Merge branch 'mpi-master' into wip-k-fmlpwip-k-fmlp

Conflicts: litmus/sched_cedf.c
author: Glenn Elliott <gelliott@cs.unc.edu> 2012-03-04 19:47:13 -0500
committer: Glenn Elliott <gelliott@cs.unc.edu> 2012-03-04 19:47:13 -0500
commit: c71c03bda1e86c9d5198c5d83f712e695c4f2a1e (patch)
tree: ecb166cb3e2b7e2adb3b5e292245fefd23381ac8 /net/ipv6
parent: ea53c912f8a86a8567697115b6a0d8152beee5c8 (diff)
parent: 6a00f206debf8a5c8899055726ad127dbeeed098 (diff)
54 files changed, 2755 insertions, 1903 deletions
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 324fac3b6c16..498b927f68be 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -98,7 +98,11 @@
 #endif
 #define INFINITY_LIFE_TIME      0xFFFFFFFF
-#define TIME_DELTA(a, b) ((unsigned long)((long)(a) - (long)(b)))
+static inline u32 cstamp_delta(unsigned long cstamp)
+{
+        return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
+}
 #define ADDRCONF_TIMER_FUZZ_MINUS       (HZ > 50 ? HZ/50 : 1)
 #define ADDRCONF_TIMER_FUZZ             (HZ / 4)
@@ -243,7 +247,7 @@ static inline bool addrconf_qdisc_ok(const struct net_device *dev)
 /* Check if a route is valid prefix route */
 static inline int addrconf_is_prefix_route(const struct rt6_info *rt)
 {
-        return ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0);
+        return (rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0;
 }
 static void addrconf_del_timer(struct inet6_ifaddr *ifp)
@@ -285,19 +289,19 @@ static int snmp6_alloc_dev(struct inet6_dev *idev)
                          sizeof(struct ipstats_mib),
                          __alignof__(struct ipstats_mib)) < 0)
                goto err_ip;
-        if (snmp_mib_init((void __percpu **)idev->stats.icmpv6,
+        idev->stats.icmpv6dev = kzalloc(sizeof(struct icmpv6_mib_device),
-                          sizeof(struct icmpv6_mib),
+                                        GFP_KERNEL);
-                          __alignof__(struct icmpv6_mib)) < 0)
+        if (!idev->stats.icmpv6dev)
                goto err_icmp;
-        if (snmp_mib_init((void __percpu **)idev->stats.icmpv6msg,
+        idev->stats.icmpv6msgdev = kzalloc(sizeof(struct icmpv6msg_mib_device),
-                          sizeof(struct icmpv6msg_mib),
+                                           GFP_KERNEL);
-                          __alignof__(struct icmpv6msg_mib)) < 0)
+        if (!idev->stats.icmpv6msgdev)
                goto err_icmpmsg;
        return 0;
 err_icmpmsg:
-        snmp_mib_free((void __percpu **)idev->stats.icmpv6);
+        kfree(idev->stats.icmpv6dev);
 err_icmp:
        snmp_mib_free((void __percpu **)idev->stats.ipv6);
 err_ip:
@@ -306,19 +310,13 @@ err_ip:
 static void snmp6_free_dev(struct inet6_dev *idev)
 {
-        snmp_mib_free((void __percpu **)idev->stats.icmpv6msg);
+        kfree(idev->stats.icmpv6msgdev);
-        snmp_mib_free((void __percpu **)idev->stats.icmpv6);
+        kfree(idev->stats.icmpv6dev);
        snmp_mib_free((void __percpu **)idev->stats.ipv6);
 }
 /* Nobody refers to this device, we may destroy it. */
-static void in6_dev_finish_destroy_rcu(struct rcu_head *head)
-{
-        struct inet6_dev *idev = container_of(head, struct inet6_dev, rcu);
-        kfree(idev);
-}
 void in6_dev_finish_destroy(struct inet6_dev *idev)
 {
        struct net_device *dev = idev->dev;
@@ -335,7 +333,7 @@ void in6_dev_finish_destroy(struct inet6_dev *idev)
                return;
        }
        snmp6_free_dev(idev);
-        call_rcu(&idev->rcu, in6_dev_finish_destroy_rcu);
+        kfree_rcu(idev, rcu);
 }
 EXPORT_SYMBOL(in6_dev_finish_destroy);
@@ -416,9 +414,6 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
            dev->type == ARPHRD_TUNNEL6 ||
            dev->type == ARPHRD_SIT ||
            dev->type == ARPHRD_NONE) {
-                printk(KERN_INFO
-                       "%s: Disabled Privacy Extensions\n",
-                       dev->name);
                ndev->cnf.use_tempaddr = -1;
        } else {
                in6_dev_hold(ndev);
@@ -534,12 +529,6 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 }
 #endif
-static void inet6_ifa_finish_destroy_rcu(struct rcu_head *head)
-{
-        struct inet6_ifaddr *ifp = container_of(head, struct inet6_ifaddr, rcu);
-        kfree(ifp);
-}
 /* Nobody refers to this ifaddr, destroy it */
 void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
 {
@@ -560,7 +549,7 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
        }
        dst_release(&ifp->rt->dst);
-        call_rcu(&ifp->rcu, inet6_ifa_finish_destroy_rcu);
+        kfree_rcu(ifp, rcu);
 }
 static void
@@ -717,12 +706,9 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
        struct inet6_ifaddr *ifa, *ifn;
        struct inet6_dev *idev = ifp->idev;
        int state;
-        int hash;
        int deleted = 0, onlink = 0;
        unsigned long expires = jiffies;
-        hash = ipv6_addr_hash(&ifp->addr);
        spin_lock_bh(&ifp->state_lock);
        state = ifp->state;
        ifp->state = INET6_IFADDR_STATE_DEAD;
@@ -827,6 +813,8 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                dst_release(&rt->dst);
        }
+        /* clean up prefsrc entries */
+        rt6_remove_prefsrc(ifp);
 out:
        in6_ifa_put(ifp);
 }
@@ -836,7 +824,7 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *i
 {
        struct inet6_dev *idev = ifp->idev;
        struct in6_addr addr, *tmpaddr;
-        unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_cstamp, tmp_tstamp;
+        unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_cstamp, tmp_tstamp, age;
        unsigned long regen_advance;
        int tmp_plen;
        int ret = 0;
@@ -886,12 +874,13 @@ retry:
                goto out;
        }
        memcpy(&addr.s6_addr[8], idev->rndid, 8);
+        age = (jiffies - ifp->tstamp) / HZ;
        tmp_valid_lft = min_t(__u32,
                              ifp->valid_lft,
-                              idev->cnf.temp_valid_lft);
+                              idev->cnf.temp_valid_lft + age);
        tmp_prefered_lft = min_t(__u32,
                                 ifp->prefered_lft,
-                                 idev->cnf.temp_prefered_lft -
+                                 idev->cnf.temp_prefered_lft + age -
                                 idev->cnf.max_desync_factor);
        tmp_plen = ifp->prefix_len;
        max_addresses = idev->cnf.max_addresses;
@@ -1085,7 +1074,7 @@ static int ipv6_get_saddr_eval(struct net *net,
        case IPV6_SADDR_RULE_PRIVACY:
            {
                /* Rule 7: Prefer public address
-                 * Note: prefer temprary address if use_tempaddr >= 2
+                 * Note: prefer temporary address if use_tempaddr >= 2
                 */
                int preftmp = dst->prefs & (IPV6_PREFER_SRC_PUBLIC|IPV6_PREFER_SRC_TMP) ?
                                !!(dst->prefs & IPV6_PREFER_SRC_TMP) :
@@ -1282,7 +1271,7 @@ static int ipv6_count_addresses(struct inet6_dev *idev)
        return cnt;
 }
-int ipv6_chk_addr(struct net *net, struct in6_addr *addr,
+int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
                  struct net_device *dev, int strict)
 {
        struct inet6_ifaddr *ifp;
@@ -1325,7 +1314,7 @@ static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
        return false;
 }
-int ipv6_chk_prefix(struct in6_addr *addr, struct net_device *dev)
+int ipv6_chk_prefix(const struct in6_addr *addr, struct net_device *dev)
 {
        struct inet6_dev *idev;
        struct inet6_ifaddr *ifa;
@@ -1426,8 +1415,10 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
 {
        struct inet6_dev *idev = ifp->idev;
-        if (addrconf_dad_end(ifp))
+        if (addrconf_dad_end(ifp)) {
+                in6_ifa_put(ifp);
                return;
+        }
        if (net_ratelimit())
                printk(KERN_INFO "%s: IPv6 duplicate address %pI6c detected!\n",
@@ -1454,7 +1445,7 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
 /* Join to solicited addr multicast group. */
-void addrconf_join_solict(struct net_device *dev, struct in6_addr *addr)
+void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)
 {
        struct in6_addr maddr;
@@ -1465,7 +1456,7 @@ void addrconf_join_solict(struct net_device *dev, struct in6_addr *addr)
        ipv6_dev_mc_inc(dev, &maddr);
 }
-void addrconf_leave_solict(struct inet6_dev *idev, struct in6_addr *addr)
+void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
 {
        struct in6_addr maddr;
@@ -1544,7 +1535,7 @@ static int addrconf_ifid_infiniband(u8 *eui, struct net_device *dev)
        return 0;
 }
-int __ipv6_isatap_ifid(u8 *eui, __be32 addr)
+static int __ipv6_isatap_ifid(u8 *eui, __be32 addr)
 {
        if (addr == 0)
                return -1;
@@ -1560,7 +1551,6 @@ int __ipv6_isatap_ifid(u8 *eui, __be32 addr)
        memcpy(eui + 4, &addr, 4);
        return 0;
 }
-EXPORT_SYMBOL(__ipv6_isatap_ifid);
 static int addrconf_ifid_sit(u8 *eui, struct net_device *dev)
 {
@@ -1968,7 +1958,7 @@ ok:
                                         *  to the stored lifetime since we'll
                                         *  be updating the timestamp below,
                                         *  else we'll set it back to the
-                                         *  minumum.
+                                         *  minimum.
                                         */
                                        if (prefered_lft != ifp->prefered_lft) {
                                                valid_lft = stored_lft;
@@ -2022,10 +2012,11 @@ ok:
                                        ipv6_ifa_notify(0, ift);
                        }
-                        if (create && in6_dev->cnf.use_tempaddr > 0) {
+                        if ((create || list_empty(&in6_dev->tempaddr_list)) && in6_dev->cnf.use_tempaddr > 0) {
                                /*
                                 * When a new public address is created as described in [ADDRCONF],
-                                 * also create a new temporary address.
+                                 * also create a new temporary address. Also create a temporary
+                                 * address if it's enabled but no temporary address currently exists.
                                 */
                                read_unlock_bh(&in6_dev->lock);
                                ipv6_create_tempaddr(ifp, NULL);
@@ -2110,7 +2101,7 @@ err_exit:
 /*
 *      Manual configuration of address on an interface
 */
-static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
+static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *pfx,
                          unsigned int plen, __u8 ifa_flags, __u32 prefered_lft,
                          __u32 valid_lft)
 {
@@ -2184,7 +2175,7 @@ static int inet6_addr_add(struct net *net, int ifindex, struct in6_addr *pfx,
        return PTR_ERR(ifp);
 }
-static int inet6_addr_del(struct net *net, int ifindex, struct in6_addr *pfx,
+static int inet6_addr_del(struct net *net, int ifindex, const struct in6_addr *pfx,
                          unsigned int plen)
 {
        struct inet6_ifaddr *ifp;
@@ -2347,7 +2338,7 @@ static void init_loopback(struct net_device *dev)
        add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
 }
-static void addrconf_add_linklocal(struct inet6_dev *idev, struct in6_addr *addr)
+static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr *addr)
 {
        struct inet6_ifaddr * ifp;
        u32 addr_flags = IFA_F_PERMANENT;
@@ -2657,8 +2648,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        struct net *net = dev_net(dev);
        struct inet6_dev *idev;
        struct inet6_ifaddr *ifa;
-        LIST_HEAD(keep_list);
+        int state, i;
-        int state;
        ASSERT_RTNL();
@@ -2684,6 +2674,23 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        }
+        /* Step 2: clear hash table */
+        for (i = 0; i < IN6_ADDR_HSIZE; i++) {
+                struct hlist_head *h = &inet6_addr_lst[i];
+                struct hlist_node *n;
+                spin_lock_bh(&addrconf_hash_lock);
+        restart:
+                hlist_for_each_entry_rcu(ifa, n, h, addr_lst) {
+                        if (ifa->idev == idev) {
+                                hlist_del_init_rcu(&ifa->addr_lst);
+                                addrconf_del_timer(ifa);
+                                goto restart;
+                        }
+                }
+                spin_unlock_bh(&addrconf_hash_lock);
+        }
        write_lock_bh(&idev->lock);
        /* Step 2: clear flags for stateless addrconf */
@@ -2717,61 +2724,24 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                                       struct inet6_ifaddr, if_list);
                addrconf_del_timer(ifa);
-                /* If just doing link down, and address is permanent
+                list_del(&ifa->if_list);
-                   and not link-local, then retain it. */
-                if (!how &&
-                    (ifa->flags&IFA_F_PERMANENT) &&
-                    !(ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
-                        list_move_tail(&ifa->if_list, &keep_list);
-                        /* If not doing DAD on this address, just keep it. */
-                        if ((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
-                            idev->cnf.accept_dad <= 0 ||
-                            (ifa->flags & IFA_F_NODAD))
-                                continue;
-                        /* If it was tentative already, no need to notify */
-                        if (ifa->flags & IFA_F_TENTATIVE)
-                                continue;
-                        /* Flag it for later restoration when link comes up */
+                write_unlock_bh(&idev->lock);
-                        ifa->flags |= IFA_F_TENTATIVE;
-                        ifa->state = INET6_IFADDR_STATE_DAD;
-                        write_unlock_bh(&idev->lock);
-                        in6_ifa_hold(ifa);
-                } else {
-                        list_del(&ifa->if_list);
-                        /* clear hash table */
-                        spin_lock_bh(&addrconf_hash_lock);
-                        hlist_del_init_rcu(&ifa->addr_lst);
-                        spin_unlock_bh(&addrconf_hash_lock);
-                        write_unlock_bh(&idev->lock);
+                spin_lock_bh(&ifa->state_lock);
-                        spin_lock_bh(&ifa->state_lock);
+                state = ifa->state;
-                        state = ifa->state;
+                ifa->state = INET6_IFADDR_STATE_DEAD;
-                        ifa->state = INET6_IFADDR_STATE_DEAD;
+                spin_unlock_bh(&ifa->state_lock);
-                        spin_unlock_bh(&ifa->state_lock);
-                        if (state == INET6_IFADDR_STATE_DEAD)
+                if (state != INET6_IFADDR_STATE_DEAD) {
-                                goto put_ifa;
+                        __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
                }
-                __ipv6_ifa_notify(RTM_DELADDR, ifa);
-                if (ifa->state == INET6_IFADDR_STATE_DEAD)
-                        atomic_notifier_call_chain(&inet6addr_chain,
-                                                   NETDEV_DOWN, ifa);
-put_ifa:
                in6_ifa_put(ifa);
                write_lock_bh(&idev->lock);
        }
-        list_splice(&keep_list, &idev->addr_list);
        write_unlock_bh(&idev->lock);
        /* Step 5: Discard multicast list */
@@ -2964,7 +2934,8 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
           start sending router solicitations.
         */
-        if (ifp->idev->cnf.forwarding == 0 &&
+        if ((ifp->idev->cnf.forwarding == 0 ||
+             ifp->idev->cnf.forwarding == 2) &&
            ifp->idev->cnf.rtr_solicits > 0 &&
            (dev->flags&IFF_LOOPBACK) == 0 &&
            (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)) {
@@ -3138,7 +3109,7 @@ void if6_proc_exit(void)
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 /* Check if address is a home address configured on any interface. */
-int ipv6_chk_home_addr(struct net *net, struct in6_addr *addr)
+int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr)
 {
        int ret = 0;
        struct inet6_ifaddr *ifp = NULL;
@@ -3448,10 +3419,8 @@ static int put_cacheinfo(struct sk_buff *skb, unsigned long cstamp,
 {
        struct ifa_cacheinfo ci;
-        ci.cstamp = (u32)(TIME_DELTA(cstamp, INITIAL_JIFFIES) / HZ * 100
+        ci.cstamp = cstamp_delta(cstamp);
-                        + TIME_DELTA(cstamp, INITIAL_JIFFIES) % HZ * 100 / HZ);
+        ci.tstamp = cstamp_delta(tstamp);
-        ci.tstamp = (u32)(TIME_DELTA(tstamp, INITIAL_JIFFIES) / HZ * 100
-                        + TIME_DELTA(tstamp, INITIAL_JIFFIES) % HZ * 100 / HZ);
        ci.ifa_prefered = preferred;
        ci.ifa_valid = valid;
@@ -3802,8 +3771,10 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
        array[DEVCONF_AUTOCONF] = cnf->autoconf;
        array[DEVCONF_DAD_TRANSMITS] = cnf->dad_transmits;
        array[DEVCONF_RTR_SOLICITS] = cnf->rtr_solicits;
-        array[DEVCONF_RTR_SOLICIT_INTERVAL] = cnf->rtr_solicit_interval;
+        array[DEVCONF_RTR_SOLICIT_INTERVAL] =
-        array[DEVCONF_RTR_SOLICIT_DELAY] = cnf->rtr_solicit_delay;
+                jiffies_to_msecs(cnf->rtr_solicit_interval);
+        array[DEVCONF_RTR_SOLICIT_DELAY] =
+                jiffies_to_msecs(cnf->rtr_solicit_delay);
        array[DEVCONF_FORCE_MLD_VERSION] = cnf->force_mld_version;
 #ifdef CONFIG_IPV6_PRIVACY
        array[DEVCONF_USE_TEMPADDR] = cnf->use_tempaddr;
@@ -3817,7 +3788,8 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
        array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
        array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
-        array[DEVCONF_RTR_PROBE_INTERVAL] = cnf->rtr_probe_interval;
+        array[DEVCONF_RTR_PROBE_INTERVAL] =
+                jiffies_to_msecs(cnf->rtr_probe_interval);
 #ifdef CONFIG_IPV6_ROUTE_INFO
        array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
 #endif
@@ -3835,6 +3807,15 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
        array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
 }
+static inline size_t inet6_ifla6_size(void)
+{
+        return nla_total_size(4) /* IFLA_INET6_FLAGS */
+             + nla_total_size(sizeof(struct ifla_cacheinfo))
+             + nla_total_size(DEVCONF_MAX * 4) /* IFLA_INET6_CONF */
+             + nla_total_size(IPSTATS_MIB_MAX * 8) /* IFLA_INET6_STATS */
+             + nla_total_size(ICMP6_MIB_MAX * 8); /* IFLA_INET6_ICMP6STATS */
+}
 static inline size_t inet6_if_nlmsg_size(void)
 {
        return NLMSG_ALIGN(sizeof(struct ifinfomsg))
@@ -3842,16 +3823,10 @@ static inline size_t inet6_if_nlmsg_size(void)
               + nla_total_size(MAX_ADDR_LEN) /* IFLA_ADDRESS */
               + nla_total_size(4) /* IFLA_MTU */
               + nla_total_size(4) /* IFLA_LINK */
-               + nla_total_size( /* IFLA_PROTINFO */
+               + nla_total_size(inet6_ifla6_size()); /* IFLA_PROTINFO */
-                        nla_total_size(4) /* IFLA_INET6_FLAGS */
-                        + nla_total_size(sizeof(struct ifla_cacheinfo))
-                        + nla_total_size(DEVCONF_MAX * 4) /* IFLA_INET6_CONF */
-                        + nla_total_size(IPSTATS_MIB_MAX * 8) /* IFLA_INET6_STATS */
-                        + nla_total_size(ICMP6_MIB_MAX * 8) /* IFLA_INET6_ICMP6STATS */
-                 );
 }
-static inline void __snmp6_fill_stats(u64 *stats, void __percpu **mib,
+static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
                                      int items, int bytes)
 {
        int i;
@@ -3861,7 +3836,7 @@ static inline void __snmp6_fill_stats(u64 *stats, void __percpu **mib,
        /* Use put_unaligned() because stats may not be aligned for u64. */
        put_unaligned(items, &stats[0]);
        for (i = 1; i < items; i++)
-                put_unaligned(snmp_fold_field(mib, i), &stats[i]);
+                put_unaligned(atomic_long_read(&mib[i]), &stats[i]);
        memset(&stats[items], 0, pad);
 }
@@ -3890,20 +3865,75 @@ static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
                                     IPSTATS_MIB_MAX, bytes, offsetof(struct ipstats_mib, syncp));
                break;
        case IFLA_INET6_ICMP6STATS:
-                __snmp6_fill_stats(stats, (void __percpu **)idev->stats.icmpv6, ICMP6_MIB_MAX, bytes);
+                __snmp6_fill_statsdev(stats, idev->stats.icmpv6dev->mibs, ICMP6_MIB_MAX, bytes);
                break;
        }
 }
+static int inet6_fill_ifla6_attrs(struct sk_buff *skb, struct inet6_dev *idev)
+{
+        struct nlattr *nla;
+        struct ifla_cacheinfo ci;
+        NLA_PUT_U32(skb, IFLA_INET6_FLAGS, idev->if_flags);
+        ci.max_reasm_len = IPV6_MAXPLEN;
+        ci.tstamp = cstamp_delta(idev->tstamp);
+        ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
+        ci.retrans_time = jiffies_to_msecs(idev->nd_parms->retrans_time);
+        NLA_PUT(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci);
+        nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
+        if (nla == NULL)
+                goto nla_put_failure;
+        ipv6_store_devconf(&idev->cnf, nla_data(nla), nla_len(nla));
+        /* XXX - MC not implemented */
+        nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
+        if (nla == NULL)
+                goto nla_put_failure;
+        snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
+        nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
+        if (nla == NULL)
+                goto nla_put_failure;
+        snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
+        return 0;
+nla_put_failure:
+        return -EMSGSIZE;
+}
+static size_t inet6_get_link_af_size(const struct net_device *dev)
+{
+        if (!__in6_dev_get(dev))
+                return 0;
+        return inet6_ifla6_size();
+}
+static int inet6_fill_link_af(struct sk_buff *skb, const struct net_device *dev)
+{
+        struct inet6_dev *idev = __in6_dev_get(dev);
+        if (!idev)
+                return -ENODATA;
+        if (inet6_fill_ifla6_attrs(skb, idev) < 0)
+                return -EMSGSIZE;
+        return 0;
+}
 static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
                             u32 pid, u32 seq, int event, unsigned int flags)
 {
        struct net_device *dev = idev->dev;
-        struct nlattr *nla;
        struct ifinfomsg *hdr;
        struct nlmsghdr *nlh;
        void *protoinfo;
-        struct ifla_cacheinfo ci;
        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*hdr), flags);
        if (nlh == NULL)
@@ -3930,31 +3960,8 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
        if (protoinfo == NULL)
                goto nla_put_failure;
-        NLA_PUT_U32(skb, IFLA_INET6_FLAGS, idev->if_flags);
+        if (inet6_fill_ifla6_attrs(skb, idev) < 0)
-        ci.max_reasm_len = IPV6_MAXPLEN;
-        ci.tstamp = (__u32)(TIME_DELTA(idev->tstamp, INITIAL_JIFFIES) / HZ * 100
-                    + TIME_DELTA(idev->tstamp, INITIAL_JIFFIES) % HZ * 100 / HZ);
-        ci.reachable_time = idev->nd_parms->reachable_time;
-        ci.retrans_time = idev->nd_parms->retrans_time;
-        NLA_PUT(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci);
-        nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
-        if (nla == NULL)
-                goto nla_put_failure;
-        ipv6_store_devconf(&idev->cnf, nla_data(nla), nla_len(nla));
-        /* XXX - MC not implemented */
-        nla = nla_reserve(skb, IFLA_INET6_STATS, IPSTATS_MIB_MAX * sizeof(u64));
-        if (nla == NULL)
-                goto nla_put_failure;
-        snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_STATS, nla_len(nla));
-        nla = nla_reserve(skb, IFLA_INET6_ICMP6STATS, ICMP6_MIB_MAX * sizeof(u64));
-        if (nla == NULL)
                goto nla_put_failure;
-        snmp6_fill_stats(nla_data(nla), idev, IFLA_INET6_ICMP6STATS, nla_len(nla));
        nla_nest_end(skb, protoinfo);
        return nlmsg_end(skb, nlh);
@@ -4021,11 +4028,11 @@ void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
                kfree_skb(skb);
                goto errout;
        }
-        rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
+        rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFINFO, NULL, GFP_ATOMIC);
        return;
 errout:
        if (err < 0)
-                rtnl_set_sk_err(net, RTNLGRP_IPV6_IFADDR, err);
+                rtnl_set_sk_err(net, RTNLGRP_IPV6_IFINFO, err);
 }
 static inline size_t inet6_prefix_nlmsg_size(void)
@@ -4122,8 +4129,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                addrconf_leave_solict(ifp->idev, &ifp->addr);
                dst_hold(&ifp->rt->dst);
-                if (ifp->state == INET6_IFADDR_STATE_DEAD &&
+                if (ip6_del_rt(ifp->rt))
-                    ip6_del_rt(ifp->rt))
                        dst_free(&ifp->rt->dst);
                break;
        }
@@ -4521,7 +4527,7 @@ static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
        t = p->sysctl;
        p->sysctl = NULL;
-        unregister_sysctl_table(t->sysctl_header);
+        unregister_net_sysctl_table(t->sysctl_header);
        kfree(t->dev_name);
        kfree(t);
 }
@@ -4625,6 +4631,12 @@ int unregister_inet6addr_notifier(struct notifier_block *nb)
 }
 EXPORT_SYMBOL(unregister_inet6addr_notifier);
+static struct rtnl_af_ops inet6_ops = {
+        .family           = AF_INET6,
+        .fill_link_af     = inet6_fill_link_af,
+        .get_link_af_size = inet6_get_link_af_size,
+};
 /*
 *      Init / cleanup code
 */
@@ -4676,6 +4688,10 @@ int __init addrconf_init(void)
        addrconf_verify(0);
+        err = rtnl_af_register(&inet6_ops);
+        if (err < 0)
+                goto errout_af;
        err = __rtnl_register(PF_INET6, RTM_GETLINK, NULL, inet6_dump_ifinfo);
        if (err < 0)
                goto errout;
@@ -4691,6 +4707,8 @@ int __init addrconf_init(void)
        return 0;
 errout:
+        rtnl_af_unregister(&inet6_ops);
+errout_af:
        unregister_netdevice_notifier(&ipv6_dev_notf);
 errlo:
        unregister_pernet_subsys(&addrconf_ops);
@@ -4711,6 +4729,8 @@ void addrconf_cleanup(void)
        rtnl_lock();
+        __rtnl_af_unregister(&inet6_ops);
        /* clean dev list */
        for_each_netdev(&init_net, dev) {
                if (__in6_dev_get(dev) == NULL)
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 8175f802651b..c8993e5a337c 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -518,10 +518,9 @@ static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb)
 static inline int ip6addrlbl_msgsize(void)
 {
-        return (NLMSG_ALIGN(sizeof(struct ifaddrlblmsg))
+        return NLMSG_ALIGN(sizeof(struct ifaddrlblmsg))
                + nla_total_size(16)    /* IFAL_ADDRESS */
-                + nla_total_size(4)     /* IFAL_LABEL */
+                + nla_total_size(4);    /* IFAL_LABEL */
-        );
 }
 static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 56b9bf2516f4..3b5669a2582d 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -272,6 +272,10 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        if (addr_len < SIN6_LEN_RFC2133)
                return -EINVAL;
+        if (addr->sin6_family != AF_INET6)
+                return -EAFNOSUPPORT;
        addr_type = ipv6_addr_type(&addr->sin6_addr);
        if ((addr_type & IPV6_ADDR_MULTICAST) && sock->type == SOCK_STREAM)
                return -EINVAL;
@@ -300,7 +304,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                        goto out;
                }
-                /* Reproduce AF_INET checks to make the bindings consitant */
+                /* Reproduce AF_INET checks to make the bindings consistent */
                v4addr = addr->sin6_addr.s6_addr32[3];
                chk_addr_ret = inet_addr_type(net, v4addr);
                if (!sysctl_ip_nonlocal_bind &&
@@ -343,7 +347,8 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                         */
                        v4addr = LOOPBACK4_IPV6;
                        if (!(addr_type & IPV6_ADDR_MULTICAST)) {
-                                if (!ipv6_chk_addr(net, &addr->sin6_addr,
+                                if (!inet->transparent &&
+                                    !ipv6_chk_addr(net, &addr->sin6_addr,
                                                   dev, 0)) {
                                        err = -EADDRNOTAVAIL;
                                        goto out_unlock;
@@ -467,7 +472,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
        if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                sin->sin6_scope_id = sk->sk_bound_dev_if;
        *uaddr_len = sizeof(*sin);
-        return(0);
+        return 0;
 }
 EXPORT_SYMBOL(inet6_getname);
@@ -488,7 +493,7 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
        case SIOCADDRT:
        case SIOCDELRT:
-                return(ipv6_route_ioctl(net, cmd, (void __user *)arg));
+                return ipv6_route_ioctl(net, cmd, (void __user *)arg);
        case SIOCSIFADDR:
                return addrconf_add_ifaddr(net, (void __user *) arg);
@@ -502,7 +507,7 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                return sk->sk_prot->ioctl(sk, cmd, arg);
        }
        /*NOTREACHED*/
-        return(0);
+        return 0;
 }
 EXPORT_SYMBOL(inet6_ioctl);
@@ -643,41 +648,34 @@ EXPORT_SYMBOL(inet6_unregister_protosw);
 int inet6_sk_rebuild_header(struct sock *sk)
 {
-        int err;
-        struct dst_entry *dst;
        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct dst_entry *dst;
        dst = __sk_dst_check(sk, np->dst_cookie);
        if (dst == NULL) {
                struct inet_sock *inet = inet_sk(sk);
                struct in6_addr *final_p, final;
-                struct flowi fl;
+                struct flowi6 fl6;
-                memset(&fl, 0, sizeof(fl));
+                memset(&fl6, 0, sizeof(fl6));
-                fl.proto = sk->sk_protocol;
+                fl6.flowi6_proto = sk->sk_protocol;
-                ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
+                ipv6_addr_copy(&fl6.daddr, &np->daddr);
-                ipv6_addr_copy(&fl.fl6_src, &np->saddr);
+                ipv6_addr_copy(&fl6.saddr, &np->saddr);
-                fl.fl6_flowlabel = np->flow_label;
+                fl6.flowlabel = np->flow_label;
-                fl.oif = sk->sk_bound_dev_if;
+                fl6.flowi6_oif = sk->sk_bound_dev_if;
-                fl.mark = sk->sk_mark;
+                fl6.flowi6_mark = sk->sk_mark;
-                fl.fl_ip_dport = inet->inet_dport;
+                fl6.fl6_dport = inet->inet_dport;
-                fl.fl_ip_sport = inet->inet_sport;
+                fl6.fl6_sport = inet->inet_sport;
-                security_sk_classify_flow(sk, &fl);
+                security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-                final_p = fl6_update_dst(&fl, np->opt, &final);
+                final_p = fl6_update_dst(&fl6, np->opt, &final);
-                err = ip6_dst_lookup(sk, &dst, &fl);
+                dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
-                if (err) {
+                if (IS_ERR(dst)) {
                        sk->sk_route_caps = 0;
-                        return err;
+                        sk->sk_err_soft = -PTR_ERR(dst);
-                }
+                        return PTR_ERR(dst);
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
-                if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0) {
-                        sk->sk_err_soft = -err;
-                        return err;
                }
                __ip6_dst_store(sk, dst, NULL, NULL);
@@ -746,7 +744,7 @@ static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto)
 static int ipv6_gso_send_check(struct sk_buff *skb)
 {
-        struct ipv6hdr *ipv6h;
+        const struct ipv6hdr *ipv6h;
        const struct inet6_protocol *ops;
        int err = -EINVAL;
@@ -771,7 +769,7 @@ out:
        return err;
 }
-static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
+static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, u32 features)
 {
        struct sk_buff *segs = ERR_PTR(-EINVAL);
        struct ipv6hdr *ipv6h;
@@ -809,7 +807,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
        }
        rcu_read_unlock();
-        if (unlikely(IS_ERR(segs)))
+        if (IS_ERR(segs))
                goto out;
        for (skb = segs; skb; skb = skb->next) {
@@ -1119,7 +1117,7 @@ static int __init inet6_init(void)
        /*
         *      ipngwg API draft makes clear that the correct semantics
         *      for TCP and UDP is to consider one TCP and UDP instance
-         *      in a host availiable by both INET and INET6 APIs and
+         *      in a host available by both INET and INET6 APIs and
         *      able to communicate via both network protocols.
         */
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index ee82d4ef26ce..2195ae651923 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -409,7 +409,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
        ah->reserved = 0;
        ah->spi = x->id.spi;
-        ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
+        ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
        sg_init_table(sg, nfrags);
        skb_to_sgvec(skb, sg, 0, skb->len);
@@ -538,14 +538,16 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        if (!pskb_may_pull(skb, ah_hlen))
                goto out;
-        ip6h = ipv6_hdr(skb);
-        skb_push(skb, hdr_len);
        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
                goto out;
        nfrags = err;
+        ah = (struct ip_auth_hdr *)skb->data;
+        ip6h = ipv6_hdr(skb);
+        skb_push(skb, hdr_len);
        work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
        if (!work_iph)
                goto out;
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 0e5e943446f0..674255f5e6b7 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -44,7 +44,7 @@
 #include <net/checksum.h>
-static int ipv6_dev_ac_dec(struct net_device *dev, struct in6_addr *addr);
+static int ipv6_dev_ac_dec(struct net_device *dev, const struct in6_addr *addr);
 /* Big ac list lock for all the sockets */
 static DEFINE_RWLOCK(ipv6_sk_ac_lock);
@@ -54,7 +54,7 @@ static DEFINE_RWLOCK(ipv6_sk_ac_lock);
 *      socket join an anycast group
 */
-int ipv6_sock_ac_join(struct sock *sk, int ifindex, struct in6_addr *addr)
+int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct net_device *dev = NULL;
@@ -145,7 +145,7 @@ error:
 /*
 *      socket leave an anycast group
 */
-int ipv6_sock_ac_drop(struct sock *sk, int ifindex, struct in6_addr *addr)
+int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct net_device *dev;
@@ -252,7 +252,7 @@ static void aca_put(struct ifacaddr6 *ac)
 /*
 *      device anycast group inc (add if not found)
 */
-int ipv6_dev_ac_inc(struct net_device *dev, struct in6_addr *addr)
+int ipv6_dev_ac_inc(struct net_device *dev, const struct in6_addr *addr)
 {
        struct ifacaddr6 *aca;
        struct inet6_dev *idev;
@@ -324,7 +324,7 @@ out:
 /*
 *      device anycast group decrement
 */
-int __ipv6_dev_ac_dec(struct inet6_dev *idev, struct in6_addr *addr)
+int __ipv6_dev_ac_dec(struct inet6_dev *idev, const struct in6_addr *addr)
 {
        struct ifacaddr6 *aca, *prev_aca;
@@ -358,7 +358,7 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, struct in6_addr *addr)
 }
 /* called with rcu_read_lock() */
-static int ipv6_dev_ac_dec(struct net_device *dev, struct in6_addr *addr)
+static int ipv6_dev_ac_dec(struct net_device *dev, const struct in6_addr *addr)
 {
        struct inet6_dev *idev = __in6_dev_get(dev);
@@ -371,7 +371,7 @@ static int ipv6_dev_ac_dec(struct net_device *dev, struct in6_addr *addr)
 *      check if the interface has this anycast address
 *      called with rcu_read_lock()
 */
-static int ipv6_chk_acast_dev(struct net_device *dev, struct in6_addr *addr)
+static int ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *addr)
 {
        struct inet6_dev *idev;
        struct ifacaddr6 *aca;
@@ -392,7 +392,7 @@ static int ipv6_chk_acast_dev(struct net_device *dev, struct in6_addr *addr)
 *      check if given interface (or any, if dev==0) has this anycast address
 */
 int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
-                        struct in6_addr *addr)
+                        const struct in6_addr *addr)
 {
        int found = 0;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index ef371aa01ac5..16560336eb72 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -40,7 +40,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        struct ipv6_pinfo       *np = inet6_sk(sk);
        struct in6_addr         *daddr, *final_p, final;
        struct dst_entry        *dst;
-        struct flowi            fl;
+        struct flowi6           fl6;
        struct ip6_flowlabel    *flowlabel = NULL;
        struct ipv6_txoptions   *opt;
        int                     addr_type;
@@ -59,11 +59,11 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        if (usin->sin6_family != AF_INET6)
                return -EAFNOSUPPORT;
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
        if (np->sndflow) {
-                fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
+                fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
-                if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
+                if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
-                        flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
+                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (flowlabel == NULL)
                                return -EINVAL;
                        ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
@@ -137,7 +137,7 @@ ipv4_connected:
        }
        ipv6_addr_copy(&np->daddr, daddr);
-        np->flow_label = fl.fl6_flowlabel;
+        np->flow_label = fl6.flowlabel;
        inet->inet_dport = usin->sin6_port;
@@ -146,53 +146,46 @@ ipv4_connected:
         *      destination cache for it.
         */
-        fl.proto = sk->sk_protocol;
+        fl6.flowi6_proto = sk->sk_protocol;
-        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
+        ipv6_addr_copy(&fl6.daddr, &np->daddr);
-        ipv6_addr_copy(&fl.fl6_src, &np->saddr);
+        ipv6_addr_copy(&fl6.saddr, &np->saddr);
-        fl.oif = sk->sk_bound_dev_if;
+        fl6.flowi6_oif = sk->sk_bound_dev_if;
-        fl.mark = sk->sk_mark;
+        fl6.flowi6_mark = sk->sk_mark;
-        fl.fl_ip_dport = inet->inet_dport;
+        fl6.fl6_dport = inet->inet_dport;
-        fl.fl_ip_sport = inet->inet_sport;
+        fl6.fl6_sport = inet->inet_sport;
-        if (!fl.oif && (addr_type&IPV6_ADDR_MULTICAST))
+        if (!fl6.flowi6_oif && (addr_type&IPV6_ADDR_MULTICAST))
-                fl.oif = np->mcast_oif;
+                fl6.flowi6_oif = np->mcast_oif;
-        security_sk_classify_flow(sk, &fl);
+        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
        opt = flowlabel ? flowlabel->opt : np->opt;
-        final_p = fl6_update_dst(&fl, opt, &final);
+        final_p = fl6_update_dst(&fl6, opt, &final);
-        err = ip6_dst_lookup(sk, &dst, &fl);
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
-        if (err)
+        err = 0;
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
                goto out;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
-        if (err < 0) {
-                if (err == -EREMOTE)
-                        err = ip6_dst_blackhole(sk, &dst, &fl);
-                if (err < 0)
-                        goto out;
        }
        /* source address lookup done in ip6_dst_lookup */
        if (ipv6_addr_any(&np->saddr))
-                ipv6_addr_copy(&np->saddr, &fl.fl6_src);
+                ipv6_addr_copy(&np->saddr, &fl6.saddr);
        if (ipv6_addr_any(&np->rcv_saddr)) {
-                ipv6_addr_copy(&np->rcv_saddr, &fl.fl6_src);
+                ipv6_addr_copy(&np->rcv_saddr, &fl6.saddr);
                inet->inet_rcv_saddr = LOOPBACK4_IPV6;
                if (sk->sk_prot->rehash)
                        sk->sk_prot->rehash(sk);
        }
        ip6_dst_store(sk, dst,
-                      ipv6_addr_equal(&fl.fl6_dst, &np->daddr) ?
+                      ipv6_addr_equal(&fl6.daddr, &np->daddr) ?
                      &np->daddr : NULL,
 #ifdef CONFIG_IPV6_SUBTREES
-                      ipv6_addr_equal(&fl.fl6_src, &np->saddr) ?
+                      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
                      &np->saddr :
 #endif
                      NULL);
@@ -238,7 +231,7 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
                kfree_skb(skb);
 }
-void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
+void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct sock_exterr_skb *serr;
@@ -257,7 +250,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
        skb_put(skb, sizeof(struct ipv6hdr));
        skb_reset_network_header(skb);
        iph = ipv6_hdr(skb);
-        ipv6_addr_copy(&iph->daddr, &fl->fl6_dst);
+        ipv6_addr_copy(&iph->daddr, &fl6->daddr);
        serr = SKB_EXT_ERR(skb);
        serr->ee.ee_errno = err;
@@ -268,7 +261,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
        serr->ee.ee_info = info;
        serr->ee.ee_data = 0;
        serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
-        serr->port = fl->fl_ip_dport;
+        serr->port = fl6->fl6_dport;
        __skb_pull(skb, skb_tail_pointer(skb) - skb->data);
        skb_reset_transport_header(skb);
@@ -277,7 +270,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
                kfree_skb(skb);
 }
-void ipv6_local_rxpmtu(struct sock *sk, struct flowi *fl, u32 mtu)
+void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct ipv6hdr *iph;
@@ -294,7 +287,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi *fl, u32 mtu)
        skb_put(skb, sizeof(struct ipv6hdr));
        skb_reset_network_header(skb);
        iph = ipv6_hdr(skb);
-        ipv6_addr_copy(&iph->daddr, &fl->fl6_dst);
+        ipv6_addr_copy(&iph->daddr, &fl6->daddr);
        mtu_info = IP6CBMTU(skb);
        if (!mtu_info) {
@@ -306,7 +299,7 @@ void ipv6_local_rxpmtu(struct sock *sk, struct flowi *fl, u32 mtu)
        mtu_info->ip6m_addr.sin6_family = AF_INET6;
        mtu_info->ip6m_addr.sin6_port = 0;
        mtu_info->ip6m_addr.sin6_flowinfo = 0;
-        mtu_info->ip6m_addr.sin6_scope_id = fl->oif;
+        mtu_info->ip6m_addr.sin6_scope_id = fl6->flowi6_oif;
        ipv6_addr_copy(&mtu_info->ip6m_addr.sin6_addr, &ipv6_hdr(skb)->daddr);
        __skb_pull(skb, skb_tail_pointer(skb) - skb->data);
@@ -577,11 +570,30 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
                u8 *ptr = nh + opt->dst1;
                put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr);
        }
+        if (np->rxopt.bits.rxorigdstaddr) {
+                struct sockaddr_in6 sin6;
+                u16 *ports = (u16 *) skb_transport_header(skb);
+                if (skb_transport_offset(skb) + 4 <= skb->len) {
+                        /* All current transport protocols have the port numbers in the
+                         * first four bytes of the transport header and this function is
+                         * written with this assumption in mind.
+                         */
+                        sin6.sin6_family = AF_INET6;
+                        ipv6_addr_copy(&sin6.sin6_addr, &ipv6_hdr(skb)->daddr);
+                        sin6.sin6_port = ports[1];
+                        sin6.sin6_flowinfo = 0;
+                        sin6.sin6_scope_id = 0;
+                        put_cmsg(msg, SOL_IPV6, IPV6_ORIGDSTADDR, sizeof(sin6), &sin6);
+                }
+        }
        return 0;
 }
 int datagram_send_ctl(struct net *net,
-                      struct msghdr *msg, struct flowi *fl,
+                      struct msghdr *msg, struct flowi6 *fl6,
                      struct ipv6_txoptions *opt,
                      int *hlimit, int *tclass, int *dontfrag)
 {
@@ -617,16 +629,17 @@ int datagram_send_ctl(struct net *net,
                        src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg);
                        if (src_info->ipi6_ifindex) {
-                                if (fl->oif && src_info->ipi6_ifindex != fl->oif)
+                                if (fl6->flowi6_oif &&
+                                    src_info->ipi6_ifindex != fl6->flowi6_oif)
                                        return -EINVAL;
-                                fl->oif = src_info->ipi6_ifindex;
+                                fl6->flowi6_oif = src_info->ipi6_ifindex;
                        }
                        addr_type = __ipv6_addr_type(&src_info->ipi6_addr);
                        rcu_read_lock();
-                        if (fl->oif) {
+                        if (fl6->flowi6_oif) {
-                                dev = dev_get_by_index_rcu(net, fl->oif);
+                                dev = dev_get_by_index_rcu(net, fl6->flowi6_oif);
                                if (!dev) {
                                        rcu_read_unlock();
                                        return -ENODEV;
@@ -642,7 +655,7 @@ int datagram_send_ctl(struct net *net,
                                                   strict ? dev : NULL, 0))
                                        err = -EINVAL;
                                else
-                                        ipv6_addr_copy(&fl->fl6_src, &src_info->ipi6_addr);
+                                        ipv6_addr_copy(&fl6->saddr, &src_info->ipi6_addr);
                        }
                        rcu_read_unlock();
@@ -659,13 +672,13 @@ int datagram_send_ctl(struct net *net,
                                goto exit_f;
                        }
-                        if (fl->fl6_flowlabel&IPV6_FLOWINFO_MASK) {
+                        if (fl6->flowlabel&IPV6_FLOWINFO_MASK) {
-                                if ((fl->fl6_flowlabel^*(__be32 *)CMSG_DATA(cmsg))&~IPV6_FLOWINFO_MASK) {
+                                if ((fl6->flowlabel^*(__be32 *)CMSG_DATA(cmsg))&~IPV6_FLOWINFO_MASK) {
                                        err = -EINVAL;
                                        goto exit_f;
                                }
                        }
-                        fl->fl6_flowlabel = IPV6_FLOWINFO_MASK & *(__be32 *)CMSG_DATA(cmsg);
+                        fl6->flowlabel = IPV6_FLOWINFO_MASK & *(__be32 *)CMSG_DATA(cmsg);
                        break;
                case IPV6_2292HOPOPTS:
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index ee9b93bdd6a2..1ac7938dd9ec 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -49,19 +49,25 @@ struct esp_skb_cb {
 #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0]))
+static u32 esp6_get_mtu(struct xfrm_state *x, int mtu);
 /*
 * Allocate an AEAD request structure with extra space for SG and IV.
 *
- * For alignment considerations the IV is placed at the front, followed
+ * For alignment considerations the upper 32 bits of the sequence number are
- * by the request and finally the SG list.
+ * placed at the front, if present. Followed by the IV, the request and finally
+ * the SG list.
 *
 * TODO: Use spare space in skb for this where possible.
 */
-static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags)
+static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqihlen)
 {
        unsigned int len;
-        len = crypto_aead_ivsize(aead);
+        len = seqihlen;
+        len += crypto_aead_ivsize(aead);
        if (len) {
                len += crypto_aead_alignmask(aead) &
                       ~(crypto_tfm_ctx_alignment() - 1);
@@ -76,10 +82,16 @@ static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags)
        return kmalloc(len, GFP_ATOMIC);
 }
-static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp)
+static inline __be32 *esp_tmp_seqhi(void *tmp)
+{
+        return PTR_ALIGN((__be32 *)tmp, __alignof__(__be32));
+}
+static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int seqhilen)
 {
        return crypto_aead_ivsize(aead) ?
