Merge branch 'master' of /pub/scm/linux/kernel/git/torvalds/linux-2.6

Conflicts:

	fs/cifs/export.c

42 files changed, 647 insertions, 700 deletions

diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 8e5d54f23b..eb0b808594 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -109,7 +109,7 @@ config INET6_IPCOMP
           If unsure, say Y.
 
 config IPV6_MIP6
-        bool "IPv6: Mobility (EXPERIMENTAL)"
+        tristate "IPv6: Mobility (EXPERIMENTAL)"
         depends on IPV6 && EXPERIMENTAL
         select XFRM
         ---help---
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index bb33309044..87c23a73d2 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -14,7 +14,6 @@ ipv6-$(CONFIG_XFRM) += xfrm6_policy.o xfrm6_state.o xfrm6_input.o \
         xfrm6_output.o
 ipv6-$(CONFIG_NETFILTER) += netfilter.o
 ipv6-$(CONFIG_IPV6_MULTIPLE_TABLES) += fib6_rules.o
-ipv6-$(CONFIG_IPV6_MIP6) += mip6.o
 ipv6-$(CONFIG_PROC_FS) += proc.o
 
 ipv6-objs += $(ipv6-y)
@@ -28,6 +27,7 @@ obj-$(CONFIG_INET6_XFRM_MODE_TRANSPORT) += xfrm6_mode_transport.o
 obj-$(CONFIG_INET6_XFRM_MODE_TUNNEL) += xfrm6_mode_tunnel.o
 obj-$(CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION) += xfrm6_mode_ro.o
 obj-$(CONFIG_INET6_XFRM_MODE_BEET) += xfrm6_mode_beet.o
+obj-$(CONFIG_IPV6_MIP6) += mip6.o
 obj-$(CONFIG_NETFILTER) += netfilter/
 
 obj-$(CONFIG_IPV6_SIT) += sit.o
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f96ed76d8f..0601292091 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1034,7 +1034,7 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
                         }
 
                         /* Rule 4: Prefer home address */
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         if (hiscore.rule < 4) {
                                 if (ifa_result->flags & IFA_F_HOMEADDRESS)
                                         hiscore.attrs |= IPV6_SADDR_SCORE_HOA;
@@ -2268,6 +2268,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                 break;
         case NETDEV_UP:
         case NETDEV_CHANGE:
+                if (dev->flags & IFF_SLAVE)
+                        break;
+
                 if (event == NETDEV_UP) {
                         if (!netif_carrier_ok(dev)) {
                                 /* device is not ready yet. */
@@ -2472,6 +2475,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                 write_unlock_bh(&idev->lock);
 
                 __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
                 in6_ifa_put(ifa);
 
                 write_lock_bh(&idev->lock);
@@ -2782,7 +2786,7 @@ static int if6_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct seq_operations if6_seq_ops = {
+static const struct seq_operations if6_seq_ops = {
         .start  = if6_seq_start,
         .next   = if6_seq_next,
         .show   = if6_seq_show,
@@ -2832,7 +2836,7 @@ void if6_proc_exit(void)
 }
 #endif  /* CONFIG_PROC_FS */
 
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 /* Check if address is a home address configured on any interface. */
 int ipv6_chk_home_addr(struct in6_addr *addr)
 {
@@ -4240,7 +4244,6 @@ errout:
 void __exit addrconf_cleanup(void)
 {
         struct net_device *dev;
-        struct inet6_dev *idev;
         struct inet6_ifaddr *ifa;
         int i;
 
@@ -4258,7 +4261,7 @@ void __exit addrconf_cleanup(void)
          */
 
         for_each_netdev(dev) {
-                if ((idev = __in6_dev_get(dev)) == NULL)
+                if (__in6_dev_get(dev) == NULL)
                         continue;
                 addrconf_ifdown(dev, 1);
         }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 6dd377253c..eed09373a4 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -58,9 +58,6 @@
 #ifdef CONFIG_IPV6_TUNNEL
 #include <net/ip6_tunnel.h>
 #endif
-#ifdef CONFIG_IPV6_MIP6
-#include <net/mip6.h>
-#endif
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -853,9 +850,6 @@ static int __init inet6_init(void)
         ipv6_frag_init();
         ipv6_nodata_init();
         ipv6_destopt_init();
-#ifdef CONFIG_IPV6_MIP6
-        mip6_init();
-#endif
 
         /* Init v6 transport protocols. */
         udpv6_init();
@@ -921,9 +915,7 @@ static void __exit inet6_exit(void)
 
         /* Cleanup code parts. */
         ipv6_packet_cleanup();
-#ifdef CONFIG_IPV6_MIP6
-        mip6_fini();
-#endif
+
         addrconf_cleanup();
         ip6_flowlabel_cleanup();
         ip6_route_cleanup();
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 128f94c79c..53f46ab6af 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -74,7 +74,7 @@ bad:
         return 0;
 }
 
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 /**
  *      ipv6_rearrange_destopt - rearrange IPv6 destination options header
  *      @iph: IPv6 header
@@ -132,6 +132,8 @@ static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *des
 bad:
         return;
 }
+#else
+static void ipv6_rearrange_destopt(struct ipv6hdr *iph, struct ipv6_opt_hdr *destopt) {}
 #endif
 
 /**
@@ -189,10 +191,8 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
         while (exthdr.raw < end) {
                 switch (nexthdr) {
                 case NEXTHDR_DEST:
-#ifdef CONFIG_IPV6_MIP6
                         if (dir == XFRM_POLICY_OUT)
                                 ipv6_rearrange_destopt(iph, exthdr.opth);
-#endif
                 case NEXTHDR_HOP:
                         if (!zero_out_mutable_opts(exthdr.opth)) {
                                 LIMIT_NETDEBUG(
@@ -228,7 +228,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
         u8 nexthdr;
         char tmp_base[8];
         struct {
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 struct in6_addr saddr;
 #endif
                 struct in6_addr daddr;
@@ -255,7 +255,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
                         err = -ENOMEM;
                         goto error;
                 }
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 memcpy(tmp_ext, &top_iph->saddr, extlen);
 #else
                 memcpy(tmp_ext, &top_iph->daddr, extlen);
@@ -294,7 +294,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
 
         memcpy(top_iph, tmp_base, sizeof(tmp_base));
         if (tmp_ext) {
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 memcpy(&top_iph->saddr, tmp_ext, extlen);
 #else
                 memcpy(&top_iph->daddr, tmp_ext, extlen);
@@ -554,3 +554,4 @@ module_init(ah6_init);
 module_exit(ah6_fini);
 
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_AH);
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 9b81264eb7..b8c533fbdb 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -539,7 +539,7 @@ static int ac6_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct seq_operations ac6_seq_ops = {
+static const struct seq_operations ac6_seq_ops = {
         .start  =       ac6_seq_start,
         .next   =       ac6_seq_next,
         .stop   =       ac6_seq_stop,
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index b1fe7ac5dc..fe0f49024a 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -657,11 +657,10 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         rthdr = (struct ipv6_rt_hdr *)CMSG_DATA(cmsg);
 
                         switch (rthdr->type) {
-                        case IPV6_SRCRT_TYPE_0:
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         case IPV6_SRCRT_TYPE_2:
-#endif
                                 break;
+#endif
                         default:
                                 err = -EINVAL;
                                 goto exit_f;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 7107bb7e2e..2db31ce3c7 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -421,3 +421,4 @@ module_init(esp6_init);
 module_exit(esp6_fini);
 
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_ESP);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 14be0b9b77..c82d4d49f7 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -42,7 +42,7 @@
 #include <net/ndisc.h>
 #include <net/ip6_route.h>
 #include <net/addrconf.h>
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 #include <net/xfrm.h>
 #endif
 
@@ -90,6 +90,7 @@ int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
  bad:
         return -1;
 }
+EXPORT_SYMBOL_GPL(ipv6_find_tlv);
 
 /*
  *      Parsing tlv encoded headers.
@@ -196,7 +197,7 @@ bad:
   Destination options header.
  *****************************/
 
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 static int ipv6_dest_hao(struct sk_buff **skbp, int optoff)
 {
         struct sk_buff *skb = *skbp;
@@ -270,7 +271,7 @@ static int ipv6_dest_hao(struct sk_buff **skbp, int optoff)
 #endif
 
 static struct tlvtype_proc tlvprocdestopt_lst[] = {
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         {
                 .type   = IPV6_TLV_HAO,
                 .func   = ipv6_dest_hao,
@@ -283,7 +284,7 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
 {
         struct sk_buff *skb = *skbp;
         struct inet6_skb_parm *opt = IP6CB(skb);
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         __u16 dstbuf;
 #endif
         struct dst_entry *dst;
@@ -298,7 +299,7 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
         }
 
         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         dstbuf = opt->dst1;
 #endif
 
@@ -308,7 +309,7 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp)
                 skb = *skbp;
                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
                 opt = IP6CB(skb);
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 opt->nhoff = dstbuf;
 #else
                 opt->nhoff = opt->dst1;
@@ -371,22 +372,13 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
         struct rt0_hdr *rthdr;
         int accept_source_route = ipv6_devconf.accept_source_route;
 
-        if (accept_source_route < 0 ||
-            ((idev = in6_dev_get(skb->dev)) == NULL)) {
-                kfree_skb(skb);
-                return -1;
-        }
-        if (idev->cnf.accept_source_route < 0) {
+        idev = in6_dev_get(skb->dev);
+        if (idev) {
+                if (accept_source_route > idev->cnf.accept_source_route)
+                        accept_source_route = idev->cnf.accept_source_route;
                 in6_dev_put(idev);
-                kfree_skb(skb);
-                return -1;
         }
 
-        if (accept_source_route > idev->cnf.accept_source_route)
-                accept_source_route = idev->cnf.accept_source_route;
-
-        in6_dev_put(idev);
-
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
             !pskb_may_pull(skb, (skb_transport_offset(skb) +
                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
@@ -398,24 +390,6 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 
         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 
-        switch (hdr->type) {
-#ifdef CONFIG_IPV6_MIP6
-        case IPV6_SRCRT_TYPE_2:
-                break;
-#endif
-        case IPV6_SRCRT_TYPE_0:
-                if (accept_source_route > 0)
-                        break;
-                kfree_skb(skb);
-                return -1;
-        default:
-                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
-                                 IPSTATS_MIB_INHDRERRORS);
-                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
-                                  (&hdr->type) - skb_network_header(skb));
-                return -1;
-        }
-
         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
             skb->pkt_type != PACKET_HOST) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
@@ -427,7 +401,7 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 looped_back:
         if (hdr->segments_left == 0) {
                 switch (hdr->type) {
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 case IPV6_SRCRT_TYPE_2:
                         /* Silently discard type 2 header unless it was
                          * processed by own
@@ -453,18 +427,10 @@ looped_back:
         }
 
         switch (hdr->type) {
-        case IPV6_SRCRT_TYPE_0:
-                if (hdr->hdrlen & 0x01) {
-                        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
-                                         IPSTATS_MIB_INHDRERRORS);
-                        icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
-                                          ((&hdr->hdrlen) -
-                                           skb_network_header(skb)));
-                        return -1;
-                }
-                break;
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         case IPV6_SRCRT_TYPE_2:
+                if (accept_source_route < 0)
+                        goto unknown_rh;
                 /* Silently discard invalid RTH type 2 */
                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
                         IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
@@ -474,6 +440,8 @@ looped_back:
                 }
                 break;
 #endif
+        default:
+                goto unknown_rh;
         }
 
         /*
@@ -520,7 +488,7 @@ looped_back:
         addr += i - 1;
 
         switch (hdr->type) {
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         case IPV6_SRCRT_TYPE_2:
                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
@@ -577,6 +545,12 @@ looped_back:
         skb_push(skb, skb->data - skb_network_header(skb));
         dst_input(skb);
         return -1;
+
+unknown_rh:
+        IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
+        icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
+                          (&hdr->type) - skb_network_header(skb));
+        return -1;
 }
 
 static struct inet6_protocol rthdr_protocol = {
@@ -590,72 +564,6 @@ void __init ipv6_rthdr_init(void)
                 printk(KERN_ERR "ipv6_rthdr_init: Could not register protocol\n");
 };
 
-/*
-   This function inverts received rthdr.
-   NOTE: specs allow to make it automatically only if
-   packet authenticated.
-
-   I will not discuss it here (though, I am really pissed off at
-   this stupid requirement making rthdr idea useless)
-
-   Actually, it creates severe problems  for us.
-   Embryonic requests has no associated sockets,
-   so that user have no control over it and
-   cannot not only to set reply options, but
-   even to know, that someone wants to connect
-   without success. :-(
-
-   For now we need to test the engine, so that I created
-   temporary (or permanent) backdoor.
-   If listening socket set IPV6_RTHDR to 2, then we invert header.
-                                                   --ANK (980729)
- */
-
-struct ipv6_txoptions *
-ipv6_invert_rthdr(struct sock *sk, struct ipv6_rt_hdr *hdr)
-{
-        /* Received rthdr:
-
-           [ H1 -> H2 -> ... H_prev ]  daddr=ME
-
-           Inverted result:
-           [ H_prev -> ... -> H1 ] daddr =sender
-
-           Note, that IP output engine will rewrite this rthdr
-           by rotating it left by one addr.
-         */
-
-        int n, i;
-        struct rt0_hdr *rthdr = (struct rt0_hdr*)hdr;
-        struct rt0_hdr *irthdr;
-        struct ipv6_txoptions *opt;
-        int hdrlen = ipv6_optlen(hdr);
-
-        if (hdr->segments_left ||
-            hdr->type != IPV6_SRCRT_TYPE_0 ||
-            hdr->hdrlen & 0x01)
-                return NULL;
-
-        n = hdr->hdrlen >> 1;
-        opt = sock_kmalloc(sk, sizeof(*opt) + hdrlen, GFP_ATOMIC);
-        if (opt == NULL)
-                return NULL;
-        memset(opt, 0, sizeof(*opt));
-        opt->tot_len = sizeof(*opt) + hdrlen;
-        opt->srcrt = (void*)(opt+1);
-        opt->opt_nflen = hdrlen;
-
-        memcpy(opt->srcrt, hdr, sizeof(*hdr));
-        irthdr = (struct rt0_hdr*)opt->srcrt;
-        irthdr->reserved = 0;
-        opt->srcrt->segments_left = n;
-        for (i=0; i<n; i++)
-                memcpy(irthdr->addr+i, rthdr->addr+(n-1-i), 16);
-        return opt;
-}
-
-EXPORT_SYMBOL_GPL(ipv6_invert_rthdr);
-
 /**********************************
   Hop-by-hop options.
  **********************************/
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index e9bcce9e7b..6a6714d154 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -272,7 +272,7 @@ static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, st
         return 0;
 }
 
