23 files changed, 202 insertions, 242 deletions

diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index ed0b9e2e797a..11b13ea69db4 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -156,6 +156,7 @@ config INET6_XFRM_MODE_ROUTEOPTIMIZATION
 config IPV6_SIT
         tristate "IPv6: IPv6-in-IPv4 tunnel (SIT driver)"
         select INET_TUNNEL
+        select NET_IP_TUNNEL
         select IPV6_NDISC_NODETYPE
         default y
         ---help---
@@ -201,6 +202,7 @@ config IPV6_TUNNEL
 config IPV6_GRE
         tristate "IPv6: GRE tunnel"
         select IPV6_TUNNEL
+        select NET_IP_TUNNEL
         ---help---
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a459c4f5b769..a33b157d9ccf 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -70,6 +70,7 @@
 #include <net/snmp.h>
 
 #include <net/af_ieee802154.h>
+#include <net/firewire.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/ndisc.h>
@@ -544,8 +545,7 @@ static const struct nla_policy devconf_ipv6_policy[NETCONFA_MAX+1] = {
 };
 
 static int inet6_netconf_get_devconf(struct sk_buff *in_skb,
-                                     struct nlmsghdr *nlh,
-                                     void *arg)
+                                     struct nlmsghdr *nlh)
 {
         struct net *net = sock_net(in_skb->sk);
         struct nlattr *tb[NETCONFA_MAX+1];
@@ -605,6 +605,77 @@ errout:
         return err;
 }
 
+static int inet6_netconf_dump_devconf(struct sk_buff *skb,
+                                      struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        int h, s_h;
+        int idx, s_idx;
+        struct net_device *dev;
+        struct inet6_dev *idev;
+        struct hlist_head *head;
+
+        s_h = cb->args[0];
+        s_idx = idx = cb->args[1];
+
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                rcu_read_lock();
+                cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^
+                          net->dev_base_seq;
+                hlist_for_each_entry_rcu(dev, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        idev = __in6_dev_get(dev);
+                        if (!idev)
+                                goto cont;
+
+                        if (inet6_netconf_fill_devconf(skb, dev->ifindex,
+                                                       &idev->cnf,
+                                                       NETLINK_CB(cb->skb).portid,
+                                                       cb->nlh->nlmsg_seq,
+                                                       RTM_NEWNETCONF,
+                                                       NLM_F_MULTI,
+                                                       -1) <= 0) {
+                                rcu_read_unlock();
+                                goto done;
+                        }
+                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+cont:
+                        idx++;
+                }
+                rcu_read_unlock();
+        }
+        if (h == NETDEV_HASHENTRIES) {
+                if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_ALL,
+                                               net->ipv6.devconf_all,
+                                               NETLINK_CB(cb->skb).portid,
+                                               cb->nlh->nlmsg_seq,
+                                               RTM_NEWNETCONF, NLM_F_MULTI,
+                                               -1) <= 0)
+                        goto done;
+                else
+                        h++;
+        }
+        if (h == NETDEV_HASHENTRIES + 1) {
+                if (inet6_netconf_fill_devconf(skb, NETCONFA_IFINDEX_DEFAULT,
+                                               net->ipv6.devconf_dflt,
+                                               NETLINK_CB(cb->skb).portid,
+                                               cb->nlh->nlmsg_seq,
+                                               RTM_NEWNETCONF, NLM_F_MULTI,
+                                               -1) <= 0)
+                        goto done;
+                else
+                        h++;
+        }
+done:
+        cb->args[0] = h;
+        cb->args[1] = idx;
+
+        return skb->len;
+}
+
 #ifdef CONFIG_SYSCTL
 static void dev_forward_change(struct inet6_dev *idev)
 {
@@ -1668,6 +1739,20 @@ static int addrconf_ifid_eui64(u8 *eui, struct net_device *dev)
         return 0;
 }
 
+static int addrconf_ifid_ieee1394(u8 *eui, struct net_device *dev)
+{
+        union fwnet_hwaddr *ha;
+
+        if (dev->addr_len != FWNET_ALEN)
+                return -1;
+
+        ha = (union fwnet_hwaddr *)dev->dev_addr;
+
+        memcpy(eui, &ha->uc.uniq_id, sizeof(ha->uc.uniq_id));
+        eui[0] ^= 2;
+        return 0;
+}
+
 static int addrconf_ifid_arcnet(u8 *eui, struct net_device *dev)
 {
         /* XXX: inherit EUI-64 from other interface -- yoshfuji */
@@ -1732,6 +1817,8 @@ static int ipv6_generate_eui64(u8 *eui, struct net_device *dev)
                 return addrconf_ifid_gre(eui, dev);
         case ARPHRD_IEEE802154:
                 return addrconf_ifid_eui64(eui, dev);
+        case ARPHRD_IEEE1394:
+                return addrconf_ifid_ieee1394(eui, dev);
         }
         return -1;
 }
@@ -2600,7 +2687,8 @@ static void addrconf_dev_config(struct net_device *dev)
             (dev->type != ARPHRD_FDDI) &&
             (dev->type != ARPHRD_ARCNET) &&
             (dev->type != ARPHRD_INFINIBAND) &&
-            (dev->type != ARPHRD_IEEE802154)) {
+            (dev->type != ARPHRD_IEEE802154) &&
+            (dev->type != ARPHRD_IEEE1394)) {
                 /* Alas, we support only Ethernet autoconfiguration. */
                 return;
         }
@@ -3537,7 +3625,7 @@ static const struct nla_policy ifa_ipv6_policy[IFA_MAX+1] = {
 };
 
