44 files changed, 1592 insertions, 991 deletions

diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 6e48f52e197c..deb4101a2a81 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -196,10 +196,3 @@ config IPV6_SUBTREES
 
           If unsure, say N.
 
-config IPV6_ROUTE_FWMARK
-        bool "IPv6: use netfilter MARK value as routing key"
-        depends on IPV6_MULTIPLE_TABLES && NETFILTER
-        ---help---
-          If you say Y here, you will be able to specify different routes for
-          packets with different mark values (see iptables(8), MARK target).
-
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index addcc011bc01..8bacda109b7f 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -5,8 +5,8 @@
 obj-$(CONFIG_IPV6) += ipv6.o
 
 ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o \
-                route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o raw.o \
-                protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
+                route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o udplite.o \
+                raw.o protocol.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
                 exthdrs.o sysctl_net_ipv6.o datagram.o proc.o \
                 ip6_flowlabel.o ipv6_syms.o inet6_connection_sock.o
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index b312a5f7a759..a5e8d207a51b 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -232,7 +232,7 @@ static inline unsigned ipv6_addr_scope2type(unsigned scope)
 
 int __ipv6_addr_type(const struct in6_addr *addr)
 {
-        u32 st;
+        __be32 st;
 
         st = addr->s6_addr32[0];
 
@@ -1164,7 +1164,7 @@ record_it:
 int ipv6_get_saddr(struct dst_entry *dst,
                    struct in6_addr *daddr, struct in6_addr *saddr)
 {
-        return ipv6_dev_get_saddr(dst ? ((struct rt6_info *)dst)->rt6i_idev->dev : NULL, daddr, saddr);
+        return ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL, daddr, saddr);
 }
 
 
@@ -3098,10 +3098,9 @@ static inline int rt_scope(int ifa_scope)
 
 static inline int inet6_ifaddr_msgsize(void)
 {
-        return nlmsg_total_size(sizeof(struct ifaddrmsg) +
-                                nla_total_size(16) +
-                                nla_total_size(sizeof(struct ifa_cacheinfo)) +
-                                128);
+        return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
+               + nla_total_size(16) /* IFA_ADDRESS */
+               + nla_total_size(sizeof(struct ifa_cacheinfo));
 }
 
 static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
@@ -3329,10 +3328,8 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr* nlh,
 
         err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).pid,
                                 nlh->nlmsg_seq, RTM_NEWADDR, 0);
-        if (err < 0) {
-                kfree_skb(skb);
-                goto errout_ifa;
-        }
+        /* failure implies BUG in inet6_ifaddr_msgsize() */
+        BUG_ON(err < 0);
 
         err = rtnl_unicast(skb, NETLINK_CB(in_skb).pid);
 errout_ifa:
@@ -3351,10 +3348,8 @@ static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
                 goto errout;
 
         err = inet6_fill_ifaddr(skb, ifa, 0, 0, event, 0);
-        if (err < 0) {
-                kfree_skb(skb);
-                goto errout;
-        }
+        /* failure implies BUG in inet6_ifaddr_msgsize() */
+        BUG_ON(err < 0);
 
         err = rtnl_notify(skb, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
 errout:
@@ -3365,6 +3360,8 @@ errout:
 static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
                                 __s32 *array, int bytes)
 {
+        BUG_ON(bytes < (DEVCONF_MAX * 4));
+
         memset(array, 0, bytes);
         array[DEVCONF_FORWARDING] = cnf->forwarding;
         array[DEVCONF_HOPLIMIT] = cnf->hop_limit;
@@ -3397,80 +3394,76 @@ static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
         array[DEVCONF_PROXY_NDP] = cnf->proxy_ndp;
 }
 
-/* Maximum length of ifinfomsg attributes */
-#define INET6_IFINFO_RTA_SPACE \
-                RTA_SPACE(IFNAMSIZ) /* IFNAME */ + \
-                RTA_SPACE(MAX_ADDR_LEN) /* ADDRESS */ + \
-                RTA_SPACE(sizeof(u32)) /* MTU */ + \
-                RTA_SPACE(sizeof(int)) /* LINK */ + \
-                RTA_SPACE(0) /* PROTINFO */ + \
-                RTA_SPACE(sizeof(u32)) /* FLAGS */ + \
-                RTA_SPACE(sizeof(struct ifla_cacheinfo)) /* CACHEINFO */ + \
-                RTA_SPACE(sizeof(__s32[DEVCONF_MAX])) /* CONF */
+static inline size_t inet6_if_nlmsg_size(void)
+{
+        return NLMSG_ALIGN(sizeof(struct ifinfomsg))
+               + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
+               + nla_total_size(MAX_ADDR_LEN) /* IFLA_ADDRESS */
+               + nla_total_size(4) /* IFLA_MTU */
+               + nla_total_size(4) /* IFLA_LINK */
+               + nla_total_size( /* IFLA_PROTINFO */
+                        nla_total_size(4) /* IFLA_INET6_FLAGS */
+                        + nla_total_size(sizeof(struct ifla_cacheinfo))
+                        + nla_total_size(DEVCONF_MAX * 4) /* IFLA_INET6_CONF */
+                 );
+}
 
 static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev, 
                              u32 pid, u32 seq, int event, unsigned int flags)
 {
-        struct net_device       *dev = idev->dev;
-        __s32                   *array = NULL;
-        struct ifinfomsg        *r;
-        struct nlmsghdr         *nlh;
-        unsigned char           *b = skb->tail;
-        struct rtattr           *subattr;
-        __u32                   mtu = dev->mtu;
-        struct ifla_cacheinfo   ci;
-
-        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*r), flags);
-        r = NLMSG_DATA(nlh);
-        r->ifi_family = AF_INET6;
-        r->__ifi_pad = 0;
-        r->ifi_type = dev->type;
-        r->ifi_index = dev->ifindex;
-        r->ifi_flags = dev_get_flags(dev);
-        r->ifi_change = 0;
-
-        RTA_PUT(skb, IFLA_IFNAME, strlen(dev->name)+1, dev->name);
+        struct net_device *dev = idev->dev;
+        struct nlattr *conf;
+        struct ifinfomsg *hdr;
+        struct nlmsghdr *nlh;
+        void *protoinfo;
+        struct ifla_cacheinfo ci;
+
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*hdr), flags);
+        if (nlh == NULL)
+                return -ENOBUFS;
+
+        hdr = nlmsg_data(nlh);
+        hdr->ifi_family = AF_INET6;
+        hdr->__ifi_pad = 0;
+        hdr->ifi_type = dev->type;
+        hdr->ifi_index = dev->ifindex;
+        hdr->ifi_flags = dev_get_flags(dev);
+        hdr->ifi_change = 0;
+
+        NLA_PUT_STRING(skb, IFLA_IFNAME, dev->name);
 
         if (dev->addr_len)
-                RTA_PUT(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr);
+                NLA_PUT(skb, IFLA_ADDRESS, dev->addr_len, dev->dev_addr);
 
-        RTA_PUT(skb, IFLA_MTU, sizeof(mtu), &mtu);
+        NLA_PUT_U32(skb, IFLA_MTU, dev->mtu);
         if (dev->ifindex != dev->iflink)
-                RTA_PUT(skb, IFLA_LINK, sizeof(int), &dev->iflink);
-                        
-        subattr = (struct rtattr*)skb->tail;
+                NLA_PUT_U32(skb, IFLA_LINK, dev->iflink);
 
-        RTA_PUT(skb, IFLA_PROTINFO, 0, NULL);
+        protoinfo = nla_nest_start(skb, IFLA_PROTINFO);
+        if (protoinfo == NULL)
+                goto nla_put_failure;
 
-        /* return the device flags */
-        RTA_PUT(skb, IFLA_INET6_FLAGS, sizeof(__u32), &idev->if_flags);
+        NLA_PUT_U32(skb, IFLA_INET6_FLAGS, idev->if_flags);
 
-        /* return interface cacheinfo */
         ci.max_reasm_len = IPV6_MAXPLEN;
         ci.tstamp = (__u32)(TIME_DELTA(idev->tstamp, INITIAL_JIFFIES) / HZ * 100
                     + TIME_DELTA(idev->tstamp, INITIAL_JIFFIES) % HZ * 100 / HZ);
         ci.reachable_time = idev->nd_parms->reachable_time;
         ci.retrans_time = idev->nd_parms->retrans_time;
-        RTA_PUT(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci);
-        
-        /* return the device sysctl params */
-        if ((array = kmalloc(DEVCONF_MAX * sizeof(*array), GFP_ATOMIC)) == NULL)
-                goto rtattr_failure;
-        ipv6_store_devconf(&idev->cnf, array, DEVCONF_MAX * sizeof(*array));
-        RTA_PUT(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(*array), array);
+        NLA_PUT(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci);
+
+        conf = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
+        if (conf == NULL)
+                goto nla_put_failure;
+        ipv6_store_devconf(&idev->cnf, nla_data(conf), nla_len(conf));
 
         /* XXX - Statistics/MC not implemented */
-        subattr->rta_len = skb->tail - (u8*)subattr;
 
-        nlh->nlmsg_len = skb->tail - b;
-        kfree(array);
-        return skb->len;
+        nla_nest_end(skb, protoinfo);
+        return nlmsg_end(skb, nlh);
 
-nlmsg_failure:
-rtattr_failure:
-        kfree(array);
-        skb_trim(skb, b - skb->data);
-        return -1;
+nla_put_failure:
+        return nlmsg_cancel(skb, nlh);
 }
 
 static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
@@ -3501,18 +3494,15 @@ static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
 {
         struct sk_buff *skb;
-        int payload = sizeof(struct ifinfomsg) + INET6_IFINFO_RTA_SPACE;
         int err = -ENOBUFS;
         
-        skb = nlmsg_new(nlmsg_total_size(payload), GFP_ATOMIC);
+        skb = nlmsg_new(inet6_if_nlmsg_size(), GFP_ATOMIC);
         if (skb == NULL)
                 goto errout;
 
         err = inet6_fill_ifinfo(skb, idev, 0, 0, event, 0);
-        if (err < 0) {
-                kfree_skb(skb);
-                goto errout;
-        }
+        /* failure implies BUG in inet6_if_nlmsg_size() */
+        BUG_ON(err < 0);
 
         err = rtnl_notify(skb, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
 errout:
@@ -3520,22 +3510,26 @@ errout:
                 rtnl_set_sk_err(RTNLGRP_IPV6_IFADDR, err);
 }
 
-/* Maximum length of prefix_cacheinfo attributes */
-#define INET6_PREFIX_RTA_SPACE \
-                RTA_SPACE(sizeof(((struct prefix_info *)NULL)->prefix)) /* ADDRESS */ + \
-                RTA_SPACE(sizeof(struct prefix_cacheinfo)) /* CACHEINFO */
+static inline size_t inet6_prefix_nlmsg_size(void)
+{
+        return NLMSG_ALIGN(sizeof(struct prefixmsg))
+               + nla_total_size(sizeof(struct in6_addr))
+               + nla_total_size(sizeof(struct prefix_cacheinfo));
+}
 
 static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
-                        struct prefix_info *pinfo, u32 pid, u32 seq, 
-                        int event, unsigned int flags)
+                             struct prefix_info *pinfo, u32 pid, u32 seq,
+                             int event, unsigned int flags)
 {
-        struct prefixmsg        *pmsg;
-        struct nlmsghdr         *nlh;
-        unsigned char           *b = skb->tail;
+        struct prefixmsg *pmsg;
+        struct nlmsghdr *nlh;
         struct prefix_cacheinfo ci;
 
-        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*pmsg), flags);
-        pmsg = NLMSG_DATA(nlh);
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(*pmsg), flags);
+        if (nlh == NULL)
+                return -ENOBUFS;
+
+        pmsg = nlmsg_data(nlh);
         pmsg->prefix_family = AF_INET6;
         pmsg->prefix_pad1 = 0;
         pmsg->prefix_pad2 = 0;
@@ -3543,44 +3537,37 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
         pmsg->prefix_len = pinfo->prefix_len;
         pmsg->prefix_type = pinfo->type;
         pmsg->prefix_pad3 = 0;
-        
         pmsg->prefix_flags = 0;
         if (pinfo->onlink)
                 pmsg->prefix_flags |= IF_PREFIX_ONLINK;
         if (pinfo->autoconf)
                 pmsg->prefix_flags |= IF_PREFIX_AUTOCONF;
 
-        RTA_PUT(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix);
+        NLA_PUT(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix);
 
         ci.preferred_time = ntohl(pinfo->prefered);
         ci.valid_time = ntohl(pinfo->valid);
-        RTA_PUT(skb, PREFIX_CACHEINFO, sizeof(ci), &ci);
+        NLA_PUT(skb, PREFIX_CACHEINFO, sizeof(ci), &ci);
 
-        nlh->nlmsg_len = skb->tail - b;
-        return skb->len;
+        return nlmsg_end(skb, nlh);
 
-nlmsg_failure:
-rtattr_failure:
-        skb_trim(skb, b - skb->data);
-        return -1;
+nla_put_failure:
+        return nlmsg_cancel(skb, nlh);
 }
 
 static void inet6_prefix_notify(int event, struct inet6_dev *idev, 
                          struct prefix_info *pinfo)
 {
         struct sk_buff *skb;
-        int payload = sizeof(struct prefixmsg) + INET6_PREFIX_RTA_SPACE;
         int err = -ENOBUFS;
 
-        skb = nlmsg_new(nlmsg_total_size(payload), GFP_ATOMIC);
+        skb = nlmsg_new(inet6_prefix_nlmsg_size(), GFP_ATOMIC);
         if (skb == NULL)
                 goto errout;
 
         err = inet6_fill_prefix(skb, idev, pinfo, 0, 0, event, 0);
-        if (err < 0) {
-                kfree_skb(skb);
-                goto errout;
-        }
+        /* failure implies BUG in inet6_prefix_nlmsg_size() */
+        BUG_ON(err < 0);
 
         err = rtnl_notify(skb, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
 errout:
@@ -3982,10 +3969,9 @@ static void addrconf_sysctl_register(struct inet6_dev *idev, struct ipv6_devconf
         struct addrconf_sysctl_table *t;
         char *dev_name = NULL;
 
-        t = kmalloc(sizeof(*t), GFP_KERNEL);
+        t = kmemdup(&addrconf_sysctl, sizeof(*t), GFP_KERNEL);
         if (t == NULL)
                 return;
-        memcpy(t, &addrconf_sysctl, sizeof(*t));
         for (i=0; t->addrconf_vars[i].data; i++) {
                 t->addrconf_vars[i].data += (char*)p - (char*)&ipv6_devconf;
                 t->addrconf_vars[i].de = NULL;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 858cae29581c..87c8f54872b7 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -49,6 +49,7 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/udp.h>
+#include <net/udplite.h>
 #include <net/tcp.h>
 #include <net/ipip.h>
 #include <net/protocol.h>
@@ -221,7 +222,7 @@ lookup_protocol:
                  * the user to assign a number at socket
                  * creation time automatically shares.
                  */
-                inet->sport = ntohs(inet->num);
+                inet->sport = htons(inet->num);
                 sk->sk_prot->hash(sk);
         }
         if (sk->sk_prot->init) {
@@ -341,7 +342,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 sk->sk_userlocks |= SOCK_BINDADDR_LOCK;
         if (snum)
                 sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
-        inet->sport = ntohs(inet->num);
+        inet->sport = htons(inet->num);
         inet->dport = 0;
         inet->daddr = 0;
 out:
@@ -678,7 +679,7 @@ int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb)
         if (np->rxopt.all) {
                 if ((opt->hop && (np->rxopt.bits.hopopts ||
                                   np->rxopt.bits.ohopopts)) ||
-                    ((IPV6_FLOWINFO_MASK & *(u32*)skb->nh.raw) &&
+                    ((IPV6_FLOWINFO_MASK & *(__be32*)skb->nh.raw) &&
                      np->rxopt.bits.rxflow) ||
                     (opt->srcrt && (np->rxopt.bits.srcrt ||
                      np->rxopt.bits.osrcrt)) ||
@@ -737,8 +738,13 @@ static int __init init_ipv6_mibs(void)
         if (snmp6_mib_init((void **)udp_stats_in6, sizeof (struct udp_mib),
                            __alignof__(struct udp_mib)) < 0)
                 goto err_udp_mib;
+        if (snmp6_mib_init((void **)udplite_stats_in6, sizeof (struct udp_mib),
+                           __alignof__(struct udp_mib)) < 0)
+                goto err_udplite_mib;
         return 0;
 
+err_udplite_mib:
+        snmp6_mib_free((void **)udp_stats_in6);
 err_udp_mib:
         snmp6_mib_free((void **)icmpv6_statistics);
 err_icmp_mib:
@@ -753,6 +759,7 @@ static void cleanup_ipv6_mibs(void)
         snmp6_mib_free((void **)ipv6_statistics);
         snmp6_mib_free((void **)icmpv6_statistics);
         snmp6_mib_free((void **)udp_stats_in6);
+        snmp6_mib_free((void **)udplite_stats_in6);
 }
 
 static int __init inet6_init(void)
@@ -780,10 +787,14 @@ static int __init inet6_init(void)
         if (err)
                 goto out_unregister_tcp_proto;
 
-        err = proto_register(&rawv6_prot, 1);
+        err = proto_register(&udplitev6_prot, 1);
         if (err)
                 goto out_unregister_udp_proto;
 
+        err = proto_register(&rawv6_prot, 1);
+        if (err)
+                goto out_unregister_udplite_proto;
+
 
         /* Register the socket-side information for inet6_create.  */
         for(r = &inetsw6[0]; r < &inetsw6[SOCK_MAX]; ++r)
@@ -837,6 +848,8 @@ static int __init inet6_init(void)
                 goto proc_tcp6_fail;
         if (udp6_proc_init())
                 goto proc_udp6_fail;
+        if (udplite6_proc_init())
+                goto proc_udplite6_fail;
         if (ipv6_misc_proc_init())
                 goto proc_misc6_fail;
 
@@ -862,6 +875,7 @@ static int __init inet6_init(void)
 
         /* Init v6 transport protocols. */
         udpv6_init();
+        udplitev6_init();
         tcpv6_init();
 
         ipv6_packet_init();
@@ -879,6 +893,8 @@ proc_if6_fail:
 proc_anycast6_fail:
         ipv6_misc_proc_exit();
 proc_misc6_fail:
+        udplite6_proc_exit();
+proc_udplite6_fail:
         udp6_proc_exit();
 proc_udp6_fail:
         tcp6_proc_exit();
@@ -902,6 +918,8 @@ out_unregister_sock:
         sock_unregister(PF_INET6);
 out_unregister_raw_proto:
         proto_unregister(&rawv6_prot);
+out_unregister_udplite_proto:
+        proto_unregister(&udplitev6_prot);
 out_unregister_udp_proto:
         proto_unregister(&udpv6_prot);
 out_unregister_tcp_proto:
@@ -919,6 +937,7 @@ static void __exit inet6_exit(void)
         ac6_proc_exit();
         ipv6_misc_proc_exit();
         udp6_proc_exit();
+        udplite6_proc_exit();
         tcp6_proc_exit();
         raw6_proc_exit();
 #endif
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index b0d83e8e4252..12c5a4dec09e 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -354,10 +354,9 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!pskb_may_pull(skb, ah_hlen))
                 goto out;
 
-        tmp_hdr = kmalloc(hdr_len, GFP_ATOMIC);
+        tmp_hdr = kmemdup(skb->nh.raw, hdr_len, GFP_ATOMIC);
         if (!tmp_hdr)
                 goto out;
-        memcpy(tmp_hdr, skb->nh.raw, hdr_len);
         if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len, XFRM_POLICY_IN))
                 goto free_out;
         skb->nh.ipv6h->priority    = 0;
@@ -397,7 +396,7 @@ out:
 }
 
 static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, 
-                    int type, int code, int offset, __u32 info)
+                    int type, int code, int offset, __be32 info)
 {
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
         struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 7206747022fc..5c94fea90e97 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -207,7 +207,7 @@ out:
 }
 
 void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, 
-                     u16 port, u32 info, u8 *payload)
+                     __be16 port, u32 info, u8 *payload)
 {
         struct ipv6_pinfo *np  = inet6_sk(sk);
         struct icmp6hdr *icmph = (struct icmp6hdr *)skb->h.raw;
@@ -318,13 +318,13 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                         ipv6_addr_copy(&sin->sin6_addr,
                           (struct in6_addr *)(skb->nh.raw + serr->addr_offset));
                         if (np->sndflow)
-                                sin->sin6_flowinfo = *(u32*)(skb->nh.raw + serr->addr_offset - 24) & IPV6_FLOWINFO_MASK;
+                                sin->sin6_flowinfo = *(__be32*)(skb->nh.raw + serr->addr_offset - 24) & IPV6_FLOWINFO_MASK;
                         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                                 sin->sin6_scope_id = IP6CB(skb)->iif;
                 } else {
                         ipv6_addr_set(&sin->sin6_addr, 0, 0,
                                       htonl(0xffff),
-                                      *(u32*)(skb->nh.raw + serr->addr_offset));
+                                      *(__be32*)(skb->nh.raw + serr->addr_offset));
                 }
         }
 
@@ -397,12 +397,12 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
         }
 
         if (np->rxopt.bits.rxtclass) {
-                int tclass = (ntohl(*(u32 *)skb->nh.ipv6h) >> 20) & 0xff;
+                int tclass = (ntohl(*(__be32 *)skb->nh.ipv6h) >> 20) & 0xff;
                 put_cmsg(msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
         }
 
-        if (np->rxopt.bits.rxflow && (*(u32*)skb->nh.raw & IPV6_FLOWINFO_MASK)) {
-                u32 flowinfo = *(u32*)skb->nh.raw & IPV6_FLOWINFO_MASK;
+        if (np->rxopt.bits.rxflow && (*(__be32*)skb->nh.raw & IPV6_FLOWINFO_MASK)) {
+                __be32 flowinfo = *(__be32*)skb->nh.raw & IPV6_FLOWINFO_MASK;
                 put_cmsg(msg, SOL_IPV6, IPV6_FLOWINFO, sizeof(flowinfo), &flowinfo);
         }
 
@@ -560,12 +560,12 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         }
 
                         if (fl->fl6_flowlabel&IPV6_FLOWINFO_MASK) {
-                                if ((fl->fl6_flowlabel^*(u32 *)CMSG_DATA(cmsg))&~IPV6_FLOWINFO_MASK) {
+                                if ((fl->fl6_flowlabel^*(__be32 *)CMSG_DATA(cmsg))&~IPV6_FLOWINFO_MASK) {
                                         err = -EINVAL;
                                         goto exit_f;
                                 }
                         }
-                        fl->fl6_flowlabel = IPV6_FLOWINFO_MASK & *(u32 *)CMSG_DATA(cmsg);
+                        fl->fl6_flowlabel = IPV6_FLOWINFO_MASK & *(__be32 *)CMSG_DATA(cmsg);
                         break;
 
                 case IPV6_2292HOPOPTS:
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index e78680a9985b..25dcf69cd807 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -256,7 +256,7 @@ static u32 esp6_get_max_size(struct xfrm_state *x, int mtu)
 }
 
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                     int type, int code, int offset, __u32 info)
+                     int type, int code, int offset, __be32 info)
 {
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
         struct ipv6_esp_hdr *esph = (struct ipv6_esp_hdr*)(skb->data+offset);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 88c96b10684c..0711f92d6a12 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -284,10 +284,12 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
 #ifdef CONFIG_IPV6_MIP6
         __u16 dstbuf;
 #endif
+        struct dst_entry *dst;
 
         if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
             !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                 IPSTATS_MIB_INHDRERRORS);
                 kfree_skb(skb);
                 return -1;
         }
@@ -298,7 +300,9 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
         dstbuf = opt->dst1;
 #endif
 
+        dst = dst_clone(skb->dst);
         if (ip6_parse_tlv(tlvprocdestopt_lst, skbp)) {
+                dst_release(dst);
                 skb = *skbp;
                 skb->h.raw += ((skb->h.raw[1]+1)<<3);
                 opt = IP6CB(skb);
@@ -310,7 +314,8 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
                 return 1;
         }
 
-        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+        IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
+        dst_release(dst);
         return -1;
 }
 
