157 files changed, 7416 insertions, 4329 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 33f90e7362cc..453512266ea1 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -663,7 +663,7 @@ out:
         return err;
 }
 
-static int vlan_init_net(struct net *net)
+static int __net_init vlan_init_net(struct net *net)
 {
         struct vlan_net *vn = net_generic(net, vlan_net_id);
         int err;
@@ -675,7 +675,7 @@ static int vlan_init_net(struct net *net)
         return err;
 }
 
-static void vlan_exit_net(struct net *net)
+static void __net_exit vlan_exit_net(struct net *net)
 {
         vlan_proc_cleanup(net);
 }
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index e75a2f3b10af..c0316e0ca6e8 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -14,6 +14,7 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
         if (skb_bond_should_drop(skb))
                 goto drop;
 
+        skb->skb_iif = skb->dev->ifindex;
         __vlan_hwaccel_put_tag(skb, vlan_tci);
         skb->dev = vlan_group_get_device(grp, vlan_tci & VLAN_VID_MASK);
 
@@ -85,6 +86,7 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
         if (skb_bond_should_drop(skb))
                 goto drop;
 
+        skb->skb_iif = skb->dev->ifindex;
         __vlan_hwaccel_put_tag(skb, vlan_tci);
         skb->dev = vlan_group_get_device(grp, vlan_tci & VLAN_VID_MASK);
 
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index c1b92cab46c7..a9e1f1785614 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -263,11 +263,10 @@ static int vlan_dev_hard_header(struct sk_buff *skb, struct net_device *dev,
                 vhdr->h_vlan_TCI = htons(vlan_tci);
 
                 /*
-                 *  Set the protocol type. For a packet of type ETH_P_802_3 we
-                 *  put the length in here instead. It is up to the 802.2
-                 *  layer to carry protocol information.
+                 *  Set the protocol type. For a packet of type ETH_P_802_3/2 we
+                 *  put the length in here instead.
                  */
-                if (type != ETH_P_802_3)
+                if (type != ETH_P_802_3 && type != ETH_P_802_2)
                         vhdr->h_vlan_encapsulated_proto = htons(type);
                 else
                         vhdr->h_vlan_encapsulated_proto = htons(len);
diff --git a/net/8021q/vlanproc.c b/net/8021q/vlanproc.c
index 9ec1f057c03a..afead353e215 100644
--- a/net/8021q/vlanproc.c
+++ b/net/8021q/vlanproc.c
@@ -140,7 +140,7 @@ void vlan_proc_cleanup(struct net *net)
  *      Create /proc/net/vlan entries
  */
 
-int vlan_proc_init(struct net *net)
+int __net_init vlan_proc_init(struct net *net)
 {
         struct vlan_net *vn = net_generic(net, vlan_net_id);
 
diff --git a/net/atm/addr.c b/net/atm/addr.c
index 82e85abc303d..cf3ae8b47572 100644
--- a/net/atm/addr.c
+++ b/net/atm/addr.c
@@ -4,7 +4,7 @@
 
 #include <linux/atm.h>
 #include <linux/atmdev.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include "signaling.h"
 #include "addr.h"
diff --git a/net/atm/atm_misc.c b/net/atm/atm_misc.c
index 02cc7e71efea..fc63526d8695 100644
--- a/net/atm/atm_misc.c
+++ b/net/atm/atm_misc.c
@@ -2,37 +2,35 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL ICA */
 
-
 #include <linux/module.h>
 #include <linux/atm.h>
 #include <linux/atmdev.h>
 #include <linux/skbuff.h>
 #include <linux/sonet.h>
 #include <linux/bitops.h>
+#include <linux/errno.h>
 #include <asm/atomic.h>
-#include <asm/errno.h>
-
 
-int atm_charge(struct atm_vcc *vcc,int truesize)
+int atm_charge(struct atm_vcc *vcc, int truesize)
 {
-        atm_force_charge(vcc,truesize);
+        atm_force_charge(vcc, truesize);
         if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
                 return 1;
-        atm_return(vcc,truesize);
+        atm_return(vcc, truesize);
         atomic_inc(&vcc->stats->rx_drop);
         return 0;
 }
+EXPORT_SYMBOL(atm_charge);
 
-
-struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc,int pdu_size,
-    gfp_t gfp_flags)
+struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc, int pdu_size,
+                                 gfp_t gfp_flags)
 {
         struct sock *sk = sk_atm(vcc);
         int guess = atm_guess_pdu2truesize(pdu_size);
 
-        atm_force_charge(vcc,guess);
+        atm_force_charge(vcc, guess);
         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) {
-                struct sk_buff *skb = alloc_skb(pdu_size,gfp_flags);
+                struct sk_buff *skb = alloc_skb(pdu_size, gfp_flags);
 
                 if (skb) {
                         atomic_add(skb->truesize-guess,
@@ -40,10 +38,11 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc,int pdu_size,
                         return skb;
                 }
         }
-        atm_return(vcc,guess);
+        atm_return(vcc, guess);
         atomic_inc(&vcc->stats->rx_drop);
         return NULL;
 }
+EXPORT_SYMBOL(atm_alloc_charge);
 
 
 /*
@@ -73,7 +72,6 @@ struct sk_buff *atm_alloc_charge(struct atm_vcc *vcc,int pdu_size,
  *       else *
  */
 
-
 int atm_pcr_goal(const struct atm_trafprm *tp)
 {
         if (tp->pcr && tp->pcr != ATM_MAX_PCR)
@@ -84,26 +82,20 @@ int atm_pcr_goal(const struct atm_trafprm *tp)
                 return -tp->max_pcr;
         return 0;
 }
+EXPORT_SYMBOL(atm_pcr_goal);
 
-
-void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+void sonet_copy_stats(struct k_sonet_stats *from, struct sonet_stats *to)
 {
 #define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
         __SONET_ITEMS
 #undef __HANDLE_ITEM
 }
+EXPORT_SYMBOL(sonet_copy_stats);
 
-
-void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
+void sonet_subtract_stats(struct k_sonet_stats *from, struct sonet_stats *to)
 {
-#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
+#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
         __SONET_ITEMS
 #undef __HANDLE_ITEM
 }
-
-
-EXPORT_SYMBOL(atm_charge);
-EXPORT_SYMBOL(atm_alloc_charge);
-EXPORT_SYMBOL(atm_pcr_goal);
-EXPORT_SYMBOL(sonet_copy_stats);
 EXPORT_SYMBOL(sonet_subtract_stats);
diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c
index b5674dc2083d..f693b78eb467 100644
--- a/net/atm/atm_sysfs.c
+++ b/net/atm/atm_sysfs.c
@@ -42,13 +42,14 @@ static ssize_t show_atmaddress(struct device *cdev,
 
         spin_lock_irqsave(&adev->lock, flags);
         list_for_each_entry(aaddr, &adev->local, entry) {
-                for(i = 0, j = 0; i < ATM_ESA_LEN; ++i, ++j) {
+                for (i = 0, j = 0; i < ATM_ESA_LEN; ++i, ++j) {
                         if (j == *fmt) {
                                 pos += sprintf(pos, ".");
                                 ++fmt;
                                 j = 0;
                         }
-                        pos += sprintf(pos, "%02x", aaddr->addr.sas_addr.prv[i]);
+                        pos += sprintf(pos, "%02x",
+                                       aaddr->addr.sas_addr.prv[i]);
                 }
                 pos += sprintf(pos, "\n");
         }
@@ -78,17 +79,17 @@ static ssize_t show_link_rate(struct device *cdev,
 
         /* show the link rate, not the data rate */
         switch (adev->link_rate) {
-                case ATM_OC3_PCR:
-                        link_rate = 155520000;
-                        break;
-                case ATM_OC12_PCR:
-                        link_rate = 622080000;
-                        break;
-                case ATM_25_PCR:
-                        link_rate = 25600000;
-                        break;
-                default:
-                        link_rate = adev->link_rate * 8 * 53;
+        case ATM_OC3_PCR:
+                link_rate = 155520000;
+                break;
+        case ATM_OC12_PCR:
+                link_rate = 622080000;
+                break;
+        case ATM_25_PCR:
+                link_rate = 25600000;
+                break;
+        default:
+                link_rate = adev->link_rate * 8 * 53;
         }
         pos += sprintf(pos, "%d\n", link_rate);
 
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index c9230c398697..4d64d87e7578 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -6,6 +6,8 @@
  *          Eric Kinzie, 2006-2007, US Naval Research Laboratory
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -15,7 +17,7 @@
 #include <linux/etherdevice.h>
 #include <linux/rtnetlink.h>
 #include <linux/ip.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <net/arp.h>
 #include <linux/atm.h>
 #include <linux/atmdev.h>
@@ -26,20 +28,14 @@
 
 #include "common.h"
 
-#ifdef SKB_DEBUG
 static void skb_debug(const struct sk_buff *skb)
 {
+#ifdef SKB_DEBUG
 #define NUM2PRINT 50
-        char buf[NUM2PRINT * 3 + 1];    /* 3 chars per byte */
-        int i = 0;
-        for (i = 0; i < skb->len && i < NUM2PRINT; i++) {
-                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
-        }
-        printk(KERN_DEBUG "br2684: skb: %s\n", buf);
-}
-#else
-#define skb_debug(skb)  do {} while (0)
+        print_hex_dump(KERN_DEBUG, "br2684: skb: ", DUMP_OFFSET,
+                       16, 1, skb->data, min(NUM2PRINT, skb->len), true);
 #endif
+}
 
 #define BR2684_ETHERTYPE_LEN    2
 #define BR2684_PAD_LEN          2
@@ -68,7 +64,7 @@ struct br2684_vcc {
         struct atm_vcc *atmvcc;
         struct net_device *device;
         /* keep old push, pop functions for chaining */
-        void (*old_push) (struct atm_vcc * vcc, struct sk_buff * skb);
+        void (*old_push)(struct atm_vcc *vcc, struct sk_buff *skb);
         void (*old_pop)(struct atm_vcc *vcc, struct sk_buff *skb);
         enum br2684_encaps encaps;
         struct list_head brvccs;
@@ -148,7 +144,7 @@ static void br2684_pop(struct atm_vcc *vcc, struct sk_buff *skb)
         struct br2684_vcc *brvcc = BR2684_VCC(vcc);
         struct net_device *net_dev = skb->dev;
 
-        pr_debug("br2684_pop(vcc %p ; net_dev %p )\n", vcc, net_dev);
+        pr_debug("(vcc %p ; net_dev %p )\n", vcc, net_dev);
         brvcc->old_pop(vcc, skb);
 
         if (!net_dev)
@@ -244,7 +240,7 @@ static netdev_tx_t br2684_start_xmit(struct sk_buff *skb,
         struct br2684_dev *brdev = BRPRIV(dev);
         struct br2684_vcc *brvcc;
 
-        pr_debug("br2684_start_xmit, skb_dst(skb)=%p\n", skb_dst(skb));
+        pr_debug("skb_dst(skb)=%p\n", skb_dst(skb));
         read_lock(&devs_lock);
         brvcc = pick_outgoing_vcc(skb, brdev);
         if (brvcc == NULL) {
@@ -300,7 +296,8 @@ static int br2684_setfilt(struct atm_vcc *atmvcc, void __user * arg)
                 struct br2684_dev *brdev;
                 read_lock(&devs_lock);
                 brdev = BRPRIV(br2684_find_dev(&fs.ifspec));
-                if (brdev == NULL || list_empty(&brdev->brvccs) || brdev->brvccs.next != brdev->brvccs.prev)    /* >1 VCC */
+                if (brdev == NULL || list_empty(&brdev->brvccs) ||
+                    brdev->brvccs.next != brdev->brvccs.prev)   /* >1 VCC */
                         brvcc = NULL;
                 else
                         brvcc = list_entry_brvcc(brdev->brvccs.next);
@@ -352,7 +349,7 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
         struct net_device *net_dev = brvcc->device;
         struct br2684_dev *brdev = BRPRIV(net_dev);
 
-        pr_debug("br2684_push\n");
+        pr_debug("\n");
 
         if (unlikely(skb == NULL)) {
                 /* skb==NULL means VCC is being destroyed */
@@ -376,29 +373,25 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
                         __skb_trim(skb, skb->len - 4);
 