 static int
-inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         struct net *net = sock_net(skb->sk);
         struct ifaddrmsg *ifm;
@@ -3603,7 +3691,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
 }
 
 static int
-inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         struct net *net = sock_net(skb->sk);
         struct ifaddrmsg *ifm;
@@ -3834,6 +3922,7 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
                                                 NLM_F_MULTI);
                         if (err <= 0)
                                 break;
+                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
                 }
                 break;
         }
@@ -3891,6 +3980,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
         s_ip_idx = ip_idx = cb->args[2];
 
         rcu_read_lock();
+        cb->seq = atomic_read(&net->ipv6.dev_addr_genid) ^ net->dev_base_seq;
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
@@ -3942,8 +4032,7 @@ static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
         return inet6_dump_addr(skb, cb, type);
 }
 
-static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh,
-                             void *arg)
+static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh)
 {
         struct net *net = sock_net(in_skb->sk);
         struct ifaddrmsg *ifm;
@@ -4368,6 +4457,8 @@ errout:
 
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 {
+        struct net *net = dev_net(ifp->idev->dev);
+
         inet6_ifa_notify(event ? : RTM_NEWADDR, ifp);
 
         switch (event) {
@@ -4393,6 +4484,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                         dst_free(&ifp->rt->dst);
                 break;
         }
+        atomic_inc(&net->ipv6.dev_addr_genid);
 }
 
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
@@ -4961,7 +5053,7 @@ int __init addrconf_init(void)
         __rtnl_register(PF_INET6, RTM_GETANYCAST, NULL,
                         inet6_dump_ifacaddr, NULL);
         __rtnl_register(PF_INET6, RTM_GETNETCONF, inet6_netconf_get_devconf,
-                        NULL, NULL);
+                        inet6_netconf_dump_devconf, NULL);
 
         ipv6_addr_label_rtnl_register();
 
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index aad64352cb60..f083a583a05c 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -414,8 +414,7 @@ static const struct nla_policy ifal_policy[IFAL_MAX+1] = {
         [IFAL_LABEL]            = { .len = sizeof(u32), },
 };
 
-static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh,
-                             void *arg)
+static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
         struct net *net = sock_net(skb->sk);
         struct ifaddrlblmsg *ifal;
@@ -436,10 +435,7 @@ static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         if (!tb[IFAL_ADDRESS])
                 return -EINVAL;
-
         pfx = nla_data(tb[IFAL_ADDRESS]);
-        if (!pfx)
-                return -EINVAL;
 
         if (!tb[IFAL_LABEL])
                 return -EINVAL;
@@ -533,8 +529,7 @@ static inline int ip6addrlbl_msgsize(void)
                 + nla_total_size(4);    /* IFAL_LABEL */
 }
 
-static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
-                          void *arg)
+static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh)
 {
         struct net *net = sock_net(in_skb->sk);
         struct ifaddrlblmsg *ifal;
@@ -561,10 +556,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
 
         if (!tb[IFAL_ADDRESS])
                 return -EINVAL;
-
         addr = nla_data(tb[IFAL_ADDRESS]);
-        if (!addr)
-                return -EINVAL;
 
         rcu_read_lock();
         p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 6b793bfc0e10..ab5c7ad482cd 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -49,7 +49,6 @@
 #include <net/udp.h>
 #include <net/udplite.h>
 #include <net/tcp.h>
-#include <net/ipip.h>
 #include <net/protocol.h>
 #include <net/inet_common.h>
 #include <net/route.h>
@@ -323,7 +322,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                         struct net_device *dev = NULL;
 
                         rcu_read_lock();
-                        if (addr_type & IPV6_ADDR_LINKLOCAL) {
+                        if (__ipv6_addr_needs_scope_id(addr_type)) {
                                 if (addr_len >= sizeof(struct sockaddr_in6) &&
                                     addr->sin6_scope_id) {
                                         /* Override any existing binding, if another one
@@ -471,8 +470,8 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
 
                 sin->sin6_port = inet->inet_sport;
         }
-        if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
-                sin->sin6_scope_id = sk->sk_bound_dev_if;
+        sin->sin6_scope_id = ipv6_iface_scope_id(&sin->sin6_addr,
+                                                 sk->sk_bound_dev_if);
         *uaddr_len = sizeof(*sin);
         return 0;
 }
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index f5a54782a340..4b56cbbc7890 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -124,7 +124,7 @@ ipv4_connected:
                 goto out;
         }
 