-               PTR_ALIGN((u8 *)tmp, crypto_aead_alignmask(aead) + 1) : tmp;
+               PTR_ALIGN((u8 *)tmp + seqhilen,
+                         crypto_aead_alignmask(aead) + 1) : tmp + seqhilen;
 }
 static inline struct aead_givcrypt_request *esp_tmp_givreq(
@@ -140,47 +152,76 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
        int blksize;
        int clen;
        int alen;
+        int plen;
+        int tfclen;
        int nfrags;
+        int assoclen;
+        int sglists;
+        int seqhilen;
        u8 *iv;
        u8 *tail;
+        __be32 *seqhi;
        struct esp_data *esp = x->data;
        /* skb is pure payload to encrypt */
        err = -ENOMEM;
-        /* Round to block size */
-        clen = skb->len;
        aead = esp->aead;
        alen = crypto_aead_authsize(aead);
+        tfclen = 0;
+        if (x->tfcpad) {
+                struct xfrm_dst *dst = (struct xfrm_dst *)skb_dst(skb);
+                u32 padto;
+                padto = min(x->tfcpad, esp6_get_mtu(x, dst->child_mtu_cached));
+                if (skb->len < padto)
+                        tfclen = padto - skb->len;
+        }
        blksize = ALIGN(crypto_aead_blocksize(aead), 4);
-        clen = ALIGN(clen + 2, blksize);
+        clen = ALIGN(skb->len + 2 + tfclen, blksize);
        if (esp->padlen)
                clen = ALIGN(clen, esp->padlen);
+        plen = clen - skb->len - tfclen;
-        if ((err = skb_cow_data(skb, clen - skb->len + alen, &trailer)) < 0)
+        err = skb_cow_data(skb, tfclen + plen + alen, &trailer);
+        if (err < 0)
                goto error;
        nfrags = err;
-        tmp = esp_alloc_tmp(aead, nfrags + 1);
+        assoclen = sizeof(*esph);
+        sglists = 1;
+        seqhilen = 0;
+        if (x->props.flags & XFRM_STATE_ESN) {
+                sglists += 2;
+                seqhilen += sizeof(__be32);
+                assoclen += seqhilen;
+        }
+        tmp = esp_alloc_tmp(aead, nfrags + sglists, seqhilen);
        if (!tmp)
                goto error;
-        iv = esp_tmp_iv(aead, tmp);
+        seqhi = esp_tmp_seqhi(tmp);
+        iv = esp_tmp_iv(aead, tmp, seqhilen);
        req = esp_tmp_givreq(aead, iv);
        asg = esp_givreq_sg(aead, req);
-        sg = asg + 1;
+        sg = asg + sglists;
        /* Fill padding... */
        tail = skb_tail_pointer(trailer);
+        if (tfclen) {
+                memset(tail, 0, tfclen);
+                tail += tfclen;
+        }
        do {
                int i;
-                for (i=0; i<clen-skb->len - 2; i++)
+                for (i = 0; i < plen - 2; i++)
                        tail[i] = i + 1;
        } while (0);
-        tail[clen-skb->len - 2] = (clen - skb->len) - 2;
+        tail[plen - 2] = plen - 2;
-        tail[clen - skb->len - 1] = *skb_mac_header(skb);
+        tail[plen - 1] = *skb_mac_header(skb);
        pskb_put(skb, trailer, clen - skb->len + alen);
        skb_push(skb, -skb_network_offset(skb));
@@ -188,19 +229,27 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
        *skb_mac_header(skb) = IPPROTO_ESP;
        esph->spi = x->id.spi;
-        esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
+        esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
        sg_init_table(sg, nfrags);
        skb_to_sgvec(skb, sg,
                     esph->enc_data + crypto_aead_ivsize(aead) - skb->data,
                     clen + alen);
-        sg_init_one(asg, esph, sizeof(*esph));
+        if ((x->props.flags & XFRM_STATE_ESN)) {
+                sg_init_table(asg, 3);
+                sg_set_buf(asg, &esph->spi, sizeof(__be32));
+                *seqhi = htonl(XFRM_SKB_CB(skb)->seq.output.hi);
+                sg_set_buf(asg + 1, seqhi, seqhilen);
+                sg_set_buf(asg + 2, &esph->seq_no, sizeof(__be32));
+        } else
+                sg_init_one(asg, esph, sizeof(*esph));
        aead_givcrypt_set_callback(req, 0, esp_output_done, skb);
        aead_givcrypt_set_crypt(req, sg, sg, clen, iv);
-        aead_givcrypt_set_assoc(req, asg, sizeof(*esph));
+        aead_givcrypt_set_assoc(req, asg, assoclen);
        aead_givcrypt_set_giv(req, esph->enc_data,
-                              XFRM_SKB_CB(skb)->seq.output);
+                              XFRM_SKB_CB(skb)->seq.output.low);
        ESP_SKB_CB(skb)->tmp = tmp;
        err = crypto_aead_givencrypt(req);
@@ -276,8 +325,12 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
        struct sk_buff *trailer;
        int elen = skb->len - sizeof(*esph) - crypto_aead_ivsize(aead);
        int nfrags;
+        int assoclen;
+        int sglists;
+        int seqhilen;
        int ret = 0;
        void *tmp;
+        __be32 *seqhi;
        u8 *iv;
        struct scatterlist *sg;
        struct scatterlist *asg;
@@ -298,15 +351,27 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
        }
        ret = -ENOMEM;
-        tmp = esp_alloc_tmp(aead, nfrags + 1);
+        assoclen = sizeof(*esph);
+        sglists = 1;
+        seqhilen = 0;
+        if (x->props.flags & XFRM_STATE_ESN) {
+                sglists += 2;
+                seqhilen += sizeof(__be32);
+                assoclen += seqhilen;
+        }
+        tmp = esp_alloc_tmp(aead, nfrags + sglists, seqhilen);
        if (!tmp)
                goto out;
        ESP_SKB_CB(skb)->tmp = tmp;
-        iv = esp_tmp_iv(aead, tmp);
+        seqhi = esp_tmp_seqhi(tmp);
+        iv = esp_tmp_iv(aead, tmp, seqhilen);
        req = esp_tmp_req(aead, iv);
        asg = esp_req_sg(aead, req);
-        sg = asg + 1;
+        sg = asg + sglists;
        skb->ip_summed = CHECKSUM_NONE;
@@ -317,11 +382,19 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
        sg_init_table(sg, nfrags);
        skb_to_sgvec(skb, sg, sizeof(*esph) + crypto_aead_ivsize(aead), elen);
-        sg_init_one(asg, esph, sizeof(*esph));
+        if ((x->props.flags & XFRM_STATE_ESN)) {
+                sg_init_table(asg, 3);
+                sg_set_buf(asg, &esph->spi, sizeof(__be32));
+                *seqhi = XFRM_SKB_CB(skb)->seq.input.hi;
+                sg_set_buf(asg + 1, seqhi, seqhilen);
+                sg_set_buf(asg + 2, &esph->seq_no, sizeof(__be32));
+        } else
+                sg_init_one(asg, esph, sizeof(*esph));
        aead_request_set_callback(req, 0, esp_input_done, skb);
        aead_request_set_crypt(req, sg, sg, elen, iv);
-        aead_request_set_assoc(req, asg, sizeof(*esph));
+        aead_request_set_assoc(req, asg, assoclen);
        ret = crypto_aead_decrypt(req);
        if (ret == -EINPROGRESS)
@@ -357,7 +430,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                     u8 type, u8 code, int offset, __be32 info)
 {
        struct net *net = dev_net(skb->dev);
-        struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
+        const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data;
        struct ip_esp_hdr *esph = (struct ip_esp_hdr *)(skb->data + offset);
        struct xfrm_state *x;
@@ -365,7 +438,8 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
            type != ICMPV6_PKT_TOOBIG)
                return;
-        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
+        x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+                              esph->spi, IPPROTO_ESP, AF_INET6);
        if (!x)
                return;
        printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%pI6\n",
@@ -427,10 +501,20 @@ static int esp_init_authenc(struct xfrm_state *x)
                goto error;
        err = -ENAMETOOLONG;
-        if (snprintf(authenc_name, CRYPTO_MAX_ALG_NAME, "authenc(%s,%s)",
-                     x->aalg ? x->aalg->alg_name : "digest_null",
+        if ((x->props.flags & XFRM_STATE_ESN)) {
-                     x->ealg->alg_name) >= CRYPTO_MAX_ALG_NAME)
+                if (snprintf(authenc_name, CRYPTO_MAX_ALG_NAME,
-                goto error;
+                             "authencesn(%s,%s)",
+                             x->aalg ? x->aalg->alg_name : "digest_null",
+                             x->ealg->alg_name) >= CRYPTO_MAX_ALG_NAME)
+                        goto error;
+        } else {
+                if (snprintf(authenc_name, CRYPTO_MAX_ALG_NAME,
+                             "authenc(%s,%s)",
+                             x->aalg ? x->aalg->alg_name : "digest_null",
+                             x->ealg->alg_name) >= CRYPTO_MAX_ALG_NAME)
+                        goto error;
+        }
        aead = crypto_alloc_aead(authenc_name, 0, 0);
        err = PTR_ERR(aead);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 262f105d23b9..79a485e8a700 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -876,22 +876,22 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
 * fl6_update_dst - update flowi destination address with info given
 *                  by srcrt option, if any.
 *
- * @fl: flowi for which fl6_dst is to be updated
+ * @fl6: flowi6 for which daddr is to be updated
 * @opt: struct ipv6_txoptions in which to look for srcrt opt
- * @orig: copy of original fl6_dst address if modified
+ * @orig: copy of original daddr address if modified
 *
 * Returns NULL if no txoptions or no srcrt, otherwise returns orig
- * and initial value of fl->fl6_dst set in orig
+ * and initial value of fl6->daddr set in orig
 */
-struct in6_addr *fl6_update_dst(struct flowi *fl,
+struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
                                const struct ipv6_txoptions *opt,
                                struct in6_addr *orig)
 {
        if (!opt || !opt->srcrt)
                return NULL;
-        ipv6_addr_copy(orig, &fl->fl6_dst);
+        ipv6_addr_copy(orig, &fl6->daddr);
-        ipv6_addr_copy(&fl->fl6_dst, ((struct rt0_hdr *)opt->srcrt)->addr);
+        ipv6_addr_copy(&fl6->daddr, ((struct rt0_hdr *)opt->srcrt)->addr);
        return orig;
 }
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index e1caa5d526c2..14ed0a955b56 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -13,12 +13,12 @@ int ipv6_ext_hdr(u8 nexthdr)
        /*
         * find out if nexthdr is an extension header or a protocol
         */
-        return ( (nexthdr == NEXTHDR_HOP)       ||
+        return   (nexthdr == NEXTHDR_HOP)       ||
                 (nexthdr == NEXTHDR_ROUTING)   ||
                 (nexthdr == NEXTHDR_FRAGMENT)  ||
                 (nexthdr == NEXTHDR_AUTH)      ||
                 (nexthdr == NEXTHDR_NONE)      ||
-                 (nexthdr == NEXTHDR_DEST) );
+                 (nexthdr == NEXTHDR_DEST);
 }
 /*
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index b1108ede18e1..34d244df907d 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -29,16 +29,16 @@ struct fib6_rule
        u8                      tclass;
 };
-struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi *fl,
+struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
                                   int flags, pol_lookup_t lookup)
 {
        struct fib_lookup_arg arg = {
                .lookup_ptr = lookup,
+                .flags = FIB_LOOKUP_NOREF,
        };
-        fib_rules_lookup(net->ipv6.fib6_rules_ops, fl, flags, &arg);
+        fib_rules_lookup(net->ipv6.fib6_rules_ops,
-        if (arg.rule)
+                         flowi6_to_flowi(fl6), flags, &arg);
-                fib_rule_put(arg.rule);
        if (arg.result)
                return arg.result;
@@ -50,6 +50,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi *fl,
 static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                            int flags, struct fib_lookup_arg *arg)
 {
+        struct flowi6 *flp6 = &flp->u.ip6;
        struct rt6_info *rt = NULL;
        struct fib6_table *table;
        struct net *net = rule->fr_net;
@@ -72,7 +73,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
        table = fib6_get_table(net, rule->table);
        if (table)
-                rt = lookup(net, table, flp, flags);
+                rt = lookup(net, table, flp6, flags);
        if (rt != net->ipv6.ip6_null_entry) {
                struct fib6_rule *r = (struct fib6_rule *)rule;
@@ -87,14 +88,14 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                        if (ipv6_dev_get_saddr(net,
                                               ip6_dst_idev(&rt->dst)->dev,
-                                               &flp->fl6_dst,
+                                               &flp6->daddr,
                                               rt6_flags2srcprefs(flags),
                                               &saddr))
                                goto again;
                        if (!ipv6_prefix_equal(&saddr, &r->src.addr,
                                               r->src.plen))
                                goto again;
-                        ipv6_addr_copy(&flp->fl6_src, &saddr);
+                        ipv6_addr_copy(&flp6->saddr, &saddr);
                }
                goto out;
        }
@@ -114,9 +115,10 @@ out:
 static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 {
        struct fib6_rule *r = (struct fib6_rule *) rule;
+        struct flowi6 *fl6 = &fl->u.ip6;
        if (r->dst.plen &&
-            !ipv6_prefix_equal(&fl->fl6_dst, &r->dst.addr, r->dst.plen))
+            !ipv6_prefix_equal(&fl6->daddr, &r->dst.addr, r->dst.plen))
                return 0;
        /*
@@ -126,14 +128,14 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
         */
        if (r->src.plen) {
                if (flags & RT6_LOOKUP_F_HAS_SADDR) {
-                        if (!ipv6_prefix_equal(&fl->fl6_src, &r->src.addr,
+                        if (!ipv6_prefix_equal(&fl6->saddr, &r->src.addr,
                                               r->src.plen))
                                return 0;
                } else if (!(r->common.flags & FIB_RULE_FIND_SADDR))
                        return 0;
        }
-        if (r->tclass && r->tclass != ((ntohl(fl->fl6_flowlabel) >> 20) & 0xff))
+        if (r->tclass && r->tclass != ((ntohl(fl6->flowlabel) >> 20) & 0xff))
                return 0;
        return 1;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 03e62f94ff8e..11900417b1cc 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -157,32 +157,32 @@ static int is_ineligible(struct sk_buff *skb)
 /*
 * Check the ICMP output rate limit
 */
-static inline int icmpv6_xrlim_allow(struct sock *sk, u8 type,
+static inline bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
-                                     struct flowi *fl)
+                                      struct flowi6 *fl6)
 {
        struct dst_entry *dst;
        struct net *net = sock_net(sk);
-        int res = 0;
+        bool res = false;
        /* Informational messages are not limited. */
        if (type & ICMPV6_INFOMSG_MASK)
-                return 1;
+                return true;
        /* Do not limit pmtu discovery, it would break it. */
        if (type == ICMPV6_PKT_TOOBIG)
-                return 1;
+                return true;
        /*
         * Look up the output route.
         * XXX: perhaps the expire for routing entries cloned by
         * this lookup should be more aggressive (not longer than timeout).
         */
-        dst = ip6_route_output(net, sk, fl);
+        dst = ip6_route_output(net, sk, fl6);
        if (dst->error) {
                IP6_INC_STATS(net, ip6_dst_idev(dst),
                              IPSTATS_MIB_OUTNOROUTES);
        } else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
-                res = 1;
+                res = true;
        } else {
                struct rt6_info *rt = (struct rt6_info *)dst;
                int tmo = net->ipv6.sysctl.icmpv6_time;
@@ -191,7 +191,9 @@ static inline int icmpv6_xrlim_allow(struct sock *sk, u8 type,
                if (rt->rt6i_dst.plen < 128)
                        tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
-                res = xrlim_allow(dst, tmo);
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
+                res = inet_peer_xrlim_allow(rt->rt6i_peer, tmo);
        }
        dst_release(dst);
        return res;
@@ -215,7 +217,7 @@ static __inline__ int opt_unrec(struct sk_buff *skb, __u32 offset)
        return (*op & 0xC0) == 0x80;
 }
-static int icmpv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct icmp6hdr *thdr, int len)
+static int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6, struct icmp6hdr *thdr, int len)
 {
        struct sk_buff *skb;
        struct icmp6hdr *icmp6h;
@@ -231,9 +233,9 @@ static int icmpv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct
        if (skb_queue_len(&sk->sk_write_queue) == 1) {
                skb->csum = csum_partial(icmp6h,
                                        sizeof(struct icmp6hdr), skb->csum);
-                icmp6h->icmp6_cksum = csum_ipv6_magic(&fl->fl6_src,
+                icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
-                                                      &fl->fl6_dst,
+                                                      &fl6->daddr,
-                                                      len, fl->proto,
+                                                      len, fl6->flowi6_proto,
                                                      skb->csum);
        } else {
                __wsum tmp_csum = 0;
@@ -244,9 +246,9 @@ static int icmpv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct
                tmp_csum = csum_partial(icmp6h,
                                        sizeof(struct icmp6hdr), tmp_csum);
-                icmp6h->icmp6_cksum = csum_ipv6_magic(&fl->fl6_src,
+                icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
-                                                      &fl->fl6_dst,
+                                                      &fl6->daddr,
-                                                      len, fl->proto,
+                                                      len, fl6->flowi6_proto,
                                                      tmp_csum);
        }
        ip6_push_pending_frames(sk);
@@ -298,6 +300,68 @@ static void mip6_addr_swap(struct sk_buff *skb)
 static inline void mip6_addr_swap(struct sk_buff *skb) {}
 #endif
+static struct dst_entry *icmpv6_route_lookup(struct net *net, struct sk_buff *skb,
+                                             struct sock *sk, struct flowi6 *fl6)
+{
+        struct dst_entry *dst, *dst2;
+        struct flowi6 fl2;
+        int err;
+        err = ip6_dst_lookup(sk, &dst, fl6);
+        if (err)
+                return ERR_PTR(err);
+        /*
+         * We won't send icmp if the destination is known
+         * anycast.
+         */
+        if (((struct rt6_info *)dst)->rt6i_flags & RTF_ANYCAST) {
+                LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: acast source\n");
+                dst_release(dst);
+                return ERR_PTR(-EINVAL);
+        }
+        /* No need to clone since we're just using its address. */
+        dst2 = dst;
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
+        if (!IS_ERR(dst)) {
+                if (dst != dst2)
+                        return dst;
+        } else {
+                if (PTR_ERR(dst) == -EPERM)
+                        dst = NULL;
+                else
+                        return dst;
+        }
+        err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
+        if (err)
+                goto relookup_failed;
+        err = ip6_dst_lookup(sk, &dst2, &fl2);
+        if (err)
+                goto relookup_failed;
+        dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
+        if (!IS_ERR(dst2)) {
+                dst_release(dst);
+                dst = dst2;
+        } else {
+                err = PTR_ERR(dst2);
+                if (err == -EPERM) {
+                        dst_release(dst);
+                        return dst2;
+                } else
+                        goto relookup_failed;
+        }
+relookup_failed:
+        if (dst)
+                return dst;
+        return ERR_PTR(err);
+}
 /*
 *      Send an ICMP message in response to a packet in error
 */
@@ -308,12 +372,10 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
        struct ipv6hdr *hdr = ipv6_hdr(skb);
        struct sock *sk;
        struct ipv6_pinfo *np;
-        struct in6_addr *saddr = NULL;
+        const struct in6_addr *saddr = NULL;
        struct dst_entry *dst;
-        struct dst_entry *dst2;
        struct icmp6hdr tmp_hdr;
-        struct flowi fl;
+        struct flowi6 fl6;
-        struct flowi fl2;
        struct icmpv6_msg msg;
        int iif = 0;
        int addr_type = 0;
@@ -380,22 +442,22 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
        mip6_addr_swap(skb);
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
-        fl.proto = IPPROTO_ICMPV6;
+        fl6.flowi6_proto = IPPROTO_ICMPV6;
-        ipv6_addr_copy(&fl.fl6_dst, &hdr->saddr);
+        ipv6_addr_copy(&fl6.daddr, &hdr->saddr);
        if (saddr)
-                ipv6_addr_copy(&fl.fl6_src, saddr);
+                ipv6_addr_copy(&fl6.saddr, saddr);
-        fl.oif = iif;
+        fl6.flowi6_oif = iif;
-        fl.fl_icmp_type = type;
+        fl6.fl6_icmp_type = type;
-        fl.fl_icmp_code = code;
+        fl6.fl6_icmp_code = code;
-        security_skb_classify_flow(skb, &fl);
+        security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
        sk = icmpv6_xmit_lock(net);
        if (sk == NULL)
                return;
        np = inet6_sk(sk);
-        if (!icmpv6_xrlim_allow(sk, type, &fl))
+        if (!icmpv6_xrlim_allow(sk, type, &fl6))
                goto out;
        tmp_hdr.icmp6_type = type;
@@ -403,61 +465,14 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
        tmp_hdr.icmp6_cksum = 0;
        tmp_hdr.icmp6_pointer = htonl(info);
-        if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
+        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
-                fl.oif = np->mcast_oif;
+                fl6.flowi6_oif = np->mcast_oif;
-        err = ip6_dst_lookup(sk, &dst, &fl);
+        dst = icmpv6_route_lookup(net, skb, sk, &fl6);
-        if (err)
+        if (IS_ERR(dst))
                goto out;
-        /*
+        if (ipv6_addr_is_multicast(&fl6.daddr))
-         * We won't send icmp if the destination is known
-         * anycast.
-         */
-        if (((struct rt6_info *)dst)->rt6i_flags & RTF_ANYCAST) {
-                LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: acast source\n");
-                goto out_dst_release;
-        }
-        /* No need to clone since we're just using its address. */
-        dst2 = dst;
-        err = xfrm_lookup(net, &dst, &fl, sk, 0);
-        switch (err) {
-        case 0:
-                if (dst != dst2)
-                        goto route_done;
-                break;
-        case -EPERM:
-                dst = NULL;
-                break;
-        default:
-                goto out;
-        }
-        if (xfrm_decode_session_reverse(skb, &fl2, AF_INET6))
-                goto relookup_failed;
-        if (ip6_dst_lookup(sk, &dst2, &fl2))
-                goto relookup_failed;
-        err = xfrm_lookup(net, &dst2, &fl2, sk, XFRM_LOOKUP_ICMP);
-        switch (err) {
-        case 0:
-                dst_release(dst);
-                dst = dst2;
-                break;
-        case -EPERM:
-                goto out_dst_release;
-        default:
-relookup_failed:
-                if (!dst)
-                        goto out;
-                break;
-        }
-route_done:
-        if (ipv6_addr_is_multicast(&fl.fl6_dst))
                hlimit = np->mcast_hops;
        else
                hlimit = np->hop_limit;
@@ -480,14 +495,14 @@ route_done:
        err = ip6_append_data(sk, icmpv6_getfrag, &msg,
                              len + sizeof(struct icmp6hdr),
                              sizeof(struct icmp6hdr), hlimit,
-                              np->tclass, NULL, &fl, (struct rt6_info*)dst,
+                              np->tclass, NULL, &fl6, (struct rt6_info*)dst,
                              MSG_DONTWAIT, np->dontfrag);
        if (err) {
                ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
                ip6_flush_pending_frames(sk);
                goto out_put;
        }
-        err = icmpv6_push_pending_frames(sk, &fl, &tmp_hdr, len + sizeof(struct icmp6hdr));
+        err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, len + sizeof(struct icmp6hdr));
 out_put:
        if (likely(idev != NULL))
@@ -506,10 +521,10 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
        struct sock *sk;
        struct inet6_dev *idev;
        struct ipv6_pinfo *np;
-        struct in6_addr *saddr = NULL;
+        const struct in6_addr *saddr = NULL;
        struct icmp6hdr *icmph = icmp6_hdr(skb);
        struct icmp6hdr tmp_hdr;
-        struct flowi fl;
+        struct flowi6 fl6;
        struct icmpv6_msg msg;
        struct dst_entry *dst;
        int err = 0;
@@ -523,30 +538,31 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
        memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
        tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
-        fl.proto = IPPROTO_ICMPV6;
+        fl6.flowi6_proto = IPPROTO_ICMPV6;
-        ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
+        ipv6_addr_copy(&fl6.daddr, &ipv6_hdr(skb)->saddr);
        if (saddr)
-                ipv6_addr_copy(&fl.fl6_src, saddr);
+                ipv6_addr_copy(&fl6.saddr, saddr);
-        fl.oif = skb->dev->ifindex;
+        fl6.flowi6_oif = skb->dev->ifindex;
-        fl.fl_icmp_type = ICMPV6_ECHO_REPLY;
+        fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
-        security_skb_classify_flow(skb, &fl);
+        security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
        sk = icmpv6_xmit_lock(net);
        if (sk == NULL)
                return;
        np = inet6_sk(sk);
-        if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
+        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
-                fl.oif = np->mcast_oif;
+                fl6.flowi6_oif = np->mcast_oif;
-        err = ip6_dst_lookup(sk, &dst, &fl);
+        err = ip6_dst_lookup(sk, &dst, &fl6);
        if (err)
                goto out;
-        if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0)
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
+        if (IS_ERR(dst))
                goto out;
-        if (ipv6_addr_is_multicast(&fl.fl6_dst))
+        if (ipv6_addr_is_multicast(&fl6.daddr))
                hlimit = np->mcast_hops;
        else
                hlimit = np->hop_limit;
@@ -560,7 +576,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
        msg.type = ICMPV6_ECHO_REPLY;
        err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
-                                sizeof(struct icmp6hdr), hlimit, np->tclass, NULL, &fl,
+                                sizeof(struct icmp6hdr), hlimit, np->tclass, NULL, &fl6,
                                (struct rt6_info*)dst, MSG_DONTWAIT,
                                np->dontfrag);
@@ -569,7 +585,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
                ip6_flush_pending_frames(sk);
                goto out_put;
        }
-        err = icmpv6_push_pending_frames(sk, &fl, &tmp_hdr, skb->len + sizeof(struct icmp6hdr));
+        err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, skb->len + sizeof(struct icmp6hdr));
 out_put:
        if (likely(idev != NULL))
@@ -629,8 +645,8 @@ static int icmpv6_rcv(struct sk_buff *skb)
 {
        struct net_device *dev = skb->dev;
        struct inet6_dev *idev = __in6_dev_get(dev);
-        struct in6_addr *saddr, *daddr;
+        const struct in6_addr *saddr, *daddr;
-        struct ipv6hdr *orig_hdr;
+        const struct ipv6hdr *orig_hdr;
        struct icmp6hdr *hdr;
        u8 type;
@@ -768,20 +784,20 @@ drop_no_count:
        return 0;
 }
-void icmpv6_flow_init(struct sock *sk, struct flowi *fl,
+void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
                      u8 type,
                      const struct in6_addr *saddr,
                      const struct in6_addr *daddr,
                      int oif)
 {
-        memset(fl, 0, sizeof(*fl));
+        memset(fl6, 0, sizeof(*fl6));
-        ipv6_addr_copy(&fl->fl6_src, saddr);
+        ipv6_addr_copy(&fl6->saddr, saddr);
-        ipv6_addr_copy(&fl->fl6_dst, daddr);
+        ipv6_addr_copy(&fl6->daddr, daddr);
-        fl->proto               = IPPROTO_ICMPV6;
+        fl6->flowi6_proto       = IPPROTO_ICMPV6;
-        fl->fl_icmp_type        = type;
+        fl6->fl6_icmp_type      = type;
-        fl->fl_icmp_code        = 0;
+        fl6->fl6_icmp_code      = 0;
-        fl->oif                 = oif;
+        fl6->flowi6_oif         = oif;
-        security_sk_classify_flow(sk, fl);
+        security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
 }
 /*
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 8a1628023bd1..8a58e8cf6646 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -54,24 +54,49 @@ int inet6_csk_bind_conflict(const struct sock *sk,
 EXPORT_SYMBOL_GPL(inet6_csk_bind_conflict);
+struct dst_entry *inet6_csk_route_req(struct sock *sk,
+                                      const struct request_sock *req)
+{
+        struct inet6_request_sock *treq = inet6_rsk(req);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct in6_addr *final_p, final;
+        struct dst_entry *dst;
+        struct flowi6 fl6;
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_TCP;
+        ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
+        final_p = fl6_update_dst(&fl6, np->opt, &final);
+        ipv6_addr_copy(&fl6.saddr, &treq->loc_addr);
+        fl6.flowi6_oif = sk->sk_bound_dev_if;
+        fl6.flowi6_mark = sk->sk_mark;
+        fl6.fl6_dport = inet_rsk(req)->rmt_port;
+        fl6.fl6_sport = inet_rsk(req)->loc_port;
+        security_req_classify_flow(req, flowi6_to_flowi(&fl6));
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
+        if (IS_ERR(dst))
+                return NULL;
+        return dst;
+}
 /*
 * request_sock (formerly open request) hash tables.
 */
 static u32 inet6_synq_hash(const struct in6_addr *raddr, const __be16 rport,
                           const u32 rnd, const u16 synq_hsize)
 {
-        u32 a = (__force u32)raddr->s6_addr32[0];
+        u32 c;
-        u32 b = (__force u32)raddr->s6_addr32[1];
-        u32 c = (__force u32)raddr->s6_addr32[2];
-        a += JHASH_GOLDEN_RATIO;
+        c = jhash_3words((__force u32)raddr->s6_addr32[0],
-        b += JHASH_GOLDEN_RATIO;
+                         (__force u32)raddr->s6_addr32[1],
-        c += rnd;
+                         (__force u32)raddr->s6_addr32[2],
-        __jhash_mix(a, b, c);
+                         rnd);
-        a += (__force u32)raddr->s6_addr32[3];
+        c = jhash_2words((__force u32)raddr->s6_addr32[3],
-        b += (__force u32)rport;
+                         (__force u32)rport,
-        __jhash_mix(a, b, c);
+                         c);
        return c & (synq_hsize - 1);
 }
@@ -178,47 +203,39 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
        return dst;
 }
-int inet6_csk_xmit(struct sk_buff *skb)
+int inet6_csk_xmit(struct sk_buff *skb, struct flowi *fl_unused)
 {
        struct sock *sk = skb->sk;
        struct inet_sock *inet = inet_sk(sk);
        struct ipv6_pinfo *np = inet6_sk(sk);
-        struct flowi fl;
+        struct flowi6 fl6;
        struct dst_entry *dst;
        struct in6_addr *final_p, final;
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
-        fl.proto = sk->sk_protocol;
+        fl6.flowi6_proto = sk->sk_protocol;
-        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
+        ipv6_addr_copy(&fl6.daddr, &np->daddr);
-        ipv6_addr_copy(&fl.fl6_src, &np->saddr);
+        ipv6_addr_copy(&fl6.saddr, &np->saddr);
-        fl.fl6_flowlabel = np->flow_label;
+        fl6.flowlabel = np->flow_label;
-        IP6_ECN_flow_xmit(sk, fl.fl6_flowlabel);
+        IP6_ECN_flow_xmit(sk, fl6.flowlabel);
-        fl.oif = sk->sk_bound_dev_if;
+        fl6.flowi6_oif = sk->sk_bound_dev_if;
-        fl.mark = sk->sk_mark;
+        fl6.flowi6_mark = sk->sk_mark;
-        fl.fl_ip_sport = inet->inet_sport;
+        fl6.fl6_sport = inet->inet_sport;
-        fl.fl_ip_dport = inet->inet_dport;
+        fl6.fl6_dport = inet->inet_dport;
-        security_sk_classify_flow(sk, &fl);
+        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-        final_p = fl6_update_dst(&fl, np->opt, &final);
+        final_p = fl6_update_dst(&fl6, np->opt, &final);
        dst = __inet6_csk_dst_check(sk, np->dst_cookie);
        if (dst == NULL) {
-                int err = ip6_dst_lookup(sk, &dst, &fl);
+                dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
-                if (err) {
-                        sk->sk_err_soft = -err;
-                        kfree_skb(skb);
-                        return err;
-                }
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
-                if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0) {
+                if (IS_ERR(dst)) {
+                        sk->sk_err_soft = -PTR_ERR(dst);
                        sk->sk_route_caps = 0;
                        kfree_skb(skb);
-                        return err;
+                        return PTR_ERR(dst);
                }
                __inet6_csk_dst_store(sk, dst, NULL, NULL);
@@ -227,9 +244,9 @@ int inet6_csk_xmit(struct sk_buff *skb)
        skb_dst_set(skb, dst_clone(dst));
        /* Restore final destination back after routing done */
-        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
+        ipv6_addr_copy(&fl6.daddr, &np->daddr);
-        return ip6_xmit(sk, skb, &fl, np->opt);
+        return ip6_xmit(sk, skb, &fl6, np->opt);
 }
 EXPORT_SYMBOL_GPL(inet6_csk_xmit);
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 633a6c266136..b53197233709 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -124,7 +124,7 @@ out:
 }
 EXPORT_SYMBOL(__inet6_lookup_established);
-static int inline compute_score(struct sock *sk, struct net *net,
+static inline int compute_score(struct sock *sk, struct net *net,
                                const unsigned short hnum,
                                const struct in6_addr *daddr,
                                const int dif)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index b6a585909d35..4076a0b14b20 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -134,9 +134,9 @@ static __inline__ u32 fib6_new_sernum(void)
 # define BITOP_BE32_SWIZZLE     0
 #endif
-static __inline__ __be32 addr_bit_set(void *token, int fn_bit)
+static __inline__ __be32 addr_bit_set(const void *token, int fn_bit)
 {
-        __be32 *addr = token;
+        const __be32 *addr = token;
        /*
         * Here,
         *      1 << ((~fn_bit ^ BITOP_BE32_SWIZZLE) & 0x1f)
@@ -260,10 +260,10 @@ struct fib6_table *fib6_get_table(struct net *net, u32 id)
          return net->ipv6.fib6_main_tbl;
 }
-struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi *fl,
+struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
                                   int flags, pol_lookup_t lookup)
 {
-        return (struct dst_entry *) lookup(net, net->ipv6.fib6_main_tbl, fl, flags);
+        return (struct dst_entry *) lookup(net, net->ipv6.fib6_main_tbl, fl6, flags);
 }
 static void __net_init fib6_tables_init(struct net *net)
@@ -394,10 +394,11 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
        arg.net = net;
        w->args = &arg;
+        rcu_read_lock();
        for (h = s_h; h < FIB6_TABLE_HASHSZ; h++, s_e = 0) {
                e = 0;
                head = &net->ipv6.fib_table_hash[h];
-                hlist_for_each_entry(tb, node, head, tb6_hlist) {
+                hlist_for_each_entry_rcu(tb, node, head, tb6_hlist) {
                        if (e < s_e)
                                goto next;
                        res = fib6_dump_table(tb, skb, cb);
@@ -408,6 +409,7 @@ next:
                }
        }
 out:
+        rcu_read_unlock();
        cb->args[1] = e;
        cb->args[0] = h;
@@ -822,7 +824,7 @@ st_failure:
 struct lookup_args {
        int             offset;         /* key offset on rt6_info       */
-        struct in6_addr *addr;          /* search key                   */
+        const struct in6_addr   *addr;          /* search key                   */
 };
 static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
@@ -881,8 +883,8 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
        return NULL;
 }
-struct fib6_node * fib6_lookup(struct fib6_node *root, struct in6_addr *daddr,
+struct fib6_node * fib6_lookup(struct fib6_node *root, const struct in6_addr *daddr,
-                               struct in6_addr *saddr)
+                               const struct in6_addr *saddr)
 {
        struct fib6_node *fn;
        struct lookup_args args[] = {
@@ -916,7 +918,7 @@ struct fib6_node * fib6_lookup(struct fib6_node *root, struct in6_addr *daddr,
 static struct fib6_node * fib6_locate_1(struct fib6_node *root,
-                                        struct in6_addr *addr,
+                                        const struct in6_addr *addr,
                                        int plen, int offset)
 {
        struct fib6_node *fn;
@@ -946,8 +948,8 @@ static struct fib6_node * fib6_locate_1(struct fib6_node *root,
 }
 struct fib6_node * fib6_locate(struct fib6_node *root,
-                               struct in6_addr *daddr, int dst_len,
+                               const struct in6_addr *daddr, int dst_len,
-                               struct in6_addr *saddr, int src_len)
+                               const struct in6_addr *saddr, int src_len)
 {
        struct fib6_node *fn;
@@ -1500,15 +1502,18 @@ static void fib6_gc_timer_cb(unsigned long arg)
 static int __net_init fib6_net_init(struct net *net)
 {
+        size_t size = sizeof(struct hlist_head) * FIB6_TABLE_HASHSZ;
        setup_timer(&net->ipv6.ip6_fib_timer, fib6_gc_timer_cb, (unsigned long)net);
        net->ipv6.rt6_stats = kzalloc(sizeof(*net->ipv6.rt6_stats), GFP_KERNEL);
        if (!net->ipv6.rt6_stats)
                goto out_timer;
-        net->ipv6.fib_table_hash = kcalloc(FIB6_TABLE_HASHSZ,
+        /* Avoid false sharing : Use at least a full cache line */
-                                           sizeof(*net->ipv6.fib_table_hash),
+        size = max_t(size_t, size, L1_CACHE_BYTES);
-                                           GFP_KERNEL);
+        net->ipv6.fib_table_hash = kzalloc(size, GFP_KERNEL);
        if (!net->ipv6.fib_table_hash)
                goto out_rt6_stats;
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 13654686aeab..f3caf1b8d572 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -342,7 +342,7 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
        if (olen > 0) {
                struct msghdr msg;
-                struct flowi flowi;
+                struct flowi6 flowi6;
                int junk;
                err = -ENOMEM;
@@ -358,9 +358,9 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
                msg.msg_controllen = olen;
                msg.msg_control = (void*)(fl->opt+1);
-                flowi.oif = 0;
+                memset(&flowi6, 0, sizeof(flowi6));
-                err = datagram_send_ctl(net, &msg, &flowi, fl->opt, &junk,
+                err = datagram_send_ctl(net, &msg, &flowi6, fl->opt, &junk,
                                        &junk, &junk);
                if (err)
                        goto done;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index a83e9209cecc..027c7ff6f1e5 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -57,7 +57,7 @@ inline int ip6_rcv_finish( struct sk_buff *skb)
 int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 {
-        struct ipv6hdr *hdr;
+        const struct ipv6hdr *hdr;
        u32             pkt_len;
        struct inet6_dev *idev;
        struct net *net = dev_net(skb->dev);
@@ -186,7 +186,7 @@ resubmit:
                int ret;
                if (ipprot->flags & INET6_PROTO_FINAL) {
-                        struct ipv6hdr *hdr;
+                        const struct ipv6hdr *hdr;
                        /* Free reference early: we don't need it any more,
                           and it may hold ip_conntrack module loaded
@@ -242,7 +242,7 @@ int ip6_input(struct sk_buff *skb)
 int ip6_mc_input(struct sk_buff *skb)
 {
-        struct ipv6hdr *hdr;
+        const struct ipv6hdr *hdr;
        int deliver;
        IP6_UPD_PO_STATS_BH(dev_net(skb_dst(skb)->dev),
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 980912ed7a38..9d4b165837d6 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -56,7 +56,7 @@
 #include <net/checksum.h>
 #include <linux/mroute6.h>
-static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
+int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
 int __ip6_local_out(struct sk_buff *skb)
 {
@@ -145,14 +145,6 @@ static int ip6_finish_output2(struct sk_buff *skb)
        return -EINVAL;
 }
-static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
-{
-        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
-        return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
-               skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
-}
 static int ip6_finish_output(struct sk_buff *skb)
 {
        if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
@@ -182,15 +174,15 @@ int ip6_output(struct sk_buff *skb)
 *      xmit an sk_buff (used by TCP, SCTP and DCCP)
 */
-int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
+int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
             struct ipv6_txoptions *opt)
 {
        struct net *net = sock_net(sk);
        struct ipv6_pinfo *np = inet6_sk(sk);
-        struct in6_addr *first_hop = &fl->fl6_dst;
+        struct in6_addr *first_hop = &fl6->daddr;
        struct dst_entry *dst = skb_dst(skb);
        struct ipv6hdr *hdr;
-        u8  proto = fl->proto;
+        u8  proto = fl6->flowi6_proto;
        int seg_len = skb->len;
        int hlimit = -1;
        int tclass = 0;
@@ -238,13 +230,13 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
        if (hlimit < 0)
                hlimit = ip6_dst_hoplimit(dst);
-        *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel;
+        *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl6->flowlabel;
        hdr->payload_len = htons(seg_len);
        hdr->nexthdr = proto;
        hdr->hop_limit = hlimit;
-        ipv6_addr_copy(&hdr->saddr, &fl->fl6_src);
+        ipv6_addr_copy(&hdr->saddr, &fl6->saddr);
        ipv6_addr_copy(&hdr->daddr, first_hop);
        skb->priority = sk->sk_priority;
@@ -282,13 +274,10 @@ int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct ipv6hdr *hdr;
-        int totlen;
        skb->protocol = htons(ETH_P_IPV6);
        skb->dev = dev;
-        totlen = len + sizeof(struct ipv6hdr);
        skb_reset_network_header(skb);
        skb_put(skb, sizeof(struct ipv6hdr));
        hdr = ipv6_hdr(skb);
@@ -409,6 +398,9 @@ int ip6_forward(struct sk_buff *skb)
                goto drop;
        }
+        if (skb->pkt_type != PACKET_HOST)
+                goto drop;
        skb_forward_csum(skb);
        /*
@@ -484,10 +476,13 @@ int ip6_forward(struct sk_buff *skb)
                else
                        target = &hdr->daddr;
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
                /* Limit redirects both by destination (here)
                   and by source (inside ndisc_send_redirect)
                 */
-                if (xrlim_allow(dst, 1*HZ))
+                if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
                        ndisc_send_redirect(skb, n, target);
        } else {
                int addrtype = ipv6_addr_type(&hdr->saddr);
@@ -601,7 +596,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
        return offset;
 }
-static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
        struct sk_buff *frag;
        struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
@@ -637,7 +632,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
        }
        mtu -= hlen + sizeof(struct frag_hdr);
-        if (skb_has_frags(skb)) {
+        if (skb_has_frag_list(skb)) {
                int first_len = skb_pagelen(skb);
                struct sk_buff *frag2;
@@ -784,7 +779,7 @@ slow_path:
                /* IF: it doesn't fit, use 'mtu' - the data space left */
                if (len > mtu)
                        len = mtu;
-                /* IF: we are not sending upto and including the packet end
+                /* IF: we are not sending up to and including the packet end
                   then align the next start on an eight byte boundary */
                if (len < left) {
                        len &= ~7;
@@ -874,17 +869,17 @@ fail:
        return err;
 }
-static inline int ip6_rt_check(struct rt6key *rt_key,
+static inline int ip6_rt_check(const struct rt6key *rt_key,
-                               struct in6_addr *fl_addr,
+                               const struct in6_addr *fl_addr,
-                               struct in6_addr *addr_cache)
+                               const struct in6_addr *addr_cache)
 {
-        return ((rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
+        return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
-                (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache)));
+                (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
 }
 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
                                          struct dst_entry *dst,
-                                          struct flowi *fl)
+                                          const struct flowi6 *fl6)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct rt6_info *rt = (struct rt6_info *)dst;
@@ -909,11 +904,11 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
         *    sockets.
         * 2. oif also should be the same.
         */
-        if (ip6_rt_check(&rt->rt6i_dst, &fl->fl6_dst, np->daddr_cache) ||
+        if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
 #ifdef CONFIG_IPV6_SUBTREES
-            ip6_rt_check(&rt->rt6i_src, &fl->fl6_src, np->saddr_cache) ||
+            ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
 #endif
-            (fl->oif && fl->oif != dst->dev->ifindex)) {
+            (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
                dst_release(dst);
                dst = NULL;
        }
@@ -923,22 +918,22 @@ out:
 }
 static int ip6_dst_lookup_tail(struct sock *sk,
-                               struct dst_entry **dst, struct flowi *fl)
+                               struct dst_entry **dst, struct flowi6 *fl6)
 {
        int err;
        struct net *net = sock_net(sk);
        if (*dst == NULL)
-                *dst = ip6_route_output(net, sk, fl);
+                *dst = ip6_route_output(net, sk, fl6);
        if ((err = (*dst)->error))
                goto out_err_release;
-        if (ipv6_addr_any(&fl->fl6_src)) {
+        if (ipv6_addr_any(&fl6->saddr)) {
-                err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
+                struct rt6_info *rt = (struct rt6_info *) *dst;
-                                         &fl->fl6_dst,
+                err = ip6_route_get_saddr(net, rt, &fl6->daddr,
-                                         sk ? inet6_sk(sk)->srcprefs : 0,
+                                          sk ? inet6_sk(sk)->srcprefs : 0,
-                                         &fl->fl6_src);
+                                          &fl6->saddr);
                if (err)
                        goto out_err_release;
        }
@@ -954,10 +949,10 @@ static int ip6_dst_lookup_tail(struct sock *sk,
         */
        if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) {
                struct inet6_ifaddr *ifp;
-                struct flowi fl_gw;
+                struct flowi6 fl_gw6;
                int redirect;
-                ifp = ipv6_get_ifaddr(net, &fl->fl6_src,
+                ifp = ipv6_get_ifaddr(net, &fl6->saddr,
                                      (*dst)->dev, 1);
                redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
@@ -970,9 +965,9 @@ static int ip6_dst_lookup_tail(struct sock *sk,
                         * default router instead
                         */
                        dst_release(*dst);
-                        memcpy(&fl_gw, fl, sizeof(struct flowi));
+                        memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
-                        memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
+                        memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
-                        *dst = ip6_route_output(net, sk, &fl_gw);
+                        *dst = ip6_route_output(net, sk, &fl_gw6);
                        if ((err = (*dst)->error))
                                goto out_err_release;
                }
@@ -993,43 +988,85 @@ out_err_release:
 *      ip6_dst_lookup - perform route lookup on flow
 *      @sk: socket which provides route info
 *      @dst: pointer to dst_entry * for result
- *      @fl: flow to lookup
+ *      @fl6: flow to lookup
 *
 *      This function performs a route lookup on the given flow.
 *
 *      It returns zero on success, or a standard errno code on error.
 */
-int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
 {
        *dst = NULL;
-        return ip6_dst_lookup_tail(sk, dst, fl);
+        return ip6_dst_lookup_tail(sk, dst, fl6);
 }
 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
 /**
- *      ip6_sk_dst_lookup - perform socket cached route lookup on flow
+ *      ip6_dst_lookup_flow - perform route lookup on flow with ipsec
+ *      @sk: socket which provides route info
+ *      @fl6: flow to lookup
+ *      @final_dst: final destination address for ipsec lookup
+ *      @can_sleep: we are in a sleepable context
+ *
+ *      This function performs a route lookup on the given flow.
+ *
+ *      It returns a valid dst pointer on success, or a pointer encoded
+ *      error code.
+ */
+struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
+                                      const struct in6_addr *final_dst,
+                                      bool can_sleep)
+{
+        struct dst_entry *dst = NULL;
+        int err;
+        err = ip6_dst_lookup_tail(sk, &dst, fl6);
+        if (err)
+                return ERR_PTR(err);
+        if (final_dst)
+                ipv6_addr_copy(&fl6->daddr, final_dst);
+        if (can_sleep)
+                fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
+        return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
+}
+EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
+/**
+ *      ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
 *      @sk: socket which provides the dst cache and route info
- *      @dst: pointer to dst_entry * for result
+ *      @fl6: flow to lookup
- *      @fl: flow to lookup
+ *      @final_dst: final destination address for ipsec lookup
+ *      @can_sleep: we are in a sleepable context
 *
 *      This function performs a route lookup on the given flow with the
 *      possibility of using the cached route in the socket if it is valid.
 *      It will take the socket dst lock when operating on the dst cache.
 *      As a result, this function can only be used in process context.
 *
- *      It returns zero on success, or a standard errno code on error.
+ *      It returns a valid dst pointer on success, or a pointer encoded
+ *      error code.