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 static void mip6_addr_swap(struct sk_buff *skb)
 {
         struct ipv6hdr *iph = ipv6_hdr(skb);
@@ -604,7 +604,7 @@ static void icmpv6_notify(struct sk_buff *skb, int type, int code, __be32 info)
 
         read_lock(&raw_v6_lock);
         if ((sk = sk_head(&raw_v6_htable[hash])) != NULL) {
-                while((sk = __raw_v6_lookup(sk, nexthdr, daddr, saddr,
+                while ((sk = __raw_v6_lookup(sk, nexthdr, saddr, daddr,
                                             IP6CB(skb)->iif))) {
                         rawv6_err(sk, skb, NULL, type, code, inner_offset, info);
                         sk = sk_next(sk);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index c206a152ed..413a4ebb19 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -648,7 +648,7 @@ static int ip6fl_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct seq_operations ip6fl_seq_ops = {
+static const struct seq_operations ip6fl_seq_ops = {
         .start  =       ip6fl_seq_start,
         .next   =       ip6fl_seq_next,
         .stop   =       ip6fl_seq_stop,
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4704b5fc30..50d86e94d9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -521,6 +521,10 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->tc_index = from->tc_index;
 #endif
         nf_copy(to, from);
+#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
+    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
+        to->nf_trace = from->nf_trace;
+#endif
         skb_copy_secmark(to, from);
 }
 
@@ -543,7 +547,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
                         found_rhdr = 1;
                         break;
                 case NEXTHDR_DEST:
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
                                 break;
 #endif
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index a0902fbdb4..281aee42d3 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -883,8 +883,8 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
          */
         max_headroom += LL_RESERVED_SPACE(tdev);
 
-        if (skb_headroom(skb) < max_headroom ||
-            skb_cloned(skb) || skb_shared(skb)) {
+        if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
+            (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
                 struct sk_buff *new_skb;
 
                 if (!(new_skb = skb_realloc_headroom(skb, max_headroom)))
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 1ee50b5782..473f165310 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -500,4 +500,4 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("IP Payload Compression Protocol (IPComp) for IPv6 - RFC3173");
 MODULE_AUTHOR("Mitsuru KANDA <mk@linux-ipv6.org>");
 
-
+MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_COMP);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index aa3d07c52a..d684639318 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -123,7 +123,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
         struct ipv6hdr *ipv6h;
         struct inet6_protocol *ops;
 
-        if (!(features & NETIF_F_HW_CSUM))
+        if (!(features & NETIF_F_V6_CSUM))
                 features &= ~NETIF_F_SG;
 
         if (unlikely(skb_shinfo(skb)->gso_type &
@@ -336,16 +336,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 break;
 
         case IPV6_RECVRTHDR:
-                if (val < 0 || val > 2)
-                        goto e_inval;
-                np->rxopt.bits.srcrt = val;
+                np->rxopt.bits.srcrt = valbool;
                 retv = 0;
                 break;
 
         case IPV6_2292RTHDR:
-                if (val < 0 || val > 2)
-                        goto e_inval;
-                np->rxopt.bits.osrcrt = val;
+                np->rxopt.bits.osrcrt = valbool;
                 retv = 0;
                 break;
 
@@ -416,11 +412,10 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 if (optname == IPV6_RTHDR && opt && opt->srcrt) {
                         struct ipv6_rt_hdr *rthdr = opt->srcrt;
                         switch (rthdr->type) {
-                        case IPV6_SRCRT_TYPE_0:
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         case IPV6_SRCRT_TYPE_2:
-#endif
                                 break;
+#endif
                         default:
                                 goto sticky_done;
                         }
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 3e308fb41b..ae9881832a 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2423,7 +2423,7 @@ static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct seq_operations igmp6_mc_seq_ops = {
+static const struct seq_operations igmp6_mc_seq_ops = {
         .start  =       igmp6_mc_seq_start,
         .next   =       igmp6_mc_seq_next,
         .stop   =       igmp6_mc_seq_stop,
@@ -2597,7 +2597,7 @@ static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct seq_operations igmp6_mcf_seq_ops = {
+static const struct seq_operations igmp6_mcf_seq_ops = {
         .start  =       igmp6_mcf_seq_start,
         .next   =       igmp6_mcf_seq_next,
         .stop   =       igmp6_mcf_seq_stop,
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 13b7160fb8..8a1399ce38 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -30,6 +30,7 @@
 #include <net/sock.h>
 #include <net/ipv6.h>
 #include <net/ip6_checksum.h>
+#include <net/rawv6.h>
 #include <net/xfrm.h>
 #include <net/mip6.h>
 
@@ -86,7 +87,7 @@ static int mip6_mh_len(int type)
         return len;
 }
 
-int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
+static int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
 {
         struct ip6_mh *mh;
 
@@ -471,7 +472,7 @@ static struct xfrm_type mip6_rthdr_type =
         .remote_addr    = mip6_xfrm_addr,
 };
 
-int __init mip6_init(void)
+static int __init mip6_init(void)
 {
         printk(KERN_INFO "Mobile IPv6\n");
 
@@ -483,18 +484,35 @@ int __init mip6_init(void)
                 printk(KERN_INFO "%s: can't add xfrm type(rthdr)\n", __FUNCTION__);
                 goto mip6_rthdr_xfrm_fail;
         }
+        if (rawv6_mh_filter_register(mip6_mh_filter) < 0) {
+                printk(KERN_INFO "%s: can't add rawv6 mh filter\n", __FUNCTION__);
+                goto mip6_rawv6_mh_fail;
+        }
+
+
         return 0;
 
+ mip6_rawv6_mh_fail:
+        xfrm_unregister_type(&mip6_rthdr_type, AF_INET6);
  mip6_rthdr_xfrm_fail:
         xfrm_unregister_type(&mip6_destopt_type, AF_INET6);
  mip6_destopt_xfrm_fail:
         return -EAGAIN;
 }
 
-void __exit mip6_fini(void)
+static void __exit mip6_fini(void)
 {
+        if (rawv6_mh_filter_unregister(mip6_mh_filter) < 0)
+                printk(KERN_INFO "%s: can't remove rawv6 mh filter\n", __FUNCTION__);
         if (xfrm_unregister_type(&mip6_rthdr_type, AF_INET6) < 0)
                 printk(KERN_INFO "%s: can't remove xfrm type(rthdr)\n", __FUNCTION__);
         if (xfrm_unregister_type(&mip6_destopt_type, AF_INET6) < 0)
                 printk(KERN_INFO "%s: can't remove xfrm type(destopt)\n", __FUNCTION__);
 }
+
+module_init(mip6_init);
+module_exit(mip6_fini);
+
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_DSTOPTS);
+MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_ROUTING);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index d8b36451ba..0358e6066a 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1062,7 +1062,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         pref = ra_msg->icmph.icmp6_router_pref;
         /* 10b is handled as if it were 00b (medium) */
         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
-            in6_dev->cnf.accept_ra_rtr_pref)
+            !in6_dev->cnf.accept_ra_rtr_pref)
                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
 #endif
 
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 9aa6240266..aeda617246 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -96,13 +96,13 @@ ip6t_ext_hdr(u8 nexthdr)
 }
 
 /* Returns whether matches rule or not. */
-static inline int
+static inline bool
 ip6_packet_match(const struct sk_buff *skb,
                  const char *indev,
                  const char *outdev,
                  const struct ip6t_ip6 *ip6info,
                  unsigned int *protoff,
-                 int *fragoff, int *hotdrop)
+                 int *fragoff, bool *hotdrop)
 {
         size_t i;
         unsigned long ret;
@@ -122,7 +122,7 @@ ip6_packet_match(const struct sk_buff *skb,
                 dprintf("DST: %u. Mask: %u. Target: %u.%s\n", ip->daddr,
                         ipinfo->dmsk.s_addr, ipinfo->dst.s_addr,
                         ipinfo->invflags & IP6T_INV_DSTIP ? " (INV)" : "");*/
-                return 0;
+                return false;
         }
 
         /* Look for ifname matches; this should unroll nicely. */
@@ -136,7 +136,7 @@ ip6_packet_match(const struct sk_buff *skb,
                 dprintf("VIA in mismatch (%s vs %s).%s\n",
                         indev, ip6info->iniface,
                         ip6info->invflags&IP6T_INV_VIA_IN ?" (INV)":"");
-                return 0;
+                return false;
         }
 
         for (i = 0, ret = 0; i < IFNAMSIZ/sizeof(unsigned long); i++) {
@@ -149,7 +149,7 @@ ip6_packet_match(const struct sk_buff *skb,
                 dprintf("VIA out mismatch (%s vs %s).%s\n",
                         outdev, ip6info->outiface,
                         ip6info->invflags&IP6T_INV_VIA_OUT ?" (INV)":"");
-                return 0;
+                return false;
         }
 
 /* ... might want to do something with class and flowlabel here ... */
@@ -162,8 +162,8 @@ ip6_packet_match(const struct sk_buff *skb,
                 protohdr = ipv6_find_hdr(skb, protoff, -1, &_frag_off);
                 if (protohdr < 0) {
                         if (_frag_off == 0)
-                                *hotdrop = 1;
-                        return 0;
+                                *hotdrop = true;
+                        return false;
                 }
                 *fragoff = _frag_off;
 
@@ -174,34 +174,34 @@ ip6_packet_match(const struct sk_buff *skb,
 
                 if (ip6info->proto == protohdr) {
                         if(ip6info->invflags & IP6T_INV_PROTO) {
-                                return 0;
+                                return false;
                         }
-                        return 1;
+                        return true;
                 }
 
                 /* We need match for the '-p all', too! */
                 if ((ip6info->proto != 0) &&
                         !(ip6info->invflags & IP6T_INV_PROTO))
-                        return 0;
+                        return false;
         }
-        return 1;
+        return true;
 }
 
 /* should be ip6 safe */
-static inline int
+static inline bool
 ip6_checkentry(const struct ip6t_ip6 *ipv6)
 {
         if (ipv6->flags & ~IP6T_F_MASK) {
                 duprintf("Unknown flag bits set: %08X\n",
                          ipv6->flags & ~IP6T_F_MASK);
-                return 0;
+                return false;
         }
         if (ipv6->invflags & ~IP6T_INV_MASK) {
                 duprintf("Unknown invflag bits set: %08X\n",
                          ipv6->invflags & ~IP6T_INV_MASK);
-                return 0;
+                return false;
         }
-        return 1;
+        return true;
 }
 
 static unsigned int
@@ -219,20 +219,20 @@ ip6t_error(struct sk_buff **pskb,
 }
 
 static inline
-int do_match(struct ip6t_entry_match *m,
-             const struct sk_buff *skb,
-             const struct net_device *in,
-             const struct net_device *out,
-             int offset,
-             unsigned int protoff,
-             int *hotdrop)
+bool do_match(struct ip6t_entry_match *m,
+              const struct sk_buff *skb,
+              const struct net_device *in,
+              const struct net_device *out,
+              int offset,
+              unsigned int protoff,
+              bool *hotdrop)
 {
         /* Stop iteration if it doesn't match */
         if (!m->u.kernel.match->match(skb, in, out, m->u.kernel.match, m->data,
                                       offset, protoff, hotdrop))
-                return 1;
+                return true;
         else
-                return 0;
+                return false;
 }
 
 static inline struct ip6t_entry *
@@ -241,6 +241,113 @@ get_entry(void *base, unsigned int offset)
         return (struct ip6t_entry *)(base + offset);
 }
 