@@ -365,7 +370,8 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 
         if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
             !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                 IPSTATS_MIB_INHDRERRORS);
                 kfree_skb(skb);
                 return -1;
         }
@@ -374,7 +380,8 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 
         if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr) ||
             skb->pkt_type != PACKET_HOST) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                 IPSTATS_MIB_INADDRERRORS);
                 kfree_skb(skb);
                 return -1;
         }
@@ -388,7 +395,8 @@ looped_back:
                          * processed by own
                          */
                         if (!addr) {
-                                IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
+                                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                                 IPSTATS_MIB_INADDRERRORS);
                                 kfree_skb(skb);
                                 return -1;
                         }
@@ -410,7 +418,8 @@ looped_back:
         switch (hdr->type) {
         case IPV6_SRCRT_TYPE_0:
                 if (hdr->hdrlen & 0x01) {
-                        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                         IPSTATS_MIB_INHDRERRORS);
                         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->hdrlen) - skb->nh.raw);
                         return -1;
                 }
@@ -419,14 +428,16 @@ looped_back:
         case IPV6_SRCRT_TYPE_2:
                 /* Silently discard invalid RTH type 2 */
                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
-                        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                         IPSTATS_MIB_INHDRERRORS);
                         kfree_skb(skb);
                         return -1;
                 }
                 break;
 #endif
         default:
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                 IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
                 return -1;
         }
@@ -439,7 +450,8 @@ looped_back:
         n = hdr->hdrlen >> 1;
 
         if (hdr->segments_left > n) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                 IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->segments_left) - skb->nh.raw);
                 return -1;
         }
@@ -449,12 +461,14 @@ looped_back:
          */
         if (skb_cloned(skb)) {
                 struct sk_buff *skb2 = skb_copy(skb, GFP_ATOMIC);
-                kfree_skb(skb);
                 /* the copy is a forwarded packet */
                 if (skb2 == NULL) {
-                        IP6_INC_STATS_BH(IPSTATS_MIB_OUTDISCARDS);      
+                        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                         IPSTATS_MIB_OUTDISCARDS);
+                        kfree_skb(skb);
                         return -1;
                 }
+                kfree_skb(skb);
                 *skbp = skb = skb2;
                 opt = IP6CB(skb2);
                 hdr = (struct ipv6_rt_hdr *) skb2->h.raw;
@@ -475,12 +489,14 @@ looped_back:
                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
                                      (xfrm_address_t *)&skb->nh.ipv6h->saddr,
                                      IPPROTO_ROUTING) < 0) {
-                        IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
+                        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                         IPSTATS_MIB_INADDRERRORS);
                         kfree_skb(skb);
                         return -1;
                 }
                 if (!ipv6_chk_home_addr(addr)) {
-                        IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
+                        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                         IPSTATS_MIB_INADDRERRORS);
                         kfree_skb(skb);
                         return -1;
                 }
@@ -491,7 +507,8 @@ looped_back:
         }
 
         if (ipv6_addr_is_multicast(addr)) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                 IPSTATS_MIB_INADDRERRORS);
                 kfree_skb(skb);
                 return -1;
         }
@@ -510,7 +527,8 @@ looped_back:
 
         if (skb->dst->dev->flags&IFF_LOOPBACK) {
                 if (skb->nh.ipv6h->hop_limit <= 1) {
-                        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                         IPSTATS_MIB_INHDRERRORS);
                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
                                     0, skb->dev);
                         kfree_skb(skb);
@@ -632,24 +650,25 @@ static int ipv6_hop_jumbo(struct sk_buff **skbp, int optoff)
         if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) {
                 LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
                                skb->nh.raw[optoff+1]);
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                 IPSTATS_MIB_INHDRERRORS);
                 goto drop;
         }
 
-        pkt_len = ntohl(*(u32*)(skb->nh.raw+optoff+2));
+        pkt_len = ntohl(*(__be32*)(skb->nh.raw+optoff+2));
         if (pkt_len <= IPV6_MAXPLEN) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
                 return 0;
         }
         if (skb->nh.ipv6h->payload_len) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
                 return 0;
         }
 
         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INTRUNCATEDPKTS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INTRUNCATEDPKTS);
                 goto drop;
         }
 
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 315bc1fbec3f..21cbbbddaf4d 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -77,7 +77,7 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp)
                 if (hp == NULL)
                         return -1;
                 if (nexthdr == NEXTHDR_FRAGMENT) {
-                        unsigned short _frag_off, *fp;
+                        __be16 _frag_off, *fp;
                         fp = skb_header_pointer(skb,
                                                 start+offsetof(struct frag_hdr,
                                                                frag_off),
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 1896ecb52899..0862809ffcf7 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -25,10 +25,6 @@ struct fib6_rule
         struct fib_rule         common;
         struct rt6key           src;
         struct rt6key           dst;
-#ifdef CONFIG_IPV6_ROUTE_FWMARK
-        u32                     fwmark;
-        u32                     fwmask;
-#endif
         u8                      tclass;
 };
 
@@ -67,7 +63,7 @@ struct dst_entry *fib6_rule_lookup(struct flowi *fl, int flags,
                 fib_rule_put(arg.rule);
 
         if (arg.result)
-                return (struct dst_entry *) arg.result;
+                return arg.result;
 
         dst_hold(&ip6_null_entry.u.dst);
         return &ip6_null_entry.u.dst;
@@ -130,22 +126,13 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
         if (r->tclass && r->tclass != ((ntohl(fl->fl6_flowlabel) >> 20) & 0xff))
                 return 0;
 
-#ifdef CONFIG_IPV6_ROUTE_FWMARK
-        if ((r->fwmark ^ fl->fl6_fwmark) & r->fwmask)
-                return 0;
-#endif
-
         return 1;
 }
 
 static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = {
-        [FRA_IFNAME]    = { .type = NLA_STRING, .len = IFNAMSIZ - 1 },
-        [FRA_PRIORITY]  = { .type = NLA_U32 },
+        FRA_GENERIC_POLICY,
         [FRA_SRC]       = { .len = sizeof(struct in6_addr) },
         [FRA_DST]       = { .len = sizeof(struct in6_addr) },
-        [FRA_FWMARK]    = { .type = NLA_U32 },
-        [FRA_FWMASK]    = { .type = NLA_U32 },
-        [FRA_TABLE]     = { .type = NLA_U32 },
 };
 
 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
@@ -155,8 +142,7 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct fib6_rule *rule6 = (struct fib6_rule *) rule;
 
-        if (frh->src_len > 128 || frh->dst_len > 128 ||
-            (frh->tos & ~IPV6_FLOWINFO_MASK))
+        if (frh->src_len > 128 || frh->dst_len > 128)
                 goto errout;
 
         if (rule->action == FR_ACT_TO_TBL) {
@@ -177,23 +163,6 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 nla_memcpy(&rule6->dst.addr, tb[FRA_DST],
                            sizeof(struct in6_addr));
 
-#ifdef CONFIG_IPV6_ROUTE_FWMARK
-        if (tb[FRA_FWMARK]) {
-                rule6->fwmark = nla_get_u32(tb[FRA_FWMARK]);
-                if (rule6->fwmark) {
-                        /*
-                         * if the mark value is non-zero,
-                         * all bits are compared by default
-                         * unless a mask is explicitly specified.
-                         */
-                        rule6->fwmask = 0xFFFFFFFF;
-                }
-        }
-
-        if (tb[FRA_FWMASK])
-                rule6->fwmask = nla_get_u32(tb[FRA_FWMASK]);
-#endif
-
         rule6->src.plen = frh->src_len;
         rule6->dst.plen = frh->dst_len;
         rule6->tclass = frh->tos;
@@ -225,14 +194,6 @@ static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
             nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
                 return 0;
 
-#ifdef CONFIG_IPV6_ROUTE_FWMARK
-        if (tb[FRA_FWMARK] && (rule6->fwmark != nla_get_u32(tb[FRA_FWMARK])))
-                return 0;
-
-        if (tb[FRA_FWMASK] && (rule6->fwmask != nla_get_u32(tb[FRA_FWMASK])))
-                return 0;
-#endif
-
         return 1;
 }
 
@@ -254,14 +215,6 @@ static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
                 NLA_PUT(skb, FRA_SRC, sizeof(struct in6_addr),
                         &rule6->src.addr);
 
-#ifdef CONFIG_IPV6_ROUTE_FWMARK
-        if (rule6->fwmark)
-                NLA_PUT_U32(skb, FRA_FWMARK, rule6->fwmark);
-
-        if (rule6->fwmask || rule6->fwmark)
-                NLA_PUT_U32(skb, FRA_FWMASK, rule6->fwmask);
-#endif
-
         return 0;
 
 nla_put_failure:
@@ -278,6 +231,12 @@ static u32 fib6_rule_default_pref(void)
         return 0x3FFF;
 }
 
+static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
+{
+        return nla_total_size(16) /* dst */
+               + nla_total_size(16); /* src */
+}
+
 static struct fib_rules_ops fib6_rules_ops = {
         .family                 = AF_INET6,
         .rule_size              = sizeof(struct fib6_rule),
@@ -287,6 +246,7 @@ static struct fib_rules_ops fib6_rules_ops = {
         .compare                = fib6_rule_compare,
         .fill                   = fib6_rule_fill,
         .default_pref           = fib6_rule_default_pref,
+        .nlmsg_payload          = fib6_rule_nlmsg_payload,
         .nlgroup                = RTNLGRP_IPV6_RULE,
         .policy                 = fib6_rule_policy,
         .rules_list             = &fib6_rules,
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 4ec876066b3f..3dcc4b7f41b4 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -177,7 +177,8 @@ static inline int icmpv6_xrlim_allow(struct sock *sk, int type,
          */
         dst = ip6_route_output(sk, fl);
         if (dst->error) {
-                IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
+                IP6_INC_STATS(ip6_dst_idev(dst),
+                              IPSTATS_MIB_OUTNOROUTES);
         } else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
                 res = 1;
         } else {
@@ -233,7 +234,7 @@ static int icmpv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct
                                                       len, fl->proto,
                                                       skb->csum);
         } else {
-                u32 tmp_csum = 0;
+                __wsum tmp_csum = 0;
 
                 skb_queue_walk(&sk->sk_write_queue, skb) {
                         tmp_csum = csum_add(tmp_csum, skb->csum);
@@ -241,13 +242,11 @@ static int icmpv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct
 
                 tmp_csum = csum_partial((char *)icmp6h,
                                         sizeof(struct icmp6hdr), tmp_csum);
-                tmp_csum = csum_ipv6_magic(&fl->fl6_src,
-                                           &fl->fl6_dst,
-                                           len, fl->proto, tmp_csum);
-                icmp6h->icmp6_cksum = tmp_csum;
+                icmp6h->icmp6_cksum = csum_ipv6_magic(&fl->fl6_src,
+                                                      &fl->fl6_dst,
+                                                      len, fl->proto,
+                                                      tmp_csum);
         }
-        if (icmp6h->icmp6_cksum == 0)
-                icmp6h->icmp6_cksum = -1;
         ip6_push_pending_frames(sk);
 out:
         return err;
@@ -263,7 +262,7 @@ static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, st
 {
         struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
         struct sk_buff *org_skb = msg->skb;
-        __u32 csum = 0;
+        __wsum csum = 0;
 
         csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
                                       to, len, csum);
@@ -555,7 +554,7 @@ out:
         icmpv6_xmit_unlock();
 }
 
-static void icmpv6_notify(struct sk_buff *skb, int type, int code, u32 info)
+static void icmpv6_notify(struct sk_buff *skb, int type, int code, __be32 info)
 {
         struct in6_addr *saddr, *daddr;
         struct inet6_protocol *ipprot;
@@ -637,8 +636,8 @@ static int icmpv6_rcv(struct sk_buff **pskb)
                         break;
                 /* fall through */
         case CHECKSUM_NONE:
-                skb->csum = ~csum_ipv6_magic(saddr, daddr, skb->len,
-                                             IPPROTO_ICMPV6, 0);
+                skb->csum = ~csum_unfold(csum_ipv6_magic(saddr, daddr, skb->len,
+                                             IPPROTO_ICMPV6, 0));
                 if (__skb_checksum_complete(skb)) {
                         LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 checksum failed [" NIP6_FMT " > " NIP6_FMT "]\n",
                                        NIP6(*saddr), NIP6(*daddr));
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 827f41d1478b..c700302ad51a 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -52,20 +52,20 @@ EXPORT_SYMBOL_GPL(inet6_csk_bind_conflict);
 /*
  * request_sock (formerly open request) hash tables.
  */
-static u32 inet6_synq_hash(const struct in6_addr *raddr, const u16 rport,
+static u32 inet6_synq_hash(const struct in6_addr *raddr, const __be16 rport,
                            const u32 rnd, const u16 synq_hsize)
 {
-        u32 a = raddr->s6_addr32[0];
-        u32 b = raddr->s6_addr32[1];
-        u32 c = raddr->s6_addr32[2];
+        u32 a = (__force u32)raddr->s6_addr32[0];
+        u32 b = (__force u32)raddr->s6_addr32[1];
+        u32 c = (__force u32)raddr->s6_addr32[2];
 
         a += JHASH_GOLDEN_RATIO;
         b += JHASH_GOLDEN_RATIO;
         c += rnd;
         __jhash_mix(a, b, c);
 
-        a += raddr->s6_addr32[3];
-        b += (u32)rport;
+        a += (__force u32)raddr->s6_addr32[3];
+        b += (__force u32)rport;
         __jhash_mix(a, b, c);
 
         return c & (synq_hsize - 1);
@@ -73,7 +73,7 @@ static u32 inet6_synq_hash(const struct in6_addr *raddr, const u16 rport,
 
 struct request_sock *inet6_csk_search_req(const struct sock *sk,
                                           struct request_sock ***prevp,
-                                          const __u16 rport,
+                                          const __be16 rport,
                                           const struct in6_addr *raddr,
                                           const struct in6_addr *laddr,
                                           const int iif)
@@ -139,9 +139,8 @@ void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
 
 EXPORT_SYMBOL_GPL(inet6_csk_addr2sockaddr);
 
-int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
+int inet6_csk_xmit(struct sk_buff *skb, struct sock *sk, int ipfragok)
 {
-        struct sock *sk = skb->sk;
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct flowi fl;
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 8accd1fbeeda..b7e5bae0e347 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -57,7 +57,7 @@ EXPORT_SYMBOL(__inet6_hash);
  */
 struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
                                            const struct in6_addr *saddr,
-                                           const u16 sport,
+                                           const __be16 sport,
                                            const struct in6_addr *daddr,
                                            const u16 hnum,
                                            const int dif)
@@ -146,8 +146,8 @@ struct sock *inet6_lookup_listener(struct inet_hashinfo *hashinfo,
 EXPORT_SYMBOL_GPL(inet6_lookup_listener);
 
 struct sock *inet6_lookup(struct inet_hashinfo *hashinfo,
-                          const struct in6_addr *saddr, const u16 sport,
-                          const struct in6_addr *daddr, const u16 dport,
+                          const struct in6_addr *saddr, const __be16 sport,
+                          const struct in6_addr *daddr, const __be16 dport,
                           const int dif)
 {
         struct sock *sk;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index f98ca30d7c1f..bf526115e518 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -139,9 +139,9 @@ static __inline__ u32 fib6_new_sernum(void)
  *      test bit
  */
 
-static __inline__ int addr_bit_set(void *token, int fn_bit)
+static __inline__ __be32 addr_bit_set(void *token, int fn_bit)
 {
-        __u32 *addr = token;
+        __be32 *addr = token;
 
         return htonl(1 << ((~fn_bit)&0x1F)) & addr[fn_bit>>5];
 }
@@ -434,7 +434,7 @@ static struct fib6_node * fib6_add_1(struct fib6_node *root, void *addr,
         struct fib6_node *pn = NULL;
         struct rt6key *key;
         int     bit;
-        int     dir = 0;
+        __be32  dir = 0;
         __u32   sernum = fib6_new_sernum();
 
         RT6_TRACE("fib6_add_1\n");
@@ -829,7 +829,7 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
                                         struct lookup_args *args)
 {
         struct fib6_node *fn;
-        int dir;
+        __be32 dir;
 
         if (unlikely(args->offset == 0))
                 return NULL;
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 6d4533b58dca..624fae251f4e 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -61,7 +61,7 @@ static DEFINE_RWLOCK(ip6_fl_lock);
 static DEFINE_RWLOCK(ip6_sk_fl_lock);
 
 
-static __inline__ struct ip6_flowlabel * __fl_lookup(u32 label)
+static __inline__ struct ip6_flowlabel * __fl_lookup(__be32 label)
 {
         struct ip6_flowlabel *fl;
 
@@ -72,7 +72,7 @@ static __inline__ struct ip6_flowlabel * __fl_lookup(u32 label)
         return NULL;
 }
 
-static struct ip6_flowlabel * fl_lookup(u32 label)
+static struct ip6_flowlabel * fl_lookup(__be32 label)
 {
         struct ip6_flowlabel *fl;
 
@@ -153,7 +153,7 @@ static void ip6_fl_gc(unsigned long dummy)
         write_unlock(&ip6_fl_lock);
 }
 
-static int fl_intern(struct ip6_flowlabel *fl, __u32 label)
+static int fl_intern(struct ip6_flowlabel *fl, __be32 label)
 {
         fl->label = label & IPV6_FLOWLABEL_MASK;
 
@@ -182,7 +182,7 @@ static int fl_intern(struct ip6_flowlabel *fl, __u32 label)
 
 /* Socket flowlabel lists */
 
-struct ip6_flowlabel * fl6_sock_lookup(struct sock *sk, u32 label)
+struct ip6_flowlabel * fl6_sock_lookup(struct sock *sk, __be32 label)
 {
         struct ipv6_fl_socklist *sfl;
         struct ipv6_pinfo *np = inet6_sk(sk);
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 6b8e6d76a58b..ad0b8abcdf4b 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -60,14 +60,22 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 {
         struct ipv6hdr *hdr;
         u32             pkt_len;
+        struct inet6_dev *idev;
 
-        if (skb->pkt_type == PACKET_OTHERHOST)
-                goto drop;
+        if (skb->pkt_type == PACKET_OTHERHOST) {
+                kfree_skb(skb);
+                return 0;
+        }
+
+        rcu_read_lock();
 
-        IP6_INC_STATS_BH(IPSTATS_MIB_INRECEIVES);
+        idev = __in6_dev_get(skb->dev);
+
+        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INRECEIVES);
 
         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INDISCARDS);
+                IP6_INC_STATS_BH(idev, IPSTATS_MIB_INDISCARDS);
+                rcu_read_unlock();
                 goto out;
         }
 
@@ -84,7 +92,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
          * arrived via the sending interface (ethX), because of the
          * nature of scoping architecture. --yoshfuji
          */
-        IP6CB(skb)->iif = skb->dst ? ((struct rt6_info *)skb->dst)->rt6i_idev->dev->ifindex : dev->ifindex;
+        IP6CB(skb)->iif = skb->dst ? ip6_dst_idev(skb->dst)->dev->ifindex : dev->ifindex;
 
         if (unlikely(!pskb_may_pull(skb, sizeof(*hdr))))
                 goto err;
@@ -104,7 +112,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                 if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
                         goto truncated;
                 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr))) {
-                        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
                         goto drop;
                 }
                 hdr = skb->nh.ipv6h;
@@ -112,17 +120,21 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 
         if (hdr->nexthdr == NEXTHDR_HOP) {
                 if (ipv6_parse_hopopts(&skb) < 0) {
-                        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
+                        rcu_read_unlock();
                         return 0;
                 }
         }
 
+        rcu_read_unlock();
+
         return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish);
 truncated:
-        IP6_INC_STATS_BH(IPSTATS_MIB_INTRUNCATEDPKTS);
+        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 err:
-        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
 drop:
+        rcu_read_unlock();
         kfree_skb(skb);
 out:
         return 0;
@@ -140,6 +152,7 @@ static inline int ip6_input_finish(struct sk_buff *skb)
         unsigned int nhoff;
         int nexthdr;
         u8 hash;
+        struct inet6_dev *idev;
 
         /*
          *      Parse extension headers
@@ -147,6 +160,7 @@ static inline int ip6_input_finish(struct sk_buff *skb)
 
         rcu_read_lock();
 resubmit:
+        idev = ip6_dst_idev(skb->dst);
         if (!pskb_pull(skb, skb->h.raw - skb->data))
                 goto discard;
         nhoff = IP6CB(skb)->nhoff;
@@ -185,24 +199,24 @@ resubmit:
                 if (ret > 0)
                         goto resubmit;
                 else if (ret == 0)
-                        IP6_INC_STATS_BH(IPSTATS_MIB_INDELIVERS);
+                        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INDELIVERS);
         } else {
                 if (!raw_sk) {
                         if (xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                                IP6_INC_STATS_BH(IPSTATS_MIB_INUNKNOWNPROTOS);
+                                IP6_INC_STATS_BH(idev, IPSTATS_MIB_INUNKNOWNPROTOS);
                                 icmpv6_send(skb, ICMPV6_PARAMPROB,
                                             ICMPV6_UNK_NEXTHDR, nhoff,
                                             skb->dev);
                         }
                 } else
-                        IP6_INC_STATS_BH(IPSTATS_MIB_INDELIVERS);
+                        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INDELIVERS);
                 kfree_skb(skb);
         }
         rcu_read_unlock();
         return 0;
 
 discard:
-        IP6_INC_STATS_BH(IPSTATS_MIB_INDISCARDS);
+        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INDISCARDS);
         rcu_read_unlock();
         kfree_skb(skb);
         return 0;
@@ -219,7 +233,7 @@ int ip6_mc_input(struct sk_buff *skb)
         struct ipv6hdr *hdr;
         int deliver;
 
-        IP6_INC_STATS_BH(IPSTATS_MIB_INMCASTPKTS);
+        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INMCASTPKTS);
 
         hdr = skb->nh.ipv6h;
         deliver = likely(!(skb->dev->flags & (IFF_PROMISC|IFF_ALLMULTI))) ||
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 66716911962e..e05ecbb1412d 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -88,7 +88,7 @@ static inline int ip6_output_finish(struct sk_buff *skb)
         } else if (dst->neighbour)
                 return dst->neighbour->output(skb);
 
-        IP6_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
+        IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
         kfree_skb(skb);
         return -EINVAL;
 
@@ -118,6 +118,7 @@ static int ip6_output2(struct sk_buff *skb)
 
         if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr)) {
                 struct ipv6_pinfo* np = skb->sk ? inet6_sk(skb->sk) : NULL;
+                struct inet6_dev *idev = ip6_dst_idev(skb->dst);
 
                 if (!(dev->flags & IFF_LOOPBACK) && (!np || np->mc_loop) &&
                     ipv6_chk_mcast_addr(dev, &skb->nh.ipv6h->daddr,
@@ -133,13 +134,13 @@ static int ip6_output2(struct sk_buff *skb)
                                         ip6_dev_loopback_xmit);
 
                         if (skb->nh.ipv6h->hop_limit == 0) {
-                                IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
+                                IP6_INC_STATS(idev, IPSTATS_MIB_OUTDISCARDS);
                                 kfree_skb(skb);
                                 return 0;
                         }
                 }
 
-                IP6_INC_STATS(IPSTATS_MIB_OUTMCASTPKTS);
+                IP6_INC_STATS(idev, IPSTATS_MIB_OUTMCASTPKTS);
         }
 
         return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb,NULL, skb->dev,ip6_output_finish);
@@ -182,12 +183,14 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
 
                 if (skb_headroom(skb) < head_room) {
                         struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
-                        kfree_skb(skb);
-                        skb = skb2;
-                        if (skb == NULL) {      
-                                IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
+                        if (skb2 == NULL) {
+                                IP6_INC_STATS(ip6_dst_idev(skb->dst),
+                                              IPSTATS_MIB_OUTDISCARDS);
+                                kfree_skb(skb);
                                 return -ENOBUFS;
                         }
+                        kfree_skb(skb);
+                        skb = skb2;
                         if (sk)
                                 skb_set_owner_w(skb, sk);
                 }
@@ -217,7 +220,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         if (tclass < 0)
                 tclass = 0;
 