                 /* accept packets that have "ipv[46]" in the snap header */
-                if ((skb->len >= (sizeof(llc_oui_ipv4)))
-                    &&
-                    (memcmp
-                     (skb->data, llc_oui_ipv4,
-                      sizeof(llc_oui_ipv4) - BR2684_ETHERTYPE_LEN) == 0)) {
-                        if (memcmp
-                            (skb->data + 6, ethertype_ipv6,
-                             sizeof(ethertype_ipv6)) == 0)
+                if ((skb->len >= (sizeof(llc_oui_ipv4))) &&
+                    (memcmp(skb->data, llc_oui_ipv4,
+                            sizeof(llc_oui_ipv4) - BR2684_ETHERTYPE_LEN) == 0)) {
+                        if (memcmp(skb->data + 6, ethertype_ipv6,
+                                   sizeof(ethertype_ipv6)) == 0)
                                 skb->protocol = htons(ETH_P_IPV6);
-                        else if (memcmp
-                                 (skb->data + 6, ethertype_ipv4,
-                                  sizeof(ethertype_ipv4)) == 0)
+                        else if (memcmp(skb->data + 6, ethertype_ipv4,
+                                        sizeof(ethertype_ipv4)) == 0)
                                 skb->protocol = htons(ETH_P_IP);
                         else
                                 goto error;
                         skb_pull(skb, sizeof(llc_oui_ipv4));
                         skb_reset_network_header(skb);
                         skb->pkt_type = PACKET_HOST;
-                        /*
-                         * Let us waste some time for checking the encapsulation.
-                         * Note, that only 7 char is checked so frames with a valid FCS
-                         * are also accepted (but FCS is not checked of course).
-                         */
+                /*
+                 * Let us waste some time for checking the encapsulation.
+                 * Note, that only 7 char is checked so frames with a valid FCS
+                 * are also accepted (but FCS is not checked of course).
+                 */
                 } else if ((skb->len >= sizeof(llc_oui_pid_pad)) &&
                            (memcmp(skb->data, llc_oui_pid_pad, 7) == 0)) {
                         skb_pull(skb, sizeof(llc_oui_pid_pad));
@@ -479,8 +472,7 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
         write_lock_irq(&devs_lock);
         net_dev = br2684_find_dev(&be.ifspec);
         if (net_dev == NULL) {
-                printk(KERN_ERR
-                       "br2684: tried to attach to non-existant device\n");
+                pr_err("tried to attach to non-existant device\n");
                 err = -ENXIO;
                 goto error;
         }
@@ -494,17 +486,16 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
                 err = -EEXIST;
                 goto error;
         }
-        if (be.fcs_in != BR2684_FCSIN_NO || be.fcs_out != BR2684_FCSOUT_NO ||
-            be.fcs_auto || be.has_vpiid || be.send_padding || (be.encaps !=
-                                                               BR2684_ENCAPS_VC
-                                                               && be.encaps !=
-                                                               BR2684_ENCAPS_LLC)
-            || be.min_size != 0) {
+        if (be.fcs_in != BR2684_FCSIN_NO ||
+            be.fcs_out != BR2684_FCSOUT_NO ||
+            be.fcs_auto || be.has_vpiid || be.send_padding ||
+            (be.encaps != BR2684_ENCAPS_VC &&
+             be.encaps != BR2684_ENCAPS_LLC) ||
+            be.min_size != 0) {
                 err = -EINVAL;
                 goto error;
         }
-        pr_debug("br2684_regvcc vcc=%p, encaps=%d, brvcc=%p\n", atmvcc,
-                 be.encaps, brvcc);
+        pr_debug("vcc=%p, encaps=%d, brvcc=%p\n", atmvcc, be.encaps, brvcc);
         if (list_empty(&brdev->brvccs) && !brdev->mac_was_set) {
                 unsigned char *esi = atmvcc->dev->esi;
                 if (esi[0] | esi[1] | esi[2] | esi[3] | esi[4] | esi[5])
@@ -541,7 +532,8 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
         }
         __module_get(THIS_MODULE);
         return 0;
-      error:
+
+error:
         write_unlock_irq(&devs_lock);
         kfree(brvcc);
         return err;
@@ -587,7 +579,7 @@ static void br2684_setup_routed(struct net_device *netdev)
         INIT_LIST_HEAD(&brdev->brvccs);
 }
 
-static int br2684_create(void __user * arg)
+static int br2684_create(void __user *arg)
 {
         int err;
         struct net_device *netdev;
@@ -595,11 +587,10 @@ static int br2684_create(void __user * arg)
         struct atm_newif_br2684 ni;
         enum br2684_payload payload;
 
-        pr_debug("br2684_create\n");
+        pr_debug("\n");
 
-        if (copy_from_user(&ni, arg, sizeof ni)) {
+        if (copy_from_user(&ni, arg, sizeof ni))
                 return -EFAULT;
-        }
 
         if (ni.media & BR2684_FLAG_ROUTED)
                 payload = p_routed;
@@ -607,9 +598,8 @@ static int br2684_create(void __user * arg)
                 payload = p_bridged;
         ni.media &= 0xffff;     /* strip flags */
 
-        if (ni.media != BR2684_MEDIA_ETHERNET || ni.mtu != 1500) {
+        if (ni.media != BR2684_MEDIA_ETHERNET || ni.mtu != 1500)
                 return -EINVAL;
-        }
 
         netdev = alloc_netdev(sizeof(struct br2684_dev),
                               ni.ifname[0] ? ni.ifname : "nas%d",
@@ -624,7 +614,7 @@ static int br2684_create(void __user * arg)
         /* open, stop, do_ioctl ? */
         err = register_netdev(netdev);
         if (err < 0) {
-                printk(KERN_ERR "br2684_create: register_netdev failed\n");
+                pr_err("register_netdev failed\n");
                 free_netdev(netdev);
                 return err;
         }
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 64629c354343..ebfa022008f7 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -2,6 +2,8 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/kernel.h> /* for UINT_MAX */
@@ -30,10 +32,10 @@
 #include <linux/jhash.h>
 #include <net/route.h> /* for struct rtable and routing */
 #include <net/icmp.h> /* icmp_send */
-#include <asm/param.h> /* for HZ */
+#include <linux/param.h> /* for HZ */
+#include <linux/uaccess.h>
 #include <asm/byteorder.h> /* for htons etc. */
 #include <asm/system.h> /* save/restore_flags */
-#include <asm/uaccess.h>
 #include <asm/atomic.h>
 
 #include "common.h"
@@ -51,13 +53,13 @@ static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
         struct atmarp_ctrl *ctrl;
         struct sk_buff *skb;
 
-        pr_debug("to_atmarpd(%d)\n", type);
+        pr_debug("(%d)\n", type);
         if (!atmarpd)
                 return -EUNATCH;
-        skb = alloc_skb(sizeof(struct atmarp_ctrl),GFP_ATOMIC);
+        skb = alloc_skb(sizeof(struct atmarp_ctrl), GFP_ATOMIC);
         if (!skb)
                 return -ENOMEM;
-        ctrl = (struct atmarp_ctrl *) skb_put(skb,sizeof(struct atmarp_ctrl));
+        ctrl = (struct atmarp_ctrl *)skb_put(skb, sizeof(struct atmarp_ctrl));
         ctrl->type = type;
         ctrl->itf_num = itf;
         ctrl->ip = ip;
@@ -71,8 +73,7 @@ static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
 
 static void link_vcc(struct clip_vcc *clip_vcc, struct atmarp_entry *entry)
 {
-        pr_debug("link_vcc %p to entry %p (neigh %p)\n", clip_vcc, entry,
-                entry->neigh);
+        pr_debug("%p to entry %p (neigh %p)\n", clip_vcc, entry, entry->neigh);
         clip_vcc->entry = entry;
         clip_vcc->xoff = 0;     /* @@@ may overrun buffer by one packet */
         clip_vcc->next = entry->vccs;
@@ -86,7 +87,7 @@ static void unlink_clip_vcc(struct clip_vcc *clip_vcc)
         struct clip_vcc **walk;
 
         if (!entry) {
-                printk(KERN_CRIT "!clip_vcc->entry (clip_vcc %p)\n", clip_vcc);
+                pr_crit("!clip_vcc->entry (clip_vcc %p)\n", clip_vcc);
                 return;
         }
         netif_tx_lock_bh(entry->neigh->dev);    /* block clip_start_xmit() */
@@ -106,13 +107,11 @@ static void unlink_clip_vcc(struct clip_vcc *clip_vcc)
                         error = neigh_update(entry->neigh, NULL, NUD_NONE,
                                              NEIGH_UPDATE_F_ADMIN);
                         if (error)
-                                printk(KERN_CRIT "unlink_clip_vcc: "
-                                       "neigh_update failed with %d\n", error);
+                                pr_crit("neigh_update failed with %d\n", error);
                         goto out;
                 }
-        printk(KERN_CRIT "ATMARP: unlink_clip_vcc failed (entry %p, vcc "
-               "0x%p)\n", entry, clip_vcc);
-      out:
+        pr_crit("ATMARP: failed (entry %p, vcc 0x%p)\n", entry, clip_vcc);
+out:
         netif_tx_unlock_bh(entry->neigh->dev);
 }
 
@@ -127,7 +126,7 @@ static int neigh_check_cb(struct neighbour *n)
 
                 if (cv->idle_timeout && time_after(jiffies, exp)) {
                         pr_debug("releasing vcc %p->%p of entry %p\n",
-                                cv, cv->vcc, entry);
+                                 cv, cv->vcc, entry);
                         vcc_release_async(cv->vcc, -ETIMEDOUT);
                 }
         }
@@ -139,7 +138,7 @@ static int neigh_check_cb(struct neighbour *n)
                 struct sk_buff *skb;
 
                 pr_debug("destruction postponed with ref %d\n",
-                        atomic_read(&n->refcnt));
+                         atomic_read(&n->refcnt));
 
                 while ((skb = skb_dequeue(&n->arp_queue)) != NULL)
                         dev_kfree_skb(skb);
@@ -163,7 +162,7 @@ static int clip_arp_rcv(struct sk_buff *skb)
 {
         struct atm_vcc *vcc;
 
-        pr_debug("clip_arp_rcv\n");
+        pr_debug("\n");
         vcc = ATM_SKB(skb)->vcc;
         if (!vcc || !atm_charge(vcc, skb->truesize)) {
                 dev_kfree_skb_any(skb);
@@ -188,7 +187,7 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         struct clip_vcc *clip_vcc = CLIP_VCC(vcc);
 
-        pr_debug("clip push\n");
+        pr_debug("\n");
         if (!skb) {
                 pr_debug("removing VCC %p\n", clip_vcc);
                 if (clip_vcc->entry)
@@ -206,12 +205,12 @@ static void clip_push(struct atm_vcc *vcc, struct sk_buff *skb)
         }
         ATM_SKB(skb)->vcc = vcc;
         skb_reset_mac_header(skb);
-        if (!clip_vcc->encap
-            || skb->len < RFC1483LLC_LEN
-            || memcmp(skb->data, llc_oui, sizeof (llc_oui)))
+        if (!clip_vcc->encap ||
+            skb->len < RFC1483LLC_LEN ||
+            memcmp(skb->data, llc_oui, sizeof(llc_oui)))
                 skb->protocol = htons(ETH_P_IP);
         else {
-                skb->protocol = ((__be16 *) skb->data)[3];
+                skb->protocol = ((__be16 *)skb->data)[3];
                 skb_pull(skb, RFC1483LLC_LEN);
                 if (skb->protocol == htons(ETH_P_ARP)) {
                         skb->dev->stats.rx_packets++;
@@ -239,7 +238,7 @@ static void clip_pop(struct atm_vcc *vcc, struct sk_buff *skb)
         int old;
         unsigned long flags;
 
-        pr_debug("clip_pop(vcc %p)\n", vcc);
+        pr_debug("(vcc %p)\n", vcc);
         clip_vcc->old_pop(vcc, skb);
         /* skb->dev == NULL in outbound ARP packets */
         if (!dev)
@@ -255,7 +254,7 @@ static void clip_pop(struct atm_vcc *vcc, struct sk_buff *skb)
 
 static void clip_neigh_solicit(struct neighbour *neigh, struct sk_buff *skb)
 {
-        pr_debug("clip_neigh_solicit (neigh %p, skb %p)\n", neigh, skb);
+        pr_debug("(neigh %p, skb %p)\n", neigh, skb);
         to_atmarpd(act_need, PRIV(neigh->dev)->number, NEIGH2ENTRY(neigh)->ip);
 }
 
@@ -284,7 +283,7 @@ static int clip_constructor(struct neighbour *neigh)
         struct in_device *in_dev;
         struct neigh_parms *parms;
 
-        pr_debug("clip_constructor (neigh %p, entry %p)\n", neigh, entry);
+        pr_debug("(neigh %p, entry %p)\n", neigh, entry);
         neigh->type = inet_addr_type(&init_net, entry->ip);
         if (neigh->type != RTN_UNICAST)
                 return -EINVAL;
@@ -369,9 +368,9 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
         int old;
         unsigned long flags;
 