+/* All zeroes == unconditional rule. */
+static inline int
+unconditional(const struct ip6t_ip6 *ipv6)
+{
+        unsigned int i;
+
+        for (i = 0; i < sizeof(*ipv6); i++)
+                if (((char *)ipv6)[i])
+                        break;
+
+        return (i == sizeof(*ipv6));
+}
+
+#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
+    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
+/* This cries for unification! */
+static const char *hooknames[] = {
+        [NF_IP6_PRE_ROUTING]            = "PREROUTING",
+        [NF_IP6_LOCAL_IN]               = "INPUT",
+        [NF_IP6_FORWARD]                = "FORWARD",
+        [NF_IP6_LOCAL_OUT]              = "OUTPUT",
+        [NF_IP6_POST_ROUTING]           = "POSTROUTING",
+};
+
+enum nf_ip_trace_comments {
+        NF_IP6_TRACE_COMMENT_RULE,
+        NF_IP6_TRACE_COMMENT_RETURN,
+        NF_IP6_TRACE_COMMENT_POLICY,
+};
+
+static const char *comments[] = {
+        [NF_IP6_TRACE_COMMENT_RULE]     = "rule",
+        [NF_IP6_TRACE_COMMENT_RETURN]   = "return",
+        [NF_IP6_TRACE_COMMENT_POLICY]   = "policy",
+};
+
+static struct nf_loginfo trace_loginfo = {
+        .type = NF_LOG_TYPE_LOG,
+        .u = {
+                .log = {
+                        .level = 4,
+                        .logflags = NF_LOG_MASK,
+                },
+        },
+};
+
+static inline int
+get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
+                      char *hookname, char **chainname,
+                      char **comment, unsigned int *rulenum)
+{
+        struct ip6t_standard_target *t = (void *)ip6t_get_target(s);
+
+        if (strcmp(t->target.u.kernel.target->name, IP6T_ERROR_TARGET) == 0) {
+                /* Head of user chain: ERROR target with chainname */
+                *chainname = t->target.data;
+                (*rulenum) = 0;
+        } else if (s == e) {
+                (*rulenum)++;
+
+                if (s->target_offset == sizeof(struct ip6t_entry)
+                   && strcmp(t->target.u.kernel.target->name,
+                             IP6T_STANDARD_TARGET) == 0
+                   && t->verdict < 0
+                   && unconditional(&s->ipv6)) {
+                        /* Tail of chains: STANDARD target (return/policy) */
+                        *comment = *chainname == hookname
+                                ? (char *)comments[NF_IP6_TRACE_COMMENT_POLICY]
+                                : (char *)comments[NF_IP6_TRACE_COMMENT_RETURN];
+                }
+                return 1;
+        } else
+                (*rulenum)++;
+
+        return 0;
+}
+
+static void trace_packet(struct sk_buff *skb,
+                         unsigned int hook,
+                         const struct net_device *in,
+                         const struct net_device *out,
+                         char *tablename,
+                         struct xt_table_info *private,
+                         struct ip6t_entry *e)
+{
+        void *table_base;
+        struct ip6t_entry *root;
+        char *hookname, *chainname, *comment;
+        unsigned int rulenum = 0;
+
+        table_base = (void *)private->entries[smp_processor_id()];
+        root = get_entry(table_base, private->hook_entry[hook]);
+
+        hookname = chainname = (char *)hooknames[hook];
+        comment = (char *)comments[NF_IP6_TRACE_COMMENT_RULE];
+
+        IP6T_ENTRY_ITERATE(root,
+                           private->size - private->hook_entry[hook],
+                           get_chainname_rulenum,
+                           e, hookname, &chainname, &comment, &rulenum);
+
+        nf_log_packet(AF_INET6, hook, skb, in, out, &trace_loginfo,
+                      "TRACE: %s:%s:%s:%u ",
+                      tablename, chainname, comment, rulenum);
+}
+#endif
+
 /* Returns one of the generic firewall policies, like NF_ACCEPT. */
 unsigned int
 ip6t_do_table(struct sk_buff **pskb,
@@ -252,7 +359,7 @@ ip6t_do_table(struct sk_buff **pskb,
         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
         int offset = 0;
         unsigned int protoff = 0;
-        int hotdrop = 0;
+        bool hotdrop = false;
         /* Initializing verdict to NF_DROP keeps gcc happy. */
         unsigned int verdict = NF_DROP;
         const char *indev, *outdev;
@@ -298,6 +405,14 @@ ip6t_do_table(struct sk_buff **pskb,
 
                         t = ip6t_get_target(e);
                         IP_NF_ASSERT(t->u.kernel.target);
+
+#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
+    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
+                        /* The packet is traced: log it */
+                        if (unlikely((*pskb)->nf_trace))
+                                trace_packet(*pskb, hook, in, out,
+                                             table->name, private, e);
+#endif
                         /* Standard target? */
                         if (!t->u.kernel.target->target) {
                                 int v;
@@ -377,19 +492,6 @@ ip6t_do_table(struct sk_buff **pskb,
 #endif
 }
 
-/* All zeroes == unconditional rule. */
-static inline int
-unconditional(const struct ip6t_ip6 *ipv6)
-{
-        unsigned int i;
-
-        for (i = 0; i < sizeof(*ipv6); i++)
-                if (((char *)ipv6)[i])
-                        break;
-
-        return (i == sizeof(*ipv6));
-}
-
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
@@ -1282,16 +1384,16 @@ void ip6t_unregister_table(struct xt_table *table)
 }
 
 /* Returns 1 if the type and code is matched by the range, 0 otherwise */
-static inline int
+static inline bool
 icmp6_type_code_match(u_int8_t test_type, u_int8_t min_code, u_int8_t max_code,
                      u_int8_t type, u_int8_t code,
-                     int invert)
+                     bool invert)
 {
         return (type == test_type && code >= min_code && code <= max_code)
                 ^ invert;
 }
 
-static int
+static bool
 icmp6_match(const struct sk_buff *skb,
            const struct net_device *in,
            const struct net_device *out,
@@ -1299,22 +1401,22 @@ icmp6_match(const struct sk_buff *skb,
            const void *matchinfo,
            int offset,
            unsigned int protoff,
-           int *hotdrop)
+           bool *hotdrop)
 {
         struct icmp6hdr _icmp, *ic;
         const struct ip6t_icmp *icmpinfo = matchinfo;
 
         /* Must not be a fragment. */
         if (offset)
-                return 0;
+                return false;
 
         ic = skb_header_pointer(skb, protoff, sizeof(_icmp), &_icmp);
         if (ic == NULL) {
                 /* We've been asked to examine this packet, and we
                    can't.  Hence, no choice but to drop. */
                 duprintf("Dropping evil ICMP tinygram.\n");
-                *hotdrop = 1;
-                return 0;
+                *hotdrop = true;
+                return false;
         }
 
         return icmp6_type_code_match(icmpinfo->type,
@@ -1325,7 +1427,7 @@ icmp6_match(const struct sk_buff *skb,
 }
 
 /* Called when user tries to insert an entry of this type. */
-static int
+static bool
 icmp6_checkentry(const char *tablename,
            const void *entry,
            const struct xt_match *match,
@@ -1339,13 +1441,13 @@ icmp6_checkentry(const char *tablename,
 }
 
 /* The built-in targets: standard (NULL) and error. */
-static struct xt_target ip6t_standard_target = {
+static struct xt_target ip6t_standard_target __read_mostly = {
         .name           = IP6T_STANDARD_TARGET,
         .targetsize     = sizeof(int),
         .family         = AF_INET6,
 };
 
-static struct xt_target ip6t_error_target = {
+static struct xt_target ip6t_error_target __read_mostly = {
         .name           = IP6T_ERROR_TARGET,
         .target         = ip6t_error,
         .targetsize     = IP6T_FUNCTION_MAXNAMELEN,
@@ -1362,7 +1464,7 @@ static struct nf_sockopt_ops ip6t_sockopts = {
         .get            = do_ip6t_get_ctl,
 };
 
-static struct xt_match icmp6_matchstruct = {
+static struct xt_match icmp6_matchstruct __read_mostly = {
         .name           = "icmp6",
         .match          = &icmp6_match,
         .matchsize      = sizeof(struct ip6t_icmp),
@@ -1395,7 +1497,7 @@ static int __init ip6_tables_init(void)
         if (ret < 0)
                 goto err5;
 
-        printk("ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
+        printk(KERN_INFO "ip6_tables: (C) 2000-2006 Netfilter Core Team\n");
         return 0;
 
 err5:
diff --git a/net/ipv6/netfilter/ip6t_HL.c b/net/ipv6/netfilter/ip6t_HL.c
index 4115a576ba..ad4d94310b 100644
--- a/net/ipv6/netfilter/ip6t_HL.c
+++ b/net/ipv6/netfilter/ip6t_HL.c
@@ -58,28 +58,28 @@ static unsigned int ip6t_hl_target(struct sk_buff **pskb,
         return XT_CONTINUE;
 }
 
-static int ip6t_hl_checkentry(const char *tablename,
+static bool ip6t_hl_checkentry(const char *tablename,
                 const void *entry,
                 const struct xt_target *target,
                 void *targinfo,
                 unsigned int hook_mask)
 {
-        struct ip6t_HL_info *info = targinfo;
+        const struct ip6t_HL_info *info = targinfo;
 
         if (info->mode > IP6T_HL_MAXMODE) {
                 printk(KERN_WARNING "ip6t_HL: invalid or unknown Mode %u\n",
                         info->mode);
-                return 0;
+                return false;
         }
-        if ((info->mode != IP6T_HL_SET) && (info->hop_limit == 0)) {
+        if (info->mode != IP6T_HL_SET && info->hop_limit == 0) {
                 printk(KERN_WARNING "ip6t_HL: increment/decrement doesn't "
                         "make sense with value 0\n");
-                return 0;
+                return false;
         }
-        return 1;
+        return true;
 }
 
-static struct xt_target ip6t_HL = {
+static struct xt_target ip6t_HL __read_mostly = {
         .name           = "HL",
         .family         = AF_INET6,
         .target         = ip6t_hl_target,
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 5bb9cd3493..b05327ebd3 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -32,12 +32,6 @@ struct in_device;
 #include <net/route.h>
 #include <linux/netfilter_ipv6/ip6t_LOG.h>
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
 /* Use lock to serialize, so printks don't overlap */
 static DEFINE_SPINLOCK(log_lock);
 
@@ -48,7 +42,8 @@ static void dump_packet(const struct nf_loginfo *info,
 {
         u_int8_t currenthdr;
         int fragment;
-        struct ipv6hdr _ip6h, *ih;
+        struct ipv6hdr _ip6h;
+        const struct ipv6hdr *ih;
         unsigned int ptr;
         unsigned int hdrlen = 0;
         unsigned int logflags;
@@ -78,7 +73,8 @@ static void dump_packet(const struct nf_loginfo *info,
         ptr = ip6hoff + sizeof(struct ipv6hdr);
         currenthdr = ih->nexthdr;
         while (currenthdr != NEXTHDR_NONE && ip6t_ext_hdr(currenthdr)) {
-                struct ipv6_opt_hdr _hdr, *hp;
+                struct ipv6_opt_hdr _hdr;
+                const struct ipv6_opt_hdr *hp;
 
                 hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
                 if (hp == NULL) {
@@ -92,7 +88,8 @@ static void dump_packet(const struct nf_loginfo *info,
 
                 switch (currenthdr) {
                 case IPPROTO_FRAGMENT: {
-                        struct frag_hdr _fhdr, *fh;
+                        struct frag_hdr _fhdr;
+                        const struct frag_hdr *fh;
 
                         printk("FRAG:");
                         fh = skb_header_pointer(skb, ptr, sizeof(_fhdr),
@@ -131,7 +128,8 @@ static void dump_packet(const struct nf_loginfo *info,
                 /* Max Length */
                 case IPPROTO_AH:
                         if (logflags & IP6T_LOG_IPOPT) {
-                                struct ip_auth_hdr _ahdr, *ah;
+                                struct ip_auth_hdr _ahdr;
+                                const struct ip_auth_hdr *ah;
 
                                 /* Max length: 3 "AH " */
                                 printk("AH ");
@@ -162,7 +160,8 @@ static void dump_packet(const struct nf_loginfo *info,
                         break;
                 case IPPROTO_ESP:
                         if (logflags & IP6T_LOG_IPOPT) {
-                                struct ip_esp_hdr _esph, *eh;
+                                struct ip_esp_hdr _esph;
+                                const struct ip_esp_hdr *eh;
 
                                 /* Max length: 4 "ESP " */
                                 printk("ESP ");
@@ -202,7 +201,8 @@ static void dump_packet(const struct nf_loginfo *info,
 
         switch (currenthdr) {
         case IPPROTO_TCP: {
-                struct tcphdr _tcph, *th;
+                struct tcphdr _tcph;
+                const struct tcphdr *th;
 
                 /* Max length: 10 "PROTO=TCP " */
                 printk("PROTO=TCP ");
@@ -250,7 +250,8 @@ static void dump_packet(const struct nf_loginfo *info,
 
                 if ((logflags & IP6T_LOG_TCPOPT)
                     && th->doff * 4 > sizeof(struct tcphdr)) {
-                        u_int8_t _opt[60 - sizeof(struct tcphdr)], *op;
+                        u_int8_t _opt[60 - sizeof(struct tcphdr)];
+                        const u_int8_t *op;
                         unsigned int i;
                         unsigned int optsize = th->doff * 4
                                                - sizeof(struct tcphdr);
@@ -273,7 +274,8 @@ static void dump_packet(const struct nf_loginfo *info,
         }
         case IPPROTO_UDP:
         case IPPROTO_UDPLITE: {
-                struct udphdr _udph, *uh;
+                struct udphdr _udph;
+                const struct udphdr *uh;
 
                 if (currenthdr == IPPROTO_UDP)
                         /* Max length: 10 "PROTO=UDP "     */
@@ -298,7 +300,8 @@ static void dump_packet(const struct nf_loginfo *info,
                 break;
         }
         case IPPROTO_ICMPV6: {
-                struct icmp6hdr _icmp6h, *ic;
+                struct icmp6hdr _icmp6h;
+                const struct icmp6hdr *ic;
 
                 /* Max length: 13 "PROTO=ICMPv6 " */
                 printk("PROTO=ICMPv6 ");
@@ -448,27 +451,27 @@ ip6t_log_target(struct sk_buff **pskb,
 }
 
 
-static int ip6t_log_checkentry(const char *tablename,
-                               const void *entry,
-                               const struct xt_target *target,
-                               void *targinfo,
-                               unsigned int hook_mask)
+static bool ip6t_log_checkentry(const char *tablename,
+                                const void *entry,
+                                const struct xt_target *target,
+                                void *targinfo,
+                                unsigned int hook_mask)
 {
         const struct ip6t_log_info *loginfo = targinfo;
 
         if (loginfo->level >= 8) {
-                DEBUGP("LOG: level %u >= 8\n", loginfo->level);
-                return 0;
+                pr_debug("LOG: level %u >= 8\n", loginfo->level);
+                return false;
         }
         if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
-                DEBUGP("LOG: prefix term %i\n",
-                       loginfo->prefix[sizeof(loginfo->prefix)-1]);
-                return 0;
+                pr_debug("LOG: prefix term %i\n",
+                         loginfo->prefix[sizeof(loginfo->prefix)-1]);
+                return false;
         }
-        return 1;
+        return true;
 }
 
