60 files changed, 3864 insertions, 1680 deletions
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index e923d4dea418..a2d211da2aba 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -77,6 +77,7 @@ config INET6_ESP
        select CRYPTO
        select CRYPTO_HMAC
        select CRYPTO_MD5
+        select CRYPTO_CBC
        select CRYPTO_SHA1
        select CRYPTO_DES
        ---help---
@@ -97,6 +98,15 @@ config INET6_IPCOMP
          If unsure, say Y.
+config IPV6_MIP6
+        bool "IPv6: Mobility (EXPERIMENTAL)"
+        depends on IPV6 && EXPERIMENTAL
+        select XFRM
+        ---help---
+          Support for IPv6 Mobility described in RFC 3775.
+          If unsure, say N.
 config INET6_XFRM_TUNNEL
        tristate
        select INET6_TUNNEL
@@ -126,6 +136,13 @@ config INET6_XFRM_MODE_TUNNEL
          If unsure, say Y.
+config INET6_XFRM_MODE_ROUTEOPTIMIZATION
+        tristate "IPv6: MIPv6 route optimization mode (EXPERIMENTAL)"
+        depends on IPV6 && EXPERIMENTAL
+        select XFRM
+        ---help---
+          Support for MIPv6 route optimization mode.
 config IPV6_TUNNEL
        tristate "IPv6: IPv6-in-IPv6 tunnel"
        select INET6_TUNNEL
@@ -135,3 +152,31 @@ config IPV6_TUNNEL
          If unsure, say N.
+config IPV6_SUBTREES
+        bool "IPv6: source address based routing"
+        depends on IPV6 && EXPERIMENTAL
+        ---help---
+          Enable routing by source address or prefix.
+          The destination address is still the primary routing key, so mixing
+          normal and source prefix specific routes in the same routing table
+          may sometimes lead to unintended routing behavior.  This can be
+          avoided by defining different routing tables for the normal and
+          source prefix specific routes.
+          If unsure, say N.
+config IPV6_MULTIPLE_TABLES
+        bool "IPv6: Multiple Routing Tables"
+        depends on IPV6 && EXPERIMENTAL
+        select FIB_RULES
+        ---help---
+          Support multiple routing tables.
+config IPV6_ROUTE_FWMARK
+        bool "IPv6: use netfilter MARK value as routing key"
+        depends on IPV6_MULTIPLE_TABLES && NETFILTER
+        ---help---
+          If you say Y here, you will be able to specify different routes for
+          packets with different mark values (see iptables(8), MARK target).
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 386e0a626948..0213c6612b58 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -13,6 +13,9 @@ ipv6-objs :=	af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o sit.o \
 ipv6-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o \
        xfrm6_output.o
 ipv6-$(CONFIG_NETFILTER) += netfilter.o
+ipv6-$(CONFIG_IPV6_MULTIPLE_TABLES) += fib6_rules.o
+ipv6-$(CONFIG_IPV6_MIP6) += mip6.o
 ipv6-objs += $(ipv6-y)
 obj-$(CONFIG_INET6_AH) += ah6.o
@@ -22,6 +25,7 @@ obj-$(CONFIG_INET6_XFRM_TUNNEL) += xfrm6_tunnel.o
 obj-$(CONFIG_INET6_TUNNEL) += tunnel6.o
 obj-$(CONFIG_INET6_XFRM_MODE_TRANSPORT) += xfrm6_mode_transport.o
 obj-$(CONFIG_INET6_XFRM_MODE_TUNNEL) += xfrm6_mode_tunnel.o
+obj-$(CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION) += xfrm6_mode_ro.o
 obj-$(CONFIG_NETFILTER) += netfilter/
 obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 4da664538f52..e03c33b2465b 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -40,7 +40,6 @@
 *                                              status etc.
 */
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -49,6 +48,7 @@
 #include <linux/net.h>
 #include <linux/in6.h>
 #include <linux/netdevice.h>
+#include <linux/if_addr.h>
 #include <linux/if_arp.h>
 #include <linux/if_arcnet.h>
 #include <linux/if_infiniband.h>
@@ -73,6 +73,7 @@
 #include <net/addrconf.h>
 #include <net/tcp.h>
 #include <net/ip.h>
+#include <net/netlink.h>
 #include <linux/if_tunnel.h>
 #include <linux/rtnetlink.h>
@@ -118,9 +119,6 @@ static int ipv6_count_addresses(struct inet6_dev *idev);
 static struct inet6_ifaddr              *inet6_addr_lst[IN6_ADDR_HSIZE];
 static DEFINE_RWLOCK(addrconf_hash_lock);
-/* Protects inet6 devices */
-DEFINE_RWLOCK(addrconf_lock);
 static void addrconf_verify(unsigned long);
 static DEFINE_TIMER(addr_chk_timer, addrconf_verify, 0, 0);
@@ -145,7 +143,7 @@ static int ipv6_chk_same_addr(const struct in6_addr *addr, struct net_device *de
 static ATOMIC_NOTIFIER_HEAD(inet6addr_chain);
-struct ipv6_devconf ipv6_devconf = {
+struct ipv6_devconf ipv6_devconf __read_mostly = {
        .forwarding             = 0,
        .hop_limit              = IPV6_DEFAULT_HOPLIMIT,
        .mtu6                   = IPV6_MIN_MTU,
@@ -174,9 +172,10 @@ struct ipv6_devconf ipv6_devconf = {
        .accept_ra_rt_info_max_plen = 0,
 #endif
 #endif
+        .proxy_ndp              = 0,
 };
-static struct ipv6_devconf ipv6_devconf_dflt = {
+static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
        .forwarding             = 0,
        .hop_limit              = IPV6_DEFAULT_HOPLIMIT,
        .mtu6                   = IPV6_MIN_MTU,
@@ -204,6 +203,7 @@ static struct ipv6_devconf ipv6_devconf_dflt = {
        .accept_ra_rt_info_max_plen = 0,
 #endif
 #endif
+        .proxy_ndp              = 0,
 };
 /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
@@ -315,6 +315,12 @@ static void addrconf_mod_timer(struct inet6_ifaddr *ifp,
 /* Nobody refers to this device, we may destroy it. */
+static void in6_dev_finish_destroy_rcu(struct rcu_head *head)
+{
+        struct inet6_dev *idev = container_of(head, struct inet6_dev, rcu);
+        kfree(idev);
+}
 void in6_dev_finish_destroy(struct inet6_dev *idev)
 {
        struct net_device *dev = idev->dev;
@@ -329,7 +335,7 @@ void in6_dev_finish_destroy(struct inet6_dev *idev)
                return;
        }
        snmp6_free_dev(idev);
-        kfree(idev);
+        call_rcu(&idev->rcu, in6_dev_finish_destroy_rcu);
 }
 static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
@@ -405,9 +411,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
        if (netif_carrier_ok(dev))
                ndev->if_flags |= IF_READY;
-        write_lock_bh(&addrconf_lock);
+        /* protected by rtnl_lock */
-        dev->ip6_ptr = ndev;
+        rcu_assign_pointer(dev->ip6_ptr, ndev);
-        write_unlock_bh(&addrconf_lock);
        ipv6_mc_init_dev(ndev);
        ndev->tstamp = jiffies;
@@ -471,7 +476,7 @@ static void addrconf_forward_change(void)
        read_lock(&dev_base_lock);
        for (dev=dev_base; dev; dev=dev->next) {
-                read_lock(&addrconf_lock);
+                rcu_read_lock();
                idev = __in6_dev_get(dev);
                if (idev) {
                        int changed = (!idev->cnf.forwarding) ^ (!ipv6_devconf.forwarding);
@@ -479,7 +484,7 @@ static void addrconf_forward_change(void)
                        if (changed)
                                dev_forward_change(idev);
                }
-                read_unlock(&addrconf_lock);
+                rcu_read_unlock();
        }
        read_unlock(&dev_base_lock);
 }
@@ -509,6 +514,26 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
        kfree(ifp);
 }
+static void
+ipv6_link_dev_addr(struct inet6_dev *idev, struct inet6_ifaddr *ifp)
+{
+        struct inet6_ifaddr *ifa, **ifap;
+        int ifp_scope = ipv6_addr_src_scope(&ifp->addr);
+        /*
+         * Each device address list is sorted in order of scope -
+         * global before linklocal.
+         */
+        for (ifap = &idev->addr_list; (ifa = *ifap) != NULL;
+             ifap = &ifa->if_next) {
+                if (ifp_scope >= ipv6_addr_src_scope(&ifa->addr))
+                        break;
+        }
+        ifp->if_next = *ifap;
+        *ifap = ifp;
+}
 /* On success it returns ifp with increased reference count */
 static struct inet6_ifaddr *
@@ -520,7 +545,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
        int hash;
        int err = 0;
-        read_lock_bh(&addrconf_lock);
+        rcu_read_lock_bh();
        if (idev->dead) {
                err = -ENODEV;                  /*XXX*/
                goto out2;
@@ -559,6 +584,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
        ifa->flags = flags | IFA_F_TENTATIVE;
        ifa->cstamp = ifa->tstamp = jiffies;
+        ifa->rt = rt;
        ifa->idev = idev;
        in6_dev_hold(idev);
        /* For caller */
@@ -574,8 +601,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
        write_lock(&idev->lock);
        /* Add to inet6_dev unicast addr list. */
-        ifa->if_next = idev->addr_list;
+        ipv6_link_dev_addr(idev, ifa);
-        idev->addr_list = ifa;
 #ifdef CONFIG_IPV6_PRIVACY
        if (ifa->flags&IFA_F_TEMPORARY) {
@@ -585,12 +611,10 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
        }
 #endif
-        ifa->rt = rt;
        in6_ifa_hold(ifa);
        write_unlock(&idev->lock);
 out2:
-        read_unlock_bh(&addrconf_lock);
+        rcu_read_unlock_bh();
        if (likely(err == 0))
                atomic_notifier_call_chain(&inet6addr_chain, NETDEV_UP, ifa);
@@ -716,7 +740,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
                        if (onlink == 0) {
-                                ip6_del_rt(rt, NULL, NULL, NULL);
+                                ip6_del_rt(rt);
                                rt = NULL;
                        } else if (!(rt->rt6i_flags & RTF_EXPIRES)) {
                                rt->rt6i_expires = expires;
@@ -893,7 +917,7 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
        memset(&hiscore, 0, sizeof(hiscore));
        read_lock(&dev_base_lock);
-        read_lock(&addrconf_lock);
+        rcu_read_lock();
        for (dev = dev_base; dev; dev=dev->next) {
                struct inet6_dev *idev;
@@ -988,7 +1012,7 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
                                        continue;
                        } else if (score.scope < hiscore.scope) {
                                if (score.scope < daddr_scope)
-                                        continue;
+                                        break; /* addresses sorted by scope */
                                else {
                                        score.rule = 2;
                                        goto record_it;
@@ -1014,9 +1038,27 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
                                        continue;
                        }
-                        /* Rule 4: Prefer home address -- not implemented yet */
+                        /* Rule 4: Prefer home address */
+#ifdef CONFIG_IPV6_MIP6
+                        if (hiscore.rule < 4) {
+                                if (ifa_result->flags & IFA_F_HOMEADDRESS)
+                                        hiscore.attrs |= IPV6_SADDR_SCORE_HOA;
+                                hiscore.rule++;
+                        }
+                        if (ifa->flags & IFA_F_HOMEADDRESS) {
+                                score.attrs |= IPV6_SADDR_SCORE_HOA;
+                                if (!(ifa_result->flags & IFA_F_HOMEADDRESS)) {
+                                        score.rule = 4;
+                                        goto record_it;
+                                }
+                        } else {
+                                if (hiscore.attrs & IPV6_SADDR_SCORE_HOA)
+                                        continue;
+                        }
+#else
                        if (hiscore.rule < 4)
                                hiscore.rule++;
+#endif
                        /* Rule 5: Prefer outgoing interface */
                        if (hiscore.rule < 5) {
@@ -1105,7 +1147,7 @@ record_it:
                }
                read_unlock_bh(&idev->lock);
        }
-        read_unlock(&addrconf_lock);
+        rcu_read_unlock();
        read_unlock(&dev_base_lock);
        if (!ifa_result)
@@ -1129,7 +1171,7 @@ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr)
        struct inet6_dev *idev;
        int err = -EADDRNOTAVAIL;
-        read_lock(&addrconf_lock);
+        rcu_read_lock();
        if ((idev = __in6_dev_get(dev)) != NULL) {
                struct inet6_ifaddr *ifp;
@@ -1143,7 +1185,7 @@ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr)
                }
                read_unlock_bh(&idev->lock);
        }
-        read_unlock(&addrconf_lock);
+        rcu_read_unlock();
        return err;
 }
@@ -1216,8 +1258,8 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
        const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
        const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
-        u32 sk_rcv_saddr = inet_sk(sk)->rcv_saddr;
+        __be32 sk_rcv_saddr = inet_sk(sk)->rcv_saddr;
-        u32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
+        __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
        int sk_ipv6only = ipv6_only_sock(sk);
        int sk2_ipv6only = inet_v6_ipv6only(sk2);
        int addr_type = ipv6_addr_type(sk_rcv_saddr6);
@@ -1444,7 +1486,7 @@ static void ipv6_regen_rndid(unsigned long data)
        struct inet6_dev *idev = (struct inet6_dev *) data;
        unsigned long expires;
-        read_lock_bh(&addrconf_lock);
+        rcu_read_lock_bh();
        write_lock_bh(&idev->lock);
        if (idev->dead)
@@ -1468,7 +1510,7 @@ static void ipv6_regen_rndid(unsigned long data)
 out:
        write_unlock_bh(&idev->lock);
-        read_unlock_bh(&addrconf_lock);
+        rcu_read_unlock_bh();
        in6_dev_put(idev);
 }
@@ -1489,59 +1531,56 @@ static void
 addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
                      unsigned long expires, u32 flags)
 {
-        struct in6_rtmsg rtmsg;
+        struct fib6_config cfg = {
+                .fc_table = RT6_TABLE_PREFIX,
+                .fc_metric = IP6_RT_PRIO_ADDRCONF,
+                .fc_ifindex = dev->ifindex,
+                .fc_expires = expires,
+                .fc_dst_len = plen,
+                .fc_flags = RTF_UP | flags,
+        };
-        memset(&rtmsg, 0, sizeof(rtmsg));
+        ipv6_addr_copy(&cfg.fc_dst, pfx);
-        ipv6_addr_copy(&rtmsg.rtmsg_dst, pfx);
-        rtmsg.rtmsg_dst_len = plen;
-        rtmsg.rtmsg_metric = IP6_RT_PRIO_ADDRCONF;
-        rtmsg.rtmsg_ifindex = dev->ifindex;
-        rtmsg.rtmsg_info = expires;
-        rtmsg.rtmsg_flags = RTF_UP|flags;
-        rtmsg.rtmsg_type = RTMSG_NEWROUTE;
        /* Prevent useless cloning on PtP SIT.
           This thing is done here expecting that the whole
           class of non-broadcast devices need not cloning.
         */
-        if (dev->type == ARPHRD_SIT && (dev->flags&IFF_POINTOPOINT))
+        if (dev->type == ARPHRD_SIT && (dev->flags & IFF_POINTOPOINT))
-                rtmsg.rtmsg_flags |= RTF_NONEXTHOP;
+                cfg.fc_flags |= RTF_NONEXTHOP;
-        ip6_route_add(&rtmsg, NULL, NULL, NULL);
+        ip6_route_add(&cfg);
 }
 /* Create "default" multicast route to the interface */
 static void addrconf_add_mroute(struct net_device *dev)
 {
-        struct in6_rtmsg rtmsg;
+        struct fib6_config cfg = {
+                .fc_table = RT6_TABLE_LOCAL,
+                .fc_metric = IP6_RT_PRIO_ADDRCONF,
+                .fc_ifindex = dev->ifindex,
+                .fc_dst_len = 8,
+                .fc_flags = RTF_UP,
+        };
+        ipv6_addr_set(&cfg.fc_dst, htonl(0xFF000000), 0, 0, 0);
-        memset(&rtmsg, 0, sizeof(rtmsg));
+        ip6_route_add(&cfg);
-        ipv6_addr_set(&rtmsg.rtmsg_dst,
-                      htonl(0xFF000000), 0, 0, 0);
-        rtmsg.rtmsg_dst_len = 8;
-        rtmsg.rtmsg_metric = IP6_RT_PRIO_ADDRCONF;
-        rtmsg.rtmsg_ifindex = dev->ifindex;
-        rtmsg.rtmsg_flags = RTF_UP;
-        rtmsg.rtmsg_type = RTMSG_NEWROUTE;
-        ip6_route_add(&rtmsg, NULL, NULL, NULL);
 }
 static void sit_route_add(struct net_device *dev)
 {
-        struct in6_rtmsg rtmsg;
+        struct fib6_config cfg = {
+                .fc_table = RT6_TABLE_MAIN,
-        memset(&rtmsg, 0, sizeof(rtmsg));
+                .fc_metric = IP6_RT_PRIO_ADDRCONF,
+                .fc_ifindex = dev->ifindex,
-        rtmsg.rtmsg_type        = RTMSG_NEWROUTE;
+                .fc_dst_len = 96,
-        rtmsg.rtmsg_metric      = IP6_RT_PRIO_ADDRCONF;
+                .fc_flags = RTF_UP | RTF_NONEXTHOP,
+        };
        /* prefix length - 96 bits "::d.d.d.d" */
-        rtmsg.rtmsg_dst_len     = 96;
+        ip6_route_add(&cfg);
-        rtmsg.rtmsg_flags       = RTF_UP|RTF_NONEXTHOP;
-        rtmsg.rtmsg_ifindex     = dev->ifindex;
-        ip6_route_add(&rtmsg, NULL, NULL, NULL);
 }
 static void addrconf_add_lroute(struct net_device *dev)
@@ -1642,7 +1681,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
                        if (rt->rt6i_flags&RTF_EXPIRES) {
                                if (valid_lft == 0) {
-                                        ip6_del_rt(rt, NULL, NULL, NULL);
+                                        ip6_del_rt(rt);
                                        rt = NULL;
                                } else {
                                        rt->rt6i_expires = jiffies + rt_expires;
@@ -1851,7 +1890,8 @@ err_exit:
 /*
 *      Manual configuration of address on an interface
 */
-static int inet6_addr_add(int ifindex, struct in6_addr *pfx, int plen)
+static int inet6_addr_add(int ifindex, struct in6_addr *pfx, int plen,
+                          __u8 ifa_flags, __u32 prefered_lft, __u32 valid_lft)
 {
        struct inet6_ifaddr *ifp;
        struct inet6_dev *idev;
@@ -1860,21 +1900,41 @@ static int inet6_addr_add(int ifindex, struct in6_addr *pfx, int plen)
        ASSERT_RTNL();
        
+        /* check the lifetime */
+        if (!valid_lft || prefered_lft > valid_lft)
+                return -EINVAL;
        if ((dev = __dev_get_by_index(ifindex)) == NULL)
                return -ENODEV;
        
-        if (!(dev->flags&IFF_UP))
-                return -ENETDOWN;
        if ((idev = addrconf_add_dev(dev)) == NULL)
                return -ENOBUFS;
        scope = ipv6_addr_scope(pfx);
-        ifp = ipv6_add_addr(idev, pfx, plen, scope, IFA_F_PERMANENT);
+        if (valid_lft == INFINITY_LIFE_TIME)
+                ifa_flags |= IFA_F_PERMANENT;
+        else if (valid_lft >= 0x7FFFFFFF/HZ)
+                valid_lft = 0x7FFFFFFF/HZ;
+        if (prefered_lft == 0)
+                ifa_flags |= IFA_F_DEPRECATED;
+        else if ((prefered_lft >= 0x7FFFFFFF/HZ) &&
+                 (prefered_lft != INFINITY_LIFE_TIME))
+                prefered_lft = 0x7FFFFFFF/HZ;
+        ifp = ipv6_add_addr(idev, pfx, plen, scope, ifa_flags);
        if (!IS_ERR(ifp)) {
+                spin_lock_bh(&ifp->lock);
+                ifp->valid_lft = valid_lft;
+                ifp->prefered_lft = prefered_lft;
+                ifp->tstamp = jiffies;
+                spin_unlock_bh(&ifp->lock);
                addrconf_dad_start(ifp, 0);
                in6_ifa_put(ifp);
+                addrconf_verify(0);
                return 0;
        }
@@ -1927,7 +1987,8 @@ int addrconf_add_ifaddr(void __user *arg)
                return -EFAULT;
        rtnl_lock();
-        err = inet6_addr_add(ireq.ifr6_ifindex, &ireq.ifr6_addr, ireq.ifr6_prefixlen);
+        err = inet6_addr_add(ireq.ifr6_ifindex, &ireq.ifr6_addr, ireq.ifr6_prefixlen,
+                             IFA_F_PERMANENT, INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
        rtnl_unlock();
        return err;
 }
@@ -2300,10 +2361,10 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                   Do not dev_put!
         */
        if (how == 1) {
-                write_lock_bh(&addrconf_lock);
-                dev->ip6_ptr = NULL;
                idev->dead = 1;
-                write_unlock_bh(&addrconf_lock);
+                /* protected by rtnl_lock */
+                rcu_assign_pointer(dev->ip6_ptr, NULL);
                /* Step 1.5: remove snmp6 entry */
                snmp6_unregister_dev(idev);
@@ -2470,7 +2531,8 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
        spin_lock_bh(&ifp->lock);
        if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
-            !(ifp->flags&IFA_F_TENTATIVE)) {
+            !(ifp->flags&IFA_F_TENTATIVE) ||
+            ifp->flags & IFA_F_NODAD) {
                ifp->flags &= ~IFA_F_TENTATIVE;
                spin_unlock_bh(&ifp->lock);
                read_unlock_bh(&idev->lock);
@@ -2715,6 +2777,26 @@ void if6_proc_exit(void)
 }
 #endif  /* CONFIG_PROC_FS */
+#ifdef CONFIG_IPV6_MIP6
+/* Check if address is a home address configured on any interface. */
+int ipv6_chk_home_addr(struct in6_addr *addr)
+{
+        int ret = 0;
+        struct inet6_ifaddr * ifp;
+        u8 hash = ipv6_addr_hash(addr);
+        read_lock_bh(&addrconf_hash_lock);
+        for (ifp = inet6_addr_lst[hash]; ifp; ifp = ifp->lst_next) {
+                if (ipv6_addr_cmp(&ifp->addr, addr) == 0 &&
+                    (ifp->flags & IFA_F_HOMEADDRESS)) {
+                        ret = 1;
+                        break;
+                }
+        }
+        read_unlock_bh(&addrconf_hash_lock);
+        return ret;
+}
+#endif
 /*
 *      Periodic address status verification
 */
@@ -2753,12 +2835,16 @@ restart:
                                        ifp->idev->nd_parms->retrans_time / HZ;
 #endif
-                        if (age >= ifp->valid_lft) {
+                        if (ifp->valid_lft != INFINITY_LIFE_TIME &&
+                            age >= ifp->valid_lft) {
                                spin_unlock(&ifp->lock);
                                in6_ifa_hold(ifp);
                                read_unlock(&addrconf_hash_lock);
                                ipv6_del_addr(ifp);
                                goto restart;
+                        } else if (ifp->prefered_lft == INFINITY_LIFE_TIME) {
+                                spin_unlock(&ifp->lock);
+                                continue;
                        } else if (age >= ifp->prefered_lft) {
                                /* jiffies - ifp->tsamp > age >= ifp->prefered_lft */
                                int deprecate = 0;
@@ -2821,178 +2907,267 @@ restart:
        spin_unlock_bh(&addrconf_verify_lock);
 }
+static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local)
+{
+        struct in6_addr *pfx = NULL;
+        if (addr)
+                pfx = nla_data(addr);
+        if (local) {
+                if (pfx && nla_memcmp(local, pfx, sizeof(*pfx)))
+                        pfx = NULL;
+                else
+                        pfx = nla_data(local);
+        }
+        return pfx;
+}
+static struct nla_policy ifa_ipv6_policy[IFA_MAX+1] __read_mostly = {
+        [IFA_ADDRESS]           = { .len = sizeof(struct in6_addr) },
+        [IFA_LOCAL]             = { .len = sizeof(struct in6_addr) },
+        [IFA_CACHEINFO]         = { .len = sizeof(struct ifa_cacheinfo) },
+};
 static int
 inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 {
-        struct rtattr **rta = arg;
+        struct ifaddrmsg *ifm;
-        struct ifaddrmsg *ifm = NLMSG_DATA(nlh);
+        struct nlattr *tb[IFA_MAX+1];
        struct in6_addr *pfx;
+        int err;
-        pfx = NULL;
+        err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
-        if (rta[IFA_ADDRESS-1]) {
+        if (err < 0)
-                if (RTA_PAYLOAD(rta[IFA_ADDRESS-1]) < sizeof(*pfx))
+                return err;
-                        return -EINVAL;
-                pfx = RTA_DATA(rta[IFA_ADDRESS-1]);
+        ifm = nlmsg_data(nlh);
-        }
+        pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
-        if (rta[IFA_LOCAL-1]) {
-                if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx)))
-                        return -EINVAL;
-                pfx = RTA_DATA(rta[IFA_LOCAL-1]);
-        }
        if (pfx == NULL)
                return -EINVAL;
        return inet6_addr_del(ifm->ifa_index, pfx, ifm->ifa_prefixlen);
 }
+static int inet6_addr_modify(struct inet6_ifaddr *ifp, u8 ifa_flags,
+                             u32 prefered_lft, u32 valid_lft)
+{
+        if (!valid_lft || (prefered_lft > valid_lft))
+                return -EINVAL;
+        if (valid_lft == INFINITY_LIFE_TIME)
+                ifa_flags |= IFA_F_PERMANENT;
+        else if (valid_lft >= 0x7FFFFFFF/HZ)
+                valid_lft = 0x7FFFFFFF/HZ;
+        if (prefered_lft == 0)
+                ifa_flags |= IFA_F_DEPRECATED;
+        else if ((prefered_lft >= 0x7FFFFFFF/HZ) &&
+                 (prefered_lft != INFINITY_LIFE_TIME))
+                prefered_lft = 0x7FFFFFFF/HZ;
+        spin_lock_bh(&ifp->lock);
+        ifp->flags = (ifp->flags & ~(IFA_F_DEPRECATED | IFA_F_PERMANENT | IFA_F_NODAD | IFA_F_HOMEADDRESS)) | ifa_flags;
+        ifp->tstamp = jiffies;
+        ifp->valid_lft = valid_lft;
+        ifp->prefered_lft = prefered_lft;
+        spin_unlock_bh(&ifp->lock);
+        if (!(ifp->flags&IFA_F_TENTATIVE))
+                ipv6_ifa_notify(0, ifp);
+        addrconf_verify(0);
+        return 0;
+}
 static int
 inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
 {
-        struct rtattr  **rta = arg;
+        struct ifaddrmsg *ifm;
-        struct ifaddrmsg *ifm = NLMSG_DATA(nlh);
+        struct nlattr *tb[IFA_MAX+1];
        struct in6_addr *pfx;
+        struct inet6_ifaddr *ifa;
+        struct net_device *dev;
+        u32 valid_lft = INFINITY_LIFE_TIME, preferred_lft = INFINITY_LIFE_TIME;
+        u8 ifa_flags;
+        int err;
-        pfx = NULL;
+        err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
-        if (rta[IFA_ADDRESS-1]) {
+        if (err < 0)
-                if (RTA_PAYLOAD(rta[IFA_ADDRESS-1]) < sizeof(*pfx))
+                return err;
-                        return -EINVAL;
-                pfx = RTA_DATA(rta[IFA_ADDRESS-1]);
+        ifm = nlmsg_data(nlh);
-        }
+        pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
-        if (rta[IFA_LOCAL-1]) {
-                if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx)))
-                        return -EINVAL;
-                pfx = RTA_DATA(rta[IFA_LOCAL-1]);
-        }
        if (pfx == NULL)
                return -EINVAL;
-        return inet6_addr_add(ifm->ifa_index, pfx, ifm->ifa_prefixlen);
+        if (tb[IFA_CACHEINFO]) {
+                struct ifa_cacheinfo *ci;
+                ci = nla_data(tb[IFA_CACHEINFO]);
+                valid_lft = ci->ifa_valid;
+                preferred_lft = ci->ifa_prefered;
+        } else {
+                preferred_lft = INFINITY_LIFE_TIME;
+                valid_lft = INFINITY_LIFE_TIME;
+        }
+        dev =  __dev_get_by_index(ifm->ifa_index);
+        if (dev == NULL)
+                return -ENODEV;
+        /* We ignore other flags so far. */
+        ifa_flags = ifm->ifa_flags & (IFA_F_NODAD | IFA_F_HOMEADDRESS);
+        ifa = ipv6_get_ifaddr(pfx, dev, 1);
+        if (ifa == NULL) {
+                /*
+                 * It would be best to check for !NLM_F_CREATE here but
+                 * userspace alreay relies on not having to provide this.
+                 */
+                return inet6_addr_add(ifm->ifa_index, pfx, ifm->ifa_prefixlen,
+                                      ifa_flags, preferred_lft, valid_lft);
+        }
+        if (nlh->nlmsg_flags & NLM_F_EXCL ||
+            !(nlh->nlmsg_flags & NLM_F_REPLACE))
+                err = -EEXIST;
+        else
+                err = inet6_addr_modify(ifa, ifa_flags, preferred_lft, valid_lft);
+        in6_ifa_put(ifa);
+        return err;
+}
+static void put_ifaddrmsg(struct nlmsghdr *nlh, u8 prefixlen, u8 flags,
+                          u8 scope, int ifindex)
+{
+        struct ifaddrmsg *ifm;
+        ifm = nlmsg_data(nlh);
+        ifm->ifa_family = AF_INET6;
+        ifm->ifa_prefixlen = prefixlen;
+        ifm->ifa_flags = flags;
+        ifm->ifa_scope = scope;
+        ifm->ifa_index = ifindex;
+}
+static int put_cacheinfo(struct sk_buff *skb, unsigned long cstamp,
+                         unsigned long tstamp, u32 preferred, u32 valid)
+{
+        struct ifa_cacheinfo ci;
+        ci.cstamp = (u32)(TIME_DELTA(cstamp, INITIAL_JIFFIES) / HZ * 100
+                        + TIME_DELTA(cstamp, INITIAL_JIFFIES) % HZ * 100 / HZ);
+        ci.tstamp = (u32)(TIME_DELTA(tstamp, INITIAL_JIFFIES) / HZ * 100
+                        + TIME_DELTA(tstamp, INITIAL_JIFFIES) % HZ * 100 / HZ);
+        ci.ifa_prefered = preferred;
+        ci.ifa_valid = valid;
+        return nla_put(skb, IFA_CACHEINFO, sizeof(ci), &ci);
 }
-/* Maximum length of ifa_cacheinfo attributes */
+static inline int rt_scope(int ifa_scope)
-#define INET6_IFADDR_RTA_SPACE \
+{
-                RTA_SPACE(16) /* IFA_ADDRESS */ + \
+        if (ifa_scope & IFA_HOST)
-                RTA_SPACE(sizeof(struct ifa_cacheinfo)) /* CACHEINFO */
+                return RT_SCOPE_HOST;
+        else if (ifa_scope & IFA_LINK)
+                return RT_SCOPE_LINK;
+        else if (ifa_scope & IFA_SITE)
+                return RT_SCOPE_SITE;
+        else
+                return RT_SCOPE_UNIVERSE;
+}
+static inline int inet6_ifaddr_msgsize(void)
+{
+        return nlmsg_total_size(sizeof(struct ifaddrmsg) +
+                                nla_total_size(16) +
+                                nla_total_size(sizeof(struct ifa_cacheinfo)) +
+                                128);
+}
 static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
                             u32 pid, u32 seq, int event, unsigned int flags)
 {
-        struct ifaddrmsg *ifm;
        struct nlmsghdr  *nlh;
-        struct ifa_cacheinfo ci;
+        u32 preferred, valid;
-        unsigned char    *b = skb->tail;
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
+        if (nlh == NULL)
+                return -ENOBUFS;
+        put_ifaddrmsg(nlh, ifa->prefix_len, ifa->flags, rt_scope(ifa->scope),
+                      ifa->idev->dev->ifindex);
-        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*ifm), flags);
-        ifm = NLMSG_DATA(nlh);
-        ifm->ifa_family = AF_INET6;
-        ifm->ifa_prefixlen = ifa->prefix_len;
-        ifm->ifa_flags = ifa->flags;
-        ifm->ifa_scope = RT_SCOPE_UNIVERSE;
-        if (ifa->scope&IFA_HOST)
-                ifm->ifa_scope = RT_SCOPE_HOST;
-        else if (ifa->scope&IFA_LINK)
-                ifm->ifa_scope = RT_SCOPE_LINK;
-        else if (ifa->scope&IFA_SITE)
-                ifm->ifa_scope = RT_SCOPE_SITE;
-        ifm->ifa_index = ifa->idev->dev->ifindex;
-        RTA_PUT(skb, IFA_ADDRESS, 16, &ifa->addr);
        if (!(ifa->flags&IFA_F_PERMANENT)) {
-                ci.ifa_prefered = ifa->prefered_lft;
+                preferred = ifa->prefered_lft;
-                ci.ifa_valid = ifa->valid_lft;
+                valid = ifa->valid_lft;
-                if (ci.ifa_prefered != INFINITY_LIFE_TIME) {
+                if (preferred != INFINITY_LIFE_TIME) {
                        long tval = (jiffies - ifa->tstamp)/HZ;
-                        ci.ifa_prefered -= tval;
+                        preferred -= tval;
-                        if (ci.ifa_valid != INFINITY_LIFE_TIME)
+                        if (valid != INFINITY_LIFE_TIME)
-                                ci.ifa_valid -= tval;
+                                valid -= tval;
                }
        } else {
-                ci.ifa_prefered = INFINITY_LIFE_TIME;
+                preferred = INFINITY_LIFE_TIME;
-                ci.ifa_valid = INFINITY_LIFE_TIME;
+                valid = INFINITY_LIFE_TIME;
-        }
+        }
-        ci.cstamp = (__u32)(TIME_DELTA(ifa->cstamp, INITIAL_JIFFIES) / HZ * 100
-                    + TIME_DELTA(ifa->cstamp, INITIAL_JIFFIES) % HZ * 100 / HZ);
-        ci.tstamp = (__u32)(TIME_DELTA(ifa->tstamp, INITIAL_JIFFIES) / HZ * 100
-                    + TIME_DELTA(ifa->tstamp, INITIAL_JIFFIES) % HZ * 100 / HZ);
-        RTA_PUT(skb, IFA_CACHEINFO, sizeof(ci), &ci);
-        nlh->nlmsg_len = skb->tail - b;
-        return skb->len;
-nlmsg_failure:
+        if (nla_put(skb, IFA_ADDRESS, 16, &ifa->addr) < 0 ||
-rtattr_failure:
+            put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0)
-        skb_trim(skb, b - skb->data);
+                return nlmsg_cancel(skb, nlh);
-        return -1;
+        return nlmsg_end(skb, nlh);
 }
 static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
                                u32 pid, u32 seq, int event, u16 flags)
 {
-        struct ifaddrmsg *ifm;
        struct nlmsghdr  *nlh;
-        struct ifa_cacheinfo ci;
+        u8 scope = RT_SCOPE_UNIVERSE;
-        unsigned char    *b = skb->tail;
+        int ifindex = ifmca->idev->dev->ifindex;
-        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*ifm), flags);
-        ifm = NLMSG_DATA(nlh);
-        ifm->ifa_family = AF_INET6;     
-        ifm->ifa_prefixlen = 128;
-        ifm->ifa_flags = IFA_F_PERMANENT;
-        ifm->ifa_scope = RT_SCOPE_UNIVERSE;
-        if (ipv6_addr_scope(&ifmca->mca_addr)&IFA_SITE)
-                ifm->ifa_scope = RT_SCOPE_SITE;
-        ifm->ifa_index = ifmca->idev->dev->ifindex;
-        RTA_PUT(skb, IFA_MULTICAST, 16, &ifmca->mca_addr);
-        ci.cstamp = (__u32)(TIME_DELTA(ifmca->mca_cstamp, INITIAL_JIFFIES) / HZ
-                    * 100 + TIME_DELTA(ifmca->mca_cstamp, INITIAL_JIFFIES) % HZ
-                    * 100 / HZ);
-        ci.tstamp = (__u32)(TIME_DELTA(ifmca->mca_tstamp, INITIAL_JIFFIES) / HZ
-                    * 100 + TIME_DELTA(ifmca->mca_tstamp, INITIAL_JIFFIES) % HZ
-                    * 100 / HZ);
-        ci.ifa_prefered = INFINITY_LIFE_TIME;
-        ci.ifa_valid = INFINITY_LIFE_TIME;
-        RTA_PUT(skb, IFA_CACHEINFO, sizeof(ci), &ci);
-        nlh->nlmsg_len = skb->tail - b;
-        return skb->len;
-nlmsg_failure:
+        if (ipv6_addr_scope(&ifmca->mca_addr) & IFA_SITE)
-rtattr_failure:
+                scope = RT_SCOPE_SITE;
-        skb_trim(skb, b - skb->data);
-        return -1;
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
+        if (nlh == NULL)
+                return -ENOBUFS;
+        put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
+        if (nla_put(skb, IFA_MULTICAST, 16, &ifmca->mca_addr) < 0 ||
+            put_cacheinfo(skb, ifmca->mca_cstamp, ifmca->mca_tstamp,
+                          INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0)
+                return nlmsg_cancel(skb, nlh);
+        return nlmsg_end(skb, nlh);
 }
 static int inet6_fill_ifacaddr(struct sk_buff *skb, struct ifacaddr6 *ifaca,
                                u32 pid, u32 seq, int event, unsigned int flags)
 {
-        struct ifaddrmsg *ifm;
        struct nlmsghdr  *nlh;
-        struct ifa_cacheinfo ci;
+        u8 scope = RT_SCOPE_UNIVERSE;
-        unsigned char    *b = skb->tail;
+        int ifindex = ifaca->aca_idev->dev->ifindex;
-        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*ifm), flags);
-        ifm = NLMSG_DATA(nlh);
-        ifm->ifa_family = AF_INET6;     
-        ifm->ifa_prefixlen = 128;
-        ifm->ifa_flags = IFA_F_PERMANENT;
-        ifm->ifa_scope = RT_SCOPE_UNIVERSE;
-        if (ipv6_addr_scope(&ifaca->aca_addr)&IFA_SITE)
-                ifm->ifa_scope = RT_SCOPE_SITE;
-        ifm->ifa_index = ifaca->aca_idev->dev->ifindex;
-        RTA_PUT(skb, IFA_ANYCAST, 16, &ifaca->aca_addr);
-        ci.cstamp = (__u32)(TIME_DELTA(ifaca->aca_cstamp, INITIAL_JIFFIES) / HZ
-                    * 100 + TIME_DELTA(ifaca->aca_cstamp, INITIAL_JIFFIES) % HZ
-                    * 100 / HZ);
-        ci.tstamp = (__u32)(TIME_DELTA(ifaca->aca_tstamp, INITIAL_JIFFIES) / HZ
-                    * 100 + TIME_DELTA(ifaca->aca_tstamp, INITIAL_JIFFIES) % HZ
-                    * 100 / HZ);
-        ci.ifa_prefered = INFINITY_LIFE_TIME;
-        ci.ifa_valid = INFINITY_LIFE_TIME;
-        RTA_PUT(skb, IFA_CACHEINFO, sizeof(ci), &ci);
-        nlh->nlmsg_len = skb->tail - b;
-        return skb->len;
-nlmsg_failure:
+        if (ipv6_addr_scope(&ifaca->aca_addr) & IFA_SITE)
-rtattr_failure:
+                scope = RT_SCOPE_SITE;
-        skb_trim(skb, b - skb->data);
-        return -1;
+        nlh = nlmsg_put(skb, pid, seq, event, sizeof(struct ifaddrmsg), flags);
+        if (nlh == NULL)
+                return -ENOBUFS;
+        put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
+        if (nla_put(skb, IFA_ANYCAST, 16, &ifaca->aca_addr) < 0 ||
+            put_cacheinfo(skb, ifaca->aca_cstamp, ifaca->aca_tstamp,
+                          INFINITY_LIFE_TIME, INFINITY_LIFE_TIME) < 0)
+                return nlmsg_cancel(skb, nlh);
+        return nlmsg_end(skb, nlh);
 }
 enum addr_type_t
@@ -3103,23 +3278,74 @@ static int inet6_dump_ifacaddr(struct sk_buff *skb, struct netlink_callback *cb)
        return inet6_dump_addr(skb, cb, type);
 }
-static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
+static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr* nlh,
+                             void *arg)
 {
+        struct ifaddrmsg *ifm;
+        struct nlattr *tb[IFA_MAX+1];
+        struct in6_addr *addr = NULL;
+        struct net_device *dev = NULL;
+        struct inet6_ifaddr *ifa;
        struct sk_buff *skb;
-        int size = NLMSG_SPACE(sizeof(struct ifaddrmsg) + INET6_IFADDR_RTA_SPACE);
+        int err;
-        skb = alloc_skb(size, GFP_ATOMIC);
+        err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
-        if (!skb) {
+        if (err < 0)
-                netlink_set_err(rtnl, 0, RTNLGRP_IPV6_IFADDR, ENOBUFS);
+                goto errout;
-                return;
+        addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
+        if (addr == NULL) {
+                err = -EINVAL;
+                goto errout;
+        }
+        ifm = nlmsg_data(nlh);
+        if (ifm->ifa_index)
+                dev = __dev_get_by_index(ifm->ifa_index);
+        if ((ifa = ipv6_get_ifaddr(addr, dev, 1)) == NULL) {
+                err = -EADDRNOTAVAIL;
+                goto errout;
        }
-        if (inet6_fill_ifaddr(skb, ifa, current->pid, 0, event, 0) < 0) {
+        if ((skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_KERNEL)) == NULL) {
+                err = -ENOBUFS;
+                goto errout_ifa;
+        }
+        err = inet6_fill_ifaddr(skb, ifa, NETLINK_CB(in_skb).pid,
+                                nlh->nlmsg_seq, RTM_NEWADDR, 0);
+        if (err < 0) {
                kfree_skb(skb);
-                netlink_set_err(rtnl, 0, RTNLGRP_IPV6_IFADDR, EINVAL);
+                goto errout_ifa;
-                return;
+        }
+        err = rtnl_unicast(skb, NETLINK_CB(in_skb).pid);
+errout_ifa:
+        in6_ifa_put(ifa);
+errout:
+        return err;
+}
+static void inet6_ifa_notify(int event, struct inet6_ifaddr *ifa)
+{
+        struct sk_buff *skb;
+        int err = -ENOBUFS;
+        skb = nlmsg_new(inet6_ifaddr_msgsize(), GFP_ATOMIC);
+        if (skb == NULL)
+                goto errout;
+        err = inet6_fill_ifaddr(skb, ifa, 0, 0, event, 0);
+        if (err < 0) {
+                kfree_skb(skb);
+                goto errout;
        }
-        NETLINK_CB(skb).dst_group = RTNLGRP_IPV6_IFADDR;
-        netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV6_IFADDR, GFP_ATOMIC);
+        err = rtnl_notify(skb, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
+errout:
+        if (err < 0)
+                rtnl_set_sk_err(RTNLGRP_IPV6_IFADDR, err);
 }
 static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
@@ -3154,6 +3380,7 @@ static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
        array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
 #endif
 #endif
+        array[DEVCONF_PROXY_NDP] = cnf->proxy_ndp;
 }
 /* Maximum length of ifinfomsg attributes */
@@ -3260,20 +3487,23 @@ static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
 {
        struct sk_buff *skb;
-        int size = NLMSG_SPACE(sizeof(struct ifinfomsg) + INET6_IFINFO_RTA_SPACE);
+        int payload = sizeof(struct ifinfomsg) + INET6_IFINFO_RTA_SPACE;
+        int err = -ENOBUFS;
        