-        pr_debug("clip_start_xmit (skb %p)\n", skb);
+        pr_debug("(skb %p)\n", skb);
         if (!skb_dst(skb)) {
-                printk(KERN_ERR "clip_start_xmit: skb_dst(skb) == NULL\n");
+                pr_err("skb_dst(skb) == NULL\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
                 return NETDEV_TX_OK;
@@ -385,7 +384,7 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
                         return 0;
                 }
 #endif
-                printk(KERN_ERR "clip_start_xmit: NO NEIGHBOUR !\n");
+                pr_err("NO NEIGHBOUR !\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
                 return NETDEV_TX_OK;
@@ -421,7 +420,7 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb,
         pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, vcc, vcc->dev);
         old = xchg(&entry->vccs->xoff, 1);      /* assume XOFF ... */
         if (old) {
-                printk(KERN_WARNING "clip_start_xmit: XOFF->XOFF transition\n");
+                pr_warning("XOFF->XOFF transition\n");
                 return NETDEV_TX_OK;
         }
         dev->stats.tx_packets++;
@@ -456,7 +455,7 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
         clip_vcc = kmalloc(sizeof(struct clip_vcc), GFP_KERNEL);
         if (!clip_vcc)
                 return -ENOMEM;
-        pr_debug("mkip clip_vcc %p vcc %p\n", clip_vcc, vcc);
+        pr_debug("%p vcc %p\n", clip_vcc, vcc);
         clip_vcc->vcc = vcc;
         vcc->user_back = clip_vcc;
         set_bit(ATM_VF_IS_CLIP, &vcc->flags);
@@ -506,16 +505,16 @@ static int clip_setentry(struct atm_vcc *vcc, __be32 ip)
         struct rtable *rt;
 
         if (vcc->push != clip_push) {
-                printk(KERN_WARNING "clip_setentry: non-CLIP VCC\n");
+                pr_warning("non-CLIP VCC\n");
                 return -EBADF;
         }
         clip_vcc = CLIP_VCC(vcc);
         if (!ip) {
                 if (!clip_vcc->entry) {
-                        printk(KERN_ERR "hiding hidden ATMARP entry\n");
+                        pr_err("hiding hidden ATMARP entry\n");
                         return 0;
                 }
-                pr_debug("setentry: remove\n");
+                pr_debug("remove\n");
                 unlink_clip_vcc(clip_vcc);
                 return 0;
         }
@@ -529,9 +528,9 @@ static int clip_setentry(struct atm_vcc *vcc, __be32 ip)
         entry = NEIGH2ENTRY(neigh);
         if (entry != clip_vcc->entry) {
                 if (!clip_vcc->entry)
-                        pr_debug("setentry: add\n");
+                        pr_debug("add\n");
                 else {
-                        pr_debug("setentry: update\n");
+                        pr_debug("update\n");
                         unlink_clip_vcc(clip_vcc);
                 }
                 link_vcc(clip_vcc, entry);
@@ -614,16 +613,16 @@ static int clip_device_event(struct notifier_block *this, unsigned long event,
 
         switch (event) {
         case NETDEV_UP:
-                pr_debug("clip_device_event NETDEV_UP\n");
+                pr_debug("NETDEV_UP\n");
                 to_atmarpd(act_up, PRIV(dev)->number, 0);
                 break;
         case NETDEV_GOING_DOWN:
-                pr_debug("clip_device_event NETDEV_DOWN\n");
+                pr_debug("NETDEV_DOWN\n");
                 to_atmarpd(act_down, PRIV(dev)->number, 0);
                 break;
         case NETDEV_CHANGE:
         case NETDEV_CHANGEMTU:
-                pr_debug("clip_device_event NETDEV_CHANGE*\n");
+                pr_debug("NETDEV_CHANGE*\n");
                 to_atmarpd(act_change, PRIV(dev)->number, 0);
                 break;
         }
@@ -645,7 +644,6 @@ static int clip_inet_event(struct notifier_block *this, unsigned long event,
         return clip_device_event(this, NETDEV_CHANGE, in_dev->dev);
 }
 
-
 static struct notifier_block clip_dev_notifier = {
         .notifier_call = clip_device_event,
 };
@@ -660,7 +658,7 @@ static struct notifier_block clip_inet_notifier = {
 
 static void atmarpd_close(struct atm_vcc *vcc)
 {
-        pr_debug("atmarpd_close\n");
+        pr_debug("\n");
 
         rtnl_lock();
         atmarpd = NULL;
@@ -671,7 +669,6 @@ static void atmarpd_close(struct atm_vcc *vcc)
         module_put(THIS_MODULE);
 }
 
-
 static struct atmdev_ops atmarpd_dev_ops = {
         .close = atmarpd_close
 };
@@ -693,11 +690,11 @@ static int atm_init_atmarp(struct atm_vcc *vcc)
                 return -EADDRINUSE;
         }
 
-        mod_timer(&idle_timer, jiffies+CLIP_CHECK_INTERVAL*HZ);
+        mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ);
 
         atmarpd = vcc;
-        set_bit(ATM_VF_META,&vcc->flags);
-        set_bit(ATM_VF_READY,&vcc->flags);
+        set_bit(ATM_VF_META, &vcc->flags);
+        set_bit(ATM_VF_READY, &vcc->flags);
             /* allow replies and avoid getting closed if signaling dies */
         vcc->dev = &atmarpd_dev;
         vcc_insert_socket(sk_atm(vcc));
@@ -950,8 +947,7 @@ static int __init atm_clip_init(void)
 
                 p = proc_create("arp", S_IRUGO, atm_proc_root, &arp_seq_fops);
                 if (!p) {
-                        printk(KERN_ERR "Unable to initialize "
-                               "/proc/net/atm/arp\n");
+                        pr_err("Unable to initialize /proc/net/atm/arp\n");
                         atm_clip_exit_noproc();
                         return -ENOMEM;
                 }
diff --git a/net/atm/common.c b/net/atm/common.c
index d61e051e0a3f..74d095a081e3 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -2,6 +2,7 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/module.h>
 #include <linux/kmod.h>
@@ -18,11 +19,10 @@
 #include <linux/bitops.h>
 #include <linux/init.h>
 #include <net/sock.h>           /* struct sock */
+#include <linux/uaccess.h>
+#include <linux/poll.h>
 
-#include <asm/uaccess.h>
 #include <asm/atomic.h>
-#include <asm/poll.h>
-
 
 #include "resources.h"          /* atm_find_dev */
 #include "common.h"             /* prototypes */
@@ -31,13 +31,15 @@
 #include "signaling.h"          /* for WAITING and sigd_attach */
 
 struct hlist_head vcc_hash[VCC_HTABLE_SIZE];
+EXPORT_SYMBOL(vcc_hash);
+
 DEFINE_RWLOCK(vcc_sklist_lock);
+EXPORT_SYMBOL(vcc_sklist_lock);
 
 static void __vcc_insert_socket(struct sock *sk)
 {
         struct atm_vcc *vcc = atm_sk(sk);
-        struct hlist_head *head = &vcc_hash[vcc->vci &
-                                        (VCC_HTABLE_SIZE - 1)];
+        struct hlist_head *head = &vcc_hash[vcc->vci & (VCC_HTABLE_SIZE - 1)];
         sk->sk_hash = vcc->vci & (VCC_HTABLE_SIZE - 1);
         sk_add_node(sk, head);
 }
@@ -48,6 +50,7 @@ void vcc_insert_socket(struct sock *sk)
         __vcc_insert_socket(sk);
         write_unlock_irq(&vcc_sklist_lock);
 }
+EXPORT_SYMBOL(vcc_insert_socket);
 
 static void vcc_remove_socket(struct sock *sk)
 {
@@ -56,37 +59,32 @@ static void vcc_remove_socket(struct sock *sk)
         write_unlock_irq(&vcc_sklist_lock);
 }
 
-
-static struct sk_buff *alloc_tx(struct atm_vcc *vcc,unsigned int size)
+static struct sk_buff *alloc_tx(struct atm_vcc *vcc, unsigned int size)
 {
         struct sk_buff *skb;
         struct sock *sk = sk_atm(vcc);
 
         if (sk_wmem_alloc_get(sk) && !atm_may_send(vcc, size)) {
                 pr_debug("Sorry: wmem_alloc = %d, size = %d, sndbuf = %d\n",
-                        sk_wmem_alloc_get(sk), size,
-                        sk->sk_sndbuf);
+                         sk_wmem_alloc_get(sk), size, sk->sk_sndbuf);
                 return NULL;
         }
         while (!(skb = alloc_skb(size, GFP_KERNEL)))
                 schedule();
-        pr_debug("AlTx %d += %d\n", sk_wmem_alloc_get(sk), skb->truesize);
+        pr_debug("%d += %d\n", sk_wmem_alloc_get(sk), skb->truesize);
         atomic_add(skb->truesize, &sk->sk_wmem_alloc);
         return skb;
 }
 
-
-EXPORT_SYMBOL(vcc_hash);
-EXPORT_SYMBOL(vcc_sklist_lock);
-EXPORT_SYMBOL(vcc_insert_socket);
-
 static void vcc_sock_destruct(struct sock *sk)
 {
         if (atomic_read(&sk->sk_rmem_alloc))
-                printk(KERN_DEBUG "vcc_sock_destruct: rmem leakage (%d bytes) detected.\n", atomic_read(&sk->sk_rmem_alloc));
+                printk(KERN_DEBUG "%s: rmem leakage (%d bytes) detected.\n",
+                       __func__, atomic_read(&sk->sk_rmem_alloc));
 
         if (atomic_read(&sk->sk_wmem_alloc))
-                printk(KERN_DEBUG "vcc_sock_destruct: wmem leakage (%d bytes) detected.\n", atomic_read(&sk->sk_wmem_alloc));
+                printk(KERN_DEBUG "%s: wmem leakage (%d bytes) detected.\n",
+                       __func__, atomic_read(&sk->sk_wmem_alloc));
 }
 
 static void vcc_def_wakeup(struct sock *sk)
@@ -142,8 +140,8 @@ int vcc_create(struct net *net, struct socket *sock, int protocol, int family)
 
         vcc = atm_sk(sk);
         vcc->dev = NULL;
-        memset(&vcc->local,0,sizeof(struct sockaddr_atmsvc));
-        memset(&vcc->remote,0,sizeof(struct sockaddr_atmsvc));
+        memset(&vcc->local, 0, sizeof(struct sockaddr_atmsvc));
+        memset(&vcc->remote, 0, sizeof(struct sockaddr_atmsvc));
         vcc->qos.txtp.max_sdu = 1 << 16; /* for meta VCs */
         atomic_set(&sk->sk_wmem_alloc, 1);
         atomic_set(&sk->sk_rmem_alloc, 0);
@@ -156,7 +154,6 @@ int vcc_create(struct net *net, struct socket *sock, int protocol, int family)
         return 0;
 }
 
-
 static void vcc_destroy_socket(struct sock *sk)
 {
         struct atm_vcc *vcc = atm_sk(sk);
@@ -171,7 +168,7 @@ static void vcc_destroy_socket(struct sock *sk)
                         vcc->push(vcc, NULL); /* atmarpd has no push */
 
                 while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                        atm_return(vcc,skb->truesize);
+                        atm_return(vcc, skb->truesize);
                         kfree_skb(skb);
                 }
 
@@ -182,7 +179,6 @@ static void vcc_destroy_socket(struct sock *sk)
         vcc_remove_socket(sk);
 }
 
-
 int vcc_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
@@ -197,7 +193,6 @@ int vcc_release(struct socket *sock)
         return 0;
 }
 
-
 void vcc_release_async(struct atm_vcc *vcc, int reply)
 {
         struct sock *sk = sk_atm(vcc);
@@ -208,8 +203,6 @@ void vcc_release_async(struct atm_vcc *vcc, int reply)
         clear_bit(ATM_VF_WAITING, &vcc->flags);
         sk->sk_state_change(sk);
 }
-
-
 EXPORT_SYMBOL(vcc_release_async);
 
 
@@ -235,37 +228,37 @@ void atm_dev_release_vccs(struct atm_dev *dev)
         write_unlock_irq(&vcc_sklist_lock);
 }
 
-
-static int adjust_tp(struct atm_trafprm *tp,unsigned char aal)
+static int adjust_tp(struct atm_trafprm *tp, unsigned char aal)
 {
         int max_sdu;
 
-        if (!tp->traffic_class) return 0;
+        if (!tp->traffic_class)
+                return 0;
         switch (aal) {
-                case ATM_AAL0:
-                        max_sdu = ATM_CELL_SIZE-1;
-                        break;
-                case ATM_AAL34:
-                        max_sdu = ATM_MAX_AAL34_PDU;
-                        break;
-                default:
-                        printk(KERN_WARNING "ATM: AAL problems ... "
-                            "(%d)\n",aal);
-                        /* fall through */
-                case ATM_AAL5:
-                        max_sdu = ATM_MAX_AAL5_PDU;
+        case ATM_AAL0:
+                max_sdu = ATM_CELL_SIZE-1;
+                break;
+        case ATM_AAL34:
+                max_sdu = ATM_MAX_AAL34_PDU;
+                break;
+        default:
+                pr_warning("AAL problems ... (%d)\n", aal);
+                /* fall through */
+        case ATM_AAL5:
+                max_sdu = ATM_MAX_AAL5_PDU;
         }
-        if (!tp->max_sdu) tp->max_sdu = max_sdu;
-        else if (tp->max_sdu > max_sdu) return -EINVAL;
-        if (!tp->max_cdv) tp->max_cdv = ATM_MAX_CDV;
+        if (!tp->max_sdu)
+                tp->max_sdu = max_sdu;
+        else if (tp->max_sdu > max_sdu)
+                return -EINVAL;
+        if (!tp->max_cdv)
+                tp->max_cdv = ATM_MAX_CDV;
         return 0;
 }
 
-
 static int check_ci(const struct atm_vcc *vcc, short vpi, int vci)
 {
-        struct hlist_head *head = &vcc_hash[vci &
-                                        (VCC_HTABLE_SIZE - 1)];
+        struct hlist_head *head = &vcc_hash[vci & (VCC_HTABLE_SIZE - 1)];
         struct hlist_node *node;
         struct sock *s;
         struct atm_vcc *walk;
@@ -289,7 +282,6 @@ static int check_ci(const struct atm_vcc *vcc, short vpi, int vci)
         return 0;
 }
 
