(&rt->dst, &ipv6_hdr(skb)->saddr);
+                neigh = dst_get_neighbour(&rt->dst);
                 if (neigh == NULL) {
-                        ND_PRINTK(0, err,
-                                  "RA: %s got default router without neighbour\n",
-                                  __func__);
-                        ip6_rt_put(rt);
+                        ND_PRINTK0(KERN_ERR
+                                   "ICMPv6 RA: %s() got default router without neighbour.\n",
+                                   __func__);
+                        dst_release(&rt->dst);
+                        in6_dev_put(in6_dev);
                         return;
                 }
                 neigh->flags |= NTF_ROUTER;
@@ -1160,7 +1274,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         }
 
         if (rt)
-                rt6_set_expires(rt, jiffies + (HZ * lifetime));
+                rt->rt6i_expires = jiffies + (HZ * lifetime);
+
         if (ra_msg->icmph.icmp6_hop_limit) {
                 in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
                 if (rt)
@@ -1218,8 +1333,8 @@ skip_linkparms:
                         lladdr = ndisc_opt_addr_data(ndopts.nd_opts_src_lladdr,
                                                      skb->dev);
                         if (!lladdr) {
-                                ND_PRINTK(2, warn,
-                                          "RA: invalid link-layer address length\n");
+                                ND_PRINTK2(KERN_WARNING
+                                           "ICMPv6 RA: invalid link-layer address length\n");
                                 goto out;
                         }
                 }
@@ -1230,13 +1345,10 @@ skip_linkparms:
                              NEIGH_UPDATE_F_ISROUTER);
         }
 
-        if (!ipv6_accept_ra(in6_dev))
+        if (!accept_ra(in6_dev))
                 goto out;
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
-        if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr, NULL, 0))
-                goto skip_routeinfo;
-
         if (in6_dev->cnf.accept_ra_rtr_pref && ndopts.nd_opts_ri) {
                 struct nd_opt_hdr *p;
                 for (p = ndopts.nd_opts_ri;
@@ -1254,8 +1366,6 @@ skip_linkparms:
                                       &ipv6_hdr(skb)->saddr);
                 }
         }
-
-skip_routeinfo:
 #endif
 
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
@@ -1269,9 +1379,7 @@ skip_routeinfo:
                 for (p = ndopts.nd_opts_pi;
                      p;
                      p = ndisc_next_option(p, ndopts.nd_opts_pi_end)) {
-                        addrconf_prefix_rcv(skb->dev, (u8 *)p,
-                                            (p->nd_opt_len) << 3,
-                                            ndopts.nd_opts_src_lladdr != NULL);
+                        addrconf_prefix_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3);
                 }
         }
 
@@ -1283,7 +1391,9 @@ skip_routeinfo:
                 mtu = ntohl(n);
 
                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
-                        ND_PRINTK(2, warn, "RA: invalid mtu: %d\n", mtu);
+                        ND_PRINTK2(KERN_WARNING
+                                   "ICMPv6 RA: invalid mtu: %d\n",
+                                   mtu);
                 } else if (in6_dev->cnf.mtu6 != mtu) {
                         in6_dev->cnf.mtu6 = mtu;
 
@@ -1304,59 +1414,120 @@ skip_routeinfo:
         }
 
         if (ndopts.nd_opts_tgt_lladdr || ndopts.nd_opts_rh) {
-                ND_PRINTK(2, warn, "RA: invalid RA options\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 RA: invalid RA options");
         }
 out:
-        ip6_rt_put(rt);
-        if (neigh)
+        if (rt)
+                dst_release(&rt->dst);
+        else if (neigh)
                 neigh_release(neigh);
+        in6_dev_put(in6_dev);
 }
 
 static void ndisc_redirect_rcv(struct sk_buff *skb)
 {
-        u8 *hdr;
+        struct inet6_dev *in6_dev;
+        struct icmp6hdr *icmph;
+        const struct in6_addr *dest;
+        const struct in6_addr *target;  /* new first hop to destination */
+        struct neighbour *neigh;
+        int on_link = 0;
         struct ndisc_options ndopts;
-        struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
-        u32 ndoptlen = skb->tail - (skb->transport_header +
-                                    offsetof(struct rd_msg, opt));
+        int optlen;
+        u8 *lladdr = NULL;
 
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
         switch (skb->ndisc_nodetype) {
         case NDISC_NODETYPE_HOST:
         case NDISC_NODETYPE_NODEFAULT:
-                ND_PRINTK(2, warn,
-                          "Redirect: from host or unauthorized router\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 Redirect: from host or unauthorized router\n");
                 return;
         }
 #endif
 
         if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
-                ND_PRINTK(2, warn,
-                          "Redirect: source address is not link-local\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 Redirect: source address is not link-local.\n");
+                return;
+        }
+
+        optlen = skb->tail - skb->transport_header;
+        optlen -= sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
+
+        if (optlen < 0) {
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 Redirect: packet too short\n");
                 return;
         }
 
-        if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
+        icmph = icmp6_hdr(skb);
+        target = (const struct in6_addr *) (icmph + 1);
+        dest = target + 1;
+
+        if (ipv6_addr_is_multicast(dest)) {
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 Redirect: destination address is multicast.\n");
                 return;
+        }
 
-        if (!ndopts.nd_opts_rh)
+        if (ipv6_addr_equal(dest, target)) {
+                on_link = 1;
+        } else if (ipv6_addr_type(target) !=
+                   (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 Redirect: target address is not link-local unicast.\n");
                 return;
+        }
 
-        hdr = (u8 *)ndopts.nd_opts_rh;
-        hdr += 8;
-        if (!pskb_pull(skb, hdr - skb_transport_header(skb)))
+        in6_dev = in6_dev_get(skb->dev);
+        if (!in6_dev)
                 return;
+        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_redirects) {
+                in6_dev_put(in6_dev);
+                return;
+        }
 
-        icmpv6_notify(skb, NDISC_REDIRECT, 0, 0);
+        /* RFC2461 8.1:
+         *      The IP source address of the Redirect MUST be the same as the current
+         *      first-hop router for the specified ICMP Destination Address.
+         */
+
+        if (!ndisc_parse_options((u8*)(dest + 1), optlen, &ndopts)) {
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 Redirect: invalid ND options\n");
+                in6_dev_put(in6_dev);
+                return;
+        }
+        if (ndopts.nd_opts_tgt_lladdr) {
+                lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr,
+                                             skb->dev);
+                if (!lladdr) {
+                        ND_PRINTK2(KERN_WARNING
+                                   "ICMPv6 Redirect: invalid link-layer address length\n");
+                        in6_dev_put(in6_dev);
+                        return;
+                }
+        }
+
+        neigh = __neigh_lookup(&nd_tbl, target, skb->dev, 1);
+        if (neigh) {
+                rt6_redirect(dest, &ipv6_hdr(skb)->daddr,
+                             &ipv6_hdr(skb)->saddr, neigh, lladdr,
+                             on_link);
+                neigh_release(neigh);
+        }
+        in6_dev_put(in6_dev);
 }
 
-void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
+void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
+                         const struct in6_addr *target)
 {
         struct net_device *dev = skb->dev;
         struct net *net = dev_net(dev);
         struct sock *sk = net->ipv6.ndisc_sk;
         int len = sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
-        struct inet_peer *peer;
         struct sk_buff *buff;
         struct icmp6hdr *icmph;
         struct in6_addr saddr_buf;
@@ -1366,22 +1537,21 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
         struct inet6_dev *idev;
         struct flowi6 fl6;
         u8 *opt;
-        int hlen, tlen;
         int rd_len;
         int err;
         u8 ha_buf[MAX_ADDR_LEN], *ha = NULL;
-        bool ret;
 
         if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
-                ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
-                          dev->name);
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 Redirect: no link-local address on %s\n",
+                           dev->name);
                 return;
         }
 
         if (!ipv6_addr_equal(&ipv6_hdr(skb)->daddr, target) &&
             ipv6_addr_type(target) != (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
-                ND_PRINTK(2, warn,
-                          "Redirect: target address is not link-local unicast\n");
+                ND_PRINTK2(KERN_WARNING
+                        "ICMPv6 Redirect: target address is not link-local unicast.\n");
                 return;
         }
 
@@ -1389,10 +1559,9 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
 
         dst = ip6_route_output(net, NULL, &fl6);
-        if (dst->error) {
-                dst_release(dst);
+        if (dst == NULL)
                 return;
-        }
+
         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
         if (IS_ERR(dst))
                 return;
@@ -1400,25 +1569,16 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
         rt = (struct rt6_info *) dst;
 
         if (rt->rt6i_flags & RTF_GATEWAY) {
-                ND_PRINTK(2, warn,
-                          "Redirect: destination is not a neighbour\n");
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 Redirect: destination is not a neighbour.\n");
                 goto release;
         }
-        peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
-        ret = inet_peer_xrlim_allow(peer, 1*HZ);
-        if (peer)
-                inet_putpeer(peer);
-        if (!ret)
+        if (!rt->rt6i_peer)
+                rt6_bind_peer(rt, 1);
+        if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
                 goto release;
 
         if (dev->addr_len) {
-                struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
-                if (!neigh) {
-                        ND_PRINTK(2, warn,
-                                  "Redirect: no neigh for target address\n");
-                        goto release;
-                }
-
                 read_lock_bh(&neigh->lock);
                 if (neigh->nud_state & NUD_VALID) {
                         memcpy(ha_buf, neigh->ha, dev->addr_len);
@@ -1427,8 +1587,6 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
                         len += ndisc_opt_addr_space(dev);
                 } else
                         read_unlock_bh(&neigh->lock);
-
-                neigh_release(neigh);
         }
 
         rd_len = min_t(unsigned int,
@@ -1436,20 +1594,18 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
         rd_len &= ~0x7;
         len += rd_len;
 
-        hlen = LL_RESERVED_SPACE(dev);
-        tlen = dev->needed_tailroom;
         buff = sock_alloc_send_skb(sk,
                                    (MAX_HEADER + sizeof(struct ipv6hdr) +
-                                    len + hlen + tlen),
+                                    len + LL_ALLOCATED_SPACE(dev)),
                                    1, &err);
         if (buff == NULL) {
-                ND_PRINTK(0, err,
-                          "Redirect: %s failed to allocate an skb, err=%d\n",
-                          __func__, err);
+                ND_PRINTK0(KERN_ERR
+                           "ICMPv6 Redirect: %s() failed to allocate an skb, err=%d.\n",
+                           __func__, err);
                 goto release;
         }
 
-        skb_reserve(buff, hlen);
+        skb_reserve(buff, LL_RESERVED_SPACE(dev));
         ip6_nd_hdr(sk, buff, dev, &saddr_buf, &ipv6_hdr(skb)->saddr,
                    IPPROTO_ICMPV6, len);
 
@@ -1465,9 +1621,9 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
          */
 
         addrp = (struct in6_addr *)(icmph + 1);
-        *addrp = *target;
+        ipv6_addr_copy(addrp, target);
         addrp++;
-        *addrp = ipv6_hdr(skb)->daddr;
+        ipv6_addr_copy(addrp, &ipv6_hdr(skb)->daddr);
 
         opt = (u8*) (addrp + 1);
 
@@ -1495,8 +1651,7 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
                                              csum_partial(icmph, len, 0));
 
         skb_dst_set(buff, dst);
-        rcu_read_lock();
-        idev = __in6_dev_get(dst->dev);
+        idev = in6_dev_get(dst->dev);
         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, buff, NULL, dst->dev,
                       dst_output);
@@ -1505,7 +1660,8 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
         }
 
-        rcu_read_unlock();
+        if (likely(idev != NULL))
+                in6_dev_put(idev);
         return;
 
 release:
@@ -1530,14 +1686,16 @@ int ndisc_rcv(struct sk_buff *skb)
         __skb_push(skb, skb->data - skb_transport_header(skb));
 
         if (ipv6_hdr(skb)->hop_limit != 255) {
-                ND_PRINTK(2, warn, "NDISC: invalid hop-limit: %d\n",
-                          ipv6_hdr(skb)->hop_limit);
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 NDISC: invalid hop-limit: %d\n",
+                           ipv6_hdr(skb)->hop_limit);
                 return 0;
         }
 
         if (msg->icmph.icmp6_code != 0) {
-                ND_PRINTK(2, warn, "NDISC: invalid ICMPv6 code: %d\n",
-                          msg->icmph.icmp6_code);
+                ND_PRINTK2(KERN_WARNING
+                           "ICMPv6 NDISC: invalid ICMPv6 code: %d\n",
+                           msg->icmph.icmp6_code);
                 return 0;
         }
 
@@ -1572,18 +1730,11 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
 {
         struct net_device *dev = ptr;
         struct net *net = dev_net(dev);
-        struct inet6_dev *idev;
 
         switch (event) {
         case NETDEV_CHANGEADDR:
                 neigh_changeaddr(&nd_tbl, dev);
                 fib6_run_gc(~0UL, net);
-                idev = in6_dev_get(dev);
-                if (!idev)
-                        break;
-                if (idev->cnf.ndisc_notify)
-                        ndisc_send_unsol_na(dev);
-                in6_dev_put(idev);
                 break;
         case NETDEV_DOWN:
                 neigh_ifdown(&nd_tbl, dev);
@@ -1611,7 +1762,11 @@ static void ndisc_warn_deprecated_sysctl(struct ctl_table *ctl,
         static int warned;
         if (strcmp(warncomm, current->comm) && warned < 5) {
                 strcpy(warncomm, current->comm);
-                pr_warn("process `%s' is using deprecated sysctl (%s) net.ipv6.neigh.%s.%s - use net.ipv6.neigh.%s.%s_ms instead\n",
+                printk(KERN_WARNING
+                        "process `%s' is using deprecated sysctl (%s) "
+                        "net.ipv6.neigh.%s.%s; "
+                        "Use net.ipv6.neigh.%s.%s_ms "
+                        "instead.\n",
                         warncomm, func,
                         dev_name, ctl->procname,
                         dev_name, ctl->procname);
@@ -1665,9 +1820,9 @@ static int __net_init ndisc_net_init(struct net *net)
         err = inet_ctl_sock_create(&sk, PF_INET6,
                                    SOCK_RAW, IPPROTO_ICMPV6, net);
         if (err < 0) {
-                ND_PRINTK(0, err,
-                          "NDISC: Failed to initialize the control socket (err %d)\n",
-                          err);
+                ND_PRINTK0(KERN_ERR
+                           "ICMPv6 NDISC: Failed to initialize the control socket (err %d).\n",
+                           err);
                 return err;
         }
 
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 429089cb073..30fcee46544 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -3,7 +3,6 @@
 #include <linux/ipv6.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
-#include <linux/export.h>
 #include <net/dst.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
@@ -15,7 +14,6 @@ int ip6_route_me_harder(struct sk_buff *skb)
 {
         struct net *net = dev_net(skb_dst(skb)->dev);
         const struct ipv6hdr *iph = ipv6_hdr(skb);
-        unsigned int hh_len;
         struct dst_entry *dst;
         struct flowi6 fl6 = {
                 .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
@@ -48,13 +46,6 @@ int ip6_route_me_harder(struct sk_buff *skb)
         }
 #endif
 
-        /* Change in oif may mean change in hh_len. */
-        hh_len = skb_dst(skb)->dev->hard_header_len;
-        if (skb_headroom(skb) < hh_len &&
-            pskb_expand_head(skb, HH_DATA_ALIGN(hh_len - skb_headroom(skb)),
-                             0, GFP_ATOMIC))
-                return -1;
-
         return 0;
 }
 EXPORT_SYMBOL(ip6_route_me_harder);
@@ -109,16 +100,9 @@ static int nf_ip6_route(struct net *net, struct dst_entry **dst,
                 .pinet6 = (struct ipv6_pinfo *) &fake_pinfo,
         };
         const void *sk = strict ? &fake_sk : NULL;
-        struct dst_entry *result;
-        int err;
-
-        result = ip6_route_output(net, sk, &fl->u.ip6);
-        err = result->error;
-        if (err)
-                dst_release(result);
-        else
-                *dst = result;
-        return err;
+
+        *dst = ip6_route_output(net, sk, &fl->u.ip6);
+        return (*dst)->error;
 }
 
 __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index c72532a60d8..5bbf5316920 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -25,6 +25,28 @@ config NF_CONNTRACK_IPV6
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP6_NF_QUEUE
+        tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
+        depends on INET && IPV6 && NETFILTER
+        depends on NETFILTER_ADVANCED
+        ---help---
+
+          This option adds a queue handler to the kernel for IPv6
+          packets which enables users to receive the filtered packets
+          with QUEUE target using libipq.
+
+          This option enables the old IPv6-only "ip6_queue" implementation
+          which has been obsoleted by the new "nfnetlink_queue" code (see
+          CONFIG_NETFILTER_NETLINK_QUEUE).
+
+          (C) Fernando Anton 2001
+          IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.
+          Universidad Carlos III de Madrid
+          Universidad Politecnica de Alcala de Henares
+          email: <fanton@it.uc3m.es>.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config IP6_NF_IPTABLES
         tristate "IP6 tables support (required for filtering)"
         depends on INET && IPV6
@@ -103,16 +125,6 @@ config IP6_NF_MATCH_MH
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_MATCH_RPFILTER
-        tristate '"rpfilter" reverse path filter match support'
-        depends on NETFILTER_ADVANCED
-        ---help---
-          This option allows you to match packets whose replies would
-          go out via the interface the packet came in.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-          The module will be called ip6t_rpfilter.
-
 config IP6_NF_MATCH_RT
         tristate '"rt" Routing header match support'
         depends on NETFILTER_ADVANCED
@@ -132,6 +144,15 @@ config IP6_NF_TARGET_HL
         (e.g. when running oldconfig). It selects
         CONFIG_NETFILTER_XT_TARGET_HL.
 
+config IP6_NF_TARGET_LOG
+        tristate "LOG target support"
+        default m if NETFILTER_ADVANCED=n
+        help
+          This option adds a `LOG' target, which allows you to create rules in
+          any iptables table which records the packet header to the syslog.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config IP6_NF_FILTER
         tristate "Packet filtering"
         default m if NETFILTER_ADVANCED=n
@@ -153,6 +174,18 @@ config IP6_NF_TARGET_REJECT
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP6_NF_TARGET_REJECT_SKERR
+        bool "Force socket error when rejecting with icmp*"
+        depends on IP6_NF_TARGET_REJECT
+        default n
+        help
+          This option enables turning a "--reject-with icmp*" into a matching
+          socket error also.
+          The REJECT target normally allows sending an ICMP message. But it
+          leaves the local socket unaware of any ingress rejects.
+
+          If unsure, say N.
+
 config IP6_NF_MANGLE
         tristate "Packet mangling"
         default m if NETFILTER_ADVANCED=n
@@ -165,6 +198,7 @@ config IP6_NF_MANGLE
 
 config IP6_NF_RAW
         tristate  'raw table support (required for TRACE)'
+        depends on NETFILTER_ADVANCED
         help
           This option adds a `raw' table to ip6tables. This table is the very
           first in the netfilter framework and hooks in at the PREROUTING
@@ -181,44 +215,9 @@ config IP6_NF_SECURITY
        help
          This option adds a `security' table to iptables, for use
          with Mandatory Access Control (MAC) policy.
-
+        
          If unsure, say N.
 
-config NF_NAT_IPV6
-        tristate "IPv6 NAT"
-        depends on NF_CONNTRACK_IPV6
-        depends on NETFILTER_ADVANCED
-        select NF_NAT
-        help
-          The IPv6 NAT option allows masquerading, port forwarding and other
-          forms of full Network Address Port Translation. It is controlled by
-          the `nat' table in ip6tables, see the man page for ip6tables(8).
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
-if NF_NAT_IPV6
-
-config IP6_NF_TARGET_MASQUERADE
-        tristate "MASQUERADE target support"
-        help
-          Masquerading is a special case of NAT: all outgoing connections are
-          changed to seem to come from a particular interface's address, and
-          if the interface goes down, those connections are lost.  This is
-          only useful for dialup accounts with dynamic IP address (ie. your IP
-          address will be different on next dialup).
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
-config IP6_NF_TARGET_NPT
-        tristate "NPT (Network Prefix translation) target support"
-        help
-          This option adds the `SNPT' and `DNPT' target, which perform
-          stateless IPv6-to-IPv6 Network Prefix Translation per RFC 6296.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
-endif # NF_NAT_IPV6
-
 endif # IP6_NF_IPTABLES
 
 endmenu
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index 2d11fcc2cf3..abfee91ce81 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -6,9 +6,9 @@
 obj-$(CONFIG_IP6_NF_IPTABLES) += ip6_tables.o
 obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
+obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
 obj-$(CONFIG_IP6_NF_SECURITY) += ip6table_security.o
-obj-$(CONFIG_NF_NAT_IPV6) += ip6table_nat.o
 
 # objects for l3 independent conntrack
 nf_conntrack_ipv6-y  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o
@@ -16,9 +16,6 @@ nf_conntrack_ipv6-y  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o
 # l3 independent conntrack
 obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o nf_defrag_ipv6.o
 
-nf_nat_ipv6-y           := nf_nat_l3proto_ipv6.o nf_nat_proto_icmpv6.o
-obj-$(CONFIG_NF_NAT_IPV6) += nf_nat_ipv6.o
-
 # defrag
 nf_defrag_ipv6-y := nf_defrag_ipv6_hooks.o nf_conntrack_reasm.o
 obj-$(CONFIG_NF_DEFRAG_IPV6) += nf_defrag_ipv6.o
@@ -30,10 +27,8 @@ obj-$(CONFIG_IP6_NF_MATCH_FRAG) += ip6t_frag.o
 obj-$(CONFIG_IP6_NF_MATCH_IPV6HEADER) += ip6t_ipv6header.o
 obj-$(CONFIG_IP6_NF_MATCH_MH) += ip6t_mh.o
 obj-$(CONFIG_IP6_NF_MATCH_OPTS) += ip6t_hbh.o
-obj-$(CONFIG_IP6_NF_MATCH_RPFILTER) += ip6t_rpfilter.o
 obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o
 
 # targets
-obj-$(CONFIG_IP6_NF_TARGET_MASQUERADE) += ip6t_MASQUERADE.o
-obj-$(CONFIG_IP6_NF_TARGET_NPT) += ip6t_NPT.o
+obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
 obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 125a90d6a79..14cb310064f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -78,6 +78,19 @@ EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
 
    Hence the start of any table is given by get_table() below.  */
 
+/* Check for an extension */
+int
+ip6t_ext_hdr(u8 nexthdr)
+{
+        return  (nexthdr == IPPROTO_HOPOPTS)   ||
+                (nexthdr == IPPROTO_ROUTING)   ||
+                (nexthdr == IPPROTO_FRAGMENT)  ||
+                (nexthdr == IPPROTO_ESP)       ||
+                (nexthdr == IPPROTO_AH)        ||
+                (nexthdr == IPPROTO_NONE)      ||
+                (nexthdr == IPPROTO_DSTOPTS);
+}
+
 /* Returns whether matches rule or not. */
 /* Performance critical - called for every packet */
 static inline bool
@@ -133,7 +146,7 @@ ip6_packet_match(const struct sk_buff *skb,
                 int protohdr;
                 unsigned short _frag_off;
 
-                protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off, NULL);
+                protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
                 if (protohdr < 0) {
                         if (_frag_off == 0)
                                 *hotdrop = true;
@@ -181,7 +194,8 @@ ip6_checkentry(const struct ip6t_ip6 *ipv6)
 static unsigned int
 ip6t_error(struct sk_buff *skb, const struct xt_action_param *par)
 {
-        net_info_ratelimited("error: `%s'\n", (const char *)par->targinfo);
+        if (net_ratelimit())
+                pr_info("error: `%s'\n", (const char *)par->targinfo);
 
         return NF_DROP;
 }
@@ -207,7 +221,8 @@ ip6t_get_target_c(const struct ip6t_entry *e)
         return ip6t_get_target((struct ip6t_entry *)e);
 }
 
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
+#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
+    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 /* This cries for unification! */
 static const char *const hooknames[] = {
         [NF_INET_PRE_ROUTING]           = "PREROUTING",
@@ -360,7 +375,6 @@ ip6t_do_table(struct sk_buff *skb,
                 const struct xt_entry_match *ematch;
 
                 IP_NF_ASSERT(e);
-                acpar.thoff = 0;
                 if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
                     &acpar.thoff, &acpar.fragoff, &acpar.hotdrop)) {
  no_match:
@@ -380,7 +394,8 @@ ip6t_do_table(struct sk_buff *skb,
                 t = ip6t_get_target_c(e);
                 IP_NF_ASSERT(t->u.kernel.target);
 
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
+#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
+    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
                 /* The packet is traced: log it */
                 if (unlikely(skb->nf_trace))
                         trace_packet(skb, hook, in, out,
@@ -394,7 +409,7 @@ ip6t_do_table(struct sk_buff *skb,
                         if (v < 0) {
                                 /* Pop from stack? */
                                 if (v != XT_RETURN) {
-                                        verdict = (unsigned int)(-v) - 1;
+                                        verdict = (unsigned)(-v) - 1;
                                         break;
                                 }
                                 if (*stackptr <= origptr)
@@ -1854,7 +1869,7 @@ compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
 {
         int ret;
 
-        if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         switch (cmd) {
@@ -1969,7 +1984,7 @@ compat_do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
         int ret;
 
-        if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         switch (cmd) {
@@ -1991,7 +2006,7 @@ do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
 {
         int ret;
 
-        if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         switch (cmd) {
@@ -2016,7 +2031,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
         int ret;
 
-        if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
+        if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
         switch (cmd) {
@@ -2271,9 +2286,90 @@ static void __exit ip6_tables_fini(void)
         unregister_pernet_subsys(&ip6_tables_net_ops);
 }
 
+/*
+ * find the offset to specified header or the protocol number of last header
+ * if target < 0. "last header" is transport protocol header, ESP, or
+ * "No next header".
+ *
+ * If target header is found, its offset is set in *offset and return protocol
+ * number. Otherwise, return -ENOENT or -EBADMSG.
+ *
+ * If the first fragment doesn't contain the final protocol header or
+ * NEXTHDR_NONE it is considered invalid.
+ *
+ * Note that non-1st fragment is special case that "the protocol number
+ * of last header" is "next header" field in Fragment header. In this case,
+ * *offset is meaningless. If fragoff is not NULL, the fragment offset is
+ * stored in *fragoff; if it is NULL, return -EINVAL.
+ */
+int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
+                  int target, unsigned short *fragoff)
+{
+        unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
+        u8 nexthdr = ipv6_hdr(skb)->nexthdr;
+        unsigned int len = skb->len - start;
+
+        if (fragoff)
+                *fragoff = 0;
+
+        while (nexthdr != target) {
+                struct ipv6_opt_hdr _hdr, *hp;
+                unsigned int hdrlen;
+
+                if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
+                        if (target < 0)
+                                break;
+                        return -ENOENT;
+                }
+
+                hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
+                if (hp == NULL)
+                        return -EBADMSG;
+                if (nexthdr == NEXTHDR_FRAGMENT) {
+                        unsigned short _frag_off;
+                        __be16 *fp;
+                        fp = skb_header_pointer(skb,
+                                                start+offsetof(struct frag_hdr,
+                                                               frag_off),
+                                                sizeof(_frag_off),
+                                                &_frag_off);
+                        if (fp == NULL)
+                                return -EBADMSG;
+
+                        _frag_off = ntohs(*fp) & ~0x7;
+                        if (_frag_off) {
+                                if (target < 0 &&
+                                    ((!ipv6_ext_hdr(hp->nexthdr)) ||
+                                     hp->nexthdr == NEXTHDR_NONE)) {
+                                        if (fragoff) {
+                                                *fragoff = _frag_off;
+                                                return hp->nexthdr;
+                                        } else {
+                                                return -EINVAL;
+                                        }
+                                }
+                                return -ENOENT;
+                        }
+                        hdrlen = 8;
+                } else if (nexthdr == NEXTHDR_AUTH)
+                        hdrlen = (hp->hdrlen + 2) << 2;
+                else
+                        hdrlen = ipv6_optlen(hp);
+
+                nexthdr = hp->nexthdr;
+                len -= hdrlen;
+                start += hdrlen;
+        }
+
+        *offset = start;
+        return nexthdr;
+}
+
 EXPORT_SYMBOL(ip6t_register_table);
 EXPORT_SYMBOL(ip6t_unregister_table);
 EXPORT_SYMBOL(ip6t_do_table);
+EXPORT_SYMBOL(ip6t_ext_hdr);
+EXPORT_SYMBOL(ipv6_find_hdr);
 
 module_init(ip6_tables_init);
 module_exit(ip6_tables_fini);
diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c
deleted file mode 100644
index 60e9053bab0..00000000000
--- a/net/ipv6/netfilter/ip6t_MASQUERADE.c
+++ /dev/null
@@ -1,135 +0,0 @@
-/*
- * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * Based on Rusty Russell's IPv6 MASQUERADE target. Development of IPv6
- * NAT funded by Astaro.
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/netdevice.h>
-#include <linux/ipv6.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv6.h>
-#include <linux/netfilter/x_tables.h>
-#include <net/netfilter/nf_nat.h>
-#include <net/addrconf.h>
-#include <net/ipv6.h>
-
-static unsigned int
-masquerade_tg6(struct sk_buff *skb, const struct xt_action_param *par)
-{
-        const struct nf_nat_range *range = par->targinfo;
-        enum ip_conntrack_info ctinfo;
-        struct in6_addr src;
-        struct nf_conn *ct;
-        struct nf_nat_range newrange;
-
-        ct = nf_ct_get(skb, &ctinfo);
-        NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
-                            ctinfo == IP_CT_RELATED_REPLY));
-
-        if (ipv6_dev_get_saddr(dev_net(par->out), par->out,
-                               &ipv6_hdr(skb)->daddr, 0, &src) < 0)
-                return NF_DROP;
-
-        nfct_nat(ct)->masq_index = par->out->ifindex;
-
-        newrange.flags          = range->flags | NF_NAT_RANGE_MAP_IPS;
-        newrange.min_addr.in6   = src;
-        newrange.max_addr.in6   = src;
-        newrange.min_proto      = range->min_proto;
-        newrange.max_proto      = range->max_proto;
-
-        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_SRC);
-}
-
-static int masquerade_tg6_checkentry(const struct xt_tgchk_param *par)
-{
-        const struct nf_nat_range *range = par->targinfo;
-
-        if (range->flags & NF_NAT_RANGE_MAP_IPS)
-                return -EINVAL;
-        return 0;
-}
-
-static int device_cmp(struct nf_conn *ct, void *ifindex)
-{
-        const struct nf_conn_nat *nat = nfct_nat(ct);
-
-        if (!nat)
-                return 0;
-        if (nf_ct_l3num(ct) != NFPROTO_IPV6)
-                return 0;
-        return nat->masq_index == (int)(long)ifindex;
-}
-
-static int masq_device_event(struct notifier_block *this,
-                             unsigned long event, void *ptr)
-{
-        const struct net_device *dev = ptr;
-        struct net *net = dev_net(dev);
-
-        if (event == NETDEV_DOWN)
-                nf_ct_iterate_cleanup(net, device_cmp,
-                                      (void *)(long)dev->ifindex);
-
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block masq_dev_notifier = {
-        .notifier_call  = masq_device_event,
-};
-
-static int masq_inet_event(struct notifier_block *this,
-                           unsigned long event, void *ptr)
-{
-        struct inet6_ifaddr *ifa = ptr;
-
-        return masq_device_event(this, event, ifa->idev->dev);
-}
-
-static struct notifier_block masq_inet_notifier = {
-        .notifier_call  = masq_inet_event,
-};
-
-static struct xt_target masquerade_tg6_reg __read_mostly = {
-        .name           = "MASQUERADE",
-        .family         = NFPROTO_IPV6,
-        .checkentry     = masquerade_tg6_checkentry,
-        .target         = masquerade_tg6,
-        .targetsize     = sizeof(struct nf_nat_range),
-        .table          = "nat",
-        .hooks          = 1 << NF_INET_POST_ROUTING,
-        .me             = THIS_MODULE,
-};
-
-static int __init masquerade_tg6_init(void)
-{
-        int err;
-
-        err = xt_register_target(&masquerade_tg6_reg);
-        if (err == 0) {
-                register_netdevice_notifier(&masq_dev_notifier);
-                register_inet6addr_notifier(&masq_inet_notifier);
-        }
-
-        return err;
-}
-static void __exit masquerade_tg6_exit(void)
-{
-        unregister_inet6addr_notifier(&masq_inet_notifier);
-        unregister_netdevice_notifier(&masq_dev_notifier);
-        xt_unregister_target(&masquerade_tg6_reg);
-}
-
-module_init(masquerade_tg6_init);
-module_exit(masquerade_tg6_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_DESCRIPTION("Xtables: automatic address SNAT");
diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
deleted file mode 100644
index 7302b0b7b64..00000000000
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ /dev/null
@@ -1,146 +0,0 @@
-/*
- * Copyright (c) 2011, 2012 Patrick McHardy <kaber@trash.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ipv6.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv6.h>
-#include <linux/netfilter_ipv6/ip6t_NPT.h>
-#include <linux/netfilter/x_tables.h>
-
-static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
-{
-        struct ip6t_npt_tginfo *npt = par->targinfo;
-        __wsum src_sum = 0, dst_sum = 0;
-        unsigned int i;
-
-        if (npt->src_pfx_len > 64 || npt->dst_pfx_len > 64)
-                return -EINVAL;
-
-        for (i = 0; i < ARRAY_SIZE(npt->src_pfx.in6.s6_addr16); i++) {
-                src_sum = csum_add(src_sum,
-                                (__force __wsum)npt->src_pfx.in6.s6_addr16[i]);
-                dst_sum = csum_add(dst_sum,
-                                (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]);
-        }
-
-        npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum);
-        return 0;
-}
-
-static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
-                             struct in6_addr *addr)
-{
-        unsigned int pfx_len;
-        unsigned int i, idx;
-        __be32 mask;
-        __sum16 sum;
-
-        pfx_len = max(npt->src_pfx_len, npt->dst_pfx_len);
-        for (i = 0; i < pfx_len; i += 32) {
-                if (pfx_len - i >= 32)
-                        mask = 0;
-                else
-                        mask = htonl(~((1 << (pfx_len - i)) - 1));
-
-                idx = i / 32;
-                addr->s6_addr32[idx] &= mask;
-                addr->s6_addr32[idx] |= npt->dst_pfx.in6.s6_addr32[idx];
-        }
-
-        if (pfx_len <= 48)
-                idx = 3;
-        else {
-                for (idx = 4; idx < ARRAY_SIZE(addr->s6_addr16); idx++) {
-                        if ((__force __sum16)addr->s6_addr16[idx] !=
-                            CSUM_MANGLED_0)
-                                break;
-                }
-                if (idx == ARRAY_SIZE(addr->s6_addr16))
-                        return false;
-        }
-
-        sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx],
-                         npt->adjustment);
-        if (sum == CSUM_MANGLED_0)
-                sum = 0;
-        *(__force __sum16 *)&addr->s6_addr16[idx] = sum;
-
-        return true;
-}
-
-static unsigned int
-ip6t_snpt_tg(struct sk_buff *skb, const struct xt_action_param *par)
-{
-        const struct ip6t_npt_tginfo *npt = par->targinfo;
-
-        if (!ip6t_npt_map_pfx(npt, &ipv6_hdr(skb)->saddr)) {
-                icmpv6_send(skb, ICMPV6_PARAMPROB, ICMPV6_HDR_FIELD,
-                            offsetof(struct ipv6hdr, saddr));
-                return NF_DROP;
-        }
-        return XT_CONTINUE;
-}
-
-static unsigned int
-ip6t_dnpt_tg(struct sk_buff *skb, const struct xt_action_param *par)
-{
-        const struct ip6t_npt_tginfo *npt = par->targinfo;
-
-        if (!ip6t_npt_map_pfx(npt, &ipv6_hdr(skb)->daddr)) {
-                icmpv6_send(skb, ICMPV6_PARAMPROB, ICMPV6_HDR_FIELD,
-                            offsetof(struct ipv6hdr, daddr));
-                return NF_DROP;
-        }
-        return XT_CONTINUE;
-}
-
-static struct xt_target ip6t_npt_target_reg[] __read_mostly = {
-        {
-                .name           = "SNPT",
-                .target         = ip6t_snpt_tg,
-                .targetsize     = sizeof(struct ip6t_npt_tginfo),
-                .checkentry     = ip6t_npt_checkentry,
-                .family         = NFPROTO_IPV6,
-                .hooks          = (1 << NF_INET_LOCAL_IN) |
-                                  (1 << NF_INET_POST_ROUTING),
-                .me             = THIS_MODULE,
-        },
-        {
-                .name           = "DNPT",
-                .target         = ip6t_dnpt_tg,
-                .targetsize     = sizeof(struct ip6t_npt_tginfo),
-                .checkentry     = ip6t_npt_checkentry,
-                .family         = NFPROTO_IPV6,
-                .hooks          = (1 << NF_INET_PRE_ROUTING) |
-                                  (1 << NF_INET_LOCAL_OUT),
-                .me             = THIS_MODULE,
-        },
-};
-
-static int __init ip6t_npt_init(void)
-{
-        return xt_register_targets(ip6t_npt_target_reg,
-                                   ARRAY_SIZE(ip6t_npt_target_reg));
-}
-
-static void __exit ip6t_npt_exit(void)
-{
-        xt_unregister_targets(ip6t_npt_target_reg,
-                              ARRAY_SIZE(ip6t_npt_target_reg));
-}
-
-module_init(ip6t_npt_init);
-module_exit(ip6t_npt_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("IPv6-to-IPv6 Network Prefix Translation (RFC 6296)");
-MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
-MODULE_ALIAS("ip6t_SNPT");
-MODULE_ALIAS("ip6t_DNPT");
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 029623dbd41..09d30498c92 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -49,7 +49,6 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
         const __u8 tclass = DEFAULT_TOS_VALUE;
         struct dst_entry *dst = NULL;
         u8 proto;
-        __be16 frag_off;
         struct flowi6 fl6;
 
         if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) ||
@@ -59,7 +58,7 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
         }
 
         proto = oip6h->nexthdr;
-        tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data), &proto, &frag_off);
+        tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data), &proto);
 
         if ((tcphoff < 0) || (tcphoff > oldskb->len)) {
                 pr_debug("Cannot get TCP header.\n");
@@ -94,8 +93,8 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
 
         memset(&fl6, 0, sizeof(fl6));
         fl6.flowi6_proto = IPPROTO_TCP;
-        fl6.saddr = oip6h->daddr;
-        fl6.daddr = oip6h->saddr;
+        ipv6_addr_copy(&fl6.saddr, &oip6h->daddr);
+        ipv6_addr_copy(&fl6.daddr, &oip6h->saddr);
         fl6.fl6_sport = otcph.dest;
         fl6.fl6_dport = otcph.source;
         security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6));
@@ -114,7 +113,8 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
                          GFP_ATOMIC);
 
         if (!nskb) {
-                net_dbg_ratelimited("cannot alloc skb\n");
+                if (net_ratelimit())
+                        pr_debug("cannot alloc skb\n");
                 dst_release(dst);
                 return;
         }
@@ -129,10 +129,9 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
         *(__be32 *)ip6h =  htonl(0x60000000 | (tclass << 20));
         ip6h->hop_limit = ip6_dst_hoplimit(dst);
         ip6h->nexthdr = IPPROTO_TCP;
-        ip6h->saddr = oip6h->daddr;
-        ip6h->daddr = oip6h->saddr;
+        ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr);
+        ipv6_addr_copy(&ip6h->daddr, &oip6h->saddr);
 
-        skb_reset_transport_header(nskb);
         tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
         /* Truncate to length (no data) */
         tcph->doff = sizeof(struct tcphdr)/4;
@@ -178,6 +177,15 @@ send_unreach(struct net *net, struct sk_buff *skb_in, unsigned char code,
                 skb_in->dev = net->loopback_dev;
 
         icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0);
+#ifdef CONFIG_IP6_NF_TARGET_REJECT_SKERR
+        if (skb_in->sk) {
+                icmpv6_err_convert(ICMPV6_DEST_UNREACH, code,
+                                   &skb_in->sk->sk_err);
+                skb_in->sk->sk_error_report(skb_in->sk);
+                pr_debug("ip6t_REJECT: sk_err=%d for skb=%p sk=%p\n",
+                        skb_in->sk->sk_err, skb_in, skb_in->sk);
+        }
+#endif
 }
 
 static unsigned int
@@ -210,7 +218,8 @@ reject_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                 send_reset(net, skb);
                 break;
         default:
-                net_info_ratelimited("case %u not handled yet\n", reject->with);
+                if (net_ratelimit())
+                        pr_info("case %u not handled yet\n", reject->with);
                 break;
         }
 
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 04099ab7d2e..89cccc5a9c9 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -41,11 +41,11 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         struct ip_auth_hdr _ah;
         const struct ip_auth_hdr *ah;
         const struct ip6t_ah *ahinfo = par->matchinfo;
-        unsigned int ptr = 0;
+        unsigned int ptr;
         unsigned int hdrlen = 0;
         int err;
 
-        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL, NULL);
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
                         par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 3b5735e56bf..eda898fda6c 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -40,10 +40,10 @@ frag_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         struct frag_hdr _frag;
         const struct frag_hdr *fh;
         const struct ip6t_frag *fraginfo = par->matchinfo;
-        unsigned int ptr = 0;
+        unsigned int ptr;
         int err;
 
-        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL, NULL);
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
                         par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 01df142bb02..59df051eaef 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -50,7 +50,7 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         const struct ipv6_opt_hdr *oh;
         const struct ip6t_opts *optinfo = par->matchinfo;
         unsigned int temp;
-        unsigned int ptr = 0;
+        unsigned int ptr;
         unsigned int hdrlen = 0;
         bool ret = false;
         u8 _opttype;
@@ -62,7 +62,7 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 
         err = ipv6_find_hdr(skb, &ptr,
                             (par->match == &hbh_mt6_reg[0]) ?
-                            NEXTHDR_HOP : NEXTHDR_DEST, NULL, NULL);
+                            NEXTHDR_HOP : NEXTHDR_DEST, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
                         par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
deleted file mode 100644
index 5060d54199a..00000000000
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
- * Copyright (c) 2011 Florian Westphal <fw@strlen.de>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/netdevice.h>
-#include <linux/route.h>
-#include <net/ip6_fib.h>
-#include <net/ip6_route.h>
-
-#include <linux/netfilter/xt_rpfilter.h>
-#include <linux/netfilter/x_tables.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
-MODULE_DESCRIPTION("Xtables: IPv6 reverse path filter match");
-
-static bool rpfilter_addr_unicast(const struct in6_addr *addr)
-{
-        int addr_type = ipv6_addr_type(addr);
-        return addr_type & IPV6_ADDR_UNICAST;
-}
-
-static bool rpfilter_lookup_reverse6(const struct sk_buff *skb,
-                                     const struct net_device *dev, u8 flags)
-{
-        struct rt6_info *rt;
-        struct ipv6hdr *iph = ipv6_hdr(skb);
-        bool ret = false;
-        struct flowi6 fl6 = {
-                .flowlabel = (* (__be32 *) iph) & IPV6_FLOWINFO_MASK,
-                .flowi6_proto = iph->nexthdr,
-                .daddr = iph->saddr,
-        };
-        int lookup_flags;
-
-        if (rpfilter_addr_unicast(&iph->daddr)) {
-                memcpy(&fl6.saddr, &iph->daddr, sizeof(struct in6_addr));
-                lookup_flags = RT6_LOOKUP_F_HAS_SADDR;
-        } else {
-                lookup_flags = 0;
-        }
-
-        fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
-        if ((flags & XT_RPFILTER_LOOSE) == 0) {
-                fl6.flowi6_oif = dev->ifindex;
-                lookup_flags |= RT6_LOOKUP_F_IFACE;
-        }
-
-        rt = (void *) ip6_route_lookup(dev_net(dev), &fl6, lookup_flags);
-        if (rt->dst.error)
-                goto out;
-
-        if (rt->rt6i_flags & (RTF_REJECT|RTF_ANYCAST))
-                goto out;
-
-        if (rt->rt6i_flags & RTF_LOCAL) {
-                ret = flags & XT_RPFILTER_ACCEPT_LOCAL;
-                goto out;
-        }
-
-        if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE))
-                ret = true;
- out:
-        ip6_rt_put(rt);
-        return ret;
-}
-
-static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
-{
-        const struct xt_rpfilter_info *info = par->matchinfo;
-        int saddrtype;
-        struct ipv6hdr *iph;
-        bool invert = info->flags & XT_RPFILTER_INVERT;
-
-        if (par->in->flags & IFF_LOOPBACK)
-                return true ^ invert;
-
-        iph = ipv6_hdr(skb);
-        saddrtype = ipv6_addr_type(&iph->saddr);
-        if (unlikely(saddrtype == IPV6_ADDR_ANY))
-                return true ^ invert; /* not routable: forward path will drop it */
-
-        return rpfilter_lookup_reverse6(skb, par->in, info->flags) ^ invert;
-}
-
-static int rpfilter_check(const struct xt_mtchk_param *par)
-{
-        const struct xt_rpfilter_info *info = par->matchinfo;
-        unsigned int options = ~XT_RPFILTER_OPTION_MASK;
-
-        if (info->flags & options) {
-                pr_info("unknown options encountered");
-                return -EINVAL;
-        }
-
-        if (strcmp(par->table, "mangle") != 0 &&
-            strcmp(par->table, "raw") != 0) {
-                pr_info("match only valid in the \'raw\' "
-                        "or \'mangle\' tables, not \'%s\'.\n", par->table);
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
-static struct xt_match rpfilter_mt_reg __read_mostly = {
-        .name           = "rpfilter",
-        .family         = NFPROTO_IPV6,
-        .checkentry     = rpfilter_check,
-        .match          = rpfilter_mt,
-        .matchsize      = sizeof(struct xt_rpfilter_info),
-        .hooks          = (1 << NF_INET_PRE_ROUTING),
-        .me             = THIS_MODULE
-};
-
-static int __init rpfilter_mt_init(void)
-{
-        return xt_register_match(&rpfilter_mt_reg);
-}
-
-static void __exit rpfilter_mt_exit(void)
-{
-        xt_unregister_match(&rpfilter_mt_reg);
-}
-
-module_init(rpfilter_mt_init);
-module_exit(rpfilter_mt_exit);
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 2c99b94eeca..d8488c50a8e 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -42,14 +42,14 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
         const struct ipv6_rt_hdr *rh;
         const struct ip6t_rt *rtinfo = par->matchinfo;
         unsigned int temp;
-        unsigned int ptr = 0;
+        unsigned int ptr;
         unsigned int hdrlen = 0;
         bool ret = false;
         struct in6_addr _addr;
         const struct in6_addr *ap;
         int err;
 