-        *(u32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel;
+        *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel;
 
         hdr->payload_len = htons(seg_len);
         hdr->nexthdr = proto;
@@ -230,7 +233,8 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
 
         mtu = dst_mtu(dst);
         if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) {
-                IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
+                IP6_INC_STATS(ip6_dst_idev(skb->dst),
+                              IPSTATS_MIB_OUTREQUESTS);
                 return NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev,
                                 dst_output);
         }
@@ -239,7 +243,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
                 printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
         skb->dev = dst->dev;
         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
-        IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
+        IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
         kfree_skb(skb);
         return -EMSGSIZE;
 }
@@ -267,7 +271,7 @@ int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
         hdr = (struct ipv6hdr *) skb_put(skb, sizeof(struct ipv6hdr));
         skb->nh.ipv6h = hdr;
 
-        *(u32*)hdr = htonl(0x60000000);
+        *(__be32*)hdr = htonl(0x60000000);
 
         hdr->payload_len = htons(len);
         hdr->nexthdr = proto;
@@ -373,7 +377,7 @@ int ip6_forward(struct sk_buff *skb)
                 goto error;
 
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
-                IP6_INC_STATS(IPSTATS_MIB_INDISCARDS);
+                IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
                 goto drop;
         }
 
@@ -406,7 +410,7 @@ int ip6_forward(struct sk_buff *skb)
                 skb->dev = dst->dev;
                 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
                             0, skb->dev);
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 
                 kfree_skb(skb);
                 return -ETIMEDOUT;
@@ -419,13 +423,13 @@ int ip6_forward(struct sk_buff *skb)
                 if (proxied > 0)
                         return ip6_input(skb);
                 else if (proxied < 0) {
-                        IP6_INC_STATS(IPSTATS_MIB_INDISCARDS);
+                        IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
                         goto drop;
                 }
         }
 
         if (!xfrm6_route_forward(skb)) {
-                IP6_INC_STATS(IPSTATS_MIB_INDISCARDS);
+                IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
                 goto drop;
         }
         dst = skb->dst;
@@ -464,14 +468,14 @@ int ip6_forward(struct sk_buff *skb)
                 /* Again, force OUTPUT device used as source address */
                 skb->dev = dst->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, dst_mtu(dst), skb->dev);
-                IP6_INC_STATS_BH(IPSTATS_MIB_INTOOBIGERRORS);
-                IP6_INC_STATS_BH(IPSTATS_MIB_FRAGFAILS);
+                IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
                 kfree_skb(skb);
                 return -EMSGSIZE;
         }
 
         if (skb_cow(skb, dst->dev->hard_header_len)) {
-                IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
+                IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
                 goto drop;
         }
 
@@ -481,11 +485,11 @@ int ip6_forward(struct sk_buff *skb)
  
         hdr->hop_limit--;
 
-        IP6_INC_STATS_BH(IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
         return NF_HOOK(PF_INET6,NF_IP6_FORWARD, skb, skb->dev, dst->dev, ip6_forward_finish);
 
 error:
-        IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
+        IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
 drop:
         kfree_skb(skb);
         return -EINVAL;
@@ -499,12 +503,12 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         dst_release(to->dst);
         to->dst = dst_clone(from->dst);
         to->dev = from->dev;
+        to->mark = from->mark;
 
 #ifdef CONFIG_NET_SCHED
         to->tc_index = from->tc_index;
 #endif
 #ifdef CONFIG_NETFILTER
-        to->nfmark = from->nfmark;
         /* Connection association is same as pre-frag packet */
         nf_conntrack_put(to->nfct);
         to->nfct = from->nfct;
@@ -571,7 +575,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
         unsigned int mtu, hlen, left, len;
-        u32 frag_id = 0;
+        __be32 frag_id = 0;
         int ptr, offset = 0, err=0;
         u8 *prevhdr, nexthdr = 0;
 
@@ -620,14 +624,13 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 skb_shinfo(skb)->frag_list = NULL;
                 /* BUILD HEADER */
 
-                tmp_hdr = kmalloc(hlen, GFP_ATOMIC);
+                tmp_hdr = kmemdup(skb->nh.raw, hlen, GFP_ATOMIC);
                 if (!tmp_hdr) {
-                        IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
+                        IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
                         return -ENOMEM;
                 }
 
                 *prevhdr = NEXTHDR_FRAGMENT;
-                memcpy(tmp_hdr, skb->nh.raw, hlen);
                 __skb_pull(skb, hlen);
                 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
                 skb->nh.raw = __skb_push(skb, hlen);
@@ -643,7 +646,8 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 skb->data_len = first_len - skb_headlen(skb);
                 skb->len = first_len;
                 skb->nh.ipv6h->payload_len = htons(first_len - sizeof(struct ipv6hdr));
- 
+
+                dst_hold(&rt->u.dst);
 
                 for (;;) {
                         /* Prepare header of the next frame,
@@ -667,7 +671,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         
                         err = output(skb);
                         if(!err)
-                                IP6_INC_STATS(IPSTATS_MIB_FRAGCREATES);
+                                IP6_INC_STATS(ip6_dst_idev(&rt->u.dst), IPSTATS_MIB_FRAGCREATES);
 
                         if (err || !frag)
                                 break;
@@ -680,7 +684,8 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 kfree(tmp_hdr);
 
                 if (err == 0) {
-                        IP6_INC_STATS(IPSTATS_MIB_FRAGOKS);
+                        IP6_INC_STATS(ip6_dst_idev(&rt->u.dst), IPSTATS_MIB_FRAGOKS);
+                        dst_release(&rt->u.dst);
                         return 0;
                 }
 
@@ -690,7 +695,8 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         frag = skb;
                 }
 
-                IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
+                IP6_INC_STATS(ip6_dst_idev(&rt->u.dst), IPSTATS_MIB_FRAGFAILS);
+                dst_release(&rt->u.dst);
                 return err;
         }
 
@@ -723,7 +729,8 @@ slow_path:
 
                 if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_RESERVED_SPACE(rt->u.dst.dev), GFP_ATOMIC)) == NULL) {
                         NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
-                        IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
+                        IP6_INC_STATS(ip6_dst_idev(skb->dst),
+                                      IPSTATS_MIB_FRAGFAILS);
                         err = -ENOMEM;
                         goto fail;
                 }
@@ -784,15 +791,17 @@ slow_path:
                 if (err)
                         goto fail;
 
-                IP6_INC_STATS(IPSTATS_MIB_FRAGCREATES);
+                IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGCREATES);
         }
+        IP6_INC_STATS(ip6_dst_idev(skb->dst),
+                      IPSTATS_MIB_FRAGOKS);
         kfree_skb(skb);
-        IP6_INC_STATS(IPSTATS_MIB_FRAGOKS);
         return err;
 
 fail:
+        IP6_INC_STATS(ip6_dst_idev(skb->dst),
+                      IPSTATS_MIB_FRAGFAILS);
         kfree_skb(skb); 
-        IP6_INC_STATS(IPSTATS_MIB_FRAGFAILS);
         return err;
 }
 
@@ -1265,7 +1274,7 @@ alloc_new_skb:
         return 0;
 error:
         inet->cork.length -= length;
-        IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
+        IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
         return err;
 }
 
@@ -1311,7 +1320,7 @@ int ip6_push_pending_frames(struct sock *sk)
 
         skb->nh.ipv6h = hdr = (struct ipv6hdr*) skb_push(skb, sizeof(struct ipv6hdr));
         
-        *(u32*)hdr = fl->fl6_flowlabel |
+        *(__be32*)hdr = fl->fl6_flowlabel |
                      htonl(0x60000000 | ((int)np->cork.tclass << 20));
 
         if (skb->len <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN)
@@ -1326,7 +1335,7 @@ int ip6_push_pending_frames(struct sock *sk)
         skb->priority = sk->sk_priority;
 
         skb->dst = dst_clone(&rt->u.dst);
-        IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS); 
+        IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
         err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dst->dev, dst_output);
         if (err) {
                 if (err > 0)
@@ -1357,7 +1366,8 @@ void ip6_flush_pending_frames(struct sock *sk)
         struct sk_buff *skb;
 
         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
-                IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
+                IP6_INC_STATS(ip6_dst_idev(skb->dst),
+                              IPSTATS_MIB_OUTDISCARDS);
                 kfree_skb(skb);
         }
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index b9f40290d12a..8d918348f5bb 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -66,7 +66,7 @@ MODULE_LICENSE("GPL");
 
 #define HASH_SIZE  32
 
-#define HASH(addr) (((addr)->s6_addr32[0] ^ (addr)->s6_addr32[1] ^ \
+#define HASH(addr) ((__force u32)((addr)->s6_addr32[0] ^ (addr)->s6_addr32[1] ^ \
                      (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
                     (HASH_SIZE - 1))
 
@@ -215,11 +215,10 @@ ip6ip6_tnl_unlink(struct ip6_tnl *t)
  *   Create tunnel matching given parameters.
  * 
  * Return: 
- *   0 on success
+ *   created tunnel or NULL
  **/
 
-static int
-ip6_tnl_create(struct ip6_tnl_parm *p, struct ip6_tnl **pt)
+static struct ip6_tnl *ip6_tnl_create(struct ip6_tnl_parm *p)
 {
         struct net_device *dev;
         struct ip6_tnl *t;
@@ -236,11 +235,11 @@ ip6_tnl_create(struct ip6_tnl_parm *p, struct ip6_tnl **pt)
                                 break;
                 }
                 if (i == IP6_TNL_MAX) 
-                        return -ENOBUFS;
+                        goto failed;
         }
         dev = alloc_netdev(sizeof (*t), name, ip6ip6_tnl_dev_setup);
         if (dev == NULL)
-                return -ENOMEM;
+                goto failed;
 
         t = netdev_priv(dev);
         dev->init = ip6ip6_tnl_dev_init;
@@ -248,13 +247,13 @@ ip6_tnl_create(struct ip6_tnl_parm *p, struct ip6_tnl **pt)
 
         if ((err = register_netdevice(dev)) < 0) {
                 free_netdev(dev);
-                return err;
+                goto failed;
         }
         dev_hold(dev);
-
         ip6ip6_tnl_link(t);
-        *pt = t;
-        return 0;
+        return t;
+failed:
+        return NULL;
 }
 
 /**
@@ -268,32 +267,23 @@ ip6_tnl_create(struct ip6_tnl_parm *p, struct ip6_tnl **pt)
  *   tunnel device is created and registered for use.
  *
  * Return:
- *   0 if tunnel located or created,
- *   -EINVAL if parameters incorrect,
- *   -ENODEV if no matching tunnel available
+ *   matching tunnel or NULL
  **/
 
-static int
-ip6ip6_tnl_locate(struct ip6_tnl_parm *p, struct ip6_tnl **pt, int create)
+static struct ip6_tnl *ip6ip6_tnl_locate(struct ip6_tnl_parm *p, int create)
 {
         struct in6_addr *remote = &p->raddr;
         struct in6_addr *local = &p->laddr;
         struct ip6_tnl *t;
 
-        if (p->proto != IPPROTO_IPV6)
-                return -EINVAL;
-
         for (t = *ip6ip6_bucket(p); t; t = t->next) {
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
-                    ipv6_addr_equal(remote, &t->parms.raddr)) {
-                        *pt = t;
-                        return (create ? -EEXIST : 0);
-                }
+                    ipv6_addr_equal(remote, &t->parms.raddr))
+                        return t;
         }
         if (!create)
-                return -ENODEV;
-        
-        return ip6_tnl_create(p, pt);
+                return NULL;
+        return ip6_tnl_create(p);
 }
 
 /**
@@ -391,7 +381,7 @@ parse_tlv_tnl_enc_lim(struct sk_buff *skb, __u8 * raw)
 
 static int
 ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-           int type, int code, int offset, __u32 info)
+           int type, int code, int offset, __be32 info)
 {
         struct ipv6hdr *ipv6h = (struct ipv6hdr *) skb->data;
         struct ip6_tnl *t;
@@ -434,12 +424,9 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 }
                 break;
         case ICMPV6_PARAMPROB:
-                /* ignore if parameter problem not caused by a tunnel
-                   encapsulation limit sub-option */
-                if (code != ICMPV6_HDR_FIELD) {
-                        break;
-                }
-                teli = parse_tlv_tnl_enc_lim(skb, skb->data);
+                teli = 0;
+                if (code == ICMPV6_HDR_FIELD)
+                        teli = parse_tlv_tnl_enc_lim(skb, skb->data);
 
                 if (teli && teli == ntohl(info) - 2) {
                         tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
@@ -451,6 +438,10 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                                "tunnel!\n", t->parms.name);
                                 rel_msg = 1;
                         }
+                } else if (net_ratelimit()) {
+                        printk(KERN_WARNING
+                               "%s: Recipient unable to parse tunneled "
+                               "packet!\n ", t->parms.name);
                 }
                 break;
         case ICMPV6_PKT_TOOBIG:
@@ -470,6 +461,7 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (rel_msg &&  pskb_may_pull(skb, offset + sizeof (*ipv6h))) {
                 struct rt6_info *rt;
                 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
+
                 if (!skb2)
                         goto out;
 
@@ -504,6 +496,27 @@ static inline void ip6ip6_ecn_decapsulate(struct ipv6hdr *outer_iph,
         if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph)))
                 IP6_ECN_set_ce(inner_iph);
 }
+static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
+{
+        struct ip6_tnl_parm *p = &t->parms;
+        int ret = 0;
+
+        if (p->flags & IP6_TNL_F_CAP_RCV) {
+                struct net_device *ldev = NULL;
+
+                if (p->link)
+                        ldev = dev_get_by_index(p->link);
+
+                if ((ipv6_addr_is_multicast(&p->laddr) ||
+                     likely(ipv6_chk_addr(&p->laddr, ldev, 0))) &&
+                    likely(!ipv6_chk_addr(&p->raddr, NULL, 0)))
+                        ret = 1;
+
+                if (ldev)
+                        dev_put(ldev);
+        }
+        return ret;
+}
 
 /**
  * ip6ip6_rcv - decapsulate IPv6 packet and retransmit it locally
@@ -528,7 +541,7 @@ ip6ip6_rcv(struct sk_buff *skb)
                         goto discard;
                 }
 
-                if (!(t->parms.flags & IP6_TNL_F_CAP_RCV)) {
+                if (!ip6_tnl_rcv_ctl(t)) {
                         t->stat.rx_dropped++;
                         read_unlock(&ip6ip6_lock);
                         goto discard;
@@ -560,31 +573,23 @@ discard:
         return 0;
 }
 
-static inline struct ipv6_txoptions *create_tel(__u8 encap_limit)
-{
-        struct ipv6_tlv_tnl_enc_lim *tel;
-        struct ipv6_txoptions *opt;
-        __u8 *raw;
-
-        int opt_len = sizeof(*opt) + 8;
-
-        if (!(opt = kzalloc(opt_len, GFP_ATOMIC))) {
-                return NULL;
-        }
-        opt->tot_len = opt_len;
-        opt->dst0opt = (struct ipv6_opt_hdr *) (opt + 1);
-        opt->opt_nflen = 8;
+struct ipv6_tel_txoption {
+        struct ipv6_txoptions ops;
+        __u8 dst_opt[8];
+};
 
-        tel = (struct ipv6_tlv_tnl_enc_lim *) (opt->dst0opt + 1);
-        tel->type = IPV6_TLV_TNL_ENCAP_LIMIT;
-        tel->length = 1;
-        tel->encap_limit = encap_limit;
+static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
+{
+        memset(opt, 0, sizeof(struct ipv6_tel_txoption));
 
-        raw = (__u8 *) opt->dst0opt;
-        raw[5] = IPV6_TLV_PADN;
-        raw[6] = 1;
+        opt->dst_opt[2] = IPV6_TLV_TNL_ENCAP_LIMIT;
+        opt->dst_opt[3] = 1;
+        opt->dst_opt[4] = encap_limit;
+        opt->dst_opt[5] = IPV6_TLV_PADN;
+        opt->dst_opt[6] = 1;
 
-        return opt;
+        opt->ops.dst0opt = (struct ipv6_opt_hdr *) opt->dst_opt;
+        opt->ops.opt_nflen = 8;
 }
 
 /**
@@ -607,6 +612,34 @@ ip6ip6_tnl_addr_conflict(struct ip6_tnl *t, struct ipv6hdr *hdr)
         return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
 }
 
+static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
+{
+        struct ip6_tnl_parm *p = &t->parms;
+        int ret = 0;
+
+        if (p->flags & IP6_TNL_F_CAP_XMIT) {
+                struct net_device *ldev = NULL;
+
+                if (p->link)
+                        ldev = dev_get_by_index(p->link);
+
+                if (unlikely(!ipv6_chk_addr(&p->laddr, ldev, 0)))
+                        printk(KERN_WARNING
+                               "%s xmit: Local address not yet configured!\n",
+                               p->name);
+                else if (!ipv6_addr_is_multicast(&p->raddr) &&
+                         unlikely(ipv6_chk_addr(&p->raddr, NULL, 0)))
+                        printk(KERN_WARNING
+                               "%s xmit: Routing loop! "
+                               "Remote address found on this node!\n",
+                               p->name);
+                else
+                        ret = 1;
+                if (ldev)
+                        dev_put(ldev);
+        }
+        return ret;
+}
 /**
  * ip6ip6_tnl_xmit - encapsulate packet and send 
  *   @skb: the outgoing socket buffer
@@ -626,8 +659,8 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         struct ip6_tnl *t = netdev_priv(dev);
         struct net_device_stats *stats = &t->stat;
         struct ipv6hdr *ipv6h = skb->nh.ipv6h;
-        struct ipv6_txoptions *opt = NULL;
         int encap_limit = -1;
+        struct ipv6_tel_txoption opt;
         __u16 offset;
         struct flowi fl;
         struct dst_entry *dst;
@@ -644,10 +677,9 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto tx_err;
         }
         if (skb->protocol != htons(ETH_P_IPV6) ||
-            !(t->parms.flags & IP6_TNL_F_CAP_XMIT) ||
-            ip6ip6_tnl_addr_conflict(t, ipv6h)) {
+            !ip6_tnl_xmit_ctl(t) || ip6ip6_tnl_addr_conflict(t, ipv6h))
                 goto tx_err;
-        }
+
         if ((offset = parse_tlv_tnl_enc_lim(skb, skb->nh.raw)) > 0) {
                 struct ipv6_tlv_tnl_enc_lim *tel;
                 tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->nh.raw[offset];
@@ -657,20 +689,17 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                         goto tx_err;
                 }
                 encap_limit = tel->encap_limit - 1;
-        } else if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT)) {
+        } else if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                 encap_limit = t->parms.encap_limit;
-        }
+
         memcpy(&fl, &t->fl, sizeof (fl));
         proto = fl.proto;
 
         dsfield = ipv6_get_dsfield(ipv6h);
         if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
-                fl.fl6_flowlabel |= (*(__u32 *) ipv6h & IPV6_TCLASS_MASK);
+                fl.fl6_flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
         if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL))
-                fl.fl6_flowlabel |= (*(__u32 *) ipv6h & IPV6_FLOWLABEL_MASK);
-
-        if (encap_limit >= 0 && (opt = create_tel(encap_limit)) == NULL)
-                goto tx_err;
+                fl.fl6_flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
 
         if ((dst = ip6_tnl_dst_check(t)) != NULL)
                 dst_hold(dst);
@@ -692,7 +721,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto tx_err_dst_release;
         }
         mtu = dst_mtu(dst) - sizeof (*ipv6h);
-        if (opt) {
+        if (encap_limit >= 0) {
                 max_headroom += 8;
                 mtu -= 8;
         }
@@ -730,12 +759,13 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 
         skb->h.raw = skb->nh.raw;
 
-        if (opt)
-                ipv6_push_nfrag_opts(skb, opt, &proto, NULL);
-
+        if (encap_limit >= 0) {
+                init_tel_txopt(&opt, encap_limit);
+                ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
+        }
         skb->nh.raw = skb_push(skb, sizeof(struct ipv6hdr));
         ipv6h = skb->nh.ipv6h;
-        *(u32*)ipv6h = fl.fl6_flowlabel | htonl(0x60000000);
+        *(__be32*)ipv6h = fl.fl6_flowlabel | htonl(0x60000000);
         dsfield = INET_ECN_encapsulate(0, dsfield);
         ipv6_change_dsfield(ipv6h, ~INET_ECN_MASK, dsfield);
         ipv6h->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
@@ -748,7 +778,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, 
                       skb->dst->dev, dst_output);
 
-        if (err == NET_XMIT_SUCCESS || err == NET_XMIT_CN) {
+        if (net_xmit_eval(err) == 0) {
                 stats->tx_bytes += pkt_len;
                 stats->tx_packets++;
         } else {
@@ -756,9 +786,6 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 stats->tx_aborted_errors++;
         }
         ip6_tnl_dst_store(t, dst);
-
-        kfree(opt);
-
         t->recursion--;
         return 0;
 tx_err_link_failure:
@@ -766,7 +793,6 @@ tx_err_link_failure:
         dst_link_failure(skb);
 tx_err_dst_release:
         dst_release(dst);
-        kfree(opt);
 tx_err:
         stats->tx_errors++;
         stats->tx_dropped++;
@@ -778,39 +804,19 @@ tx_err:
 static void ip6_tnl_set_cap(struct ip6_tnl *t)
 {
         struct ip6_tnl_parm *p = &t->parms;
-        struct in6_addr *laddr = &p->laddr;
-        struct in6_addr *raddr = &p->raddr;
-        int ltype = ipv6_addr_type(laddr);
-        int rtype = ipv6_addr_type(raddr);
+        int ltype = ipv6_addr_type(&p->laddr);
+        int rtype = ipv6_addr_type(&p->raddr);
 
         p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV);
 
-        if (ltype != IPV6_ADDR_ANY && rtype != IPV6_ADDR_ANY &&
-            ((ltype|rtype) &
-             (IPV6_ADDR_UNICAST|
-              IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL|
-              IPV6_ADDR_MAPPED|IPV6_ADDR_RESERVED)) == IPV6_ADDR_UNICAST) {
-                struct net_device *ldev = NULL;
-                int l_ok = 1;
-                int r_ok = 1;
-
-                if (p->link)
-                        ldev = dev_get_by_index(p->link);
-                
-                if (ltype&IPV6_ADDR_UNICAST && !ipv6_chk_addr(laddr, ldev, 0))
-                        l_ok = 0;
-                
-                if (rtype&IPV6_ADDR_UNICAST && ipv6_chk_addr(raddr, NULL, 0))
-                        r_ok = 0;
-                
-                if (l_ok && r_ok) {
-                        if (ltype&IPV6_ADDR_UNICAST)
-                                p->flags |= IP6_TNL_F_CAP_XMIT;
-                        if (rtype&IPV6_ADDR_UNICAST)
-                                p->flags |= IP6_TNL_F_CAP_RCV;
-                }
-                if (ldev)
-                        dev_put(ldev);
+        if (ltype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
+            rtype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
+            !((ltype|rtype) & IPV6_ADDR_LOOPBACK) &&
+            (!((ltype|rtype) & IPV6_ADDR_LINKLOCAL) || p->link)) {
+                if (ltype&IPV6_ADDR_UNICAST)
+                        p->flags |= IP6_TNL_F_CAP_XMIT;
+                if (rtype&IPV6_ADDR_UNICAST)
+                        p->flags |= IP6_TNL_F_CAP_RCV;
         }
 }
 