-        if (addr_type&IPV6_ADDR_LINKLOCAL) {
+        if (__ipv6_addr_needs_scope_id(addr_type)) {
                 if (addr_len >= sizeof(struct sockaddr_in6) &&
                     usin->sin6_scope_id) {
                         if (sk->sk_bound_dev_if &&
@@ -355,18 +355,19 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
                 sin->sin6_port = serr->port;
-                sin->sin6_scope_id = 0;
                 if (skb->protocol == htons(ETH_P_IPV6)) {
                         const struct ipv6hdr *ip6h = container_of((struct in6_addr *)(nh + serr->addr_offset),
                                                                   struct ipv6hdr, daddr);
                         sin->sin6_addr = ip6h->daddr;
                         if (np->sndflow)
                                 sin->sin6_flowinfo = ip6_flowinfo(ip6h);
-                        if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
-                                sin->sin6_scope_id = IP6CB(skb)->iif;
+                        sin->sin6_scope_id =
+                                ipv6_iface_scope_id(&sin->sin6_addr,
+                                                    IP6CB(skb)->iif);
                 } else {
                         ipv6_addr_set_v4mapped(*(__be32 *)(nh + serr->addr_offset),
                                                &sin->sin6_addr);
+                        sin->sin6_scope_id = 0;
                 }
         }
 
@@ -376,18 +377,19 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
         if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
-                sin->sin6_scope_id = 0;
                 if (skb->protocol == htons(ETH_P_IPV6)) {
                         sin->sin6_addr = ipv6_hdr(skb)->saddr;
                         if (np->rxopt.all)
                                 ip6_datagram_recv_ctl(sk, msg, skb);
-                        if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
-                                sin->sin6_scope_id = IP6CB(skb)->iif;
+                        sin->sin6_scope_id =
+                                ipv6_iface_scope_id(&sin->sin6_addr,
+                                                    IP6CB(skb)->iif);
                 } else {
                         struct inet_sock *inet = inet_sk(sk);
 
                         ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
                                                &sin->sin6_addr);
+                        sin->sin6_scope_id = 0;
                         if (inet->cmsg_flags)
                                 ip_cmsg_recv(msg, skb);
                 }
@@ -592,7 +594,9 @@ int ip6_datagram_recv_ctl(struct sock *sk, struct msghdr *msg,
                         sin6.sin6_addr = ipv6_hdr(skb)->daddr;
                         sin6.sin6_port = ports[1];
                         sin6.sin6_flowinfo = 0;
-                        sin6.sin6_scope_id = 0;
+                        sin6.sin6_scope_id =
+                                ipv6_iface_scope_id(&ipv6_hdr(skb)->daddr,
+                                                    opt->iif);
 
                         put_cmsg(msg, SOL_IPV6, IPV6_ORIGDSTADDR, sizeof(sin6), &sin6);
                 }
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index fff5bdd8b680..71b900c3f4ff 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -434,7 +434,7 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
          *      Source addr check
          */
 
-        if (addr_type & IPV6_ADDR_LINKLOCAL)
+        if (__ipv6_addr_needs_scope_id(addr_type))
                 iif = skb->dev->ifindex;
 
         /*
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 9bfab19ff3c0..e4311cbc8b4e 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -54,6 +54,10 @@ int inet6_csk_bind_conflict(const struct sock *sk,
                                 if (ipv6_rcv_saddr_equal(sk, sk2))
                                         break;
                         }
+                        if (!relax && reuse && sk2->sk_reuse &&
+                            sk2->sk_state != TCP_LISTEN &&
+                            ipv6_rcv_saddr_equal(sk, sk2))
+                                break;
                 }
         }
 
@@ -169,10 +173,8 @@ void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
         sin6->sin6_port = inet_sk(sk)->inet_dport;
         /* We do not store received flowlabel for TCP */
         sin6->sin6_flowinfo = 0;
-        sin6->sin6_scope_id = 0;
-        if (sk->sk_bound_dev_if &&
-            ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL)
-                sin6->sin6_scope_id = sk->sk_bound_dev_if;
+        sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
+                                                  sk->sk_bound_dev_if);
 }
 
 EXPORT_SYMBOL_GPL(inet6_csk_addr2sockaddr);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index b973ed3d06cf..46e88433ec7d 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -144,7 +144,9 @@ static void ip6_fl_gc(unsigned long dummy)
         spin_lock(&ip6_fl_lock);
 
         for (i=0; i<=FL_HASH_MASK; i++) {
-                struct ip6_flowlabel *fl, **flp;
+                struct ip6_flowlabel *fl;
+                struct ip6_flowlabel __rcu **flp;
+
                 flp = &fl_ht[i];
                 while ((fl = rcu_dereference_protected(*flp,
                                                        lockdep_is_held(&ip6_fl_lock))) != NULL) {
@@ -179,7 +181,9 @@ static void __net_exit ip6_fl_purge(struct net *net)
 
         spin_lock(&ip6_fl_lock);
         for (i = 0; i <= FL_HASH_MASK; i++) {
-                struct ip6_flowlabel *fl, **flp;
+                struct ip6_flowlabel *fl;
+                struct ip6_flowlabel __rcu **flp;
+
                 flp = &fl_ht[i];
                 while ((fl = rcu_dereference_protected(*flp,
                                                        lockdep_is_held(&ip6_fl_lock))) != NULL) {
@@ -506,7 +510,8 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct in6_flowlabel_req freq;
         struct ipv6_fl_socklist *sfl1=NULL;
-        struct ipv6_fl_socklist *sfl, **sflp;
+        struct ipv6_fl_socklist *sfl;
+        struct ipv6_fl_socklist __rcu **sflp;
         struct ip6_flowlabel *fl, *fl1 = NULL;
 