-        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL, NULL);
+        err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
                         par->hotdrop = true;
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index beb5777d204..c9e37c8fd62 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -44,7 +44,7 @@ ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
 static struct nf_hook_ops *filter_ops __read_mostly;
 
 /* Default to forward because I got too much mail already. */
-static bool forward = true;
+static int forward = NF_ACCEPT;
 module_param(forward, bool, 0000);
 
 static int __net_init ip6table_filter_net_init(struct net *net)
@@ -56,12 +56,14 @@ static int __net_init ip6table_filter_net_init(struct net *net)
                 return -ENOMEM;
         /* Entry 1 is the FORWARD hook */
         ((struct ip6t_standard *)repl->entries)[1].target.verdict =
-                forward ? -NF_ACCEPT - 1 : -NF_DROP - 1;
+                -forward - 1;
 
         net->ipv6.ip6table_filter =
                 ip6t_register_table(net, &packet_filter, repl);
         kfree(repl);
-        return PTR_RET(net->ipv6.ip6table_filter);
+        if (IS_ERR(net->ipv6.ip6table_filter))
+                return PTR_ERR(net->ipv6.ip6table_filter);
+        return 0;
 }
 
 static void __net_exit ip6table_filter_net_exit(struct net *net)
@@ -78,6 +80,11 @@ static int __init ip6table_filter_init(void)
 {
         int ret;
 
+        if (forward < 0 || forward > NF_MAX_VERDICT) {
+                pr_err("iptables forward must be 0 or 1\n");
+                return -EINVAL;
+        }
+
         ret = register_pernet_subsys(&ip6table_filter_net_ops);
         if (ret < 0)
                 return ret;
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 7431121b87d..00d19173db7 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -42,7 +42,8 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr) ||
             ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                net_warn_ratelimited("ip6t_hook: happy cracking\n");
+                if (net_ratelimit())
+                        pr_warning("ip6t_hook: happy cracking.\n");
                 return NF_ACCEPT;
         }
 #endif
@@ -97,7 +98,9 @@ static int __net_init ip6table_mangle_net_init(struct net *net)
         net->ipv6.ip6table_mangle =
                 ip6t_register_table(net, &packet_mangler, repl);
         kfree(repl);
-        return PTR_RET(net->ipv6.ip6table_mangle);
+        if (IS_ERR(net->ipv6.ip6table_mangle))
+                return PTR_ERR(net->ipv6.ip6table_mangle);
+        return 0;
 }
 
 static void __net_exit ip6table_mangle_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
deleted file mode 100644
index e0e788d25b1..00000000000
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ /dev/null
@@ -1,330 +0,0 @@
-/*
- * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * Based on Rusty Russell's IPv4 NAT code. Development of IPv6 NAT
- * funded by Astaro.
- */
-
-#include <linux/module.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv6.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
-#include <linux/ipv6.h>
-#include <net/ipv6.h>
-
-#include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_core.h>
-#include <net/netfilter/nf_nat_l3proto.h>
-
-static const struct xt_table nf_nat_ipv6_table = {
-        .name           = "nat",
-        .valid_hooks    = (1 << NF_INET_PRE_ROUTING) |
-                          (1 << NF_INET_POST_ROUTING) |
-                          (1 << NF_INET_LOCAL_OUT) |
-                          (1 << NF_INET_LOCAL_IN),
-        .me             = THIS_MODULE,
-        .af             = NFPROTO_IPV6,
-};
-
-static unsigned int alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
-{
-        /* Force range to this IP; let proto decide mapping for
-         * per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
-         */
-        struct nf_nat_range range;
-
-        range.flags = 0;
-        pr_debug("Allocating NULL binding for %p (%pI6)\n", ct,
-                 HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
-                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip6 :
-                 &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip6);
-
-        return nf_nat_setup_info(ct, &range, HOOK2MANIP(hooknum));
-}
-
-static unsigned int nf_nat_rule_find(struct sk_buff *skb, unsigned int hooknum,
-                                     const struct net_device *in,
-                                     const struct net_device *out,
-                                     struct nf_conn *ct)
-{
-        struct net *net = nf_ct_net(ct);
-        unsigned int ret;
-
-        ret = ip6t_do_table(skb, hooknum, in, out, net->ipv6.ip6table_nat);
-        if (ret == NF_ACCEPT) {
-                if (!nf_nat_initialized(ct, HOOK2MANIP(hooknum)))
-                        ret = alloc_null_binding(ct, hooknum);
-        }
-        return ret;
-}
-
-static unsigned int
-nf_nat_ipv6_fn(unsigned int hooknum,
-               struct sk_buff *skb,
-               const struct net_device *in,
-               const struct net_device *out,
-               int (*okfn)(struct sk_buff *))
-{
-        struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
-        struct nf_conn_nat *nat;
-        enum nf_nat_manip_type maniptype = HOOK2MANIP(hooknum);
-        __be16 frag_off;
-        int hdrlen;
-        u8 nexthdr;
-
-        ct = nf_ct_get(skb, &ctinfo);
-        /* Can't track?  It's not due to stress, or conntrack would
-         * have dropped it.  Hence it's the user's responsibilty to
-         * packet filter it out, or implement conntrack/NAT for that
-         * protocol. 8) --RR
-         */
-        if (!ct)
-                return NF_ACCEPT;
-
-        /* Don't try to NAT if this packet is not conntracked */
-        if (nf_ct_is_untracked(ct))
-                return NF_ACCEPT;
-
-        nat = nfct_nat(ct);
-        if (!nat) {
-                /* NAT module was loaded late. */
-                if (nf_ct_is_confirmed(ct))
-                        return NF_ACCEPT;
-                nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
-                if (nat == NULL) {
-                        pr_debug("failed to add NAT extension\n");
-                        return NF_ACCEPT;
-                }
-        }
-
-        switch (ctinfo) {
-        case IP_CT_RELATED:
-        case IP_CT_RELATED_REPLY:
-                nexthdr = ipv6_hdr(skb)->nexthdr;
-                hdrlen = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
-                                          &nexthdr, &frag_off);
-
-                if (hdrlen >= 0 && nexthdr == IPPROTO_ICMPV6) {
-                        if (!nf_nat_icmpv6_reply_translation(skb, ct, ctinfo,
-                                                             hooknum, hdrlen))
-                                return NF_DROP;
-                        else
-                                return NF_ACCEPT;
-                }
-                /* Fall thru... (Only ICMPs can be IP_CT_IS_REPLY) */
-        case IP_CT_NEW:
-                /* Seen it before?  This can happen for loopback, retrans,
-                 * or local packets.
-                 */
-                if (!nf_nat_initialized(ct, maniptype)) {
-                        unsigned int ret;
-
-                        ret = nf_nat_rule_find(skb, hooknum, in, out, ct);
-                        if (ret != NF_ACCEPT)
-                                return ret;
-                } else {
-                        pr_debug("Already setup manip %s for ct %p\n",
-                                 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
-                                 ct);
-                        if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))
-                                goto oif_changed;
-                }
-                break;
-
-        default:
-                /* ESTABLISHED */
-                NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
-                             ctinfo == IP_CT_ESTABLISHED_REPLY);
-                if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))
-                        goto oif_changed;
-        }
-
-        return nf_nat_packet(ct, ctinfo, hooknum, skb);
-
-oif_changed:
-        nf_ct_kill_acct(ct, ctinfo, skb);
-        return NF_DROP;
-}
-
-static unsigned int
-nf_nat_ipv6_in(unsigned int hooknum,
-               struct sk_buff *skb,
-               const struct net_device *in,
-               const struct net_device *out,
-               int (*okfn)(struct sk_buff *))
-{
-        unsigned int ret;
-        struct in6_addr daddr = ipv6_hdr(skb)->daddr;
-
-        ret = nf_nat_ipv6_fn(hooknum, skb, in, out, okfn);
-        if (ret != NF_DROP && ret != NF_STOLEN &&
-            ipv6_addr_cmp(&daddr, &ipv6_hdr(skb)->daddr))
-                skb_dst_drop(skb);
-
-        return ret;
-}
-
-static unsigned int
-nf_nat_ipv6_out(unsigned int hooknum,
-                struct sk_buff *skb,
-                const struct net_device *in,
-                const struct net_device *out,
-                int (*okfn)(struct sk_buff *))
-{
-#ifdef CONFIG_XFRM
-        const struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
-#endif
-        unsigned int ret;
-
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct ipv6hdr))
-                return NF_ACCEPT;
-
-        ret = nf_nat_ipv6_fn(hooknum, skb, in, out, okfn);
-#ifdef CONFIG_XFRM
-        if (ret != NF_DROP && ret != NF_STOLEN &&
-            !(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
-            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
-                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-
-                if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.src.u3,
-                                      &ct->tuplehash[!dir].tuple.dst.u3) ||
-                    (ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
-                     ct->tuplehash[dir].tuple.src.u.all !=
-                     ct->tuplehash[!dir].tuple.dst.u.all))
-                        if (nf_xfrm_me_harder(skb, AF_INET6) < 0)
-                                ret = NF_DROP;
-        }
-#endif
-        return ret;
-}
-
-static unsigned int
-nf_nat_ipv6_local_fn(unsigned int hooknum,
-                     struct sk_buff *skb,
-                     const struct net_device *in,
-                     const struct net_device *out,
-                     int (*okfn)(struct sk_buff *))
-{
-        const struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
-        unsigned int ret;
-
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct ipv6hdr))
-                return NF_ACCEPT;
-
-        ret = nf_nat_ipv6_fn(hooknum, skb, in, out, okfn);
-        if (ret != NF_DROP && ret != NF_STOLEN &&
-            (ct = nf_ct_get(skb, &ctinfo)) != NULL) {
-                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-
-                if (!nf_inet_addr_cmp(&ct->tuplehash[dir].tuple.dst.u3,
-                                      &ct->tuplehash[!dir].tuple.src.u3)) {
-                        if (ip6_route_me_harder(skb))
-                                ret = NF_DROP;
-                }
-#ifdef CONFIG_XFRM
-                else if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
-                         ct->tuplehash[dir].tuple.dst.protonum != IPPROTO_ICMPV6 &&
-                         ct->tuplehash[dir].tuple.dst.u.all !=
-                         ct->tuplehash[!dir].tuple.src.u.all)
-                        if (nf_xfrm_me_harder(skb, AF_INET6))
-                                ret = NF_DROP;
-#endif
-        }
-        return ret;
-}
-
-static struct nf_hook_ops nf_nat_ipv6_ops[] __read_mostly = {
-        /* Before packet filtering, change destination */
-        {
-                .hook           = nf_nat_ipv6_in,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_PRE_ROUTING,
-                .priority       = NF_IP6_PRI_NAT_DST,
-        },
-        /* After packet filtering, change source */
-        {
-                .hook           = nf_nat_ipv6_out,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_POST_ROUTING,
-                .priority       = NF_IP6_PRI_NAT_SRC,
-        },
-        /* Before packet filtering, change destination */
-        {
-                .hook           = nf_nat_ipv6_local_fn,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP6_PRI_NAT_DST,
-        },
-        /* After packet filtering, change source */
-        {
-                .hook           = nf_nat_ipv6_fn,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP6_PRI_NAT_SRC,
-        },
-};
-
-static int __net_init ip6table_nat_net_init(struct net *net)
-{
-        struct ip6t_replace *repl;
-
-        repl = ip6t_alloc_initial_table(&nf_nat_ipv6_table);
-        if (repl == NULL)
-                return -ENOMEM;
-        net->ipv6.ip6table_nat = ip6t_register_table(net, &nf_nat_ipv6_table, repl);
-        kfree(repl);
-        return PTR_RET(net->ipv6.ip6table_nat);
-}
-
-static void __net_exit ip6table_nat_net_exit(struct net *net)
-{
-        ip6t_unregister_table(net, net->ipv6.ip6table_nat);
-}
-
-static struct pernet_operations ip6table_nat_net_ops = {
-        .init   = ip6table_nat_net_init,
-        .exit   = ip6table_nat_net_exit,
-};
-
-static int __init ip6table_nat_init(void)
-{
-        int err;
-
-        err = register_pernet_subsys(&ip6table_nat_net_ops);
-        if (err < 0)
-                goto err1;
-
-        err = nf_register_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
-        if (err < 0)
-                goto err2;
-        return 0;
-
-err2:
-        unregister_pernet_subsys(&ip6table_nat_net_ops);
-err1:
-        return err;
-}
-
-static void __exit ip6table_nat_exit(void)
-{
-        nf_unregister_hooks(nf_nat_ipv6_ops, ARRAY_SIZE(nf_nat_ipv6_ops));
-        unregister_pernet_subsys(&ip6table_nat_net_ops);
-}
-
-module_init(ip6table_nat_init);
-module_exit(ip6table_nat_exit);
-
-MODULE_LICENSE("GPL");
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 60d1bddff7a..5b9926a011b 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -40,7 +40,9 @@ static int __net_init ip6table_raw_net_init(struct net *net)
         net->ipv6.ip6table_raw =
                 ip6t_register_table(net, &packet_raw, repl);
         kfree(repl);
-        return PTR_RET(net->ipv6.ip6table_raw);
+        if (IS_ERR(net->ipv6.ip6table_raw))
+                return PTR_ERR(net->ipv6.ip6table_raw);
+        return 0;
 }
 
 static void __net_exit ip6table_raw_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index db155351339..91aa2b4d83c 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -58,7 +58,10 @@ static int __net_init ip6table_security_net_init(struct net *net)
         net->ipv6.ip6table_security =
                 ip6t_register_table(net, &security_table, repl);
         kfree(repl);
-        return PTR_RET(net->ipv6.ip6table_security);
+        if (IS_ERR(net->ipv6.ip6table_security))
+                return PTR_ERR(net->ipv6.ip6table_security);
+
+        return 0;
 }
 
 static void __net_exit ip6table_security_net_exit(struct net *net)
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 137e245860a..4111050a9fc 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -21,7 +21,6 @@
 
 #include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv6.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
@@ -29,7 +28,6 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
-#include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #include <net/netfilter/nf_log.h>
 
@@ -66,112 +64,125 @@ static int ipv6_print_tuple(struct seq_file *s,
                           tuple->src.u3.ip6, tuple->dst.u3.ip6);
 }
 
+/*
+ * Based on ipv6_skip_exthdr() in net/ipv6/exthdr.c
+ *
+ * This function parses (probably truncated) exthdr set "hdr"
+ * of length "len". "nexthdrp" initially points to some place,
+ * where type of the first header can be found.
+ *
+ * It skips all well-known exthdrs, and returns pointer to the start
+ * of unparsable area i.e. the first header with unknown type.
+ * if success, *nexthdr is updated by type/protocol of this header.
+ *
+ * NOTES: - it may return pointer pointing beyond end of packet,
+ *          if the last recognized header is truncated in the middle.
+ *        - if packet is truncated, so that all parsed headers are skipped,
+ *          it returns -1.
+ *        - if packet is fragmented, return pointer of the fragment header.
+ *        - ESP is unparsable for now and considered like
+ *          normal payload protocol.
+ *        - Note also special handling of AUTH header. Thanks to IPsec wizards.
+ */
+
+static int nf_ct_ipv6_skip_exthdr(const struct sk_buff *skb, int start,
+                                  u8 *nexthdrp, int len)
+{
+        u8 nexthdr = *nexthdrp;
+
+        while (ipv6_ext_hdr(nexthdr)) {
+                struct ipv6_opt_hdr hdr;
+                int hdrlen;
+
+                if (len < (int)sizeof(struct ipv6_opt_hdr))
+                        return -1;
+                if (nexthdr == NEXTHDR_NONE)
+                        break;
+                if (nexthdr == NEXTHDR_FRAGMENT)
+                        break;
+                if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
+                        BUG();
+                if (nexthdr == NEXTHDR_AUTH)
+                        hdrlen = (hdr.hdrlen+2)<<2;
+                else
+                        hdrlen = ipv6_optlen(&hdr);
+
+                nexthdr = hdr.nexthdr;
+                len -= hdrlen;
+                start += hdrlen;
+        }
+
+        *nexthdrp = nexthdr;
+        return start;
+}
+
 static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
                             unsigned int *dataoff, u_int8_t *protonum)
 {
         unsigned int extoff = nhoff + sizeof(struct ipv6hdr);
-        __be16 frag_off;
+        unsigned char pnum;
         int protoff;
-        u8 nexthdr;
 
         if (skb_copy_bits(skb, nhoff + offsetof(struct ipv6hdr, nexthdr),
-                          &nexthdr, sizeof(nexthdr)) != 0) {
+                          &pnum, sizeof(pnum)) != 0) {
                 pr_debug("ip6_conntrack_core: can't get nexthdr\n");
                 return -NF_ACCEPT;
         }
-        protoff = ipv6_skip_exthdr(skb, extoff, &nexthdr, &frag_off);
+        protoff = nf_ct_ipv6_skip_exthdr(skb, extoff, &pnum, skb->len - extoff);
         /*
-         * (protoff == skb->len) means the packet has not data, just
-         * IPv6 and possibly extensions headers, but it is tracked anyway
+         * (protoff == skb->len) mean that the packet doesn't have no data
+         * except of IPv6 & ext headers. but it's tracked anyway. - YK
          */
-        if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
+        if ((protoff < 0) || (protoff > skb->len)) {
                 pr_debug("ip6_conntrack_core: can't find proto in pkt\n");
                 return -NF_ACCEPT;
         }
 
         *dataoff = protoff;
-        *protonum = nexthdr;
+        *protonum = pnum;
         return NF_ACCEPT;
 }
 
-static unsigned int ipv6_helper(unsigned int hooknum,
-                                struct sk_buff *skb,
-                                const struct net_device *in,
-                                const struct net_device *out,
-                                int (*okfn)(struct sk_buff *))
+static unsigned int ipv6_confirm(unsigned int hooknum,
+                                 struct sk_buff *skb,
+                                 const struct net_device *in,
+                                 const struct net_device *out,
+                                 int (*okfn)(struct sk_buff *))
 {
         struct nf_conn *ct;
         const struct nf_conn_help *help;
         const struct nf_conntrack_helper *helper;
         enum ip_conntrack_info ctinfo;
-        unsigned int ret;
-        __be16 frag_off;
-        int protoff;
-        u8 nexthdr;
+        unsigned int ret, protoff;
+        unsigned int extoff = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
+        unsigned char pnum = ipv6_hdr(skb)->nexthdr;
+
 
         /* This is where we call the helper: as the packet goes out. */
         ct = nf_ct_get(skb, &ctinfo);
         if (!ct || ctinfo == IP_CT_RELATED_REPLY)
-                return NF_ACCEPT;
+                goto out;
 
         help = nfct_help(ct);
         if (!help)
-                return NF_ACCEPT;
+                goto out;
         /* rcu_read_lock()ed by nf_hook_slow */
         helper = rcu_dereference(help->helper);
         if (!helper)
-                return NF_ACCEPT;
+                goto out;
 
-        nexthdr = ipv6_hdr(skb)->nexthdr;
-        protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
-                                   &frag_off);
-        if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
+        protoff = nf_ct_ipv6_skip_exthdr(skb, extoff, &pnum,
+                                         skb->len - extoff);
+        if (protoff > skb->len || pnum == NEXTHDR_FRAGMENT) {
                 pr_debug("proto header not found\n");
                 return NF_ACCEPT;
         }
 
         ret = helper->help(skb, protoff, ct, ctinfo);
-        if (ret != NF_ACCEPT && (ret & NF_VERDICT_MASK) != NF_QUEUE) {
+        if (ret != NF_ACCEPT) {
                 nf_log_packet(NFPROTO_IPV6, hooknum, skb, in, out, NULL,
                               "nf_ct_%s: dropping packet", helper->name);
-        }
-        return ret;
-}
-
-static unsigned int ipv6_confirm(unsigned int hooknum,
-                                 struct sk_buff *skb,
-                                 const struct net_device *in,
-                                 const struct net_device *out,
-                                 int (*okfn)(struct sk_buff *))
-{
-        struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
-        unsigned char pnum = ipv6_hdr(skb)->nexthdr;
-        int protoff;
-        __be16 frag_off;
-
-        ct = nf_ct_get(skb, &ctinfo);
-        if (!ct || ctinfo == IP_CT_RELATED_REPLY)
-                goto out;
-
-        protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &pnum,
-                                   &frag_off);
-        if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
-                pr_debug("proto header not found\n");
-                goto out;
-        }
-
-        /* adjust seqs for loopback traffic only in outgoing direction */
-        if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
-            !nf_is_loopback_packet(skb)) {
-                typeof(nf_nat_seq_adjust_hook) seq_adjust;
-
-                seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
-                if (!seq_adjust ||
-                    !seq_adjust(skb, ct, ctinfo, protoff)) {
-                        NF_CT_STAT_INC_ATOMIC(nf_ct_net(ct), drop);
-                        return NF_DROP;
-                }
+                return ret;
         }
 out:
         /* We've seen it coming out the other side: confirm it */
@@ -181,14 +192,9 @@ out:
 static unsigned int __ipv6_conntrack_in(struct net *net,
                                         unsigned int hooknum,
                                         struct sk_buff *skb,
-                                        const struct net_device *in,
-                                        const struct net_device *out,
                                         int (*okfn)(struct sk_buff *))
 {
         struct sk_buff *reasm = skb->nfct_reasm;
-        const struct nf_conn_help *help;
-        struct nf_conn *ct;
-        enum ip_conntrack_info ctinfo;
 
         /* This packet is fragmented and has reassembled packet. */
         if (reasm) {
@@ -200,25 +206,6 @@ static unsigned int __ipv6_conntrack_in(struct net *net,
                         if (ret != NF_ACCEPT)
                                 return ret;
                 }
-
-                /* Conntrack helpers need the entire reassembled packet in the
-                 * POST_ROUTING hook. In case of unconfirmed connections NAT
-                 * might reassign a helper, so the entire packet is also
-                 * required.
-                 */
-                ct = nf_ct_get(reasm, &ctinfo);
-                if (ct != NULL && !nf_ct_is_untracked(ct)) {
-                        help = nfct_help(ct);
-                        if ((help && help->helper) || !nf_ct_is_confirmed(ct)) {
-                                nf_conntrack_get_reasm(skb);
-                                NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, reasm,
-                                               (struct net_device *)in,
-                                               (struct net_device *)out,
-                                               okfn, NF_IP6_PRI_CONNTRACK + 1);
-                                return NF_DROP_ERR(-ECANCELED);
-                        }
-                }
-
                 nf_conntrack_get(reasm->nfct);
                 skb->nfct = reasm->nfct;
                 skb->nfctinfo = reasm->nfctinfo;
@@ -234,7 +221,7 @@ static unsigned int ipv6_conntrack_in(unsigned int hooknum,
                                       const struct net_device *out,
                                       int (*okfn)(struct sk_buff *))
 {
-        return __ipv6_conntrack_in(dev_net(in), hooknum, skb, in, out, okfn);
+        return __ipv6_conntrack_in(dev_net(in), hooknum, skb, okfn);
 }
 
 static unsigned int ipv6_conntrack_local(unsigned int hooknum,
@@ -245,10 +232,11 @@ static unsigned int ipv6_conntrack_local(unsigned int hooknum,
 {
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct ipv6hdr)) {
-                net_notice_ratelimited("ipv6_conntrack_local: packet too short\n");
+                if (net_ratelimit())
+                        pr_notice("ipv6_conntrack_local: packet too short\n");
                 return NF_ACCEPT;
         }
-        return __ipv6_conntrack_in(dev_net(out), hooknum, skb, in, out, okfn);
+        return __ipv6_conntrack_in(dev_net(out), hooknum, skb, okfn);
 }
 
 static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
@@ -267,13 +255,6 @@ static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
                 .priority       = NF_IP6_PRI_CONNTRACK,
         },
         {
-                .hook           = ipv6_helper,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_POST_ROUTING,
-                .priority       = NF_IP6_PRI_CONNTRACK_HELPER,
-        },
-        {
                 .hook           = ipv6_confirm,
                 .owner          = THIS_MODULE,
                 .pf             = NFPROTO_IPV6,
@@ -281,13 +262,6 @@ static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
                 .priority       = NF_IP6_PRI_LAST,
         },
         {
-                .hook           = ipv6_helper,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP6_PRI_CONNTRACK_HELPER,
-        },
-        {
                 .hook           = ipv6_confirm,
                 .owner          = THIS_MODULE,
                 .pf             = NFPROTO_IPV6,
@@ -296,56 +270,7 @@ static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
         },
 };
 
-static int
-ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
-{
-        const struct inet_sock *inet = inet_sk(sk);
-        const struct ipv6_pinfo *inet6 = inet6_sk(sk);
-        const struct nf_conntrack_tuple_hash *h;
-        struct sockaddr_in6 sin6;
-        struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
-        struct nf_conn *ct;
-
-        tuple.src.u3.in6 = inet6->rcv_saddr;
-        tuple.src.u.tcp.port = inet->inet_sport;
-        tuple.dst.u3.in6 = inet6->daddr;
-        tuple.dst.u.tcp.port = inet->inet_dport;
-        tuple.dst.protonum = sk->sk_protocol;
-
-        if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP)
-                return -ENOPROTOOPT;
-
-        if (*len < 0 || (unsigned int) *len < sizeof(sin6))
-                return -EINVAL;
-
-        h = nf_conntrack_find_get(sock_net(sk), NF_CT_DEFAULT_ZONE, &tuple);
-        if (!h) {
-                pr_debug("IP6T_SO_ORIGINAL_DST: Can't find %pI6c/%u-%pI6c/%u.\n",
-                         &tuple.src.u3.ip6, ntohs(tuple.src.u.tcp.port),
-                         &tuple.dst.u3.ip6, ntohs(tuple.dst.u.tcp.port));
-                return -ENOENT;
-        }
-
-        ct = nf_ct_tuplehash_to_ctrack(h);
-
-        sin6.sin6_family = AF_INET6;
-        sin6.sin6_port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
-        sin6.sin6_flowinfo = inet6->flow_label & IPV6_FLOWINFO_MASK;
-        memcpy(&sin6.sin6_addr,
-                &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6,
-                                        sizeof(sin6.sin6_addr));
-
-        nf_ct_put(ct);
-
-        if (ipv6_addr_type(&sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL)
-                sin6.sin6_scope_id = sk->sk_bound_dev_if;
-        else
-                sin6.sin6_scope_id = 0;
-
-        return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0;
-}
-
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
@@ -353,11 +278,10 @@ ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
 static int ipv6_tuple_to_nlattr(struct sk_buff *skb,
                                 const struct nf_conntrack_tuple *tuple)
 {
-        if (nla_put(skb, CTA_IP_V6_SRC, sizeof(u_int32_t) * 4,
-                    &tuple->src.u3.ip6) ||
-            nla_put(skb, CTA_IP_V6_DST, sizeof(u_int32_t) * 4,
-                    &tuple->dst.u3.ip6))
-                goto nla_put_failure;
+        NLA_PUT(skb, CTA_IP_V6_SRC, sizeof(u_int32_t) * 4,
+                &tuple->src.u3.ip6);
+        NLA_PUT(skb, CTA_IP_V6_DST, sizeof(u_int32_t) * 4,
+                &tuple->dst.u3.ip6);
         return 0;
 
 nla_put_failure:
@@ -396,7 +320,7 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = {
         .invert_tuple           = ipv6_invert_tuple,
         .print_tuple            = ipv6_print_tuple,
         .get_l4proto            = ipv6_get_l4proto,
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
         .tuple_to_nlattr        = ipv6_tuple_to_nlattr,
         .nlattr_tuple_size      = ipv6_nlattr_tuple_size,
         .nlattr_to_tuple        = ipv6_nlattr_to_tuple,
@@ -409,89 +333,37 @@ MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET6));
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Yasuyuki KOZAKAI @USAGI <yasuyuki.kozakai@toshiba.co.jp>");
 
-static struct nf_sockopt_ops so_getorigdst6 = {
-        .pf             = NFPROTO_IPV6,
-        .get_optmin     = IP6T_SO_ORIGINAL_DST,
-        .get_optmax     = IP6T_SO_ORIGINAL_DST + 1,
-        .get            = ipv6_getorigdst,
-        .owner          = THIS_MODULE,
-};
-
-static int ipv6_net_init(struct net *net)
+static int __init nf_conntrack_l3proto_ipv6_init(void)
 {
         int ret = 0;
 
-        ret = nf_conntrack_l4proto_register(net,
-                                            &nf_conntrack_l4proto_tcp6);
-        if (ret < 0) {
-                printk(KERN_ERR "nf_conntrack_l4proto_tcp6: protocol register failed\n");
-                goto out;
-        }
-        ret = nf_conntrack_l4proto_register(net,
-                                            &nf_conntrack_l4proto_udp6);
+        need_conntrack();
+        nf_defrag_ipv6_enable();
+
+        ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_tcp6);
         if (ret < 0) {
-                printk(KERN_ERR "nf_conntrack_l4proto_udp6: protocol register failed\n");
-                goto cleanup_tcp6;
+                pr_err("nf_conntrack_ipv6: can't register tcp.\n");
+                return ret;
         }
-        ret = nf_conntrack_l4proto_register(net,
-                                            &nf_conntrack_l4proto_icmpv6);
+
+        ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udp6);
         if (ret < 0) {
-                printk(KERN_ERR "nf_conntrack_l4proto_icmp6: protocol register failed\n");
-                goto cleanup_udp6;
+                pr_err("nf_conntrack_ipv6: can't register udp.\n");
+                goto cleanup_tcp;
         }
-        ret = nf_conntrack_l3proto_register(net,
-                                            &nf_conntrack_l3proto_ipv6);
+
+        ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_icmpv6);
         if (ret < 0) {
-                printk(KERN_ERR "nf_conntrack_l3proto_ipv6: protocol register failed\n");
-                goto cleanup_icmpv6;
+                pr_err("nf_conntrack_ipv6: can't register icmpv6.\n");
+                goto cleanup_udp;
         }
-        return 0;
- cleanup_icmpv6:
-        nf_conntrack_l4proto_unregister(net,
-                                        &nf_conntrack_l4proto_icmpv6);
- cleanup_udp6:
-        nf_conntrack_l4proto_unregister(net,
-                                        &nf_conntrack_l4proto_udp6);
- cleanup_tcp6:
-        nf_conntrack_l4proto_unregister(net,
-                                        &nf_conntrack_l4proto_tcp6);
- out:
-        return ret;
-}
-
-static void ipv6_net_exit(struct net *net)
-{
-        nf_conntrack_l3proto_unregister(net,
-                                        &nf_conntrack_l3proto_ipv6);
-        nf_conntrack_l4proto_unregister(net,
-                                        &nf_conntrack_l4proto_icmpv6);
-        nf_conntrack_l4proto_unregister(net,
-                                        &nf_conntrack_l4proto_udp6);
-        nf_conntrack_l4proto_unregister(net,
-                                        &nf_conntrack_l4proto_tcp6);
-}
-
-static struct pernet_operations ipv6_net_ops = {
-        .init = ipv6_net_init,
-        .exit = ipv6_net_exit,
-};
-
-static int __init nf_conntrack_l3proto_ipv6_init(void)
-{
-        int ret = 0;
-
-        need_conntrack();
-        nf_defrag_ipv6_enable();
 
-        ret = nf_register_sockopt(&so_getorigdst6);
+        ret = nf_conntrack_l3proto_register(&nf_conntrack_l3proto_ipv6);
         if (ret < 0) {
-                pr_err("Unable to register netfilter socket option\n");
-                return ret;
+                pr_err("nf_conntrack_ipv6: can't register ipv6\n");
+                goto cleanup_icmpv6;
         }
 
-        ret = register_pernet_subsys(&ipv6_net_ops);
-        if (ret < 0)
-                goto cleanup_pernet;
         ret = nf_register_hooks(ipv6_conntrack_ops,
                                 ARRAY_SIZE(ipv6_conntrack_ops));
         if (ret < 0) {
@@ -502,9 +374,13 @@ static int __init nf_conntrack_l3proto_ipv6_init(void)
         return ret;
 
  cleanup_ipv6:
-        unregister_pernet_subsys(&ipv6_net_ops);
- cleanup_pernet:
-        nf_unregister_sockopt(&so_getorigdst6);
+        nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
+ cleanup_icmpv6:
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
+ cleanup_udp:
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp6);
+ cleanup_tcp:
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
         return ret;
 }
 
@@ -512,8 +388,10 @@ static void __exit nf_conntrack_l3proto_ipv6_fini(void)
 {
         synchronize_net();
         nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
-        unregister_pernet_subsys(&ipv6_net_ops);
-        nf_unregister_sockopt(&so_getorigdst6);
+        nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp6);
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
 }
 
 module_init(nf_conntrack_l3proto_ipv6_init);
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 24df3dde007..7c05e7eacbc 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -29,11 +29,6 @@
 
 static unsigned int nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
 
-static inline struct nf_icmp_net *icmpv6_pernet(struct net *net)
-{
-        return &net->ct.nf_ct_proto.icmpv6;
-}
-
 static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
                                 unsigned int dataoff,
                                 struct nf_conntrack_tuple *tuple)
@@ -93,31 +88,25 @@ static int icmpv6_print_tuple(struct seq_file *s,
                           ntohs(tuple->src.u.icmp.id));
 }
 
-static unsigned int *icmpv6_get_timeouts(struct net *net)
-{
-        return &icmpv6_pernet(net)->timeout;
-}
-
 /* Returns verdict for packet, or -1 for invalid. */
 static int icmpv6_packet(struct nf_conn *ct,
                        const struct sk_buff *skb,
                        unsigned int dataoff,
                        enum ip_conntrack_info ctinfo,
                        u_int8_t pf,
-                       unsigned int hooknum,
-                       unsigned int *timeout)
+                       unsigned int hooknum)
 {
         /* Do not immediately delete the connection after the first
            successful reply to avoid excessive conntrackd traffic
            and also to handle correctly ICMP echo reply duplicates. */
-        nf_ct_refresh_acct(ct, ctinfo, skb, *timeout);
+        nf_ct_refresh_acct(ct, ctinfo, skb, nf_ct_icmpv6_timeout);
 
         return NF_ACCEPT;
 }
 
 /* Called when a new connection for this protocol found. */
 static bool icmpv6_new(struct nf_conn *ct, const struct sk_buff *skb,
-                       unsigned int dataoff, unsigned int *timeouts)
+                       unsigned int dataoff)
 {
         static const u_int8_t valid_new[] = {
                 [ICMPV6_ECHO_REQUEST - 128] = 1,
@@ -232,17 +221,17 @@ icmpv6_error(struct net *net, struct nf_conn *tmpl,
         return icmpv6_error_message(net, tmpl, skb, dataoff, ctinfo, hooknum);
 }
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
 
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 static int icmpv6_tuple_to_nlattr(struct sk_buff *skb,
                                   const struct nf_conntrack_tuple *t)
 {
-        if (nla_put_be16(skb, CTA_PROTO_ICMPV6_ID, t->src.u.icmp.id) ||
-            nla_put_u8(skb, CTA_PROTO_ICMPV6_TYPE, t->dst.u.icmp.type) ||
-            nla_put_u8(skb, CTA_PROTO_ICMPV6_CODE, t->dst.u.icmp.code))
-                goto nla_put_failure;
+        NLA_PUT_BE16(skb, CTA_PROTO_ICMPV6_ID, t->src.u.icmp.id);
+        NLA_PUT_U8(skb, CTA_PROTO_ICMPV6_TYPE, t->dst.u.icmp.type);
+        NLA_PUT_U8(skb, CTA_PROTO_ICMPV6_CODE, t->dst.u.icmp.code);
+
         return 0;
 
 nla_put_failure:
@@ -281,50 +270,12 @@ static int icmpv6_nlattr_tuple_size(void)
 }
 #endif
 
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
-
-#include <linux/netfilter/nfnetlink.h>
-#include <linux/netfilter/nfnetlink_cttimeout.h>
-
-static int icmpv6_timeout_nlattr_to_obj(struct nlattr *tb[],
-                                        struct net *net, void *data)
-{
-        unsigned int *timeout = data;
-        struct nf_icmp_net *in = icmpv6_pernet(net);
-
-        if (tb[CTA_TIMEOUT_ICMPV6_TIMEOUT]) {
-                *timeout =
-                    ntohl(nla_get_be32(tb[CTA_TIMEOUT_ICMPV6_TIMEOUT])) * HZ;
-        } else {
-                /* Set default ICMPv6 timeout. */
-                *timeout = in->timeout;
-        }
-        return 0;
-}
-
-static int
-icmpv6_timeout_obj_to_nlattr(struct sk_buff *skb, const void *data)
-{
-        const unsigned int *timeout = data;
-
-        if (nla_put_be32(skb, CTA_TIMEOUT_ICMPV6_TIMEOUT, htonl(*timeout / HZ)))
-                goto nla_put_failure;
-        return 0;
-
-nla_put_failure:
-        return -ENOSPC;
-}
-
-static const struct nla_policy
-icmpv6_timeout_nla_policy[CTA_TIMEOUT_ICMPV6_MAX+1] = {
-        [CTA_TIMEOUT_ICMPV6_TIMEOUT]    = { .type = NLA_U32 },
-};
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
-
 #ifdef CONFIG_SYSCTL
+static struct ctl_table_header *icmpv6_sysctl_header;
 static struct ctl_table icmpv6_sysctl_table[] = {
         {
                 .procname       = "nf_conntrack_icmpv6_timeout",
+                .data           = &nf_ct_icmpv6_timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
@@ -333,36 +284,6 @@ static struct ctl_table icmpv6_sysctl_table[] = {
 };
 #endif /* CONFIG_SYSCTL */
 
-static int icmpv6_kmemdup_sysctl_table(struct nf_proto_net *pn,
-                                       struct nf_icmp_net *in)
-{
-#ifdef CONFIG_SYSCTL
-        pn->ctl_table = kmemdup(icmpv6_sysctl_table,
-                                sizeof(icmpv6_sysctl_table),
-                                GFP_KERNEL);
-        if (!pn->ctl_table)
-                return -ENOMEM;
-
-        pn->ctl_table[0].data = &in->timeout;
-#endif
-        return 0;
-}
-
-static int icmpv6_init_net(struct net *net, u_int16_t proto)
-{
-        struct nf_icmp_net *in = icmpv6_pernet(net);
-        struct nf_proto_net *pn = &in->pn;
-
-        in->timeout = nf_ct_icmpv6_timeout;
-
-        return icmpv6_kmemdup_sysctl_table(pn, in);
-}
-
-static struct nf_proto_net *icmpv6_get_net_proto(struct net *net)
-{
-        return &net->ct.nf_ct_proto.icmpv6.pn;
-}
-
 struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 __read_mostly =
 {
         .l3proto                = PF_INET6,
@@ -372,24 +293,16 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 __read_mostly =
         .invert_tuple           = icmpv6_invert_tuple,
         .print_tuple            = icmpv6_print_tuple,
         .packet                 = icmpv6_packet,
-        .get_timeouts           = icmpv6_get_timeouts,
         .new                    = icmpv6_new,
         .error                  = icmpv6_error,
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
+#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
         .tuple_to_nlattr        = icmpv6_tuple_to_nlattr,
         .nlattr_tuple_size      = icmpv6_nlattr_tuple_size,
         .nlattr_to_tuple        = icmpv6_nlattr_to_tuple,
         .nla_policy             = icmpv6_nla_policy,
 #endif
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK_TIMEOUT)
-        .ctnl_timeout           = {
-                .nlattr_to_obj  = icmpv6_timeout_nlattr_to_obj,
-                .obj_to_nlattr  = icmpv6_timeout_obj_to_nlattr,
-                .nlattr_max     = CTA_TIMEOUT_ICMP_MAX,
-                .obj_size       = sizeof(unsigned int),
-                .nla_policy     = icmpv6_timeout_nla_policy,
-        },
-#endif /* CONFIG_NF_CT_NETLINK_TIMEOUT */
-        .init_net               = icmpv6_init_net,
-        .get_net_proto          = icmpv6_get_net_proto,
+#ifdef CONFIG_SYSCTL
+        .ctl_table_header       = &icmpv6_sysctl_header,
+        .ctl_table              = icmpv6_sysctl_table,
+#endif
 };
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 3dacecc9906..08572726381 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -57,27 +57,41 @@ struct nf_ct_frag6_skb_cb
 
 #define NFCT_FRAG6_CB(skb)      ((struct nf_ct_frag6_skb_cb*)((skb)->cb))
 
+struct nf_ct_frag6_queue
+{
+        struct inet_frag_queue  q;
+
+        __be32                  id;             /* fragment id          */
+        u32                     user;
+        struct in6_addr         saddr;
+        struct in6_addr         daddr;
+
+        unsigned int            csum;
+        __u16                   nhoffset;
+};
+
 static struct inet_frags nf_frags;
+static struct netns_frags nf_init_frags;
 
 #ifdef CONFIG_SYSCTL
 static struct ctl_table nf_ct_frag6_sysctl_table[] = {
         {
                 .procname       = "nf_conntrack_frag6_timeout",
-                .data           = &init_net.nf_frag.frags.timeout,
+                .data           = &nf_init_frags.timeout,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_jiffies,
         },
         {
                 .procname       = "nf_conntrack_frag6_low_thresh",
-                .data           = &init_net.nf_frag.frags.low_thresh,
+                .data           = &nf_init_frags.low_thresh,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
         {
                 .procname       = "nf_conntrack_frag6_high_thresh",
-                .data           = &init_net.nf_frag.frags.high_thresh,
+                .data           = &nf_init_frags.high_thresh,
                 .maxlen         = sizeof(unsigned int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
@@ -85,86 +99,68 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = {
         { }
 };
 
-static int nf_ct_frag6_sysctl_register(struct net *net)
-{
-        struct ctl_table *table;
-        struct ctl_table_header *hdr;
-
-        table = nf_ct_frag6_sysctl_table;
-        if (!net_eq(net, &init_net)) {
-                table = kmemdup(table, sizeof(nf_ct_frag6_sysctl_table),
-                                GFP_KERNEL);
-                if (table == NULL)
-                        goto err_alloc;
-
-                table[0].data = &net->ipv6.frags.high_thresh;
-                table[1].data = &net->ipv6.frags.low_thresh;
-                table[2].data = &net->ipv6.frags.timeout;
-        }
-
-        hdr = register_net_sysctl(net, "net/netfilter", table);
-        if (hdr == NULL)
-                goto err_reg;
-
-        net->nf_frag.sysctl.frags_hdr = hdr;
-        return 0;
-
-err_reg:
-        if (!net_eq(net, &init_net))
-                kfree(table);
-err_alloc:
-        return -ENOMEM;
-}
+static struct ctl_table_header *nf_ct_frag6_sysctl_header;
+#endif
 
-static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
+static unsigned int nf_hashfn(struct inet_frag_queue *q)
 {
-        struct ctl_table *table;
+        const struct nf_ct_frag6_queue *nq;
 
-        table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg;
-        unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr);
-        if (!net_eq(net, &init_net))
-                kfree(table);
+        nq = container_of(q, struct nf_ct_frag6_queue, q);
+        return inet6_hash_frag(nq->id, &nq->saddr, &nq->daddr, nf_frags.rnd);
 }
 
-#else
-static int nf_ct_frag6_sysctl_register(struct net *net)
+static void nf_skb_free(struct sk_buff *skb)
 {
-        return 0;
+        if (NFCT_FRAG6_CB(skb)->orig)
+                kfree_skb(NFCT_FRAG6_CB(skb)->orig);
 }
-static void __net_exit nf_ct_frags6_sysctl_unregister(struct net *net)
+
+/* Destruction primitives. */
+
+static __inline__ void fq_put(struct nf_ct_frag6_queue *fq)
 {
+        inet_frag_put(&fq->q, &nf_frags);
 }
-#endif
 
-static unsigned int nf_hashfn(struct inet_frag_queue *q)
+/* Kill fq entry. It is not destroyed immediately,
+ * because caller (and someone more) holds reference count.
+ */
+static __inline__ void fq_kill(struct nf_ct_frag6_queue *fq)
 {
-        const struct frag_queue *nq;
-
-        nq = container_of(q, struct frag_queue, q);
-        return inet6_hash_frag(nq->id, &nq->saddr, &nq->daddr, nf_frags.rnd);
+        inet_frag_kill(&fq->q, &nf_frags);
 }
 