-static struct xt_target ip6t_log_reg = {
+static struct xt_target ip6t_log_reg __read_mostly = {
         .name           = "LOG",
         .family         = AF_INET6,
         .target         = ip6t_log_target,
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index cb3d2415a0..2f487cda3b 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -34,12 +34,6 @@ MODULE_AUTHOR("Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>");
 MODULE_DESCRIPTION("IP6 tables REJECT target module");
 MODULE_LICENSE("GPL");
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
 /* Send RST reply */
 static void send_reset(struct sk_buff *oldskb)
 {
@@ -54,7 +48,7 @@ static void send_reset(struct sk_buff *oldskb)
 
         if ((!(ipv6_addr_type(&oip6h->saddr) & IPV6_ADDR_UNICAST)) ||
             (!(ipv6_addr_type(&oip6h->daddr) & IPV6_ADDR_UNICAST))) {
-                DEBUGP("ip6t_REJECT: addr is not unicast.\n");
+                pr_debug("ip6t_REJECT: addr is not unicast.\n");
                 return;
         }
 
@@ -62,16 +56,17 @@ static void send_reset(struct sk_buff *oldskb)
         tcphoff = ipv6_skip_exthdr(oldskb, ((u8*)(oip6h+1) - oldskb->data), &proto);
 
         if ((tcphoff < 0) || (tcphoff > oldskb->len)) {
-                DEBUGP("ip6t_REJECT: Can't get TCP header.\n");
+                pr_debug("ip6t_REJECT: Can't get TCP header.\n");
                 return;
         }
 
         otcplen = oldskb->len - tcphoff;
 
         /* IP header checks: fragment, too short. */
-        if ((proto != IPPROTO_TCP) || (otcplen < sizeof(struct tcphdr))) {
-                DEBUGP("ip6t_REJECT: proto(%d) != IPPROTO_TCP, or too short. otcplen = %d\n",
-                        proto, otcplen);
+        if (proto != IPPROTO_TCP || otcplen < sizeof(struct tcphdr)) {
+                pr_debug("ip6t_REJECT: proto(%d) != IPPROTO_TCP, "
+                         "or too short. otcplen = %d\n",
+                         proto, otcplen);
                 return;
         }
 
@@ -80,14 +75,14 @@ static void send_reset(struct sk_buff *oldskb)
 
         /* No RST for RST. */
         if (otcph.rst) {
-                DEBUGP("ip6t_REJECT: RST is set\n");
+                pr_debug("ip6t_REJECT: RST is set\n");
                 return;
         }
 
         /* Check checksum. */
         if (csum_ipv6_magic(&oip6h->saddr, &oip6h->daddr, otcplen, IPPROTO_TCP,
                             skb_checksum(oldskb, tcphoff, otcplen, 0))) {
-                DEBUGP("ip6t_REJECT: TCP checksum is invalid\n");
+                pr_debug("ip6t_REJECT: TCP checksum is invalid\n");
                 return;
         }
 
@@ -159,7 +154,7 @@ static void send_reset(struct sk_buff *oldskb)
         tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr,
                                       &ipv6_hdr(nskb)->daddr,
                                       sizeof(struct tcphdr), IPPROTO_TCP,
-                                      csum_partial((char *)tcph,
+                                      csum_partial(tcph,
                                                    sizeof(struct tcphdr), 0));
 
         nf_ct_attach(nskb, oldskb);
@@ -186,7 +181,7 @@ static unsigned int reject6_target(struct sk_buff **pskb,
 {
         const struct ip6t_reject_info *reject = targinfo;
 
-        DEBUGP(KERN_DEBUG "%s: medium point\n", __FUNCTION__);
+        pr_debug("%s: medium point\n", __FUNCTION__);
         /* WARNING: This code causes reentry within ip6tables.
            This means that the ip6tables jump stack is now crap.  We
            must return an absolute verdict. --RR */
@@ -221,30 +216,30 @@ static unsigned int reject6_target(struct sk_buff **pskb,
         return NF_DROP;
 }
 
-static int check(const char *tablename,
-                 const void *entry,
-                 const struct xt_target *target,
-                 void *targinfo,
-                 unsigned int hook_mask)
+static bool check(const char *tablename,
+                  const void *entry,
+                  const struct xt_target *target,
+                  void *targinfo,
+                  unsigned int hook_mask)
 {
         const struct ip6t_reject_info *rejinfo = targinfo;
         const struct ip6t_entry *e = entry;
 
         if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
                 printk("ip6t_REJECT: ECHOREPLY is not supported.\n");
-                return 0;
+                return false;
         } else if (rejinfo->with == IP6T_TCP_RESET) {
                 /* Must specify that it's a TCP packet */
                 if (e->ipv6.proto != IPPROTO_TCP
                     || (e->ipv6.invflags & XT_INV_PROTO)) {
-                        DEBUGP("ip6t_REJECT: TCP_RESET illegal for non-tcp\n");
-                        return 0;
+                        printk("ip6t_REJECT: TCP_RESET illegal for non-tcp\n");
+                        return false;
                 }
         }
-        return 1;
+        return true;
 }
 
-static struct xt_target ip6t_reject_reg = {
+static struct xt_target ip6t_reject_reg __read_mostly = {
         .name           = "REJECT",
         .family         = AF_INET6,
         .target         = reject6_target,
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index d3c154371b..2a25fe25e0 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -23,25 +23,20 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("IPv6 AH match");
 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
 /* Returns 1 if the spi is matched by the range, 0 otherwise */
-static inline int
-spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)
+static inline bool
+spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, bool invert)
 {
-        int r=0;
-        DEBUGP("ah spi_match:%c 0x%x <= 0x%x <= 0x%x",invert? '!':' ',
-               min,spi,max);
+        bool r;
+
+        pr_debug("ah spi_match:%c 0x%x <= 0x%x <= 0x%x",
+                 invert ? '!' : ' ', min, spi, max);
         r = (spi >= min && spi <= max) ^ invert;
-        DEBUGP(" result %s\n",r? "PASS\n" : "FAILED\n");
+        pr_debug(" result %s\n", r ? "PASS" : "FAILED");
         return r;
 }
 
-static int
+static bool
 match(const struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
@@ -49,9 +44,10 @@ match(const struct sk_buff *skb,
       const void *matchinfo,
       int offset,
       unsigned int protoff,
-      int *hotdrop)
+      bool *hotdrop)
 {
-        struct ip_auth_hdr *ah, _ah;
+        struct ip_auth_hdr _ah;
+        const struct ip_auth_hdr *ah;
         const struct ip6t_ah *ahinfo = matchinfo;
         unsigned int ptr;
         unsigned int hdrlen = 0;
@@ -60,40 +56,40 @@ match(const struct sk_buff *skb,
         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_AUTH, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *hotdrop = 1;
-                return 0;
+                        *hotdrop = true;
+                return false;
         }
 
         ah = skb_header_pointer(skb, ptr, sizeof(_ah), &_ah);
         if (ah == NULL) {
-                *hotdrop = 1;
-                return 0;
+                *hotdrop = true;
+                return false;
         }
 
         hdrlen = (ah->hdrlen + 2) << 2;
 
-        DEBUGP("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
-        DEBUGP("RES %04X ", ah->reserved);
-        DEBUGP("SPI %u %08X\n", ntohl(ah->spi), ntohl(ah->spi));
-
-        DEBUGP("IPv6 AH spi %02X ",
-               (spi_match(ahinfo->spis[0], ahinfo->spis[1],
-                          ntohl(ah->spi),
-                          !!(ahinfo->invflags & IP6T_AH_INV_SPI))));
-        DEBUGP("len %02X %04X %02X ",
-               ahinfo->hdrlen, hdrlen,
-               (!ahinfo->hdrlen ||
-                (ahinfo->hdrlen == hdrlen) ^
-                !!(ahinfo->invflags & IP6T_AH_INV_LEN)));
-        DEBUGP("res %02X %04X %02X\n",
-               ahinfo->hdrres, ah->reserved,
-               !(ahinfo->hdrres && ah->reserved));
+        pr_debug("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
+        pr_debug("RES %04X ", ah->reserved);
+        pr_debug("SPI %u %08X\n", ntohl(ah->spi), ntohl(ah->spi));
+
+        pr_debug("IPv6 AH spi %02X ",
+                 spi_match(ahinfo->spis[0], ahinfo->spis[1],
+                           ntohl(ah->spi),
+                           !!(ahinfo->invflags & IP6T_AH_INV_SPI)));
+        pr_debug("len %02X %04X %02X ",
+                 ahinfo->hdrlen, hdrlen,
+                 (!ahinfo->hdrlen ||
+                  (ahinfo->hdrlen == hdrlen) ^
+                  !!(ahinfo->invflags & IP6T_AH_INV_LEN)));
+        pr_debug("res %02X %04X %02X\n",
+                 ahinfo->hdrres, ah->reserved,
+                 !(ahinfo->hdrres && ah->reserved));
 
         return (ah != NULL)
                &&
-               (spi_match(ahinfo->spis[0], ahinfo->spis[1],
-                          ntohl(ah->spi),
-                          !!(ahinfo->invflags & IP6T_AH_INV_SPI)))
+               spi_match(ahinfo->spis[0], ahinfo->spis[1],
+                         ntohl(ah->spi),
+                         !!(ahinfo->invflags & IP6T_AH_INV_SPI))
                &&
                (!ahinfo->hdrlen ||
                 (ahinfo->hdrlen == hdrlen) ^
@@ -103,7 +99,7 @@ match(const struct sk_buff *skb,
 }
 
 /* Called when user tries to insert an entry of this type. */
-static int
+static bool
 checkentry(const char *tablename,
           const void *entry,
           const struct xt_match *match,
@@ -113,13 +109,13 @@ checkentry(const char *tablename,
         const struct ip6t_ah *ahinfo = matchinfo;
 
         if (ahinfo->invflags & ~IP6T_AH_INV_MASK) {
-                DEBUGP("ip6t_ah: unknown flags %X\n", ahinfo->invflags);
-                return 0;
+                pr_debug("ip6t_ah: unknown flags %X\n", ahinfo->invflags);
+                return false;
         }
-        return 1;
+        return true;
 }
 
-static struct xt_match ah_match = {
+static struct xt_match ah_match __read_mostly = {
         .name           = "ah",
         .family         = AF_INET6,
         .match          = match,
diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c
index 0f3dd932f0..34ba150bfe 100644
--- a/net/ipv6/netfilter/ip6t_eui64.c
+++ b/net/ipv6/netfilter/ip6t_eui64.c
@@ -19,7 +19,7 @@ MODULE_DESCRIPTION("IPv6 EUI64 address checking match");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 
-static int
+static bool
 match(const struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
@@ -27,16 +27,16 @@ match(const struct sk_buff *skb,
       const void *matchinfo,
       int offset,
       unsigned int protoff,
-      int *hotdrop)
+      bool *hotdrop)
 {
         unsigned char eui64[8];
         int i = 0;
 
         if (!(skb_mac_header(skb) >= skb->head &&
-              (skb_mac_header(skb) + ETH_HLEN) <= skb->data) &&
+              skb_mac_header(skb) + ETH_HLEN <= skb->data) &&
             offset != 0) {
-                *hotdrop = 1;
-                return 0;
+                *hotdrop = true;
+                return false;
         }
 
         memset(eui64, 0, sizeof(eui64));
@@ -50,19 +50,19 @@ match(const struct sk_buff *skb,
                         eui64[0] |= 0x02;
 
                         i = 0;
-                        while ((ipv6_hdr(skb)->saddr.s6_addr[8 + i] == eui64[i])
-                               && (i < 8))
+                        while (ipv6_hdr(skb)->saddr.s6_addr[8 + i] == eui64[i]
+                               && i < 8)
                                 i++;
 
                         if (i == 8)
-                                return 1;
+                                return true;
                 }
         }
 
-        return 0;
+        return false;
 }
 
-static struct xt_match eui64_match = {
+static struct xt_match eui64_match __read_mostly = {
         .name           = "eui64",
         .family         = AF_INET6,
         .match          = match,
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 5a5da71321..968aeba020 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -22,25 +22,19 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("IPv6 FRAG match");
 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
 /* Returns 1 if the id is matched by the range, 0 otherwise */
-static inline int
-id_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
+static inline bool
+id_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
 {
-        int r = 0;
-        DEBUGP("frag id_match:%c 0x%x <= 0x%x <= 0x%x", invert ? '!' : ' ',
-               min, id, max);
+        bool r;
+        pr_debug("frag id_match:%c 0x%x <= 0x%x <= 0x%x", invert ? '!' : ' ',
+                 min, id, max);
         r = (id >= min && id <= max) ^ invert;
-        DEBUGP(" result %s\n", r ? "PASS" : "FAILED");
+        pr_debug(" result %s\n", r ? "PASS" : "FAILED");
         return r;
 }
 