 */
-int ip6_sk_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
+                                         const struct in6_addr *final_dst,
+                                         bool can_sleep)
 {
-        *dst = NULL;
+        struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
-        if (sk) {
+        int err;
-                *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
-                *dst = ip6_sk_dst_check(sk, *dst, fl);
+        dst = ip6_sk_dst_check(sk, dst, fl6);
-        }
-        return ip6_dst_lookup_tail(sk, dst, fl);
+        err = ip6_dst_lookup_tail(sk, &dst, fl6);
+        if (err)
+                return ERR_PTR(err);
+        if (final_dst)
+                ipv6_addr_copy(&fl6->daddr, final_dst);
+        if (can_sleep)
+                fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
+        return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
 }
-EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup);
+EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
 static inline int ip6_ufo_append_data(struct sock *sk,
                        int getfrag(void *from, char *to, int offset, int len,
@@ -1066,7 +1103,6 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                skb->ip_summed = CHECKSUM_PARTIAL;
                skb->csum = 0;
-                sk->sk_sndmsg_off = 0;
        }
        err = skb_append_datato_frags(sk,skb, getfrag, from,
@@ -1109,11 +1145,12 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        int offset, int len, int odd, struct sk_buff *skb),
        void *from, int length, int transhdrlen,
-        int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi *fl,
+        int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
        struct rt6_info *rt, unsigned int flags, int dontfrag)
 {
        struct inet_sock *inet = inet_sk(sk);
        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct inet_cork *cork;
        struct sk_buff *skb;
        unsigned int maxfraglen, fragheaderlen;
        int exthdrlen;
@@ -1123,9 +1160,11 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        int err;
        int offset = 0;
        int csummode = CHECKSUM_NONE;
+        __u8 tx_flags = 0;
        if (flags&MSG_PROBE)
                return 0;
+        cork = &inet->cork.base;
        if (skb_queue_empty(&sk->sk_write_queue)) {
                /*
                 * setup for corking
@@ -1165,8 +1204,8 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                        /* need source address above miyazawa*/
                }
                dst_hold(&rt->dst);
-                inet->cork.dst = &rt->dst;
+                cork->dst = &rt->dst;
-                inet->cork.fl = *fl;
+                inet->cork.fl.u.ip6 = *fl6;
                np->cork.hop_limit = hlimit;
                np->cork.tclass = tclass;
                mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
@@ -1175,10 +1214,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                        if (np->frag_size)
                                mtu = np->frag_size;
                }
-                inet->cork.fragsize = mtu;
+                cork->fragsize = mtu;
                if (dst_allfrag(rt->dst.path))
-                        inet->cork.flags |= IPCORK_ALLFRAG;
+                        cork->flags |= IPCORK_ALLFRAG;
-                inet->cork.length = 0;
+                cork->length = 0;
                sk->sk_sndmsg_page = NULL;
                sk->sk_sndmsg_off = 0;
                exthdrlen = rt->dst.header_len + (opt ? opt->opt_flen : 0) -
@@ -1186,12 +1225,12 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                length += exthdrlen;
                transhdrlen += exthdrlen;
        } else {
-                rt = (struct rt6_info *)inet->cork.dst;
+                rt = (struct rt6_info *)cork->dst;
-                fl = &inet->cork.fl;
+                fl6 = &inet->cork.fl.u.ip6;
                opt = np->cork.opt;
                transhdrlen = 0;
                exthdrlen = 0;
-                mtu = inet->cork.fragsize;
+                mtu = cork->fragsize;
        }
        hh_len = LL_RESERVED_SPACE(rt->dst.dev);
@@ -1201,12 +1240,19 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
        if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
-                if (inet->cork.length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
+                if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
-                        ipv6_local_error(sk, EMSGSIZE, fl, mtu-exthdrlen);
+                        ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
                        return -EMSGSIZE;
                }
        }
+        /* For UDP, check if TX timestamp is enabled */
+        if (sk->sk_type == SOCK_DGRAM) {
+                err = sock_tx_timestamp(sk, &tx_flags);
+                if (err)
+                        goto error;
+        }
        /*
         * Let's try using as much space as possible.
         * Use MTU if total length of the message fits into the MTU.
@@ -1223,11 +1269,11 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         * --yoshfuji
         */
-        inet->cork.length += length;
+        cork->length += length;
        if (length > mtu) {
                int proto = sk->sk_protocol;
                if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
-                        ipv6_local_rxpmtu(sk, fl, mtu-exthdrlen);
+                        ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
                        return -EMSGSIZE;
                }
@@ -1248,7 +1294,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        while (length > 0) {
                /* Check if the remaining data fits into current packet. */
-                copy = (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
+                copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
                if (copy < length)
                        copy = maxfraglen - skb->len;
@@ -1273,7 +1319,7 @@ alloc_new_skb:
                         * we know we need more fragment(s).
                         */
                        datalen = length + fraggap;
-                        if (datalen > (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
+                        if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
                                datalen = maxfraglen - fragheaderlen;
                        fraglen = datalen + fragheaderlen;
@@ -1311,6 +1357,12 @@ alloc_new_skb:
                                                           sk->sk_allocation);
                                if (unlikely(skb == NULL))
                                        err = -ENOBUFS;
+                                else {
+                                        /* Only the initial fragment
+                                         * is time stamped.
+                                         */
+                                        tx_flags = 0;
+                                }
                        }
                        if (skb == NULL)
                                goto error;
@@ -1322,6 +1374,9 @@ alloc_new_skb:
                        /* reserve for fragmentation */
                        skb_reserve(skb, hh_len+sizeof(struct frag_hdr));
+                        if (sk->sk_type == SOCK_DGRAM)
+                                skb_shinfo(skb)->tx_flags = tx_flags;
                        /*
                         *      Find where to start putting bytes
                         */
@@ -1428,7 +1483,7 @@ alloc_new_skb:
        }
        return 0;
 error:
-        inet->cork.length -= length;
+        cork->length -= length;
        IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
        return err;
 }
@@ -1444,10 +1499,10 @@ static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
                np->cork.opt = NULL;
        }
-        if (inet->cork.dst) {
+        if (inet->cork.base.dst) {
-                dst_release(inet->cork.dst);
+                dst_release(inet->cork.base.dst);
-                inet->cork.dst = NULL;
+                inet->cork.base.dst = NULL;
-                inet->cork.flags &= ~IPCORK_ALLFRAG;
+                inet->cork.base.flags &= ~IPCORK_ALLFRAG;
        }
        memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
 }
@@ -1462,9 +1517,9 @@ int ip6_push_pending_frames(struct sock *sk)
        struct net *net = sock_net(sk);
        struct ipv6hdr *hdr;
        struct ipv6_txoptions *opt = np->cork.opt;
-        struct rt6_info *rt = (struct rt6_info *)inet->cork.dst;
+        struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
-        struct flowi *fl = &inet->cork.fl;
+        struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
-        unsigned char proto = fl->proto;
+        unsigned char proto = fl6->flowi6_proto;
        int err = 0;
        if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
@@ -1489,7 +1544,7 @@ int ip6_push_pending_frames(struct sock *sk)
        if (np->pmtudisc < IPV6_PMTUDISC_DO)
                skb->local_df = 1;
-        ipv6_addr_copy(final_dst, &fl->fl6_dst);
+        ipv6_addr_copy(final_dst, &fl6->daddr);
        __skb_pull(skb, skb_network_header_len(skb));
        if (opt && opt->opt_flen)
                ipv6_push_frag_opts(skb, opt, &proto);
@@ -1500,12 +1555,12 @@ int ip6_push_pending_frames(struct sock *sk)
        skb_reset_network_header(skb);
        hdr = ipv6_hdr(skb);
-        *(__be32*)hdr = fl->fl6_flowlabel |
+        *(__be32*)hdr = fl6->flowlabel |
                     htonl(0x60000000 | ((int)np->cork.tclass << 20));
        hdr->hop_limit = np->cork.hop_limit;
        hdr->nexthdr = proto;
-        ipv6_addr_copy(&hdr->saddr, &fl->fl6_src);
+        ipv6_addr_copy(&hdr->saddr, &fl6->saddr);
        ipv6_addr_copy(&hdr->daddr, final_dst);
        skb->priority = sk->sk_priority;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 0fd027f3f47e..36c2842a86b2 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -57,8 +57,7 @@
 MODULE_AUTHOR("Ville Nuorvala");
 MODULE_DESCRIPTION("IPv6 tunneling device");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_NETDEV("ip6tnl0");
-#define IPV6_TLV_TEL_DST_SIZE 8
 #ifdef IP6_TNL_DEBUG
 #define IP6_TNL_TRACE(x...) printk(KERN_DEBUG "%s:" x "\n", __func__)
@@ -75,7 +74,7 @@ MODULE_LICENSE("GPL");
                     (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
                    (HASH_SIZE - 1))
-static void ip6_tnl_dev_init(struct net_device *dev);
+static int ip6_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_setup(struct net_device *dev);
 static int ip6_tnl_net_id __read_mostly;
@@ -83,15 +82,42 @@ struct ip6_tnl_net {
        /* the IPv6 tunnel fallback device */
        struct net_device *fb_tnl_dev;
        /* lists for storing tunnels in use */
-        struct ip6_tnl *tnls_r_l[HASH_SIZE];
+        struct ip6_tnl __rcu *tnls_r_l[HASH_SIZE];
-        struct ip6_tnl *tnls_wc[1];
+        struct ip6_tnl __rcu *tnls_wc[1];
-        struct ip6_tnl **tnls[2];
+        struct ip6_tnl __rcu **tnls[2];
+};
+/* often modified stats are per cpu, other are shared (netdev->stats) */
+struct pcpu_tstats {
+        unsigned long   rx_packets;
+        unsigned long   rx_bytes;
+        unsigned long   tx_packets;
+        unsigned long   tx_bytes;
 };
+static struct net_device_stats *ip6_get_stats(struct net_device *dev)
+{
+        struct pcpu_tstats sum = { 0 };
+        int i;
+        for_each_possible_cpu(i) {
+                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
+                sum.rx_packets += tstats->rx_packets;
+                sum.rx_bytes   += tstats->rx_bytes;
+                sum.tx_packets += tstats->tx_packets;
+                sum.tx_bytes   += tstats->tx_bytes;
+        }
+        dev->stats.rx_packets = sum.rx_packets;
+        dev->stats.rx_bytes   = sum.rx_bytes;
+        dev->stats.tx_packets = sum.tx_packets;
+        dev->stats.tx_bytes   = sum.tx_bytes;
+        return &dev->stats;
+}
 /*
- * Locking : hash tables are protected by RCU and a spinlock
+ * Locking : hash tables are protected by RCU and RTNL
 */
-static DEFINE_SPINLOCK(ip6_tnl_lock);
 static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 {
@@ -136,10 +162,10 @@ static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 static struct ip6_tnl *
-ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
+ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_addr *local)
 {
-        unsigned h0 = HASH(remote);
+        unsigned int h0 = HASH(remote);
-        unsigned h1 = HASH(local);
+        unsigned int h1 = HASH(local);
        struct ip6_tnl *t;
        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
@@ -167,11 +193,11 @@ ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
 * Return: head of IPv6 tunnel list
 **/
-static struct ip6_tnl **
+static struct ip6_tnl __rcu **
-ip6_tnl_bucket(struct ip6_tnl_net *ip6n, struct ip6_tnl_parm *p)
+ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct ip6_tnl_parm *p)
 {
-        struct in6_addr *remote = &p->raddr;
+        const struct in6_addr *remote = &p->raddr;
-        struct in6_addr *local = &p->laddr;
+        const struct in6_addr *local = &p->laddr;
        unsigned h = 0;
        int prio = 0;
@@ -190,12 +216,10 @@ ip6_tnl_bucket(struct ip6_tnl_net *ip6n, struct ip6_tnl_parm *p)
 static void
 ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
-        struct ip6_tnl **tp = ip6_tnl_bucket(ip6n, &t->parms);
+        struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
-        spin_lock_bh(&ip6_tnl_lock);
+        rcu_assign_pointer(t->next , rtnl_dereference(*tp));
-        t->next = *tp;
        rcu_assign_pointer(*tp, t);
-        spin_unlock_bh(&ip6_tnl_lock);
 }
 /**
@@ -206,18 +230,25 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 static void
 ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
-        struct ip6_tnl **tp;
+        struct ip6_tnl __rcu **tp;
+        struct ip6_tnl *iter;
-        for (tp = ip6_tnl_bucket(ip6n, &t->parms); *tp; tp = &(*tp)->next) {
-                if (t == *tp) {
+        for (tp = ip6_tnl_bucket(ip6n, &t->parms);
-                        spin_lock_bh(&ip6_tnl_lock);
+             (iter = rtnl_dereference(*tp)) != NULL;
-                        *tp = t->next;
+             tp = &iter->next) {
-                        spin_unlock_bh(&ip6_tnl_lock);
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
                        break;
                }
        }
 }
+static void ip6_dev_free(struct net_device *dev)
+{
+        free_percpu(dev->tstats);
+        free_netdev(dev);
+}
 /**
 * ip6_tnl_create() - create a new tunnel
 *   @p: tunnel parameters
@@ -249,14 +280,11 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
        dev_net_set(dev, net);
-        if (strchr(name, '%')) {
-                if (dev_alloc_name(dev, name) < 0)
-                        goto failed_free;
-        }
        t = netdev_priv(dev);
        t->parms = *p;
-        ip6_tnl_dev_init(dev);
+        err = ip6_tnl_dev_init(dev);
+        if (err < 0)
+                goto failed_free;
        if ((err = register_netdevice(dev)) < 0)
                goto failed_free;
@@ -266,7 +294,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
        return t;
 failed_free:
-        free_netdev(dev);
+        ip6_dev_free(dev);
 failed:
        return NULL;
 }
@@ -288,12 +316,15 @@ failed:
 static struct ip6_tnl *ip6_tnl_locate(struct net *net,
                struct ip6_tnl_parm *p, int create)
 {
-        struct in6_addr *remote = &p->raddr;
+        const struct in6_addr *remote = &p->raddr;
-        struct in6_addr *local = &p->laddr;
+        const struct in6_addr *local = &p->laddr;
+        struct ip6_tnl __rcu **tp;
        struct ip6_tnl *t;
        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        for (t = *ip6_tnl_bucket(ip6n, p); t; t = t->next) {
+        for (tp = ip6_tnl_bucket(ip6n, p);
+             (t = rtnl_dereference(*tp)) != NULL;
+             tp = &t->next) {
                if (ipv6_addr_equal(local, &t->parms.laddr) &&
                    ipv6_addr_equal(remote, &t->parms.raddr))
                        return t;
@@ -318,13 +349,10 @@ ip6_tnl_dev_uninit(struct net_device *dev)
        struct net *net = dev_net(dev);
        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        if (dev == ip6n->fb_tnl_dev) {
+        if (dev == ip6n->fb_tnl_dev)
-                spin_lock_bh(&ip6_tnl_lock);
+                rcu_assign_pointer(ip6n->tnls_wc[0], NULL);
-                ip6n->tnls_wc[0] = NULL;
+        else
-                spin_unlock_bh(&ip6_tnl_lock);
-        } else {
                ip6_tnl_unlink(ip6n, t);
-        }
        ip6_tnl_dst_reset(t);
        dev_put(dev);
 }
@@ -341,7 +369,7 @@ ip6_tnl_dev_uninit(struct net_device *dev)
 static __u16
 parse_tlv_tnl_enc_lim(struct sk_buff *skb, __u8 * raw)
 {
-        struct ipv6hdr *ipv6h = (struct ipv6hdr *) raw;
+        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
        __u8 nexthdr = ipv6h->nexthdr;
        __u16 off = sizeof (*ipv6h);
@@ -402,7 +430,7 @@ static int
 ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
            u8 *type, u8 *code, int *msg, __u32 *info, int offset)
 {
-        struct ipv6hdr *ipv6h = (struct ipv6hdr *) skb->data;
+        const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) skb->data;
        struct ip6_tnl *t;
        int rel_msg = 0;
        u8 rel_type = ICMPV6_DEST_UNREACH;
@@ -502,9 +530,9 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        __u32 rel_info = ntohl(info);
        int err;
        struct sk_buff *skb2;
-        struct iphdr *eiph;
+        const struct iphdr *eiph;
-        struct flowi fl;
        struct rtable *rt;
+        struct flowi4 fl4;
        err = ip6_tnl_err(skb, IPPROTO_IPIP, opt, &rel_type, &rel_code,
                          &rel_msg, &rel_info, offset);
@@ -545,11 +573,11 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        eiph = ip_hdr(skb2);
        /* Try to guess incoming interface */
-        memset(&fl, 0, sizeof(fl));
+        rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
-        fl.fl4_dst = eiph->saddr;
+                                   eiph->saddr, 0,
-        fl.fl4_tos = RT_TOS(eiph->tos);
+                                   0, 0,
-        fl.proto = IPPROTO_IPIP;
+                                   IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
-        if (ip_route_output_key(dev_net(skb->dev), &rt, &fl))
+        if (IS_ERR(rt))
                goto out;
        skb2->dev = rt->dst.dev;
@@ -558,15 +586,18 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        if (rt->rt_flags & RTCF_LOCAL) {
                ip_rt_put(rt);
                rt = NULL;
-                fl.fl4_dst = eiph->daddr;
+                rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
-                fl.fl4_src = eiph->saddr;
+                                           eiph->daddr, eiph->saddr,
-                fl.fl4_tos = eiph->tos;
+                                           0, 0,
-                if (ip_route_output_key(dev_net(skb->dev), &rt, &fl) ||
+                                           IPPROTO_IPIP,
+                                           RT_TOS(eiph->tos), 0);
+                if (IS_ERR(rt) ||
                    rt->dst.dev->type != ARPHRD_TUNNEL) {
-                        ip_rt_put(rt);
+                        if (!IS_ERR(rt))
+                                ip_rt_put(rt);
                        goto out;
                }
-                skb_dst_set(skb2, (struct dst_entry *)rt);
+                skb_dst_set(skb2, &rt->dst);
        } else {
                ip_rt_put(rt);
                if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
@@ -634,8 +665,8 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        return 0;
 }
-static void ip4ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
+static void ip4ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
-                                        struct ipv6hdr *ipv6h,
+                                        const struct ipv6hdr *ipv6h,
                                        struct sk_buff *skb)
 {
        __u8 dsfield = ipv6_get_dsfield(ipv6h) & ~INET_ECN_MASK;
@@ -647,8 +678,8 @@ static void ip4ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
                IP_ECN_set_ce(ip_hdr(skb));
 }
-static void ip6ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
+static void ip6ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
-                                        struct ipv6hdr *ipv6h,
+                                        const struct ipv6hdr *ipv6h,
                                        struct sk_buff *skb)
 {
        if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
@@ -691,17 +722,19 @@ static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
 static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                       __u8 ipproto,
-                       void (*dscp_ecn_decapsulate)(struct ip6_tnl *t,
+                       void (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
-                                                    struct ipv6hdr *ipv6h,
+                                                    const struct ipv6hdr *ipv6h,
                                                    struct sk_buff *skb))
 {
        struct ip6_tnl *t;
-        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
+        const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
        rcu_read_lock();
        if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
                                        &ipv6h->daddr)) != NULL) {
+                struct pcpu_tstats *tstats;
                if (t->parms.proto != ipproto && t->parms.proto != 0) {
                        rcu_read_unlock();
                        goto discard;
@@ -724,10 +757,16 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                skb->pkt_type = PACKET_HOST;
                memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
-                skb_tunnel_rx(skb, t->dev);
+                tstats = this_cpu_ptr(t->dev->tstats);
+                tstats->rx_packets++;
+                tstats->rx_bytes += skb->len;
+                __skb_tunnel_rx(skb, t->dev);
                dscp_ecn_decapsulate(t, ipv6h, skb);
                netif_rx(skb);
                rcu_read_unlock();
                return 0;
        }
@@ -785,7 +824,7 @@ static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
 **/
 static inline int
-ip6_tnl_addr_conflict(struct ip6_tnl *t, struct ipv6hdr *hdr)
+ip6_tnl_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
 {
        return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
 }
@@ -841,7 +880,7 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
 static int ip6_tnl_xmit2(struct sk_buff *skb,
                         struct net_device *dev,
                         __u8 dsfield,
-                         struct flowi *fl,
+                         struct flowi6 *fl6,
                         int encap_limit,
                         __u32 *pmtu)
 {
@@ -861,10 +900,16 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
        if ((dst = ip6_tnl_dst_check(t)) != NULL)
                dst_hold(dst);
        else {
-                dst = ip6_route_output(net, NULL, fl);
+                dst = ip6_route_output(net, NULL, fl6);
-                if (dst->error || xfrm_lookup(net, &dst, fl, NULL, 0) < 0)
+                if (dst->error)
+                        goto tx_err_link_failure;
+                dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), NULL, 0);
+                if (IS_ERR(dst)) {
+                        err = PTR_ERR(dst);
+                        dst = NULL;
                        goto tx_err_link_failure;
+                }
        }
        tdev = dst->dev;
@@ -914,7 +959,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
        skb->transport_header = skb->network_header;
-        proto = fl->proto;
+        proto = fl6->flowi6_proto;
        if (encap_limit >= 0) {
                init_tel_txopt(&opt, encap_limit);
                ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
@@ -922,20 +967,22 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
        skb_push(skb, sizeof(struct ipv6hdr));
        skb_reset_network_header(skb);
        ipv6h = ipv6_hdr(skb);
-        *(__be32*)ipv6h = fl->fl6_flowlabel | htonl(0x60000000);
+        *(__be32*)ipv6h = fl6->flowlabel | htonl(0x60000000);
        dsfield = INET_ECN_encapsulate(0, dsfield);
        ipv6_change_dsfield(ipv6h, ~INET_ECN_MASK, dsfield);
        ipv6h->hop_limit = t->parms.hop_limit;
        ipv6h->nexthdr = proto;
-        ipv6_addr_copy(&ipv6h->saddr, &fl->fl6_src);
+        ipv6_addr_copy(&ipv6h->saddr, &fl6->saddr);
-        ipv6_addr_copy(&ipv6h->daddr, &fl->fl6_dst);
+        ipv6_addr_copy(&ipv6h->daddr, &fl6->daddr);
        nf_reset(skb);
        pkt_len = skb->len;
        err = ip6_local_out(skb);
        if (net_xmit_eval(err) == 0) {
-                stats->tx_bytes += pkt_len;
+                struct pcpu_tstats *tstats = this_cpu_ptr(t->dev->tstats);
-                stats->tx_packets++;
+                tstats->tx_bytes += pkt_len;
+                tstats->tx_packets++;
        } else {
                stats->tx_errors++;
                stats->tx_aborted_errors++;
@@ -954,9 +1001,9 @@ static inline int
 ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct ip6_tnl *t = netdev_priv(dev);
-        struct iphdr  *iph = ip_hdr(skb);
+        const struct iphdr  *iph = ip_hdr(skb);
        int encap_limit = -1;
-        struct flowi fl;
+        struct flowi6 fl6;
        __u8 dsfield;
        __u32 mtu;
        int err;
@@ -968,16 +1015,16 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                encap_limit = t->parms.encap_limit;
-        memcpy(&fl, &t->fl, sizeof (fl));
+        memcpy(&fl6, &t->fl.u.ip6, sizeof (fl6));
-        fl.proto = IPPROTO_IPIP;
+        fl6.flowi6_proto = IPPROTO_IPIP;
        dsfield = ipv4_get_dsfield(iph);
        if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
-                fl.fl6_flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
+                fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
                                          & IPV6_TCLASS_MASK;
-        err = ip6_tnl_xmit2(skb, dev, dsfield, &fl, encap_limit, &mtu);
+        err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
        if (err != 0) {
                /* XXX: send ICMP error even if DF is not set. */
                if (err == -EMSGSIZE)
@@ -996,7 +1043,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
        int encap_limit = -1;
        __u16 offset;
-        struct flowi fl;
+        struct flowi6 fl6;
        __u8 dsfield;
        __u32 mtu;
        int err;
@@ -1018,16 +1065,16 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        } else if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                encap_limit = t->parms.encap_limit;
-        memcpy(&fl, &t->fl, sizeof (fl));
+        memcpy(&fl6, &t->fl.u.ip6, sizeof (fl6));
-        fl.proto = IPPROTO_IPV6;
+        fl6.flowi6_proto = IPPROTO_IPV6;
        dsfield = ipv6_get_dsfield(ipv6h);
        if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
-                fl.fl6_flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
+                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
        if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL))
-                fl.fl6_flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
+                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
-        err = ip6_tnl_xmit2(skb, dev, dsfield, &fl, encap_limit, &mtu);
+        err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
        if (err != 0) {
                if (err == -EMSGSIZE)
                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
@@ -1090,21 +1137,21 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
 {
        struct net_device *dev = t->dev;
        struct ip6_tnl_parm *p = &t->parms;
-        struct flowi *fl = &t->fl;
+        struct flowi6 *fl6 = &t->fl.u.ip6;
        memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
        memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
        /* Set up flowi template */
-        ipv6_addr_copy(&fl->fl6_src, &p->laddr);
+        ipv6_addr_copy(&fl6->saddr, &p->laddr);
-        ipv6_addr_copy(&fl->fl6_dst, &p->raddr);
+        ipv6_addr_copy(&fl6->daddr, &p->raddr);
-        fl->oif = p->link;
+        fl6->flowi6_oif = p->link;
-        fl->fl6_flowlabel = 0;
+        fl6->flowlabel = 0;
        if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS))
-                fl->fl6_flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
+                fl6->flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
        if (!(p->flags&IP6_TNL_F_USE_ORIG_FLOWLABEL))
-                fl->fl6_flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;
+                fl6->flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;
        ip6_tnl_set_cap(t);
@@ -1131,6 +1178,8 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
                                sizeof (struct ipv6hdr);
                        dev->mtu = rt->rt6i_dev->mtu - sizeof (struct ipv6hdr);
+                        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                                dev->mtu-=8;
                        if (dev->mtu < IPV6_MIN_MTU)
                                dev->mtu = IPV6_MIN_MTU;
@@ -1240,6 +1289,7 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                                t = netdev_priv(dev);
                        ip6_tnl_unlink(ip6n, t);
+                        synchronize_net();
                        err = ip6_tnl_change(t, &p);
                        ip6_tnl_link(ip6n, t);
                        netdev_state_change(dev);
@@ -1300,12 +1350,14 @@ ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
 static const struct net_device_ops ip6_tnl_netdev_ops = {
-        .ndo_uninit = ip6_tnl_dev_uninit,
+        .ndo_uninit     = ip6_tnl_dev_uninit,
        .ndo_start_xmit = ip6_tnl_xmit,
-        .ndo_do_ioctl = ip6_tnl_ioctl,
+        .ndo_do_ioctl   = ip6_tnl_ioctl,
        .ndo_change_mtu = ip6_tnl_change_mtu,
+        .ndo_get_stats  = ip6_get_stats,
 };
 /**
 * ip6_tnl_dev_setup - setup virtual tunnel device
 *   @dev: virtual device associated with tunnel
@@ -1316,15 +1368,21 @@ static const struct net_device_ops ip6_tnl_netdev_ops = {
 static void ip6_tnl_dev_setup(struct net_device *dev)
 {
+        struct ip6_tnl *t;
        dev->netdev_ops = &ip6_tnl_netdev_ops;
-        dev->destructor = free_netdev;
+        dev->destructor = ip6_dev_free;
        dev->type = ARPHRD_TUNNEL6;
        dev->hard_header_len = LL_MAX_HEADER + sizeof (struct ipv6hdr);
        dev->mtu = ETH_DATA_LEN - sizeof (struct ipv6hdr);
+        t = netdev_priv(dev);
+        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+                dev->mtu-=8;
        dev->flags |= IFF_NOARP;
        dev->addr_len = sizeof(struct in6_addr);
        dev->features |= NETIF_F_NETNS_LOCAL;
+        dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
 }
@@ -1333,12 +1391,17 @@ static void ip6_tnl_dev_setup(struct net_device *dev)
 *   @dev: virtual device associated with tunnel
 **/
-static inline void
+static inline int
 ip6_tnl_dev_init_gen(struct net_device *dev)
 {
        struct ip6_tnl *t = netdev_priv(dev);
        t->dev = dev;
        strcpy(t->parms.name, dev->name);
+        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        if (!dev->tstats)
+                return -ENOMEM;
+        return 0;
 }
 /**
@@ -1346,11 +1409,15 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
 *   @dev: virtual device associated with tunnel
 **/
-static void ip6_tnl_dev_init(struct net_device *dev)
+static int ip6_tnl_dev_init(struct net_device *dev)
 {
        struct ip6_tnl *t = netdev_priv(dev);
-        ip6_tnl_dev_init_gen(dev);
+        int err = ip6_tnl_dev_init_gen(dev);
+        if (err)
+                return err;
        ip6_tnl_link_config(t);
+        return 0;
 }
 /**
@@ -1360,25 +1427,29 @@ static void ip6_tnl_dev_init(struct net_device *dev)
 * Return: 0
 **/
-static void __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
+static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
 {
        struct ip6_tnl *t = netdev_priv(dev);
        struct net *net = dev_net(dev);
        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+        int err = ip6_tnl_dev_init_gen(dev);
+        if (err)
+                return err;
-        ip6_tnl_dev_init_gen(dev);
        t->parms.proto = IPPROTO_IPV6;
        dev_hold(dev);
-        ip6n->tnls_wc[0] = t;
+        rcu_assign_pointer(ip6n->tnls_wc[0], t);
+        return 0;
 }
-static struct xfrm6_tunnel ip4ip6_handler = {
+static struct xfrm6_tunnel ip4ip6_handler __read_mostly = {
        .handler        = ip4ip6_rcv,
        .err_handler    = ip4ip6_err,
        .priority       =       1,
 };
-static struct xfrm6_tunnel ip6ip6_handler = {
+static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
        .handler        = ip6ip6_rcv,
        .err_handler    = ip6ip6_err,
        .priority       =       1,
@@ -1391,14 +1462,14 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
        LIST_HEAD(list);
        for (h = 0; h < HASH_SIZE; h++) {
-                t = ip6n->tnls_r_l[h];
+                t = rtnl_dereference(ip6n->tnls_r_l[h]);
                while (t != NULL) {
                        unregister_netdevice_queue(t->dev, &list);
-                        t = t->next;
+                        t = rtnl_dereference(t->next);
                }
        }
-        t = ip6n->tnls_wc[0];
+        t = rtnl_dereference(ip6n->tnls_wc[0]);
        unregister_netdevice_queue(t->dev, &list);
        unregister_netdevice_many(&list);
 }
@@ -1419,7 +1490,9 @@ static int __net_init ip6_tnl_init_net(struct net *net)
                goto err_alloc_dev;
        dev_net_set(ip6n->fb_tnl_dev, net);
-        ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
+        err = ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
+        if (err < 0)
+                goto err_register;
        err = register_netdev(ip6n->fb_tnl_dev);
        if (err < 0)
@@ -1427,7 +1500,7 @@ static int __net_init ip6_tnl_init_net(struct net *net)
        return 0;
 err_register:
-        free_netdev(ip6n->fb_tnl_dev);
+        ip6_dev_free(ip6n->fb_tnl_dev);
 err_alloc_dev:
        return err;
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 66078dad7fe8..82a809901f8e 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -34,6 +34,7 @@
 #include <linux/seq_file.h>
 #include <linux/init.h>
 #include <linux/slab.h>
+#include <linux/compat.h>
 #include <net/protocol.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
@@ -134,14 +135,15 @@ static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
        return NULL;
 }
-static int ip6mr_fib_lookup(struct net *net, struct flowi *flp,
+static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
                            struct mr6_table **mrt)
 {
        struct ip6mr_result res;
        struct fib_lookup_arg arg = { .result = &res, };
        int err;
-        err = fib_rules_lookup(net->ipv6.mr6_rules_ops, flp, 0, &arg);
+        err = fib_rules_lookup(net->ipv6.mr6_rules_ops,
+                               flowi6_to_flowi(flp6), 0, &arg);
        if (err < 0)
                return err;
        *mrt = res.mrt;
@@ -269,7 +271,7 @@ static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
        return net->ipv6.mrt6;
 }
-static int ip6mr_fib_lookup(struct net *net, struct flowi *flp,
+static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
                            struct mr6_table **mrt)
 {
        *mrt = net->ipv6.mrt6;
@@ -616,9 +618,9 @@ static int pim6_rcv(struct sk_buff *skb)
        struct net_device  *reg_dev = NULL;
        struct net *net = dev_net(skb->dev);
        struct mr6_table *mrt;
-        struct flowi fl = {
+        struct flowi6 fl6 = {
-                .iif    = skb->dev->ifindex,
+                .flowi6_iif     = skb->dev->ifindex,
-                .mark   = skb->mark,
+                .flowi6_mark    = skb->mark,
        };
        int reg_vif_num;
@@ -643,7 +645,7 @@ static int pim6_rcv(struct sk_buff *skb)
            ntohs(encap->payload_len) + sizeof(*pim) > skb->len)
                goto drop;
-        if (ip6mr_fib_lookup(net, &fl, &mrt) < 0)
+        if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0)
                goto drop;
        reg_vif_num = mrt->mroute_reg_vif_num;
@@ -661,12 +663,13 @@ static int pim6_rcv(struct sk_buff *skb)
        skb_pull(skb, (u8 *)encap - skb->data);
        skb_reset_network_header(skb);
        skb->protocol = htons(ETH_P_IPV6);
-        skb->ip_summed = 0;
+        skb->ip_summed = CHECKSUM_NONE;
        skb->pkt_type = PACKET_HOST;
        skb_tunnel_rx(skb, reg_dev);
        netif_rx(skb);
        dev_put(reg_dev);
        return 0;
 drop:
@@ -685,14 +688,14 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
 {
        struct net *net = dev_net(dev);
        struct mr6_table *mrt;
-        struct flowi fl = {
+        struct flowi6 fl6 = {
-                .oif            = dev->ifindex,
+                .flowi6_oif     = dev->ifindex,
-                .iif            = skb->skb_iif,
+                .flowi6_iif     = skb->skb_iif,
-                .mark           = skb->mark,
+                .flowi6_mark    = skb->mark,
        };
        int err;
-        err = ip6mr_fib_lookup(net, &fl, &mrt);
+        err = ip6mr_fib_lookup(net, &fl6, &mrt);
        if (err < 0)
                return err;
@@ -986,8 +989,8 @@ static int mif6_add(struct net *net, struct mr6_table *mrt,
 }
 static struct mfc6_cache *ip6mr_cache_find(struct mr6_table *mrt,
-                                           struct in6_addr *origin,
+                                           const struct in6_addr *origin,
-                                           struct in6_addr *mcastgrp)
+                                           const struct in6_addr *mcastgrp)
 {
        int line = MFC6_HASH(mcastgrp, origin);
        struct mfc6_cache *c;
@@ -1037,7 +1040,6 @@ static void ip6mr_cache_resolve(struct net *net, struct mr6_table *mrt,
        while((skb = __skb_dequeue(&uc->mfc_un.unres.unresolved))) {
                if (ipv6_hdr(skb)->version == 0) {
-                        int err;
                        struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct ipv6hdr));
                        if (__ip6mr_fill_mroute(mrt, skb, c, NLMSG_DATA(nlh)) > 0) {
@@ -1048,7 +1050,7 @@ static void ip6mr_cache_resolve(struct net *net, struct mr6_table *mrt,
                                skb_trim(skb, nlh->nlmsg_len);
                                ((struct nlmsgerr *)NLMSG_DATA(nlh))->error = -EMSGSIZE;
                        }
-                        err = rtnl_unicast(skb, net, NETLINK_CB(skb).pid);
+                        rtnl_unicast(skb, net, NETLINK_CB(skb).pid);
                } else
                        ip6_mr_forward(net, mrt, skb, c);
        }
@@ -1546,13 +1548,13 @@ int ip6mr_sk_done(struct sock *sk)
 struct sock *mroute6_socket(struct net *net, struct sk_buff *skb)
 {
        struct mr6_table *mrt;
-        struct flowi fl = {
+        struct flowi6 fl6 = {
-                .iif    = skb->skb_iif,
+                .flowi6_iif     = skb->skb_iif,
-                .oif    = skb->dev->ifindex,
+                .flowi6_oif     = skb->dev->ifindex,
-                .mark   = skb->mark,
+                .flowi6_mark    = skb->mark,
        };
-        if (ip6mr_fib_lookup(net, &fl, &mrt) < 0)
+        if (ip6mr_fib_lookup(net, &fl6, &mrt) < 0)
                return NULL;
        return mrt->mroute6_sk;
@@ -1803,6 +1805,80 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void __user *arg)
        }
 }
+#ifdef CONFIG_COMPAT
+struct compat_sioc_sg_req6 {
+        struct sockaddr_in6 src;
+        struct sockaddr_in6 grp;
+        compat_ulong_t pktcnt;
+        compat_ulong_t bytecnt;
+        compat_ulong_t wrong_if;
+};
+struct compat_sioc_mif_req6 {
+        mifi_t  mifi;
+        compat_ulong_t icount;
+        compat_ulong_t ocount;
+        compat_ulong_t ibytes;
+        compat_ulong_t obytes;
+};
+int ip6mr_compat_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
+{
+        struct compat_sioc_sg_req6 sr;
+        struct compat_sioc_mif_req6 vr;
+        struct mif_device *vif;
+        struct mfc6_cache *c;
+        struct net *net = sock_net(sk);
+        struct mr6_table *mrt;
+        mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
+        if (mrt == NULL)
+                return -ENOENT;
+        switch (cmd) {
+        case SIOCGETMIFCNT_IN6:
+                if (copy_from_user(&vr, arg, sizeof(vr)))
+                        return -EFAULT;
+                if (vr.mifi >= mrt->maxvif)
+                        return -EINVAL;
+                read_lock(&mrt_lock);
+                vif = &mrt->vif6_table[vr.mifi];
+                if (MIF_EXISTS(mrt, vr.mifi)) {
+                        vr.icount = vif->pkt_in;
+                        vr.ocount = vif->pkt_out;
+                        vr.ibytes = vif->bytes_in;
+                        vr.obytes = vif->bytes_out;
+                        read_unlock(&mrt_lock);
+                        if (copy_to_user(arg, &vr, sizeof(vr)))
+                                return -EFAULT;
+                        return 0;
+                }
+                read_unlock(&mrt_lock);
+                return -EADDRNOTAVAIL;
+        case SIOCGETSGCNT_IN6:
+                if (copy_from_user(&sr, arg, sizeof(sr)))
+                        return -EFAULT;
+                read_lock(&mrt_lock);
+                c = ip6mr_cache_find(mrt, &sr.src.sin6_addr, &sr.grp.sin6_addr);
+                if (c) {
+                        sr.pktcnt = c->mfc_un.res.pkt;
+                        sr.bytecnt = c->mfc_un.res.bytes;
+                        sr.wrong_if = c->mfc_un.res.wrong_if;
+                        read_unlock(&mrt_lock);
+                        if (copy_to_user(arg, &sr, sizeof(sr)))
+                                return -EFAULT;
+                        return 0;
+                }
+                read_unlock(&mrt_lock);
+                return -EADDRNOTAVAIL;
+        default:
+                return -ENOIOCTLCMD;
+        }
+}
+#endif
 static inline int ip6mr_forward2_finish(struct sk_buff *skb)
 {
@@ -1822,7 +1898,7 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
        struct mif_device *vif = &mrt->vif6_table[vifi];
        struct net_device *dev;
        struct dst_entry *dst;
-        struct flowi fl;
+        struct flowi6 fl6;
        if (vif->dev == NULL)
                goto out_free;
@@ -1840,14 +1916,12 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
        ipv6h = ipv6_hdr(skb);
-        fl = (struct flowi) {
+        fl6 = (struct flowi6) {
-                .oif = vif->link,
+                .flowi6_oif = vif->link,
-                .nl_u = { .ip6_u =
+                .daddr = ipv6h->daddr,
-                                { .daddr = ipv6h->daddr, }
-                }
        };
-        dst = ip6_route_output(net, NULL, &fl);
+        dst = ip6_route_output(net, NULL, &fl6);
        if (!dst)
                goto out_free;
@@ -1970,13 +2044,13 @@ int ip6_mr_input(struct sk_buff *skb)
        struct mfc6_cache *cache;
        struct net *net = dev_net(skb->dev);
        struct mr6_table *mrt;
-        struct flowi fl = {
+        struct flowi6 fl6 = {
-                .iif    = skb->dev->ifindex,
+                .flowi6_iif     = skb->dev->ifindex,
-                .mark   = skb->mark,
+                .flowi6_mark    = skb->mark,
        };
        int err;
-        err = ip6mr_fib_lookup(net, &fl, &mrt);
+        err = ip6mr_fib_lookup(net, &fl6, &mrt);
        if (err < 0)
                return err;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 85cccd6ed0b7..bba658d9a03c 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -55,7 +55,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
        struct net *net = dev_net(skb->dev);
        __be32 spi;
-        struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
+        const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data;
        struct ip_comp_hdr *ipcomph =
                (struct ip_comp_hdr *)(skb->data + offset);
        struct xfrm_state *x;
@@ -64,7 +64,8 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                return;
        spi = htonl(ntohs(ipcomph->cpi));
-        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
+        x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+                              spi, IPPROTO_COMP, AF_INET6);
        if (!x)
                return;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index a7f66bc8f0b0..9cb191ecaba8 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -342,6 +342,25 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                retv = 0;
                break;
+        case IPV6_TRANSPARENT:
+                if (!capable(CAP_NET_ADMIN)) {
+                        retv = -EPERM;
+                        break;
+                }
+                if (optlen < sizeof(int))
+                        goto e_inval;
+                /* we don't have a separate transparent bit for IPV6 we use the one in the IPv4 socket */
+                inet_sk(sk)->transparent = valbool;
+                retv = 0;
+                break;
+        case IPV6_RECVORIGDSTADDR:
+                if (optlen < sizeof(int))
+                        goto e_inval;
+                np->rxopt.bits.rxorigdstaddr = valbool;
+                retv = 0;
+                break;
        case IPV6_HOPOPTS:
        case IPV6_RTHDRDSTOPTS:
        case IPV6_RTHDR:
@@ -425,12 +444,12 @@ sticky_done:
        {
                struct ipv6_txoptions *opt = NULL;
                struct msghdr msg;
-                struct flowi fl;
+                struct flowi6 fl6;
                int junk;
-                fl.fl6_flowlabel = 0;
+                memset(&fl6, 0, sizeof(fl6));
-                fl.oif = sk->sk_bound_dev_if;
+                fl6.flowi6_oif = sk->sk_bound_dev_if;
-                fl.mark = sk->sk_mark;
+                fl6.flowi6_mark = sk->sk_mark;
                if (optlen == 0)
                        goto update;
@@ -456,7 +475,7 @@ sticky_done:
                msg.msg_controllen = optlen;
                msg.msg_control = (void*)(opt+1);
-                retv = datagram_send_ctl(net, &msg, &fl, opt, &junk, &junk,
+                retv = datagram_send_ctl(net, &msg, &fl6, opt, &junk, &junk,
                                         &junk);
                if (retv)
                        goto done;
@@ -1104,6 +1123,14 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                break;
        }
+        case IPV6_TRANSPARENT:
+                val = inet_sk(sk)->transparent;
+                break;
+        case IPV6_RECVORIGDSTADDR:
+                val = np->rxopt.bits.rxorigdstaddr;
+                break;
        case IPV6_UNICAST_HOPS:
        case IPV6_MULTICAST_HOPS:
        {
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index d1444b95ad7e..3e6ebcdb4779 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -82,7 +82,7 @@ static void *__mld2_query_bugs[] __attribute__((__unused__)) = {
 static struct in6_addr mld2_all_mcr = MLD2_ALL_MCR_INIT;
 /* Big mc list lock for all the sockets */
-static DEFINE_RWLOCK(ipv6_sk_mc_lock);
+static DEFINE_SPINLOCK(ipv6_sk_mc_lock);
 static void igmp6_join_group(struct ifmcaddr6 *ma);
 static void igmp6_leave_group(struct ifmcaddr6 *ma);
@@ -92,16 +92,16 @@ static void mld_gq_timer_expire(unsigned long data);
 static void mld_ifc_timer_expire(unsigned long data);
 static void mld_ifc_event(struct inet6_dev *idev);
 static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
-static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *addr);
+static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *addr);
 static void mld_clear_delrec(struct inet6_dev *idev);
 static int sf_setstate(struct ifmcaddr6 *pmc);
 static void sf_markstate(struct ifmcaddr6 *pmc);
 static void ip6_mc_clear_src(struct ifmcaddr6 *pmc);
-static int ip6_mc_del_src(struct inet6_dev *idev, struct in6_addr *pmca,
+static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
-                          int sfmode, int sfcount, struct in6_addr *psfsrc,
+                          int sfmode, int sfcount, const struct in6_addr *psfsrc,
                          int delta);
-static int ip6_mc_add_src(struct inet6_dev *idev, struct in6_addr *pmca,
+static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
-                          int sfmode, int sfcount, struct in6_addr *psfsrc,
+                          int sfmode, int sfcount, const struct in6_addr *psfsrc,
                          int delta);
 static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
                            struct inet6_dev *idev);
@@ -123,6 +123,11 @@ int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
 *      socket join on multicast group
 */
+#define for_each_pmc_rcu(np, pmc)                               \
+        for (pmc = rcu_dereference(np->ipv6_mc_list);           \
+             pmc != NULL;                                       \
+             pmc = rcu_dereference(pmc->next))
 int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 {
        struct net_device *dev = NULL;
@@ -134,15 +139,15 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
        if (!ipv6_addr_is_multicast(addr))
                return -EINVAL;
-        read_lock_bh(&ipv6_sk_mc_lock);
+        rcu_read_lock();
-        for (mc_lst=np->ipv6_mc_list; mc_lst; mc_lst=mc_lst->next) {
+        for_each_pmc_rcu(np, mc_lst) {
                if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
                    ipv6_addr_equal(&mc_lst->addr, addr)) {
-                        read_unlock_bh(&ipv6_sk_mc_lock);
+                        rcu_read_unlock();
                        return -EADDRINUSE;
                }
        }
-        read_unlock_bh(&ipv6_sk_mc_lock);
+        rcu_read_unlock();
        mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL);
@@ -186,10 +191,10 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
                return err;
        }
-        write_lock_bh(&ipv6_sk_mc_lock);
+        spin_lock(&ipv6_sk_mc_lock);
        mc_lst->next = np->ipv6_mc_list;
-        np->ipv6_mc_list = mc_lst;
+        rcu_assign_pointer(np->ipv6_mc_list, mc_lst);
-        write_unlock_bh(&ipv6_sk_mc_lock);
+        spin_unlock(&ipv6_sk_mc_lock);
        rcu_read_unlock();
@@ -202,17 +207,21 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr)
 int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
-        struct ipv6_mc_socklist *mc_lst, **lnk;
+        struct ipv6_mc_socklist *mc_lst;
+        struct ipv6_mc_socklist __rcu **lnk;
        struct net *net = sock_net(sk);
-        write_lock_bh(&ipv6_sk_mc_lock);
+        spin_lock(&ipv6_sk_mc_lock);
-        for (lnk = &np->ipv6_mc_list; (mc_lst = *lnk) !=NULL ; lnk = &mc_lst->next) {
+        for (lnk = &np->ipv6_mc_list;
+             (mc_lst = rcu_dereference_protected(*lnk,
+                        lockdep_is_held(&ipv6_sk_mc_lock))) !=NULL ;
+              lnk = &mc_lst->next) {
                if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
                    ipv6_addr_equal(&mc_lst->addr, addr)) {
                        struct net_device *dev;
                        *lnk = mc_lst->next;
-                        write_unlock_bh(&ipv6_sk_mc_lock);
+                        spin_unlock(&ipv6_sk_mc_lock);
                        rcu_read_lock();
                        dev = dev_get_by_index_rcu(net, mc_lst->ifindex);
@@ -225,18 +234,19 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
                        } else
                                (void) ip6_mc_leave_src(sk, mc_lst, NULL);
                        rcu_read_unlock();
-                        sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
+                        atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
+                        kfree_rcu(mc_lst, rcu);
                        return 0;
                }
        }
-        write_unlock_bh(&ipv6_sk_mc_lock);
+        spin_unlock(&ipv6_sk_mc_lock);
        return -EADDRNOTAVAIL;
 }
 /* called with rcu_read_lock() */
 static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
-                                             struct in6_addr *group,
+                                             const struct in6_addr *group,
                                             int ifindex)
 {
        struct net_device *dev = NULL;
@@ -257,7 +267,7 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
                return NULL;
        idev = __in6_dev_get(dev);
        if (!idev)
-                return NULL;;
+                return NULL;
        read_lock_bh(&idev->lock);
        if (idev->dead) {
                read_unlock_bh(&idev->lock);
@@ -272,12 +282,13 @@ void ipv6_sock_mc_close(struct sock *sk)
        struct ipv6_mc_socklist *mc_lst;
        struct net *net = sock_net(sk);
-        write_lock_bh(&ipv6_sk_mc_lock);
+        spin_lock(&ipv6_sk_mc_lock);
-        while ((mc_lst = np->ipv6_mc_list) != NULL) {
+        while ((mc_lst = rcu_dereference_protected(np->ipv6_mc_list,
+                                lockdep_is_held(&ipv6_sk_mc_lock))) != NULL) {
                struct net_device *dev;
                np->ipv6_mc_list = mc_lst->next;
-                write_unlock_bh(&ipv6_sk_mc_lock);
+                spin_unlock(&ipv6_sk_mc_lock);
                rcu_read_lock();
                dev = dev_get_by_index_rcu(net, mc_lst->ifindex);
@@ -290,11 +301,13 @@ void ipv6_sock_mc_close(struct sock *sk)
                } else
                        (void) ip6_mc_leave_src(sk, mc_lst, NULL);
                rcu_read_unlock();
-                sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
-                write_lock_bh(&ipv6_sk_mc_lock);
+                atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
+                kfree_rcu(mc_lst, rcu);
+                spin_lock(&ipv6_sk_mc_lock);
        }
-        write_unlock_bh(&ipv6_sk_mc_lock);
+        spin_unlock(&ipv6_sk_mc_lock);
 }
 int ip6_mc_source(int add, int omode, struct sock *sk,
@@ -302,7 +315,6 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
 {
        struct in6_addr *source, *group;
        struct ipv6_mc_socklist *pmc;
-        struct net_device *dev;
        struct inet6_dev *idev;
        struct ipv6_pinfo *inet6 = inet6_sk(sk);
        struct ip6_sf_socklist *psl;
@@ -324,12 +336,10 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
                rcu_read_unlock();
                return -ENODEV;
        }
-        dev = idev->dev;
        err = -EADDRNOTAVAIL;
-        read_lock(&ipv6_sk_mc_lock);
+        for_each_pmc_rcu(inet6, pmc) {
-        for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
                if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
                        continue;
                if (ipv6_addr_equal(&pmc->addr, group))
@@ -428,7 +438,6 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
 done:
        if (pmclocked)
                write_unlock(&pmc->sflock);
-        read_unlock(&ipv6_sk_mc_lock);
        read_unlock_bh(&idev->lock);
        rcu_read_unlock();
        if (leavegroup)
@@ -438,9 +447,8 @@ done:
 int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
 {
-        struct in6_addr *group;
+        const struct in6_addr *group;
        struct ipv6_mc_socklist *pmc;
-        struct net_device *dev;
        struct inet6_dev *idev;
        struct ipv6_pinfo *inet6 = inet6_sk(sk);
        struct ip6_sf_socklist *newpsl, *psl;
@@ -463,17 +471,15 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
                rcu_read_unlock();
                return -ENODEV;
        }
-        dev = idev->dev;
        err = 0;
-        read_lock(&ipv6_sk_mc_lock);
        if (gsf->gf_fmode == MCAST_INCLUDE && gsf->gf_numsrc == 0) {
                leavegroup = 1;
                goto done;
        }
-        for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rcu(inet6, pmc) {
                if (pmc->ifindex != gsf->gf_interface)
                        continue;
                if (ipv6_addr_equal(&pmc->addr, group))
@@ -521,7 +527,6 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
        write_unlock(&pmc->sflock);
        err = 0;
 done:
-        read_unlock(&ipv6_sk_mc_lock);
        read_unlock_bh(&idev->lock);
        rcu_read_unlock();
        if (leavegroup)
@@ -533,10 +538,9 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
        struct group_filter __user *optval, int __user *optlen)
 {
        int err, i, count, copycount;
-        struct in6_addr *group;
+        const struct in6_addr *group;
        struct ipv6_mc_socklist *pmc;
        struct inet6_dev *idev;
-        struct net_device *dev;
        struct ipv6_pinfo *inet6 = inet6_sk(sk);
        struct ip6_sf_socklist *psl;
        struct net *net = sock_net(sk);
@@ -553,7 +557,6 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
                rcu_read_unlock();
                return -ENODEV;
        }
-        dev = idev->dev;
        err = -EADDRNOTAVAIL;
        /*
@@ -562,7 +565,7 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
         * so reading the list is safe.