-static void nf_skb_free(struct sk_buff *skb)
+static void nf_ct_frag6_evictor(void)
 {
-        if (NFCT_FRAG6_CB(skb)->orig)
-                kfree_skb(NFCT_FRAG6_CB(skb)->orig);
+        local_bh_disable();
+        inet_frag_evictor(&nf_init_frags, &nf_frags);
+        local_bh_enable();
 }
 
 static void nf_ct_frag6_expire(unsigned long data)
 {
-        struct frag_queue *fq;
-        struct net *net;
+        struct nf_ct_frag6_queue *fq;
 
-        fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);
-        net = container_of(fq->q.net, struct net, nf_frag.frags);
+        fq = container_of((struct inet_frag_queue *)data,
+                        struct nf_ct_frag6_queue, q);
 
-        ip6_expire_frag_queue(net, fq, &nf_frags);
+        spin_lock(&fq->q.lock);
+
+        if (fq->q.last_in & INET_FRAG_COMPLETE)
+                goto out;
+
+        fq_kill(fq);
+
+out:
+        spin_unlock(&fq->q.lock);
+        fq_put(fq);
 }
 
 /* Creation primitives. */
-static inline struct frag_queue *fq_find(struct net *net, __be32 id,
-                                         u32 user, struct in6_addr *src,
-                                         struct in6_addr *dst)
+
+static __inline__ struct nf_ct_frag6_queue *
+fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
 {
         struct inet_frag_queue *q;
         struct ip6_create_arg arg;
@@ -178,23 +174,23 @@ static inline struct frag_queue *fq_find(struct net *net, __be32 id,
         read_lock_bh(&nf_frags.lock);
         hash = inet6_hash_frag(id, src, dst, nf_frags.rnd);
 
-        q = inet_frag_find(&net->nf_frag.frags, &nf_frags, &arg, hash);
+        q = inet_frag_find(&nf_init_frags, &nf_frags, &arg, hash);
         local_bh_enable();
         if (q == NULL)
                 goto oom;
 
-        return container_of(q, struct frag_queue, q);
+        return container_of(q, struct nf_ct_frag6_queue, q);
 
 oom:
+        pr_debug("Can't alloc new queue\n");
         return NULL;
 }
 
 
-static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
+static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                              const struct frag_hdr *fhdr, int nhoff)
 {
         struct sk_buff *prev, *next;
-        unsigned int payload_len;
         int offset, end;
 
         if (fq->q.last_in & INET_FRAG_COMPLETE) {
@@ -202,10 +198,8 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb,
                 goto err;
         }
 
-        payload_len = ntohs(ipv6_hdr(skb)->payload_len);
-
         offset = ntohs(fhdr->frag_off) & ~0x7;
-        end = offset + (payload_len -
+        end = offset + (ntohs(ipv6_hdr(skb)->payload_len) -
                         ((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
 
         if ((unsigned int)end > IPV6_MAXPLEN) {
@@ -311,15 +305,10 @@ found:
         else
                 fq->q.fragments = skb;
 
-        if (skb->dev) {
-                fq->iif = skb->dev->ifindex;
-                skb->dev = NULL;
-        }
+        skb->dev = NULL;
         fq->q.stamp = skb->tstamp;
         fq->q.meat += skb->len;
-        if (payload_len > fq->q.max_size)
-                fq->q.max_size = payload_len;
-        atomic_add(skb->truesize, &fq->q.net->mem);
+        atomic_add(skb->truesize, &nf_init_frags.mem);
 
         /* The first fragment.
          * nhoffset is obtained from the first fragment, of course.
@@ -329,12 +318,12 @@ found:
                 fq->q.last_in |= INET_FRAG_FIRST_IN;
         }
         write_lock(&nf_frags.lock);
-        list_move_tail(&fq->q.lru_list, &fq->q.net->lru_list);
+        list_move_tail(&fq->q.lru_list, &nf_init_frags.lru_list);
         write_unlock(&nf_frags.lock);
         return 0;
 
 discard_fq:
-        inet_frag_kill(&fq->q, &nf_frags);
+        fq_kill(fq);
 err:
         return -1;
 }
@@ -349,12 +338,12 @@ err:
  *      the last and the first frames arrived and all the bits are here.
  */
 static struct sk_buff *
-nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
+nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
 {
         struct sk_buff *fp, *op, *head = fq->q.fragments;
         int    payload_len;
 
-        inet_frag_kill(&fq->q, &nf_frags);
+        fq_kill(fq);
 
         WARN_ON(head == NULL);
         WARN_ON(NFCT_FRAG6_CB(head)->offset != 0);
@@ -381,16 +370,16 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
                 struct sk_buff *clone;
                 int i, plen = 0;
 
-                clone = alloc_skb(0, GFP_ATOMIC);
-                if (clone == NULL)
+                if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL) {
+                        pr_debug("Can't alloc skb\n");
                         goto out_oom;
-
+                }
                 clone->next = head->next;
                 head->next = clone;
                 skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
                 skb_frag_list_init(head);
-                for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
-                        plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
+                for (i=0; i<skb_shinfo(head)->nr_frags; i++)
+                        plen += skb_shinfo(head)->frags[i].size;
                 clone->len = clone->data_len = head->data_len - plen;
                 head->data_len -= clone->len;
                 head->len -= clone->len;
@@ -398,7 +387,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
                 clone->ip_summed = head->ip_summed;
 
                 NFCT_FRAG6_CB(clone)->orig = NULL;
-                atomic_add(clone->truesize, &fq->q.net->mem);
+                atomic_add(clone->truesize, &nf_init_frags.mem);
         }
 
         /* We have to remove fragment header from datagram and to relocate
@@ -422,14 +411,12 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
                         head->csum = csum_add(head->csum, fp->csum);
                 head->truesize += fp->truesize;
         }
-        atomic_sub(head->truesize, &fq->q.net->mem);
+        atomic_sub(head->truesize, &nf_init_frags.mem);
 
-        head->local_df = 1;
         head->next = NULL;
         head->dev = dev;
         head->tstamp = fq->q.stamp;
         ipv6_hdr(head)->payload_len = htons(payload_len);
-        IP6CB(head)->frag_max_size = sizeof(struct ipv6hdr) + fq->q.max_size;
 
         /* Yes, and fold redundant checksum back. 8) */
         if (head->ip_summed == CHECKSUM_COMPLETE)
@@ -458,11 +445,12 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
         return head;
 
 out_oversize:
-        net_dbg_ratelimited("nf_ct_frag6_reasm: payload len = %d\n",
-                            payload_len);
+        if (net_ratelimit())
+                printk(KERN_DEBUG "nf_ct_frag6_reasm: payload len = %d\n", payload_len);
         goto out_fail;
 out_oom:
-        net_dbg_ratelimited("nf_ct_frag6_reasm: no memory for reassembly\n");
+        if (net_ratelimit())
+                printk(KERN_DEBUG "nf_ct_frag6_reasm: no memory for reassembly\n");
 out_fail:
         return NULL;
 }
@@ -534,10 +522,8 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
 {
         struct sk_buff *clone;
         struct net_device *dev = skb->dev;
-        struct net *net = skb_dst(skb) ? dev_net(skb_dst(skb)->dev)
-                                       : dev_net(skb->dev);
         struct frag_hdr *fhdr;
-        struct frag_queue *fq;
+        struct nf_ct_frag6_queue *fq;
         struct ipv6hdr *hdr;
         int fhoff, nhoff;
         u8 prevhdr;
@@ -569,11 +555,10 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
         hdr = ipv6_hdr(clone);
         fhdr = (struct frag_hdr *)skb_transport_header(clone);
 
-        local_bh_disable();
-        inet_frag_evictor(&net->nf_frag.frags, &nf_frags, false);
-        local_bh_enable();
+        if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh)
+                nf_ct_frag6_evictor();
 
-        fq = fq_find(net, fhdr->identification, user, &hdr->saddr, &hdr->daddr);
+        fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr);
         if (fq == NULL) {
                 pr_debug("Can't find and can't create new queue\n");
                 goto ret_orig;
@@ -584,7 +569,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
         if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
                 spin_unlock_bh(&fq->q.lock);
                 pr_debug("Can't insert skb to queue\n");
-                inet_frag_put(&fq->q, &nf_frags);
+                fq_put(fq);
                 goto ret_orig;
         }
 
@@ -596,7 +581,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
         }
         spin_unlock_bh(&fq->q.lock);
 
-        inet_frag_put(&fq->q, &nf_frags);
+        fq_put(fq);
         return ret_skb;
 
 ret_orig:
@@ -609,7 +594,6 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
                         int (*okfn)(struct sk_buff *))
 {
         struct sk_buff *s, *s2;
-        unsigned int ret = 0;
 
         for (s = NFCT_FRAG6_CB(skb)->orig; s;) {
                 nf_conntrack_put_reasm(s->nfct_reasm);
@@ -619,62 +603,49 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
                 s2 = s->next;
                 s->next = NULL;
 
-                if (ret != -ECANCELED)
-                        ret = NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, s,
-                                             in, out, okfn,
-                                             NF_IP6_PRI_CONNTRACK_DEFRAG + 1);
-                else
-                        kfree_skb(s);
-
+                NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, s, in, out, okfn,
+                               NF_IP6_PRI_CONNTRACK_DEFRAG + 1);
                 s = s2;
         }
         nf_conntrack_put_reasm(skb);
 }
 
-static int nf_ct_net_init(struct net *net)
-{
-        net->nf_frag.frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
-        net->nf_frag.frags.low_thresh = IPV6_FRAG_LOW_THRESH;
-        net->nf_frag.frags.timeout = IPV6_FRAG_TIMEOUT;
-        inet_frags_init_net(&net->nf_frag.frags);
-
-        return nf_ct_frag6_sysctl_register(net);
-}
-
-static void nf_ct_net_exit(struct net *net)
-{
-        nf_ct_frags6_sysctl_unregister(net);
-        inet_frags_exit_net(&net->nf_frag.frags, &nf_frags);
-}
-
-static struct pernet_operations nf_ct_net_ops = {
-        .init = nf_ct_net_init,
-        .exit = nf_ct_net_exit,
-};
-
 int nf_ct_frag6_init(void)
 {
-        int ret = 0;
-
         nf_frags.hashfn = nf_hashfn;
         nf_frags.constructor = ip6_frag_init;
         nf_frags.destructor = NULL;
         nf_frags.skb_free = nf_skb_free;
-        nf_frags.qsize = sizeof(struct frag_queue);
+        nf_frags.qsize = sizeof(struct nf_ct_frag6_queue);
         nf_frags.match = ip6_frag_match;
         nf_frags.frag_expire = nf_ct_frag6_expire;
         nf_frags.secret_interval = 10 * 60 * HZ;
+        nf_init_frags.timeout = IPV6_FRAG_TIMEOUT;
+        nf_init_frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
+        nf_init_frags.low_thresh = IPV6_FRAG_LOW_THRESH;
+        inet_frags_init_net(&nf_init_frags);
         inet_frags_init(&nf_frags);
 
-        ret = register_pernet_subsys(&nf_ct_net_ops);
-        if (ret)
+#ifdef CONFIG_SYSCTL
+        nf_ct_frag6_sysctl_header = register_sysctl_paths(nf_net_netfilter_sysctl_path,
+                                                          nf_ct_frag6_sysctl_table);
+        if (!nf_ct_frag6_sysctl_header) {
                 inet_frags_fini(&nf_frags);
+                return -ENOMEM;
+        }
+#endif
 
-        return ret;
+        return 0;
 }
 
 void nf_ct_frag6_cleanup(void)
 {
-        unregister_pernet_subsys(&nf_ct_net_ops);
+#ifdef CONFIG_SYSCTL
+        unregister_sysctl_table(nf_ct_frag6_sysctl_header);
+        nf_ct_frag6_sysctl_header = NULL;
+#endif
         inet_frags_fini(&nf_frags);
+
+        nf_init_frags.low_thresh = 0;
+        nf_ct_frag6_evictor();
 }
diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
index aacd121fe8c..cdd6d045e42 100644
--- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
+++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
@@ -19,7 +19,7 @@
 
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter_bridge.h>
-#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
@@ -35,7 +35,7 @@ static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
 {
         u16 zone = NF_CT_DEFAULT_ZONE;
 
-#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
         if (skb->nfct)
                 zone = nf_ct_zone((struct nf_conn *)skb->nfct);
 #endif
@@ -60,7 +60,7 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
 {
         struct sk_buff *reasm;
 
-#if IS_ENABLED(CONFIG_NF_CONNTRACK)
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
         /* Previously seen (loopback)?  */
         if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
                 return NF_ACCEPT;
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
deleted file mode 100644
index abfe75a2e31..00000000000
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ /dev/null
@@ -1,288 +0,0 @@
-/*
- * Copyright (c) 2011 Patrick McHardy <kaber@trash.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * Development of IPv6 NAT funded by Astaro.
- */
-#include <linux/types.h>
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ipv6.h>
-#include <linux/netfilter.h>
-#include <linux/netfilter_ipv6.h>
-#include <net/secure_seq.h>
-#include <net/checksum.h>
-#include <net/ip6_checksum.h>
-#include <net/ip6_route.h>
-#include <net/ipv6.h>
-
-#include <net/netfilter/nf_conntrack_core.h>
-#include <net/netfilter/nf_conntrack.h>
-#include <net/netfilter/nf_nat_core.h>
-#include <net/netfilter/nf_nat_l3proto.h>
-#include <net/netfilter/nf_nat_l4proto.h>
-
-static const struct nf_nat_l3proto nf_nat_l3proto_ipv6;
-
-#ifdef CONFIG_XFRM
-static void nf_nat_ipv6_decode_session(struct sk_buff *skb,
-                                       const struct nf_conn *ct,
-                                       enum ip_conntrack_dir dir,
-                                       unsigned long statusbit,
-                                       struct flowi *fl)
-{
-        const struct nf_conntrack_tuple *t = &ct->tuplehash[dir].tuple;
-        struct flowi6 *fl6 = &fl->u.ip6;
-
-        if (ct->status & statusbit) {
-                fl6->daddr = t->dst.u3.in6;
-                if (t->dst.protonum == IPPROTO_TCP ||
-                    t->dst.protonum == IPPROTO_UDP ||
-                    t->dst.protonum == IPPROTO_UDPLITE ||
-                    t->dst.protonum == IPPROTO_DCCP ||
-                    t->dst.protonum == IPPROTO_SCTP)
-                        fl6->fl6_dport = t->dst.u.all;
-        }
-
-        statusbit ^= IPS_NAT_MASK;
-
-        if (ct->status & statusbit) {
-                fl6->saddr = t->src.u3.in6;
-                if (t->dst.protonum == IPPROTO_TCP ||
-                    t->dst.protonum == IPPROTO_UDP ||
-                    t->dst.protonum == IPPROTO_UDPLITE ||
-                    t->dst.protonum == IPPROTO_DCCP ||
-                    t->dst.protonum == IPPROTO_SCTP)
-                        fl6->fl6_sport = t->src.u.all;
-        }
-}
-#endif
-
-static bool nf_nat_ipv6_in_range(const struct nf_conntrack_tuple *t,
-                                 const struct nf_nat_range *range)
-{
-        return ipv6_addr_cmp(&t->src.u3.in6, &range->min_addr.in6) >= 0 &&
-               ipv6_addr_cmp(&t->src.u3.in6, &range->max_addr.in6) <= 0;
-}
-
-static u32 nf_nat_ipv6_secure_port(const struct nf_conntrack_tuple *t,
-                                   __be16 dport)
-{
-        return secure_ipv6_port_ephemeral(t->src.u3.ip6, t->dst.u3.ip6, dport);
-}
-
-static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb,
-                                  unsigned int iphdroff,
-                                  const struct nf_nat_l4proto *l4proto,
-                                  const struct nf_conntrack_tuple *target,
-                                  enum nf_nat_manip_type maniptype)
-{
-        struct ipv6hdr *ipv6h;
-        __be16 frag_off;
-        int hdroff;
-        u8 nexthdr;
-
-        if (!skb_make_writable(skb, iphdroff + sizeof(*ipv6h)))
-                return false;
-
-        ipv6h = (void *)skb->data + iphdroff;
-        nexthdr = ipv6h->nexthdr;
-        hdroff = ipv6_skip_exthdr(skb, iphdroff + sizeof(*ipv6h),
-                                  &nexthdr, &frag_off);
-        if (hdroff < 0)
-                goto manip_addr;
-
-        if ((frag_off & htons(~0x7)) == 0 &&
-            !l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv6, iphdroff, hdroff,
-                                target, maniptype))
-                return false;
-manip_addr:
-        if (maniptype == NF_NAT_MANIP_SRC)
-                ipv6h->saddr = target->src.u3.in6;
-        else
-                ipv6h->daddr = target->dst.u3.in6;
-
-        return true;
-}
-
-static void nf_nat_ipv6_csum_update(struct sk_buff *skb,
-                                    unsigned int iphdroff, __sum16 *check,
-                                    const struct nf_conntrack_tuple *t,
-                                    enum nf_nat_manip_type maniptype)
-{
-        const struct ipv6hdr *ipv6h = (struct ipv6hdr *)(skb->data + iphdroff);
-        const struct in6_addr *oldip, *newip;
-
-        if (maniptype == NF_NAT_MANIP_SRC) {
-                oldip = &ipv6h->saddr;
-                newip = &t->src.u3.in6;
-        } else {
-                oldip = &ipv6h->daddr;
-                newip = &t->dst.u3.in6;
-        }
-        inet_proto_csum_replace16(check, skb, oldip->s6_addr32,
-                                  newip->s6_addr32, 1);
-}
-
-static void nf_nat_ipv6_csum_recalc(struct sk_buff *skb,
-                                    u8 proto, void *data, __sum16 *check,
-                                    int datalen, int oldlen)
-{
-        const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
-        struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
-
-        if (skb->ip_summed != CHECKSUM_PARTIAL) {
-                if (!(rt->rt6i_flags & RTF_LOCAL) &&
-                    (!skb->dev || skb->dev->features & NETIF_F_V6_CSUM)) {
-                        skb->ip_summed = CHECKSUM_PARTIAL;
-                        skb->csum_start = skb_headroom(skb) +
-                                          skb_network_offset(skb) +
-                                          (data - (void *)skb->data);
-                        skb->csum_offset = (void *)check - data;
-                        *check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
-                                                  datalen, proto, 0);
-                } else {
-                        *check = 0;
-                        *check = csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
-                                                 datalen, proto,
-                                                 csum_partial(data, datalen,
-                                                              0));
-                        if (proto == IPPROTO_UDP && !*check)
-                                *check = CSUM_MANGLED_0;
-                }
-        } else
-                inet_proto_csum_replace2(check, skb,
-                                         htons(oldlen), htons(datalen), 1);
-}
-
-static int nf_nat_ipv6_nlattr_to_range(struct nlattr *tb[],
-                                       struct nf_nat_range *range)
-{
-        if (tb[CTA_NAT_V6_MINIP]) {
-                nla_memcpy(&range->min_addr.ip6, tb[CTA_NAT_V6_MINIP],
-                           sizeof(struct in6_addr));
-                range->flags |= NF_NAT_RANGE_MAP_IPS;
-        }
-
-        if (tb[CTA_NAT_V6_MAXIP])
-                nla_memcpy(&range->max_addr.ip6, tb[CTA_NAT_V6_MAXIP],
-                           sizeof(struct in6_addr));
-        else
-                range->max_addr = range->min_addr;
-
-        return 0;
-}
-
-static const struct nf_nat_l3proto nf_nat_l3proto_ipv6 = {
-        .l3proto                = NFPROTO_IPV6,
-        .secure_port            = nf_nat_ipv6_secure_port,
-        .in_range               = nf_nat_ipv6_in_range,
-        .manip_pkt              = nf_nat_ipv6_manip_pkt,
-        .csum_update            = nf_nat_ipv6_csum_update,
-        .csum_recalc            = nf_nat_ipv6_csum_recalc,
-        .nlattr_to_range        = nf_nat_ipv6_nlattr_to_range,
-#ifdef CONFIG_XFRM
-        .decode_session = nf_nat_ipv6_decode_session,
-#endif
-};
-
-int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
-                                    struct nf_conn *ct,
-                                    enum ip_conntrack_info ctinfo,
-                                    unsigned int hooknum,
-                                    unsigned int hdrlen)
-{
-        struct {
-                struct icmp6hdr icmp6;
-                struct ipv6hdr  ip6;
-        } *inside;
-        enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
-        enum nf_nat_manip_type manip = HOOK2MANIP(hooknum);
-        const struct nf_nat_l4proto *l4proto;
-        struct nf_conntrack_tuple target;
-        unsigned long statusbit;
-
-        NF_CT_ASSERT(ctinfo == IP_CT_RELATED || ctinfo == IP_CT_RELATED_REPLY);
-
-        if (!skb_make_writable(skb, hdrlen + sizeof(*inside)))
-                return 0;
-        if (nf_ip6_checksum(skb, hooknum, hdrlen, IPPROTO_ICMPV6))
-                return 0;
-
-        inside = (void *)skb->data + hdrlen;
-        if (inside->icmp6.icmp6_type == NDISC_REDIRECT) {
-                if ((ct->status & IPS_NAT_DONE_MASK) != IPS_NAT_DONE_MASK)
-                        return 0;
-                if (ct->status & IPS_NAT_MASK)
-                        return 0;
-        }
-
-        if (manip == NF_NAT_MANIP_SRC)
-                statusbit = IPS_SRC_NAT;
-        else
-                statusbit = IPS_DST_NAT;
-
-        /* Invert if this is reply direction */
-        if (dir == IP_CT_DIR_REPLY)
-                statusbit ^= IPS_NAT_MASK;
-
-        if (!(ct->status & statusbit))
-                return 1;
-
-        l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, inside->ip6.nexthdr);
-        if (!nf_nat_ipv6_manip_pkt(skb, hdrlen + sizeof(inside->icmp6),
-                                   l4proto, &ct->tuplehash[!dir].tuple, !manip))
-                return 0;
-
-        if (skb->ip_summed != CHECKSUM_PARTIAL) {
-                struct ipv6hdr *ipv6h = ipv6_hdr(skb);
-                inside = (void *)skb->data + hdrlen;
-                inside->icmp6.icmp6_cksum = 0;
-                inside->icmp6.icmp6_cksum =
-                        csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr,
-                                        skb->len - hdrlen, IPPROTO_ICMPV6,
-                                        csum_partial(&inside->icmp6,
-                                                     skb->len - hdrlen, 0));
-        }
-
-        nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
-        l4proto = __nf_nat_l4proto_find(NFPROTO_IPV6, IPPROTO_ICMPV6);
-        if (!nf_nat_ipv6_manip_pkt(skb, 0, l4proto, &target, manip))
-                return 0;
-
-        return 1;
-}
-EXPORT_SYMBOL_GPL(nf_nat_icmpv6_reply_translation);
-
-static int __init nf_nat_l3proto_ipv6_init(void)
-{
-        int err;
-
-        err = nf_nat_l4proto_register(NFPROTO_IPV6, &nf_nat_l4proto_icmpv6);
-        if (err < 0)
-                goto err1;
-        err = nf_nat_l3proto_register(&nf_nat_l3proto_ipv6);
-        if (err < 0)
-                goto err2;
-        return err;
-
-err2:
-        nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_icmpv6);
-err1:
-        return err;
-}
-
-static void __exit nf_nat_l3proto_ipv6_exit(void)
-{
-        nf_nat_l3proto_unregister(&nf_nat_l3proto_ipv6);
-        nf_nat_l4proto_unregister(NFPROTO_IPV6, &nf_nat_l4proto_icmpv6);
-}
-
-MODULE_LICENSE("GPL");
-MODULE_ALIAS("nf-nat-" __stringify(AF_INET6));
-
-module_init(nf_nat_l3proto_ipv6_init);
-module_exit(nf_nat_l3proto_ipv6_exit);
diff --git a/net/ipv6/netfilter/nf_nat_proto_icmpv6.c b/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
deleted file mode 100644
index 61aaf70f376..00000000000
--- a/net/ipv6/netfilter/nf_nat_proto_icmpv6.c
+++ /dev/null
@@ -1,90 +0,0 @@
-/*
- * Copyright (c) 2011 Patrick Mchardy <kaber@trash.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * Based on Rusty Russell's IPv4 ICMP NAT code. Development of IPv6
- * NAT funded by Astaro.
- */
-
-#include <linux/types.h>
-#include <linux/init.h>
-#include <linux/icmpv6.h>
-
-#include <linux/netfilter.h>
-#include <net/netfilter/nf_nat.h>
-#include <net/netfilter/nf_nat_core.h>
-#include <net/netfilter/nf_nat_l3proto.h>
-#include <net/netfilter/nf_nat_l4proto.h>
-
-static bool
-icmpv6_in_range(const struct nf_conntrack_tuple *tuple,
-                enum nf_nat_manip_type maniptype,
-                const union nf_conntrack_man_proto *min,
-                const union nf_conntrack_man_proto *max)
-{
-        return ntohs(tuple->src.u.icmp.id) >= ntohs(min->icmp.id) &&
-               ntohs(tuple->src.u.icmp.id) <= ntohs(max->icmp.id);
-}
-
-static void
-icmpv6_unique_tuple(const struct nf_nat_l3proto *l3proto,
-                    struct nf_conntrack_tuple *tuple,
-                    const struct nf_nat_range *range,
-                    enum nf_nat_manip_type maniptype,
-                    const struct nf_conn *ct)
-{
-        static u16 id;
-        unsigned int range_size;
-        unsigned int i;
-
-        range_size = ntohs(range->max_proto.icmp.id) -
-                     ntohs(range->min_proto.icmp.id) + 1;
-
-        if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED))
-                range_size = 0xffff;
-
-        for (i = 0; ; ++id) {
-                tuple->src.u.icmp.id = htons(ntohs(range->min_proto.icmp.id) +
-                                             (id % range_size));
-                if (++i == range_size || !nf_nat_used_tuple(tuple, ct))
-                        return;
-        }
-}
-
-static bool
-icmpv6_manip_pkt(struct sk_buff *skb,
-                 const struct nf_nat_l3proto *l3proto,
-                 unsigned int iphdroff, unsigned int hdroff,
-                 const struct nf_conntrack_tuple *tuple,
-                 enum nf_nat_manip_type maniptype)
-{
-        struct icmp6hdr *hdr;
-
-        if (!skb_make_writable(skb, hdroff + sizeof(*hdr)))
-                return false;
-
-        hdr = (struct icmp6hdr *)(skb->data + hdroff);
-        l3proto->csum_update(skb, iphdroff, &hdr->icmp6_cksum,
-                             tuple, maniptype);
-        if (hdr->icmp6_code == ICMPV6_ECHO_REQUEST ||
-            hdr->icmp6_code == ICMPV6_ECHO_REPLY) {
-                inet_proto_csum_replace2(&hdr->icmp6_cksum, skb,
-                                         hdr->icmp6_identifier,
-                                         tuple->src.u.icmp.id, 0);
-                hdr->icmp6_identifier = tuple->src.u.icmp.id;
-        }
-        return true;
-}
-
-const struct nf_nat_l4proto nf_nat_l4proto_icmpv6 = {
-        .l4proto                = IPPROTO_ICMPV6,
-        .manip_pkt              = icmpv6_manip_pkt,
-        .in_range               = icmpv6_in_range,
-        .unique_tuple           = icmpv6_unique_tuple,
-#if IS_ENABLED(CONFIG_NF_CT_NETLINK)
-        .nlattr_to_range        = nf_nat_l4proto_nlattr_to_range,
-#endif
-};
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
deleted file mode 100644
index c2e73e647e4..00000000000
--- a/net/ipv6/output_core.c
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * IPv6 library code, needed by static components when full IPv6 support is
- * not configured or static.  These functions are needed by GSO/GRO implementation.
- */
-#include <linux/export.h>
-#include <net/ipv6.h>
-#include <net/ip6_fib.h>
-
-void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
-{
-        static atomic_t ipv6_fragmentation_id;
-        int old, new;
-
-#if IS_ENABLED(CONFIG_IPV6)
-        if (rt && !(rt->dst.flags & DST_NOPEER)) {
-                struct inet_peer *peer;
-                struct net *net;
-
-                net = dev_net(rt->dst.dev);
-                peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
-                if (peer) {
-                        fhdr->identification = htonl(inet_getid(peer, 0));
-                        inet_putpeer(peer);
-                        return;
-                }
-        }
-#endif
-        do {
-                old = atomic_read(&ipv6_fragmentation_id);
-                new = old + 1;
-                if (!new)
-                        new = 1;
-        } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
-        fhdr->identification = htonl(new);
-}
-EXPORT_SYMBOL(ipv6_select_ident);
-
-int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
-{
-        u16 offset = sizeof(struct ipv6hdr);
-        struct ipv6_opt_hdr *exthdr =
-                                (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
-        unsigned int packet_len = skb->tail - skb->network_header;
-        int found_rhdr = 0;
-        *nexthdr = &ipv6_hdr(skb)->nexthdr;
-
-        while (offset + 1 <= packet_len) {
-
-                switch (**nexthdr) {
-
-                case NEXTHDR_HOP:
-                        break;
-                case NEXTHDR_ROUTING:
-                        found_rhdr = 1;
-                        break;
-                case NEXTHDR_DEST:
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
-                        if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
-                                break;
-#endif
-                        if (found_rhdr)
-                                return offset;
-                        break;
-                default :
-                        return offset;
-                }
-
-                offset += ipv6_optlen(exthdr);
-                *nexthdr = &exthdr->nexthdr;
-                exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
-                                                 offset);
-        }
-
-        return offset;
-}
-EXPORT_SYMBOL(ip6_find_1stfragopt);
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 745a3204295..18ff5df7ec0 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -21,7 +21,6 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/stddef.h>
-#include <linux/export.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/sock.h>
@@ -142,7 +141,11 @@ static const struct snmp_mib snmp6_udplite6_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, atomic_long_t *smib)
+/* can be called either with percpu mib (pcpumib != NULL),
+ * or shared one (smib != NULL)
+ */
+static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void __percpu **pcpumib,
+                                     atomic_long_t *smib)
 {
         char name[32];
         int i;
@@ -159,14 +162,14 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, atomic_long_t *smib)
                 snprintf(name, sizeof(name), "Icmp6%s%s",
                         i & 0x100 ? "Out" : "In", p);
                 seq_printf(seq, "%-32s\t%lu\n", name,
-                           atomic_long_read(smib + i));
+                        pcpumib ? snmp_fold_field(pcpumib, i) : atomic_long_read(smib + i));
         }
 
         /* print by number (nonzero only) - ICMPMsgStat format */
         for (i = 0; i < ICMP6MSG_MIB_MAX; i++) {
                 unsigned long val;
 
-                val = atomic_long_read(smib + i);
+                val = pcpumib ? snmp_fold_field(pcpumib, i) : atomic_long_read(smib + i);
                 if (!val)
                         continue;
                 snprintf(name, sizeof(name), "Icmp6%sType%u",
@@ -211,7 +214,8 @@ static int snmp6_seq_show(struct seq_file *seq, void *v)
                             snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp));
         snmp6_seq_show_item(seq, (void __percpu **)net->mib.icmpv6_statistics,
                             NULL, snmp6_icmp6_list);
-        snmp6_seq_show_icmpv6msg(seq, net->mib.icmpv6msg_statistics->mibs);
+        snmp6_seq_show_icmpv6msg(seq,
+                            (void __percpu **)net->mib.icmpv6msg_statistics, NULL);
         snmp6_seq_show_item(seq, (void __percpu **)net->mib.udp_stats_in6,
                             NULL, snmp6_udp6_list);
         snmp6_seq_show_item(seq, (void __percpu **)net->mib.udplite_stats_in6,
@@ -237,11 +241,11 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v)
         struct inet6_dev *idev = (struct inet6_dev *)seq->private;
 
         seq_printf(seq, "%-32s\t%u\n", "ifIndex", idev->dev->ifindex);
-        snmp6_seq_show_item64(seq, (void __percpu **)idev->stats.ipv6,
-                            snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp));
+        snmp6_seq_show_item(seq, (void __percpu **)idev->stats.ipv6, NULL,
+                            snmp6_ipstats_list);
         snmp6_seq_show_item(seq, NULL, idev->stats.icmpv6dev->mibs,
                             snmp6_icmp6_list);
-        snmp6_seq_show_icmpv6msg(seq, idev->stats.icmpv6msgdev->mibs);
+        snmp6_seq_show_icmpv6msg(seq, NULL, idev->stats.icmpv6msgdev->mibs);
         return 0;
 }
 
@@ -307,10 +311,10 @@ static int __net_init ipv6_proc_init_net(struct net *net)
                 goto proc_dev_snmp6_fail;
         return 0;
 
-proc_dev_snmp6_fail:
-        proc_net_remove(net, "snmp6");
 proc_snmp6_fail:
         proc_net_remove(net, "sockstat6");
+proc_dev_snmp6_fail:
+        proc_net_remove(net, "dev_snmp6");
         return -ENOMEM;
 }
 
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index 22d1bd4670d..9a7978fdc02 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -25,13 +25,13 @@
 #include <linux/spinlock.h>
 #include <net/protocol.h>
 
-#if IS_ENABLED(CONFIG_IPV6)
 const struct inet6_protocol __rcu *inet6_protos[MAX_INET_PROTOS] __read_mostly;
-EXPORT_SYMBOL(inet6_protos);
 
 int inet6_add_protocol(const struct inet6_protocol *prot, unsigned char protocol)
 {
-        return !cmpxchg((const struct inet6_protocol **)&inet6_protos[protocol],
+        int hash = protocol & (MAX_INET_PROTOS - 1);
+
+        return !cmpxchg((const struct inet6_protocol **)&inet6_protos[hash],
                         NULL, prot) ? 0 : -1;
 }
 EXPORT_SYMBOL(inet6_add_protocol);
@@ -42,9 +42,9 @@ EXPORT_SYMBOL(inet6_add_protocol);
 
 int inet6_del_protocol(const struct inet6_protocol *prot, unsigned char protocol)
 {
-        int ret;
+        int ret, hash = protocol & (MAX_INET_PROTOS - 1);
 
-        ret = (cmpxchg((const struct inet6_protocol **)&inet6_protos[protocol],
+        ret = (cmpxchg((const struct inet6_protocol **)&inet6_protos[hash],
                        prot, NULL) == prot) ? 0 : -1;
 
         synchronize_net();
@@ -52,26 +52,3 @@ int inet6_del_protocol(const struct inet6_protocol *prot, unsigned char protocol
         return ret;
 }
 EXPORT_SYMBOL(inet6_del_protocol);
-#endif
-
-const struct net_offload __rcu *inet6_offloads[MAX_INET_PROTOS] __read_mostly;
-
-int inet6_add_offload(const struct net_offload *prot, unsigned char protocol)
-{
-        return !cmpxchg((const struct net_offload **)&inet6_offloads[protocol],
-                        NULL, prot) ? 0 : -1;
-}
-EXPORT_SYMBOL(inet6_add_offload);
-
-int inet6_del_offload(const struct net_offload *prot, unsigned char protocol)
-{
-        int ret;
-
-        ret = (cmpxchg((const struct net_offload **)&inet6_offloads[protocol],
-                       prot, NULL) == prot) ? 0 : -1;
-
-        synchronize_net();
-
-        return ret;
-}
-EXPORT_SYMBOL(inet6_del_offload);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 6cd29b1e8b9..343852e5c70 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -50,7 +50,7 @@
 #include <net/udp.h>
 #include <net/inet_common.h>
 #include <net/tcp_states.h>
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 #include <net/mip6.h>
 #endif
 #include <linux/mroute6.h>
@@ -61,7 +61,6 @@
 
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-#include <linux/export.h>
 
 static struct raw_hashinfo raw_v6_hashinfo = {
         .lock = __RW_LOCK_UNLOCKED(raw_v6_hashinfo.lock),
@@ -72,7 +71,7 @@ static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
                 const struct in6_addr *rmt_addr, int dif)
 {
         struct hlist_node *node;
-        bool is_multicast = ipv6_addr_is_multicast(loc_addr);
+        int is_multicast = ipv6_addr_is_multicast(loc_addr);
 
         sk_for_each_from(sk, node)
                 if (inet_sk(sk)->inet_num == num) {
@@ -107,23 +106,24 @@ found:
  *      0 - deliver
  *      1 - block
  */
-static int icmpv6_filter(const struct sock *sk, const struct sk_buff *skb)
+static __inline__ int icmpv6_filter(struct sock *sk, struct sk_buff *skb)
 {
-        struct icmp6hdr *_hdr;
-        const struct icmp6hdr *hdr;
+        struct icmp6hdr *icmph;
+        struct raw6_sock *rp = raw6_sk(sk);
+
+        if (pskb_may_pull(skb, sizeof(struct icmp6hdr))) {
+                __u32 *data = &rp->filter.data[0];
+                int bit_nr;
 
-        hdr = skb_header_pointer(skb, skb_transport_offset(skb),
-                                 sizeof(_hdr), &_hdr);
-        if (hdr) {
-                const __u32 *data = &raw6_sk(sk)->filter.data[0];
-                unsigned int type = hdr->icmp6_type;
+                icmph = (struct icmp6hdr *) skb->data;
+                bit_nr = icmph->icmp6_type;
 
-                return (data[type >> 5] & (1U << (type & 31))) != 0;
+                return (data[bit_nr >> 5] & (1 << (bit_nr & 31))) != 0;
         }
-        return 1;
+        return 0;
 }
 
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 typedef int mh_filter_t(struct sock *sock, struct sk_buff *skb);
 
 static mh_filter_t __rcu *mh_filter __read_mostly;
@@ -137,7 +137,7 @@ EXPORT_SYMBOL(rawv6_mh_filter_register);
 
 int rawv6_mh_filter_unregister(mh_filter_t filter)
 {
-        RCU_INIT_POINTER(mh_filter, NULL);
+        rcu_assign_pointer(mh_filter, NULL);
         synchronize_rcu();
         return 0;
 }
@@ -152,19 +152,19 @@ EXPORT_SYMBOL(rawv6_mh_filter_unregister);
  *
  *      Caller owns SKB so we must make clones.
  */
-static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
+static int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
 {
         const struct in6_addr *saddr;
         const struct in6_addr *daddr;
         struct sock *sk;
-        bool delivered = false;
+        int delivered = 0;
         __u8 hash;
         struct net *net;
 
         saddr = &ipv6_hdr(skb)->saddr;
         daddr = saddr + 1;
 
-        hash = nexthdr & (RAW_HTABLE_SIZE - 1);
+        hash = nexthdr & (MAX_INET_PROTOS - 1);
 
         read_lock(&raw_v6_hashinfo.lock);
         sk = sk_head(&raw_v6_hashinfo.ht[hash]);
@@ -178,13 +178,13 @@ static bool ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
         while (sk) {
                 int filtered;
 
-                delivered = true;
+                delivered = 1;
                 switch (nexthdr) {
                 case IPPROTO_ICMPV6:
                         filtered = icmpv6_filter(sk, skb);
                         break;
 
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 case IPPROTO_MH:
                 {
                         /* XXX: To validate MH only once for each packet,
@@ -224,11 +224,11 @@ out:
         return delivered;
 }
 
-bool raw6_local_deliver(struct sk_buff *skb, int nexthdr)
+int raw6_local_deliver(struct sk_buff *skb, int nexthdr)
 {
         struct sock *raw_sk;
 
-        raw_sk = sk_head(&raw_v6_hashinfo.ht[nexthdr & (RAW_HTABLE_SIZE - 1)]);
+        raw_sk = sk_head(&raw_v6_hashinfo.ht[nexthdr & (MAX_INET_PROTOS - 1)]);
         if (raw_sk && !ipv6_raw_deliver(skb, nexthdr))
                 raw_sk = NULL;
 
@@ -298,9 +298,9 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         }
 
         inet->inet_rcv_saddr = inet->inet_saddr = v4addr;
-        np->rcv_saddr = addr->sin6_addr;
+        ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
         if (!(addr_type & IPV6_ADDR_MULTICAST))
-                np->saddr = addr->sin6_addr;
+                ipv6_addr_copy(&np->saddr, &addr->sin6_addr);
         err = 0;
 out_unlock:
         rcu_read_unlock();
@@ -327,12 +327,9 @@ static void rawv6_err(struct sock *sk, struct sk_buff *skb,
                 return;
 
         harderr = icmpv6_err_convert(type, code, &err);
-        if (type == ICMPV6_PKT_TOOBIG) {
-                ip6_sk_update_pmtu(skb, sk, info);
+        if (type == ICMPV6_PKT_TOOBIG)
                 harderr = (np->pmtudisc == IPV6_PMTUDISC_DO);
-        }
-        if (type == NDISC_REDIRECT)
-                ip6_sk_redirect(skb, sk);
+
         if (np->recverr) {
                 u8 *payload = skb->data;
                 if (!inet->hdrincl)
@@ -375,9 +372,9 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
         read_unlock(&raw_v6_hashinfo.lock);
 }
 
-static inline int rawv6_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
 {
-        if ((raw6_sk(sk)->checksum || rcu_access_pointer(sk->sk_filter)) &&
+        if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
             skb_checksum_complete(skb)) {
                 atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
@@ -385,8 +382,7 @@ static inline int rawv6_rcv_skb(struct sock *sk, struct sk_buff *skb)
         }
 
         /* Charge it to the socket. */
-        skb_dst_drop(skb);
-        if (sock_queue_rcv_skb(sk, skb) < 0) {
+        if (ip_queue_rcv_skb(sk, skb) < 0) {
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
@@ -497,7 +493,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (sin6) {
                 sin6->sin6_family = AF_INET6;
                 sin6->sin6_port = 0;
-                sin6->sin6_addr = ipv6_hdr(skb)->saddr;
+                ipv6_addr_copy(&sin6->sin6_addr, &ipv6_hdr(skb)->saddr);
                 sin6->sin6_flowinfo = 0;
                 sin6->sin6_scope_id = 0;
                 if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL)
@@ -546,7 +542,8 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
                 goto out;
 
         offset = rp->offset;
-        total_len = inet_sk(sk)->cork.base.length;
+        total_len = inet_sk(sk)->cork.base.length - (skb_network_header(skb) -
+                                                     skb->data);
         if (offset >= total_len - 1) {
                 err = -EINVAL;
                 ip6_flush_pending_frames(sk);
@@ -613,8 +610,6 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
         struct sk_buff *skb;
         int err;
         struct rt6_info *rt = (struct rt6_info *)*dstp;
-        int hlen = LL_RESERVED_SPACE(rt->dst.dev);
-        int tlen = rt->dst.dev->needed_tailroom;
 
         if (length > rt->dst.dev->mtu) {
                 ipv6_local_error(sk, EMSGSIZE, fl6, rt->dst.dev->mtu);
@@ -624,11 +619,11 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
                 goto out;
 
         skb = sock_alloc_send_skb(sk,
-                                  length + hlen + tlen + 15,
+                                  length + LL_ALLOCATED_SPACE(rt->dst.dev) + 15,
                                   flags & MSG_DONTWAIT, &err);
         if (skb == NULL)
                 goto error;
-        skb_reserve(skb, hlen);
+        skb_reserve(skb, LL_RESERVED_SPACE(rt->dst.dev));
 
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
@@ -848,18 +843,16 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 goto out;
 
         if (!ipv6_addr_any(daddr))
-                fl6.daddr = *daddr;
+                ipv6_addr_copy(&fl6.daddr, daddr);
         else
                 fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
         if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
-                fl6.saddr = np->saddr;
+                ipv6_addr_copy(&fl6.saddr, &np->saddr);
 
         final_p = fl6_update_dst(&fl6, opt, &final);
 
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
                 fl6.flowi6_oif = np->mcast_oif;
-        else if (!fl6.flowi6_oif)
-                fl6.flowi6_oif = np->ucast_oif;
         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 
         dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
@@ -1250,8 +1243,7 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
                    sk_wmem_alloc_get(sp),
                    sk_rmem_alloc_get(sp),
                    0, 0L, 0,
-                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
-                   0,
+                   sock_i_uid(sp), 0,
                    sock_i_ino(sp),
                    atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
 }
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index e5253ec9e0f..7b954e2539d 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -42,7 +42,6 @@
 #include <linux/jhash.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
-#include <linux/export.h>
 
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -65,8 +64,36 @@ struct ip6frag_skb_cb
 #define FRAG6_CB(skb)   ((struct ip6frag_skb_cb*)((skb)->cb))
 
 
+/*
+ *      Equivalent of ipv4 struct ipq
+ */
+
+struct frag_queue
+{
+        struct inet_frag_queue  q;
+
+        __be32                  id;             /* fragment id          */
+        u32                     user;
+        struct in6_addr         saddr;
+        struct in6_addr         daddr;
+
+        int                     iif;
+        unsigned int            csum;
+        __u16                   nhoffset;
+};
+
 static struct inet_frags ip6_frags;
 
+int ip6_frag_nqueues(struct net *net)
+{
+        return net->ipv6.frags.nqueues;
+}
+
+int ip6_frag_mem(struct net *net)
+{
+        return atomic_read(&net->ipv6.frags.mem);
+}
+
 static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                           struct net_device *dev);
 
@@ -106,16 +133,15 @@ static unsigned int ip6_hashfn(struct inet_frag_queue *q)
         return inet6_hash_frag(fq->id, &fq->saddr, &fq->daddr, ip6_frags.rnd);
 }
 
-bool ip6_frag_match(struct inet_frag_queue *q, void *a)
+int ip6_frag_match(struct inet_frag_queue *q, void *a)
 {
         struct frag_queue *fq;
         struct ip6_create_arg *arg = a;
 
         fq = container_of(q, struct frag_queue, q);
-        return  fq->id == arg->id &&
-                fq->user == arg->user &&
-                ipv6_addr_equal(&fq->saddr, arg->src) &&
-                ipv6_addr_equal(&fq->daddr, arg->dst);
+        return (fq->id == arg->id && fq->user == arg->user &&
+                        ipv6_addr_equal(&fq->saddr, arg->src) &&
+                        ipv6_addr_equal(&fq->daddr, arg->dst));
 }
 EXPORT_SYMBOL(ip6_frag_match);
 