-
 static int find_ci(const struct atm_vcc *vcc, short *vpi, int *vci)
 {
         static short p;        /* poor man's per-device cache */
@@ -327,14 +319,13 @@ static int find_ci(const struct atm_vcc *vcc, short *vpi, int *vci)
                 if ((c == ATM_NOT_RSV_VCI || *vci != ATM_VCI_ANY) &&
                     *vpi == ATM_VPI_ANY) {
                         p++;
-                        if (p >= 1 << vcc->dev->ci_range.vpi_bits) p = 0;
+                        if (p >= 1 << vcc->dev->ci_range.vpi_bits)
+                                p = 0;
                 }
-        }
-        while (old_p != p || old_c != c);
+        } while (old_p != p || old_c != c);
         return -EADDRINUSE;
 }
 
-
 static int __vcc_connect(struct atm_vcc *vcc, struct atm_dev *dev, short vpi,
                          int vci)
 {
@@ -362,37 +353,46 @@ static int __vcc_connect(struct atm_vcc *vcc, struct atm_dev *dev, short vpi,
         __vcc_insert_socket(sk);
         write_unlock_irq(&vcc_sklist_lock);
         switch (vcc->qos.aal) {
-                case ATM_AAL0:
-                        error = atm_init_aal0(vcc);
-                        vcc->stats = &dev->stats.aal0;
-                        break;
-                case ATM_AAL34:
-                        error = atm_init_aal34(vcc);
-                        vcc->stats = &dev->stats.aal34;
-                        break;
-                case ATM_NO_AAL:
-                        /* ATM_AAL5 is also used in the "0 for default" case */
-                        vcc->qos.aal = ATM_AAL5;
-                        /* fall through */
-                case ATM_AAL5:
-                        error = atm_init_aal5(vcc);
-                        vcc->stats = &dev->stats.aal5;
-                        break;
-                default:
-                        error = -EPROTOTYPE;
+        case ATM_AAL0:
+                error = atm_init_aal0(vcc);
+                vcc->stats = &dev->stats.aal0;
+                break;
+        case ATM_AAL34:
+                error = atm_init_aal34(vcc);
+                vcc->stats = &dev->stats.aal34;
+                break;
+        case ATM_NO_AAL:
+                /* ATM_AAL5 is also used in the "0 for default" case */
+                vcc->qos.aal = ATM_AAL5;
+                /* fall through */
+        case ATM_AAL5:
+                error = atm_init_aal5(vcc);
+                vcc->stats = &dev->stats.aal5;
+                break;
+        default:
+                error = -EPROTOTYPE;
         }
-        if (!error) error = adjust_tp(&vcc->qos.txtp,vcc->qos.aal);
-        if (!error) error = adjust_tp(&vcc->qos.rxtp,vcc->qos.aal);
+        if (!error)
+                error = adjust_tp(&vcc->qos.txtp, vcc->qos.aal);
+        if (!error)
+                error = adjust_tp(&vcc->qos.rxtp, vcc->qos.aal);
         if (error)
                 goto fail;
-        pr_debug("VCC %d.%d, AAL %d\n",vpi,vci,vcc->qos.aal);
-        pr_debug("  TX: %d, PCR %d..%d, SDU %d\n",vcc->qos.txtp.traffic_class,
-            vcc->qos.txtp.min_pcr,vcc->qos.txtp.max_pcr,vcc->qos.txtp.max_sdu);
-        pr_debug("  RX: %d, PCR %d..%d, SDU %d\n",vcc->qos.rxtp.traffic_class,
-            vcc->qos.rxtp.min_pcr,vcc->qos.rxtp.max_pcr,vcc->qos.rxtp.max_sdu);
+        pr_debug("VCC %d.%d, AAL %d\n", vpi, vci, vcc->qos.aal);
+        pr_debug("  TX: %d, PCR %d..%d, SDU %d\n",
+                 vcc->qos.txtp.traffic_class,
+                 vcc->qos.txtp.min_pcr,
+                 vcc->qos.txtp.max_pcr,
+                 vcc->qos.txtp.max_sdu);
+        pr_debug("  RX: %d, PCR %d..%d, SDU %d\n",
+                 vcc->qos.rxtp.traffic_class,
+                 vcc->qos.rxtp.min_pcr,
+                 vcc->qos.rxtp.max_pcr,
+                 vcc->qos.rxtp.max_sdu);
 
         if (dev->ops->open) {
-                if ((error = dev->ops->open(vcc)))
+                error = dev->ops->open(vcc);
+                if (error)
                         goto fail;
         }
         return 0;
@@ -406,14 +406,13 @@ fail_module_put:
         return error;
 }
 
-
 int vcc_connect(struct socket *sock, int itf, short vpi, int vci)
 {
         struct atm_dev *dev;
         struct atm_vcc *vcc = ATM_SD(sock);
         int error;
 
-        pr_debug("vcc_connect (vpi %d, vci %d)\n",vpi,vci);
+        pr_debug("(vpi %d, vci %d)\n", vpi, vci);
         if (sock->state == SS_CONNECTED)
                 return -EISCONN;
         if (sock->state != SS_UNCONNECTED)
@@ -422,30 +421,33 @@ int vcc_connect(struct socket *sock, int itf, short vpi, int vci)
                 return -EINVAL;
 
         if (vpi != ATM_VPI_UNSPEC && vci != ATM_VCI_UNSPEC)
-                clear_bit(ATM_VF_PARTIAL,&vcc->flags);
+                clear_bit(ATM_VF_PARTIAL, &vcc->flags);
         else
-                if (test_bit(ATM_VF_PARTIAL,&vcc->flags))
+                if (test_bit(ATM_VF_PARTIAL, &vcc->flags))
                         return -EINVAL;
-        pr_debug("vcc_connect (TX: cl %d,bw %d-%d,sdu %d; "
-            "RX: cl %d,bw %d-%d,sdu %d,AAL %s%d)\n",
-            vcc->qos.txtp.traffic_class,vcc->qos.txtp.min_pcr,
-            vcc->qos.txtp.max_pcr,vcc->qos.txtp.max_sdu,
-            vcc->qos.rxtp.traffic_class,vcc->qos.rxtp.min_pcr,
-            vcc->qos.rxtp.max_pcr,vcc->qos.rxtp.max_sdu,
-            vcc->qos.aal == ATM_AAL5 ? "" : vcc->qos.aal == ATM_AAL0 ? "" :
-            " ??? code ",vcc->qos.aal == ATM_AAL0 ? 0 : vcc->qos.aal);
+        pr_debug("(TX: cl %d,bw %d-%d,sdu %d; "
+                 "RX: cl %d,bw %d-%d,sdu %d,AAL %s%d)\n",
+                 vcc->qos.txtp.traffic_class, vcc->qos.txtp.min_pcr,
+                 vcc->qos.txtp.max_pcr, vcc->qos.txtp.max_sdu,
+                 vcc->qos.rxtp.traffic_class, vcc->qos.rxtp.min_pcr,
+                 vcc->qos.rxtp.max_pcr, vcc->qos.rxtp.max_sdu,
+                 vcc->qos.aal == ATM_AAL5 ? "" :
+                 vcc->qos.aal == ATM_AAL0 ? "" : " ??? code ",
+                 vcc->qos.aal == ATM_AAL0 ? 0 : vcc->qos.aal);
         if (!test_bit(ATM_VF_HASQOS, &vcc->flags))
                 return -EBADFD;
         if (vcc->qos.txtp.traffic_class == ATM_ANYCLASS ||
             vcc->qos.rxtp.traffic_class == ATM_ANYCLASS)
                 return -EINVAL;
         if (likely(itf != ATM_ITF_ANY)) {
-                dev = try_then_request_module(atm_dev_lookup(itf), "atm-device-%d", itf);
+                dev = try_then_request_module(atm_dev_lookup(itf),
+                                              "atm-device-%d", itf);
         } else {
                 dev = NULL;
                 mutex_lock(&atm_dev_mutex);
                 if (!list_empty(&atm_devs)) {
-                        dev = list_entry(atm_devs.next, struct atm_dev, dev_list);
+                        dev = list_entry(atm_devs.next,
+                                         struct atm_dev, dev_list);
                         atm_dev_hold(dev);
                 }
                 mutex_unlock(&atm_dev_mutex);
@@ -458,13 +460,12 @@ int vcc_connect(struct socket *sock, int itf, short vpi, int vci)
                 return error;
         }
         if (vpi == ATM_VPI_UNSPEC || vci == ATM_VCI_UNSPEC)
-                set_bit(ATM_VF_PARTIAL,&vcc->flags);
-        if (test_bit(ATM_VF_READY,&ATM_SD(sock)->flags))
+                set_bit(ATM_VF_PARTIAL, &vcc->flags);
+        if (test_bit(ATM_VF_READY, &ATM_SD(sock)->flags))
                 sock->state = SS_CONNECTED;
         return 0;
 }
 
-
 int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                 size_t size, int flags)
 {
@@ -478,8 +479,8 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         if (flags & ~MSG_DONTWAIT)              /* only handle MSG_DONTWAIT */
                 return -EOPNOTSUPP;
         vcc = ATM_SD(sock);
-        if (test_bit(ATM_VF_RELEASED,&vcc->flags) ||
-            test_bit(ATM_VF_CLOSE,&vcc->flags) ||
+        if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
+            test_bit(ATM_VF_CLOSE, &vcc->flags) ||
             !test_bit(ATM_VF_READY, &vcc->flags))
                 return 0;
 
@@ -497,13 +498,12 @@ int vcc_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         if (error)
                 return error;
         sock_recv_ts_and_drops(msg, sk, skb);
-        pr_debug("RcvM %d -= %d\n", atomic_read(&sk->sk_rmem_alloc), skb->truesize);
+        pr_debug("%d -= %d\n", atomic_read(&sk->sk_rmem_alloc), skb->truesize);
         atm_return(vcc, skb->truesize);
         skb_free_datagram(sk, skb);
         return copied;
 }
 
-
 int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
                 size_t total_len)
 {
@@ -511,7 +511,7 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
         DEFINE_WAIT(wait);
         struct atm_vcc *vcc;
         struct sk_buff *skb;
-        int eff,error;
+        int eff, error;
         const void __user *buff;
         int size;
 
@@ -550,7 +550,7 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
         eff = (size+3) & ~3; /* align to word boundary */
         prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
         error = 0;
-        while (!(skb = alloc_tx(vcc,eff))) {
+        while (!(skb = alloc_tx(vcc, eff))) {
                 if (m->msg_flags & MSG_DONTWAIT) {
                         error = -EAGAIN;
                         break;
@@ -560,9 +560,9 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
                         error = -ERESTARTSYS;
                         break;
                 }
-                if (test_bit(ATM_VF_RELEASED,&vcc->flags) ||
-                    test_bit(ATM_VF_CLOSE,&vcc->flags) ||
-                    !test_bit(ATM_VF_READY,&vcc->flags)) {
+                if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
+                    test_bit(ATM_VF_CLOSE, &vcc->flags) ||
+                    !test_bit(ATM_VF_READY, &vcc->flags)) {
                         error = -EPIPE;
                         send_sig(SIGPIPE, current, 0);
                         break;
@@ -574,20 +574,20 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
                 goto out;
         skb->dev = NULL; /* for paths shared with net_device interfaces */
         ATM_SKB(skb)->atm_options = vcc->atm_options;
-        if (copy_from_user(skb_put(skb,size),buff,size)) {
+        if (copy_from_user(skb_put(skb, size), buff, size)) {
                 kfree_skb(skb);
                 error = -EFAULT;
                 goto out;
         }
-        if (eff != size) memset(skb->data+size,0,eff-size);
-        error = vcc->dev->ops->send(vcc,skb);
+        if (eff != size)
+                memset(skb->data + size, 0, eff-size);
+        error = vcc->dev->ops->send(vcc, skb);
         error = error ? error : size;
 out:
         release_sock(sk);
         return error;
 }
 
-
 unsigned int vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
 {
         struct sock *sk = sock->sk;
@@ -623,8 +623,7 @@ unsigned int vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
         return mask;
 }
 
-
-static int atm_change_qos(struct atm_vcc *vcc,struct atm_qos *qos)
+static int atm_change_qos(struct atm_vcc *vcc, struct atm_qos *qos)
 {
         int error;
 
@@ -636,25 +635,31 @@ static int atm_change_qos(struct atm_vcc *vcc,struct atm_qos *qos)
             qos->rxtp.traffic_class != vcc->qos.rxtp.traffic_class ||
             qos->txtp.traffic_class != vcc->qos.txtp.traffic_class)
                 return -EINVAL;
-        error = adjust_tp(&qos->txtp,qos->aal);
-        if (!error) error = adjust_tp(&qos->rxtp,qos->aal);
-        if (error) return error;
-        if (!vcc->dev->ops->change_qos) return -EOPNOTSUPP;
+        error = adjust_tp(&qos->txtp, qos->aal);
+        if (!error)
+                error = adjust_tp(&qos->rxtp, qos->aal);
+        if (error)
+                return error;
+        if (!vcc->dev->ops->change_qos)
+                return -EOPNOTSUPP;
         if (sk_atm(vcc)->sk_family == AF_ATMPVC)
-                return vcc->dev->ops->change_qos(vcc,qos,ATM_MF_SET);
-        return svc_change_qos(vcc,qos);
+                return vcc->dev->ops->change_qos(vcc, qos, ATM_MF_SET);
+        return svc_change_qos(vcc, qos);
 }
 