-        skb = alloc_skb(size, GFP_ATOMIC);
+        skb = nlmsg_new(nlmsg_total_size(payload), GFP_ATOMIC);
-        if (!skb) {
+        if (skb == NULL)
-                netlink_set_err(rtnl, 0, RTNLGRP_IPV6_IFINFO, ENOBUFS);
+                goto errout;
-                return;
-        }
+        err = inet6_fill_ifinfo(skb, idev, 0, 0, event, 0);
-        if (inet6_fill_ifinfo(skb, idev, current->pid, 0, event, 0) < 0) {
+        if (err < 0) {
                kfree_skb(skb);
-                netlink_set_err(rtnl, 0, RTNLGRP_IPV6_IFINFO, EINVAL);
+                goto errout;
-                return;
        }
-        NETLINK_CB(skb).dst_group = RTNLGRP_IPV6_IFINFO;
-        netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV6_IFINFO, GFP_ATOMIC);
+        err = rtnl_notify(skb, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC);
+errout:
+        if (err < 0)
+                rtnl_set_sk_err(RTNLGRP_IPV6_IFADDR, err);
 }
 /* Maximum length of prefix_cacheinfo attributes */
@@ -3325,33 +3555,40 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
                         struct prefix_info *pinfo)
 {
        struct sk_buff *skb;
-        int size = NLMSG_SPACE(sizeof(struct prefixmsg) + INET6_PREFIX_RTA_SPACE);
+        int payload = sizeof(struct prefixmsg) + INET6_PREFIX_RTA_SPACE;
+        int err = -ENOBUFS;
-        skb = alloc_skb(size, GFP_ATOMIC);
+        skb = nlmsg_new(nlmsg_total_size(payload), GFP_ATOMIC);
-        if (!skb) {
+        if (skb == NULL)
-                netlink_set_err(rtnl, 0, RTNLGRP_IPV6_PREFIX, ENOBUFS);
+                goto errout;
-                return;
-        }
+        err = inet6_fill_prefix(skb, idev, pinfo, 0, 0, event, 0);
-        if (inet6_fill_prefix(skb, idev, pinfo, current->pid, 0, event, 0) < 0) {
+        if (err < 0) {
                kfree_skb(skb);
-                netlink_set_err(rtnl, 0, RTNLGRP_IPV6_PREFIX, EINVAL);
+                goto errout;
-                return;
        }
-        NETLINK_CB(skb).dst_group = RTNLGRP_IPV6_PREFIX;
-        netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV6_PREFIX, GFP_ATOMIC);
+        err = rtnl_notify(skb, 0, RTNLGRP_IPV6_PREFIX, NULL, GFP_ATOMIC);
+errout:
+        if (err < 0)
+                rtnl_set_sk_err(RTNLGRP_IPV6_PREFIX, err);
 }
 static struct rtnetlink_link inet6_rtnetlink_table[RTM_NR_MSGTYPES] = {
        [RTM_GETLINK - RTM_BASE] = { .dumpit    = inet6_dump_ifinfo, },
        [RTM_NEWADDR - RTM_BASE] = { .doit      = inet6_rtm_newaddr, },
        [RTM_DELADDR - RTM_BASE] = { .doit      = inet6_rtm_deladdr, },
-        [RTM_GETADDR - RTM_BASE] = { .dumpit    = inet6_dump_ifaddr, },
+        [RTM_GETADDR - RTM_BASE] = { .doit      = inet6_rtm_getaddr,
+                                     .dumpit    = inet6_dump_ifaddr, },
        [RTM_GETMULTICAST - RTM_BASE] = { .dumpit = inet6_dump_ifmcaddr, },
        [RTM_GETANYCAST - RTM_BASE] = { .dumpit = inet6_dump_ifacaddr, },
        [RTM_NEWROUTE - RTM_BASE] = { .doit     = inet6_rtm_newroute, },
        [RTM_DELROUTE - RTM_BASE] = { .doit     = inet6_rtm_delroute, },
        [RTM_GETROUTE - RTM_BASE] = { .doit     = inet6_rtm_getroute,
                                      .dumpit   = inet6_dump_fib, },
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+        [RTM_GETRULE  - RTM_BASE] = { .dumpit   = fib6_rules_dump,   },
+#endif
 };
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
@@ -3360,7 +3597,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
        switch (event) {
        case RTM_NEWADDR:
-                ip6_ins_rt(ifp->rt, NULL, NULL, NULL);
+                ip6_ins_rt(ifp->rt);
                if (ifp->idev->cnf.forwarding)
                        addrconf_join_anycast(ifp);
                break;
@@ -3369,7 +3606,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                        addrconf_leave_anycast(ifp);
                addrconf_leave_solict(ifp->idev, &ifp->addr);
                dst_hold(&ifp->rt->u.dst);
-                if (ip6_del_rt(ifp->rt, NULL, NULL, NULL))
+                if (ip6_del_rt(ifp->rt))
                        dst_free(&ifp->rt->u.dst);
                break;
        }
@@ -3377,10 +3614,10 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 {
-        read_lock_bh(&addrconf_lock);
+        rcu_read_lock_bh();
        if (likely(ifp->idev->dead == 0))
                __ipv6_ifa_notify(event, ifp);
-        read_unlock_bh(&addrconf_lock);
+        rcu_read_unlock_bh();
 }
 #ifdef CONFIG_SYSCTL
@@ -3477,7 +3714,7 @@ static struct addrconf_sysctl_table
        ctl_table addrconf_conf_dir[2];
        ctl_table addrconf_proto_dir[2];
        ctl_table addrconf_root_dir[2];
-} addrconf_sysctl = {
+} addrconf_sysctl __read_mostly = {
        .sysctl_header = NULL,
        .addrconf_vars = {
                {
@@ -3667,6 +3904,14 @@ static struct addrconf_sysctl_table
 #endif
 #endif
                {
+                        .ctl_name       =       NET_IPV6_PROXY_NDP,
+                        .procname       =       "proxy_ndp",
+                        .data           =       &ipv6_devconf.proxy_ndp,
+                        .maxlen         =       sizeof(int),
+                        .mode           =       0644,
+                        .proc_handler   =       &proc_dointvec,
+                },
+                {
                        .ctl_name       =       0,      /* sentinel */
                }
        },
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e19457fe4f6e..e94eccb99707 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -23,7 +23,6 @@
 #include <linux/module.h>
 #include <linux/capability.h>
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -60,6 +59,9 @@
 #ifdef CONFIG_IPV6_TUNNEL
 #include <net/ip6_tunnel.h>
 #endif
+#ifdef CONFIG_IPV6_MIP6
+#include <net/mip6.h>
+#endif
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -68,7 +70,7 @@ MODULE_AUTHOR("Cast of dozens");
 MODULE_DESCRIPTION("IPv6 protocol stack for Linux");
 MODULE_LICENSE("GPL");
-int sysctl_ipv6_bindv6only;
+int sysctl_ipv6_bindv6only __read_mostly;
 /* The inetsw table contains everything that inet_create needs to
 * build a new socket.
@@ -244,7 +246,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        struct sock *sk = sock->sk;
        struct inet_sock *inet = inet_sk(sk);
        struct ipv6_pinfo *np = inet6_sk(sk);
-        __u32 v4addr = 0;
+        __be32 v4addr = 0;
        unsigned short snum;
        int addr_type = 0;
        int err = 0;
@@ -638,6 +640,7 @@ int inet6_sk_rebuild_header(struct sock *sk)
                fl.oif = sk->sk_bound_dev_if;
                fl.fl_ip_dport = inet->dport;
                fl.fl_ip_sport = inet->sport;
+                security_sk_classify_flow(sk, &fl);
                if (np->opt && np->opt->srcrt) {
                        struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
@@ -659,9 +662,7 @@ int inet6_sk_rebuild_header(struct sock *sk)
                        return err;
                }
-                ip6_dst_store(sk, dst, NULL);
+                __ip6_dst_store(sk, dst, NULL, NULL);
-                sk->sk_route_caps = dst->dev->features &
-                        ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
        }
        return 0;
@@ -760,6 +761,8 @@ static int __init inet6_init(void)
        struct list_head *r;
        int err;
+        BUILD_BUG_ON(sizeof(struct inet6_skb_parm) > sizeof(dummy_skb->cb));
 #ifdef MODULE
 #if 0 /* FIXME --RR */
        if (!mod_member_present(&__this_module, can_unload))
@@ -769,11 +772,6 @@ static int __init inet6_init(void)
 #endif
 #endif
-        if (sizeof(struct inet6_skb_parm) > sizeof(dummy_skb->cb)) {
-                printk(KERN_CRIT "inet6_proto_init: size fault\n");
-                return -EINVAL;
-        }
        err = proto_register(&tcpv6_prot, 1);
        if (err)
                goto out;
@@ -859,6 +857,9 @@ static int __init inet6_init(void)
        ipv6_frag_init();
        ipv6_nodata_init();
        ipv6_destopt_init();
+#ifdef CONFIG_IPV6_MIP6
+        mip6_init();
+#endif
        /* Init v6 transport protocols. */
        udpv6_init();
@@ -922,6 +923,9 @@ static void __exit inet6_exit(void)
        tcp6_proc_exit();
        raw6_proc_exit();
 #endif
+#ifdef CONFIG_IPV6_MIP6
+        mip6_fini();
+#endif
        /* Cleanup code parts. */
        sit_cleanup();
        ip6_flowlabel_cleanup();
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index d31c0d6c0448..b0d83e8e4252 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -24,7 +24,6 @@
 *      This file is derived from net/ipv4/ah.c.
 */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <net/ip.h>
 #include <net/ah.h>
@@ -75,6 +74,66 @@ bad:
        return 0;
 }
+#ifdef CONFIG_IPV6_MIP6
+/**
+ *      ipv6_rearrange_destopt - rearrange IPv6 destination options header
+ *      @iph: IPv6 header
+ *      @destopt: destionation options header
+ */
+static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *destopt)
+{
+        u8 *opt = (u8 *)destopt;
+        int len = ipv6_optlen(destopt);
+        int off = 0;
+        int optlen = 0;
+        off += 2;
+        len -= 2;
+        while (len > 0) {
+                switch (opt[off]) {
+                case IPV6_TLV_PAD0:
+                        optlen = 1;
+                        break;
+                default:
+                        if (len < 2)
+                                goto bad;
+                        optlen = opt[off+1]+2;
+                        if (len < optlen)
+                                goto bad;
+                        /* Rearrange the source address in @iph and the
+                         * addresses in home address option for final source.
+                         * See 11.3.2 of RFC 3775 for details.
+                         */
+                        if (opt[off] == IPV6_TLV_HAO) {
+                                struct in6_addr final_addr;
+                                struct ipv6_destopt_hao *hao;
+                                hao = (struct ipv6_destopt_hao *)&opt[off];
+                                if (hao->length != sizeof(hao->addr)) {
+                                        if (net_ratelimit())
+                                                printk(KERN_WARNING "destopt hao: invalid header length: %u\n", hao->length);
+                                        goto bad;
+                                }
+                                ipv6_addr_copy(&final_addr, &hao->addr);
+                                ipv6_addr_copy(&hao->addr, &iph->saddr);
+                                ipv6_addr_copy(&iph->saddr, &final_addr);
+                        }
+                        break;
+                }
+                off += optlen;
+                len -= optlen;
+        }
+        /* Note: ok if len == 0 */
+bad:
+        return;
+}
+#endif
 /**
 *      ipv6_rearrange_rthdr - rearrange IPv6 routing header
 *      @iph: IPv6 header
@@ -114,7 +173,7 @@ static void ipv6_rearrange_rthdr(struct ipv6hdr *iph, struct ipv6_rt_hdr *rthdr)
        ipv6_addr_copy(&iph->daddr, &final_addr);
 }
-static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len)
+static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
 {
        union {
                struct ipv6hdr *iph;
@@ -129,8 +188,12 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len)
        while (exthdr.raw < end) {
                switch (nexthdr) {
-                case NEXTHDR_HOP:
                case NEXTHDR_DEST:
+#ifdef CONFIG_IPV6_MIP6
+                        if (dir == XFRM_POLICY_OUT)
+                                ipv6_rearrange_destopt(iph, exthdr.opth);
+#endif
+                case NEXTHDR_HOP:
                        if (!zero_out_mutable_opts(exthdr.opth)) {
                                LIMIT_NETDEBUG(
                                        KERN_WARNING "overrun %sopts\n",
@@ -165,6 +228,9 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
        u8 nexthdr;
        char tmp_base[8];
        struct {
+#ifdef CONFIG_IPV6_MIP6
+                struct in6_addr saddr;
+#endif
                struct in6_addr daddr;
                char hdrs[0];
        } *tmp_ext;
@@ -189,10 +255,15 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
                        err = -ENOMEM;
                        goto error;
                }
+#ifdef CONFIG_IPV6_MIP6
+                memcpy(tmp_ext, &top_iph->saddr, extlen);
+#else
                memcpy(tmp_ext, &top_iph->daddr, extlen);
+#endif
                err = ipv6_clear_mutable_options(top_iph,
                                                 extlen - sizeof(*tmp_ext) +
-                                                 sizeof(*top_iph));
+                                                 sizeof(*top_iph),
+                                                 XFRM_POLICY_OUT);
                if (err)
                        goto error_free_iph;
        }
@@ -214,13 +285,20 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
        ah->spi = x->id.spi;
        ah->seq_no = htonl(++x->replay.oseq);
        xfrm_aevent_doreplay(x);
-        ahp->icv(ahp, skb, ah->auth_data);
+        err = ah_mac_digest(ahp, skb, ah->auth_data);
+        if (err)
+                goto error_free_iph;
+        memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
        err = 0;
        memcpy(top_iph, tmp_base, sizeof(tmp_base));
        if (tmp_ext) {
+#ifdef CONFIG_IPV6_MIP6
+                memcpy(&top_iph->saddr, tmp_ext, extlen);
+#else
                memcpy(&top_iph->daddr, tmp_ext, extlen);
+#endif
 error_free_iph:
                kfree(tmp_ext);
        }
@@ -252,6 +330,7 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        u16 hdr_len;
        u16 ah_hlen;
        int nexthdr;
+        int err = -EINVAL;
        if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
                goto out;
@@ -279,7 +358,7 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        if (!tmp_hdr)
                goto out;
        memcpy(tmp_hdr, skb->nh.raw, hdr_len);
-        if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len))
+        if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len, XFRM_POLICY_IN))
                goto free_out;
        skb->nh.ipv6h->priority    = 0;
        skb->nh.ipv6h->flow_lbl[0] = 0;
@@ -293,8 +372,11 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
                memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
                memset(ah->auth_data, 0, ahp->icv_trunc_len);
                skb_push(skb, hdr_len);
-                ahp->icv(ahp, skb, ah->auth_data);
+                err = ah_mac_digest(ahp, skb, ah->auth_data);
-                if (memcmp(ah->auth_data, auth_data, ahp->icv_trunc_len)) {
+                if (err)
+                        goto free_out;
+                err = -EINVAL;
+                if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len)) {
                        LIMIT_NETDEBUG(KERN_WARNING "ipsec ah authentication error\n");
                        x->stats.integrity_failed++;
                        goto free_out;
@@ -311,7 +393,7 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 free_out:
        kfree(tmp_hdr);
 out:
-        return -EINVAL;
+        return err;
 }
 static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, 
@@ -339,6 +421,7 @@ static int ah6_init_state(struct xfrm_state *x)
 {
        struct ah_data *ahp = NULL;
        struct xfrm_algo_desc *aalg_desc;
+        struct crypto_hash *tfm;
        if (!x->aalg)
                goto error;
@@ -356,24 +439,27 @@ static int ah6_init_state(struct xfrm_state *x)
        ahp->key = x->aalg->alg_key;
        ahp->key_len = (x->aalg->alg_key_len+7)/8;
-        ahp->tfm = crypto_alloc_tfm(x->aalg->alg_name, 0);
+        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
-        if (!ahp->tfm)
+        if (IS_ERR(tfm))
+                goto error;
+        ahp->tfm = tfm;
+        if (crypto_hash_setkey(tfm, ahp->key, ahp->key_len))
                goto error;
-        ahp->icv = ah_hmac_digest;
        
        /*
         * Lookup the algorithm description maintained by xfrm_algo,
         * verify crypto transform properties, and store information
         * we need for AH processing.  This lookup cannot fail here
-         * after a successful crypto_alloc_tfm().
+         * after a successful crypto_alloc_hash().
         */
        aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
        BUG_ON(!aalg_desc);
        if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-            crypto_tfm_alg_digestsize(ahp->tfm)) {
+            crypto_hash_digestsize(tfm)) {
                printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_tfm_alg_digestsize(ahp->tfm),
+                       x->aalg->alg_name, crypto_hash_digestsize(tfm),
                       aalg_desc->uinfo.auth.icv_fullbits/8);
                goto error;
        }
@@ -388,7 +474,7 @@ static int ah6_init_state(struct xfrm_state *x)
                goto error;
        
        x->props.header_len = XFRM_ALIGN8(sizeof(struct ipv6_auth_hdr) + ahp->icv_trunc_len);
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                x->props.header_len += sizeof(struct ipv6hdr);
        x->data = ahp;
@@ -397,7 +483,7 @@ static int ah6_init_state(struct xfrm_state *x)
 error:
        if (ahp) {
                kfree(ahp->work_icv);
-                crypto_free_tfm(ahp->tfm);
+                crypto_free_hash(ahp->tfm);
                kfree(ahp);
        }
        return -EINVAL;
@@ -412,7 +498,7 @@ static void ah6_destroy(struct xfrm_state *x)
        kfree(ahp->work_icv);
        ahp->work_icv = NULL;
-        crypto_free_tfm(ahp->tfm);
+        crypto_free_hash(ahp->tfm);
        ahp->tfm = NULL;
        kfree(ahp);
 }
@@ -425,7 +511,8 @@ static struct xfrm_type ah6_type =
        .init_state     = ah6_init_state,
        .destructor     = ah6_destroy,
        .input          = ah6_input,
-        .output         = ah6_output
+        .output         = ah6_output,
+        .hdr_offset     = xfrm6_find_1stfragopt,
 };
 static struct inet6_protocol ah6_protocol = {
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 39ec528923f6..a9604764e015 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -14,7 +14,6 @@
 */
 #include <linux/capability.h>
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -57,7 +56,7 @@ ip6_onlink(struct in6_addr *addr, struct net_device *dev)
        int     onlink;
        onlink = 0;
-        read_lock(&addrconf_lock);
+        rcu_read_lock();
        idev = __in6_dev_get(dev);
        if (idev) {
                read_lock_bh(&idev->lock);
@@ -69,7 +68,7 @@ ip6_onlink(struct in6_addr *addr, struct net_device *dev)
                }
                read_unlock_bh(&idev->lock);
        }
-        read_unlock(&addrconf_lock);
+        rcu_read_unlock();
        return onlink;
 }
@@ -336,7 +335,7 @@ int ipv6_dev_ac_inc(struct net_device *dev, struct in6_addr *addr)
        write_unlock_bh(&idev->lock);
        dst_hold(&rt->u.dst);
-        if (ip6_ins_rt(rt, NULL, NULL, NULL))
+        if (ip6_ins_rt(rt))
                dst_release(&rt->u.dst);
        addrconf_join_solict(dev, &aca->aca_addr);
@@ -379,7 +378,7 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, struct in6_addr *addr)
        addrconf_leave_solict(idev, &aca->aca_addr);
        dst_hold(&aca->aca_rt->u.dst);
-        if (ip6_del_rt(aca->aca_rt, NULL, NULL, NULL))
+        if (ip6_del_rt(aca->aca_rt))
                dst_free(&aca->aca_rt->u.dst);
        else
                dst_release(&aca->aca_rt->u.dst);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 99a6eb23378b..7206747022fc 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -156,6 +156,8 @@ ipv4_connected:
        if (!fl.oif && (addr_type&IPV6_ADDR_MULTICAST))
                fl.oif = np->mcast_oif;
+        security_sk_classify_flow(sk, &fl);
        if (flowlabel) {
                if (flowlabel->opt && flowlabel->opt->srcrt) {
                        struct rt0_hdr *rt0 = (struct rt0_hdr *) flowlabel->opt->srcrt;
@@ -191,7 +193,12 @@ ipv4_connected:
        ip6_dst_store(sk, dst,
                      ipv6_addr_equal(&fl.fl6_dst, &np->daddr) ?
-                      &np->daddr : NULL);
+                      &np->daddr : NULL,
+#ifdef CONFIG_IPV6_SUBTREES
+                      ipv6_addr_equal(&fl.fl6_src, &np->saddr) ?
+                      &np->saddr :
+#endif
+                      NULL);
        sk->sk_state = TCP_ESTABLISHED;
 out:
@@ -641,10 +648,13 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                        rthdr = (struct ipv6_rt_hdr *)CMSG_DATA(cmsg);
-                        /*
+                        switch (rthdr->type) {
-                         *      TYPE 0
+                        case IPV6_SRCRT_TYPE_0:
-                         */
+#ifdef CONFIG_IPV6_MIP6
-                        if (rthdr->type) {
+                        case IPV6_SRCRT_TYPE_2:
+#endif
+                                break;
+                        default:
                                err = -EINVAL;
                                goto exit_f;
                        }
@@ -696,7 +706,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                        }
                        tc = *(int *)CMSG_DATA(cmsg);
-                        if (tc < 0 || tc > 0xff)
+                        if (tc < -1 || tc > 0xff)
                                goto exit_f;
                        err = 0;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index a15a6f320f70..e78680a9985b 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -24,7 +24,7 @@
 *      This file is derived from net/ipv4/esp.c
 */
-#include <linux/config.h>
+#include <linux/err.h>
 #include <linux/module.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
@@ -45,7 +45,8 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
        int hdr_len;
        struct ipv6hdr *top_iph;
        struct ipv6_esp_hdr *esph;
-        struct crypto_tfm *tfm;
+        struct crypto_blkcipher *tfm;
+        struct blkcipher_desc desc;
        struct esp_data *esp;
        struct sk_buff *trailer;
        int blksize;
@@ -68,7 +69,9 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
        alen = esp->auth.icv_trunc_len;
        tfm = esp->conf.tfm;
-        blksize = ALIGN(crypto_tfm_alg_blocksize(tfm), 4);
+        desc.tfm = tfm;
+        desc.flags = 0;
+        blksize = ALIGN(crypto_blkcipher_blocksize(tfm), 4);
        clen = ALIGN(clen + 2, blksize);
        if (esp->conf.padlen)
                clen = ALIGN(clen, esp->conf.padlen);
@@ -96,8 +99,13 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
        esph->seq_no = htonl(++x->replay.oseq);
        xfrm_aevent_doreplay(x);
-        if (esp->conf.ivlen)
+        if (esp->conf.ivlen) {
-                crypto_cipher_set_iv(tfm, esp->conf.ivec, crypto_tfm_alg_ivsize(tfm));
+                if (unlikely(!esp->conf.ivinitted)) {
+                        get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
+                        esp->conf.ivinitted = 1;
+                }
+                crypto_blkcipher_set_iv(tfm, esp->conf.ivec, esp->conf.ivlen);
+        }
        do {
                struct scatterlist *sg = &esp->sgbuf[0];
@@ -108,24 +116,25 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
                                goto error;
                }
                skb_to_sgvec(skb, sg, esph->enc_data+esp->conf.ivlen-skb->data, clen);
-                crypto_cipher_encrypt(tfm, sg, sg, clen);
+                err = crypto_blkcipher_encrypt(&desc, sg, sg, clen);
                if (unlikely(sg != &esp->sgbuf[0]))
                        kfree(sg);
        } while (0);
+        if (unlikely(err))
+                goto error;
        if (esp->conf.ivlen) {
-                memcpy(esph->enc_data, esp->conf.ivec, crypto_tfm_alg_ivsize(tfm));
+                memcpy(esph->enc_data, esp->conf.ivec, esp->conf.ivlen);
-                crypto_cipher_get_iv(tfm, esp->conf.ivec, crypto_tfm_alg_ivsize(tfm));
+                crypto_blkcipher_get_iv(tfm, esp->conf.ivec, esp->conf.ivlen);
        }
        if (esp->auth.icv_full_len) {
-                esp->auth.icv(esp, skb, (u8*)esph-skb->data,
+                err = esp_mac_digest(esp, skb, (u8 *)esph - skb->data,
-                        sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen+clen, trailer->tail);
+                                     sizeof(*esph) + esp->conf.ivlen + clen);
-                pskb_put(skb, trailer, alen);
+                memcpy(pskb_put(skb, trailer, alen), esp->auth.work_icv, alen);
        }
-        err = 0;
 error:
        return err;
 }
@@ -135,8 +144,10 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
        struct ipv6hdr *iph;
        struct ipv6_esp_hdr *esph;
        struct esp_data *esp = x->data;
+        struct crypto_blkcipher *tfm = esp->conf.tfm;
+        struct blkcipher_desc desc = { .tfm = tfm };
        struct sk_buff *trailer;
-        int blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4);
+        int blksize = ALIGN(crypto_blkcipher_blocksize(tfm), 4);
        int alen = esp->auth.icv_trunc_len;
        int elen = skb->len - sizeof(struct ipv6_esp_hdr) - esp->conf.ivlen - alen;
@@ -156,15 +167,16 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
        /* If integrity check is required, do this. */
        if (esp->auth.icv_full_len) {
-                u8 sum[esp->auth.icv_full_len];
+                u8 sum[alen];
-                u8 sum1[alen];
-                esp->auth.icv(esp, skb, 0, skb->len-alen, sum);
+                ret = esp_mac_digest(esp, skb, 0, skb->len - alen);
+                if (ret)
+                        goto out;
-                if (skb_copy_bits(skb, skb->len-alen, sum1, alen))
+                if (skb_copy_bits(skb, skb->len - alen, sum, alen))
                        BUG();
-                if (unlikely(memcmp(sum, sum1, alen))) {
+                if (unlikely(memcmp(esp->auth.work_icv, sum, alen))) {
                        x->stats.integrity_failed++;
                        ret = -EINVAL;
                        goto out;
@@ -183,7 +195,7 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
        /* Get ivec. This can be wrong, check against another impls. */
        if (esp->conf.ivlen)
-                crypto_cipher_set_iv(esp->conf.tfm, esph->enc_data, crypto_tfm_alg_ivsize(esp->conf.tfm));
+                crypto_blkcipher_set_iv(tfm, esph->enc_data, esp->conf.ivlen);
        {
                u8 nexthdr[2];
@@ -198,9 +210,11 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
                        }
                }
                skb_to_sgvec(skb, sg, sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen, elen);
-                crypto_cipher_decrypt(esp->conf.tfm, sg, sg, elen);
+                ret = crypto_blkcipher_decrypt(&desc, sg, sg, elen);
                if (unlikely(sg != &esp->sgbuf[0]))
                        kfree(sg);
+                if (unlikely(ret))
+                        goto out;
                if (skb_copy_bits(skb, skb->len-alen-2, nexthdr, 2))
                        BUG();
@@ -226,9 +240,9 @@ out:
 static u32 esp6_get_max_size(struct xfrm_state *x, int mtu)
 {
        struct esp_data *esp = x->data;
-        u32 blksize = ALIGN(crypto_tfm_alg_blocksize(esp->conf.tfm), 4);
+        u32 blksize = ALIGN(crypto_blkcipher_blocksize(esp->conf.tfm), 4);
-        if (x->props.mode) {
+        if (x->props.mode == XFRM_MODE_TUNNEL) {
                mtu = ALIGN(mtu + 2, blksize);
        } else {
                /* The worst case. */
@@ -267,11 +281,11 @@ static void esp6_destroy(struct xfrm_state *x)
        if (!esp)
                return;
-        crypto_free_tfm(esp->conf.tfm);
+        crypto_free_blkcipher(esp->conf.tfm);
        esp->conf.tfm = NULL;
        kfree(esp->conf.ivec);
        esp->conf.ivec = NULL;
-        crypto_free_tfm(esp->auth.tfm);
+        crypto_free_hash(esp->auth.tfm);
        esp->auth.tfm = NULL;
        kfree(esp->auth.work_icv);
        esp->auth.work_icv = NULL;
@@ -281,6 +295,7 @@ static void esp6_destroy(struct xfrm_state *x)
 static int esp6_init_state(struct xfrm_state *x)
 {
        struct esp_data *esp = NULL;
+        struct crypto_blkcipher *tfm;
        /* null auth and encryption can have zero length keys */
        if (x->aalg) {
@@ -299,24 +314,29 @@ static int esp6_init_state(struct xfrm_state *x)
        if (x->aalg) {
                struct xfrm_algo_desc *aalg_desc;
+                struct crypto_hash *hash;
                esp->auth.key = x->aalg->alg_key;
                esp->auth.key_len = (x->aalg->alg_key_len+7)/8;
-                esp->auth.tfm = crypto_alloc_tfm(x->aalg->alg_name, 0);
+                hash = crypto_alloc_hash(x->aalg->alg_name, 0,
-                if (esp->auth.tfm == NULL)
+                                         CRYPTO_ALG_ASYNC);
+                if (IS_ERR(hash))
+                        goto error;
+                esp->auth.tfm = hash;
+                if (crypto_hash_setkey(hash, esp->auth.key, esp->auth.key_len))
                        goto error;
-                esp->auth.icv = esp_hmac_digest;
 
                aalg_desc = xfrm_aalg_get_byname(x->aalg->alg_name, 0);
                BUG_ON(!aalg_desc);
 
                if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-                        crypto_tfm_alg_digestsize(esp->auth.tfm)) {
+                    crypto_hash_digestsize(hash)) {
-                                printk(KERN_INFO "ESP: %s digestsize %u != %hu\n",
+                        NETDEBUG(KERN_INFO "ESP: %s digestsize %u != %hu\n",
-                                        x->aalg->alg_name,
+                                 x->aalg->alg_name,
-                                        crypto_tfm_alg_digestsize(esp->auth.tfm),
+                                 crypto_hash_digestsize(hash),
-                                        aalg_desc->uinfo.auth.icv_fullbits/8);
+                                 aalg_desc->uinfo.auth.icv_fullbits/8);
-                                goto error;
+                        goto error;
                }
 