@@ -844,8 +850,11 @@ static void ip6ip6_tnl_link_config(struct ip6_tnl *t)
         dev->iflink = p->link;
 
         if (p->flags & IP6_TNL_F_CAP_XMIT) {
+                int strict = (ipv6_addr_type(&p->raddr) &
+                              (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));
+
                 struct rt6_info *rt = rt6_lookup(&p->raddr, &p->laddr,
-                                                 p->link, 0);
+                                                 p->link, strict);
 
                 if (rt == NULL)
                         return;
@@ -920,26 +929,20 @@ static int
 ip6ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 {
         int err = 0;
-        int create;
         struct ip6_tnl_parm p;
         struct ip6_tnl *t = NULL;
 
         switch (cmd) {
         case SIOCGETTUNNEL:
                 if (dev == ip6ip6_fb_tnl_dev) {
-                        if (copy_from_user(&p,
-                                           ifr->ifr_ifru.ifru_data,
-                                           sizeof (p))) {
+                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p))) {
                                 err = -EFAULT;
                                 break;
                         }
-                        if ((err = ip6ip6_tnl_locate(&p, &t, 0)) == -ENODEV)
-                                t = netdev_priv(dev);
-                        else if (err)
-                                break;
-                } else
+                        t = ip6ip6_tnl_locate(&p, 0);
+                }
+                if (t == NULL)
                         t = netdev_priv(dev);
-
                 memcpy(&p, &t->parms, sizeof (p));
                 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof (p))) {
                         err = -EFAULT;
@@ -948,35 +951,36 @@ ip6ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         case SIOCADDTUNNEL:
         case SIOCCHGTUNNEL:
                 err = -EPERM;
-                create = (cmd == SIOCADDTUNNEL);
                 if (!capable(CAP_NET_ADMIN))
                         break;
-                if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p))) {
-                        err = -EFAULT;
+                err = -EFAULT;
+                if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
                         break;
-                }
-                if (!create && dev != ip6ip6_fb_tnl_dev) {
-                        t = netdev_priv(dev);
-                }
-                if (!t && (err = ip6ip6_tnl_locate(&p, &t, create))) {
+                err = -EINVAL;
+                if (p.proto != IPPROTO_IPV6)
                         break;
-                }
-                if (cmd == SIOCCHGTUNNEL) {
-                        if (t->dev != dev) {
-                                err = -EEXIST;
-                                break;
-                        }
+                t = ip6ip6_tnl_locate(&p, cmd == SIOCADDTUNNEL);
+                if (dev != ip6ip6_fb_tnl_dev && cmd == SIOCCHGTUNNEL) {
+                        if (t != NULL) {
+                                if (t->dev != dev) {
+                                        err = -EEXIST;
+                                        break;
+                                }
+                        } else
+                                t = netdev_priv(dev);
+
                         ip6ip6_tnl_unlink(t);
                         err = ip6ip6_tnl_change(t, &p);
                         ip6ip6_tnl_link(t);
                         netdev_state_change(dev);
                 }
-                if (copy_to_user(ifr->ifr_ifru.ifru_data,
-                                 &t->parms, sizeof (p))) {
-                        err = -EFAULT;
-                } else {
+                if (t) {
                         err = 0;
-                }
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof (p)))
+                                err = -EFAULT;
+
+                } else
+                        err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
                 break;
         case SIOCDELTUNNEL:
                 err = -EPERM;
@@ -984,22 +988,18 @@ ip6ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         break;
 
                 if (dev == ip6ip6_fb_tnl_dev) {
-                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data,
-                                           sizeof (p))) {
-                                err = -EFAULT;
+                        err = -EFAULT;
+                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
                                 break;
-                        }
-                        err = ip6ip6_tnl_locate(&p, &t, 0);
-                        if (err)
+                        err = -ENOENT;
+                        if ((t = ip6ip6_tnl_locate(&p, 0)) == NULL)
                                 break;
-                        if (t == netdev_priv(ip6ip6_fb_tnl_dev)) {
-                                err = -EPERM;
+                        err = -EPERM;
+                        if (t->dev == ip6ip6_fb_tnl_dev)
                                 break;
-                        }
-                } else {
-                        t = netdev_priv(dev);
+                        dev = t->dev;
                 }
-                err = unregister_netdevice(t->dev);
+                err = unregister_netdevice(dev);
                 break;
         default:
                 err = -EINVAL;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 71f59f18ede8..511730b67e97 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -176,7 +176,7 @@ out_ok:
 }
 
 static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                                int type, int code, int offset, __u32 info)
+                                int type, int code, int offset, __be32 info)
 {
         __be32 spi;
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index de6b91981b30..1eafcfc95e81 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -51,6 +51,7 @@
 #include <net/inet_common.h>
 #include <net/tcp.h>
 #include <net/udp.h>
+#include <net/udplite.h>
 #include <net/xfrm.h>
 
 #include <asm/uaccess.h>
@@ -239,6 +240,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                         struct sk_buff *pktopt;
 
                         if (sk->sk_protocol != IPPROTO_UDP &&
+                            sk->sk_protocol != IPPROTO_UDPLITE &&
                             sk->sk_protocol != IPPROTO_TCP)
                                 break;
 
@@ -276,11 +278,15 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                                 sk->sk_family = PF_INET;
                                 tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
                         } else {
+                                struct proto *prot = &udp_prot;
+
+                                if (sk->sk_protocol == IPPROTO_UDPLITE)
+                                        prot = &udplite_prot;
                                 local_bh_disable();
                                 sock_prot_dec_use(sk->sk_prot);
-                                sock_prot_inc_use(&udp_prot);
+                                sock_prot_inc_use(prot);
                                 local_bh_enable();
-                                sk->sk_prot = &udp_prot;
+                                sk->sk_prot = prot;
                                 sk->sk_socket->ops = &inet_dgram_ops;
                                 sk->sk_family = PF_INET;
                         }
@@ -813,6 +819,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
         switch (optname) {
         case IPV6_ADDRFORM:
                 if (sk->sk_protocol != IPPROTO_UDP &&
+                    sk->sk_protocol != IPPROTO_UDPLITE &&
                     sk->sk_protocol != IPPROTO_TCP)
                         return -EINVAL;
                 if (sk->sk_state != TCP_ESTABLISHED)
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 3b114e3fa2f8..a1c231a04ac2 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -83,7 +83,7 @@
 struct mld2_grec {
         __u8            grec_type;
         __u8            grec_auxwords;
-        __u16           grec_nsrcs;
+        __be16          grec_nsrcs;
         struct in6_addr grec_mca;
         struct in6_addr grec_src[0];
 };
@@ -91,18 +91,18 @@ struct mld2_grec {
 struct mld2_report {
         __u8    type;
         __u8    resv1;
-        __u16   csum;
-        __u16   resv2;
-        __u16   ngrec;
+        __sum16 csum;
+        __be16  resv2;
+        __be16  ngrec;
         struct mld2_grec grec[0];
 };
 
 struct mld2_query {
         __u8 type;
         __u8 code;
-        __u16 csum;
-        __u16 mrc;
-        __u16 resv1;
+        __sum16 csum;
+        __be16 mrc;
+        __be16 resv1;
         struct in6_addr mca;
 #if defined(__LITTLE_ENDIAN_BITFIELD)
         __u8 qrv:3,
@@ -116,7 +116,7 @@ struct mld2_query {
 #error "Please fix <asm/byteorder.h>"
 #endif
         __u8 qqic;
-        __u16 nsrcs;
+        __be16 nsrcs;
         struct in6_addr srcs[0];
 };
 
@@ -1465,7 +1465,7 @@ static void mld_sendpack(struct sk_buff *skb)
         struct inet6_dev *idev = in6_dev_get(skb->dev);
         int err;
 
-        IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
+        IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
         payload_len = skb->tail - (unsigned char *)skb->nh.ipv6h -
                 sizeof(struct ipv6hdr);
         mldlen = skb->tail - skb->h.raw;
@@ -1477,9 +1477,9 @@ static void mld_sendpack(struct sk_buff *skb)
                 mld_dev_queue_xmit);
         if (!err) {
                 ICMP6_INC_STATS(idev,ICMP6_MIB_OUTMSGS);
-                IP6_INC_STATS(IPSTATS_MIB_OUTMCASTPKTS);
+                IP6_INC_STATS(idev, IPSTATS_MIB_OUTMCASTPKTS);
         } else
-                IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
+                IP6_INC_STATS(idev, IPSTATS_MIB_OUTDISCARDS);
 
         if (likely(idev != NULL))
                 in6_dev_put(idev);
@@ -1763,7 +1763,10 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                      IPV6_TLV_ROUTERALERT, 2, 0, 0,
                      IPV6_TLV_PADN, 0 };
 
-        IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
+        rcu_read_lock();
+        IP6_INC_STATS(__in6_dev_get(dev),
+                      IPSTATS_MIB_OUTREQUESTS);
+        rcu_read_unlock();
         snd_addr = addr;
         if (type == ICMPV6_MGM_REDUCTION) {
                 snd_addr = &all_routers;
@@ -1777,7 +1780,10 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         skb = sock_alloc_send_skb(sk, LL_RESERVED_SPACE(dev) + full_len, 1, &err);
 
         if (skb == NULL) {
-                IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
+                rcu_read_lock();
+                IP6_INC_STATS(__in6_dev_get(dev),
+                              IPSTATS_MIB_OUTDISCARDS);
+                rcu_read_unlock();
                 return;
         }
 
@@ -1816,9 +1822,9 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                 else
                         ICMP6_INC_STATS(idev, ICMP6_MIB_OUTGROUPMEMBRESPONSES);
                 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTMSGS);
-                IP6_INC_STATS(IPSTATS_MIB_OUTMCASTPKTS);
+                IP6_INC_STATS(idev, IPSTATS_MIB_OUTMCASTPKTS);
         } else
-                IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
+                IP6_INC_STATS(idev, IPSTATS_MIB_OUTDISCARDS);
 
         if (likely(idev != NULL))
                 in6_dev_put(idev);
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 7ccdc8fc5a31..be7dd7db65d7 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -262,10 +262,10 @@ static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb, struct
         sel.proto = fl->proto;
         sel.dport = xfrm_flowi_dport(fl);
         if (sel.dport)
-                sel.dport_mask = ~((__u16)0);
+                sel.dport_mask = htons(~0);
         sel.sport = xfrm_flowi_sport(fl);
         if (sel.sport)
-                sel.sport_mask = ~((__u16)0);
+                sel.sport_mask = htons(~0);
         sel.ifindex = fl->oif;
 
         err = km_report(IPPROTO_DSTOPTS, &sel,
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 73eb8c33e9f0..56ea92837307 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -472,7 +472,9 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                         inc_opt = 0;
         }
 
-        skb = sock_alloc_send_skb(sk, MAX_HEADER + len + LL_RESERVED_SPACE(dev),
+        skb = sock_alloc_send_skb(sk,
+                                  (MAX_HEADER + sizeof(struct ipv6hdr) +
+                                   len + LL_RESERVED_SPACE(dev)),
                                   1, &err);
 
         if (skb == NULL) {
@@ -513,7 +515,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
 
         skb->dst = dst;
         idev = in6_dev_get(dst->dev);
-        IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
+        IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
         err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, dst_output);
         if (!err) {
                 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTNEIGHBORADVERTISEMENTS);
@@ -561,7 +563,9 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
         if (send_llinfo)
                 len += ndisc_opt_addr_space(dev);
 
-        skb = sock_alloc_send_skb(sk, MAX_HEADER + len + LL_RESERVED_SPACE(dev),
+        skb = sock_alloc_send_skb(sk,
+                                  (MAX_HEADER + sizeof(struct ipv6hdr) +
+                                   len + LL_RESERVED_SPACE(dev)),
                                   1, &err);
         if (skb == NULL) {
                 ND_PRINTK0(KERN_ERR
@@ -597,7 +601,7 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
         /* send it! */
         skb->dst = dst;
         idev = in6_dev_get(dst->dev);
-        IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
+        IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
         err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, dst_output);
         if (!err) {
                 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTNEIGHBORSOLICITS);
@@ -636,7 +640,9 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
         if (dev->addr_len)
                 len += ndisc_opt_addr_space(dev);
 
-        skb = sock_alloc_send_skb(sk, MAX_HEADER + len + LL_RESERVED_SPACE(dev),
+        skb = sock_alloc_send_skb(sk,
+                                  (MAX_HEADER + sizeof(struct ipv6hdr) +
+                                   len + LL_RESERVED_SPACE(dev)),
                                   1, &err);
         if (skb == NULL) {
                 ND_PRINTK0(KERN_ERR
@@ -670,7 +676,7 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
         /* send it! */
         skb->dst = dst;
         idev = in6_dev_get(dst->dev);
-        IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS); 
+        IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
         err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev, dst_output);
         if (!err) {
                 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTROUTERSOLICITS);
@@ -1261,10 +1267,11 @@ skip_defrtr:
         }
 
         if (ndopts.nd_opts_mtu) {
+                __be32 n;
                 u32 mtu;
 
-                memcpy(&mtu, ((u8*)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
-                mtu = ntohl(mtu);
+                memcpy(&n, ((u8*)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu));
+                mtu = ntohl(n);
 
                 if (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) {
                         ND_PRINTK2(KERN_WARNING
@@ -1446,7 +1453,9 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
         rd_len &= ~0x7;
         len += rd_len;
 
-        buff = sock_alloc_send_skb(sk, MAX_HEADER + len + LL_RESERVED_SPACE(dev),
+        buff = sock_alloc_send_skb(sk,
+                                   (MAX_HEADER + sizeof(struct ipv6hdr) +
+                                    len + LL_RESERVED_SPACE(dev)),
                                    1, &err);
         if (buff == NULL) {
                 ND_PRINTK0(KERN_ERR
@@ -1504,7 +1513,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
 
         buff->dst = dst;
         idev = in6_dev_get(dst->dev);
-        IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
+        IP6_INC_STATS(idev, IPSTATS_MIB_OUTREQUESTS);
         err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, buff, NULL, dst->dev, dst_output);
         if (!err) {
                 ICMP6_INC_STATS(idev, ICMP6_MIB_OUTREDIRECTS);
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 580b1aba6722..f6294e5bcb31 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -31,7 +31,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
 #endif
 
         if (dst->error) {
-                IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
+                IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
                 LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
                 dst_release(dst);
                 return -EINVAL;
@@ -80,11 +80,11 @@ static int nf_ip6_reroute(struct sk_buff **pskb, const struct nf_info *info)
         return 0;
 }
 
-unsigned int nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
+__sum16 nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
                              unsigned int dataoff, u_int8_t protocol)
 {
         struct ipv6hdr *ip6h = skb->nh.ipv6h;
-        unsigned int csum = 0;
+        __sum16 csum = 0;
 
         switch (skb->ip_summed) {
         case CHECKSUM_COMPLETE:
@@ -100,12 +100,13 @@ unsigned int nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
                 }
                 /* fall through */
         case CHECKSUM_NONE:
-                skb->csum = ~csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
+                skb->csum = ~csum_unfold(
+                                csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
                                              skb->len - dataoff,
                                              protocol,
                                              csum_sub(0,
                                                       skb_checksum(skb, 0,
-                                                                   dataoff, 0)));
+                                                                   dataoff, 0))));
                 csum = __skb_checksum_complete(skb);
         }
         return csum;
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index d7c45a9c15fe..fc3e5eb4bc3f 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -6,7 +6,7 @@ menu "IPv6: Netfilter Configuration (EXPERIMENTAL)"
         depends on INET && IPV6 && NETFILTER && EXPERIMENTAL
 
 config NF_CONNTRACK_IPV6
-        tristate "IPv6 support for new connection tracking (EXPERIMENTAL)"
+        tristate "IPv6 connection tracking support (EXPERIMENTAL)"
         depends on EXPERIMENTAL && NF_CONNTRACK
         ---help---
           Connection tracking keeps a record of what packets have passed
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 9fec832ee08b..d4d9f182441a 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -241,7 +241,7 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
         pmsg->data_len        = data_len;
         pmsg->timestamp_sec   = entry->skb->tstamp.off_sec;
         pmsg->timestamp_usec  = entry->skb->tstamp.off_usec;
-        pmsg->mark            = entry->skb->nfmark;
+        pmsg->mark            = entry->skb->mark;
         pmsg->hook            = entry->info->hook;
         pmsg->hw_protocol     = entry->skb->protocol;
         
@@ -620,6 +620,7 @@ static ctl_table ipq_root_table[] = {
         { .ctl_name = 0 }
 };
 
+#ifdef CONFIG_PROC_FS
 static int
 ipq_get_info(char *buffer, char **start, off_t offset, int length)
 {
@@ -653,6 +654,7 @@ ipq_get_info(char *buffer, char **start, off_t offset, int length)
                 len = 0;
         return len;
 }
+#endif /* CONFIG_PROC_FS */
 
 static struct nf_queue_handler nfqh = {
         .name   = "ip6_queue",
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 204e02162d49..f63fb86d7c7b 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1481,7 +1481,8 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
                 if (hp == NULL)
                         return -EBADMSG;
                 if (nexthdr == NEXTHDR_FRAGMENT) {
-                        unsigned short _frag_off, *fp;
+                        unsigned short _frag_off;
+                        __be16 *fp;
                         fp = skb_header_pointer(skb,
                                                 start+offsetof(struct frag_hdr,
                                                                frag_off),
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 0cf537d30185..33b1faa90d74 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -69,9 +69,9 @@ static void dump_packet(const struct nf_loginfo *info,
         /* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */
         printk("LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
                ntohs(ih->payload_len) + sizeof(struct ipv6hdr),
-               (ntohl(*(u_int32_t *)ih) & 0x0ff00000) >> 20,
+               (ntohl(*(__be32 *)ih) & 0x0ff00000) >> 20,
                ih->hop_limit,
-               (ntohl(*(u_int32_t *)ih) & 0x000fffff));
+               (ntohl(*(__be32 *)ih) & 0x000fffff));
 
         fragment = 0;
         ptr = ip6hoff + sizeof(struct ipv6hdr);
@@ -270,11 +270,15 @@ static void dump_packet(const struct nf_loginfo *info,
                 }
                 break;
         }
-        case IPPROTO_UDP: {
+        case IPPROTO_UDP:
+        case IPPROTO_UDPLITE: {
                 struct udphdr _udph, *uh;
 
-                /* Max length: 10 "PROTO=UDP " */
-                printk("PROTO=UDP ");
+                if (currenthdr == IPPROTO_UDP)
+                        /* Max length: 10 "PROTO=UDP "     */
+                        printk("PROTO=UDP " );
+                else    /* Max length: 14 "PROTO=UDPLITE " */
+                        printk("PROTO=UDPLITE ");
 
                 if (fragment)
                         break;
@@ -436,13 +440,8 @@ ip6t_log_target(struct sk_buff **pskb,
         li.u.log.level = loginfo->level;
         li.u.log.logflags = loginfo->logflags;
 
-        if (loginfo->logflags & IP6T_LOG_NFLOG)
-                nf_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
-                              "%s", loginfo->prefix);
-        else
-                ip6t_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
-                                loginfo->prefix);
-
+        ip6t_log_packet(PF_INET6, hooknum, *pskb, in, out, &li,
+                        loginfo->prefix);
         return IP6T_CONTINUE;
 }
 
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 386ea260e767..6250e86a6ddc 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -149,11 +149,10 @@ ip6t_local_hook(unsigned int hook,
                    int (*okfn)(struct sk_buff *))
 {
 
-        unsigned long nfmark;
         unsigned int ret;
         struct in6_addr saddr, daddr;
         u_int8_t hop_limit;
-        u_int32_t flowlabel;
+        u_int32_t flowlabel, mark;
 
 #if 0
         /* root is playing with raw sockets. */
@@ -165,10 +164,10 @@ ip6t_local_hook(unsigned int hook,
         }
 #endif
 
-        /* save source/dest address, nfmark, hoplimit, flowlabel, priority,  */
+        /* save source/dest address, mark, hoplimit, flowlabel, priority,  */
         memcpy(&saddr, &(*pskb)->nh.ipv6h->saddr, sizeof(saddr));
         memcpy(&daddr, &(*pskb)->nh.ipv6h->daddr, sizeof(daddr));
-        nfmark = (*pskb)->nfmark;
+        mark = (*pskb)->mark;
         hop_limit = (*pskb)->nh.ipv6h->hop_limit;
 
         /* flowlabel and prio (includes version, which shouldn't change either */
@@ -179,7 +178,7 @@ ip6t_local_hook(unsigned int hook,
         if (ret != NF_DROP && ret != NF_STOLEN 
                 && (memcmp(&(*pskb)->nh.ipv6h->saddr, &saddr, sizeof(saddr))
                     || memcmp(&(*pskb)->nh.ipv6h->daddr, &daddr, sizeof(daddr))
-                    || (*pskb)->nfmark != nfmark
+                    || (*pskb)->mark != mark
                     || (*pskb)->nh.ipv6h->hop_limit != hop_limit))
                 return ip6_route_me_harder(*pskb) == 0 ? ret : NF_DROP;
 
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index e5e53fff9e38..a20615ffccff 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -33,7 +33,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
-#include <net/netfilter/nf_conntrack_protocol.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
 
@@ -43,8 +43,6 @@
 #define DEBUGP(format, args...)
 #endif
 
-DECLARE_PER_CPU(struct ip_conntrack_stat, nf_conntrack_stat);
-
 static int ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
                              struct nf_conntrack_tuple *tuple)
 {
@@ -211,11 +209,6 @@ out:
         return nf_conntrack_confirm(pskb);
 }
 
-extern struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb);
-extern void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
-                               struct net_device *in,
-                               struct net_device *out,
-                               int (*okfn)(struct sk_buff *));
 static unsigned int ipv6_defrag(unsigned int hooknum,
                                 struct sk_buff **pskb,
                                 const struct net_device *in,
@@ -331,26 +324,7 @@ static struct nf_hook_ops ipv6_conntrack_ops[] = {
 };
 
 #ifdef CONFIG_SYSCTL
-
-/* From nf_conntrack_proto_icmpv6.c */
-extern unsigned int nf_ct_icmpv6_timeout;
-
-/* From nf_conntrack_reasm.c */
-extern unsigned int nf_ct_frag6_timeout;
-extern unsigned int nf_ct_frag6_low_thresh;
-extern unsigned int nf_ct_frag6_high_thresh;
-
-static struct ctl_table_header *nf_ct_ipv6_sysctl_header;
-
-static ctl_table nf_ct_sysctl_table[] = {
-        {
-                .ctl_name       = NET_NF_CONNTRACK_ICMPV6_TIMEOUT,
-                .procname       = "nf_conntrack_icmpv6_timeout",
-                .data           = &nf_ct_icmpv6_timeout,
-                .maxlen         = sizeof(unsigned int),
-                .mode           = 0644,
-                .proc_handler   = &proc_dointvec_jiffies,
-        },
+static ctl_table nf_ct_ipv6_sysctl_table[] = {
         {
                 .ctl_name       = NET_NF_CONNTRACK_FRAG6_TIMEOUT,
                 .procname       = "nf_conntrack_frag6_timeout",
@@ -377,26 +351,6 @@ static ctl_table nf_ct_sysctl_table[] = {
         },
         { .ctl_name = 0 }
 };
-
-static ctl_table nf_ct_netfilter_table[] = {
-        {
-                .ctl_name       = NET_NETFILTER,
-                .procname       = "netfilter",
-                .mode           = 0555,
-                .child          = nf_ct_sysctl_table,
-        },
-        { .ctl_name = 0 }
-};
-
-static ctl_table nf_ct_net_table[] = {
-        {
-                .ctl_name       = CTL_NET,
-                .procname       = "net",
-                .mode           = 0555,
-                .child          = nf_ct_netfilter_table,
-        },
-        { .ctl_name = 0 }
-};
 #endif
 
 #if defined(CONFIG_NF_CT_NETLINK) || \
@@ -454,16 +408,14 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 = {
         .tuple_to_nfattr        = ipv6_tuple_to_nfattr,
         .nfattr_to_tuple        = ipv6_nfattr_to_tuple,
 #endif
+#ifdef CONFIG_SYSCTL
+        .ctl_table_path         = nf_net_netfilter_sysctl_path,
+        .ctl_table              = nf_ct_ipv6_sysctl_table,
+#endif
         .get_features           = ipv6_get_features,
         .me                     = THIS_MODULE,
 };
 
-extern struct nf_conntrack_protocol nf_conntrack_protocol_tcp6;
-extern struct nf_conntrack_protocol nf_conntrack_protocol_udp6;
-extern struct nf_conntrack_protocol nf_conntrack_protocol_icmpv6;
-extern int nf_ct_frag6_init(void);
-extern void nf_ct_frag6_cleanup(void);
-
 MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET6));
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Yasuyuki KOZAKAI @USAGI <yasuyuki.kozakai@toshiba.co.jp>");
@@ -479,19 +431,19 @@ static int __init nf_conntrack_l3proto_ipv6_init(void)
                 printk("nf_conntrack_ipv6: can't initialize frag6.\n");
                 return ret;
         }
-        ret = nf_conntrack_protocol_register(&nf_conntrack_protocol_tcp6);
+        ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_tcp6);
         if (ret < 0) {
                 printk("nf_conntrack_ipv6: can't register tcp.\n");
                 goto cleanup_frag6;
         }
 