 
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index e4efffe2522e..d3ddd8400354 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -38,6 +38,7 @@
 
 #include <net/sock.h>
 #include <net/ip.h>
+#include <net/ip_tunnels.h>
 #include <net/icmp.h>
 #include <net/protocol.h>
 #include <net/addrconf.h>
@@ -110,46 +111,6 @@ static u32 HASH_ADDR(const struct in6_addr *addr)
 #define tunnels_l       tunnels[1]
 #define tunnels_wc      tunnels[0]
 
-static struct rtnl_link_stats64 *ip6gre_get_stats64(struct net_device *dev,
-                struct rtnl_link_stats64 *tot)
-{
-        int i;
-
-        for_each_possible_cpu(i) {
-                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
-                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
-                unsigned int start;
-
-                do {
-                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
-                        rx_packets = tstats->rx_packets;
-                        tx_packets = tstats->tx_packets;
-                        rx_bytes = tstats->rx_bytes;
-                        tx_bytes = tstats->tx_bytes;
-                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
-
-                tot->rx_packets += rx_packets;
-                tot->tx_packets += tx_packets;
-                tot->rx_bytes   += rx_bytes;
-                tot->tx_bytes   += tx_bytes;
-        }
-
-        tot->multicast = dev->stats.multicast;
-        tot->rx_crc_errors = dev->stats.rx_crc_errors;
-        tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
-        tot->rx_length_errors = dev->stats.rx_length_errors;
-        tot->rx_frame_errors = dev->stats.rx_frame_errors;
-        tot->rx_errors = dev->stats.rx_errors;
-
-        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
-        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
-        tot->tx_dropped = dev->stats.tx_dropped;
-        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
-        tot->tx_errors = dev->stats.tx_errors;
-
-        return tot;
-}
-
 /* Given src, dst and key, find appropriate for input tunnel. */
 
 static struct ip6_tnl *ip6gre_tunnel_lookup(struct net_device *dev,
@@ -667,7 +628,6 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
         struct net_device_stats *stats = &tunnel->dev->stats;
         int err = -1;
         u8 proto;
-        int pkt_len;
         struct sk_buff *new_skb;
 
         if (dev->type == ARPHRD_ETHER)
@@ -801,23 +761,9 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
                 }
         }
 
-        nf_reset(skb);
-        pkt_len = skb->len;
-        err = ip6_local_out(skb);
-
-        if (net_xmit_eval(err) == 0) {
-                struct pcpu_tstats *tstats = this_cpu_ptr(tunnel->dev->tstats);
-
-                tstats->tx_bytes += pkt_len;
-                tstats->tx_packets++;
-        } else {
-                stats->tx_errors++;
-                stats->tx_aborted_errors++;
-        }
-
+        ip6tunnel_xmit(skb, dev);
         if (ndst)
                 ip6_tnl_dst_store(tunnel, ndst);
-
         return 0;
 tx_err_link_failure:
         stats->tx_carrier_errors++;
@@ -1271,7 +1217,7 @@ static const struct net_device_ops ip6gre_netdev_ops = {
         .ndo_start_xmit         = ip6gre_tunnel_xmit,
         .ndo_do_ioctl           = ip6gre_tunnel_ioctl,
         .ndo_change_mtu         = ip6gre_tunnel_change_mtu,
-        .ndo_get_stats64        = ip6gre_get_stats64,
+        .ndo_get_stats64        = ip_tunnel_get_stats64,
 };
 
 static void ip6gre_dev_free(struct net_device *dev)
@@ -1520,7 +1466,7 @@ static const struct net_device_ops ip6gre_tap_netdev_ops = {
         .ndo_set_mac_address = eth_mac_addr,
         .ndo_validate_addr = eth_validate_addr,
         .ndo_change_mtu = ip6gre_tunnel_change_mtu,
-        .ndo_get_stats64 = ip6gre_get_stats64,
+        .ndo_get_stats64 = ip_tunnel_get_stats64,
 };
 
 static void ip6gre_tap_setup(struct net_device *dev)
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 8234c1dcdf72..71b766ee821d 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -92,14 +92,12 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         u8 *prevhdr;
         int offset = 0;
 