                esp->auth.icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
@@ -328,24 +348,22 @@ static int esp6_init_state(struct xfrm_state *x)
        }
        esp->conf.key = x->ealg->alg_key;
        esp->conf.key_len = (x->ealg->alg_key_len+7)/8;
-        if (x->props.ealgo == SADB_EALG_NULL)
+        tfm = crypto_alloc_blkcipher(x->ealg->alg_name, 0, CRYPTO_ALG_ASYNC);
-                esp->conf.tfm = crypto_alloc_tfm(x->ealg->alg_name, CRYPTO_TFM_MODE_ECB);
+        if (IS_ERR(tfm))
-        else
-                esp->conf.tfm = crypto_alloc_tfm(x->ealg->alg_name, CRYPTO_TFM_MODE_CBC);
-        if (esp->conf.tfm == NULL)
                goto error;
-        esp->conf.ivlen = crypto_tfm_alg_ivsize(esp->conf.tfm);
+        esp->conf.tfm = tfm;
+        esp->conf.ivlen = crypto_blkcipher_ivsize(tfm);
        esp->conf.padlen = 0;
        if (esp->conf.ivlen) {
                esp->conf.ivec = kmalloc(esp->conf.ivlen, GFP_KERNEL);
                if (unlikely(esp->conf.ivec == NULL))
                        goto error;
-                get_random_bytes(esp->conf.ivec, esp->conf.ivlen);
+                esp->conf.ivinitted = 0;
        }
-        if (crypto_cipher_setkey(esp->conf.tfm, esp->conf.key, esp->conf.key_len))
+        if (crypto_blkcipher_setkey(tfm, esp->conf.key, esp->conf.key_len))
                goto error;
        x->props.header_len = sizeof(struct ipv6_esp_hdr) + esp->conf.ivlen;
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                x->props.header_len += sizeof(struct ipv6hdr);
        x->data = esp;
        return 0;
@@ -366,7 +384,8 @@ static struct xfrm_type esp6_type =
        .destructor     = esp6_destroy,
        .get_max_size   = esp6_get_max_size,
        .input          = esp6_input,
-        .output         = esp6_output
+        .output         = esp6_output,
+        .hdr_offset     = xfrm6_find_1stfragopt,
 };
 static struct inet6_protocol esp6_protocol = {
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index a18d4256372c..88c96b10684c 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -43,9 +43,54 @@
 #include <net/ndisc.h>
 #include <net/ip6_route.h>
 #include <net/addrconf.h>
+#ifdef CONFIG_IPV6_MIP6
+#include <net/xfrm.h>
+#endif
 #include <asm/uaccess.h>
+int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
+{
+        int packet_len = skb->tail - skb->nh.raw;
+        struct ipv6_opt_hdr *hdr;
+        int len;
+        if (offset + 2 > packet_len)
+                goto bad;
+        hdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+        len = ((hdr->hdrlen + 1) << 3);
+        if (offset + len > packet_len)
+                goto bad;
+        offset += 2;
+        len -= 2;
+        while (len > 0) {
+                int opttype = skb->nh.raw[offset];
+                int optlen;
+                if (opttype == type)
+                        return offset;
+                switch (opttype) {
+                case IPV6_TLV_PAD0:
+                        optlen = 1;
+                        break;
+                default:
+                        optlen = skb->nh.raw[offset + 1] + 2;
+                        if (optlen > len)
+                                goto bad;
+                        break;
+                }
+                offset += optlen;
+                len -= optlen;
+        }
+        /* not_found */
+ bad:
+        return -1;
+}
 /*
 *      Parsing tlv encoded headers.
 *
@@ -56,7 +101,7 @@
 struct tlvtype_proc {
        int     type;
-        int     (*func)(struct sk_buff *skb, int offset);
+        int     (*func)(struct sk_buff **skbp, int offset);
 };
 /*********************
@@ -65,8 +110,10 @@ struct tlvtype_proc {
 /* An unknown option is detected, decide what to do */
-static int ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
+static int ip6_tlvopt_unknown(struct sk_buff **skbp, int optoff)
 {
+        struct sk_buff *skb = *skbp;
        switch ((skb->nh.raw[optoff] & 0xC0) >> 6) {
        case 0: /* ignore */
                return 1;
@@ -91,8 +138,9 @@ static int ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
 /* Parse tlv encoded option header (hop-by-hop or destination) */
-static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
+static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff **skbp)
 {
+        struct sk_buff *skb = *skbp;
        struct tlvtype_proc *curr;
        int off = skb->h.raw - skb->nh.raw;
        int len = ((skb->h.raw[1]+1)<<3);
@@ -122,13 +170,13 @@ static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
                                        /* type specific length/alignment 
                                           checks will be performed in the 
                                           func(). */
-                                        if (curr->func(skb, off) == 0)
+                                        if (curr->func(skbp, off) == 0)
                                                return 0;
                                        break;
                                }
                        }
                        if (curr->type < 0) {
-                                if (ip6_tlvopt_unknown(skb, off) == 0)
+                                if (ip6_tlvopt_unknown(skbp, off) == 0)
                                        return 0;
                        }
                        break;
@@ -147,8 +195,85 @@ bad:
  Destination options header.
 *****************************/
+#ifdef CONFIG_IPV6_MIP6
+static int ipv6_dest_hao(struct sk_buff **skbp, int optoff)
+{
+        struct sk_buff *skb = *skbp;
+        struct ipv6_destopt_hao *hao;
+        struct inet6_skb_parm *opt = IP6CB(skb);
+        struct ipv6hdr *ipv6h = (struct ipv6hdr *)skb->nh.raw;
+        struct in6_addr tmp_addr;
+        int ret;
+        if (opt->dsthao) {
+                LIMIT_NETDEBUG(KERN_DEBUG "hao duplicated\n");
+                goto discard;
+        }
+        opt->dsthao = opt->dst1;
+        opt->dst1 = 0;
+        hao = (struct ipv6_destopt_hao *)(skb->nh.raw + optoff);
+        if (hao->length != 16) {
+                LIMIT_NETDEBUG(
+                        KERN_DEBUG "hao invalid option length = %d\n", hao->length);
+                goto discard;
+        }
+        if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
+                LIMIT_NETDEBUG(
+                        KERN_DEBUG "hao is not an unicast addr: " NIP6_FMT "\n", NIP6(hao->addr));
+                goto discard;
+        }
+        ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
+                               (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
+        if (unlikely(ret < 0))
+                goto discard;
+        if (skb_cloned(skb)) {
+                struct sk_buff *skb2 = skb_copy(skb, GFP_ATOMIC);
+                struct inet6_skb_parm *opt2;
+                if (skb2 == NULL)
+                        goto discard;
+                opt2 = IP6CB(skb2);
+                memcpy(opt2, opt, sizeof(*opt2));
+                kfree_skb(skb);
+                /* update all variable using below by copied skbuff */
+                *skbp = skb = skb2;
+                hao = (struct ipv6_destopt_hao *)(skb2->nh.raw + optoff);
+                ipv6h = (struct ipv6hdr *)skb2->nh.raw;
+        }
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
+                skb->ip_summed = CHECKSUM_NONE;
+        ipv6_addr_copy(&tmp_addr, &ipv6h->saddr);
+        ipv6_addr_copy(&ipv6h->saddr, &hao->addr);
+        ipv6_addr_copy(&hao->addr, &tmp_addr);
+        if (skb->tstamp.off_sec == 0)
+                __net_timestamp(skb);
+        return 1;
+ discard:
+        kfree_skb(skb);
+        return 0;
+}
+#endif
 static struct tlvtype_proc tlvprocdestopt_lst[] = {
-        /* No destination options are defined now */
+#ifdef CONFIG_IPV6_MIP6
+        {
+                .type   = IPV6_TLV_HAO,
+                .func   = ipv6_dest_hao,
+        },
+#endif
        {-1,                    NULL}
 };
@@ -156,6 +281,9 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
 {
        struct sk_buff *skb = *skbp;
        struct inet6_skb_parm *opt = IP6CB(skb);
+#ifdef CONFIG_IPV6_MIP6
+        __u16 dstbuf;
+#endif
        if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
            !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
@@ -166,10 +294,19 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
        opt->lastopt = skb->h.raw - skb->nh.raw;
        opt->dst1 = skb->h.raw - skb->nh.raw;
+#ifdef CONFIG_IPV6_MIP6
+        dstbuf = opt->dst1;
+#endif
-        if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
+        if (ip6_parse_tlv(tlvprocdestopt_lst, skbp)) {
+                skb = *skbp;
                skb->h.raw += ((skb->h.raw[1]+1)<<3);
+                opt = IP6CB(skb);
+#ifdef CONFIG_IPV6_MIP6
+                opt->nhoff = dstbuf;
+#else
                opt->nhoff = opt->dst1;
+#endif
                return 1;
        }
@@ -179,7 +316,7 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
 static struct inet6_protocol destopt_protocol = {
        .handler        =       ipv6_destopt_rcv,
-        .flags          =       INET6_PROTO_NOPOLICY,
+        .flags          =       INET6_PROTO_NOPOLICY | INET6_PROTO_GSO_EXTHDR,
 };
 void __init ipv6_destopt_init(void)
@@ -219,7 +356,7 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 {
        struct sk_buff *skb = *skbp;
        struct inet6_skb_parm *opt = IP6CB(skb);
-        struct in6_addr *addr;
+        struct in6_addr *addr = NULL;
        struct in6_addr daddr;
        int n, i;
@@ -244,6 +381,23 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 looped_back:
        if (hdr->segments_left == 0) {
+                switch (hdr->type) {
+#ifdef CONFIG_IPV6_MIP6
+                case IPV6_SRCRT_TYPE_2:
+                        /* Silently discard type 2 header unless it was
+                         * processed by own
+                         */
+                        if (!addr) {
+                                IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
+                                kfree_skb(skb);
+                                return -1;
+                        }
+                        break;
+#endif
+                default:
+                        break;
+                }
                opt->lastopt = skb->h.raw - skb->nh.raw;
                opt->srcrt = skb->h.raw - skb->nh.raw;
                skb->h.raw += (hdr->hdrlen + 1) << 3;
@@ -253,17 +407,29 @@ looped_back:
                return 1;
        }
-        if (hdr->type != IPV6_SRCRT_TYPE_0) {
+        switch (hdr->type) {
+        case IPV6_SRCRT_TYPE_0:
+                if (hdr->hdrlen & 0x01) {
+                        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                        icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->hdrlen) - skb->nh.raw);
+                        return -1;
+                }
+                break;
+#ifdef CONFIG_IPV6_MIP6
+        case IPV6_SRCRT_TYPE_2:
+                /* Silently discard invalid RTH type 2 */
+                if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
+                        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
+                        kfree_skb(skb);
+                        return -1;
+                }
+                break;
+#endif
+        default:
                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
                return -1;
        }
-        
-        if (hdr->hdrlen & 0x01) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
-                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->hdrlen) - skb->nh.raw);
-                return -1;
-        }
        /*
         *      This is the routing header forwarding algorithm from
@@ -294,7 +460,7 @@ looped_back:
                hdr = (struct ipv6_rt_hdr *) skb2->h.raw;
        }
-        if (skb->ip_summed == CHECKSUM_HW)
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
                skb->ip_summed = CHECKSUM_NONE;
        i = n - --hdr->segments_left;
@@ -303,6 +469,27 @@ looped_back:
        addr = rthdr->addr;
        addr += i - 1;
+        switch (hdr->type) {
+#ifdef CONFIG_IPV6_MIP6
+        case IPV6_SRCRT_TYPE_2:
+                if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
+                                     (xfrm_address_t *)&skb->nh.ipv6h->saddr,
+                                     IPPROTO_ROUTING) < 0) {
+                        IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
+                        kfree_skb(skb);
+                        return -1;
+                }
+                if (!ipv6_chk_home_addr(addr)) {
+                        IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
+                        kfree_skb(skb);
+                        return -1;
+                }
+                break;
+#endif
+        default:
+                break;
+        }
        if (ipv6_addr_is_multicast(addr)) {
                IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
                kfree_skb(skb);
@@ -340,7 +527,7 @@ looped_back:
 static struct inet6_protocol rthdr_protocol = {
        .handler        =       ipv6_rthdr_rcv,
-        .flags          =       INET6_PROTO_NOPOLICY,
+        .flags          =       INET6_PROTO_NOPOLICY | INET6_PROTO_GSO_EXTHDR,
 };
 void __init ipv6_rthdr_init(void)
@@ -421,8 +608,10 @@ EXPORT_SYMBOL_GPL(ipv6_invert_rthdr);
 /* Router Alert as of RFC 2711 */
-static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
+static int ipv6_hop_ra(struct sk_buff **skbp, int optoff)
 {
+        struct sk_buff *skb = *skbp;
        if (skb->nh.raw[optoff+1] == 2) {
                IP6CB(skb)->ra = optoff;
                return 1;
@@ -435,8 +624,9 @@ static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
 /* Jumbo payload */
-static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
+static int ipv6_hop_jumbo(struct sk_buff **skbp, int optoff)
 {
+        struct sk_buff *skb = *skbp;
        u32 pkt_len;
        if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) {
@@ -485,8 +675,9 @@ static struct tlvtype_proc tlvprochopopt_lst[] = {
        { -1, }
 };
-int ipv6_parse_hopopts(struct sk_buff *skb)
+int ipv6_parse_hopopts(struct sk_buff **skbp)
 {
+        struct sk_buff *skb = *skbp;
        struct inet6_skb_parm *opt = IP6CB(skb);
        /*
@@ -502,8 +693,10 @@ int ipv6_parse_hopopts(struct sk_buff *skb)
        }
        opt->hop = sizeof(struct ipv6hdr);
-        if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
+        if (ip6_parse_tlv(tlvprochopopt_lst, skbp)) {
+                skb = *skbp;
                skb->h.raw += (skb->h.raw[1]+1)<<3;
+                opt = IP6CB(skb);
                opt->nhoff = sizeof(struct ipv6hdr);
                return 1;
        }
@@ -635,14 +828,17 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
        struct ipv6_txoptions *opt2;
        int err;
-        if (newtype != IPV6_HOPOPTS && opt->hopopt)
+        if (opt) {
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
+                if (newtype != IPV6_HOPOPTS && opt->hopopt)
-        if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
+                if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
-        if (newtype != IPV6_RTHDR && opt->srcrt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
+                if (newtype != IPV6_RTHDR && opt->srcrt)
-        if (newtype != IPV6_DSTOPTS && opt->dst1opt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
+                if (newtype != IPV6_DSTOPTS && opt->dst1opt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
+        }
        if (newopt && newoptlen)
                tot_len += CMSG_ALIGN(newoptlen);
@@ -659,25 +855,25 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
        opt2->tot_len = tot_len;
        p = (char *)(opt2 + 1);
-        err = ipv6_renew_option(opt->hopopt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
                                newtype != IPV6_HOPOPTS,
                                &opt2->hopopt, &p);
        if (err)
                goto out;
-        err = ipv6_renew_option(opt->dst0opt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
                                newtype != IPV6_RTHDRDSTOPTS,
                                &opt2->dst0opt, &p);
        if (err)
                goto out;
-        err = ipv6_renew_option(opt->srcrt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
                                newtype != IPV6_RTHDR,
-                                (struct ipv6_opt_hdr **)opt2->srcrt, &p);
+                                (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
        if (err)
                goto out;
-        err = ipv6_renew_option(opt->dst1opt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
                                newtype != IPV6_DSTOPTS,
                                &opt2->dst1opt, &p);
        if (err)
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
new file mode 100644
index 000000000000..34f5bfaddfc2
--- /dev/null
+++ b/net/ipv6/fib6_rules.c
@@ -0,0 +1,305 @@
+/*
+ * net/ipv6/fib6_rules.c        IPv6 Routing Policy Rules
+ *
+ * Copyright (C)2003-2006 Helsinki University of Technology
+ * Copyright (C)2003-2006 USAGI/WIDE Project
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation, version 2.
+ *
+ * Authors
+ *      Thomas Graf             <tgraf@suug.ch>
+ *      Ville Nuorvala          <vnuorval@tcs.hut.fi>
+ */
+#include <linux/config.h>
+#include <linux/netdevice.h>
+#include <net/fib_rules.h>
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+#include <net/netlink.h>
+struct fib6_rule
+{
+        struct fib_rule         common;
+        struct rt6key           src;
+        struct rt6key           dst;
+#ifdef CONFIG_IPV6_ROUTE_FWMARK
+        u32                     fwmark;
+        u32                     fwmask;
+#endif
+        u8                      tclass;
+};
+static struct fib_rules_ops fib6_rules_ops;
+static struct fib6_rule main_rule = {
+        .common = {
+                .refcnt =       ATOMIC_INIT(2),
+                .pref =         0x7FFE,
+                .action =       FR_ACT_TO_TBL,
+                .table =        RT6_TABLE_MAIN,
+        },
+};
+static struct fib6_rule local_rule = {
+        .common = {
+                .refcnt =       ATOMIC_INIT(2),
+                .pref =         0,
+                .action =       FR_ACT_TO_TBL,
+                .table =        RT6_TABLE_LOCAL,
+                .flags =        FIB_RULE_PERMANENT,
+        },
+};
+static LIST_HEAD(fib6_rules);
+struct dst_entry *fib6_rule_lookup(struct flowi *fl, int flags,
+                                   pol_lookup_t lookup)
+{
+        struct fib_lookup_arg arg = {
+                .lookup_ptr = lookup,
+        };
+        fib_rules_lookup(&fib6_rules_ops, fl, flags, &arg);
+        if (arg.rule)
+                fib_rule_put(arg.rule);
+        if (arg.result)
+                return (struct dst_entry *) arg.result;
+        dst_hold(&ip6_null_entry.u.dst);
+        return &ip6_null_entry.u.dst;
+}
+static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
+                            int flags, struct fib_lookup_arg *arg)
+{
+        struct rt6_info *rt = NULL;
+        struct fib6_table *table;
+        pol_lookup_t lookup = arg->lookup_ptr;
+        switch (rule->action) {
+        case FR_ACT_TO_TBL:
+                break;
+        case FR_ACT_UNREACHABLE:
+                rt = &ip6_null_entry;
+                goto discard_pkt;
+        default:
+        case FR_ACT_BLACKHOLE:
+                rt = &ip6_blk_hole_entry;
+                goto discard_pkt;
+        case FR_ACT_PROHIBIT:
+                rt = &ip6_prohibit_entry;
+                goto discard_pkt;
+        }
+        table = fib6_get_table(rule->table);
+        if (table)
+                rt = lookup(table, flp, flags);
+        if (rt != &ip6_null_entry)
+                goto out;
+        dst_release(&rt->u.dst);
+        rt = NULL;
+        goto out;
+discard_pkt:
+        dst_hold(&rt->u.dst);
+out:
+        arg->result = rt;
+        return rt == NULL ? -EAGAIN : 0;
+}
+static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
+{
+        struct fib6_rule *r = (struct fib6_rule *) rule;
+        if (!ipv6_prefix_equal(&fl->fl6_dst, &r->dst.addr, r->dst.plen))
+                return 0;
+        if ((flags & RT6_LOOKUP_F_HAS_SADDR) &&
+            !ipv6_prefix_equal(&fl->fl6_src, &r->src.addr, r->src.plen))
+                return 0;
+        if (r->tclass && r->tclass != ((ntohl(fl->fl6_flowlabel) >> 20) & 0xff))
+                return 0;
+#ifdef CONFIG_IPV6_ROUTE_FWMARK
+        if ((r->fwmark ^ fl->fl6_fwmark) & r->fwmask)
+                return 0;
+#endif
+        return 1;
+}
+static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = {
+        [FRA_IFNAME]    = { .type = NLA_STRING, .len = IFNAMSIZ - 1 },
+        [FRA_PRIORITY]  = { .type = NLA_U32 },
+        [FRA_SRC]       = { .len = sizeof(struct in6_addr) },
+        [FRA_DST]       = { .len = sizeof(struct in6_addr) },
+        [FRA_FWMARK]    = { .type = NLA_U32 },
+        [FRA_FWMASK]    = { .type = NLA_U32 },
+        [FRA_TABLE]     = { .type = NLA_U32 },
+};
+static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
+                               struct nlmsghdr *nlh, struct fib_rule_hdr *frh,
+                               struct nlattr **tb)
+{
+        int err = -EINVAL;
+        struct fib6_rule *rule6 = (struct fib6_rule *) rule;
+        if (frh->src_len > 128 || frh->dst_len > 128 ||
+            (frh->tos & ~IPV6_FLOWINFO_MASK))
+                goto errout;
+        if (rule->action == FR_ACT_TO_TBL) {
+                if (rule->table == RT6_TABLE_UNSPEC)
+                        goto errout;
+                if (fib6_new_table(rule->table) == NULL) {
+                        err = -ENOBUFS;
+                        goto errout;
+                }
+        }
+        if (tb[FRA_SRC])
+                nla_memcpy(&rule6->src.addr, tb[FRA_SRC],
+                           sizeof(struct in6_addr));
+        if (tb[FRA_DST])
+                nla_memcpy(&rule6->dst.addr, tb[FRA_DST],
+                           sizeof(struct in6_addr));
+#ifdef CONFIG_IPV6_ROUTE_FWMARK
+        if (tb[FRA_FWMARK]) {
+                rule6->fwmark = nla_get_u32(tb[FRA_FWMARK]);
+                if (rule6->fwmark) {
+                        /*
+                         * if the mark value is non-zero,
+                         * all bits are compared by default
+                         * unless a mask is explicitly specified.
+                         */
+                        rule6->fwmask = 0xFFFFFFFF;
+                }
+        }
+        if (tb[FRA_FWMASK])
+                rule6->fwmask = nla_get_u32(tb[FRA_FWMASK]);
+#endif
+        rule6->src.plen = frh->src_len;
+        rule6->dst.plen = frh->dst_len;
+        rule6->tclass = frh->tos;
+        err = 0;
+errout:
+        return err;
+}
+static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
+                             struct nlattr **tb)
+{
+        struct fib6_rule *rule6 = (struct fib6_rule *) rule;
+        if (frh->src_len && (rule6->src.plen != frh->src_len))
+                return 0;
+        if (frh->dst_len && (rule6->dst.plen != frh->dst_len))
+                return 0;
+        if (frh->tos && (rule6->tclass != frh->tos))
+                return 0;
+        if (tb[FRA_SRC] &&
+            nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
+                return 0;
+        if (tb[FRA_DST] &&
+            nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
+                return 0;
+#ifdef CONFIG_IPV6_ROUTE_FWMARK
+        if (tb[FRA_FWMARK] && (rule6->fwmark != nla_get_u32(tb[FRA_FWMARK])))
+                return 0;
+        if (tb[FRA_FWMASK] && (rule6->fwmask != nla_get_u32(tb[FRA_FWMASK])))
+                return 0;
+#endif
+        return 1;
+}
+static int fib6_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
+                          struct nlmsghdr *nlh, struct fib_rule_hdr *frh)
+{
+        struct fib6_rule *rule6 = (struct fib6_rule *) rule;
+        frh->family = AF_INET6;
+        frh->dst_len = rule6->dst.plen;
+        frh->src_len = rule6->src.plen;
+        frh->tos = rule6->tclass;
+        if (rule6->dst.plen)
+                NLA_PUT(skb, FRA_DST, sizeof(struct in6_addr),
+                        &rule6->dst.addr);
+        if (rule6->src.plen)
+                NLA_PUT(skb, FRA_SRC, sizeof(struct in6_addr),
+                        &rule6->src.addr);
+#ifdef CONFIG_IPV6_ROUTE_FWMARK
+        if (rule6->fwmark)
+                NLA_PUT_U32(skb, FRA_FWMARK, rule6->fwmark);
+        if (rule6->fwmask || rule6->fwmark)
+                NLA_PUT_U32(skb, FRA_FWMASK, rule6->fwmask);
+#endif
+        return 0;
+nla_put_failure:
+        return -ENOBUFS;
+}
+int fib6_rules_dump(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        return fib_rules_dump(skb, cb, AF_INET6);
+}
+static u32 fib6_rule_default_pref(void)
+{
+        return 0x3FFF;
+}
+static struct fib_rules_ops fib6_rules_ops = {
+        .family                 = AF_INET6,
+        .rule_size              = sizeof(struct fib6_rule),
+        .action                 = fib6_rule_action,
+        .match                  = fib6_rule_match,
+        .configure              = fib6_rule_configure,
+        .compare                = fib6_rule_compare,
+        .fill                   = fib6_rule_fill,
+        .default_pref           = fib6_rule_default_pref,
+        .nlgroup                = RTNLGRP_IPV6_RULE,
+        .policy                 = fib6_rule_policy,
+        .rules_list             = &fib6_rules,
+        .owner                  = THIS_MODULE,
+};
+void __init fib6_rules_init(void)
+{
+        list_add_tail(&local_rule.common.list, &fib6_rules);
+        list_add_tail(&main_rule.common.list, &fib6_rules);
+        fib_rules_register(&fib6_rules_ops);
+}
+void fib6_rules_cleanup(void)
+{
+        fib_rules_unregister(&fib6_rules_ops);
+}
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 1044b6fce0d5..4ec876066b3f 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -151,7 +151,7 @@ static int is_ineligible(struct sk_buff *skb)
        return 0;
 }
-static int sysctl_icmpv6_time = 1*HZ; 
+static int sysctl_icmpv6_time __read_mostly = 1*HZ;
 /* 
 * Check the ICMP output rate limit 
@@ -273,6 +273,29 @@ static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, st
        return 0;
 }
+#ifdef CONFIG_IPV6_MIP6
+static void mip6_addr_swap(struct sk_buff *skb)
+{
+        struct ipv6hdr *iph = skb->nh.ipv6h;
+        struct inet6_skb_parm *opt = IP6CB(skb);
+        struct ipv6_destopt_hao *hao;
+        struct in6_addr tmp;
+        int off;
+        if (opt->dsthao) {
+                off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
+                if (likely(off >= 0)) {
+                        hao = (struct ipv6_destopt_hao *)(skb->nh.raw + off);
+                        ipv6_addr_copy(&tmp, &iph->saddr);
+                        ipv6_addr_copy(&iph->saddr, &hao->addr);
+                        ipv6_addr_copy(&hao->addr, &tmp);
+                }
+        }
+}
+#else
+static inline void mip6_addr_swap(struct sk_buff *skb) {}
+#endif
 /*
 *      Send an ICMP message in response to a packet in error
 */
@@ -350,6 +373,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
                return;
        }
+        mip6_addr_swap(skb);
        memset(&fl, 0, sizeof(fl));
        fl.proto = IPPROTO_ICMPV6;
        ipv6_addr_copy(&fl.fl6_dst, &hdr->saddr);
@@ -358,6 +383,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
        fl.oif = iif;
        fl.fl_icmp_type = type;
        fl.fl_icmp_code = code;
+        security_skb_classify_flow(skb, &fl);
        if (icmpv6_xmit_lock())
                return;
@@ -401,7 +427,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
        if (hlimit < 0)
                hlimit = ipv6_get_hoplimit(dst->dev);
-        tclass = np->cork.tclass;
+        tclass = np->tclass;
        if (tclass < 0)
                tclass = 0;
@@ -472,6 +498,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
                ipv6_addr_copy(&fl.fl6_src, saddr);
        fl.oif = skb->dev->ifindex;
        fl.fl_icmp_type = ICMPV6_ECHO_REPLY;
+        security_skb_classify_flow(skb, &fl);
        if (icmpv6_xmit_lock())
                return;
@@ -497,7 +524,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
        if (hlimit < 0)
                hlimit = ipv6_get_hoplimit(dst->dev);
-        tclass = np->cork.tclass;
+        tclass = np->tclass;
        if (tclass < 0)
                tclass = 0;
@@ -604,7 +631,7 @@ static int icmpv6_rcv(struct sk_buff **pskb)
        /* Perform checksum. */
        switch (skb->ip_summed) {
-        case CHECKSUM_HW:
+        case CHECKSUM_COMPLETE:
                if (!csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_ICMPV6,
                                     skb->csum))
                        break;
@@ -712,6 +739,11 @@ discard_it:
        return 0;
 }
+/*
+ * Special lock-class for __icmpv6_socket:
+ */
+static struct lock_class_key icmpv6_socket_sk_dst_lock_key;
 int __init icmpv6_init(struct net_proto_family *ops)
 {
        struct sock *sk;
@@ -730,6 +762,14 @@ int __init icmpv6_init(struct net_proto_family *ops)
                sk = per_cpu(__icmpv6_socket, i)->sk;
                sk->sk_allocation = GFP_ATOMIC;
+                /*
+                 * Split off their lock-class, because sk->sk_dst_lock
+                 * gets used from softirqs, which is safe for
+                 * __icmpv6_socket (because those never get directly used
+                 * via userspace syscalls), but unsafe for normal sockets.
+                 */
+                lockdep_set_class(&sk->sk_dst_lock,
+                                  &icmpv6_socket_sk_dst_lock_key);
                /* Enough space for 2 64K ICMP packets, including
                 * sk_buff struct overhead.
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index eb2865d5ae28..827f41d1478b 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -13,7 +13,6 @@
 *             2 of the License, or(at your option) any later version.
 */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/in6.h>
 #include <linux/ipv6.h>
@@ -158,6 +157,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
        fl.oif = sk->sk_bound_dev_if;
        fl.fl_ip_sport = inet->sport;
        fl.fl_ip_dport = inet->dport;
+        security_sk_classify_flow(sk, &fl);
        if (np->opt && np->opt->srcrt) {
                struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
@@ -186,9 +186,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
                        return err;
                }
-                ip6_dst_store(sk, dst, NULL);
+                __ip6_dst_store(sk, dst, NULL, NULL);
-                sk->sk_route_caps = dst->dev->features &
-                        ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
        }
        skb->dst = dst_clone(dst);
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 2ae84c961678..8accd1fbeeda 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -14,7 +14,6 @@
 *      2 of the License, or (at your option) any later version.
 */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/random.h>
@@ -65,7 +64,7 @@ struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
 {
        struct sock *sk;
        const struct hlist_node *node;
-        const __u32 ports = INET_COMBINED_PORTS(sport, hnum);
+        const __portpair ports = INET_COMBINED_PORTS(sport, hnum);
        /* Optimize here for direct hit, only listening connections can
         * have wildcards anyways.
         */
@@ -83,7 +82,7 @@ struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
        sk_for_each(sk, node, &(head + hashinfo->ehash_size)->chain) {
                const struct inet_timewait_sock *tw = inet_twsk(sk);
-                if(*((__u32 *)&(tw->tw_dport))  == ports        &&
+                if(*((__portpair *)&(tw->tw_dport))     == ports        &&
                   sk->sk_family                == PF_INET6) {
                        const struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
@@ -172,7 +171,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
        const struct in6_addr *daddr = &np->rcv_saddr;
        const struct in6_addr *saddr = &np->daddr;
        const int dif = sk->sk_bound_dev_if;
-        const u32 ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
        const unsigned int hash = inet6_ehashfn(daddr, inet->num, saddr,
                                                inet->dport);
        struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
@@ -189,7 +188,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
                tw = inet_twsk(sk2);
-                if(*((__u32 *)&(tw->tw_dport)) == ports          &&
+                if(*((__portpair *)&(tw->tw_dport)) == ports             &&
                   sk2->sk_family              == PF_INET6       &&
                   ipv6_addr_equal(&tw6->tw_v6_daddr, saddr)     &&
                   ipv6_addr_equal(&tw6->tw_v6_rcv_saddr, daddr) &&
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 2cb6149349bf..8fcae7a6510b 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -18,8 +18,8 @@
 *      Yuji SEKIYA @USAGI:     Support default route on router node;
 *                              remove ip6_null_entry from the top of
 *                              routing table.
+ *      Ville Nuorvala:         Fixed routing subtrees.
 */
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/net.h>
@@ -27,6 +27,7 @@
 #include <linux/netdevice.h>
 #include <linux/in6.h>
 #include <linux/init.h>
+#include <linux/list.h>
 #ifdef  CONFIG_PROC_FS
 #include <linux/proc_fs.h>
@@ -69,19 +70,19 @@ struct fib6_cleaner_t
        void *arg;
 };
-DEFINE_RWLOCK(fib6_walker_lock);
+static DEFINE_RWLOCK(fib6_walker_lock);
 #ifdef CONFIG_IPV6_SUBTREES
 #define FWS_INIT FWS_S
-#define SUBTREE(fn) ((fn)->subtree)
 #else
 #define FWS_INIT FWS_L
-#define SUBTREE(fn) NULL
 #endif
 static void fib6_prune_clones(struct fib6_node *fn, struct rt6_info *rt);
+static struct rt6_info * fib6_find_prefix(struct fib6_node *fn);
 static struct fib6_node * fib6_repair_tree(struct fib6_node *fn);
+static int fib6_walk(struct fib6_walker_t *w);
+static int fib6_walk_continue(struct fib6_walker_t *w);
 /*
 *      A routing update causes an increase of the serial number on the
@@ -94,13 +95,31 @@ static __u32 rt_sernum;
 static DEFINE_TIMER(ip6_fib_timer, fib6_run_gc, 0, 0);
-struct fib6_walker_t fib6_walker_list = {
+static struct fib6_walker_t fib6_walker_list = {
        .prev   = &fib6_walker_list,
        .next   = &fib6_walker_list, 
 };
 #define FOR_WALKERS(w) for ((w)=fib6_walker_list.next; (w) != &fib6_walker_list; (w)=(w)->next)
+static inline void fib6_walker_link(struct fib6_walker_t *w)
+{
+        write_lock_bh(&fib6_walker_lock);
+        w->next = fib6_walker_list.next;
+        w->prev = &fib6_walker_list;
+        w->next->prev = w;
+        w->prev->next = w;
+        write_unlock_bh(&fib6_walker_lock);
+}
+static inline void fib6_walker_unlink(struct fib6_walker_t *w)
+{
+        write_lock_bh(&fib6_walker_lock);
+        w->next->prev = w->prev;
+        w->prev->next = w->next;
+        w->prev = w->next = w;
+        write_unlock_bh(&fib6_walker_lock);
+}
 static __inline__ u32 fib6_new_sernum(void)
 {
        u32 n = ++rt_sernum;
@@ -148,6 +167,253 @@ static __inline__ void rt6_release(struct rt6_info *rt)
                dst_free(&rt->u.dst);
 }
+static struct fib6_table fib6_main_tbl = {
+        .tb6_id         = RT6_TABLE_MAIN,
+        .tb6_lock       = RW_LOCK_UNLOCKED,
+        .tb6_root       = {
+                .leaf           = &ip6_null_entry,
+                .fn_flags       = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
+        },
+};
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+#define FIB_TABLE_HASHSZ 256
+#else
+#define FIB_TABLE_HASHSZ 1
+#endif
+static struct hlist_head fib_table_hash[FIB_TABLE_HASHSZ];
+static void fib6_link_table(struct fib6_table *tb)
+{
+        unsigned int h;
+        h = tb->tb6_id & (FIB_TABLE_HASHSZ - 1);
+        /*
+         * No protection necessary, this is the only list mutatation
+         * operation, tables never disappear once they exist.
+         */
+        hlist_add_head_rcu(&tb->tb6_hlist, &fib_table_hash[h]);
+}
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+static struct fib6_table fib6_local_tbl = {
+        .tb6_id         = RT6_TABLE_LOCAL,
+        .tb6_lock       = RW_LOCK_UNLOCKED,
+        .tb6_root       = {
+                .leaf           = &ip6_null_entry,
+                .fn_flags       = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
+        },
+};
+static struct fib6_table *fib6_alloc_table(u32 id)
+{
+        struct fib6_table *table;
+        table = kzalloc(sizeof(*table), GFP_ATOMIC);
+        if (table != NULL) {
+                table->tb6_id = id;
+                table->tb6_lock = RW_LOCK_UNLOCKED;
+                table->tb6_root.leaf = &ip6_null_entry;
+                table->tb6_root.fn_flags = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
+        }
+        return table;
+}
+struct fib6_table *fib6_new_table(u32 id)
+{
+        struct fib6_table *tb;
+        if (id == 0)
+                id = RT6_TABLE_MAIN;
+        tb = fib6_get_table(id);
+        if (tb)
+                return tb;
+        tb = fib6_alloc_table(id);
+        if (tb != NULL)
+                fib6_link_table(tb);
+        return tb;
+}
+struct fib6_table *fib6_get_table(u32 id)
+{
+        struct fib6_table *tb;
+        struct hlist_node *node;
+        unsigned int h;
+        if (id == 0)
+                id = RT6_TABLE_MAIN;
+        h = id & (FIB_TABLE_HASHSZ - 1);
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(tb, node, &fib_table_hash[h], tb6_hlist) {
+                if (tb->tb6_id == id) {
+                        rcu_read_unlock();
+                        return tb;
+                }
+        }
+        rcu_read_unlock();
+        return NULL;
+}
+static void __init fib6_tables_init(void)
+{
+        fib6_link_table(&fib6_main_tbl);
+        fib6_link_table(&fib6_local_tbl);
+}
+#else
+struct fib6_table *fib6_new_table(u32 id)
+{
+        return fib6_get_table(id);
+}
+struct fib6_table *fib6_get_table(u32 id)
+{
+        return &fib6_main_tbl;
+}
+struct dst_entry *fib6_rule_lookup(struct flowi *fl, int flags,
+                                   pol_lookup_t lookup)
+{
+        return (struct dst_entry *) lookup(&fib6_main_tbl, fl, flags);
+}
+static void __init fib6_tables_init(void)
+{
+        fib6_link_table(&fib6_main_tbl);
+}
+#endif
+static int fib6_dump_node(struct fib6_walker_t *w)
+{
+        int res;
+        struct rt6_info *rt;
+        for (rt = w->leaf; rt; rt = rt->u.next) {
+                res = rt6_dump_route(rt, w->args);
+                if (res < 0) {
+                        /* Frame is full, suspend walking */
+                        w->leaf = rt;
+                        return 1;
+                }
+                BUG_TRAP(res!=0);
+        }
+        w->leaf = NULL;
+        return 0;
+}
+static void fib6_dump_end(struct netlink_callback *cb)
+{
+        struct fib6_walker_t *w = (void*)cb->args[2];
+        if (w) {
+                cb->args[2] = 0;
+                kfree(w);
+        }
+        cb->done = (void*)cb->args[3];
+        cb->args[1] = 3;
+}
+static int fib6_dump_done(struct netlink_callback *cb)
+{
+        fib6_dump_end(cb);
+        return cb->done ? cb->done(cb) : 0;
+}
+static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
+                           struct netlink_callback *cb)
+{
+        struct fib6_walker_t *w;
+        int res;
+        w = (void *)cb->args[2];
+        w->root = &table->tb6_root;
+        if (cb->args[4] == 0) {
+                read_lock_bh(&table->tb6_lock);
+                res = fib6_walk(w);
+                read_unlock_bh(&table->tb6_lock);
+                if (res > 0)
+                        cb->args[4] = 1;
+        } else {
+                read_lock_bh(&table->tb6_lock);
+                res = fib6_walk_continue(w);
+                read_unlock_bh(&table->tb6_lock);
+                if (res != 0) {
+                        if (res < 0)
+                                fib6_walker_unlink(w);
+                        goto end;
+                }
+                fib6_walker_unlink(w);
+                cb->args[4] = 0;
+        }
+end:
+        return res;
+}
+int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        unsigned int h, s_h;
+        unsigned int e = 0, s_e;
+        struct rt6_rtnl_dump_arg arg;
+        struct fib6_walker_t *w;
+        struct fib6_table *tb;
+        struct hlist_node *node;
+        int res = 0;
+        s_h = cb->args[0];
+        s_e = cb->args[1];
+        w = (void *)cb->args[2];
+        if (w == NULL) {
+                /* New dump:
+                 *
+                 * 1. hook callback destructor.
+                 */
+                cb->args[3] = (long)cb->done;
+                cb->done = fib6_dump_done;
+                /*
+                 * 2. allocate and initialize walker.
+                 */
+                w = kzalloc(sizeof(*w), GFP_ATOMIC);
+                if (w == NULL)
+                        return -ENOMEM;
+                w->func = fib6_dump_node;
+                cb->args[2] = (long)w;
+        }
+        arg.skb = skb;
+        arg.cb = cb;
+        w->args = &arg;
+        for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
+                e = 0;
+                hlist_for_each_entry(tb, node, &fib_table_hash[h], tb6_hlist) {
+                        if (e < s_e)
+                                goto next;
+                        res = fib6_dump_table(tb, skb, cb);
+                        if (res != 0)
+                                goto out;
+next:
+                        e++;
+                }
+        }
+out:
+        cb->args[1] = e;
+        cb->args[0] = h;
+        res = res < 0 ? res : skb->len;
+        if (res <= 0)
+                fib6_dump_end(cb);
+        return res;
+}
 /*
 *      Routing Table
@@ -344,7 +610,7 @@ insert_above:
 */
 static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
-                struct nlmsghdr *nlh,  struct netlink_skb_parms *req)
+                            struct nl_info *info)
 {
        struct rt6_info *iter = NULL;
        struct rt6_info **ins;
@@ -399,7 +665,7 @@ out:
        *ins = rt;
        rt->rt6i_node = fn;
        atomic_inc(&rt->rt6i_ref);
-        inet6_rt_notify(RTM_NEWROUTE, rt, nlh, req);
+        inet6_rt_notify(RTM_NEWROUTE, rt, info);
        rt6_stats.fib_rt_entries++;
        if ((fn->fn_flags & RTN_RTINFO) == 0) {
@@ -429,10 +695,9 @@ void fib6_force_start_gc(void)
 *      with source addr info in sub-trees
 */
-int fib6_add(struct fib6_node *root, struct rt6_info *rt, 
+int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
-                struct nlmsghdr *nlh, void *_rtattr, struct netlink_skb_parms *req)
 {
-        struct fib6_node *fn;
+        struct fib6_node *fn, *pn = NULL;
        int err = -ENOMEM;
        fn = fib6_add_1(root, &rt->rt6i_dst.addr, sizeof(struct in6_addr),
@@ -441,6 +706,8 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
        if (fn == NULL)
                goto out;
+        pn = fn;
 #ifdef CONFIG_IPV6_SUBTREES
        if (rt->rt6i_src.plen) {
                struct fib6_node *sn;
@@ -486,10 +753,6 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
                        /* Now link new subtree to main tree */
                        sfn->parent = fn;
                        fn->subtree = sfn;
-                        if (fn->leaf == NULL) {
-                                fn->leaf = rt;
-                                atomic_inc(&rt->rt6i_ref);
-                        }
                } else {
                        sn = fib6_add_1(fn->subtree, &rt->rt6i_src.addr,
                                        sizeof(struct in6_addr), rt->rt6i_src.plen,
@@ -499,21 +762,42 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
                                goto st_failure;
                }
+                if (fn->leaf == NULL) {
+                        fn->leaf = rt;
+                        atomic_inc(&rt->rt6i_ref);
+                }
                fn = sn;
        }
 #endif
-        err = fib6_add_rt2node(fn, rt, nlh, req);
+        err = fib6_add_rt2node(fn, rt, info);
        if (err == 0) {
                fib6_start_gc(rt);
                if (!(rt->rt6i_flags&RTF_CACHE))
-                        fib6_prune_clones(fn, rt);
+                        fib6_prune_clones(pn, rt);
        }
 out:
-        if (err)
+        if (err) {
+#ifdef CONFIG_IPV6_SUBTREES
+                /*
+                 * If fib6_add_1 has cleared the old leaf pointer in the
+                 * super-tree leaf node we have to find a new one for it.
+                 */
+                if (pn != fn && !pn->leaf && !(pn->fn_flags & RTN_RTINFO)) {
+                        pn->leaf = fib6_find_prefix(pn);
+#if RT6_DEBUG >= 2
+                        if (!pn->leaf) {
+                                BUG_TRAP(pn->leaf != NULL);
+                                pn->leaf = &ip6_null_entry;
+                        }
+#endif
+                        atomic_inc(&pn->leaf->rt6i_ref);
+                }
+#endif
                dst_free(&rt->u.dst);
+        }
        return err;
 #ifdef CONFIG_IPV6_SUBTREES
@@ -544,6 +828,9 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
        struct fib6_node *fn;
        int dir;
+        if (unlikely(args->offset == 0))
+                return NULL;
        /*
         *      Descend on a tree
         */
@@ -565,33 +852,26 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
                break;
        }
-        while ((fn->fn_flags & RTN_ROOT) == 0) {
+        while(fn) {
-#ifdef CONFIG_IPV6_SUBTREES
+                if (FIB6_SUBTREE(fn) || fn->fn_flags & RTN_RTINFO) {
-                if (fn->subtree) {
-                        struct fib6_node *st;
-                        struct lookup_args *narg;
-                        narg = args + 1;
-                        if (narg->addr) {
-                                st = fib6_lookup_1(fn->subtree, narg);
-                                if (st && !(st->fn_flags & RTN_ROOT))
-                                        return st;
-                        }
-                }
-#endif
-                if (fn->fn_flags & RTN_RTINFO) {
                        struct rt6key *key;
                        key = (struct rt6key *) ((u8 *) fn->leaf +
                                                 args->offset);
-                        if (ipv6_prefix_equal(&key->addr, args->addr, key->plen))
+                        if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) {
-                                return fn;
+#ifdef CONFIG_IPV6_SUBTREES
+                                if (fn->subtree)
+                                        fn = fib6_lookup_1(fn->subtree, args + 1);
+#endif
+                                if (!fn || fn->fn_flags & RTN_RTINFO)
+                                        return fn;
+                        }
                }
+                if (fn->fn_flags & RTN_ROOT)
+                        break;
                fn = fn->parent;
        }
@@ -601,18 +881,24 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
 struct fib6_node * fib6_lookup(struct fib6_node *root, struct in6_addr *daddr,
                               struct in6_addr *saddr)
 {
-        struct lookup_args args[2];
        struct fib6_node *fn;
+        struct lookup_args args[] = {
-        args[0].offset = offsetof(struct rt6_info, rt6i_dst);
+                {
-        args[0].addr = daddr;
+                        .offset = offsetof(struct rt6_info, rt6i_dst),
+                        .addr = daddr,
+                },
 #ifdef CONFIG_IPV6_SUBTREES
-        args[1].offset = offsetof(struct rt6_info, rt6i_src);
+                {
-        args[1].addr = saddr;
+                        .offset = offsetof(struct rt6_info, rt6i_src),
+                        .addr = saddr,
+                },
 #endif
+                {
+                        .offset = 0,    /* sentinel */
+                }
+        };
-        fn = fib6_lookup_1(root, args);
+        fn = fib6_lookup_1(root, daddr ? args : args + 1);
        if (fn == NULL || fn->fn_flags & RTN_TL_ROOT)
                fn = root;
@@ -668,10 +954,8 @@ struct fib6_node * fib6_locate(struct fib6_node *root,
 #ifdef CONFIG_IPV6_SUBTREES
        if (src_len) {
                BUG_TRAP(saddr!=NULL);
-                if (fn == NULL)
+                if (fn && fn->subtree)
-                        fn = fn->subtree;
+                        fn = fib6_locate_1(fn->subtree, saddr, src_len,
-                if (fn)
-                        fn = fib6_locate_1(fn, saddr, src_len,
                                           offsetof(struct rt6_info, rt6i_src));
        }
 #endif
@@ -700,7 +984,7 @@ static struct rt6_info * fib6_find_prefix(struct fib6_node *fn)
                if(fn->right)
                        return fn->right->leaf;
-                fn = SUBTREE(fn);
+                fn = FIB6_SUBTREE(fn);
        }
        return NULL;
 }
@@ -731,7 +1015,7 @@ static struct fib6_node * fib6_repair_tree(struct fib6_node *fn)
                if (fn->right) child = fn->right, children |= 1;
                if (fn->left) child = fn->left, children |= 2;
-                if (children == 3 || SUBTREE(fn) 
+                if (children == 3 || FIB6_SUBTREE(fn)
 #ifdef CONFIG_IPV6_SUBTREES
                    /* Subtree root (i.e. fn) may have one child */
                    || (children && fn->fn_flags&RTN_ROOT)
@@ -750,9 +1034,9 @@ static struct fib6_node * fib6_repair_tree(struct fib6_node *fn)
                pn = fn->parent;
 #ifdef CONFIG_IPV6_SUBTREES
-                if (SUBTREE(pn) == fn) {
+                if (FIB6_SUBTREE(pn) == fn) {
                        BUG_TRAP(fn->fn_flags&RTN_ROOT);
-                        SUBTREE(pn) = NULL;
+                        FIB6_SUBTREE(pn) = NULL;
                        nstate = FWS_L;
                } else {
                        BUG_TRAP(!(fn->fn_flags&RTN_ROOT));
@@ -800,7 +1084,7 @@ static struct fib6_node * fib6_repair_tree(struct fib6_node *fn)
                read_unlock(&fib6_walker_lock);
                node_free(fn);
-                if (pn->fn_flags&RTN_RTINFO || SUBTREE(pn))
+                if (pn->fn_flags&RTN_RTINFO || FIB6_SUBTREE(pn))
                        return pn;
                rt6_release(pn->leaf);
@@ -810,7 +1094,7 @@ static struct fib6_node * fib6_repair_tree(struct fib6_node *fn)
 }
 static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
-    struct nlmsghdr *nlh, void *_rtattr, struct netlink_skb_parms *req)
+                           struct nl_info *info)
 {
        struct fib6_walker_t *w;
        struct rt6_info *rt = *rtp;
@@ -866,11 +1150,11 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
                if (atomic_read(&rt->rt6i_ref) != 1) BUG();
        }
-        inet6_rt_notify(RTM_DELROUTE, rt, nlh, req);
+        inet6_rt_notify(RTM_DELROUTE, rt, info);
        rt6_release(rt);
 }
-int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct netlink_skb_parms *req)
+int fib6_del(struct rt6_info *rt, struct nl_info *info)
 {
        struct fib6_node *fn = rt->rt6i_node;
        struct rt6_info **rtp;
@@ -886,8 +1170,18 @@ int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct ne
        BUG_TRAP(fn->fn_flags&RTN_RTINFO);
-        if (!(rt->rt6i_flags&RTF_CACHE))
+        if (!(rt->rt6i_flags&RTF_CACHE)) {
-                fib6_prune_clones(fn, rt);
+                struct fib6_node *pn = fn;
+#ifdef CONFIG_IPV6_SUBTREES
+                /* clones of this route might be in another subtree */
+                if (rt->rt6i_src.plen) {
+                        while (!(pn->fn_flags&RTN_ROOT))
+                                pn = pn->parent;
+                        pn = pn->parent;
+                }
+#endif
+                fib6_prune_clones(pn, rt);
+        }
        /*
         *      Walk the leaf entries looking for ourself
@@ -895,7 +1189,7 @@ int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct ne
        for (rtp = &fn->leaf; *rtp; rtp = &(*rtp)->u.next) {
                if (*rtp == rt) {
-                        fib6_del_route(fn, rtp, nlh, _rtattr, req);
+                        fib6_del_route(fn, rtp, info);
                        return 0;
                }
        }
@@ -926,7 +1220,7 @@ int fib6_del(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct ne
 *      <0  -> walk is terminated by an error.
 */
-int fib6_walk_continue(struct fib6_walker_t *w)
+static int fib6_walk_continue(struct fib6_walker_t *w)
 {
        struct fib6_node *fn, *pn;
@@ -943,8 +1237,8 @@ int fib6_walk_continue(struct fib6_walker_t *w)
                switch (w->state) {
 #ifdef CONFIG_IPV6_SUBTREES
                case FWS_S:
-                        if (SUBTREE(fn)) {
+                        if (FIB6_SUBTREE(fn)) {
-                                w->node = SUBTREE(fn);
+                                w->node = FIB6_SUBTREE(fn);
                                continue;
                        }
                        w->state = FWS_L;
@@ -978,7 +1272,7 @@ int fib6_walk_continue(struct fib6_walker_t *w)
                        pn = fn->parent;
                        w->node = pn;
 #ifdef CONFIG_IPV6_SUBTREES
-                        if (SUBTREE(pn) == fn) {
+                        if (FIB6_SUBTREE(pn) == fn) {
                                BUG_TRAP(fn->fn_flags&RTN_ROOT);
                                w->state = FWS_L;
                                continue;
@@ -1000,7 +1294,7 @@ int fib6_walk_continue(struct fib6_walker_t *w)
        }
 }
-int fib6_walk(struct fib6_walker_t *w)
+static int fib6_walk(struct fib6_walker_t *w)
 {
        int res;
@@ -1024,7 +1318,7 @@ static int fib6_clean_node(struct fib6_walker_t *w)
                res = c->func(rt, c->arg);
                if (res < 0) {
                        w->leaf = rt;
-                        res = fib6_del(rt, NULL, NULL, NULL);
+                        res = fib6_del(rt, NULL);
                        if (res) {
 #if RT6_DEBUG >= 2
                                printk(KERN_DEBUG "fib6_clean_node: del failed: rt=%p@%p err=%d\n", rt, rt->rt6i_node, res);
@@ -1050,9 +1344,9 @@ static int fib6_clean_node(struct fib6_walker_t *w)
 *      ignoring pure split nodes) will be scanned.
 */
-void fib6_clean_tree(struct fib6_node *root,
+static void fib6_clean_tree(struct fib6_node *root,
-                     int (*func)(struct rt6_info *, void *arg),
+                            int (*func)(struct rt6_info *, void *arg),
-                     int prune, void *arg)
+                            int prune, void *arg)
 {
        struct fib6_cleaner_t c;
@@ -1065,6 +1359,25 @@ void fib6_clean_tree(struct fib6_node *root,
        fib6_walk(&c.w);
 }
+void fib6_clean_all(int (*func)(struct rt6_info *, void *arg),
+                    int prune, void *arg)
+{
+        struct fib6_table *table;
+        struct hlist_node *node;
+        unsigned int h;
+        rcu_read_lock();
+        for (h = 0; h < FIB_TABLE_HASHSZ; h++) {
+                hlist_for_each_entry_rcu(table, node, &fib_table_hash[h],
+                                         tb6_hlist) {
+                        write_lock_bh(&table->tb6_lock);
+                        fib6_clean_tree(&table->tb6_root, func, prune, arg);
+                        write_unlock_bh(&table->tb6_lock);
+                }
+        }
+        rcu_read_unlock();
+}
 static int fib6_prune_clone(struct rt6_info *rt, void *arg)
 {
        if (rt->rt6i_flags & RTF_CACHE) {
@@ -1143,11 +1456,8 @@ void fib6_run_gc(unsigned long dummy)
        }
        gc_args.more = 0;
-        write_lock_bh(&rt6_lock);
        ndisc_dst_gc(&gc_args.more);
-        fib6_clean_tree(&ip6_routing_table, fib6_age, 0, NULL);
+        fib6_clean_all(fib6_age, 0, NULL);
-        write_unlock_bh(&rt6_lock);
        if (gc_args.more)
                mod_timer(&ip6_fib_timer, jiffies + ip6_rt_gc_interval);
@@ -1162,10 +1472,10 @@ void __init fib6_init(void)
 {
        fib6_node_kmem = kmem_cache_create("fib6_nodes",
                                           sizeof(struct fib6_node),
-                                           0, SLAB_HWCACHE_ALIGN,
+                                           0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
                                           NULL, NULL);
-        if (!fib6_node_kmem)
-                panic("cannot create fib6_nodes cache");
+        fib6_tables_init();
 }
 void fib6_gc_cleanup(void)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index f9ca63912fbf..1d672b0547f2 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -10,7 +10,6 @@
 */
 #include <linux/capability.h>
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index aceee252503d..6b8e6d76a58b 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -71,6 +71,8 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
                goto out;
        }
+        memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
        /*
         * Store incoming device index. When the packet will
         * be queued, we cannot refer to skb->dev anymore.
@@ -84,14 +86,9 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         */
        IP6CB(skb)->iif = skb->dst ? ((struct rt6_info *)skb->dst)->rt6i_idev->dev->ifindex : dev->ifindex;
-        if (skb->len < sizeof(struct ipv6hdr))
+        if (unlikely(!pskb_may_pull(skb, sizeof(*hdr))))
                goto err;
-        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) {
-                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
-                goto drop;
-        }
        hdr = skb->nh.ipv6h;
        if (hdr->version != 6)
@@ -114,7 +111,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
        }
        if (hdr->nexthdr == NEXTHDR_HOP) {
-                if (ipv6_parse_hopopts(skb) < 0) {
+                if (ipv6_parse_hopopts(&skb) < 0) {
                        IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
                        return 0;
                }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index abb94de33768..66716911962e 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -28,7 +28,6 @@
 *                              for datagram xmit
 */
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/string.h>
@@ -148,7 +147,7 @@ static int ip6_output2(struct sk_buff *skb)
 int ip6_output(struct sk_buff *skb)
 {
-        if ((skb->len > dst_mtu(skb->dst) && !skb_shinfo(skb)->gso_size) ||
+        if ((skb->len > dst_mtu(skb->dst) && !skb_is_gso(skb)) ||
                                dst_allfrag(skb->dst))
                return ip6_fragment(skb, ip6_output2);
        else
@@ -230,7 +229,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
        skb->priority = sk->sk_priority;
        mtu = dst_mtu(dst);
-        if ((skb->len <= mtu) || ipfragok) {
+        if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) {
                IP6_INC_STATS(IPSTATS_MIB_OUTREQUESTS);
                return NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev,
                                dst_output);
@@ -309,6 +308,56 @@ static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
        return 0;
 }
+static int ip6_forward_proxy_check(struct sk_buff *skb)
+{
+        struct ipv6hdr *hdr = skb->nh.ipv6h;
+        u8 nexthdr = hdr->nexthdr;
+        int offset;
+        if (ipv6_ext_hdr(nexthdr)) {
+                offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr);
+                if (offset < 0)
+                        return 0;
+        } else
+                offset = sizeof(struct ipv6hdr);
+        if (nexthdr == IPPROTO_ICMPV6) {
+                struct icmp6hdr *icmp6;
+                if (!pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data))
+                        return 0;
+                icmp6 = (struct icmp6hdr *)(skb->nh.raw + offset);
+                switch (icmp6->icmp6_type) {
+                case NDISC_ROUTER_SOLICITATION:
+                case NDISC_ROUTER_ADVERTISEMENT:
+                case NDISC_NEIGHBOUR_SOLICITATION:
+                case NDISC_NEIGHBOUR_ADVERTISEMENT:
+                case NDISC_REDIRECT:
+                        /* For reaction involving unicast neighbor discovery
+                         * message destined to the proxied address, pass it to
+                         * input function.
+                         */
+                        return 1;
+                default:
+                        break;
+                }
+        }
+        /*
+         * The proxying router can't forward traffic sent to a link-local
+         * address, so signal the sender and discard the packet. This
+         * behavior is clarified by the MIPv6 specification.
+         */
+        if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
+                dst_link_failure(skb);
+                return -1;
+        }
+        return 0;
+}
 static inline int ip6_forward_finish(struct sk_buff *skb)
 {
        return dst_output(skb);
@@ -357,11 +406,24 @@ int ip6_forward(struct sk_buff *skb)
                skb->dev = dst->dev;
                icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
                            0, skb->dev);
+                IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
                kfree_skb(skb);
                return -ETIMEDOUT;
        }
+        /* XXX: idev->cnf.proxy_ndp? */
+        if (ipv6_devconf.proxy_ndp &&
+            pneigh_lookup(&nd_tbl, &hdr->daddr, skb->dev, 0)) {
+                int proxied = ip6_forward_proxy_check(skb);
+                if (proxied > 0)
+                        return ip6_input(skb);
+                else if (proxied < 0) {
+                        IP6_INC_STATS(IPSTATS_MIB_INDISCARDS);
+                        goto drop;
+                }
+        }
        if (!xfrm6_route_forward(skb)) {
                IP6_INC_STATS(IPSTATS_MIB_INDISCARDS);
                goto drop;
@@ -475,17 +537,25 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
                switch (**nexthdr) {
                case NEXTHDR_HOP:
+                        break;
                case NEXTHDR_ROUTING:
+                        found_rhdr = 1;
+                        break;
                case NEXTHDR_DEST:
-                        if (**nexthdr == NEXTHDR_ROUTING) found_rhdr = 1;
+#ifdef CONFIG_IPV6_MIP6
-                        if (**nexthdr == NEXTHDR_DEST && found_rhdr) return offset;
+                        if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
-                        offset += ipv6_optlen(exthdr);
+                                break;
-                        *nexthdr = &exthdr->nexthdr;
+#endif
-                        exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+                        if (found_rhdr)
+                                return offset;
                        break;
                default :
                        return offset;
                }
+                offset += ipv6_optlen(exthdr);
+                *nexthdr = &exthdr->nexthdr;
+                exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
        }
        return offset;
@@ -596,6 +666,9 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                        }
                        