-static int
+static bool
 match(const struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
@@ -48,9 +42,10 @@ match(const struct sk_buff *skb,
       const void *matchinfo,
       int offset,
       unsigned int protoff,
-      int *hotdrop)
+      bool *hotdrop)
 {
-        struct frag_hdr _frag, *fh;
+        struct frag_hdr _frag;
+        const struct frag_hdr *fh;
         const struct ip6t_frag *fraginfo = matchinfo;
         unsigned int ptr;
         int err;
@@ -58,53 +53,53 @@ match(const struct sk_buff *skb,
         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_FRAGMENT, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *hotdrop = 1;
-                return 0;
+                        *hotdrop = true;
+                return false;
         }
 
         fh = skb_header_pointer(skb, ptr, sizeof(_frag), &_frag);
         if (fh == NULL) {
-                *hotdrop = 1;
-                return 0;
+                *hotdrop = true;
+                return false;
         }
 
-        DEBUGP("INFO %04X ", fh->frag_off);
-        DEBUGP("OFFSET %04X ", ntohs(fh->frag_off) & ~0x7);
-        DEBUGP("RES %02X %04X", fh->reserved, ntohs(fh->frag_off) & 0x6);
-        DEBUGP("MF %04X ", fh->frag_off & htons(IP6_MF));
-        DEBUGP("ID %u %08X\n", ntohl(fh->identification),
-               ntohl(fh->identification));
-
-        DEBUGP("IPv6 FRAG id %02X ",
-               (id_match(fraginfo->ids[0], fraginfo->ids[1],
-                         ntohl(fh->identification),
-                         !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))));
-        DEBUGP("res %02X %02X%04X %02X ",
-               (fraginfo->flags & IP6T_FRAG_RES), fh->reserved,
-               ntohs(fh->frag_off) & 0x6,
-               !((fraginfo->flags & IP6T_FRAG_RES)
-                 && (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
-        DEBUGP("first %02X %02X %02X ",
-               (fraginfo->flags & IP6T_FRAG_FST),
-               ntohs(fh->frag_off) & ~0x7,
-               !((fraginfo->flags & IP6T_FRAG_FST)
-                 && (ntohs(fh->frag_off) & ~0x7)));
-        DEBUGP("mf %02X %02X %02X ",
-               (fraginfo->flags & IP6T_FRAG_MF),
-               ntohs(fh->frag_off) & IP6_MF,
-               !((fraginfo->flags & IP6T_FRAG_MF)
-                 && !((ntohs(fh->frag_off) & IP6_MF))));
-        DEBUGP("last %02X %02X %02X\n",
-               (fraginfo->flags & IP6T_FRAG_NMF),
-               ntohs(fh->frag_off) & IP6_MF,
-               !((fraginfo->flags & IP6T_FRAG_NMF)
-                 && (ntohs(fh->frag_off) & IP6_MF)));
+        pr_debug("INFO %04X ", fh->frag_off);
+        pr_debug("OFFSET %04X ", ntohs(fh->frag_off) & ~0x7);
+        pr_debug("RES %02X %04X", fh->reserved, ntohs(fh->frag_off) & 0x6);
+        pr_debug("MF %04X ", fh->frag_off & htons(IP6_MF));
+        pr_debug("ID %u %08X\n", ntohl(fh->identification),
+                 ntohl(fh->identification));
+
+        pr_debug("IPv6 FRAG id %02X ",
+                 id_match(fraginfo->ids[0], fraginfo->ids[1],
+                          ntohl(fh->identification),
+                          !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)));
+        pr_debug("res %02X %02X%04X %02X ",
+                 fraginfo->flags & IP6T_FRAG_RES, fh->reserved,
+                 ntohs(fh->frag_off) & 0x6,
+                 !((fraginfo->flags & IP6T_FRAG_RES)
+                   && (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
+        pr_debug("first %02X %02X %02X ",
+                 fraginfo->flags & IP6T_FRAG_FST,
+                 ntohs(fh->frag_off) & ~0x7,
+                 !((fraginfo->flags & IP6T_FRAG_FST)
+                   && (ntohs(fh->frag_off) & ~0x7)));
+        pr_debug("mf %02X %02X %02X ",
+                 fraginfo->flags & IP6T_FRAG_MF,
+                 ntohs(fh->frag_off) & IP6_MF,
+                 !((fraginfo->flags & IP6T_FRAG_MF)
+                   && !((ntohs(fh->frag_off) & IP6_MF))));
+        pr_debug("last %02X %02X %02X\n",
+                 fraginfo->flags & IP6T_FRAG_NMF,
+                 ntohs(fh->frag_off) & IP6_MF,
+                 !((fraginfo->flags & IP6T_FRAG_NMF)
+                   && (ntohs(fh->frag_off) & IP6_MF)));
 
         return (fh != NULL)
                &&
-               (id_match(fraginfo->ids[0], fraginfo->ids[1],
-                         ntohl(fh->identification),
-                         !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)))
+               id_match(fraginfo->ids[0], fraginfo->ids[1],
+                        ntohl(fh->identification),
+                        !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))
                &&
                !((fraginfo->flags & IP6T_FRAG_RES)
                  && (fh->reserved || (ntohs(fh->frag_off) & 0x6)))
@@ -120,7 +115,7 @@ match(const struct sk_buff *skb,
 }
 
 /* Called when user tries to insert an entry of this type. */
-static int
+static bool
 checkentry(const char *tablename,
            const void *ip,
            const struct xt_match *match,
@@ -130,13 +125,13 @@ checkentry(const char *tablename,
         const struct ip6t_frag *fraginfo = matchinfo;
 
         if (fraginfo->invflags & ~IP6T_FRAG_INV_MASK) {
-                DEBUGP("ip6t_frag: unknown flags %X\n", fraginfo->invflags);
-                return 0;
+                pr_debug("ip6t_frag: unknown flags %X\n", fraginfo->invflags);
+                return false;
         }
-        return 1;
+        return true;
 }
 
-static struct xt_match frag_match = {
+static struct xt_match frag_match __read_mostly = {
         .name           = "frag",
         .family         = AF_INET6,
         .match          = match,
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index d2373c7cd3..e6ca6018b1 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -25,12 +25,6 @@ MODULE_DESCRIPTION("IPv6 opts match");
 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 MODULE_ALIAS("ip6t_dst");
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
 /*
  *  (Type & 0xC0) >> 6
  *      0       -> ignorable
@@ -47,7 +41,7 @@ MODULE_ALIAS("ip6t_dst");
  *      5       -> RTALERT 2 x x
  */
 
-static int
+static bool
 match(const struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
@@ -55,45 +49,48 @@ match(const struct sk_buff *skb,
       const void *matchinfo,
       int offset,
       unsigned int protoff,
-      int *hotdrop)
+      bool *hotdrop)
 {
-        struct ipv6_opt_hdr _optsh, *oh;
+        struct ipv6_opt_hdr _optsh;
+        const struct ipv6_opt_hdr *oh;
         const struct ip6t_opts *optinfo = matchinfo;
         unsigned int temp;
         unsigned int ptr;
         unsigned int hdrlen = 0;
-        unsigned int ret = 0;
-        u8 _opttype, *tp = NULL;
-        u8 _optlen, *lp = NULL;
+        bool ret = false;
+        u8 _opttype;
+        u8 _optlen;
+        const u_int8_t *tp = NULL;
+        const u_int8_t *lp = NULL;
         unsigned int optlen;
         int err;
 
         err = ipv6_find_hdr(skb, &ptr, match->data, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *hotdrop = 1;
-                return 0;
+                        *hotdrop = true;
+                return false;
         }
 
         oh = skb_header_pointer(skb, ptr, sizeof(_optsh), &_optsh);
         if (oh == NULL) {
-                *hotdrop = 1;
-                return 0;
+                *hotdrop = true;
+                return false;
         }
 
         hdrlen = ipv6_optlen(oh);
         if (skb->len - ptr < hdrlen) {
                 /* Packet smaller than it's length field */
-                return 0;
+                return false;
         }
 
-        DEBUGP("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
+        pr_debug("IPv6 OPTS LEN %u %u ", hdrlen, oh->hdrlen);
 
-        DEBUGP("len %02X %04X %02X ",
-               optinfo->hdrlen, hdrlen,
-               (!(optinfo->flags & IP6T_OPTS_LEN) ||
-                ((optinfo->hdrlen == hdrlen) ^
-                 !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
+        pr_debug("len %02X %04X %02X ",
+                 optinfo->hdrlen, hdrlen,
+                 (!(optinfo->flags & IP6T_OPTS_LEN) ||
+                  ((optinfo->hdrlen == hdrlen) ^
+                   !!(optinfo->invflags & IP6T_OPTS_INV_LEN))));
 
         ret = (oh != NULL) &&
               (!(optinfo->flags & IP6T_OPTS_LEN) ||
@@ -105,10 +102,10 @@ match(const struct sk_buff *skb,
         if (!(optinfo->flags & IP6T_OPTS_OPTS)) {
                 return ret;
         } else if (optinfo->flags & IP6T_OPTS_NSTRICT) {
-                DEBUGP("Not strict - not implemented");
+                pr_debug("Not strict - not implemented");
         } else {
-                DEBUGP("Strict ");
-                DEBUGP("#%d ", optinfo->optsnr);
+                pr_debug("Strict ");
+                pr_debug("#%d ", optinfo->optsnr);
                 for (temp = 0; temp < optinfo->optsnr; temp++) {
                         /* type field exists ? */
                         if (hdrlen < 1)
@@ -120,12 +117,11 @@ match(const struct sk_buff *skb,
 
                         /* Type check */
                         if (*tp != (optinfo->opts[temp] & 0xFF00) >> 8) {
-                                DEBUGP("Tbad %02X %02X\n",
-                                       *tp,
-                                       (optinfo->opts[temp] & 0xFF00) >> 8);
-                                return 0;
+                                pr_debug("Tbad %02X %02X\n", *tp,
+                                         (optinfo->opts[temp] & 0xFF00) >> 8);
+                                return false;
                         } else {
-                                DEBUGP("Tok ");
+                                pr_debug("Tok ");
                         }
                         /* Length check */
                         if (*tp) {
@@ -142,23 +138,23 @@ match(const struct sk_buff *skb,
                                 spec_len = optinfo->opts[temp] & 0x00FF;
 
                                 if (spec_len != 0x00FF && spec_len != *lp) {
-                                        DEBUGP("Lbad %02X %04X\n", *lp,
-                                               spec_len);
-                                        return 0;
+                                        pr_debug("Lbad %02X %04X\n", *lp,
+                                                 spec_len);
+                                        return false;
                                 }
-                                DEBUGP("Lok ");
+                                pr_debug("Lok ");
                                 optlen = *lp + 2;
                         } else {
-                                DEBUGP("Pad1\n");
+                                pr_debug("Pad1\n");
                                 optlen = 1;
                         }
 
                         /* Step to the next */
-                        DEBUGP("len%04X \n", optlen);
+                        pr_debug("len%04X \n", optlen);
 
                         if ((ptr > skb->len - optlen || hdrlen < optlen) &&
-                            (temp < optinfo->optsnr - 1)) {
-                                DEBUGP("new pointer is too large! \n");
+                            temp < optinfo->optsnr - 1) {
+                                pr_debug("new pointer is too large! \n");
                                 break;
                         }
                         ptr += optlen;
@@ -167,14 +163,14 @@ match(const struct sk_buff *skb,
                 if (temp == optinfo->optsnr)
                         return ret;
                 else
-                        return 0;
+                        return false;
         }
 
-        return 0;
+        return false;
 }
 
 /* Called when user tries to insert an entry of this type. */
-static int
+static bool
 checkentry(const char *tablename,
            const void *entry,
            const struct xt_match *match,
@@ -184,13 +180,13 @@ checkentry(const char *tablename,
         const struct ip6t_opts *optsinfo = matchinfo;
 
         if (optsinfo->invflags & ~IP6T_OPTS_INV_MASK) {
-                DEBUGP("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
-                return 0;
+                pr_debug("ip6t_opts: unknown flags %X\n", optsinfo->invflags);
+                return false;
         }
-        return 1;
+        return true;
 }
 
-static struct xt_match opts_match[] = {
+static struct xt_match opts_match[] __read_mostly = {
         {
                 .name           = "hbh",
                 .family         = AF_INET6,
diff --git a/net/ipv6/netfilter/ip6t_hl.c b/net/ipv6/netfilter/ip6t_hl.c
index d606c0e6d6..ca29ec00dc 100644
--- a/net/ipv6/netfilter/ip6t_hl.c
+++ b/net/ipv6/netfilter/ip6t_hl.c
@@ -19,37 +19,37 @@ MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
 MODULE_DESCRIPTION("IP tables Hop Limit matching module");
 MODULE_LICENSE("GPL");
 
-static int match(const struct sk_buff *skb,
-                 const struct net_device *in, const struct net_device *out,
-                 const struct xt_match *match, const void *matchinfo,
-                 int offset, unsigned int protoff, int *hotdrop)
+static bool match(const struct sk_buff *skb,
+                  const struct net_device *in, const struct net_device *out,
+                  const struct xt_match *match, const void *matchinfo,
+                  int offset, unsigned int protoff, bool *hotdrop)
 {
         const struct ip6t_hl_info *info = matchinfo;
         const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 
         switch (info->mode) {
                 case IP6T_HL_EQ:
-                        return (ip6h->hop_limit == info->hop_limit);
+                        return ip6h->hop_limit == info->hop_limit;
                         break;
                 case IP6T_HL_NE:
-                        return (!(ip6h->hop_limit == info->hop_limit));
+                        return ip6h->hop_limit != info->hop_limit;
                         break;
                 case IP6T_HL_LT:
-                        return (ip6h->hop_limit < info->hop_limit);
+                        return ip6h->hop_limit < info->hop_limit;
                         break;
                 case IP6T_HL_GT:
-                        return (ip6h->hop_limit > info->hop_limit);
+                        return ip6h->hop_limit > info->hop_limit;
                         break;
                 default:
                         printk(KERN_WARNING "ip6t_hl: unknown mode %d\n",
                                 info->mode);
-                        return 0;
+                        return false;
         }
 