-        if (!(features & NETIF_F_V6_CSUM))
-                features &= ~NETIF_F_SG;
-
         if (unlikely(skb_shinfo(skb)->gso_type &
                      ~(SKB_GSO_UDP |
                        SKB_GSO_DODGY |
                        SKB_GSO_TCP_ECN |
                        SKB_GSO_GRE |
+                       SKB_GSO_UDP_TUNNEL |
                        SKB_GSO_TCPV6 |
                        0)))
                 goto out;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index fff83cbc197f..1e55866cead7 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -47,6 +47,7 @@
 
 #include <net/icmp.h>
 #include <net/ip.h>
+#include <net/ip_tunnels.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
 #include <net/addrconf.h>
@@ -955,7 +956,6 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         unsigned int max_headroom = sizeof(struct ipv6hdr);
         u8 proto;
         int err = -1;
-        int pkt_len;
 
         if (!fl6->flowi6_mark)
                 dst = ip6_tnl_dst_check(t);
@@ -1035,19 +1035,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         ipv6h->nexthdr = proto;
         ipv6h->saddr = fl6->saddr;
         ipv6h->daddr = fl6->daddr;
-        nf_reset(skb);
-        pkt_len = skb->len;
-        err = ip6_local_out(skb);
-
-        if (net_xmit_eval(err) == 0) {
-                struct pcpu_tstats *tstats = this_cpu_ptr(t->dev->tstats);
-
-                tstats->tx_bytes += pkt_len;
-                tstats->tx_packets++;
-        } else {
-                stats->tx_errors++;
-                stats->tx_aborted_errors++;
-        }
+        ip6tunnel_xmit(skb, dev);
         if (ndst)
                 ip6_tnl_dst_store(t, ndst);
         return 0;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 96bfb4e4b820..241fb8ad9fcf 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -842,9 +842,9 @@ static void ip6mr_destroy_unres(struct mr6_table *mrt, struct mfc6_cache *c)
                 if (ipv6_hdr(skb)->version == 0) {
                         struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct ipv6hdr));
                         nlh->nlmsg_type = NLMSG_ERROR;
-                        nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
+                        nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr));
                         skb_trim(skb, nlh->nlmsg_len);
-                        ((struct nlmsgerr *)NLMSG_DATA(nlh))->error = -ETIMEDOUT;
+                        ((struct nlmsgerr *)nlmsg_data(nlh))->error = -ETIMEDOUT;
                         rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
                 } else
                         kfree_skb(skb);
@@ -1100,13 +1100,13 @@ static void ip6mr_cache_resolve(struct net *net, struct mr6_table *mrt,
                 if (ipv6_hdr(skb)->version == 0) {
                         struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct ipv6hdr));
 
-                        if (__ip6mr_fill_mroute(mrt, skb, c, NLMSG_DATA(nlh)) > 0) {
+                        if (__ip6mr_fill_mroute(mrt, skb, c, nlmsg_data(nlh)) > 0) {
                                 nlh->nlmsg_len = skb_tail_pointer(skb) - (u8 *)nlh;
                         } else {
                                 nlh->nlmsg_type = NLMSG_ERROR;
-                                nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
+                                nlh->nlmsg_len = nlmsg_msg_size(sizeof(struct nlmsgerr));
                                 skb_trim(skb, nlh->nlmsg_len);
-                                ((struct nlmsgerr *)NLMSG_DATA(nlh))->error = -EMSGSIZE;
+                                ((struct nlmsgerr *)nlmsg_data(nlh))->error = -EMSGSIZE;
                         }
                         rtnl_unicast(skb, net, NETLINK_CB(skb).portid);
                 } else
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 76ef4353d518..2712ab22a174 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -610,8 +610,6 @@ void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
                 }
         }
 #endif
-        if (!dev->addr_len)
-                send_sllao = 0;
         if (send_sllao)
                 optlen += ndisc_opt_addr_space(dev);
 
diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 33608c610276..938e0b7ea1bd 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -18,9 +18,8 @@
 static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
 {
         struct ip6t_npt_tginfo *npt = par->targinfo;
-        __wsum src_sum = 0, dst_sum = 0;
         struct in6_addr pfx;
-        unsigned int i;
+        __wsum src_sum, dst_sum;
 
         if (npt->src_pfx_len > 64 || npt->dst_pfx_len > 64)
                 return -EINVAL;
@@ -33,12 +32,8 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
         if (!ipv6_addr_equal(&pfx, &npt->dst_pfx.in6))
                 return -EINVAL;
 
-        for (i = 0; i < ARRAY_SIZE(npt->src_pfx.in6.s6_addr16); i++) {
-                src_sum = csum_add(src_sum,
-                                (__force __wsum)npt->src_pfx.in6.s6_addr16[i]);
-                dst_sum = csum_add(dst_sum,
-                                (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]);
-        }
+        src_sum = csum_partial(&npt->src_pfx.in6, sizeof(npt->src_pfx.in6), 0);
+        dst_sum = csum_partial(&npt->dst_pfx.in6, sizeof(npt->dst_pfx.in6), 0);
 
         npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum));
         return 0;
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 2b6c226f5198..97bcf2bae857 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -330,12 +330,8 @@ ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                                         sizeof(sin6.sin6_addr));
 
         nf_ct_put(ct);
-
-        if (ipv6_addr_type(&sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL)
-                sin6.sin6_scope_id = sk->sk_bound_dev_if;
-        else
-                sin6.sin6_scope_id = 0;
-
+        sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr,
+                                                 sk->sk_bound_dev_if);
         return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0;
 }
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 330b5e7b7df6..eedff8ccded5 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -263,7 +263,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
         if (addr_type != IPV6_ADDR_ANY) {
                 struct net_device *dev = NULL;
 