@@ -126,23 +152,51 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a)
 
         fq->id = arg->id;
         fq->user = arg->user;
-        fq->saddr = *arg->src;
-        fq->daddr = *arg->dst;
+        ipv6_addr_copy(&fq->saddr, arg->src);
+        ipv6_addr_copy(&fq->daddr, arg->dst);
 }
 EXPORT_SYMBOL(ip6_frag_init);
 
-void ip6_expire_frag_queue(struct net *net, struct frag_queue *fq,
-                           struct inet_frags *frags)
+/* Destruction primitives. */
+
+static __inline__ void fq_put(struct frag_queue *fq)
 {
+        inet_frag_put(&fq->q, &ip6_frags);
+}
+
+/* Kill fq entry. It is not destroyed immediately,
+ * because caller (and someone more) holds reference count.
+ */
+static __inline__ void fq_kill(struct frag_queue *fq)
+{
+        inet_frag_kill(&fq->q, &ip6_frags);
+}
+
+static void ip6_evictor(struct net *net, struct inet6_dev *idev)
+{
+        int evicted;
+
+        evicted = inet_frag_evictor(&net->ipv6.frags, &ip6_frags);
+        if (evicted)
+                IP6_ADD_STATS_BH(net, idev, IPSTATS_MIB_REASMFAILS, evicted);
+}
+
+static void ip6_frag_expire(unsigned long data)
+{
+        struct frag_queue *fq;
         struct net_device *dev = NULL;
+        struct net *net;
+
+        fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);
 
         spin_lock(&fq->q.lock);
 
         if (fq->q.last_in & INET_FRAG_COMPLETE)
                 goto out;
 
-        inet_frag_kill(&fq->q, frags);
+        fq_kill(fq);
 
+        net = container_of(fq->q.net, struct net, ipv6.frags);
         rcu_read_lock();
         dev = dev_get_by_index_rcu(net, fq->iif);
         if (!dev)
@@ -166,19 +220,7 @@ out_rcu_unlock:
         rcu_read_unlock();
 out:
         spin_unlock(&fq->q.lock);
-        inet_frag_put(&fq->q, frags);
-}
-EXPORT_SYMBOL(ip6_expire_frag_queue);
-
-static void ip6_frag_expire(unsigned long data)
-{
-        struct frag_queue *fq;
-        struct net *net;
-
-        fq = container_of((struct inet_frag_queue *)data, struct frag_queue, q);
-        net = container_of(fq->q.net, struct net, ipv6.frags);
-
-        ip6_expire_frag_queue(net, fq, &ip6_frags);
+        fq_put(fq);
 }
 
 static __inline__ struct frag_queue *
@@ -293,11 +335,12 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
         }
 
 found:
-        /* RFC5722, Section 4, amended by Errata ID : 3089
-         *                          When reassembling an IPv6 datagram, if
+        /* RFC5722, Section 4:
+         *                                  When reassembling an IPv6 datagram, if
          *   one or more its constituent fragments is determined to be an
          *   overlapping fragment, the entire datagram (and any constituent
-         *   fragments) MUST be silently discarded.
+         *   fragments, including those not yet received) MUST be silently
+         *   discarded.
          */
 
         /* Check for overlap with preceding fragment. */
@@ -347,7 +390,7 @@ found:
         return -1;
 
 discard_fq:
-        inet_frag_kill(&fq->q, &ip6_frags);
+        fq_kill(fq);
 err:
         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
                       IPSTATS_MIB_REASMFAILS);
@@ -371,9 +414,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         struct sk_buff *fp, *head = fq->q.fragments;
         int    payload_len;
         unsigned int nhoff;
-        int sum_truesize;
 
-        inet_frag_kill(&fq->q, &ip6_frags);
+        fq_kill(fq);
 
         /* Make the one we just received the head. */
         if (prev) {
@@ -391,7 +433,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 skb_morph(head, fq->q.fragments);
                 head->next = fq->q.fragments->next;
 
-                consume_skb(fq->q.fragments);
+                kfree_skb(fq->q.fragments);
                 fq->q.fragments = head;
         }
 
@@ -422,8 +464,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 head->next = clone;
                 skb_shinfo(clone)->frag_list = skb_shinfo(head)->frag_list;
                 skb_frag_list_init(head);
-                for (i = 0; i < skb_shinfo(head)->nr_frags; i++)
-                        plen += skb_frag_size(&skb_shinfo(head)->frags[i]);
+                for (i=0; i<skb_shinfo(head)->nr_frags; i++)
+                        plen += skb_shinfo(head)->frags[i].size;
                 clone->len = clone->data_len = head->data_len - plen;
                 head->data_len -= clone->len;
                 head->len -= clone->len;
@@ -441,33 +483,20 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         head->mac_header += sizeof(struct frag_hdr);
         head->network_header += sizeof(struct frag_hdr);
 
+        skb_shinfo(head)->frag_list = head->next;
         skb_reset_transport_header(head);
         skb_push(head, head->data - skb_network_header(head));
 
-        sum_truesize = head->truesize;
-        for (fp = head->next; fp;) {
-                bool headstolen;
-                int delta;
-                struct sk_buff *next = fp->next;
-
-                sum_truesize += fp->truesize;
+        for (fp=head->next; fp; fp = fp->next) {
+                head->data_len += fp->len;
+                head->len += fp->len;
                 if (head->ip_summed != fp->ip_summed)
                         head->ip_summed = CHECKSUM_NONE;
                 else if (head->ip_summed == CHECKSUM_COMPLETE)
                         head->csum = csum_add(head->csum, fp->csum);
-
-                if (skb_try_coalesce(head, fp, &headstolen, &delta)) {
-                        kfree_skb_partial(fp, headstolen);
-                } else {
-                        if (!skb_shinfo(head)->frag_list)
-                                skb_shinfo(head)->frag_list = fp;
-                        head->data_len += fp->len;
-                        head->len += fp->len;
-                        head->truesize += fp->truesize;
-                }
-                fp = next;
+                head->truesize += fp->truesize;
         }
-        atomic_sub(sum_truesize, &fq->q.net->mem);
+        atomic_sub(head->truesize, &fq->q.net->mem);
 
         head->next = NULL;
         head->dev = dev;
@@ -489,10 +518,12 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         return 1;
 
 out_oversize:
-        net_dbg_ratelimited("ip6_frag_reasm: payload len = %d\n", payload_len);
+        if (net_ratelimit())
+                printk(KERN_DEBUG "ip6_frag_reasm: payload len = %d\n", payload_len);
         goto out_fail;
 out_oom:
-        net_dbg_ratelimited("ip6_frag_reasm: no memory for reassembly\n");
+        if (net_ratelimit())
+                printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n");
 out_fail:
         rcu_read_lock();
         IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
@@ -506,7 +537,6 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
         struct frag_queue *fq;
         const struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct net *net = dev_net(skb_dst(skb)->dev);
-        int evicted;
 
         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
 
@@ -531,10 +561,8 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
                 return 1;
         }
 
-        evicted = inet_frag_evictor(&net->ipv6.frags, &ip6_frags, false);
-        if (evicted)
-                IP6_ADD_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
-                                 IPSTATS_MIB_REASMFAILS, evicted);
+        if (atomic_read(&net->ipv6.frags.mem) > net->ipv6.frags.high_thresh)
+                ip6_evictor(net, ip6_dst_idev(skb_dst(skb)));
 
         fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr);
         if (fq != NULL) {
@@ -545,7 +573,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
                 ret = ip6_frag_queue(fq, skb, fhdr, IP6CB(skb)->nhoff);
 
                 spin_unlock(&fq->q.lock);
-                inet_frag_put(&fq->q, &ip6_frags);
+                fq_put(fq);
                 return ret;
         }
 
@@ -616,13 +644,9 @@ static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
                 table[0].data = &net->ipv6.frags.high_thresh;
                 table[1].data = &net->ipv6.frags.low_thresh;
                 table[2].data = &net->ipv6.frags.timeout;
-
-                /* Don't export sysctls to unprivileged users */
-                if (net->user_ns != &init_user_ns)
-                        table[0].procname = NULL;
         }
 
-        hdr = register_net_sysctl(net, "net/ipv6", table);
+        hdr = register_net_sysctl_table(net, net_ipv6_ctl_path, table);
         if (hdr == NULL)
                 goto err_reg;
 
@@ -650,7 +674,7 @@ static struct ctl_table_header *ip6_ctl_header;
 
 static int ip6_frags_sysctl_register(void)
 {
-        ip6_ctl_header = register_net_sysctl(&init_net, "net/ipv6",
+        ip6_ctl_header = register_net_sysctl_rotable(net_ipv6_ctl_path,
                         ip6_frags_ctl_table);
         return ip6_ctl_header == NULL ? -ENOMEM : 0;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e229a3bc345..f02fe523bd3 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -24,11 +24,8 @@
  *              Fixed routing subtrees.
  */
 
-#define pr_fmt(fmt) "IPv6: " fmt
-
 #include <linux/capability.h>
 #include <linux/errno.h>
-#include <linux/export.h>
 #include <linux/types.h>
 #include <linux/times.h>
 #include <linux/socket.h>
@@ -57,7 +54,6 @@
 #include <net/xfrm.h>
 #include <net/netevent.h>
 #include <net/netlink.h>
-#include <net/nexthop.h>
 
 #include <asm/uaccess.h>
 
@@ -65,11 +61,22 @@
 #include <linux/sysctl.h>
 #endif
 
-static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
+/* Set to 3 to get tracing. */
+#define RT6_DEBUG 2
+
+#if RT6_DEBUG >= 3
+#define RDBG(x) printk x
+#define RT6_TRACE(x...) printk(KERN_DEBUG x)
+#else
+#define RDBG(x)
+#define RT6_TRACE(x...) do { ; } while (0)
+#endif
+
+static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
                                     const struct in6_addr *dest);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
-static unsigned int      ip6_mtu(const struct dst_entry *dst);
+static unsigned int      ip6_default_mtu(const struct dst_entry *dst);
 static struct dst_entry *ip6_negative_advice(struct dst_entry *);
 static void             ip6_dst_destroy(struct dst_entry *);
 static void             ip6_dst_ifdown(struct dst_entry *,
@@ -79,16 +86,13 @@ static int		 ip6_dst_gc(struct dst_ops *ops);
 static int              ip6_pkt_discard(struct sk_buff *skb);
 static int              ip6_pkt_discard_out(struct sk_buff *skb);
 static void             ip6_link_failure(struct sk_buff *skb);
-static void             ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
-                                           struct sk_buff *skb, u32 mtu);
-static void             rt6_do_redirect(struct dst_entry *dst, struct sock *sk,
-                                        struct sk_buff *skb);
+static void             ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
 static struct rt6_info *rt6_add_route_info(struct net *net,
                                            const struct in6_addr *prefix, int prefixlen,
                                            const struct in6_addr *gwaddr, int ifindex,
-                                           unsigned int pref);
+                                           unsigned pref);
 static struct rt6_info *rt6_get_route_info(struct net *net,
                                            const struct in6_addr *prefix, int prefixlen,
                                            const struct in6_addr *gwaddr, int ifindex);
@@ -103,7 +107,10 @@ static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
         if (!(rt->dst.flags & DST_HOST))
                 return NULL;
 
-        peer = rt6_get_peer_create(rt);
+        if (!rt->rt6i_peer)
+                rt6_bind_peer(rt, 1);
+
+        peer = rt->rt6i_peer;
         if (peer) {
                 u32 *old_p = __DST_METRICS_PTR(old);
                 unsigned long prev, new;
@@ -124,44 +131,9 @@ static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
         return p;
 }
 
-static inline const void *choose_neigh_daddr(struct rt6_info *rt,
-                                             struct sk_buff *skb,
-                                             const void *daddr)
+static struct neighbour *ip6_neigh_lookup(const struct dst_entry *dst, const void *daddr)
 {
-        struct in6_addr *p = &rt->rt6i_gateway;
-
-        if (!ipv6_addr_any(p))
-                return (const void *) p;
-        else if (skb)
-                return &ipv6_hdr(skb)->daddr;
-        return daddr;
-}
-
-static struct neighbour *ip6_neigh_lookup(const struct dst_entry *dst,
-                                          struct sk_buff *skb,
-                                          const void *daddr)
-{
-        struct rt6_info *rt = (struct rt6_info *) dst;
-        struct neighbour *n;
-
-        daddr = choose_neigh_daddr(rt, skb, daddr);
-        n = __ipv6_neigh_lookup(&nd_tbl, dst->dev, daddr);
-        if (n)
-                return n;
-        return neigh_create(&nd_tbl, daddr, dst->dev);
-}
-
-static int rt6_bind_neighbour(struct rt6_info *rt, struct net_device *dev)
-{
-        struct neighbour *n = __ipv6_neigh_lookup(&nd_tbl, dev, &rt->rt6i_gateway);
-        if (!n) {
-                n = neigh_create(&nd_tbl, &rt->rt6i_gateway, dev);
-                if (IS_ERR(n))
-                        return PTR_ERR(n);
-        }
-        rt->n = n;
-
-        return 0;
+        return __neigh_lookup_errno(&nd_tbl, daddr, dst->dev);
 }
 
 static struct dst_ops ip6_dst_ops_template = {
@@ -171,32 +143,23 @@ static struct dst_ops ip6_dst_ops_template = {
         .gc_thresh              =       1024,
         .check                  =       ip6_dst_check,
         .default_advmss         =       ip6_default_advmss,
-        .mtu                    =       ip6_mtu,
+        .default_mtu            =       ip6_default_mtu,
         .cow_metrics            =       ipv6_cow_metrics,
         .destroy                =       ip6_dst_destroy,
         .ifdown                 =       ip6_dst_ifdown,
         .negative_advice        =       ip6_negative_advice,
         .link_failure           =       ip6_link_failure,
         .update_pmtu            =       ip6_rt_update_pmtu,
-        .redirect               =       rt6_do_redirect,
         .local_out              =       __ip6_local_out,
         .neigh_lookup           =       ip6_neigh_lookup,
 };
 
-static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst)
-{
-        unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
-
-        return mtu ? : dst->dev->mtu;
-}
-
-static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
-                                         struct sk_buff *skb, u32 mtu)
+static unsigned int ip6_blackhole_default_mtu(const struct dst_entry *dst)
 {
+        return 0;
 }
 
-static void ip6_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
-                                      struct sk_buff *skb)
+static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
 
@@ -211,23 +174,22 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .protocol               =       cpu_to_be16(ETH_P_IPV6),
         .destroy                =       ip6_dst_destroy,
         .check                  =       ip6_dst_check,
-        .mtu                    =       ip6_blackhole_mtu,
+        .default_mtu            =       ip6_blackhole_default_mtu,
         .default_advmss         =       ip6_default_advmss,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
-        .redirect               =       ip6_rt_blackhole_redirect,
         .cow_metrics            =       ip6_rt_blackhole_cow_metrics,
         .neigh_lookup           =       ip6_neigh_lookup,
 };
 
 static const u32 ip6_template_metrics[RTAX_MAX] = {
-        [RTAX_HOPLIMIT - 1] = 0,
+        [RTAX_HOPLIMIT - 1] = 255,
 };
 
-static const struct rt6_info ip6_null_entry_template = {
+static struct rt6_info ip6_null_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
                 .__use          = 1,
-                .obsolete       = DST_OBSOLETE_FORCE_CHK,
+                .obsolete       = -1,
                 .error          = -ENETUNREACH,
                 .input          = ip6_pkt_discard,
                 .output         = ip6_pkt_discard_out,
@@ -243,11 +205,11 @@ static const struct rt6_info ip6_null_entry_template = {
 static int ip6_pkt_prohibit(struct sk_buff *skb);
 static int ip6_pkt_prohibit_out(struct sk_buff *skb);
 
-static const struct rt6_info ip6_prohibit_entry_template = {
+static struct rt6_info ip6_prohibit_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
                 .__use          = 1,
-                .obsolete       = DST_OBSOLETE_FORCE_CHK,
+                .obsolete       = -1,
                 .error          = -EACCES,
                 .input          = ip6_pkt_prohibit,
                 .output         = ip6_pkt_prohibit_out,
@@ -258,11 +220,11 @@ static const struct rt6_info ip6_prohibit_entry_template = {
         .rt6i_ref       = ATOMIC_INIT(1),
 };
 
-static const struct rt6_info ip6_blk_hole_entry_template = {
+static struct rt6_info ip6_blk_hole_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
                 .__use          = 1,
-                .obsolete       = DST_OBSOLETE_FORCE_CHK,
+                .obsolete       = -1,
                 .error          = -EINVAL,
                 .input          = dst_discard,
                 .output         = dst_discard,
@@ -276,23 +238,16 @@ static const struct rt6_info ip6_blk_hole_entry_template = {
 #endif
 
 /* allocate dst with ip6_dst_ops */
-static inline struct rt6_info *ip6_dst_alloc(struct net *net,
+static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops,
                                              struct net_device *dev,
-                                             int flags,
-                                             struct fib6_table *table)
+                                             int flags)
 {
-        struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
-                                        0, DST_OBSOLETE_FORCE_CHK, flags);
+        struct rt6_info *rt = dst_alloc(ops, dev, 0, 0, flags);
 
-        if (rt) {
-                struct dst_entry *dst = &rt->dst;
+        if (rt != NULL)
+                memset(&rt->rt6i_table, 0,
+                        sizeof(*rt) - sizeof(struct dst_entry));
 
-                memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
-                rt6_init_peer(rt, table ? &table->tb6_peers : net->ipv6.peers);
-                rt->rt6i_genid = rt_genid(net);
-                INIT_LIST_HEAD(&rt->rt6i_siblings);
-                rt->rt6i_nsiblings = 0;
-        }
         return rt;
 }
 
@@ -300,41 +255,37 @@ static void ip6_dst_destroy(struct dst_entry *dst)
 {
         struct rt6_info *rt = (struct rt6_info *)dst;
         struct inet6_dev *idev = rt->rt6i_idev;
-
-        if (rt->n)
-                neigh_release(rt->n);
+        struct inet_peer *peer = rt->rt6i_peer;
 
         if (!(rt->dst.flags & DST_HOST))
                 dst_destroy_metrics_generic(dst);
 
-        if (idev) {
+        if (idev != NULL) {
                 rt->rt6i_idev = NULL;
                 in6_dev_put(idev);
         }
-
-        if (!(rt->rt6i_flags & RTF_EXPIRES) && dst->from)
-                dst_release(dst->from);
-
-        if (rt6_has_peer(rt)) {
-                struct inet_peer *peer = rt6_peer_ptr(rt);
+        if (peer) {
+                rt->rt6i_peer = NULL;
                 inet_putpeer(peer);
         }
 }
 
+static atomic_t __rt6_peer_genid = ATOMIC_INIT(0);
+
+static u32 rt6_peer_genid(void)
+{
+        return atomic_read(&__rt6_peer_genid);
+}
+
 void rt6_bind_peer(struct rt6_info *rt, int create)
 {
-        struct inet_peer_base *base;
         struct inet_peer *peer;
 
-        base = inetpeer_base_ptr(rt->_rt6i_peer);
-        if (!base)
-                return;
-
-        peer = inet_getpeer_v6(base, &rt->rt6i_dst.addr, create);
-        if (peer) {
-                if (!rt6_set_peer(rt, peer))
-                        inet_putpeer(peer);
-        }
+        peer = inet_getpeer_v6(&rt->rt6i_dst.addr, create);
+        if (peer && cmpxchg(&rt->rt6i_peer, NULL, peer) != NULL)
+                inet_putpeer(peer);
+        else
+                rt->rt6i_peer_genid = rt6_peer_genid();
 }
 
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
@@ -345,103 +296,28 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         struct net_device *loopback_dev =
                 dev_net(dev)->loopback_dev;
 
-        if (dev != loopback_dev) {
-                if (idev && idev->dev == dev) {
-                        struct inet6_dev *loopback_idev =
-                                in6_dev_get(loopback_dev);
-                        if (loopback_idev) {
-                                rt->rt6i_idev = loopback_idev;
-                                in6_dev_put(idev);
-                        }
-                }
-                if (rt->n && rt->n->dev == dev) {
-                        rt->n->dev = loopback_dev;
-                        dev_hold(loopback_dev);
-                        dev_put(dev);
+        if (dev != loopback_dev && idev != NULL && idev->dev == dev) {
+                struct inet6_dev *loopback_idev =
+                        in6_dev_get(loopback_dev);
+                if (loopback_idev != NULL) {
+                        rt->rt6i_idev = loopback_idev;
+                        in6_dev_put(idev);
                 }
         }
 }
 
-static bool rt6_check_expired(const struct rt6_info *rt)
+static __inline__ int rt6_check_expired(const struct rt6_info *rt)
 {
-        if (rt->rt6i_flags & RTF_EXPIRES) {
-                if (time_after(jiffies, rt->dst.expires))
-                        return true;
-        } else if (rt->dst.from) {
-                return rt6_check_expired((struct rt6_info *) rt->dst.from);
-        }
-        return false;
+        return (rt->rt6i_flags & RTF_EXPIRES) &&
+                time_after(jiffies, rt->rt6i_expires);
 }
 
-static bool rt6_need_strict(const struct in6_addr *daddr)
+static inline int rt6_need_strict(const struct in6_addr *daddr)
 {
         return ipv6_addr_type(daddr) &
                 (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
 }
 
-/* Multipath route selection:
- *   Hash based function using packet header and flowlabel.
- * Adapted from fib_info_hashfn()
- */
-static int rt6_info_hash_nhsfn(unsigned int candidate_count,
-                               const struct flowi6 *fl6)
-{
-        unsigned int val = fl6->flowi6_proto;
-
-        val ^= (__force u32)fl6->daddr.s6_addr32[0];
-        val ^= (__force u32)fl6->daddr.s6_addr32[1];
-        val ^= (__force u32)fl6->daddr.s6_addr32[2];
-        val ^= (__force u32)fl6->daddr.s6_addr32[3];
-
-        val ^= (__force u32)fl6->saddr.s6_addr32[0];
-        val ^= (__force u32)fl6->saddr.s6_addr32[1];
-        val ^= (__force u32)fl6->saddr.s6_addr32[2];
-        val ^= (__force u32)fl6->saddr.s6_addr32[3];
-
-        /* Work only if this not encapsulated */
-        switch (fl6->flowi6_proto) {
-        case IPPROTO_UDP:
-        case IPPROTO_TCP:
-        case IPPROTO_SCTP:
-                val ^= (__force u16)fl6->fl6_sport;
-                val ^= (__force u16)fl6->fl6_dport;
-                break;
-
-        case IPPROTO_ICMPV6:
-                val ^= (__force u16)fl6->fl6_icmp_type;
-                val ^= (__force u16)fl6->fl6_icmp_code;
-                break;
-        }
-        /* RFC6438 recommands to use flowlabel */
-        val ^= (__force u32)fl6->flowlabel;
-
-        /* Perhaps, we need to tune, this function? */
-        val = val ^ (val >> 7) ^ (val >> 12);
-        return val % candidate_count;
-}
-
-static struct rt6_info *rt6_multipath_select(struct rt6_info *match,
-                                             struct flowi6 *fl6)
-{
-        struct rt6_info *sibling, *next_sibling;
-        int route_choosen;
-
-        route_choosen = rt6_info_hash_nhsfn(match->rt6i_nsiblings + 1, fl6);
-        /* Don't change the route, if route_choosen == 0
-         * (siblings does not include ourself)
-         */
-        if (route_choosen)
-                list_for_each_entry_safe(sibling, next_sibling,
-                                &match->rt6i_siblings, rt6i_siblings) {
-                        route_choosen--;
-                        if (route_choosen == 0) {
-                                match = sibling;
-                                break;
-                        }
-                }
-        return match;
-}
-
 /*
  *      Route lookup. Any table->tb6_lock is implied.
  */
@@ -459,13 +335,13 @@ static inline struct rt6_info *rt6_device_match(struct net *net,
                 goto out;
 
         for (sprt = rt; sprt; sprt = sprt->dst.rt6_next) {
-                struct net_device *dev = sprt->dst.dev;
+                struct net_device *dev = sprt->rt6i_dev;
 
                 if (oif) {
                         if (dev->ifindex == oif)
                                 return sprt;
                         if (dev->flags & IFF_LOOPBACK) {
-                                if (!sprt->rt6i_idev ||
+                                if (sprt->rt6i_idev == NULL ||
                                     sprt->rt6i_idev->dev->ifindex != oif) {
                                         if (flags & RT6_LOOKUP_F_IFACE && oif)
                                                 continue;
@@ -505,9 +381,10 @@ static void rt6_probe(struct rt6_info *rt)
          * Router Reachability Probe MUST be rate-limited
          * to no more than one per minute.
          */
-        neigh = rt ? rt->n : NULL;
+        rcu_read_lock();
+        neigh = rt ? dst_get_neighbour(&rt->dst) : NULL;
         if (!neigh || (neigh->nud_state & NUD_VALID))
-                return;
+                goto out;
         read_lock_bh(&neigh->lock);
         if (!(neigh->nud_state & NUD_VALID) &&
             time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
@@ -519,10 +396,12 @@ static void rt6_probe(struct rt6_info *rt)
 
                 target = (struct in6_addr *)&neigh->primary_key;
                 addrconf_addr_solict_mult(target, &mcaddr);
-                ndisc_send_ns(rt->dst.dev, NULL, target, &mcaddr, NULL);
+                ndisc_send_ns(rt->rt6i_dev, NULL, target, &mcaddr, NULL);
         } else {
                 read_unlock_bh(&neigh->lock);
         }
+out:
+        rcu_read_unlock();
 }
 #else
 static inline void rt6_probe(struct rt6_info *rt)
@@ -535,7 +414,7 @@ static inline void rt6_probe(struct rt6_info *rt)
  */
 static inline int rt6_check_dev(struct rt6_info *rt, int oif)
 {
-        struct net_device *dev = rt->dst.dev;
+        struct net_device *dev = rt->rt6i_dev;
         if (!oif || dev->ifindex == oif)
                 return 2;
         if ((dev->flags & IFF_LOOPBACK) &&
@@ -544,32 +423,37 @@ static inline int rt6_check_dev(struct rt6_info *rt, int oif)
         return 0;
 }
 
-static inline bool rt6_check_neigh(struct rt6_info *rt)
+static inline int rt6_check_neigh(struct rt6_info *rt)
 {
         struct neighbour *neigh;
-        bool ret = false;
+        int m;
 
-        neigh = rt->n;
+        rcu_read_lock();
+        neigh = dst_get_neighbour(&rt->dst);
         if (rt->rt6i_flags & RTF_NONEXTHOP ||
             !(rt->rt6i_flags & RTF_GATEWAY))
-                ret = true;
+                m = 1;
         else if (neigh) {
                 read_lock_bh(&neigh->lock);
                 if (neigh->nud_state & NUD_VALID)
-                        ret = true;
+                        m = 2;
 #ifdef CONFIG_IPV6_ROUTER_PREF
-                else if (!(neigh->nud_state & NUD_FAILED))
-                        ret = true;
+                else if (neigh->nud_state & NUD_FAILED)
+                        m = 0;
 #endif
+                else
+                        m = 1;
                 read_unlock_bh(&neigh->lock);
-        }
-        return ret;
+        } else
+                m = 0;
+        rcu_read_unlock();
+        return m;
 }
 
 static int rt6_score_route(struct rt6_info *rt, int oif,
                            int strict)
 {
-        int m;
+        int m, n;
 
         m = rt6_check_dev(rt, oif);
         if (!m && (strict & RT6_LOOKUP_F_IFACE))
@@ -577,7 +461,8 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
 #ifdef CONFIG_IPV6_ROUTER_PREF
         m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
 #endif
-        if (!rt6_check_neigh(rt) && (strict & RT6_LOOKUP_F_REACHABLE))
+        n = rt6_check_neigh(rt);
+        if (!n && (strict & RT6_LOOKUP_F_REACHABLE))
                 return -1;
         return m;
 }
@@ -630,6 +515,9 @@ static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
         struct rt6_info *match, *rt0;
         struct net *net;
 
+        RT6_TRACE("%s(fn->leaf=%p, oif=%d)\n",
+                  __func__, fn->leaf, oif);
+
         rt0 = fn->rr_ptr;
         if (!rt0)
                 fn->rr_ptr = rt0 = fn->leaf;
@@ -648,7 +536,10 @@ static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
                         fn->rr_ptr = next;
         }
 
-        net = dev_net(rt0->dst.dev);
+        RT6_TRACE("%s() => %p\n",
+                  __func__, match);
+
+        net = dev_net(rt0->rt6i_dev);
         return match ? match : net->ipv6.ip6_null_entry;
 }
 
@@ -714,12 +605,13 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
                                  (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
 
         if (rt) {
-                if (!addrconf_finite_timeout(lifetime))
-                        rt6_clean_expires(rt);
-                else
-                        rt6_set_expires(rt, jiffies + HZ * lifetime);
-
-                ip6_rt_put(rt);
+                if (!addrconf_finite_timeout(lifetime)) {
+                        rt->rt6i_flags &= ~RTF_EXPIRES;
+                } else {
+                        rt->rt6i_expires = jiffies + HZ * lifetime;
+                        rt->rt6i_flags |= RTF_EXPIRES;
+                }
+                dst_release(&rt->dst);
         }
         return 0;
 }
@@ -741,7 +633,7 @@ do { \
                                 goto restart; \
                 } \
         } \
-} while (0)
+} while(0)
 
 static struct rt6_info *ip6_pol_route_lookup(struct net *net,
                                              struct fib6_table *table,
@@ -755,8 +647,6 @@ static struct rt6_info *ip6_pol_route_lookup(struct net *net,
 restart:
         rt = fn->leaf;
         rt = rt6_device_match(net, rt, &fl6->saddr, fl6->flowi6_oif, flags);
-        if (rt->rt6i_nsiblings && fl6->flowi6_oif == 0)
-                rt = rt6_multipath_select(rt, fl6);
         BACKTRACK(net, &fl6->saddr);
 out:
         dst_use(&rt->dst, jiffies);
@@ -765,13 +655,6 @@ out:
 
 }
 
-struct dst_entry * ip6_route_lookup(struct net *net, struct flowi6 *fl6,
-                                    int flags)
-{
-        return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_lookup);
-}
-EXPORT_SYMBOL_GPL(ip6_route_lookup);
-
 struct rt6_info *rt6_lookup(struct net *net, const struct in6_addr *daddr,
                             const struct in6_addr *saddr, int oif, int strict)
 {
@@ -820,12 +703,12 @@ static int __ip6_ins_rt(struct rt6_info *rt, struct nl_info *info)
 int ip6_ins_rt(struct rt6_info *rt)
 {
         struct nl_info info = {
-                .nl_net = dev_net(rt->dst.dev),
+                .nl_net = dev_net(rt->rt6i_dev),
         };
         return __ip6_ins_rt(rt, &info);
 }
 
-static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
+static struct rt6_info *rt6_alloc_cow(const struct rt6_info *ort,
                                       const struct in6_addr *daddr,
                                       const struct in6_addr *saddr)
 {
@@ -838,27 +721,29 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
         rt = ip6_rt_copy(ort, daddr);
 
         if (rt) {
+                struct neighbour *neigh;
                 int attempts = !in_softirq();
 
-                if (!(rt->rt6i_flags & RTF_GATEWAY)) {
+                if (!(rt->rt6i_flags&RTF_GATEWAY)) {
                         if (ort->rt6i_dst.plen != 128 &&
                             ipv6_addr_equal(&ort->rt6i_dst.addr, daddr))
                                 rt->rt6i_flags |= RTF_ANYCAST;
-                        rt->rt6i_gateway = *daddr;
+                        ipv6_addr_copy(&rt->rt6i_gateway, daddr);
                 }
 
                 rt->rt6i_flags |= RTF_CACHE;
 
 #ifdef CONFIG_IPV6_SUBTREES
                 if (rt->rt6i_src.plen && saddr) {
-                        rt->rt6i_src.addr = *saddr;
+                        ipv6_addr_copy(&rt->rt6i_src.addr, saddr);
                         rt->rt6i_src.plen = 128;
                 }
 #endif
 
         retry:
-                if (rt6_bind_neighbour(rt, rt->dst.dev)) {
-                        struct net *net = dev_net(rt->dst.dev);
+                neigh = ndisc_get_neigh(rt->rt6i_dev, &rt->rt6i_gateway);
+                if (IS_ERR(neigh)) {
+                        struct net *net = dev_net(rt->rt6i_dev);
                         int saved_rt_min_interval =
                                 net->ipv6.sysctl.ip6_rt_gc_min_interval;
                         int saved_rt_elasticity =
@@ -877,10 +762,14 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
                                 goto retry;
                         }
 
-                        net_warn_ratelimited("Neighbour table overflow\n");
+                        if (net_ratelimit())
+                                printk(KERN_WARNING
+                                       "ipv6: Neighbour table overflow.\n");
                         dst_free(&rt->dst);
                         return NULL;
                 }
+                dst_set_neighbour(&rt->dst, neigh);
+
         }
 
         return rt;
@@ -893,7 +782,7 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort,
 
         if (rt) {
                 rt->rt6i_flags |= RTF_CACHE;
-                rt->n = neigh_clone(ort->n);
+                dst_set_neighbour(&rt->dst, neigh_clone(dst_get_neighbour_raw(&ort->dst)));
         }
         return rt;
 }
@@ -918,8 +807,7 @@ restart_2:
 
 restart:
         rt = rt6_select(fn, oif, strict | reachable);
-        if (rt->rt6i_nsiblings && oif == 0)
-                rt = rt6_multipath_select(rt, fl6);
+
         BACKTRACK(net, &fl6->saddr);
         if (rt == net->ipv6.ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
@@ -928,14 +816,14 @@ restart:
         dst_hold(&rt->dst);
         read_unlock_bh(&table->tb6_lock);
 
-        if (!rt->n && !(rt->rt6i_flags & RTF_NONEXTHOP))
+        if (!dst_get_neighbour_raw(&rt->dst) && !(rt->rt6i_flags & RTF_NONEXTHOP))
                 nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
         else if (!(rt->dst.flags & DST_HOST))
                 nrt = rt6_alloc_clone(rt, &fl6->daddr);
         else
                 goto out2;
 
-        ip6_rt_put(rt);
+        dst_release(&rt->dst);
         rt = nrt ? : net->ipv6.ip6_null_entry;
 
         dst_hold(&rt->dst);
@@ -952,7 +840,7 @@ restart:
          * Race condition! In the gap, when table->tb6_lock was
          * released someone could insert this route.  Relookup.
          */
-        ip6_rt_put(rt);
+        dst_release(&rt->dst);
         goto relookup;
 
 out:
@@ -975,16 +863,6 @@ static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *
         return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags);
 }
 
-static struct dst_entry *ip6_route_input_lookup(struct net *net,
-                                                struct net_device *dev,
-                                                struct flowi6 *fl6, int flags)
-{
-        if (rt6_need_strict(&fl6->daddr) && dev->type != ARPHRD_PIMREG)
-                flags |= RT6_LOOKUP_F_IFACE;
-
-        return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_input);
-}
-
 void ip6_route_input(struct sk_buff *skb)
 {
         const struct ipv6hdr *iph = ipv6_hdr(skb);
@@ -994,12 +872,15 @@ void ip6_route_input(struct sk_buff *skb)
                 .flowi6_iif = skb->dev->ifindex,
                 .daddr = iph->daddr,
                 .saddr = iph->saddr,
-                .flowlabel = (* (__be32 *) iph) & IPV6_FLOWINFO_MASK,
+                .flowlabel = (* (__be32 *) iph)&IPV6_FLOWINFO_MASK,
                 .flowi6_mark = skb->mark,
                 .flowi6_proto = iph->nexthdr,
         };
 
-        skb_dst_set(skb, ip6_route_input_lookup(net, skb->dev, &fl6, flags));
+        if (rt6_need_strict(&iph->daddr) && skb->dev->type != ARPHRD_PIMREG)
+                flags |= RT6_LOOKUP_F_IFACE;
+
+        skb_dst_set(skb, fib6_rule_lookup(net, &fl6, flags, ip6_pol_route_input));
 }
 
 static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
@@ -1013,8 +894,6 @@ struct dst_entry * ip6_route_output(struct net *net, const struct sock *sk,
 {
         int flags = 0;
 
-        fl6->flowi6_iif = LOOPBACK_IFINDEX;
-
         if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr))
                 flags |= RT6_LOOKUP_F_IFACE;
 
@@ -1033,12 +912,11 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
         struct rt6_info *rt, *ort = (struct rt6_info *) dst_orig;
         struct dst_entry *new = NULL;
 
-        rt = dst_alloc(&ip6_dst_blackhole_ops, ort->dst.dev, 1, DST_OBSOLETE_NONE, 0);
+        rt = dst_alloc(&ip6_dst_blackhole_ops, ort->dst.dev, 1, 0, 0);
         if (rt) {
-                new = &rt->dst;
+                memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
 
-                memset(new + 1, 0, sizeof(*rt) - sizeof(*new));
-                rt6_init_peer(rt, net->ipv6.peers);
+                new = &rt->dst;
 
                 new->__use = 1;
                 new->input = dst_discard;
@@ -1051,10 +929,10 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
                 rt->rt6i_idev = ort->rt6i_idev;
                 if (rt->rt6i_idev)
                         in6_dev_hold(rt->rt6i_idev);
+                rt->rt6i_expires = 0;
 
-                rt->rt6i_gateway = ort->rt6i_gateway;
-                rt->rt6i_flags = ort->rt6i_flags;
-                rt6_clean_expires(rt);
+                ipv6_addr_copy(&rt->rt6i_gateway, &ort->rt6i_gateway);
+                rt->rt6i_flags = ort->rt6i_flags & ~RTF_EXPIRES;
                 rt->rt6i_metric = 0;
 
                 memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
@@ -1079,16 +957,14 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
 
         rt = (struct rt6_info *) dst;
 
-        /* All IPV6 dsts are created with ->obsolete set to the value
-         * DST_OBSOLETE_FORCE_CHK which forces validation calls down
-         * into this function always.
-         */
-        if (rt->rt6i_genid != rt_genid(dev_net(rt->dst.dev)))
-                return NULL;
-
-        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie)) {
+                if (rt->rt6i_peer_genid != rt6_peer_genid()) {
+                        if (!rt->rt6i_peer)
+                                rt6_bind_peer(rt, 0);
+                        rt->rt6i_peer_genid = rt6_peer_genid();
+                }
                 return dst;
-
+        }
         return NULL;
 }
 
@@ -1118,22 +994,19 @@ static void ip6_link_failure(struct sk_buff *skb)
 
         rt = (struct rt6_info *) skb_dst(skb);
         if (rt) {
-                if (rt->rt6i_flags & RTF_CACHE)
-                        rt6_update_expires(rt, 0);
-                else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
+                if (rt->rt6i_flags&RTF_CACHE) {
+                        dst_set_expires(&rt->dst, 0);
+                        rt->rt6i_flags |= RTF_EXPIRES;
+                } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
                         rt->rt6i_node->fn_sernum = -1;
         }
 }
 
-static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
-                               struct sk_buff *skb, u32 mtu)
+static void ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
         struct rt6_info *rt6 = (struct rt6_info*)dst;
 
-        dst_confirm(dst);
         if (mtu < dst_mtu(dst) && rt6->rt6i_dst.plen == 128) {
-                struct net *net = dev_net(dst->dev);
-
                 rt6->rt6i_flags |= RTF_MODIFIED;
                 if (mtu < IPV6_MIN_MTU) {
                         u32 features = dst_metric(dst, RTAX_FEATURES);
@@ -1142,66 +1015,9 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                         dst_metric_set(dst, RTAX_FEATURES, features);
                 }
                 dst_metric_set(dst, RTAX_MTU, mtu);
-                rt6_update_expires(rt6, net->ipv6.sysctl.ip6_rt_mtu_expires);
         }
 }
 
-void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
-                     int oif, u32 mark)
-{
-        const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
-        struct dst_entry *dst;
-        struct flowi6 fl6;
-
-        memset(&fl6, 0, sizeof(fl6));
-        fl6.flowi6_oif = oif;
-        fl6.flowi6_mark = mark;
-        fl6.flowi6_flags = 0;
-        fl6.daddr = iph->daddr;
-        fl6.saddr = iph->saddr;
-        fl6.flowlabel = (*(__be32 *) iph) & IPV6_FLOWINFO_MASK;
-
-        dst = ip6_route_output(net, NULL, &fl6);
-        if (!dst->error)
-                ip6_rt_update_pmtu(dst, NULL, skb, ntohl(mtu));
-        dst_release(dst);
-}
-EXPORT_SYMBOL_GPL(ip6_update_pmtu);
-
-void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
-{
-        ip6_update_pmtu(skb, sock_net(sk), mtu,
-                        sk->sk_bound_dev_if, sk->sk_mark);
-}
-EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu);
-
-void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark)
-{
-        const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
-        struct dst_entry *dst;
-        struct flowi6 fl6;
-
-        memset(&fl6, 0, sizeof(fl6));
-        fl6.flowi6_oif = oif;
-        fl6.flowi6_mark = mark;
-        fl6.flowi6_flags = 0;
-        fl6.daddr = iph->daddr;
-        fl6.saddr = iph->saddr;
-        fl6.flowlabel = (*(__be32 *) iph) & IPV6_FLOWINFO_MASK;
-
-        dst = ip6_route_output(net, NULL, &fl6);
-        if (!dst->error)
-                rt6_do_redirect(dst, NULL, skb);
-        dst_release(dst);
-}
-EXPORT_SYMBOL_GPL(ip6_redirect);
-
-void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk)
-{
-        ip6_redirect(skb, sock_net(sk), sk->sk_bound_dev_if, sk->sk_mark);
-}
-EXPORT_SYMBOL_GPL(ip6_sk_redirect);
-
 static unsigned int ip6_default_advmss(const struct dst_entry *dst)
 {
         struct net_device *dev = dst->dev;
@@ -1224,15 +1040,10 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
         return mtu;
 }
 
-static unsigned int ip6_mtu(const struct dst_entry *dst)
+static unsigned int ip6_default_mtu(const struct dst_entry *dst)
 {
+        unsigned int mtu = IPV6_MIN_MTU;
         struct inet6_dev *idev;
-        unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
-
-        if (mtu)
-                return mtu;
-
-        mtu = IPV6_MIN_MTU;
 
         rcu_read_lock();
         idev = __in6_dev_get(dst->dev);
@@ -1248,42 +1059,37 @@ static DEFINE_SPINLOCK(icmp6_dst_lock);
 
 struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
                                   struct neighbour *neigh,
-                                  struct flowi6 *fl6)
+                                  const struct in6_addr *addr)
 {
-        struct dst_entry *dst;
         struct rt6_info *rt;
         struct inet6_dev *idev = in6_dev_get(dev);
         struct net *net = dev_net(dev);
 
-        if (unlikely(!idev))
-                return ERR_PTR(-ENODEV);
+        if (unlikely(idev == NULL))
+                return NULL;
 
-        rt = ip6_dst_alloc(net, dev, 0, NULL);
-        if (unlikely(!rt)) {
+        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, dev, 0);
+        if (unlikely(rt == NULL)) {
                 in6_dev_put(idev);
-                dst = ERR_PTR(-ENOMEM);
                 goto out;
         }
 
         if (neigh)
                 neigh_hold(neigh);
         else {
-                neigh = ip6_neigh_lookup(&rt->dst, NULL, &fl6->daddr);
-                if (IS_ERR(neigh)) {
-                        in6_dev_put(idev);
-                        dst_free(&rt->dst);
-                        return ERR_CAST(neigh);
-                }
+                neigh = ndisc_get_neigh(dev, addr);
+                if (IS_ERR(neigh))
+                        neigh = NULL;
         }
 
         rt->dst.flags |= DST_HOST;
         rt->dst.output  = ip6_output;
-        rt->n = neigh;
+        dst_set_neighbour(&rt->dst, neigh);
         atomic_set(&rt->dst.__refcnt, 1);
-        rt->rt6i_dst.addr = fl6->daddr;
+        ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
         rt->rt6i_dst.plen = 128;
         rt->rt6i_idev     = idev;
-        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 0);
+        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 255);
 
         spin_lock_bh(&icmp6_dst_lock);
         rt->dst.next = icmp6_dst_gc_list;
@@ -1292,10 +1098,8 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
 
         fib6_force_start_gc(net);
 
-        dst = xfrm_lookup(net, &rt->dst, flowi6_to_flowi(fl6), NULL, 0);
-
 out:
-        return dst;
+        return &rt->dst;
 }
 
 int icmp6_dst_gc(void)
@@ -1367,6 +1171,12 @@ out:
         return entries > rt_max_size;
 }
 
+/* Clean host part of a prefix. Not necessary in radix tree,
+   but results in cleaner routing tables.
+
+   Remove it only when all the things will work!
+ */
+
 int ip6_dst_hoplimit(struct dst_entry *dst)
 {
         int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT);
@@ -1419,33 +1229,23 @@ int ip6_route_add(struct fib6_config *cfg)
         if (cfg->fc_metric == 0)
                 cfg->fc_metric = IP6_RT_PRIO_USER;
 