                        err = output(skb);
+                        if(!err)
+                                IP6_INC_STATS(IPSTATS_MIB_FRAGCREATES);
                        if (err || !frag)
                                break;
@@ -707,12 +780,11 @@ slow_path:
                /*
                 *      Put this fragment into the sending queue.
                 */
-                IP6_INC_STATS(IPSTATS_MIB_FRAGCREATES);
                err = output(frag);
                if (err)
                        goto fail;
+                IP6_INC_STATS(IPSTATS_MIB_FRAGCREATES);
        }
        kfree_skb(skb);
        IP6_INC_STATS(IPSTATS_MIB_FRAGOKS);
@@ -724,48 +796,59 @@ fail:
        return err;
 }
-int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+static inline int ip6_rt_check(struct rt6key *rt_key,
+                               struct in6_addr *fl_addr,
+                               struct in6_addr *addr_cache)
 {
-        int err = 0;
+        return ((rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
+                (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache)));
+}
-        *dst = NULL;
+static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
-        if (sk) {
+                                          struct dst_entry *dst,
-                struct ipv6_pinfo *np = inet6_sk(sk);
+                                          struct flowi *fl)
-        
+{
-                *dst = sk_dst_check(sk, np->dst_cookie);
+        struct ipv6_pinfo *np = inet6_sk(sk);
-                if (*dst) {
+        struct rt6_info *rt = (struct rt6_info *)dst;
-                        struct rt6_info *rt = (struct rt6_info*)*dst;
-        
+        if (!dst)
-                        /* Yes, checking route validity in not connected
+                goto out;
-                         * case is not very simple. Take into account,
-                         * that we do not support routing by source, TOS,
+        /* Yes, checking route validity in not connected
-                         * and MSG_DONTROUTE            --ANK (980726)
+         * case is not very simple. Take into account,
-                         *
+         * that we do not support routing by source, TOS,
-                         * 1. If route was host route, check that
+         * and MSG_DONTROUTE            --ANK (980726)
-                         *    cached destination is current.
+         *
-                         *    If it is network route, we still may
+         * 1. ip6_rt_check(): If route was host route,
-                         *    check its validity using saved pointer
+         *    check that cached destination is current.
-                         *    to the last used address: daddr_cache.
+         *    If it is network route, we still may
-                         *    We do not want to save whole address now,
+         *    check its validity using saved pointer
-                         *    (because main consumer of this service
+         *    to the last used address: daddr_cache.
-                         *    is tcp, which has not this problem),
+         *    We do not want to save whole address now,
-                         *    so that the last trick works only on connected
+         *    (because main consumer of this service
-                         *    sockets.
+         *    is tcp, which has not this problem),
-                         * 2. oif also should be the same.
+         *    so that the last trick works only on connected
-                         */
+         *    sockets.
-                        if (((rt->rt6i_dst.plen != 128 ||
+         * 2. oif also should be the same.
-                              !ipv6_addr_equal(&fl->fl6_dst,
+         */
-                                               &rt->rt6i_dst.addr))
+        if (ip6_rt_check(&rt->rt6i_dst, &fl->fl6_dst, np->daddr_cache) ||
-                             && (np->daddr_cache == NULL ||
+#ifdef CONFIG_IPV6_SUBTREES
-                                 !ipv6_addr_equal(&fl->fl6_dst,
+            ip6_rt_check(&rt->rt6i_src, &fl->fl6_src, np->saddr_cache) ||
-                                                  np->daddr_cache)))
+#endif
-                            || (fl->oif && fl->oif != (*dst)->dev->ifindex)) {
+            (fl->oif && fl->oif != dst->dev->ifindex)) {
-                                dst_release(*dst);
+                dst_release(dst);
-                                *dst = NULL;
+                dst = NULL;
-                        }
-                }
        }
+out:
+        return dst;
+}
+static int ip6_dst_lookup_tail(struct sock *sk,
+                               struct dst_entry **dst, struct flowi *fl)
+{
+        int err;
        if (*dst == NULL)
                *dst = ip6_route_output(sk, fl);
@@ -774,7 +857,6 @@ int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
        if (ipv6_addr_any(&fl->fl6_src)) {
                err = ipv6_get_saddr(*dst, &fl->fl6_dst, &fl->fl6_src);
                if (err)
                        goto out_err_release;
        }
@@ -787,8 +869,48 @@ out_err_release:
        return err;
 }
+/**
+ *      ip6_dst_lookup - perform route lookup on flow
+ *      @sk: socket which provides route info
+ *      @dst: pointer to dst_entry * for result
+ *      @fl: flow to lookup
+ *
+ *      This function performs a route lookup on the given flow.
+ *
+ *      It returns zero on success, or a standard errno code on error.
+ */
+int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+{
+        *dst = NULL;
+        return ip6_dst_lookup_tail(sk, dst, fl);
+}
 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
+/**
+ *      ip6_sk_dst_lookup - perform socket cached route lookup on flow
+ *      @sk: socket which provides the dst cache and route info
+ *      @dst: pointer to dst_entry * for result
+ *      @fl: flow to lookup
+ *
+ *      This function performs a route lookup on the given flow with the
+ *      possibility of using the cached route in the socket if it is valid.
+ *      It will take the socket dst lock when operating on the dst cache.
+ *      As a result, this function can only be used in process context.
+ *
+ *      It returns zero on success, or a standard errno code on error.
+ */
+int ip6_sk_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+{
+        *dst = NULL;
+        if (sk) {
+                *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
+                *dst = ip6_sk_dst_check(sk, *dst, fl);
+        }
+        return ip6_dst_lookup_tail(sk, dst, fl);
+}
+EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup);
 static inline int ip6_ufo_append_data(struct sock *sk,
                        int getfrag(void *from, char *to, int offset, int len,
                        int odd, struct sk_buff *skb),
@@ -822,7 +944,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                /* initialize protocol header pointer */
                skb->h.raw = skb->data + fragheaderlen;
-                skb->ip_summed = CHECKSUM_HW;
+                skb->ip_summed = CHECKSUM_PARTIAL;
                skb->csum = 0;
                sk->sk_sndmsg_off = 0;
        }
@@ -835,7 +957,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                /* specify the length of each IP datagram fragment*/
                skb_shinfo(skb)->gso_size = mtu - fragheaderlen - 
                                            sizeof(struct frag_hdr);
-                skb_shinfo(skb)->gso_type = SKB_GSO_UDPV4;
+                skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                ipv6_select_ident(skb, &fhdr);
                skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
                __skb_queue_tail(&sk->sk_write_queue, skb);
@@ -919,7 +1041,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);
-        fragheaderlen = sizeof(struct ipv6hdr) + (opt ? opt->opt_nflen : 0);
+        fragheaderlen = sizeof(struct ipv6hdr) + rt->u.dst.nfheader_len + (opt ? opt->opt_nflen : 0);
        maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
        if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
@@ -1051,7 +1173,7 @@ alloc_new_skb:
                                skb_prev->csum = csum_sub(skb_prev->csum,
                                                          skb->csum);
                                data += fraggap;
-                                skb_trim(skb_prev, maxfraglen);
+                                pskb_trim_unique(skb_prev, maxfraglen);
                        }
                        copy = datalen - transhdrlen - fraggap;
                        if (copy < 0) {
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index a995796b5a57..84d7ebdb9d21 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -19,7 +19,6 @@
 *
 */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/capability.h>
 #include <linux/errno.h>
@@ -568,10 +567,9 @@ static inline struct ipv6_txoptions *create_tel(__u8 encap_limit)
        int opt_len = sizeof(*opt) + 8;
-        if (!(opt = kmalloc(opt_len, GFP_ATOMIC))) {
+        if (!(opt = kzalloc(opt_len, GFP_ATOMIC))) {
                return NULL;
        }
-        memset(opt, 0, opt_len);
        opt->tot_len = opt_len;
        opt->dst0opt = (struct ipv6_opt_hdr *) (opt + 1);
        opt->opt_nflen = 8;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index f28cd37feed3..a2860e35efd7 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -30,7 +30,6 @@
 *  The decompression of IP datagram MUST be done after the reassembly, 
 *  AH/ESP processing.
 */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
@@ -54,7 +53,7 @@
 struct ipcomp6_tfms {
        struct list_head list;
-        struct crypto_tfm **tfms;
+        struct crypto_comp **tfms;
        int users;
 };
@@ -71,7 +70,7 @@ static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
        int plen, dlen;
        struct ipcomp_data *ipcd = x->data;
        u8 *start, *scratch;
-        struct crypto_tfm *tfm;
+        struct crypto_comp *tfm;
        int cpu;
        if (skb_linearize_cow(skb))
@@ -110,7 +109,8 @@ static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
                goto out_put_cpu;
        }
-        skb_put(skb, dlen - plen);
+        skb->truesize += dlen - plen;
+        __skb_put(skb, dlen - plen);
        memcpy(skb->data, scratch, dlen);
        err = ipch->nexthdr;
@@ -129,7 +129,7 @@ static int ipcomp6_output(struct xfrm_state *x, struct sk_buff *skb)
        struct ipcomp_data *ipcd = x->data;
        int plen, dlen;
        u8 *start, *scratch;
-        struct crypto_tfm *tfm;
+        struct crypto_comp *tfm;
        int cpu;
        hdr_len = skb->h.raw - skb->data;
@@ -178,7 +178,7 @@ out_ok:
 static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                int type, int code, int offset, __u32 info)
 {
-        u32 spi;
+        __be32 spi;
        struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
        struct ipv6_comp_hdr *ipcomph = (struct ipv6_comp_hdr*)(skb->data+offset);
        struct xfrm_state *x;
@@ -212,7 +212,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
        memcpy(t->id.daddr.a6, x->id.daddr.a6, sizeof(struct in6_addr));
        memcpy(&t->sel, &x->sel, sizeof(t->sel));
        t->props.family = AF_INET6;
-        t->props.mode = 1;
+        t->props.mode = XFRM_MODE_TUNNEL;
        memcpy(t->props.saddr.a6, x->props.saddr.a6, sizeof(struct in6_addr));
        if (xfrm_init_state(t))
@@ -234,7 +234,7 @@ static int ipcomp6_tunnel_attach(struct xfrm_state *x)
 {
        int err = 0;
        struct xfrm_state *t = NULL;
-        u32 spi;
+        __be32 spi;
        spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&x->props.saddr);
        if (spi)
@@ -301,7 +301,7 @@ static void **ipcomp6_alloc_scratches(void)
        return scratches;
 }
-static void ipcomp6_free_tfms(struct crypto_tfm **tfms)
+static void ipcomp6_free_tfms(struct crypto_comp **tfms)
 {
        struct ipcomp6_tfms *pos;
        int cpu;
@@ -323,28 +323,28 @@ static void ipcomp6_free_tfms(struct crypto_tfm **tfms)
                return;
        for_each_possible_cpu(cpu) {
-                struct crypto_tfm *tfm = *per_cpu_ptr(tfms, cpu);
+                struct crypto_comp *tfm = *per_cpu_ptr(tfms, cpu);
-                crypto_free_tfm(tfm);
+                crypto_free_comp(tfm);
        }
        free_percpu(tfms);
 }
-static struct crypto_tfm **ipcomp6_alloc_tfms(const char *alg_name)
+static struct crypto_comp **ipcomp6_alloc_tfms(const char *alg_name)
 {
        struct ipcomp6_tfms *pos;
-        struct crypto_tfm **tfms;
+        struct crypto_comp **tfms;
        int cpu;
        /* This can be any valid CPU ID so we don't need locking. */
        cpu = raw_smp_processor_id();
        list_for_each_entry(pos, &ipcomp6_tfms_list, list) {
-                struct crypto_tfm *tfm;
+                struct crypto_comp *tfm;
                tfms = pos->tfms;
                tfm = *per_cpu_ptr(tfms, cpu);
-                if (!strcmp(crypto_tfm_alg_name(tfm), alg_name)) {
+                if (!strcmp(crypto_comp_name(tfm), alg_name)) {
                        pos->users++;
                        return tfms;
                }
@@ -358,12 +358,13 @@ static struct crypto_tfm **ipcomp6_alloc_tfms(const char *alg_name)
        INIT_LIST_HEAD(&pos->list);
        list_add(&pos->list, &ipcomp6_tfms_list);
-        pos->tfms = tfms = alloc_percpu(struct crypto_tfm *);
+        pos->tfms = tfms = alloc_percpu(struct crypto_comp *);
        if (!tfms)
                goto error;
        for_each_possible_cpu(cpu) {
-                struct crypto_tfm *tfm = crypto_alloc_tfm(alg_name, 0);
+                struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
+                                                            CRYPTO_ALG_ASYNC);
                if (!tfm)
                        goto error;
                *per_cpu_ptr(tfms, cpu) = tfm;
@@ -416,7 +417,7 @@ static int ipcomp6_init_state(struct xfrm_state *x)
                goto out;
        x->props.header_len = 0;
-        if (x->props.mode)
+        if (x->props.mode == XFRM_MODE_TUNNEL)
                x->props.header_len += sizeof(struct ipv6hdr);
        
        mutex_lock(&ipcomp6_resource_mutex);
@@ -428,7 +429,7 @@ static int ipcomp6_init_state(struct xfrm_state *x)
                goto error;
        mutex_unlock(&ipcomp6_resource_mutex);
-        if (x->props.mode) {
+        if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = ipcomp6_tunnel_attach(x);
                if (err)
                        goto error_tunnel;
@@ -460,6 +461,7 @@ static struct xfrm_type ipcomp6_type =
        .destructor     = ipcomp6_destroy,
        .input          = ipcomp6_input,
        .output         = ipcomp6_output,
+        .hdr_offset     = xfrm6_find_1stfragopt,
 };
 static struct inet6_protocol ipcomp6_protocol = 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4c20eeb3d568..de6b91981b30 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -27,7 +27,6 @@
 #include <linux/module.h>
 #include <linux/capability.h>
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -58,9 +57,116 @@
 DEFINE_SNMP_STAT(struct ipstats_mib, ipv6_statistics) __read_mostly;
+static struct inet6_protocol *ipv6_gso_pull_exthdrs(struct sk_buff *skb,
+                                                    int proto)
+{
+        struct inet6_protocol *ops = NULL;
+        for (;;) {
+                struct ipv6_opt_hdr *opth;
+                int len;
+                if (proto != NEXTHDR_HOP) {
+                        ops = rcu_dereference(inet6_protos[proto]);
+                        if (unlikely(!ops))
+                                break;
+                        if (!(ops->flags & INET6_PROTO_GSO_EXTHDR))
+                                break;
+                }
+                if (unlikely(!pskb_may_pull(skb, 8)))
+                        break;
+                opth = (void *)skb->data;
+                len = opth->hdrlen * 8 + 8;
+                if (unlikely(!pskb_may_pull(skb, len)))
+                        break;
+                proto = opth->nexthdr;
+                __skb_pull(skb, len);
+        }
+        return ops;
+}
+static int ipv6_gso_send_check(struct sk_buff *skb)
+{
+        struct ipv6hdr *ipv6h;
+        struct inet6_protocol *ops;
+        int err = -EINVAL;
+        if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
+                goto out;
+        ipv6h = skb->nh.ipv6h;
+        __skb_pull(skb, sizeof(*ipv6h));
+        err = -EPROTONOSUPPORT;
+        rcu_read_lock();
+        ops = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
+        if (likely(ops && ops->gso_send_check)) {
+                skb->h.raw = skb->data;
+                err = ops->gso_send_check(skb);
+        }
+        rcu_read_unlock();
+out:
+        return err;
+}
+static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
+{
+        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        struct ipv6hdr *ipv6h;
+        struct inet6_protocol *ops;
+        if (!(features & NETIF_F_HW_CSUM))
+                features &= ~NETIF_F_SG;
+        if (unlikely(skb_shinfo(skb)->gso_type &
+                     ~(SKB_GSO_UDP |
+                       SKB_GSO_DODGY |
+                       SKB_GSO_TCP_ECN |
+                       SKB_GSO_TCPV6 |
+                       0)))
+                goto out;
+        if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
+                goto out;
+        ipv6h = skb->nh.ipv6h;
+        __skb_pull(skb, sizeof(*ipv6h));
+        segs = ERR_PTR(-EPROTONOSUPPORT);
+        rcu_read_lock();
+        ops = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
+        if (likely(ops && ops->gso_segment)) {
+                skb->h.raw = skb->data;
+                segs = ops->gso_segment(skb, features);
+        }
+        rcu_read_unlock();
+        if (unlikely(IS_ERR(segs)))
+                goto out;
+        for (skb = segs; skb; skb = skb->next) {
+                ipv6h = skb->nh.ipv6h;
+                ipv6h->payload_len = htons(skb->len - skb->mac_len -
+                                           sizeof(*ipv6h));
+        }
+out:
+        return segs;
+}
 static struct packet_type ipv6_packet_type = {
        .type = __constant_htons(ETH_P_IPV6), 
        .func = ipv6_rcv,
+        .gso_send_check = ipv6_gso_send_check,
+        .gso_segment = ipv6_gso_segment,
 };
 struct ip6_ra_chain *ip6_ra_chain;
@@ -259,7 +365,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                break;
        case IPV6_TCLASS:
-                if (val < 0 || val > 0xff)
+                if (val < -1 || val > 0xff)
                        goto e_inval;
                np->tclass = val;
                retv = 0;
@@ -304,8 +410,16 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                /* routing header option needs extra check */
                if (optname == IPV6_RTHDR && opt->srcrt) {
                        struct ipv6_rt_hdr *rthdr = opt->srcrt;
-                        if (rthdr->type)
+                        switch (rthdr->type) {
+                        case IPV6_SRCRT_TYPE_0:
+#ifdef CONFIG_IPV6_MIP6
+                        case IPV6_SRCRT_TYPE_2:
+#endif
+                                break;
+                        default:
                                goto sticky_done;
+                        }
                        if ((rthdr->hdrlen & 1) ||
                            (rthdr->hdrlen >> 1) != rthdr->segments_left)
                                goto sticky_done;
@@ -844,6 +958,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
        case IPV6_TCLASS:
                val = np->tclass;
+                if (val < 0)
+                        val = 0;
                break;
        case IPV6_RECVTCLASS:
diff --git a/net/ipv6/ipv6_syms.c b/net/ipv6/ipv6_syms.c
index 16482785bdfd..0e8e0676a033 100644
--- a/net/ipv6/ipv6_syms.c
+++ b/net/ipv6/ipv6_syms.c
@@ -1,5 +1,4 @@
-#include <linux/config.h>
 #include <linux/module.h>
 #include <net/protocol.h>
 #include <net/ipv6.h>
@@ -15,7 +14,6 @@ EXPORT_SYMBOL(ndisc_mc_map);
 EXPORT_SYMBOL(register_inet6addr_notifier);
 EXPORT_SYMBOL(unregister_inet6addr_notifier);
 EXPORT_SYMBOL(ip6_route_output);
-EXPORT_SYMBOL(addrconf_lock);
 EXPORT_SYMBOL(ipv6_setsockopt);
 EXPORT_SYMBOL(ipv6_getsockopt);
 EXPORT_SYMBOL(inet6_register_protosw);
@@ -32,6 +30,8 @@ EXPORT_SYMBOL(ipv6_chk_addr);
 EXPORT_SYMBOL(in6_dev_finish_destroy);
 #ifdef CONFIG_XFRM
 EXPORT_SYMBOL(xfrm6_rcv);
+EXPORT_SYMBOL(xfrm6_input_addr);
+EXPORT_SYMBOL(xfrm6_find_1stfragopt);
 #endif
 EXPORT_SYMBOL(rt6_lookup);
 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 6e871afbb2c7..3b114e3fa2f8 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -28,7 +28,6 @@
 *              - MLDv2 support
 */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/types.h>
@@ -172,7 +171,7 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
 #define IPV6_MLD_MAX_MSF        64
-int sysctl_mld_max_msf = IPV6_MLD_MAX_MSF;
+int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
 /*
 *      socket join on multicast group
@@ -269,13 +268,14 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, struct in6_addr *addr)
                        if ((dev = dev_get_by_index(mc_lst->ifindex)) != NULL) {
                                struct inet6_dev *idev = in6_dev_get(dev);
+                                (void) ip6_mc_leave_src(sk, mc_lst, idev);
                                if (idev) {
-                                        (void) ip6_mc_leave_src(sk,mc_lst,idev);
                                        __ipv6_dev_mc_dec(idev, &mc_lst->addr);
                                        in6_dev_put(idev);
                                }
                                dev_put(dev);
-                        }
+                        } else
+                                (void) ip6_mc_leave_src(sk, mc_lst, NULL);
                        sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
                        return 0;
                }
@@ -335,13 +335,14 @@ void ipv6_sock_mc_close(struct sock *sk)
                if (dev) {
                        struct inet6_dev *idev = in6_dev_get(dev);
+                        (void) ip6_mc_leave_src(sk, mc_lst, idev);
                        if (idev) {
-                                (void) ip6_mc_leave_src(sk, mc_lst, idev);
                                __ipv6_dev_mc_dec(idev, &mc_lst->addr);
                                in6_dev_put(idev);
                        }
                        dev_put(dev);
-                }
+                } else
+                        (void) ip6_mc_leave_src(sk, mc_lst, NULL);
                sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
new file mode 100644
index 000000000000..99d116caecda
--- /dev/null
+++ b/net/ipv6/mip6.c
@@ -0,0 +1,519 @@
+/*
+ * Copyright (C)2003-2006 Helsinki University of Technology
+ * Copyright (C)2003-2006 USAGI/WIDE Project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+/*
+ * Authors:
+ *      Noriaki TAKAMIYA @USAGI
+ *      Masahide NAKAMURA @USAGI
+ */
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/time.h>
+#include <linux/ipv6.h>
+#include <linux/icmpv6.h>
+#include <net/sock.h>
+#include <net/ipv6.h>
+#include <net/ip6_checksum.h>
+#include <net/xfrm.h>
+#include <net/mip6.h>
+static xfrm_address_t *mip6_xfrm_addr(struct xfrm_state *x, xfrm_address_t *addr)
+{
+        return x->coaddr;
+}
+static inline unsigned int calc_padlen(unsigned int len, unsigned int n)
+{
+        return (n - len + 16) & 0x7;
+}
+static inline void *mip6_padn(__u8 *data, __u8 padlen)
+{
+        if (!data)
+                return NULL;
+        if (padlen == 1) {
+                data[0] = MIP6_OPT_PAD_1;
+        } else if (padlen > 1) {
+                data[0] = MIP6_OPT_PAD_N;
+                data[1] = padlen - 2;
+                if (padlen > 2)
+                        memset(data+2, 0, data[1]);
+        }
+        return data + padlen;
+}
+static inline void mip6_param_prob(struct sk_buff *skb, int code, int pos)
+{
+        icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos, skb->dev);
+}
+static int mip6_mh_len(int type)
+{
+        int len = 0;
+        switch (type) {
+        case IP6_MH_TYPE_BRR:
+                len = 0;
+                break;
+        case IP6_MH_TYPE_HOTI:
+        case IP6_MH_TYPE_COTI:
+        case IP6_MH_TYPE_BU:
+        case IP6_MH_TYPE_BACK:
+                len = 1;
+                break;
+        case IP6_MH_TYPE_HOT:
+        case IP6_MH_TYPE_COT:
+        case IP6_MH_TYPE_BERROR:
+                len = 2;
+                break;
+        }
+        return len;
+}
+int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
+{
+        struct ip6_mh *mh;
+        int mhlen;
+        if (!pskb_may_pull(skb, (skb->h.raw - skb->data) + 8) ||
+            !pskb_may_pull(skb, (skb->h.raw - skb->data) + ((skb->h.raw[1] + 1) << 3)))
+                return -1;
+        mh = (struct ip6_mh *)skb->h.raw;
+        if (mh->ip6mh_hdrlen < mip6_mh_len(mh->ip6mh_type)) {
+                LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH message too short: %d vs >=%d\n",
+                               mh->ip6mh_hdrlen, mip6_mh_len(mh->ip6mh_type));
+                mip6_param_prob(skb, 0, (&mh->ip6mh_hdrlen) - skb->nh.raw);
+                return -1;
+        }
+        mhlen = (mh->ip6mh_hdrlen + 1) << 3;
+        if (skb->ip_summed == CHECKSUM_COMPLETE) {
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+                if (csum_ipv6_magic(&skb->nh.ipv6h->saddr,
+                                    &skb->nh.ipv6h->daddr,
+                                    mhlen, IPPROTO_MH,
+                                    skb->csum)) {
+                        LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH hw checksum failed\n");
+                        skb->ip_summed = CHECKSUM_NONE;
+                }
+        }
+        if (skb->ip_summed == CHECKSUM_NONE) {
+                if (csum_ipv6_magic(&skb->nh.ipv6h->saddr,
+                                    &skb->nh.ipv6h->daddr,
+                                    mhlen, IPPROTO_MH,
+                                    skb_checksum(skb, 0, mhlen, 0))) {
+                        LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH checksum failed "
+                                       "[" NIP6_FMT " > " NIP6_FMT "]\n",
+                                       NIP6(skb->nh.ipv6h->saddr),
+                                       NIP6(skb->nh.ipv6h->daddr));
+                        return -1;
+                }
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+        }
+        if (mh->ip6mh_proto != IPPROTO_NONE) {
+                LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH invalid payload proto = %d\n",
+                               mh->ip6mh_proto);
+                mip6_param_prob(skb, 0, (&mh->ip6mh_proto) - skb->nh.raw);
+                return -1;
+        }
+        return 0;
+}
+struct mip6_report_rate_limiter {
+        spinlock_t lock;
+        struct timeval stamp;
+        int iif;
+        struct in6_addr src;
+        struct in6_addr dst;
+};
+static struct mip6_report_rate_limiter mip6_report_rl = {
+        .lock = SPIN_LOCK_UNLOCKED
+};
+static int mip6_destopt_input(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct ipv6hdr *iph = skb->nh.ipv6h;
+        struct ipv6_destopt_hdr *destopt = (struct ipv6_destopt_hdr *)skb->data;
+        if (!ipv6_addr_equal(&iph->saddr, (struct in6_addr *)x->coaddr) &&
+            !ipv6_addr_any((struct in6_addr *)x->coaddr))
+                return -ENOENT;
+        return destopt->nexthdr;
+}
+/* Destination Option Header is inserted.
+ * IP Header's src address is replaced with Home Address Option in
+ * Destination Option Header.
+ */
+static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct ipv6hdr *iph;
+        struct ipv6_destopt_hdr *dstopt;
+        struct ipv6_destopt_hao *hao;
+        u8 nexthdr;
+        int len;
+        iph = (struct ipv6hdr *)skb->data;
+        iph->payload_len = htons(skb->len - sizeof(*iph));
+        nexthdr = *skb->nh.raw;
+        *skb->nh.raw = IPPROTO_DSTOPTS;
+        dstopt = (struct ipv6_destopt_hdr *)skb->h.raw;
+        dstopt->nexthdr = nexthdr;
+        hao = mip6_padn((char *)(dstopt + 1),
+                        calc_padlen(sizeof(*dstopt), 6));
+        hao->type = IPV6_TLV_HAO;
+        hao->length = sizeof(*hao) - 2;
+        BUG_TRAP(hao->length == 16);
+        len = ((char *)hao - (char *)dstopt) + sizeof(*hao);
+        memcpy(&hao->addr, &iph->saddr, sizeof(hao->addr));
+        memcpy(&iph->saddr, x->coaddr, sizeof(iph->saddr));
+        BUG_TRAP(len == x->props.header_len);
+        dstopt->hdrlen = (x->props.header_len >> 3) - 1;
+        return 0;
+}
+static inline int mip6_report_rl_allow(struct timeval *stamp,
+                                       struct in6_addr *dst,
+                                       struct in6_addr *src, int iif)
+{
+        int allow = 0;
+        spin_lock_bh(&mip6_report_rl.lock);
+        if (mip6_report_rl.stamp.tv_sec != stamp->tv_sec ||
+            mip6_report_rl.stamp.tv_usec != stamp->tv_usec ||
+            mip6_report_rl.iif != iif ||
+            !ipv6_addr_equal(&mip6_report_rl.src, src) ||
+            !ipv6_addr_equal(&mip6_report_rl.dst, dst)) {
+                mip6_report_rl.stamp.tv_sec = stamp->tv_sec;
+                mip6_report_rl.stamp.tv_usec = stamp->tv_usec;
+                mip6_report_rl.iif = iif;
+                ipv6_addr_copy(&mip6_report_rl.src, src);
+                ipv6_addr_copy(&mip6_report_rl.dst, dst);
+                allow = 1;
+        }
+        spin_unlock_bh(&mip6_report_rl.lock);
+        return allow;
+}
+static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb, struct flowi *fl)
+{
+        struct inet6_skb_parm *opt = (struct inet6_skb_parm *)skb->cb;
+        struct ipv6_destopt_hao *hao = NULL;
+        struct xfrm_selector sel;
+        int offset;
+        struct timeval stamp;
+        int err = 0;
+        if (unlikely(fl->proto == IPPROTO_MH &&
+                     fl->fl_mh_type <= IP6_MH_TYPE_MAX))
+                goto out;
+        if (likely(opt->dsthao)) {
+                offset = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
+                if (likely(offset >= 0))
+                        hao = (struct ipv6_destopt_hao *)(skb->nh.raw + offset);
+        }
+        skb_get_timestamp(skb, &stamp);
+        if (!mip6_report_rl_allow(&stamp, &skb->nh.ipv6h->daddr,
+                                  hao ? &hao->addr : &skb->nh.ipv6h->saddr,
+                                  opt->iif))
+                goto out;
+        memset(&sel, 0, sizeof(sel));
+        memcpy(&sel.daddr, (xfrm_address_t *)&skb->nh.ipv6h->daddr,
+               sizeof(sel.daddr));
+        sel.prefixlen_d = 128;
+        memcpy(&sel.saddr, (xfrm_address_t *)&skb->nh.ipv6h->saddr,
+               sizeof(sel.saddr));
+        sel.prefixlen_s = 128;
+        sel.family = AF_INET6;
+        sel.proto = fl->proto;
+        sel.dport = xfrm_flowi_dport(fl);
+        if (sel.dport)
+                sel.dport_mask = ~((__u16)0);
+        sel.sport = xfrm_flowi_sport(fl);
+        if (sel.sport)
+                sel.sport_mask = ~((__u16)0);
+        sel.ifindex = fl->oif;
+        err = km_report(IPPROTO_DSTOPTS, &sel,
+                        (hao ? (xfrm_address_t *)&hao->addr : NULL));
+ out:
+        return err;
+}
+static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
+                               u8 **nexthdr)
+{
+        u16 offset = sizeof(struct ipv6hdr);
+        struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.ipv6h + 1);
+        unsigned int packet_len = skb->tail - skb->nh.raw;
+        int found_rhdr = 0;
+        *nexthdr = &skb->nh.ipv6h->nexthdr;
+        while (offset + 1 <= packet_len) {
+                switch (**nexthdr) {
+                case NEXTHDR_HOP:
+                        break;
+                case NEXTHDR_ROUTING:
+                        found_rhdr = 1;
+                        break;
+                case NEXTHDR_DEST:
+                        /*
+                         * HAO MUST NOT appear more than once.
+                         * XXX: It is better to try to find by the end of
+                         * XXX: packet if HAO exists.
+                         */
+                        if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0) {
+                                LIMIT_NETDEBUG(KERN_WARNING "mip6: hao exists already, override\n");
+                                return offset;
+                        }
+                        if (found_rhdr)
+                                return offset;
+                        break;
+                default:
+                        return offset;
+                }
+                offset += ipv6_optlen(exthdr);
+                *nexthdr = &exthdr->nexthdr;
+                exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+        }
+        return offset;
+}
+static int mip6_destopt_init_state(struct xfrm_state *x)
+{
+        if (x->id.spi) {
+                printk(KERN_INFO "%s: spi is not 0: %u\n", __FUNCTION__,
+                       x->id.spi);
+                return -EINVAL;
+        }
+        if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
+                printk(KERN_INFO "%s: state's mode is not %u: %u\n",
+                       __FUNCTION__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
+                return -EINVAL;
+        }
+        x->props.header_len = sizeof(struct ipv6_destopt_hdr) +
+                calc_padlen(sizeof(struct ipv6_destopt_hdr), 6) +
+                sizeof(struct ipv6_destopt_hao);
+        BUG_TRAP(x->props.header_len == 24);
+        return 0;
+}
+/*
+ * Do nothing about destroying since it has no specific operation for
+ * destination options header unlike IPsec protocols.
+ */
+static void mip6_destopt_destroy(struct xfrm_state *x)
+{
+}
+static struct xfrm_type mip6_destopt_type =
+{
+        .description    = "MIP6DESTOPT",
+        .owner          = THIS_MODULE,
+        .proto          = IPPROTO_DSTOPTS,
+        .flags          = XFRM_TYPE_NON_FRAGMENT,
+        .init_state     = mip6_destopt_init_state,
+        .destructor     = mip6_destopt_destroy,
+        .input          = mip6_destopt_input,
+        .output         = mip6_destopt_output,
+        .reject         = mip6_destopt_reject,
+        .hdr_offset     = mip6_destopt_offset,
+        .local_addr     = mip6_xfrm_addr,
+};
+static int mip6_rthdr_input(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct rt2_hdr *rt2 = (struct rt2_hdr *)skb->data;
+        if (!ipv6_addr_equal(&rt2->addr, (struct in6_addr *)x->coaddr) &&
+            !ipv6_addr_any((struct in6_addr *)x->coaddr))
+                return -ENOENT;
+        return rt2->rt_hdr.nexthdr;
+}
+/* Routing Header type 2 is inserted.
+ * IP Header's dst address is replaced with Routing Header's Home Address.
+ */
+static int mip6_rthdr_output(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct ipv6hdr *iph;
+        struct rt2_hdr *rt2;
+        u8 nexthdr;
+        iph = (struct ipv6hdr *)skb->data;
+        iph->payload_len = htons(skb->len - sizeof(*iph));
+        nexthdr = *skb->nh.raw;
+        *skb->nh.raw = IPPROTO_ROUTING;
+        rt2 = (struct rt2_hdr *)skb->h.raw;
+        rt2->rt_hdr.nexthdr = nexthdr;
+        rt2->rt_hdr.hdrlen = (x->props.header_len >> 3) - 1;
+        rt2->rt_hdr.type = IPV6_SRCRT_TYPE_2;
+        rt2->rt_hdr.segments_left = 1;
+        memset(&rt2->reserved, 0, sizeof(rt2->reserved));
+        BUG_TRAP(rt2->rt_hdr.hdrlen == 2);
+        memcpy(&rt2->addr, &iph->daddr, sizeof(rt2->addr));
+        memcpy(&iph->daddr, x->coaddr, sizeof(iph->daddr));
+        return 0;
+}
+static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
+                             u8 **nexthdr)
+{
+        u16 offset = sizeof(struct ipv6hdr);
+        struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.ipv6h + 1);
+        unsigned int packet_len = skb->tail - skb->nh.raw;
+        int found_rhdr = 0;
+        *nexthdr = &skb->nh.ipv6h->nexthdr;
+        while (offset + 1 <= packet_len) {
+                switch (**nexthdr) {
+                case NEXTHDR_HOP:
+                        break;
+                case NEXTHDR_ROUTING:
+                        if (offset + 3 <= packet_len) {
+                                struct ipv6_rt_hdr *rt;
+                                rt = (struct ipv6_rt_hdr *)(skb->nh.raw + offset);
+                                if (rt->type != 0)
+                                        return offset;
+                        }
+                        found_rhdr = 1;
+                        break;
+                case NEXTHDR_DEST:
+                        if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
+                                return offset;
+                        if (found_rhdr)
+                                return offset;
+                        break;
+                default:
+                        return offset;
+                }
+                offset += ipv6_optlen(exthdr);
+                *nexthdr = &exthdr->nexthdr;
+                exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
+        }
+        return offset;
+}
+static int mip6_rthdr_init_state(struct xfrm_state *x)
+{
+        if (x->id.spi) {
+                printk(KERN_INFO "%s: spi is not 0: %u\n", __FUNCTION__,
+                       x->id.spi);
+                return -EINVAL;
+        }
+        if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
+                printk(KERN_INFO "%s: state's mode is not %u: %u\n",
+                       __FUNCTION__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
+                return -EINVAL;
+        }
+        x->props.header_len = sizeof(struct rt2_hdr);
+        return 0;
+}
+/*
+ * Do nothing about destroying since it has no specific operation for routing
+ * header type 2 unlike IPsec protocols.
+ */
+static void mip6_rthdr_destroy(struct xfrm_state *x)
+{
+}
+static struct xfrm_type mip6_rthdr_type =
+{
+        .description    = "MIP6RT",
+        .owner          = THIS_MODULE,
+        .proto          = IPPROTO_ROUTING,
+        .flags          = XFRM_TYPE_NON_FRAGMENT,
+        .init_state     = mip6_rthdr_init_state,
+        .destructor     = mip6_rthdr_destroy,
+        .input          = mip6_rthdr_input,
+        .output         = mip6_rthdr_output,
+        .hdr_offset     = mip6_rthdr_offset,
+        .remote_addr    = mip6_xfrm_addr,
+};
+int __init mip6_init(void)
+{
+        printk(KERN_INFO "Mobile IPv6\n");
+        if (xfrm_register_type(&mip6_destopt_type, AF_INET6) < 0) {
+                printk(KERN_INFO "%s: can't add xfrm type(destopt)\n", __FUNCTION__);
+                goto mip6_destopt_xfrm_fail;
+        }
+        if (xfrm_register_type(&mip6_rthdr_type, AF_INET6) < 0) {
+                printk(KERN_INFO "%s: can't add xfrm type(rthdr)\n", __FUNCTION__);
+                goto mip6_rthdr_xfrm_fail;
+        }
+        return 0;
+ mip6_rthdr_xfrm_fail:
+        xfrm_unregister_type(&mip6_destopt_type, AF_INET6);
+ mip6_destopt_xfrm_fail:
+        return -EAGAIN;
+}
+void __exit mip6_fini(void)
+{
+        if (xfrm_unregister_type(&mip6_rthdr_type, AF_INET6) < 0)
+                printk(KERN_INFO "%s: can't remove xfrm type(rthdr)\n", __FUNCTION__);
+        if (xfrm_unregister_type(&mip6_destopt_type, AF_INET6) < 0)
+                printk(KERN_INFO "%s: can't remove xfrm type(destopt)\n", __FUNCTION__);
+}
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index dfa20d3be9b6..0304b5fe8d6a 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -48,7 +48,6 @@
 #endif
 #include <linux/module.h>
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -63,6 +62,7 @@
 #include <linux/sysctl.h>
 #endif
+#include <linux/if_addr.h>
 #include <linux/if_arp.h>
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
@@ -412,7 +412,8 @@ static void pndisc_destructor(struct pneigh_entry *n)
 */
 static inline void ndisc_flow_init(struct flowi *fl, u8 type,
-                            struct in6_addr *saddr, struct in6_addr *daddr)
+                            struct in6_addr *saddr, struct in6_addr *daddr,
+                            int oif)
 {
        memset(fl, 0, sizeof(*fl));
        ipv6_addr_copy(&fl->fl6_src, saddr);
@@ -420,6 +421,8 @@ static inline void ndisc_flow_init(struct flowi *fl, u8 type,
        fl->proto               = IPPROTO_ICMPV6;
        fl->fl_icmp_type        = type;
        fl->fl_icmp_code        = 0;
+        fl->oif                 = oif;
+        security_sk_classify_flow(ndisc_socket->sk, fl);
 }
 static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
@@ -451,7 +454,8 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                src_addr = &tmpaddr;
        }
-        ndisc_flow_init(&fl, NDISC_NEIGHBOUR_ADVERTISEMENT, src_addr, daddr);
+        ndisc_flow_init(&fl, NDISC_NEIGHBOUR_ADVERTISEMENT, src_addr, daddr,
+                        dev->ifindex);
        dst = ndisc_dst_alloc(dev, neigh, daddr, ip6_output);
        if (!dst)
@@ -492,7 +496,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
        msg->icmph.icmp6_unused = 0;
        msg->icmph.icmp6_router    = router;
        msg->icmph.icmp6_solicited = solicited;
-        msg->icmph.icmp6_override  = !!override;
+        msg->icmph.icmp6_override  = override;
        /* Set the target address. */
        ipv6_addr_copy(&msg->target, solicited_addr);
@@ -541,7 +545,8 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
                saddr = &addr_buf;
        }
-        ndisc_flow_init(&fl, NDISC_NEIGHBOUR_SOLICITATION, saddr, daddr);
+        ndisc_flow_init(&fl, NDISC_NEIGHBOUR_SOLICITATION, saddr, daddr,
+                        dev->ifindex);
        dst = ndisc_dst_alloc(dev, neigh, daddr, ip6_output);
        if (!dst)
@@ -616,7 +621,8 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
        int len;
        int err;
-        ndisc_flow_init(&fl, NDISC_ROUTER_SOLICITATION, saddr, daddr);
+        ndisc_flow_init(&fl, NDISC_ROUTER_SOLICITATION, saddr, daddr,
+                        dev->ifindex);
        dst = ndisc_dst_alloc(dev, NULL, daddr, ip6_output);
        if (!dst)
@@ -730,8 +736,10 @@ static void ndisc_recv_ns(struct sk_buff *skb)
        struct inet6_ifaddr *ifp;
        struct inet6_dev *idev = NULL;
        struct neighbour *neigh;
+        struct pneigh_entry *pneigh = NULL;
        int dad = ipv6_addr_any(saddr);
        int inc;
+        int is_router;
        if (ipv6_addr_is_multicast(&msg->target)) {
                ND_PRINTK2(KERN_WARNING 
@@ -816,7 +824,9 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                if (ipv6_chk_acast_addr(dev, &msg->target) ||
                    (idev->cnf.forwarding && 
-                     pneigh_lookup(&nd_tbl, &msg->target, dev, 0))) {
+                     (ipv6_devconf.proxy_ndp || idev->cnf.proxy_ndp) &&
+                     (pneigh = pneigh_lookup(&nd_tbl,
+                                             &msg->target, dev, 0)) != NULL)) {
                        if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
                            skb->pkt_type != PACKET_HOST &&
                            inc != 0 &&
@@ -837,12 +847,14 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                        goto out;
        }
+        is_router = !!(pneigh ? pneigh->flags & NTF_ROUTER : idev->cnf.forwarding);
        if (dad) {
                struct in6_addr maddr;
                ipv6_addr_all_nodes(&maddr);
                ndisc_send_na(dev, NULL, &maddr, &msg->target,
-                              idev->cnf.forwarding, 0, (ifp != NULL), 1);
+                              is_router, 0, (ifp != NULL), 1);
                goto out;
        }
@@ -863,7 +875,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
                             NEIGH_UPDATE_F_OVERRIDE);
        if (neigh || !dev->hard_header) {
                ndisc_send_na(dev, neigh, saddr, &msg->target,
-                              idev->cnf.forwarding, 
+                              is_router,
                              1, (ifp != NULL && inc), inc);
                if (neigh)
                        neigh_release(neigh);
@@ -946,6 +958,20 @@ static void ndisc_recv_na(struct sk_buff *skb)
                if (neigh->nud_state & NUD_FAILED)
                        goto out;
+                /*
+                 * Don't update the neighbor cache entry on a proxy NA from
+                 * ourselves because either the proxied node is off link or it
+                 * has already sent a NA to us.
+                 */
+                if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
+                    ipv6_devconf.forwarding && ipv6_devconf.proxy_ndp &&
+                    pneigh_lookup(&nd_tbl, &msg->target, dev, 0)) {
+                        /* XXX: idev->cnf.prixy_ndp */
+                        WARN_ON(skb->dst != NULL &&
+                                ((struct rt6_info *)skb->dst)->rt6i_idev);
+                        goto out;
+                }
                neigh_update(neigh, lladdr,
                             msg->icmph.icmp6_solicited ? NUD_REACHABLE : NUD_STALE,
                             NEIGH_UPDATE_F_WEAK_OVERRIDE|
@@ -960,7 +986,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
                        struct rt6_info *rt;
                        rt = rt6_get_dflt_router(saddr, dev);
                        if (rt)
-                                ip6_del_rt(rt, NULL, NULL, NULL);
+                                ip6_del_rt(rt);
                }
 out:
@@ -1113,7 +1139,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
        if (rt && lifetime == 0) {
                neigh_clone(neigh);
-                ip6_del_rt(rt, NULL, NULL, NULL);
+                ip6_del_rt(rt);
                rt = NULL;
        }
@@ -1345,7 +1371,8 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
        neigh = __neigh_lookup(&nd_tbl, target, skb->dev, 1);
        if (neigh) {
-                rt6_redirect(dest, &skb->nh.ipv6h->saddr, neigh, lladdr, 
+                rt6_redirect(dest, &skb->nh.ipv6h->daddr,
+                             &skb->nh.ipv6h->saddr, neigh, lladdr,
                             on_link);
                neigh_release(neigh);
        }
@@ -1381,7 +1408,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                return;
        }
-        ndisc_flow_init(&fl, NDISC_REDIRECT, &saddr_buf, &skb->nh.ipv6h->saddr);
+        ndisc_flow_init(&fl, NDISC_REDIRECT, &saddr_buf, &skb->nh.ipv6h->saddr,
+                        dev->ifindex);
        dst = ip6_route_output(NULL, &fl);
        if (dst == NULL)
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 395a417ba955..580b1aba6722 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -87,7 +87,7 @@ unsigned int nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
        unsigned int csum = 0;
        switch (skb->ip_summed) {
-        case CHECKSUM_HW:
+        case CHECKSUM_COMPLETE:
                if (hook != NF_IP6_PRE_ROUTING && hook != NF_IP6_LOCAL_IN)
                        break;
                if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index eeeb57d4c9c5..ac1dfebde175 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -5,7 +5,7 @@
 # Link order matters here.
 obj-$(CONFIG_IP6_NF_IPTABLES) += ip6_tables.o
 obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o
-obj-$(CONFIG_IP6_NF_MATCH_OPTS) += ip6t_hbh.o ip6t_dst.o
+obj-$(CONFIG_IP6_NF_MATCH_OPTS) += ip6t_hbh.o
 obj-$(CONFIG_IP6_NF_MATCH_IPV6HEADER) += ip6t_ipv6header.o
 obj-$(CONFIG_IP6_NF_MATCH_FRAG) += ip6t_frag.o
 obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index b4b7d441af25..9510c24ca8d2 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -56,15 +56,15 @@ struct ipq_queue_entry {
 typedef int (*ipq_cmpfn)(struct ipq_queue_entry *, unsigned long);
-static unsigned char copy_mode = IPQ_COPY_NONE;
+static unsigned char copy_mode __read_mostly = IPQ_COPY_NONE;
-static unsigned int queue_maxlen = IPQ_QMAX_DEFAULT;
+static unsigned int queue_maxlen __read_mostly = IPQ_QMAX_DEFAULT;
 static DEFINE_RWLOCK(queue_lock);
-static int peer_pid;
+static int peer_pid __read_mostly;
-static unsigned int copy_range;
+static unsigned int copy_range __read_mostly;
 static unsigned int queue_total;
 static unsigned int queue_dropped = 0;
 static unsigned int queue_user_dropped = 0;
-static struct sock *ipqnl;
+static struct sock *ipqnl __read_mostly;
 static LIST_HEAD(queue_list);
 static DEFINE_MUTEX(ipqnl_mutex);
@@ -206,9 +206,9 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                break;
        