-        return 0;
+        return false;
 }
 
-static struct xt_match hl_match = {
+static struct xt_match hl_match __read_mostly = {
         .name           = "hl",
         .family         = AF_INET6,
         .match          = match,
diff --git a/net/ipv6/netfilter/ip6t_ipv6header.c b/net/ipv6/netfilter/ip6t_ipv6header.c
index fd6a086909..2c65c2f9a4 100644
--- a/net/ipv6/netfilter/ip6t_ipv6header.c
+++ b/net/ipv6/netfilter/ip6t_ipv6header.c
@@ -26,7 +26,7 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("IPv6 headers match");
 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 
-static int
+static bool
 ipv6header_match(const struct sk_buff *skb,
                  const struct net_device *in,
                  const struct net_device *out,
@@ -34,7 +34,7 @@ ipv6header_match(const struct sk_buff *skb,
                  const void *matchinfo,
                  int offset,
                  unsigned int protoff,
-                 int *hotdrop)
+                 bool *hotdrop)
 {
         const struct ip6t_ipv6header_info *info = matchinfo;
         unsigned int temp;
@@ -58,7 +58,7 @@ ipv6header_match(const struct sk_buff *skb,
 
                 /* Is there enough space for the next ext header? */
                 if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return 0;
+                        return false;
                 /* No more exthdr -> evaluate */
                 if (nexthdr == NEXTHDR_NONE) {
                         temp |= MASK_NONE;
@@ -74,9 +74,9 @@ ipv6header_match(const struct sk_buff *skb,
                 BUG_ON(hp == NULL);
 
                 /* Calculate the header length */
-                if (nexthdr == NEXTHDR_FRAGMENT) {
+                if (nexthdr == NEXTHDR_FRAGMENT)
                         hdrlen = 8;
-                } else if (nexthdr == NEXTHDR_AUTH)
+                else if (nexthdr == NEXTHDR_AUTH)
                         hdrlen = (hp->hdrlen + 2) << 2;
                 else
                         hdrlen = ipv6_optlen(hp);
@@ -99,7 +99,7 @@ ipv6header_match(const struct sk_buff *skb,
                         temp |= MASK_DSTOPTS;
                         break;
                 default:
-                        return 0;
+                        return false;
                         break;
                 }
 
@@ -110,7 +110,7 @@ ipv6header_match(const struct sk_buff *skb,
                         break;
         }
 
-        if ((nexthdr != NEXTHDR_NONE) && (nexthdr != NEXTHDR_ESP))
+        if (nexthdr != NEXTHDR_NONE && nexthdr != NEXTHDR_ESP)
                 temp |= MASK_PROTO;
 
         if (info->modeflag)
@@ -124,7 +124,7 @@ ipv6header_match(const struct sk_buff *skb,
         }
 }
 
-static int
+static bool
 ipv6header_checkentry(const char *tablename,
                       const void *ip,
                       const struct xt_match *match,
@@ -136,12 +136,12 @@ ipv6header_checkentry(const char *tablename,
         /* invflags is 0 or 0xff in hard mode */
         if ((!info->modeflag) && info->invflags != 0x00 &&
             info->invflags != 0xFF)
-                return 0;
+                return false;
 
-        return 1;
+        return true;
 }
 
-static struct xt_match ip6t_ipv6header_match = {
+static struct xt_match ip6t_ipv6header_match __read_mostly = {
         .name           = "ipv6header",
         .family         = AF_INET6,
         .match          = &ipv6header_match,
diff --git a/net/ipv6/netfilter/ip6t_mh.c b/net/ipv6/netfilter/ip6t_mh.c
index c2a909893a..0fa714092d 100644
--- a/net/ipv6/netfilter/ip6t_mh.c
+++ b/net/ipv6/netfilter/ip6t_mh.c
@@ -31,16 +31,13 @@ MODULE_LICENSE("GPL");
 #endif
 
 /* Returns 1 if the type is matched by the range, 0 otherwise */
-static inline int
-type_match(u_int8_t min, u_int8_t max, u_int8_t type, int invert)
+static inline bool
+type_match(u_int8_t min, u_int8_t max, u_int8_t type, bool invert)
 {
-        int ret;
-
-        ret = (type >= min && type <= max) ^ invert;
-        return ret;
+        return (type >= min && type <= max) ^ invert;
 }
 
-static int
+static bool
 match(const struct sk_buff *skb,
          const struct net_device *in,
          const struct net_device *out,
@@ -48,29 +45,30 @@ match(const struct sk_buff *skb,
          const void *matchinfo,
          int offset,
          unsigned int protoff,
-         int *hotdrop)
+         bool *hotdrop)
 {
-        struct ip6_mh _mh, *mh;
+        struct ip6_mh _mh;
+        const struct ip6_mh *mh;
         const struct ip6t_mh *mhinfo = matchinfo;
 
         /* Must not be a fragment. */
         if (offset)
-                return 0;
+                return false;
 
         mh = skb_header_pointer(skb, protoff, sizeof(_mh), &_mh);
         if (mh == NULL) {
                 /* We've been asked to examine this packet, and we
                    can't.  Hence, no choice but to drop. */
                 duprintf("Dropping evil MH tinygram.\n");
-                *hotdrop = 1;
-                return 0;
+                *hotdrop = true;
+                return false;
         }
 
         if (mh->ip6mh_proto != IPPROTO_NONE) {
                 duprintf("Dropping invalid MH Payload Proto: %u\n",
                          mh->ip6mh_proto);
-                *hotdrop = 1;
-                return 0;
+                *hotdrop = true;
+                return false;
         }
 
         return type_match(mhinfo->types[0], mhinfo->types[1], mh->ip6mh_type,
@@ -78,7 +76,7 @@ match(const struct sk_buff *skb,
 }
 
 /* Called when user tries to insert an entry of this type. */
-static int
+static bool
 mh_checkentry(const char *tablename,
               const void *entry,
               const struct xt_match *match,
@@ -91,7 +89,7 @@ mh_checkentry(const char *tablename,
         return !(mhinfo->invflags & ~IP6T_MH_INV_MASK);
 }
 
-static struct xt_match mh_match = {
+static struct xt_match mh_match __read_mostly = {
         .name           = "mh",
         .family         = AF_INET6,
         .checkentry     = mh_checkentry,
diff --git a/net/ipv6/netfilter/ip6t_owner.c b/net/ipv6/netfilter/ip6t_owner.c
index 43738bba00..6036613aef 100644
--- a/net/ipv6/netfilter/ip6t_owner.c
+++ b/net/ipv6/netfilter/ip6t_owner.c
@@ -23,7 +23,7 @@ MODULE_DESCRIPTION("IP6 tables owner matching module");
 MODULE_LICENSE("GPL");
 
 
-static int
+static bool
 match(const struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
@@ -31,29 +31,27 @@ match(const struct sk_buff *skb,
       const void *matchinfo,
       int offset,
       unsigned int protoff,
-      int *hotdrop)
+      bool *hotdrop)
 {
         const struct ip6t_owner_info *info = matchinfo;
 
         if (!skb->sk || !skb->sk->sk_socket || !skb->sk->sk_socket->file)
-                return 0;
+                return false;
 
-        if (info->match & IP6T_OWNER_UID) {
+        if (info->match & IP6T_OWNER_UID)
                 if ((skb->sk->sk_socket->file->f_uid != info->uid) ^
                     !!(info->invert & IP6T_OWNER_UID))
-                        return 0;
-        }
+                        return false;
 
-        if (info->match & IP6T_OWNER_GID) {
+        if (info->match & IP6T_OWNER_GID)
                 if ((skb->sk->sk_socket->file->f_gid != info->gid) ^
                     !!(info->invert & IP6T_OWNER_GID))
-                        return 0;
-        }
+                        return false;
 
-        return 1;
+        return true;
 }
 
-static int
+static bool
 checkentry(const char *tablename,
            const void *ip,
            const struct xt_match *match,
@@ -65,12 +63,12 @@ checkentry(const char *tablename,
         if (info->match & (IP6T_OWNER_PID | IP6T_OWNER_SID)) {
                 printk("ipt_owner: pid and sid matching "
                        "not supported anymore\n");
-                return 0;
+                return false;
         }
-        return 1;
+        return true;
 }
 
-static struct xt_match owner_match = {
+static struct xt_match owner_match __read_mostly = {
         .name           = "owner",
         .family         = AF_INET6,
         .match          = match,
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 81ab00d8c1..357cea703b 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -24,25 +24,19 @@ MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("IPv6 RT match");
 MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
 /* Returns 1 if the id is matched by the range, 0 otherwise */
-static inline int
-segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, int invert)
+static inline bool
+segsleft_match(u_int32_t min, u_int32_t max, u_int32_t id, bool invert)
 {
-        int r = 0;
-        DEBUGP("rt segsleft_match:%c 0x%x <= 0x%x <= 0x%x",
-               invert ? '!' : ' ', min, id, max);
+        bool r;
+        pr_debug("rt segsleft_match:%c 0x%x <= 0x%x <= 0x%x",
+                 invert ? '!' : ' ', min, id, max);
         r = (id >= min && id <= max) ^ invert;
-        DEBUGP(" result %s\n", r ? "PASS" : "FAILED");
+        pr_debug(" result %s\n", r ? "PASS" : "FAILED");
         return r;
 }
 
-static int
+static bool
 match(const struct sk_buff *skb,
       const struct net_device *in,
       const struct net_device *out,
@@ -50,59 +44,61 @@ match(const struct sk_buff *skb,
       const void *matchinfo,
       int offset,
       unsigned int protoff,
-      int *hotdrop)
+      bool *hotdrop)
 {
-        struct ipv6_rt_hdr _route, *rh;
+        struct ipv6_rt_hdr _route;
+        const struct ipv6_rt_hdr *rh;
         const struct ip6t_rt *rtinfo = matchinfo;
         unsigned int temp;
         unsigned int ptr;
         unsigned int hdrlen = 0;
-        unsigned int ret = 0;
-        struct in6_addr *ap, _addr;
+        bool ret = false;
+        struct in6_addr _addr;
+        const struct in6_addr *ap;
         int err;
 
         err = ipv6_find_hdr(skb, &ptr, NEXTHDR_ROUTING, NULL);
         if (err < 0) {
                 if (err != -ENOENT)
-                        *hotdrop = 1;
-                return 0;
+                        *hotdrop = true;
+                return false;
         }
 
         rh = skb_header_pointer(skb, ptr, sizeof(_route), &_route);
         if (rh == NULL) {
-                *hotdrop = 1;
-                return 0;
+                *hotdrop = true;
+                return false;
         }
 
         hdrlen = ipv6_optlen(rh);
         if (skb->len - ptr < hdrlen) {
                 /* Pcket smaller than its length field */
-                return 0;
+                return false;
         }
 
-        DEBUGP("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
-        DEBUGP("TYPE %04X ", rh->type);
-        DEBUGP("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
-
-        DEBUGP("IPv6 RT segsleft %02X ",
-               (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
-                               rh->segments_left,
-                               !!(rtinfo->invflags & IP6T_RT_INV_SGS))));
-        DEBUGP("type %02X %02X %02X ",
-               rtinfo->rt_type, rh->type,
-               (!(rtinfo->flags & IP6T_RT_TYP) ||
-                ((rtinfo->rt_type == rh->type) ^
-                 !!(rtinfo->invflags & IP6T_RT_INV_TYP))));
-        DEBUGP("len %02X %04X %02X ",
-               rtinfo->hdrlen, hdrlen,
-               (!(rtinfo->flags & IP6T_RT_LEN) ||
-                ((rtinfo->hdrlen == hdrlen) ^
-                 !!(rtinfo->invflags & IP6T_RT_INV_LEN))));
-        DEBUGP("res %02X %02X %02X ",
-               (rtinfo->flags & IP6T_RT_RES),
-               ((struct rt0_hdr *)rh)->reserved,
-               !((rtinfo->flags & IP6T_RT_RES) &&
-                 (((struct rt0_hdr *)rh)->reserved)));
+        pr_debug("IPv6 RT LEN %u %u ", hdrlen, rh->hdrlen);
+        pr_debug("TYPE %04X ", rh->type);
+        pr_debug("SGS_LEFT %u %02X\n", rh->segments_left, rh->segments_left);
+
+        pr_debug("IPv6 RT segsleft %02X ",
+                 segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
+                                rh->segments_left,
+                                !!(rtinfo->invflags & IP6T_RT_INV_SGS)));
+        pr_debug("type %02X %02X %02X ",
+                 rtinfo->rt_type, rh->type,
+                 (!(rtinfo->flags & IP6T_RT_TYP) ||
+                  ((rtinfo->rt_type == rh->type) ^
+                   !!(rtinfo->invflags & IP6T_RT_INV_TYP))));
+        pr_debug("len %02X %04X %02X ",
+                 rtinfo->hdrlen, hdrlen,
+                 !(rtinfo->flags & IP6T_RT_LEN) ||
+                  ((rtinfo->hdrlen == hdrlen) ^
+                   !!(rtinfo->invflags & IP6T_RT_INV_LEN)));
+        pr_debug("res %02X %02X %02X ",
+                 rtinfo->flags & IP6T_RT_RES,
+                 ((const struct rt0_hdr *)rh)->reserved,
+                 !((rtinfo->flags & IP6T_RT_RES) &&
+                   (((const struct rt0_hdr *)rh)->reserved)));
 
         ret = (rh != NULL)
               &&
@@ -129,18 +125,18 @@ match(const struct sk_buff *skb,
                 ret = (*rp == 0);
         }
 