-        err = -ENOBUFS;
-        if (cfg->fc_nlinfo.nlh &&
-            !(cfg->fc_nlinfo.nlh->nlmsg_flags & NLM_F_CREATE)) {
-                table = fib6_get_table(net, cfg->fc_table);
-                if (!table) {
-                        pr_warn("NLM_F_CREATE should be specified when creating new route\n");
-                        table = fib6_new_table(net, cfg->fc_table);
-                }
-        } else {
-                table = fib6_new_table(net, cfg->fc_table);
-        }
-
-        if (!table)
+        table = fib6_new_table(net, cfg->fc_table);
+        if (table == NULL) {
+                err = -ENOBUFS;
                 goto out;
+        }
 
-        rt = ip6_dst_alloc(net, NULL, DST_NOCOUNT, table);
+        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, NULL, DST_NOCOUNT);
 
-        if (!rt) {
+        if (rt == NULL) {
                 err = -ENOMEM;
                 goto out;
         }
 
-        if (cfg->fc_flags & RTF_EXPIRES)
-                rt6_set_expires(rt, jiffies +
-                                clock_t_to_jiffies(cfg->fc_expires));
-        else
-                rt6_clean_expires(rt);
+        rt->dst.obsolete = -1;
+        rt->rt6i_expires = (cfg->fc_flags & RTF_EXPIRES) ?
+                                jiffies + clock_t_to_jiffies(cfg->fc_expires) :
+                                0;
 
         if (cfg->fc_protocol == RTPROT_UNSPEC)
                 cfg->fc_protocol = RTPROT_BOOT;
@@ -1486,9 +1286,8 @@ int ip6_route_add(struct fib6_config *cfg)
            they would result in kernel looping; promote them to reject routes
          */
         if ((cfg->fc_flags & RTF_REJECT) ||
-            (dev && (dev->flags & IFF_LOOPBACK) &&
-             !(addr_type & IPV6_ADDR_LOOPBACK) &&
-             !(cfg->fc_flags & RTF_LOCAL))) {
+            (dev && (dev->flags&IFF_LOOPBACK) && !(addr_type&IPV6_ADDR_LOOPBACK)
+                                              && !(cfg->fc_flags&RTF_LOCAL))) {
                 /* hold loopback dev/idev if we haven't done so. */
                 if (dev != net->loopback_dev) {
                         if (dev) {
@@ -1505,21 +1304,8 @@ int ip6_route_add(struct fib6_config *cfg)
                 }
                 rt->dst.output = ip6_pkt_discard_out;
                 rt->dst.input = ip6_pkt_discard;
+                rt->dst.error = -ENETUNREACH;
                 rt->rt6i_flags = RTF_REJECT|RTF_NONEXTHOP;
-                switch (cfg->fc_type) {
-                case RTN_BLACKHOLE:
-                        rt->dst.error = -EINVAL;
-                        break;
-                case RTN_PROHIBIT:
-                        rt->dst.error = -EACCES;
-                        break;
-                case RTN_THROW:
-                        rt->dst.error = -EAGAIN;
-                        break;
-                default:
-                        rt->dst.error = -ENETUNREACH;
-                        break;
-                }
                 goto install_route;
         }
 
@@ -1528,7 +1314,7 @@ int ip6_route_add(struct fib6_config *cfg)
                 int gwa_type;
 
                 gw_addr = &cfg->fc_gateway;
-                rt->rt6i_gateway = *gw_addr;
+                ipv6_addr_copy(&rt->rt6i_gateway, gw_addr);
                 gwa_type = ipv6_addr_type(gw_addr);
 
                 if (gwa_type != (IPV6_ADDR_LINKLOCAL|IPV6_ADDR_UNICAST)) {
@@ -1542,39 +1328,39 @@ int ip6_route_add(struct fib6_config *cfg)
                            some exceptions. --ANK
                          */
                         err = -EINVAL;
-                        if (!(gwa_type & IPV6_ADDR_UNICAST))
+                        if (!(gwa_type&IPV6_ADDR_UNICAST))
                                 goto out;
 
                         grt = rt6_lookup(net, gw_addr, NULL, cfg->fc_ifindex, 1);
 
                         err = -EHOSTUNREACH;
-                        if (!grt)
+                        if (grt == NULL)
                                 goto out;
                         if (dev) {
-                                if (dev != grt->dst.dev) {
-                                        ip6_rt_put(grt);
+                                if (dev != grt->rt6i_dev) {
+                                        dst_release(&grt->dst);
                                         goto out;
                                 }
                         } else {
-                                dev = grt->dst.dev;
+                                dev = grt->rt6i_dev;
                                 idev = grt->rt6i_idev;
                                 dev_hold(dev);
                                 in6_dev_hold(grt->rt6i_idev);
                         }
-                        if (!(grt->rt6i_flags & RTF_GATEWAY))
+                        if (!(grt->rt6i_flags&RTF_GATEWAY))
                                 err = 0;
-                        ip6_rt_put(grt);
+                        dst_release(&grt->dst);
 
                         if (err)
                                 goto out;
                 }
                 err = -EINVAL;
-                if (!dev || (dev->flags & IFF_LOOPBACK))
+                if (dev == NULL || (dev->flags&IFF_LOOPBACK))
                         goto out;
         }
 
         err = -ENODEV;
-        if (!dev)
+        if (dev == NULL)
                 goto out;
 
         if (!ipv6_addr_any(&cfg->fc_prefsrc)) {
@@ -1582,15 +1368,18 @@ int ip6_route_add(struct fib6_config *cfg)
                         err = -EINVAL;
                         goto out;
                 }
-                rt->rt6i_prefsrc.addr = cfg->fc_prefsrc;
+                ipv6_addr_copy(&rt->rt6i_prefsrc.addr, &cfg->fc_prefsrc);
                 rt->rt6i_prefsrc.plen = 128;
         } else
                 rt->rt6i_prefsrc.plen = 0;
 
         if (cfg->fc_flags & (RTF_GATEWAY | RTF_NONEXTHOP)) {
-                err = rt6_bind_neighbour(rt, dev);
-                if (err)
+                struct neighbour *n = __neigh_lookup_errno(&nd_tbl, &rt->rt6i_gateway, dev);
+                if (IS_ERR(n)) {
+                        err = PTR_ERR(n);
                         goto out;
+                }
+                dst_set_neighbour(&rt->dst, n);
         }
 
         rt->rt6i_flags = cfg->fc_flags;
@@ -1636,27 +1425,26 @@ static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
 {
         int err;
         struct fib6_table *table;
-        struct net *net = dev_net(rt->dst.dev);
+        struct net *net = dev_net(rt->rt6i_dev);
 
-        if (rt == net->ipv6.ip6_null_entry) {
-                err = -ENOENT;
-                goto out;
-        }
+        if (rt == net->ipv6.ip6_null_entry)
+                return -ENOENT;
 
         table = rt->rt6i_table;
         write_lock_bh(&table->tb6_lock);
+
         err = fib6_del(rt, info);
+        dst_release(&rt->dst);
+
         write_unlock_bh(&table->tb6_lock);
 
-out:
-        ip6_rt_put(rt);
         return err;
 }
 
 int ip6_del_rt(struct rt6_info *rt)
 {
         struct nl_info info = {
-                .nl_net = dev_net(rt->dst.dev),
+                .nl_net = dev_net(rt->rt6i_dev),
         };
         return __ip6_del_rt(rt, &info);
 }
@@ -1669,7 +1457,7 @@ static int ip6_route_del(struct fib6_config *cfg)
         int err = -ESRCH;
 
         table = fib6_get_table(cfg->fc_nlinfo.nl_net, cfg->fc_table);
-        if (!table)
+        if (table == NULL)
                 return err;
 
         read_lock_bh(&table->tb6_lock);
@@ -1681,8 +1469,8 @@ static int ip6_route_del(struct fib6_config *cfg)
         if (fn) {
                 for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
                         if (cfg->fc_ifindex &&
-                            (!rt->dst.dev ||
-                             rt->dst.dev->ifindex != cfg->fc_ifindex))
+                            (rt->rt6i_dev == NULL ||
+                             rt->rt6i_dev->ifindex != cfg->fc_ifindex))
                                 continue;
                         if (cfg->fc_flags & RTF_GATEWAY &&
                             !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
@@ -1700,93 +1488,108 @@ static int ip6_route_del(struct fib6_config *cfg)
         return err;
 }
 
-static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
+/*
+ *      Handle redirects
+ */
+struct ip6rd_flowi {
+        struct flowi6 fl6;
+        struct in6_addr gateway;
+};
+
+static struct rt6_info *__ip6_route_redirect(struct net *net,
+                                             struct fib6_table *table,
+                                             struct flowi6 *fl6,
+                                             int flags)
 {
-        struct net *net = dev_net(skb->dev);
-        struct netevent_redirect netevent;
-        struct rt6_info *rt, *nrt = NULL;
-        const struct in6_addr *target;
-        struct ndisc_options ndopts;
-        const struct in6_addr *dest;
-        struct neighbour *old_neigh;
-        struct inet6_dev *in6_dev;
-        struct neighbour *neigh;
-        struct icmp6hdr *icmph;
-        int optlen, on_link;
-        u8 *lladdr;
+        struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6;
+        struct rt6_info *rt;
+        struct fib6_node *fn;
 
-        optlen = skb->tail - skb->transport_header;
-        optlen -= sizeof(struct icmp6hdr) + 2 * sizeof(struct in6_addr);
+        /*
+         * Get the "current" route for this destination and
+         * check if the redirect has come from approriate router.
+         *
+         * RFC 2461 specifies that redirects should only be
+         * accepted if they come from the nexthop to the target.
+         * Due to the way the routes are chosen, this notion
+         * is a bit fuzzy and one might need to check all possible
+         * routes.
+         */
 
-        if (optlen < 0) {
-                net_dbg_ratelimited("rt6_do_redirect: packet too short\n");
-                return;
+        read_lock_bh(&table->tb6_lock);
+        fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
+restart:
+        for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
+                /*
+                 * Current route is on-link; redirect is always invalid.
+                 *
+                 * Seems, previous statement is not true. It could
+                 * be node, which looks for us as on-link (f.e. proxy ndisc)
+                 * But then router serving it might decide, that we should
+                 * know truth 8)8) --ANK (980726).
+                 */
+                if (rt6_check_expired(rt))
+                        continue;
+                if (!(rt->rt6i_flags & RTF_GATEWAY))
+                        continue;
+                if (fl6->flowi6_oif != rt->rt6i_dev->ifindex)
+                        continue;
+                if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway))
+                        continue;
+                break;
         }
 
-        icmph = icmp6_hdr(skb);
-        target = (const struct in6_addr *) (icmph + 1);
-        dest = target + 1;
-
-        if (ipv6_addr_is_multicast(dest)) {
-                net_dbg_ratelimited("rt6_do_redirect: destination address is multicast\n");
-                return;
-        }
+        if (!rt)
+                rt = net->ipv6.ip6_null_entry;
+        BACKTRACK(net, &fl6->saddr);
+out:
+        dst_hold(&rt->dst);
 
-        on_link = 0;
-        if (ipv6_addr_equal(dest, target)) {
-                on_link = 1;
-        } else if (ipv6_addr_type(target) !=
-                   (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
-                net_dbg_ratelimited("rt6_do_redirect: target address is not link-local unicast\n");
-                return;
-        }
+        read_unlock_bh(&table->tb6_lock);
 
-        in6_dev = __in6_dev_get(skb->dev);
-        if (!in6_dev)
-                return;
-        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_redirects)
-                return;
+        return rt;
+};
 
-        /* RFC2461 8.1:
-         *      The IP source address of the Redirect MUST be the same as the current
-         *      first-hop router for the specified ICMP Destination Address.
-         */
+static struct rt6_info *ip6_route_redirect(const struct in6_addr *dest,
+                                           const struct in6_addr *src,
+                                           const struct in6_addr *gateway,
+                                           struct net_device *dev)
+{
+        int flags = RT6_LOOKUP_F_HAS_SADDR;
+        struct net *net = dev_net(dev);
+        struct ip6rd_flowi rdfl = {
+                .fl6 = {
+                        .flowi6_oif = dev->ifindex,
+                        .daddr = *dest,
+                        .saddr = *src,
+                },
+        };
 
-        if (!ndisc_parse_options((u8*)(dest + 1), optlen, &ndopts)) {
-                net_dbg_ratelimited("rt6_redirect: invalid ND options\n");
-                return;
-        }
+        ipv6_addr_copy(&rdfl.gateway, gateway);
 
-        lladdr = NULL;
-        if (ndopts.nd_opts_tgt_lladdr) {
-                lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr,
-                                             skb->dev);
-                if (!lladdr) {
-                        net_dbg_ratelimited("rt6_redirect: invalid link-layer address length\n");
-                        return;
-                }
-        }
+        if (rt6_need_strict(dest))
+                flags |= RT6_LOOKUP_F_IFACE;
 
-        rt = (struct rt6_info *) dst;
-        if (rt == net->ipv6.ip6_null_entry) {
-                net_dbg_ratelimited("rt6_redirect: source isn't a valid nexthop for redirect target\n");
-                return;
-        }
+        return (struct rt6_info *)fib6_rule_lookup(net, &rdfl.fl6,
+                                                   flags, __ip6_route_redirect);
+}
 
-        /* Redirect received -> path was valid.
-         * Look, redirects are sent only in response to data packets,
-         * so that this nexthop apparently is reachable. --ANK
-         */
-        dst_confirm(&rt->dst);
+void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
+                  const struct in6_addr *saddr,
+                  struct neighbour *neigh, u8 *lladdr, int on_link)
+{
+        struct rt6_info *rt, *nrt = NULL;
+        struct netevent_redirect netevent;
+        struct net *net = dev_net(neigh->dev);
 
-        neigh = __neigh_lookup(&nd_tbl, target, skb->dev, 1);
-        if (!neigh)
-                return;
+        rt = ip6_route_redirect(dest, src, saddr, neigh->dev);
 
-        /* Duplicate redirect: silently ignore. */
-        old_neigh = rt->n;
-        if (neigh == old_neigh)
+        if (rt == net->ipv6.ip6_null_entry) {
+                if (net_ratelimit())
+                        printk(KERN_DEBUG "rt6_redirect: source isn't a valid nexthop "
+                               "for redirect target\n");
                 goto out;
+        }
 
         /*
          *      We have finally decided to accept it.
@@ -1799,53 +1602,172 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
                                      NEIGH_UPDATE_F_ISROUTER))
                      );
 
+        /*
+         * Redirect received -> path was valid.
+         * Look, redirects are sent only in response to data packets,
+         * so that this nexthop apparently is reachable. --ANK
+         */
+        dst_confirm(&rt->dst);
+
+        /* Duplicate redirect: silently ignore. */
+        if (neigh == dst_get_neighbour_raw(&rt->dst))
+                goto out;
+
         nrt = ip6_rt_copy(rt, dest);
-        if (!nrt)
+        if (nrt == NULL)
                 goto out;
 
         nrt->rt6i_flags = RTF_GATEWAY|RTF_UP|RTF_DYNAMIC|RTF_CACHE;
         if (on_link)
                 nrt->rt6i_flags &= ~RTF_GATEWAY;
 
-        nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key;
-        nrt->n = neigh_clone(neigh);
+        ipv6_addr_copy(&nrt->rt6i_gateway, (struct in6_addr*)neigh->primary_key);
+        dst_set_neighbour(&nrt->dst, neigh_clone(neigh));
 
         if (ip6_ins_rt(nrt))
                 goto out;
 
         netevent.old = &rt->dst;
-        netevent.old_neigh = old_neigh;
         netevent.new = &nrt->dst;
-        netevent.new_neigh = neigh;
-        netevent.daddr = dest;
         call_netevent_notifiers(NETEVENT_REDIRECT, &netevent);
 
-        if (rt->rt6i_flags & RTF_CACHE) {
-                rt = (struct rt6_info *) dst_clone(&rt->dst);
+        if (rt->rt6i_flags&RTF_CACHE) {
+                ip6_del_rt(rt);
+                return;
+        }
+
+out:
+        dst_release(&rt->dst);
+}
+
+/*
+ *      Handle ICMP "packet too big" messages
+ *      i.e. Path MTU discovery
+ */
+
+static void rt6_do_pmtu_disc(const struct in6_addr *daddr, const struct in6_addr *saddr,
+                             struct net *net, u32 pmtu, int ifindex)
+{
+        struct rt6_info *rt, *nrt;
+        int allfrag = 0;
+again:
+        rt = rt6_lookup(net, daddr, saddr, ifindex, 0);
+        if (rt == NULL)
+                return;
+
+        if (rt6_check_expired(rt)) {
                 ip6_del_rt(rt);
+                goto again;
         }
 
+        if (pmtu >= dst_mtu(&rt->dst))
+                goto out;
+
+        if (pmtu < IPV6_MIN_MTU) {
+                /*
+                 * According to RFC2460, PMTU is set to the IPv6 Minimum Link
+                 * MTU (1280) and a fragment header should always be included
+                 * after a node receiving Too Big message reporting PMTU is
+                 * less than the IPv6 Minimum Link MTU.
+                 */
+                pmtu = IPV6_MIN_MTU;
+                allfrag = 1;
+        }
+
+        /* New mtu received -> path was valid.
+           They are sent only in response to data packets,
+           so that this nexthop apparently is reachable. --ANK
+         */
+        dst_confirm(&rt->dst);
+
+        /* Host route. If it is static, it would be better
+           not to override it, but add new one, so that
+           when cache entry will expire old pmtu
+           would return automatically.
+         */
+        if (rt->rt6i_flags & RTF_CACHE) {
+                dst_metric_set(&rt->dst, RTAX_MTU, pmtu);
+                if (allfrag) {
+                        u32 features = dst_metric(&rt->dst, RTAX_FEATURES);
+                        features |= RTAX_FEATURE_ALLFRAG;
+                        dst_metric_set(&rt->dst, RTAX_FEATURES, features);
+                }
+                dst_set_expires(&rt->dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
+                rt->rt6i_flags |= RTF_MODIFIED|RTF_EXPIRES;
+                goto out;
+        }
+
+        /* Network route.
+           Two cases are possible:
+           1. It is connected route. Action: COW
+           2. It is gatewayed route or NONEXTHOP route. Action: clone it.
+         */
+        if (!dst_get_neighbour_raw(&rt->dst) && !(rt->rt6i_flags & RTF_NONEXTHOP))
+                nrt = rt6_alloc_cow(rt, daddr, saddr);
+        else
+                nrt = rt6_alloc_clone(rt, daddr);
+
+        if (nrt) {
+                dst_metric_set(&nrt->dst, RTAX_MTU, pmtu);
+                if (allfrag) {
+                        u32 features = dst_metric(&nrt->dst, RTAX_FEATURES);
+                        features |= RTAX_FEATURE_ALLFRAG;
+                        dst_metric_set(&nrt->dst, RTAX_FEATURES, features);
+                }
+
+                /* According to RFC 1981, detecting PMTU increase shouldn't be
+                 * happened within 5 mins, the recommended timer is 10 mins.
+                 * Here this route expiration time is set to ip6_rt_mtu_expires
+                 * which is 10 mins. After 10 mins the decreased pmtu is expired
+                 * and detecting PMTU increase will be automatically happened.
+                 */
+                dst_set_expires(&nrt->dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
+                nrt->rt6i_flags |= RTF_DYNAMIC|RTF_EXPIRES;
+
+                ip6_ins_rt(nrt);
+        }
 out:
-        neigh_release(neigh);
+        dst_release(&rt->dst);
+}
+
+void rt6_pmtu_discovery(const struct in6_addr *daddr, const struct in6_addr *saddr,
+                        struct net_device *dev, u32 pmtu)
+{
+        struct net *net = dev_net(dev);
+
+        /*
+         * RFC 1981 states that a node "MUST reduce the size of the packets it
+         * is sending along the path" that caused the Packet Too Big message.
+         * Since it's not possible in the general case to determine which
+         * interface was used to send the original packet, we update the MTU
+         * on the interface that will be used to send future packets. We also
+         * update the MTU on the interface that received the Packet Too Big in
+         * case the original packet was forced out that interface with
+         * SO_BINDTODEVICE or similar. This is the next best thing to the
+         * correct behaviour, which would be to update the MTU on all
+         * interfaces.
+         */
+        rt6_do_pmtu_disc(daddr, saddr, net, pmtu, 0);
+        rt6_do_pmtu_disc(daddr, saddr, net, pmtu, dev->ifindex);
 }
 
 /*
  *      Misc support functions
  */
 
-static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
+static struct rt6_info *ip6_rt_copy(const struct rt6_info *ort,
                                     const struct in6_addr *dest)
 {
-        struct net *net = dev_net(ort->dst.dev);
-        struct rt6_info *rt = ip6_dst_alloc(net, ort->dst.dev, 0,
-                                            ort->rt6i_table);
+        struct net *net = dev_net(ort->rt6i_dev);
+        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops,
+                                            ort->dst.dev, 0);
 
         if (rt) {
                 rt->dst.input = ort->dst.input;
                 rt->dst.output = ort->dst.output;
                 rt->dst.flags |= DST_HOST;
 
-                rt->rt6i_dst.addr = *dest;
+                ipv6_addr_copy(&rt->rt6i_dst.addr, dest);
                 rt->rt6i_dst.plen = 128;
                 dst_copy_metrics(&rt->dst, &ort->dst);
                 rt->dst.error = ort->dst.error;
@@ -1853,14 +1775,10 @@ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                 if (rt->rt6i_idev)
                         in6_dev_hold(rt->rt6i_idev);
                 rt->dst.lastuse = jiffies;
+                rt->rt6i_expires = 0;
 
-                rt->rt6i_gateway = ort->rt6i_gateway;
-                rt->rt6i_flags = ort->rt6i_flags;
-                if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
-                    (RTF_DEFAULT | RTF_ADDRCONF))
-                        rt6_set_from(rt, ort);
-                else
-                        rt6_clean_expires(rt);
+                ipv6_addr_copy(&rt->rt6i_gateway, &ort->rt6i_gateway);
+                rt->rt6i_flags = ort->rt6i_flags & ~RTF_EXPIRES;
                 rt->rt6i_metric = 0;
 
 #ifdef CONFIG_IPV6_SUBTREES
@@ -1882,16 +1800,16 @@ static struct rt6_info *rt6_get_route_info(struct net *net,
         struct fib6_table *table;
 
         table = fib6_get_table(net, RT6_TABLE_INFO);
-        if (!table)
+        if (table == NULL)
                 return NULL;
 
-        read_lock_bh(&table->tb6_lock);
+        write_lock_bh(&table->tb6_lock);
         fn = fib6_locate(&table->tb6_root, prefix ,prefixlen, NULL, 0);
         if (!fn)
                 goto out;
 
         for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
-                if (rt->dst.dev->ifindex != ifindex)
+                if (rt->rt6i_dev->ifindex != ifindex)
                         continue;
                 if ((rt->rt6i_flags & (RTF_ROUTEINFO|RTF_GATEWAY)) != (RTF_ROUTEINFO|RTF_GATEWAY))
                         continue;
@@ -1901,14 +1819,14 @@ static struct rt6_info *rt6_get_route_info(struct net *net,
                 break;
         }
 out:
-        read_unlock_bh(&table->tb6_lock);
+        write_unlock_bh(&table->tb6_lock);
         return rt;
 }
 
 static struct rt6_info *rt6_add_route_info(struct net *net,
                                            const struct in6_addr *prefix, int prefixlen,
                                            const struct in6_addr *gwaddr, int ifindex,
-                                           unsigned int pref)
+                                           unsigned pref)
 {
         struct fib6_config cfg = {
                 .fc_table       = RT6_TABLE_INFO,
@@ -1917,13 +1835,13 @@ static struct rt6_info *rt6_add_route_info(struct net *net,
                 .fc_dst_len     = prefixlen,
                 .fc_flags       = RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO |
                                   RTF_UP | RTF_PREF(pref),
-                .fc_nlinfo.portid = 0,
+                .fc_nlinfo.pid = 0,
                 .fc_nlinfo.nlh = NULL,
                 .fc_nlinfo.nl_net = net,
         };
 
-        cfg.fc_dst = *prefix;
-        cfg.fc_gateway = *gwaddr;
+        ipv6_addr_copy(&cfg.fc_dst, prefix);
+        ipv6_addr_copy(&cfg.fc_gateway, gwaddr);
 
         /* We should treat it as a default route if prefix length is 0. */
         if (!prefixlen)
@@ -1941,19 +1859,19 @@ struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_dev
         struct fib6_table *table;
 
         table = fib6_get_table(dev_net(dev), RT6_TABLE_DFLT);
-        if (!table)
+        if (table == NULL)
                 return NULL;
 
-        read_lock_bh(&table->tb6_lock);
+        write_lock_bh(&table->tb6_lock);
         for (rt = table->tb6_root.leaf; rt; rt=rt->dst.rt6_next) {
-                if (dev == rt->dst.dev &&
+                if (dev == rt->rt6i_dev &&
                     ((rt->rt6i_flags & (RTF_ADDRCONF | RTF_DEFAULT)) == (RTF_ADDRCONF | RTF_DEFAULT)) &&
                     ipv6_addr_equal(&rt->rt6i_gateway, addr))
                         break;
         }
         if (rt)
                 dst_hold(&rt->dst);
-        read_unlock_bh(&table->tb6_lock);
+        write_unlock_bh(&table->tb6_lock);
         return rt;
 }
 
@@ -1967,12 +1885,12 @@ struct rt6_info *rt6_add_dflt_router(const struct in6_addr *gwaddr,
                 .fc_ifindex     = dev->ifindex,
                 .fc_flags       = RTF_GATEWAY | RTF_ADDRCONF | RTF_DEFAULT |
                                   RTF_UP | RTF_EXPIRES | RTF_PREF(pref),
-                .fc_nlinfo.portid = 0,
+                .fc_nlinfo.pid = 0,
                 .fc_nlinfo.nlh = NULL,
                 .fc_nlinfo.nl_net = dev_net(dev),
         };
 
-        cfg.fc_gateway = *gwaddr;
+        ipv6_addr_copy(&cfg.fc_gateway, gwaddr);
 
         ip6_route_add(&cfg);
 
@@ -1986,7 +1904,7 @@ void rt6_purge_dflt_routers(struct net *net)
 
         /* NOTE: Keep consistent with rt6_get_dflt_router */
         table = fib6_get_table(net, RT6_TABLE_DFLT);
-        if (!table)
+        if (table == NULL)
                 return;
 
 restart:
@@ -2018,9 +1936,9 @@ static void rtmsg_to_fib6_config(struct net *net,
 
         cfg->fc_nlinfo.nl_net = net;
 
-        cfg->fc_dst = rtmsg->rtmsg_dst;
-        cfg->fc_src = rtmsg->rtmsg_src;
-        cfg->fc_gateway = rtmsg->rtmsg_gateway;
+        ipv6_addr_copy(&cfg->fc_dst, &rtmsg->rtmsg_dst);
+        ipv6_addr_copy(&cfg->fc_src, &rtmsg->rtmsg_src);
+        ipv6_addr_copy(&cfg->fc_gateway, &rtmsg->rtmsg_gateway);
 }
 
 int ipv6_route_ioctl(struct net *net, unsigned int cmd, void __user *arg)
@@ -2032,7 +1950,7 @@ int ipv6_route_ioctl(struct net *net, unsigned int cmd, void __user *arg)
         switch(cmd) {
         case SIOCADDRT:         /* Add a route */
         case SIOCDELRT:         /* Delete a route */
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
                 err = copy_from_user(&rtmsg, arg,
                                      sizeof(struct in6_rtmsg));
@@ -2119,14 +2037,17 @@ static int ip6_pkt_prohibit_out(struct sk_buff *skb)
 
 struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
                                     const struct in6_addr *addr,
-                                    bool anycast)
+                                    int anycast)
 {
         struct net *net = dev_net(idev->dev);
-        struct rt6_info *rt = ip6_dst_alloc(net, net->loopback_dev, 0, NULL);
-        int err;
+        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops,
+                                            net->loopback_dev, 0);
+        struct neighbour *neigh;
 
-        if (!rt) {
-                net_warn_ratelimited("Maximum number of routes reached, consider increasing route/max_size\n");
+        if (rt == NULL) {
+                if (net_ratelimit())
+                        pr_warning("IPv6:  Maximum number of routes reached,"
+                                   " consider increasing route/max_size.\n");
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -2136,19 +2057,22 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         rt->dst.input = ip6_input;
         rt->dst.output = ip6_output;
         rt->rt6i_idev = idev;
+        rt->dst.obsolete = -1;
 
         rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
         if (anycast)
                 rt->rt6i_flags |= RTF_ANYCAST;
         else
                 rt->rt6i_flags |= RTF_LOCAL;
-        err = rt6_bind_neighbour(rt, rt->dst.dev);
-        if (err) {
+        neigh = ndisc_get_neigh(rt->rt6i_dev, &rt->rt6i_gateway);
+        if (IS_ERR(neigh)) {
                 dst_free(&rt->dst);
-                return ERR_PTR(err);
+
+                return ERR_CAST(neigh);
         }
+        dst_set_neighbour(&rt->dst, neigh);
 
-        rt->rt6i_dst.addr = *addr;
+        ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
         rt->rt6i_dst.plen = 128;
         rt->rt6i_table = fib6_get_table(net, RT6_TABLE_LOCAL);
 
@@ -2166,7 +2090,7 @@ int ip6_route_get_saddr(struct net *net,
         struct inet6_dev *idev = ip6_dst_idev((struct dst_entry*)rt);
         int err = 0;
         if (rt->rt6i_prefsrc.plen)
-                *saddr = rt->rt6i_prefsrc.addr;
+                ipv6_addr_copy(saddr, &rt->rt6i_prefsrc.addr);
         else
                 err = ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
                                          daddr, prefs, saddr);
@@ -2186,7 +2110,7 @@ static int fib6_remove_prefsrc(struct rt6_info *rt, void *arg)
         struct net *net = ((struct arg_dev_net_ip *)arg)->net;
         struct in6_addr *addr = ((struct arg_dev_net_ip *)arg)->addr;
 
-        if (((void *)rt->dst.dev == dev || !dev) &&
+        if (((void *)rt->rt6i_dev == dev || dev == NULL) &&
             rt != net->ipv6.ip6_null_entry &&
             ipv6_addr_equal(addr, &rt->rt6i_prefsrc.addr)) {
                 /* remove prefsrc entry */
@@ -2216,10 +2140,11 @@ static int fib6_ifdown(struct rt6_info *rt, void *arg)
         const struct arg_dev_net *adn = arg;
         const struct net_device *dev = adn->dev;
 
-        if ((rt->dst.dev == dev || !dev) &&
-            rt != adn->net->ipv6.ip6_null_entry)
+        if ((rt->rt6i_dev == dev || dev == NULL) &&
+            rt != adn->net->ipv6.ip6_null_entry) {
+                RT6_TRACE("deleted by ifdown %p\n", rt);
                 return -1;
-
+        }
         return 0;
 }
 
@@ -2234,9 +2159,10 @@ void rt6_ifdown(struct net *net, struct net_device *dev)
         icmp6_clean_all(fib6_ifdown, &adn);
 }
 
-struct rt6_mtu_change_arg {
+struct rt6_mtu_change_arg
+{
         struct net_device *dev;
-        unsigned int mtu;
+        unsigned mtu;
 };
 
 static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
@@ -2251,7 +2177,7 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
         */
 
         idev = __in6_dev_get(arg->dev);
-        if (!idev)
+        if (idev == NULL)
                 return 0;
 
         /* For administrative MTU increase, there is no way to discover
@@ -2268,7 +2194,7 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
            also have the lowest MTU, TOO BIG MESSAGE will be lead to
            PMTU discouvery.
          */
-        if (rt->dst.dev == arg->dev &&
+        if (rt->rt6i_dev == arg->dev &&
             !dst_metric_locked(&rt->dst, RTAX_MTU) &&
             (dst_mtu(&rt->dst) >= arg->mtu ||
              (dst_mtu(&rt->dst) < arg->mtu &&
@@ -2278,7 +2204,7 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
         return 0;
 }
 
-void rt6_mtu_change(struct net_device *dev, unsigned int mtu)
+void rt6_mtu_change(struct net_device *dev, unsigned mtu)
 {
         struct rt6_mtu_change_arg arg = {
                 .dev = dev,
@@ -2294,7 +2220,6 @@ static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
         [RTA_IIF]               = { .type = NLA_U32 },
         [RTA_PRIORITY]          = { .type = NLA_U32 },
         [RTA_METRICS]           = { .type = NLA_NESTED },
-        [RTA_MULTIPATH]         = { .len = sizeof(struct rtnexthop) },
 };
 
 static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
@@ -2317,18 +2242,14 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         cfg->fc_src_len = rtm->rtm_src_len;
         cfg->fc_flags = RTF_UP;
         cfg->fc_protocol = rtm->rtm_protocol;
-        cfg->fc_type = rtm->rtm_type;
 
-        if (rtm->rtm_type == RTN_UNREACHABLE ||
-            rtm->rtm_type == RTN_BLACKHOLE ||
-            rtm->rtm_type == RTN_PROHIBIT ||
-            rtm->rtm_type == RTN_THROW)
+        if (rtm->rtm_type == RTN_UNREACHABLE)
                 cfg->fc_flags |= RTF_REJECT;
 
         if (rtm->rtm_type == RTN_LOCAL)
                 cfg->fc_flags |= RTF_LOCAL;
 
-        cfg->fc_nlinfo.portid = NETLINK_CB(skb).portid;
+        cfg->fc_nlinfo.pid = NETLINK_CB(skb).pid;
         cfg->fc_nlinfo.nlh = nlh;
         cfg->fc_nlinfo.nl_net = sock_net(skb->sk);
 
@@ -2372,71 +2293,11 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (tb[RTA_TABLE])
                 cfg->fc_table = nla_get_u32(tb[RTA_TABLE]);
 
-        if (tb[RTA_MULTIPATH]) {
-                cfg->fc_mp = nla_data(tb[RTA_MULTIPATH]);
-                cfg->fc_mp_len = nla_len(tb[RTA_MULTIPATH]);
-        }
-
         err = 0;
 errout:
         return err;
 }
 
-static int ip6_route_multipath(struct fib6_config *cfg, int add)
-{
-        struct fib6_config r_cfg;
-        struct rtnexthop *rtnh;
-        int remaining;
-        int attrlen;
-        int err = 0, last_err = 0;
-
-beginning:
-        rtnh = (struct rtnexthop *)cfg->fc_mp;
-        remaining = cfg->fc_mp_len;
-
-        /* Parse a Multipath Entry */
-        while (rtnh_ok(rtnh, remaining)) {
-                memcpy(&r_cfg, cfg, sizeof(*cfg));
-                if (rtnh->rtnh_ifindex)
-                        r_cfg.fc_ifindex = rtnh->rtnh_ifindex;
-
-                attrlen = rtnh_attrlen(rtnh);
-                if (attrlen > 0) {
-                        struct nlattr *nla, *attrs = rtnh_attrs(rtnh);
-
-                        nla = nla_find(attrs, attrlen, RTA_GATEWAY);
-                        if (nla) {
-                                nla_memcpy(&r_cfg.fc_gateway, nla, 16);
-                                r_cfg.fc_flags |= RTF_GATEWAY;
-                        }
-                }
-                err = add ? ip6_route_add(&r_cfg) : ip6_route_del(&r_cfg);
-                if (err) {
-                        last_err = err;
-                        /* If we are trying to remove a route, do not stop the
-                         * loop when ip6_route_del() fails (because next hop is
-                         * already gone), we should try to remove all next hops.
-                         */
-                        if (add) {
-                                /* If add fails, we should try to delete all
-                                 * next hops that have been already added.
-                                 */
-                                add = 0;
-                                goto beginning;
-                        }
-                }
-                /* Because each route is added like a single route we remove
-                 * this flag after the first nexthop (if there is a collision,
-                 * we have already fail to add the first nexthop:
-                 * fib6_add_rt2node() has reject it).
-                 */
-                cfg->fc_nlinfo.nlh->nlmsg_flags &= ~NLM_F_EXCL;
-                rtnh = rtnh_next(rtnh, &remaining);
-        }
-
-        return last_err;
-}
-
 static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
         struct fib6_config cfg;
@@ -2446,10 +2307,7 @@ static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *a
         if (err < 0)
                 return err;
 
-        if (cfg.fc_mp)
-                return ip6_route_multipath(&cfg, 0);
-        else
-                return ip6_route_del(&cfg);
+        return ip6_route_del(&cfg);
 }
 
 static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
@@ -2461,10 +2319,7 @@ static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *a
         if (err < 0)
                 return err;
 
-        if (cfg.fc_mp)
-                return ip6_route_multipath(&cfg, 1);
-        else
-                return ip6_route_add(&cfg);
+        return ip6_route_add(&cfg);
 }
 
 static inline size_t rt6_nlmsg_size(void)
@@ -2485,7 +2340,7 @@ static inline size_t rt6_nlmsg_size(void)
 static int rt6_fill_node(struct net *net,
                          struct sk_buff *skb, struct rt6_info *rt,
                          struct in6_addr *dst, struct in6_addr *src,
-                         int iif, int type, u32 portid, u32 seq,
+                         int iif, int type, u32 pid, u32 seq,
                          int prefix, int nowait, unsigned int flags)
 {
         struct rtmsg *rtm;
@@ -2501,8 +2356,8 @@ static int rt6_fill_node(struct net *net,
                 }
         }
 
-        nlh = nlmsg_put(skb, portid, seq, type, sizeof(*rtm), flags);
-        if (!nlh)
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*rtm), flags);
+        if (nlh == NULL)
                 return -EMSGSIZE;
 
         rtm = nlmsg_data(nlh);
@@ -2515,60 +2370,39 @@ static int rt6_fill_node(struct net *net,
         else
                 table = RT6_TABLE_UNSPEC;
         rtm->rtm_table = table;
-        if (nla_put_u32(skb, RTA_TABLE, table))
-                goto nla_put_failure;
-        if (rt->rt6i_flags & RTF_REJECT) {
-                switch (rt->dst.error) {
-                case -EINVAL:
-                        rtm->rtm_type = RTN_BLACKHOLE;
-                        break;
-                case -EACCES:
-                        rtm->rtm_type = RTN_PROHIBIT;
-                        break;
-                case -EAGAIN:
-                        rtm->rtm_type = RTN_THROW;
-                        break;
-                default:
-                        rtm->rtm_type = RTN_UNREACHABLE;
-                        break;
-                }
-        }
-        else if (rt->rt6i_flags & RTF_LOCAL)
+        NLA_PUT_U32(skb, RTA_TABLE, table);
+        if (rt->rt6i_flags&RTF_REJECT)
+                rtm->rtm_type = RTN_UNREACHABLE;
+        else if (rt->rt6i_flags&RTF_LOCAL)
                 rtm->rtm_type = RTN_LOCAL;
-        else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
+        else if (rt->rt6i_dev && (rt->rt6i_dev->flags&IFF_LOOPBACK))
                 rtm->rtm_type = RTN_LOCAL;
         else
                 rtm->rtm_type = RTN_UNICAST;
         rtm->rtm_flags = 0;
         rtm->rtm_scope = RT_SCOPE_UNIVERSE;
         rtm->rtm_protocol = rt->rt6i_protocol;
-        if (rt->rt6i_flags & RTF_DYNAMIC)
+        if (rt->rt6i_flags&RTF_DYNAMIC)
                 rtm->rtm_protocol = RTPROT_REDIRECT;
-        else if (rt->rt6i_flags & RTF_ADDRCONF) {
-                if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ROUTEINFO))
-                        rtm->rtm_protocol = RTPROT_RA;
-                else
-                        rtm->rtm_protocol = RTPROT_KERNEL;
-        }
+        else if (rt->rt6i_flags & RTF_ADDRCONF)
+                rtm->rtm_protocol = RTPROT_KERNEL;
+        else if (rt->rt6i_flags&RTF_DEFAULT)
+                rtm->rtm_protocol = RTPROT_RA;
 
-        if (rt->rt6i_flags & RTF_CACHE)
+        if (rt->rt6i_flags&RTF_CACHE)
                 rtm->rtm_flags |= RTM_F_CLONED;
 
         if (dst) {
-                if (nla_put(skb, RTA_DST, 16, dst))
-                        goto nla_put_failure;
+                NLA_PUT(skb, RTA_DST, 16, dst);
                 rtm->rtm_dst_len = 128;
         } else if (rtm->rtm_dst_len)
-                if (nla_put(skb, RTA_DST, 16, &rt->rt6i_dst.addr))
-                        goto nla_put_failure;
+                NLA_PUT(skb, RTA_DST, 16, &rt->rt6i_dst.addr);
 #ifdef CONFIG_IPV6_SUBTREES
         if (src) {
-                if (nla_put(skb, RTA_SRC, 16, src))
-                        goto nla_put_failure;
+                NLA_PUT(skb, RTA_SRC, 16, src);
                 rtm->rtm_src_len = 128;
-        } else if (rtm->rtm_src_len &&
-                   nla_put(skb, RTA_SRC, 16, &rt->rt6i_src.addr))
-                goto nla_put_failure;
+        } else if (rtm->rtm_src_len)
+                NLA_PUT(skb, RTA_SRC, 16, &rt->rt6i_src.addr);
 #endif
         if (iif) {
 #ifdef CONFIG_IPV6_MROUTE
@@ -2586,40 +2420,42 @@ static int rt6_fill_node(struct net *net,
                         }
                 } else
 #endif
-                        if (nla_put_u32(skb, RTA_IIF, iif))
-                                goto nla_put_failure;
+                        NLA_PUT_U32(skb, RTA_IIF, iif);
         } else if (dst) {
                 struct in6_addr saddr_buf;
-                if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf) == 0 &&
-                    nla_put(skb, RTA_PREFSRC, 16, &saddr_buf))
-                        goto nla_put_failure;
+                if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf) == 0)
+                        NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
         }
 
         if (rt->rt6i_prefsrc.plen) {
                 struct in6_addr saddr_buf;
-                saddr_buf = rt->rt6i_prefsrc.addr;
-                if (nla_put(skb, RTA_PREFSRC, 16, &saddr_buf))
-                        goto nla_put_failure;
+                ipv6_addr_copy(&saddr_buf, &rt->rt6i_prefsrc.addr);
+                NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
         }
 
         if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                 goto nla_put_failure;
 
-        n = rt->n;
-        if (n) {
-                if (nla_put(skb, RTA_GATEWAY, 16, &n->primary_key) < 0)
-                        goto nla_put_failure;
-        }
+        rcu_read_lock();
+        n = dst_get_neighbour(&rt->dst);
+        if (n)
+                NLA_PUT(skb, RTA_GATEWAY, 16, &n->primary_key);
+        rcu_read_unlock();
 
-        if (rt->dst.dev &&
-            nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
-                goto nla_put_failure;
-        if (nla_put_u32(skb, RTA_PRIORITY, rt->rt6i_metric))
-                goto nla_put_failure;
+        if (rt->dst.dev)
+                NLA_PUT_U32(skb, RTA_OIF, rt->rt6i_dev->ifindex);
+
+        NLA_PUT_U32(skb, RTA_PRIORITY, rt->rt6i_metric);
 
-        expires = (rt->rt6i_flags & RTF_EXPIRES) ? rt->dst.expires - jiffies : 0;
+        if (!(rt->rt6i_flags & RTF_EXPIRES))
+                expires = 0;
+        else if (rt->rt6i_expires - jiffies < INT_MAX)
+                expires = rt->rt6i_expires - jiffies;
+        else
+                expires = INT_MAX;
 
-        if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, rt->dst.error) < 0)
+        if (rtnl_put_cacheinfo(skb, &rt->dst, 0, 0, 0,
+                               expires, rt->dst.error) < 0)
                 goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
@@ -2642,7 +2478,7 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
 
         return rt6_fill_node(arg->net,
                      arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
-                     NETLINK_CB(arg->cb->skb).portid, arg->cb->nlh->nlmsg_seq,
+                     NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
                      prefix, 0, NLM_F_MULTI);
 }
 
@@ -2654,7 +2490,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         struct sk_buff *skb;
         struct rtmsg *rtm;
         struct flowi6 fl6;
-        int err, iif = 0, oif = 0;
+        int err, iif = 0;
 
         err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
         if (err < 0)
@@ -2667,48 +2503,33 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
                 if (nla_len(tb[RTA_SRC]) < sizeof(struct in6_addr))
                         goto errout;
 
-                fl6.saddr = *(struct in6_addr *)nla_data(tb[RTA_SRC]);
+                ipv6_addr_copy(&fl6.saddr, nla_data(tb[RTA_SRC]));
         }
 
         if (tb[RTA_DST]) {
                 if (nla_len(tb[RTA_DST]) < sizeof(struct in6_addr))
                         goto errout;
 
-                fl6.daddr = *(struct in6_addr *)nla_data(tb[RTA_DST]);
+                ipv6_addr_copy(&fl6.daddr, nla_data(tb[RTA_DST]));
         }
 
         if (tb[RTA_IIF])
                 iif = nla_get_u32(tb[RTA_IIF]);
 
         if (tb[RTA_OIF])
-                oif = nla_get_u32(tb[RTA_OIF]);
+                fl6.flowi6_oif = nla_get_u32(tb[RTA_OIF]);
 
         if (iif) {
                 struct net_device *dev;
-                int flags = 0;
-
                 dev = __dev_get_by_index(net, iif);
                 if (!dev) {
                         err = -ENODEV;
                         goto errout;
                 }
-
-                fl6.flowi6_iif = iif;
-
-                if (!ipv6_addr_any(&fl6.saddr))
-                        flags |= RT6_LOOKUP_F_HAS_SADDR;
-
-                rt = (struct rt6_info *)ip6_route_input_lookup(net, dev, &fl6,
-                                                               flags);
-        } else {
-                fl6.flowi6_oif = oif;
-
-                rt = (struct rt6_info *)ip6_route_output(net, NULL, &fl6);
         }
 