-
 static int check_tp(const struct atm_trafprm *tp)
 {
         /* @@@ Should be merged with adjust_tp */
-        if (!tp->traffic_class || tp->traffic_class == ATM_ANYCLASS) return 0;
+        if (!tp->traffic_class || tp->traffic_class == ATM_ANYCLASS)
+                return 0;
         if (tp->traffic_class != ATM_UBR && !tp->min_pcr && !tp->pcr &&
-            !tp->max_pcr) return -EINVAL;
-        if (tp->min_pcr == ATM_MAX_PCR) return -EINVAL;
+            !tp->max_pcr)
+                return -EINVAL;
+        if (tp->min_pcr == ATM_MAX_PCR)
+                return -EINVAL;
         if (tp->min_pcr && tp->max_pcr && tp->max_pcr != ATM_MAX_PCR &&
-            tp->min_pcr > tp->max_pcr) return -EINVAL;
+            tp->min_pcr > tp->max_pcr)
+                return -EINVAL;
         /*
          * We allow pcr to be outside [min_pcr,max_pcr], because later
          * adjustment may still push it in the valid range.
@@ -662,7 +667,6 @@ static int check_tp(const struct atm_trafprm *tp)
         return 0;
 }
 
-
 static int check_qos(const struct atm_qos *qos)
 {
         int error;
@@ -672,9 +676,11 @@ static int check_qos(const struct atm_qos *qos)
         if (qos->txtp.traffic_class != qos->rxtp.traffic_class &&
             qos->txtp.traffic_class && qos->rxtp.traffic_class &&
             qos->txtp.traffic_class != ATM_ANYCLASS &&
-            qos->rxtp.traffic_class != ATM_ANYCLASS) return -EINVAL;
+            qos->rxtp.traffic_class != ATM_ANYCLASS)
+                return -EINVAL;
         error = check_tp(&qos->txtp);
-        if (error) return error;
+        if (error)
+                return error;
         return check_tp(&qos->rxtp);
 }
 
@@ -690,37 +696,41 @@ int vcc_setsockopt(struct socket *sock, int level, int optname,
 
         vcc = ATM_SD(sock);
         switch (optname) {
-                case SO_ATMQOS:
-                        {
-                                struct atm_qos qos;
-
-                                if (copy_from_user(&qos,optval,sizeof(qos)))
-                                        return -EFAULT;
-                                error = check_qos(&qos);
-                                if (error) return error;
-                                if (sock->state == SS_CONNECTED)
-                                        return atm_change_qos(vcc,&qos);
-                                if (sock->state != SS_UNCONNECTED)
-                                        return -EBADFD;
-                                vcc->qos = qos;
-                                set_bit(ATM_VF_HASQOS,&vcc->flags);
-                                return 0;
-                        }
-                case SO_SETCLP:
-                        if (get_user(value,(unsigned long __user *)optval))
-                                return -EFAULT;
-                        if (value) vcc->atm_options |= ATM_ATMOPT_CLP;
-                        else vcc->atm_options &= ~ATM_ATMOPT_CLP;
-                        return 0;
-                default:
-                        if (level == SOL_SOCKET) return -EINVAL;
-                        break;
+        case SO_ATMQOS:
+        {
+                struct atm_qos qos;
+
+                if (copy_from_user(&qos, optval, sizeof(qos)))
+                        return -EFAULT;
+                error = check_qos(&qos);
+                if (error)
+                        return error;
+                if (sock->state == SS_CONNECTED)
+                        return atm_change_qos(vcc, &qos);
+                if (sock->state != SS_UNCONNECTED)
+                        return -EBADFD;
+                vcc->qos = qos;
+                set_bit(ATM_VF_HASQOS, &vcc->flags);
+                return 0;
         }
-        if (!vcc->dev || !vcc->dev->ops->setsockopt) return -EINVAL;
-        return vcc->dev->ops->setsockopt(vcc,level,optname,optval,optlen);
+        case SO_SETCLP:
+                if (get_user(value, (unsigned long __user *)optval))
+                        return -EFAULT;
+                if (value)
+                        vcc->atm_options |= ATM_ATMOPT_CLP;
+                else
+                        vcc->atm_options &= ~ATM_ATMOPT_CLP;
+                return 0;
+        default:
+                if (level == SOL_SOCKET)
+                        return -EINVAL;
+                break;
+        }
+        if (!vcc->dev || !vcc->dev->ops->setsockopt)
+                return -EINVAL;
+        return vcc->dev->ops->setsockopt(vcc, level, optname, optval, optlen);
 }
 
-
 int vcc_getsockopt(struct socket *sock, int level, int optname,
                    char __user *optval, int __user *optlen)
 {
@@ -734,33 +744,33 @@ int vcc_getsockopt(struct socket *sock, int level, int optname,
 
         vcc = ATM_SD(sock);
         switch (optname) {
-                case SO_ATMQOS:
-                        if (!test_bit(ATM_VF_HASQOS,&vcc->flags))
-                                return -EINVAL;
-                        return copy_to_user(optval,&vcc->qos,sizeof(vcc->qos)) ?
-                            -EFAULT : 0;
-                case SO_SETCLP:
-                        return put_user(vcc->atm_options & ATM_ATMOPT_CLP ? 1 :
-                          0,(unsigned long __user *)optval) ? -EFAULT : 0;
-                case SO_ATMPVC:
-                        {
-                                struct sockaddr_atmpvc pvc;
-
-                                if (!vcc->dev ||
-                                    !test_bit(ATM_VF_ADDR,&vcc->flags))
-                                        return -ENOTCONN;
-                                pvc.sap_family = AF_ATMPVC;
-                                pvc.sap_addr.itf = vcc->dev->number;
-                                pvc.sap_addr.vpi = vcc->vpi;
-                                pvc.sap_addr.vci = vcc->vci;
-                                return copy_to_user(optval,&pvc,sizeof(pvc)) ?
-                                    -EFAULT : 0;
-                        }
-                default:
-                        if (level == SOL_SOCKET) return -EINVAL;
+        case SO_ATMQOS:
+                if (!test_bit(ATM_VF_HASQOS, &vcc->flags))
+                        return -EINVAL;
+                return copy_to_user(optval, &vcc->qos, sizeof(vcc->qos))
+                        ? -EFAULT : 0;
+        case SO_SETCLP:
+                return put_user(vcc->atm_options & ATM_ATMOPT_CLP ? 1 : 0,
+                                (unsigned long __user *)optval) ? -EFAULT : 0;
+        case SO_ATMPVC:
+        {
+                struct sockaddr_atmpvc pvc;
+
+                if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
+                        return -ENOTCONN;
+                pvc.sap_family = AF_ATMPVC;
+                pvc.sap_addr.itf = vcc->dev->number;
+                pvc.sap_addr.vpi = vcc->vpi;
+                pvc.sap_addr.vci = vcc->vci;
+                return copy_to_user(optval, &pvc, sizeof(pvc)) ? -EFAULT : 0;
+        }
+        default:
+                if (level == SOL_SOCKET)
+                        return -EINVAL;
                         break;
         }
-        if (!vcc->dev || !vcc->dev->ops->getsockopt) return -EINVAL;
+        if (!vcc->dev || !vcc->dev->ops->getsockopt)
+                return -EINVAL;
         return vcc->dev->ops->getsockopt(vcc, level, optname, optval, len);
 }
 
@@ -768,23 +778,27 @@ static int __init atm_init(void)
 {
         int error;
 
-        if ((error = proto_register(&vcc_proto, 0)) < 0)
+        error = proto_register(&vcc_proto, 0);
+        if (error < 0)
                 goto out;
-
-        if ((error = atmpvc_init()) < 0) {
-                printk(KERN_ERR "atmpvc_init() failed with %d\n", error);
+        error = atmpvc_init();
+        if (error < 0) {
+                pr_err("atmpvc_init() failed with %d\n", error);
                 goto out_unregister_vcc_proto;
         }
-        if ((error = atmsvc_init()) < 0) {
-                printk(KERN_ERR "atmsvc_init() failed with %d\n", error);
+        error = atmsvc_init();
+        if (error < 0) {
+                pr_err("atmsvc_init() failed with %d\n", error);
                 goto out_atmpvc_exit;
         }
-        if ((error = atm_proc_init()) < 0) {
-                printk(KERN_ERR "atm_proc_init() failed with %d\n",error);
+        error = atm_proc_init();
+        if (error < 0) {
+                pr_err("atm_proc_init() failed with %d\n", error);
                 goto out_atmsvc_exit;
         }
-        if ((error = atm_sysfs_init()) < 0) {
-                printk(KERN_ERR "atm_sysfs_init() failed with %d\n",error);
+        error = atm_sysfs_init();
+        if (error < 0) {
+                pr_err("atm_sysfs_init() failed with %d\n", error);
                 goto out_atmproc_exit;
         }
 out:
diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c
index 2ea40995dced..62dc8bfe6fe7 100644
--- a/net/atm/ioctl.c
+++ b/net/atm/ioctl.c
@@ -3,6 +3,7 @@
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 /* 2003 John Levon  <levon@movementarian.org> */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/module.h>
 #include <linux/kmod.h>
@@ -36,6 +37,7 @@ void register_atm_ioctl(struct atm_ioctl *ioctl)
         list_add_tail(&ioctl->list, &ioctl_list);
         mutex_unlock(&ioctl_mutex);
 }
+EXPORT_SYMBOL(register_atm_ioctl);
 
 void deregister_atm_ioctl(struct atm_ioctl *ioctl)
 {
@@ -43,129 +45,128 @@ void deregister_atm_ioctl(struct atm_ioctl *ioctl)
         list_del(&ioctl->list);
         mutex_unlock(&ioctl_mutex);
 }
-
-EXPORT_SYMBOL(register_atm_ioctl);
 EXPORT_SYMBOL(deregister_atm_ioctl);
 
-static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg, int compat)
+static int do_vcc_ioctl(struct socket *sock, unsigned int cmd,
+                        unsigned long arg, int compat)
 {
         struct sock *sk = sock->sk;
         struct atm_vcc *vcc;
         int error;
-        struct list_head * pos;
+        struct list_head *pos;
         void __user *argp = (void __user *)arg;
 