-        ret = nf_conntrack_protocol_register(&nf_conntrack_protocol_udp6);
+        ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_udp6);
         if (ret < 0) {
                 printk("nf_conntrack_ipv6: can't register udp.\n");
                 goto cleanup_tcp;
         }
 
-        ret = nf_conntrack_protocol_register(&nf_conntrack_protocol_icmpv6);
+        ret = nf_conntrack_l4proto_register(&nf_conntrack_l4proto_icmpv6);
         if (ret < 0) {
                 printk("nf_conntrack_ipv6: can't register icmpv6.\n");
                 goto cleanup_udp;
@@ -510,28 +462,16 @@ static int __init nf_conntrack_l3proto_ipv6_init(void)
                        "hook.\n");
                 goto cleanup_ipv6;
         }
-#ifdef CONFIG_SYSCTL
-        nf_ct_ipv6_sysctl_header = register_sysctl_table(nf_ct_net_table, 0);
-        if (nf_ct_ipv6_sysctl_header == NULL) {
-                printk("nf_conntrack: can't register to sysctl.\n");
-                ret = -ENOMEM;
-                goto cleanup_hooks;
-        }
-#endif
         return ret;
 
-#ifdef CONFIG_SYSCTL
- cleanup_hooks:
-        nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
-#endif
  cleanup_ipv6:
         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
  cleanup_icmpv6:
-        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_icmpv6);
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
  cleanup_udp:
-        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_udp6);
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp6);
  cleanup_tcp:
-        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_tcp6);
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
  cleanup_frag6:
         nf_ct_frag6_cleanup();
         return ret;
@@ -540,14 +480,11 @@ static int __init nf_conntrack_l3proto_ipv6_init(void)
 static void __exit nf_conntrack_l3proto_ipv6_fini(void)
 {
         synchronize_net();
-#ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(nf_ct_ipv6_sysctl_header);
-#endif
         nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
-        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_icmpv6);
-        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_udp6);
-        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_tcp6);
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_icmpv6);
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_udp6);
+        nf_conntrack_l4proto_unregister(&nf_conntrack_l4proto_tcp6);
         nf_ct_frag6_cleanup();
 }
 
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 34d447208ffd..3905cacc69af 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -29,11 +29,11 @@
 #include <linux/seq_file.h>
 #include <linux/netfilter_ipv6.h>
 #include <net/netfilter/nf_conntrack_tuple.h>
-#include <net/netfilter/nf_conntrack_protocol.h>
+#include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
 
-unsigned long nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
+static unsigned long nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
 
 #if 0
 #define DEBUGP printk
@@ -142,9 +142,6 @@ static int icmpv6_new(struct nf_conn *conntrack,
         return 1;
 }
 
-extern int
-nf_ct_ipv6_skip_exthdr(struct sk_buff *skb, int start, u8 *nexthdrp, int len);
-extern struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6;
 static int
 icmpv6_error_message(struct sk_buff *skb,
                      unsigned int icmp6off,
@@ -155,7 +152,7 @@ icmpv6_error_message(struct sk_buff *skb,
         struct nf_conntrack_tuple_hash *h;
         struct icmp6hdr _hdr, *hp;
         unsigned int inip6off;
-        struct nf_conntrack_protocol *inproto;
+        struct nf_conntrack_l4proto *inproto;
         u_int8_t inprotonum;
         unsigned int inprotoff;
 
@@ -185,7 +182,7 @@ icmpv6_error_message(struct sk_buff *skb,
                 return -NF_ACCEPT;
         }
 
-        inproto = __nf_ct_proto_find(PF_INET6, inprotonum);
+        inproto = __nf_ct_l4proto_find(PF_INET6, inprotonum);
 
         /* Are they talking about one of our connections? */
         if (!nf_ct_get_tuple(skb, inip6off, inprotoff, PF_INET6, inprotonum,
@@ -290,7 +287,7 @@ static int icmpv6_nfattr_to_tuple(struct nfattr *tb[],
         tuple->dst.u.icmp.code =
                         *(u_int8_t *)NFA_DATA(tb[CTA_PROTO_ICMPV6_CODE-1]);
         tuple->src.u.icmp.id =
-                        *(u_int16_t *)NFA_DATA(tb[CTA_PROTO_ICMPV6_ID-1]);
+                        *(__be16 *)NFA_DATA(tb[CTA_PROTO_ICMPV6_ID-1]);
 
         if (tuple->dst.u.icmp.type < 128
             || tuple->dst.u.icmp.type - 128 >= sizeof(invmap)
@@ -301,10 +298,27 @@ static int icmpv6_nfattr_to_tuple(struct nfattr *tb[],
 }
 #endif
 
-struct nf_conntrack_protocol nf_conntrack_protocol_icmpv6 =
+#ifdef CONFIG_SYSCTL
+static struct ctl_table_header *icmpv6_sysctl_header;
+static struct ctl_table icmpv6_sysctl_table[] = {
+        {
+                .ctl_name       = NET_NF_CONNTRACK_ICMPV6_TIMEOUT,
+                .procname       = "nf_conntrack_icmpv6_timeout",
+                .data           = &nf_ct_icmpv6_timeout,
+                .maxlen         = sizeof(unsigned int),
+                .mode           = 0644,
+                .proc_handler   = &proc_dointvec_jiffies,
+        },
+        {
+                .ctl_name       = 0
+        }
+};
+#endif /* CONFIG_SYSCTL */
+
+struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 =
 {
         .l3proto                = PF_INET6,
-        .proto                  = IPPROTO_ICMPV6,
+        .l4proto                = IPPROTO_ICMPV6,
         .name                   = "icmpv6",
         .pkt_to_tuple           = icmpv6_pkt_to_tuple,
         .invert_tuple           = icmpv6_invert_tuple,
@@ -318,6 +332,10 @@ struct nf_conntrack_protocol nf_conntrack_protocol_icmpv6 =
         .tuple_to_nfattr        = icmpv6_tuple_to_nfattr,
         .nfattr_to_tuple        = icmpv6_nfattr_to_tuple,
 #endif
+#ifdef CONFIG_SYSCTL
+        .ctl_table_header       = &icmpv6_sysctl_header,
+        .ctl_table              = icmpv6_sysctl_table,
+#endif
 };
 
-EXPORT_SYMBOL(nf_conntrack_protocol_icmpv6);
+EXPORT_SYMBOL(nf_conntrack_l4proto_icmpv6);
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index bf93c1ea6be9..37e5fca923aa 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -72,7 +72,7 @@ struct nf_ct_frag6_queue
         struct hlist_node       list;
         struct list_head        lru_list;       /* lru list member      */
 
-        __u32                   id;             /* fragment id          */
+        __be32                  id;             /* fragment id          */
         struct in6_addr         saddr;
         struct in6_addr         daddr;
 
@@ -115,28 +115,28 @@ static __inline__ void fq_unlink(struct nf_ct_frag6_queue *fq)
         write_unlock(&nf_ct_frag6_lock);
 }
 
-static unsigned int ip6qhashfn(u32 id, struct in6_addr *saddr,
+static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
                                struct in6_addr *daddr)
 {
         u32 a, b, c;
 
-        a = saddr->s6_addr32[0];
-        b = saddr->s6_addr32[1];
-        c = saddr->s6_addr32[2];
+        a = (__force u32)saddr->s6_addr32[0];
+        b = (__force u32)saddr->s6_addr32[1];
+        c = (__force u32)saddr->s6_addr32[2];
 
         a += JHASH_GOLDEN_RATIO;
         b += JHASH_GOLDEN_RATIO;
         c += nf_ct_frag6_hash_rnd;
         __jhash_mix(a, b, c);
 
-        a += saddr->s6_addr32[3];
-        b += daddr->s6_addr32[0];
-        c += daddr->s6_addr32[1];
+        a += (__force u32)saddr->s6_addr32[3];
+        b += (__force u32)daddr->s6_addr32[0];
+        c += (__force u32)daddr->s6_addr32[1];
         __jhash_mix(a, b, c);
 
-        a += daddr->s6_addr32[2];
-        b += daddr->s6_addr32[3];
-        c += id;
+        a += (__force u32)daddr->s6_addr32[2];
+        b += (__force u32)daddr->s6_addr32[3];
+        c += (__force u32)id;
         __jhash_mix(a, b, c);
 
         return c & (FRAG6Q_HASHSZ - 1);
@@ -338,7 +338,7 @@ static struct nf_ct_frag6_queue *nf_ct_frag6_intern(unsigned int hash,
 
 
 static struct nf_ct_frag6_queue *
-nf_ct_frag6_create(unsigned int hash, u32 id, struct in6_addr *src,                                struct in6_addr *dst)
+nf_ct_frag6_create(unsigned int hash, __be32 id, struct in6_addr *src,                             struct in6_addr *dst)
 {
         struct nf_ct_frag6_queue *fq;
 
@@ -366,7 +366,7 @@ oom:
 }
 
 static __inline__ struct nf_ct_frag6_queue *
-fq_find(u32 id, struct in6_addr *src, struct in6_addr *dst)
+fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
 {
         struct nf_ct_frag6_queue *fq;
         struct hlist_node *n;
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index efee7a6301a8..35249d8487bb 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -49,6 +49,8 @@ static int sockstat6_seq_show(struct seq_file *seq, void *v)
                        fold_prot_inuse(&tcpv6_prot));
         seq_printf(seq, "UDP6: inuse %d\n",
                        fold_prot_inuse(&udpv6_prot));
+        seq_printf(seq, "UDPLITE6: inuse %d\n",
+                        fold_prot_inuse(&udplitev6_prot));
         seq_printf(seq, "RAW6: inuse %d\n",
                        fold_prot_inuse(&rawv6_prot));
         seq_printf(seq, "FRAG6: inuse %d memory %d\n",
@@ -133,6 +135,14 @@ static struct snmp_mib snmp6_udp6_list[] = {
         SNMP_MIB_SENTINEL
 };
 
+static struct snmp_mib snmp6_udplite6_list[] = {
+        SNMP_MIB_ITEM("UdpLite6InDatagrams", UDP_MIB_INDATAGRAMS),
+        SNMP_MIB_ITEM("UdpLite6NoPorts", UDP_MIB_NOPORTS),
+        SNMP_MIB_ITEM("UdpLite6InErrors", UDP_MIB_INERRORS),
+        SNMP_MIB_ITEM("UdpLite6OutDatagrams", UDP_MIB_OUTDATAGRAMS),
+        SNMP_MIB_SENTINEL
+};
+
 static unsigned long
 fold_field(void *mib[], int offt)
 {
@@ -161,11 +171,13 @@ static int snmp6_seq_show(struct seq_file *seq, void *v)
 
         if (idev) {
                 seq_printf(seq, "%-32s\t%u\n", "ifIndex", idev->dev->ifindex);
+                snmp6_seq_show_item(seq, (void **)idev->stats.ipv6, snmp6_ipstats_list);
                 snmp6_seq_show_item(seq, (void **)idev->stats.icmpv6, snmp6_icmp6_list);
         } else {
                 snmp6_seq_show_item(seq, (void **)ipv6_statistics, snmp6_ipstats_list);
                 snmp6_seq_show_item(seq, (void **)icmpv6_statistics, snmp6_icmp6_list);
                 snmp6_seq_show_item(seq, (void **)udp_stats_in6, snmp6_udp6_list);
+                snmp6_seq_show_item(seq, (void **)udplite_stats_in6, snmp6_udplite6_list);
         }
         return 0;
 }
@@ -281,6 +293,9 @@ int snmp6_alloc_dev(struct inet6_dev *idev)
         if (!idev || !idev->dev)
                 return -EINVAL;
 
+        if (snmp6_mib_init((void **)idev->stats.ipv6, sizeof(struct ipstats_mib),
+                           __alignof__(struct ipstats_mib)) < 0)
+                goto err_ip;
         if (snmp6_mib_init((void **)idev->stats.icmpv6, sizeof(struct icmpv6_mib),
                            __alignof__(struct icmpv6_mib)) < 0)
                 goto err_icmp;
@@ -288,12 +303,15 @@ int snmp6_alloc_dev(struct inet6_dev *idev)
         return 0;
 
 err_icmp:
+        snmp6_mib_free((void **)idev->stats.ipv6);
+err_ip:
         return err;
 }
 
 int snmp6_free_dev(struct inet6_dev *idev)
 {
         snmp6_mib_free((void **)idev->stats.icmpv6);
+        snmp6_mib_free((void **)idev->stats.ipv6);
         return 0;
 }
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d6dedc4aec77..c2e629d6aea4 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -220,7 +220,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sockaddr_in6 *addr = (struct sockaddr_in6 *) uaddr;
-        __u32 v4addr = 0;
+        __be32 v4addr = 0;
         int addr_type;
         int err;
 
@@ -290,7 +290,7 @@ out:
 
 void rawv6_err(struct sock *sk, struct sk_buff *skb,
                struct inet6_skb_parm *opt,
-               int type, int code, int offset, u32 info)
+               int type, int code, int offset, __be32 info)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -370,9 +370,9 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
         }
         if (skb->ip_summed != CHECKSUM_UNNECESSARY)
-                skb->csum = ~csum_ipv6_magic(&skb->nh.ipv6h->saddr,
+                skb->csum = ~csum_unfold(csum_ipv6_magic(&skb->nh.ipv6h->saddr,
                                              &skb->nh.ipv6h->daddr,
-                                             skb->len, inet->num, 0);
+                                             skb->len, inet->num, 0));
 
         if (inet->hdrincl) {
                 if (skb_checksum_complete(skb)) {
@@ -479,8 +479,8 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
         int offset;
         int len;
         int total_len;
-        u32 tmp_csum;
-        u16 csum;
+        __wsum tmp_csum;
+        __sum16 csum;
 
         if (!rp->checksum)
                 goto send;
@@ -530,16 +530,15 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
 
         /* in case cksum was not initialized */
         if (unlikely(csum))
-                tmp_csum = csum_sub(tmp_csum, csum);
+                tmp_csum = csum_sub(tmp_csum, csum_unfold(csum));
 
-        tmp_csum = csum_ipv6_magic(&fl->fl6_src,
+        csum = csum_ipv6_magic(&fl->fl6_src,
                                    &fl->fl6_dst,
                                    total_len, fl->proto, tmp_csum);
 
-        if (tmp_csum == 0)
-                tmp_csum = -1;
+        if (csum == 0 && fl->proto == IPPROTO_UDP)
+                csum = CSUM_MANGLED_0;
 
-        csum = tmp_csum;
         if (skb_store_bits(skb, offset, &csum, 2))
                 BUG();
 
@@ -586,7 +585,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
         if (err)
                 goto error_fault;
 
-        IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);         
+        IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
         err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
                       dst_output);
         if (err > 0)
@@ -600,7 +599,7 @@ error_fault:
         err = -EFAULT;
         kfree_skb(skb);
 error:
-        IP6_INC_STATS(IPSTATS_MIB_OUTDISCARDS);
+        IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
         return err; 
 }
 
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index f39bbedd1327..6f9a9046510f 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -47,6 +47,7 @@
 #include <net/snmp.h>
 
 #include <net/ipv6.h>
+#include <net/ip6_route.h>
 #include <net/protocol.h>
 #include <net/transp_v6.h>
 #include <net/rawv6.h>
@@ -76,7 +77,7 @@ struct frag_queue
         struct hlist_node       list;
         struct list_head lru_list;              /* lru list member      */
 
-        __u32                   id;             /* fragment id          */
+        __be32                  id;             /* fragment id          */
         struct in6_addr         saddr;
         struct in6_addr         daddr;
 
@@ -124,28 +125,28 @@ static __inline__ void fq_unlink(struct frag_queue *fq)
  * callers should be careful not to use the hash value outside the ipfrag_lock
  * as doing so could race with ipfrag_hash_rnd being recalculated.
  */
-static unsigned int ip6qhashfn(u32 id, struct in6_addr *saddr,
+static unsigned int ip6qhashfn(__be32 id, struct in6_addr *saddr,
                                struct in6_addr *daddr)
 {
         u32 a, b, c;
 
-        a = saddr->s6_addr32[0];
-        b = saddr->s6_addr32[1];
-        c = saddr->s6_addr32[2];
+        a = (__force u32)saddr->s6_addr32[0];
+        b = (__force u32)saddr->s6_addr32[1];
+        c = (__force u32)saddr->s6_addr32[2];
 
         a += JHASH_GOLDEN_RATIO;
         b += JHASH_GOLDEN_RATIO;
         c += ip6_frag_hash_rnd;
         __jhash_mix(a, b, c);
 
-        a += saddr->s6_addr32[3];
-        b += daddr->s6_addr32[0];
-        c += daddr->s6_addr32[1];
+        a += (__force u32)saddr->s6_addr32[3];
+        b += (__force u32)daddr->s6_addr32[0];
+        c += (__force u32)daddr->s6_addr32[1];
         __jhash_mix(a, b, c);
 
-        a += daddr->s6_addr32[2];
-        b += daddr->s6_addr32[3];
-        c += id;
+        a += (__force u32)daddr->s6_addr32[2];
+        b += (__force u32)daddr->s6_addr32[3];
+        c += (__force u32)id;
         __jhash_mix(a, b, c);
 
         return c & (IP6Q_HASHSZ - 1);
@@ -257,7 +258,7 @@ static __inline__ void fq_kill(struct frag_queue *fq)
         }
 }
 
-static void ip6_evictor(void)
+static void ip6_evictor(struct inet6_dev *idev)
 {
         struct frag_queue *fq;
         struct list_head *tmp;
@@ -284,14 +285,14 @@ static void ip6_evictor(void)
                 spin_unlock(&fq->lock);
 
                 fq_put(fq, &work);
-                IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
+                IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS);
         }
 }
 
 static void ip6_frag_expire(unsigned long data)
 {
         struct frag_queue *fq = (struct frag_queue *) data;
-        struct net_device *dev;
+        struct net_device *dev = NULL;
 
         spin_lock(&fq->lock);
 
@@ -300,17 +301,19 @@ static void ip6_frag_expire(unsigned long data)
 
         fq_kill(fq);
 
-        IP6_INC_STATS_BH(IPSTATS_MIB_REASMTIMEOUT);
-        IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
+        dev = dev_get_by_index(fq->iif);
+        if (!dev)
+                goto out;
+
+        rcu_read_lock();
+        IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
+        IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
+        rcu_read_unlock();
 
         /* Don't send error if the first segment did not arrive. */
         if (!(fq->last_in&FIRST_IN) || !fq->fragments)
                 goto out;
 
-        dev = dev_get_by_index(fq->iif);
-        if (!dev)
-                goto out;
-
         /*
            But use as source device on which LAST ARRIVED
            segment was received. And do not use fq->dev
@@ -318,8 +321,9 @@ static void ip6_frag_expire(unsigned long data)
          */
         fq->fragments->dev = dev;
         icmpv6_send(fq->fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
-        dev_put(dev);
 out:
+        if (dev)
+                dev_put(dev);
         spin_unlock(&fq->lock);
         fq_put(fq, NULL);
 }
@@ -366,7 +370,8 @@ static struct frag_queue *ip6_frag_intern(struct frag_queue *fq_in)
 
 
 static struct frag_queue *
-ip6_frag_create(u32 id, struct in6_addr *src, struct in6_addr *dst)
+ip6_frag_create(__be32 id, struct in6_addr *src, struct in6_addr *dst,
+                struct inet6_dev *idev)
 {
         struct frag_queue *fq;
 
@@ -386,12 +391,13 @@ ip6_frag_create(u32 id, struct in6_addr *src, struct in6_addr *dst)
         return ip6_frag_intern(fq);
 
 oom:
-        IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
+        IP6_INC_STATS_BH(idev, IPSTATS_MIB_REASMFAILS);
         return NULL;
 }
 
 static __inline__ struct frag_queue *
-fq_find(u32 id, struct in6_addr *src, struct in6_addr *dst)
+fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst,
+        struct inet6_dev *idev)
 {
         struct frag_queue *fq;
         struct hlist_node *n;
@@ -410,7 +416,7 @@ fq_find(u32 id, struct in6_addr *src, struct in6_addr *dst)
         }
         read_unlock(&ip6_frag_lock);
 
-        return ip6_frag_create(id, src, dst);
+        return ip6_frag_create(id, src, dst, idev);
 }
 
 
@@ -428,7 +434,8 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                         ((u8 *) (fhdr + 1) - (u8 *) (skb->nh.ipv6h + 1)));
 
         if ((unsigned int)end > IPV6_MAXPLEN) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                 IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb,ICMPV6_HDR_FIELD, (u8*)&fhdr->frag_off - skb->nh.raw);
                 return;
         }
@@ -455,7 +462,8 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                         /* RFC2460 says always send parameter problem in
                          * this case. -DaveM
                          */
-                        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                         IPSTATS_MIB_INHDRERRORS);
                         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, 
                                           offsetof(struct ipv6hdr, payload_len));
                         return;
@@ -571,7 +579,7 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
         return;
 
 err:
-        IP6_INC_STATS(IPSTATS_MIB_REASMFAILS);
+        IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
         kfree_skb(skb);
 }
 
@@ -665,7 +673,9 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
         if (head->ip_summed == CHECKSUM_COMPLETE)
                 head->csum = csum_partial(head->nh.raw, head->h.raw-head->nh.raw, head->csum);
 
-        IP6_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
+        rcu_read_lock();
+        IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
+        rcu_read_unlock();
         fq->fragments = NULL;
         return 1;
 
@@ -677,7 +687,9 @@ out_oom:
         if (net_ratelimit())
                 printk(KERN_DEBUG "ip6_frag_reasm: no memory for reassembly\n");
 out_fail:
-        IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
+        rcu_read_lock();
+        IP6_INC_STATS_BH(__in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
+        rcu_read_unlock();
         return -1;
 }
 
@@ -691,16 +703,16 @@ static int ipv6_frag_rcv(struct sk_buff **skbp)
 
         hdr = skb->nh.ipv6h;
 
-        IP6_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
+        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMREQDS);
 
         /* Jumbo payload inhibits frag. header */
         if (hdr->payload_len==0) {
-                IP6_INC_STATS(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb->h.raw-skb->nh.raw);
                 return -1;
         }
         if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+sizeof(struct frag_hdr))) {
-                IP6_INC_STATS(IPSTATS_MIB_INHDRERRORS);
+                IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, skb->h.raw-skb->nh.raw);
                 return -1;
         }
@@ -711,16 +723,17 @@ static int ipv6_frag_rcv(struct sk_buff **skbp)
         if (!(fhdr->frag_off & htons(0xFFF9))) {
                 /* It is not a fragmented frame */
                 skb->h.raw += sizeof(struct frag_hdr);
-                IP6_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMOKS);
 
                 IP6CB(skb)->nhoff = (u8*)fhdr - skb->nh.raw;
                 return 1;
         }
 
         if (atomic_read(&ip6_frag_mem) > sysctl_ip6frag_high_thresh)
-                ip6_evictor();
+                ip6_evictor(ip6_dst_idev(skb->dst));
 
-        if ((fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr)) != NULL) {
+        if ((fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr,
+                          ip6_dst_idev(skb->dst))) != NULL) {
                 int ret = -1;
 
                 spin_lock(&fq->lock);
@@ -736,7 +749,7 @@ static int ipv6_frag_rcv(struct sk_buff **skbp)
                 return ret;
         }
 
-        IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
+        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_REASMFAILS);
         kfree_skb(skb);
         return -1;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b39ae99122d5..9f80518aacbd 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -440,7 +440,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
         if (pref == ICMPV6_ROUTER_PREF_INVALID)
                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
 
-        lifetime = htonl(rinfo->lifetime);
+        lifetime = ntohl(rinfo->lifetime);
         if (lifetime == 0xffffffff) {
                 /* infinity */
         } else if (lifetime > 0x7fffffff/HZ) {
@@ -711,12 +711,10 @@ void ip6_route_input(struct sk_buff *skb)
                         .ip6_u = {
                                 .daddr = iph->daddr,
                                 .saddr = iph->saddr,
-#ifdef CONFIG_IPV6_ROUTE_FWMARK
-                                .fwmark = skb->nfmark,
-#endif
-                                .flowlabel = (* (u32 *) iph)&IPV6_FLOWINFO_MASK,
+                                .flowlabel = (* (__be32 *) iph)&IPV6_FLOWINFO_MASK,
                         },
                 },
+                .mark = skb->mark,
                 .proto = iph->nexthdr,
         };
 