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
-        if (!skb) {
-                ip6_rt_put(rt);
+        if (skb == NULL) {
                 err = -ENOBUFS;
                 goto errout;
         }
@@ -2719,17 +2540,18 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         skb_reset_mac_header(skb);
         skb_reserve(skb, MAX_HEADER + sizeof(struct ipv6hdr));
 
+        rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl6);
         skb_dst_set(skb, &rt->dst);
 
         err = rt6_fill_node(net, skb, rt, &fl6.daddr, &fl6.saddr, iif,
-                            RTM_NEWROUTE, NETLINK_CB(in_skb).portid,
+                            RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
                             nlh->nlmsg_seq, 0, 0, 0);
         if (err < 0) {
                 kfree_skb(skb);
                 goto errout;
         }
 
-        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
+        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid);
 errout:
         return err;
 }
@@ -2742,21 +2564,21 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
         int err;
 
         err = -ENOBUFS;
-        seq = info->nlh ? info->nlh->nlmsg_seq : 0;
+        seq = info->nlh != NULL ? info->nlh->nlmsg_seq : 0;
 
         skb = nlmsg_new(rt6_nlmsg_size(), gfp_any());
-        if (!skb)
+        if (skb == NULL)
                 goto errout;
 
         err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
-                                event, info->portid, seq, 0, 0, 0);
+                                event, info->pid, seq, 0, 0, 0);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
                 kfree_skb(skb);
                 goto errout;
         }
-        rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE,
+        rtnl_notify(skb, net, info->pid, RTNLGRP_IPV6_ROUTE,
                     info->nlh, gfp_any());
         return;
 errout:
@@ -2811,23 +2633,25 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 #else
         seq_puts(m, "00000000000000000000000000000000 00 ");
 #endif
-        n = rt->n;
+        rcu_read_lock();
+        n = dst_get_neighbour(&rt->dst);
         if (n) {
                 seq_printf(m, "%pi6", n->primary_key);
         } else {
                 seq_puts(m, "00000000000000000000000000000000");
         }
+        rcu_read_unlock();
         seq_printf(m, " %08x %08x %08x %08x %8s\n",
                    rt->rt6i_metric, atomic_read(&rt->dst.__refcnt),
                    rt->dst.__use, rt->rt6i_flags,
-                   rt->dst.dev ? rt->dst.dev->name : "");
+                   rt->rt6i_dev ? rt->rt6i_dev->name : "");
         return 0;
 }
 
 static int ipv6_route_show(struct seq_file *m, void *v)
 {
         struct net *net = (struct net *)m->private;
-        fib6_clean_all_ro(net, rt6_info_route, 0, m);
+        fib6_clean_all(net, rt6_info_route, 0, m);
         return 0;
 }
 
@@ -2985,10 +2809,6 @@ struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
                 table[7].data = &net->ipv6.sysctl.ip6_rt_mtu_expires;
                 table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
                 table[9].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
-
-                /* Don't export sysctls to unprivileged users */
-                if (net->user_ns != &init_user_ns)
-                        table[0].procname = NULL;
         }
 
         return table;
@@ -3049,6 +2869,10 @@ static int __net_init ip6_route_net_init(struct net *net)
         net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
         net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;
 
+#ifdef CONFIG_PROC_FS
+        proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
+        proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
+#endif
         net->ipv6.ip6_rt_gc_expire = 30*HZ;
 
         ret = 0;
@@ -3069,6 +2893,10 @@ out_ip6_dst_ops:
 
 static void __net_exit ip6_route_net_exit(struct net *net)
 {
+#ifdef CONFIG_PROC_FS
+        proc_net_remove(net, "ipv6_route");
+        proc_net_remove(net, "rt6_stats");
+#endif
         kfree(net->ipv6.ip6_null_entry);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
         kfree(net->ipv6.ip6_prohibit_entry);
@@ -3077,58 +2905,11 @@ static void __net_exit ip6_route_net_exit(struct net *net)
         dst_entries_destroy(&net->ipv6.ip6_dst_ops);
 }
 
-static int __net_init ip6_route_net_init_late(struct net *net)
-{
-#ifdef CONFIG_PROC_FS
-        proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
-        proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
-#endif
-        return 0;
-}
-
-static void __net_exit ip6_route_net_exit_late(struct net *net)
-{
-#ifdef CONFIG_PROC_FS
-        proc_net_remove(net, "ipv6_route");
-        proc_net_remove(net, "rt6_stats");
-#endif
-}
-
 static struct pernet_operations ip6_route_net_ops = {
         .init = ip6_route_net_init,
         .exit = ip6_route_net_exit,
 };
 
-static int __net_init ipv6_inetpeer_init(struct net *net)
-{
-        struct inet_peer_base *bp = kmalloc(sizeof(*bp), GFP_KERNEL);
-
-        if (!bp)
-                return -ENOMEM;
-        inet_peer_base_init(bp);
-        net->ipv6.peers = bp;
-        return 0;
-}
-
-static void __net_exit ipv6_inetpeer_exit(struct net *net)
-{
-        struct inet_peer_base *bp = net->ipv6.peers;
-
-        net->ipv6.peers = NULL;
-        inetpeer_invalidate_tree(bp);
-        kfree(bp);
-}
-
-static struct pernet_operations ipv6_inetpeer_ops = {
-        .init   =       ipv6_inetpeer_init,
-        .exit   =       ipv6_inetpeer_exit,
-};
-
-static struct pernet_operations ip6_route_net_late_ops = {
-        .init = ip6_route_net_init_late,
-        .exit = ip6_route_net_exit_late,
-};
-
 static struct notifier_block ip6_route_dev_notifier = {
         .notifier_call = ip6_route_dev_notify,
         .priority = 0,
@@ -3149,13 +2930,9 @@ int __init ip6_route_init(void)
         if (ret)
                 goto out_kmem_cache;
 
-        ret = register_pernet_subsys(&ipv6_inetpeer_ops);
-        if (ret)
-                goto out_dst_entries;
-
         ret = register_pernet_subsys(&ip6_route_net_ops);
         if (ret)
-                goto out_register_inetpeer;
+                goto out_dst_entries;
 
         ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
 
@@ -3182,25 +2959,19 @@ int __init ip6_route_init(void)
         if (ret)
                 goto xfrm6_init;
 
-        ret = register_pernet_subsys(&ip6_route_net_late_ops);
-        if (ret)
-                goto fib6_rules_init;
-
         ret = -ENOBUFS;
         if (__rtnl_register(PF_INET6, RTM_NEWROUTE, inet6_rtm_newroute, NULL, NULL) ||
             __rtnl_register(PF_INET6, RTM_DELROUTE, inet6_rtm_delroute, NULL, NULL) ||
             __rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL, NULL))
-                goto out_register_late_subsys;
+                goto fib6_rules_init;
 
         ret = register_netdevice_notifier(&ip6_route_dev_notifier);
         if (ret)
-                goto out_register_late_subsys;
+                goto fib6_rules_init;
 
 out:
         return ret;
 
-out_register_late_subsys:
-        unregister_pernet_subsys(&ip6_route_net_late_ops);
 fib6_rules_init:
         fib6_rules_cleanup();
 xfrm6_init:
@@ -3209,8 +2980,6 @@ out_fib6_init:
         fib6_gc_cleanup();
 out_register_subsys:
         unregister_pernet_subsys(&ip6_route_net_ops);
-out_register_inetpeer:
-        unregister_pernet_subsys(&ipv6_inetpeer_ops);
 out_dst_entries:
         dst_entries_destroy(&ip6_dst_blackhole_ops);
 out_kmem_cache:
@@ -3221,11 +2990,9 @@ out_kmem_cache:
 void ip6_route_cleanup(void)
 {
         unregister_netdevice_notifier(&ip6_route_dev_notifier);
-        unregister_pernet_subsys(&ip6_route_net_late_ops);
         fib6_rules_cleanup();
         xfrm6_fini();
         fib6_gc_cleanup();
-        unregister_pernet_subsys(&ipv6_inetpeer_ops);
         unregister_pernet_subsys(&ip6_route_net_ops);
         dst_entries_destroy(&ip6_dst_blackhole_ops);
         kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index cfba99b2c2a..c1e0d63db2e 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -17,8 +17,6 @@
  * Fred Templin <fred.l.templin@boeing.com>:    isatap support
  */
 
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
 #include <linux/module.h>
 #include <linux/capability.h>
 #include <linux/errno.h>
@@ -65,14 +63,9 @@
 #define HASH_SIZE  16
 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 
-static bool log_ecn_error = true;
-module_param(log_ecn_error, bool, 0644);
-MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
-
 static int ipip6_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_setup(struct net_device *dev);
 static void ipip6_dev_free(struct net_device *dev);
-static struct rtnl_link_ops sit_link_ops __read_mostly;
 
 static int sit_net_id __read_mostly;
 struct sit_net {
@@ -85,45 +78,44 @@ struct sit_net {
         struct net_device *fb_tunnel_dev;
 };
 
-static struct rtnl_link_stats64 *ipip6_get_stats64(struct net_device *dev,
-                                                   struct rtnl_link_stats64 *tot)
+/*
+ * Locking : hash tables are protected by RCU and RTNL
+ */
+
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
+
+/* often modified stats are per cpu, other are shared (netdev->stats) */
+struct pcpu_tstats {
+        unsigned long   rx_packets;
+        unsigned long   rx_bytes;
+        unsigned long   tx_packets;
+        unsigned long   tx_bytes;
+};
+
+static struct net_device_stats *ipip6_get_stats(struct net_device *dev)
 {
+        struct pcpu_tstats sum = { 0 };
         int i;
 
         for_each_possible_cpu(i) {
                 const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
-                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
-                unsigned int start;
-
-                do {
-                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
-                        rx_packets = tstats->rx_packets;
-                        tx_packets = tstats->tx_packets;
-                        rx_bytes = tstats->rx_bytes;
-                        tx_bytes = tstats->tx_bytes;
-                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
-
-                tot->rx_packets += rx_packets;
-                tot->tx_packets += tx_packets;
-                tot->rx_bytes   += rx_bytes;
-                tot->tx_bytes   += tx_bytes;
-        }
-
-        tot->rx_errors = dev->stats.rx_errors;
-        tot->rx_frame_errors = dev->stats.rx_frame_errors;
-        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
-        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
-        tot->tx_dropped = dev->stats.tx_dropped;
-        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
-        tot->tx_errors = dev->stats.tx_errors;
 
-        return tot;
+                sum.rx_packets += tstats->rx_packets;
+                sum.rx_bytes   += tstats->rx_bytes;
+                sum.tx_packets += tstats->tx_packets;
+                sum.tx_bytes   += tstats->tx_bytes;
+        }
+        dev->stats.rx_packets = sum.rx_packets;
+        dev->stats.rx_bytes   = sum.rx_bytes;
+        dev->stats.tx_packets = sum.tx_packets;
+        dev->stats.tx_bytes   = sum.tx_bytes;
+        return &dev->stats;
 }
-
 /*
  * Must be invoked with rcu_read_lock
  */
-static struct ip_tunnel *ipip6_tunnel_lookup(struct net *net,
+static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
                 struct net_device *dev, __be32 remote, __be32 local)
 {
         unsigned int h0 = HASH(remote);
@@ -131,20 +123,20 @@ static struct ip_tunnel *ipip6_tunnel_lookup(struct net *net,
         struct ip_tunnel *t;
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
-        for_each_ip_tunnel_rcu(t, sitn->tunnels_r_l[h0 ^ h1]) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r_l[h0 ^ h1]) {
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        for_each_ip_tunnel_rcu(t, sitn->tunnels_r[h0]) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r[h0]) {
                 if (remote == t->parms.iph.daddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        for_each_ip_tunnel_rcu(t, sitn->tunnels_l[h1]) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_l[h1]) {
                 if (local == t->parms.iph.saddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
@@ -221,37 +213,6 @@ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
 #endif
 }
 
-static int ipip6_tunnel_create(struct net_device *dev)
-{
-        struct ip_tunnel *t = netdev_priv(dev);
-        struct net *net = dev_net(dev);
-        struct sit_net *sitn = net_generic(net, sit_net_id);
-        int err;
-
-        err = ipip6_tunnel_init(dev);
-        if (err < 0)
-                goto out;
-        ipip6_tunnel_clone_6rd(dev, sitn);
-
-        if ((__force u16)t->parms.i_flags & SIT_ISATAP)
-                dev->priv_flags |= IFF_ISATAP;
-
-        err = register_netdevice(dev);
-        if (err < 0)
-                goto out;
-
-        strcpy(t->parms.name, dev->name);
-        dev->rtnl_link_ops = &sit_link_ops;
-
-        dev_hold(dev);
-
-        ipip6_tunnel_link(sitn, t);
-        return 0;
-
-out:
-        return err;
-}
-
 static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
                 struct ip_tunnel_parm *parms, int create)
 {
@@ -292,9 +253,21 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
         nt = netdev_priv(dev);
 
         nt->parms = *parms;
-        if (ipip6_tunnel_create(dev) < 0)
+        if (ipip6_tunnel_init(dev) < 0)
+                goto failed_free;
+        ipip6_tunnel_clone_6rd(dev, sitn);
+
+        if (parms->i_flags & SIT_ISATAP)
+                dev->priv_flags |= IFF_ISATAP;
+
+        if (register_netdevice(dev) < 0)
                 goto failed_free;
 
+        strcpy(nt->parms.name, dev->name);
+
+        dev_hold(dev);
+
+        ipip6_tunnel_link(sitn, nt);
         return nt;
 
 failed_free:
@@ -503,7 +476,7 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
         if (dev == sitn->fb_tunnel_dev) {
-                RCU_INIT_POINTER(sitn->tunnels_wc[0], NULL);
+                rcu_assign_pointer(sitn->tunnels_wc[0], NULL);
         } else {
                 ipip6_tunnel_unlink(sitn, netdev_priv(dev));
                 ipip6_tunnel_del_prl(netdev_priv(dev), NULL);
@@ -536,6 +509,9 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                 case ICMP_PORT_UNREACH:
                         /* Impossible event. */
                         return 0;
+                case ICMP_FRAG_NEEDED:
+                        /* Soft state for pmtu is maintained by IP core. */
+                        return 0;
                 default:
                         /* All others are translated to HOST_UNREACH.
                            rfc2003 contains "deep thoughts" about NET_UNREACH,
@@ -548,33 +524,16 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                 if (code != ICMP_EXC_TTL)
                         return 0;
                 break;
-        case ICMP_REDIRECT:
-                break;
         }
 
         err = -ENOENT;
 
+        rcu_read_lock();
         t = ipip6_tunnel_lookup(dev_net(skb->dev),
                                 skb->dev,
                                 iph->daddr,
                                 iph->saddr);
-        if (t == NULL)
-                goto out;
-
-        if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
-                ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-                                 t->dev->ifindex, 0, IPPROTO_IPV6, 0);
-                err = 0;
-                goto out;
-        }
-        if (type == ICMP_REDIRECT) {
-                ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
-                              IPPROTO_IPV6, 0);
-                err = 0;
-                goto out;
-        }
-
-        if (t->parms.iph.daddr == 0)
+        if (t == NULL || t->parms.iph.daddr == 0)
                 goto out;
 
         err = 0;
@@ -587,20 +546,27 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
+        rcu_read_unlock();
         return err;
 }
 
+static inline void ipip6_ecn_decapsulate(const struct iphdr *iph, struct sk_buff *skb)
+{
+        if (INET_ECN_is_ce(iph->tos))
+                IP6_ECN_set_ce(ipv6_hdr(skb));
+}
+
 static int ipip6_rcv(struct sk_buff *skb)
 {
         const struct iphdr *iph;
         struct ip_tunnel *tunnel;
-        int err;
 
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                 goto out;
 
         iph = ip_hdr(skb);
 
+        rcu_read_lock();
         tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
                                      iph->saddr, iph->daddr);
         if (tunnel != NULL) {
@@ -616,33 +582,27 @@ static int ipip6_rcv(struct sk_buff *skb)
                 if ((tunnel->dev->priv_flags & IFF_ISATAP) &&
                     !isatap_chksrc(skb, iph, tunnel)) {
                         tunnel->dev->stats.rx_errors++;
-                        goto out;
-                }
-
-                __skb_tunnel_rx(skb, tunnel->dev);
-
-                err = IP_ECN_decapsulate(iph, skb);
-                if (unlikely(err)) {
-                        if (log_ecn_error)
-                                net_info_ratelimited("non-ECT from %pI4 with TOS=%#x\n",
-                                                     &iph->saddr, iph->tos);
-                        if (err > 1) {
-                                ++tunnel->dev->stats.rx_frame_errors;
-                                ++tunnel->dev->stats.rx_errors;
-                                goto out;
-                        }
+                        rcu_read_unlock();
+                        kfree_skb(skb);
+                        return 0;
                 }
 
                 tstats = this_cpu_ptr(tunnel->dev->tstats);
                 tstats->rx_packets++;
                 tstats->rx_bytes += skb->len;
 
+                __skb_tunnel_rx(skb, tunnel->dev);
+
+                ipip6_ecn_decapsulate(iph, skb);
+
                 netif_rx(skb);
 
+                rcu_read_unlock();
                 return 0;
         }
 
         /* no tunnel matched,  let upstream know, ipsec may handle it */
+        rcu_read_unlock();
         return 1;
 out:
         kfree_skb(skb);
@@ -696,6 +656,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                                      struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
+        struct pcpu_tstats *tstats;
         const struct iphdr  *tiph = &tunnel->parms.iph;
         const struct ipv6hdr *iph6 = ipv6_hdr(skb);
         u8     tos = tunnel->parms.iph.tos;
@@ -719,27 +680,23 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         /* ISATAP (RFC4214) - must come before 6to4 */
         if (dev->priv_flags & IFF_ISATAP) {
                 struct neighbour *neigh = NULL;
-                bool do_tx_error = false;
 
                 if (skb_dst(skb))
-                        neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
+                        neigh = dst_get_neighbour(skb_dst(skb));
 
                 if (neigh == NULL) {
-                        net_dbg_ratelimited("sit: nexthop == NULL\n");
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "sit: nexthop == NULL\n");
                         goto tx_error;
                 }
 
-                addr6 = (const struct in6_addr *)&neigh->primary_key;
+                addr6 = (const struct in6_addr*)&neigh->primary_key;
                 addr_type = ipv6_addr_type(addr6);
 
                 if ((addr_type & IPV6_ADDR_UNICAST) &&
                      ipv6_addr_is_isatap(addr6))
                         dst = addr6->s6_addr32[3];
                 else
-                        do_tx_error = true;
-
-                neigh_release(neigh);
-                if (do_tx_error)
                         goto tx_error;
         }
 
@@ -748,17 +705,17 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 
         if (!dst) {
                 struct neighbour *neigh = NULL;
-                bool do_tx_error = false;
 
                 if (skb_dst(skb))
-                        neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
+                        neigh = dst_get_neighbour(skb_dst(skb));
 
                 if (neigh == NULL) {
-                        net_dbg_ratelimited("sit: nexthop == NULL\n");
+                        if (net_ratelimit())
+                                printk(KERN_DEBUG "sit: nexthop == NULL\n");
                         goto tx_error;
                 }
 
-                addr6 = (const struct in6_addr *)&neigh->primary_key;
+                addr6 = (const struct in6_addr*)&neigh->primary_key;
                 addr_type = ipv6_addr_type(addr6);
 
                 if (addr_type == IPV6_ADDR_ANY) {
@@ -766,14 +723,10 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         addr_type = ipv6_addr_type(addr6);
                 }
 
-                if ((addr_type & IPV6_ADDR_COMPATv4) != 0)
-                        dst = addr6->s6_addr32[3];
-                else
-                        do_tx_error = true;
+                if ((addr_type & IPV6_ADDR_COMPATv4) == 0)
+                        goto tx_error_icmp;
 
-                neigh_release(neigh);
-                if (do_tx_error)
-                        goto tx_error;
+                dst = addr6->s6_addr32[3];
         }
 
         rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
@@ -813,7 +766,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 }
 
                 if (tunnel->parms.iph.daddr && skb_dst(skb))
-                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
+                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
 
                 if (skb->len > mtu) {
                         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
@@ -876,7 +829,9 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         if ((iph->ttl = tiph->ttl) == 0)
                 iph->ttl        =       iph6->hop_limit;
 
-        iptunnel_xmit(skb, dev);
+        nf_reset(skb);
+        tstats = this_cpu_ptr(dev->tstats);
+        __IPTUNNEL_XMIT(tstats, &dev->stats);
         return NETDEV_TX_OK;
 
 tx_error_icmp:
@@ -924,59 +879,6 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
         dev->iflink = tunnel->parms.link;
 }
 
-static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p)
-{
-        struct net *net = dev_net(t->dev);
-        struct sit_net *sitn = net_generic(net, sit_net_id);
-
-        ipip6_tunnel_unlink(sitn, t);
-        synchronize_net();
-        t->parms.iph.saddr = p->iph.saddr;
-        t->parms.iph.daddr = p->iph.daddr;
-        memcpy(t->dev->dev_addr, &p->iph.saddr, 4);
-        memcpy(t->dev->broadcast, &p->iph.daddr, 4);
-        ipip6_tunnel_link(sitn, t);
-        t->parms.iph.ttl = p->iph.ttl;
-        t->parms.iph.tos = p->iph.tos;
-        if (t->parms.link != p->link) {
-                t->parms.link = p->link;
-                ipip6_tunnel_bind_dev(t->dev);
-        }
-        netdev_state_change(t->dev);
-}
-
-#ifdef CONFIG_IPV6_SIT_6RD
-static int ipip6_tunnel_update_6rd(struct ip_tunnel *t,
-                                   struct ip_tunnel_6rd *ip6rd)
-{
-        struct in6_addr prefix;
-        __be32 relay_prefix;
-
-        if (ip6rd->relay_prefixlen > 32 ||
-            ip6rd->prefixlen + (32 - ip6rd->relay_prefixlen) > 64)
-                return -EINVAL;
-
-        ipv6_addr_prefix(&prefix, &ip6rd->prefix, ip6rd->prefixlen);
-        if (!ipv6_addr_equal(&prefix, &ip6rd->prefix))
-                return -EINVAL;
-        if (ip6rd->relay_prefixlen)
-                relay_prefix = ip6rd->relay_prefix &
-                               htonl(0xffffffffUL <<
-                                     (32 - ip6rd->relay_prefixlen));
-        else
-                relay_prefix = 0;
-        if (relay_prefix != ip6rd->relay_prefix)
-                return -EINVAL;
-
-        t->ip6rd.prefix = prefix;
-        t->ip6rd.relay_prefix = relay_prefix;
-        t->ip6rd.prefixlen = ip6rd->prefixlen;
-        t->ip6rd.relay_prefixlen = ip6rd->relay_prefixlen;
-        netdev_state_change(t->dev);
-        return 0;
-}
-#endif
-
 static int
 ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
 {
@@ -1014,7 +916,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                                 goto done;
 #ifdef CONFIG_IPV6_SIT_6RD
                 } else {
-                        ip6rd.prefix = t->ip6rd.prefix;
+                        ipv6_addr_copy(&ip6rd.prefix, &t->ip6rd.prefix);
                         ip6rd.relay_prefix = t->ip6rd.relay_prefix;
                         ip6rd.prefixlen = t->ip6rd.prefixlen;
                         ip6rd.relay_prefixlen = t->ip6rd.relay_prefixlen;
@@ -1029,7 +931,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
         case SIOCADDTUNNEL:
         case SIOCCHGTUNNEL:
                 err = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
                         goto done;
 
                 err = -EFAULT;
@@ -1058,13 +960,28 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                                         break;
                                 }
                                 t = netdev_priv(dev);
+                                ipip6_tunnel_unlink(sitn, t);
+                                synchronize_net();
+                                t->parms.iph.saddr = p.iph.saddr;
+                                t->parms.iph.daddr = p.iph.daddr;
+                                memcpy(dev->dev_addr, &p.iph.saddr, 4);
+                                memcpy(dev->broadcast, &p.iph.daddr, 4);
+                                ipip6_tunnel_link(sitn, t);
+                                netdev_state_change(dev);
                         }
-
-                        ipip6_tunnel_update(t, &p);
                 }
 
                 if (t) {
                         err = 0;
+                        if (cmd == SIOCCHGTUNNEL) {
+                                t->parms.iph.ttl = p.iph.ttl;
+                                t->parms.iph.tos = p.iph.tos;
+                                if (t->parms.link != p.link) {
+                                        t->parms.link = p.link;
+                                        ipip6_tunnel_bind_dev(dev);
+                                        netdev_state_change(dev);
+                                }
+                        }
                         if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
                                 err = -EFAULT;
                 } else
@@ -1073,7 +990,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
 
         case SIOCDELTUNNEL:
                 err = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
                         goto done;
 
                 if (dev == sitn->fb_tunnel_dev) {
@@ -1106,7 +1023,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
         case SIOCDELPRL:
         case SIOCCHGPRL:
                 err = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
                         goto done;
                 err = -EINVAL;
                 if (dev == sitn->fb_tunnel_dev)
@@ -1135,7 +1052,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
         case SIOCCHG6RD:
         case SIOCDEL6RD:
                 err = -EPERM;
-                if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
+                if (!capable(CAP_NET_ADMIN))
                         goto done;
 
                 err = -EFAULT;
@@ -1146,9 +1063,31 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 t = netdev_priv(dev);
 
                 if (cmd != SIOCDEL6RD) {
-                        err = ipip6_tunnel_update_6rd(t, &ip6rd);
-                        if (err < 0)
+                        struct in6_addr prefix;
+                        __be32 relay_prefix;
+
+                        err = -EINVAL;
+                        if (ip6rd.relay_prefixlen > 32 ||
+                            ip6rd.prefixlen + (32 - ip6rd.relay_prefixlen) > 64)
+                                goto done;
+
+                        ipv6_addr_prefix(&prefix, &ip6rd.prefix,
+                                         ip6rd.prefixlen);
+                        if (!ipv6_addr_equal(&prefix, &ip6rd.prefix))
                                 goto done;
+                        if (ip6rd.relay_prefixlen)
+                                relay_prefix = ip6rd.relay_prefix &
+                                               htonl(0xffffffffUL <<
+                                                     (32 - ip6rd.relay_prefixlen));
+                        else
+                                relay_prefix = 0;
+                        if (relay_prefix != ip6rd.relay_prefix)
+                                goto done;
+
+                        ipv6_addr_copy(&t->ip6rd.prefix, &prefix);
+                        t->ip6rd.relay_prefix = relay_prefix;
+                        t->ip6rd.prefixlen = ip6rd.prefixlen;
+                        t->ip6rd.relay_prefixlen = ip6rd.relay_prefixlen;
                 } else
                         ipip6_tunnel_clone_6rd(dev, sitn);
 
@@ -1177,7 +1116,7 @@ static const struct net_device_ops ipip6_netdev_ops = {
         .ndo_start_xmit = ipip6_tunnel_xmit,
         .ndo_do_ioctl   = ipip6_tunnel_ioctl,
         .ndo_change_mtu = ipip6_tunnel_change_mtu,
-        .ndo_get_stats64= ipip6_get_stats64,
+        .ndo_get_stats  = ipip6_get_stats,
 };
 
 static void ipip6_dev_free(struct net_device *dev)
@@ -1242,239 +1181,6 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
         return 0;
 }
 
-static void ipip6_netlink_parms(struct nlattr *data[],
-                                struct ip_tunnel_parm *parms)
-{
-        memset(parms, 0, sizeof(*parms));
-
-        parms->iph.version = 4;
-        parms->iph.protocol = IPPROTO_IPV6;
-        parms->iph.ihl = 5;
-        parms->iph.ttl = 64;
-
-        if (!data)
-                return;
-
-        if (data[IFLA_IPTUN_LINK])
-                parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);
-
-        if (data[IFLA_IPTUN_LOCAL])
-                parms->iph.saddr = nla_get_be32(data[IFLA_IPTUN_LOCAL]);
-
-        if (data[IFLA_IPTUN_REMOTE])
-                parms->iph.daddr = nla_get_be32(data[IFLA_IPTUN_REMOTE]);
-
-        if (data[IFLA_IPTUN_TTL]) {
-                parms->iph.ttl = nla_get_u8(data[IFLA_IPTUN_TTL]);
-                if (parms->iph.ttl)
-                        parms->iph.frag_off = htons(IP_DF);
-        }
-
-        if (data[IFLA_IPTUN_TOS])
-                parms->iph.tos = nla_get_u8(data[IFLA_IPTUN_TOS]);
-
-        if (!data[IFLA_IPTUN_PMTUDISC] || nla_get_u8(data[IFLA_IPTUN_PMTUDISC]))
-                parms->iph.frag_off = htons(IP_DF);
-
-        if (data[IFLA_IPTUN_FLAGS])
-                parms->i_flags = nla_get_be16(data[IFLA_IPTUN_FLAGS]);
-}
-
-#ifdef CONFIG_IPV6_SIT_6RD
-/* This function returns true when 6RD attributes are present in the nl msg */
-static bool ipip6_netlink_6rd_parms(struct nlattr *data[],
-                                    struct ip_tunnel_6rd *ip6rd)
-{
-        bool ret = false;
-        memset(ip6rd, 0, sizeof(*ip6rd));
-
-        if (!data)
-                return ret;
-
-        if (data[IFLA_IPTUN_6RD_PREFIX]) {
-                ret = true;
-                nla_memcpy(&ip6rd->prefix, data[IFLA_IPTUN_6RD_PREFIX],
-                           sizeof(struct in6_addr));
-        }
-
-        if (data[IFLA_IPTUN_6RD_RELAY_PREFIX]) {
-                ret = true;
-                ip6rd->relay_prefix =
-                        nla_get_be32(data[IFLA_IPTUN_6RD_RELAY_PREFIX]);
-        }
-
-        if (data[IFLA_IPTUN_6RD_PREFIXLEN]) {
-                ret = true;
-                ip6rd->prefixlen = nla_get_u16(data[IFLA_IPTUN_6RD_PREFIXLEN]);
-        }
-
-        if (data[IFLA_IPTUN_6RD_RELAY_PREFIXLEN]) {
-                ret = true;
-                ip6rd->relay_prefixlen =
-                        nla_get_u16(data[IFLA_IPTUN_6RD_RELAY_PREFIXLEN]);
-        }
-
-        return ret;
-}
-#endif
-
-static int ipip6_newlink(struct net *src_net, struct net_device *dev,
-                         struct nlattr *tb[], struct nlattr *data[])
-{
-        struct net *net = dev_net(dev);
-        struct ip_tunnel *nt;
-#ifdef CONFIG_IPV6_SIT_6RD
-        struct ip_tunnel_6rd ip6rd;
-#endif
-        int err;
-
-        nt = netdev_priv(dev);
-        ipip6_netlink_parms(data, &nt->parms);
-
-        if (ipip6_tunnel_locate(net, &nt->parms, 0))
-                return -EEXIST;
-
-        err = ipip6_tunnel_create(dev);
-        if (err < 0)
-                return err;
-
-#ifdef CONFIG_IPV6_SIT_6RD
-        if (ipip6_netlink_6rd_parms(data, &ip6rd))
-                err = ipip6_tunnel_update_6rd(nt, &ip6rd);
-#endif
-
-        return err;
-}
-
-static int ipip6_changelink(struct net_device *dev, struct nlattr *tb[],
-                          struct nlattr *data[])
-{
-        struct ip_tunnel *t;
-        struct ip_tunnel_parm p;
-        struct net *net = dev_net(dev);
-        struct sit_net *sitn = net_generic(net, sit_net_id);
-#ifdef CONFIG_IPV6_SIT_6RD
-        struct ip_tunnel_6rd ip6rd;
-#endif
-
-        if (dev == sitn->fb_tunnel_dev)
-                return -EINVAL;
-
-        ipip6_netlink_parms(data, &p);
-
-        if (((dev->flags & IFF_POINTOPOINT) && !p.iph.daddr) ||
-            (!(dev->flags & IFF_POINTOPOINT) && p.iph.daddr))
-                return -EINVAL;
-
-        t = ipip6_tunnel_locate(net, &p, 0);
-
-        if (t) {
-                if (t->dev != dev)
-                        return -EEXIST;
-        } else
-                t = netdev_priv(dev);
-
-        ipip6_tunnel_update(t, &p);
-
-#ifdef CONFIG_IPV6_SIT_6RD
-        if (ipip6_netlink_6rd_parms(data, &ip6rd))
-                return ipip6_tunnel_update_6rd(t, &ip6rd);
-#endif
-
-        return 0;
-}
-
-static size_t ipip6_get_size(const struct net_device *dev)
-{
-        return
-                /* IFLA_IPTUN_LINK */
-                nla_total_size(4) +
-                /* IFLA_IPTUN_LOCAL */
-                nla_total_size(4) +
-                /* IFLA_IPTUN_REMOTE */
-                nla_total_size(4) +
-                /* IFLA_IPTUN_TTL */
-                nla_total_size(1) +
-                /* IFLA_IPTUN_TOS */
-                nla_total_size(1) +
-                /* IFLA_IPTUN_PMTUDISC */
-                nla_total_size(1) +
-                /* IFLA_IPTUN_FLAGS */
-                nla_total_size(2) +
-#ifdef CONFIG_IPV6_SIT_6RD
-                /* IFLA_IPTUN_6RD_PREFIX */
-                nla_total_size(sizeof(struct in6_addr)) +
-                /* IFLA_IPTUN_6RD_RELAY_PREFIX */
-                nla_total_size(4) +
-                /* IFLA_IPTUN_6RD_PREFIXLEN */
-                nla_total_size(2) +
-                /* IFLA_IPTUN_6RD_RELAY_PREFIXLEN */
-                nla_total_size(2) +
-#endif
-                0;
-}
-
-static int ipip6_fill_info(struct sk_buff *skb, const struct net_device *dev)
-{
-        struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct ip_tunnel_parm *parm = &tunnel->parms;
-
-        if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
-            nla_put_be32(skb, IFLA_IPTUN_LOCAL, parm->iph.saddr) ||
-            nla_put_be32(skb, IFLA_IPTUN_REMOTE, parm->iph.daddr) ||
-            nla_put_u8(skb, IFLA_IPTUN_TTL, parm->iph.ttl) ||
-            nla_put_u8(skb, IFLA_IPTUN_TOS, parm->iph.tos) ||
-            nla_put_u8(skb, IFLA_IPTUN_PMTUDISC,
-                       !!(parm->iph.frag_off & htons(IP_DF))) ||
-            nla_put_be16(skb, IFLA_IPTUN_FLAGS, parm->i_flags))
-                goto nla_put_failure;
-
-#ifdef CONFIG_IPV6_SIT_6RD
-        if (nla_put(skb, IFLA_IPTUN_6RD_PREFIX, sizeof(struct in6_addr),
-                    &tunnel->ip6rd.prefix) ||
-            nla_put_be32(skb, IFLA_IPTUN_6RD_RELAY_PREFIX,
-                         tunnel->ip6rd.relay_prefix) ||
-            nla_put_u16(skb, IFLA_IPTUN_6RD_PREFIXLEN,
-                        tunnel->ip6rd.prefixlen) ||
-            nla_put_u16(skb, IFLA_IPTUN_6RD_RELAY_PREFIXLEN,
-                        tunnel->ip6rd.relay_prefixlen))
-                goto nla_put_failure;
-#endif
-
-        return 0;
-
-nla_put_failure:
-        return -EMSGSIZE;
-}
-
-static const struct nla_policy ipip6_policy[IFLA_IPTUN_MAX + 1] = {
-        [IFLA_IPTUN_LINK]               = { .type = NLA_U32 },
-        [IFLA_IPTUN_LOCAL]              = { .type = NLA_U32 },
-        [IFLA_IPTUN_REMOTE]             = { .type = NLA_U32 },
-        [IFLA_IPTUN_TTL]                = { .type = NLA_U8 },
-        [IFLA_IPTUN_TOS]                = { .type = NLA_U8 },
-        [IFLA_IPTUN_PMTUDISC]           = { .type = NLA_U8 },
-        [IFLA_IPTUN_FLAGS]              = { .type = NLA_U16 },
-#ifdef CONFIG_IPV6_SIT_6RD
-        [IFLA_IPTUN_6RD_PREFIX]         = { .len = sizeof(struct in6_addr) },
-        [IFLA_IPTUN_6RD_RELAY_PREFIX]   = { .type = NLA_U32 },
-        [IFLA_IPTUN_6RD_PREFIXLEN]      = { .type = NLA_U16 },
-        [IFLA_IPTUN_6RD_RELAY_PREFIXLEN] = { .type = NLA_U16 },
-#endif
-};
-
-static struct rtnl_link_ops sit_link_ops __read_mostly = {
-        .kind           = "sit",
-        .maxtype        = IFLA_IPTUN_MAX,
-        .policy         = ipip6_policy,
-        .priv_size      = sizeof(struct ip_tunnel),
-        .setup          = ipip6_tunnel_setup,
-        .newlink        = ipip6_newlink,
-        .changelink     = ipip6_changelink,
-        .get_size       = ipip6_get_size,
-        .fill_info      = ipip6_fill_info,
-};
-
 static struct xfrm_tunnel sit_handler __read_mostly = {
         .handler        =       ipip6_rcv,
         .err_handler    =       ipip6_err,
@@ -1561,7 +1267,6 @@ static struct pernet_operations sit_net_ops = {
 
 static void __exit sit_cleanup(void)
 {
-        rtnl_link_unregister(&sit_link_ops);
         xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
 
         unregister_pernet_device(&sit_net_ops);
@@ -1572,28 +1277,17 @@ static int __init sit_init(void)
 {
         int err;
 
-        pr_info("IPv6 over IPv4 tunneling driver\n");
+        printk(KERN_INFO "IPv6 over IPv4 tunneling driver\n");
 
         err = register_pernet_device(&sit_net_ops);
         if (err < 0)
                 return err;
         err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
         if (err < 0) {
-                pr_info("%s: can't add protocol\n", __func__);
-                goto xfrm_tunnel_failed;
+                unregister_pernet_device(&sit_net_ops);
+                printk(KERN_INFO "sit init: Can't add protocol\n");
         }
-        err = rtnl_link_register(&sit_link_ops);
-        if (err < 0)
-                goto rtnl_link_failed;
-
-out:
         return err;
-
-rtnl_link_failed:
-        xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
-xfrm_tunnel_failed:
-        unregister_pernet_device(&sit_net_ops);
-        goto out;
 }
 
 module_init(sit_init);
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 40161977f7c..ac838965ff3 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -21,6 +21,9 @@
 #include <net/ipv6.h>
 #include <net/tcp.h>
 
+extern int sysctl_tcp_syncookies;
+extern __u32 syncookie_secret[2][16-4+SHA_DIGEST_WORDS];
+
 #define COOKIEBITS 24   /* Upper bits store count */
 #define COOKIEMASK (((__u32)1 << COOKIEBITS) - 1)
 
@@ -112,7 +115,7 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, const struct in6_addr *saddr,
                 & COOKIEMASK;
 }
 
-__u32 cookie_v6_init_sequence(struct sock *sk, const struct sk_buff *skb, __u16 *mssp)
+__u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
 {
         const struct ipv6hdr *iph = ipv6_hdr(skb);
         const struct tcphdr *th = tcp_hdr(skb);
@@ -134,7 +137,7 @@ __u32 cookie_v6_init_sequence(struct sock *sk, const struct sk_buff *skb, __u16
                                      jiffies / (HZ * 60), mssind);
 }
 
-static inline int cookie_check(const struct sk_buff *skb, __u32 cookie)
+static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
 {
         const struct ipv6hdr *iph = ipv6_hdr(skb);
         const struct tcphdr *th = tcp_hdr(skb);
@@ -149,7 +152,7 @@ static inline int cookie_check(const struct sk_buff *skb, __u32 cookie)
 struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_options_received tcp_opt;
-        const u8 *hash_location;
+        u8 *hash_location;
         struct inet_request_sock *ireq;
         struct inet6_request_sock *ireq6;
         struct tcp_request_sock *treq;
@@ -177,7 +180,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         /* check for timestamp cookie support */
         memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, &hash_location, 0, NULL);
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
 
         if (!cookie_check_timestamp(&tcp_opt, &ecn_ok))
                 goto out;
@@ -190,7 +193,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         ireq = inet_rsk(req);
         ireq6 = inet6_rsk(req);
         treq = tcp_rsk(req);
-        treq->listener = NULL;
 
         if (security_inet_conn_request(sk, skb, req))
                 goto out_free;
@@ -198,8 +200,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         req->mss = mss;
         ireq->rmt_port = th->source;
         ireq->loc_port = th->dest;
-        ireq6->rmt_addr = ipv6_hdr(skb)->saddr;
-        ireq6->loc_addr = ipv6_hdr(skb)->daddr;
+        ipv6_addr_copy(&ireq6->rmt_addr, &ipv6_hdr(skb)->saddr);
+        ipv6_addr_copy(&ireq6->loc_addr, &ipv6_hdr(skb)->daddr);
         if (ipv6_opt_accepted(sk, skb) ||
             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
             np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
@@ -214,7 +216,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                 ireq6->iif = inet6_iif(skb);
 
         req->expires = 0UL;
-        req->num_retrans = 0;
+        req->retrans = 0;
         ireq->ecn_ok            = ecn_ok;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
@@ -235,9 +237,9 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                 struct flowi6 fl6;
                 memset(&fl6, 0, sizeof(fl6));
                 fl6.flowi6_proto = IPPROTO_TCP;
-                fl6.daddr = ireq6->rmt_addr;
+                ipv6_addr_copy(&fl6.daddr, &ireq6->rmt_addr);
                 final_p = fl6_update_dst(&fl6, np->opt, &final);
-                fl6.saddr = ireq6->loc_addr;
+                ipv6_addr_copy(&fl6.saddr, &ireq6->loc_addr);
                 fl6.flowi6_oif = sk->sk_bound_dev_if;
                 fl6.flowi6_mark = sk->sk_mark;
                 fl6.fl6_dport = inet_rsk(req)->rmt_port;
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index e85c48bd404..6dcf5e7d661 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -10,14 +10,37 @@
 #include <linux/in6.h>
 #include <linux/ipv6.h>
 #include <linux/slab.h>
-#include <linux/export.h>
 #include <net/ndisc.h>
 #include <net/ipv6.h>
 #include <net/addrconf.h>
 #include <net/inet_frag.h>
 
+static struct ctl_table empty[1];
+
+static ctl_table ipv6_static_skeleton[] = {
+        {
+                .procname       = "neigh",
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = empty,
+        },
+        { }
+};
+
 static ctl_table ipv6_table_template[] = {
         {
+                .procname       = "route",
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = ipv6_route_table_template
+        },
+        {
+                .procname       = "icmp",
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = ipv6_icmp_table_template
+        },
+        {
                 .procname       = "bindv6only",
                 .data           = &init_net.ipv6.sysctl.bindv6only,
                 .maxlen         = sizeof(int),
@@ -38,6 +61,13 @@ static ctl_table ipv6_rotable[] = {
         { }
 };
 
+struct ctl_path net_ipv6_ctl_path[] = {
+        { .procname = "net", },
+        { .procname = "ipv6", },
+        { },
+};
+EXPORT_SYMBOL_GPL(net_ipv6_ctl_path);
+
 static int __net_init ipv6_sysctl_net_init(struct net *net)
 {
         struct ctl_table *ipv6_table;
@@ -50,37 +80,28 @@ static int __net_init ipv6_sysctl_net_init(struct net *net)
                              GFP_KERNEL);
         if (!ipv6_table)
                 goto out;
-        ipv6_table[0].data = &net->ipv6.sysctl.bindv6only;
 
         ipv6_route_table = ipv6_route_sysctl_init(net);
         if (!ipv6_route_table)
                 goto out_ipv6_table;
+        ipv6_table[0].child = ipv6_route_table;
 
         ipv6_icmp_table = ipv6_icmp_sysctl_init(net);
         if (!ipv6_icmp_table)
                 goto out_ipv6_route_table;
+        ipv6_table[1].child = ipv6_icmp_table;
 
-        net->ipv6.sysctl.hdr = register_net_sysctl(net, "net/ipv6", ipv6_table);
-        if (!net->ipv6.sysctl.hdr)
-                goto out_ipv6_icmp_table;
-
-        net->ipv6.sysctl.route_hdr =
-                register_net_sysctl(net, "net/ipv6/route", ipv6_route_table);
-        if (!net->ipv6.sysctl.route_hdr)
-                goto out_unregister_ipv6_table;
+        ipv6_table[2].data = &net->ipv6.sysctl.bindv6only;
 
-        net->ipv6.sysctl.icmp_hdr =
-                register_net_sysctl(net, "net/ipv6/icmp", ipv6_icmp_table);
-        if (!net->ipv6.sysctl.icmp_hdr)
-                goto out_unregister_route_table;
+        net->ipv6.sysctl.table = register_net_sysctl_table(net, net_ipv6_ctl_path,
+                                                           ipv6_table);
+        if (!net->ipv6.sysctl.table)
+                goto out_ipv6_icmp_table;
 
         err = 0;
 out:
         return err;
-out_unregister_route_table:
-        unregister_net_sysctl_table(net->ipv6.sysctl.route_hdr);
-out_unregister_ipv6_table:
-        unregister_net_sysctl_table(net->ipv6.sysctl.hdr);
+
 out_ipv6_icmp_table:
         kfree(ipv6_icmp_table);
 out_ipv6_route_table:
@@ -96,13 +117,11 @@ static void __net_exit ipv6_sysctl_net_exit(struct net *net)
         struct ctl_table *ipv6_route_table;
         struct ctl_table *ipv6_icmp_table;
 