         vcc = ATM_SD(sock);
         switch (cmd) {
-                case SIOCOUTQ:
-                        if (sock->state != SS_CONNECTED ||
-                            !test_bit(ATM_VF_READY, &vcc->flags)) {
-                                error =  -EINVAL;
-                                goto done;
-                        }
-                        error = put_user(sk->sk_sndbuf - sk_wmem_alloc_get(sk),
-                                         (int __user *) argp) ? -EFAULT : 0;
+        case SIOCOUTQ:
+                if (sock->state != SS_CONNECTED ||
+                    !test_bit(ATM_VF_READY, &vcc->flags)) {
+                        error =  -EINVAL;
+                        goto done;
+                }
+                error = put_user(sk->sk_sndbuf - sk_wmem_alloc_get(sk),
+                                 (int __user *)argp) ? -EFAULT : 0;
+                goto done;
+        case SIOCINQ:
+        {
+                struct sk_buff *skb;
+
+                if (sock->state != SS_CONNECTED) {
+                        error = -EINVAL;
                         goto done;
-                case SIOCINQ:
-                        {
-                                struct sk_buff *skb;
-
-                                if (sock->state != SS_CONNECTED) {
-                                        error = -EINVAL;
-                                        goto done;
-                                }
-                                skb = skb_peek(&sk->sk_receive_queue);
-                                error = put_user(skb ? skb->len : 0,
-                                                 (int __user *)argp) ? -EFAULT : 0;
-                                goto done;
-                        }
-                case SIOCGSTAMP: /* borrowed from IP */
+                }
+                skb = skb_peek(&sk->sk_receive_queue);
+                error = put_user(skb ? skb->len : 0,
+                                 (int __user *)argp) ? -EFAULT : 0;
+                goto done;
+        }
+        case SIOCGSTAMP: /* borrowed from IP */
 #ifdef CONFIG_COMPAT
-                        if (compat)
-                                error = compat_sock_get_timestamp(sk, argp);
-                        else
+                if (compat)
+                        error = compat_sock_get_timestamp(sk, argp);
+                else
 #endif
-                                error = sock_get_timestamp(sk, argp);
-                        goto done;
-                case SIOCGSTAMPNS: /* borrowed from IP */
+                        error = sock_get_timestamp(sk, argp);
+                goto done;
+        case SIOCGSTAMPNS: /* borrowed from IP */
 #ifdef CONFIG_COMPAT
-                        if (compat)
-                                error = compat_sock_get_timestampns(sk, argp);
-                        else
+                if (compat)
+                        error = compat_sock_get_timestampns(sk, argp);
+                else
 #endif
-                                error = sock_get_timestampns(sk, argp);
+                        error = sock_get_timestampns(sk, argp);
+                goto done;
+        case ATM_SETSC:
+                if (net_ratelimit())
+                        pr_warning("ATM_SETSC is obsolete; used by %s:%d\n",
+                                   current->comm, task_pid_nr(current));
+                error = 0;
+                goto done;
+        case ATMSIGD_CTRL:
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
                         goto done;
-                case ATM_SETSC:
-                        if (net_ratelimit())
-                                printk(KERN_WARNING "ATM_SETSC is obsolete; used by %s:%d\n",
-                                       current->comm, task_pid_nr(current));
-                        error = 0;
+                }
+                /*
+                 * The user/kernel protocol for exchanging signalling
+                 * info uses kernel pointers as opaque references,
+                 * so the holder of the file descriptor can scribble
+                 * on the kernel... so we should make sure that we
+                 * have the same privileges that /proc/kcore needs
+                 */
+                if (!capable(CAP_SYS_RAWIO)) {
+                        error = -EPERM;
                         goto done;
-                case ATMSIGD_CTRL:
-                        if (!capable(CAP_NET_ADMIN)) {
-                                error = -EPERM;
-                                goto done;
-                        }
-                        /*
-                         * The user/kernel protocol for exchanging signalling
-                         * info uses kernel pointers as opaque references,
-                         * so the holder of the file descriptor can scribble
-                         * on the kernel... so we should make sure that we
-                         * have the same privileges that /proc/kcore needs
-                         */
-                        if (!capable(CAP_SYS_RAWIO)) {
-                                error = -EPERM;
-                                goto done;
-                        }
+                }
 #ifdef CONFIG_COMPAT
-                        /* WTF? I don't even want to _think_ about making this
-                           work for 32-bit userspace. TBH I don't really want
-                           to think about it at all. dwmw2. */
-                        if (compat) {
-                                if (net_ratelimit())
-                                        printk(KERN_WARNING "32-bit task cannot be atmsigd\n");
-                                error = -EINVAL;
-                                goto done;
-                        }
+                /* WTF? I don't even want to _think_ about making this
+                   work for 32-bit userspace. TBH I don't really want
+                   to think about it at all. dwmw2. */
+                if (compat) {
+                        if (net_ratelimit())
+                                pr_warning("32-bit task cannot be atmsigd\n");
+                        error = -EINVAL;
+                        goto done;
+                }
 #endif
-                        error = sigd_attach(vcc);
-                        if (!error)
-                                sock->state = SS_CONNECTED;
+                error = sigd_attach(vcc);
+                if (!error)
+                        sock->state = SS_CONNECTED;
+                goto done;
+        case ATM_SETBACKEND:
+        case ATM_NEWBACKENDIF:
+        {
+                atm_backend_t backend;
+                error = get_user(backend, (atm_backend_t __user *)argp);
+                if (error)
                         goto done;
-                case ATM_SETBACKEND:
-                case ATM_NEWBACKENDIF:
-                        {
-                                atm_backend_t backend;
-                                error = get_user(backend, (atm_backend_t __user *) argp);
-                                if (error)
-                                        goto done;
-                                switch (backend) {
-                                        case ATM_BACKEND_PPP:
-                                                request_module("pppoatm");
-                                                break;
-                                        case ATM_BACKEND_BR2684:
-                                                request_module("br2684");
-                                                break;
-                                }
-                        }
-                        break;
-                case ATMMPC_CTRL:
-                case ATMMPC_DATA:
-                        request_module("mpoa");
-                        break;
-                case ATMARPD_CTRL:
-                        request_module("clip");
+                switch (backend) {
+                case ATM_BACKEND_PPP:
+                        request_module("pppoatm");
                         break;
-                case ATMLEC_CTRL:
-                        request_module("lec");
+                case ATM_BACKEND_BR2684:
+                        request_module("br2684");
                         break;
+                }
+                break;
+        }
+        case ATMMPC_CTRL:
+        case ATMMPC_DATA:
+                request_module("mpoa");
+                break;
+        case ATMARPD_CTRL:
+                request_module("clip");
+                break;
+        case ATMLEC_CTRL:
+                request_module("lec");
+                break;
         }
 
         error = -ENOIOCTLCMD;
 
         mutex_lock(&ioctl_mutex);
         list_for_each(pos, &ioctl_list) {
-                struct atm_ioctl * ic = list_entry(pos, struct atm_ioctl, list);
+                struct atm_ioctl *ic = list_entry(pos, struct atm_ioctl, list);
                 if (try_module_get(ic->owner)) {
                         error = ic->ioctl(sock, cmd, arg);
                         module_put(ic->owner);
@@ -184,7 +185,6 @@ done:
         return error;
 }
 
-
 int vcc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         return do_vcc_ioctl(sock, cmd, arg, 0);
@@ -287,8 +287,8 @@ static int do_atmif_sioc(struct socket *sock, unsigned int cmd,
         sioc = compat_alloc_user_space(sizeof(*sioc));
         sioc32 = compat_ptr(arg);
 
-        if (copy_in_user(&sioc->number, &sioc32->number, 2 * sizeof(int))
-            || get_user(data, &sioc32->arg))
+        if (copy_in_user(&sioc->number, &sioc32->number, 2 * sizeof(int)) ||
+            get_user(data, &sioc32->arg))
                 return -EFAULT;
         datap = compat_ptr(data);
         if (put_user(datap, &sioc->arg))
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 42749b7b917c..5da5753157f9 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -4,6 +4,8 @@
  * Marko Kiiskila <mkiiskila@yahoo.com>
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
 #include <linux/kernel.h>
 #include <linux/bitops.h>
 #include <linux/capability.h>
@@ -16,7 +18,7 @@
 #include <linux/skbuff.h>
 #include <linux/ip.h>
 #include <asm/byteorder.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <net/arp.h>
 #include <net/dst.h>
 #include <linux/proc_fs.h>
@@ -85,17 +87,19 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                                        int is_rdesc,
                                        struct lec_arp_table **ret_entry);
 static void lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
-                           const unsigned char *atm_addr, unsigned long remoteflag,
+                           const unsigned char *atm_addr,
+                           unsigned long remoteflag,
                            unsigned int targetless_le_arp);
 static void lec_flush_complete(struct lec_priv *priv, unsigned long tran_id);
 static int lec_mcast_make(struct lec_priv *priv, struct atm_vcc *vcc);
 static void lec_set_flush_tran_id(struct lec_priv *priv,
                                   const unsigned char *atm_addr,
                                   unsigned long tran_id);
-static void lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
+static void lec_vcc_added(struct lec_priv *priv,
+                          const struct atmlec_ioc *ioc_data,
                           struct atm_vcc *vcc,
-                          void (*old_push) (struct atm_vcc *vcc,
-                                            struct sk_buff *skb));
+                          void (*old_push)(struct atm_vcc *vcc,
+                                           struct sk_buff *skb));
 static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc);
 
 /* must be done under lec_arp_lock */
@@ -110,7 +114,6 @@ static inline void lec_arp_put(struct lec_arp_table *entry)
                 kfree(entry);
 }
 
-
 static struct lane2_ops lane2_ops = {
         lane2_resolve,          /* resolve,             spec 3.1.3 */
         lane2_associate_req,    /* associate_req,       spec 3.1.4 */
@@ -148,7 +151,8 @@ static void lec_handle_bridge(struct sk_buff *skb, struct net_device *dev)
                 mesg = (struct atmlec_msg *)skb2->data;
                 mesg->type = l_topology_change;
                 buff += 4;
-                mesg->content.normal.flag = *buff & 0x01;       /* 0x01 is topology change */
+                mesg->content.normal.flag = *buff & 0x01;
+                                        /* 0x01 is topology change */
 
                 priv = netdev_priv(dev);
                 atm_force_charge(priv->lecd, skb2->truesize);
@@ -242,7 +246,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb)
 
 static void lec_tx_timeout(struct net_device *dev)
 {
-        printk(KERN_INFO "%s: tx timeout\n", dev->name);
+        pr_info("%s\n", dev->name);
         dev->trans_start = jiffies;
         netif_wake_queue(dev);
 }
@@ -261,14 +265,10 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
         unsigned char rdesc[ETH_ALEN];  /* Token Ring route descriptor */
 #endif
         int is_rdesc;
-#if DUMP_PACKETS > 0
-        char buf[300];
-        int i = 0;
-#endif /* DUMP_PACKETS >0 */
 
-        pr_debug("lec_start_xmit called\n");
+        pr_debug("called\n");
         if (!priv->lecd) {
-                printk("%s:No lecd attached\n", dev->name);
+                pr_info("%s:No lecd attached\n", dev->name);
                 dev->stats.tx_errors++;
                 netif_stop_queue(dev);
                 kfree_skb(skb);
@@ -276,8 +276,8 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
         }
 
         pr_debug("skbuff head:%lx data:%lx tail:%lx end:%lx\n",
-                (long)skb->head, (long)skb->data, (long)skb_tail_pointer(skb),
-                (long)skb_end_pointer(skb));
+                 (long)skb->head, (long)skb->data, (long)skb_tail_pointer(skb),
+                 (long)skb_end_pointer(skb));
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
         if (memcmp(skb->data, bridge_ula_lec, sizeof(bridge_ula_lec)) == 0)
                 lec_handle_bridge(skb, dev);
@@ -285,8 +285,7 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
 
         /* Make sure we have room for lec_id */
         if (skb_headroom(skb) < 2) {
-
-                pr_debug("lec_start_xmit: reallocating skb\n");
+                pr_debug("reallocating skb\n");
                 skb2 = skb_realloc_headroom(skb, LEC_HEADER_LEN);
                 kfree_skb(skb);
                 if (skb2 == NULL)
@@ -313,23 +312,17 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
         }
 #endif
 
-#if DUMP_PACKETS > 0
-        printk("%s: send datalen:%ld lecid:%4.4x\n", dev->name,
-               skb->len, priv->lecid);
 #if DUMP_PACKETS >= 2
-        for (i = 0; i < skb->len && i < 99; i++) {
-                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
-        }
+#define MAX_DUMP_SKB 99
 #elif DUMP_PACKETS >= 1
-        for (i = 0; i < skb->len && i < 30; i++) {
-                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
-        }
+#define MAX_DUMP_SKB 30
+#endif
+#if DUMP_PACKETS >= 1
+        printk(KERN_DEBUG "%s: send datalen:%ld lecid:%4.4x\n",
+               dev->name, skb->len, priv->lecid);
+        print_hex_dump(KERN_DEBUG, "", DUMP_OFFSET, 16, 1,
+                       skb->data, min(skb->len, MAX_DUMP_SKB), true);
 #endif /* DUMP_PACKETS >= 1 */
-        if (i == skb->len)
-                printk("%s\n", buf);
-        else
-                printk("%s...\n", buf);
-#endif /* DUMP_PACKETS > 0 */
 
         /* Minimum ethernet-frame size */
 #ifdef CONFIG_TR
@@ -367,31 +360,28 @@ static netdev_tx_t lec_start_xmit(struct sk_buff *skb,
 #endif
         entry = NULL;
         vcc = lec_arp_resolve(priv, dst, is_rdesc, &entry);
-        pr_debug("%s:vcc:%p vcc_flags:%lx, entry:%p\n", dev->name,
-                vcc, vcc ? vcc->flags : 0, entry);
+        pr_debug("%s:vcc:%p vcc_flags:%lx, entry:%p\n",
+                 dev->name, vcc, vcc ? vcc->flags : 0, entry);
         if (!vcc || !test_bit(ATM_VF_READY, &vcc->flags)) {
                 if (entry && (entry->tx_wait.qlen < LEC_UNRES_QUE_LEN)) {
-                        pr_debug("%s:lec_start_xmit: queuing packet, ",
-                                dev->name);
-                        pr_debug("MAC address %pM\n", lec_h->h_dest);
+                        pr_debug("%s:queuing packet, MAC address %pM\n",
+                                 dev->name, lec_h->h_dest);
                         skb_queue_tail(&entry->tx_wait, skb);
                 } else {
-                        pr_debug
-                            ("%s:lec_start_xmit: tx queue full or no arp entry, dropping, ",
-                             dev->name);
-                        pr_debug("MAC address %pM\n", lec_h->h_dest);
+                        pr_debug("%s:tx queue full or no arp entry, dropping, MAC address: %pM\n",
+                                 dev->name, lec_h->h_dest);
                         dev->stats.tx_dropped++;
                         dev_kfree_skb(skb);
                 }
                 goto out;
         }
 #if DUMP_PACKETS > 0
-        printk("%s:sending to vpi:%d vci:%d\n", dev->name, vcc->vpi, vcc->vci);
+        printk(KERN_DEBUG "%s:sending to vpi:%d vci:%d\n",
+               dev->name, vcc->vpi, vcc->vci);
 #endif /* DUMP_PACKETS > 0 */
 
         while (entry && (skb2 = skb_dequeue(&entry->tx_wait))) {
-                pr_debug("lec.c: emptying tx queue, ");
-                pr_debug("MAC address %pM\n", lec_h->h_dest);
+                pr_debug("emptying tx queue, MAC address %pM\n", lec_h->h_dest);
                 lec_send(vcc, skb2);
         }
 