         */
-        for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
+        for_each_pmc_rcu(inet6, pmc) {
                if (pmc->ifindex != gsf->gf_interface)
                        continue;
                if (ipv6_addr_equal(group, &pmc->addr))
@@ -612,13 +615,13 @@ int inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
        struct ip6_sf_socklist *psl;
        int rv = 1;
-        read_lock(&ipv6_sk_mc_lock);
+        rcu_read_lock();
-        for (mc = np->ipv6_mc_list; mc; mc = mc->next) {
+        for_each_pmc_rcu(np, mc) {
                if (ipv6_addr_equal(&mc->addr, mc_addr))
                        break;
        }
        if (!mc) {
-                read_unlock(&ipv6_sk_mc_lock);
+                rcu_read_unlock();
                return 1;
        }
        read_lock(&mc->sflock);
@@ -638,7 +641,7 @@ int inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
                        rv = 0;
        }
        read_unlock(&mc->sflock);
-        read_unlock(&ipv6_sk_mc_lock);
+        rcu_read_unlock();
        return rv;
 }
@@ -745,7 +748,7 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
        spin_unlock_bh(&idev->mc_lock);
 }
-static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *pmca)
+static void mld_del_delrec(struct inet6_dev *idev, const struct in6_addr *pmca)
 {
        struct ifmcaddr6 *pmc, *pmc_prev;
        struct ip6_sf_list *psf, *psf_next;
@@ -1045,7 +1048,7 @@ static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
 /* mark EXCLUDE-mode sources */
 static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
-        struct in6_addr *srcs)
+        const struct in6_addr *srcs)
 {
        struct ip6_sf_list *psf;
        int i, scount;
@@ -1073,7 +1076,7 @@ static int mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
 }
 static int mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
-        struct in6_addr *srcs)
+        const struct in6_addr *srcs)
 {
        struct ip6_sf_list *psf;
        int i, scount;
@@ -1108,7 +1111,7 @@ int igmp6_event_query(struct sk_buff *skb)
 {
        struct mld2_query *mlh2 = NULL;
        struct ifmcaddr6 *ma;
-        struct in6_addr *group;
+        const struct in6_addr *group;
        unsigned long max_delay;
        struct inet6_dev *idev;
        struct mld_msg *mld;
@@ -1389,7 +1392,7 @@ static void mld_sendpack(struct sk_buff *skb)
        struct inet6_dev *idev;
        struct net *net = dev_net(skb->dev);
        int err;
-        struct flowi fl;
+        struct flowi6 fl6;
        struct dst_entry *dst;
        rcu_read_lock();
@@ -1412,11 +1415,16 @@ static void mld_sendpack(struct sk_buff *skb)
                goto err_out;
        }
-        icmpv6_flow_init(net->ipv6.igmp_sk, &fl, ICMPV6_MLD2_REPORT,
+        icmpv6_flow_init(net->ipv6.igmp_sk, &fl6, ICMPV6_MLD2_REPORT,
                         &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
                         skb->dev->ifindex);
-        err = xfrm_lookup(net, &dst, &fl, NULL, 0);
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
+        err = 0;
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
+                dst = NULL;
+        }
        skb_dst_set(skb, dst);
        if (err)
                goto err_out;
@@ -1719,7 +1727,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
        u8 ra[8] = { IPPROTO_ICMPV6, 0,
                     IPV6_TLV_ROUTERALERT, 2, 0, 0,
                     IPV6_TLV_PADN, 0 };
-        struct flowi fl;
+        struct flowi6 fl6;
        struct dst_entry *dst;
        if (type == ICMPV6_MGM_REDUCTION)
@@ -1779,13 +1787,15 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                goto err_out;
        }
-        icmpv6_flow_init(sk, &fl, type,
+        icmpv6_flow_init(sk, &fl6, type,
                         &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
                         skb->dev->ifindex);
-        err = xfrm_lookup(net, &dst, &fl, NULL, 0);
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
-        if (err)
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
                goto err_out;
+        }
        skb_dst_set(skb, dst);
        err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
@@ -1807,7 +1817,7 @@ err_out:
 }
 static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
-        struct in6_addr *psfsrc)
+        const struct in6_addr *psfsrc)
 {
        struct ip6_sf_list *psf, *psf_prev;
        int rv = 0;
@@ -1843,8 +1853,8 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
        return rv;
 }
-static int ip6_mc_del_src(struct inet6_dev *idev, struct in6_addr *pmca,
+static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
-                          int sfmode, int sfcount, struct in6_addr *psfsrc,
+                          int sfmode, int sfcount, const struct in6_addr *psfsrc,
                          int delta)
 {
        struct ifmcaddr6 *pmc;
@@ -1904,7 +1914,7 @@ static int ip6_mc_del_src(struct inet6_dev *idev, struct in6_addr *pmca,
 * Add multicast single-source filter to the interface list
 */
 static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
-        struct in6_addr *psfsrc, int delta)
+        const struct in6_addr *psfsrc, int delta)
 {
        struct ip6_sf_list *psf, *psf_prev;
@@ -2007,8 +2017,8 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
 /*
 * Add multicast source filter list to the interface list
 */
-static int ip6_mc_add_src(struct inet6_dev *idev, struct in6_addr *pmca,
+static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
-                          int sfmode, int sfcount, struct in6_addr *psfsrc,
+                          int sfmode, int sfcount, const struct in6_addr *psfsrc,
                          int delta)
 {
        struct ifmcaddr6 *pmc;
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index d6e9599d0705..43242e6e6103 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -126,7 +126,7 @@ static struct mip6_report_rate_limiter mip6_report_rl = {
 static int mip6_destopt_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
        struct ipv6_destopt_hdr *destopt = (struct ipv6_destopt_hdr *)skb->data;
        int err = destopt->nexthdr;
@@ -181,8 +181,8 @@ static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
 }
 static inline int mip6_report_rl_allow(struct timeval *stamp,
-                                       struct in6_addr *dst,
+                                       const struct in6_addr *dst,
-                                       struct in6_addr *src, int iif)
+                                       const struct in6_addr *src, int iif)
 {
        int allow = 0;
@@ -203,18 +203,20 @@ static inline int mip6_report_rl_allow(struct timeval *stamp,
        return allow;
 }
-static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb, struct flowi *fl)
+static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb,
+                               const struct flowi *fl)
 {
        struct net *net = xs_net(x);
        struct inet6_skb_parm *opt = (struct inet6_skb_parm *)skb->cb;
+        const struct flowi6 *fl6 = &fl->u.ip6;
        struct ipv6_destopt_hao *hao = NULL;
        struct xfrm_selector sel;
        int offset;
        struct timeval stamp;
        int err = 0;
-        if (unlikely(fl->proto == IPPROTO_MH &&
+        if (unlikely(fl6->flowi6_proto == IPPROTO_MH &&
-                     fl->fl_mh_type <= IP6_MH_TYPE_MAX))
+                     fl6->fl6_mh_type <= IP6_MH_TYPE_MAX))
                goto out;
        if (likely(opt->dsthao)) {
@@ -239,14 +241,14 @@ static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb, struct
               sizeof(sel.saddr));
        sel.prefixlen_s = 128;
        sel.family = AF_INET6;
-        sel.proto = fl->proto;
+        sel.proto = fl6->flowi6_proto;
-        sel.dport = xfrm_flowi_dport(fl);
+        sel.dport = xfrm_flowi_dport(fl, &fl6->uli);
        if (sel.dport)
                sel.dport_mask = htons(~0);
-        sel.sport = xfrm_flowi_sport(fl);
+        sel.sport = xfrm_flowi_sport(fl, &fl6->uli);
        if (sel.sport)
                sel.sport_mask = htons(~0);
-        sel.ifindex = fl->oif;
+        sel.ifindex = fl6->flowi6_oif;
        err = km_report(net, IPPROTO_DSTOPTS, &sel,
                        (hao ? (xfrm_address_t *)&hao->addr : NULL));
@@ -347,7 +349,7 @@ static const struct xfrm_type mip6_destopt_type =
 static int mip6_rthdr_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
        struct rt2_hdr *rt2 = (struct rt2_hdr *)skb->data;
        int err = rt2->rt_hdr.nexthdr;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 58841c4ae947..7596f071d308 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -91,7 +91,9 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
-static u32 ndisc_hash(const void *pkey, const struct net_device *dev);
+static u32 ndisc_hash(const void *pkey,
+                      const struct net_device *dev,
+                      __u32 rnd);
 static int ndisc_constructor(struct neighbour *neigh);
 static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb);
 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb);
@@ -139,18 +141,18 @@ struct neigh_table nd_tbl = {
        .proxy_redo =   pndisc_redo,
        .id =           "ndisc_cache",
        .parms = {
-                .tbl =                  &nd_tbl,
+                .tbl                    = &nd_tbl,
-                .base_reachable_time =  30 * HZ,
+                .base_reachable_time    = ND_REACHABLE_TIME,
-                .retrans_time =  1 * HZ,
+                .retrans_time           = ND_RETRANS_TIMER,
-                .gc_staletime = 60 * HZ,
+                .gc_staletime           = 60 * HZ,
-                .reachable_time =               30 * HZ,
+                .reachable_time         = ND_REACHABLE_TIME,
-                .delay_probe_time =      5 * HZ,
+                .delay_probe_time       = 5 * HZ,
-                .queue_len =             3,
+                .queue_len              = 3,
-                .ucast_probes =  3,
+                .ucast_probes           = 3,
-                .mcast_probes =  3,
+                .mcast_probes           = 3,
-                .anycast_delay =         1 * HZ,
+                .anycast_delay          = 1 * HZ,
-                .proxy_delay =          (8 * HZ) / 10,
+                .proxy_delay            = (8 * HZ) / 10,
-                .proxy_qlen =           64,
+                .proxy_qlen             = 64,
        },
        .gc_interval =    30 * HZ,
        .gc_thresh1 =    128,
@@ -228,12 +230,12 @@ static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
        do {
                cur = ((void *)cur) + (cur->nd_opt_len << 3);
        } while(cur < end && cur->nd_opt_type != type);
-        return (cur <= end && cur->nd_opt_type == type ? cur : NULL);
+        return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 }
 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 {
-        return (opt->nd_opt_type == ND_OPT_RDNSS);
+        return opt->nd_opt_type == ND_OPT_RDNSS;
 }
 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
@@ -244,7 +246,7 @@ static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
        do {
                cur = ((void *)cur) + (cur->nd_opt_len << 3);
        } while(cur < end && !ndisc_is_useropt(cur));
-        return (cur <= end && ndisc_is_useropt(cur) ? cur : NULL);
+        return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 }
 static struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
@@ -319,10 +321,10 @@ static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
        int prepad = ndisc_addr_option_pad(dev->type);
        if (lladdrlen != NDISC_OPT_SPACE(dev->addr_len + prepad))
                return NULL;
-        return (lladdr + prepad);
+        return lladdr + prepad;
 }
-int ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
+int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
 {
        switch (dev->type) {
        case ARPHRD_ETHER:
@@ -339,6 +341,8 @@ int ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int d
        case ARPHRD_INFINIBAND:
                ipv6_ib_mc_map(addr, dev->broadcast, buf);
                return 0;
+        case ARPHRD_IPGRE:
+                return ipv6_ipgre_mc_map(addr, dev->broadcast, buf);
        default:
                if (dir) {
                        memcpy(buf, dev->broadcast, dev->addr_len);
@@ -350,7 +354,9 @@ int ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int d
 EXPORT_SYMBOL(ndisc_mc_map);
-static u32 ndisc_hash(const void *pkey, const struct net_device *dev)
+static u32 ndisc_hash(const void *pkey,
+                      const struct net_device *dev,
+                      __u32 hash_rnd)
 {
        const u32 *p32 = pkey;
        u32 addr_hash, i;
@@ -359,7 +365,7 @@ static u32 ndisc_hash(const void *pkey, const struct net_device *dev)
        for (i = 0; i < (sizeof(struct in6_addr) / sizeof(u32)); i++)
                addr_hash ^= *p32++;
-        return jhash_2words(addr_hash, dev->ifindex, nd_tbl.hash_rnd);
+        return jhash_2words(addr_hash, dev->ifindex, hash_rnd);
 }
 static int ndisc_constructor(struct neighbour *neigh)
@@ -507,7 +513,7 @@ void ndisc_send_skb(struct sk_buff *skb,
                    const struct in6_addr *saddr,
                    struct icmp6hdr *icmp6h)
 {
-        struct flowi fl;
+        struct flowi6 fl6;
        struct dst_entry *dst;
        struct net *net = dev_net(dev);
        struct sock *sk = net->ipv6.ndisc_sk;
@@ -517,7 +523,7 @@ void ndisc_send_skb(struct sk_buff *skb,
        type = icmp6h->icmp6_type;
-        icmpv6_flow_init(sk, &fl, type, saddr, daddr, dev->ifindex);
+        icmpv6_flow_init(sk, &fl6, type, saddr, daddr, dev->ifindex);
        dst = icmp6_dst_alloc(dev, neigh, daddr);
        if (!dst) {
@@ -525,8 +531,8 @@ void ndisc_send_skb(struct sk_buff *skb,
                return;
        }
-        err = xfrm_lookup(net, &dst, &fl, NULL, 0);
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
-        if (err < 0) {
+        if (IS_ERR(dst)) {
                kfree_skb(skb);
                return;
        }
@@ -605,6 +611,29 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                     inc_opt ? ND_OPT_TARGET_LL_ADDR : 0);
 }
+static void ndisc_send_unsol_na(struct net_device *dev)
+{
+        struct inet6_dev *idev;
+        struct inet6_ifaddr *ifa;
+        struct in6_addr mcaddr;
+        idev = in6_dev_get(dev);
+        if (!idev)
+                return;
+        read_lock_bh(&idev->lock);
+        list_for_each_entry(ifa, &idev->addr_list, if_list) {
+                addrconf_addr_solict_mult(&ifa->addr, &mcaddr);
+                ndisc_send_na(dev, NULL, &mcaddr, &ifa->addr,
+                              /*router=*/ !!idev->cnf.forwarding,
+                              /*solicited=*/ false, /*override=*/ true,
+                              /*inc_opt=*/ true);
+        }
+        read_unlock_bh(&idev->lock);
+        in6_dev_put(idev);
+}
 void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
                   const struct in6_addr *solicit,
                   const struct in6_addr *daddr, const struct in6_addr *saddr)
@@ -719,8 +748,8 @@ static int pndisc_is_router(const void *pkey,
 static void ndisc_recv_ns(struct sk_buff *skb)
 {
        struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
-        struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
+        const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
-        struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
+        const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
        u8 *lladdr = NULL;
        u32 ndoptlen = skb->tail - (skb->transport_header +
                                    offsetof(struct nd_msg, opt));
@@ -895,8 +924,8 @@ out:
 static void ndisc_recv_na(struct sk_buff *skb)
 {
        struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
-        struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
+        const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
-        struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
+        const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
        u8 *lladdr = NULL;
        u32 ndoptlen = skb->tail - (skb->transport_header +
                                    offsetof(struct nd_msg, opt));
@@ -939,9 +968,10 @@ static void ndisc_recv_na(struct sk_buff *skb)
        }
        ifp = ipv6_get_ifaddr(dev_net(dev), &msg->target, dev, 1);
        if (ifp) {
-                if (ifp->flags & IFA_F_TENTATIVE) {
+                if (skb->pkt_type != PACKET_LOOPBACK
-                        addrconf_dad_failure(ifp);
+                    && (ifp->flags & IFA_F_TENTATIVE)) {
-                        return;
+                                addrconf_dad_failure(ifp);
+                                return;
                }
                /* What should we make now? The advertisement
                   is invalid, but ndisc specs say nothing
@@ -1008,7 +1038,7 @@ static void ndisc_recv_rs(struct sk_buff *skb)
        unsigned long ndoptlen = skb->len - sizeof(*rs_msg);
        struct neighbour *neigh;
        struct inet6_dev *idev;
-        struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
+        const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
        struct ndisc_options ndopts;
        u8 *lladdr = NULL;
@@ -1105,6 +1135,18 @@ errout:
        rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
 }
+static inline int accept_ra(struct inet6_dev *in6_dev)
+{
+        /*
+         * If forwarding is enabled, RA are not accepted unless the special
+         * hybrid mode (accept_ra=2) is enabled.
+         */
+        if (in6_dev->cnf.forwarding && in6_dev->cnf.accept_ra < 2)
+                return 0;
+        return in6_dev->cnf.accept_ra;
+}
 static void ndisc_router_discovery(struct sk_buff *skb)
 {
        struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
@@ -1158,8 +1200,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                return;
        }
-        /* skip route and link configuration on routers */
+        if (!accept_ra(in6_dev))
-        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra)
                goto skip_linkparms;
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
@@ -1244,7 +1285,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
        if (ra_msg->icmph.icmp6_hop_limit) {
                in6_dev->cnf.hop_limit = ra_msg->icmph.icmp6_hop_limit;
                if (rt)
-                        rt->dst.metrics[RTAX_HOPLIMIT-1] = ra_msg->icmph.icmp6_hop_limit;
+                        dst_metric_set(&rt->dst, RTAX_HOPLIMIT,
+                                       ra_msg->icmph.icmp6_hop_limit);
        }
 skip_defrtr:
@@ -1309,8 +1351,7 @@ skip_linkparms:
                             NEIGH_UPDATE_F_ISROUTER);
        }
-        /* skip route and link configuration on routers */
+        if (!accept_ra(in6_dev))
-        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra)
                goto out;
 #ifdef CONFIG_IPV6_ROUTE_INFO
@@ -1363,7 +1404,7 @@ skip_linkparms:
                        in6_dev->cnf.mtu6 = mtu;
                        if (rt)
-                                rt->dst.metrics[RTAX_MTU-1] = mtu;
+                                dst_metric_set(&rt->dst, RTAX_MTU, mtu);
                        rt6_mtu_change(skb->dev, mtu);
                }
@@ -1394,8 +1435,8 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
 {
        struct inet6_dev *in6_dev;
        struct icmp6hdr *icmph;
-        struct in6_addr *dest;
+        const struct in6_addr *dest;
-        struct in6_addr *target;        /* new first hop to destination */
+        const struct in6_addr *target;  /* new first hop to destination */
        struct neighbour *neigh;
        int on_link = 0;
        struct ndisc_options ndopts;
@@ -1428,7 +1469,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
        }
        icmph = icmp6_hdr(skb);
-        target = (struct in6_addr *) (icmph + 1);
+        target = (const struct in6_addr *) (icmph + 1);
        dest = target + 1;
        if (ipv6_addr_is_multicast(dest)) {
@@ -1500,7 +1541,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
        struct rt6_info *rt;
        struct dst_entry *dst;
        struct inet6_dev *idev;
-        struct flowi fl;
+        struct flowi6 fl6;
        u8 *opt;
        int rd_len;
        int err;
@@ -1520,15 +1561,15 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                return;
        }
-        icmpv6_flow_init(sk, &fl, NDISC_REDIRECT,
+        icmpv6_flow_init(sk, &fl6, NDISC_REDIRECT,
                         &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
-        dst = ip6_route_output(net, NULL, &fl);
+        dst = ip6_route_output(net, NULL, &fl6);
        if (dst == NULL)
                return;
-        err = xfrm_lookup(net, &dst, &fl, NULL, 0);
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
-        if (err)
+        if (IS_ERR(dst))
                return;
        rt = (struct rt6_info *) dst;
@@ -1538,7 +1579,9 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                           "ICMPv6 Redirect: destination is not a neighbour.\n");
                goto release;
        }
-        if (!xrlim_allow(dst, 1*HZ))
+        if (!rt->rt6i_peer)
+                rt6_bind_peer(rt, 1);
+        if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
                goto release;
        if (dev->addr_len) {
@@ -1703,6 +1746,9 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
                neigh_ifdown(&nd_tbl, dev);
                fib6_run_gc(~0UL, net);
                break;
+        case NETDEV_NOTIFY_PEERS:
+                ndisc_send_unsol_na(dev);
+                break;
        default:
                break;
        }
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 7155b2451d7c..30fcee465448 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -13,18 +13,16 @@
 int ip6_route_me_harder(struct sk_buff *skb)
 {
        struct net *net = dev_net(skb_dst(skb)->dev);
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
        struct dst_entry *dst;
-        struct flowi fl = {
+        struct flowi6 fl6 = {
-                .oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
+                .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0,
-                .mark = skb->mark,
+                .flowi6_mark = skb->mark,
-                .nl_u =
+                .daddr = iph->daddr,
-                { .ip6_u =
+                .saddr = iph->saddr,
-                  { .daddr = iph->daddr,
-                    .saddr = iph->saddr, } },
        };
-        dst = ip6_route_output(net, skb->sk, &fl);
+        dst = ip6_route_output(net, skb->sk, &fl6);
        if (dst->error) {
                IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
                LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
@@ -39,9 +37,10 @@ int ip6_route_me_harder(struct sk_buff *skb)
 #ifdef CONFIG_XFRM
        if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
-            xfrm_decode_session(skb, &fl, AF_INET6) == 0) {
+            xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) {
                skb_dst_set(skb, NULL);
-                if (xfrm_lookup(net, &dst, &fl, skb->sk, 0))
+                dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), skb->sk, 0);
+                if (IS_ERR(dst))
                        return -1;
                skb_dst_set(skb, dst);
        }
@@ -68,7 +67,7 @@ static void nf_ip6_saveroute(const struct sk_buff *skb,
        struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
        if (entry->hook == NF_INET_LOCAL_OUT) {
-                struct ipv6hdr *iph = ipv6_hdr(skb);
+                const struct ipv6hdr *iph = ipv6_hdr(skb);
                rt_info->daddr = iph->daddr;
                rt_info->saddr = iph->saddr;
@@ -82,7 +81,7 @@ static int nf_ip6_reroute(struct sk_buff *skb,
        struct ip6_rt_info *rt_info = nf_queue_entry_reroute(entry);
        if (entry->hook == NF_INET_LOCAL_OUT) {
-                struct ipv6hdr *iph = ipv6_hdr(skb);
+                const struct ipv6hdr *iph = ipv6_hdr(skb);
                if (!ipv6_addr_equal(&iph->daddr, &rt_info->daddr) ||
                    !ipv6_addr_equal(&iph->saddr, &rt_info->saddr) ||
                    skb->mark != rt_info->mark)
@@ -91,16 +90,25 @@ static int nf_ip6_reroute(struct sk_buff *skb,
        return 0;
 }
-static int nf_ip6_route(struct dst_entry **dst, struct flowi *fl)
+static int nf_ip6_route(struct net *net, struct dst_entry **dst,
+                        struct flowi *fl, bool strict)
 {
-        *dst = ip6_route_output(&init_net, NULL, fl);
+        static const struct ipv6_pinfo fake_pinfo;
+        static const struct inet_sock fake_sk = {
+                /* makes ip6_route_output set RT6_LOOKUP_F_IFACE: */
+                .sk.sk_bound_dev_if = 1,
+                .pinet6 = (struct ipv6_pinfo *) &fake_pinfo,
+        };
+        const void *sk = strict ? &fake_sk : NULL;
+        *dst = ip6_route_output(net, sk, &fl->u.ip6);
        return (*dst)->error;
 }
 __sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
                             unsigned int dataoff, u_int8_t protocol)
 {
-        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        const struct ipv6hdr *ip6h = ipv6_hdr(skb);
        __sum16 csum = 0;
        switch (skb->ip_summed) {
@@ -134,7 +142,7 @@ static __sum16 nf_ip6_checksum_partial(struct sk_buff *skb, unsigned int hook,
                                       unsigned int dataoff, unsigned int len,
                                       u_int8_t protocol)
 {
-        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        const struct ipv6hdr *ip6h = ipv6_hdr(skb);
        __wsum hsum;
        __sum16 csum = 0;
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 29d643bcafa4..448464844a25 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -5,10 +5,15 @@
 menu "IPv6: Netfilter Configuration"
        depends on INET && IPV6 && NETFILTER
+config NF_DEFRAG_IPV6
+        tristate
+        default n
 config NF_CONNTRACK_IPV6
        tristate "IPv6 connection tracking support"
        depends on INET && IPV6 && NF_CONNTRACK
        default m if NETFILTER_ADVANCED=n
+        select NF_DEFRAG_IPV6
        ---help---
          Connection tracking keeps a record of what packets have passed
          through your machine, in order to figure out how they are related
@@ -132,10 +137,10 @@ config IP6_NF_MATCH_RT
 # The targets
 config IP6_NF_TARGET_HL
        tristate '"HL" hoplimit target support'
-        depends on NETFILTER_ADVANCED
+        depends on NETFILTER_ADVANCED && IP6_NF_MANGLE
        select NETFILTER_XT_TARGET_HL
        ---help---
-        This is a backwards-compat option for the user's convenience
+        This is a backwards-compatible option for the user's convenience
        (e.g. when running oldconfig). It selects
        CONFIG_NETFILTER_XT_TARGET_HL.
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index aafbba30c899..abfee91ce816 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -11,10 +11,14 @@ obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
 obj-$(CONFIG_IP6_NF_SECURITY) += ip6table_security.o
 # objects for l3 independent conntrack
-nf_conntrack_ipv6-objs  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o nf_conntrack_reasm.o
+nf_conntrack_ipv6-y  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o
 # l3 independent conntrack
-obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o
+obj-$(CONFIG_NF_CONNTRACK_IPV6) += nf_conntrack_ipv6.o nf_defrag_ipv6.o
+# defrag
+nf_defrag_ipv6-y := nf_defrag_ipv6_hooks.o nf_conntrack_reasm.o
+obj-$(CONFIG_NF_DEFRAG_IPV6) += nf_defrag_ipv6.o
 # matches
 obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 413ab0754e1f..249394863284 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -204,7 +204,8 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
        else
                pmsg->outdev_name[0] = '\0';
-        if (entry->indev && entry->skb->dev) {
+        if (entry->indev && entry->skb->dev &&
+            entry->skb->mac_header != entry->skb->network_header) {
                pmsg->hw_type = entry->skb->dev->type;
                pmsg->hw_addrlen = dev_parse_header(entry->skb, pmsg->hw_addr);
        }
@@ -403,7 +404,8 @@ ipq_dev_drop(int ifindex)
 static inline void
 __ipq_rcv_skb(struct sk_buff *skb)
 {
-        int status, type, pid, flags, nlmsglen, skblen;
+        int status, type, pid, flags;
+        unsigned int nlmsglen, skblen;
        struct nlmsghdr *nlh;
        skblen = skb->len;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 8e754be92c24..94874b0bdcdc 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -82,13 +82,13 @@ EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
 int
 ip6t_ext_hdr(u8 nexthdr)
 {
-        return ( (nexthdr == IPPROTO_HOPOPTS)   ||
+        return  (nexthdr == IPPROTO_HOPOPTS)   ||
-                 (nexthdr == IPPROTO_ROUTING)   ||
+                (nexthdr == IPPROTO_ROUTING)   ||
-                 (nexthdr == IPPROTO_FRAGMENT)  ||
+                (nexthdr == IPPROTO_FRAGMENT)  ||
-                 (nexthdr == IPPROTO_ESP)       ||
+                (nexthdr == IPPROTO_ESP)       ||
-                 (nexthdr == IPPROTO_AH)        ||
+                (nexthdr == IPPROTO_AH)        ||
-                 (nexthdr == IPPROTO_NONE)      ||
+                (nexthdr == IPPROTO_NONE)      ||
-                 (nexthdr == IPPROTO_DSTOPTS) );
+                (nexthdr == IPPROTO_DSTOPTS);
 }
 /* Returns whether matches rule or not. */
@@ -215,7 +215,7 @@ static inline bool unconditional(const struct ip6t_ip6 *ipv6)
        return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
 }
-static inline const struct ip6t_entry_target *
+static inline const struct xt_entry_target *
 ip6t_get_target_c(const struct ip6t_entry *e)
 {
        return ip6t_get_target((struct ip6t_entry *)e);
@@ -260,9 +260,9 @@ get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
                      const char *hookname, const char **chainname,
                      const char **comment, unsigned int *rulenum)
 {
-        const struct ip6t_standard_target *t = (void *)ip6t_get_target_c(s);
+        const struct xt_standard_target *t = (void *)ip6t_get_target_c(s);
-        if (strcmp(t->target.u.kernel.target->name, IP6T_ERROR_TARGET) == 0) {
+        if (strcmp(t->target.u.kernel.target->name, XT_ERROR_TARGET) == 0) {
                /* Head of user chain: ERROR target with chainname */
                *chainname = t->target.data;
                (*rulenum) = 0;
@@ -271,7 +271,7 @@ get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
                if (s->target_offset == sizeof(struct ip6t_entry) &&
                    strcmp(t->target.u.kernel.target->name,
-                           IP6T_STANDARD_TARGET) == 0 &&
+                           XT_STANDARD_TARGET) == 0 &&
                    t->verdict < 0 &&
                    unconditional(&s->ipv6)) {
                        /* Tail of chains: STANDARD target (return/policy) */
@@ -340,6 +340,7 @@ ip6t_do_table(struct sk_buff *skb,
        unsigned int *stackptr, origptr, cpu;
        const struct xt_table_info *private;
        struct xt_action_param acpar;
+        unsigned int addend;
        /* Initialization */
        indev = in ? in->name : nulldevname;
@@ -358,7 +359,8 @@ ip6t_do_table(struct sk_buff *skb,
        IP_NF_ASSERT(table->valid_hooks & (1 << hook));
-        xt_info_rdlock_bh();
+        local_bh_disable();
+        addend = xt_write_recseq_begin();
        private = table->private;
        cpu        = smp_processor_id();
        table_base = private->entries[cpu];
@@ -369,7 +371,7 @@ ip6t_do_table(struct sk_buff *skb,
        e = get_entry(table_base, private->hook_entry[hook]);
        do {
-                const struct ip6t_entry_target *t;
+                const struct xt_entry_target *t;
                const struct xt_entry_match *ematch;
                IP_NF_ASSERT(e);
@@ -403,14 +405,14 @@ ip6t_do_table(struct sk_buff *skb,
                if (!t->u.kernel.target->target) {
                        int v;
-                        v = ((struct ip6t_standard_target *)t)->verdict;
+                        v = ((struct xt_standard_target *)t)->verdict;
                        if (v < 0) {
                                /* Pop from stack? */
-                                if (v != IP6T_RETURN) {
+                                if (v != XT_RETURN) {
                                        verdict = (unsigned)(-v) - 1;
                                        break;
                                }
-                                if (*stackptr == 0)
+                                if (*stackptr <= origptr)
                                        e = get_entry(table_base,
                                            private->underflow[hook]);
                                else
@@ -434,16 +436,18 @@ ip6t_do_table(struct sk_buff *skb,
                acpar.targinfo = t->data;
                verdict = t->u.kernel.target->target(skb, &acpar);
-                if (verdict == IP6T_CONTINUE)
+                if (verdict == XT_CONTINUE)
                        e = ip6t_next_entry(e);
                else
                        /* Verdict */
                        break;
        } while (!acpar.hotdrop);
-        xt_info_rdunlock_bh();
        *stackptr = origptr;
+        xt_write_recseq_end(addend);
+        local_bh_enable();
 #ifdef DEBUG_ALLOW_ALL
        return NF_ACCEPT;
 #else
@@ -474,7 +478,7 @@ mark_source_chains(const struct xt_table_info *newinfo,
                e->counters.pcnt = pos;
                for (;;) {
-                        const struct ip6t_standard_target *t
+                        const struct xt_standard_target *t
                                = (void *)ip6t_get_target_c(e);
                        int visited = e->comefrom & (1 << hook);
@@ -488,13 +492,13 @@ mark_source_chains(const struct xt_table_info *newinfo,
                        /* Unconditional return/END. */
                        if ((e->target_offset == sizeof(struct ip6t_entry) &&
                             (strcmp(t->target.u.user.name,
-                                     IP6T_STANDARD_TARGET) == 0) &&
+                                     XT_STANDARD_TARGET) == 0) &&
                             t->verdict < 0 &&
                             unconditional(&e->ipv6)) || visited) {
                                unsigned int oldpos, size;
                                if ((strcmp(t->target.u.user.name,
-                                            IP6T_STANDARD_TARGET) == 0) &&
+                                            XT_STANDARD_TARGET) == 0) &&
                                    t->verdict < -NF_MAX_VERDICT - 1) {
                                        duprintf("mark_source_chains: bad "
                                                "negative verdict (%i)\n",
@@ -537,7 +541,7 @@ mark_source_chains(const struct xt_table_info *newinfo,
                                int newpos = t->verdict;
                                if (strcmp(t->target.u.user.name,
-                                           IP6T_STANDARD_TARGET) == 0 &&
+                                           XT_STANDARD_TARGET) == 0 &&
                                    newpos >= 0) {
                                        if (newpos > newinfo->size -
                                                sizeof(struct ip6t_entry)) {
@@ -565,7 +569,7 @@ mark_source_chains(const struct xt_table_info *newinfo,
        return 1;
 }
-static void cleanup_match(struct ip6t_entry_match *m, struct net *net)
+static void cleanup_match(struct xt_entry_match *m, struct net *net)
 {
        struct xt_mtdtor_param par;
@@ -581,14 +585,14 @@ static void cleanup_match(struct ip6t_entry_match *m, struct net *net)
 static int
 check_entry(const struct ip6t_entry *e, const char *name)
 {
-        const struct ip6t_entry_target *t;
+        const struct xt_entry_target *t;
        if (!ip6_checkentry(&e->ipv6)) {
                duprintf("ip_tables: ip check failed %p %s.\n", e, name);
                return -EINVAL;
        }
-        if (e->target_offset + sizeof(struct ip6t_entry_target) >
+        if (e->target_offset + sizeof(struct xt_entry_target) >
            e->next_offset)
                return -EINVAL;
@@ -599,7 +603,7 @@ check_entry(const struct ip6t_entry *e, const char *name)
        return 0;
 }
-static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par)
+static int check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 {
        const struct ip6t_ip6 *ipv6 = par->entryinfo;
        int ret;
@@ -618,7 +622,7 @@ static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par)
 }
 static int
-find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par)
+find_check_match(struct xt_entry_match *m, struct xt_mtchk_param *par)
 {
        struct xt_match *match;
        int ret;
@@ -643,7 +647,7 @@ err:
 static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
 {
-        struct ip6t_entry_target *t = ip6t_get_target(e);
+        struct xt_entry_target *t = ip6t_get_target(e);
        struct xt_tgchk_param par = {
                .net       = net,
                .table     = name,
@@ -670,7 +674,7 @@ static int
 find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
                 unsigned int size)
 {
-        struct ip6t_entry_target *t;
+        struct xt_entry_target *t;
        struct xt_target *target;
        int ret;
        unsigned int j;
@@ -721,7 +725,7 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
 static bool check_underflow(const struct ip6t_entry *e)
 {
-        const struct ip6t_entry_target *t;
+        const struct xt_entry_target *t;
        unsigned int verdict;
        if (!unconditional(&e->ipv6))
@@ -729,7 +733,7 @@ static bool check_underflow(const struct ip6t_entry *e)
        t = ip6t_get_target_c(e);
        if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
                return false;
-        verdict = ((struct ip6t_standard_target *)t)->verdict;
+        verdict = ((struct xt_standard_target *)t)->verdict;
        verdict = -verdict - 1;
        return verdict == NF_DROP || verdict == NF_ACCEPT;
 }
@@ -752,7 +756,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
        }
        if (e->next_offset
-            < sizeof(struct ip6t_entry) + sizeof(struct ip6t_entry_target)) {
+            < sizeof(struct ip6t_entry) + sizeof(struct xt_entry_target)) {
                duprintf("checking: element %p size %u\n",
                         e, e->next_offset);
                return -EINVAL;
@@ -784,7 +788,7 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
 static void cleanup_entry(struct ip6t_entry *e, struct net *net)
 {
        struct xt_tgdtor_param par;
-        struct ip6t_entry_target *t;
+        struct xt_entry_target *t;
        struct xt_entry_match *ematch;
        /* Cleanup all matches */
@@ -897,42 +901,25 @@ get_counters(const struct xt_table_info *t,
        struct ip6t_entry *iter;
        unsigned int cpu;
        unsigned int i;
-        unsigned int curcpu = get_cpu();
-        /* Instead of clearing (by a previous call to memset())
-         * the counters and using adds, we set the counters
-         * with data used by 'current' CPU
-         *
-         * Bottom half has to be disabled to prevent deadlock
-         * if new softirq were to run and call ipt_do_table
-         */
-        local_bh_disable();
-        i = 0;
-        xt_entry_foreach(iter, t->entries[curcpu], t->size) {
-                SET_COUNTER(counters[i], iter->counters.bcnt,
-                            iter->counters.pcnt);
-                ++i;
-        }
-        local_bh_enable();
-        /* Processing counters from other cpus, we can let bottom half enabled,
-         * (preemption is disabled)
-         */
        for_each_possible_cpu(cpu) {
-                if (cpu == curcpu)
+                seqcount_t *s = &per_cpu(xt_recseq, cpu);
-                        continue;
                i = 0;
-                local_bh_disable();
-                xt_info_wrlock(cpu);
                xt_entry_foreach(iter, t->entries[cpu], t->size) {
-                        ADD_COUNTER(counters[i], iter->counters.bcnt,
+                        u64 bcnt, pcnt;
-                                    iter->counters.pcnt);
+                        unsigned int start;
+                        do {
+                                start = read_seqcount_begin(s);
+                                bcnt = iter->counters.bcnt;
+                                pcnt = iter->counters.pcnt;
+                        } while (read_seqcount_retry(s, start));
+                        ADD_COUNTER(counters[i], bcnt, pcnt);
                        ++i;
                }
-                xt_info_wrunlock(cpu);
-                local_bh_enable();
        }
-        put_cpu();
 }
 static struct xt_counters *alloc_counters(const struct xt_table *table)
@@ -945,7 +932,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table)
           (other than comefrom, which userspace doesn't care
           about). */
        countersize = sizeof(struct xt_counters) * private->number;
-        counters = vmalloc(countersize);
+        counters = vzalloc(countersize);
        if (counters == NULL)
                return ERR_PTR(-ENOMEM);
@@ -985,8 +972,8 @@ copy_entries_to_user(unsigned int total_size,
        /* ... then go back and fix counters and names */
        for (off = 0, num = 0; off < total_size; off += e->next_offset, num++){
                unsigned int i;
-                const struct ip6t_entry_match *m;
+                const struct xt_entry_match *m;
-                const struct ip6t_entry_target *t;
+                const struct xt_entry_target *t;
                e = (struct ip6t_entry *)(loc_cpu_entry + off);
                if (copy_to_user(userptr + off
@@ -1003,7 +990,7 @@ copy_entries_to_user(unsigned int total_size,
                        m = (void *)e + i;
                        if (copy_to_user(userptr + off + i
-                                         + offsetof(struct ip6t_entry_match,
+                                         + offsetof(struct xt_entry_match,
                                                    u.user.name),
                                         m->u.kernel.match->name,
                                         strlen(m->u.kernel.match->name)+1)
@@ -1015,7 +1002,7 @@ copy_entries_to_user(unsigned int total_size,
                t = ip6t_get_target_c(e);
                if (copy_to_user(userptr + off + e->target_offset
-                                 + offsetof(struct ip6t_entry_target,
+                                 + offsetof(struct xt_entry_target,
                                            u.user.name),
                                 t->u.kernel.target->name,
                                 strlen(t->u.kernel.target->name)+1) != 0) {
@@ -1053,7 +1040,7 @@ static int compat_calc_entry(const struct ip6t_entry *e,
                             const void *base, struct xt_table_info *newinfo)
 {
        const struct xt_entry_match *ematch;
-        const struct ip6t_entry_target *t;
+        const struct xt_entry_target *t;
        unsigned int entry_offset;
        int off, i, ret;
@@ -1093,6 +1080,7 @@ static int compat_table_info(const struct xt_table_info *info,
        memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
        newinfo->initial_entries = 0;
        loc_cpu_entry = info->entries[raw_smp_processor_id()];
+        xt_compat_init_offsets(AF_INET6, info->number);
        xt_entry_foreach(iter, loc_cpu_entry, info->size) {
                ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
                if (ret != 0)
@@ -1105,7 +1093,7 @@ static int compat_table_info(const struct xt_table_info *info,
 static int get_info(struct net *net, void __user *user,
                    const int *len, int compat)
 {
-        char name[IP6T_TABLE_MAXNAMELEN];
+        char name[XT_TABLE_MAXNAMELEN];
        struct xt_table *t;
        int ret;
@@ -1118,7 +1106,7 @@ static int get_info(struct net *net, void __user *user,
        if (copy_from_user(name, user, sizeof(name)) != 0)
                return -EFAULT;
-        name[IP6T_TABLE_MAXNAMELEN-1] = '\0';
+        name[XT_TABLE_MAXNAMELEN-1] = '\0';
 #ifdef CONFIG_COMPAT
        if (compat)
                xt_compat_lock(AF_INET6);
@@ -1137,6 +1125,7 @@ static int get_info(struct net *net, void __user *user,
                        private = &tmp;
                }
 #endif
+                memset(&info, 0, sizeof(info));
                info.valid_hooks = t->valid_hooks;
                memcpy(info.hook_entry, private->hook_entry,
                       sizeof(info.hook_entry));
@@ -1215,7 +1204,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
        struct ip6t_entry *iter;
        ret = 0;
-        counters = vmalloc(num_counters * sizeof(struct xt_counters));
+        counters = vzalloc(num_counters * sizeof(struct xt_counters));
        if (!counters) {
                ret = -ENOMEM;
                goto out;
@@ -1290,6 +1279,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len)
        /* overflow check */
        if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
                return -ENOMEM;
+        tmp.name[sizeof(tmp.name)-1] = 0;
        newinfo = xt_alloc_table_info(tmp.size);
        if (!newinfo)
@@ -1339,6 +1329,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
        int ret = 0;
        const void *loc_cpu_entry;
        struct ip6t_entry *iter;
+        unsigned int addend;
 #ifdef CONFIG_COMPAT
        struct compat_xt_counters_info compat_tmp;
@@ -1395,13 +1386,13 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
        i = 0;
        /* Choose the copy that is on our node */
        curcpu = smp_processor_id();
-        xt_info_wrlock(curcpu);
+        addend = xt_write_recseq_begin();
        loc_cpu_entry = private->entries[curcpu];
        xt_entry_foreach(iter, loc_cpu_entry, private->size) {
                ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
                ++i;
        }
-        xt_info_wrunlock(curcpu);
+        xt_write_recseq_end(addend);
 unlock_up_free:
        local_bh_enable();
@@ -1415,14 +1406,14 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len,
 #ifdef CONFIG_COMPAT
 struct compat_ip6t_replace {
-        char                    name[IP6T_TABLE_MAXNAMELEN];
+        char                    name[XT_TABLE_MAXNAMELEN];
        u32                     valid_hooks;
        u32                     num_entries;
        u32                     size;
        u32                     hook_entry[NF_INET_NUMHOOKS];
        u32                     underflow[NF_INET_NUMHOOKS];
        u32                     num_counters;
-        compat_uptr_t           counters;       /* struct ip6t_counters * */
+        compat_uptr_t           counters;       /* struct xt_counters * */
        struct compat_ip6t_entry entries[0];
 };
@@ -1431,7 +1422,7 @@ compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
                          unsigned int *size, struct xt_counters *counters,
                          unsigned int i)
 {
-        struct ip6t_entry_target *t;
+        struct xt_entry_target *t;
        struct compat_ip6t_entry __user *ce;
        u_int16_t target_offset, next_offset;
        compat_uint_t origsize;
@@ -1466,7 +1457,7 @@ compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
 }
 static int
-compat_find_calc_match(struct ip6t_entry_match *m,
+compat_find_calc_match(struct xt_entry_match *m,
                       const char *name,
                       const struct ip6t_ip6 *ipv6,
                       unsigned int hookmask,
@@ -1488,7 +1479,7 @@ compat_find_calc_match(struct ip6t_entry_match *m,
 static void compat_release_entry(struct compat_ip6t_entry *e)
 {
-        struct ip6t_entry_target *t;
+        struct xt_entry_target *t;
        struct xt_entry_match *ematch;
        /* Cleanup all matches */
@@ -1509,7 +1500,7 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
                                  const char *name)
 {
        struct xt_entry_match *ematch;
-        struct ip6t_entry_target *t;
+        struct xt_entry_target *t;
        struct xt_target *target;
        unsigned int entry_offset;
        unsigned int j;
@@ -1591,8 +1582,7 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
                            unsigned int *size, const char *name,
                            struct xt_table_info *newinfo, unsigned char *base)
 {
-        struct ip6t_entry_target *t;
+        struct xt_entry_target *t;
-        struct xt_target *target;
        struct ip6t_entry *de;
        unsigned int origsize;
        int ret, h;
@@ -1614,7 +1604,6 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
        }
        de->target_offset = e->target_offset - (origsize - *size);
        t = compat_ip6t_get_target(e);
-        target = t->u.kernel.target;
        xt_compat_target_from_user(t, dstptr, size);
        de->next_offset = e->next_offset - (origsize - *size);
@@ -1695,6 +1684,7 @@ translate_compat_table(struct net *net,
        duprintf("translate_compat_table: size %u\n", info->size);
        j = 0;
        xt_compat_lock(AF_INET6);
+        xt_compat_init_offsets(AF_INET6, number);
        /* Walk through entries, checking offsets. */
        xt_entry_foreach(iter0, entry0, total_size) {
                ret = check_compat_entry_size_and_hooks(iter0, info, &size,
@@ -1836,6 +1826,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                return -ENOMEM;
        if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
                return -ENOMEM;
+        tmp.name[sizeof(tmp.name)-1] = 0;
        newinfo = xt_alloc_table_info(tmp.size);
        if (!newinfo)
@@ -1899,7 +1890,7 @@ compat_do_ip6t_set_ctl(struct sock *sk, int cmd, void __user *user,
 }
 struct compat_ip6t_get_entries {
-        char name[IP6T_TABLE_MAXNAMELEN];
+        char name[XT_TABLE_MAXNAMELEN];
        compat_uint_t size;
        struct compat_ip6t_entry entrytable[0];
 };
@@ -2054,7 +2045,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        case IP6T_SO_GET_REVISION_MATCH:
        case IP6T_SO_GET_REVISION_TARGET: {
-                struct ip6t_get_revision rev;