-        ipv6_table = net->ipv6.sysctl.hdr->ctl_table_arg;
-        ipv6_route_table = net->ipv6.sysctl.route_hdr->ctl_table_arg;
-        ipv6_icmp_table = net->ipv6.sysctl.icmp_hdr->ctl_table_arg;
+        ipv6_table = net->ipv6.sysctl.table->ctl_table_arg;
+        ipv6_route_table = ipv6_table[0].child;
+        ipv6_icmp_table = ipv6_table[1].child;
 
-        unregister_net_sysctl_table(net->ipv6.sysctl.icmp_hdr);
-        unregister_net_sysctl_table(net->ipv6.sysctl.route_hdr);
-        unregister_net_sysctl_table(net->ipv6.sysctl.hdr);
+        unregister_net_sysctl_table(net->ipv6.sysctl.table);
 
         kfree(ipv6_table);
         kfree(ipv6_route_table);
@@ -120,7 +139,7 @@ int ipv6_sysctl_register(void)
 {
         int err = -ENOMEM;
 
-        ip6_header = register_net_sysctl(&init_net, "net/ipv6", ipv6_rotable);
+        ip6_header = register_net_sysctl_rotable(net_ipv6_ctl_path, ipv6_rotable);
         if (ip6_header == NULL)
                 goto out;
 
@@ -140,3 +159,18 @@ void ipv6_sysctl_unregister(void)
         unregister_net_sysctl_table(ip6_header);
         unregister_pernet_subsys(&ipv6_sysctl_net_ops);
 }
+
+static struct ctl_table_header *ip6_base;
+
+int ipv6_static_sysctl_register(void)
+{
+        ip6_base = register_sysctl_paths(net_ipv6_ctl_path, ipv6_static_skeleton);
+        if (ip6_base == NULL)
+                return -ENOMEM;
+        return 0;
+}
+
+void ipv6_static_sysctl_unregister(void)
+{
+        unregister_net_sysctl_table(ip6_base);
+}
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 93825dd3a7c..cdbce216521 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -62,7 +62,6 @@
 #include <net/netdma.h>
 #include <net/inet_common.h>
 #include <net/secure_seq.h>
-#include <net/tcp_memcontrol.h>
 
 #include <asm/uaccess.h>
 
@@ -77,6 +76,9 @@ static void	tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                                       struct request_sock *req);
 
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
+static void     __tcp_v6_send_check(struct sk_buff *skb,
+                                    const struct in6_addr *saddr,
+                                    const struct in6_addr *daddr);
 
 static const struct inet_connection_sock_af_ops ipv6_mapped;
 static const struct inet_connection_sock_af_ops ipv6_specific;
@@ -91,18 +93,6 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 }
 #endif
 
-static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
-{
-        struct dst_entry *dst = skb_dst(skb);
-        const struct rt6_info *rt = (const struct rt6_info *)dst;
-
-        dst_hold(dst);
-        sk->sk_rx_dst = dst;
-        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
-        if (rt->rt6i_node)
-                inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
-}
-
 static void tcp_v6_hash(struct sock *sk)
 {
         if (sk->sk_state != TCP_CLOSE) {
@@ -116,7 +106,15 @@ static void tcp_v6_hash(struct sock *sk)
         }
 }
 
-static __u32 tcp_v6_init_sequence(const struct sk_buff *skb)
+static __inline__ __sum16 tcp_v6_check(int len,
+                                   const struct in6_addr *saddr,
+                                   const struct in6_addr *daddr,
+                                   __wsum base)
+{
+        return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
+}
+
+static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 {
         return secure_tcpv6_sequence_number(ipv6_hdr(skb)->daddr.s6_addr32,
                                             ipv6_hdr(skb)->saddr.s6_addr32,
@@ -155,7 +153,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                         flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                         if (flowlabel == NULL)
                                 return -EINVAL;
-                        usin->sin6_addr = flowlabel->dst;
+                        ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
                         fl6_sock_release(flowlabel);
                 }
         }
@@ -197,7 +195,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                 tp->write_seq = 0;
         }
 
-        np->daddr = usin->sin6_addr;
+        ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
         np->flow_label = fl6.flowlabel;
 
         /*
@@ -246,8 +244,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                 saddr = &np->rcv_saddr;
 
         fl6.flowi6_proto = IPPROTO_TCP;
-        fl6.daddr = np->daddr;
-        fl6.saddr = saddr ? *saddr : np->saddr;
+        ipv6_addr_copy(&fl6.daddr, &np->daddr);
+        ipv6_addr_copy(&fl6.saddr,
+                       (saddr ? saddr : &np->saddr));
         fl6.flowi6_oif = sk->sk_bound_dev_if;
         fl6.flowi6_mark = sk->sk_mark;
         fl6.fl6_dport = usin->sin6_port;
@@ -265,11 +264,11 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
         if (saddr == NULL) {
                 saddr = &fl6.saddr;
-                np->rcv_saddr = *saddr;
+                ipv6_addr_copy(&np->rcv_saddr, saddr);
         }
 
         /* set the source address */
-        np->saddr = *saddr;
+        ipv6_addr_copy(&np->saddr, saddr);
         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
         sk->sk_gso_type = SKB_GSO_TCPV6;
@@ -278,8 +277,22 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         rt = (struct rt6_info *) dst;
         if (tcp_death_row.sysctl_tw_recycle &&
             !tp->rx_opt.ts_recent_stamp &&
-            ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr))
-                tcp_fetch_timewait_stamp(sk, dst);
+            ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
+                struct inet_peer *peer = rt6_get_peer(rt);
+                /*
+                 * VJ's idea. We save last timestamp seen from
+                 * the destination in peer table, when entering state
+                 * TIME-WAIT * and initialize rx_opt.ts_recent from it,
+                 * when trying new connection.
+                 */
+                if (peer) {
+                        inet_peer_refcheck(peer);
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
+                                tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
+                                tp->rx_opt.ts_recent = peer->tcp_ts;
+                        }
+                }
+        }
 
         icsk->icsk_ext_hdr_len = 0;
         if (np->opt)
@@ -295,7 +308,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         if (err)
                 goto late_failure;
 
-        if (!tp->write_seq && likely(!tp->repair))
+        if (!tp->write_seq)
                 tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
                                                              np->daddr.s6_addr32,
                                                              inet->inet_sport,
@@ -316,23 +329,6 @@ failure:
         return err;
 }
 
-static void tcp_v6_mtu_reduced(struct sock *sk)
-{
-        struct dst_entry *dst;
-
-        if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
-                return;
-
-        dst = inet6_csk_update_pmtu(sk, tcp_sk(sk)->mtu_info);
-        if (!dst)
-                return;
-
-        if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
-                tcp_sync_mss(sk, dst_mtu(dst));
-                tcp_simple_retransmit(sk);
-        }
-}
-
 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 u8 type, u8 code, int offset, __be32 info)
 {
@@ -360,7 +356,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         }
 
         bh_lock_sock(sk);
-        if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
+        if (sock_owned_by_user(sk))
                 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 
         if (sk->sk_state == TCP_CLOSE)
@@ -381,20 +377,49 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         np = inet6_sk(sk);
 
-        if (type == NDISC_REDIRECT) {
-                struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+        if (type == ICMPV6_PKT_TOOBIG) {
+                struct dst_entry *dst;
 
-                if (dst)
-                        dst->ops->redirect(dst, sk, skb);
-        }
+                if (sock_owned_by_user(sk))
+                        goto out;
+                if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE))
+                        goto out;
 
-        if (type == ICMPV6_PKT_TOOBIG) {
-                tp->mtu_info = ntohl(info);
-                if (!sock_owned_by_user(sk))
-                        tcp_v6_mtu_reduced(sk);
-                else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
-                                           &tp->tsq_flags))
-                        sock_hold(sk);
+                /* icmp should have updated the destination cache entry */
+                dst = __sk_dst_check(sk, np->dst_cookie);
+
+                if (dst == NULL) {
+                        struct inet_sock *inet = inet_sk(sk);
+                        struct flowi6 fl6;
+
+                        /* BUGGG_FUTURE: Again, it is not clear how
+                           to handle rthdr case. Ignore this complexity
+                           for now.
+                         */
+                        memset(&fl6, 0, sizeof(fl6));
+                        fl6.flowi6_proto = IPPROTO_TCP;
+                        ipv6_addr_copy(&fl6.daddr, &np->daddr);
+                        ipv6_addr_copy(&fl6.saddr, &np->saddr);
+                        fl6.flowi6_oif = sk->sk_bound_dev_if;
+                        fl6.flowi6_mark = sk->sk_mark;
+                        fl6.fl6_dport = inet->inet_dport;
+                        fl6.fl6_sport = inet->inet_sport;
+                        security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
+
+                        dst = ip6_dst_lookup_flow(sk, &fl6, NULL, false);
+                        if (IS_ERR(dst)) {
+                                sk->sk_err_soft = -PTR_ERR(dst);
+                                goto out;
+                        }
+
+                } else
+                        dst_hold(dst);
+
+                if (inet_csk(sk)->icsk_pmtu_cookie > dst_mtu(dst)) {
+                        tcp_sync_mss(sk, dst_mtu(dst));
+                        tcp_simple_retransmit(sk);
+                } /* else let the usual retransmit timer handle it */
+                dst_release(dst);
                 goto out;
         }
 
@@ -450,46 +475,60 @@ out:
 }
 
 
-static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
-                              struct flowi6 *fl6,
-                              struct request_sock *req,
-                              struct request_values *rvp,
-                              u16 queue_mapping)
+static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
+                              struct request_values *rvp)
 {
         struct inet6_request_sock *treq = inet6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sk_buff * skb;
-        int err = -ENOMEM;
+        struct ipv6_txoptions *opt = NULL;
+        struct in6_addr * final_p, final;
+        struct flowi6 fl6;
+        struct dst_entry *dst;
+        int err;
 
-        /* First, grab a route. */
-        if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
-                goto done;
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_TCP;
+        ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
+        ipv6_addr_copy(&fl6.saddr, &treq->loc_addr);
+        fl6.flowlabel = 0;
+        fl6.flowi6_oif = treq->iif;
+        fl6.flowi6_mark = sk->sk_mark;
+        fl6.fl6_dport = inet_rsk(req)->rmt_port;
+        fl6.fl6_sport = inet_rsk(req)->loc_port;
+        security_req_classify_flow(req, flowi6_to_flowi(&fl6));
 
-        skb = tcp_make_synack(sk, dst, req, rvp, NULL);
+        opt = np->opt;
+        final_p = fl6_update_dst(&fl6, opt, &final);
 
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
+                dst = NULL;
+                goto done;
+        }
+        skb = tcp_make_synack(sk, dst, req, rvp);
+        err = -ENOMEM;
         if (skb) {
                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 
-                fl6->daddr = treq->rmt_addr;
-                skb_set_queue_mapping(skb, queue_mapping);
-                err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
+                ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
+                err = ip6_xmit(sk, skb, &fl6, opt);
                 err = net_xmit_eval(err);
         }
 
 done:
+        if (opt && opt != np->opt)
+                sock_kfree_s(sk, opt, opt->tot_len);
+        dst_release(dst);
         return err;
 }
 
 static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
                              struct request_values *rvp)
 {
-        struct flowi6 fl6;
-        int res;
-
-        res = tcp_v6_send_synack(sk, NULL, &fl6, req, rvp, 0);
-        if (!res)
-                TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
-        return res;
+        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
+        return tcp_v6_send_synack(sk, req, rvp);
 }
 
 static void tcp_v6_reqsk_destructor(struct request_sock *req)
@@ -501,7 +540,19 @@ static void tcp_v6_reqsk_destructor(struct request_sock *req)
 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
                                                    const struct in6_addr *addr)
 {
-        return tcp_md5_do_lookup(sk, (union tcp_md5_addr *)addr, AF_INET6);
+        struct tcp_sock *tp = tcp_sk(sk);
+        int i;
+
+        BUG_ON(tp == NULL);
+
+        if (!tp->md5sig_info || !tp->md5sig_info->entries6)
+                return NULL;
+
+        for (i = 0; i < tp->md5sig_info->entries6; i++) {
+                if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, addr))
+                        return &tp->md5sig_info->keys6[i].base;
+        }
+        return NULL;
 }
 
 static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
@@ -516,11 +567,137 @@ static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
         return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 }
 
+static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
+                             char *newkey, u8 newkeylen)
+{
+        /* Add key to the list */
+        struct tcp_md5sig_key *key;
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp6_md5sig_key *keys;
+
+        key = tcp_v6_md5_do_lookup(sk, peer);
+        if (key) {
+                /* modify existing entry - just update that one */
+                kfree(key->key);
+                key->key = newkey;
+                key->keylen = newkeylen;
+        } else {
+                /* reallocate new list if current one is full. */
+                if (!tp->md5sig_info) {
+                        tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
+                        if (!tp->md5sig_info) {
+                                kfree(newkey);
+                                return -ENOMEM;
+                        }
+                        sk_nocaps_add(sk, NETIF_F_GSO_MASK);
+                }
+                if (tp->md5sig_info->entries6 == 0 &&
+                        tcp_alloc_md5sig_pool(sk) == NULL) {
+                        kfree(newkey);
+                        return -ENOMEM;
+                }
+                if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
+                        keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
+                                       (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
+
+                        if (!keys) {
+                                kfree(newkey);
+                                if (tp->md5sig_info->entries6 == 0)
+                                        tcp_free_md5sig_pool();
+                                return -ENOMEM;
+                        }
+
+                        if (tp->md5sig_info->entries6)
+                                memmove(keys, tp->md5sig_info->keys6,
+                                        (sizeof (tp->md5sig_info->keys6[0]) *
+                                         tp->md5sig_info->entries6));
+
+                        kfree(tp->md5sig_info->keys6);
+                        tp->md5sig_info->keys6 = keys;
+                        tp->md5sig_info->alloced6++;
+                }
+
+                ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
+                               peer);
+                tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.key = newkey;
+                tp->md5sig_info->keys6[tp->md5sig_info->entries6].base.keylen = newkeylen;
+
+                tp->md5sig_info->entries6++;
+        }
+        return 0;
+}
+
+static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
+                               u8 *newkey, __u8 newkeylen)
+{
+        return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
+                                 newkey, newkeylen);
+}
+
+static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int i;
+
+        for (i = 0; i < tp->md5sig_info->entries6; i++) {
+                if (ipv6_addr_equal(&tp->md5sig_info->keys6[i].addr, peer)) {
+                        /* Free the key */
+                        kfree(tp->md5sig_info->keys6[i].base.key);
+                        tp->md5sig_info->entries6--;
+
+                        if (tp->md5sig_info->entries6 == 0) {
+                                kfree(tp->md5sig_info->keys6);
+                                tp->md5sig_info->keys6 = NULL;
+                                tp->md5sig_info->alloced6 = 0;
+                                tcp_free_md5sig_pool();
+                        } else {
+                                /* shrink the database */
+                                if (tp->md5sig_info->entries6 != i)
+                                        memmove(&tp->md5sig_info->keys6[i],
+                                                &tp->md5sig_info->keys6[i+1],
+                                                (tp->md5sig_info->entries6 - i)
+                                                * sizeof (tp->md5sig_info->keys6[0]));
+                        }
+                        return 0;
+                }
+        }
+        return -ENOENT;
+}
+
+static void tcp_v6_clear_md5_list (struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int i;
+
+        if (tp->md5sig_info->entries6) {
+                for (i = 0; i < tp->md5sig_info->entries6; i++)
+                        kfree(tp->md5sig_info->keys6[i].base.key);
+                tp->md5sig_info->entries6 = 0;
+                tcp_free_md5sig_pool();
+        }
+
+        kfree(tp->md5sig_info->keys6);
+        tp->md5sig_info->keys6 = NULL;
+        tp->md5sig_info->alloced6 = 0;
+
+        if (tp->md5sig_info->entries4) {
+                for (i = 0; i < tp->md5sig_info->entries4; i++)
+                        kfree(tp->md5sig_info->keys4[i].base.key);
+                tp->md5sig_info->entries4 = 0;
+                tcp_free_md5sig_pool();
+        }
+
+        kfree(tp->md5sig_info->keys4);
+        tp->md5sig_info->keys4 = NULL;
+        tp->md5sig_info->alloced4 = 0;
+}
+
 static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
                                   int optlen)
 {
         struct tcp_md5sig cmd;
         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
+        u8 *newkey;
 
         if (optlen < sizeof(cmd))
                 return -EINVAL;
@@ -532,22 +709,36 @@ static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
                 return -EINVAL;
 
         if (!cmd.tcpm_keylen) {
+                if (!tcp_sk(sk)->md5sig_info)
+                        return -ENOENT;
                 if (ipv6_addr_v4mapped(&sin6->sin6_addr))
-                        return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
-                                              AF_INET);
-                return tcp_md5_do_del(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
-                                      AF_INET6);
+                        return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
+                return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
         }
 
         if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
                 return -EINVAL;
 
-        if (ipv6_addr_v4mapped(&sin6->sin6_addr))
-                return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr.s6_addr32[3],
-                                      AF_INET, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
+        if (!tcp_sk(sk)->md5sig_info) {
+                struct tcp_sock *tp = tcp_sk(sk);
+                struct tcp_md5sig_info *p;
+
+                p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
+                if (!p)
+                        return -ENOMEM;
 
-        return tcp_md5_do_add(sk, (union tcp_md5_addr *)&sin6->sin6_addr,
-                              AF_INET6, cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
+                tp->md5sig_info = p;
+                sk_nocaps_add(sk, NETIF_F_GSO_MASK);
+        }
+
+        newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
+        if (!newkey)
+                return -ENOMEM;
+        if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
+                return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
+                                         newkey, cmd.tcpm_keylen);
+        }
+        return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 }
 
 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
@@ -559,8 +750,8 @@ static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 
         bp = &hp->md5_blk.ip6;
         /* 1. TCP pseudo-header (RFC2460) */
-        bp->saddr = *saddr;
-        bp->daddr = *daddr;
+        ipv6_addr_copy(&bp->saddr, saddr);
+        ipv6_addr_copy(&bp->daddr, daddr);
         bp->protocol = cpu_to_be32(IPPROTO_TCP);
         bp->len = cpu_to_be32(nbytes);
 
@@ -570,7 +761,7 @@ static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 
 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
                                const struct in6_addr *daddr, struct in6_addr *saddr,
-                               const struct tcphdr *th)
+                               struct tcphdr *th)
 {
         struct tcp_md5sig_pool *hp;
         struct hash_desc *desc;
@@ -602,14 +793,13 @@ clear_hash_noput:
 }
 
 static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
-                               const struct sock *sk,
-                               const struct request_sock *req,
-                               const struct sk_buff *skb)
+                               struct sock *sk, struct request_sock *req,
+                               struct sk_buff *skb)
 {
         const struct in6_addr *saddr, *daddr;
         struct tcp_md5sig_pool *hp;
         struct hash_desc *desc;
-        const struct tcphdr *th = tcp_hdr(skb);
+        struct tcphdr *th = tcp_hdr(skb);
 
         if (sk) {
                 saddr = &inet6_sk(sk)->saddr;
@@ -652,12 +842,12 @@ clear_hash_noput:
         return 1;
 }
 
-static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
+static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 {
-        const __u8 *hash_location = NULL;
+        __u8 *hash_location = NULL;
         struct tcp_md5sig_key *hash_expected;
         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
-        const struct tcphdr *th = tcp_hdr(skb);
+        struct tcphdr *th = tcp_hdr(skb);
         int genhash;
         u8 newhash[16];
 
@@ -684,10 +874,12 @@ static int tcp_v6_inbound_md5_hash(struct sock *sk, const struct sk_buff *skb)
                                       NULL, NULL, skb);
 
         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
-                net_info_ratelimited("MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
-                                     genhash ? "failed" : "mismatch",
-                                     &ip6h->saddr, ntohs(th->source),
-                                     &ip6h->daddr, ntohs(th->dest));
+                if (net_ratelimit()) {
+                        printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
+                               genhash ? "failed" : "mismatch",
+                               &ip6h->saddr, ntohs(th->source),
+                               &ip6h->daddr, ntohs(th->dest));
+                }
                 return 1;
         }
         return 0;
@@ -711,11 +903,84 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 };
 #endif
 
+static void __tcp_v6_send_check(struct sk_buff *skb,
+                                const struct in6_addr *saddr, const struct in6_addr *daddr)
+{
+        struct tcphdr *th = tcp_hdr(skb);
+
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                th->check = ~tcp_v6_check(skb->len, saddr, daddr, 0);
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct tcphdr, check);
+        } else {
+                th->check = tcp_v6_check(skb->len, saddr, daddr,
+                                         csum_partial(th, th->doff << 2,
+                                                      skb->csum));
+        }
+}
+
+static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
+{
+        struct ipv6_pinfo *np = inet6_sk(sk);
+
+        __tcp_v6_send_check(skb, &np->saddr, &np->daddr);
+}
+
+static int tcp_v6_gso_send_check(struct sk_buff *skb)
+{
+        const struct ipv6hdr *ipv6h;
+        struct tcphdr *th;
+
+        if (!pskb_may_pull(skb, sizeof(*th)))
+                return -EINVAL;
+
+        ipv6h = ipv6_hdr(skb);
+        th = tcp_hdr(skb);
+
+        th->check = 0;
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
+        return 0;
+}
+
+static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
+                                         struct sk_buff *skb)
+{
+        const struct ipv6hdr *iph = skb_gro_network_header(skb);
+
+        switch (skb->ip_summed) {
+        case CHECKSUM_COMPLETE:
+                if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
+                                  skb->csum)) {
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        break;
+                }
+
+                /* fall through */
+        case CHECKSUM_NONE:
+                NAPI_GRO_CB(skb)->flush = 1;
+                return NULL;
+        }
+
+        return tcp_gro_receive(head, skb);
+}
+
+static int tcp6_gro_complete(struct sk_buff *skb)
+{
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
+        struct tcphdr *th = tcp_hdr(skb);
+
+        th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
+                                  &iph->saddr, &iph->daddr, 0);
+        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
+
+        return tcp_gro_complete(skb);
+}
+
 static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
-                                 u32 ts, struct tcp_md5sig_key *key, int rst, u8 tclass)
+                                 u32 ts, struct tcp_md5sig_key *key, int rst)
 {
-        const struct tcphdr *th = tcp_hdr(skb);
-        struct tcphdr *t1;
+        struct tcphdr *th = tcp_hdr(skb), *t1;
         struct sk_buff *buff;
         struct flowi6 fl6;
         struct net *net = dev_net(skb_dst(skb)->dev);
@@ -772,8 +1037,8 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 #endif
 
         memset(&fl6, 0, sizeof(fl6));
-        fl6.daddr = ipv6_hdr(skb)->saddr;
-        fl6.saddr = ipv6_hdr(skb)->daddr;
+        ipv6_addr_copy(&fl6.daddr, &ipv6_hdr(skb)->saddr);
+        ipv6_addr_copy(&fl6.saddr, &ipv6_hdr(skb)->daddr);
 
         buff->ip_summed = CHECKSUM_PARTIAL;
         buff->csum = 0;
@@ -781,8 +1046,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
 
         fl6.flowi6_proto = IPPROTO_TCP;
-        if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL)
-                fl6.flowi6_oif = inet6_iif(skb);
+        fl6.flowi6_oif = inet6_iif(skb);
         fl6.fl6_dport = t1->dest;
         fl6.fl6_sport = t1->source;
         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
@@ -794,7 +1058,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
         if (!IS_ERR(dst)) {
                 skb_dst_set(buff, dst);
-                ip6_xmit(ctl_sk, buff, &fl6, NULL, tclass);
+                ip6_xmit(ctl_sk, buff, &fl6, NULL);
                 TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
                 if (rst)
                         TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
@@ -806,16 +1070,9 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 
 static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 {
-        const struct tcphdr *th = tcp_hdr(skb);
+        struct tcphdr *th = tcp_hdr(skb);
         u32 seq = 0, ack_seq = 0;
         struct tcp_md5sig_key *key = NULL;
-#ifdef CONFIG_TCP_MD5SIG
-        const __u8 *hash_location = NULL;
-        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
-        unsigned char newhash[16];
-        int genhash;
-        struct sock *sk1 = NULL;
-#endif
 
         if (th->rst)
                 return;
@@ -824,32 +1081,8 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                 return;
 
 #ifdef CONFIG_TCP_MD5SIG
-        hash_location = tcp_parse_md5sig_option(th);
-        if (!sk && hash_location) {
-                /*
-                 * active side is lost. Try to find listening socket through
-                 * source port, and then find md5 key through listening socket.
-                 * we are not loose security here:
-                 * Incoming packet is checked with md5 hash with finding key,
-                 * no RST generated if md5 hash doesn't match.
-                 */
-                sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
-                                           &tcp_hashinfo, &ipv6h->daddr,
-                                           ntohs(th->source), inet6_iif(skb));
-                if (!sk1)
-                        return;
-
-                rcu_read_lock();
-                key = tcp_v6_md5_do_lookup(sk1, &ipv6h->saddr);
-                if (!key)
-                        goto release_sk1;
-
-                genhash = tcp_v6_md5_hash_skb(newhash, key, NULL, NULL, skb);
-                if (genhash || memcmp(hash_location, newhash, 16) != 0)
-                        goto release_sk1;
-        } else {
-                key = sk ? tcp_v6_md5_do_lookup(sk, &ipv6h->saddr) : NULL;
-        }
+        if (sk)
+                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
 #endif
 
         if (th->ack)
@@ -858,21 +1091,13 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                 ack_seq = ntohl(th->seq) + th->syn + th->fin + skb->len -
                           (th->doff << 2);
 
-        tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1, 0);
-
-#ifdef CONFIG_TCP_MD5SIG
-release_sk1:
-        if (sk1) {
-                rcu_read_unlock();
-                sock_put(sk1);
-        }
-#endif
+        tcp_v6_send_response(skb, seq, ack_seq, 0, 0, key, 1);
 }
 
 static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
-                            struct tcp_md5sig_key *key, u8 tclass)
+                            struct tcp_md5sig_key *key)
 {
-        tcp_v6_send_response(skb, seq, ack, win, ts, key, 0, tclass);
+        tcp_v6_send_response(skb, seq, ack, win, ts, key, 0);
 }
 
 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
@@ -882,8 +1107,7 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 
         tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
-                        tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw),
-                        tw->tw_tclass);
+                        tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw));
 
         inet_twsk_put(tw);
 }
@@ -892,7 +1116,7 @@ static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                                   struct request_sock *req)
 {
         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
-                        tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), 0);
+                        tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr));
 }
 
 
@@ -907,7 +1131,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
                                    &ipv6_hdr(skb)->saddr,
                                    &ipv6_hdr(skb)->daddr, inet6_iif(skb));
         if (req)
-                return tcp_check_req(sk, skb, req, prev, false);
+                return tcp_check_req(sk, skb, req, prev);
 
         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
                         &ipv6_hdr(skb)->saddr, th->source,
@@ -936,15 +1160,14 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_extend_values tmp_ext;
         struct tcp_options_received tmp_opt;
-        const u8 *hash_location;
+        u8 *hash_location;
         struct request_sock *req;
         struct inet6_request_sock *treq;
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         __u32 isn = TCP_SKB_CB(skb)->when;
         struct dst_entry *dst = NULL;
-        struct flowi6 fl6;
-        bool want_cookie = false;
+        int want_cookie = 0;
 
         if (skb->protocol == htons(ETH_P_IP))
                 return tcp_v4_conn_request(sk, skb);
@@ -972,7 +1195,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
         tmp_opt.user_mss = tp->rx_opt.user_mss;
-        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
         if (tmp_opt.cookie_plus > 0 &&
             tmp_opt.saw_tstamp &&
@@ -1005,7 +1228,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 while (l-- > 0)
                         *c++ ^= *hash_location++;
 
-                want_cookie = false;    /* not our kind of cookie */
+                want_cookie = 0;        /* not our kind of cookie */
                 tmp_ext.cookie_out_never = 0; /* false */
                 tmp_ext.cookie_plus = tmp_opt.cookie_plus;
         } else if (!tp->rx_opt.cookie_in_always) {
@@ -1024,25 +1247,26 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_openreq_init(req, &tmp_opt, skb);
 
         treq = inet6_rsk(req);
-        treq->rmt_addr = ipv6_hdr(skb)->saddr;
-        treq->loc_addr = ipv6_hdr(skb)->daddr;
+        ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
+        ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
         if (!want_cookie || tmp_opt.tstamp_ok)
-                TCP_ECN_create_request(req, skb);
-
-        treq->iif = sk->sk_bound_dev_if;
-
-        /* So that link locals have meaning */
-        if (!sk->sk_bound_dev_if &&
-            ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
-                treq->iif = inet6_iif(skb);
+                TCP_ECN_create_request(req, tcp_hdr(skb));
 
         if (!isn) {
+                struct inet_peer *peer = NULL;
+
                 if (ipv6_opt_accepted(sk, skb) ||
                     np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
                     np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
                         atomic_inc(&skb->users);
                         treq->pktopts = skb;
                 }
+                treq->iif = sk->sk_bound_dev_if;
+
+                /* So that link locals have meaning */
+                if (!sk->sk_bound_dev_if &&
+                    ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
+                        treq->iif = inet6_iif(skb);
 
                 if (want_cookie) {
                         isn = cookie_v6_init_sequence(sk, skb, &req->mss);
@@ -1061,8 +1285,14 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                  */
                 if (tmp_opt.saw_tstamp &&
                     tcp_death_row.sysctl_tw_recycle &&
-                    (dst = inet6_csk_route_req(sk, &fl6, req)) != NULL) {
-                        if (!tcp_peer_is_proven(req, dst, true)) {
+                    (dst = inet6_csk_route_req(sk, req)) != NULL &&
+                    (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
+                    ipv6_addr_equal((struct in6_addr *)peer->daddr.addr.a6,
+                                    &treq->rmt_addr)) {
+                        inet_peer_refcheck(peer);
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
+                            (s32)(peer->tcp_ts - req->ts_recent) >
+                                                        TCP_PAWS_WINDOW) {
                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
                                 goto drop_and_release;
                         }
@@ -1071,7 +1301,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 else if (!sysctl_tcp_syncookies &&
                          (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
                           (sysctl_max_syn_backlog >> 2)) &&
-                         !tcp_peer_is_proven(req, dst, false)) {
+                         (!peer || !peer->tcp_ts_stamp) &&
+                         (!dst || !dst_metric(dst, RTAX_RTT))) {
                         /* Without syncookies last quarter of
                          * backlog is filled with destinations,
                          * proven to be alive.
@@ -1088,18 +1319,15 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         }
 have_isn:
         tcp_rsk(req)->snt_isn = isn;
+        tcp_rsk(req)->snt_synack = tcp_time_stamp;
 
-        if (security_inet_conn_request(sk, skb, req))
-                goto drop_and_release;
+        security_inet_conn_request(sk, skb, req);
 
-        if (tcp_v6_send_synack(sk, dst, &fl6, req,
-                               (struct request_values *)&tmp_ext,
-                               skb_get_queue_mapping(skb)) ||
+        if (tcp_v6_send_synack(sk, req,
+                               (struct request_values *)&tmp_ext) ||
             want_cookie)
                 goto drop_and_free;
 
-        tcp_rsk(req)->snt_synack = tcp_time_stamp;
-        tcp_rsk(req)->listener = NULL;
         inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
         return 0;
 
@@ -1121,10 +1349,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         struct inet_sock *newinet;
         struct tcp_sock *newtp;
         struct sock *newsk;
+        struct ipv6_txoptions *opt;
 #ifdef CONFIG_TCP_MD5SIG
         struct tcp_md5sig_key *key;
 #endif
-        struct flowi6 fl6;
 
         if (skb->protocol == htons(ETH_P_IP)) {
                 /*
@@ -1149,7 +1377,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
                 ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
 
-                newnp->rcv_saddr = newnp->saddr;
+                ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
 
                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
@@ -1163,7 +1391,6 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 newnp->opt         = NULL;
                 newnp->mcast_oif   = inet6_iif(skb);
                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
-                newnp->rcv_tclass  = ipv6_tclass(ipv6_hdr(skb));
 
                 /*
                  * No need to charge this sock to the relevant IPv6 refcnt debug socks count
@@ -1181,12 +1408,13 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         }
 
         treq = inet6_rsk(req);
+        opt = np->opt;
 
         if (sk_acceptq_is_full(sk))
                 goto out_overflow;
 
         if (!dst) {
-                dst = inet6_csk_route_req(sk, &fl6, req);
+                dst = inet6_csk_route_req(sk, req);
                 if (!dst)
                         goto out;
         }
@@ -1203,7 +1431,6 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         newsk->sk_gso_type = SKB_GSO_TCPV6;
         __ip6_dst_store(newsk, dst, NULL, NULL);
-        inet6_sk_rx_dst_set(newsk, skb);
 
         newtcp6sk = (struct tcp6_sock *)newsk;
         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
@@ -1214,9 +1441,9 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
 
-        newnp->daddr = treq->rmt_addr;
-        newnp->saddr = treq->loc_addr;
-        newnp->rcv_saddr = treq->loc_addr;
+        ipv6_addr_copy(&newnp->daddr, &treq->rmt_addr);
+        ipv6_addr_copy(&newnp->saddr, &treq->loc_addr);
+        ipv6_addr_copy(&newnp->rcv_saddr, &treq->loc_addr);
         newsk->sk_bound_dev_if = treq->iif;
 
         /* Now IPv6 options...
@@ -1233,9 +1460,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         /* Clone pktoptions received with SYN */
         newnp->pktoptions = NULL;
         if (treq->pktopts != NULL) {
-                newnp->pktoptions = skb_clone(treq->pktopts,
-                                              sk_gfp_atomic(sk, GFP_ATOMIC));
-                consume_skb(treq->pktopts);
+                newnp->pktoptions = skb_clone(treq->pktopts, GFP_ATOMIC);
+                kfree_skb(treq->pktopts);
                 treq->pktopts = NULL;
                 if (newnp->pktoptions)
                         skb_set_owner_r(newnp->pktoptions, newsk);
@@ -1243,7 +1469,6 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         newnp->opt        = NULL;
         newnp->mcast_oif  = inet6_iif(skb);
         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
-        newnp->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
 
         /* Clone native IPv6 options from listening socket (if any)
 
@@ -1251,8 +1476,11 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
            but we make one more one thing there: reattach optmem
            to newsk.
          */
-        if (np->opt)
-                newnp->opt = ipv6_dup_options(newsk, np->opt);
+        if (opt) {
+                newnp->opt = ipv6_dup_options(newsk, opt);
+                if (opt != np->opt)
+                        sock_kfree_s(sk, opt, opt->tot_len);
+        }
 
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
         if (newnp->opt)
@@ -1262,13 +1490,11 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         tcp_mtup_init(newsk);
         tcp_sync_mss(newsk, dst_mtu(dst));
         newtp->advmss = dst_metric_advmss(dst);
-        if (tcp_sk(sk)->rx_opt.user_mss &&
-            tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
-                newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
-
         tcp_initialize_rcv_mss(newsk);
-        tcp_synack_rtt_meas(newsk, req);
-        newtp->total_retrans = req->num_retrans;
+        if (tcp_rsk(req)->snt_synack)
+                tcp_valid_rtt_meas(newsk,
+                    tcp_time_stamp - tcp_rsk(req)->snt_synack);
+        newtp->total_retrans = req->retrans;
 
         newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
         newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
@@ -1281,15 +1507,15 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                  * memory, then we end up not copying the key
                  * across. Shucks.
                  */
-                tcp_md5_do_add(newsk, (union tcp_md5_addr *)&newnp->daddr,
-                               AF_INET6, key->key, key->keylen,
-                               sk_gfp_atomic(sk, GFP_ATOMIC));
+                char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
+                if (newkey != NULL)
+                        tcp_v6_md5_do_add(newsk, &newnp->daddr,
+                                          newkey, key->keylen);
         }
 #endif
 
         if (__inet_inherit_port(sk, newsk) < 0) {
-                inet_csk_prepare_forced_close(newsk);
-                tcp_done(newsk);
+                sock_put(newsk);
                 goto out;
         }
         __inet6_hash(newsk, NULL);
@@ -1299,6 +1525,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 out_overflow:
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 out_nonewsk:
+        if (opt && opt != np->opt)
+                sock_kfree_s(sk, opt, opt->tot_len);
         dst_release(dst);
 out:
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
@@ -1377,20 +1605,10 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                                                --ANK (980728)
          */
         if (np->rxopt.all)
-                opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
+                opt_skb = skb_clone(skb, GFP_ATOMIC);
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
-                struct dst_entry *dst = sk->sk_rx_dst;
-
-                sock_rps_save_rxhash(sk, skb);
-                if (dst) {
-                        if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
-                            dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
-                                dst_release(dst);
-                                sk->sk_rx_dst = NULL;
-                        }
-                }
-
+                sock_rps_save_rxhash(sk, skb->rxhash);
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                         goto reset;
                 if (opt_skb)
@@ -1412,7 +1630,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                  * the new socket..
                  */
                 if(nsk != sk) {
-                        sock_rps_save_rxhash(nsk, skb);
+                        sock_rps_save_rxhash(nsk, skb->rxhash);
                         if (tcp_child_process(sk, nsk, skb))
                                 goto reset;
                         if (opt_skb)
@@ -1420,7 +1638,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                         return 0;
                 }
         } else
-                sock_rps_save_rxhash(sk, skb);
+                sock_rps_save_rxhash(sk, skb->rxhash);
 
         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
                 goto reset;
@@ -1455,8 +1673,6 @@ ipv6_pktoptions:
                         np->mcast_oif = inet6_iif(opt_skb);
                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
-                if (np->rxopt.bits.rxtclass)
-                        np->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
                 if (ipv6_opt_accepted(sk, opt_skb)) {
                         skb_set_owner_r(opt_skb, sk);
                         opt_skb = xchg(&np->pktoptions, opt_skb);
@@ -1472,7 +1688,7 @@ ipv6_pktoptions:
 
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
-        const struct tcphdr *th;
+        struct tcphdr *th;
         const struct ipv6hdr *hdr;
         struct sock *sk;
         int ret;
@@ -1506,7 +1722,7 @@ static int tcp_v6_rcv(struct sk_buff *skb)
                                     skb->len - th->doff*4);
         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
         TCP_SKB_CB(skb)->when = 0;
-        TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
+        TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(hdr);
         TCP_SKB_CB(skb)->sacked = 0;
 
         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -1536,7 +1752,7 @@ process:
 #ifdef CONFIG_NET_DMA
                 struct tcp_sock *tp = tcp_sk(sk);
                 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
-                        tp->ucopy.dma_chan = net_dma_find_channel();
+                        tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY);
                 if (tp->ucopy.dma_chan)
                         ret = tcp_v6_do_rcv(sk, skb);
                 else
@@ -1545,8 +1761,7 @@ process:
                         if (!tcp_prequeue(sk, skb))
                                 ret = tcp_v6_do_rcv(sk, skb);
                 }
-        } else if (unlikely(sk_add_backlog(sk, skb,
-                                           sk->sk_rcvbuf + sk->sk_sndbuf))) {
+        } else if (unlikely(sk_add_backlog(sk, skb))) {
                 bh_unlock_sock(sk);
                 NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
                 goto discard_and_relse;
@@ -1619,58 +1834,52 @@ do_time_wait:
         goto discard_it;
 }
 
-static void tcp_v6_early_demux(struct sk_buff *skb)
+static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
 {
-        const struct ipv6hdr *hdr;
-        const struct tcphdr *th;
-        struct sock *sk;
+        struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct inet_peer *peer;
 
-        if (skb->pkt_type != PACKET_HOST)
-                return;
+        if (!rt ||
+            !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
+                peer = inet_getpeer_v6(&np->daddr, 1);
+                *release_it = true;
+        } else {
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
+                peer = rt->rt6i_peer;
+                *release_it = false;
+        }
 
-        if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
-                return;
+        return peer;
+}
 
-        hdr = ipv6_hdr(skb);
-        th = tcp_hdr(skb);
+static void *tcp_v6_tw_get_peer(struct sock *sk)
+{
+        struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
+        struct inet_timewait_sock *tw = inet_twsk(sk);
 
-        if (th->doff < sizeof(struct tcphdr) / 4)
-                return;
+        if (tw->tw_family == AF_INET)
+                return tcp_v4_tw_get_peer(sk);
 
-        sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
-                                        &hdr->saddr, th->source,
-                                        &hdr->daddr, ntohs(th->dest),
-                                        inet6_iif(skb));
-        if (sk) {
-                skb->sk = sk;
-                skb->destructor = sock_edemux;
-                if (sk->sk_state != TCP_TIME_WAIT) {
-                        struct dst_entry *dst = sk->sk_rx_dst;
-
-                        if (dst)
-                                dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
-                        if (dst &&
-                            inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
-                                skb_dst_set_noref(skb, dst);
-                }
-        }
+        return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
 }
 
 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
         .twsk_unique    = tcp_twsk_unique,
         .twsk_destructor= tcp_twsk_destructor,
+        .twsk_getpeer   = tcp_v6_tw_get_peer,
 };
 
 static const struct inet_connection_sock_af_ops ipv6_specific = {
         .queue_xmit        = inet6_csk_xmit,
         .send_check        = tcp_v6_send_check,
         .rebuild_header    = inet6_sk_rebuild_header,
-        .sk_rx_dst_set     = inet6_sk_rx_dst_set,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
+        .get_peer          = tcp_v6_get_peer,
         .net_header_len    = sizeof(struct ipv6hdr),
-        .net_frag_header_len = sizeof(struct frag_hdr),
         .setsockopt        = ipv6_setsockopt,
         .getsockopt        = ipv6_getsockopt,
         .addr2sockaddr     = inet6_csk_addr2sockaddr,
@@ -1686,6 +1895,7 @@ static const struct inet_connection_sock_af_ops ipv6_specific = {
 static const struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
         .md5_lookup     =       tcp_v6_md5_lookup,
         .calc_md5_hash  =       tcp_v6_md5_hash_skb,
+        .md5_add        =       tcp_v6_md5_add_func,
         .md5_parse      =       tcp_v6_parse_md5_keys,
 };
 #endif
@@ -1698,9 +1908,9 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
-        .sk_rx_dst_set     = inet_sk_rx_dst_set,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
+        .get_peer          = tcp_v4_get_peer,
         .net_header_len    = sizeof(struct iphdr),
         .setsockopt        = ipv6_setsockopt,
         .getsockopt        = ipv6_getsockopt,
@@ -1717,6 +1927,7 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
         .md5_lookup     =       tcp_v4_md5_lookup,
         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
+        .md5_add        =       tcp_v6_md5_add_func,
         .md5_parse      =       tcp_v6_parse_md5_keys,
 };
 #endif
@@ -1727,20 +1938,73 @@ static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
 static int tcp_v6_init_sock(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        skb_queue_head_init(&tp->out_of_order_queue);
+        tcp_init_xmit_timers(sk);
+        tcp_prequeue_init(tp);
+
+        icsk->icsk_rto = TCP_TIMEOUT_INIT;
+        tp->mdev = TCP_TIMEOUT_INIT;
 
-        tcp_init_sock(sk);
+        /* So many TCP implementations out there (incorrectly) count the
+         * initial SYN frame in their delayed-ACK and congestion control
+         * algorithms that we must have the following bandaid to talk
+         * efficiently to them.  -DaveM
+         */
+        tp->snd_cwnd = 2;
+
+        /* See draft-stevens-tcpca-spec-01 for discussion of the
+         * initialization of these values.
+         */
+        tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+        tp->snd_cwnd_clamp = ~0;
+        tp->mss_cache = TCP_MSS_DEFAULT;
+
+        tp->reordering = sysctl_tcp_reordering;
+
+        sk->sk_state = TCP_CLOSE;
 
         icsk->icsk_af_ops = &ipv6_specific;
+        icsk->icsk_ca_ops = &tcp_init_congestion_ops;
+        icsk->icsk_sync_mss = tcp_sync_mss;
+        sk->sk_write_space = sk_stream_write_space;
+        sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
 
 #ifdef CONFIG_TCP_MD5SIG
-        tcp_sk(sk)->af_specific = &tcp_sock_ipv6_specific;
+        tp->af_specific = &tcp_sock_ipv6_specific;
 #endif
 