@@ -942,7 +940,7 @@ struct dst_entry *ndisc_dst_alloc(struct net_device *dev,
         fib6_force_start_gc();
 
 out:
-        return (struct dst_entry *)rt;
+        return &rt->u.dst;
 }
 
 int ndisc_dst_gc(int *more)
@@ -1225,7 +1223,7 @@ out:
         if (idev)
                 in6_dev_put(idev);
         if (rt)
-                dst_free((struct dst_entry *) rt);
+                dst_free(&rt->u.dst);
         return err;
 }
 
@@ -1751,9 +1749,9 @@ static inline int ip6_pkt_drop(struct sk_buff *skb, int code)
 {
         int type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
         if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED)
-                IP6_INC_STATS(IPSTATS_MIB_INADDRERRORS);
+                IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INADDRERRORS);
 
-        IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
+        IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_OUTNOROUTES);
         icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0, skb->dev);
         kfree_skb(skb);
         return 0;
@@ -1824,7 +1822,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
                 rt->rt6i_flags |= RTF_LOCAL;
         rt->rt6i_nexthop = ndisc_get_neigh(rt->rt6i_dev, &rt->rt6i_gateway);
         if (rt->rt6i_nexthop == NULL) {
-                dst_free((struct dst_entry *) rt);
+                dst_free(&rt->u.dst);
                 return ERR_PTR(-ENOMEM);
         }
 
@@ -2008,6 +2006,20 @@ int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         return ip6_route_add(&cfg);
 }
 
+static inline size_t rt6_nlmsg_size(void)
+{
+        return NLMSG_ALIGN(sizeof(struct rtmsg))
+               + nla_total_size(16) /* RTA_SRC */
+               + nla_total_size(16) /* RTA_DST */
+               + nla_total_size(16) /* RTA_GATEWAY */
+               + nla_total_size(16) /* RTA_PREFSRC */
+               + nla_total_size(4) /* RTA_TABLE */
+               + nla_total_size(4) /* RTA_IIF */
+               + nla_total_size(4) /* RTA_OIF */
+               + nla_total_size(4) /* RTA_PRIORITY */
+               + nla_total_size(sizeof(struct rta_cacheinfo));
+}
+
 static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
                          struct in6_addr *dst, struct in6_addr *src,
                          int iif, int type, u32 pid, u32 seq,
@@ -2015,7 +2027,7 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
 {
         struct rtmsg *rtm;
         struct nlmsghdr *nlh;
-        struct rta_cacheinfo ci;
+        long expires;
         u32 table;
 
         if (prefix) {   /* user wants prefix routes only */
@@ -2089,18 +2101,11 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
                 NLA_PUT_U32(skb, RTA_OIF, rt->rt6i_dev->ifindex);
 
         NLA_PUT_U32(skb, RTA_PRIORITY, rt->rt6i_metric);
-        ci.rta_lastuse = jiffies_to_clock_t(jiffies - rt->u.dst.lastuse);
-        if (rt->rt6i_expires)
-                ci.rta_expires = jiffies_to_clock_t(rt->rt6i_expires - jiffies);
-        else
-                ci.rta_expires = 0;
-        ci.rta_used = rt->u.dst.__use;
-        ci.rta_clntref = atomic_read(&rt->u.dst.__refcnt);
-        ci.rta_error = rt->u.dst.error;
-        ci.rta_id = 0;
-        ci.rta_ts = 0;
-        ci.rta_tsage = 0;
-        NLA_PUT(skb, RTA_CACHEINFO, sizeof(ci), &ci);
+
+        expires = rt->rt6i_expires ? rt->rt6i_expires - jiffies : 0;
+        if (rtnl_put_cacheinfo(skb, &rt->u.dst, 0, 0, 0,
+                               expires, rt->u.dst.error) < 0)
+                goto nla_put_failure;
 
         return nlmsg_end(skb, nlh);
 
@@ -2202,7 +2207,6 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
         struct sk_buff *skb;
         u32 pid = 0, seq = 0;
         struct nlmsghdr *nlh = NULL;
-        int payload = sizeof(struct rtmsg) + 256;
         int err = -ENOBUFS;
 
         if (info) {
@@ -2212,15 +2216,13 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
                         seq = nlh->nlmsg_seq;
         }
 
-        skb = nlmsg_new(nlmsg_total_size(payload), gfp_any());
+        skb = nlmsg_new(rt6_nlmsg_size(), gfp_any());
         if (skb == NULL)
                 goto errout;
 
         err = rt6_fill_node(skb, rt, NULL, NULL, 0, event, pid, seq, 0, 0);
-        if (err < 0) {
-                kfree_skb(skb);
-                goto errout;
-        }
+        /* failure implies BUG in rt6_nlmsg_size() */
+        BUG_ON(err < 0);
 
         err = rtnl_notify(skb, pid, RTNLGRP_IPV6_ROUTE, nlh, gfp_any());
 errout:
@@ -2248,7 +2250,6 @@ struct rt6_proc_arg
 static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 {
         struct rt6_proc_arg *arg = (struct rt6_proc_arg *) p_arg;
-        int i;
 
         if (arg->skip < arg->offset / RT6_INFO_LEN) {
                 arg->skip++;
@@ -2258,38 +2259,28 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
         if (arg->len >= arg->length)
                 return 0;
 
-        for (i=0; i<16; i++) {
-                sprintf(arg->buffer + arg->len, "%02x",
-                        rt->rt6i_dst.addr.s6_addr[i]);
-                arg->len += 2;
-        }
-        arg->len += sprintf(arg->buffer + arg->len, " %02x ",
+        arg->len += sprintf(arg->buffer + arg->len,
+                            NIP6_SEQFMT " %02x ",
+                            NIP6(rt->rt6i_dst.addr),
                             rt->rt6i_dst.plen);
 
 #ifdef CONFIG_IPV6_SUBTREES
-        for (i=0; i<16; i++) {
-                sprintf(arg->buffer + arg->len, "%02x",
-                        rt->rt6i_src.addr.s6_addr[i]);
-                arg->len += 2;
-        }
-        arg->len += sprintf(arg->buffer + arg->len, " %02x ",
+        arg->len += sprintf(arg->buffer + arg->len,
+                            NIP6_SEQFMT " %02x ",
+                            NIP6(rt->rt6i_src.addr),
                             rt->rt6i_src.plen);
 #else
-        sprintf(arg->buffer + arg->len,
-                "00000000000000000000000000000000 00 ");
-        arg->len += 36;
+        arg->len += sprintf(arg->buffer + arg->len,
+                            "00000000000000000000000000000000 00 ");
 #endif
 
         if (rt->rt6i_nexthop) {
-                for (i=0; i<16; i++) {
-                        sprintf(arg->buffer + arg->len, "%02x",
-                                rt->rt6i_nexthop->primary_key[i]);
-                        arg->len += 2;
-                }
+                arg->len += sprintf(arg->buffer + arg->len,
+                                    NIP6_SEQFMT,
+                                    NIP6(*((struct in6_addr *)rt->rt6i_nexthop->primary_key)));
         } else {
-                sprintf(arg->buffer + arg->len,
-                        "00000000000000000000000000000000");
-                arg->len += 32;
+                arg->len += sprintf(arg->buffer + arg->len,
+                                    "00000000000000000000000000000000");
         }
         arg->len += sprintf(arg->buffer + arg->len,
                             " %08x %08x %08x %08x %8s\n",
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index be699f85b2c7..77b7b0911438 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -60,7 +60,7 @@
  */
 
 #define HASH_SIZE  16
-#define HASH(addr) ((addr^(addr>>4))&0xF)
+#define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 
 static int ipip6_fb_tunnel_init(struct net_device *dev);
 static int ipip6_tunnel_init(struct net_device *dev);
@@ -76,7 +76,7 @@ static struct ip_tunnel **tunnels[4] = { tunnels_wc, tunnels_l, tunnels_r, tunne
 
 static DEFINE_RWLOCK(ipip6_lock);
 
-static struct ip_tunnel * ipip6_tunnel_lookup(u32 remote, u32 local)
+static struct ip_tunnel * ipip6_tunnel_lookup(__be32 remote, __be32 local)
 {
         unsigned h0 = HASH(remote);
         unsigned h1 = HASH(local);
@@ -102,8 +102,8 @@ static struct ip_tunnel * ipip6_tunnel_lookup(u32 remote, u32 local)
 
 static struct ip_tunnel ** ipip6_bucket(struct ip_tunnel *t)
 {
-        u32 remote = t->parms.iph.daddr;
-        u32 local = t->parms.iph.saddr;
+        __be32 remote = t->parms.iph.daddr;
+        __be32 local = t->parms.iph.saddr;
         unsigned h = 0;
         int prio = 0;
 
@@ -144,8 +144,8 @@ static void ipip6_tunnel_link(struct ip_tunnel *t)
 
 static struct ip_tunnel * ipip6_tunnel_locate(struct ip_tunnel_parm *parms, int create)
 {
-        u32 remote = parms->iph.daddr;
-        u32 local = parms->iph.saddr;
+        __be32 remote = parms->iph.daddr;
+        __be32 local = parms->iph.saddr;
         struct ip_tunnel *t, **tp, *nt;
         struct net_device *dev;
         unsigned h = 0;
@@ -405,9 +405,9 @@ out:
 /* Returns the embedded IPv4 address if the IPv6 address
    comes from 6to4 (RFC 3056) addr space */
 
-static inline u32 try_6to4(struct in6_addr *v6dst)
+static inline __be32 try_6to4(struct in6_addr *v6dst)
 {
-        u32 dst = 0;
+        __be32 dst = 0;
 
         if (v6dst->s6_addr16[0] == htons(0x2002)) {
                 /* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
@@ -432,7 +432,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         struct net_device *tdev;                        /* Device to other host */
         struct iphdr  *iph;                     /* Our new IP header */
         int    max_headroom;                    /* The extra header space needed */
-        u32    dst = tiph->daddr;
+        __be32 dst = tiph->daddr;
         int    mtu;
         struct in6_addr *addr6; 
         int addr_type;
@@ -809,7 +809,7 @@ static void __exit sit_destroy_tunnels(void)
         }
 }
 
-void __exit sit_cleanup(void)
+static void __exit sit_cleanup(void)
 {
         inet_del_protocol(&sit_protocol, IPPROTO_IPV6);
 
@@ -819,7 +819,7 @@ void __exit sit_cleanup(void)
         rtnl_unlock();
 }
 
-int __init sit_init(void)
+static int __init sit_init(void)
 {
         int err;
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4c2a7c0cafef..c25e930c2c69 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -66,10 +66,13 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 
+#include <linux/crypto.h>
+#include <linux/scatterlist.h>
+
 /* Socket used for sending RSTs and ACKs */
 static struct socket *tcp6_socket;
 
-static void     tcp_v6_send_reset(struct sk_buff *skb);
+static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
 static void     tcp_v6_send_check(struct sock *sk, int len, 
                                   struct sk_buff *skb);
@@ -78,6 +81,10 @@ static int	tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
 
 static struct inet_connection_sock_af_ops ipv6_mapped;
 static struct inet_connection_sock_af_ops ipv6_specific;
+#ifdef CONFIG_TCP_MD5SIG
+static struct tcp_sock_af_ops tcp_sock_ipv6_specific;
+static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
+#endif
 
 static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
 {
@@ -98,27 +105,20 @@ static void tcp_v6_hash(struct sock *sk)
         }
 }
 
-static __inline__ u16 tcp_v6_check(struct tcphdr *th, int len,
+static __inline__ __sum16 tcp_v6_check(struct tcphdr *th, int len,
                                    struct in6_addr *saddr, 
                                    struct in6_addr *daddr, 
-                                   unsigned long base)
+                                   __wsum base)
 {
         return csum_ipv6_magic(saddr, daddr, len, IPPROTO_TCP, base);
 }
 
-static __u32 tcp_v6_init_sequence(struct sock *sk, struct sk_buff *skb)
+static __u32 tcp_v6_init_sequence(struct sk_buff *skb)
 {
-        if (skb->protocol == htons(ETH_P_IPV6)) {
-                return secure_tcpv6_sequence_number(skb->nh.ipv6h->daddr.s6_addr32,
-                                                    skb->nh.ipv6h->saddr.s6_addr32,
-                                                    skb->h.th->dest,
-                                                    skb->h.th->source);
-        } else {
-                return secure_tcp_sequence_number(skb->nh.iph->daddr,
-                                                  skb->nh.iph->saddr,
-                                                  skb->h.th->dest,
-                                                  skb->h.th->source);
-        }
+        return secure_tcpv6_sequence_number(skb->nh.ipv6h->daddr.s6_addr32,
+                                            skb->nh.ipv6h->saddr.s6_addr32,
+                                            skb->h.th->dest,
+                                            skb->h.th->source);
 }
 
 static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, 
@@ -215,6 +215,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
                 icsk->icsk_af_ops = &ipv6_mapped;
                 sk->sk_backlog_rcv = tcp_v4_do_rcv;
+#ifdef CONFIG_TCP_MD5SIG
+                tp->af_specific = &tcp_sock_ipv6_mapped_specific;
+#endif
 
                 err = tcp_v4_connect(sk, (struct sockaddr *)&sin, sizeof(sin));
 
@@ -222,6 +225,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                         icsk->icsk_ext_hdr_len = exthdrlen;
                         icsk->icsk_af_ops = &ipv6_specific;
                         sk->sk_backlog_rcv = tcp_v6_do_rcv;
+#ifdef CONFIG_TCP_MD5SIG
+                        tp->af_specific = &tcp_sock_ipv6_specific;
+#endif
                         goto failure;
                 } else {
                         ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
@@ -310,7 +316,7 @@ failure:
 }
 
 static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                int type, int code, int offset, __u32 info)
+                int type, int code, int offset, __be32 info)
 {
         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
         const struct tcphdr *th = (struct tcphdr *)(skb->data+offset);
@@ -509,8 +515,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 
                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
                 err = ip6_xmit(sk, skb, &fl, opt, 0);
-                if (err == NET_XMIT_CN)
-                        err = 0;
+                err = net_xmit_eval(err);
         }
 
 done:
@@ -526,7 +531,396 @@ static void tcp_v6_reqsk_destructor(struct request_sock *req)
                 kfree_skb(inet6_rsk(req)->pktopts);
 }
 
-static struct request_sock_ops tcp6_request_sock_ops = {
+#ifdef CONFIG_TCP_MD5SIG
+static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
+                                                   struct in6_addr *addr)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int i;
+
+        BUG_ON(tp == NULL);
+
+        if (!tp->md5sig_info || !tp->md5sig_info->entries6)
+                return NULL;
+
+        for (i = 0; i < tp->md5sig_info->entries6; i++) {
+                if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, addr) == 0)
+                        return (struct tcp_md5sig_key *)&tp->md5sig_info->keys6[i];
+        }
+        return NULL;
+}
+
+static struct tcp_md5sig_key *tcp_v6_md5_lookup(struct sock *sk,
+                                                struct sock *addr_sk)
+{
+        return tcp_v6_md5_do_lookup(sk, &inet6_sk(addr_sk)->daddr);
+}
+
+static struct tcp_md5sig_key *tcp_v6_reqsk_md5_lookup(struct sock *sk,
+                                                      struct request_sock *req)
+{
+        return tcp_v6_md5_do_lookup(sk, &inet6_rsk(req)->rmt_addr);
+}
+
+static int tcp_v6_md5_do_add(struct sock *sk, struct in6_addr *peer,
+                             char *newkey, u8 newkeylen)
+{
+        /* Add key to the list */
+        struct tcp6_md5sig_key *key;
+        struct tcp_sock *tp = tcp_sk(sk);
+        struct tcp6_md5sig_key *keys;
+
+        key = (struct tcp6_md5sig_key*) tcp_v6_md5_do_lookup(sk, peer);
+        if (key) {
+                /* modify existing entry - just update that one */
+                kfree(key->key);
+                key->key = newkey;
+                key->keylen = newkeylen;
+        } else {
+                /* reallocate new list if current one is full. */
+                if (!tp->md5sig_info) {
+                        tp->md5sig_info = kzalloc(sizeof(*tp->md5sig_info), GFP_ATOMIC);
+                        if (!tp->md5sig_info) {
+                                kfree(newkey);
+                                return -ENOMEM;
+                        }
+                }
+                tcp_alloc_md5sig_pool();
+                if (tp->md5sig_info->alloced6 == tp->md5sig_info->entries6) {
+                        keys = kmalloc((sizeof (tp->md5sig_info->keys6[0]) *
+                                       (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
+
+                        if (!keys) {
+                                tcp_free_md5sig_pool();
+                                kfree(newkey);
+                                return -ENOMEM;
+                        }
+
+                        if (tp->md5sig_info->entries6)
+                                memmove(keys, tp->md5sig_info->keys6,
+                                        (sizeof (tp->md5sig_info->keys6[0]) *
+                                         tp->md5sig_info->entries6));
+
+                        kfree(tp->md5sig_info->keys6);
+                        tp->md5sig_info->keys6 = keys;
+                        tp->md5sig_info->alloced6++;
+                }
+
+                ipv6_addr_copy(&tp->md5sig_info->keys6[tp->md5sig_info->entries6].addr,
+                               peer);
+                tp->md5sig_info->keys6[tp->md5sig_info->entries6].key = newkey;
+                tp->md5sig_info->keys6[tp->md5sig_info->entries6].keylen = newkeylen;
+
+                tp->md5sig_info->entries6++;
+        }
+        return 0;
+}
+
+static int tcp_v6_md5_add_func(struct sock *sk, struct sock *addr_sk,
+                               u8 *newkey, __u8 newkeylen)
+{
+        return tcp_v6_md5_do_add(sk, &inet6_sk(addr_sk)->daddr,
+                                 newkey, newkeylen);
+}
+
+static int tcp_v6_md5_do_del(struct sock *sk, struct in6_addr *peer)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int i;
+
+        for (i = 0; i < tp->md5sig_info->entries6; i++) {
+                if (ipv6_addr_cmp(&tp->md5sig_info->keys6[i].addr, peer) == 0) {
+                        /* Free the key */
+                        kfree(tp->md5sig_info->keys6[i].key);
+                        tp->md5sig_info->entries6--;
+
+                        if (tp->md5sig_info->entries6 == 0) {
+                                kfree(tp->md5sig_info->keys6);
+                                tp->md5sig_info->keys6 = NULL;
+
+                                tcp_free_md5sig_pool();
+
+                                return 0;
+                        } else {
+                                /* shrink the database */
+                                if (tp->md5sig_info->entries6 != i)
+                                        memmove(&tp->md5sig_info->keys6[i],
+                                                &tp->md5sig_info->keys6[i+1],
+                                                (tp->md5sig_info->entries6 - i)
+                                                * sizeof (tp->md5sig_info->keys6[0]));
+                        }
+                }
+        }
+        return -ENOENT;
+}
+
+static void tcp_v6_clear_md5_list (struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int i;
+
+        if (tp->md5sig_info->entries6) {
+                for (i = 0; i < tp->md5sig_info->entries6; i++)
+                        kfree(tp->md5sig_info->keys6[i].key);
+                tp->md5sig_info->entries6 = 0;
+                tcp_free_md5sig_pool();
+        }
+
+        kfree(tp->md5sig_info->keys6);
+        tp->md5sig_info->keys6 = NULL;
+        tp->md5sig_info->alloced6 = 0;
+
+        if (tp->md5sig_info->entries4) {
+                for (i = 0; i < tp->md5sig_info->entries4; i++)
+                        kfree(tp->md5sig_info->keys4[i].key);
+                tp->md5sig_info->entries4 = 0;
+                tcp_free_md5sig_pool();
+        }
+
+        kfree(tp->md5sig_info->keys4);
+        tp->md5sig_info->keys4 = NULL;
+        tp->md5sig_info->alloced4 = 0;
+}
+
+static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
+                                  int optlen)
+{
+        struct tcp_md5sig cmd;
+        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)&cmd.tcpm_addr;
+        u8 *newkey;
+
+        if (optlen < sizeof(cmd))
+                return -EINVAL;
+
+        if (copy_from_user(&cmd, optval, sizeof(cmd)))
+                return -EFAULT;
+
+        if (sin6->sin6_family != AF_INET6)
+                return -EINVAL;
+
+        if (!cmd.tcpm_keylen) {
+                if (!tcp_sk(sk)->md5sig_info)
+                        return -ENOENT;
+                if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_MAPPED)
+                        return tcp_v4_md5_do_del(sk, sin6->sin6_addr.s6_addr32[3]);
+                return tcp_v6_md5_do_del(sk, &sin6->sin6_addr);
+        }
+
+        if (cmd.tcpm_keylen > TCP_MD5SIG_MAXKEYLEN)
+                return -EINVAL;
+
+        if (!tcp_sk(sk)->md5sig_info) {
+                struct tcp_sock *tp = tcp_sk(sk);
+                struct tcp_md5sig_info *p;
+
+                p = kzalloc(sizeof(struct tcp_md5sig_info), GFP_KERNEL);
+                if (!p)
+                        return -ENOMEM;
+
+                tp->md5sig_info = p;
+        }
+
+        newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
+        if (!newkey)
+                return -ENOMEM;
+        if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_MAPPED) {
+                return tcp_v4_md5_do_add(sk, sin6->sin6_addr.s6_addr32[3],
+                                         newkey, cmd.tcpm_keylen);
+        }
+        return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
+}
+
+static int tcp_v6_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
+                                   struct in6_addr *saddr,
+                                   struct in6_addr *daddr,
+                                   struct tcphdr *th, int protocol,
+                                   int tcplen)
+{
+        struct scatterlist sg[4];
+        __u16 data_len;
+        int block = 0;
+        __sum16 cksum;
+        struct tcp_md5sig_pool *hp;
+        struct tcp6_pseudohdr *bp;
+        struct hash_desc *desc;
+        int err;
+        unsigned int nbytes = 0;
+
+        hp = tcp_get_md5sig_pool();
+        if (!hp) {
+                printk(KERN_WARNING "%s(): hash pool not found...\n", __FUNCTION__);
+                goto clear_hash_noput;
+        }
+        bp = &hp->md5_blk.ip6;
+        desc = &hp->md5_desc;
+
+        /* 1. TCP pseudo-header (RFC2460) */
+        ipv6_addr_copy(&bp->saddr, saddr);
+        ipv6_addr_copy(&bp->daddr, daddr);
+        bp->len = htonl(tcplen);
+        bp->protocol = htonl(protocol);
+
+        sg_set_buf(&sg[block++], bp, sizeof(*bp));
+        nbytes += sizeof(*bp);
+
+        /* 2. TCP header, excluding options */
+        cksum = th->check;
+        th->check = 0;
+        sg_set_buf(&sg[block++], th, sizeof(*th));
+        nbytes += sizeof(*th);
+
+        /* 3. TCP segment data (if any) */
+        data_len = tcplen - (th->doff << 2);
+        if (data_len > 0) {
+                u8 *data = (u8 *)th + (th->doff << 2);
+                sg_set_buf(&sg[block++], data, data_len);
+                nbytes += data_len;
+        }
+
+        /* 4. shared key */
+        sg_set_buf(&sg[block++], key->key, key->keylen);
+        nbytes += key->keylen;
+
+        /* Now store the hash into the packet */
+        err = crypto_hash_init(desc);
+        if (err) {
+                printk(KERN_WARNING "%s(): hash_init failed\n", __FUNCTION__);
+                goto clear_hash;
+        }
+        err = crypto_hash_update(desc, sg, nbytes);
+        if (err) {
+                printk(KERN_WARNING "%s(): hash_update failed\n", __FUNCTION__);
+                goto clear_hash;
+        }
+        err = crypto_hash_final(desc, md5_hash);
+        if (err) {
+                printk(KERN_WARNING "%s(): hash_final failed\n", __FUNCTION__);
+                goto clear_hash;
+        }
+
+        /* Reset header, and free up the crypto */
+        tcp_put_md5sig_pool();
+        th->check = cksum;
+out:
+        return 0;
+clear_hash:
+        tcp_put_md5sig_pool();
+clear_hash_noput:
+        memset(md5_hash, 0, 16);
+        goto out;
+}
+
+static int tcp_v6_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
+                                struct sock *sk,
+                                struct dst_entry *dst,
+                                struct request_sock *req,
+                                struct tcphdr *th, int protocol,
+                                int tcplen)
+{
+        struct in6_addr *saddr, *daddr;
+
+        if (sk) {
+                saddr = &inet6_sk(sk)->saddr;
+                daddr = &inet6_sk(sk)->daddr;
+        } else {
+                saddr = &inet6_rsk(req)->loc_addr;
+                daddr = &inet6_rsk(req)->rmt_addr;
+        }
+        return tcp_v6_do_calc_md5_hash(md5_hash, key,
+                                       saddr, daddr,
+                                       th, protocol, tcplen);
+}
+
+static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
+{
+        __u8 *hash_location = NULL;
+        struct tcp_md5sig_key *hash_expected;
+        struct ipv6hdr *ip6h = skb->nh.ipv6h;
+        struct tcphdr *th = skb->h.th;
+        int length = (th->doff << 2) - sizeof (*th);
+        int genhash;
+        u8 *ptr;
+        u8 newhash[16];
+
+        hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
+
+        /* If the TCP option is too short, we can short cut */
+        if (length < TCPOLEN_MD5SIG)
+                return hash_expected ? 1 : 0;
+
+        /* parse options */
+        ptr = (u8*)(th + 1);
+        while (length > 0) {
+                int opcode = *ptr++;
+                int opsize;
+
+                switch(opcode) {
+                case TCPOPT_EOL:
+                        goto done_opts;
+                case TCPOPT_NOP:
+                        length--;
+                        continue;
+                default:
+                        opsize = *ptr++;
+                        if (opsize < 2 || opsize > length)
+                                goto done_opts;
+                        if (opcode == TCPOPT_MD5SIG) {
+                                hash_location = ptr;
+                                goto done_opts;
+                        }
+                }
+                ptr += opsize - 2;
+                length -= opsize;
+        }
+
+done_opts:
+        /* do we have a hash as expected? */
+        if (!hash_expected) {
+                if (!hash_location)
+                        return 0;
+                if (net_ratelimit()) {
+                        printk(KERN_INFO "MD5 Hash NOT expected but found "
+                               "(" NIP6_FMT ", %u)->"
+                               "(" NIP6_FMT ", %u)\n",
+                               NIP6(ip6h->saddr), ntohs(th->source),
+                               NIP6(ip6h->daddr), ntohs(th->dest));
+                }
+                return 1;
+        }
+
+        if (!hash_location) {
+                if (net_ratelimit()) {
+                        printk(KERN_INFO "MD5 Hash expected but NOT found "
+                               "(" NIP6_FMT ", %u)->"
+                               "(" NIP6_FMT ", %u)\n",
+                               NIP6(ip6h->saddr), ntohs(th->source),
+                               NIP6(ip6h->daddr), ntohs(th->dest));
+                }
+                return 1;
+        }
+
+        /* check the signature */
+        genhash = tcp_v6_do_calc_md5_hash(newhash,
+                                          hash_expected,
+                                          &ip6h->saddr, &ip6h->daddr,
+                                          th, sk->sk_protocol,
+                                          skb->len);
+        if (genhash || memcmp(hash_location, newhash, 16) != 0) {
+                if (net_ratelimit()) {
+                        printk(KERN_INFO "MD5 Hash %s for "
+                               "(" NIP6_FMT ", %u)->"
+                               "(" NIP6_FMT ", %u)\n",
+                               genhash ? "failed" : "mismatch",
+                               NIP6(ip6h->saddr), ntohs(th->source),
+                               NIP6(ip6h->daddr), ntohs(th->dest));
+                }
+                return 1;
+        }
+        return 0;
+}
+#endif
+
+static struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
         .family         =       AF_INET6,
         .obj_size       =       sizeof(struct tcp6_request_sock),
         .rtx_syn_ack    =       tcp_v6_send_synack,
@@ -535,9 +929,16 @@ static struct request_sock_ops tcp6_request_sock_ops = {
         .send_reset     =       tcp_v6_send_reset
 };
 