        case IPQ_COPY_PACKET:
-                if (entry->skb->ip_summed == CHECKSUM_HW &&
+                if ((entry->skb->ip_summed == CHECKSUM_PARTIAL ||
-                    (*errp = skb_checksum_help(entry->skb,
+                     entry->skb->ip_summed == CHECKSUM_COMPLETE) &&
-                                               entry->info->outdev == NULL))) {
+                    (*errp = skb_checksum_help(entry->skb))) {
                        read_unlock_bh(&queue_lock);
                        return NULL;
                }
@@ -505,7 +505,7 @@ ipq_rcv_skb(struct sk_buff *skb)
        if (type <= IPQM_BASE)
                return;
        
-        if (security_netlink_recv(skb))
+        if (security_netlink_recv(skb, CAP_NET_ADMIN))
                RCV_SKB_FAIL(-EPERM);   
        write_lock_bh(&queue_lock);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 2e72f89a7019..4ab368fa0b8f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -19,13 +19,13 @@
 */
 #include <linux/capability.h>
-#include <linux/config.h>
 #include <linux/in.h>
 #include <linux/skbuff.h>
 #include <linux/kmod.h>
 #include <linux/vmalloc.h>
 #include <linux/netdevice.h>
 #include <linux/module.h>
+#include <linux/poison.h>
 #include <linux/icmpv6.h>
 #include <net/ipv6.h>
 #include <asm/uaccess.h>
@@ -70,9 +70,6 @@ do {								\
 #define IP_NF_ASSERT(x)
 #endif
-#include <linux/netfilter_ipv4/listhelp.h>
 #if 0
 /* All the better to debug you with... */
 #define static
@@ -220,8 +217,7 @@ ip6t_error(struct sk_buff **pskb,
          const struct net_device *out,
          unsigned int hooknum,
          const struct xt_target *target,
-          const void *targinfo,
+          const void *targinfo)
-          void *userinfo)
 {
        if (net_ratelimit())
                printk("ip6_tables: error: `%s'\n", (char *)targinfo);
@@ -258,8 +254,7 @@ ip6t_do_table(struct sk_buff **pskb,
              unsigned int hook,
              const struct net_device *in,
              const struct net_device *out,
-              struct xt_table *table,
+              struct xt_table *table)
-              void *userdata)
 {
        static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
        int offset = 0;
@@ -349,8 +344,7 @@ ip6t_do_table(struct sk_buff **pskb,
                                                                     in, out,
                                                                     hook,
                                                                     t->u.kernel.target,
-                                                                     t->data,
+                                                                     t->data);
-                                                                     userdata);
 #ifdef CONFIG_NETFILTER_DEBUG
                                if (((struct ip6t_entry *)table_base)->comefrom
@@ -377,7 +371,7 @@ ip6t_do_table(struct sk_buff **pskb,
        } while (!hotdrop);
 #ifdef CONFIG_NETFILTER_DEBUG
-        ((struct ip6t_entry *)table_base)->comefrom = 0xdead57ac;
+        ((struct ip6t_entry *)table_base)->comefrom = NETFILTER_LINK_POISON;
 #endif
        read_unlock_bh(&table->lock);
@@ -507,8 +501,7 @@ cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
                return 1;
        if (m->u.kernel.match->destroy)
-                m->u.kernel.match->destroy(m->u.kernel.match, m->data,
+                m->u.kernel.match->destroy(m->u.kernel.match, m->data);
-                                           m->u.match_size - sizeof(*m));
        module_put(m->u.kernel.match->me);
        return 0;
 }
@@ -561,7 +554,6 @@ check_match(struct ip6t_entry_match *m,
        if (m->u.kernel.match->checkentry
            && !m->u.kernel.match->checkentry(name, ipv6, match,  m->data,
-                                              m->u.match_size - sizeof(*m),
                                              hookmask)) {
                duprintf("ip_tables: check failed for `%s'.\n",
                         m->u.kernel.match->name);
@@ -618,12 +610,10 @@ check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
        if (t->u.kernel.target == &ip6t_standard_target) {
                if (!standard_check(t, size)) {
                        ret = -EINVAL;
-                        goto cleanup_matches;
+                        goto err;
                }
        } else if (t->u.kernel.target->checkentry
                   && !t->u.kernel.target->checkentry(name, e, target, t->data,
-                                                      t->u.target_size
-                                                      - sizeof(*t),
                                                      e->comefrom)) {
                duprintf("ip_tables: check failed for `%s'.\n",
                         t->u.kernel.target->name);
@@ -695,8 +685,7 @@ cleanup_entry(struct ip6t_entry *e, unsigned int *i)
        IP6T_MATCH_ITERATE(e, cleanup_match, NULL);
        t = ip6t_get_target(e);
        if (t->u.kernel.target->destroy)
-                t->u.kernel.target->destroy(t->u.kernel.target, t->data,
+                t->u.kernel.target->destroy(t->u.kernel.target, t->data);
-                                            t->u.target_size - sizeof(*t));
        module_put(t->u.kernel.target->me);
        return 0;
 }
@@ -1281,7 +1270,8 @@ int ip6t_register_table(struct xt_table *table,
                return ret;
        }
-        if (xt_register_table(table, &bootstrap, newinfo) != 0) {
+        ret = xt_register_table(table, &bootstrap, newinfo);
+        if (ret != 0) {
                xt_free_table_info(newinfo);
                return ret;
        }
@@ -1351,7 +1341,6 @@ icmp6_checkentry(const char *tablename,
           const void *entry,
           const struct xt_match *match,
           void *matchinfo,
-           unsigned int matchsize,
           unsigned int hook_mask)
 {
        const struct ip6t_icmp *icmpinfo = matchinfo;
@@ -1397,23 +1386,39 @@ static int __init ip6_tables_init(void)
 {
        int ret;
-        xt_proto_init(AF_INET6);
+        ret = xt_proto_init(AF_INET6);
+        if (ret < 0)
+                goto err1;
        /* Noone else will be downing sem now, so we won't sleep */
-        xt_register_target(&ip6t_standard_target);
+        ret = xt_register_target(&ip6t_standard_target);
-        xt_register_target(&ip6t_error_target);
+        if (ret < 0)
-        xt_register_match(&icmp6_matchstruct);
+                goto err2;
+        ret = xt_register_target(&ip6t_error_target);
+        if (ret < 0)
+                goto err3;
+        ret = xt_register_match(&icmp6_matchstruct);
+        if (ret < 0)
+                goto err4;
        /* Register setsockopt */
        ret = nf_register_sockopt(&ip6t_sockopts);
-        if (ret < 0) {
+        if (ret < 0)
-                duprintf("Unable to register sockopts.\n");
+                goto err5;
-                xt_proto_fini(AF_INET6);
-                return ret;
-        }
        printk("ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
        return 0;
+err5:
+        xt_unregister_match(&icmp6_matchstruct);
+err4:
+        xt_unregister_target(&ip6t_error_target);
+err3:
+        xt_unregister_target(&ip6t_standard_target);
+err2:
+        xt_proto_fini(AF_INET6);
+err1:
+        return ret;
 }
 static void __exit ip6_tables_fini(void)
diff --git a/net/ipv6/netfilter/ip6t_HL.c b/net/ipv6/netfilter/ip6t_HL.c
index b8eff8ee69b1..435750f664dd 100644
--- a/net/ipv6/netfilter/ip6t_HL.c
+++ b/net/ipv6/netfilter/ip6t_HL.c
@@ -22,11 +22,10 @@ static unsigned int ip6t_hl_target(struct sk_buff **pskb,
                                   const struct net_device *out,
                                   unsigned int hooknum,
                                   const struct xt_target *target,
-                                   const void *targinfo, void *userinfo)
+                                   const void *targinfo)
 {
        struct ipv6hdr *ip6h;
        const struct ip6t_HL_info *info = targinfo;
-        u_int16_t diffs[2];
        int new_hl;
        if (!skb_make_writable(pskb, (*pskb)->len))
@@ -53,11 +52,8 @@ static unsigned int ip6t_hl_target(struct sk_buff **pskb,
                        break;
        }
-        if (new_hl != ip6h->hop_limit) {
+        if (new_hl != ip6h->hop_limit)
-                diffs[0] = htons(((unsigned)ip6h->hop_limit) << 8) ^ 0xFFFF;
                ip6h->hop_limit = new_hl;
-                diffs[1] = htons(((unsigned)ip6h->hop_limit) << 8);
-        }
        return IP6T_CONTINUE;
 }
@@ -66,7 +62,6 @@ static int ip6t_hl_checkentry(const char *tablename,
                const void *entry,
                const struct xt_target *target,
                void *targinfo,
-                unsigned int targinfosize,
                unsigned int hook_mask)
 {
        struct ip6t_HL_info *info = targinfo;
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 73c6300109d6..0cf537d30185 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -427,8 +427,7 @@ ip6t_log_target(struct sk_buff **pskb,
                const struct net_device *out,
                unsigned int hooknum,
                const struct xt_target *target,
-                const void *targinfo,
+                const void *targinfo)
-                void *userinfo)
 {
        const struct ip6t_log_info *loginfo = targinfo;
        struct nf_loginfo li;
@@ -452,7 +451,6 @@ static int ip6t_log_checkentry(const char *tablename,
                               const void *entry,
                               const struct xt_target *target,
                               void *targinfo,
-                               unsigned int targinfosize,
                               unsigned int hook_mask)
 {
        const struct ip6t_log_info *loginfo = targinfo;
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index de1175c27f6d..311eae82feb3 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -15,7 +15,6 @@
 * 2 of the License, or (at your option) any later version.
 */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/icmpv6.h>
@@ -97,6 +96,7 @@ static void send_reset(struct sk_buff *oldskb)
        ipv6_addr_copy(&fl.fl6_dst, &oip6h->saddr);
        fl.fl_ip_sport = otcph.dest;
        fl.fl_ip_dport = otcph.source;
+        security_skb_classify_flow(oldskb, &fl);
        dst = ip6_route_output(NULL, &fl);
        if (dst == NULL)
                return;
@@ -180,8 +180,7 @@ static unsigned int reject6_target(struct sk_buff **pskb,
                           const struct net_device *out,
                           unsigned int hooknum,
                           const struct xt_target *target,
-                           const void *targinfo,
+                           const void *targinfo)
-                           void *userinfo)
 {
        const struct ip6t_reject_info *reject = targinfo;
@@ -224,7 +223,6 @@ static int check(const char *tablename,
                 const void *entry,
                 const struct xt_target *target,
                 void *targinfo,
-                 unsigned int targinfosize,
                 unsigned int hook_mask)
 {
        const struct ip6t_reject_info *rejinfo = targinfo;
@@ -257,9 +255,7 @@ static struct ip6t_target ip6t_reject_reg = {
 static int __init ip6t_reject_init(void)
 {
-        if (ip6t_register_target(&ip6t_reject_reg))
+        return ip6t_register_target(&ip6t_reject_reg);
-                return -EINVAL;
-        return 0;
 }
 static void __exit ip6t_reject_fini(void)
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 2f7bb20c758b..ec1b1608156c 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -102,7 +102,6 @@ checkentry(const char *tablename,
          const void *entry,
          const struct xt_match *match,
          void *matchinfo,
-          unsigned int matchinfosize,
          unsigned int hook_mask)
 {
        const struct ip6t_ah *ahinfo = matchinfo;
diff --git a/net/ipv6/netfilter/ip6t_dst.c b/net/ipv6/netfilter/ip6t_dst.c
deleted file mode 100644
index 9422413d0571..000000000000
--- a/net/ipv6/netfilter/ip6t_dst.c
+++ /dev/null
@@ -1,220 +0,0 @@
-/* Kernel module to match Hop-by-Hop and Destination parameters. */
-/* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ipv6.h>
-#include <linux/types.h>
-#include <net/checksum.h>
-#include <net/ipv6.h>
-#include <asm/byteorder.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
-#include <linux/netfilter_ipv6/ip6t_opts.h>
-#define HOPBYHOP        0
-MODULE_LICENSE("GPL");
-#if HOPBYHOP
-MODULE_DESCRIPTION("IPv6 HbH match");
-#else
-MODULE_DESCRIPTION("IPv6 DST match");
-#endif
-MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-/*
- *  (Type & 0xC0) >> 6
- *      0       -> ignorable
- *      1       -> must drop the packet
- *      2       -> send ICMP PARM PROB regardless and drop packet
- *      3       -> Send ICMP if not a multicast address and drop packet
- *  (Type & 0x20) >> 5
- *      0       -> invariant
- *      1       -> can change the routing
- *  (Type & 0x1F) Type
- *      0       -> Pad1 (only 1 byte!)
- *      1       -> PadN LENGTH info (total length = length + 2)
- *      C0 | 2  -> JUMBO 4 x x x x ( xxxx > 64k )
- *      5       -> RTALERT 2 x x
- */
-static int
-match(const struct sk_buff *skb,
-      const struct net_device *in,
-      const struct net_device *out,
-      const struct xt_match *match,
-      const void *matchinfo,
-      int offset,
-      unsigned int protoff,
-      int *hotdrop)
-{
-        struct ipv6_opt_hdr _optsh, *oh;
-        const struct ip6t_opts *optinfo = matchinfo;
-        unsigned int temp;
-        unsigned int ptr;
-        unsigned int hdrlen = 0;
-        unsigned int ret = 0;
-        u8 _opttype, *tp = NULL;
-        u8 _optlen, *lp = NULL;
-        unsigned int optlen;
-#if HOPBYHOP
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_HOP, NULL) < 0)
-#else
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_DEST, NULL) < 0)
-#endif
-                return 0;
-        oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
-        if (oh == NULL) {
-                *hotdrop = 1;
-                return 0;
-        }
-        hdrlen = ipv6_optlen(oh);
-        if (skb->len - ptr < hdrlen) {
-                /* Packet smaller than it's length field */
-                return 0;
-        }
-        DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
-        DEBUGP("len %02X %04X %02X ",
-               optinfo->hdrlen, hdrlen,
-               (!(optinfo->flags & IP6T_OPTS_LEN) ||
-                ((optinfo->hdrlen == hdrlen) ^
-                 !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
-        ret = (oh != NULL) &&
-              (!(optinfo->flags & IP6T_OPTS_LEN) ||
-               ((optinfo->hdrlen == hdrlen) ^
-                !!(optinfo->invflags & IP6T_OPTS_INV_LEN)));
-        ptr += 2;
-        hdrlen -= 2;
-        if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
-                return ret;
-        } else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
-                DEBUGP("Not strict - not implemented");
-        } else {
-                DEBUGP("Strict ");
-                DEBUGP("#%d ", optinfo->optsnr);
-                for (temp = 0; temp < optinfo->optsnr; temp++) {
-                        /* type field exists ? */
-                        if (hdrlen < 1)
-                                break;
-                        tp = skb_header_pointer(skb, ptr, sizeof(_opttype),
-                                                &_opttype);
-                        if (tp == NULL)
-                                break;
-                        /* Type check */
-                        if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) {
-                                DEBUGP("Tbad %02X %02X\n",
-                                       *tp,
-                                       (optinfo->opts[temp] & 0xFF00) >> 8);
-                                return 0;
-                        } else {
-                                DEBUGP("Tok ");
-                        }
-                        /* Length check */
-                        if (*tp) {
-                                u16 spec_len;
-                                /* length field exists ? */
-                                if (hdrlen < 2)
-                                        break;
-                                lp = skb_header_pointer(skb, ptr + 1,
-                                                        sizeof(_optlen),
-                                                        &_optlen);
-                                if (lp == NULL)
-                                        break;
-                                spec_len = optinfo->opts[temp] & 0x00FF;
-                                if (spec_len != 0x00FF && spec_len != *lp) {
-                                        DEBUGP("Lbad %02X %04X\n", *lp,
-                                               spec_len);
-                                        return 0;
-                                }
-                                DEBUGP("Lok ");
-                                optlen = *lp + 2;
-                        } else {
-                                DEBUGP("Pad1\n");
-                                optlen = 1;
-                        }
-                        /* Step to the next */
-                        DEBUGP("len%04X \n", optlen);
-                        if ((ptr > skb->len - optlen || hdrlen < optlen) &&
-                            (temp < optinfo->optsnr - 1)) {
-                                DEBUGP("new pointer is too large! \n");
-                                break;
-                        }
-                        ptr += optlen;
-                        hdrlen -= optlen;
-                }
-                if (temp == optinfo->optsnr)
-                        return ret;
-                else
-                        return 0;
-        }
-        return 0;
-}
-/* Called when user tries to insert an entry of this type. */
-static int
-checkentry(const char *tablename,
-           const void *info,
-           const struct xt_match *match,
-           void *matchinfo,
-           unsigned int matchinfosize,
-           unsigned int hook_mask)
-{
-        const struct ip6t_opts *optsinfo = matchinfo;
-        if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
-                DEBUGP("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
-                return 0;
-        }
-        return 1;
-}
-static struct ip6t_match opts_match = {
-#if HOPBYHOP
-        .name           = "hbh",
-#else
-        .name           = "dst",
-#endif
-        .match          = match,
-        .matchsize      = sizeof(struct ip6t_opts),
-        .checkentry     = checkentry,
-        .me             = THIS_MODULE,
-};
-static int __init ip6t_dst_init(void)
-{
-        return ip6t_register_match(&opts_match);
-}
-static void __exit ip6t_dst_fini(void)
-{
-        ip6t_unregister_match(&opts_match);
-}
-module_init(ip6t_dst_init);
-module_exit(ip6t_dst_fini);
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 06768c84bd31..78d9c8b9e28a 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -119,7 +119,6 @@ checkentry(const char *tablename,
           const void *ip,
           const struct xt_match *match,
           void *matchinfo,
-           unsigned int matchinfosize,
           unsigned int hook_mask)
 {
        const struct ip6t_frag *fraginfo = matchinfo;
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 374f1be85c0d..d32a205e3af2 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -19,15 +19,10 @@
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter_ipv6/ip6t_opts.h>
-#define HOPBYHOP        1
 MODULE_LICENSE("GPL");
-#if HOPBYHOP
+MODULE_DESCRIPTION("IPv6 opts match");
-MODULE_DESCRIPTION("IPv6 HbH match");
-#else
-MODULE_DESCRIPTION("IPv6 DST match");
-#endif
 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
+MODULE_ALIAS("ip6t_dst");
 #if 0
 #define DEBUGP printk
@@ -71,11 +66,7 @@ match(const struct sk_buff *skb,
        u8 _optlen, *lp = NULL;
        unsigned int optlen;
-#if HOPBYHOP
+        if (ipv6_find_hdr(skb, &ptr, match->data, NULL) < 0)
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_HOP, NULL) < 0)
-#else
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_DEST, NULL) < 0)
-#endif
                return 0;
        oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
@@ -182,7 +173,6 @@ checkentry(const char *tablename,
           const void *entry,
           const struct xt_match *match,
           void *matchinfo,
-           unsigned int matchinfosize,
           unsigned int hook_mask)
 {
        const struct ip6t_opts *optsinfo = matchinfo;
@@ -194,26 +184,35 @@ checkentry(const char *tablename,
        return 1;
 }
-static struct ip6t_match opts_match = {
+static struct xt_match opts_match[] = {
-#if HOPBYHOP
+        {
-        .name           = "hbh",
+                .name           = "hbh",
-#else
+                .family         = AF_INET6,
-        .name           = "dst",
+                .match          = match,
-#endif
+                .matchsize      = sizeof(struct ip6t_opts),
-        .match          = match,
+                .checkentry     = checkentry,
-        .matchsize      = sizeof(struct ip6t_opts),
+                .me             = THIS_MODULE,
-        .checkentry     = checkentry,
+                .data           = NEXTHDR_HOP,
-        .me             = THIS_MODULE,
+        },
+        {
+                .name           = "dst",
+                .family         = AF_INET6,
+                .match          = match,
+                .matchsize      = sizeof(struct ip6t_opts),
+                .checkentry     = checkentry,
+                .me             = THIS_MODULE,
+                .data           = NEXTHDR_DEST,
+        },
 };
 static int __init ip6t_hbh_init(void)
 {
-        return ip6t_register_match(&opts_match);
+        return xt_register_matches(opts_match, ARRAY_SIZE(opts_match));
 }
 static void __exit ip6t_hbh_fini(void)
 {
-        ip6t_unregister_match(&opts_match);
+        xt_unregister_matches(opts_match, ARRAY_SIZE(opts_match));
 }
 module_init(ip6t_hbh_init);
diff --git a/net/ipv6/netfilter/ip6t_ipv6header.c b/net/ipv6/netfilter/ip6t_ipv6header.c
index 9375eeb1369f..3093c398002f 100644
--- a/net/ipv6/netfilter/ip6t_ipv6header.c
+++ b/net/ipv6/netfilter/ip6t_ipv6header.c
@@ -128,7 +128,6 @@ ipv6header_checkentry(const char *tablename,
                      const void *ip,
                      const struct xt_match *match,
                      void *matchinfo,
-                      unsigned int matchsize,
                      unsigned int hook_mask)
 {
        const struct ip6t_ipv6header_info *info = matchinfo;
diff --git a/net/ipv6/netfilter/ip6t_owner.c b/net/ipv6/netfilter/ip6t_owner.c
index 5d047990cd44..4eb9bbc4ebc3 100644
--- a/net/ipv6/netfilter/ip6t_owner.c
+++ b/net/ipv6/netfilter/ip6t_owner.c
@@ -57,7 +57,6 @@ checkentry(const char *tablename,
           const void *ip,
           const struct xt_match *match,
           void *matchinfo,
-           unsigned int matchsize,
           unsigned int hook_mask)
 {
        const struct ip6t_owner_info *info = matchinfo;
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index fbb0184a41d8..bcb2e168a5bc 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -197,7 +197,6 @@ checkentry(const char *tablename,
           const void *entry,
           const struct xt_match *match,
           void *matchinfo,
-           unsigned int matchinfosize,
           unsigned int hook_mask)
 {
        const struct ip6t_rt *rtinfo = matchinfo;
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 60976c0c58e8..2fc07c74decf 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -108,7 +108,7 @@ ip6t_hook(unsigned int hook,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(pskb, hook, in, out, &packet_filter, NULL);
+        return ip6t_do_table(pskb, hook, in, out, &packet_filter);
 }
 static unsigned int
@@ -128,7 +128,7 @@ ip6t_local_out_hook(unsigned int hook,
        }
 #endif
-        return ip6t_do_table(pskb, hook, in, out, &packet_filter, NULL);
+        return ip6t_do_table(pskb, hook, in, out, &packet_filter);
 }
 static struct nf_hook_ops ip6t_ops[] = {
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 03a13eab1dae..386ea260e767 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -138,7 +138,7 @@ ip6t_route_hook(unsigned int hook,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(pskb, hook, in, out, &packet_mangler, NULL);
+        return ip6t_do_table(pskb, hook, in, out, &packet_mangler);
 }
 static unsigned int
@@ -174,18 +174,14 @@ ip6t_local_hook(unsigned int hook,
        /* flowlabel and prio (includes version, which shouldn't change either */
        flowlabel = *((u_int32_t *) (*pskb)->nh.ipv6h);
-        ret = ip6t_do_table(pskb, hook, in, out, &packet_mangler, NULL);
+        ret = ip6t_do_table(pskb, hook, in, out, &packet_mangler);
        if (ret != NF_DROP && ret != NF_STOLEN 
                && (memcmp(&(*pskb)->nh.ipv6h->saddr, &saddr, sizeof(saddr))
                    || memcmp(&(*pskb)->nh.ipv6h->daddr, &daddr, sizeof(daddr))
                    || (*pskb)->nfmark != nfmark
-                    || (*pskb)->nh.ipv6h->hop_limit != hop_limit)) {
+                    || (*pskb)->nh.ipv6h->hop_limit != hop_limit))
+                return ip6_route_me_harder(*pskb) == 0 ? ret : NF_DROP;
-                /* something which could affect routing has changed */
-                DEBUGP("ip6table_mangle: we'd need to re-route a packet\n");
-        }
        return ret;
 }
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 61a7c58e99f8..b4154da575c0 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -122,7 +122,7 @@ ip6t_hook(unsigned int hook,
         const struct net_device *out,
         int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(pskb, hook, in, out, &packet_raw, NULL);
+        return ip6t_do_table(pskb, hook, in, out, &packet_raw);
 }
 static struct nf_hook_ops ip6t_ops[] = { 
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 2a71c3b669f1..e5e53fff9e38 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -20,7 +20,6 @@
 *        structures.
 */
-#include <linux/config.h>
 #include <linux/types.h>
 #include <linux/ipv6.h>
 #include <linux/in6.h>
@@ -336,7 +335,7 @@ static struct nf_hook_ops ipv6_conntrack_ops[] = {
 /* From nf_conntrack_proto_icmpv6.c */
 extern unsigned int nf_ct_icmpv6_timeout;
-/* From nf_conntrack_frag6.c */
+/* From nf_conntrack_reasm.c */
 extern unsigned int nf_ct_frag6_timeout;
 extern unsigned int nf_ct_frag6_low_thresh;
 extern unsigned int nf_ct_frag6_high_thresh;
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index ef18a7b7014b..34d447208ffd 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -33,7 +33,7 @@
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
-unsigned long nf_ct_icmpv6_timeout = 30*HZ;
+unsigned long nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
 #if 0
 #define DEBUGP printk
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index c32a029e43f0..bf93c1ea6be9 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -14,7 +14,6 @@
 * 2 of the License, or (at your option) any later version.
 */
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/string.h>
@@ -55,9 +54,9 @@
 #define NF_CT_FRAG6_LOW_THRESH 196608  /* == 192*1024 */
 #define NF_CT_FRAG6_TIMEOUT IPV6_FRAG_TIMEOUT
-unsigned int nf_ct_frag6_high_thresh = 256*1024;
+unsigned int nf_ct_frag6_high_thresh __read_mostly = 256*1024;
-unsigned int nf_ct_frag6_low_thresh = 192*1024;
+unsigned int nf_ct_frag6_low_thresh __read_mostly = 192*1024;
-unsigned long nf_ct_frag6_timeout = IPV6_FRAG_TIMEOUT;
+unsigned long nf_ct_frag6_timeout __read_mostly = IPV6_FRAG_TIMEOUT;
 struct nf_ct_frag6_skb_cb
 {
@@ -409,7 +408,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                return -1;
        }
-        if (skb->ip_summed == CHECKSUM_HW)
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
                skb->csum = csum_sub(skb->csum,
                                     csum_partial(skb->nh.raw,
                                                  (u8*)(fhdr + 1) - skb->nh.raw,
@@ -641,7 +640,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
                head->len += fp->len;
                if (head->ip_summed != fp->ip_summed)
                        head->ip_summed = CHECKSUM_NONE;
-                else if (head->ip_summed == CHECKSUM_HW)
+                else if (head->ip_summed == CHECKSUM_COMPLETE)
                        head->csum = csum_add(head->csum, fp->csum);
                head->truesize += fp->truesize;
                atomic_sub(fp->truesize, &nf_ct_frag6_mem);
@@ -653,7 +652,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
        head->nh.ipv6h->payload_len = htons(payload_len);
        /* Yes, and fold redundant checksum back. 8) */
-        if (head->ip_summed == CHECKSUM_HW)
+        if (head->ip_summed == CHECKSUM_COMPLETE)
                head->csum = csum_partial(head->nh.raw, head->h.raw-head->nh.raw, head->csum);
        fq->fragments = NULL;
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 779ddf77f4d4..efee7a6301a8 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -17,7 +17,6 @@
 *              as published by the Free Software Foundation; either version
 *              2 of the License, or (at your option) any later version.
 */
-#include <linux/config.h>
 #include <linux/sched.h>
 #include <linux/socket.h>
 #include <linux/net.h>
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index fa1ce0ae123e..d09329ca3267 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -50,6 +50,9 @@
 #include <net/udp.h>
 #include <net/inet_common.h>
 #include <net/tcp_states.h>
+#ifdef CONFIG_IPV6_MIP6
+#include <net/mip6.h>
+#endif
 #include <net/rawv6.h>
 #include <net/xfrm.h>
@@ -169,8 +172,32 @@ int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
        sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr, IP6CB(skb)->iif);
        while (sk) {
+                int filtered;
                delivered = 1;
-                if (nexthdr != IPPROTO_ICMPV6 || !icmpv6_filter(sk, skb)) {
+                switch (nexthdr) {
+                case IPPROTO_ICMPV6:
+                        filtered = icmpv6_filter(sk, skb);
+                        break;
+#ifdef CONFIG_IPV6_MIP6
+                case IPPROTO_MH:
+                        /* XXX: To validate MH only once for each packet,
+                         * this is placed here. It should be after checking
+                         * xfrm policy, however it doesn't. The checking xfrm
+                         * policy is placed in rawv6_rcv() because it is
+                         * required for each socket.
+                         */
+                        filtered = mip6_mh_filter(sk, skb);
+                        break;
+#endif
+                default:
+                        filtered = 0;
+                        break;
+                }
+                if (filtered < 0)
+                        break;
+                if (filtered == 0) {
                        struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);
                        /* Not releasing hash table! */
@@ -334,7 +361,7 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
        if (!rp->checksum)
                skb->ip_summed = CHECKSUM_UNNECESSARY;
-        if (skb->ip_summed == CHECKSUM_HW) {
+        if (skb->ip_summed == CHECKSUM_COMPLETE) {
                skb_postpull_rcsum(skb, skb->nh.raw,
                                   skb->h.raw - skb->nh.raw);
                if (!csum_ipv6_magic(&skb->nh.ipv6h->saddr,
@@ -411,6 +438,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
        /* Copy the address. */
        if (sin6) {
                sin6->sin6_family = AF_INET6;
+                sin6->sin6_port = 0;
                ipv6_addr_copy(&sin6->sin6_addr, &skb->nh.ipv6h->saddr);
                sin6->sin6_flowinfo = 0;
                sin6->sin6_scope_id = 0;
@@ -581,6 +609,9 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
        struct iovec *iov;
        u8 __user *type = NULL;
        u8 __user *code = NULL;
+#ifdef CONFIG_IPV6_MIP6
+        u8 len = 0;
+#endif
        int probed = 0;
        int i;
@@ -612,6 +643,20 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                                probed = 1;
                        }
                        break;
+#ifdef CONFIG_IPV6_MIP6
+                case IPPROTO_MH:
+                        if (iov->iov_base && iov->iov_len < 1)
+                                break;
+                        /* check if type field is readable or not. */
+                        if (iov->iov_len > 2 - len) {
+                                u8 __user *p = iov->iov_base;
+                                get_user(fl->fl_mh_type, &p[2 - len]);
+                                probed = 1;
+                        } else
+                                len += iov->iov_len;
+                        break;
+#endif
                default:
                        probed = 1;
                        break;
@@ -758,6 +803,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
        if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
                fl.oif = np->mcast_oif;
+        security_sk_classify_flow(sk, &fl);
        err = ip6_dst_lookup(sk, &dst, &fl);
        if (err)
@@ -780,7 +826,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
        }
        if (tclass < 0) {
-                tclass = np->cork.tclass;
+                tclass = np->tclass;
                if (tclass < 0)
                        tclass = 0;
        }
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index eef985e010ea..f39bbedd1327 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -28,7 +28,6 @@
 *      YOSHIFUJI,H. @USAGI     Always remove fragment header to
 *                              calculate ICV correctly.
 */
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/string.h>
@@ -54,10 +53,10 @@
 #include <net/ndisc.h>
 #include <net/addrconf.h>
-int sysctl_ip6frag_high_thresh = 256*1024;
+int sysctl_ip6frag_high_thresh __read_mostly = 256*1024;
-int sysctl_ip6frag_low_thresh = 192*1024;
+int sysctl_ip6frag_low_thresh __read_mostly = 192*1024;
-int sysctl_ip6frag_time = IPV6_FRAG_TIMEOUT;
+int sysctl_ip6frag_time __read_mostly = IPV6_FRAG_TIMEOUT;
 struct ip6frag_skb_cb
 {
@@ -153,7 +152,7 @@ static unsigned int ip6qhashfn(u32 id, struct in6_addr *saddr,
 }
 static struct timer_list ip6_frag_secret_timer;
-int sysctl_ip6frag_secret_interval = 10 * 60 * HZ;
+int sysctl_ip6frag_secret_interval __read_mostly = 10 * 60 * HZ;
 static void ip6_frag_secret_rebuild(unsigned long dummy)
 {
@@ -434,7 +433,7 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
                return;
        }
-        if (skb->ip_summed == CHECKSUM_HW)
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
                skb->csum = csum_sub(skb->csum,
                                     csum_partial(skb->nh.raw, (u8*)(fhdr+1)-skb->nh.raw, 0));
@@ -648,7 +647,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
                head->len += fp->len;
                if (head->ip_summed != fp->ip_summed)
                        head->ip_summed = CHECKSUM_NONE;
-                else if (head->ip_summed == CHECKSUM_HW)
+                else if (head->ip_summed == CHECKSUM_COMPLETE)
                        head->csum = csum_add(head->csum, fp->csum);
                head->truesize += fp->truesize;
                atomic_sub(fp->truesize, &ip6_frag_mem);
@@ -663,7 +662,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
        *skb_in = head;
        /* Yes, and fold redundant checksum back. 8) */
-        if (head->ip_summed == CHECKSUM_HW)
+        if (head->ip_summed == CHECKSUM_COMPLETE)
                head->csum = csum_partial(head->nh.raw, head->h.raw-head->nh.raw, head->csum);
        IP6_INC_STATS_BH(IPSTATS_MIB_REASMOKS);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8a777932786d..d6b4b4f48d18 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -22,10 +22,11 @@
 *              routers in REACHABLE, STALE, DELAY or PROBE states).
 *              - always select the same router if it is (probably)
 *              reachable.  otherwise, round-robin the list.
+ *      Ville Nuorvala
+ *              Fixed routing subtrees.
 */
 #include <linux/capability.h>
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/times.h>
@@ -36,7 +37,6 @@
 #include <linux/netdevice.h>
 #include <linux/in6.h>
 #include <linux/init.h>
-#include <linux/netlink.h>
 #include <linux/if_arp.h>
 #ifdef  CONFIG_PROC_FS
@@ -54,6 +54,8 @@
 #include <linux/rtnetlink.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
+#include <net/netevent.h>
+#include <net/netlink.h>
 #include <asm/uaccess.h>
@@ -74,9 +76,6 @@
 #define CLONE_OFFLINK_ROUTE 0
-#define RT6_SELECT_F_IFACE      0x1
-#define RT6_SELECT_F_REACHABLE  0x2
 static int ip6_rt_max_size = 4096;
 static int ip6_rt_gc_min_interval = HZ / 2;
 static int ip6_rt_gc_timeout = 60*HZ;
@@ -140,15 +139,49 @@ struct rt6_info ip6_null_entry = {
        .rt6i_ref       = ATOMIC_INIT(1),
 };
-struct fib6_node ip6_routing_table = {
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
-        .leaf           = &ip6_null_entry,
-        .fn_flags       = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO,
-};
-/* Protects all the ip6 fib */
+struct rt6_info ip6_prohibit_entry = {
+        .u = {
+                .dst = {
+                        .__refcnt       = ATOMIC_INIT(1),
+                        .__use          = 1,
+                        .dev            = &loopback_dev,
+                        .obsolete       = -1,
+                        .error          = -EACCES,
+                        .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
+                        .input          = ip6_pkt_discard,
+                        .output         = ip6_pkt_discard_out,
+                        .ops            = &ip6_dst_ops,
+                        .path           = (struct dst_entry*)&ip6_prohibit_entry,
+                }
+        },
+        .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
+        .rt6i_metric    = ~(u32) 0,
+        .rt6i_ref       = ATOMIC_INIT(1),
+};
-DEFINE_RWLOCK(rt6_lock);
+struct rt6_info ip6_blk_hole_entry = {
+        .u = {
+                .dst = {
+                        .__refcnt       = ATOMIC_INIT(1),
+                        .__use          = 1,
+                        .dev            = &loopback_dev,
+                        .obsolete       = -1,
+                        .error          = -EINVAL,
+                        .metrics        = { [RTAX_HOPLIMIT - 1] = 255, },
+                        .input          = ip6_pkt_discard,
+                        .output         = ip6_pkt_discard_out,
+                        .ops            = &ip6_dst_ops,
+                        .path           = (struct dst_entry*)&ip6_blk_hole_entry,
+                }
+        },
+        .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
+        .rt6i_metric    = ~(u32) 0,
+        .rt6i_ref       = ATOMIC_INIT(1),
+};
+#endif
 /* allocate dst with ip6_dst_ops */
 static __inline__ struct rt6_info *ip6_dst_alloc(void)
@@ -188,8 +221,14 @@ static __inline__ int rt6_check_expired(const struct rt6_info *rt)
                time_after(jiffies, rt->rt6i_expires));
 }
+static inline int rt6_need_strict(struct in6_addr *daddr)
+{
+        return (ipv6_addr_type(daddr) &
+                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
+}
 /*
- *      Route lookup. Any rt6_lock is implied.
+ *      Route lookup. Any table->tb6_lock is implied.
 */
 static __inline__ struct rt6_info *rt6_device_match(struct rt6_info *rt,
@@ -298,7 +337,7 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
        int m, n;
                