+                struct xt_get_revision rev;
                int target;
                if (*len != sizeof(rev)) {
@@ -2065,6 +2056,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
                        ret = -EFAULT;
                        break;
                }
+                rev.name[sizeof(rev.name)-1] = 0;
                if (cmd == IP6T_SO_GET_REVISION_TARGET)
                        target = 1;
@@ -2191,7 +2183,7 @@ static int icmp6_checkentry(const struct xt_mtchk_param *par)
 /* The built-in targets: standard (NULL) and error. */
 static struct xt_target ip6t_builtin_tg[] __read_mostly = {
        {
-                .name             = IP6T_STANDARD_TARGET,
+                .name             = XT_STANDARD_TARGET,
                .targetsize       = sizeof(int),
                .family           = NFPROTO_IPV6,
 #ifdef CONFIG_COMPAT
@@ -2201,9 +2193,9 @@ static struct xt_target ip6t_builtin_tg[] __read_mostly = {
 #endif
        },
        {
-                .name             = IP6T_ERROR_TARGET,
+                .name             = XT_ERROR_TARGET,
                .target           = ip6t_error,
-                .targetsize       = IP6T_FUNCTION_MAXNAMELEN,
+                .targetsize       = XT_FUNCTION_MAXNAMELEN,
                .family           = NFPROTO_IPV6,
        },
 };
@@ -2259,7 +2251,7 @@ static int __init ip6_tables_init(void)
        if (ret < 0)
                goto err1;
-        /* Noone else will be downing sem now, so we won't sleep */
+        /* No one else will be downing sem now, so we won't sleep */
        ret = xt_register_targets(ip6t_builtin_tg, ARRAY_SIZE(ip6t_builtin_tg));
        if (ret < 0)
                goto err2;
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 0a07ae7b933f..e6af8d72f26b 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -23,6 +23,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <net/netfilter/nf_log.h>
+#include <net/netfilter/xt_log.h>
 MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
 MODULE_DESCRIPTION("Xtables: IPv6 packet logging to syslog");
@@ -32,11 +33,9 @@ struct in_device;
 #include <net/route.h>
 #include <linux/netfilter_ipv6/ip6t_LOG.h>
-/* Use lock to serialize, so printks don't overlap */
-static DEFINE_SPINLOCK(log_lock);
 /* One level of recursion won't kill us */
-static void dump_packet(const struct nf_loginfo *info,
+static void dump_packet(struct sbuff *m,
+                        const struct nf_loginfo *info,
                        const struct sk_buff *skb, unsigned int ip6hoff,
                        int recurse)
 {
@@ -55,15 +54,15 @@ static void dump_packet(const struct nf_loginfo *info,
        ih = skb_header_pointer(skb, ip6hoff, sizeof(_ip6h), &_ip6h);
        if (ih == NULL) {
-                printk("TRUNCATED");
+                sb_add(m, "TRUNCATED");
                return;
        }
        /* Max length: 88 "SRC=0000.0000.0000.0000.0000.0000.0000.0000 DST=0000.0000.0000.0000.0000.0000.0000.0000 " */
-        printk("SRC=%pI6 DST=%pI6 ", &ih->saddr, &ih->daddr);
+        sb_add(m, "SRC=%pI6 DST=%pI6 ", &ih->saddr, &ih->daddr);
        /* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */
-        printk("LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
+        sb_add(m, "LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
               ntohs(ih->payload_len) + sizeof(struct ipv6hdr),
               (ntohl(*(__be32 *)ih) & 0x0ff00000) >> 20,
               ih->hop_limit,
@@ -78,35 +77,35 @@ static void dump_packet(const struct nf_loginfo *info,
                hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
                if (hp == NULL) {
-                        printk("TRUNCATED");
+                        sb_add(m, "TRUNCATED");
                        return;
                }
                /* Max length: 48 "OPT (...) " */
                if (logflags & IP6T_LOG_IPOPT)
-                        printk("OPT ( ");
+                        sb_add(m, "OPT ( ");
                switch (currenthdr) {
                case IPPROTO_FRAGMENT: {
                        struct frag_hdr _fhdr;
                        const struct frag_hdr *fh;
-                        printk("FRAG:");
+                        sb_add(m, "FRAG:");
                        fh = skb_header_pointer(skb, ptr, sizeof(_fhdr),
                                                &_fhdr);
                        if (fh == NULL) {
-                                printk("TRUNCATED ");
+                                sb_add(m, "TRUNCATED ");
                                return;
                        }
                        /* Max length: 6 "65535 " */
-                        printk("%u ", ntohs(fh->frag_off) & 0xFFF8);
+                        sb_add(m, "%u ", ntohs(fh->frag_off) & 0xFFF8);
                        /* Max length: 11 "INCOMPLETE " */
                        if (fh->frag_off & htons(0x0001))
-                                printk("INCOMPLETE ");
+                                sb_add(m, "INCOMPLETE ");
-                        printk("ID:%08x ", ntohl(fh->identification));
+                        sb_add(m, "ID:%08x ", ntohl(fh->identification));
                        if (ntohs(fh->frag_off) & 0xFFF8)
                                fragment = 1;
@@ -120,7 +119,7 @@ static void dump_packet(const struct nf_loginfo *info,
                case IPPROTO_HOPOPTS:
                        if (fragment) {
                                if (logflags & IP6T_LOG_IPOPT)
-                                        printk(")");
+                                        sb_add(m, ")");
                                return;
                        }
                        hdrlen = ipv6_optlen(hp);
@@ -132,10 +131,10 @@ static void dump_packet(const struct nf_loginfo *info,
                                const struct ip_auth_hdr *ah;
                                /* Max length: 3 "AH " */
-                                printk("AH ");
+                                sb_add(m, "AH ");
                                if (fragment) {
-                                        printk(")");
+                                        sb_add(m, ")");
                                        return;
                                }
@@ -146,13 +145,13 @@ static void dump_packet(const struct nf_loginfo *info,
                                         * Max length: 26 "INCOMPLETE [65535
                                         *  bytes] )"
                                         */
-                                        printk("INCOMPLETE [%u bytes] )",
+                                        sb_add(m, "INCOMPLETE [%u bytes] )",
                                               skb->len - ptr);
                                        return;
                                }
                                /* Length: 15 "SPI=0xF1234567 */
-                                printk("SPI=0x%x ", ntohl(ah->spi));
+                                sb_add(m, "SPI=0x%x ", ntohl(ah->spi));
                        }
@@ -164,10 +163,10 @@ static void dump_packet(const struct nf_loginfo *info,
                                const struct ip_esp_hdr *eh;
                                /* Max length: 4 "ESP " */
-                                printk("ESP ");
+                                sb_add(m, "ESP ");
                                if (fragment) {
-                                        printk(")");
+                                        sb_add(m, ")");
                                        return;
                                }
@@ -177,23 +176,23 @@ static void dump_packet(const struct nf_loginfo *info,
                                eh = skb_header_pointer(skb, ptr, sizeof(_esph),
                                                        &_esph);
                                if (eh == NULL) {
-                                        printk("INCOMPLETE [%u bytes] )",
+                                        sb_add(m, "INCOMPLETE [%u bytes] )",
                                               skb->len - ptr);
                                        return;
                                }
                                /* Length: 16 "SPI=0xF1234567 )" */
-                                printk("SPI=0x%x )", ntohl(eh->spi) );
+                                sb_add(m, "SPI=0x%x )", ntohl(eh->spi) );
                        }
                        return;
                default:
                        /* Max length: 20 "Unknown Ext Hdr 255" */
-                        printk("Unknown Ext Hdr %u", currenthdr);
+                        sb_add(m, "Unknown Ext Hdr %u", currenthdr);
                        return;
                }
                if (logflags & IP6T_LOG_IPOPT)
-                        printk(") ");
+                        sb_add(m, ") ");
                currenthdr = hp->nexthdr;
                ptr += hdrlen;
@@ -205,7 +204,7 @@ static void dump_packet(const struct nf_loginfo *info,
                const struct tcphdr *th;
                /* Max length: 10 "PROTO=TCP " */
-                printk("PROTO=TCP ");
+                sb_add(m, "PROTO=TCP ");
                if (fragment)
                        break;
@@ -213,40 +212,40 @@ static void dump_packet(const struct nf_loginfo *info,
                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
                th = skb_header_pointer(skb, ptr, sizeof(_tcph), &_tcph);
                if (th == NULL) {
-                        printk("INCOMPLETE [%u bytes] ", skb->len - ptr);
+                        sb_add(m, "INCOMPLETE [%u bytes] ", skb->len - ptr);
                        return;
                }
                /* Max length: 20 "SPT=65535 DPT=65535 " */
-                printk("SPT=%u DPT=%u ",
+                sb_add(m, "SPT=%u DPT=%u ",
                       ntohs(th->source), ntohs(th->dest));
                /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
                if (logflags & IP6T_LOG_TCPSEQ)
-                        printk("SEQ=%u ACK=%u ",
+                        sb_add(m, "SEQ=%u ACK=%u ",
                               ntohl(th->seq), ntohl(th->ack_seq));
                /* Max length: 13 "WINDOW=65535 " */
-                printk("WINDOW=%u ", ntohs(th->window));
+                sb_add(m, "WINDOW=%u ", ntohs(th->window));
                /* Max length: 9 "RES=0x3C " */
-                printk("RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));
+                sb_add(m, "RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));
                /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */
                if (th->cwr)
-                        printk("CWR ");
+                        sb_add(m, "CWR ");
                if (th->ece)
-                        printk("ECE ");
+                        sb_add(m, "ECE ");
                if (th->urg)
-                        printk("URG ");
+                        sb_add(m, "URG ");
                if (th->ack)
-                        printk("ACK ");
+                        sb_add(m, "ACK ");
                if (th->psh)
-                        printk("PSH ");
+                        sb_add(m, "PSH ");
                if (th->rst)
-                        printk("RST ");
+                        sb_add(m, "RST ");
                if (th->syn)
-                        printk("SYN ");
+                        sb_add(m, "SYN ");
                if (th->fin)
-                        printk("FIN ");
+                        sb_add(m, "FIN ");
                /* Max length: 11 "URGP=65535 " */
-                printk("URGP=%u ", ntohs(th->urg_ptr));
+                sb_add(m, "URGP=%u ", ntohs(th->urg_ptr));
                if ((logflags & IP6T_LOG_TCPOPT) &&
                    th->doff * 4 > sizeof(struct tcphdr)) {
@@ -260,15 +259,15 @@ static void dump_packet(const struct nf_loginfo *info,
                                                ptr + sizeof(struct tcphdr),
                                                optsize, _opt);
                        if (op == NULL) {
-                                printk("OPT (TRUNCATED)");
+                                sb_add(m, "OPT (TRUNCATED)");
                                return;
                        }
                        /* Max length: 127 "OPT (" 15*4*2chars ") " */
-                        printk("OPT (");
+                        sb_add(m, "OPT (");
                        for (i =0; i < optsize; i++)
-                                printk("%02X", op[i]);
+                                sb_add(m, "%02X", op[i]);
-                        printk(") ");
+                        sb_add(m, ") ");
                }
                break;
        }
@@ -279,9 +278,9 @@ static void dump_packet(const struct nf_loginfo *info,
                if (currenthdr == IPPROTO_UDP)
                        /* Max length: 10 "PROTO=UDP "     */
-                        printk("PROTO=UDP " );
+                        sb_add(m, "PROTO=UDP " );
                else    /* Max length: 14 "PROTO=UDPLITE " */
-                        printk("PROTO=UDPLITE ");
+                        sb_add(m, "PROTO=UDPLITE ");
                if (fragment)
                        break;
@@ -289,12 +288,12 @@ static void dump_packet(const struct nf_loginfo *info,
                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
                uh = skb_header_pointer(skb, ptr, sizeof(_udph), &_udph);
                if (uh == NULL) {
-                        printk("INCOMPLETE [%u bytes] ", skb->len - ptr);
+                        sb_add(m, "INCOMPLETE [%u bytes] ", skb->len - ptr);
                        return;
                }
                /* Max length: 20 "SPT=65535 DPT=65535 " */
-                printk("SPT=%u DPT=%u LEN=%u ",
+                sb_add(m, "SPT=%u DPT=%u LEN=%u ",
                       ntohs(uh->source), ntohs(uh->dest),
                       ntohs(uh->len));
                break;
@@ -304,7 +303,7 @@ static void dump_packet(const struct nf_loginfo *info,
                const struct icmp6hdr *ic;
                /* Max length: 13 "PROTO=ICMPv6 " */
-                printk("PROTO=ICMPv6 ");
+                sb_add(m, "PROTO=ICMPv6 ");
                if (fragment)
                        break;
@@ -312,18 +311,18 @@ static void dump_packet(const struct nf_loginfo *info,
                /* Max length: 25 "INCOMPLETE [65535 bytes] " */
                ic = skb_header_pointer(skb, ptr, sizeof(_icmp6h), &_icmp6h);
                if (ic == NULL) {
-                        printk("INCOMPLETE [%u bytes] ", skb->len - ptr);
+                        sb_add(m, "INCOMPLETE [%u bytes] ", skb->len - ptr);
                        return;
                }
                /* Max length: 18 "TYPE=255 CODE=255 " */
-                printk("TYPE=%u CODE=%u ", ic->icmp6_type, ic->icmp6_code);
+                sb_add(m, "TYPE=%u CODE=%u ", ic->icmp6_type, ic->icmp6_code);
                switch (ic->icmp6_type) {
                case ICMPV6_ECHO_REQUEST:
                case ICMPV6_ECHO_REPLY:
                        /* Max length: 19 "ID=65535 SEQ=65535 " */
-                        printk("ID=%u SEQ=%u ",
+                        sb_add(m, "ID=%u SEQ=%u ",
                                ntohs(ic->icmp6_identifier),
                                ntohs(ic->icmp6_sequence));
                        break;
@@ -334,35 +333,35 @@ static void dump_packet(const struct nf_loginfo *info,
                case ICMPV6_PARAMPROB:
                        /* Max length: 17 "POINTER=ffffffff " */
-                        printk("POINTER=%08x ", ntohl(ic->icmp6_pointer));
+                        sb_add(m, "POINTER=%08x ", ntohl(ic->icmp6_pointer));
                        /* Fall through */
                case ICMPV6_DEST_UNREACH:
                case ICMPV6_PKT_TOOBIG:
                case ICMPV6_TIME_EXCEED:
                        /* Max length: 3+maxlen */
                        if (recurse) {
-                                printk("[");
+                                sb_add(m, "[");
-                                dump_packet(info, skb, ptr + sizeof(_icmp6h),
+                                dump_packet(m, info, skb,
-                                            0);
+                                            ptr + sizeof(_icmp6h), 0);
-                                printk("] ");
+                                sb_add(m, "] ");
                        }
                        /* Max length: 10 "MTU=65535 " */
                        if (ic->icmp6_type == ICMPV6_PKT_TOOBIG)
-                                printk("MTU=%u ", ntohl(ic->icmp6_mtu));
+                                sb_add(m, "MTU=%u ", ntohl(ic->icmp6_mtu));
                }
                break;
        }
        /* Max length: 10 "PROTO=255 " */
        default:
-                printk("PROTO=%u ", currenthdr);
+                sb_add(m, "PROTO=%u ", currenthdr);
        }
        /* Max length: 15 "UID=4294967295 " */
        if ((logflags & IP6T_LOG_UID) && recurse && skb->sk) {
                read_lock_bh(&skb->sk->sk_callback_lock);
                if (skb->sk->sk_socket && skb->sk->sk_socket->file)
-                        printk("UID=%u GID=%u ",
+                        sb_add(m, "UID=%u GID=%u ",
                                skb->sk->sk_socket->file->f_cred->fsuid,
                                skb->sk->sk_socket->file->f_cred->fsgid);
                read_unlock_bh(&skb->sk->sk_callback_lock);
@@ -370,10 +369,11 @@ static void dump_packet(const struct nf_loginfo *info,
        /* Max length: 16 "MARK=0xFFFFFFFF " */
        if (!recurse && skb->mark)
-                printk("MARK=0x%x ", skb->mark);
+                sb_add(m, "MARK=0x%x ", skb->mark);
 }
-static void dump_mac_header(const struct nf_loginfo *info,
+static void dump_mac_header(struct sbuff *m,
+                            const struct nf_loginfo *info,
                            const struct sk_buff *skb)
 {
        struct net_device *dev = skb->dev;
@@ -387,7 +387,7 @@ static void dump_mac_header(const struct nf_loginfo *info,
        switch (dev->type) {
        case ARPHRD_ETHER:
-                printk("MACSRC=%pM MACDST=%pM MACPROTO=%04x ",
+                sb_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",
                       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
                       ntohs(eth_hdr(skb)->h_proto));
                return;
@@ -396,7 +396,7 @@ static void dump_mac_header(const struct nf_loginfo *info,
        }
 fallback:
-        printk("MAC=");
+        sb_add(m, "MAC=");
        if (dev->hard_header_len &&
            skb->mac_header != skb->network_header) {
                const unsigned char *p = skb_mac_header(skb);
@@ -408,19 +408,19 @@ fallback:
                        p = NULL;
                if (p != NULL) {
-                        printk("%02x", *p++);
+                        sb_add(m, "%02x", *p++);
                        for (i = 1; i < len; i++)
-                                printk(":%02x", p[i]);
+                                sb_add(m, ":%02x", *p++);
                }
-                printk(" ");
+                sb_add(m, " ");
                if (dev->type == ARPHRD_SIT) {
                        const struct iphdr *iph =
                                (struct iphdr *)skb_mac_header(skb);
-                        printk("TUNNEL=%pI4->%pI4 ", &iph->saddr, &iph->daddr);
+                        sb_add(m, "TUNNEL=%pI4->%pI4 ", &iph->saddr, &iph->daddr);
                }
        } else
-                printk(" ");
+                sb_add(m, " ");
 }
 static struct nf_loginfo default_loginfo = {
@@ -442,22 +442,22 @@ ip6t_log_packet(u_int8_t pf,
                const struct nf_loginfo *loginfo,
                const char *prefix)
 {
+        struct sbuff *m = sb_open();
        if (!loginfo)
                loginfo = &default_loginfo;
-        spin_lock_bh(&log_lock);
+        sb_add(m, "<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
-        printk("<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
+               prefix,
-                prefix,
+               in ? in->name : "",
-                in ? in->name : "",
+               out ? out->name : "");
-                out ? out->name : "");
+        if (in != NULL)
+                dump_mac_header(m, loginfo, skb);
-        /* MAC logging for input path only. */
+        dump_packet(m, loginfo, skb, skb_network_offset(skb), 1);
-        if (in && !out)
-                dump_mac_header(loginfo, skb);
-        dump_packet(loginfo, skb, skb_network_offset(skb), 1);
+        sb_close(m);
-        printk("\n");
-        spin_unlock_bh(&log_lock);
 }
 static unsigned int
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 2933396e0281..a5a4c5dd5396 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -45,9 +45,11 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
        int tcphoff, needs_ack;
        const struct ipv6hdr *oip6h = ipv6_hdr(oldskb);
        struct ipv6hdr *ip6h;
+#define DEFAULT_TOS_VALUE       0x0U
+        const __u8 tclass = DEFAULT_TOS_VALUE;
        struct dst_entry *dst = NULL;
        u8 proto;
-        struct flowi fl;
+        struct flowi6 fl6;
        if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) ||
            (!(ipv6_addr_type(&oip6h->daddr) & IPV6_ADDR_UNICAST))) {
@@ -89,19 +91,20 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
                return;
        }
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
-        fl.proto = IPPROTO_TCP;
+        fl6.flowi6_proto = IPPROTO_TCP;
-        ipv6_addr_copy(&fl.fl6_src, &oip6h->daddr);
+        ipv6_addr_copy(&fl6.saddr, &oip6h->daddr);
-        ipv6_addr_copy(&fl.fl6_dst, &oip6h->saddr);
+        ipv6_addr_copy(&fl6.daddr, &oip6h->saddr);
-        fl.fl_ip_sport = otcph.dest;
+        fl6.fl6_sport = otcph.dest;
-        fl.fl_ip_dport = otcph.source;
+        fl6.fl6_dport = otcph.source;
-        security_skb_classify_flow(oldskb, &fl);
+        security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6));
-        dst = ip6_route_output(net, NULL, &fl);
+        dst = ip6_route_output(net, NULL, &fl6);
        if (dst == NULL || dst->error) {
                dst_release(dst);
                return;
        }
-        if (xfrm_lookup(net, &dst, &fl, NULL, 0))
+        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
+        if (IS_ERR(dst))
                return;
        hh_len = (dst->dev->hard_header_len + 15)&~15;
@@ -123,8 +126,8 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
        skb_put(nskb, sizeof(struct ipv6hdr));
        skb_reset_network_header(nskb);
        ip6h = ipv6_hdr(nskb);
-        ip6h->version = 6;
+        *(__be32 *)ip6h =  htonl(0x60000000 | (tclass << 20));
-        ip6h->hop_limit = dst_metric(dst, RTAX_HOPLIMIT);
+        ip6h->hop_limit = ip6_dst_hoplimit(dst);
        ip6h->nexthdr = IPPROTO_TCP;
        ipv6_addr_copy(&ip6h->saddr, &oip6h->daddr);
        ipv6_addr_copy(&ip6h->daddr, &oip6h->saddr);
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 679a0a3b7b3c..00d19173db7e 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -64,7 +64,8 @@ ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
            (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr)) ||
             memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr)) ||
             skb->mark != mark ||
-             ipv6_hdr(skb)->hop_limit != hop_limit))
+             ipv6_hdr(skb)->hop_limit != hop_limit ||
+             flowlabel != *((u_int32_t *)ipv6_hdr(skb))))
                return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
        return ret;
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index ff43461704be..4111050a9fc5 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -16,7 +16,6 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/icmp.h>
-#include <linux/sysctl.h>
 #include <net/ipv6.h>
 #include <net/inet_frag.h>
@@ -29,6 +28,7 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
+#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 #include <net/netfilter/nf_log.h>
 static bool ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
@@ -160,7 +160,7 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
        /* This is where we call the helper: as the packet goes out. */
        ct = nf_ct_get(skb, &ctinfo);
-        if (!ct || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY)
+        if (!ct || ctinfo == IP_CT_RELATED_REPLY)
                goto out;
        help = nfct_help(ct);
@@ -189,53 +189,6 @@ out:
        return nf_conntrack_confirm(skb);
 }
-static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
-                                                struct sk_buff *skb)
-{
-        u16 zone = NF_CT_DEFAULT_ZONE;
-        if (skb->nfct)
-                zone = nf_ct_zone((struct nf_conn *)skb->nfct);
-#ifdef CONFIG_BRIDGE_NETFILTER
-        if (skb->nf_bridge &&
-            skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
-                return IP6_DEFRAG_CONNTRACK_BRIDGE_IN + zone;
-#endif
-        if (hooknum == NF_INET_PRE_ROUTING)
-                return IP6_DEFRAG_CONNTRACK_IN + zone;
-        else
-                return IP6_DEFRAG_CONNTRACK_OUT + zone;
-}
-static unsigned int ipv6_defrag(unsigned int hooknum,
-                                struct sk_buff *skb,
-                                const struct net_device *in,
-                                const struct net_device *out,
-                                int (*okfn)(struct sk_buff *))
-{
-        struct sk_buff *reasm;
-        /* Previously seen (loopback)?  */
-        if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
-                return NF_ACCEPT;
-        reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb));
-        /* queued */
-        if (reasm == NULL)
-                return NF_STOLEN;
-        /* error occured or not fragmented */
-        if (reasm == skb)
-                return NF_ACCEPT;
-        nf_ct_frag6_output(hooknum, reasm, (struct net_device *)in,
-                           (struct net_device *)out, okfn);
-        return NF_STOLEN;
-}
 static unsigned int __ipv6_conntrack_in(struct net *net,
                                        unsigned int hooknum,
                                        struct sk_buff *skb,
@@ -288,13 +241,6 @@ static unsigned int ipv6_conntrack_local(unsigned int hooknum,
 static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
        {
-                .hook           = ipv6_defrag,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_PRE_ROUTING,
-                .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
-        },
-        {
                .hook           = ipv6_conntrack_in,
                .owner          = THIS_MODULE,
                .pf             = NFPROTO_IPV6,
@@ -309,13 +255,6 @@ static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
                .priority       = NF_IP6_PRI_CONNTRACK,
        },
        {
-                .hook           = ipv6_defrag,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
-        },
-        {
                .hook           = ipv6_confirm,
                .owner          = THIS_MODULE,
                .pf             = NFPROTO_IPV6,
@@ -387,10 +326,6 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = {
        .nlattr_to_tuple        = ipv6_nlattr_to_tuple,
        .nla_policy             = ipv6_nla_policy,
 #endif
-#ifdef CONFIG_SYSCTL
-        .ctl_table_path         = nf_net_netfilter_sysctl_path,
-        .ctl_table              = nf_ct_ipv6_sysctl_table,
-#endif
        .me                     = THIS_MODULE,
 };
@@ -403,16 +338,12 @@ static int __init nf_conntrack_l3proto_ipv6_init(void)
        int ret = 0;
        need_conntrack();
+        nf_defrag_ipv6_enable();
-        ret = nf_ct_frag6_init();
-        if (ret < 0) {
-                pr_err("nf_conntrack_ipv6: can't initialize frag6.\n");
-                return ret;
-        }
        ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_tcp6);
        if (ret < 0) {
                pr_err("nf_conntrack_ipv6: can't register tcp.\n");
-                goto cleanup_frag6;
+                return ret;
        }
        ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udp6);
@@ -450,8 +381,6 @@ static int __init nf_conntrack_l3proto_ipv6_init(void)
        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp6);
 cleanup_tcp:
        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
- cleanup_frag6:
-        nf_ct_frag6_cleanup();
        return ret;
 }
@@ -463,7 +392,6 @@ static void __exit nf_conntrack_l3proto_ipv6_fini(void)
        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp6);
        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
-        nf_ct_frag6_cleanup();
 }
 module_init(nf_conntrack_l3proto_ipv6_init);
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 1df3c8b6bf47..7c05e7eacbc6 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -177,7 +177,7 @@ icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
        /* Update skb to refer to this connection */
        skb->nfct = &nf_ct_tuplehash_to_ctrack(h)->ct_general;
        skb->nfctinfo = *ctinfo;
-        return -NF_ACCEPT;
+        return NF_ACCEPT;
 }
 static int
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 578f3c1a16db..085727263812 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -45,6 +45,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 struct nf_ct_frag6_skb_cb
@@ -73,7 +74,7 @@ static struct inet_frags nf_frags;
 static struct netns_frags nf_init_frags;
 #ifdef CONFIG_SYSCTL
-struct ctl_table nf_ct_ipv6_sysctl_table[] = {
+static struct ctl_table nf_ct_frag6_sysctl_table[] = {
        {
                .procname       = "nf_conntrack_frag6_timeout",
                .data           = &nf_init_frags.timeout,
@@ -97,6 +98,8 @@ struct ctl_table nf_ct_ipv6_sysctl_table[] = {
        },
        { }
 };
+static struct ctl_table_header *nf_ct_frag6_sysctl_header;
 #endif
 static unsigned int nf_hashfn(struct inet_frag_queue *q)
@@ -284,7 +287,7 @@ found:
        /* Check for overlap with preceding fragment. */
        if (prev &&
-            (NFCT_FRAG6_CB(prev)->offset + prev->len) - offset > 0)
+            (NFCT_FRAG6_CB(prev)->offset + prev->len) > offset)
                goto discard_fq;
        /* Look for overlap with succeeding segment. */
@@ -363,7 +366,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
        /* If the first fragment is fragmented itself, we split
         * it to two chunks: the first with data and paged part
         * and the second, holding only fragments. */
-        if (skb_has_frags(head)) {
+        if (skb_has_frag_list(head)) {
                struct sk_buff *clone;
                int i, plen = 0;
@@ -623,11 +626,24 @@ int nf_ct_frag6_init(void)
        inet_frags_init_net(&nf_init_frags);
        inet_frags_init(&nf_frags);
+#ifdef CONFIG_SYSCTL
+        nf_ct_frag6_sysctl_header = register_sysctl_paths(nf_net_netfilter_sysctl_path,
+                                                          nf_ct_frag6_sysctl_table);
+        if (!nf_ct_frag6_sysctl_header) {
+                inet_frags_fini(&nf_frags);
+                return -ENOMEM;
+        }
+#endif
        return 0;
 }
 void nf_ct_frag6_cleanup(void)
 {
+#ifdef CONFIG_SYSCTL
+        unregister_sysctl_table(nf_ct_frag6_sysctl_header);
+        nf_ct_frag6_sysctl_header = NULL;
+#endif
        inet_frags_fini(&nf_frags);
        nf_init_frags.low_thresh = 0;
diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
new file mode 100644
index 000000000000..cdd6d045e42e
--- /dev/null
+++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c
@@ -0,0 +1,137 @@
+/* (C) 1999-2001 Paul `Rusty' Russell
+ * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/types.h>
+#include <linux/ipv6.h>
+#include <linux/in6.h>
+#include <linux/netfilter.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/icmp.h>
+#include <linux/sysctl.h>
+#include <net/ipv6.h>
+#include <net/inet_frag.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netfilter_bridge.h>
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_helper.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
+#include <net/netfilter/nf_conntrack_l3proto.h>
+#include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
+#endif
+#include <net/netfilter/nf_conntrack_zones.h>
+#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
+static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
+                                                struct sk_buff *skb)
+{
+        u16 zone = NF_CT_DEFAULT_ZONE;
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+        if (skb->nfct)
+                zone = nf_ct_zone((struct nf_conn *)skb->nfct);
+#endif
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge &&
+            skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
+                return IP6_DEFRAG_CONNTRACK_BRIDGE_IN + zone;
+#endif
+        if (hooknum == NF_INET_PRE_ROUTING)
+                return IP6_DEFRAG_CONNTRACK_IN + zone;
+        else
+                return IP6_DEFRAG_CONNTRACK_OUT + zone;
+}
+static unsigned int ipv6_defrag(unsigned int hooknum,
+                                struct sk_buff *skb,
+                                const struct net_device *in,
+                                const struct net_device *out,
+                                int (*okfn)(struct sk_buff *))
+{
+        struct sk_buff *reasm;
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+        /* Previously seen (loopback)?  */
+        if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
+                return NF_ACCEPT;
+#endif
+        reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb));
+        /* queued */
+        if (reasm == NULL)
+                return NF_STOLEN;
+        /* error occurred or not fragmented */
+        if (reasm == skb)
+                return NF_ACCEPT;
+        nf_ct_frag6_output(hooknum, reasm, (struct net_device *)in,
+                           (struct net_device *)out, okfn);
+        return NF_STOLEN;
+}
+static struct nf_hook_ops ipv6_defrag_ops[] = {
+        {
+                .hook           = ipv6_defrag,
+                .owner          = THIS_MODULE,
+                .pf             = NFPROTO_IPV6,
+                .hooknum        = NF_INET_PRE_ROUTING,
+                .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
+        },
+        {
+                .hook           = ipv6_defrag,
+                .owner          = THIS_MODULE,
+                .pf             = NFPROTO_IPV6,
+                .hooknum        = NF_INET_LOCAL_OUT,
+                .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
+        },
+};
+static int __init nf_defrag_init(void)
+{
+        int ret = 0;
+        ret = nf_ct_frag6_init();
+        if (ret < 0) {
+                pr_err("nf_defrag_ipv6: can't initialize frag6.\n");
+                return ret;
+        }
+        ret = nf_register_hooks(ipv6_defrag_ops, ARRAY_SIZE(ipv6_defrag_ops));
+        if (ret < 0) {
+                pr_err("nf_defrag_ipv6: can't register hooks\n");
+                goto cleanup_frag6;
+        }
+        return ret;
+cleanup_frag6:
+        nf_ct_frag6_cleanup();
+        return ret;
+}
+static void __exit nf_defrag_fini(void)
+{
+        nf_unregister_hooks(ipv6_defrag_ops, ARRAY_SIZE(ipv6_defrag_ops));
+        nf_ct_frag6_cleanup();
+}
+void nf_defrag_ipv6_enable(void)
+{
+}
+EXPORT_SYMBOL_GPL(nf_defrag_ipv6_enable);
+module_init(nf_defrag_init);
+module_exit(nf_defrag_fini);
+MODULE_LICENSE("GPL");
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index d082eaeefa25..18ff5df7ec02 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -126,6 +126,8 @@ static const struct snmp_mib snmp6_udp6_list[] = {
        SNMP_MIB_ITEM("Udp6NoPorts", UDP_MIB_NOPORTS),
        SNMP_MIB_ITEM("Udp6InErrors", UDP_MIB_INERRORS),
        SNMP_MIB_ITEM("Udp6OutDatagrams", UDP_MIB_OUTDATAGRAMS),
+        SNMP_MIB_ITEM("Udp6RcvbufErrors", UDP_MIB_RCVBUFERRORS),
+        SNMP_MIB_ITEM("Udp6SndbufErrors", UDP_MIB_SNDBUFERRORS),
        SNMP_MIB_SENTINEL
 };
@@ -134,10 +136,16 @@ static const struct snmp_mib snmp6_udplite6_list[] = {
        SNMP_MIB_ITEM("UdpLite6NoPorts", UDP_MIB_NOPORTS),
        SNMP_MIB_ITEM("UdpLite6InErrors", UDP_MIB_INERRORS),
        SNMP_MIB_ITEM("UdpLite6OutDatagrams", UDP_MIB_OUTDATAGRAMS),
+        SNMP_MIB_ITEM("UdpLite6RcvbufErrors", UDP_MIB_RCVBUFERRORS),
+        SNMP_MIB_ITEM("UdpLite6SndbufErrors", UDP_MIB_SNDBUFERRORS),
        SNMP_MIB_SENTINEL
 };
-static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void __percpu **mib)
+/* can be called either with percpu mib (pcpumib != NULL),
+ * or shared one (smib != NULL)
+ */
+static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void __percpu **pcpumib,
+                                     atomic_long_t *smib)
 {
        char name[32];
        int i;
@@ -154,14 +162,14 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void __percpu **mib)
                snprintf(name, sizeof(name), "Icmp6%s%s",
                        i & 0x100 ? "Out" : "In", p);
                seq_printf(seq, "%-32s\t%lu\n", name,
-                        snmp_fold_field(mib, i));
+                        pcpumib ? snmp_fold_field(pcpumib, i) : atomic_long_read(smib + i));
        }
        /* print by number (nonzero only) - ICMPMsgStat format */
        for (i = 0; i < ICMP6MSG_MIB_MAX; i++) {
                unsigned long val;
-                val = snmp_fold_field(mib, i);
+                val = pcpumib ? snmp_fold_field(pcpumib, i) : atomic_long_read(smib + i);
                if (!val)
                        continue;
                snprintf(name, sizeof(name), "Icmp6%sType%u",
@@ -170,14 +178,22 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void __percpu **mib)
        }
 }
-static void snmp6_seq_show_item(struct seq_file *seq, void __percpu **mib,
+/* can be called either with percpu mib (pcpumib != NULL),
+ * or shared one (smib != NULL)
+ */
+static void snmp6_seq_show_item(struct seq_file *seq, void __percpu **pcpumib,
+                                atomic_long_t *smib,
                                const struct snmp_mib *itemlist)
 {
        int i;
+        unsigned long val;
-        for (i = 0; itemlist[i].name; i++)
+        for (i = 0; itemlist[i].name; i++) {
-                seq_printf(seq, "%-32s\t%lu\n", itemlist[i].name,
+                val = pcpumib ?
-                           snmp_fold_field(mib, itemlist[i].entry));
+                        snmp_fold_field(pcpumib, itemlist[i].entry) :
+                        atomic_long_read(smib + itemlist[i].entry);
+                seq_printf(seq, "%-32s\t%lu\n", itemlist[i].name, val);
+        }
 }
 static void snmp6_seq_show_item64(struct seq_file *seq, void __percpu **mib,
@@ -197,13 +213,13 @@ static int snmp6_seq_show(struct seq_file *seq, void *v)
        snmp6_seq_show_item64(seq, (void __percpu **)net->mib.ipv6_statistics,
                            snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp));
        snmp6_seq_show_item(seq, (void __percpu **)net->mib.icmpv6_statistics,
-                            snmp6_icmp6_list);
+                            NULL, snmp6_icmp6_list);
        snmp6_seq_show_icmpv6msg(seq,
-                            (void __percpu **)net->mib.icmpv6msg_statistics);
+                            (void __percpu **)net->mib.icmpv6msg_statistics, NULL);
        snmp6_seq_show_item(seq, (void __percpu **)net->mib.udp_stats_in6,
-                            snmp6_udp6_list);
+                            NULL, snmp6_udp6_list);
        snmp6_seq_show_item(seq, (void __percpu **)net->mib.udplite_stats_in6,
-                            snmp6_udplite6_list);
+                            NULL, snmp6_udplite6_list);
        return 0;
 }
@@ -225,11 +241,11 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v)
        struct inet6_dev *idev = (struct inet6_dev *)seq->private;
        seq_printf(seq, "%-32s\t%u\n", "ifIndex", idev->dev->ifindex);
-        snmp6_seq_show_item(seq, (void __percpu **)idev->stats.ipv6,
+        snmp6_seq_show_item(seq, (void __percpu **)idev->stats.ipv6, NULL,
                            snmp6_ipstats_list);
-        snmp6_seq_show_item(seq, (void __percpu **)idev->stats.icmpv6,
+        snmp6_seq_show_item(seq, NULL, idev->stats.icmpv6dev->mibs,
                            snmp6_icmp6_list);
-        snmp6_seq_show_icmpv6msg(seq, (void __percpu **)idev->stats.icmpv6msg);
+        snmp6_seq_show_icmpv6msg(seq, NULL, idev->stats.icmpv6msgdev->mibs);
        return 0;
 }
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index 1fa3468f0f32..9a7978fdc02a 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -25,28 +25,15 @@
 #include <linux/spinlock.h>
 #include <net/protocol.h>
-const struct inet6_protocol *inet6_protos[MAX_INET_PROTOS];
+const struct inet6_protocol __rcu *inet6_protos[MAX_INET_PROTOS] __read_mostly;
-static DEFINE_SPINLOCK(inet6_proto_lock);
 int inet6_add_protocol(const struct inet6_protocol *prot, unsigned char protocol)
 {
-        int ret, hash = protocol & (MAX_INET_PROTOS - 1);
+        int hash = protocol & (MAX_INET_PROTOS - 1);
-        spin_lock_bh(&inet6_proto_lock);
-        if (inet6_protos[hash]) {
-                ret = -1;
-        } else {
-                inet6_protos[hash] = prot;
-                ret = 0;
-        }
-        spin_unlock_bh(&inet6_proto_lock);
-        return ret;
+        return !cmpxchg((const struct inet6_protocol **)&inet6_protos[hash],
+                        NULL, prot) ? 0 : -1;
 }
 EXPORT_SYMBOL(inet6_add_protocol);
 /*
@@ -57,20 +44,11 @@ int inet6_del_protocol(const struct inet6_protocol *prot, unsigned char protocol
 {
        int ret, hash = protocol & (MAX_INET_PROTOS - 1);
-        spin_lock_bh(&inet6_proto_lock);
+        ret = (cmpxchg((const struct inet6_protocol **)&inet6_protos[hash],
+                       prot, NULL) == prot) ? 0 : -1;
-        if (inet6_protos[hash] != prot) {
-                ret = -1;
-        } else {
-                inet6_protos[hash] = NULL;
-                ret = 0;
-        }
-        spin_unlock_bh(&inet6_proto_lock);
        synchronize_net();
        return ret;
 }
 EXPORT_SYMBOL(inet6_del_protocol);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e677937a07fc..cc7313b8f7ea 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -31,6 +31,7 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/skbuff.h>
+#include <linux/compat.h>
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
@@ -66,8 +67,8 @@ static struct raw_hashinfo raw_v6_hashinfo = {
 };
 static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
-                unsigned short num, struct in6_addr *loc_addr,
+                unsigned short num, const struct in6_addr *loc_addr,
-                struct in6_addr *rmt_addr, int dif)
+                const struct in6_addr *rmt_addr, int dif)
 {
        struct hlist_node *node;
        int is_multicast = ipv6_addr_is_multicast(loc_addr);
@@ -123,18 +124,18 @@ static __inline__ int icmpv6_filter(struct sock *sk, struct sk_buff *skb)
 }
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-static int (*mh_filter)(struct sock *sock, struct sk_buff *skb);
+typedef int mh_filter_t(struct sock *sock, struct sk_buff *skb);
-int rawv6_mh_filter_register(int (*filter)(struct sock *sock,
+static mh_filter_t __rcu *mh_filter __read_mostly;
-                                           struct sk_buff *skb))
+int rawv6_mh_filter_register(mh_filter_t filter)
 {
        rcu_assign_pointer(mh_filter, filter);
        return 0;
 }
 EXPORT_SYMBOL(rawv6_mh_filter_register);
-int rawv6_mh_filter_unregister(int (*filter)(struct sock *sock,
+int rawv6_mh_filter_unregister(mh_filter_t filter)
-                                             struct sk_buff *skb))
 {
        rcu_assign_pointer(mh_filter, NULL);
        synchronize_rcu();
@@ -153,8 +154,8 @@ EXPORT_SYMBOL(rawv6_mh_filter_unregister);
 */
 static int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
 {
-        struct in6_addr *saddr;
+        const struct in6_addr *saddr;
-        struct in6_addr *daddr;
+        const struct in6_addr *daddr;
        struct sock *sk;
        int delivered = 0;
        __u8 hash;
@@ -192,10 +193,10 @@ static int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
                         * policy is placed in rawv6_rcv() because it is
                         * required for each socket.
                         */
-                        int (*filter)(struct sock *sock, struct sk_buff *skb);
+                        mh_filter_t *filter;
                        filter = rcu_dereference(mh_filter);
-                        filtered = filter ? filter(sk, skb) : 0;
+                        filtered = filter ? (*filter)(sk, skb) : 0;
                        break;
                }
 #endif
@@ -347,7 +348,7 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
 {
        struct sock *sk;
        int hash;
-        struct in6_addr *saddr, *daddr;
+        const struct in6_addr *saddr, *daddr;
        struct net *net;
        hash = nexthdr & (RAW_HTABLE_SIZE - 1);
@@ -356,7 +357,7 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
        sk = sk_head(&raw_v6_hashinfo.ht[hash]);
        if (sk != NULL) {
                /* Note: ipv6_hdr(skb) != skb->data */
-                struct ipv6hdr *ip6h = (struct ipv6hdr *)skb->data;
+                const struct ipv6hdr *ip6h = (const struct ipv6hdr *)skb->data;
                saddr = &ip6h->saddr;
                daddr = &ip6h->daddr;
                net = dev_net(skb->dev);
@@ -373,7 +374,7 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
 static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
 {
-        if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
+        if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
            skb_checksum_complete(skb)) {
                atomic_inc(&sk->sk_drops);
                kfree_skb(skb);
@@ -523,7 +524,7 @@ csum_copy_err:
        goto out;
 }
-static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
+static int rawv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
                                     struct raw6_sock *rp)
 {
        struct sk_buff *skb;
@@ -541,8 +542,8 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                goto out;
        offset = rp->offset;
-        total_len = inet_sk(sk)->cork.length - (skb_network_header(skb) -
+        total_len = inet_sk(sk)->cork.base.length - (skb_network_header(skb) -
-                                                skb->data);
+                                                     skb->data);
        if (offset >= total_len - 1) {
                err = -EINVAL;
                ip6_flush_pending_frames(sk);
@@ -585,11 +586,10 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
        if (unlikely(csum))
                tmp_csum = csum_sub(tmp_csum, csum_unfold(csum));
-        csum = csum_ipv6_magic(&fl->fl6_src,
+        csum = csum_ipv6_magic(&fl6->saddr, &fl6->daddr,
-                                   &fl->fl6_dst,
+                               total_len, fl6->flowi6_proto, tmp_csum);
-                                   total_len, fl->proto, tmp_csum);
-        if (csum == 0 && fl->proto == IPPROTO_UDP)
+        if (csum == 0 && fl6->flowi6_proto == IPPROTO_UDP)
                csum = CSUM_MANGLED_0;
        if (skb_store_bits(skb, offset, &csum, 2))
@@ -602,7 +602,7 @@ out:
 }
 static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
-                        struct flowi *fl, struct dst_entry **dstp,
+                        struct flowi6 *fl6, struct dst_entry **dstp,
                        unsigned int flags)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
@@ -612,7 +612,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
        struct rt6_info *rt = (struct rt6_info *)*dstp;
        if (length > rt->dst.dev->mtu) {
-                ipv6_local_error(sk, EMSGSIZE, fl, rt->dst.dev->mtu);
+                ipv6_local_error(sk, EMSGSIZE, fl6, rt->dst.dev->mtu);
                return -EMSGSIZE;
        }
        if (flags&MSG_PROBE)
@@ -661,7 +661,7 @@ error:
        return err;
 }
-static int rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
+static int rawv6_probe_proto_opt(struct flowi6 *fl6, struct msghdr *msg)
 {
        struct iovec *iov;
        u8 __user *type = NULL;
@@ -678,7 +678,7 @@ static int rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                if (!iov)
                        continue;
-                switch (fl->proto) {
+                switch (fl6->flowi6_proto) {
                case IPPROTO_ICMPV6:
                        /* check if one-byte field is readable or not. */
                        if (iov->iov_base && iov->iov_len < 1)
@@ -693,8 +693,8 @@ static int rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                                code = iov->iov_base;
                        if (type && code) {
-                                if (get_user(fl->fl_icmp_type, type) ||
+                                if (get_user(fl6->fl6_icmp_type, type) ||
-                                    get_user(fl->fl_icmp_code, code))
+                                    get_user(fl6->fl6_icmp_code, code))
                                        return -EFAULT;
                                probed = 1;
                        }
@@ -705,7 +705,7 @@ static int rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                        /* check if type field is readable or not. */
                        if (iov->iov_len > 2 - len) {
                                u8 __user *p = iov->iov_base;
-                                if (get_user(fl->fl_mh_type, &p[2 - len]))
+                                if (get_user(fl6->fl6_mh_type, &p[2 - len]))
                                        return -EFAULT;
                                probed = 1;
                        } else
@@ -734,7 +734,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
        struct ipv6_txoptions *opt = NULL;
        struct ip6_flowlabel *flowlabel = NULL;
        struct dst_entry *dst = NULL;
-        struct flowi fl;
+        struct flowi6 fl6;
        int addr_len = msg->msg_namelen;
        int hlimit = -1;
        int tclass = -1;
@@ -755,16 +755,16 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
        /*
         *      Get and verify the address.