+#ifdef CONFIG_TCP_MD5SIG
+static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
+        .md5_lookup     =       tcp_v6_reqsk_md5_lookup,
+};
+#endif
+
 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
         .twsk_unique    = tcp_twsk_unique,
+        .twsk_destructor= tcp_twsk_destructor,
 };
 
 static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
@@ -547,7 +948,7 @@ static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
-                skb->csum = offsetof(struct tcphdr, check);
+                skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP, 
                                             csum_partial((char *)th, th->doff<<2, 
@@ -569,16 +970,20 @@ static int tcp_v6_gso_send_check(struct sk_buff *skb)
         th->check = 0;
         th->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
                                      IPPROTO_TCP, 0);
-        skb->csum = offsetof(struct tcphdr, check);
+        skb->csum_offset = offsetof(struct tcphdr, check);
         skb->ip_summed = CHECKSUM_PARTIAL;
         return 0;
 }
 
-static void tcp_v6_send_reset(struct sk_buff *skb)
+static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 {
         struct tcphdr *th = skb->h.th, *t1; 
         struct sk_buff *buff;
         struct flowi fl;
+        int tot_len = sizeof(*th);
+#ifdef CONFIG_TCP_MD5SIG
+        struct tcp_md5sig_key *key;
+#endif
 
         if (th->rst)
                 return;
@@ -586,25 +991,35 @@ static void tcp_v6_send_reset(struct sk_buff *skb)
         if (!ipv6_unicast_destination(skb))
                 return; 
 
+#ifdef CONFIG_TCP_MD5SIG
+        if (sk)
+                key = tcp_v6_md5_do_lookup(sk, &skb->nh.ipv6h->daddr);
+        else
+                key = NULL;
+
+        if (key)
+                tot_len += TCPOLEN_MD5SIG_ALIGNED;
+#endif
+
         /*
          * We need to grab some memory, and put together an RST,
          * and then put it into the queue to be sent.
          */
 
-        buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + sizeof(struct tcphdr),
+        buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
                          GFP_ATOMIC);
         if (buff == NULL) 
                 return;
 
-        skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + sizeof(struct tcphdr));
+        skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 
-        t1 = (struct tcphdr *) skb_push(buff,sizeof(struct tcphdr));
+        t1 = (struct tcphdr *) skb_push(buff, tot_len);
 
         /* Swap the send and the receive. */
         memset(t1, 0, sizeof(*t1));
         t1->dest = th->source;
         t1->source = th->dest;
-        t1->doff = sizeof(*t1)/4;
+        t1->doff = tot_len / 4;
         t1->rst = 1;
   
         if(th->ack) {
@@ -615,6 +1030,22 @@ static void tcp_v6_send_reset(struct sk_buff *skb)
                                     + skb->len - (th->doff<<2));
         }
 
+#ifdef CONFIG_TCP_MD5SIG
+        if (key) {
+                __be32 *opt = (__be32*)(t1 + 1);
+                opt[0] = htonl((TCPOPT_NOP << 24) |
+                               (TCPOPT_NOP << 16) |
+                               (TCPOPT_MD5SIG << 8) |
+                               TCPOLEN_MD5SIG);
+                tcp_v6_do_calc_md5_hash((__u8*)&opt[1],
+                                        key,
+                                        &skb->nh.ipv6h->daddr,
+                                        &skb->nh.ipv6h->saddr,
+                                        t1, IPPROTO_TCP,
+                                        tot_len);
+        }
+#endif
+
         buff->csum = csum_partial((char *)t1, sizeof(*t1), 0);
 
         memset(&fl, 0, sizeof(fl));
@@ -645,15 +1076,37 @@ static void tcp_v6_send_reset(struct sk_buff *skb)
         kfree_skb(buff);
 }
 
-static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
+static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
+                            struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
 {
         struct tcphdr *th = skb->h.th, *t1;
         struct sk_buff *buff;
         struct flowi fl;
         int tot_len = sizeof(struct tcphdr);
+        __be32 *topt;
+#ifdef CONFIG_TCP_MD5SIG
+        struct tcp_md5sig_key *key;
+        struct tcp_md5sig_key tw_key;
+#endif
+
+#ifdef CONFIG_TCP_MD5SIG
+        if (!tw && skb->sk) {
+                key = tcp_v6_md5_do_lookup(skb->sk, &skb->nh.ipv6h->daddr);
+        } else if (tw && tw->tw_md5_keylen) {
+                tw_key.key = tw->tw_md5_key;
+                tw_key.keylen = tw->tw_md5_keylen;
+                key = &tw_key;
+        } else {
+                key = NULL;
+        }
+#endif
 
         if (ts)
                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
+#ifdef CONFIG_TCP_MD5SIG
+        if (key)
+                tot_len += TCPOLEN_MD5SIG_ALIGNED;
+#endif
 
         buff = alloc_skb(MAX_HEADER + sizeof(struct ipv6hdr) + tot_len,
                          GFP_ATOMIC);
@@ -673,15 +1126,29 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
         t1->ack_seq = htonl(ack);
         t1->ack = 1;
         t1->window = htons(win);
+
+        topt = (__be32 *)(t1 + 1);
         
         if (ts) {
-                u32 *ptr = (u32*)(t1 + 1);
-                *ptr++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
-                               (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
-                *ptr++ = htonl(tcp_time_stamp);
-                *ptr = htonl(ts);
+                *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
+                                (TCPOPT_TIMESTAMP << 8) | TCPOLEN_TIMESTAMP);
+                *topt++ = htonl(tcp_time_stamp);
+                *topt = htonl(ts);
         }
 
+#ifdef CONFIG_TCP_MD5SIG
+        if (key) {
+                *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
+                                (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
+                tcp_v6_do_calc_md5_hash((__u8 *)topt,
+                                        key,
+                                        &skb->nh.ipv6h->daddr,
+                                        &skb->nh.ipv6h->saddr,
+                                        t1, IPPROTO_TCP,
+                                        tot_len);
+        }
+#endif
+
         buff->csum = csum_partial((char *)t1, tot_len, 0);
 
         memset(&fl, 0, sizeof(fl));
@@ -712,9 +1179,9 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
 static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 {
         struct inet_timewait_sock *tw = inet_twsk(sk);
-        const struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
+        struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 
-        tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
+        tcp_v6_send_ack(tcptw, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
                         tcptw->tw_ts_recent);
 
@@ -723,7 +1190,7 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 
 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
 {
-        tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
+        tcp_v6_send_ack(NULL, skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
 }
 
 
@@ -794,6 +1261,10 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         if (req == NULL)
                 goto drop;
 
+#ifdef CONFIG_TCP_MD5SIG
+        tcp_rsk(req)->af_specific = &tcp_request_sock_ipv6_ops;
+#endif
+
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
         tmp_opt.user_mss = tp->rx_opt.user_mss;
@@ -822,7 +1293,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 treq->iif = inet6_iif(skb);
 
         if (isn == 0) 
-                isn = tcp_v6_init_sequence(sk,skb);
+                isn = tcp_v6_init_sequence(skb);
 
         tcp_rsk(req)->snt_isn = isn;
 
@@ -852,6 +1323,9 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         struct tcp_sock *newtp;
         struct sock *newsk;
         struct ipv6_txoptions *opt;
+#ifdef CONFIG_TCP_MD5SIG
+        struct tcp_md5sig_key *key;
+#endif
 
         if (skb->protocol == htons(ETH_P_IP)) {
                 /*
@@ -882,6 +1356,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
                 inet_csk(newsk)->icsk_af_ops = &ipv6_mapped;
                 newsk->sk_backlog_rcv = tcp_v4_do_rcv;
+#ifdef CONFIG_TCP_MD5SIG
+                newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
+#endif
+
                 newnp->pktoptions  = NULL;
                 newnp->opt         = NULL;
                 newnp->mcast_oif   = inet6_iif(skb);
@@ -1016,6 +1494,21 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
 
+#ifdef CONFIG_TCP_MD5SIG
+        /* Copy over the MD5 key from the original socket */
+        if ((key = tcp_v6_md5_do_lookup(sk, &newnp->daddr)) != NULL) {
+                /* We're using one, so create a matching key
+                 * on the newsk structure. If we fail to get
+                 * memory, then we end up not copying the key
+                 * across. Shucks.
+                 */
+                char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
+                if (newkey != NULL)
+                        tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr,
+                                          newkey, key->keylen);
+        }
+#endif
+
         __inet6_hash(&tcp_hashinfo, newsk);
         inet_inherit_port(&tcp_hashinfo, sk, newsk);
 
@@ -1031,7 +1524,7 @@ out:
         return NULL;
 }
 
-static int tcp_v6_checksum_init(struct sk_buff *skb)
+static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
 {
         if (skb->ip_summed == CHECKSUM_COMPLETE) {
                 if (!tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
@@ -1041,8 +1534,8 @@ static int tcp_v6_checksum_init(struct sk_buff *skb)
                 }
         }
 
-        skb->csum = ~tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
-                                  &skb->nh.ipv6h->daddr, 0);
+        skb->csum = ~csum_unfold(tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
+                                  &skb->nh.ipv6h->daddr, 0));
 
         if (skb->len <= 76) {
                 return __skb_checksum_complete(skb);
@@ -1075,6 +1568,11 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
         if (skb->protocol == htons(ETH_P_IP))
                 return tcp_v4_do_rcv(sk, skb);
 
+#ifdef CONFIG_TCP_MD5SIG
+        if (tcp_v6_inbound_md5_hash (sk, skb))
+                goto discard;
+#endif
+
         if (sk_filter(sk, skb))
                 goto discard;
 
@@ -1140,7 +1638,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
         return 0;
 
 reset:
-        tcp_v6_send_reset(skb);
+        tcp_v6_send_reset(sk, skb);
 discard:
         if (opt_skb)
                 __kfree_skb(opt_skb);
@@ -1265,7 +1763,7 @@ no_tcp_socket:
 bad_packet:
                 TCP_INC_STATS_BH(TCP_MIB_INERRS);
         } else {
-                tcp_v6_send_reset(skb);
+                tcp_v6_send_reset(NULL, skb);
         }
 
 discard_it:
@@ -1344,6 +1842,15 @@ static struct inet_connection_sock_af_ops ipv6_specific = {
 #endif
 };
 
+#ifdef CONFIG_TCP_MD5SIG
+static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
+        .md5_lookup     =       tcp_v6_md5_lookup,
+        .calc_md5_hash  =       tcp_v6_calc_md5_hash,
+        .md5_add        =       tcp_v6_md5_add_func,
+        .md5_parse      =       tcp_v6_parse_md5_keys,
+};
+#endif
+
 /*
  *      TCP over IPv4 via INET6 API
  */
@@ -1366,6 +1873,15 @@ static struct inet_connection_sock_af_ops ipv6_mapped = {
 #endif
 };
 
+#ifdef CONFIG_TCP_MD5SIG
+static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
+        .md5_lookup     =       tcp_v4_md5_lookup,
+        .calc_md5_hash  =       tcp_v4_calc_md5_hash,
+        .md5_add        =       tcp_v6_md5_add_func,
+        .md5_parse      =       tcp_v6_parse_md5_keys,
+};
+#endif
+
 /* NOTE: A lot of things set to zero explicitly by call to
  *       sk_alloc() so need not be done here.
  */
@@ -1405,6 +1921,10 @@ static int tcp_v6_init_sock(struct sock *sk)
         sk->sk_write_space = sk_stream_write_space;
         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
 
+#ifdef CONFIG_TCP_MD5SIG
+        tp->af_specific = &tcp_sock_ipv6_specific;
+#endif
+
         sk->sk_sndbuf = sysctl_tcp_wmem[1];
         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
 
@@ -1415,6 +1935,11 @@ static int tcp_v6_init_sock(struct sock *sk)
 
 static int tcp_v6_destroy_sock(struct sock *sk)
 {
+#ifdef CONFIG_TCP_MD5SIG
+        /* Clean up the MD5 key list */
+        if (tcp_sk(sk)->md5sig_info)
+                tcp_v6_clear_md5_list(sk);
+#endif
         tcp_v4_destroy_sock(sk);
         return inet6_destroy_sock(sk);
 }
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 0ef9a35798d1..918d07dd1219 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -104,7 +104,7 @@ drop:
 }
 
 static void tunnel6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                        int type, int code, int offset, __u32 info)
+                        int type, int code, int offset, __be32 info)
 {
         struct xfrm6_tunnel *handler;
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index c83f23e51c46..f52a5c3cc0a3 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -38,26 +38,18 @@
 #include <linux/skbuff.h>
 #include <asm/uaccess.h>
 
-#include <net/sock.h>
-#include <net/snmp.h>
-
-#include <net/ipv6.h>
 #include <net/ndisc.h>
 #include <net/protocol.h>
 #include <net/transp_v6.h>
 #include <net/ip6_route.h>
-#include <net/addrconf.h>
-#include <net/ip.h>
-#include <net/udp.h>
 #include <net/raw.h>
-#include <net/inet_common.h>
 #include <net/tcp_states.h>
-
 #include <net/ip6_checksum.h>
 #include <net/xfrm.h>
 
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include "udp_impl.h"
 
 DEFINE_SNMP_STAT(struct udp_mib, udp_stats_in6) __read_mostly;
 
@@ -66,23 +58,9 @@ static inline int udp_v6_get_port(struct sock *sk, unsigned short snum)
         return udp_get_port(sk, snum, ipv6_rcv_saddr_equal);
 }
 
-static void udp_v6_hash(struct sock *sk)
-{
-        BUG();
-}
-
-static void udp_v6_unhash(struct sock *sk)
-{
-        write_lock_bh(&udp_hash_lock);
-        if (sk_del_node_init(sk)) {
-                inet_sk(sk)->num = 0;
-                sock_prot_dec_use(sk->sk_prot);
-        }
-        write_unlock_bh(&udp_hash_lock);
-}
-
-static struct sock *udp_v6_lookup(struct in6_addr *saddr, u16 sport,
-                                  struct in6_addr *daddr, u16 dport, int dif)
+static struct sock *__udp6_lib_lookup(struct in6_addr *saddr, __be16 sport,
+                                      struct in6_addr *daddr, __be16 dport,
+                                      int dif, struct hlist_head udptable[])
 {
         struct sock *sk, *result = NULL;
         struct hlist_node *node;
@@ -90,7 +68,7 @@ static struct sock *udp_v6_lookup(struct in6_addr *saddr, u16 sport,
         int badness = -1;
 
         read_lock(&udp_hash_lock);
-        sk_for_each(sk, node, &udp_hash[hnum & (UDP_HTABLE_SIZE - 1)]) {
+        sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {
                 struct inet_sock *inet = inet_sk(sk);
 
                 if (inet->num == hnum && sk->sk_family == PF_INET6) {
@@ -132,20 +110,11 @@ static struct sock *udp_v6_lookup(struct in6_addr *saddr, u16 sport,
 }
 
 /*
- *
- */
-
-static void udpv6_close(struct sock *sk, long timeout)
-{
-        sk_common_release(sk);
-}
-
-/*
  *      This should be easy, if there is something there we
  *      return it, otherwise we block.
  */
 
-static int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk, 
+int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                   struct msghdr *msg, size_t len,
                   int noblock, int flags, int *addr_len)
 {
@@ -153,7 +122,7 @@ static int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         struct inet_sock *inet = inet_sk(sk);
         struct sk_buff *skb;
         size_t copied;
-        int err;
+        int err, copy_only, is_udplite = IS_UDPLITE(sk);
 
         if (addr_len)
                 *addr_len=sizeof(struct sockaddr_in6);
@@ -172,15 +141,21 @@ try_again:
                 msg->msg_flags |= MSG_TRUNC;
         }
 
-        if (skb->ip_summed==CHECKSUM_UNNECESSARY) {
-                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov,
-                                              copied);
-        } else if (msg->msg_flags&MSG_TRUNC) {
-                if (__skb_checksum_complete(skb))
+        /*
+         *      Decide whether to checksum and/or copy data.
+         */
+        copy_only = (skb->ip_summed==CHECKSUM_UNNECESSARY);
+
+        if (is_udplite  ||  (!copy_only  &&  msg->msg_flags&MSG_TRUNC)) {
+                if (__udp_lib_checksum_complete(skb))
                         goto csum_copy_err;
-                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov,
-                                              copied);
-        } else {
+                copy_only = 1;
+        }
+
+        if (copy_only)
+                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
+                                              msg->msg_iov, copied       );
+        else {
                 err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
                 if (err == -EINVAL)
                         goto csum_copy_err;
@@ -231,14 +206,15 @@ csum_copy_err:
         skb_kill_datagram(sk, skb, flags);
 
         if (flags & MSG_DONTWAIT) {
-                UDP6_INC_STATS_USER(UDP_MIB_INERRORS);
+                UDP6_INC_STATS_USER(UDP_MIB_INERRORS, is_udplite);
                 return -EAGAIN;
         }
         goto try_again;
 }
 
-static void udpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-               int type, int code, int offset, __u32 info)
+void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+                    int type, int code, int offset, __be32 info,
+                    struct hlist_head udptable[]                    )
 {
         struct ipv6_pinfo *np;
         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
@@ -248,8 +224,8 @@ static void udpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct sock *sk;
         int err;
 
-        sk = udp_v6_lookup(daddr, uh->dest, saddr, uh->source, inet6_iif(skb));
-   
+        sk = __udp6_lib_lookup(daddr, uh->dest,
+                               saddr, uh->source, inet6_iif(skb), udptable);
         if (sk == NULL)
                 return;
 
@@ -270,36 +246,60 @@ out:
         sock_put(sk);
 }
 
-static inline int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+static __inline__ void udpv6_err(struct sk_buff *skb,
+                                 struct inet6_skb_parm *opt, int type,
+                                 int code, int offset, __be32 info     )
+{
+        return __udp6_lib_err(skb, opt, type, code, offset, info, udp_hash);
+}
+
+int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
 {
+        struct udp_sock *up = udp_sk(sk);
         int rc;
 
-        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
-                kfree_skb(skb);
-                return -1;
-        }
+        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
+                goto drop;
 
-        if (skb_checksum_complete(skb)) {
-                UDP6_INC_STATS_BH(UDP_MIB_INERRORS);
-                kfree_skb(skb);
-                return 0;
+        /*
+         * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c).
+         */
+        if ((up->pcflag & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
+
+                if (up->pcrlen == 0) {          /* full coverage was set  */
+                        LIMIT_NETDEBUG(KERN_WARNING "UDPLITE6: partial coverage"
+                                " %d while full coverage %d requested\n",
+                                UDP_SKB_CB(skb)->cscov, skb->len);
+                        goto drop;
+                }
+                if (UDP_SKB_CB(skb)->cscov  <  up->pcrlen) {
+                        LIMIT_NETDEBUG(KERN_WARNING "UDPLITE6: coverage %d "
+                                                    "too small, need min %d\n",
+                                       UDP_SKB_CB(skb)->cscov, up->pcrlen);
+                        goto drop;
+                }
         }
 