        m = rt6_check_dev(rt, oif);
-        if (!m && (strict & RT6_SELECT_F_IFACE))
+        if (!m && (strict & RT6_LOOKUP_F_IFACE))
                return -1;
 #ifdef CONFIG_IPV6_ROUTER_PREF
        m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
@@ -306,7 +345,7 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
        n = rt6_check_neigh(rt);
        if (n > 1)
                m |= 16;
-        else if (!n && strict & RT6_SELECT_F_REACHABLE)
+        else if (!n && strict & RT6_LOOKUP_F_REACHABLE)
                return -1;
        return m;
 }
@@ -346,10 +385,10 @@ static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
        }
        if (!match &&
-            (strict & RT6_SELECT_F_REACHABLE) &&
+            (strict & RT6_LOOKUP_F_REACHABLE) &&
            last && last != rt0) {
                /* no entries matched; do round-robin */
-                static spinlock_t lock = SPIN_LOCK_UNLOCKED;
+                static DEFINE_SPINLOCK(lock);
                spin_lock(&lock);
                *head = rt0->u.next;
                rt0->u.next = last->u.next;
@@ -417,7 +456,7 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
        rt = rt6_get_route_info(prefix, rinfo->prefix_len, gwaddr, dev->ifindex);
        if (rt && !lifetime) {
-                ip6_del_rt(rt, NULL, NULL, NULL);
+                ip6_del_rt(rt);
                rt = NULL;
        }
@@ -441,44 +480,95 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
 }
 #endif
-struct rt6_info *rt6_lookup(struct in6_addr *daddr, struct in6_addr *saddr,
+#define BACKTRACK(saddr) \
-                            int oif, int strict)
+do { \
+        if (rt == &ip6_null_entry) { \
+                struct fib6_node *pn; \
+                while (fn) { \
+                        if (fn->fn_flags & RTN_TL_ROOT) \
+                                goto out; \
+                        pn = fn->parent; \
+                        if (FIB6_SUBTREE(pn) && FIB6_SUBTREE(pn) != fn) \
+                                fn = fib6_lookup(pn->subtree, NULL, saddr); \
+                        else \
+                                fn = pn; \
+                        if (fn->fn_flags & RTN_RTINFO) \
+                                goto restart; \
+                } \
+        } \
+} while(0)
+static struct rt6_info *ip6_pol_route_lookup(struct fib6_table *table,
+                                             struct flowi *fl, int flags)
 {
        struct fib6_node *fn;
        struct rt6_info *rt;
-        read_lock_bh(&rt6_lock);
+        read_lock_bh(&table->tb6_lock);
-        fn = fib6_lookup(&ip6_routing_table, daddr, saddr);
+        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
-        rt = rt6_device_match(fn->leaf, oif, strict);
+restart:
+        rt = fn->leaf;
+        rt = rt6_device_match(rt, fl->oif, flags);
+        BACKTRACK(&fl->fl6_src);
+out:
        dst_hold(&rt->u.dst);
-        rt->u.dst.__use++;
+        read_unlock_bh(&table->tb6_lock);
-        read_unlock_bh(&rt6_lock);
        rt->u.dst.lastuse = jiffies;
-        if (rt->u.dst.error == 0)
+        rt->u.dst.__use++;
-                return rt;
-        dst_release(&rt->u.dst);
+        return rt;
+}
+struct rt6_info *rt6_lookup(struct in6_addr *daddr, struct in6_addr *saddr,
+                            int oif, int strict)
+{
+        struct flowi fl = {
+                .oif = oif,
+                .nl_u = {
+                        .ip6_u = {
+                                .daddr = *daddr,
+                                /* TODO: saddr */
+                        },
+                },
+        };
+        struct dst_entry *dst;
+        int flags = strict ? RT6_LOOKUP_F_IFACE : 0;
+        dst = fib6_rule_lookup(&fl, flags, ip6_pol_route_lookup);
+        if (dst->error == 0)
+                return (struct rt6_info *) dst;
+        dst_release(dst);
        return NULL;
 }
-/* ip6_ins_rt is called with FREE rt6_lock.
+/* ip6_ins_rt is called with FREE table->tb6_lock.
   It takes new route entry, the addition fails by any reason the
   route is freed. In any case, if caller does not hold it, it may
   be destroyed.
 */
-int ip6_ins_rt(struct rt6_info *rt, struct nlmsghdr *nlh,
+static int __ip6_ins_rt(struct rt6_info *rt, struct nl_info *info)
-                void *_rtattr, struct netlink_skb_parms *req)
 {
        int err;
+        struct fib6_table *table;
-        write_lock_bh(&rt6_lock);
+        table = rt->rt6i_table;
-        err = fib6_add(&ip6_routing_table, rt, nlh, _rtattr, req);
+        write_lock_bh(&table->tb6_lock);
-        write_unlock_bh(&rt6_lock);
+        err = fib6_add(&table->tb6_root, rt, info);
+        write_unlock_bh(&table->tb6_lock);
        return err;
 }
+int ip6_ins_rt(struct rt6_info *rt)
+{
+        return __ip6_ins_rt(rt, NULL);
+}
 static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, struct in6_addr *daddr,
                                      struct in6_addr *saddr)
 {
@@ -532,51 +622,39 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, struct in6_addr *d
        return rt;
 }
-#define BACKTRACK() \
+static struct rt6_info *ip6_pol_route_input(struct fib6_table *table,
-if (rt == &ip6_null_entry) { \
+                                            struct flowi *fl, int flags)
-       while ((fn = fn->parent) != NULL) { \
-                if (fn->fn_flags & RTN_ROOT) { \
-                        goto out; \
-                } \
-                if (fn->fn_flags & RTN_RTINFO) \
-                        goto restart; \
-        } \
-}
-void ip6_route_input(struct sk_buff *skb)
 {
        struct fib6_node *fn;
        struct rt6_info *rt, *nrt;
-        int strict;
+        int strict = 0;
        int attempts = 3;
        int err;
-        int reachable = RT6_SELECT_F_REACHABLE;
+        int reachable = RT6_LOOKUP_F_REACHABLE;
-        strict = ipv6_addr_type(&skb->nh.ipv6h->daddr) & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL) ? RT6_SELECT_F_IFACE : 0;
+        strict |= flags & RT6_LOOKUP_F_IFACE;
 relookup:
-        read_lock_bh(&rt6_lock);
+        read_lock_bh(&table->tb6_lock);
 restart_2:
-        fn = fib6_lookup(&ip6_routing_table, &skb->nh.ipv6h->daddr,
+        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
-                         &skb->nh.ipv6h->saddr);
 restart:
-        rt = rt6_select(&fn->leaf, skb->dev->ifindex, strict | reachable);
+        rt = rt6_select(&fn->leaf, fl->iif, strict | reachable);
-        BACKTRACK();
+        BACKTRACK(&fl->fl6_src);
        if (rt == &ip6_null_entry ||
            rt->rt6i_flags & RTF_CACHE)
                goto out;
        dst_hold(&rt->u.dst);
-        read_unlock_bh(&rt6_lock);
+        read_unlock_bh(&table->tb6_lock);
        if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
-                nrt = rt6_alloc_cow(rt, &skb->nh.ipv6h->daddr, &skb->nh.ipv6h->saddr);
+                nrt = rt6_alloc_cow(rt, &fl->fl6_dst, &fl->fl6_src);
        else {
 #if CLONE_OFFLINK_ROUTE
-                nrt = rt6_alloc_clone(rt, &skb->nh.ipv6h->daddr);
+                nrt = rt6_alloc_clone(rt, &fl->fl6_dst);
 #else
                goto out2;
 #endif
@@ -587,7 +665,7 @@ restart:
        dst_hold(&rt->u.dst);
        if (nrt) {
-                err = ip6_ins_rt(nrt, NULL, NULL, &NETLINK_CB(skb));
+                err = ip6_ins_rt(nrt);
                if (!err)
                        goto out2;
        }
@@ -596,7 +674,7 @@ restart:
                goto out2;
        /*
-         * Race condition! In the gap, when rt6_lock was
+         * Race condition! In the gap, when table->tb6_lock was
         * released someone could insert this route.  Relookup.
         */
        dst_release(&rt->u.dst);
@@ -608,40 +686,63 @@ out:
                goto restart_2;
        }
        dst_hold(&rt->u.dst);
-        read_unlock_bh(&rt6_lock);
+        read_unlock_bh(&table->tb6_lock);
 out2:
        rt->u.dst.lastuse = jiffies;
        rt->u.dst.__use++;
-        skb->dst = (struct dst_entry *) rt;
-        return;
+        return rt;
 }
-struct dst_entry * ip6_route_output(struct sock *sk, struct flowi *fl)
+void ip6_route_input(struct sk_buff *skb)
+{
+        struct ipv6hdr *iph = skb->nh.ipv6h;
+        struct flowi fl = {
+                .iif = skb->dev->ifindex,
+                .nl_u = {
+                        .ip6_u = {
+                                .daddr = iph->daddr,
+                                .saddr = iph->saddr,
+#ifdef CONFIG_IPV6_ROUTE_FWMARK
+                                .fwmark = skb->nfmark,
+#endif
+                                .flowlabel = (* (u32 *) iph)&IPV6_FLOWINFO_MASK,
+                        },
+                },
+                .proto = iph->nexthdr,
+        };
+        int flags = rt6_need_strict(&iph->daddr) ? RT6_LOOKUP_F_IFACE : 0;
+        skb->dst = fib6_rule_lookup(&fl, flags, ip6_pol_route_input);
+}
+static struct rt6_info *ip6_pol_route_output(struct fib6_table *table,
+                                             struct flowi *fl, int flags)
 {
        struct fib6_node *fn;
        struct rt6_info *rt, *nrt;
-        int strict;
+        int strict = 0;
        int attempts = 3;
        int err;
-        int reachable = RT6_SELECT_F_REACHABLE;
+        int reachable = RT6_LOOKUP_F_REACHABLE;
-        strict = ipv6_addr_type(&fl->fl6_dst) & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL) ? RT6_SELECT_F_IFACE : 0;
+        strict |= flags & RT6_LOOKUP_F_IFACE;
 relookup:
-        read_lock_bh(&rt6_lock);
+        read_lock_bh(&table->tb6_lock);
 restart_2:
-        fn = fib6_lookup(&ip6_routing_table, &fl->fl6_dst, &fl->fl6_src);
+        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 restart:
        rt = rt6_select(&fn->leaf, fl->oif, strict | reachable);
-        BACKTRACK();
+        BACKTRACK(&fl->fl6_src);
        if (rt == &ip6_null_entry ||
            rt->rt6i_flags & RTF_CACHE)
                goto out;
        dst_hold(&rt->u.dst);
-        read_unlock_bh(&rt6_lock);
+        read_unlock_bh(&table->tb6_lock);
        if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
                nrt = rt6_alloc_cow(rt, &fl->fl6_dst, &fl->fl6_src);
@@ -658,7 +759,7 @@ restart:
        dst_hold(&rt->u.dst);
        if (nrt) {
-                err = ip6_ins_rt(nrt, NULL, NULL, NULL);
+                err = ip6_ins_rt(nrt);
                if (!err)
                        goto out2;
        }
@@ -667,7 +768,7 @@ restart:
                goto out2;
        /*
-         * Race condition! In the gap, when rt6_lock was
+         * Race condition! In the gap, when table->tb6_lock was
         * released someone could insert this route.  Relookup.
         */
        dst_release(&rt->u.dst);
@@ -679,11 +780,21 @@ out:
                goto restart_2;
        }
        dst_hold(&rt->u.dst);
-        read_unlock_bh(&rt6_lock);
+        read_unlock_bh(&table->tb6_lock);
 out2:
        rt->u.dst.lastuse = jiffies;
        rt->u.dst.__use++;
-        return &rt->u.dst;
+        return rt;
+}
+struct dst_entry * ip6_route_output(struct sock *sk, struct flowi *fl)
+{
+        int flags = 0;
+        if (rt6_need_strict(&fl->fl6_dst))
+                flags |= RT6_LOOKUP_F_IFACE;
+        return fib6_rule_lookup(fl, flags, ip6_pol_route_output);
 }
@@ -709,7 +820,7 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
        if (rt) {
                if (rt->rt6i_flags & RTF_CACHE)
-                        ip6_del_rt(rt, NULL, NULL, NULL);
+                        ip6_del_rt(rt);
                else
                        dst_release(dst);
        }
@@ -743,11 +854,10 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
                        dst->metrics[RTAX_FEATURES-1] |= RTAX_FEATURE_ALLFRAG;
                }
                dst->metrics[RTAX_MTU-1] = mtu;
+                call_netevent_notifiers(NETEVENT_PMTU_UPDATE, dst);
        }
 }
-/* Protected by rt6_lock.  */
-static struct dst_entry *ndisc_dst_gc_list;
 static int ipv6_get_mtu(struct net_device *dev);
 static inline unsigned int ipv6_advmss(unsigned int mtu)
@@ -768,6 +878,9 @@ static inline unsigned int ipv6_advmss(unsigned int mtu)
        return mtu;
 }
+static struct dst_entry *ndisc_dst_gc_list;
+static DEFINE_SPINLOCK(ndisc_lock);
 struct dst_entry *ndisc_dst_alloc(struct net_device *dev, 
                                  struct neighbour *neigh,
                                  struct in6_addr *addr,
@@ -808,10 +921,10 @@ struct dst_entry *ndisc_dst_alloc(struct net_device *dev,
        rt->rt6i_dst.plen = 128;
 #endif
-        write_lock_bh(&rt6_lock);
+        spin_lock_bh(&ndisc_lock);
        rt->u.dst.next = ndisc_dst_gc_list;
        ndisc_dst_gc_list = &rt->u.dst;
-        write_unlock_bh(&rt6_lock);
+        spin_unlock_bh(&ndisc_lock);
        fib6_force_start_gc();
@@ -825,8 +938,11 @@ int ndisc_dst_gc(int *more)
        int freed;
        next = NULL;
+        freed = 0;
+        spin_lock_bh(&ndisc_lock);
        pprev = &ndisc_dst_gc_list;
-        freed = 0;
        while ((dst = *pprev) != NULL) {
                if (!atomic_read(&dst->__refcnt)) {
                        *pprev = dst->next;
@@ -838,6 +954,8 @@ int ndisc_dst_gc(int *more)
                }
        }
+        spin_unlock_bh(&ndisc_lock);
        return freed;
 }
@@ -898,28 +1016,24 @@ int ipv6_get_hoplimit(struct net_device *dev)
 *
 */
-int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, 
+int ip6_route_add(struct fib6_config *cfg)
-                void *_rtattr, struct netlink_skb_parms *req)
 {
        int err;
-        struct rtmsg *r;
-        struct rtattr **rta;
        struct rt6_info *rt = NULL;
        struct net_device *dev = NULL;
        struct inet6_dev *idev = NULL;
+        struct fib6_table *table;
        int addr_type;
-        rta = (struct rtattr **) _rtattr;
+        if (cfg->fc_dst_len > 128 || cfg->fc_src_len > 128)
-        if (rtmsg->rtmsg_dst_len > 128 || rtmsg->rtmsg_src_len > 128)
                return -EINVAL;
 #ifndef CONFIG_IPV6_SUBTREES
-        if (rtmsg->rtmsg_src_len)
+        if (cfg->fc_src_len)
                return -EINVAL;
 #endif
-        if (rtmsg->rtmsg_ifindex) {
+        if (cfg->fc_ifindex) {
                err = -ENODEV;
-                dev = dev_get_by_index(rtmsg->rtmsg_ifindex);
+                dev = dev_get_by_index(cfg->fc_ifindex);
                if (!dev)
                        goto out;
                idev = in6_dev_get(dev);
@@ -927,8 +1041,14 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh,
                        goto out;
        }
-        if (rtmsg->rtmsg_metric == 0)
+        if (cfg->fc_metric == 0)
-                rtmsg->rtmsg_metric = IP6_RT_PRIO_USER;
+                cfg->fc_metric = IP6_RT_PRIO_USER;
+        table = fib6_new_table(cfg->fc_table);
+        if (table == NULL) {
+                err = -ENOBUFS;
+                goto out;
+        }
        rt = ip6_dst_alloc();
@@ -938,14 +1058,13 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh,
        }
        rt->u.dst.obsolete = -1;
-        rt->rt6i_expires = jiffies + clock_t_to_jiffies(rtmsg->rtmsg_info);
+        rt->rt6i_expires = jiffies + clock_t_to_jiffies(cfg->fc_expires);
-        if (nlh && (r = NLMSG_DATA(nlh))) {
-                rt->rt6i_protocol = r->rtm_protocol;
-        } else {
-                rt->rt6i_protocol = RTPROT_BOOT;
-        }
-        addr_type = ipv6_addr_type(&rtmsg->rtmsg_dst);
+        if (cfg->fc_protocol == RTPROT_UNSPEC)
+                cfg->fc_protocol = RTPROT_BOOT;
+        rt->rt6i_protocol = cfg->fc_protocol;
+        addr_type = ipv6_addr_type(&cfg->fc_dst);
        if (addr_type & IPV6_ADDR_MULTICAST)
                rt->u.dst.input = ip6_mc_input;
@@ -954,24 +1073,22 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh,
        rt->u.dst.output = ip6_output;
-        ipv6_addr_prefix(&rt->rt6i_dst.addr, 
+        ipv6_addr_prefix(&rt->rt6i_dst.addr, &cfg->fc_dst, cfg->fc_dst_len);
-                         &rtmsg->rtmsg_dst, rtmsg->rtmsg_dst_len);
+        rt->rt6i_dst.plen = cfg->fc_dst_len;
-        rt->rt6i_dst.plen = rtmsg->rtmsg_dst_len;
        if (rt->rt6i_dst.plen == 128)
               rt->u.dst.flags = DST_HOST;
 #ifdef CONFIG_IPV6_SUBTREES
-        ipv6_addr_prefix(&rt->rt6i_src.addr, 
+        ipv6_addr_prefix(&rt->rt6i_src.addr, &cfg->fc_src, cfg->fc_src_len);
-                         &rtmsg->rtmsg_src, rtmsg->rtmsg_src_len);
+        rt->rt6i_src.plen = cfg->fc_src_len;
-        rt->rt6i_src.plen = rtmsg->rtmsg_src_len;
 #endif
-        rt->rt6i_metric = rtmsg->rtmsg_metric;
+        rt->rt6i_metric = cfg->fc_metric;
        /* We cannot add true routes via loopback here,
           they would result in kernel looping; promote them to reject routes
         */
-        if ((rtmsg->rtmsg_flags&RTF_REJECT) ||
+        if ((cfg->fc_flags & RTF_REJECT) ||
            (dev && (dev->flags&IFF_LOOPBACK) && !(addr_type&IPV6_ADDR_LOOPBACK))) {
                /* hold loopback dev/idev if we haven't done so. */
                if (dev != &loopback_dev) {
@@ -994,12 +1111,12 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh,
                goto install_route;
        }
-        if (rtmsg->rtmsg_flags & RTF_GATEWAY) {
+        if (cfg->fc_flags & RTF_GATEWAY) {
                struct in6_addr *gw_addr;
                int gwa_type;
-                gw_addr = &rtmsg->rtmsg_gateway;
+                gw_addr = &cfg->fc_gateway;
-                ipv6_addr_copy(&rt->rt6i_gateway, &rtmsg->rtmsg_gateway);
+                ipv6_addr_copy(&rt->rt6i_gateway, gw_addr);
                gwa_type = ipv6_addr_type(gw_addr);
                if (gwa_type != (IPV6_ADDR_LINKLOCAL|IPV6_ADDR_UNICAST)) {
@@ -1016,7 +1133,7 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh,
                        if (!(gwa_type&IPV6_ADDR_UNICAST))
                                goto out;
-                        grt = rt6_lookup(gw_addr, NULL, rtmsg->rtmsg_ifindex, 1);
+                        grt = rt6_lookup(gw_addr, NULL, cfg->fc_ifindex, 1);
                        err = -EHOSTUNREACH;
                        if (grt == NULL)
@@ -1048,7 +1165,7 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh,
        if (dev == NULL)
                goto out;
-        if (rtmsg->rtmsg_flags & (RTF_GATEWAY|RTF_NONEXTHOP)) {
+        if (cfg->fc_flags & (RTF_GATEWAY | RTF_NONEXTHOP)) {
                rt->rt6i_nexthop = __neigh_lookup_errno(&nd_tbl, &rt->rt6i_gateway, dev);
                if (IS_ERR(rt->rt6i_nexthop)) {
                        err = PTR_ERR(rt->rt6i_nexthop);
@@ -1057,24 +1174,24 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh,
                }
        }
-        rt->rt6i_flags = rtmsg->rtmsg_flags;
+        rt->rt6i_flags = cfg->fc_flags;
 install_route:
-        if (rta && rta[RTA_METRICS-1]) {
+        if (cfg->fc_mx) {
-                int attrlen = RTA_PAYLOAD(rta[RTA_METRICS-1]);
+                struct nlattr *nla;
-                struct rtattr *attr = RTA_DATA(rta[RTA_METRICS-1]);
+                int remaining;
-                while (RTA_OK(attr, attrlen)) {
+                nla_for_each_attr(nla, cfg->fc_mx, cfg->fc_mx_len, remaining) {
-                        unsigned flavor = attr->rta_type;
+                        int type = nla->nla_type;
-                        if (flavor) {
-                                if (flavor > RTAX_MAX) {
+                        if (type) {
+                                if (type > RTAX_MAX) {
                                        err = -EINVAL;
                                        goto out;
                                }
-                                rt->u.dst.metrics[flavor-1] =
-                                        *(u32 *)RTA_DATA(attr);
+                                rt->u.dst.metrics[type - 1] = nla_get_u32(nla);
                        }
-                        attr = RTA_NEXT(attr, attrlen);
                }
        }
@@ -1086,7 +1203,8 @@ install_route:
                rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(dst_mtu(&rt->u.dst));
        rt->u.dst.dev = dev;
        rt->rt6i_idev = idev;
-        return ip6_ins_rt(rt, nlh, _rtattr, req);
+        rt->rt6i_table = table;
+        return __ip6_ins_rt(rt, &cfg->fc_nlinfo);
 out:
        if (dev)
@@ -1098,51 +1216,65 @@ out:
        return err;
 }
-int ip6_del_rt(struct rt6_info *rt, struct nlmsghdr *nlh, void *_rtattr, struct netlink_skb_parms *req)
+static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
 {
        int err;
+        struct fib6_table *table;
-        write_lock_bh(&rt6_lock);
+        if (rt == &ip6_null_entry)
+                return -ENOENT;
-        err = fib6_del(rt, nlh, _rtattr, req);
+        table = rt->rt6i_table;
+        write_lock_bh(&table->tb6_lock);
+        err = fib6_del(rt, info);
        dst_release(&rt->u.dst);
-        write_unlock_bh(&rt6_lock);
+        write_unlock_bh(&table->tb6_lock);
        return err;
 }
-static int ip6_route_del(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, void *_rtattr, struct netlink_skb_parms *req)
+int ip6_del_rt(struct rt6_info *rt)
 {
+        return __ip6_del_rt(rt, NULL);
+}
+static int ip6_route_del(struct fib6_config *cfg)
+{
+        struct fib6_table *table;
        struct fib6_node *fn;
        struct rt6_info *rt;
        int err = -ESRCH;
-        read_lock_bh(&rt6_lock);
+        table = fib6_get_table(cfg->fc_table);
+        if (table == NULL)
+                return err;
-        fn = fib6_locate(&ip6_routing_table,
+        read_lock_bh(&table->tb6_lock);
-                         &rtmsg->rtmsg_dst, rtmsg->rtmsg_dst_len,
-                         &rtmsg->rtmsg_src, rtmsg->rtmsg_src_len);
+        fn = fib6_locate(&table->tb6_root,
+                         &cfg->fc_dst, cfg->fc_dst_len,
+                         &cfg->fc_src, cfg->fc_src_len);
        