@@ -444,14 +434,12 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
         pr_debug("%s: msg from zeppelin:%d\n", dev->name, mesg->type);
         switch (mesg->type) {
         case l_set_mac_addr:
-                for (i = 0; i < 6; i++) {
+                for (i = 0; i < 6; i++)
                         dev->dev_addr[i] = mesg->content.normal.mac_addr[i];
-                }
                 break;
         case l_del_mac_addr:
-                for (i = 0; i < 6; i++) {
+                for (i = 0; i < 6; i++)
                         dev->dev_addr[i] = 0;
-                }
                 break;
         case l_addr_delete:
                 lec_addr_delete(priv, mesg->content.normal.atm_addr,
@@ -477,10 +465,10 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                                mesg->content.normal.atm_addr,
                                mesg->content.normal.flag,
                                mesg->content.normal.targetless_le_arp);
-                pr_debug("lec: in l_arp_update\n");
+                pr_debug("in l_arp_update\n");
                 if (mesg->sizeoftlvs != 0) {    /* LANE2 3.1.5 */
-                        pr_debug("lec: LANE2 3.1.5, got tlvs, size %d\n",
-                                mesg->sizeoftlvs);
+                        pr_debug("LANE2 3.1.5, got tlvs, size %d\n",
+                                 mesg->sizeoftlvs);
                         lane2_associate_ind(dev, mesg->content.normal.mac_addr,
                                             tmp, mesg->sizeoftlvs);
                 }
@@ -499,13 +487,14 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                 priv->flush_timeout = (mesg->content.config.flush_timeout * HZ);
                 priv->path_switching_delay =
                     (mesg->content.config.path_switching_delay * HZ);
-                priv->lane_version = mesg->content.config.lane_version; /* LANE2 */
+                priv->lane_version = mesg->content.config.lane_version;
+                                        /* LANE2 */
                 priv->lane2_ops = NULL;
                 if (priv->lane_version > 1)
                         priv->lane2_ops = &lane2_ops;
                 if (dev_set_mtu(dev, mesg->content.config.mtu))
-                        printk("%s: change_mtu to %d failed\n", dev->name,
-                               mesg->content.config.mtu);
+                        pr_info("%s: change_mtu to %d failed\n",
+                                dev->name, mesg->content.config.mtu);
                 priv->is_proxy = mesg->content.config.is_proxy;
                 break;
         case l_flush_tran_id:
@@ -518,40 +507,35 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                 break;
         case l_should_bridge:
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
-                {
-                        pr_debug("%s: bridge zeppelin asks about %pM\n",
-                                 dev->name, mesg->content.proxy.mac_addr);
+        {
+                pr_debug("%s: bridge zeppelin asks about %pM\n",
+                         dev->name, mesg->content.proxy.mac_addr);
 
-                        if (br_fdb_test_addr_hook == NULL)
-                                break;
+                if (br_fdb_test_addr_hook == NULL)
+                        break;
 
-                        if (br_fdb_test_addr_hook(dev,
-                                        mesg->content.proxy.mac_addr)) {
-                                /* hit from bridge table, send LE_ARP_RESPONSE */
-                                struct sk_buff *skb2;
-                                struct sock *sk;
-
-                                pr_debug
-                                    ("%s: entry found, responding to zeppelin\n",
-                                     dev->name);
-                                skb2 =
-                                    alloc_skb(sizeof(struct atmlec_msg),
-                                              GFP_ATOMIC);
-                                if (skb2 == NULL)
-                                        break;
-                                skb2->len = sizeof(struct atmlec_msg);
-                                skb_copy_to_linear_data(skb2, mesg,
-                                                        sizeof(*mesg));
-                                atm_force_charge(priv->lecd, skb2->truesize);
-                                sk = sk_atm(priv->lecd);
-                                skb_queue_tail(&sk->sk_receive_queue, skb2);
-                                sk->sk_data_ready(sk, skb2->len);
-                        }
+                if (br_fdb_test_addr_hook(dev, mesg->content.proxy.mac_addr)) {
+                        /* hit from bridge table, send LE_ARP_RESPONSE */
+                        struct sk_buff *skb2;
+                        struct sock *sk;
+
+                        pr_debug("%s: entry found, responding to zeppelin\n",
+                                 dev->name);
+                        skb2 = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
+                        if (skb2 == NULL)
+                                break;
+                        skb2->len = sizeof(struct atmlec_msg);
+                        skb_copy_to_linear_data(skb2, mesg, sizeof(*mesg));
+                        atm_force_charge(priv->lecd, skb2->truesize);
+                        sk = sk_atm(priv->lecd);
+                        skb_queue_tail(&sk->sk_receive_queue, skb2);
+                        sk->sk_data_ready(sk, skb2->len);
                 }
+        }
 #endif /* defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE) */
                 break;
         default:
-                printk("%s: Unknown message type %d\n", dev->name, mesg->type);
+                pr_info("%s: Unknown message type %d\n", dev->name, mesg->type);
                 dev_kfree_skb(skb);
                 return -EINVAL;
         }
@@ -572,14 +556,13 @@ static void lec_atm_close(struct atm_vcc *vcc)
         lec_arp_destroy(priv);
 
         if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
-                printk("%s lec_atm_close: closing with messages pending\n",
-                       dev->name);
-        while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue)) != NULL) {
+                pr_info("%s closing with messages pending\n", dev->name);
+        while ((skb = skb_dequeue(&sk_atm(vcc)->sk_receive_queue))) {
                 atm_return(vcc, skb->truesize);
                 dev_kfree_skb(skb);
         }
 
-        printk("%s: Shut down!\n", dev->name);
+        pr_info("%s: Shut down!\n", dev->name);
         module_put(THIS_MODULE);
 }
 
@@ -608,9 +591,8 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
         struct sk_buff *skb;
         struct atmlec_msg *mesg;
 
-        if (!priv || !priv->lecd) {
+        if (!priv || !priv->lecd)
                 return -1;
-        }
         skb = alloc_skb(sizeof(struct atmlec_msg), GFP_ATOMIC);
         if (!skb)
                 return -1;
@@ -633,7 +615,7 @@ send_to_lecd(struct lec_priv *priv, atmlec_msg_type type,
         sk->sk_data_ready(sk, skb->len);
 
         if (data != NULL) {
-                pr_debug("lec: about to send %d bytes of data\n", data->len);
+                pr_debug("about to send %d bytes of data\n", data->len);
                 atm_force_charge(priv->lecd, data->truesize);
                 skb_queue_tail(&sk->sk_receive_queue, data);
                 sk->sk_data_ready(sk, skb->len);
@@ -691,36 +673,28 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
         struct net_device *dev = (struct net_device *)vcc->proto_data;
         struct lec_priv *priv = netdev_priv(dev);
 
-#if DUMP_PACKETS >0
-        int i = 0;
-        char buf[300];
-
-        printk("%s: lec_push vcc vpi:%d vci:%d\n", dev->name,
-               vcc->vpi, vcc->vci);
+#if DUMP_PACKETS > 0
+        printk(KERN_DEBUG "%s: vcc vpi:%d vci:%d\n",
+               dev->name, vcc->vpi, vcc->vci);
 #endif
         if (!skb) {
                 pr_debug("%s: null skb\n", dev->name);
                 lec_vcc_close(priv, vcc);
                 return;
         }
-#if DUMP_PACKETS > 0
-        printk("%s: rcv datalen:%ld lecid:%4.4x\n", dev->name,
-               skb->len, priv->lecid);
 #if DUMP_PACKETS >= 2
-        for (i = 0; i < skb->len && i < 99; i++) {
-                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
-        }
+#define MAX_SKB_DUMP 99
 #elif DUMP_PACKETS >= 1
-        for (i = 0; i < skb->len && i < 30; i++) {
-                sprintf(buf + i * 3, "%2.2x ", 0xff & skb->data[i]);
-        }
-#endif /* DUMP_PACKETS >= 1 */
-        if (i == skb->len)
-                printk("%s\n", buf);
-        else
-                printk("%s...\n", buf);
+#define MAX_SKB_DUMP 30
+#endif
+#if DUMP_PACKETS > 0
+        printk(KERN_DEBUG "%s: rcv datalen:%ld lecid:%4.4x\n",
+               dev->name, skb->len, priv->lecid);
+        print_hex_dump(KERN_DEBUG, "", DUMP_OFFSET, 16, 1,
+                       skb->data, min(MAX_SKB_DUMP, skb->len), true);
 #endif /* DUMP_PACKETS > 0 */
-        if (memcmp(skb->data, lec_ctrl_magic, 4) == 0) {        /* Control frame, to daemon */
+        if (memcmp(skb->data, lec_ctrl_magic, 4) == 0) {
+                                /* Control frame, to daemon */
                 struct sock *sk = sk_atm(vcc);
 
                 pr_debug("%s: To daemon\n", dev->name);
@@ -778,9 +752,8 @@ static void lec_push(struct atm_vcc *vcc, struct sk_buff *skb)
                         dev_kfree_skb(skb);
                         return;
                 }
-                if (!hlist_empty(&priv->lec_arp_empty_ones)) {
+                if (!hlist_empty(&priv->lec_arp_empty_ones))
                         lec_arp_check_empties(priv, vcc, skb);
-                }
                 skb_pull(skb, 2);       /* skip lec_id */
 #ifdef CONFIG_TR
                 if (priv->is_trdev)
@@ -801,7 +774,7 @@ static void lec_pop(struct atm_vcc *vcc, struct sk_buff *skb)
         struct net_device *dev = skb->dev;
 
         if (vpriv == NULL) {
-                printk("lec_pop(): vpriv = NULL!?!?!?\n");
+                pr_info("vpriv = NULL!?!?!?\n");
                 return;
         }
 
@@ -822,15 +795,13 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
 
         /* Lecd must be up in this case */
         bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc));
-        if (bytes_left != 0) {
-                printk
-                    ("lec: lec_vcc_attach, copy from user failed for %d bytes\n",
-                     bytes_left);
-        }
+        if (bytes_left != 0)
+                pr_info("copy from user failed for %d bytes\n", bytes_left);
         if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF ||
             !dev_lec[ioc_data.dev_num])
                 return -EINVAL;
-        if (!(vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL)))
+        vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL);
+        if (!vpriv)
                 return -ENOMEM;
         vpriv->xoff = 0;
         vpriv->old_pop = vcc->pop;
@@ -921,9 +892,8 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
         priv->flush_timeout = (4 * HZ);
         priv->path_switching_delay = (6 * HZ);
 
-        if (dev_lec[i]->flags & IFF_UP) {
+        if (dev_lec[i]->flags & IFF_UP)
                 netif_start_queue(dev_lec[i]);
-        }
         __module_get(THIS_MODULE);
         return i;
 }
@@ -1125,7 +1095,9 @@ static int lec_seq_show(struct seq_file *seq, void *v)
         else {
                 struct lec_state *state = seq->private;
                 struct net_device *dev = state->dev;
-                struct lec_arp_table *entry = hlist_entry(state->node, struct lec_arp_table, next);
+                struct lec_arp_table *entry = hlist_entry(state->node,
+                                                          struct lec_arp_table,
+                                                          next);
 
                 seq_printf(seq, "%s ", dev->name);
                 lec_info(seq, entry);
@@ -1199,13 +1171,13 @@ static int __init lane_module_init(void)
 
         p = proc_create("lec", S_IRUGO, atm_proc_root, &lec_seq_fops);
         if (!p) {
-                printk(KERN_ERR "Unable to initialize /proc/net/atm/lec\n");
+                pr_err("Unable to initialize /proc/net/atm/lec\n");
                 return -ENOMEM;
         }
 #endif
 
         register_atm_ioctl(&lane_ioctl_ops);
-        printk("lec.c: " __DATE__ " " __TIME__ " initialized\n");
+        pr_info("lec.c: " __DATE__ " " __TIME__ " initialized\n");
         return 0;
 }
 
@@ -1294,13 +1266,13 @@ static int lane2_associate_req(struct net_device *dev, const u8 *lan_dst,
         struct lec_priv *priv = netdev_priv(dev);
 
         if (compare_ether_addr(lan_dst, dev->dev_addr))
-                return (0);     /* not our mac address */
+                return 0;       /* not our mac address */
 
         kfree(priv->tlvs);      /* NULL if there was no previous association */
 
         priv->tlvs = kmemdup(tlvs, sizeoftlvs, GFP_KERNEL);
         if (priv->tlvs == NULL)
-                return (0);
+                return 0;
         priv->sizeoftlvs = sizeoftlvs;
 
         skb = alloc_skb(sizeoftlvs, GFP_ATOMIC);
@@ -1310,12 +1282,12 @@ static int lane2_associate_req(struct net_device *dev, const u8 *lan_dst,
         skb_copy_to_linear_data(skb, tlvs, sizeoftlvs);
         retval = send_to_lecd(priv, l_associate_req, NULL, NULL, skb);
         if (retval != 0)
-                printk("lec.c: lane2_associate_req() failed\n");
+                pr_info("lec.c: lane2_associate_req() failed\n");
         /*
          * If the previous association has changed we must
          * somehow notify other LANE entities about the change
          */
-        return (1);
+        return 1;
 }
 