+        if (udp_lib_checksum_complete(skb))
+                goto drop;
+
         if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
                 if (rc == -ENOMEM)
-                        UDP6_INC_STATS_BH(UDP_MIB_RCVBUFERRORS);
-                UDP6_INC_STATS_BH(UDP_MIB_INERRORS);
-                kfree_skb(skb);
-                return 0;
+                        UDP6_INC_STATS_BH(UDP_MIB_RCVBUFERRORS, up->pcflag);
+                goto drop;
         }
-        UDP6_INC_STATS_BH(UDP_MIB_INDATAGRAMS);
+        UDP6_INC_STATS_BH(UDP_MIB_INDATAGRAMS, up->pcflag);
         return 0;
+drop:
+        UDP6_INC_STATS_BH(UDP_MIB_INERRORS, up->pcflag);
+        kfree_skb(skb);
+        return -1;
 }
 
 static struct sock *udp_v6_mcast_next(struct sock *sk,
-                                      u16 loc_port, struct in6_addr *loc_addr,
-                                      u16 rmt_port, struct in6_addr *rmt_addr,
+                                      __be16 loc_port, struct in6_addr *loc_addr,
+                                      __be16 rmt_port, struct in6_addr *rmt_addr,
                                       int dif)
 {
         struct hlist_node *node;
@@ -338,15 +338,15 @@ static struct sock *udp_v6_mcast_next(struct sock *sk,
  * Note: called only from the BH handler context,
  * so we don't need to lock the hashes.
  */
-static void udpv6_mcast_deliver(struct udphdr *uh,
-                                struct in6_addr *saddr, struct in6_addr *daddr,
-                                struct sk_buff *skb)
+static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr,
+                           struct in6_addr *daddr, struct hlist_head udptable[])
 {
         struct sock *sk, *sk2;
+        const struct udphdr *uh = skb->h.uh;
         int dif;
 
         read_lock(&udp_hash_lock);
-        sk = sk_head(&udp_hash[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
+        sk = sk_head(&udptable[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
         dif = inet6_iif(skb);
         sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
         if (!sk) {
@@ -364,9 +364,35 @@ static void udpv6_mcast_deliver(struct udphdr *uh,
         udpv6_queue_rcv_skb(sk, skb);
 out:
         read_unlock(&udp_hash_lock);
+        return 0;
+}
+
+static inline int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh)
+
+{
+        if (uh->check == 0) {
+                /* RFC 2460 section 8.1 says that we SHOULD log
+                   this error. Well, it is reasonable.
+                 */
+                LIMIT_NETDEBUG(KERN_INFO "IPv6: udp checksum is 0\n");
+                return 1;
+        }
+        if (skb->ip_summed == CHECKSUM_COMPLETE &&
+            !csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
+                             skb->len, IPPROTO_UDP, skb->csum             ))
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+        if (skb->ip_summed != CHECKSUM_UNNECESSARY)
+                skb->csum = ~csum_unfold(csum_ipv6_magic(&skb->nh.ipv6h->saddr,
+                                                         &skb->nh.ipv6h->daddr,
+                                                         skb->len, IPPROTO_UDP,
+                                                         0));
+
+        return (UDP_SKB_CB(skb)->partial_cov = 0);
 }
 
-static int udpv6_rcv(struct sk_buff **pskb)
+int __udp6_lib_rcv(struct sk_buff **pskb, struct hlist_head udptable[],
+                   int is_udplite)
 {
         struct sk_buff *skb = *pskb;
         struct sock *sk;
@@ -383,44 +409,39 @@ static int udpv6_rcv(struct sk_buff **pskb)
         uh = skb->h.uh;
 
         ulen = ntohs(uh->len);
+        if (ulen > skb->len)
+                goto short_packet;
 
-        /* Check for jumbo payload */
-        if (ulen == 0)
-                ulen = skb->len;
+        if(! is_udplite ) {             /* UDP validates ulen. */
 
-        if (ulen > skb->len || ulen < sizeof(*uh))
-                goto short_packet;
+                /* Check for jumbo payload */
+                if (ulen == 0)
+                        ulen = skb->len;
 
-        if (uh->check == 0) {
-                /* RFC 2460 section 8.1 says that we SHOULD log
-                   this error. Well, it is reasonable.
-                 */
-                LIMIT_NETDEBUG(KERN_INFO "IPv6: udp checksum is 0\n");
-                goto discard;
-        }
+                if (ulen < sizeof(*uh))
+                        goto short_packet;
 
-        if (ulen < skb->len) {
-                if (pskb_trim_rcsum(skb, ulen))
-                        goto discard;
-                saddr = &skb->nh.ipv6h->saddr;
-                daddr = &skb->nh.ipv6h->daddr;
-                uh = skb->h.uh;
-        }
+                if (ulen < skb->len) {
+                        if (pskb_trim_rcsum(skb, ulen))
+                                goto short_packet;
+                        saddr = &skb->nh.ipv6h->saddr;
+                        daddr = &skb->nh.ipv6h->daddr;
+                        uh = skb->h.uh;
+                }
 
-        if (skb->ip_summed == CHECKSUM_COMPLETE &&
-            !csum_ipv6_magic(saddr, daddr, ulen, IPPROTO_UDP, skb->csum))
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                if (udp6_csum_init(skb, uh))
+                        goto discard;
 
-        if (skb->ip_summed != CHECKSUM_UNNECESSARY)
-                skb->csum = ~csum_ipv6_magic(saddr, daddr, ulen, IPPROTO_UDP, 0);
+        } else  {                       /* UDP-Lite validates cscov. */
+                if (udplite6_csum_init(skb, uh))
+                        goto discard;
+        }
 
         /* 
          *      Multicast receive code 
          */
-        if (ipv6_addr_is_multicast(daddr)) {
-                udpv6_mcast_deliver(uh, saddr, daddr, skb);
-                return 0;
-        }
+        if (ipv6_addr_is_multicast(daddr))
+                return __udp6_lib_mcast_deliver(skb, saddr, daddr, udptable);
 
         /* Unicast */
 
@@ -428,15 +449,16 @@ static int udpv6_rcv(struct sk_buff **pskb)
          * check socket cache ... must talk to Alan about his plans
          * for sock caches... i'll skip this for now.
          */
-        sk = udp_v6_lookup(saddr, uh->source, daddr, uh->dest, inet6_iif(skb));
+        sk = __udp6_lib_lookup(saddr, uh->source,
+                               daddr, uh->dest, inet6_iif(skb), udptable);
 
         if (sk == NULL) {
                 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
                         goto discard;
 
-                if (skb_checksum_complete(skb))
+                if (udp_lib_checksum_complete(skb))
                         goto discard;
-                UDP6_INC_STATS_BH(UDP_MIB_NOPORTS);
+                UDP6_INC_STATS_BH(UDP_MIB_NOPORTS, is_udplite);
 
                 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
 
@@ -451,14 +473,20 @@ static int udpv6_rcv(struct sk_buff **pskb)
         return(0);
 
 short_packet:   
-        if (net_ratelimit())
-                printk(KERN_DEBUG "UDP: short packet: %d/%u\n", ulen, skb->len);
+        LIMIT_NETDEBUG(KERN_DEBUG "UDP%sv6: short packet: %d/%u\n",
+                       is_udplite? "-Lite" : "",  ulen, skb->len);
 
 discard:
-        UDP6_INC_STATS_BH(UDP_MIB_INERRORS);
+        UDP6_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
         kfree_skb(skb);
         return(0);      
 }
+
+static __inline__ int udpv6_rcv(struct sk_buff **pskb)
+{
+        return __udp6_lib_rcv(pskb, udp_hash, 0);
+}
+
 /*
  * Throw away all pending data and cancel the corking. Socket is locked.
  */
@@ -477,13 +505,15 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
  *      Sending
  */
 
-static int udp_v6_push_pending_frames(struct sock *sk, struct udp_sock *up)
+static int udp_v6_push_pending_frames(struct sock *sk)
 {
         struct sk_buff *skb;
         struct udphdr *uh;
+        struct udp_sock  *up = udp_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
         struct flowi *fl = &inet->cork.fl;
         int err = 0;
+        __wsum csum = 0;
 
         /* Grab the skbuff where UDP header space exists. */
         if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
@@ -498,35 +528,17 @@ static int udp_v6_push_pending_frames(struct sock *sk, struct udp_sock *up)
         uh->len = htons(up->len);
         uh->check = 0;
 
-        if (sk->sk_no_check == UDP_CSUM_NOXMIT) {
-                skb->ip_summed = CHECKSUM_NONE;
-                goto send;
-        }
-
-        if (skb_queue_len(&sk->sk_write_queue) == 1) {
-                skb->csum = csum_partial((char *)uh,
-                                sizeof(struct udphdr), skb->csum);
-                uh->check = csum_ipv6_magic(&fl->fl6_src,
-                                            &fl->fl6_dst,
-                                            up->len, fl->proto, skb->csum);
-        } else {
-                u32 tmp_csum = 0;
-
-                skb_queue_walk(&sk->sk_write_queue, skb) {
-                        tmp_csum = csum_add(tmp_csum, skb->csum);
-                }
-                tmp_csum = csum_partial((char *)uh,
-                                sizeof(struct udphdr), tmp_csum);
-                tmp_csum = csum_ipv6_magic(&fl->fl6_src,
-                                           &fl->fl6_dst,
-                                           up->len, fl->proto, tmp_csum);
-                uh->check = tmp_csum;
+        if (up->pcflag)
+                csum = udplite_csum_outgoing(sk, skb);
+         else
+                csum = udp_csum_outgoing(sk, skb);
 
-        }
+        /* add protocol-dependent pseudo-header */
+        uh->check = csum_ipv6_magic(&fl->fl6_src, &fl->fl6_dst,
+                                    up->len, fl->proto, csum   );
         if (uh->check == 0)
-                uh->check = -1;
+                uh->check = CSUM_MANGLED_0;
 
-send:
         err = ip6_push_pending_frames(sk);
 out:
         up->len = 0;
@@ -534,7 +546,7 @@ out:
         return err;
 }
 
-static int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk, 
+int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                   struct msghdr *msg, size_t len)
 {
         struct ipv6_txoptions opt_space;
@@ -554,6 +566,8 @@ static int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
         int err;
         int connected = 0;
+        int is_udplite = up->pcflag;
+        int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
 
         /* destination address check */
         if (sin6) {
@@ -694,7 +708,7 @@ do_udp_sendmsg:
                 opt = fl6_merge_options(&opt_space, flowlabel, opt);
         opt = ipv6_fixup_options(&opt_space, opt);
 
-        fl.proto = IPPROTO_UDP;
+        fl.proto = sk->sk_protocol;
         ipv6_addr_copy(&fl.fl6_dst, daddr);
         if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
                 ipv6_addr_copy(&fl.fl6_src, &np->saddr);
@@ -761,14 +775,15 @@ back_from_confirm:
 
 do_append_data:
         up->len += ulen;
-        err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov, ulen,
+        getfrag  =  is_udplite ?  udplite_getfrag : ip_generic_getfrag;
+        err = ip6_append_data(sk, getfrag, msg->msg_iov, ulen,
                 sizeof(struct udphdr), hlimit, tclass, opt, &fl,
                 (struct rt6_info*)dst,
                 corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
         if (err)
                 udp_v6_flush_pending_frames(sk);
         else if (!corkreq)
-                err = udp_v6_push_pending_frames(sk, up);
+                err = udp_v6_push_pending_frames(sk);
         else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
                 up->pending = 0;
 
@@ -793,7 +808,7 @@ do_append_data:
 out:
         fl6_sock_release(flowlabel);
         if (!err) {
-                UDP6_INC_STATS_USER(UDP_MIB_OUTDATAGRAMS);
+                UDP6_INC_STATS_USER(UDP_MIB_OUTDATAGRAMS, is_udplite);
                 return len;
         }
         /*
@@ -804,7 +819,7 @@ out:
          * seems like overkill.
          */
         if (err == -ENOBUFS || test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
-                UDP6_INC_STATS_USER(UDP_MIB_SNDBUFERRORS);
+                UDP6_INC_STATS_USER(UDP_MIB_SNDBUFERRORS, is_udplite);
         }
         return err;
 
@@ -816,7 +831,7 @@ do_confirm:
         goto out;
 }
 
-static int udpv6_destroy_sock(struct sock *sk)
+int udpv6_destroy_sock(struct sock *sk)
 {
         lock_sock(sk);
         udp_v6_flush_pending_frames(sk);
@@ -830,119 +845,41 @@ static int udpv6_destroy_sock(struct sock *sk)
 /*
  *      Socket option code for UDP
  */
-static int do_udpv6_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
-{
-        struct udp_sock *up = udp_sk(sk);
-        int val;
-        int err = 0;
-
-        if(optlen<sizeof(int))
-                return -EINVAL;
-
-        if (get_user(val, (int __user *)optval))
-                return -EFAULT;
-
-        switch(optname) {
-        case UDP_CORK:
-                if (val != 0) {
-                        up->corkflag = 1;
-                } else {
-                        up->corkflag = 0;
-                        lock_sock(sk);
-                        udp_v6_push_pending_frames(sk, up);
-                        release_sock(sk);
-                }
-                break;
-                
-        case UDP_ENCAP:
-                switch (val) {
-                case 0:
-                        up->encap_type = val;
-                        break;
-                default:
-                        err = -ENOPROTOOPT;
-                        break;
-                }
-                break;
-
-        default:
-                err = -ENOPROTOOPT;
-                break;
-        };
-
-        return err;
-}
-
-static int udpv6_setsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int optlen)
+int udpv6_setsockopt(struct sock *sk, int level, int optname,
+                     char __user *optval, int optlen)
 {
-        if (level != SOL_UDP)
-                return ipv6_setsockopt(sk, level, optname, optval, optlen);
-        return do_udpv6_setsockopt(sk, level, optname, optval, optlen);
+        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
+                return udp_lib_setsockopt(sk, level, optname, optval, optlen,
+                                          udp_v6_push_pending_frames);
+        return ipv6_setsockopt(sk, level, optname, optval, optlen);
 }
 
 #ifdef CONFIG_COMPAT
-static int compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
-                                   char __user *optval, int optlen)
+int compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
+                            char __user *optval, int optlen)
 {
-        if (level != SOL_UDP)
-                return compat_ipv6_setsockopt(sk, level, optname,
-                                              optval, optlen);
-        return do_udpv6_setsockopt(sk, level, optname, optval, optlen);
+        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
+                return udp_lib_setsockopt(sk, level, optname, optval, optlen,
+                                          udp_v6_push_pending_frames);
+        return compat_ipv6_setsockopt(sk, level, optname, optval, optlen);
 }
 #endif
 
-static int do_udpv6_getsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int __user *optlen)
-{
-        struct udp_sock *up = udp_sk(sk);
-        int val, len;
-
-        if(get_user(len,optlen))
-                return -EFAULT;
-
-        len = min_t(unsigned int, len, sizeof(int));
-        
-        if(len < 0)
-                return -EINVAL;
-
-        switch(optname) {
-        case UDP_CORK:
-                val = up->corkflag;
-                break;
-
-        case UDP_ENCAP:
-                val = up->encap_type;
-                break;
-
-        default:
-                return -ENOPROTOOPT;
-        };
-
-        if(put_user(len, optlen))
-                return -EFAULT;
-        if(copy_to_user(optval, &val,len))
-                return -EFAULT;
-        return 0;
-}
-
-static int udpv6_getsockopt(struct sock *sk, int level, int optname,
-                          char __user *optval, int __user *optlen)
+int udpv6_getsockopt(struct sock *sk, int level, int optname,
+                     char __user *optval, int __user *optlen)
 {
-        if (level != SOL_UDP)
-                return ipv6_getsockopt(sk, level, optname, optval, optlen);
-        return do_udpv6_getsockopt(sk, level, optname, optval, optlen);
+        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
+                return udp_lib_getsockopt(sk, level, optname, optval, optlen);
+        return ipv6_getsockopt(sk, level, optname, optval, optlen);
 }
 
 #ifdef CONFIG_COMPAT
-static int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
-                                   char __user *optval, int __user *optlen)
+int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
+                            char __user *optval, int __user *optlen)
 {
-        if (level != SOL_UDP)
-                return compat_ipv6_getsockopt(sk, level, optname,
-                                              optval, optlen);
-        return do_udpv6_getsockopt(sk, level, optname, optval, optlen);
+        if (level == SOL_UDP  ||  level == SOL_UDPLITE)
+                return udp_lib_getsockopt(sk, level, optname, optval, optlen);
+        return compat_ipv6_getsockopt(sk, level, optname, optval, optlen);
 }
 #endif
 
@@ -983,7 +920,7 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
                    atomic_read(&sp->sk_refcnt), sp);
 }
 
-static int udp6_seq_show(struct seq_file *seq, void *v)
+int udp6_seq_show(struct seq_file *seq, void *v)
 {
         if (v == SEQ_START_TOKEN)
                 seq_printf(seq,
@@ -1002,6 +939,7 @@ static struct udp_seq_afinfo udp6_seq_afinfo = {
         .owner          = THIS_MODULE,
         .name           = "udp6",
         .family         = AF_INET6,
+        .hashtable      = udp_hash,
         .seq_show       = udp6_seq_show,
         .seq_fops       = &udp6_seq_fops,
 };
@@ -1021,7 +959,7 @@ void udp6_proc_exit(void) {
 struct proto udpv6_prot = {
         .name              = "UDPv6",
         .owner             = THIS_MODULE,
-        .close             = udpv6_close,
+        .close             = udp_lib_close,
         .connect           = ip6_datagram_connect,
         .disconnect        = udp_disconnect,
         .ioctl             = udp_ioctl,
@@ -1031,8 +969,8 @@ struct proto udpv6_prot = {
         .sendmsg           = udpv6_sendmsg,
         .recvmsg           = udpv6_recvmsg,
         .backlog_rcv       = udpv6_queue_rcv_skb,
-        .hash              = udp_v6_hash,
-        .unhash            = udp_v6_unhash,
+        .hash              = udp_lib_hash,
+        .unhash            = udp_lib_unhash,
         .get_port          = udp_v6_get_port,
         .obj_size          = sizeof(struct udp6_sock),
 #ifdef CONFIG_COMPAT
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
new file mode 100644
index 000000000000..ec9878899128
--- /dev/null
+++ b/net/ipv6/udp_impl.h
@@ -0,0 +1,34 @@
+#ifndef _UDP6_IMPL_H
+#define _UDP6_IMPL_H
+#include <net/udp.h>
+#include <net/udplite.h>
+#include <net/protocol.h>
+#include <net/addrconf.h>
+#include <net/inet_common.h>
+
+extern int      __udp6_lib_rcv(struct sk_buff **, struct hlist_head [], int );
+extern void     __udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *,
+                               int , int , int , __be32 , struct hlist_head []);
+
+extern int      udpv6_getsockopt(struct sock *sk, int level, int optname,
+                                 char __user *optval, int __user *optlen);
+extern int      udpv6_setsockopt(struct sock *sk, int level, int optname,
+                                 char __user *optval, int optlen);
+#ifdef CONFIG_COMPAT
+extern int      compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
+                                        char __user *optval, int optlen);
+extern int      compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
+                                       char __user *optval, int __user *optlen);
+#endif
+extern int      udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
+                              struct msghdr *msg, size_t len);
+extern int      udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
+                              struct msghdr *msg, size_t len,
+                              int noblock, int flags, int *addr_len);
+extern int      udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);
+extern int      udpv6_destroy_sock(struct sock *sk);
+
+#ifdef CONFIG_PROC_FS
+extern int      udp6_seq_show(struct seq_file *seq, void *v);
+#endif
+#endif  /* _UDP6_IMPL_H */
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
new file mode 100644
index 000000000000..629f97162fbc
--- /dev/null
+++ b/net/ipv6/udplite.c
@@ -0,0 +1,105 @@
+/*
+ *  UDPLITEv6   An implementation of the UDP-Lite protocol over IPv6.
+ *              See also net/ipv4/udplite.c
+ *
+ *  Version:    $Id: udplite.c,v 1.9 2006/10/19 08:28:10 gerrit Exp $
+ *
+ *  Authors:    Gerrit Renker       <gerrit@erg.abdn.ac.uk>
+ *
+ *  Changes:
+ *  Fixes:
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ */
+#include "udp_impl.h"
+
+DEFINE_SNMP_STAT(struct udp_mib, udplite_stats_in6) __read_mostly;
+
+static int udplitev6_rcv(struct sk_buff **pskb)
+{
+        return __udp6_lib_rcv(pskb, udplite_hash, 1);
+}
+
+static void udplitev6_err(struct sk_buff *skb,
+                          struct inet6_skb_parm *opt,
+                          int type, int code, int offset, __be32 info)
+{
+        return __udp6_lib_err(skb, opt, type, code, offset, info, udplite_hash);
+}
+
+static struct inet6_protocol udplitev6_protocol = {
+        .handler        =       udplitev6_rcv,
+        .err_handler    =       udplitev6_err,
+        .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
+};
+
+static int udplite_v6_get_port(struct sock *sk, unsigned short snum)
+{
+        return udplite_get_port(sk, snum, ipv6_rcv_saddr_equal);
+}
+
+struct proto udplitev6_prot = {
+        .name              = "UDPLITEv6",
+        .owner             = THIS_MODULE,
+        .close             = udp_lib_close,
+        .connect           = ip6_datagram_connect,
+        .disconnect        = udp_disconnect,
+        .ioctl             = udp_ioctl,
+        .init              = udplite_sk_init,
+        .destroy           = udpv6_destroy_sock,
+        .setsockopt        = udpv6_setsockopt,
+        .getsockopt        = udpv6_getsockopt,
+        .sendmsg           = udpv6_sendmsg,
+        .recvmsg           = udpv6_recvmsg,
+        .backlog_rcv       = udpv6_queue_rcv_skb,
+        .hash              = udp_lib_hash,
+        .unhash            = udp_lib_unhash,
+        .get_port          = udplite_v6_get_port,
+        .obj_size          = sizeof(struct udp6_sock),
+#ifdef CONFIG_COMPAT
+        .compat_setsockopt = compat_udpv6_setsockopt,
+        .compat_getsockopt = compat_udpv6_getsockopt,
+#endif
+};
+
+static struct inet_protosw udplite6_protosw = {
+        .type           = SOCK_DGRAM,
+        .protocol       = IPPROTO_UDPLITE,
+        .prot           = &udplitev6_prot,
+        .ops            = &inet6_dgram_ops,
+        .capability     = -1,
+        .no_check       = 0,
+        .flags          = INET_PROTOSW_PERMANENT,
+};
+
+void __init udplitev6_init(void)
+{
+        if (inet6_add_protocol(&udplitev6_protocol, IPPROTO_UDPLITE) < 0)
+                printk(KERN_ERR "%s: Could not register.\n", __FUNCTION__);
+
+        inet6_register_protosw(&udplite6_protosw);
+}
+
+#ifdef CONFIG_PROC_FS
+static struct file_operations udplite6_seq_fops;
+static struct udp_seq_afinfo udplite6_seq_afinfo = {
+        .owner          = THIS_MODULE,
+        .name           = "udplite6",
+        .family         = AF_INET6,
+        .hashtable      = udplite_hash,
+        .seq_show       = udp6_seq_show,
+        .seq_fops       = &udplite6_seq_fops,
+};
+
+int __init udplite6_proc_init(void)
+{
+        return udp_proc_register(&udplite6_seq_afinfo);
+}
+
+void udplite6_proc_exit(void)
+{
+        udp_proc_unregister(&udplite6_seq_afinfo);
+}
+#endif
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index d400f8fae129..8dffd4daae9c 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -274,11 +274,12 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
                         break;
 
                 case IPPROTO_UDP:
+                case IPPROTO_UDPLITE:
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
                 case IPPROTO_DCCP:
                         if (pskb_may_pull(skb, skb->nh.raw + offset + 4 - skb->data)) {
-                                u16 *ports = (u16 *)exthdr;
+                                __be16 *ports = (__be16 *)exthdr;
 
                                 fl->fl_ip_sport = ports[0];
                                 fl->fl_ip_dport = ports[1];
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 7931e4f898d4..01a5c52a2be3 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -62,7 +62,7 @@ static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
 {
         unsigned h;
 
-        h = addr->a6[0] ^ addr->a6[1] ^ addr->a6[2] ^ addr->a6[3];
+        h = (__force u32)(addr->a6[0] ^ addr->a6[1] ^ addr->a6[2] ^ addr->a6[3]);
         h ^= h >> 16;
         h ^= h >> 8;
         h &= XFRM6_TUNNEL_SPI_BYADDR_HSIZE - 1;
@@ -126,7 +126,7 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
         return NULL;
 }
 
-u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
+__be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
 {
         struct xfrm6_tunnel_spi *x6spi;
         u32 spi;
@@ -196,7 +196,7 @@ out:
         return spi;
 }
 
-u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
+__be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
 {
         struct xfrm6_tunnel_spi *x6spi;
         u32 spi;
@@ -265,7 +265,7 @@ static int xfrm6_tunnel_rcv(struct sk_buff *skb)
 }
 
 static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                            int type, int code, int offset, __u32 info)
+                            int type, int code, int offset, __be32 info)
 {
         /* xfrm6_tunnel native err handling */
         switch (type) {