         */
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
-        fl.mark = sk->sk_mark;
+        fl6.flowi6_mark = sk->sk_mark;
        if (sin6) {
                if (addr_len < SIN6_LEN_RFC2133)
                        return -EINVAL;
                if (sin6->sin6_family && sin6->sin6_family != AF_INET6)
-                        return(-EAFNOSUPPORT);
+                        return -EAFNOSUPPORT;
                /* port is the proto value [0..255] carried in nexthdr */
                proto = ntohs(sin6->sin6_port);
@@ -772,16 +772,16 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                if (!proto)
                        proto = inet->inet_num;
                else if (proto != inet->inet_num)
-                        return(-EINVAL);
+                        return -EINVAL;
                if (proto > 255)
-                        return(-EINVAL);
+                        return -EINVAL;
                daddr = &sin6->sin6_addr;
                if (np->sndflow) {
-                        fl.fl6_flowlabel = sin6->sin6_flowinfo&IPV6_FLOWINFO_MASK;
+                        fl6.flowlabel = sin6->sin6_flowinfo&IPV6_FLOWINFO_MASK;
-                        if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
+                        if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
-                                flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
+                                flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                if (flowlabel == NULL)
                                        return -EINVAL;
                                daddr = &flowlabel->dst;
@@ -799,32 +799,32 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                if (addr_len >= sizeof(struct sockaddr_in6) &&
                    sin6->sin6_scope_id &&
                    ipv6_addr_type(daddr)&IPV6_ADDR_LINKLOCAL)
-                        fl.oif = sin6->sin6_scope_id;
+                        fl6.flowi6_oif = sin6->sin6_scope_id;
        } else {
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -EDESTADDRREQ;
                proto = inet->inet_num;
                daddr = &np->daddr;
-                fl.fl6_flowlabel = np->flow_label;
+                fl6.flowlabel = np->flow_label;
        }
-        if (fl.oif == 0)
+        if (fl6.flowi6_oif == 0)
-                fl.oif = sk->sk_bound_dev_if;
+                fl6.flowi6_oif = sk->sk_bound_dev_if;
        if (msg->msg_controllen) {
                opt = &opt_space;
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(struct ipv6_txoptions);
-                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit,
+                err = datagram_send_ctl(sock_net(sk), msg, &fl6, opt, &hlimit,
                                        &tclass, &dontfrag);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
                }
-                if ((fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) && !flowlabel) {
+                if ((fl6.flowlabel&IPV6_FLOWLABEL_MASK) && !flowlabel) {
-                        flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
+                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (flowlabel == NULL)
                                return -EINVAL;
                }
@@ -837,40 +837,31 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                opt = fl6_merge_options(&opt_space, flowlabel, opt);
        opt = ipv6_fixup_options(&opt_space, opt);
-        fl.proto = proto;
+        fl6.flowi6_proto = proto;
-        err = rawv6_probe_proto_opt(&fl, msg);
+        err = rawv6_probe_proto_opt(&fl6, msg);
        if (err)
                goto out;
        if (!ipv6_addr_any(daddr))
-                ipv6_addr_copy(&fl.fl6_dst, daddr);
+                ipv6_addr_copy(&fl6.daddr, daddr);
        else
-                fl.fl6_dst.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
+                fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
-        if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
+        if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
-                ipv6_addr_copy(&fl.fl6_src, &np->saddr);
+                ipv6_addr_copy(&fl6.saddr, &np->saddr);
-        final_p = fl6_update_dst(&fl, opt, &final);
+        final_p = fl6_update_dst(&fl6, opt, &final);
-        if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
+        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
-                fl.oif = np->mcast_oif;
+                fl6.flowi6_oif = np->mcast_oif;
-        security_sk_classify_flow(sk, &fl);
+        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-        err = ip6_dst_lookup(sk, &dst, &fl);
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
-        if (err)
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
                goto out;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
-        if (err < 0) {
-                if (err == -EREMOTE)
-                        err = ip6_dst_blackhole(sk, &dst, &fl);
-                if (err < 0)
-                        goto out;
        }
        if (hlimit < 0) {
-                if (ipv6_addr_is_multicast(&fl.fl6_dst))
+                if (ipv6_addr_is_multicast(&fl6.daddr))
                        hlimit = np->mcast_hops;
                else
                        hlimit = np->hop_limit;
@@ -889,17 +880,17 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
 back_from_confirm:
        if (inet->hdrincl)
-                err = rawv6_send_hdrinc(sk, msg->msg_iov, len, &fl, &dst, msg->msg_flags);
+                err = rawv6_send_hdrinc(sk, msg->msg_iov, len, &fl6, &dst, msg->msg_flags);
        else {
                lock_sock(sk);
                err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov,
-                        len, 0, hlimit, tclass, opt, &fl, (struct rt6_info*)dst,
+                        len, 0, hlimit, tclass, opt, &fl6, (struct rt6_info*)dst,
                        msg->msg_flags, dontfrag);
                if (err)
                        ip6_flush_pending_frames(sk);
                else if (!(msg->msg_flags & MSG_MORE))
-                        err = rawv6_push_pending_frames(sk, &fl, rp);
+                        err = rawv6_push_pending_frames(sk, &fl6, rp);
                release_sock(sk);
        }
 done:
@@ -985,7 +976,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
                        /* You may get strange result with a positive odd offset;
                           RFC2292bis agrees with me. */
                        if (val > 0 && (val&1))
-                                return(-EINVAL);
+                                return -EINVAL;
                        if (val < 0) {
                                rp->checksum = 0;
                        } else {
@@ -997,7 +988,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
                        break;
                default:
-                        return(-ENOPROTOOPT);
+                        return -ENOPROTOOPT;
        }
 }
@@ -1157,6 +1148,23 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
        }
 }
+#ifdef CONFIG_COMPAT
+static int compat_rawv6_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
+{
+        switch (cmd) {
+        case SIOCOUTQ:
+        case SIOCINQ:
+                return -ENOIOCTLCMD;
+        default:
+#ifdef CONFIG_IPV6_MROUTE
+                return ip6mr_compat_ioctl(sk, cmd, compat_ptr(arg));
+#else
+                return -ENOIOCTLCMD;
+#endif
+        }
+}
+#endif
 static void rawv6_close(struct sock *sk, long timeout)
 {
        if (inet_sk(sk)->inet_num == IPPROTO_RAW)
@@ -1190,7 +1198,7 @@ static int rawv6_init_sk(struct sock *sk)
        default:
                break;
        }
-        return(0);
+        return 0;
 }
 struct proto rawv6_prot = {
@@ -1215,6 +1223,7 @@ struct proto rawv6_prot = {
 #ifdef CONFIG_COMPAT
        .compat_setsockopt = compat_rawv6_setsockopt,
        .compat_getsockopt = compat_rawv6_getsockopt,
+        .compat_ioctl      = compat_rawv6_ioctl,
 #endif
 };
@@ -1222,7 +1231,7 @@ struct proto rawv6_prot = {
 static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
 {
        struct ipv6_pinfo *np = inet6_sk(sp);
-        struct in6_addr *dest, *src;
+        const struct in6_addr *dest, *src;
        __u16 destp, srcp;
        dest  = &np->daddr;
@@ -1231,7 +1240,7 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
        srcp  = inet_sk(sp)->inet_num;
        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
                   i,
                   src->s6_addr32[0], src->s6_addr32[1],
                   src->s6_addr32[2], src->s6_addr32[3], srcp,
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 64cfef1b0a4c..7b954e2539d0 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -104,26 +104,22 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
 unsigned int inet6_hash_frag(__be32 id, const struct in6_addr *saddr,
                             const struct in6_addr *daddr, u32 rnd)
 {
-        u32 a, b, c;
+        u32 c;
-        a = (__force u32)saddr->s6_addr32[0];
+        c = jhash_3words((__force u32)saddr->s6_addr32[0],
-        b = (__force u32)saddr->s6_addr32[1];
+                         (__force u32)saddr->s6_addr32[1],
-        c = (__force u32)saddr->s6_addr32[2];
+                         (__force u32)saddr->s6_addr32[2],
+                         rnd);
-        a += JHASH_GOLDEN_RATIO;
+        c = jhash_3words((__force u32)saddr->s6_addr32[3],
-        b += JHASH_GOLDEN_RATIO;
+                         (__force u32)daddr->s6_addr32[0],
-        c += rnd;
+                         (__force u32)daddr->s6_addr32[1],
-        __jhash_mix(a, b, c);
+                         c);
-        a += (__force u32)saddr->s6_addr32[3];
+        c =  jhash_3words((__force u32)daddr->s6_addr32[2],
-        b += (__force u32)daddr->s6_addr32[0];
+                          (__force u32)daddr->s6_addr32[3],
-        c += (__force u32)daddr->s6_addr32[1];
+                          (__force u32)id,
-        __jhash_mix(a, b, c);
+                          c);
-        a += (__force u32)daddr->s6_addr32[2];
-        b += (__force u32)daddr->s6_addr32[3];
-        c += (__force u32)id;
-        __jhash_mix(a, b, c);
        return c & (INETFRAGS_HASHSZ - 1);
 }
@@ -228,7 +224,7 @@ out:
 }
 static __inline__ struct frag_queue *
-fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst)
+fq_find(struct net *net, __be32 id, const struct in6_addr *src, const struct in6_addr *dst)
 {
        struct inet_frag_queue *q;
        struct ip6_create_arg arg;
@@ -349,7 +345,7 @@ found:
        /* Check for overlap with preceding fragment. */
        if (prev &&
-            (FRAG6_CB(prev)->offset + prev->len) - offset > 0)
+            (FRAG6_CB(prev)->offset + prev->len) > offset)
                goto discard_fq;
        /* Look for overlap with succeeding segment. */
@@ -458,7 +454,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
        /* If the first fragment is fragmented itself, we split
         * it to two chunks: the first with data and paged part
         * and the second, holding only fragments. */
-        if (skb_has_frags(head)) {
+        if (skb_has_frag_list(head)) {
                struct sk_buff *clone;
                int i, plen = 0;
@@ -539,7 +535,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
 {
        struct frag_hdr *fhdr;
        struct frag_queue *fq;
-        struct ipv6hdr *hdr = ipv6_hdr(skb);
+        const struct ipv6hdr *hdr = ipv6_hdr(skb);
        struct net *net = dev_net(skb_dst(skb)->dev);
        IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a275c6e1e25c..0ef1f086feb8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -72,10 +72,10 @@
 #define RT6_TRACE(x...) do { ; } while (0)
 #endif
-#define CLONE_OFFLINK_ROUTE 0
 static struct rt6_info * ip6_rt_copy(struct rt6_info *ort);
 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
+static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
+static unsigned int      ip6_default_mtu(const struct dst_entry *dst);
 static struct dst_entry *ip6_negative_advice(struct dst_entry *);
 static void             ip6_dst_destroy(struct dst_entry *);
 static void             ip6_dst_ifdown(struct dst_entry *,
@@ -89,40 +89,89 @@ static void		ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
 #ifdef CONFIG_IPV6_ROUTE_INFO
 static struct rt6_info *rt6_add_route_info(struct net *net,
-                                           struct in6_addr *prefix, int prefixlen,
+                                           const struct in6_addr *prefix, int prefixlen,
-                                           struct in6_addr *gwaddr, int ifindex,
+                                           const struct in6_addr *gwaddr, int ifindex,
                                           unsigned pref);
 static struct rt6_info *rt6_get_route_info(struct net *net,
-                                           struct in6_addr *prefix, int prefixlen,
+                                           const struct in6_addr *prefix, int prefixlen,
-                                           struct in6_addr *gwaddr, int ifindex);
+                                           const struct in6_addr *gwaddr, int ifindex);
 #endif
+static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
+{
+        struct rt6_info *rt = (struct rt6_info *) dst;
+        struct inet_peer *peer;
+        u32 *p = NULL;
+        if (!rt->rt6i_peer)
+                rt6_bind_peer(rt, 1);
+        peer = rt->rt6i_peer;
+        if (peer) {
+                u32 *old_p = __DST_METRICS_PTR(old);
+                unsigned long prev, new;
+                p = peer->metrics;
+                if (inet_metrics_new(peer))
+                        memcpy(p, old_p, sizeof(u32) * RTAX_MAX);
+                new = (unsigned long) p;
+                prev = cmpxchg(&dst->_metrics, old, new);
+                if (prev != old) {
+                        p = __DST_METRICS_PTR(prev);
+                        if (prev & DST_METRICS_READ_ONLY)
+                                p = NULL;
+                }
+        }
+        return p;
+}
 static struct dst_ops ip6_dst_ops_template = {
        .family                 =       AF_INET6,
        .protocol               =       cpu_to_be16(ETH_P_IPV6),
        .gc                     =       ip6_dst_gc,
        .gc_thresh              =       1024,
        .check                  =       ip6_dst_check,
+        .default_advmss         =       ip6_default_advmss,
+        .default_mtu            =       ip6_default_mtu,
+        .cow_metrics            =       ipv6_cow_metrics,
        .destroy                =       ip6_dst_destroy,
        .ifdown                 =       ip6_dst_ifdown,
        .negative_advice        =       ip6_negative_advice,
        .link_failure           =       ip6_link_failure,
        .update_pmtu            =       ip6_rt_update_pmtu,
        .local_out              =       __ip6_local_out,
-        .entries                =       ATOMIC_INIT(0),
 };
+static unsigned int ip6_blackhole_default_mtu(const struct dst_entry *dst)
+{
+        return 0;
+}
 static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
 {
 }
+static u32 *ip6_rt_blackhole_cow_metrics(struct dst_entry *dst,
+                                         unsigned long old)
+{
+        return NULL;
+}
 static struct dst_ops ip6_dst_blackhole_ops = {
        .family                 =       AF_INET6,
        .protocol               =       cpu_to_be16(ETH_P_IPV6),
        .destroy                =       ip6_dst_destroy,
        .check                  =       ip6_dst_check,
+        .default_mtu            =       ip6_blackhole_default_mtu,
+        .default_advmss         =       ip6_default_advmss,
        .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
-        .entries                =       ATOMIC_INIT(0),
+        .cow_metrics            =       ip6_rt_blackhole_cow_metrics,
+};
+static const u32 ip6_template_metrics[RTAX_MAX] = {
+        [RTAX_HOPLIMIT - 1] = 255,
 };
 static struct rt6_info ip6_null_entry_template = {
@@ -131,7 +180,6 @@ static struct rt6_info ip6_null_entry_template = {
                .__use          = 1,
                .obsolete       = -1,
                .error          = -ENETUNREACH,
-                .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
                .input          = ip6_pkt_discard,
                .output         = ip6_pkt_discard_out,
        },
@@ -152,7 +200,6 @@ static struct rt6_info ip6_prohibit_entry_template = {
                .__use          = 1,
                .obsolete       = -1,
                .error          = -EACCES,
-                .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
                .input          = ip6_pkt_prohibit,
                .output         = ip6_pkt_prohibit_out,
        },
@@ -168,7 +215,6 @@ static struct rt6_info ip6_blk_hole_entry_template = {
                .__use          = 1,
                .obsolete       = -1,
                .error          = -EINVAL,
-                .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
                .input          = dst_discard,
                .output         = dst_discard,
        },
@@ -181,20 +227,49 @@ static struct rt6_info ip6_blk_hole_entry_template = {
 #endif
 /* allocate dst with ip6_dst_ops */
-static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops)
+static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops,
+                                             struct net_device *dev,
+                                             int flags)
 {
-        return (struct rt6_info *)dst_alloc(ops);
+        struct rt6_info *rt = dst_alloc(ops, dev, 0, 0, flags);
+        memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
+        return rt;
 }
 static void ip6_dst_destroy(struct dst_entry *dst)
 {
        struct rt6_info *rt = (struct rt6_info *)dst;
        struct inet6_dev *idev = rt->rt6i_idev;
+        struct inet_peer *peer = rt->rt6i_peer;
        if (idev != NULL) {
                rt->rt6i_idev = NULL;
                in6_dev_put(idev);
        }
+        if (peer) {
+                rt->rt6i_peer = NULL;
+                inet_putpeer(peer);
+        }
+}
+static atomic_t __rt6_peer_genid = ATOMIC_INIT(0);
+static u32 rt6_peer_genid(void)
+{
+        return atomic_read(&__rt6_peer_genid);
+}
+void rt6_bind_peer(struct rt6_info *rt, int create)
+{
+        struct inet_peer *peer;
+        peer = inet_getpeer_v6(&rt->rt6i_dst.addr, create);
+        if (peer && cmpxchg(&rt->rt6i_peer, NULL, peer) != NULL)
+                inet_putpeer(peer);
+        else
+                rt->rt6i_peer_genid = rt6_peer_genid();
 }
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
@@ -217,14 +292,14 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 static __inline__ int rt6_check_expired(const struct rt6_info *rt)
 {
-        return (rt->rt6i_flags & RTF_EXPIRES &&
+        return (rt->rt6i_flags & RTF_EXPIRES) &&
-                time_after(jiffies, rt->rt6i_expires));
+                time_after(jiffies, rt->rt6i_expires);
 }
-static inline int rt6_need_strict(struct in6_addr *daddr)
+static inline int rt6_need_strict(const struct in6_addr *daddr)
 {
-        return (ipv6_addr_type(daddr) &
+        return ipv6_addr_type(daddr) &
-                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK));
+                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
 }
 /*
@@ -233,7 +308,7 @@ static inline int rt6_need_strict(struct in6_addr *daddr)
 static inline struct rt6_info *rt6_device_match(struct net *net,
                                                    struct rt6_info *rt,
-                                                    struct in6_addr *saddr,
+                                                    const struct in6_addr *saddr,
                                                    int oif,
                                                    int flags)
 {
@@ -440,12 +515,12 @@ static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
                  __func__, match);
        net = dev_net(rt0->rt6i_dev);
-        return (match ? match : net->ipv6.ip6_null_entry);
+        return match ? match : net->ipv6.ip6_null_entry;
 }
 #ifdef CONFIG_IPV6_ROUTE_INFO
 int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
-                  struct in6_addr *gwaddr)
+                  const struct in6_addr *gwaddr)
 {
        struct net *net = dev_net(dev);
        struct route_info *rinfo = (struct route_info *) opt;
@@ -537,17 +612,17 @@ do { \
 static struct rt6_info *ip6_pol_route_lookup(struct net *net,
                                             struct fib6_table *table,
-                                             struct flowi *fl, int flags)
+                                             struct flowi6 *fl6, int flags)
 {
        struct fib6_node *fn;
        struct rt6_info *rt;
        read_lock_bh(&table->tb6_lock);
-        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
+        fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
 restart:
        rt = fn->leaf;
-        rt = rt6_device_match(net, rt, &fl->fl6_src, fl->oif, flags);
+        rt = rt6_device_match(net, rt, &fl6->saddr, fl6->flowi6_oif, flags);
-        BACKTRACK(net, &fl->fl6_src);
+        BACKTRACK(net, &fl6->saddr);
 out:
        dst_use(&rt->dst, jiffies);
        read_unlock_bh(&table->tb6_lock);
@@ -558,23 +633,19 @@ out:
 struct rt6_info *rt6_lookup(struct net *net, const struct in6_addr *daddr,
                            const struct in6_addr *saddr, int oif, int strict)
 {
-        struct flowi fl = {
+        struct flowi6 fl6 = {
-                .oif = oif,
+                .flowi6_oif = oif,
-                .nl_u = {
+                .daddr = *daddr,
-                        .ip6_u = {
-                                .daddr = *daddr,
-                        },
-                },
        };
        struct dst_entry *dst;
        int flags = strict ? RT6_LOOKUP_F_IFACE : 0;
        if (saddr) {
-                memcpy(&fl.fl6_src, saddr, sizeof(*saddr));
+                memcpy(&fl6.saddr, saddr, sizeof(*saddr));
                flags |= RT6_LOOKUP_F_HAS_SADDR;
        }
-        dst = fib6_rule_lookup(net, &fl, flags, ip6_pol_route_lookup);
+        dst = fib6_rule_lookup(net, &fl6, flags, ip6_pol_route_lookup);
        if (dst->error == 0)
                return (struct rt6_info *) dst;
@@ -612,8 +683,8 @@ int ip6_ins_rt(struct rt6_info *rt)
        return __ip6_ins_rt(rt, &info);
 }
-static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, struct in6_addr *daddr,
+static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, const struct in6_addr *daddr,
-                                      struct in6_addr *saddr)
+                                      const struct in6_addr *saddr)
 {
        struct rt6_info *rt;
@@ -681,7 +752,7 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, struct in6_addr *dad
        return rt;
 }
-static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, struct in6_addr *daddr)
+static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, const struct in6_addr *daddr)
 {
        struct rt6_info *rt = ip6_rt_copy(ort);
        if (rt) {
@@ -695,7 +766,7 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, struct in6_addr *d
 }
 static struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, int oif,
-                                      struct flowi *fl, int flags)
+                                      struct flowi6 *fl6, int flags)
 {
        struct fib6_node *fn;
        struct rt6_info *rt, *nrt;
@@ -710,12 +781,12 @@ relookup:
        read_lock_bh(&table->tb6_lock);
 restart_2:
-        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
+        fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
 restart:
        rt = rt6_select(fn, oif, strict | reachable);
-        BACKTRACK(net, &fl->fl6_src);
+        BACKTRACK(net, &fl6->saddr);
        if (rt == net->ipv6.ip6_null_entry ||
            rt->rt6i_flags & RTF_CACHE)
                goto out;
@@ -724,14 +795,11 @@ restart:
        read_unlock_bh(&table->tb6_lock);
        if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
-                nrt = rt6_alloc_cow(rt, &fl->fl6_dst, &fl->fl6_src);
+                nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
-        else {
+        else if (!(rt->dst.flags & DST_HOST))
-#if CLONE_OFFLINK_ROUTE
+                nrt = rt6_alloc_clone(rt, &fl6->daddr);
-                nrt = rt6_alloc_clone(rt, &fl->fl6_dst);
+        else
-#else
                goto out2;
-#endif
-        }
        dst_release(&rt->dst);
        rt = nrt ? : net->ipv6.ip6_null_entry;
@@ -768,78 +836,71 @@ out2:
 }
 static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *table,
-                                            struct flowi *fl, int flags)
+                                            struct flowi6 *fl6, int flags)
 {
-        return ip6_pol_route(net, table, fl->iif, fl, flags);
+        return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags);
 }
 void ip6_route_input(struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
        struct net *net = dev_net(skb->dev);
        int flags = RT6_LOOKUP_F_HAS_SADDR;
-        struct flowi fl = {
+        struct flowi6 fl6 = {
-                .iif = skb->dev->ifindex,
+                .flowi6_iif = skb->dev->ifindex,
-                .nl_u = {
+                .daddr = iph->daddr,
-                        .ip6_u = {
+                .saddr = iph->saddr,
-                                .daddr = iph->daddr,
+                .flowlabel = (* (__be32 *) iph)&IPV6_FLOWINFO_MASK,
-                                .saddr = iph->saddr,
+                .flowi6_mark = skb->mark,
-                                .flowlabel = (* (__be32 *) iph)&IPV6_FLOWINFO_MASK,
+                .flowi6_proto = iph->nexthdr,
-                        },
-                },
-                .mark = skb->mark,
-                .proto = iph->nexthdr,
        };
        if (rt6_need_strict(&iph->daddr) && skb->dev->type != ARPHRD_PIMREG)
                flags |= RT6_LOOKUP_F_IFACE;
-        skb_dst_set(skb, fib6_rule_lookup(net, &fl, flags, ip6_pol_route_input));
+        skb_dst_set(skb, fib6_rule_lookup(net, &fl6, flags, ip6_pol_route_input));
 }
 static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
-                                             struct flowi *fl, int flags)
+                                             struct flowi6 *fl6, int flags)
 {
-        return ip6_pol_route(net, table, fl->oif, fl, flags);
+        return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags);
 }
-struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
+struct dst_entry * ip6_route_output(struct net *net, const struct sock *sk,
-                                    struct flowi *fl)
+                                    struct flowi6 *fl6)
 {
        int flags = 0;
-        if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl->fl6_dst))
+        if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr))
                flags |= RT6_LOOKUP_F_IFACE;
-        if (!ipv6_addr_any(&fl->fl6_src))
+        if (!ipv6_addr_any(&fl6->saddr))
                flags |= RT6_LOOKUP_F_HAS_SADDR;
        else if (sk)
                flags |= rt6_srcprefs2flags(inet6_sk(sk)->srcprefs);
-        return fib6_rule_lookup(net, fl, flags, ip6_pol_route_output);
+        return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_output);
 }
 EXPORT_SYMBOL(ip6_route_output);
-int ip6_dst_blackhole(struct sock *sk, struct dst_entry **dstp, struct flowi *fl)
+struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_orig)
 {
-        struct rt6_info *ort = (struct rt6_info *) *dstp;
+        struct rt6_info *rt, *ort = (struct rt6_info *) dst_orig;
-        struct rt6_info *rt = (struct rt6_info *)
-                dst_alloc(&ip6_dst_blackhole_ops);
        struct dst_entry *new = NULL;
+        rt = dst_alloc(&ip6_dst_blackhole_ops, ort->dst.dev, 1, 0, 0);
        if (rt) {
+                memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
                new = &rt->dst;
-                atomic_set(&new->__refcnt, 1);
                new->__use = 1;
                new->input = dst_discard;
                new->output = dst_discard;
-                memcpy(new->metrics, ort->dst.metrics, RTAX_MAX*sizeof(u32));
+                dst_copy_metrics(new, &ort->dst);
-                new->dev = ort->dst.dev;
-                if (new->dev)
-                        dev_hold(new->dev);
                rt->rt6i_idev = ort->rt6i_idev;
                if (rt->rt6i_idev)
                        in6_dev_hold(rt->rt6i_idev);
@@ -857,11 +918,9 @@ int ip6_dst_blackhole(struct sock *sk, struct dst_entry **dstp, struct flowi *fl
                dst_free(new);
        }
-        dst_release(*dstp);
+        dst_release(dst_orig);
-        *dstp = new;
+        return new ? new : ERR_PTR(-ENOMEM);
-        return (new ? 0 : -ENOMEM);
 }
-EXPORT_SYMBOL_GPL(ip6_dst_blackhole);
 /*
 *      Destination cache support functions
@@ -873,9 +932,14 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
        rt = (struct rt6_info *) dst;
-        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie)) {
+                if (rt->rt6i_peer_genid != rt6_peer_genid()) {
+                        if (!rt->rt6i_peer)
+                                rt6_bind_peer(rt, 0);
+                        rt->rt6i_peer_genid = rt6_peer_genid();
+                }
                return dst;
+        }
        return NULL;
 }
@@ -920,18 +984,21 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
        if (mtu < dst_mtu(dst) && rt6->rt6i_dst.plen == 128) {
                rt6->rt6i_flags |= RTF_MODIFIED;
                if (mtu < IPV6_MIN_MTU) {
+                        u32 features = dst_metric(dst, RTAX_FEATURES);
                        mtu = IPV6_MIN_MTU;
-                        dst->metrics[RTAX_FEATURES-1] |= RTAX_FEATURE_ALLFRAG;
+                        features |= RTAX_FEATURE_ALLFRAG;
+                        dst_metric_set(dst, RTAX_FEATURES, features);
                }
-                dst->metrics[RTAX_MTU-1] = mtu;
+                dst_metric_set(dst, RTAX_MTU, mtu);
-                call_netevent_notifiers(NETEVENT_PMTU_UPDATE, dst);
        }
 }
-static int ipv6_get_mtu(struct net_device *dev);
+static unsigned int ip6_default_advmss(const struct dst_entry *dst)
-static inline unsigned int ipv6_advmss(struct net *net, unsigned int mtu)
 {
+        struct net_device *dev = dst->dev;
+        unsigned int mtu = dst_mtu(dst);
+        struct net *net = dev_net(dev);
        mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
        if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
@@ -948,6 +1015,20 @@ static inline unsigned int ipv6_advmss(struct net *net, unsigned int mtu)
        return mtu;
 }
+static unsigned int ip6_default_mtu(const struct dst_entry *dst)
+{
+        unsigned int mtu = IPV6_MIN_MTU;
+        struct inet6_dev *idev;
+        rcu_read_lock();
+        idev = __in6_dev_get(dst->dev);
+        if (idev)
+                mtu = idev->cnf.mtu6;
+        rcu_read_unlock();
+        return mtu;
+}
 static struct dst_entry *icmp6_dst_gc_list;
 static DEFINE_SPINLOCK(icmp6_dst_lock);
@@ -962,13 +1043,12 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
        if (unlikely(idev == NULL))
                return NULL;
-        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
+        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, dev, 0);
        if (unlikely(rt == NULL)) {
                in6_dev_put(idev);
                goto out;
        }
-        dev_hold(dev);
        if (neigh)
                neigh_hold(neigh);
        else {
@@ -977,23 +1057,12 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
                        neigh = NULL;
        }
-        rt->rt6i_dev      = dev;
        rt->rt6i_idev     = idev;
        rt->rt6i_nexthop  = neigh;
        atomic_set(&rt->dst.__refcnt, 1);
-        rt->dst.metrics[RTAX_HOPLIMIT-1] = 255;
+        dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 255);
-        rt->dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(rt->rt6i_dev);
-        rt->dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->dst));
        rt->dst.output  = ip6_output;
-#if 0   /* there's no chance to use these for ndisc */
-        rt->dst.flags   = ipv6_addr_type(addr) & IPV6_ADDR_UNICAST
-                                ? DST_HOST
-                                : 0;
-        ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
-        rt->rt6i_dst.plen = 128;
-#endif
        spin_lock_bh(&icmp6_dst_lock);
        rt->dst.next = icmp6_dst_gc_list;
        icmp6_dst_gc_list = &rt->dst;
@@ -1007,11 +1076,9 @@ out:
 int icmp6_dst_gc(void)
 {
-        struct dst_entry *dst, *next, **pprev;
+        struct dst_entry *dst, **pprev;
        int more = 0;
-        next = NULL;
        spin_lock_bh(&icmp6_dst_lock);
        pprev = &icmp6_dst_gc_list;
@@ -1058,19 +1125,22 @@ static int ip6_dst_gc(struct dst_ops *ops)
        int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
        int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
        unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
+        int entries;
+        entries = dst_entries_get_fast(ops);
        if (time_after(rt_last_gc + rt_min_interval, now) &&
-            atomic_read(&ops->entries) <= rt_max_size)
+            entries <= rt_max_size)
                goto out;
        net->ipv6.ip6_rt_gc_expire++;
        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net);
        net->ipv6.ip6_rt_last_gc = now;
-        if (atomic_read(&ops->entries) < ops->gc_thresh)
+        entries = dst_entries_get_slow(ops);
+        if (entries < ops->gc_thresh)
                net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
 out:
        net->ipv6.ip6_rt_gc_expire -= net->ipv6.ip6_rt_gc_expire>>rt_elasticity;
-        return (atomic_read(&ops->entries) > rt_max_size);
+        return entries > rt_max_size;
 }
 /* Clean host part of a prefix. Not necessary in radix tree,
@@ -1079,23 +1149,10 @@ out:
   Remove it only when all the things will work!
 */
-static int ipv6_get_mtu(struct net_device *dev)
-{
-        int mtu = IPV6_MIN_MTU;
-        struct inet6_dev *idev;
-        rcu_read_lock();
-        idev = __in6_dev_get(dev);
-        if (idev)
-                mtu = idev->cnf.mtu6;
-        rcu_read_unlock();
-        return mtu;
-}
 int ip6_dst_hoplimit(struct dst_entry *dst)
 {
-        int hoplimit = dst_metric(dst, RTAX_HOPLIMIT);
+        int hoplimit = dst_metric_raw(dst, RTAX_HOPLIMIT);
-        if (hoplimit < 0) {
+        if (hoplimit == 0) {
                struct net_device *dev = dst->dev;
                struct inet6_dev *idev;
@@ -1109,6 +1166,7 @@ int ip6_dst_hoplimit(struct dst_entry *dst)
        }
        return hoplimit;
 }
+EXPORT_SYMBOL(ip6_dst_hoplimit);
 /*
 *
@@ -1149,7 +1207,7 @@ int ip6_route_add(struct fib6_config *cfg)
                goto out;
        }
-        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
+        rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, NULL, DST_NOCOUNT);
        if (rt == NULL) {
                err = -ENOMEM;
@@ -1169,6 +1227,8 @@ int ip6_route_add(struct fib6_config *cfg)
        if (addr_type & IPV6_ADDR_MULTICAST)
                rt->dst.input = ip6_mc_input;
+        else if (cfg->fc_flags & RTF_LOCAL)
+                rt->dst.input = ip6_input;
        else
                rt->dst.input = ip6_forward;
@@ -1177,7 +1237,7 @@ int ip6_route_add(struct fib6_config *cfg)
        ipv6_addr_prefix(&rt->rt6i_dst.addr, &cfg->fc_dst, cfg->fc_dst_len);
        rt->rt6i_dst.plen = cfg->fc_dst_len;
        if (rt->rt6i_dst.plen == 128)
-               rt->dst.flags = DST_HOST;
+               rt->dst.flags |= DST_HOST;
 #ifdef CONFIG_IPV6_SUBTREES
        ipv6_addr_prefix(&rt->rt6i_src.addr, &cfg->fc_src, cfg->fc_src_len);
@@ -1190,7 +1250,8 @@ int ip6_route_add(struct fib6_config *cfg)
           they would result in kernel looping; promote them to reject routes
         */
        if ((cfg->fc_flags & RTF_REJECT) ||
-            (dev && (dev->flags&IFF_LOOPBACK) && !(addr_type&IPV6_ADDR_LOOPBACK))) {
+            (dev && (dev->flags&IFF_LOOPBACK) && !(addr_type&IPV6_ADDR_LOOPBACK)
+                                              && !(cfg->fc_flags&RTF_LOCAL))) {
                /* hold loopback dev/idev if we haven't done so. */
                if (dev != net->loopback_dev) {
                        if (dev) {
@@ -1213,7 +1274,7 @@ int ip6_route_add(struct fib6_config *cfg)
        }
        if (cfg->fc_flags & RTF_GATEWAY) {
-                struct in6_addr *gw_addr;
+                const struct in6_addr *gw_addr;
                int gwa_type;
                gw_addr = &cfg->fc_gateway;
@@ -1266,6 +1327,16 @@ int ip6_route_add(struct fib6_config *cfg)
        if (dev == NULL)
                goto out;
+        if (!ipv6_addr_any(&cfg->fc_prefsrc)) {
+                if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                ipv6_addr_copy(&rt->rt6i_prefsrc.addr, &cfg->fc_prefsrc);
+                rt->rt6i_prefsrc.plen = 128;
+        } else
+                rt->rt6i_prefsrc.plen = 0;
        if (cfg->fc_flags & (RTF_GATEWAY | RTF_NONEXTHOP)) {
                rt->rt6i_nexthop = __neigh_lookup_errno(&nd_tbl, &rt->rt6i_gateway, dev);
                if (IS_ERR(rt->rt6i_nexthop)) {
@@ -1291,17 +1362,11 @@ install_route:
                                        goto out;
                                }
-                                rt->dst.metrics[type - 1] = nla_get_u32(nla);
+                                dst_metric_set(&rt->dst, type, nla_get_u32(nla));
                        }
                }
        }
-        if (dst_metric(&rt->dst, RTAX_HOPLIMIT) == 0)
-                rt->dst.metrics[RTAX_HOPLIMIT-1] = -1;
-        if (!dst_mtu(&rt->dst))
-                rt->dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(dev);
-        if (!dst_metric(&rt->dst, RTAX_ADVMSS))
-                rt->dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->dst));
        rt->dst.dev = dev;
        rt->rt6i_idev = idev;
        rt->rt6i_table = table;
@@ -1391,16 +1456,16 @@ static int ip6_route_del(struct fib6_config *cfg)
 *      Handle redirects
 */
 struct ip6rd_flowi {
-        struct flowi fl;
+        struct flowi6 fl6;
        struct in6_addr gateway;
 };
 static struct rt6_info *__ip6_route_redirect(struct net *net,
                                             struct fib6_table *table,
-                                             struct flowi *fl,
+                                             struct flowi6 *fl6,
                                             int flags)
 {
-        struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl;
+        struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6;
        struct rt6_info *rt;
        struct fib6_node *fn;
@@ -1416,7 +1481,7 @@ static struct rt6_info *__ip6_route_redirect(struct net *net,
         */
        read_lock_bh(&table->tb6_lock);
-        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
+        fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
 restart:
        for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
                /*
@@ -1431,7 +1496,7 @@ restart:
                        continue;
                if (!(rt->rt6i_flags & RTF_GATEWAY))
                        continue;
-                if (fl->oif != rt->rt6i_dev->ifindex)
+                if (fl6->flowi6_oif != rt->rt6i_dev->ifindex)
                        continue;
                if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway))
                        continue;
@@ -1440,7 +1505,7 @@ restart:
        if (!rt)
                rt = net->ipv6.ip6_null_entry;
-        BACKTRACK(net, &fl->fl6_src);
+        BACKTRACK(net, &fl6->saddr);
 out:
        dst_hold(&rt->dst);
@@ -1449,22 +1514,18 @@ out:
        return rt;
 };
-static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
+static struct rt6_info *ip6_route_redirect(const struct in6_addr *dest,
-                                           struct in6_addr *src,
+                                           const struct in6_addr *src,
-                                           struct in6_addr *gateway,
+                                           const struct in6_addr *gateway,
                                           struct net_device *dev)
 {
        int flags = RT6_LOOKUP_F_HAS_SADDR;
        struct net *net = dev_net(dev);
        struct ip6rd_flowi rdfl = {
-                .fl = {
+                .fl6 = {
-                        .oif = dev->ifindex,
+                        .flowi6_oif = dev->ifindex,
-                        .nl_u = {
+                        .daddr = *dest,
-                                .ip6_u = {
+                        .saddr = *src,
-                                        .daddr = *dest,
-                                        .saddr = *src,
-                                },
-                        },
                },
        };
@@ -1473,12 +1534,12 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
        if (rt6_need_strict(dest))
                flags |= RT6_LOOKUP_F_IFACE;
-        return (struct rt6_info *)fib6_rule_lookup(net, (struct flowi *)&rdfl,
+        return (struct rt6_info *)fib6_rule_lookup(net, &rdfl.fl6,
                                                   flags, __ip6_route_redirect);
 }
-void rt6_redirect(struct in6_addr *dest, struct in6_addr *src,
+void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
-                  struct in6_addr *saddr,
+                  const struct in6_addr *saddr,
                  struct neighbour *neigh, u8 *lladdr, int on_link)
 {
        struct rt6_info *rt, *nrt = NULL;
@@ -1530,10 +1591,6 @@ void rt6_redirect(struct in6_addr *dest, struct in6_addr *src,
        ipv6_addr_copy(&nrt->rt6i_gateway, (struct in6_addr*)neigh->primary_key);
        nrt->rt6i_nexthop = neigh_clone(neigh);
-        /* Reset pmtu, it may be better */
-        nrt->dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(neigh->dev);
-        nrt->dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(dev_net(neigh->dev),
-                                                        dst_mtu(&nrt->dst));
        if (ip6_ins_rt(nrt))
                goto out;
@@ -1556,16 +1613,21 @@ out:
 *      i.e. Path MTU discovery
 */
-static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
+static void rt6_do_pmtu_disc(const struct in6_addr *daddr, const struct in6_addr *saddr,
                             struct net *net, u32 pmtu, int ifindex)
 {
        struct rt6_info *rt, *nrt;
        int allfrag = 0;
+again:
        rt = rt6_lookup(net, daddr, saddr, ifindex, 0);
        if (rt == NULL)
                return;
+        if (rt6_check_expired(rt)) {
+                ip6_del_rt(rt);
+                goto again;
+        }
        if (pmtu >= dst_mtu(&rt->dst))
                goto out;
@@ -1592,9 +1654,12 @@ static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
           would return automatically.
         */
        if (rt->rt6i_flags & RTF_CACHE) {
-                rt->dst.metrics[RTAX_MTU-1] = pmtu;
+                dst_metric_set(&rt->dst, RTAX_MTU, pmtu);
-                if (allfrag)
+                if (allfrag) {
-                        rt->dst.metrics[RTAX_FEATURES-1] |= RTAX_FEATURE_ALLFRAG;
+                        u32 features = dst_metric(&rt->dst, RTAX_FEATURES);
+                        features |= RTAX_FEATURE_ALLFRAG;
+                        dst_metric_set(&rt->dst, RTAX_FEATURES, features);
+                }
                dst_set_expires(&rt->dst, net->ipv6.sysctl.ip6_rt_mtu_expires);
                rt->rt6i_flags |= RTF_MODIFIED|RTF_EXPIRES;
                goto out;
@@ -1611,9 +1676,12 @@ static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
                nrt = rt6_alloc_clone(rt, daddr);
        if (nrt) {
-                nrt->dst.metrics[RTAX_MTU-1] = pmtu;
+                dst_metric_set(&nrt->dst, RTAX_MTU, pmtu);
-                if (allfrag)
+                if (allfrag) {
-                        nrt->dst.metrics[RTAX_FEATURES-1] |= RTAX_FEATURE_ALLFRAG;
+                        u32 features = dst_metric(&nrt->dst, RTAX_FEATURES);
+                        features |= RTAX_FEATURE_ALLFRAG;
+                        dst_metric_set(&nrt->dst, RTAX_FEATURES, features);
+                }
                /* According to RFC 1981, detecting PMTU increase shouldn't be
                 * happened within 5 mins, the recommended timer is 10 mins.
@@ -1630,7 +1698,7 @@ out:
        dst_release(&rt->dst);
 }
-void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
+void rt6_pmtu_discovery(const struct in6_addr *daddr, const struct in6_addr *saddr,
                        struct net_device *dev, u32 pmtu)
 {
        struct net *net = dev_net(dev);
@@ -1658,17 +1726,15 @@ void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
 static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 {
        struct net *net = dev_net(ort->rt6i_dev);
-        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
+        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops,
+                                            ort->dst.dev, 0);
        if (rt) {
                rt->dst.input = ort->dst.input;
                rt->dst.output = ort->dst.output;
-                memcpy(rt->dst.metrics, ort->dst.metrics, RTAX_MAX*sizeof(u32));
+                dst_copy_metrics(&rt->dst, &ort->dst);
                rt->dst.error = ort->dst.error;
-                rt->dst.dev = ort->dst.dev;
-                if (rt->dst.dev)
-                        dev_hold(rt->dst.dev);
                rt->rt6i_idev = ort->rt6i_idev;
                if (rt->rt6i_idev)
                        in6_dev_hold(rt->rt6i_idev);
@@ -1683,6 +1749,7 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 #ifdef CONFIG_IPV6_SUBTREES
                memcpy(&rt->rt6i_src, &ort->rt6i_src, sizeof(struct rt6key));
 #endif
+                memcpy(&rt->rt6i_prefsrc, &ort->rt6i_prefsrc, sizeof(struct rt6key));
                rt->rt6i_table = ort->rt6i_table;
        }
        return rt;
@@ -1690,8 +1757,8 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 #ifdef CONFIG_IPV6_ROUTE_INFO
 static struct rt6_info *rt6_get_route_info(struct net *net,
-                                           struct in6_addr *prefix, int prefixlen,
+                                           const struct in6_addr *prefix, int prefixlen,
-                                           struct in6_addr *gwaddr, int ifindex)
+                                           const struct in6_addr *gwaddr, int ifindex)
 {
        struct fib6_node *fn;
        struct rt6_info *rt = NULL;
@@ -1722,8 +1789,8 @@ out:
 }
 static struct rt6_info *rt6_add_route_info(struct net *net,
-                                           struct in6_addr *prefix, int prefixlen,
+                                           const struct in6_addr *prefix, int prefixlen,
-                                           struct in6_addr *gwaddr, int ifindex,
+                                           const struct in6_addr *gwaddr, int ifindex,
                                           unsigned pref)
 {
        struct fib6_config cfg = {
@@ -1751,7 +1818,7 @@ static struct rt6_info *rt6_add_route_info(struct net *net,
 }
 #endif
-struct rt6_info *rt6_get_dflt_router(struct in6_addr *addr, struct net_device *dev)
+struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_device *dev)
 {
        struct rt6_info *rt;
        struct fib6_table *table;
@@ -1773,7 +1840,7 @@ struct rt6_info *rt6_get_dflt_router(struct in6_addr *addr, struct net_device *d
        return rt;
 }
-struct rt6_info *rt6_add_dflt_router(struct in6_addr *gwaddr,
+struct rt6_info *rt6_add_dflt_router(const struct in6_addr *gwaddr,
                                     struct net_device *dev,
                                     unsigned int pref)
 {
@@ -1938,23 +2005,23 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
                                    int anycast)
 {
        struct net *net = dev_net(idev->dev);
-        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
+        struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops,
+                                            net->loopback_dev, 0);
        struct neighbour *neigh;
-        if (rt == NULL)
+        if (rt == NULL) {
+                if (net_ratelimit())
+                        pr_warning("IPv6:  Maximum number of routes reached,"
+                                   " consider increasing route/max_size.\n");
                return ERR_PTR(-ENOMEM);
+        }
-        dev_hold(net->loopback_dev);
        in6_dev_hold(idev);
-        rt->dst.flags = DST_HOST;
+        rt->dst.flags |= DST_HOST;
        rt->dst.input = ip6_input;
        rt->dst.output = ip6_output;
-        rt->rt6i_dev = net->loopback_dev;
        rt->rt6i_idev = idev;
-        rt->dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(rt->rt6i_dev);
-        rt->dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->dst));
-        rt->dst.metrics[RTAX_HOPLIMIT-1] = -1;
        rt->dst.obsolete = -1;
        rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
@@ -1966,12 +2033,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
        if (IS_ERR(neigh)) {
                dst_free(&rt->dst);
-                /* We are casting this because that is the return
+                return ERR_CAST(neigh);
-                 * value type.  But an errno encoded pointer is the
-                 * same regardless of the underlying pointer type,
-                 * and that's what we are returning.  So this is OK.
-                 */
-                return (struct rt6_info *) neigh;
        }
        rt->rt6i_nexthop = neigh;
@@ -1984,6 +2046,55 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
        return rt;
 }
+int ip6_route_get_saddr(struct net *net,
+                        struct rt6_info *rt,
+                        const struct in6_addr *daddr,
+                        unsigned int prefs,
+                        struct in6_addr *saddr)
+{
+        struct inet6_dev *idev = ip6_dst_idev((struct dst_entry*)rt);
+        int err = 0;
+        if (rt->rt6i_prefsrc.plen)
+                ipv6_addr_copy(saddr, &rt->rt6i_prefsrc.addr);
+        else
+                err = ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
+                                         daddr, prefs, saddr);
+        return err;
+}
+/* remove deleted ip from prefsrc entries */
+struct arg_dev_net_ip {
+        struct net_device *dev;
+        struct net *net;
+        struct in6_addr *addr;
+};
+static int fib6_remove_prefsrc(struct rt6_info *rt, void *arg)
+{
+        struct net_device *dev = ((struct arg_dev_net_ip *)arg)->dev;
+        struct net *net = ((struct arg_dev_net_ip *)arg)->net;
+        struct in6_addr *addr = ((struct arg_dev_net_ip *)arg)->addr;
+        if (((void *)rt->rt6i_dev == dev || dev == NULL) &&
+            rt != net->ipv6.ip6_null_entry &&
+            ipv6_addr_equal(addr, &rt->rt6i_prefsrc.addr)) {
+                /* remove prefsrc entry */
+                rt->rt6i_prefsrc.plen = 0;
+        }
+        return 0;
+}
+void rt6_remove_prefsrc(struct inet6_ifaddr *ifp)
+{
+        struct net *net = dev_net(ifp->idev->dev);
+        struct arg_dev_net_ip adni = {
+                .dev = ifp->idev->dev,
+                .net = net,
+                .addr = &ifp->addr,
+        };
+        fib6_clean_all(net, fib6_remove_prefsrc, 0, &adni);
+}
 struct arg_dev_net {
        struct net_device *dev;
        struct net *net;
@@ -1991,11 +2102,11 @@ struct arg_dev_net {
 static int fib6_ifdown(struct rt6_info *rt, void *arg)
 {
-        struct net_device *dev = ((struct arg_dev_net *)arg)->dev;
+        const struct arg_dev_net *adn = arg;
-        struct net *net = ((struct arg_dev_net *)arg)->net;
+        const struct net_device *dev = adn->dev;
-        if (((void *)rt->rt6i_dev == dev || dev == NULL) &&
+        if ((rt->rt6i_dev == dev || dev == NULL) &&
-            rt != net->ipv6.ip6_null_entry) {
+            rt != adn->net->ipv6.ip6_null_entry) {
                RT6_TRACE("deleted by ifdown %p\n", rt);
                return -1;
        }
@@ -2023,7 +2134,6 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
 {
        struct rt6_mtu_change_arg *arg = (struct rt6_mtu_change_arg *) p_arg;
        struct inet6_dev *idev;
-        struct net *net = dev_net(arg->dev);
        /* In IPv6 pmtu discovery is not optional,
           so that RTAX_MTU lock cannot disable it.