-                if (addr_type & IPV6_ADDR_LINKLOCAL) {
+                if (__ipv6_addr_needs_scope_id(addr_type)) {
                         if (addr_len >= sizeof(struct sockaddr_in6) &&
                             addr->sin6_scope_id) {
                                 /* Override any existing binding, if another
@@ -498,9 +498,8 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                 sin6->sin6_port = 0;
                 sin6->sin6_addr = ipv6_hdr(skb)->saddr;
                 sin6->sin6_flowinfo = 0;
-                sin6->sin6_scope_id = 0;
-                if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL)
-                        sin6->sin6_scope_id = IP6CB(skb)->iif;
+                sin6->sin6_scope_id = ipv6_iface_scope_id(&sin6->sin6_addr,
+                                                          IP6CB(skb)->iif);
         }
 
         sock_recv_ts_and_drops(msg, sk, skb);
@@ -802,7 +801,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
 
                 if (addr_len >= sizeof(struct sockaddr_in6) &&
                     sin6->sin6_scope_id &&
-                    ipv6_addr_type(daddr)&IPV6_ADDR_LINKLOCAL)
+                    __ipv6_addr_needs_scope_id(__ipv6_addr_type(daddr)))
                         fl6.flowi6_oif = sin6->sin6_scope_id;
         } else {
                 if (sk->sk_state != TCP_ESTABLISHED)
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 196ab9347ad1..e6e44cef8db2 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -58,6 +58,7 @@
 #include <net/ndisc.h>
 #include <net/addrconf.h>
 #include <net/inet_frag.h>
+#include <net/inet_ecn.h>
 
 struct ip6frag_skb_cb
 {
@@ -67,6 +68,10 @@ struct ip6frag_skb_cb
 
 #define FRAG6_CB(skb)   ((struct ip6frag_skb_cb*)((skb)->cb))
 
+static inline u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h)
+{
+        return 1 << (ipv6_get_dsfield(ipv6h) & INET_ECN_MASK);
+}
 
 static struct inet_frags ip6_frags;
 
@@ -119,6 +124,7 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a)
         fq->user = arg->user;
         fq->saddr = *arg->src;
         fq->daddr = *arg->dst;
+        fq->ecn = arg->ecn;
 }
 EXPORT_SYMBOL(ip6_frag_init);
 
@@ -173,7 +179,8 @@ static void ip6_frag_expire(unsigned long data)
 }
 
 static __inline__ struct frag_queue *
-fq_find(struct net *net, __be32 id, const struct in6_addr *src, const struct in6_addr *dst)
+fq_find(struct net *net, __be32 id, const struct in6_addr *src,
+        const struct in6_addr *dst, u8 ecn)
 {
         struct inet_frag_queue *q;
         struct ip6_create_arg arg;
@@ -183,6 +190,7 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src, const struct in6
         arg.user = IP6_DEFRAG_LOCAL_DELIVER;
         arg.src = src;
         arg.dst = dst;
+        arg.ecn = ecn;
 
         read_lock(&ip6_frags.lock);
         hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd);
@@ -202,6 +210,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
         struct net_device *dev;
         int offset, end;
         struct net *net = dev_net(skb_dst(skb)->dev);
+        u8 ecn;
 
         if (fq->q.last_in & INET_FRAG_COMPLETE)
                 goto err;
@@ -219,6 +228,8 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                 return -1;
         }
 
+        ecn = ip6_frag_ecn(ipv6_hdr(skb));
+
         if (skb->ip_summed == CHECKSUM_COMPLETE) {
                 const unsigned char *nh = skb_network_header(skb);
                 skb->csum = csum_sub(skb->csum,
@@ -319,6 +330,7 @@ found:
         }
         fq->q.stamp = skb->tstamp;
         fq->q.meat += skb->len;
+        fq->ecn |= ecn;
         add_frag_mem_limit(&fq->q, skb->truesize);
 
         /* The first fragment.
@@ -362,9 +374,14 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         int    payload_len;
         unsigned int nhoff;
         int sum_truesize;
+        u8 ecn;
 
         inet_frag_kill(&fq->q, &ip6_frags);
 
+        ecn = ip_frag_ecn_table[fq->ecn];
+        if (unlikely(ecn == 0xff))
+                goto out_fail;
+
         /* Make the one we just received the head. */
         if (prev) {
                 head = prev->next;
@@ -463,6 +480,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         head->dev = dev;
         head->tstamp = fq->q.stamp;
         ipv6_hdr(head)->payload_len = htons(payload_len);
+        ipv6_change_dsfield(ipv6_hdr(head), 0xff, ecn);
         IP6CB(head)->nhoff = nhoff;
 