        if (fn) {
                for (rt = fn->leaf; rt; rt = rt->u.next) {
-                        if (rtmsg->rtmsg_ifindex &&
+                        if (cfg->fc_ifindex &&
                            (rt->rt6i_dev == NULL ||
-                             rt->rt6i_dev->ifindex != rtmsg->rtmsg_ifindex))
+                             rt->rt6i_dev->ifindex != cfg->fc_ifindex))
                                continue;
-                        if (rtmsg->rtmsg_flags&RTF_GATEWAY &&
+                        if (cfg->fc_flags & RTF_GATEWAY &&
-                            !ipv6_addr_equal(&rtmsg->rtmsg_gateway, &rt->rt6i_gateway))
+                            !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
                                continue;
-                        if (rtmsg->rtmsg_metric &&
+                        if (cfg->fc_metric && cfg->fc_metric != rt->rt6i_metric)
-                            rtmsg->rtmsg_metric != rt->rt6i_metric)
                                continue;
                        dst_hold(&rt->u.dst);
-                        read_unlock_bh(&rt6_lock);
+                        read_unlock_bh(&table->tb6_lock);
-                        return ip6_del_rt(rt, nlh, _rtattr, req);
+                        return __ip6_del_rt(rt, &cfg->fc_nlinfo);
                }
        }
-        read_unlock_bh(&rt6_lock);
+        read_unlock_bh(&table->tb6_lock);
        return err;
 }
@@ -1150,11 +1282,17 @@ static int ip6_route_del(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, void *_r
 /*
 *      Handle redirects
 */
-void rt6_redirect(struct in6_addr *dest, struct in6_addr *saddr,
+struct ip6rd_flowi {
-                  struct neighbour *neigh, u8 *lladdr, int on_link)
+        struct flowi fl;
+        struct in6_addr gateway;
+};
+static struct rt6_info *__ip6_route_redirect(struct fib6_table *table,
+                                             struct flowi *fl,
+                                             int flags)
 {
-        struct rt6_info *rt, *nrt = NULL;
+        struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl;
-        int strict;
+        struct rt6_info *rt;
        struct fib6_node *fn;
        /*
@@ -1167,10 +1305,9 @@ void rt6_redirect(struct in6_addr *dest, struct in6_addr *saddr,
         * is a bit fuzzy and one might need to check all possible
         * routes.
         */
-        strict = ipv6_addr_type(dest) & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL);
-        read_lock_bh(&rt6_lock);
+        read_lock_bh(&table->tb6_lock);
-        fn = fib6_lookup(&ip6_routing_table, dest, NULL);
+        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 restart:
        for (rt = fn->leaf; rt; rt = rt->u.next) {
                /*
@@ -1185,29 +1322,60 @@ restart:
                        continue;
                if (!(rt->rt6i_flags & RTF_GATEWAY))
                        continue;
-                if (neigh->dev != rt->rt6i_dev)
+                if (fl->oif != rt->rt6i_dev->ifindex)
                        continue;
-                if (!ipv6_addr_equal(saddr, &rt->rt6i_gateway))
+                if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway))
                        continue;
                break;
        }
-        if (rt)
-                dst_hold(&rt->u.dst);
-        else if (strict) {
-                while ((fn = fn->parent) != NULL) {
-                        if (fn->fn_flags & RTN_ROOT)
-                                break;
-                        if (fn->fn_flags & RTN_RTINFO)
-                                goto restart;
-                }
-        }
-        read_unlock_bh(&rt6_lock);
-        if (!rt) {
+        if (!rt)
+                rt = &ip6_null_entry;
+        BACKTRACK(&fl->fl6_src);
+out:
+        dst_hold(&rt->u.dst);
+        read_unlock_bh(&table->tb6_lock);
+        return rt;
+};
+static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
+                                           struct in6_addr *src,
+                                           struct in6_addr *gateway,
+                                           struct net_device *dev)
+{
+        struct ip6rd_flowi rdfl = {
+                .fl = {
+                        .oif = dev->ifindex,
+                        .nl_u = {
+                                .ip6_u = {
+                                        .daddr = *dest,
+                                        .saddr = *src,
+                                },
+                        },
+                },
+                .gateway = *gateway,
+        };
+        int flags = rt6_need_strict(dest) ? RT6_LOOKUP_F_IFACE : 0;
+        return (struct rt6_info *)fib6_rule_lookup((struct flowi *)&rdfl, flags, __ip6_route_redirect);
+}
+void rt6_redirect(struct in6_addr *dest, struct in6_addr *src,
+                  struct in6_addr *saddr,
+                  struct neighbour *neigh, u8 *lladdr, int on_link)
+{
+        struct rt6_info *rt, *nrt = NULL;
+        struct netevent_redirect netevent;
+        rt = ip6_route_redirect(dest, src, saddr, neigh->dev);
+        if (rt == &ip6_null_entry) {
                if (net_ratelimit())
                        printk(KERN_DEBUG "rt6_redirect: source isn't a valid nexthop "
                               "for redirect target\n");
-                return;
+                goto out;
        }
        /*
@@ -1250,11 +1418,15 @@ restart:
        nrt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(neigh->dev);
        nrt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(dst_mtu(&nrt->u.dst));
-        if (ip6_ins_rt(nrt, NULL, NULL, NULL))
+        if (ip6_ins_rt(nrt))
                goto out;
+        netevent.old = &rt->u.dst;
+        netevent.new = &nrt->u.dst;
+        call_netevent_notifiers(NETEVENT_REDIRECT, &netevent);
        if (rt->rt6i_flags&RTF_CACHE) {
-                ip6_del_rt(rt, NULL, NULL, NULL);
+                ip6_del_rt(rt);
                return;
        }
@@ -1336,7 +1508,7 @@ void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
                dst_set_expires(&nrt->u.dst, ip6_rt_mtu_expires);
                nrt->rt6i_flags |= RTF_DYNAMIC|RTF_EXPIRES;
-                ip6_ins_rt(nrt, NULL, NULL, NULL);
+                ip6_ins_rt(nrt);
        }
 out:
        dst_release(&rt->u.dst);
@@ -1372,6 +1544,7 @@ static struct rt6_info * ip6_rt_copy(struct rt6_info *ort)
 #ifdef CONFIG_IPV6_SUBTREES
                memcpy(&rt->rt6i_src, &ort->rt6i_src, sizeof(struct rt6key));
 #endif
+                rt->rt6i_table = ort->rt6i_table;
        }
        return rt;
 }
@@ -1382,9 +1555,14 @@ static struct rt6_info *rt6_get_route_info(struct in6_addr *prefix, int prefixle
 {
        struct fib6_node *fn;
        struct rt6_info *rt = NULL;
+        struct fib6_table *table;
-        write_lock_bh(&rt6_lock);
+        table = fib6_get_table(RT6_TABLE_INFO);
-        fn = fib6_locate(&ip6_routing_table, prefix ,prefixlen, NULL, 0);
+        if (table == NULL)
+                return NULL;
+        write_lock_bh(&table->tb6_lock);
+        fn = fib6_locate(&table->tb6_root, prefix ,prefixlen, NULL, 0);
        if (!fn)
                goto out;
@@ -1399,7 +1577,7 @@ static struct rt6_info *rt6_get_route_info(struct in6_addr *prefix, int prefixle
                break;
        }
 out:
-        write_unlock_bh(&rt6_lock);
+        write_unlock_bh(&table->tb6_lock);
        return rt;
 }
@@ -1407,21 +1585,23 @@ static struct rt6_info *rt6_add_route_info(struct in6_addr *prefix, int prefixle
                                           struct in6_addr *gwaddr, int ifindex,
                                           unsigned pref)
 {
-        struct in6_rtmsg rtmsg;
+        struct fib6_config cfg = {
+                .fc_table       = RT6_TABLE_INFO,
+                .fc_metric      = 1024,
+                .fc_ifindex     = ifindex,
+                .fc_dst_len     = prefixlen,
+                .fc_flags       = RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO |
+                                  RTF_UP | RTF_PREF(pref),
+        };
+        ipv6_addr_copy(&cfg.fc_dst, prefix);
+        ipv6_addr_copy(&cfg.fc_gateway, gwaddr);
-        memset(&rtmsg, 0, sizeof(rtmsg));
-        rtmsg.rtmsg_type = RTMSG_NEWROUTE;
-        ipv6_addr_copy(&rtmsg.rtmsg_dst, prefix);
-        rtmsg.rtmsg_dst_len = prefixlen;
-        ipv6_addr_copy(&rtmsg.rtmsg_gateway, gwaddr);
-        rtmsg.rtmsg_metric = 1024;
-        rtmsg.rtmsg_flags = RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO | RTF_UP | RTF_PREF(pref);
        /* We should treat it as a default route if prefix length is 0. */
        if (!prefixlen)
-                rtmsg.rtmsg_flags |= RTF_DEFAULT;
+                cfg.fc_flags |= RTF_DEFAULT;
-        rtmsg.rtmsg_ifindex = ifindex;
-        ip6_route_add(&rtmsg, NULL, NULL, NULL);
+        ip6_route_add(&cfg);
        return rt6_get_route_info(prefix, prefixlen, gwaddr, ifindex);
 }
@@ -1430,12 +1610,14 @@ static struct rt6_info *rt6_add_route_info(struct in6_addr *prefix, int prefixle
 struct rt6_info *rt6_get_dflt_router(struct in6_addr *addr, struct net_device *dev)
 {       
        struct rt6_info *rt;
-        struct fib6_node *fn;
+        struct fib6_table *table;
-        fn = &ip6_routing_table;
+        table = fib6_get_table(RT6_TABLE_DFLT);
+        if (table == NULL)
+                return NULL;
-        write_lock_bh(&rt6_lock);
+        write_lock_bh(&table->tb6_lock);
-        for (rt = fn->leaf; rt; rt=rt->u.next) {
+        for (rt = table->tb6_root.leaf; rt; rt=rt->u.next) {
                if (dev == rt->rt6i_dev &&
                    ((rt->rt6i_flags & (RTF_ADDRCONF | RTF_DEFAULT)) == (RTF_ADDRCONF | RTF_DEFAULT)) &&
                    ipv6_addr_equal(&rt->rt6i_gateway, addr))
@@ -1443,7 +1625,7 @@ struct rt6_info *rt6_get_dflt_router(struct in6_addr *addr, struct net_device *d
        }
        if (rt)
                dst_hold(&rt->u.dst);
-        write_unlock_bh(&rt6_lock);
+        write_unlock_bh(&table->tb6_lock);
        return rt;
 }
@@ -1451,43 +1633,65 @@ struct rt6_info *rt6_add_dflt_router(struct in6_addr *gwaddr,
                                     struct net_device *dev,
                                     unsigned int pref)
 {
-        struct in6_rtmsg rtmsg;
+        struct fib6_config cfg = {
+                .fc_table       = RT6_TABLE_DFLT,
+                .fc_metric      = 1024,
+                .fc_ifindex     = dev->ifindex,
+                .fc_flags       = RTF_GATEWAY | RTF_ADDRCONF | RTF_DEFAULT |
+                                  RTF_UP | RTF_EXPIRES | RTF_PREF(pref),
+        };
-        memset(&rtmsg, 0, sizeof(struct in6_rtmsg));
+        ipv6_addr_copy(&cfg.fc_gateway, gwaddr);
-        rtmsg.rtmsg_type = RTMSG_NEWROUTE;
-        ipv6_addr_copy(&rtmsg.rtmsg_gateway, gwaddr);
-        rtmsg.rtmsg_metric = 1024;
-        rtmsg.rtmsg_flags = RTF_GATEWAY | RTF_ADDRCONF | RTF_DEFAULT | RTF_UP | RTF_EXPIRES |
-                            RTF_PREF(pref);
-        rtmsg.rtmsg_ifindex = dev->ifindex;
+        ip6_route_add(&cfg);
-        ip6_route_add(&rtmsg, NULL, NULL, NULL);
        return rt6_get_dflt_router(gwaddr, dev);
 }
 void rt6_purge_dflt_routers(void)
 {
        struct rt6_info *rt;
+        struct fib6_table *table;
+        /* NOTE: Keep consistent with rt6_get_dflt_router */
+        table = fib6_get_table(RT6_TABLE_DFLT);
+        if (table == NULL)
+                return;
 restart:
-        read_lock_bh(&rt6_lock);
+        read_lock_bh(&table->tb6_lock);
-        for (rt = ip6_routing_table.leaf; rt; rt = rt->u.next) {
+        for (rt = table->tb6_root.leaf; rt; rt = rt->u.next) {
                if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) {
                        dst_hold(&rt->u.dst);
+                        read_unlock_bh(&table->tb6_lock);
-                        read_unlock_bh(&rt6_lock);
+                        ip6_del_rt(rt);
-                        ip6_del_rt(rt, NULL, NULL, NULL);
                        goto restart;
                }
        }
-        read_unlock_bh(&rt6_lock);
+        read_unlock_bh(&table->tb6_lock);
+}
+static void rtmsg_to_fib6_config(struct in6_rtmsg *rtmsg,
+                                 struct fib6_config *cfg)
+{
+        memset(cfg, 0, sizeof(*cfg));
+        cfg->fc_table = RT6_TABLE_MAIN;
+        cfg->fc_ifindex = rtmsg->rtmsg_ifindex;
+        cfg->fc_metric = rtmsg->rtmsg_metric;
+        cfg->fc_expires = rtmsg->rtmsg_info;
+        cfg->fc_dst_len = rtmsg->rtmsg_dst_len;
+        cfg->fc_src_len = rtmsg->rtmsg_src_len;
+        cfg->fc_flags = rtmsg->rtmsg_flags;
+        ipv6_addr_copy(&cfg->fc_dst, &rtmsg->rtmsg_dst);
+        ipv6_addr_copy(&cfg->fc_src, &rtmsg->rtmsg_src);
+        ipv6_addr_copy(&cfg->fc_gateway, &rtmsg->rtmsg_gateway);
 }
 int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
 {
+        struct fib6_config cfg;
        struct in6_rtmsg rtmsg;
        int err;
@@ -1500,14 +1704,16 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
                                     sizeof(struct in6_rtmsg));
                if (err)
                        return -EFAULT;
-                        
+                rtmsg_to_fib6_config(&rtmsg, &cfg);
                rtnl_lock();
                switch (cmd) {
                case SIOCADDRT:
-                        err = ip6_route_add(&rtmsg, NULL, NULL, NULL);
+                        err = ip6_route_add(&cfg);
                        break;
                case SIOCDELRT:
-                        err = ip6_route_del(&rtmsg, NULL, NULL, NULL);
+                        err = ip6_route_del(&cfg);
                        break;
                default:
                        err = -EINVAL;
@@ -1526,6 +1732,10 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
 static int ip6_pkt_discard(struct sk_buff *skb)
 {
+        int type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
+        if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED)
+                IP6_INC_STATS(IPSTATS_MIB_INADDRERRORS);
        IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_NOROUTE, 0, skb->dev);
        kfree_skb(skb);
@@ -1577,6 +1787,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
        ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
        rt->rt6i_dst.plen = 128;
+        rt->rt6i_table = fib6_get_table(RT6_TABLE_LOCAL);
        atomic_set(&rt->u.dst.__refcnt, 1);
@@ -1595,9 +1806,7 @@ static int fib6_ifdown(struct rt6_info *rt, void *arg)
 void rt6_ifdown(struct net_device *dev)
 {
-        write_lock_bh(&rt6_lock);
+        fib6_clean_all(fib6_ifdown, 0, dev);
-        fib6_clean_tree(&ip6_routing_table, fib6_ifdown, 0, dev);
-        write_unlock_bh(&rt6_lock);
 }
 struct rt6_mtu_change_arg
@@ -1647,80 +1856,114 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
 void rt6_mtu_change(struct net_device *dev, unsigned mtu)
 {
-        struct rt6_mtu_change_arg arg;
+        struct rt6_mtu_change_arg arg = {
+                .dev = dev,
+                .mtu = mtu,
+        };
-        arg.dev = dev;
+        fib6_clean_all(rt6_mtu_change_route, 0, &arg);
-        arg.mtu = mtu;
-        read_lock_bh(&rt6_lock);
-        fib6_clean_tree(&ip6_routing_table, rt6_mtu_change_route, 0, &arg);
-        read_unlock_bh(&rt6_lock);
 }
-static int inet6_rtm_to_rtmsg(struct rtmsg *r, struct rtattr **rta,
+static struct nla_policy rtm_ipv6_policy[RTA_MAX+1] __read_mostly = {
-                              struct in6_rtmsg *rtmsg)
+        [RTA_GATEWAY]           = { .len = sizeof(struct in6_addr) },
+        [RTA_OIF]               = { .type = NLA_U32 },
+        [RTA_IIF]               = { .type = NLA_U32 },
+        [RTA_PRIORITY]          = { .type = NLA_U32 },
+        [RTA_METRICS]           = { .type = NLA_NESTED },
+};
+static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
+                              struct fib6_config *cfg)
 {
-        memset(rtmsg, 0, sizeof(*rtmsg));
+        struct rtmsg *rtm;
+        struct nlattr *tb[RTA_MAX+1];
+        int err;
-        rtmsg->rtmsg_dst_len = r->rtm_dst_len;
+        err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
-        rtmsg->rtmsg_src_len = r->rtm_src_len;
+        if (err < 0)
-        rtmsg->rtmsg_flags = RTF_UP;
+                goto errout;
-        if (r->rtm_type == RTN_UNREACHABLE)
-                rtmsg->rtmsg_flags |= RTF_REJECT;
-        if (rta[RTA_GATEWAY-1]) {
+        err = -EINVAL;
-                if (rta[RTA_GATEWAY-1]->rta_len != RTA_LENGTH(16))
+        rtm = nlmsg_data(nlh);
-                        return -EINVAL;
+        memset(cfg, 0, sizeof(*cfg));
-                memcpy(&rtmsg->rtmsg_gateway, RTA_DATA(rta[RTA_GATEWAY-1]), 16);
-                rtmsg->rtmsg_flags |= RTF_GATEWAY;
+        cfg->fc_table = rtm->rtm_table;
-        }
+        cfg->fc_dst_len = rtm->rtm_dst_len;
-        if (rta[RTA_DST-1]) {
+        cfg->fc_src_len = rtm->rtm_src_len;
-                if (RTA_PAYLOAD(rta[RTA_DST-1]) < ((r->rtm_dst_len+7)>>3))
+        cfg->fc_flags = RTF_UP;
-                        return -EINVAL;
+        cfg->fc_protocol = rtm->rtm_protocol;
-                memcpy(&rtmsg->rtmsg_dst, RTA_DATA(rta[RTA_DST-1]), ((r->rtm_dst_len+7)>>3));
+        if (rtm->rtm_type == RTN_UNREACHABLE)
+                cfg->fc_flags |= RTF_REJECT;
+        cfg->fc_nlinfo.pid = NETLINK_CB(skb).pid;
+        cfg->fc_nlinfo.nlh = nlh;
+        if (tb[RTA_GATEWAY]) {
+                nla_memcpy(&cfg->fc_gateway, tb[RTA_GATEWAY], 16);
+                cfg->fc_flags |= RTF_GATEWAY;
        }
-        if (rta[RTA_SRC-1]) {
-                if (RTA_PAYLOAD(rta[RTA_SRC-1]) < ((r->rtm_src_len+7)>>3))
+        if (tb[RTA_DST]) {
-                        return -EINVAL;
+                int plen = (rtm->rtm_dst_len + 7) >> 3;
-                memcpy(&rtmsg->rtmsg_src, RTA_DATA(rta[RTA_SRC-1]), ((r->rtm_src_len+7)>>3));
+                if (nla_len(tb[RTA_DST]) < plen)
+                        goto errout;
+                nla_memcpy(&cfg->fc_dst, tb[RTA_DST], plen);
        }
-        if (rta[RTA_OIF-1]) {
-                if (rta[RTA_OIF-1]->rta_len != RTA_LENGTH(sizeof(int)))
+        if (tb[RTA_SRC]) {
-                        return -EINVAL;
+                int plen = (rtm->rtm_src_len + 7) >> 3;
-                memcpy(&rtmsg->rtmsg_ifindex, RTA_DATA(rta[RTA_OIF-1]), sizeof(int));
+                if (nla_len(tb[RTA_SRC]) < plen)
+                        goto errout;
+                nla_memcpy(&cfg->fc_src, tb[RTA_SRC], plen);
        }
-        if (rta[RTA_PRIORITY-1]) {
-                if (rta[RTA_PRIORITY-1]->rta_len != RTA_LENGTH(4))
+        if (tb[RTA_OIF])
-                        return -EINVAL;
+                cfg->fc_ifindex = nla_get_u32(tb[RTA_OIF]);
-                memcpy(&rtmsg->rtmsg_metric, RTA_DATA(rta[RTA_PRIORITY-1]), 4);
+        if (tb[RTA_PRIORITY])
+                cfg->fc_metric = nla_get_u32(tb[RTA_PRIORITY]);
+        if (tb[RTA_METRICS]) {
+                cfg->fc_mx = nla_data(tb[RTA_METRICS]);
+                cfg->fc_mx_len = nla_len(tb[RTA_METRICS]);
        }
-        return 0;
+        if (tb[RTA_TABLE])
+                cfg->fc_table = nla_get_u32(tb[RTA_TABLE]);
+        err = 0;
+errout:
+        return err;
 }
 int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
-        struct rtmsg *r = NLMSG_DATA(nlh);
+        struct fib6_config cfg;
-        struct in6_rtmsg rtmsg;
+        int err;
-        if (inet6_rtm_to_rtmsg(r, arg, &rtmsg))
+        err = rtm_to_fib6_config(skb, nlh, &cfg);
-                return -EINVAL;
+        if (err < 0)
-        return ip6_route_del(&rtmsg, nlh, arg, &NETLINK_CB(skb));
+                return err;
+        return ip6_route_del(&cfg);
 }
 int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
-        struct rtmsg *r = NLMSG_DATA(nlh);
+        struct fib6_config cfg;
-        struct in6_rtmsg rtmsg;
+        int err;
-        if (inet6_rtm_to_rtmsg(r, arg, &rtmsg))
+        err = rtm_to_fib6_config(skb, nlh, &cfg);
-                return -EINVAL;
+        if (err < 0)
-        return ip6_route_add(&rtmsg, nlh, arg, &NETLINK_CB(skb));
+                return err;
-}
-struct rt6_rtnl_dump_arg
+        return ip6_route_add(&cfg);
-{
+}
-        struct sk_buff *skb;
-        struct netlink_callback *cb;
-};
 static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
                         struct in6_addr *dst, struct in6_addr *src,
@@ -1728,9 +1971,9 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
                         int prefix, unsigned int flags)
 {
        struct rtmsg *rtm;
-        struct nlmsghdr  *nlh;
+        struct nlmsghdr *nlh;
-        unsigned char    *b = skb->tail;
        struct rta_cacheinfo ci;
+        u32 table;
        if (prefix) {   /* user wants prefix routes only */
                if (!(rt->rt6i_flags & RTF_PREFIX_RT)) {
@@ -1739,13 +1982,21 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
                }
        }
-        nlh = NLMSG_NEW(skb, pid, seq, type, sizeof(*rtm), flags);
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*rtm), flags);
-        rtm = NLMSG_DATA(nlh);
+        if (nlh == NULL)
+                return -ENOBUFS;
+        rtm = nlmsg_data(nlh);
        rtm->rtm_family = AF_INET6;
        rtm->rtm_dst_len = rt->rt6i_dst.plen;
        rtm->rtm_src_len = rt->rt6i_src.plen;
        rtm->rtm_tos = 0;
-        rtm->rtm_table = RT_TABLE_MAIN;
+        if (rt->rt6i_table)
+                table = rt->rt6i_table->tb6_id;
+        else
+                table = RT6_TABLE_UNSPEC;
+        rtm->rtm_table = table;
+        NLA_PUT_U32(skb, RTA_TABLE, table);
        if (rt->rt6i_flags&RTF_REJECT)
                rtm->rtm_type = RTN_UNREACHABLE;
        else if (rt->rt6i_dev && (rt->rt6i_dev->flags&IFF_LOOPBACK))
@@ -1766,31 +2017,35 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
                rtm->rtm_flags |= RTM_F_CLONED;
        if (dst) {
-                RTA_PUT(skb, RTA_DST, 16, dst);
+                NLA_PUT(skb, RTA_DST, 16, dst);
                rtm->rtm_dst_len = 128;
        } else if (rtm->rtm_dst_len)
-                RTA_PUT(skb, RTA_DST, 16, &rt->rt6i_dst.addr);
+                NLA_PUT(skb, RTA_DST, 16, &rt->rt6i_dst.addr);
 #ifdef CONFIG_IPV6_SUBTREES
        if (src) {
-                RTA_PUT(skb, RTA_SRC, 16, src);
+                NLA_PUT(skb, RTA_SRC, 16, src);
                rtm->rtm_src_len = 128;
        } else if (rtm->rtm_src_len)
-                RTA_PUT(skb, RTA_SRC, 16, &rt->rt6i_src.addr);
+                NLA_PUT(skb, RTA_SRC, 16, &rt->rt6i_src.addr);
 #endif
        if (iif)
-                RTA_PUT(skb, RTA_IIF, 4, &iif);
+                NLA_PUT_U32(skb, RTA_IIF, iif);
        else if (dst) {
                struct in6_addr saddr_buf;
                if (ipv6_get_saddr(&rt->u.dst, dst, &saddr_buf) == 0)
-                        RTA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
+                        NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
        }
        if (rtnetlink_put_metrics(skb, rt->u.dst.metrics) < 0)
-                goto rtattr_failure;
+                goto nla_put_failure;
        if (rt->u.dst.neighbour)
-                RTA_PUT(skb, RTA_GATEWAY, 16, &rt->u.dst.neighbour->primary_key);
+                NLA_PUT(skb, RTA_GATEWAY, 16, &rt->u.dst.neighbour->primary_key);
        if (rt->u.dst.dev)
-                RTA_PUT(skb, RTA_OIF, sizeof(int), &rt->rt6i_dev->ifindex);
+                NLA_PUT_U32(skb, RTA_OIF, rt->rt6i_dev->ifindex);
-        RTA_PUT(skb, RTA_PRIORITY, 4, &rt->rt6i_metric);
+        NLA_PUT_U32(skb, RTA_PRIORITY, rt->rt6i_metric);
        ci.rta_lastuse = jiffies_to_clock_t(jiffies - rt->u.dst.lastuse);
        if (rt->rt6i_expires)
                ci.rta_expires = jiffies_to_clock_t(rt->rt6i_expires - jiffies);
@@ -1802,23 +2057,21 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
        ci.rta_id = 0;
        ci.rta_ts = 0;
        ci.rta_tsage = 0;
-        RTA_PUT(skb, RTA_CACHEINFO, sizeof(ci), &ci);
+        NLA_PUT(skb, RTA_CACHEINFO, sizeof(ci), &ci);
-        nlh->nlmsg_len = skb->tail - b;
-        return skb->len;
-nlmsg_failure:
+        return nlmsg_end(skb, nlh);
-rtattr_failure:
-        skb_trim(skb, b - skb->data);
+nla_put_failure:
-        return -1;
+        return nlmsg_cancel(skb, nlh);
 }
-static int rt6_dump_route(struct rt6_info *rt, void *p_arg)
+int rt6_dump_route(struct rt6_info *rt, void *p_arg)
 {
        struct rt6_rtnl_dump_arg *arg = (struct rt6_rtnl_dump_arg *) p_arg;
        int prefix;
-        if (arg->cb->nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(struct rtmsg))) {
+        if (nlmsg_len(arg->cb->nlh) >= sizeof(struct rtmsg)) {
-                struct rtmsg *rtm = NLMSG_DATA(arg->cb->nlh);
+                struct rtmsg *rtm = nlmsg_data(arg->cb->nlh);
                prefix = (rtm->rtm_flags & RTM_F_PREFIX) != 0;
        } else
                prefix = 0;
@@ -1828,189 +2081,108 @@ static int rt6_dump_route(struct rt6_info *rt, void *p_arg)
                     prefix, NLM_F_MULTI);
 }
-static int fib6_dump_node(struct fib6_walker_t *w)
+int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
 {
-        int res;
+        struct nlattr *tb[RTA_MAX+1];
        struct rt6_info *rt;
+        struct sk_buff *skb;
+        struct rtmsg *rtm;
+        struct flowi fl;
+        int err, iif = 0;
-        for (rt = w->leaf; rt; rt = rt->u.next) {
+        err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
-                res = rt6_dump_route(rt, w->args);
+        if (err < 0)
-                if (res < 0) {
+                goto errout;
-                        /* Frame is full, suspend walking */
-                        w->leaf = rt;
-                        return 1;
-                }
-                BUG_TRAP(res!=0);
-        }
-        w->leaf = NULL;
-        return 0;
-}
-static void fib6_dump_end(struct netlink_callback *cb)
-{
-        struct fib6_walker_t *w = (void*)cb->args[0];
-        if (w) {
-                cb->args[0] = 0;
-                fib6_walker_unlink(w);
-                kfree(w);
-        }
-        cb->done = (void*)cb->args[1];
-        cb->args[1] = 0;
-}
-static int fib6_dump_done(struct netlink_callback *cb)
-{
-        fib6_dump_end(cb);
-        return cb->done ? cb->done(cb) : 0;
-}
-int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
-{
-        struct rt6_rtnl_dump_arg arg;
-        struct fib6_walker_t *w;
-        int res;
-        arg.skb = skb;
+        err = -EINVAL;
-        arg.cb = cb;
+        memset(&fl, 0, sizeof(fl));
-        w = (void*)cb->args[0];
+        if (tb[RTA_SRC]) {
-        if (w == NULL) {
+                if (nla_len(tb[RTA_SRC]) < sizeof(struct in6_addr))
-                /* New dump:
+                        goto errout;
-                 * 
-                 * 1. hook callback destructor.
-                 */
-                cb->args[1] = (long)cb->done;
-                cb->done = fib6_dump_done;
-                /*
+                ipv6_addr_copy(&fl.fl6_src, nla_data(tb[RTA_SRC]));
-                 * 2. allocate and initialize walker.
-                 */
-                w = kzalloc(sizeof(*w), GFP_ATOMIC);
-                if (w == NULL)
-                        return -ENOMEM;
-                RT6_TRACE("dump<%p", w);
-                w->root = &ip6_routing_table;
-                w->func = fib6_dump_node;
-                w->args = &arg;
-                cb->args[0] = (long)w;
-                read_lock_bh(&rt6_lock);
-                res = fib6_walk(w);
-                read_unlock_bh(&rt6_lock);
-        } else {
-                w->args = &arg;
-                read_lock_bh(&rt6_lock);
-                res = fib6_walk_continue(w);
-                read_unlock_bh(&rt6_lock);
        }
-#if RT6_DEBUG >= 3
-        if (res <= 0 && skb->len == 0)
-                RT6_TRACE("%p>dump end\n", w);
-#endif
-        res = res < 0 ? res : skb->len;
-        /* res < 0 is an error. (really, impossible)
-           res == 0 means that dump is complete, but skb still can contain data.
-           res > 0 dump is not complete, but frame is full.
-         */
-        /* Destroy walker, if dump of this table is complete. */
-        if (res <= 0)
-                fib6_dump_end(cb);
-        return res;
-}
-int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
-{
-        struct rtattr **rta = arg;
-        int iif = 0;
-        int err = -ENOBUFS;
-        struct sk_buff *skb;
-        struct flowi fl;
-        struct rt6_info *rt;
-        skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
+        if (tb[RTA_DST]) {
-        if (skb == NULL)
+                if (nla_len(tb[RTA_DST]) < sizeof(struct in6_addr))
-                goto out;
+                        goto errout;
-        /* Reserve room for dummy headers, this skb can pass
+                ipv6_addr_copy(&fl.fl6_dst, nla_data(tb[RTA_DST]));
-           through good chunk of routing engine.
+        }
-         */
-        skb->mac.raw = skb->data;
-        skb_reserve(skb, MAX_HEADER + sizeof(struct ipv6hdr));
-        memset(&fl, 0, sizeof(fl));
+        if (tb[RTA_IIF])
-        if (rta[RTA_SRC-1])
+                iif = nla_get_u32(tb[RTA_IIF]);
-                ipv6_addr_copy(&fl.fl6_src,
-                               (struct in6_addr*)RTA_DATA(rta[RTA_SRC-1]));
-        if (rta[RTA_DST-1])
-                ipv6_addr_copy(&fl.fl6_dst,
-                               (struct in6_addr*)RTA_DATA(rta[RTA_DST-1]));
-        if (rta[RTA_IIF-1])
+        if (tb[RTA_OIF])
-                memcpy(&iif, RTA_DATA(rta[RTA_IIF-1]), sizeof(int));
+                fl.oif = nla_get_u32(tb[RTA_OIF]);
        if (iif) {
                struct net_device *dev;
                dev = __dev_get_by_index(iif);
                if (!dev) {
                        err = -ENODEV;
-                        goto out_free;
+                        goto errout;
                }
        }
-        fl.oif = 0;
+        skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
-        if (rta[RTA_OIF-1])
+        if (skb == NULL) {
-                memcpy(&fl.oif, RTA_DATA(rta[RTA_OIF-1]), sizeof(int));
+                err = -ENOBUFS;
+                goto errout;
+        }
-        rt = (struct rt6_info*)ip6_route_output(NULL, &fl);
+        /* Reserve room for dummy headers, this skb can pass
+           through good chunk of routing engine.
+         */
+        skb->mac.raw = skb->data;
+        skb_reserve(skb, MAX_HEADER + sizeof(struct ipv6hdr));
+        rt = (struct rt6_info*) ip6_route_output(NULL, &fl);
        skb->dst = &rt->u.dst;
-        NETLINK_CB(skb).dst_pid = NETLINK_CB(in_skb).pid;
+        err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
-        err = rt6_fill_node(skb, rt, 
-                            &fl.fl6_dst, &fl.fl6_src,
-                            iif,
                            RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
                            nlh->nlmsg_seq, 0, 0);
        if (err < 0) {
-                err = -EMSGSIZE;
+                kfree_skb(skb);
-                goto out_free;
+                goto errout;
        }
-        err = netlink_unicast(rtnl, skb, NETLINK_CB(in_skb).pid, MSG_DONTWAIT);
+        err = rtnl_unicast(skb, NETLINK_CB(in_skb).pid);
-        if (err > 0)
+errout:
-                err = 0;
-out:
        return err;
-out_free:
-        kfree_skb(skb);
-        goto out;       
 }
-void inet6_rt_notify(int event, struct rt6_info *rt, struct nlmsghdr *nlh, 
+void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
-                        struct netlink_skb_parms *req)
 {
        struct sk_buff *skb;
-        int size = NLMSG_SPACE(sizeof(struct rtmsg)+256);
+        u32 pid = 0, seq = 0;
-        u32 pid = current->pid;
+        struct nlmsghdr *nlh = NULL;
-        u32 seq = 0;
+        int payload = sizeof(struct rtmsg) + 256;
+        int err = -ENOBUFS;
-        if (req)
-                pid = req->pid;
+        if (info) {
-        if (nlh)
+                pid = info->pid;
-                seq = nlh->nlmsg_seq;
+                nlh = info->nlh;
-        
+                if (nlh)
-        skb = alloc_skb(size, gfp_any());
+                        seq = nlh->nlmsg_seq;
-        if (!skb) {
-                netlink_set_err(rtnl, 0, RTNLGRP_IPV6_ROUTE, ENOBUFS);
-                return;
        }
-        if (rt6_fill_node(skb, rt, NULL, NULL, 0, event, pid, seq, 0, 0) < 0) {
+        skb = nlmsg_new(nlmsg_total_size(payload), gfp_any());
+        if (skb == NULL)
+                goto errout;
+        err = rt6_fill_node(skb, rt, NULL, NULL, 0, event, pid, seq, 0, 0);
+        if (err < 0) {
                kfree_skb(skb);
-                netlink_set_err(rtnl, 0, RTNLGRP_IPV6_ROUTE, EINVAL);
+                goto errout;
-                return;
        }
-        NETLINK_CB(skb).dst_group = RTNLGRP_IPV6_ROUTE;
-        netlink_broadcast(rtnl, skb, 0, RTNLGRP_IPV6_ROUTE, gfp_any());
+        err = rtnl_notify(skb, pid, RTNLGRP_IPV6_ROUTE, nlh, gfp_any());
+errout:
+        if (err < 0)
+                rtnl_set_sk_err(RTNLGRP_IPV6_ROUTE, err);
 }
 /*
@@ -2086,16 +2258,13 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 static int rt6_proc_info(char *buffer, char **start, off_t offset, int length)
 {
-        struct rt6_proc_arg arg;
+        struct rt6_proc_arg arg = {
-        arg.buffer = buffer;
+                .buffer = buffer,
-        arg.offset = offset;
+                .offset = offset,
-        arg.length = length;
+                .length = length,
-        arg.skip = 0;
+        };
-        arg.len = 0;
-        read_lock_bh(&rt6_lock);
+        fib6_clean_all(rt6_info_route, 0, &arg);
-        fib6_clean_tree(&ip6_routing_table, rt6_info_route, 0, &arg);
-        read_unlock_bh(&rt6_lock);
        *start = buffer;
        if (offset)
@@ -2250,13 +2419,9 @@ void __init ip6_route_init(void)
 {
        struct proc_dir_entry *p;
-        ip6_dst_ops.kmem_cachep = kmem_cache_create("ip6_dst_cache",
+        ip6_dst_ops.kmem_cachep =
-                                                     sizeof(struct rt6_info),
+                kmem_cache_create("ip6_dst_cache", sizeof(struct rt6_info), 0,
-                                                     0, SLAB_HWCACHE_ALIGN,
+                                  SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
-                                                     NULL, NULL);
-        if (!ip6_dst_ops.kmem_cachep)
-                panic("cannot create ip6_dst_cache");
        fib6_init();
 #ifdef  CONFIG_PROC_FS
        p = proc_net_create("ipv6_route", 0, rt6_proc_info);
@@ -2268,10 +2433,16 @@ void __init ip6_route_init(void)
 #ifdef CONFIG_XFRM
        xfrm6_init();
 #endif
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+        fib6_rules_init();
+#endif
 }
 void ip6_route_cleanup(void)
 {
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+        fib6_rules_cleanup();
+#endif
 #ifdef CONFIG_PROC_FS
        proc_net_remove("ipv6_route");
        proc_net_remove("rt6_stats");
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 6578c3080f47..836eecd7e62b 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -18,7 +18,6 @@
 * Nate Thompson <nate@thebog.net>:             6to4 support
 */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/capability.h>
 #include <linux/errno.h>
@@ -381,7 +380,6 @@ static int ipip6_rcv(struct sk_buff *skb)
                secpath_reset(skb);
                skb->mac.raw = skb->nh.raw;
                skb->nh.raw = skb->data;
-                memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
                IPCB(skb)->flags = 0;
                skb->protocol = htons(ETH_P_IPV6);
                skb->pkt_type = PACKET_HOST;
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 8eff9fa1e983..7a4639db1346 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -7,7 +7,6 @@
 #include <linux/mm.h>
 #include <linux/sysctl.h>
-#include <linux/config.h>
 #include <linux/in6.h>
 #include <linux/ipv6.h>
 #include <net/ndisc.h>
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index a50eb306e9e2..3b6575478fcc 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -26,7 +26,6 @@
 */
 #include <linux/module.h>
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -252,6 +251,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                final_p = &final;
        }
+        security_sk_classify_flow(sk, &fl);
        err = ip6_dst_lookup(sk, &dst, &fl);
        if (err)
                goto failure;
@@ -270,9 +271,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        ipv6_addr_copy(&np->saddr, saddr);
        inet->rcv_saddr = LOOPBACK4_IPV6;
-        ip6_dst_store(sk, dst, NULL);
+        sk->sk_gso_type = SKB_GSO_TCPV6;
-        sk->sk_route_caps = dst->dev->features &
+        __ip6_dst_store(sk, dst, NULL, NULL);
-                ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
        icsk->icsk_ext_hdr_len = 0;
        if (np->opt)
@@ -376,6 +376,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                        fl.oif = sk->sk_bound_dev_if;
                        fl.fl_ip_dport = inet->dport;
                        fl.fl_ip_sport = inet->sport;
+                        security_skb_classify_flow(skb, &fl);
                        if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
                                sk->sk_err_soft = -err;
@@ -429,7 +430,6 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        case TCP_SYN_RECV:  /* Cannot happen.
                               It can, it SYNs are crossed. --ANK */ 
                if (!sock_owned_by_user(sk)) {
-                        TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
                        sk->sk_err = err;
                        sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
@@ -470,6 +470,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
        fl.oif = treq->iif;
        fl.fl_ip_dport = inet_rsk(req)->rmt_port;
        fl.fl_ip_sport = inet_sk(sk)->sport;
+        security_req_classify_flow(req, &fl);
        if (dst == NULL) {
                opt = np->opt;
@@ -544,7 +545,7 @@ static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct tcphdr *th = skb->h.th;
-        if (skb->ip_summed == CHECKSUM_HW) {
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
                th->check = ~csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,  0);
                skb->csum = offsetof(struct tcphdr, check);
        } else {
@@ -554,6 +555,24 @@ static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
        }
 }
+static int tcp_v6_gso_send_check(struct sk_buff *skb)
+{
+        struct ipv6hdr *ipv6h;
+        struct tcphdr *th;
+        if (!pskb_may_pull(skb, sizeof(*th)))
+                return -EINVAL;
+        ipv6h = skb->nh.ipv6h;
+        th = skb->h.th;
+        th->check = 0;
+        th->check = ~csum_ipv6_magic(&ipv6h->saddr, &ipv6h->daddr, skb->len,
+                                     IPPROTO_TCP, 0);
+        skb->csum = offsetof(struct tcphdr, check);
+        skb->ip_summed = CHECKSUM_PARTIAL;
+        return 0;
+}
 static void tcp_v6_send_reset(struct sk_buff *skb)
 {
@@ -610,6 +629,7 @@ static void tcp_v6_send_reset(struct sk_buff *skb)
        fl.oif = inet6_iif(skb);
        fl.fl_ip_dport = t1->dest;
        fl.fl_ip_sport = t1->source;
+        security_skb_classify_flow(skb, &fl);
        /* sk = NULL, but it is safe for now. RST socket required. */
        if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
@@ -676,6 +696,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
        fl.oif = inet6_iif(skb);
        fl.fl_ip_dport = t1->dest;
        fl.fl_ip_sport = t1->source;
+        security_skb_classify_flow(skb, &fl);
        if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
                if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
@@ -805,6 +826,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        tcp_rsk(req)->snt_isn = isn;
+        security_inet_conn_request(sk, skb, req);
        if (tcp_v6_send_synack(sk, req, NULL))
                goto drop;
@@ -815,7 +838,6 @@ drop:
        if (req)
                reqsk_free(req);
-        TCP_INC_STATS_BH(TCP_MIB_ATTEMPTFAILS);
        return 0; /* don't send reset */
 }
@@ -909,6 +931,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                fl.oif = sk->sk_bound_dev_if;
                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                fl.fl_ip_sport = inet_sk(sk)->sport;
+                security_req_classify_flow(req, &fl);
                if (ip6_dst_lookup(sk, &dst, &fl))
                        goto out;
@@ -930,9 +953,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         * comment in that function for the gory details. -acme
         */
-        ip6_dst_store(newsk, dst, NULL);
+        newsk->sk_gso_type = SKB_GSO_TCPV6;
-        newsk->sk_route_caps = dst->dev->features &
+        __ip6_dst_store(newsk, dst, NULL, NULL);
-                ~(NETIF_F_IP_CSUM | NETIF_F_TSO);
        newtcp6sk = (struct tcp6_sock *)newsk;
        inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
@@ -1011,7 +1033,7 @@ out:
 static int tcp_v6_checksum_init(struct sk_buff *skb)
 {
-        if (skb->ip_summed == CHECKSUM_HW) {
+        if (skb->ip_summed == CHECKSUM_COMPLETE) {
                if (!tcp_v6_check(skb->h.th,skb->len,&skb->nh.ipv6h->saddr,
                                  &skb->nh.ipv6h->daddr,skb->csum)) {
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1053,7 +1075,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
        if (skb->protocol == htons(ETH_P_IP))
                return tcp_v4_do_rcv(sk, skb);
-        if (sk_filter(sk, skb, 0))
+        if (sk_filter(sk, skb))
                goto discard;
        /*
@@ -1210,12 +1232,12 @@ process:
        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                goto discard_and_relse;
-        if (sk_filter(sk, skb, 0))
+        if (sk_filter(sk, skb))
                goto discard_and_relse;
        skb->dev = NULL;
-        bh_lock_sock(sk);
+        bh_lock_sock_nested(sk);
        ret = 0;
        if (!sock_owned_by_user(sk)) {
 #ifdef CONFIG_NET_DMA
@@ -1469,7 +1491,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                   dest->s6_addr32[0], dest->s6_addr32[1],
                   dest->s6_addr32[2], dest->s6_addr32[3], destp,
                   sp->sk_state, 
-                   tp->write_seq-tp->snd_una, tp->rcv_nxt-tp->copied_seq,
+                   tp->write_seq-tp->snd_una,
+                   (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
                   timer_active,
                   jiffies_to_clock_t(timer_expires - jiffies),
                   icsk->icsk_retransmits,
@@ -1605,6 +1628,8 @@ struct proto tcpv6_prot = {
 static struct inet6_protocol tcpv6_protocol = {
        .handler        =       tcp_v6_rcv,
        .err_handler    =       tcp_v6_err,
+        .gso_send_check =       tcp_v6_gso_send_check,
+        .gso_segment    =       tcp_tso_segment,
        .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 8d3432a70f3a..9662561701d1 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -23,7 +23,6 @@
 *      2 of the License, or (at your option) any later version.
 */
-#include <linux/config.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
@@ -62,81 +61,9 @@
 DEFINE_SNMP_STAT(struct udp_mib, udp_stats_in6) __read_mostly;
-/* Grrr, addr_type already calculated by caller, but I don't want
+static inline int udp_v6_get_port(struct sock *sk, unsigned short snum)
- * to add some silly "cookie" argument to this method just for that.
- */
-static int udp_v6_get_port(struct sock *sk, unsigned short snum)
 {
-        struct sock *sk2;
+        return udp_get_port(sk, snum, ipv6_rcv_saddr_equal);
-        struct hlist_node *node;
-        write_lock_bh(&udp_hash_lock);
-        if (snum == 0) {
-                int best_size_so_far, best, result, i;
-                if (udp_port_rover > sysctl_local_port_range[1] ||
-                    udp_port_rover < sysctl_local_port_range[0])
-                        udp_port_rover = sysctl_local_port_range[0];
-                best_size_so_far = 32767;
-                best = result = udp_port_rover;
-                for (i = 0; i < UDP_HTABLE_SIZE; i++, result++) {
-                        int size;
-                        struct hlist_head *list;
-                        list = &udp_hash[result & (UDP_HTABLE_SIZE - 1)];
-                        if (hlist_empty(list)) {
-                                if (result > sysctl_local_port_range[1])
-                                        result = sysctl_local_port_range[0] +
-                                                ((result - sysctl_local_port_range[0]) &
-                                                 (UDP_HTABLE_SIZE - 1));
-                                goto gotit;
-                        }
-                        size = 0;
-                        sk_for_each(sk2, node, list)
-                                if (++size >= best_size_so_far)
-                                        goto next;
-                        best_size_so_far = size;
-                        best = result;
-                next:;
-                }
-                result = best;
-                for(i = 0; i < (1 << 16) / UDP_HTABLE_SIZE; i++, result += UDP_HTABLE_SIZE) {
-                        if (result > sysctl_local_port_range[1])
-                                result = sysctl_local_port_range[0]
-                                        + ((result - sysctl_local_port_range[0]) &
-                                           (UDP_HTABLE_SIZE - 1));
-                        if (!udp_lport_inuse(result))
-                                break;
-                }
-                if (i >= (1 << 16) / UDP_HTABLE_SIZE)
-                        goto fail;
-gotit:
-                udp_port_rover = snum = result;
-        } else {
-                sk_for_each(sk2, node,
-                            &udp_hash[snum & (UDP_HTABLE_SIZE - 1)]) {
-                        if (inet_sk(sk2)->num == snum &&
-                            sk2 != sk &&
-                            (!sk2->sk_bound_dev_if ||
-                             !sk->sk_bound_dev_if ||
-                             sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
-                            (!sk2->sk_reuse || !sk->sk_reuse) &&
-                            ipv6_rcv_saddr_equal(sk, sk2))
-                                goto fail;
-                }
-        }
-        inet_sk(sk)->num = snum;
-        if (sk_unhashed(sk)) {
-                sk_add_node(sk, &udp_hash[snum & (UDP_HTABLE_SIZE - 1)]);
-                sock_prot_inc_use(sk->sk_prot);
-        }
-        write_unlock_bh(&udp_hash_lock);
-        return 0;
-fail:
-        write_unlock_bh(&udp_hash_lock);
-        return 1;
 }
 static void udp_v6_hash(struct sock *sk)
@@ -346,6 +273,8 @@ out:
 static inline int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
 {
+        int rc;
        if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
                kfree_skb(skb);
                return -1;
@@ -357,7 +286,10 @@ static inline int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                return 0;
        }
-        if (sock_queue_rcv_skb(sk,skb)<0) {
+        if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
+                /* Note that an ENOMEM error is charged twice */
+                if (rc == -ENOMEM)
+                        UDP6_INC_STATS_BH(UDP_MIB_RCVBUFERRORS);
                UDP6_INC_STATS_BH(UDP_MIB_INERRORS);
                kfree_skb(skb);
                return 0;
@@ -476,7 +408,7 @@ static int udpv6_rcv(struct sk_buff **pskb)
                uh = skb->h.uh;
        }
-        if (skb->ip_summed == CHECKSUM_HW &&
+        if (skb->ip_summed == CHECKSUM_COMPLETE &&
            !csum_ipv6_magic(saddr, daddr, ulen, IPPROTO_UDP, skb->csum))
                skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -783,7 +715,9 @@ do_udp_sendmsg:
                connected = 0;
        }
-        err = ip6_dst_lookup(sk, &dst, fl);
+        security_sk_classify_flow(sk, fl);
+        err = ip6_sk_dst_lookup(sk, &dst, fl);
        if (err)
                goto out;
        if (final_p)
@@ -841,7 +775,12 @@ do_append_data:
                if (connected) {
                        ip6_dst_store(sk, dst,
                                      ipv6_addr_equal(&fl->fl6_dst, &np->daddr) ?
-                                      &np->daddr : NULL);
+                                      &np->daddr : NULL,
+#ifdef CONFIG_IPV6_SUBTREES
+                                      ipv6_addr_equal(&fl->fl6_src, &np->saddr) ?
+                                      &np->saddr :
+#endif
+                                      NULL);
                } else {
                        dst_release(dst);
                }
@@ -856,6 +795,16 @@ out:
                UDP6_INC_STATS_USER(UDP_MIB_OUTDATAGRAMS);
                return len;
        }
+        /*
+         * ENOBUFS = no kernel mem, SOCK_NOSPACE = no sndbuf space.  Reporting
+         * ENOBUFS might not be good (it's not tunable per se), but otherwise
+         * we don't have a good statistic (IpOutDiscards but it can be too many
+         * things).  We could add another new stat but at least for now that
+         * seems like overkill.
+         */
+        if (err == -ENOBUFS || test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
+                UDP6_INC_STATS_USER(UDP_MIB_SNDBUFERRORS);
+        }
        return err;
 do_confirm:
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 0405d74ff910..5c8b7a568800 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -16,10 +16,10 @@
 #include <net/ipv6.h>
 #include <net/xfrm.h>
-int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi)
+int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi)
 {
        int err;
-        u32 seq;
+        __be32 seq;
        struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
        struct xfrm_state *x;
        int xfrm_nr = 0;
@@ -72,7 +72,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi)
                if (x->mode->input(x, skb))
                        goto drop;
-                if (x->props.mode) { /* XXX */
+                if (x->props.mode == XFRM_MODE_TUNNEL) { /* XXX */
                        decaps = 1;
                        break;
                }
@@ -138,3 +138,111 @@ int xfrm6_rcv(struct sk_buff **pskb)
 {
        return xfrm6_rcv_spi(*pskb, 0);
 }
+int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
+                     xfrm_address_t *saddr, u8 proto)
+{
+        struct xfrm_state *x = NULL;
+        int wildcard = 0;
+        struct in6_addr any;
+        xfrm_address_t *xany;
+        struct xfrm_state *xfrm_vec_one = NULL;
+        int nh = 0;
+        int i = 0;
+        ipv6_addr_set(&any, 0, 0, 0, 0);
+        xany = (xfrm_address_t *)&any;
+        for (i = 0; i < 3; i++) {
+                xfrm_address_t *dst, *src;
+                switch (i) {
+                case 0:
+                        dst = daddr;
+                        src = saddr;
+                        break;
+                case 1:
+                        /* lookup state with wild-card source address */
+                        wildcard = 1;
+                        dst = daddr;
+                        src = xany;
+                        break;
+                case 2:
+                default:
+                        /* lookup state with wild-card addresses */
+                        wildcard = 1; /* XXX */
+                        dst = xany;
+                        src = xany;
+                        break;
+                }
+                x = xfrm_state_lookup_byaddr(dst, src, proto, AF_INET6);
+                if (!x)
+                        continue;
+                spin_lock(&x->lock);
+                if (wildcard) {
+                        if ((x->props.flags & XFRM_STATE_WILDRECV) == 0) {
+                                spin_unlock(&x->lock);
+                                xfrm_state_put(x);
+                                x = NULL;
+                                continue;
+                        }
+                }
+                if (unlikely(x->km.state != XFRM_STATE_VALID)) {
+                        spin_unlock(&x->lock);
+                        xfrm_state_put(x);
+                        x = NULL;
+                        continue;
+                }
+                if (xfrm_state_check_expire(x)) {
+                        spin_unlock(&x->lock);
+                        xfrm_state_put(x);
+                        x = NULL;
+                        continue;
+                }
+                nh = x->type->input(x, skb);
+                if (nh <= 0) {
+                        spin_unlock(&x->lock);
+                        xfrm_state_put(x);
+                        x = NULL;
+                        continue;
+                }
+                x->curlft.bytes += skb->len;
+                x->curlft.packets++;
+                spin_unlock(&x->lock);
+                xfrm_vec_one = x;
+                break;
+        }
+        if (!xfrm_vec_one)
+                goto drop;
+        /* Allocate new secpath or COW existing one. */
+        if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
+                struct sec_path *sp;
+                sp = secpath_dup(skb->sp);
+                if (!sp)
+                        goto drop;
+                if (skb->sp)
+                        secpath_put(skb->sp);
+                skb->sp = sp;
+        }
+        if (1 + skb->sp->len > XFRM_MAX_DEPTH)
+                goto drop;
+        skb->sp->xvec[skb->sp->len] = xfrm_vec_one;
+        skb->sp->len ++;
+        return 1;
+drop:
+        if (xfrm_vec_one)
+                xfrm_state_put(xfrm_vec_one);
+        return -1;
+}
diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c
new file mode 100644
index 000000000000..6031c16d46ca
--- /dev/null
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -0,0 +1,93 @@
+/*
+ * xfrm6_mode_ro.c - Route optimization mode for IPv6.
+ *
+ * Copyright (C)2003-2006 Helsinki University of Technology
+ * Copyright (C)2003-2006 USAGI/WIDE Project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+/*
+ * Authors:
+ *      Noriaki TAKAMIYA @USAGI
+ *      Masahide NAKAMURA @USAGI
+ */
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/stringify.h>
+#include <net/ipv6.h>
+#include <net/xfrm.h>
+/* Add route optimization header space.
+ *
+ * The IP header and mutable extension headers will be moved forward to make
+ * space for the route optimization header.
+ *
+ * On exit, skb->h will be set to the start of the encapsulation header to be
+ * filled in by x->type->output and skb->nh will be set to the nextheader field
+ * of the extension header directly preceding the encapsulation header, or in
+ * its absence, that of the top IP header.  The value of skb->data will always
+ * point to the top IP header.
+ */
+static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
+{
+        struct ipv6hdr *iph;
+        u8 *prevhdr;
+        int hdr_len;
+        skb_push(skb, x->props.header_len);
+        iph = skb->nh.ipv6h;
+        hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+        skb->nh.raw = prevhdr - x->props.header_len;
+        skb->h.raw = skb->data + hdr_len;
+        memmove(skb->data, iph, hdr_len);
+        return 0;
+}
+/*
+ * Do nothing about routing optimization header unlike IPsec.
+ */
+static int xfrm6_ro_input(struct xfrm_state *x, struct sk_buff *skb)
+{
+        return 0;
+}
+static struct xfrm_mode xfrm6_ro_mode = {
+        .input = xfrm6_ro_input,
+        .output = xfrm6_ro_output,
+        .owner = THIS_MODULE,
+        .encap = XFRM_MODE_ROUTEOPTIMIZATION,
+};
+static int __init xfrm6_ro_init(void)
+{
+        return xfrm_register_mode(&xfrm6_ro_mode, AF_INET6);
+}
+static void __exit xfrm6_ro_exit(void)
+{
+        int err;
+        err = xfrm_unregister_mode(&xfrm6_ro_mode, AF_INET6);
+        BUG_ON(err);
+}
+module_init(xfrm6_ro_init);
+module_exit(xfrm6_ro_exit);
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_XFRM_MODE(AF_INET6, XFRM_MODE_ROUTEOPTIMIZATION);
diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c
index 711d713e36d8..3a4b39b12bad 100644
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -25,9 +25,8 @@
 * its absence, that of the top IP header.  The value of skb->data will always
 * point to the top IP header.
 */
-static int xfrm6_transport_output(struct sk_buff *skb)
+static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
 {
-        struct xfrm_state *x = skb->dst->xfrm;
        struct ipv6hdr *iph;
        u8 *prevhdr;
        int hdr_len;
@@ -35,7 +34,7 @@ static int xfrm6_transport_output(struct sk_buff *skb)
        skb_push(skb, x->props.header_len);
        iph = skb->nh.ipv6h;
-        hdr_len = ip6_find_1stfragopt(skb, &prevhdr);
+        hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
        skb->nh.raw = prevhdr - x->props.header_len;
        skb->h.raw = skb->data + hdr_len;
        memmove(skb->data, iph, hdr_len);
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 8af79be2edca..5e7d8a7d6414 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -37,10 +37,9 @@ static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)
 * its absence, that of the top IP header.  The value of skb->data will always
 * point to the top IP header.
 */
-static int xfrm6_tunnel_output(struct sk_buff *skb)
+static int xfrm6_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 {
        struct dst_entry *dst = skb->dst;
-        struct xfrm_state *x = dst->xfrm;
        struct ipv6hdr *iph, *top_iph;
        int dsfield;
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 48fccb1eca08..c260ea104c52 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -17,6 +17,12 @@
 #include <net/ipv6.h>
 #include <net/xfrm.h>
+int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
+                          u8 **prevhdr)
+{
+        return ip6_find_1stfragopt(skb, prevhdr);
+}
 static int xfrm6_tunnel_check_size(struct sk_buff *skb)
 {
        int mtu, ret = 0;
@@ -41,13 +47,13 @@ static int xfrm6_output_one(struct sk_buff *skb)
        struct xfrm_state *x = dst->xfrm;
        int err;
        