@@ -2054,8 +2164,7 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
            (dst_mtu(&rt->dst) >= arg->mtu ||
             (dst_mtu(&rt->dst) < arg->mtu &&
              dst_mtu(&rt->dst) == idev->cnf.mtu6))) {
-                rt->dst.metrics[RTAX_MTU-1] = arg->mtu;
+                dst_metric_set(&rt->dst, RTAX_MTU, arg->mtu);
-                rt->dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, arg->mtu);
        }
        return 0;
 }
@@ -2102,6 +2211,9 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
        if (rtm->rtm_type == RTN_UNREACHABLE)
                cfg->fc_flags |= RTF_REJECT;
+        if (rtm->rtm_type == RTN_LOCAL)
+                cfg->fc_flags |= RTF_LOCAL;
        cfg->fc_nlinfo.pid = NETLINK_CB(skb).pid;
        cfg->fc_nlinfo.nlh = nlh;
        cfg->fc_nlinfo.nl_net = sock_net(skb->sk);
@@ -2129,6 +2241,9 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
                nla_memcpy(&cfg->fc_src, tb[RTA_SRC], plen);
        }
+        if (tb[RTA_PREFSRC])
+                nla_memcpy(&cfg->fc_prefsrc, tb[RTA_PREFSRC], 16);
        if (tb[RTA_OIF])
                cfg->fc_ifindex = nla_get_u32(tb[RTA_OIF]);
@@ -2222,6 +2337,8 @@ static int rt6_fill_node(struct net *net,
        NLA_PUT_U32(skb, RTA_TABLE, table);
        if (rt->rt6i_flags&RTF_REJECT)
                rtm->rtm_type = RTN_UNREACHABLE;
+        else if (rt->rt6i_flags&RTF_LOCAL)
+                rtm->rtm_type = RTN_LOCAL;
        else if (rt->rt6i_dev && (rt->rt6i_dev->flags&IFF_LOOPBACK))
                rtm->rtm_type = RTN_LOCAL;
        else
@@ -2269,14 +2386,18 @@ static int rt6_fill_node(struct net *net,
 #endif
                        NLA_PUT_U32(skb, RTA_IIF, iif);
        } else if (dst) {
-                struct inet6_dev *idev = ip6_dst_idev(&rt->dst);
                struct in6_addr saddr_buf;
-                if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
+                if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf) == 0)
-                                       dst, 0, &saddr_buf) == 0)
                        NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
        }
-        if (rtnetlink_put_metrics(skb, rt->dst.metrics) < 0)
+        if (rt->rt6i_prefsrc.plen) {
+                struct in6_addr saddr_buf;
+                ipv6_addr_copy(&saddr_buf, &rt->rt6i_prefsrc.addr);
+                NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
+        }
+        if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                goto nla_put_failure;
        if (rt->dst.neighbour)
@@ -2329,7 +2450,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
        struct rt6_info *rt;
        struct sk_buff *skb;
        struct rtmsg *rtm;
-        struct flowi fl;
+        struct flowi6 fl6;
        int err, iif = 0;
        err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
@@ -2337,27 +2458,27 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
                goto errout;
        err = -EINVAL;
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
        if (tb[RTA_SRC]) {
                if (nla_len(tb[RTA_SRC]) < sizeof(struct in6_addr))
                        goto errout;
-                ipv6_addr_copy(&fl.fl6_src, nla_data(tb[RTA_SRC]));
+                ipv6_addr_copy(&fl6.saddr, nla_data(tb[RTA_SRC]));
        }
        if (tb[RTA_DST]) {
                if (nla_len(tb[RTA_DST]) < sizeof(struct in6_addr))
                        goto errout;
-                ipv6_addr_copy(&fl.fl6_dst, nla_data(tb[RTA_DST]));
+                ipv6_addr_copy(&fl6.daddr, nla_data(tb[RTA_DST]));
        }
        if (tb[RTA_IIF])
                iif = nla_get_u32(tb[RTA_IIF]);
        if (tb[RTA_OIF])
-                fl.oif = nla_get_u32(tb[RTA_OIF]);
+                fl6.flowi6_oif = nla_get_u32(tb[RTA_OIF]);
        if (iif) {
                struct net_device *dev;
@@ -2380,10 +2501,10 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
        skb_reset_mac_header(skb);
        skb_reserve(skb, MAX_HEADER + sizeof(struct ipv6hdr));
-        rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl);
+        rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl6);
        skb_dst_set(skb, &rt->dst);
-        err = rt6_fill_node(net, skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
+        err = rt6_fill_node(net, skb, rt, &fl6.daddr, &fl6.saddr, iif,
                            RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
                            nlh->nlmsg_seq, 0, 0, 0);
        if (err < 0) {
@@ -2452,8 +2573,6 @@ static int ip6_route_dev_notify(struct notifier_block *this,
 #ifdef CONFIG_PROC_FS
-#define RT6_INFO_LEN (32 + 4 + 32 + 4 + 32 + 40 + 5 + 1)
 struct rt6_proc_arg
 {
        char *buffer;
@@ -2516,7 +2635,7 @@ static int rt6_stats_seq_show(struct seq_file *seq, void *v)
                   net->ipv6.rt6_stats->fib_rt_alloc,
                   net->ipv6.rt6_stats->fib_rt_entries,
                   net->ipv6.rt6_stats->fib_rt_cache,
-                   atomic_read(&net->ipv6.ip6_dst_ops.entries),
+                   dst_entries_get_slow(&net->ipv6.ip6_dst_ops),
                   net->ipv6.rt6_stats->fib_discarded_routes);
        return 0;
@@ -2542,14 +2661,16 @@ static
 int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write,
                              void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-        struct net *net = current->nsproxy->net_ns;
+        struct net *net;
-        int delay = net->ipv6.sysctl.flush_delay;
+        int delay;
-        if (write) {
+        if (!write)
-                proc_dointvec(ctl, write, buffer, lenp, ppos);
-                fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
-                return 0;
-        } else
                return -EINVAL;
+        net = (struct net *)ctl->extra1;
+        delay = net->ipv6.sysctl.flush_delay;
+        proc_dointvec(ctl, write, buffer, lenp, ppos);
+        fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
+        return 0;
 }
 ctl_table ipv6_route_table_template[] = {
@@ -2636,6 +2757,7 @@ struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
        if (table) {
                table[0].data = &net->ipv6.sysctl.flush_delay;
+                table[0].extra1 = net;
                table[1].data = &net->ipv6.ip6_dst_ops.gc_thresh;
                table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;
                table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
@@ -2658,14 +2780,19 @@ static int __net_init ip6_route_net_init(struct net *net)
        memcpy(&net->ipv6.ip6_dst_ops, &ip6_dst_ops_template,
               sizeof(net->ipv6.ip6_dst_ops));
+        if (dst_entries_init(&net->ipv6.ip6_dst_ops) < 0)
+                goto out_ip6_dst_ops;
        net->ipv6.ip6_null_entry = kmemdup(&ip6_null_entry_template,
                                           sizeof(*net->ipv6.ip6_null_entry),
                                           GFP_KERNEL);
        if (!net->ipv6.ip6_null_entry)
-                goto out_ip6_dst_ops;
+                goto out_ip6_dst_entries;
        net->ipv6.ip6_null_entry->dst.path =
                (struct dst_entry *)net->ipv6.ip6_null_entry;
        net->ipv6.ip6_null_entry->dst.ops = &net->ipv6.ip6_dst_ops;
+        dst_init_metrics(&net->ipv6.ip6_null_entry->dst,
+                         ip6_template_metrics, true);
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
        net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
@@ -2676,6 +2803,8 @@ static int __net_init ip6_route_net_init(struct net *net)
        net->ipv6.ip6_prohibit_entry->dst.path =
                (struct dst_entry *)net->ipv6.ip6_prohibit_entry;
        net->ipv6.ip6_prohibit_entry->dst.ops = &net->ipv6.ip6_dst_ops;
+        dst_init_metrics(&net->ipv6.ip6_prohibit_entry->dst,
+                         ip6_template_metrics, true);
        net->ipv6.ip6_blk_hole_entry = kmemdup(&ip6_blk_hole_entry_template,
                                               sizeof(*net->ipv6.ip6_blk_hole_entry),
@@ -2685,6 +2814,8 @@ static int __net_init ip6_route_net_init(struct net *net)
        net->ipv6.ip6_blk_hole_entry->dst.path =
                (struct dst_entry *)net->ipv6.ip6_blk_hole_entry;
        net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
+        dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
+                         ip6_template_metrics, true);
 #endif
        net->ipv6.sysctl.flush_delay = 0;
@@ -2712,6 +2843,8 @@ out_ip6_prohibit_entry:
 out_ip6_null_entry:
        kfree(net->ipv6.ip6_null_entry);
 #endif
+out_ip6_dst_entries:
+        dst_entries_destroy(&net->ipv6.ip6_dst_ops);
 out_ip6_dst_ops:
        goto out;
 }
@@ -2727,6 +2860,7 @@ static void __net_exit ip6_route_net_exit(struct net *net)
        kfree(net->ipv6.ip6_prohibit_entry);
        kfree(net->ipv6.ip6_blk_hole_entry);
 #endif
+        dst_entries_destroy(&net->ipv6.ip6_dst_ops);
 }
 static struct pernet_operations ip6_route_net_ops = {
@@ -2750,10 +2884,14 @@ int __init ip6_route_init(void)
        if (!ip6_dst_ops_template.kmem_cachep)
                goto out;
-        ret = register_pernet_subsys(&ip6_route_net_ops);
+        ret = dst_entries_init(&ip6_dst_blackhole_ops);
        if (ret)
                goto out_kmem_cache;
+        ret = register_pernet_subsys(&ip6_route_net_ops);
+        if (ret)
+                goto out_dst_entries;
        ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
        /* Registering of the loopback is done before this portion of code,
@@ -2800,6 +2938,8 @@ out_fib6_init:
        fib6_gc_cleanup();
 out_register_subsys:
        unregister_pernet_subsys(&ip6_route_net_ops);
+out_dst_entries:
+        dst_entries_destroy(&ip6_dst_blackhole_ops);
 out_kmem_cache:
        kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
        goto out;
@@ -2812,5 +2952,6 @@ void ip6_route_cleanup(void)
        xfrm6_fini();
        fib6_gc_cleanup();
        unregister_pernet_subsys(&ip6_route_net_ops);
+        dst_entries_destroy(&ip6_dst_blackhole_ops);
        kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
 }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 4699cd3c3118..1cca5761aea9 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -63,36 +63,63 @@
 #define HASH_SIZE  16
 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
-static void ipip6_tunnel_init(struct net_device *dev);
+static int ipip6_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_setup(struct net_device *dev);
+static void ipip6_dev_free(struct net_device *dev);
 static int sit_net_id __read_mostly;
 struct sit_net {
-        struct ip_tunnel *tunnels_r_l[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_r_l[HASH_SIZE];
-        struct ip_tunnel *tunnels_r[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_r[HASH_SIZE];
-        struct ip_tunnel *tunnels_l[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_l[HASH_SIZE];
-        struct ip_tunnel *tunnels_wc[1];
+        struct ip_tunnel __rcu *tunnels_wc[1];
-        struct ip_tunnel **tunnels[4];
+        struct ip_tunnel __rcu **tunnels[4];
        struct net_device *fb_tunnel_dev;
 };
 /*
- * Locking : hash tables are protected by RCU and a spinlock
+ * Locking : hash tables are protected by RCU and RTNL
 */
-static DEFINE_SPINLOCK(ipip6_lock);
 #define for_each_ip_tunnel_rcu(start) \
        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
+/* often modified stats are per cpu, other are shared (netdev->stats) */
+struct pcpu_tstats {
+        unsigned long   rx_packets;
+        unsigned long   rx_bytes;
+        unsigned long   tx_packets;
+        unsigned long   tx_bytes;
+};
+static struct net_device_stats *ipip6_get_stats(struct net_device *dev)
+{
+        struct pcpu_tstats sum = { 0 };
+        int i;
+        for_each_possible_cpu(i) {
+                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
+                sum.rx_packets += tstats->rx_packets;
+                sum.rx_bytes   += tstats->rx_bytes;
+                sum.tx_packets += tstats->tx_packets;
+                sum.tx_bytes   += tstats->tx_bytes;
+        }
+        dev->stats.rx_packets = sum.rx_packets;
+        dev->stats.rx_bytes   = sum.rx_bytes;
+        dev->stats.tx_packets = sum.tx_packets;
+        dev->stats.tx_bytes   = sum.tx_bytes;
+        return &dev->stats;
+}
 /*
 * Must be invoked with rcu_read_lock
 */
 static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
                struct net_device *dev, __be32 remote, __be32 local)
 {
-        unsigned h0 = HASH(remote);
+        unsigned int h0 = HASH(remote);
-        unsigned h1 = HASH(local);
+        unsigned int h1 = HASH(local);
        struct ip_tunnel *t;
        struct sit_net *sitn = net_generic(net, sit_net_id);
@@ -121,12 +148,12 @@ static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
        return NULL;
 }
-static struct ip_tunnel **__ipip6_bucket(struct sit_net *sitn,
+static struct ip_tunnel __rcu **__ipip6_bucket(struct sit_net *sitn,
                struct ip_tunnel_parm *parms)
 {
        __be32 remote = parms->iph.daddr;
        __be32 local = parms->iph.saddr;
-        unsigned h = 0;
+        unsigned int h = 0;
        int prio = 0;
        if (remote) {
@@ -140,7 +167,7 @@ static struct ip_tunnel **__ipip6_bucket(struct sit_net *sitn,
        return &sitn->tunnels[prio][h];
 }
-static inline struct ip_tunnel **ipip6_bucket(struct sit_net *sitn,
+static inline struct ip_tunnel __rcu **ipip6_bucket(struct sit_net *sitn,
                struct ip_tunnel *t)
 {
        return __ipip6_bucket(sitn, &t->parms);
@@ -148,13 +175,14 @@ static inline struct ip_tunnel **ipip6_bucket(struct sit_net *sitn,
 static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp;
+        struct ip_tunnel __rcu **tp;
+        struct ip_tunnel *iter;
-        for (tp = ipip6_bucket(sitn, t); *tp; tp = &(*tp)->next) {
-                if (t == *tp) {
+        for (tp = ipip6_bucket(sitn, t);
-                        spin_lock_bh(&ipip6_lock);
+             (iter = rtnl_dereference(*tp)) != NULL;
-                        *tp = t->next;
+             tp = &iter->next) {
-                        spin_unlock_bh(&ipip6_lock);
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
                        break;
                }
        }
@@ -162,12 +190,10 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp = ipip6_bucket(sitn, t);
+        struct ip_tunnel __rcu **tp = ipip6_bucket(sitn, t);
-        spin_lock_bh(&ipip6_lock);
+        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
-        t->next = *tp;
        rcu_assign_pointer(*tp, t);
-        spin_unlock_bh(&ipip6_lock);
 }
 static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
@@ -187,17 +213,20 @@ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
 #endif
 }
-static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
+static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
                struct ip_tunnel_parm *parms, int create)
 {
        __be32 remote = parms->iph.daddr;
        __be32 local = parms->iph.saddr;
-        struct ip_tunnel *t, **tp, *nt;
+        struct ip_tunnel *t, *nt;
+        struct ip_tunnel __rcu **tp;
        struct net_device *dev;
        char name[IFNAMSIZ];
        struct sit_net *sitn = net_generic(net, sit_net_id);
-        for (tp = __ipip6_bucket(sitn, parms); (t = *tp) != NULL; tp = &t->next) {
+        for (tp = __ipip6_bucket(sitn, parms);
+            (t = rtnl_dereference(*tp)) != NULL;
+             tp = &t->next) {
                if (local == t->parms.iph.saddr &&
                    remote == t->parms.iph.daddr &&
                    parms->link == t->parms.link) {
@@ -213,7 +242,7 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
        if (parms->name[0])
                strlcpy(name, parms->name, IFNAMSIZ);
        else
-                sprintf(name, "sit%%d");
+                strcpy(name, "sit%d");
        dev = alloc_netdev(sizeof(*t), name, ipip6_tunnel_setup);
        if (dev == NULL)
@@ -221,15 +250,11 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
        dev_net_set(dev, net);
-        if (strchr(name, '%')) {
-                if (dev_alloc_name(dev, name) < 0)
-                        goto failed_free;
-        }
        nt = netdev_priv(dev);
        nt->parms = *parms;
-        ipip6_tunnel_init(dev);
+        if (ipip6_tunnel_init(dev) < 0)
+                goto failed_free;
        ipip6_tunnel_clone_6rd(dev, sitn);
        if (parms->i_flags & SIT_ISATAP)
@@ -244,7 +269,7 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
        return nt;
 failed_free:
-        free_netdev(dev);
+        ipip6_dev_free(dev);
 failed:
        return NULL;
 }
@@ -340,7 +365,7 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
        ASSERT_RTNL();
-        for (p = t->prl; p; p = p->next) {
+        for (p = rtnl_dereference(t->prl); p; p = rtnl_dereference(p->next)) {
                if (p->addr == a->addr) {
                        if (chg) {
                                p->flags = a->flags;
@@ -371,18 +396,13 @@ out:
        return err;
 }
-static void prl_entry_destroy_rcu(struct rcu_head *head)
-{
-        kfree(container_of(head, struct ip_tunnel_prl_entry, rcu_head));
-}
 static void prl_list_destroy_rcu(struct rcu_head *head)
 {
        struct ip_tunnel_prl_entry *p, *n;
        p = container_of(head, struct ip_tunnel_prl_entry, rcu_head);
        do {
-                n = p->next;
+                n = rcu_dereference_protected(p->next, 1);
                kfree(p);
                p = n;
        } while (p);
@@ -391,26 +411,28 @@ static void prl_list_destroy_rcu(struct rcu_head *head)
 static int
 ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
 {
-        struct ip_tunnel_prl_entry *x, **p;
+        struct ip_tunnel_prl_entry *x;
+        struct ip_tunnel_prl_entry __rcu **p;
        int err = 0;
        ASSERT_RTNL();
        if (a && a->addr != htonl(INADDR_ANY)) {
-                for (p = &t->prl; *p; p = &(*p)->next) {
+                for (p = &t->prl;
-                        if ((*p)->addr == a->addr) {
+                     (x = rtnl_dereference(*p)) != NULL;
-                                x = *p;
+                     p = &x->next) {
+                        if (x->addr == a->addr) {
                                *p = x->next;
-                                call_rcu(&x->rcu_head, prl_entry_destroy_rcu);
+                                kfree_rcu(x, rcu_head);
                                t->prl_count--;
                                goto out;
                        }
                }
                err = -ENXIO;
        } else {
-                if (t->prl) {
+                x = rtnl_dereference(t->prl);
+                if (x) {
                        t->prl_count = 0;
-                        x = t->prl;
                        call_rcu(&x->rcu_head, prl_list_destroy_rcu);
                        t->prl = NULL;
                }
@@ -420,7 +442,7 @@ out:
 }
 static int
-isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
+isatap_chksrc(struct sk_buff *skb, const struct iphdr *iph, struct ip_tunnel *t)
 {
        struct ip_tunnel_prl_entry *p;
        int ok = 1;
@@ -433,7 +455,8 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
                else
                        skb->ndisc_nodetype = NDISC_NODETYPE_NODEFAULT;
        } else {
-                struct in6_addr *addr6 = &ipv6_hdr(skb)->saddr;
+                const struct in6_addr *addr6 = &ipv6_hdr(skb)->saddr;
                if (ipv6_addr_is_isatap(addr6) &&
                    (addr6->s6_addr32[3] == iph->saddr) &&
                    ipv6_chk_prefix(addr6, t->dev))
@@ -451,15 +474,12 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
        struct sit_net *sitn = net_generic(net, sit_net_id);
        if (dev == sitn->fb_tunnel_dev) {
-                spin_lock_bh(&ipip6_lock);
+                rcu_assign_pointer(sitn->tunnels_wc[0], NULL);
-                sitn->tunnels_wc[0] = NULL;
-                spin_unlock_bh(&ipip6_lock);
-                dev_put(dev);
        } else {
                ipip6_tunnel_unlink(sitn, netdev_priv(dev));
                ipip6_tunnel_del_prl(netdev_priv(dev), NULL);
-                dev_put(dev);
        }
+        dev_put(dev);
 }
@@ -470,7 +490,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
   8 bytes of packet payload. It means, that precise relaying of
   ICMP in the real Internet is absolutely infeasible.
 */
-        struct iphdr *iph = (struct iphdr*)skb->data;
+        const struct iphdr *iph = (const struct iphdr *)skb->data;
        const int type = icmp_hdr(skb)->type;
        const int code = icmp_hdr(skb)->code;
        struct ip_tunnel *t;
@@ -528,7 +548,7 @@ out:
        return err;
 }
-static inline void ipip6_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
+static inline void ipip6_ecn_decapsulate(const struct iphdr *iph, struct sk_buff *skb)
 {
        if (INET_ECN_is_ce(iph->tos))
                IP6_ECN_set_ce(ipv6_hdr(skb));
@@ -536,7 +556,7 @@ static inline void ipip6_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
 static int ipip6_rcv(struct sk_buff *skb)
 {
-        struct iphdr *iph;
+        const struct iphdr *iph;
        struct ip_tunnel *tunnel;
        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
@@ -548,6 +568,8 @@ static int ipip6_rcv(struct sk_buff *skb)
        tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
                                     iph->saddr, iph->daddr);
        if (tunnel != NULL) {
+                struct pcpu_tstats *tstats;
                secpath_reset(skb);
                skb->mac_header = skb->network_header;
                skb_reset_network_header(skb);
@@ -563,16 +585,23 @@ static int ipip6_rcv(struct sk_buff *skb)
                        return 0;
                }
-                skb_tunnel_rx(skb, tunnel->dev);
+                tstats = this_cpu_ptr(tunnel->dev->tstats);
+                tstats->rx_packets++;
+                tstats->rx_bytes += skb->len;
+                __skb_tunnel_rx(skb, tunnel->dev);
                ipip6_ecn_decapsulate(iph, skb);
                netif_rx(skb);
                rcu_read_unlock();
                return 0;
        }
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+        /* no tunnel matched,  let upstream know, ipsec may handle it */
        rcu_read_unlock();
+        return 1;
 out:
        kfree_skb(skb);
        return 0;
@@ -583,14 +612,14 @@ out:
 * comes from 6rd / 6to4 (RFC 3056) addr space.
 */
 static inline
-__be32 try_6rd(struct in6_addr *v6dst, struct ip_tunnel *tunnel)
+__be32 try_6rd(const struct in6_addr *v6dst, struct ip_tunnel *tunnel)
 {
        __be32 dst = 0;
 #ifdef CONFIG_IPV6_SIT_6RD
        if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
                              tunnel->ip6rd.prefixlen)) {
-                unsigned pbw0, pbi0;
+                unsigned int pbw0, pbi0;
                int pbi1;
                u32 d;
@@ -625,19 +654,19 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                                     struct net_device *dev)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &dev->stats;
+        struct pcpu_tstats *tstats;
-        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
+        const struct iphdr  *tiph = &tunnel->parms.iph;
-        struct iphdr  *tiph = &tunnel->parms.iph;
+        const struct ipv6hdr *iph6 = ipv6_hdr(skb);
-        struct ipv6hdr *iph6 = ipv6_hdr(skb);
        u8     tos = tunnel->parms.iph.tos;
        __be16 df = tiph->frag_off;
        struct rtable *rt;                      /* Route to the other host */
-        struct net_device *tdev;                        /* Device to other host */
+        struct net_device *tdev;                /* Device to other host */
        struct iphdr  *iph;                     /* Our new IP header */
        unsigned int max_headroom;              /* The extra header space needed */
        __be32 dst = tiph->daddr;
+        struct flowi4 fl4;
        int    mtu;
-        struct in6_addr *addr6;
+        const struct in6_addr *addr6;
        int addr_type;
        if (skb->protocol != htons(ETH_P_IPV6))
@@ -656,7 +685,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                        goto tx_error;
                }
-                addr6 = (struct in6_addr*)&neigh->primary_key;
+                addr6 = (const struct in6_addr*)&neigh->primary_key;
                addr_type = ipv6_addr_type(addr6);
                if ((addr_type & IPV6_ADDR_UNICAST) &&
@@ -681,7 +710,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                        goto tx_error;
                }
-                addr6 = (struct in6_addr*)&neigh->primary_key;
+                addr6 = (const struct in6_addr*)&neigh->primary_key;
                addr_type = ipv6_addr_type(addr6);
                if (addr_type == IPV6_ADDR_ANY) {
@@ -695,28 +724,25 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                dst = addr6->s6_addr32[3];
        }
-        {
+        rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
-                struct flowi fl = { .nl_u = { .ip4_u =
+                                   dst, tiph->saddr,
-                                              { .daddr = dst,
+                                   0, 0,
-                                                .saddr = tiph->saddr,
+                                   IPPROTO_IPV6, RT_TOS(tos),
-                                                .tos = RT_TOS(tos) } },
+                                   tunnel->parms.link);
-                                    .oif = tunnel->parms.link,
+        if (IS_ERR(rt)) {
-                                    .proto = IPPROTO_IPV6 };
+                dev->stats.tx_carrier_errors++;
-                if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
+                goto tx_error_icmp;
-                        stats->tx_carrier_errors++;
-                        goto tx_error_icmp;
-                }
        }
        if (rt->rt_type != RTN_UNICAST) {
                ip_rt_put(rt);
-                stats->tx_carrier_errors++;
+                dev->stats.tx_carrier_errors++;
                goto tx_error_icmp;
        }
        tdev = rt->dst.dev;
        if (tdev == dev) {
                ip_rt_put(rt);
-                stats->collisions++;
+                dev->stats.collisions++;
                goto tx_error;
        }
@@ -724,7 +750,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                mtu = dst_mtu(&rt->dst) - sizeof(struct iphdr);
                if (mtu < 68) {
-                        stats->collisions++;
+                        dev->stats.collisions++;
                        ip_rt_put(rt);
                        goto tx_error;
                }
@@ -763,7 +789,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                if (!new_skb) {
                        ip_rt_put(rt);
-                        txq->tx_dropped++;
+                        dev->stats.tx_dropped++;
                        dev_kfree_skb(skb);
                        return NETDEV_TX_OK;
                }
@@ -792,21 +818,21 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        iph->frag_off           =       df;
        iph->protocol           =       IPPROTO_IPV6;
        iph->tos                =       INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
-        iph->daddr              =       rt->rt_dst;
+        iph->daddr              =       fl4.daddr;
-        iph->saddr              =       rt->rt_src;
+        iph->saddr              =       fl4.saddr;
        if ((iph->ttl = tiph->ttl) == 0)
                iph->ttl        =       iph6->hop_limit;
        nf_reset(skb);
+        tstats = this_cpu_ptr(dev->tstats);
-        IPTUNNEL_XMIT();
+        __IPTUNNEL_XMIT(tstats, &dev->stats);
        return NETDEV_TX_OK;
 tx_error_icmp:
        dst_link_failure(skb);
 tx_error:
-        stats->tx_errors++;
+        dev->stats.tx_errors++;
        dev_kfree_skb(skb);
        return NETDEV_TX_OK;
 }
@@ -815,20 +841,21 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
 {
        struct net_device *tdev = NULL;
        struct ip_tunnel *tunnel;
-        struct iphdr *iph;
+        const struct iphdr *iph;
+        struct flowi4 fl4;
        tunnel = netdev_priv(dev);
        iph = &tunnel->parms.iph;
        if (iph->daddr) {
-                struct flowi fl = { .nl_u = { .ip4_u =
+                struct rtable *rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
-                                              { .daddr = iph->daddr,
+                                                          iph->daddr, iph->saddr,
-                                                .saddr = iph->saddr,
+                                                          0, 0,
-                                                .tos = RT_TOS(iph->tos) } },
+                                                          IPPROTO_IPV6,
-                                    .oif = tunnel->parms.link,
+                                                          RT_TOS(iph->tos),
-                                    .proto = IPPROTO_IPV6 };
+                                                          tunnel->parms.link);
-                struct rtable *rt;
-                if (!ip_route_output_key(dev_net(dev), &rt, &fl)) {
+                if (!IS_ERR(rt)) {
                        tdev = rt->dst.dev;
                        ip_rt_put(rt);
                }
@@ -929,6 +956,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                                }
                                t = netdev_priv(dev);
                                ipip6_tunnel_unlink(sitn, t);
+                                synchronize_net();
                                t->parms.iph.saddr = p.iph.saddr;
                                t->parms.iph.daddr = p.iph.daddr;
                                memcpy(dev->dev_addr, &p.iph.saddr, 4);
@@ -1083,12 +1111,19 @@ static const struct net_device_ops ipip6_netdev_ops = {
        .ndo_start_xmit = ipip6_tunnel_xmit,
        .ndo_do_ioctl   = ipip6_tunnel_ioctl,
        .ndo_change_mtu = ipip6_tunnel_change_mtu,
+        .ndo_get_stats  = ipip6_get_stats,
 };
+static void ipip6_dev_free(struct net_device *dev)
+{
+        free_percpu(dev->tstats);
+        free_netdev(dev);
+}
 static void ipip6_tunnel_setup(struct net_device *dev)
 {
        dev->netdev_ops         = &ipip6_netdev_ops;
-        dev->destructor         = free_netdev;
+        dev->destructor         = ipip6_dev_free;
        dev->type               = ARPHRD_SIT;
        dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
@@ -1098,9 +1133,10 @@ static void ipip6_tunnel_setup(struct net_device *dev)
        dev->iflink             = 0;
        dev->addr_len           = 4;
        dev->features           |= NETIF_F_NETNS_LOCAL;
+        dev->features           |= NETIF_F_LLTX;
 }
-static void ipip6_tunnel_init(struct net_device *dev)
+static int ipip6_tunnel_init(struct net_device *dev)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
@@ -1111,9 +1147,14 @@ static void ipip6_tunnel_init(struct net_device *dev)
        memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
        ipip6_tunnel_bind_dev(dev);
+        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        if (!dev->tstats)
+                return -ENOMEM;
+        return 0;
 }
-static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
+static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
        struct iphdr *iph = &tunnel->parms.iph;
@@ -1128,11 +1169,15 @@ static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
        iph->ihl                = 5;
        iph->ttl                = 64;
+        dev->tstats = alloc_percpu(struct pcpu_tstats);
+        if (!dev->tstats)
+                return -ENOMEM;
        dev_hold(dev);
-        sitn->tunnels_wc[0]     = tunnel;
+        rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
+        return 0;
 }
-static struct xfrm_tunnel sit_handler = {
+static struct xfrm_tunnel sit_handler __read_mostly = {
        .handler        =       ipip6_rcv,
        .err_handler    =       ipip6_err,
        .priority       =       1,
@@ -1145,11 +1190,12 @@ static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_hea
        for (prio = 1; prio < 4; prio++) {
                int h;
                for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t = sitn->tunnels[prio][h];
+                        struct ip_tunnel *t;
+                        t = rtnl_dereference(sitn->tunnels[prio][h]);
                        while (t != NULL) {
                                unregister_netdevice_queue(t->dev, head);
-                                t = t->next;
+                                t = rtnl_dereference(t->next);
                        }
                }
        }
@@ -1173,7 +1219,10 @@ static int __net_init sit_init_net(struct net *net)
        }
        dev_net_set(sitn->fb_tunnel_dev, net);
-        ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
+        err = ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
+        if (err)
+                goto err_dev_free;
        ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
        if ((err = register_netdev(sitn->fb_tunnel_dev)))
@@ -1183,7 +1232,8 @@ static int __net_init sit_init_net(struct net *net)
 err_reg_dev:
        dev_put(sitn->fb_tunnel_dev);
-        free_netdev(sitn->fb_tunnel_dev);
+err_dev_free:
+        ipip6_dev_free(sitn->fb_tunnel_dev);
 err_alloc_dev:
        return err;
 }
@@ -1235,4 +1285,4 @@ static int __init sit_init(void)
 module_init(sit_init);
 module_exit(sit_cleanup);
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("sit0");
+MODULE_ALIAS_NETDEV("sit0");
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 09fd34f0dbf2..8b9644a8b697 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -66,7 +66,7 @@ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
 static DEFINE_PER_CPU(__u32 [16 + 5 + SHA_WORKSPACE_WORDS],
                      ipv6_cookie_scratch);
-static u32 cookie_hash(struct in6_addr *saddr, struct in6_addr *daddr,
+static u32 cookie_hash(const struct in6_addr *saddr, const struct in6_addr *daddr,
                       __be16 sport, __be16 dport, u32 count, int c)
 {
        __u32 *tmp = __get_cpu_var(ipv6_cookie_scratch);
@@ -86,7 +86,8 @@ static u32 cookie_hash(struct in6_addr *saddr, struct in6_addr *daddr,
        return tmp[17];
 }
-static __u32 secure_tcp_syn_cookie(struct in6_addr *saddr, struct in6_addr *daddr,
+static __u32 secure_tcp_syn_cookie(const struct in6_addr *saddr,
+                                   const struct in6_addr *daddr,
                                   __be16 sport, __be16 dport, __u32 sseq,
                                   __u32 count, __u32 data)
 {
@@ -96,8 +97,8 @@ static __u32 secure_tcp_syn_cookie(struct in6_addr *saddr, struct in6_addr *dadd
                & COOKIEMASK));
 }
-static __u32 check_tcp_syn_cookie(__u32 cookie, struct in6_addr *saddr,
+static __u32 check_tcp_syn_cookie(__u32 cookie, const struct in6_addr *saddr,
-                                  struct in6_addr *daddr, __be16 sport,
+                                  const struct in6_addr *daddr, __be16 sport,
                                  __be16 dport, __u32 sseq, __u32 count,
                                  __u32 maxdiff)
 {
@@ -116,7 +117,7 @@ static __u32 check_tcp_syn_cookie(__u32 cookie, struct in6_addr *saddr,
 __u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
        const struct tcphdr *th = tcp_hdr(skb);
        int mssind;
        const __u16 mss = *mssp;
@@ -138,7 +139,7 @@ __u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
 static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
        const struct tcphdr *th = tcp_hdr(skb);
        __u32 seq = ntohl(th->seq) - 1;
        __u32 mssind = check_tcp_syn_cookie(cookie, &iph->saddr, &iph->daddr,
@@ -232,23 +233,20 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         */
        {
                struct in6_addr *final_p, final;
-                struct flowi fl;
+                struct flowi6 fl6;
-                memset(&fl, 0, sizeof(fl));
+                memset(&fl6, 0, sizeof(fl6));
-                fl.proto = IPPROTO_TCP;
+                fl6.flowi6_proto = IPPROTO_TCP;
-                ipv6_addr_copy(&fl.fl6_dst, &ireq6->rmt_addr);
+                ipv6_addr_copy(&fl6.daddr, &ireq6->rmt_addr);
-                final_p = fl6_update_dst(&fl, np->opt, &final);
+                final_p = fl6_update_dst(&fl6, np->opt, &final);
-                ipv6_addr_copy(&fl.fl6_src, &ireq6->loc_addr);
+                ipv6_addr_copy(&fl6.saddr, &ireq6->loc_addr);
-                fl.oif = sk->sk_bound_dev_if;
+                fl6.flowi6_oif = sk->sk_bound_dev_if;
-                fl.mark = sk->sk_mark;
+                fl6.flowi6_mark = sk->sk_mark;
-                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
+                fl6.fl6_dport = inet_rsk(req)->rmt_port;
-                fl.fl_ip_sport = inet_sk(sk)->inet_sport;
+                fl6.fl6_sport = inet_sk(sk)->inet_sport;
-                security_req_classify_flow(req, &fl);
+                security_req_classify_flow(req, flowi6_to_flowi(&fl6));
-                if (ip6_dst_lookup(sk, &dst, &fl))
-                        goto out_free;
+                dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
+                if (IS_ERR(dst))
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
-                if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
                        goto out_free;
        }
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index fa1d8f4e0051..6dcf5e7d661b 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -15,6 +15,18 @@
 #include <net/addrconf.h>
 #include <net/inet_frag.h>
+static struct ctl_table empty[1];
+static ctl_table ipv6_static_skeleton[] = {
+        {
+                .procname       = "neigh",
+                .maxlen         = 0,
+                .mode           = 0555,
+                .child          = empty,
+        },
+        { }
+};
 static ctl_table ipv6_table_template[] = {
        {
                .procname       = "route",
@@ -152,8 +164,7 @@ static struct ctl_table_header *ip6_base;
 int ipv6_static_sysctl_register(void)
 {
-        static struct ctl_table empty[1];
+        ip6_base = register_sysctl_paths(net_ipv6_ctl_path, ipv6_static_skeleton);
-        ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty);
        if (ip6_base == NULL)
                return -ENOMEM;
        return 0;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index fe6d40418c0b..87551ca568cd 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -76,8 +76,8 @@ static void	tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
 static void     __tcp_v6_send_check(struct sk_buff *skb,
-                                    struct in6_addr *saddr,
+                                    const struct in6_addr *saddr,
-                                    struct in6_addr *daddr);
+                                    const struct in6_addr *daddr);
 static const struct inet_connection_sock_af_ops ipv6_mapped;
 static const struct inet_connection_sock_af_ops ipv6_specific;
@@ -86,7 +86,7 @@ static const struct tcp_sock_af_ops tcp_sock_ipv6_specific;
 static const struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
 #else
 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
-                                                   struct in6_addr *addr)
+                                                   const struct in6_addr *addr)
 {
        return NULL;
 }
@@ -106,8 +106,8 @@ static void tcp_v6_hash(struct sock *sk)
 }
 static __inline__ __sum16 tcp_v6_check(int len,
-                                   struct in6_addr *saddr,
+                                   const struct in6_addr *saddr,
-                                   struct in6_addr *daddr,
+                                   const struct in6_addr *daddr,
                                   __wsum base)
 {
        return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
@@ -130,7 +130,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
        struct in6_addr *saddr = NULL, *final_p, final;
-        struct flowi fl;
+        struct rt6_info *rt;
+        struct flowi6 fl6;
        struct dst_entry *dst;
        int addr_type;
        int err;
@@ -139,16 +140,16 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                return -EINVAL;
        if (usin->sin6_family != AF_INET6)
-                return(-EAFNOSUPPORT);
+                return -EAFNOSUPPORT;
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
        if (np->sndflow) {
-                fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
+                fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
-                IP6_ECN_flow_init(fl.fl6_flowlabel);
+                IP6_ECN_flow_init(fl6.flowlabel);
-                if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
+                if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
                        struct ip6_flowlabel *flowlabel;
-                        flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
+                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (flowlabel == NULL)
                                return -EINVAL;
                        ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
@@ -194,7 +195,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        }
        ipv6_addr_copy(&np->daddr, &usin->sin6_addr);
-        np->flow_label = fl.fl6_flowlabel;
+        np->flow_label = fl6.flowlabel;
        /*
         *      TCP over IPv4
@@ -241,35 +242,27 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        if (!ipv6_addr_any(&np->rcv_saddr))
                saddr = &np->rcv_saddr;
-        fl.proto = IPPROTO_TCP;
+        fl6.flowi6_proto = IPPROTO_TCP;
-        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
+        ipv6_addr_copy(&fl6.daddr, &np->daddr);
-        ipv6_addr_copy(&fl.fl6_src,
+        ipv6_addr_copy(&fl6.saddr,
                       (saddr ? saddr : &np->saddr));
-        fl.oif = sk->sk_bound_dev_if;
+        fl6.flowi6_oif = sk->sk_bound_dev_if;
-        fl.mark = sk->sk_mark;
+        fl6.flowi6_mark = sk->sk_mark;
-        fl.fl_ip_dport = usin->sin6_port;
+        fl6.fl6_dport = usin->sin6_port;
-        fl.fl_ip_sport = inet->inet_sport;
+        fl6.fl6_sport = inet->inet_sport;
-        final_p = fl6_update_dst(&fl, np->opt, &final);
+        final_p = fl6_update_dst(&fl6, np->opt, &final);
-        security_sk_classify_flow(sk, &fl);
+        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-        err = ip6_dst_lookup(sk, &dst, &fl);
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
-        if (err)
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
                goto failure;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
-        if (err < 0) {
-                if (err == -EREMOTE)
-                        err = ip6_dst_blackhole(sk, &dst, &fl);
-                if (err < 0)
-                        goto failure;
        }
        if (saddr == NULL) {
-                saddr = &fl.fl6_src;
+                saddr = &fl6.saddr;
                ipv6_addr_copy(&np->rcv_saddr, saddr);
        }
@@ -280,6 +273,26 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        sk->sk_gso_type = SKB_GSO_TCPV6;
        __ip6_dst_store(sk, dst, NULL, NULL);
+        rt = (struct rt6_info *) dst;
+        if (tcp_death_row.sysctl_tw_recycle &&
+            !tp->rx_opt.ts_recent_stamp &&
+            ipv6_addr_equal(&rt->rt6i_dst.addr, &np->daddr)) {
+                struct inet_peer *peer = rt6_get_peer(rt);
+                /*
+                 * VJ's idea. We save last timestamp seen from
+                 * the destination in peer table, when entering state
+                 * TIME-WAIT * and initialize rx_opt.ts_recent from it,
+                 * when trying new connection.
+                 */
+                if (peer) {
+                        inet_peer_refcheck(peer);
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp <= TCP_PAWS_MSL) {
+                                tp->rx_opt.ts_recent_stamp = peer->tcp_ts_stamp;
+                                tp->rx_opt.ts_recent = peer->tcp_ts;
+                        }
+                }
+        }
        icsk->icsk_ext_hdr_len = 0;
        if (np->opt)
                icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
@@ -318,7 +331,7 @@ failure:
 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                u8 type, u8 code, int offset, __be32 info)
 {
-        struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
+        const struct ipv6hdr *hdr = (const struct ipv6hdr*)skb->data;
        const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
        struct ipv6_pinfo *np;
        struct sock *sk;
@@ -364,7 +377,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        np = inet6_sk(sk);
        if (type == ICMPV6_PKT_TOOBIG) {
-                struct dst_entry *dst = NULL;
+                struct dst_entry *dst;
                if (sock_owned_by_user(sk))
                        goto out;
@@ -376,29 +389,25 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                if (dst == NULL) {
                        struct inet_sock *inet = inet_sk(sk);
-                        struct flowi fl;
+                        struct flowi6 fl6;
                        /* BUGGG_FUTURE: Again, it is not clear how
                           to handle rthdr case. Ignore this complexity
                           for now.
                         */
-                        memset(&fl, 0, sizeof(fl));
+                        memset(&fl6, 0, sizeof(fl6));
-                        fl.proto = IPPROTO_TCP;
+                        fl6.flowi6_proto = IPPROTO_TCP;
-                        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
+                        ipv6_addr_copy(&fl6.daddr, &np->daddr);
-                        ipv6_addr_copy(&fl.fl6_src, &np->saddr);
+                        ipv6_addr_copy(&fl6.saddr, &np->saddr);
-                        fl.oif = sk->sk_bound_dev_if;
+                        fl6.flowi6_oif = sk->sk_bound_dev_if;
-                        fl.mark = sk->sk_mark;
+                        fl6.flowi6_mark = sk->sk_mark;
-                        fl.fl_ip_dport = inet->inet_dport;
+                        fl6.fl6_dport = inet->inet_dport;
-                        fl.fl_ip_sport = inet->inet_sport;
+                        fl6.fl6_sport = inet->inet_sport;
-                        security_skb_classify_flow(skb, &fl);
+                        security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
-                        if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
+                        dst = ip6_dst_lookup_flow(sk, &fl6, NULL, false);
-                                sk->sk_err_soft = -err;
+                        if (IS_ERR(dst)) {
-                                goto out;
+                                sk->sk_err_soft = -PTR_ERR(dst);
-                        }
-                        if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0) {
-                                sk->sk_err_soft = -err;
                                goto out;
                        }
@@ -473,38 +482,37 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
        struct sk_buff * skb;
        struct ipv6_txoptions *opt = NULL;
        struct in6_addr * final_p, final;
-        struct flowi fl;
+        struct flowi6 fl6;
        struct dst_entry *dst;
-        int err = -1;
+        int err;
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
-        fl.proto = IPPROTO_TCP;
+        fl6.flowi6_proto = IPPROTO_TCP;
-        ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
+        ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
-        ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
+        ipv6_addr_copy(&fl6.saddr, &treq->loc_addr);
-        fl.fl6_flowlabel = 0;
+        fl6.flowlabel = 0;
-        fl.oif = treq->iif;
+        fl6.flowi6_oif = treq->iif;
-        fl.mark = sk->sk_mark;
+        fl6.flowi6_mark = sk->sk_mark;
-        fl.fl_ip_dport = inet_rsk(req)->rmt_port;
+        fl6.fl6_dport = inet_rsk(req)->rmt_port;
-        fl.fl_ip_sport = inet_rsk(req)->loc_port;
+        fl6.fl6_sport = inet_rsk(req)->loc_port;
-        security_req_classify_flow(req, &fl);
+        security_req_classify_flow(req, flowi6_to_flowi(&fl6));
        opt = np->opt;
-        final_p = fl6_update_dst(&fl, opt, &final);
+        final_p = fl6_update_dst(&fl6, opt, &final);
-        err = ip6_dst_lookup(sk, &dst, &fl);
+        dst = ip6_dst_lookup_flow(sk, &fl6, final_p, false);
-        if (err)
+        if (IS_ERR(dst)) {
-                goto done;
+                err = PTR_ERR(dst);
-        if (final_p)
+                dst = NULL;
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
                goto done;
+        }
        skb = tcp_make_synack(sk, dst, req, rvp);
+        err = -ENOMEM;
        if (skb) {
                __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
-                ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
+                ipv6_addr_copy(&fl6.daddr, &treq->rmt_addr);
-                err = ip6_xmit(sk, skb, &fl, opt);
+                err = ip6_xmit(sk, skb, &fl6, opt);
                err = net_xmit_eval(err);
        }
@@ -543,7 +551,7 @@ static void tcp_v6_reqsk_destructor(struct request_sock *req)
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
-                                                   struct in6_addr *addr)
+                                                   const struct in6_addr *addr)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        int i;
@@ -572,7 +580,7 @@ static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
        return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
 }
-static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
+static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                             char *newkey, u8 newkeylen)
 {
        /* Add key to the list */
@@ -637,7 +645,7 @@ static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
                                 newkey, newkeylen);
 }
-static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
+static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
 {
        struct tcp_sock *tp = tcp_sk(sk);
        int i;
@@ -745,8 +753,8 @@ static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
 }
 static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
-                                        struct in6_addr *daddr,
+                                        const struct in6_addr *daddr,
-                                        struct in6_addr *saddr, int nbytes)
+                                        const struct in6_addr *saddr, int nbytes)
 {
        struct tcp6_pseudohdr *bp;
        struct scatterlist sg;
@@ -763,7 +771,7 @@ static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
 }
 static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
-                               struct in6_addr *daddr, struct in6_addr *saddr,
+                               const struct in6_addr *daddr, struct in6_addr *saddr,
                               struct tcphdr *th)
 {
        struct tcp_md5sig_pool *hp;
@@ -799,7 +807,7 @@ static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
                               struct sock *sk, struct request_sock *req,
                               struct sk_buff *skb)
 {
-        struct in6_addr *saddr, *daddr;
+        const struct in6_addr *saddr, *daddr;
        struct tcp_md5sig_pool *hp;
        struct hash_desc *desc;
        struct tcphdr *th = tcp_hdr(skb);
@@ -811,7 +819,7 @@ static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
                saddr = &inet6_rsk(req)->loc_addr;
                daddr = &inet6_rsk(req)->rmt_addr;
        } else {
-                struct ipv6hdr *ip6h = ipv6_hdr(skb);
+                const struct ipv6hdr *ip6h = ipv6_hdr(skb);
                saddr = &ip6h->saddr;
                daddr = &ip6h->daddr;
        }
@@ -849,7 +857,7 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 {
        __u8 *hash_location = NULL;
        struct tcp_md5sig_key *hash_expected;
-        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        const struct ipv6hdr *ip6h = ipv6_hdr(skb);
        struct tcphdr *th = tcp_hdr(skb);
        int genhash;
        u8 newhash[16];
@@ -906,14 +914,8 @@ static const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
 };
 #endif
-static struct timewait_sock_ops tcp6_timewait_sock_ops = {
-        .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
-        .twsk_unique    = tcp_twsk_unique,
-        .twsk_destructor= tcp_twsk_destructor,
-};
 static void __tcp_v6_send_check(struct sk_buff *skb,
-                                struct in6_addr *saddr, struct in6_addr *daddr)
+                                const struct in6_addr *saddr, const struct in6_addr *daddr)
 {
        struct tcphdr *th = tcp_hdr(skb);
@@ -937,7 +939,7 @@ static void tcp_v6_send_check(struct sock *sk, struct sk_buff *skb)
 static int tcp_v6_gso_send_check(struct sk_buff *skb)
 {
-        struct ipv6hdr *ipv6h;
+        const struct ipv6hdr *ipv6h;
        struct tcphdr *th;
        if (!pskb_may_pull(skb, sizeof(*th)))
@@ -955,7 +957,7 @@ static int tcp_v6_gso_send_check(struct sk_buff *skb)
 static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
                                         struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = skb_gro_network_header(skb);
+        const struct ipv6hdr *iph = skb_gro_network_header(skb);
        switch (skb->ip_summed) {
        case CHECKSUM_COMPLETE:
@@ -976,7 +978,7 @@ static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
 static int tcp6_gro_complete(struct sk_buff *skb)
 {
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
        struct tcphdr *th = tcp_hdr(skb);
        th->check = ~tcp_v6_check(skb->len - skb_transport_offset(skb),
@@ -991,7 +993,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 {
        struct tcphdr *th = tcp_hdr(skb), *t1;
        struct sk_buff *buff;
-        struct flowi fl;
+        struct flowi6 fl6;
        struct net *net = dev_net(skb_dst(skb)->dev);
        struct sock *ctl_sk = net->ipv6.tcp_sk;
        unsigned int tot_len = sizeof(struct tcphdr);
@@ -1045,34 +1047,33 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
        }
 #endif
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
-        ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
+        ipv6_addr_copy(&fl6.daddr, &ipv6_hdr(skb)->saddr);
-        ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
+        ipv6_addr_copy(&fl6.saddr, &ipv6_hdr(skb)->daddr);
        buff->ip_summed = CHECKSUM_PARTIAL;
        buff->csum = 0;
-        __tcp_v6_send_check(buff, &fl.fl6_src, &fl.fl6_dst);
+        __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr);
-        fl.proto = IPPROTO_TCP;
+        fl6.flowi6_proto = IPPROTO_TCP;
-        fl.oif = inet6_iif(skb);
+        fl6.flowi6_oif = inet6_iif(skb);
-        fl.fl_ip_dport = t1->dest;
+        fl6.fl6_dport = t1->dest;
-        fl.fl_ip_sport = t1->source;
+        fl6.fl6_sport = t1->source;
-        security_skb_classify_flow(skb, &fl);
+        security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
        /* Pass a socket to ip6_dst_lookup either it is for RST
         * Underlying function will use this to retrieve the network
         * namespace
         */
-        if (!ip6_dst_lookup(ctl_sk, &dst, &fl)) {
+        dst = ip6_dst_lookup_flow(ctl_sk, &fl6, NULL, false);
-                if (xfrm_lookup(net, &dst, &fl, NULL, 0) >= 0) {
+        if (!IS_ERR(dst)) {
-                        skb_dst_set(buff, dst);
+                skb_dst_set(buff, dst);
-                        ip6_xmit(ctl_sk, buff, &fl, NULL);
+                ip6_xmit(ctl_sk, buff, &fl6, NULL);
-                        TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
+                TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
-                        if (rst)
+                if (rst)
-                                TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
+                        TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
-                        return;
+                return;
-                }
        }
        kfree_skb(buff);
@@ -1176,6 +1177,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct tcp_sock *tp = tcp_sk(sk);
        __u32 isn = TCP_SKB_CB(skb)->when;
+        struct dst_entry *dst = NULL;
 #ifdef CONFIG_SYN_COOKIES
        int want_cookie = 0;
 #else
@@ -1273,6 +1275,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                TCP_ECN_create_request(req, tcp_hdr(skb));
        if (!isn) {
+                struct inet_peer *peer = NULL;
                if (ipv6_opt_accepted(sk, skb) ||
                    np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
                    np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
@@ -1285,13 +1289,57 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                if (!sk->sk_bound_dev_if &&
                    ipv6_addr_type(&treq->rmt_addr) & IPV6_ADDR_LINKLOCAL)
                        treq->iif = inet6_iif(skb);
-                if (!want_cookie) {
-                        isn = tcp_v6_init_sequence(skb);
+                if (want_cookie) {
-                } else {
                        isn = cookie_v6_init_sequence(sk, skb, &req->mss);
                        req->cookie_ts = tmp_opt.tstamp_ok;
+                        goto have_isn;
+                }
+                /* VJ's idea. We save last timestamp seen
+                 * from the destination in peer table, when entering
+                 * state TIME-WAIT, and check against it before
+                 * accepting new connection request.