-        DEBUGP("#%d ", rtinfo->addrnr);
+        pr_debug("#%d ", rtinfo->addrnr);
         if (!(rtinfo->flags & IP6T_RT_FST)) {
                 return ret;
         } else if (rtinfo->flags & IP6T_RT_FST_NSTRICT) {
-                DEBUGP("Not strict ");
+                pr_debug("Not strict ");
                 if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
-                        DEBUGP("There isn't enough space\n");
-                        return 0;
+                        pr_debug("There isn't enough space\n");
+                        return false;
                 } else {
                         unsigned int i = 0;
 
-                        DEBUGP("#%d ", rtinfo->addrnr);
+                        pr_debug("#%d ", rtinfo->addrnr);
                         for (temp = 0;
                              temp < (unsigned int)((hdrlen - 8) / 16);
                              temp++) {
@@ -154,25 +150,25 @@ match(const struct sk_buff *skb,
                                 BUG_ON(ap == NULL);
 
                                 if (ipv6_addr_equal(ap, &rtinfo->addrs[i])) {
-                                        DEBUGP("i=%d temp=%d;\n", i, temp);
+                                        pr_debug("i=%d temp=%d;\n", i, temp);
                                         i++;
                                 }
                                 if (i == rtinfo->addrnr)
                                         break;
                         }
-                        DEBUGP("i=%d #%d\n", i, rtinfo->addrnr);
+                        pr_debug("i=%d #%d\n", i, rtinfo->addrnr);
                         if (i == rtinfo->addrnr)
                                 return ret;
                         else
-                                return 0;
+                                return false;
                 }
         } else {
-                DEBUGP("Strict ");
+                pr_debug("Strict ");
                 if (rtinfo->addrnr > (unsigned int)((hdrlen - 8) / 16)) {
-                        DEBUGP("There isn't enough space\n");
-                        return 0;
+                        pr_debug("There isn't enough space\n");
+                        return false;
                 } else {
-                        DEBUGP("#%d ", rtinfo->addrnr);
+                        pr_debug("#%d ", rtinfo->addrnr);
                         for (temp = 0; temp < rtinfo->addrnr; temp++) {
                                 ap = skb_header_pointer(skb,
                                                         ptr
@@ -185,20 +181,20 @@ match(const struct sk_buff *skb,
                                 if (!ipv6_addr_equal(ap, &rtinfo->addrs[temp]))
                                         break;
                         }
-                        DEBUGP("temp=%d #%d\n", temp, rtinfo->addrnr);
-                        if ((temp == rtinfo->addrnr) &&
-                            (temp == (unsigned int)((hdrlen - 8) / 16)))
+                        pr_debug("temp=%d #%d\n", temp, rtinfo->addrnr);
+                        if (temp == rtinfo->addrnr &&
+                            temp == (unsigned int)((hdrlen - 8) / 16))
                                 return ret;
                         else
-                                return 0;
+                                return false;
                 }
         }
 
-        return 0;
+        return false;
 }
 
 /* Called when user tries to insert an entry of this type. */
-static int
+static bool
 checkentry(const char *tablename,
            const void *entry,
            const struct xt_match *match,
@@ -208,21 +204,21 @@ checkentry(const char *tablename,
         const struct ip6t_rt *rtinfo = matchinfo;
 
         if (rtinfo->invflags & ~IP6T_RT_INV_MASK) {
-                DEBUGP("ip6t_rt: unknown flags %X\n", rtinfo->invflags);
-                return 0;
+                pr_debug("ip6t_rt: unknown flags %X\n", rtinfo->invflags);
+                return false;
         }
         if ((rtinfo->flags & (IP6T_RT_RES | IP6T_RT_FST_MASK)) &&
             (!(rtinfo->flags & IP6T_RT_TYP) ||
              (rtinfo->rt_type != 0) ||
              (rtinfo->invflags & IP6T_RT_INV_TYP))) {
-                DEBUGP("`--rt-type 0' required before `--rt-0-*'");
-                return 0;
+                pr_debug("`--rt-type 0' required before `--rt-0-*'");
+                return false;
         }
 
-        return 1;
+        return true;
 }
 
-static struct xt_match rt_match = {
+static struct xt_match rt_match __read_mostly = {
         .name           = "rt",
         .family         = AF_INET6,
         .match          = match,
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index f2d26495f4..f0a9efa67f 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -21,12 +21,6 @@ MODULE_DESCRIPTION("ip6tables mangle table");
                             (1 << NF_IP6_LOCAL_OUT) | \
                             (1 << NF_IP6_POST_ROUTING))
 
-#if 0
-#define DEBUGP(x, args...)      printk(KERN_DEBUG x, ## args)
-#else
-#define DEBUGP(x, args...)
-#endif
-
 static struct
 {
         struct ip6t_replace repl;
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 0acda45d45..ec290e4ebd 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -8,12 +8,6 @@
 
 #define RAW_VALID_HOOKS ((1 << NF_IP6_PRE_ROUTING) | (1 << NF_IP6_LOCAL_OUT))
 
-#if 0
-#define DEBUGP(x, args...)      printk(KERN_DEBUG x, ## args)
-#else
-#define DEBUGP(x, args...)
-#endif
-
 static struct
 {
         struct ip6t_replace repl;
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 1b1797f1f3..36df2218b6 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -26,12 +26,6 @@
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
 static int ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
                              struct nf_conntrack_tuple *tuple)
 {
@@ -92,7 +86,7 @@ static int ipv6_print_conntrack(struct seq_file *s,
  *        - Note also special handling of AUTH header. Thanks to IPsec wizards.
  */
 
-int nf_ct_ipv6_skip_exthdr(struct sk_buff *skb, int start, u8 *nexthdrp,
+int nf_ct_ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
                            int len)
 {
         u8 nexthdr = *nexthdrp;
@@ -123,22 +117,25 @@ int nf_ct_ipv6_skip_exthdr(struct sk_buff *skb, int start, u8 *nexthdrp,
         return start;
 }
 
-static int
-ipv6_prepare(struct sk_buff **pskb, unsigned int hooknum, unsigned int *dataoff,
-             u_int8_t *protonum)
+static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
+                            unsigned int *dataoff, u_int8_t *protonum)
 {
-        unsigned int extoff = (u8 *)(ipv6_hdr(*pskb) + 1) - (*pskb)->data;
-        unsigned char pnum = ipv6_hdr(*pskb)->nexthdr;
-        int protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum,
-                                             (*pskb)->len - extoff);
+        unsigned int extoff = nhoff + sizeof(struct ipv6hdr);
+        unsigned char pnum;
+        int protoff;
+
+        if (skb_copy_bits(skb, nhoff + offsetof(struct ipv6hdr, nexthdr),
+                          &pnum, sizeof(pnum)) != 0) {
+                pr_debug("ip6_conntrack_core: can't get nexthdr\n");
+                return -NF_ACCEPT;
+        }
+        protoff = nf_ct_ipv6_skip_exthdr(skb, extoff, &pnum, skb->len - extoff);
         /*
-         * (protoff == (*pskb)->len) mean that the packet doesn't have no data
+         * (protoff == skb->len) mean that the packet doesn't have no data
          * except of IPv6 & ext headers. but it's tracked anyway. - YK
          */
-        if ((protoff < 0) || (protoff > (*pskb)->len)) {
-                DEBUGP("ip6_conntrack_core: can't find proto in pkt\n");
-                NF_CT_STAT_INC_ATOMIC(error);
-                NF_CT_STAT_INC_ATOMIC(invalid);
+        if ((protoff < 0) || (protoff > skb->len)) {
+                pr_debug("ip6_conntrack_core: can't find proto in pkt\n");
                 return -NF_ACCEPT;
         }
 
@@ -147,11 +144,6 @@ ipv6_prepare(struct sk_buff **pskb, unsigned int hooknum, unsigned int *dataoff,
         return NF_ACCEPT;
 }
 
-static u_int32_t ipv6_get_features(const struct nf_conntrack_tuple *tuple)
-{
-        return NF_CT_F_BASIC;
-}
-
 static unsigned int ipv6_confirm(unsigned int hooknum,
                                  struct sk_buff **pskb,
                                  const struct net_device *in,
@@ -183,7 +175,7 @@ static unsigned int ipv6_confirm(unsigned int hooknum,
         protoff = nf_ct_ipv6_skip_exthdr(*pskb, extoff, &pnum,
                                          (*pskb)->len - extoff);
         if (protoff > (*pskb)->len || pnum == NEXTHDR_FRAGMENT) {
-                DEBUGP("proto header not found\n");
+                pr_debug("proto header not found\n");
                 return NF_ACCEPT;
         }
 
@@ -381,14 +373,14 @@ static int ipv6_nfattr_to_tuple(struct nfattr *tb[],
 }
 #endif
 
-struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 = {
+struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 __read_mostly = {
         .l3proto                = PF_INET6,
         .name                   = "ipv6",
         .pkt_to_tuple           = ipv6_pkt_to_tuple,
         .invert_tuple           = ipv6_invert_tuple,
         .print_tuple            = ipv6_print_tuple,
         .print_conntrack        = ipv6_print_conntrack,
-        .prepare                = ipv6_prepare,
+        .get_l4proto            = ipv6_get_l4proto,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
         .tuple_to_nfattr        = ipv6_tuple_to_nfattr,
         .nfattr_to_tuple        = ipv6_nfattr_to_tuple,
@@ -397,7 +389,6 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv6 = {
         .ctl_table_path         = nf_net_netfilter_sysctl_path,
         .ctl_table              = nf_ct_ipv6_sysctl_table,
 #endif
-        .get_features           = ipv6_get_features,
         .me                     = THIS_MODULE,
 };
 
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 8814b95b23..ab154fb900 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -27,12 +27,6 @@
 
 static unsigned long nf_ct_icmpv6_timeout __read_mostly = 30*HZ;
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
 static int icmpv6_pkt_to_tuple(const struct sk_buff *skb,
                                unsigned int dataoff,
                                struct nf_conntrack_tuple *tuple)
@@ -125,8 +119,8 @@ static int icmpv6_new(struct nf_conn *conntrack,
 
         if (type < 0 || type >= sizeof(valid_new) || !valid_new[type]) {
                 /* Can't create a new ICMPv6 `conn' with this. */
-                DEBUGP("icmpv6: can't create new conn with type %u\n",
-                       type + 128);
+                pr_debug("icmpv6: can't create new conn with type %u\n",
+                         type + 128);
                 NF_CT_DUMP_TUPLE(&conntrack->tuplehash[0].tuple);
                 return 0;
         }
@@ -142,60 +136,36 @@ icmpv6_error_message(struct sk_buff *skb,
 {
         struct nf_conntrack_tuple intuple, origtuple;
         struct nf_conntrack_tuple_hash *h;
-        struct icmp6hdr _hdr, *hp;
-        unsigned int inip6off;
         struct nf_conntrack_l4proto *inproto;
-        u_int8_t inprotonum;
-        unsigned int inprotoff;
 
         NF_CT_ASSERT(skb->nfct == NULL);
 
-        hp = skb_header_pointer(skb, icmp6off, sizeof(_hdr), &_hdr);
-        if (hp == NULL) {
-                DEBUGP("icmpv6_error: Can't get ICMPv6 hdr.\n");
-                return -NF_ACCEPT;
-        }
-
-        inip6off = icmp6off + sizeof(_hdr);
-        if (skb_copy_bits(skb, inip6off+offsetof(struct ipv6hdr, nexthdr),
-                          &inprotonum, sizeof(inprotonum)) != 0) {
-                DEBUGP("icmpv6_error: Can't get nexthdr in inner IPv6 header.\n");
-                return -NF_ACCEPT;
-        }
-        inprotoff = nf_ct_ipv6_skip_exthdr(skb,
-                                           inip6off + sizeof(struct ipv6hdr),
-                                           &inprotonum,
-                                           skb->len - inip6off
-                                                    - sizeof(struct ipv6hdr));
-
-        if ((inprotoff > skb->len) || (inprotonum == NEXTHDR_FRAGMENT)) {
-                DEBUGP("icmpv6_error: Can't get protocol header in ICMPv6 payload.\n");
+        /* Are they talking about one of our connections? */
+        if (!nf_ct_get_tuplepr(skb,
+                               skb_network_offset(skb)
+                                + sizeof(struct ipv6hdr)
+                                + sizeof(struct icmp6hdr),
+                               PF_INET6, &origtuple)) {
+                pr_debug("icmpv6_error: Can't get tuple\n");
                 return -NF_ACCEPT;
         }
 
         /* rcu_read_lock()ed by nf_hook_slow */
-        inproto = __nf_ct_l4proto_find(PF_INET6, inprotonum);
-
-        /* Are they talking about one of our connections? */
-        if (!nf_ct_get_tuple(skb, inip6off, inprotoff, PF_INET6, inprotonum,
-                             &origtuple, &nf_conntrack_l3proto_ipv6, inproto)) {
-                DEBUGP("icmpv6_error: Can't get tuple\n");
-                return -NF_ACCEPT;
-        }
+        inproto = __nf_ct_l4proto_find(PF_INET6, origtuple.dst.protonum);
 
         /* Ordinarily, we'd expect the inverted tupleproto, but it's
            been preserved inside the ICMP. */
         if (!nf_ct_invert_tuple(&intuple, &origtuple,
                                 &nf_conntrack_l3proto_ipv6, inproto)) {
-                DEBUGP("icmpv6_error: Can't invert tuple\n");
+                pr_debug("icmpv6_error: Can't invert tuple\n");
                 return -NF_ACCEPT;
         }
 
         *ctinfo = IP_CT_RELATED;
 
-        h = nf_conntrack_find_get(&intuple, NULL);
+        h = nf_conntrack_find_get(&intuple);
         if (!h) {
-                DEBUGP("icmpv6_error: no match\n");
+                pr_debug("icmpv6_error: no match\n");
                 return -NF_ACCEPT;
         } else {
                 if (NF_CT_DIRECTION(h) == IP_CT_DIR_REPLY)
@@ -306,7 +276,7 @@ static struct ctl_table icmpv6_sysctl_table[] = {
 };
 #endif /* CONFIG_SYSCTL */
 
-struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 =
+struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 __read_mostly =
 {
         .l3proto                = PF_INET6,
         .l4proto                = IPPROTO_ICMPV6,
@@ -327,5 +297,3 @@ struct nf_conntrack_l4proto nf_conntrack_l4proto_icmpv6 =
         .ctl_table              = icmpv6_sysctl_table,
 #endif
 };
-
-EXPORT_SYMBOL(nf_conntrack_l4proto_icmpv6);
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 347ab76082..25442a8c1b 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -44,12 +44,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
 #define NF_CT_FRAG6_HIGH_THRESH 262144 /* == 256*1024 */
 #define NF_CT_FRAG6_LOW_THRESH 196608  /* == 192*1024 */
 #define NF_CT_FRAG6_TIMEOUT IPV6_FRAG_TIMEOUT
@@ -343,7 +337,7 @@ nf_ct_frag6_create(unsigned int hash, __be32 id, struct in6_addr *src,				   str
         struct nf_ct_frag6_queue *fq;
 
         if ((fq = frag_alloc_queue()) == NULL) {
-                DEBUGP("Can't alloc new queue\n");
+                pr_debug("Can't alloc new queue\n");
                 goto oom;
         }
 
@@ -393,7 +387,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
         int offset, end;
 
         if (fq->last_in & COMPLETE) {
-                DEBUGP("Allready completed\n");
+                pr_debug("Allready completed\n");
                 goto err;
         }
 
@@ -402,7 +396,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                         ((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
 
         if ((unsigned int)end > IPV6_MAXPLEN) {
-                DEBUGP("offset is too large.\n");
+                pr_debug("offset is too large.\n");
                 return -1;
         }
 
@@ -420,7 +414,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                  */
                 if (end < fq->len ||
                     ((fq->last_in & LAST_IN) && end != fq->len)) {
-                        DEBUGP("already received last fragment\n");
+                        pr_debug("already received last fragment\n");
                         goto err;
                 }
                 fq->last_in |= LAST_IN;
@@ -433,13 +427,13 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                         /* RFC2460 says always send parameter problem in
                          * this case. -DaveM
                          */
-                        DEBUGP("the end of this fragment is not rounded to 8 bytes.\n");
+                        pr_debug("end of fragment not rounded to 8 bytes.\n");
                         return -1;
                 }
                 if (end > fq->len) {
                         /* Some bits beyond end -> corruption. */
                         if (fq->last_in & LAST_IN) {
-                                DEBUGP("last packet already reached.\n");
+                                pr_debug("last packet already reached.\n");
                                 goto err;
                         }
                         fq->len = end;
@@ -451,11 +445,11 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
 
         /* Point into the IP datagram 'data' part. */
         if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data)) {
-                DEBUGP("queue: message is too short.\n");
+                pr_debug("queue: message is too short.\n");
                 goto err;
         }
         if (pskb_trim_rcsum(skb, end - offset)) {
-                DEBUGP("Can't trim\n");
+                pr_debug("Can't trim\n");
                 goto err;
         }
 
@@ -480,11 +474,11 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                 if (i > 0) {
                         offset += i;
                         if (end <= offset) {
-                                DEBUGP("overlap\n");
+                                pr_debug("overlap\n");
                                 goto err;
                         }
                         if (!pskb_pull(skb, i)) {
-                                DEBUGP("Can't pull\n");
+                                pr_debug("Can't pull\n");
                                 goto err;
                         }
                         if (skb->ip_summed != CHECKSUM_UNNECESSARY)
@@ -503,7 +497,7 @@ static int nf_ct_frag6_queue(struct nf_ct_frag6_queue *fq, struct sk_buff *skb,
                         /* Eat head of the next overlapped fragment
                          * and leave the loop. The next ones cannot overlap.
                          */
-                        DEBUGP("Eat head of the overlapped parts.: %d", i);
+                        pr_debug("Eat head of the overlapped parts.: %d", i);
                         if (!pskb_pull(next, i))
                                 goto err;
 
@@ -586,13 +580,13 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
                        sizeof(struct ipv6hdr) + fq->len -
                        sizeof(struct frag_hdr));
         if (payload_len > IPV6_MAXPLEN) {
-                DEBUGP("payload len is too large.\n");
+                pr_debug("payload len is too large.\n");
                 goto out_oversize;
         }
 
         /* Head of list must not be cloned. */
         if (skb_cloned(head) && pskb_expand_head(head, 0, 0, GFP_ATOMIC)) {
-                DEBUGP("skb is cloned but can't expand head");
+                pr_debug("skb is cloned but can't expand head");
                 goto out_oom;
         }
 
@@ -604,7 +598,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
                 int i, plen = 0;
 
                 if ((clone = alloc_skb(0, GFP_ATOMIC)) == NULL) {
-                        DEBUGP("Can't alloc skb\n");
+                        pr_debug("Can't alloc skb\n");
                         goto out_oom;
                 }
                 clone->next = head->next;
@@ -719,11 +713,11 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
                         return -1;
                 }
                 if (len < (int)sizeof(struct ipv6_opt_hdr)) {
-                        DEBUGP("too short\n");
+                        pr_debug("too short\n");
                         return -1;
                 }
                 if (nexthdr == NEXTHDR_NONE) {
-                        DEBUGP("next header is none\n");
+                        pr_debug("next header is none\n");
                         return -1;
                 }
                 if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
@@ -764,7 +758,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
 
         /* Jumbo payload inhibits frag. header */
         if (ipv6_hdr(skb)->payload_len == 0) {
-                DEBUGP("payload len = 0\n");
+                pr_debug("payload len = 0\n");
                 return skb;
         }
 
@@ -773,14 +767,14 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
 
         clone = skb_clone(skb, GFP_ATOMIC);
         if (clone == NULL) {
-                DEBUGP("Can't clone skb\n");
+                pr_debug("Can't clone skb\n");
                 return skb;
         }
 
         NFCT_FRAG6_CB(clone)->orig = skb;
 
         if (!pskb_may_pull(clone, fhoff + sizeof(*fhdr))) {
-                DEBUGP("message is too short.\n");
+                pr_debug("message is too short.\n");
                 goto ret_orig;
         }
 
@@ -789,7 +783,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
         fhdr = (struct frag_hdr *)skb_transport_header(clone);
 
         if (!(fhdr->frag_off & htons(0xFFF9))) {
-                DEBUGP("Invalid fragment offset\n");
+                pr_debug("Invalid fragment offset\n");
                 /* It is not a fragmented frame */
                 goto ret_orig;
         }
@@ -799,7 +793,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
 
         fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
         if (fq == NULL) {
-                DEBUGP("Can't find and can't create new queue\n");
+                pr_debug("Can't find and can't create new queue\n");
                 goto ret_orig;
         }
 
@@ -807,7 +801,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
 
         if (nf_ct_frag6_queue(fq, clone, fhdr, nhoff) < 0) {
                 spin_unlock(&fq->lock);
-                DEBUGP("Can't insert skb to queue\n");
+                pr_debug("Can't insert skb to queue\n");
                 fq_put(fq, NULL);
                 goto ret_orig;
         }
@@ -815,7 +809,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
         if (fq->last_in == (FIRST_IN|LAST_IN) && fq->meat == fq->len) {
                 ret_skb = nf_ct_frag6_reasm(fq, dev);
                 if (ret_skb == NULL)
-                        DEBUGP("Can't reassemble fragmented packets\n");
+                        pr_debug("Can't reassemble fragmented packets\n");
         }
         spin_unlock(&fq->lock);
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index a58459a766..e27383d855 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -49,7 +49,7 @@
 #include <net/udp.h>
 #include <net/inet_common.h>
 #include <net/tcp_states.h>
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 #include <net/mip6.h>
 #endif
 
@@ -137,6 +137,28 @@ static __inline__ int icmpv6_filter(struct sock *sk, struct sk_buff *skb)
         return 0;
 }
 
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+static int (*mh_filter)(struct sock *sock, struct sk_buff *skb);
+
+int rawv6_mh_filter_register(int (*filter)(struct sock *sock,
+                                           struct sk_buff *skb))
+{
+        rcu_assign_pointer(mh_filter, filter);
+        return 0;
+}
+EXPORT_SYMBOL(rawv6_mh_filter_register);
+
+int rawv6_mh_filter_unregister(int (*filter)(struct sock *sock,
+                                             struct sk_buff *skb))
+{
+        rcu_assign_pointer(mh_filter, NULL);
+        synchronize_rcu();
+        return 0;
+}
+EXPORT_SYMBOL(rawv6_mh_filter_unregister);
+
+#endif
+
 /*
  *      demultiplex raw sockets.
  *      (should consider queueing the skb in the sock receive_queue
@@ -178,16 +200,22 @@ int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
                 case IPPROTO_ICMPV6:
                         filtered = icmpv6_filter(sk, skb);
                         break;
-#ifdef CONFIG_IPV6_MIP6
+
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 case IPPROTO_MH:
+                {
                         /* XXX: To validate MH only once for each packet,
                          * this is placed here. It should be after checking
                          * xfrm policy, however it doesn't. The checking xfrm
                          * policy is placed in rawv6_rcv() because it is
                          * required for each socket.
                          */
-                        filtered = mip6_mh_filter(sk, skb);
+                        int (*filter)(struct sock *sock, struct sk_buff *skb);
+
+                        filter = rcu_dereference(mh_filter);
+                        filtered = filter ? filter(sk, skb) : 0;
                         break;
+                }
 #endif
                 default:
                         filtered = 0;
@@ -611,9 +639,7 @@ static int rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
         struct iovec *iov;
         u8 __user *type = NULL;
         u8 __user *code = NULL;
-#ifdef CONFIG_IPV6_MIP6
         u8 len = 0;
-#endif
         int probed = 0;
         int i;
 
@@ -646,7 +672,6 @@ static int rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                                 probed = 1;
                         }
                         break;
-#ifdef CONFIG_IPV6_MIP6
                 case IPPROTO_MH:
                         if (iov->iov_base && iov->iov_len < 1)
                                 break;
@@ -660,7 +685,6 @@ static int rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
                                 len += iov->iov_len;
 
                         break;
-#endif
                 default:
                         probed = 1;
                         break;
@@ -1256,7 +1280,7 @@ static int raw6_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct seq_operations raw6_seq_ops = {
+static const struct seq_operations raw6_seq_ops = {
         .start =        raw6_seq_start,
         .next =         raw6_seq_next,
         .stop =         raw6_seq_stop,
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1efa95a99f..eb20bb690a 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -532,7 +532,8 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
          */
         max_headroom = LL_RESERVED_SPACE(tdev)+sizeof(struct iphdr);
 
-        if (skb_headroom(skb) < max_headroom || skb_cloned(skb) || skb_shared(skb)) {
+        if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
+            (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 193d9d60bb..d67fb1ef75 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -484,17 +484,6 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
 
         if (dst == NULL) {
                 opt = np->opt;
-                if (opt == NULL &&
-                    np->rxopt.bits.osrcrt == 2 &&
-                    treq->pktopts) {
-                        struct sk_buff *pktopts = treq->pktopts;
-                        struct inet6_skb_parm *rxopt = IP6CB(pktopts);
-                        if (rxopt->srcrt)
-                                opt = ipv6_invert_rthdr(sk,
-                          (struct ipv6_rt_hdr *)(skb_network_header(pktopts) +
-                                                 rxopt->srcrt));
-                }
-
                 if (opt && opt->srcrt) {
                         struct rt0_hdr *rt0 = (struct rt0_hdr *) opt->srcrt;
                         ipv6_addr_copy(&final, &fl.fl6_dst);
@@ -1391,15 +1380,6 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         if (sk_acceptq_is_full(sk))
                 goto out_overflow;
 
-        if (np->rxopt.bits.osrcrt == 2 &&
-            opt == NULL && treq->pktopts) {
-                struct inet6_skb_parm *rxopt = IP6CB(treq->pktopts);
-                if (rxopt->srcrt)
-                        opt = ipv6_invert_rthdr(sk,
-                   (struct ipv6_rt_hdr *)(skb_network_header(treq->pktopts) +
-                                          rxopt->srcrt));
-        }
-
         if (dst == NULL) {
                 struct in6_addr *final_p = NULL, final;
                 struct flowi fl;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 1faa2ea80a..3ec0c4770e 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -18,7 +18,7 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 #include <net/mip6.h>
 #endif
 
@@ -318,7 +318,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
                         fl->proto = nexthdr;
                         return;
 
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                 case IPPROTO_MH:
                         if (pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
                                 struct ip6_mh *mh;
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index baa461b9f7..cdadb48474 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -65,7 +65,7 @@ __xfrm6_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n)
                 goto end;
 
         /* Rule 2: select MIPv6 RO or inbound trigger */
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         for (i = 0; i < n; i++) {
                 if (src[i] &&
                     (src[i]->props.mode == XFRM_MODE_ROUTEOPTIMIZATION ||
@@ -130,7 +130,7 @@ __xfrm6_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n)
                 goto end;
 
         /* Rule 2: select MIPv6 RO or inbound trigger */
-#ifdef CONFIG_IPV6_MIP6
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         for (i = 0; i < n; i++) {
                 if (src[i] &&
                     (src[i]->mode == XFRM_MODE_ROUTEOPTIMIZATION ||
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 5502cc948d..6f87dd568d 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -379,3 +379,4 @@ static void __exit xfrm6_tunnel_fini(void)
 module_init(xfrm6_tunnel_init);
 module_exit(xfrm6_tunnel_fini);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_IPV6);