-        if (skb->ip_summed == CHECKSUM_HW) {
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
-                err = skb_checksum_help(skb, 0);
+                err = skb_checksum_help(skb);
                if (err)
                        goto error_nolock;
        }
-        if (x->props.mode) {
+        if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = xfrm6_tunnel_check_size(skb);
                if (err)
                        goto error_nolock;
@@ -59,7 +65,7 @@ static int xfrm6_output_one(struct sk_buff *skb)
                if (err)
                        goto error;
-                err = x->mode->output(skb);
+                err = x->mode->output(x, skb);
                if (err)
                        goto error;
@@ -69,6 +75,8 @@ static int xfrm6_output_one(struct sk_buff *skb)
                x->curlft.bytes += skb->len;
                x->curlft.packets++;
+                if (x->props.mode == XFRM_MODE_ROUTEOPTIMIZATION)
+                        x->lastused = (u64)xtime.tv_sec;
                spin_unlock_bh(&x->lock);
@@ -80,7 +88,7 @@ static int xfrm6_output_one(struct sk_buff *skb)
                }
                dst = skb->dst;
                x = dst->xfrm;
-        } while (x && !x->props.mode);
+        } while (x && (x->props.mode != XFRM_MODE_TUNNEL));
        IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
        err = 0;
@@ -122,10 +130,10 @@ static int xfrm6_output_finish(struct sk_buff *skb)
 {
        struct sk_buff *segs;
-        if (!skb_shinfo(skb)->gso_size)
+        if (!skb_is_gso(skb))
                return xfrm6_output_finish2(skb);
-        skb->protocol = htons(ETH_P_IP);
+        skb->protocol = htons(ETH_P_IPV6);
        segs = skb_gso_segment(skb, 0);
        kfree_skb(skb);
        if (unlikely(IS_ERR(segs)))
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index ee715f2691e9..6a252e2134d1 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -12,13 +12,15 @@
 */
 #include <linux/compiler.h>
-#include <linux/config.h>
 #include <linux/netdevice.h>
 #include <net/addrconf.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
+#ifdef CONFIG_IPV6_MIP6
+#include <net/mip6.h>
+#endif
 static struct dst_ops xfrm6_dst_ops;
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
@@ -32,6 +34,26 @@ static int xfrm6_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
        return err;
 }
+static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
+{
+        struct rt6_info *rt;
+        struct flowi fl_tunnel = {
+                .nl_u = {
+                        .ip6_u = {
+                                .daddr = *(struct in6_addr *)&daddr->a6,
+                        },
+                },
+        };
+        if (!xfrm6_dst_lookup((struct xfrm_dst **)&rt, &fl_tunnel)) {
+                ipv6_get_saddr(&rt->u.dst, (struct in6_addr *)&daddr->a6,
+                               (struct in6_addr *)&saddr->a6);
+                dst_release(&rt->u.dst);
+                return 0;
+        }
+        return -EHOSTUNREACH;
+}
 static struct dst_entry *
 __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
 {
@@ -51,7 +73,9 @@ __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
                                 xdst->u.rt6.rt6i_src.plen);
                if (ipv6_addr_equal(&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) &&
                    ipv6_addr_equal(&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) &&
-                    xfrm_bundle_ok(xdst, fl, AF_INET6)) {
+                    xfrm_bundle_ok(xdst, fl, AF_INET6,
+                                   (xdst->u.rt6.rt6i_dst.plen != 128 ||
+                                    xdst->u.rt6.rt6i_src.plen != 128))) {
                        dst_clone(dst);
                        break;
                }
@@ -60,6 +84,40 @@ __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
        return dst;
 }
+static inline struct in6_addr*
+__xfrm6_bundle_addr_remote(struct xfrm_state *x, struct in6_addr *addr)
+{
+        return (x->type->remote_addr) ?
+                (struct in6_addr*)x->type->remote_addr(x, (xfrm_address_t *)addr) :
+                (struct in6_addr*)&x->id.daddr;
+}
+static inline struct in6_addr*
+__xfrm6_bundle_addr_local(struct xfrm_state *x, struct in6_addr *addr)
+{
+        return (x->type->local_addr) ?
+                (struct in6_addr*)x->type->local_addr(x, (xfrm_address_t *)addr) :
+                (struct in6_addr*)&x->props.saddr;
+}
+static inline void
+__xfrm6_bundle_len_inc(int *len, int *nflen, struct xfrm_state *x)
+{
+        if (x->type->flags & XFRM_TYPE_NON_FRAGMENT)
+                *nflen += x->props.header_len;
+        else
+                *len += x->props.header_len;
+}
+static inline void
+__xfrm6_bundle_len_dec(int *len, int *nflen, struct xfrm_state *x)
+{
+        if (x->type->flags & XFRM_TYPE_NON_FRAGMENT)
+                *nflen -= x->props.header_len;
+        else
+                *len -= x->props.header_len;
+}
 /* Allocate chain of dst_entry's, attach known xfrm's, calculate
 * all the metrics... Shortly, bundle a bundle.
 */
@@ -84,6 +142,7 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
        int i;
        int err = 0;
        int header_len = 0;
+        int nfheader_len = 0;
        int trailer_len = 0;
        dst = dst_prev = NULL;
@@ -110,17 +169,18 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                xdst = (struct xfrm_dst *)dst1;
                xdst->route = &rt->u.dst;
+                xdst->genid = xfrm[i]->genid;
                if (rt->rt6i_node)
                        xdst->route_cookie = rt->rt6i_node->fn_sernum;
                dst1->next = dst_prev;
                dst_prev = dst1;
-                if (xfrm[i]->props.mode) {
+                if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
-                        remote = (struct in6_addr*)&xfrm[i]->id.daddr;
+                        remote = __xfrm6_bundle_addr_remote(xfrm[i], remote);
-                        local  = (struct in6_addr*)&xfrm[i]->props.saddr;
+                        local  = __xfrm6_bundle_addr_local(xfrm[i], local);
                        tunnel = 1;
                }
-                header_len += xfrm[i]->props.header_len;
+                __xfrm6_bundle_len_inc(&header_len, &nfheader_len, xfrm[i]);
                trailer_len += xfrm[i]->props.trailer_len;
                if (tunnel) {
@@ -155,6 +215,7 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                dst_prev->flags        |= DST_HOST;
                dst_prev->lastuse       = jiffies;
                dst_prev->header_len    = header_len;
+                dst_prev->nfheader_len  = nfheader_len;
                dst_prev->trailer_len   = trailer_len;
                memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
@@ -173,7 +234,7 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                x->u.rt6.rt6i_src      = rt0->rt6i_src; 
                x->u.rt6.rt6i_idev     = rt0->rt6i_idev;
                in6_dev_hold(rt0->rt6i_idev);
-                header_len -= x->u.dst.xfrm->props.header_len;
+                __xfrm6_bundle_len_dec(&header_len, &nfheader_len, x->u.dst.xfrm);
                trailer_len -= x->u.dst.xfrm->props.trailer_len;
        }
@@ -233,6 +294,18 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
                        fl->proto = nexthdr;
                        return;
+#ifdef CONFIG_IPV6_MIP6
+                case IPPROTO_MH:
+                        if (pskb_may_pull(skb, skb->nh.raw + offset + 3 - skb->data)) {
+                                struct ip6_mh *mh;
+                                mh = (struct ip6_mh *)exthdr;
+                                fl->fl_mh_type = mh->ip6mh_type;
+                        }
+                        fl->proto = nexthdr;
+                        return;
+#endif
                /* XXX Why are there these headers? */
                case IPPROTO_AH:
                case IPPROTO_ESP:
@@ -309,6 +382,7 @@ static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
        .family =               AF_INET6,
        .dst_ops =              &xfrm6_dst_ops,
        .dst_lookup =           xfrm6_dst_lookup,
+        .get_saddr =            xfrm6_get_saddr,
        .find_bundle =          __xfrm6_find_bundle,
        .bundle_create =        __xfrm6_bundle_create,
        .decode_session =       _decode_session6,
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index b33296b3f6de..9ddaa9d41539 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -29,9 +29,9 @@ __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
        ipv6_addr_copy((struct in6_addr *)&x->sel.daddr, &fl->fl6_dst);
        ipv6_addr_copy((struct in6_addr *)&x->sel.saddr, &fl->fl6_src);
        x->sel.dport = xfrm_flowi_dport(fl);
-        x->sel.dport_mask = ~0;
+        x->sel.dport_mask = htons(0xffff);
        x->sel.sport = xfrm_flowi_sport(fl);
-        x->sel.sport_mask = ~0;
+        x->sel.sport_mask = htons(0xffff);
        x->sel.prefixlen_d = 128;
        x->sel.prefixlen_s = 128;
        x->sel.proto = fl->proto;
@@ -42,102 +42,135 @@ __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
        memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
        if (ipv6_addr_any((struct in6_addr*)&x->props.saddr))
                memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
-        if (tmpl->mode && ipv6_addr_any((struct in6_addr*)&x->props.saddr)) {
-                struct rt6_info *rt;
-                struct flowi fl_tunnel = {
-                        .nl_u = {
-                                .ip6_u = {
-                                        .daddr = *(struct in6_addr *)daddr,
-                                }
-                        }
-                };
-                if (!xfrm_dst_lookup((struct xfrm_dst **)&rt,
-                                     &fl_tunnel, AF_INET6)) {
-                        ipv6_get_saddr(&rt->u.dst, (struct in6_addr *)daddr,
-                                       (struct in6_addr *)&x->props.saddr);
-                        dst_release(&rt->u.dst);
-                }
-        }
        x->props.mode = tmpl->mode;
        x->props.reqid = tmpl->reqid;
        x->props.family = AF_INET6;
 }
-static struct xfrm_state *
+static int
-__xfrm6_state_lookup(xfrm_address_t *daddr, u32 spi, u8 proto)
+__xfrm6_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n)
 {
-        unsigned h = __xfrm6_spi_hash(daddr, spi, proto);
+        int i;
-        struct xfrm_state *x;
+        int j = 0;
-        list_for_each_entry(x, xfrm6_state_afinfo.state_byspi+h, byspi) {
+        /* Rule 1: select IPsec transport except AH */
-                if (x->props.family == AF_INET6 &&
+        for (i = 0; i < n; i++) {
-                    spi == x->id.spi &&
+                if (src[i]->props.mode == XFRM_MODE_TRANSPORT &&
-                    ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)x->id.daddr.a6) &&
+                    src[i]->id.proto != IPPROTO_AH) {
-                    proto == x->id.proto) {
+                        dst[j++] = src[i];
-                        xfrm_state_hold(x);
+                        src[i] = NULL;
-                        return x;
+                }
+        }
+        if (j == n)
+                goto end;
+        /* Rule 2: select MIPv6 RO or inbound trigger */
+#ifdef CONFIG_IPV6_MIP6
+        for (i = 0; i < n; i++) {
+                if (src[i] &&
+                    (src[i]->props.mode == XFRM_MODE_ROUTEOPTIMIZATION ||
+                     src[i]->props.mode == XFRM_MODE_IN_TRIGGER)) {
+                        dst[j++] = src[i];
+                        src[i] = NULL;
+                }
+        }
+        if (j == n)
+                goto end;
+#endif
+        /* Rule 3: select IPsec transport AH */
+        for (i = 0; i < n; i++) {
+                if (src[i] &&
+                    src[i]->props.mode == XFRM_MODE_TRANSPORT &&
+                    src[i]->id.proto == IPPROTO_AH) {
+                        dst[j++] = src[i];
+                        src[i] = NULL;
                }
        }
-        return NULL;
+        if (j == n)
+                goto end;
+        /* Rule 4: select IPsec tunnel */
+        for (i = 0; i < n; i++) {
+                if (src[i] &&
+                    src[i]->props.mode == XFRM_MODE_TUNNEL) {
+                        dst[j++] = src[i];
+                        src[i] = NULL;
+                }
+        }
+        if (likely(j == n))
+                goto end;
+        /* Final rule */
+        for (i = 0; i < n; i++) {
+                if (src[i]) {
+                        dst[j++] = src[i];
+                        src[i] = NULL;
+                }
+        }
+ end:
+        return 0;
 }
-static struct xfrm_state *
+static int
-__xfrm6_find_acq(u8 mode, u32 reqid, u8 proto, 
+__xfrm6_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n)
-                 xfrm_address_t *daddr, xfrm_address_t *saddr, 
-                 int create)
 {
-        struct xfrm_state *x, *x0;
+        int i;
-        unsigned h = __xfrm6_dst_hash(daddr);
+        int j = 0;
-        x0 = NULL;
+        /* Rule 1: select IPsec transport */
+        for (i = 0; i < n; i++) {
-        list_for_each_entry(x, xfrm6_state_afinfo.state_bydst+h, bydst) {
+                if (src[i]->mode == XFRM_MODE_TRANSPORT) {
-                if (x->props.family == AF_INET6 &&
+                        dst[j++] = src[i];
-                    ipv6_addr_equal((struct in6_addr *)daddr, (struct in6_addr *)x->id.daddr.a6) &&
+                        src[i] = NULL;
-                    mode == x->props.mode &&
+                }
-                    proto == x->id.proto &&
-                    ipv6_addr_equal((struct in6_addr *)saddr, (struct in6_addr *)x->props.saddr.a6) &&
-                    reqid == x->props.reqid &&
-                    x->km.state == XFRM_STATE_ACQ &&
-                    !x->id.spi) {
-                            x0 = x;
-                            break;
-                    }
        }
-        if (!x0 && create && (x0 = xfrm_state_alloc()) != NULL) {
+        if (j == n)
-                ipv6_addr_copy((struct in6_addr *)x0->sel.daddr.a6,
+                goto end;
-                               (struct in6_addr *)daddr);
-                ipv6_addr_copy((struct in6_addr *)x0->sel.saddr.a6,
+        /* Rule 2: select MIPv6 RO or inbound trigger */
-                               (struct in6_addr *)saddr);
+#ifdef CONFIG_IPV6_MIP6
-                x0->sel.prefixlen_d = 128;
+        for (i = 0; i < n; i++) {
-                x0->sel.prefixlen_s = 128;
+                if (src[i] &&
-                ipv6_addr_copy((struct in6_addr *)x0->props.saddr.a6,
+                    (src[i]->mode == XFRM_MODE_ROUTEOPTIMIZATION ||
-                               (struct in6_addr *)saddr);
+                     src[i]->mode == XFRM_MODE_IN_TRIGGER)) {
-                x0->km.state = XFRM_STATE_ACQ;
+                        dst[j++] = src[i];
-                ipv6_addr_copy((struct in6_addr *)x0->id.daddr.a6,
+                        src[i] = NULL;
-                               (struct in6_addr *)daddr);
+                }
-                x0->id.proto = proto;
-                x0->props.family = AF_INET6;
-                x0->props.mode = mode;
-                x0->props.reqid = reqid;
-                x0->lft.hard_add_expires_seconds = XFRM_ACQ_EXPIRES;
-                xfrm_state_hold(x0);
-                x0->timer.expires = jiffies + XFRM_ACQ_EXPIRES*HZ;
-                add_timer(&x0->timer);
-                xfrm_state_hold(x0);
-                list_add_tail(&x0->bydst, xfrm6_state_afinfo.state_bydst+h);
-                wake_up(&km_waitq);
        }
-        if (x0)
+        if (j == n)
-                xfrm_state_hold(x0);
+                goto end;
-        return x0;
+#endif
+        /* Rule 3: select IPsec tunnel */
+        for (i = 0; i < n; i++) {
+                if (src[i] &&
+                    src[i]->mode == XFRM_MODE_TUNNEL) {
+                        dst[j++] = src[i];
+                        src[i] = NULL;
+                }
+        }
+        if (likely(j == n))
+                goto end;
+        /* Final rule */
+        for (i = 0; i < n; i++) {
+                if (src[i]) {
+                        dst[j++] = src[i];
+                        src[i] = NULL;
+                }
+        }
+ end:
+        return 0;
 }
 static struct xfrm_state_afinfo xfrm6_state_afinfo = {
        .family                 = AF_INET6,
        .init_tempsel           = __xfrm6_init_tempsel,
-        .state_lookup           = __xfrm6_state_lookup,
+        .tmpl_sort              = __xfrm6_tmpl_sort,
-        .find_acq               = __xfrm6_find_acq,
+        .state_sort             = __xfrm6_state_sort,
 };
 void __init xfrm6_state_init(void)
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index d37768e5064f..7af227bb1551 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -21,7 +21,6 @@
 * Based on net/ipv4/xfrm4_tunnel.c
 *
 */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/xfrm.h>
 #include <linux/list.h>
@@ -32,27 +31,6 @@
 #include <linux/icmpv6.h>
 #include <linux/mutex.h>
-#ifdef CONFIG_IPV6_XFRM6_TUNNEL_DEBUG
-# define X6TDEBUG       3
-#else
-# define X6TDEBUG       1
-#endif
-#define X6TPRINTK(fmt, args...)         printk(fmt, ## args)
-#define X6TNOPRINTK(fmt, args...)       do { ; } while(0)
-#if X6TDEBUG >= 1
-# define X6TPRINTK1     X6TPRINTK
-#else
-# define X6TPRINTK1     X6TNOPRINTK
-#endif
-#if X6TDEBUG >= 3
-# define X6TPRINTK3     X6TPRINTK
-#else
-# define X6TPRINTK3     X6TNOPRINTK
-#endif
 /*
 * xfrm_tunnel_spi things are for allocating unique id ("spi") 
 * per xfrm_address_t.
@@ -63,15 +41,8 @@ struct xfrm6_tunnel_spi {
        xfrm_address_t addr;
        u32 spi;
        atomic_t refcnt;
-#ifdef XFRM6_TUNNEL_SPI_MAGIC
-        u32 magic;
-#endif
 };
-#ifdef CONFIG_IPV6_XFRM6_TUNNEL_DEBUG
-# define XFRM6_TUNNEL_SPI_MAGIC 0xdeadbeef
-#endif
 static DEFINE_RWLOCK(xfrm6_tunnel_spi_lock);
 static u32 xfrm6_tunnel_spi;
@@ -87,43 +58,15 @@ static kmem_cache_t *xfrm6_tunnel_spi_kmem __read_mostly;
 static struct hlist_head xfrm6_tunnel_spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
 static struct hlist_head xfrm6_tunnel_spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
-#ifdef XFRM6_TUNNEL_SPI_MAGIC
-static int x6spi_check_magic(const struct xfrm6_tunnel_spi *x6spi,
-                             const char *name)
-{
-        if (unlikely(x6spi->magic != XFRM6_TUNNEL_SPI_MAGIC)) {
-                X6TPRINTK3(KERN_DEBUG "%s(): x6spi object "
-                                      "at %p has corrupted magic %08x "
-                                      "(should be %08x)\n",
-                           name, x6spi, x6spi->magic, XFRM6_TUNNEL_SPI_MAGIC);
-                return -1;
-        }
-        return 0;
-}
-#else
-static int inline x6spi_check_magic(const struct xfrm6_tunnel_spi *x6spi,
-                                    const char *name)
-{
-        return 0;
-}
-#endif
-#define X6SPI_CHECK_MAGIC(x6spi) x6spi_check_magic((x6spi), __FUNCTION__)
 static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
 {
        unsigned h;
-        X6TPRINTK3(KERN_DEBUG "%s(addr=%p)\n", __FUNCTION__, addr);
        h = addr->a6[0] ^ addr->a6[1] ^ addr->a6[2] ^ addr->a6[3];
        h ^= h >> 16;
        h ^= h >> 8;
        h &= XFRM6_TUNNEL_SPI_BYADDR_HSIZE - 1;
-        X6TPRINTK3(KERN_DEBUG "%s() = %u\n", __FUNCTION__, h);
        return h;
 }
@@ -137,19 +80,13 @@ static int xfrm6_tunnel_spi_init(void)
 {
        int i;
-        X6TPRINTK3(KERN_DEBUG "%s()\n", __FUNCTION__);
        xfrm6_tunnel_spi = 0;
        xfrm6_tunnel_spi_kmem = kmem_cache_create("xfrm6_tunnel_spi",
                                                  sizeof(struct xfrm6_tunnel_spi),
                                                  0, SLAB_HWCACHE_ALIGN,
                                                  NULL, NULL);
-        if (!xfrm6_tunnel_spi_kmem) {
+        if (!xfrm6_tunnel_spi_kmem)
-                X6TPRINTK1(KERN_ERR
-                           "%s(): failed to allocate xfrm6_tunnel_spi_kmem\n",
-                           __FUNCTION__);
                return -ENOMEM;
-        }
        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
                INIT_HLIST_HEAD(&xfrm6_tunnel_spi_byaddr[i]);
@@ -162,22 +99,16 @@ static void xfrm6_tunnel_spi_fini(void)
 {
        int i;
-        X6TPRINTK3(KERN_DEBUG "%s()\n", __FUNCTION__);
        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++) {
                if (!hlist_empty(&xfrm6_tunnel_spi_byaddr[i]))
-                        goto err;
+                        return;
        }
        for (i = 0; i < XFRM6_TUNNEL_SPI_BYSPI_HSIZE; i++) {
                if (!hlist_empty(&xfrm6_tunnel_spi_byspi[i]))
-                        goto err;
+                        return;
        }
        kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
        xfrm6_tunnel_spi_kmem = NULL;
-        return;
-err:
-        X6TPRINTK1(KERN_ERR "%s(): table is not empty\n", __FUNCTION__);
-        return;
 }
 static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
@@ -185,19 +116,13 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        struct hlist_node *pos;
-        X6TPRINTK3(KERN_DEBUG "%s(saddr=%p)\n", __FUNCTION__, saddr);
        hlist_for_each_entry(x6spi, pos,
                             &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                             list_byaddr) {
-                if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0) {
+                if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0)
-                        X6SPI_CHECK_MAGIC(x6spi);
-                        X6TPRINTK3(KERN_DEBUG "%s() = %p(%u)\n", __FUNCTION__, x6spi, x6spi->spi);
                        return x6spi;
-                }
        }
-        X6TPRINTK3(KERN_DEBUG "%s() = NULL(0)\n", __FUNCTION__);
        return NULL;
 }
@@ -206,8 +131,6 @@ u32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        u32 spi;
-        X6TPRINTK3(KERN_DEBUG "%s(saddr=%p)\n", __FUNCTION__, saddr);
        read_lock_bh(&xfrm6_tunnel_spi_lock);
        x6spi = __xfrm6_tunnel_spi_lookup(saddr);
        spi = x6spi ? x6spi->spi : 0;
@@ -224,8 +147,6 @@ static u32 __xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
        struct hlist_node *pos;
        unsigned index;
-        X6TPRINTK3(KERN_DEBUG "%s(saddr=%p)\n", __FUNCTION__, saddr);
        if (xfrm6_tunnel_spi < XFRM6_TUNNEL_SPI_MIN ||
            xfrm6_tunnel_spi >= XFRM6_TUNNEL_SPI_MAX)
                xfrm6_tunnel_spi = XFRM6_TUNNEL_SPI_MIN;
@@ -259,18 +180,10 @@ try_next_2:;
        spi = 0;
        goto out;
 alloc_spi:
-        X6TPRINTK3(KERN_DEBUG "%s(): allocate new spi for " NIP6_FMT "\n",
-                              __FUNCTION__, 
-                              NIP6(*(struct in6_addr *)saddr));
        x6spi = kmem_cache_alloc(xfrm6_tunnel_spi_kmem, SLAB_ATOMIC);
-        if (!x6spi) {
+        if (!x6spi)
-                X6TPRINTK1(KERN_ERR "%s(): kmem_cache_alloc() failed\n", 
-                           __FUNCTION__);
                goto out;
-        }
-#ifdef XFRM6_TUNNEL_SPI_MAGIC
-        x6spi->magic = XFRM6_TUNNEL_SPI_MAGIC;
-#endif
        memcpy(&x6spi->addr, saddr, sizeof(x6spi->addr));
        x6spi->spi = spi;
        atomic_set(&x6spi->refcnt, 1);
@@ -279,9 +192,7 @@ alloc_spi:
        index = xfrm6_tunnel_spi_hash_byaddr(saddr);
        hlist_add_head(&x6spi->list_byaddr, &xfrm6_tunnel_spi_byaddr[index]);
-        X6SPI_CHECK_MAGIC(x6spi);
 out:
-        X6TPRINTK3(KERN_DEBUG "%s() = %u\n", __FUNCTION__, spi);
        return spi;
 }
@@ -290,8 +201,6 @@ u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        u32 spi;
-        X6TPRINTK3(KERN_DEBUG "%s(saddr=%p)\n", __FUNCTION__, saddr);
        write_lock_bh(&xfrm6_tunnel_spi_lock);
        x6spi = __xfrm6_tunnel_spi_lookup(saddr);
        if (x6spi) {
@@ -301,8 +210,6 @@ u32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
                spi = __xfrm6_tunnel_alloc_spi(saddr);
        write_unlock_bh(&xfrm6_tunnel_spi_lock);
-        X6TPRINTK3(KERN_DEBUG "%s() = %u\n", __FUNCTION__, spi);
        return spi;
 }
@@ -313,8 +220,6 @@ void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        struct hlist_node *pos, *n;
-        X6TPRINTK3(KERN_DEBUG "%s(saddr=%p)\n", __FUNCTION__, saddr);
        write_lock_bh(&xfrm6_tunnel_spi_lock);
        hlist_for_each_entry_safe(x6spi, pos, n, 
@@ -322,12 +227,6 @@ void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
                                  list_byaddr)
        {
                if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0) {
-                        X6TPRINTK3(KERN_DEBUG "%s(): x6spi object for " NIP6_FMT 
-                                              " found at %p\n",
-                                   __FUNCTION__, 
-                                   NIP6(*(struct in6_addr *)saddr),
-                                   x6spi);
-                        X6SPI_CHECK_MAGIC(x6spi);
                        if (atomic_dec_and_test(&x6spi->refcnt)) {
                                hlist_del(&x6spi->list_byaddr);
                                hlist_del(&x6spi->list_byspi);
@@ -359,7 +258,7 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_tunnel_rcv(struct sk_buff *skb)
 {
        struct ipv6hdr *iph = skb->nh.ipv6h;
-        u32 spi;
+        __be32 spi;
        spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr);
        return xfrm6_rcv_spi(skb, spi);
@@ -378,20 +277,14 @@ static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                case ICMPV6_ADDR_UNREACH:
                case ICMPV6_PORT_UNREACH:
                default:
-                        X6TPRINTK3(KERN_DEBUG
-                                   "xfrm6_tunnel: Destination Unreach.\n");
                        break;
                }
                break;
        case ICMPV6_PKT_TOOBIG:
-                        X6TPRINTK3(KERN_DEBUG 
-                                   "xfrm6_tunnel: Packet Too Big.\n");
                break;
        case ICMPV6_TIME_EXCEED:
                switch (code) {
                case ICMPV6_EXC_HOPLIMIT:
-                        X6TPRINTK3(KERN_DEBUG
-                                   "xfrm6_tunnel: Too small Hoplimit.\n");
                        break;
                case ICMPV6_EXC_FRAGTIME:
                default: 
@@ -414,7 +307,7 @@ static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 static int xfrm6_tunnel_init_state(struct xfrm_state *x)
 {
-        if (!x->props.mode)
+        if (x->props.mode != XFRM_MODE_TUNNEL)
                return -EINVAL;
        if (x->encap)
@@ -448,22 +341,14 @@ static struct xfrm6_tunnel xfrm6_tunnel_handler = {
 static int __init xfrm6_tunnel_init(void)
 {
-        X6TPRINTK3(KERN_DEBUG "%s()\n", __FUNCTION__);
+        if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0)
-        if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0) {
-                X6TPRINTK1(KERN_ERR
-                           "xfrm6_tunnel init: can't add xfrm type\n");
                return -EAGAIN;
-        }
        if (xfrm6_tunnel_register(&xfrm6_tunnel_handler)) {
-                X6TPRINTK1(KERN_ERR
-                           "xfrm6_tunnel init(): can't add handler\n");
                xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
                return -EAGAIN;
        }
        if (xfrm6_tunnel_spi_init() < 0) {
-                X6TPRINTK1(KERN_ERR
-                           "xfrm6_tunnel init: failed to initialize spi\n");
                xfrm6_tunnel_deregister(&xfrm6_tunnel_handler);
                xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
                return -EAGAIN;
@@ -473,15 +358,9 @@ static int __init xfrm6_tunnel_init(void)
 static void __exit xfrm6_tunnel_fini(void)
 {
-        X6TPRINTK3(KERN_DEBUG "%s()\n", __FUNCTION__);
        xfrm6_tunnel_spi_fini();
-        if (xfrm6_tunnel_deregister(&xfrm6_tunnel_handler))
+        xfrm6_tunnel_deregister(&xfrm6_tunnel_handler);
-                X6TPRINTK1(KERN_ERR 
+        xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
-                           "xfrm6_tunnel close: can't remove handler\n");
-        if (xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6) < 0)
-                X6TPRINTK1(KERN_ERR
-                           "xfrm6_tunnel close: can't remove xfrm type\n");
 }
 module_init(xfrm6_tunnel_init);