+                 *
+                 * If "isn" is not zero, this request hit alive
+                 * timewait bucket, so that all the necessary checks
+                 * are made in the function processing timewait state.
+                 */
+                if (tmp_opt.saw_tstamp &&
+                    tcp_death_row.sysctl_tw_recycle &&
+                    (dst = inet6_csk_route_req(sk, req)) != NULL &&
+                    (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
+                    ipv6_addr_equal((struct in6_addr *)peer->daddr.addr.a6,
+                                    &treq->rmt_addr)) {
+                        inet_peer_refcheck(peer);
+                        if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
+                            (s32)(peer->tcp_ts - req->ts_recent) >
+                                                        TCP_PAWS_WINDOW) {
+                                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_PAWSPASSIVEREJECTED);
+                                goto drop_and_release;
+                        }
                }
+                /* Kill the following clause, if you dislike this way. */
+                else if (!sysctl_tcp_syncookies &&
+                         (sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
+                          (sysctl_max_syn_backlog >> 2)) &&
+                         (!peer || !peer->tcp_ts_stamp) &&
+                         (!dst || !dst_metric(dst, RTAX_RTT))) {
+                        /* Without syncookies last quarter of
+                         * backlog is filled with destinations,
+                         * proven to be alive.
+                         * It means that we continue to communicate
+                         * to destinations, already remembered
+                         * to the moment of synflood.
+                         */
+                        LIMIT_NETDEBUG(KERN_DEBUG "TCP: drop open request from %pI6/%u\n",
+                                       &treq->rmt_addr, ntohs(tcp_hdr(skb)->source));
+                        goto drop_and_release;
+                }
+                isn = tcp_v6_init_sequence(skb);
        }
+have_isn:
        tcp_rsk(req)->snt_isn = isn;
        security_inet_conn_request(sk, skb, req);
@@ -1304,6 +1352,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
        return 0;
+drop_and_release:
+        dst_release(dst);
 drop_and_free:
        reqsk_free(req);
 drop:
@@ -1382,34 +1432,15 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
        if (sk_acceptq_is_full(sk))
                goto out_overflow;
-        if (dst == NULL) {
+        if (!dst) {
-                struct in6_addr *final_p, final;
+                dst = inet6_csk_route_req(sk, req);
-                struct flowi fl;
+                if (!dst)
-                memset(&fl, 0, sizeof(fl));
-                fl.proto = IPPROTO_TCP;
-                ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
-                final_p = fl6_update_dst(&fl, opt, &final);
-                ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
-                fl.oif = sk->sk_bound_dev_if;
-                fl.mark = sk->sk_mark;
-                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
-                fl.fl_ip_sport = inet_rsk(req)->loc_port;
-                security_req_classify_flow(req, &fl);
-                if (ip6_dst_lookup(sk, &dst, &fl))
-                        goto out;
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
-                if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
                        goto out;
        }
        newsk = tcp_create_openreq_child(sk, req, skb);
        if (newsk == NULL)
-                goto out;
+                goto out_nonewsk;
        /*
         * No need to charge this sock to the relevant IPv6 refcnt debug socks
@@ -1438,7 +1469,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
           First: no IPv4 options.
         */
-        newinet->opt = NULL;
+        newinet->inet_opt = NULL;
        newnp->ipv6_fl_list = NULL;
        /* Clone RX bits */
@@ -1476,7 +1507,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
        tcp_mtup_init(newsk);
        tcp_sync_mss(newsk, dst_mtu(dst));
-        newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
+        newtp->advmss = dst_metric_advmss(dst);
        tcp_initialize_rcv_mss(newsk);
        newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
@@ -1497,18 +1528,22 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
        }
 #endif
+        if (__inet_inherit_port(sk, newsk) < 0) {
+                sock_put(newsk);
+                goto out;
+        }
        __inet6_hash(newsk, NULL);
-        __inet_inherit_port(sk, newsk);
        return newsk;
 out_overflow:
        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
-out:
+out_nonewsk:
-        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
        if (opt && opt != np->opt)
                sock_kfree_s(sk, opt, opt->tot_len);
        dst_release(dst);
+out:
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
        return NULL;
 }
@@ -1587,10 +1622,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                opt_skb = skb_clone(skb, GFP_ATOMIC);
        if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
-                TCP_CHECK_TIMER(sk);
+                sock_rps_save_rxhash(sk, skb->rxhash);
                if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                        goto reset;
-                TCP_CHECK_TIMER(sk);
                if (opt_skb)
                        goto ipv6_pktoptions;
                return 0;
@@ -1610,18 +1644,18 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 * the new socket..
                 */
                if(nsk != sk) {
+                        sock_rps_save_rxhash(nsk, skb->rxhash);
                        if (tcp_child_process(sk, nsk, skb))
                                goto reset;
                        if (opt_skb)
                                __kfree_skb(opt_skb);
                        return 0;
                }
-        }
+        } else
+                sock_rps_save_rxhash(sk, skb->rxhash);
-        TCP_CHECK_TIMER(sk);
        if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
                goto reset;
-        TCP_CHECK_TIMER(sk);
        if (opt_skb)
                goto ipv6_pktoptions;
        return 0;
@@ -1669,7 +1703,7 @@ ipv6_pktoptions:
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
        struct tcphdr *th;
-        struct ipv6hdr *hdr;
+        const struct ipv6hdr *hdr;
        struct sock *sk;
        int ret;
        struct net *net = dev_net(skb->dev);
@@ -1814,19 +1848,51 @@ do_time_wait:
        goto discard_it;
 }
-static int tcp_v6_remember_stamp(struct sock *sk)
+static struct inet_peer *tcp_v6_get_peer(struct sock *sk, bool *release_it)
 {
-        /* Alas, not yet... */
+        struct rt6_info *rt = (struct rt6_info *) __sk_dst_get(sk);
-        return 0;
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct inet_peer *peer;
+        if (!rt ||
+            !ipv6_addr_equal(&np->daddr, &rt->rt6i_dst.addr)) {
+                peer = inet_getpeer_v6(&np->daddr, 1);
+                *release_it = true;
+        } else {
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
+                peer = rt->rt6i_peer;
+                *release_it = false;
+        }
+        return peer;
+}
+static void *tcp_v6_tw_get_peer(struct sock *sk)
+{
+        struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
+        struct inet_timewait_sock *tw = inet_twsk(sk);
+        if (tw->tw_family == AF_INET)
+                return tcp_v4_tw_get_peer(sk);
+        return inet_getpeer_v6(&tw6->tw_v6_daddr, 1);
 }
+static struct timewait_sock_ops tcp6_timewait_sock_ops = {
+        .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
+        .twsk_unique    = tcp_twsk_unique,
+        .twsk_destructor= tcp_twsk_destructor,
+        .twsk_getpeer   = tcp_v6_tw_get_peer,
+};
 static const struct inet_connection_sock_af_ops ipv6_specific = {
        .queue_xmit        = inet6_csk_xmit,
        .send_check        = tcp_v6_send_check,
        .rebuild_header    = inet6_sk_rebuild_header,
        .conn_request      = tcp_v6_conn_request,
        .syn_recv_sock     = tcp_v6_syn_recv_sock,
-        .remember_stamp    = tcp_v6_remember_stamp,
+        .get_peer          = tcp_v6_get_peer,
        .net_header_len    = sizeof(struct ipv6hdr),
        .setsockopt        = ipv6_setsockopt,
        .getsockopt        = ipv6_getsockopt,
@@ -1858,7 +1924,7 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
        .rebuild_header    = inet_sk_rebuild_header,
        .conn_request      = tcp_v6_conn_request,
        .syn_recv_sock     = tcp_v6_syn_recv_sock,
-        .remember_stamp    = tcp_v4_remember_stamp,
+        .get_peer          = tcp_v4_get_peer,
        .net_header_len    = sizeof(struct iphdr),
        .setsockopt        = ipv6_setsockopt,
        .getsockopt        = ipv6_getsockopt,
@@ -1963,15 +2029,15 @@ static void get_openreq6(struct seq_file *seq,
                         struct sock *sk, struct request_sock *req, int i, int uid)
 {
        int ttd = req->expires - jiffies;
-        struct in6_addr *src = &inet6_rsk(req)->loc_addr;
+        const struct in6_addr *src = &inet6_rsk(req)->loc_addr;
-        struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
+        const struct in6_addr *dest = &inet6_rsk(req)->rmt_addr;
        if (ttd < 0)
                ttd = 0;
        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
                   i,
                   src->s6_addr32[0], src->s6_addr32[1],
                   src->s6_addr32[2], src->s6_addr32[3],
@@ -1992,7 +2058,7 @@ static void get_openreq6(struct seq_file *seq,
 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 {
-        struct in6_addr *dest, *src;
+        const struct in6_addr *dest, *src;
        __u16 destp, srcp;
        int timer_active;
        unsigned long timer_expires;
@@ -2022,7 +2088,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %lu %lu %u %u %d\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %lu %lu %u %u %d\n",
                   i,
                   src->s6_addr32[0], src->s6_addr32[1],
                   src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -2049,7 +2115,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
 static void get_timewait6_sock(struct seq_file *seq,
                               struct inet_timewait_sock *tw, int i)
 {
-        struct in6_addr *dest, *src;
+        const struct in6_addr *dest, *src;
        __u16 destp, srcp;
        struct inet6_timewait_sock *tw6 = inet6_twsk((struct sock *)tw);
        int ttd = tw->tw_ttd - jiffies;
@@ -2064,7 +2130,7 @@ static void get_timewait6_sock(struct seq_file *seq,
        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK\n",
                   i,
                   src->s6_addr32[0], src->s6_addr32[1],
                   src->s6_addr32[2], src->s6_addr32[3], srcp,
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index fc3c86a47452..4f3cec12aa85 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -30,28 +30,31 @@
 #include <net/protocol.h>
 #include <net/xfrm.h>
-static struct xfrm6_tunnel *tunnel6_handlers;
+static struct xfrm6_tunnel __rcu *tunnel6_handlers __read_mostly;
-static struct xfrm6_tunnel *tunnel46_handlers;
+static struct xfrm6_tunnel __rcu *tunnel46_handlers __read_mostly;
 static DEFINE_MUTEX(tunnel6_mutex);
 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family)
 {
-        struct xfrm6_tunnel **pprev;
+        struct xfrm6_tunnel __rcu **pprev;
+        struct xfrm6_tunnel *t;
        int ret = -EEXIST;
        int priority = handler->priority;
        mutex_lock(&tunnel6_mutex);
        for (pprev = (family == AF_INET6) ? &tunnel6_handlers : &tunnel46_handlers;
-             *pprev; pprev = &(*pprev)->next) {
+             (t = rcu_dereference_protected(*pprev,
-                if ((*pprev)->priority > priority)
+                        lockdep_is_held(&tunnel6_mutex))) != NULL;
+             pprev = &t->next) {
+                if (t->priority > priority)
                        break;
-                if ((*pprev)->priority == priority)
+                if (t->priority == priority)
                        goto err;
        }
        handler->next = *pprev;
-        *pprev = handler;
+        rcu_assign_pointer(*pprev, handler);
        ret = 0;
@@ -65,14 +68,17 @@ EXPORT_SYMBOL(xfrm6_tunnel_register);
 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family)
 {
-        struct xfrm6_tunnel **pprev;
+        struct xfrm6_tunnel __rcu **pprev;
+        struct xfrm6_tunnel *t;
        int ret = -ENOENT;
        mutex_lock(&tunnel6_mutex);
        for (pprev = (family == AF_INET6) ? &tunnel6_handlers : &tunnel46_handlers;
-             *pprev; pprev = &(*pprev)->next) {
+             (t = rcu_dereference_protected(*pprev,
-                if (*pprev == handler) {
+                        lockdep_is_held(&tunnel6_mutex))) != NULL;
+             pprev = &t->next) {
+                if (t == handler) {
                        *pprev = handler->next;
                        ret = 0;
                        break;
@@ -88,6 +94,11 @@ int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family)
 EXPORT_SYMBOL(xfrm6_tunnel_deregister);
+#define for_each_tunnel_rcu(head, handler)              \
+        for (handler = rcu_dereference(head);           \
+             handler != NULL;                           \
+             handler = rcu_dereference(handler->next))  \
 static int tunnel6_rcv(struct sk_buff *skb)
 {
        struct xfrm6_tunnel *handler;
@@ -95,7 +106,7 @@ static int tunnel6_rcv(struct sk_buff *skb)
        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                goto drop;
-        for (handler = tunnel6_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel6_handlers, handler)
                if (!handler->handler(skb))
                        return 0;
@@ -113,7 +124,7 @@ static int tunnel46_rcv(struct sk_buff *skb)
        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                goto drop;
-        for (handler = tunnel46_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel46_handlers, handler)
                if (!handler->handler(skb))
                        return 0;
@@ -129,7 +140,7 @@ static void tunnel6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
        struct xfrm6_tunnel *handler;
-        for (handler = tunnel6_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel6_handlers, handler)
                if (!handler->err_handler(skb, opt, type, code, offset, info))
                        break;
 }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 5acb3560ff15..328985c40883 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -54,8 +54,8 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
        const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
        const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
-        __be32 sk1_rcv_saddr = inet_sk(sk)->inet_rcv_saddr;
+        __be32 sk1_rcv_saddr = sk_rcv_saddr(sk);
-        __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
+        __be32 sk2_rcv_saddr = sk_rcv_saddr(sk2);
        int sk_ipv6only = ipv6_only_sock(sk);
        int sk2_ipv6only = inet_v6_ipv6only(sk2);
        int addr_type = ipv6_addr_type(sk_rcv_saddr6);
@@ -122,8 +122,8 @@ static void udp_v6_rehash(struct sock *sk)
 static inline int compute_score(struct sock *sk, struct net *net,
                                unsigned short hnum,
-                                struct in6_addr *saddr, __be16 sport,
+                                const struct in6_addr *saddr, __be16 sport,
-                                struct in6_addr *daddr, __be16 dport,
+                                const struct in6_addr *daddr, __be16 dport,
                                int dif)
 {
        int score = -1;
@@ -227,7 +227,7 @@ begin:
        if (result) {
 exact_match:
-                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                if (unlikely(!atomic_inc_not_zero_hint(&result->sk_refcnt, 2)))
                        result = NULL;
                else if (unlikely(compute_score2(result, net, saddr, sport,
                                  daddr, hnum, dif) < badness)) {
@@ -239,8 +239,8 @@ exact_match:
 }
 static struct sock *__udp6_lib_lookup(struct net *net,
-                                      struct in6_addr *saddr, __be16 sport,
+                                      const struct in6_addr *saddr, __be16 sport,
-                                      struct in6_addr *daddr, __be16 dport,
+                                      const struct in6_addr *daddr, __be16 dport,
                                      int dif, struct udp_table *udptable)
 {
        struct sock *sk, *result;
@@ -294,7 +294,7 @@ begin:
                goto begin;
        if (result) {
-                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                if (unlikely(!atomic_inc_not_zero_hint(&result->sk_refcnt, 2)))
                        result = NULL;
                else if (unlikely(compute_score(result, net, hnum, saddr, sport,
                                        daddr, dport, dif) < badness)) {
@@ -311,7 +311,7 @@ static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,
                                          struct udp_table *udptable)
 {
        struct sock *sk;
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
        if (unlikely(sk = skb_steal_sock(skb)))
                return sk;
@@ -320,6 +320,14 @@ static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,
                                 udptable);
 }
+struct sock *udp6_lib_lookup(struct net *net, const struct in6_addr *saddr, __be16 sport,
+                             const struct in6_addr *daddr, __be16 dport, int dif)
+{
+        return __udp6_lib_lookup(net, saddr, sport, daddr, dport, dif, &udp_table);
+}
+EXPORT_SYMBOL_GPL(udp6_lib_lookup);
 /*
 *      This should be easy, if there is something there we
 *      return it, otherwise we block.
@@ -445,8 +453,11 @@ csum_copy_err:
        }
        unlock_sock_fast(sk, slow);
-        if (flags & MSG_DONTWAIT)
+        if (noblock)
                return -EAGAIN;
+        /* starting over for a new packet */
+        msg->msg_flags &= ~MSG_TRUNC;
        goto try_again;
 }
@@ -455,9 +466,9 @@ void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                    struct udp_table *udptable)
 {
        struct ipv6_pinfo *np;
-        struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
+        const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
-        struct in6_addr *saddr = &hdr->saddr;
+        const struct in6_addr *saddr = &hdr->saddr;
-        struct in6_addr *daddr = &hdr->daddr;
+        const struct in6_addr *daddr = &hdr->daddr;
        struct udphdr *uh = (struct udphdr*)(skb->data+offset);
        struct sock *sk;
        int err;
@@ -497,6 +508,9 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
        int rc;
        int is_udplite = IS_UDPLITE(sk);
+        if (!ipv6_addr_any(&inet6_sk(sk)->daddr))
+                sock_rps_save_rxhash(sk, skb->rxhash);
        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                goto drop;
@@ -519,7 +533,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                }
        }
-        if (sk->sk_filter) {
+        if (rcu_dereference_raw(sk->sk_filter)) {
                if (udp_lib_checksum_complete(skb))
                        goto drop;
        }
@@ -542,8 +556,8 @@ drop_no_sk_drops_inc:
 }
 static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
-                                      __be16 loc_port, struct in6_addr *loc_addr,
+                                      __be16 loc_port, const struct in6_addr *loc_addr,
-                                      __be16 rmt_port, struct in6_addr *rmt_addr,
+                                      __be16 rmt_port, const struct in6_addr *rmt_addr,
                                      int dif)
 {
        struct hlist_nulls_node *node;
@@ -594,7 +608,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
                sk = stack[i];
                if (skb1) {
-                        if (sk_rcvqueues_full(sk, skb)) {
+                        if (sk_rcvqueues_full(sk, skb1)) {
                                kfree_skb(skb1);
                                goto drop;
                        }
@@ -622,7 +636,7 @@ drop:
 * so we don't need to lock the hashes.
 */
 static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
-                struct in6_addr *saddr, struct in6_addr *daddr,
+                const struct in6_addr *saddr, const struct in6_addr *daddr,
                struct udp_table *udptable)
 {
        struct sock *sk, *stack[256 / sizeof(struct sock *)];
@@ -705,7 +719,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        struct net *net = dev_net(skb->dev);
        struct sock *sk;
        struct udphdr *uh;
-        struct in6_addr *saddr, *daddr;
+        const struct in6_addr *saddr, *daddr;
        u32 ulen = 0;
        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
@@ -878,7 +892,7 @@ static int udp_v6_push_pending_frames(struct sock *sk)
        struct udphdr *uh;
        struct udp_sock  *up = udp_sk(sk);
        struct inet_sock *inet = inet_sk(sk);
-        struct flowi *fl = &inet->cork.fl;
+        struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
        int err = 0;
        int is_udplite = IS_UDPLITE(sk);
        __wsum csum = 0;
@@ -891,23 +905,23 @@ static int udp_v6_push_pending_frames(struct sock *sk)
         * Create a UDP header
         */
        uh = udp_hdr(skb);
-        uh->source = fl->fl_ip_sport;
+        uh->source = fl6->fl6_sport;
-        uh->dest = fl->fl_ip_dport;
+        uh->dest = fl6->fl6_dport;
        uh->len = htons(up->len);
        uh->check = 0;
        if (is_udplite)
                csum = udplite_csum_outgoing(sk, skb);
        else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
-                udp6_hwcsum_outgoing(sk, skb, &fl->fl6_src, &fl->fl6_dst,
+                udp6_hwcsum_outgoing(sk, skb, &fl6->saddr, &fl6->daddr,
                                     up->len);
                goto send;
        } else
                csum = udp_csum_outgoing(sk, skb);
        /* add protocol-dependent pseudo-header */
-        uh->check = csum_ipv6_magic(&fl->fl6_src, &fl->fl6_dst,
+        uh->check = csum_ipv6_magic(&fl6->saddr, &fl6->daddr,
-                                    up->len, fl->proto, csum   );
+                                    up->len, fl6->flowi6_proto, csum);
        if (uh->check == 0)
                uh->check = CSUM_MANGLED_0;
@@ -939,7 +953,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
        struct in6_addr *daddr, *final_p, final;
        struct ipv6_txoptions *opt = NULL;
        struct ip6_flowlabel *flowlabel = NULL;
-        struct flowi fl;
+        struct flowi6 fl6;
        struct dst_entry *dst;
        int addr_len = msg->msg_namelen;
        int ulen = len;
@@ -1022,19 +1036,19 @@ do_udp_sendmsg:
        }
        ulen += sizeof(struct udphdr);
-        memset(&fl, 0, sizeof(fl));
+        memset(&fl6, 0, sizeof(fl6));
        if (sin6) {
                if (sin6->sin6_port == 0)
                        return -EINVAL;
-                fl.fl_ip_dport = sin6->sin6_port;
+                fl6.fl6_dport = sin6->sin6_port;
                daddr = &sin6->sin6_addr;
                if (np->sndflow) {
-                        fl.fl6_flowlabel = sin6->sin6_flowinfo&IPV6_FLOWINFO_MASK;
+                        fl6.flowlabel = sin6->sin6_flowinfo&IPV6_FLOWINFO_MASK;
-                        if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
+                        if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
-                                flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
+                                flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                                if (flowlabel == NULL)
                                        return -EINVAL;
                                daddr = &flowlabel->dst;
@@ -1052,38 +1066,38 @@ do_udp_sendmsg:
                if (addr_len >= sizeof(struct sockaddr_in6) &&
                    sin6->sin6_scope_id &&
                    ipv6_addr_type(daddr)&IPV6_ADDR_LINKLOCAL)
-                        fl.oif = sin6->sin6_scope_id;
+                        fl6.flowi6_oif = sin6->sin6_scope_id;
        } else {
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -EDESTADDRREQ;
-                fl.fl_ip_dport = inet->inet_dport;
+                fl6.fl6_dport = inet->inet_dport;
                daddr = &np->daddr;
-                fl.fl6_flowlabel = np->flow_label;
+                fl6.flowlabel = np->flow_label;
                connected = 1;
        }
-        if (!fl.oif)
+        if (!fl6.flowi6_oif)
-                fl.oif = sk->sk_bound_dev_if;
+                fl6.flowi6_oif = sk->sk_bound_dev_if;
-        if (!fl.oif)
+        if (!fl6.flowi6_oif)
-                fl.oif = np->sticky_pktinfo.ipi6_ifindex;
+                fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex;
-        fl.mark = sk->sk_mark;
+        fl6.flowi6_mark = sk->sk_mark;
        if (msg->msg_controllen) {
                opt = &opt_space;
                memset(opt, 0, sizeof(struct ipv6_txoptions));
                opt->tot_len = sizeof(*opt);
-                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit,
+                err = datagram_send_ctl(sock_net(sk), msg, &fl6, opt, &hlimit,
                                        &tclass, &dontfrag);
                if (err < 0) {
                        fl6_sock_release(flowlabel);
                        return err;
                }
-                if ((fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) && !flowlabel) {
+                if ((fl6.flowlabel&IPV6_FLOWLABEL_MASK) && !flowlabel) {
-                        flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
+                        flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
                        if (flowlabel == NULL)
                                return -EINVAL;
                }
@@ -1097,42 +1111,35 @@ do_udp_sendmsg:
                opt = fl6_merge_options(&opt_space, flowlabel, opt);
        opt = ipv6_fixup_options(&opt_space, opt);
-        fl.proto = sk->sk_protocol;
+        fl6.flowi6_proto = sk->sk_protocol;
        if (!ipv6_addr_any(daddr))
-                ipv6_addr_copy(&fl.fl6_dst, daddr);
+                ipv6_addr_copy(&fl6.daddr, daddr);
        else
-                fl.fl6_dst.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
+                fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
-        if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
+        if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
-                ipv6_addr_copy(&fl.fl6_src, &np->saddr);
+                ipv6_addr_copy(&fl6.saddr, &np->saddr);
-        fl.fl_ip_sport = inet->inet_sport;
+        fl6.fl6_sport = inet->inet_sport;
-        final_p = fl6_update_dst(&fl, opt, &final);
+        final_p = fl6_update_dst(&fl6, opt, &final);
        if (final_p)
                connected = 0;
-        if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst)) {
+        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) {
-                fl.oif = np->mcast_oif;
+                fl6.flowi6_oif = np->mcast_oif;
                connected = 0;
        }
-        security_sk_classify_flow(sk, &fl);
+        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
-        err = ip6_sk_dst_lookup(sk, &dst, &fl);
+        dst = ip6_sk_dst_lookup_flow(sk, &fl6, final_p, true);
-        if (err)
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
+                dst = NULL;
                goto out;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
-        if (err < 0) {
-                if (err == -EREMOTE)
-                        err = ip6_dst_blackhole(sk, &dst, &fl);
-                if (err < 0)
-                        goto out;
        }
        if (hlimit < 0) {
-                if (ipv6_addr_is_multicast(&fl.fl6_dst))
+                if (ipv6_addr_is_multicast(&fl6.daddr))
                        hlimit = np->mcast_hops;
                else
                        hlimit = np->hop_limit;
@@ -1167,7 +1174,7 @@ do_append_data:
        up->len += ulen;
        getfrag  =  is_udplite ?  udplite_getfrag : ip_generic_getfrag;
        err = ip6_append_data(sk, getfrag, msg->msg_iov, ulen,
-                sizeof(struct udphdr), hlimit, tclass, opt, &fl,
+                sizeof(struct udphdr), hlimit, tclass, opt, &fl6,
                (struct rt6_info*)dst,
                corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags, dontfrag);
        if (err)
@@ -1180,10 +1187,10 @@ do_append_data:
        if (dst) {
                if (connected) {
                        ip6_dst_store(sk, dst,
-                                      ipv6_addr_equal(&fl.fl6_dst, &np->daddr) ?
+                                      ipv6_addr_equal(&fl6.daddr, &np->daddr) ?
                                      &np->daddr : NULL,
 #ifdef CONFIG_IPV6_SUBTREES
-                                      ipv6_addr_equal(&fl.fl6_src, &np->saddr) ?
+                                      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
                                      &np->saddr :
 #endif
                                      NULL);
@@ -1274,7 +1281,7 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
 static int udp6_ufo_send_check(struct sk_buff *skb)
 {
-        struct ipv6hdr *ipv6h;
+        const struct ipv6hdr *ipv6h;
        struct udphdr *uh;
        if (!pskb_may_pull(skb, sizeof(*uh)))
@@ -1291,7 +1298,7 @@ static int udp6_ufo_send_check(struct sk_buff *skb)
        return 0;
 }
-static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, int features)
+static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
 {
        struct sk_buff *segs = ERR_PTR(-EINVAL);
        unsigned int mss;
@@ -1324,14 +1331,14 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, int features)
        /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
         * do checksum of UDP packets sent as multiple IP fragments.
         */
-        offset = skb->csum_start - skb_headroom(skb);
+        offset = skb_checksum_start_offset(skb);
        csum = skb_checksum(skb, offset, skb->len- offset, 0);
        offset += skb->csum_offset;
        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
        skb->ip_summed = CHECKSUM_NONE;
        /* Check if there is enough headroom to insert fragment header. */
-        if ((skb_headroom(skb) < frag_hdr_sz) &&
+        if ((skb_mac_header(skb) < skb->head + frag_hdr_sz) &&
            pskb_expand_head(skb, frag_hdr_sz, 0, GFP_ATOMIC))
                goto out;
@@ -1378,7 +1385,7 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
 {
        struct inet_sock *inet = inet_sk(sp);
        struct ipv6_pinfo *np = inet6_sk(sp);
-        struct in6_addr *dest, *src;
+        const struct in6_addr *dest, *src;
        __u16 destp, srcp;
        dest  = &np->daddr;
@@ -1387,7 +1394,7 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
        srcp  = ntohs(inet->inet_sport);
        seq_printf(seq,
                   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
                   bucket,
                   src->s6_addr32[0], src->s6_addr32[1],
                   src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -1469,6 +1476,7 @@ struct proto udpv6_prot = {
        .compat_setsockopt = compat_udpv6_setsockopt,
        .compat_getsockopt = compat_udpv6_getsockopt,
 #endif
+        .clear_sk          = sk_prot_clear_portaddr_nulls,
 };
 static struct inet_protosw udpv6_protosw = {
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 5f48fadc27f7..986c4de5292e 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -55,6 +55,7 @@ struct proto udplitev6_prot = {
        .compat_setsockopt = compat_udpv6_setsockopt,
        .compat_getsockopt = compat_udpv6_getsockopt,
 #endif
+        .clear_sk          = sk_prot_clear_portaddr_nulls,
 };
 static struct inet_protosw udplite6_protosw = {
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index bbd48b101bae..3437d7d4eed6 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -41,10 +41,8 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 {
        struct ipv6hdr *top_iph;
        struct ip_beet_phdr *ph;
-        struct iphdr *iphv4;
        int optlen, hdr_len;
-        iphv4 = ip_hdr(skb);
        hdr_len = 0;
        optlen = XFRM_MODE_SKB_CB(skb)->optlen;
        if (unlikely(optlen))
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index b809812c8d30..4d6edff0498f 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -14,12 +14,13 @@
 #include <net/dsfield.h>
 #include <net/dst.h>
 #include <net/inet_ecn.h>
+#include <net/ip6_route.h>
 #include <net/ipv6.h>
 #include <net/xfrm.h>
 static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)
 {
-        struct ipv6hdr *outer_iph = ipv6_hdr(skb);
+        const struct ipv6hdr *outer_iph = ipv6_hdr(skb);
        struct ipv6hdr *inner_iph = ipipv6_hdr(skb);
        if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph)))
@@ -53,9 +54,9 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
        if (x->props.flags & XFRM_STATE_NOECN)
                dsfield &= ~INET_ECN_MASK;
        ipv6_change_dsfield(top_iph, 0, dsfield);
-        top_iph->hop_limit = dst_metric(dst->child, RTAX_HOPLIMIT);
+        top_iph->hop_limit = ip6_dst_hoplimit(dst->child);
-        ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
+        ipv6_addr_copy(&top_iph->saddr, (const struct in6_addr *)&x->props.saddr);
-        ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
+        ipv6_addr_copy(&top_iph->daddr, (const struct in6_addr *)&x->id.daddr);
        return 0;
 }
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 6434bd5ce088..49a91c5f5623 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -17,6 +17,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <net/dst.h>
 #include <net/ipv6.h>
+#include <net/ip6_route.h>
 #include <net/xfrm.h>
 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
@@ -78,7 +79,7 @@ int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(xfrm6_prepare_output);
-static int xfrm6_output_finish(struct sk_buff *skb)
+int xfrm6_output_finish(struct sk_buff *skb)
 {
 #ifdef CONFIG_NETFILTER
        IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
@@ -88,8 +89,21 @@ static int xfrm6_output_finish(struct sk_buff *skb)
        return xfrm_output(skb);
 }
+static int __xfrm6_output(struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+        struct xfrm_state *x = dst->xfrm;
+        if ((x && x->props.mode == XFRM_MODE_TUNNEL) &&
+            ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
+                dst_allfrag(skb_dst(skb)))) {
+                        return ip6_fragment(skb, x->outer_mode->afinfo->output_finish);
+        }
+        return x->outer_mode->afinfo->output_finish(skb);
+}
 int xfrm6_output(struct sk_buff *skb)
 {
        return NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL,
-                       skb_dst(skb)->dev, xfrm6_output_finish);
+                       skb_dst(skb)->dev, __xfrm6_output);
 }
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 6baeabbbca82..d879f7efbd10 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -27,18 +27,19 @@
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
 static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,
-                                          xfrm_address_t *saddr,
+                                          const xfrm_address_t *saddr,
-                                          xfrm_address_t *daddr)
+                                          const xfrm_address_t *daddr)
 {
-        struct flowi fl = {};
+        struct flowi6 fl6;
        struct dst_entry *dst;
        int err;
-        memcpy(&fl.fl6_dst, daddr, sizeof(fl.fl6_dst));
+        memset(&fl6, 0, sizeof(fl6));
+        memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
        if (saddr)
-                memcpy(&fl.fl6_src, saddr, sizeof(fl.fl6_src));
+                memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
-        dst = ip6_route_output(net, NULL, &fl);
+        dst = ip6_route_output(net, NULL, &fl6);
        err = dst->error;
        if (dst->error) {
@@ -67,7 +68,7 @@ static int xfrm6_get_saddr(struct net *net,
        return 0;
 }
-static int xfrm6_get_tos(struct flowi *fl)
+static int xfrm6_get_tos(const struct flowi *fl)
 {
        return 0;
 }
@@ -87,7 +88,7 @@ static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
 }
 static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
-                          struct flowi *fl)
+                          const struct flowi *fl)
 {
        struct rt6_info *rt = (struct rt6_info*)xdst->route;
@@ -98,6 +99,10 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
        if (!xdst->u.rt6.rt6i_idev)
                return -ENODEV;
+        xdst->u.rt6.rt6i_peer = rt->rt6i_peer;
+        if (rt->rt6i_peer)
+                atomic_inc(&rt->rt6i_peer->refcnt);
        /* Sheit... I remember I did this right. Apparently,
         * it was magically lost, so this code needs audit */
        xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
@@ -116,18 +121,19 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
 static inline void
 _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 {
+        struct flowi6 *fl6 = &fl->u.ip6;
        int onlyproto = 0;
        u16 offset = skb_network_header_len(skb);
-        struct ipv6hdr *hdr = ipv6_hdr(skb);
+        const struct ipv6hdr *hdr = ipv6_hdr(skb);
        struct ipv6_opt_hdr *exthdr;
        const unsigned char *nh = skb_network_header(skb);
        u8 nexthdr = nh[IP6CB(skb)->nhoff];
-        memset(fl, 0, sizeof(struct flowi));
+        memset(fl6, 0, sizeof(struct flowi6));
-        fl->mark = skb->mark;
+        fl6->flowi6_mark = skb->mark;
-        ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
+        ipv6_addr_copy(&fl6->daddr, reverse ? &hdr->saddr : &hdr->daddr);
-        ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
+        ipv6_addr_copy(&fl6->saddr, reverse ? &hdr->daddr : &hdr->saddr);
        while (nh + offset + 1 < skb->data ||
               pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
@@ -154,20 +160,20 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                             pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
                                __be16 *ports = (__be16 *)exthdr;
-                                fl->fl_ip_sport = ports[!!reverse];
+                                fl6->fl6_sport = ports[!!reverse];
-                                fl->fl_ip_dport = ports[!reverse];
+                                fl6->fl6_dport = ports[!reverse];
                        }
-                        fl->proto = nexthdr;
+                        fl6->flowi6_proto = nexthdr;
                        return;
                case IPPROTO_ICMPV6:
                        if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
                                u8 *icmp = (u8 *)exthdr;
-                                fl->fl_icmp_type = icmp[0];
+                                fl6->fl6_icmp_type = icmp[0];
-                                fl->fl_icmp_code = icmp[1];
+                                fl6->fl6_icmp_code = icmp[1];
                        }
-                        fl->proto = nexthdr;
+                        fl6->flowi6_proto = nexthdr;
                        return;
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
@@ -176,9 +182,9 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                                struct ip6_mh *mh;
                                mh = (struct ip6_mh *)exthdr;
-                                fl->fl_mh_type = mh->ip6mh_type;
+                                fl6->fl6_mh_type = mh->ip6mh_type;
                        }
-                        fl->proto = nexthdr;
+                        fl6->flowi6_proto = nexthdr;
                        return;
 #endif
@@ -187,8 +193,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                case IPPROTO_ESP:
                case IPPROTO_COMP:
                default:
-                        fl->fl_ipsec_spi = 0;
+                        fl6->fl6_ipsec_spi = 0;
-                        fl->proto = nexthdr;
+                        fl6->flowi6_proto = nexthdr;
                        return;
                }
        }
@@ -199,7 +205,7 @@ static inline int xfrm6_garbage_collect(struct dst_ops *ops)
        struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
        xfrm6_policy_afinfo.garbage_collect(net);
-        return (atomic_read(&ops->entries) > ops->gc_thresh * 2);
+        return dst_entries_get_fast(ops) > ops->gc_thresh * 2;
 }
 static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
@@ -216,6 +222,9 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
        if (likely(xdst->u.rt6.rt6i_idev))
                in6_dev_put(xdst->u.rt6.rt6i_idev);
+        dst_destroy_metrics_generic(dst);
+        if (likely(xdst->u.rt6.rt6i_peer))
+                inet_putpeer(xdst->u.rt6.rt6i_peer);
        xfrm_dst_destroy(xdst);
 }
@@ -251,11 +260,11 @@ static struct dst_ops xfrm6_dst_ops = {
        .protocol =             cpu_to_be16(ETH_P_IPV6),
        .gc =                   xfrm6_garbage_collect,
        .update_pmtu =          xfrm6_update_pmtu,
+        .cow_metrics =          dst_cow_metrics_generic,
        .destroy =              xfrm6_dst_destroy,
        .ifdown =               xfrm6_dst_ifdown,
        .local_out =            __ip6_local_out,
        .gc_thresh =            1024,
-        .entries =              ATOMIC_INIT(0),
 };
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
@@ -267,6 +276,7 @@ static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
        .get_tos =              xfrm6_get_tos,
        .init_path =            xfrm6_init_path,
        .fill_dst =             xfrm6_fill_dst,
+        .blackhole_route =      ip6_blackhole_route,
 };
 static int __init xfrm6_policy_init(void)
@@ -312,11 +322,13 @@ int __init xfrm6_init(void)
         */
        gc_thresh = FIB6_TABLE_HASHSZ * 8;
        xfrm6_dst_ops.gc_thresh = (gc_thresh < 1024) ? 1024 : gc_thresh;
+        dst_entries_init(&xfrm6_dst_ops);
        ret = xfrm6_policy_init();
-        if (ret)
+        if (ret) {
+                dst_entries_destroy(&xfrm6_dst_ops);
                goto out;
+        }
        ret = xfrm6_state_init();
        if (ret)
                goto out_policy;
@@ -341,4 +353,5 @@ void xfrm6_fini(void)
        //xfrm6_input_fini();
        xfrm6_policy_fini();
        xfrm6_state_fini();
+        dst_entries_destroy(&xfrm6_dst_ops);
 }
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index a67575d472a3..248f0b2a7ee9 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -20,26 +20,28 @@
 #include <net/addrconf.h>
 static void
-__xfrm6_init_tempsel(struct xfrm_selector *sel, struct flowi *fl)
+__xfrm6_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
 {
+        const struct flowi6 *fl6 = &fl->u.ip6;
        /* Initialize temporary selector matching only
         * to current session. */
-        ipv6_addr_copy((struct in6_addr *)&sel->daddr, &fl->fl6_dst);
+        ipv6_addr_copy((struct in6_addr *)&sel->daddr, &fl6->daddr);
-        ipv6_addr_copy((struct in6_addr *)&sel->saddr, &fl->fl6_src);
+        ipv6_addr_copy((struct in6_addr *)&sel->saddr, &fl6->saddr);
-        sel->dport = xfrm_flowi_dport(fl);
+        sel->dport = xfrm_flowi_dport(fl, &fl6->uli);
        sel->dport_mask = htons(0xffff);
-        sel->sport = xfrm_flowi_sport(fl);
+        sel->sport = xfrm_flowi_sport(fl, &fl6->uli);
        sel->sport_mask = htons(0xffff);
        sel->family = AF_INET6;
        sel->prefixlen_d = 128;
        sel->prefixlen_s = 128;
-        sel->proto = fl->proto;
+        sel->proto = fl6->flowi6_proto;
-        sel->ifindex = fl->oif;
+        sel->ifindex = fl6->flowi6_oif;
 }
 static void
-xfrm6_init_temprop(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
+xfrm6_init_temprop(struct xfrm_state *x, const struct xfrm_tmpl *tmpl,
-                   xfrm_address_t *daddr, xfrm_address_t *saddr)
+                   const xfrm_address_t *daddr, const xfrm_address_t *saddr)
 {
        x->id = tmpl->id;
        if (ipv6_addr_any((struct in6_addr*)&x->id.daddr))
@@ -176,6 +178,7 @@ static struct xfrm_state_afinfo xfrm6_state_afinfo = {
        .tmpl_sort              = __xfrm6_tmpl_sort,
        .state_sort             = __xfrm6_state_sort,
        .output                 = xfrm6_output,
+        .output_finish          = xfrm6_output_finish,
        .extract_input          = xfrm6_extract_input,
        .extract_output         = xfrm6_extract_output,
        .transport_finish       = xfrm6_transport_finish,
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 2ce3a8278f26..4fe1db12d2a3 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -68,7 +68,7 @@ static DEFINE_SPINLOCK(xfrm6_tunnel_spi_lock);
 static struct kmem_cache *xfrm6_tunnel_spi_kmem __read_mostly;
-static inline unsigned xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
+static inline unsigned xfrm6_tunnel_spi_hash_byaddr(const xfrm_address_t *addr)
 {
        unsigned h;
@@ -85,7 +85,7 @@ static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
        return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
 }
-static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr)
+static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr)
 {
        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
        struct xfrm6_tunnel_spi *x6spi;
@@ -101,7 +101,7 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(struct net *net, xfrm_
        return NULL;
 }
-__be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr)
+__be32 xfrm6_tunnel_spi_lookup(struct net *net, const xfrm_address_t *saddr)
 {
        struct xfrm6_tunnel_spi *x6spi;
        u32 spi;
@@ -199,7 +199,7 @@ static void x6spi_destroy_rcu(struct rcu_head *head)
                        container_of(head, struct xfrm6_tunnel_spi, rcu_head));
 }
-void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr)
+static void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr)
 {
        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
        struct xfrm6_tunnel_spi *x6spi;
@@ -223,8 +223,6 @@ void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr)
        spin_unlock_bh(&xfrm6_tunnel_spi_lock);
 }
-EXPORT_SYMBOL(xfrm6_tunnel_free_spi);
 static int xfrm6_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 {
        skb_push(skb, -skb_network_offset(skb));
@@ -239,11 +237,11 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_tunnel_rcv(struct sk_buff *skb)
 {
        struct net *net = dev_net(skb->dev);
-        struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
        __be32 spi;
-        spi = xfrm6_tunnel_spi_lookup(net, (xfrm_address_t *)&iph->saddr);
+        spi = xfrm6_tunnel_spi_lookup(net, (const xfrm_address_t *)&iph->saddr);
-        return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi) > 0 ? : 0;
+        return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi);
 }
 static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
@@ -317,13 +315,13 @@ static const struct xfrm_type xfrm6_tunnel_type = {
        .output         = xfrm6_tunnel_output,
 };
-static struct xfrm6_tunnel xfrm6_tunnel_handler = {
+static struct xfrm6_tunnel xfrm6_tunnel_handler __read_mostly = {
        .handler        = xfrm6_tunnel_rcv,
        .err_handler    = xfrm6_tunnel_err,
        .priority       = 2,
 };
-static struct xfrm6_tunnel xfrm46_tunnel_handler = {
+static struct xfrm6_tunnel xfrm46_tunnel_handler __read_mostly = {
        .handler        = xfrm6_tunnel_rcv,
        .err_handler    = xfrm6_tunnel_err,
        .priority       = 2,
author	Glenn Elliott <gelliott@cs.unc.edu>	2012-03-04 19:47:13 -0500
committer	Glenn Elliott <gelliott@cs.unc.edu>	2012-03-04 19:47:13 -0500
commit	c71c03bda1e86c9d5198c5d83f712e695c4f2a1e (patch)
tree	ecb166cb3e2b7e2adb3b5e292245fefd23381ac8 /net/ipv6
parent	ea53c912f8a86a8567697115b6a0d8152beee5c8 (diff)
parent	6a00f206debf8a5c8899055726ad127dbeeed098 (diff)