+        /* TCP Cookie Transactions */
+        if (sysctl_tcp_cookie_size > 0) {
+                /* Default, cookies without s_data_payload. */
+                tp->cookie_values =
+                        kzalloc(sizeof(*tp->cookie_values),
+                                sk->sk_allocation);
+                if (tp->cookie_values != NULL)
+                        kref_init(&tp->cookie_values->kref);
+        }
+        /* Presumed zeroed, in order of appearance:
+         *      cookie_in_always, cookie_out_never,
+         *      s_data_constant, s_data_in, s_data_out
+         */
+        sk->sk_sndbuf = sysctl_tcp_wmem[1];
+        sk->sk_rcvbuf = sysctl_tcp_rmem[1];
+
+        local_bh_disable();
+        percpu_counter_inc(&tcp_sockets_allocated);
+        local_bh_enable();
+
         return 0;
 }
 
 static void tcp_v6_destroy_sock(struct sock *sk)
 {
+#ifdef CONFIG_TCP_MD5SIG
+        /* Clean up the MD5 key list */
+        if (tcp_sk(sk)->md5sig_info)
+                tcp_v6_clear_md5_list(sk);
+#endif
         tcp_v4_destroy_sock(sk);
         inet6_destroy_sock(sk);
 }
@@ -1748,7 +2012,7 @@ static void tcp_v6_destroy_sock(struct sock *sk)
 #ifdef CONFIG_PROC_FS
 /* Proc filesystem TCPv6 sock list dumping. */
 static void get_openreq6(struct seq_file *seq,
-                         const struct sock *sk, struct request_sock *req, int i, kuid_t uid)
+                         struct sock *sk, struct request_sock *req, int i, int uid)
 {
         int ttd = req->expires - jiffies;
         const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
@@ -1771,8 +2035,8 @@ static void get_openreq6(struct seq_file *seq,
                    0,0, /* could print option size, but that is af dependent. */
                    1,   /* timers active (only the expire timer) */
                    jiffies_to_clock_t(ttd),
-                   req->num_timeout,
-                   from_kuid_munged(seq_user_ns(seq), uid),
+                   req->retrans,
+                   uid,
                    0,  /* non standard timer */
                    0, /* open_requests have no inode */
                    0, req);
@@ -1784,10 +2048,10 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
         __u16 destp, srcp;
         int timer_active;
         unsigned long timer_expires;
-        const struct inet_sock *inet = inet_sk(sp);
-        const struct tcp_sock *tp = tcp_sk(sp);
+        struct inet_sock *inet = inet_sk(sp);
+        struct tcp_sock *tp = tcp_sk(sp);
         const struct inet_connection_sock *icsk = inet_csk(sp);
-        const struct ipv6_pinfo *np = inet6_sk(sp);
+        struct ipv6_pinfo *np = inet6_sk(sp);
 
         dest  = &np->daddr;
         src   = &np->rcv_saddr;
@@ -1820,9 +2084,9 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                    tp->write_seq-tp->snd_una,
                    (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
                    timer_active,
-                   jiffies_delta_to_clock_t(timer_expires - jiffies),
+                   jiffies_to_clock_t(timer_expires - jiffies),
                    icsk->icsk_retransmits,
-                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
+                   sock_i_uid(sp),
                    icsk->icsk_probes_out,
                    sock_i_ino(sp),
                    atomic_read(&sp->sk_refcnt), sp,
@@ -1839,8 +2103,11 @@ static void get_timewait6_sock(struct seq_file *seq,
 {
         const struct in6_addr *dest, *src;
         __u16 destp, srcp;
-        const struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
-        long delta = tw->tw_ttd - jiffies;
+        struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
+        int ttd = tw->tw_ttd - jiffies;
+
+        if (ttd < 0)
+                ttd = 0;
 
         dest = &tw6->tw_v6_daddr;
         src  = &tw6->tw_v6_rcv_saddr;
@@ -1856,7 +2123,7 @@ static void get_timewait6_sock(struct seq_file *seq,
                    dest->s6_addr32[0], dest->s6_addr32[1],
                    dest->s6_addr32[2], dest->s6_addr32[3], destp,
                    tw->tw_substate, 0, 0,
-                   3, jiffies_delta_to_clock_t(delta), 0, 0, 0, 0,
+                   3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
                    atomic_read(&tw->tw_refcnt), tw);
 }
 
@@ -1891,18 +2158,12 @@ out:
         return 0;
 }
 
-static const struct file_operations tcp6_afinfo_seq_fops = {
-        .owner   = THIS_MODULE,
-        .open    = tcp_seq_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = seq_release_net
-};
-
 static struct tcp_seq_afinfo tcp6_seq_afinfo = {
         .name           = "tcp6",
         .family         = AF_INET6,
-        .seq_fops       = &tcp6_afinfo_seq_fops,
+        .seq_fops       = {
+                .owner          = THIS_MODULE,
+        },
         .seq_ops        = {
                 .show           = tcp6_seq_show,
         },
@@ -1936,8 +2197,6 @@ struct proto tcpv6_prot = {
         .sendmsg                = tcp_sendmsg,
         .sendpage               = tcp_sendpage,
         .backlog_rcv            = tcp_v6_do_rcv,
-        .release_cb             = tcp_release_cb,
-        .mtu_reduced            = tcp_v6_mtu_reduced,
         .hash                   = tcp_v6_hash,
         .unhash                 = inet_unhash,
         .get_port               = inet_csk_get_port,
@@ -1946,6 +2205,7 @@ struct proto tcpv6_prot = {
         .memory_allocated       = &tcp_memory_allocated,
         .memory_pressure        = &tcp_memory_pressure,
         .orphan_count           = &tcp_orphan_count,
+        .sysctl_mem             = sysctl_tcp_mem,
         .sysctl_wmem            = sysctl_tcp_wmem,
         .sysctl_rmem            = sysctl_tcp_rmem,
         .max_header             = MAX_TCP_HEADER,
@@ -1959,15 +2219,15 @@ struct proto tcpv6_prot = {
         .compat_setsockopt      = compat_tcp_setsockopt,
         .compat_getsockopt      = compat_tcp_getsockopt,
 #endif
-#ifdef CONFIG_MEMCG_KMEM
-        .proto_cgroup           = tcp_proto_cgroup,
-#endif
 };
 
 static const struct inet6_protocol tcpv6_protocol = {
-        .early_demux    =       tcp_v6_early_demux,
         .handler        =       tcp_v6_rcv,
         .err_handler    =       tcp_v6_err,
+        .gso_send_check =       tcp_v6_gso_send_check,
+        .gso_segment    =       tcp_tso_segment,
+        .gro_receive    =       tcp6_gro_receive,
+        .gro_complete   =       tcp6_gro_complete,
         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
 
@@ -2022,10 +2282,10 @@ int __init tcpv6_init(void)
 out:
         return ret;
 
-out_tcpv6_protosw:
-        inet6_unregister_protosw(&tcpv6_protosw);
 out_tcpv6_protocol:
         inet6_del_protocol(&tcpv6_protocol, IPPROTO_TCP);
+out_tcpv6_protosw:
+        inet6_unregister_protosw(&tcpv6_protosw);
         goto out;
 }
 
diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
deleted file mode 100644
index 2ec6bf6a0aa..00000000000
--- a/net/ipv6/tcpv6_offload.c
+++ /dev/null
@@ -1,95 +0,0 @@
-/*
- *      IPV6 GSO/GRO offload support
- *      Linux INET6 implementation
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- *
- *      TCPv6 GSO/GRO support
- */
-#include <linux/skbuff.h>
-#include <net/protocol.h>
-#include <net/tcp.h>
-#include <net/ip6_checksum.h>
-#include "ip6_offload.h"
-
-static int tcp_v6_gso_send_check(struct sk_buff *skb)
-{
-        const struct ipv6hdr *ipv6h;
-        struct tcphdr *th;
-
-        if (!pskb_may_pull(skb, sizeof(*th)))
-                return -EINVAL;
-
-        ipv6h = ipv6_hdr(skb);
-        th = tcp_hdr(skb);
-
-        th->check = 0;
-        skb->ip_summed = CHECKSUM_PARTIAL;
-        __tcp_v6_send_check(skb, &ipv6h->saddr, &ipv6h->daddr);
-        return 0;
-}
-
-static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
-                                         struct sk_buff *skb)
-{
-        const struct ipv6hdr *iph = skb_gro_network_header(skb);
-        __wsum wsum;
-        __sum16 sum;
-
-        switch (skb->ip_summed) {
-        case CHECKSUM_COMPLETE:
-                if (!tcp_v6_check(skb_gro_len(skb), &iph->saddr, &iph->daddr,
-                                  skb->csum)) {
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        break;
-                }
-flush:
-                NAPI_GRO_CB(skb)->flush = 1;
-                return NULL;
-
-        case CHECKSUM_NONE:
-                wsum = ~csum_unfold(csum_ipv6_magic(&iph->saddr, &iph->daddr,
-                                                    skb_gro_len(skb),
-                                                    IPPROTO_TCP, 0));
-                sum = csum_fold(skb_checksum(skb,
-                                             skb_gro_offset(skb),
-                                             skb_gro_len(skb),
-                                             wsum));
-                if (sum)
-                        goto flush;
-
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                break;
-        }
-
-        return tcp_gro_receive(head, skb);
-}
-
-static int tcp6_gro_complete(struct sk_buff *skb)
-{
-        const struct ipv6hdr *iph = ipv6_hdr(skb);
-        struct tcphdr *th = tcp_hdr(skb);
-
-        th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
-                                  &iph->saddr, &iph->daddr, 0);
-        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
-
-        return tcp_gro_complete(skb);
-}
-
-static const struct net_offload tcpv6_offload = {
-        .callbacks = {
-                .gso_send_check =       tcp_v6_gso_send_check,
-                .gso_segment    =       tcp_tso_segment,
-                .gro_receive    =       tcp6_gro_receive,
-                .gro_complete   =       tcp6_gro_complete,
-        },
-};
-
-int __init tcpv6_offload_init(void)
-{
-        return inet6_add_offload(&tcpv6_offload, IPPROTO_TCP);
-}
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 4b0f50d9a96..4f3cec12aa8 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -19,8 +19,6 @@
  *              YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
  */
 
-#define pr_fmt(fmt) "IPv6: " fmt
-
 #include <linux/icmpv6.h>
 #include <linux/init.h>
 #include <linux/module.h>
@@ -162,11 +160,11 @@ static const struct inet6_protocol tunnel46_protocol = {
 static int __init tunnel6_init(void)
 {
         if (inet6_add_protocol(&tunnel6_protocol, IPPROTO_IPV6)) {
-                pr_err("%s: can't add protocol\n", __func__);
+                printk(KERN_ERR "tunnel6 init(): can't add protocol\n");
                 return -EAGAIN;
         }
         if (inet6_add_protocol(&tunnel46_protocol, IPPROTO_IPIP)) {
-                pr_err("%s: can't add protocol\n", __func__);
+                printk(KERN_ERR "tunnel6 init(): can't add protocol\n");
                 inet6_del_protocol(&tunnel6_protocol, IPPROTO_IPV6);
                 return -EAGAIN;
         }
@@ -176,9 +174,9 @@ static int __init tunnel6_init(void)
 static void __exit tunnel6_fini(void)
 {
         if (inet6_del_protocol(&tunnel46_protocol, IPPROTO_IPIP))
-                pr_err("%s: can't remove protocol\n", __func__);
+                printk(KERN_ERR "tunnel6 close: can't remove protocol\n");
         if (inet6_del_protocol(&tunnel6_protocol, IPPROTO_IPV6))
-                pr_err("%s: can't remove protocol\n", __func__);
+                printk(KERN_ERR "tunnel6 close: can't remove protocol\n");
 }
 
 module_init(tunnel6_init);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index dfaa29b8b29..bb95e8e1c6f 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -48,7 +48,6 @@
 
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
-#include <trace/events/skb.h>
 #include "udp_impl.h"
 
 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
@@ -104,7 +103,7 @@ int udp_v6_get_port(struct sock *sk, unsigned short snum)
 {
         unsigned int hash2_nulladdr =
                 udp6_portaddr_hash(sock_net(sk), &in6addr_any, snum);
-        unsigned int hash2_partial =
+        unsigned int hash2_partial = 
                 udp6_portaddr_hash(sock_net(sk), &inet6_sk(sk)->rcv_saddr, 0);
 
         /* precompute partial secondary hash */
@@ -239,7 +238,7 @@ exact_match:
         return result;
 }
 
-struct sock *__udp6_lib_lookup(struct net *net,
+static struct sock *__udp6_lib_lookup(struct net *net,
                                       const struct in6_addr *saddr, __be16 sport,
                                       const struct in6_addr *daddr, __be16 dport,
                                       int dif, struct udp_table *udptable)
@@ -306,7 +305,6 @@ begin:
         rcu_read_unlock();
         return result;
 }
-EXPORT_SYMBOL_GPL(__udp6_lib_lookup);
 
 static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,
                                           __be16 sport, __be16 dport,
@@ -342,15 +340,15 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
         struct sk_buff *skb;
-        unsigned int ulen, copied;
-        int peeked, off = 0;
+        unsigned int ulen;
+        int peeked;
         int err;
         int is_udplite = IS_UDPLITE(sk);
         int is_udp4;
         bool slow;
 
         if (addr_len)
-                *addr_len = sizeof(struct sockaddr_in6);
+                *addr_len=sizeof(struct sockaddr_in6);
 
         if (flags & MSG_ERRQUEUE)
                 return ipv6_recv_error(sk, msg, len);
@@ -360,15 +358,14 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
 
 try_again:
         skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
-                                  &peeked, &off, &err);
+                                  &peeked, &err);
         if (!skb)
                 goto out;
 
         ulen = skb->len - sizeof(struct udphdr);
-        copied = len;
-        if (copied > ulen)
-                copied = ulen;
-        else if (copied < ulen)
+        if (len > ulen)
+                len = ulen;
+        else if (len < ulen)
                 msg->msg_flags |= MSG_TRUNC;
 
         is_udp4 = (skb->protocol == htons(ETH_P_IP));
@@ -379,34 +376,22 @@ try_again:
          * coverage checksum (UDP-Lite), do it before the copy.
          */
 
-        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+        if (len < ulen || UDP_SKB_CB(skb)->partial_cov) {
                 if (udp_lib_checksum_complete(skb))
                         goto csum_copy_err;
         }
 
         if (skb_csum_unnecessary(skb))
                 err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, copied);
+                                              msg->msg_iov,len);
         else {
                 err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
                 if (err == -EINVAL)
                         goto csum_copy_err;
         }
-        if (unlikely(err)) {
-                trace_kfree_skb(skb, udpv6_recvmsg);
-                if (!peeked) {
-                        atomic_inc(&sk->sk_drops);
-                        if (is_udp4)
-                                UDP_INC_STATS_USER(sock_net(sk),
-                                                   UDP_MIB_INERRORS,
-                                                   is_udplite);
-                        else
-                                UDP6_INC_STATS_USER(sock_net(sk),
-                                                    UDP_MIB_INERRORS,
-                                                    is_udplite);
-                }
+        if (err)
                 goto out_free;
-        }
+
         if (!peeked) {
                 if (is_udp4)
                         UDP_INC_STATS_USER(sock_net(sk),
@@ -432,7 +417,8 @@ try_again:
                         ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
                                                &sin6->sin6_addr);
                 else {
-                        sin6->sin6_addr = ipv6_hdr(skb)->saddr;
+                        ipv6_addr_copy(&sin6->sin6_addr,
+                                       &ipv6_hdr(skb)->saddr);
                         if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                                 sin6->sin6_scope_id = IP6CB(skb)->iif;
                 }
@@ -446,7 +432,7 @@ try_again:
                         datagram_recv_ctl(sk, msg, skb);
         }
 
-        err = copied;
+        err = len;
         if (flags & MSG_TRUNC)
                 err = ulen;
 
@@ -492,11 +478,6 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (sk == NULL)
                 return;
 
-        if (type == ICMPV6_PKT_TOOBIG)
-                ip6_sk_update_pmtu(skb, sk, info);
-        if (type == NDISC_REDIRECT)
-                ip6_sk_redirect(skb, sk);
-
         np = inet6_sk(sk);
 
         if (!icmpv6_err_convert(type, code, &err) && !np->recverr)
@@ -514,28 +495,6 @@ out:
         sock_put(sk);
 }
 
-static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
-{
-        int rc;
-
-        if (!ipv6_addr_any(&inet6_sk(sk)->daddr))
-                sock_rps_save_rxhash(sk, skb);
-
-        rc = sock_queue_rcv_skb(sk, skb);
-        if (rc < 0) {
-                int is_udplite = IS_UDPLITE(sk);
-
-                /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM)
-                        UDP6_INC_STATS_BH(sock_net(sk),
-                                        UDP_MIB_RCVBUFERRORS, is_udplite);
-                UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
-                kfree_skb(skb);
-                return -1;
-        }
-        return 0;
-}
-
 static __inline__ void udpv6_err(struct sk_buff *skb,
                                  struct inet6_skb_parm *opt, u8 type,
                                  u8 code, int offset, __be32 info     )
@@ -543,54 +502,18 @@ static __inline__ void udpv6_err(struct sk_buff *skb,
         __udp6_lib_err(skb, opt, type, code, offset, info, &udp_table);
 }
 
-static struct static_key udpv6_encap_needed __read_mostly;
-void udpv6_encap_enable(void)
-{
-        if (!static_key_enabled(&udpv6_encap_needed))
-                static_key_slow_inc(&udpv6_encap_needed);
-}
-EXPORT_SYMBOL(udpv6_encap_enable);
-
-int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
 {
         struct udp_sock *up = udp_sk(sk);
         int rc;
         int is_udplite = IS_UDPLITE(sk);
 
+        if (!ipv6_addr_any(&inet6_sk(sk)->daddr))
+                sock_rps_save_rxhash(sk, skb->rxhash);
+
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto drop;
 
-        if (static_key_false(&udpv6_encap_needed) && up->encap_type) {
-                int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);
-
-                /*
-                 * This is an encapsulation socket so pass the skb to
-                 * the socket's udp_encap_rcv() hook. Otherwise, just
-                 * fall through and pass this up the UDP socket.
-                 * up->encap_rcv() returns the following value:
-                 * =0 if skb was successfully passed to the encap
-                 *    handler or was discarded by it.
-                 * >0 if skb should be passed on to UDP.
-                 * <0 if skb should be resubmitted as proto -N
-                 */
-
-                /* if we're overly short, let UDP handle it */
-                encap_rcv = ACCESS_ONCE(up->encap_rcv);
-                if (skb->len > sizeof(struct udphdr) && encap_rcv != NULL) {
-                        int ret;
-
-                        ret = encap_rcv(sk, skb);
-                        if (ret <= 0) {
-                                UDP_INC_STATS_BH(sock_net(sk),
-                                                 UDP_MIB_INDATAGRAMS,
-                                                 is_udplite);
-                                return -ret;
-                        }
-                }
-
-                /* FALLTHROUGH -- it's a UDP Packet */
-        }
-
         /*
          * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c).
          */
@@ -610,30 +533,24 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 }
         }
 
-        if (rcu_access_pointer(sk->sk_filter)) {
+        if (rcu_dereference_raw(sk->sk_filter)) {
                 if (udp_lib_checksum_complete(skb))
                         goto drop;
         }
 
-        if (sk_rcvqueues_full(sk, skb, sk->sk_rcvbuf))
-                goto drop;
-
-        skb_dst_drop(skb);
-
-        bh_lock_sock(sk);
-        rc = 0;
-        if (!sock_owned_by_user(sk))
-                rc = __udpv6_queue_rcv_skb(sk, skb);
-        else if (sk_add_backlog(sk, skb, sk->sk_rcvbuf)) {
-                bh_unlock_sock(sk);
-                goto drop;
+        if ((rc = ip_queue_rcv_skb(sk, skb)) < 0) {
+                /* Note that an ENOMEM error is charged twice */
+                if (rc == -ENOMEM)
+                        UDP6_INC_STATS_BH(sock_net(sk),
+                                        UDP_MIB_RCVBUFERRORS, is_udplite);
+                goto drop_no_sk_drops_inc;
         }
-        bh_unlock_sock(sk);
 
-        return rc;
+        return 0;
 drop:
-        UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
         atomic_inc(&sk->sk_drops);
+drop_no_sk_drops_inc:
+        UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
         kfree_skb(skb);
         return -1;
 }
@@ -682,27 +599,37 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
 static void flush_stack(struct sock **stack, unsigned int count,
                         struct sk_buff *skb, unsigned int final)
 {
-        struct sk_buff *skb1 = NULL;
-        struct sock *sk;
         unsigned int i;
+        struct sock *sk;
+        struct sk_buff *skb1;
 
         for (i = 0; i < count; i++) {
+                skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
+
                 sk = stack[i];
-                if (likely(skb1 == NULL))
-                        skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
-                if (!skb1) {
-                        atomic_inc(&sk->sk_drops);
-                        UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
-                                          IS_UDPLITE(sk));
-                        UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-                                          IS_UDPLITE(sk));
+                if (skb1) {
+                        if (sk_rcvqueues_full(sk, skb1)) {
+                                kfree_skb(skb1);
+                                goto drop;
+                        }
+                        bh_lock_sock(sk);
+                        if (!sock_owned_by_user(sk))
+                                udpv6_queue_rcv_skb(sk, skb1);
+                        else if (sk_add_backlog(sk, skb1)) {
+                                kfree_skb(skb1);
+                                bh_unlock_sock(sk);
+                                goto drop;
+                        }
+                        bh_unlock_sock(sk);
+                        continue;
                 }
-
-                if (skb1 && udpv6_queue_rcv_skb(sk, skb1) <= 0)
-                        skb1 = NULL;
+drop:
+                atomic_inc(&sk->sk_drops);
+                UDP6_INC_STATS_BH(sock_net(sk),
+                                UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
+                UDP6_INC_STATS_BH(sock_net(sk),
+                                UDP_MIB_INERRORS, IS_UDPLITE(sk));
         }
-        if (unlikely(skb1))
-                kfree_skb(skb1);
 }
 /*
  * Note: called only from the BH handler context,
@@ -842,29 +769,39 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
          * for sock caches... i'll skip this for now.
          */
         sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
-        if (sk != NULL) {
-                int ret = udpv6_queue_rcv_skb(sk, skb);
-                sock_put(sk);
 
-                /* a return value > 0 means to resubmit the input, but
-                 * it wants the return to be -protocol, or 0
-                 */
-                if (ret > 0)
-                        return -ret;
+        if (sk == NULL) {
+                if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
+                        goto discard;
+
+                if (udp_lib_checksum_complete(skb))
+                        goto discard;
+                UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
+                                proto == IPPROTO_UDPLITE);
 
+                icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
+
+                kfree_skb(skb);
                 return 0;
         }
 
-        if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
-                goto discard;
+        /* deliver */
 
-        if (udp_lib_checksum_complete(skb))
+        if (sk_rcvqueues_full(sk, skb)) {
+                sock_put(sk);
                 goto discard;
-
-        UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
-
-        kfree_skb(skb);
+        }
+        bh_lock_sock(sk);
+        if (!sock_owned_by_user(sk))
+                udpv6_queue_rcv_skb(sk, skb);
+        else if (sk_add_backlog(sk, skb)) {
+                atomic_inc(&sk->sk_drops);
+                bh_unlock_sock(sk);
+                sock_put(sk);
+                goto discard;
+        }
+        bh_unlock_sock(sk);
+        sock_put(sk);
         return 0;
 
 short_packet:
@@ -1176,11 +1113,11 @@ do_udp_sendmsg:
 
         fl6.flowi6_proto = sk->sk_protocol;
         if (!ipv6_addr_any(daddr))
-                fl6.daddr = *daddr;
+                ipv6_addr_copy(&fl6.daddr, daddr);
         else
                 fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
         if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
-                fl6.saddr = np->saddr;
+                ipv6_addr_copy(&fl6.saddr, &np->saddr);
         fl6.fl6_sport = inet->inet_sport;
 
         final_p = fl6_update_dst(&fl6, opt, &final);
@@ -1190,8 +1127,7 @@ do_udp_sendmsg:
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) {
                 fl6.flowi6_oif = np->mcast_oif;
                 connected = 0;
-        } else if (!fl6.flowi6_oif)
-                fl6.flowi6_oif = np->ucast_oif;
+        }
 
         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 
@@ -1343,9 +1279,102 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
 }
 #endif
 
+static int udp6_ufo_send_check(struct sk_buff *skb)
+{
+        const struct ipv6hdr *ipv6h;
+        struct udphdr *uh;
+
+        if (!pskb_may_pull(skb, sizeof(*uh)))
+                return -EINVAL;
+
+        ipv6h = ipv6_hdr(skb);
+        uh = udp_hdr(skb);
+
+        uh->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
+                                     IPPROTO_UDP, 0);
+        skb->csum_start = skb_transport_header(skb) - skb->head;
+        skb->csum_offset = offsetof(struct udphdr, check);
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        return 0;
+}
+
+static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        unsigned int mss;
+        unsigned int unfrag_ip6hlen, unfrag_len;
+        struct frag_hdr *fptr;
+        u8 *mac_start, *prevhdr;
+        u8 nexthdr;
+        u8 frag_hdr_sz = sizeof(struct frag_hdr);
+        int offset;
+        __wsum csum;
+
+        mss = skb_shinfo(skb)->gso_size;
+        if (unlikely(skb->len <= mss))
+                goto out;
+
+        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
+                /* Packet is from an untrusted source, reset gso_segs. */
+                int type = skb_shinfo(skb)->gso_type;
+
+                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY) ||
+                             !(type & (SKB_GSO_UDP))))
+                        goto out;
+
+                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
+
+                segs = NULL;
+                goto out;
+        }
+
+        /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
+         * do checksum of UDP packets sent as multiple IP fragments.
+         */
+        offset = skb_checksum_start_offset(skb);
+        csum = skb_checksum(skb, offset, skb->len- offset, 0);
+        offset += skb->csum_offset;
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+        skb->ip_summed = CHECKSUM_NONE;
+
+        /* Check if there is enough headroom to insert fragment header. */
+        if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
+            pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
+                goto out;
+
+        /* Find the unfragmentable header and shift it left by frag_hdr_sz
+         * bytes to insert fragment header.
+         */
+        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+        nexthdr = *prevhdr;
+        *prevhdr = NEXTHDR_FRAGMENT;
+        unfrag_len = skb_network_header(skb) - skb_mac_header(skb) +
+                     unfrag_ip6hlen;
+        mac_start = skb_mac_header(skb);
+        memmove(mac_start-frag_hdr_sz, mac_start, unfrag_len);
+
+        skb->mac_header -= frag_hdr_sz;
+        skb->network_header -= frag_hdr_sz;
+
+        fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
+        fptr->nexthdr = nexthdr;
+        fptr->reserved = 0;
+        ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
+
+        /* Fragment the skb. ipv6 header and the remaining fields of the
+         * fragment header are updated in ipv6_gso_segment()
+         */
+        segs = skb_segment(skb, features);
+
+out:
+        return segs;
+}
+
 static const struct inet6_protocol udpv6_protocol = {
         .handler        =       udpv6_rcv,
         .err_handler    =       udpv6_err,
+        .gso_send_check =       udp6_ufo_send_check,
+        .gso_segment    =       udp6_ufo_fragment,
         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
 
@@ -1375,8 +1404,7 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
                    sk_wmem_alloc_get(sp),
                    sk_rmem_alloc_get(sp),
                    0, 0L, 0,
-                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
-                   0,
+                   sock_i_uid(sp), 0,
                    sock_i_ino(sp),
                    atomic_read(&sp->sk_refcnt), sp,
                    atomic_read(&sp->sk_drops));
@@ -1396,19 +1424,13 @@ int udp6_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static const struct file_operations udp6_afinfo_seq_fops = {
-        .owner    = THIS_MODULE,
-        .open     = udp_seq_open,
-        .read     = seq_read,
-        .llseek   = seq_lseek,
-        .release  = seq_release_net
-};
-
 static struct udp_seq_afinfo udp6_seq_afinfo = {
         .name           = "udp6",
         .family         = AF_INET6,
         .udp_table      = &udp_table,
-        .seq_fops       = &udp6_afinfo_seq_fops,
+        .seq_fops       = {
+                .owner  =       THIS_MODULE,
+        },
         .seq_ops        = {
                 .show           = udp6_seq_show,
         },
@@ -1438,7 +1460,7 @@ struct proto udpv6_prot = {
         .getsockopt        = udpv6_getsockopt,
         .sendmsg           = udpv6_sendmsg,
         .recvmsg           = udpv6_recvmsg,
-        .backlog_rcv       = __udpv6_queue_rcv_skb,
+        .backlog_rcv       = udpv6_queue_rcv_skb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
         .rehash            = udp_v6_rehash,
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
deleted file mode 100644
index 0c8934a317c..00000000000
--- a/net/ipv6/udp_offload.c
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- *      IPV6 GSO/GRO offload support
- *      Linux INET6 implementation
- *
- *      This program is free software; you can redistribute it and/or
- *      modify it under the terms of the GNU General Public License
- *      as published by the Free Software Foundation; either version
- *      2 of the License, or (at your option) any later version.
- *
- *      UDPv6 GSO support
- */
-#include <linux/skbuff.h>
-#include <net/protocol.h>
-#include <net/ipv6.h>
-#include <net/udp.h>
-#include <net/ip6_checksum.h>
-#include "ip6_offload.h"
-
-static int udp6_ufo_send_check(struct sk_buff *skb)
-{
-        const struct ipv6hdr *ipv6h;
-        struct udphdr *uh;
-
-        if (!pskb_may_pull(skb, sizeof(*uh)))
-                return -EINVAL;
-
-        ipv6h = ipv6_hdr(skb);
-        uh = udp_hdr(skb);
-
-        uh->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
-                                     IPPROTO_UDP, 0);
-        skb->csum_start = skb_transport_header(skb) - skb->head;
-        skb->csum_offset = offsetof(struct udphdr, check);
-        skb->ip_summed = CHECKSUM_PARTIAL;
-        return 0;
-}
-
-static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
-        netdev_features_t features)
-{
-        struct sk_buff *segs = ERR_PTR(-EINVAL);
-        unsigned int mss;
-        unsigned int unfrag_ip6hlen, unfrag_len;
-        struct frag_hdr *fptr;
-        u8 *mac_start, *prevhdr;
-        u8 nexthdr;
-        u8 frag_hdr_sz = sizeof(struct frag_hdr);
-        int offset;
-        __wsum csum;
-
-        mss = skb_shinfo(skb)->gso_size;
-        if (unlikely(skb->len <= mss))
-                goto out;
-
-        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {
-                /* Packet is from an untrusted source, reset gso_segs. */
-                int type = skb_shinfo(skb)->gso_type;
-
-                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY) ||
-                             !(type & (SKB_GSO_UDP))))
-                        goto out;
-
-                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(skb->len, mss);
-
-                segs = NULL;
-                goto out;
-        }
-
-        /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
-         * do checksum of UDP packets sent as multiple IP fragments.
-         */
-        offset = skb_checksum_start_offset(skb);
-        csum = skb_checksum(skb, offset, skb->len - offset, 0);
-        offset += skb->csum_offset;
-        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
-        skb->ip_summed = CHECKSUM_NONE;
-
-        /* Check if there is enough headroom to insert fragment header. */
-        if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
-            pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
-                goto out;
-
-        /* Find the unfragmentable header and shift it left by frag_hdr_sz
-         * bytes to insert fragment header.
-         */
-        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
-        nexthdr = *prevhdr;
-        *prevhdr = NEXTHDR_FRAGMENT;
-        unfrag_len = skb_network_header(skb) - skb_mac_header(skb) +
-                     unfrag_ip6hlen;
-        mac_start = skb_mac_header(skb);
-        memmove(mac_start-frag_hdr_sz, mac_start, unfrag_len);
-
-        skb->mac_header -= frag_hdr_sz;
-        skb->network_header -= frag_hdr_sz;
-
-        fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
-        fptr->nexthdr = nexthdr;
-        fptr->reserved = 0;
-        ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
-
-        /* Fragment the skb. ipv6 header and the remaining fields of the
-         * fragment header are updated in ipv6_gso_segment()
-         */
-        segs = skb_segment(skb, features);
-
-out:
-        return segs;
-}
-static const struct net_offload udpv6_offload = {
-        .callbacks = {
-                .gso_send_check =       udp6_ufo_send_check,
-                .gso_segment    =       udp6_ufo_fragment,
-        },
-};
-
-int __init udp_offload_init(void)
-{
-        return inet6_add_offload(&udpv6_offload, IPPROTO_UDP);
-}
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 1d08e21d9f6..986c4de5292 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -11,7 +11,6 @@
  *              as published by the Free Software Foundation; either version
  *              2 of the License, or (at your option) any later version.
  */
-#include <linux/export.h>
 #include "udp_impl.h"
 
 static int udplitev6_rcv(struct sk_buff *skb)
@@ -94,20 +93,13 @@ void udplitev6_exit(void)
 }
 
 #ifdef CONFIG_PROC_FS
-
-static const struct file_operations udplite6_afinfo_seq_fops = {
-        .owner    = THIS_MODULE,
-        .open     = udp_seq_open,
-        .read     = seq_read,
-        .llseek   = seq_lseek,
-        .release  = seq_release_net
-};
-
 static struct udp_seq_afinfo udplite6_seq_afinfo = {
         .name           = "udplite6",
         .family         = AF_INET6,
         .udp_table      = &udplite_table,
-        .seq_fops       = &udplite6_afinfo_seq_fops,
+        .seq_fops       = {
+                .owner  =       THIS_MODULE,
+        },
         .seq_ops        = {
                 .show           = udp6_seq_show,
         },
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index 9949a356d62..3437d7d4eed 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -72,14 +72,15 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
                 top_iph->nexthdr = IPPROTO_BEETPH;
         }
 
-        top_iph->saddr = *(struct in6_addr *)&x->props.saddr;
-        top_iph->daddr = *(struct in6_addr *)&x->id.daddr;
+        ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
+        ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
         return 0;
 }
 
 static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ipv6hdr *ip6h;
+        const unsigned char *old_mac;
         int size = sizeof(struct ipv6hdr);
         int err;
 
@@ -89,14 +90,17 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 
         __skb_push(skb, size);
         skb_reset_network_header(skb);
-        skb_mac_header_rebuild(skb);
+
+        old_mac = skb_mac_header(skb);
+        skb_set_mac_header(skb, -skb->mac_len);
+        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
 
         xfrm6_beet_make_header(skb);
 
         ip6h = ipv6_hdr(skb);
         ip6h->payload_len = htons(skb->len - size);
-        ip6h->daddr = *(struct in6_addr *)&x->sel.daddr.a6;
-        ip6h->saddr = *(struct in6_addr *)&x->sel.saddr.a6;
+        ipv6_addr_copy(&ip6h->daddr, (struct in6_addr *) &x->sel.daddr.a6);
+        ipv6_addr_copy(&ip6h->saddr, (struct in6_addr *) &x->sel.saddr.a6);
         err = 0;
 out:
         return err;
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 9f2095b19ad..4d6edff0498 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -55,14 +55,15 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
                 dsfield &= ~INET_ECN_MASK;
         ipv6_change_dsfield(top_iph, 0, dsfield);
         top_iph->hop_limit = ip6_dst_hoplimit(dst->child);
-        top_iph->saddr = *(struct in6_addr *)&x->props.saddr;
-        top_iph->daddr = *(struct in6_addr *)&x->id.daddr;
+        ipv6_addr_copy(&top_iph->saddr, (const struct in6_addr *)&x->props.saddr);
+        ipv6_addr_copy(&top_iph->daddr, (const struct in6_addr *)&x->id.daddr);
         return 0;
 }
 
 static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = -EINVAL;
+        const unsigned char *old_mac;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
                 goto out;
@@ -79,9 +80,10 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!(x->props.flags & XFRM_STATE_NOECN))
                 ipip6_ecn_decapsulate(skb);
 
+        old_mac = skb_mac_header(skb);
+        skb_set_mac_header(skb, -skb->mac_len);
+        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
         skb_reset_network_header(skb);
-        skb_mac_header_rebuild(skb);
-
         err = 0;
 
 out:
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 8755a3079d0..49a91c5f562 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -28,43 +28,6 @@ int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
 
 EXPORT_SYMBOL(xfrm6_find_1stfragopt);
 
-static int xfrm6_local_dontfrag(struct sk_buff *skb)
-{
-        int proto;
-        struct sock *sk = skb->sk;
-
-        if (sk) {
-                proto = sk->sk_protocol;
-
-                if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
-                        return inet6_sk(sk)->dontfrag;
-        }
-
-        return 0;
-}
-
-static void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu)
-{
-        struct flowi6 fl6;
-        struct sock *sk = skb->sk;
-
-        fl6.flowi6_oif = sk->sk_bound_dev_if;
-        fl6.daddr = ipv6_hdr(skb)->daddr;
-
-        ipv6_local_rxpmtu(sk, &fl6, mtu);
-}
-
-static void xfrm6_local_error(struct sk_buff *skb, u32 mtu)
-{
-        struct flowi6 fl6;
-        struct sock *sk = skb->sk;
-
-        fl6.fl6_dport = inet_sk(sk)->inet_dport;
-        fl6.daddr = ipv6_hdr(skb)->daddr;
-
-        ipv6_local_error(sk, EMSGSIZE, &fl6, mtu);
-}
-
 static int xfrm6_tunnel_check_size(struct sk_buff *skb)
 {
         int mtu, ret = 0;
@@ -76,13 +39,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
 
         if (!skb->local_df && skb->len > mtu) {
                 skb->dev = dst->dev;
-
-                if (xfrm6_local_dontfrag(skb))
-                        xfrm6_local_rxpmtu(skb, mtu);
-                else if (skb->sk)
-                        xfrm6_local_error(skb, mtu);
-                else
-                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 ret = -EMSGSIZE;
         }
 
@@ -136,18 +93,9 @@ static int __xfrm6_output(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
         struct xfrm_state *x = dst->xfrm;
-        int mtu = ip6_skb_dst_mtu(skb);
-
-        if (skb->len > mtu && xfrm6_local_dontfrag(skb)) {
-                xfrm6_local_rxpmtu(skb, mtu);
-                return -EMSGSIZE;
-        } else if (!skb->local_df && skb->len > mtu && skb->sk) {
-                xfrm6_local_error(skb, mtu);
-                return -EMSGSIZE;
-        }
 
-        if (x->props.mode == XFRM_MODE_TUNNEL &&
-            ((skb->len > mtu && !skb_is_gso(skb)) ||
+        if ((x && x->props.mode == XFRM_MODE_TUNNEL) &&
+            ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
                 dst_allfrag(skb_dst(skb)))) {
                         return ip6_fragment(skb, x->outer_mode->afinfo->output_finish);
         }
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index c9844135c9c..d879f7efbd1 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -20,7 +20,7 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 #include <net/mip6.h>
 #endif
 
@@ -73,13 +73,6 @@ static int xfrm6_get_tos(const struct flowi *fl)
         return 0;
 }
 
-static void xfrm6_init_dst(struct net *net, struct xfrm_dst *xdst)
-{
-        struct rt6_info *rt = (struct rt6_info *)xdst;
-
-        rt6_init_peer(rt, net->ipv6.peers);
-}
-
 static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
                            int nfheader_len)
 {
@@ -106,11 +99,12 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         if (!xdst->u.rt6.rt6i_idev)
                 return -ENODEV;
 
-        rt6_transfer_peer(&xdst->u.rt6, rt);
+        xdst->u.rt6.rt6i_peer = rt->rt6i_peer;
+        if (rt->rt6i_peer)
+                atomic_inc(&rt->rt6i_peer->refcnt);
 
         /* Sheit... I remember I did this right. Apparently,
          * it was magically lost, so this code needs audit */
-        xdst->u.rt6.n = neigh_clone(rt->n);
         xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
                                                    RTF_LOCAL);
         xdst->u.rt6.rt6i_metric = rt->rt6i_metric;
@@ -138,8 +132,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
         memset(fl6, 0, sizeof(struct flowi6));
         fl6->flowi6_mark = skb->mark;
 
-        fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
-        fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
+        ipv6_addr_copy(&fl6->daddr, reverse ? &hdr->saddr : &hdr->daddr);
+        ipv6_addr_copy(&fl6->saddr, reverse ? &hdr->daddr : &hdr->saddr);
 
         while (nh + offset + 1 < skb->data ||
                pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
@@ -182,7 +176,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                         fl6->flowi6_proto = nexthdr;
                         return;
 
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 case IPPROTO_MH:
                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
                                 struct ip6_mh *mh;
@@ -214,22 +208,12 @@ static inline int xfrm6_garbage_collect(struct dst_ops *ops)
         return dst_entries_get_fast(ops) > ops->gc_thresh * 2;
 }
 
-static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk,
-                              struct sk_buff *skb, u32 mtu)
-{
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        struct dst_entry *path = xdst->route;
-
-        path->ops->update_pmtu(path, sk, skb, mtu);
-}
-
-static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk,
-                           struct sk_buff *skb)
+static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
         struct dst_entry *path = xdst->route;
 
-        path->ops->redirect(path, sk, skb);
+        path->ops->update_pmtu(path, mtu);
 }
 
 static void xfrm6_dst_destroy(struct dst_entry *dst)
@@ -239,10 +223,8 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
         if (likely(xdst->u.rt6.rt6i_idev))
                 in6_dev_put(xdst->u.rt6.rt6i_idev);
         dst_destroy_metrics_generic(dst);
-        if (rt6_has_peer(&xdst->u.rt6)) {
-                struct inet_peer *peer = rt6_peer_ptr(&xdst->u.rt6);
-                inet_putpeer(peer);
-        }
+        if (likely(xdst->u.rt6.rt6i_peer))
+                inet_putpeer(xdst->u.rt6.rt6i_peer);
         xfrm_dst_destroy(xdst);
 }
 
@@ -278,7 +260,6 @@ static struct dst_ops xfrm6_dst_ops = {
         .protocol =             cpu_to_be16(ETH_P_IPV6),
         .gc =                   xfrm6_garbage_collect,
         .update_pmtu =          xfrm6_update_pmtu,
-        .redirect =             xfrm6_redirect,
         .cow_metrics =          dst_cow_metrics_generic,
         .destroy =              xfrm6_dst_destroy,
         .ifdown =               xfrm6_dst_ifdown,
@@ -293,7 +274,6 @@ static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
         .get_saddr =            xfrm6_get_saddr,
         .decode_session =       _decode_session6,
         .get_tos =              xfrm6_get_tos,
-        .init_dst =             xfrm6_init_dst,
         .init_path =            xfrm6_init_path,
         .fill_dst =             xfrm6_fill_dst,
         .blackhole_route =      ip6_blackhole_route,
@@ -327,7 +307,21 @@ static struct ctl_table_header *sysctl_hdr;
 int __init xfrm6_init(void)
 {
         int ret;
-
+        unsigned int gc_thresh;
+
+        /*
+         * We need a good default value for the xfrm6 gc threshold.
+         * In ipv4 we set it to the route hash table size * 8, which
+         * is half the size of the maximaum route cache for ipv4.  It
+         * would be good to do the same thing for v6, except the table is
+         * constructed differently here.  Here each table for a net namespace
+         * can have FIB_TABLE_HASHSZ entries, so lets go with the same
+         * computation that we used for ipv4 here.  Also, lets keep the initial
+         * gc_thresh to a minimum of 1024, since, the ipv6 route cache defaults
+         * to that as a minimum as well
+         */
+        gc_thresh = FIB6_TABLE_HASHSZ * 8;
+        xfrm6_dst_ops.gc_thresh = (gc_thresh < 1024) ? 1024 : gc_thresh;
         dst_entries_init(&xfrm6_dst_ops);
 
         ret = xfrm6_policy_init();
@@ -340,8 +334,8 @@ int __init xfrm6_init(void)
                 goto out_policy;
 
 #ifdef CONFIG_SYSCTL
-        sysctl_hdr = register_net_sysctl(&init_net, "net/ipv6",
-                                         xfrm6_policy_table);
+        sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv6_ctl_path,
+                                                xfrm6_policy_table);
 #endif
 out:
         return ret;
@@ -356,6 +350,7 @@ void xfrm6_fini(void)
         if (sysctl_hdr)
                 unregister_net_sysctl_table(sysctl_hdr);
 #endif
+        //xfrm6_input_fini();
         xfrm6_policy_fini();
         xfrm6_state_fini();
         dst_entries_destroy(&xfrm6_dst_ops);
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index d8c70b8efc2..248f0b2a7ee 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -15,7 +15,6 @@
 #include <linux/pfkeyv2.h>
 #include <linux/ipsec.h>
 #include <linux/netfilter_ipv6.h>
-#include <linux/export.h>
 #include <net/dsfield.h>
 #include <net/ipv6.h>
 #include <net/addrconf.h>
@@ -27,8 +26,8 @@ __xfrm6_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
 
         /* Initialize temporary selector matching only
          * to current session. */
-        *(struct in6_addr *)&sel->daddr = fl6->daddr;
-        *(struct in6_addr *)&sel->saddr = fl6->saddr;
+        ipv6_addr_copy((struct in6_addr *)&sel->daddr, &fl6->daddr);
+        ipv6_addr_copy((struct in6_addr *)&sel->saddr, &fl6->saddr);
         sel->dport = xfrm_flowi_dport(fl, &fl6->uli);
         sel->dport_mask = htons(0xffff);
         sel->sport = xfrm_flowi_sport(fl, &fl6->uli);
@@ -101,7 +100,7 @@ static int __xfrm6_state_sort_cmp(void *p)
                         return 1;
                 else
                         return 3;
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         case XFRM_MODE_ROUTEOPTIMIZATION:
         case XFRM_MODE_IN_TRIGGER:
                 return 2;
@@ -134,7 +133,7 @@ static int __xfrm6_tmpl_sort_cmp(void *p)
         switch (v->mode) {
         case XFRM_MODE_TRANSPORT:
                 return 1;
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         case XFRM_MODE_ROUTEOPTIMIZATION:
         case XFRM_MODE_IN_TRIGGER:
                 return 2;
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index ee5a7065aac..4fe1db12d2a 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -68,9 +68,9 @@ static DEFINE_SPINLOCK(xfrm6_tunnel_spi_lock);
 
 static struct kmem_cache *xfrm6_tunnel_spi_kmem __read_mostly;
 
-static inline unsigned int xfrm6_tunnel_spi_hash_byaddr(const xfrm_address_t *addr)
+static inline unsigned xfrm6_tunnel_spi_hash_byaddr(const xfrm_address_t *addr)
 {
-        unsigned int h;
+        unsigned h;
 
         h = (__force u32)(addr->a6[0] ^ addr->a6[1] ^ addr->a6[2] ^ addr->a6[3]);
         h ^= h >> 16;
@@ -80,7 +80,7 @@ static inline unsigned int xfrm6_tunnel_spi_hash_byaddr(const xfrm_address_t *ad
         return h;
 }
 
-static inline unsigned int xfrm6_tunnel_spi_hash_byspi(u32 spi)
+static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
 {
         return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
 }