         /* Yes, and fold redundant checksum back. 8) */
@@ -526,7 +544,8 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
                 IP6_ADD_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
                                  IPSTATS_MIB_REASMFAILS, evicted);
 
-        fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr);
+        fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr,
+                     ip6_frag_ecn(hdr));
         if (fq != NULL) {
                 int ret;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e5fe0041adfa..ad0aa6b0b86a 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2355,7 +2355,7 @@ beginning:
         return last_err;
 }
 
-static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
+static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh)
 {
         struct fib6_config cfg;
         int err;
@@ -2370,7 +2370,7 @@ static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *a
                 return ip6_route_del(&cfg);
 }
 
-static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
+static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh)
 {
         struct fib6_config cfg;
         int err;
@@ -2562,7 +2562,7 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
                      prefix, 0, NLM_F_MULTI);
 }
 
-static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
+static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh)
 {
         struct net *net = sock_net(in_skb->sk);
         struct nlattr *tb[RTA_MAX+1];
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 02f96dcbcf02..335363478bbf 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -49,7 +49,7 @@
 #include <net/ip.h>
 #include <net/udp.h>
 #include <net/icmp.h>
-#include <net/ipip.h>
+#include <net/ip_tunnels.h>
 #include <net/inet_ecn.h>
 #include <net/xfrm.h>
 #include <net/dsfield.h>
@@ -87,41 +87,6 @@ struct sit_net {
         struct net_device *fb_tunnel_dev;
 };
 
-static struct rtnl_link_stats64 *ipip6_get_stats64(struct net_device *dev,
-                                                   struct rtnl_link_stats64 *tot)
-{
-        int i;
-
-        for_each_possible_cpu(i) {
-                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
-                u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
-                unsigned int start;
-
-                do {
-                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
-                        rx_packets = tstats->rx_packets;
-                        tx_packets = tstats->tx_packets;
-                        rx_bytes = tstats->rx_bytes;
-                        tx_bytes = tstats->tx_bytes;
-                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
-
-                tot->rx_packets += rx_packets;
-                tot->tx_packets += tx_packets;
-                tot->rx_bytes   += rx_bytes;
-                tot->tx_bytes   += tx_bytes;
-        }
-
-        tot->rx_errors = dev->stats.rx_errors;
-        tot->rx_frame_errors = dev->stats.rx_frame_errors;
-        tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
-        tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
-        tot->tx_dropped = dev->stats.tx_dropped;
-        tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
-        tot->tx_errors = dev->stats.tx_errors;
-
-        return tot;
-}
-
 /*
  * Must be invoked with rcu_read_lock
  */
@@ -899,6 +864,8 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         if ((iph->ttl = tiph->ttl) == 0)
                 iph->ttl        =       iph6->hop_limit;
 
+        skb->ip_summed = CHECKSUM_NONE;
+        ip_select_ident(iph, skb_dst(skb), NULL);
         iptunnel_xmit(skb, dev);
         return NETDEV_TX_OK;
 
@@ -1200,7 +1167,7 @@ static const struct net_device_ops ipip6_netdev_ops = {
         .ndo_start_xmit = ipip6_tunnel_xmit,
         .ndo_do_ioctl   = ipip6_tunnel_ioctl,
         .ndo_change_mtu = ipip6_tunnel_change_mtu,
-        .ndo_get_stats64= ipip6_get_stats64,
+        .ndo_get_stats64 = ip_tunnel_get_stats64,
 };
 
 static void ipip6_dev_free(struct net_device *dev)
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 8a0848b60b35..d5dda20bd717 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -149,7 +149,6 @@ static inline int cookie_check(const struct sk_buff *skb, __u32 cookie)
 struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_options_received tcp_opt;
-        const u8 *hash_location;
         struct inet_request_sock *ireq;
         struct inet6_request_sock *ireq6;
         struct tcp_request_sock *treq;
@@ -177,7 +176,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         /* check for timestamp cookie support */
         memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, &hash_location, 0, NULL);
+        tcp_parse_options(skb, &tcp_opt, 0, NULL);
 
         if (!cookie_check_timestamp(&tcp_opt, sock_net(sk), &ecn_ok))
                 goto out;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f6d629fd6aee..1033d2b1d81e 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -461,7 +461,6 @@ out:
 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
                               struct flowi6 *fl6,
                               struct request_sock *req,
-                              struct request_values *rvp,
                               u16 queue_mapping)
 {
         struct inet6_request_sock *treq = inet6_rsk(req);
@@ -473,7 +472,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
         if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
                 goto done;
 
-        skb = tcp_make_synack(sk, dst, req, rvp, NULL);
+        skb = tcp_make_synack(sk, dst, req, NULL);
 
         if (skb) {
                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
@@ -488,13 +487,12 @@ done:
         return err;
 }
 
-static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
-                             struct request_values *rvp)
+static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req)
 {
         struct flowi6 fl6;
         int res;
 
-        res = tcp_v6_send_synack(sk, NULL, &fl6, req, rvp, 0);
+        res = tcp_v6_send_synack(sk, NULL, &fl6, req, 0);
         if (!res)
                 TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
         return res;
@@ -947,9 +945,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
  */
 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 {
-        struct tcp_extend_values tmp_ext;
         struct tcp_options_received tmp_opt;
-        const u8 *hash_location;
         struct request_sock *req;
         struct inet6_request_sock *treq;
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -987,50 +983,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
         tmp_opt.user_mss = tp->rx_opt.user_mss;
-        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, NULL);
-
-        if (tmp_opt.cookie_plus > 0 &&
-            tmp_opt.saw_tstamp &&
-            !tp->rx_opt.cookie_out_never &&
-            (sysctl_tcp_cookie_size > 0 ||
-             (tp->cookie_values != NULL &&
-              tp->cookie_values->cookie_desired > 0))) {
-                u8 *c;
-                u32 *d;
-                u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
-                int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
-
-                if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
-                        goto drop_and_free;
-
-                /* Secret recipe starts with IP addresses */
-                d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
-                *mess++ ^= *d++;
-                *mess++ ^= *d++;
-                *mess++ ^= *d++;
-                *mess++ ^= *d++;
-                d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
-                *mess++ ^= *d++;
-                *mess++ ^= *d++;
-                *mess++ ^= *d++;
-                *mess++ ^= *d++;
-
-                /* plus variable length Initiator Cookie */
-                c = (u8 *)mess;
-                while (l-- > 0)
-                        *c++ ^= *hash_location++;
-
-                want_cookie = false;    /* not our kind of cookie */
-                tmp_ext.cookie_out_never = 0; /* false */
-                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
-        } else if (!tp->rx_opt.cookie_in_always) {
-                /* redundant indications, but ensure initialization. */
-                tmp_ext.cookie_out_never = 1; /* true */
-                tmp_ext.cookie_plus = 0;
-        } else {
-                goto drop_and_free;
-        }
-        tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
+        tcp_parse_options(skb, &tmp_opt, 0, NULL);
 
         if (want_cookie && !tmp_opt.saw_tstamp)
                 tcp_clear_options(&tmp_opt);
@@ -1108,7 +1061,6 @@ have_isn:
                 goto drop_and_release;
 
         if (tcp_v6_send_synack(sk, dst, &fl6, req,
-                               (struct request_values *)&tmp_ext,
                                skb_get_queue_mapping(skb)) ||
             want_cookie)
                 goto drop_and_free;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d8e5e852fc7a..da6019b63730 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -450,15 +450,16 @@ try_again:
                 sin6->sin6_family = AF_INET6;
                 sin6->sin6_port = udp_hdr(skb)->source;
                 sin6->sin6_flowinfo = 0;
-                sin6->sin6_scope_id = 0;
 
-                if (is_udp4)
+                if (is_udp4) {
                         ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
                                                &sin6->sin6_addr);
-                else {
+                        sin6->sin6_scope_id = 0;
+                } else {
                         sin6->sin6_addr = ipv6_hdr(skb)->saddr;
-                        if (ipv6_addr_type(&sin6->sin6_addr) & IPV6_ADDR_LINKLOCAL)
-                                sin6->sin6_scope_id = IP6CB(skb)->iif;
+                        sin6->sin6_scope_id =
+                                ipv6_iface_scope_id(&sin6->sin6_addr,
+                                                    IP6CB(skb)->iif);
                 }
 
         }
@@ -1118,7 +1119,7 @@ do_udp_sendmsg:
 
                 if (addr_len >= sizeof(struct sockaddr_in6) &&
                     sin6->sin6_scope_id &&
-                    ipv6_addr_type(daddr)&IPV6_ADDR_LINKLOCAL)
+                    __ipv6_addr_needs_scope_id(__ipv6_addr_type(daddr)))
                         fl6.flowi6_oif = sin6->sin6_scope_id;
         } else {
                 if (sk->sk_state != TCP_ESTABLISHED)
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index cf05cf073c51..3bb3a891a424 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -21,6 +21,10 @@ static int udp6_ufo_send_check(struct sk_buff *skb)
         const struct ipv6hdr *ipv6h;
         struct udphdr *uh;
 
+        /* UDP Tunnel offload on ipv6 is not yet supported. */
+        if (skb->encapsulation)
+                return -EINVAL;
+
         if (!pskb_may_pull(skb, sizeof(*uh)))
                 return -EINVAL;
 
@@ -56,7 +60,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 /* Packet is from an untrusted source, reset gso_segs. */
                 int type = skb_shinfo(skb)->gso_type;
 
-                if (unlikely(type & ~(SKB_GSO_UDP | SKB_GSO_DODGY |
+                if (unlikely(type & ~(SKB_GSO_UDP |
+                                      SKB_GSO_DODGY |
+                                      SKB_GSO_UDP_TUNNEL |
                                       SKB_GSO_GRE) ||
                              !(type & (SKB_GSO_UDP))))
                         goto out;