 /*
@@ -1348,12 +1320,12 @@ static void lane2_associate_ind(struct net_device *dev, const u8 *mac_addr,
         entry->sizeoftlvs = sizeoftlvs;
 #endif
 #if 0
-        printk("lec.c: lane2_associate_ind()\n");
-        printk("dump of tlvs, sizeoftlvs=%d\n", sizeoftlvs);
+        pr_info("\n");
+        pr_info("dump of tlvs, sizeoftlvs=%d\n", sizeoftlvs);
         while (i < sizeoftlvs)
-                printk("%02x ", tlvs[i++]);
+                pr_cont("%02x ", tlvs[i++]);
 
-        printk("\n");
+        pr_cont("\n");
 #endif
 
         /* tell MPOA about the TLVs we saw */
@@ -1373,15 +1345,15 @@ static void lane2_associate_ind(struct net_device *dev, const u8 *mac_addr,
 
 #include <linux/types.h>
 #include <linux/timer.h>
-#include <asm/param.h>
+#include <linux/param.h>
 #include <asm/atomic.h>
 #include <linux/inetdevice.h>
 #include <net/route.h>
 
 #if 0
-#define pr_debug(format,args...)
+#define pr_debug(format, args...)
 /*
-#define pr_debug printk
+  #define pr_debug printk
 */
 #endif
 #define DEBUG_ARP_TABLE 0
@@ -1395,7 +1367,7 @@ static void lec_arp_expire_arp(unsigned long data);
  * Arp table funcs
  */
 
-#define HASH(ch) (ch & (LEC_ARP_TABLE_SIZE -1))
+#define HASH(ch) (ch & (LEC_ARP_TABLE_SIZE - 1))
 
 /*
  * Initialization of arp-cache
@@ -1404,9 +1376,8 @@ static void lec_arp_init(struct lec_priv *priv)
 {
         unsigned short i;
 
-        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
+        for (i = 0; i < LEC_ARP_TABLE_SIZE; i++)
                 INIT_HLIST_HEAD(&priv->lec_arp_tables[i]);
-        }
         INIT_HLIST_HEAD(&priv->lec_arp_empty_ones);
         INIT_HLIST_HEAD(&priv->lec_no_forward);
         INIT_HLIST_HEAD(&priv->mcast_fwds);
@@ -1450,10 +1421,7 @@ lec_arp_add(struct lec_priv *priv, struct lec_arp_table *entry)
         tmp = &priv->lec_arp_tables[HASH(entry->mac_addr[ETH_ALEN - 1])];
         hlist_add_head(&entry->next, tmp);
 
-        pr_debug("LEC_ARP: Added entry:%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
-                0xff & entry->mac_addr[0], 0xff & entry->mac_addr[1],
-                0xff & entry->mac_addr[2], 0xff & entry->mac_addr[3],
-                0xff & entry->mac_addr[4], 0xff & entry->mac_addr[5]);
+        pr_debug("Added entry:%pM\n", entry->mac_addr);
 }
 
 /*
@@ -1466,20 +1434,23 @@ lec_arp_remove(struct lec_priv *priv, struct lec_arp_table *to_remove)
         struct lec_arp_table *entry;
         int i, remove_vcc = 1;
 
-        if (!to_remove) {
+        if (!to_remove)
                 return -1;
-        }
 
         hlist_del(&to_remove->next);
         del_timer(&to_remove->timer);
 
-        /* If this is the only MAC connected to this VCC, also tear down the VCC */
+        /*
+         * If this is the only MAC connected to this VCC,
+         * also tear down the VCC
+         */
         if (to_remove->status >= ESI_FLUSH_PENDING) {
                 /*
                  * ESI_FLUSH_PENDING, ESI_FORWARD_DIRECT
                  */
                 for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                        hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
+                        hlist_for_each_entry(entry, node,
+                                             &priv->lec_arp_tables[i], next) {
                                 if (memcmp(to_remove->atm_addr,
                                            entry->atm_addr, ATM_ESA_LEN) == 0) {
                                         remove_vcc = 0;
@@ -1492,10 +1463,7 @@ lec_arp_remove(struct lec_priv *priv, struct lec_arp_table *to_remove)
         }
         skb_queue_purge(&to_remove->tx_wait);   /* FIXME: good place for this? */
 
-        pr_debug("LEC_ARP: Removed entry:%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
-                0xff & to_remove->mac_addr[0], 0xff & to_remove->mac_addr[1],
-                0xff & to_remove->mac_addr[2], 0xff & to_remove->mac_addr[3],
-                0xff & to_remove->mac_addr[4], 0xff & to_remove->mac_addr[5]);
+        pr_debug("Removed entry:%pM\n", to_remove->mac_addr);
         return 0;
 }
 
@@ -1513,9 +1481,8 @@ static const char *get_status_string(unsigned char st)
                 return "ESI_FLUSH_PENDING";
         case ESI_FORWARD_DIRECT:
                 return "ESI_FORWARD_DIRECT";
-        default:
-                return "<UNKNOWN>";
         }
+        return "<UNKNOWN>";
 }
 
 static void dump_arp_table(struct lec_priv *priv)
@@ -1525,18 +1492,15 @@ static void dump_arp_table(struct lec_priv *priv)
         char buf[256];
         int i, j, offset;
 
-        printk("Dump %p:\n", priv);
+        pr_info("Dump %p:\n", priv);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(rulla, node, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry(rulla, node,
+                                     &priv->lec_arp_tables[i], next) {
                         offset = 0;
                         offset += sprintf(buf, "%d: %p\n", i, rulla);
-                        offset += sprintf(buf + offset, "Mac:");
-                        for (j = 0; j < ETH_ALEN; j++) {
-                                offset += sprintf(buf + offset,
-                                                  "%2.2x ",
-                                                  rulla->mac_addr[j] & 0xff);
-                        }
-                        offset += sprintf(buf + offset, "Atm:");
+                        offset += sprintf(buf + offset, "Mac: %pM",
+                                          rulla->mac_addr);
+                        offset += sprintf(buf + offset, " Atm:");
                         for (j = 0; j < ATM_ESA_LEN; j++) {
                                 offset += sprintf(buf + offset,
                                                   "%2.2x ",
@@ -1556,20 +1520,16 @@ static void dump_arp_table(struct lec_priv *priv)
                                     "Flags:%x, Packets_flooded:%x, Status: %s ",
                                     rulla->flags, rulla->packets_flooded,
                                     get_status_string(rulla->status));
-                        printk("%s\n", buf);
+                        pr_info("%s\n", buf);
                 }
         }
 
         if (!hlist_empty(&priv->lec_no_forward))
-                printk("No forward\n");
+                pr_info("No forward\n");
         hlist_for_each_entry(rulla, node, &priv->lec_no_forward, next) {
                 offset = 0;
-                offset += sprintf(buf + offset, "Mac:");
-                for (j = 0; j < ETH_ALEN; j++) {
-                        offset += sprintf(buf + offset, "%2.2x ",
-                                          rulla->mac_addr[j] & 0xff);
-                }
-                offset += sprintf(buf + offset, "Atm:");
+                offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
+                offset += sprintf(buf + offset, " Atm:");
                 for (j = 0; j < ATM_ESA_LEN; j++) {
                         offset += sprintf(buf + offset, "%2.2x ",
                                           rulla->atm_addr[j] & 0xff);
@@ -1586,19 +1546,15 @@ static void dump_arp_table(struct lec_priv *priv)
                                   "Flags:%x, Packets_flooded:%x, Status: %s ",
                                   rulla->flags, rulla->packets_flooded,
                                   get_status_string(rulla->status));
-                printk("%s\n", buf);
+                pr_info("%s\n", buf);
         }
 
         if (!hlist_empty(&priv->lec_arp_empty_ones))
-                printk("Empty ones\n");
+                pr_info("Empty ones\n");
         hlist_for_each_entry(rulla, node, &priv->lec_arp_empty_ones, next) {
                 offset = 0;
-                offset += sprintf(buf + offset, "Mac:");
-                for (j = 0; j < ETH_ALEN; j++) {
-                        offset += sprintf(buf + offset, "%2.2x ",
-                                          rulla->mac_addr[j] & 0xff);
-                }
-                offset += sprintf(buf + offset, "Atm:");
+                offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
+                offset += sprintf(buf + offset, " Atm:");
                 for (j = 0; j < ATM_ESA_LEN; j++) {
                         offset += sprintf(buf + offset, "%2.2x ",
                                           rulla->atm_addr[j] & 0xff);
@@ -1615,19 +1571,15 @@ static void dump_arp_table(struct lec_priv *priv)
                                   "Flags:%x, Packets_flooded:%x, Status: %s ",
                                   rulla->flags, rulla->packets_flooded,
                                   get_status_string(rulla->status));
-                printk("%s", buf);
+                pr_info("%s", buf);
         }
 
         if (!hlist_empty(&priv->mcast_fwds))
-                printk("Multicast Forward VCCs\n");
+                pr_info("Multicast Forward VCCs\n");
         hlist_for_each_entry(rulla, node, &priv->mcast_fwds, next) {
                 offset = 0;
-                offset += sprintf(buf + offset, "Mac:");
-                for (j = 0; j < ETH_ALEN; j++) {
-                        offset += sprintf(buf + offset, "%2.2x ",
-                                          rulla->mac_addr[j] & 0xff);
-                }
-                offset += sprintf(buf + offset, "Atm:");
+                offset += sprintf(buf + offset, "Mac: %pM", rulla->mac_addr);
+                offset += sprintf(buf + offset, " Atm:");
                 for (j = 0; j < ATM_ESA_LEN; j++) {
                         offset += sprintf(buf + offset, "%2.2x ",
                                           rulla->atm_addr[j] & 0xff);
@@ -1644,7 +1596,7 @@ static void dump_arp_table(struct lec_priv *priv)
                                   "Flags:%x, Packets_flooded:%x, Status: %s ",
                                   rulla->flags, rulla->packets_flooded,
                                   get_status_string(rulla->status));
-                printk("%s\n", buf);
+                pr_info("%s\n", buf);
         }
 
 }
@@ -1670,14 +1622,16 @@ static void lec_arp_destroy(struct lec_priv *priv)
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry_safe(entry, node, next,
+                                          &priv->lec_arp_tables[i], next) {
                         lec_arp_remove(priv, entry);
                         lec_arp_put(entry);
                 }
                 INIT_HLIST_HEAD(&priv->lec_arp_tables[i]);
         }
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+        hlist_for_each_entry_safe(entry, node, next,
+                                  &priv->lec_arp_empty_ones, next) {
                 del_timer_sync(&entry->timer);
                 lec_arp_clear_vccs(entry);
                 hlist_del(&entry->next);
@@ -1685,7 +1639,8 @@ static void lec_arp_destroy(struct lec_priv *priv)
         }
         INIT_HLIST_HEAD(&priv->lec_arp_empty_ones);
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->lec_no_forward, next) {
+        hlist_for_each_entry_safe(entry, node, next,
+                                  &priv->lec_no_forward, next) {
                 del_timer_sync(&entry->timer);
                 lec_arp_clear_vccs(entry);
                 hlist_del(&entry->next);
@@ -1714,15 +1669,12 @@ static struct lec_arp_table *lec_arp_find(struct lec_priv *priv,
         struct hlist_head *head;
         struct lec_arp_table *entry;
 
-        pr_debug("LEC_ARP: lec_arp_find :%2.2x %2.2x %2.2x %2.2x %2.2x %2.2x\n",
-                mac_addr[0] & 0xff, mac_addr[1] & 0xff, mac_addr[2] & 0xff,
-                mac_addr[3] & 0xff, mac_addr[4] & 0xff, mac_addr[5] & 0xff);
+        pr_debug("%pM\n", mac_addr);
 
         head = &priv->lec_arp_tables[HASH(mac_addr[ETH_ALEN - 1])];
         hlist_for_each_entry(entry, node, head, next) {
-                if (!compare_ether_addr(mac_addr, entry->mac_addr)) {
+                if (!compare_ether_addr(mac_addr, entry->mac_addr))
                         return entry;
-                }
         }
         return NULL;
 }
@@ -1734,7 +1686,7 @@ static struct lec_arp_table *make_entry(struct lec_priv *priv,
 
         to_return = kzalloc(sizeof(struct lec_arp_table), GFP_ATOMIC);
         if (!to_return) {
-                printk("LEC: Arp entry kmalloc failed\n");
+                pr_info("LEC: Arp entry kmalloc failed\n");
                 return NULL;
         }
         memcpy(to_return->mac_addr, mac_addr, ETH_ALEN);
@@ -1755,7 +1707,7 @@ static void lec_arp_expire_arp(unsigned long data)
 
         entry = (struct lec_arp_table *)data;
 
-        pr_debug("lec_arp_expire_arp\n");
+        pr_debug("\n");
         if (entry->status == ESI_ARP_PENDING) {
                 if (entry->no_tries <= entry->priv->max_retry_count) {
                         if (entry->is_rdesc)
@@ -1779,10 +1731,10 @@ static void lec_arp_expire_vcc(unsigned long data)
 
         del_timer(&to_remove->timer);
 
-        pr_debug("LEC_ARP %p %p: lec_arp_expire_vcc vpi:%d vci:%d\n",
-                to_remove, priv,
-                to_remove->vcc ? to_remove->recv_vcc->vpi : 0,
-                to_remove->vcc ? to_remove->recv_vcc->vci : 0);
+        pr_debug("%p %p: vpi:%d vci:%d\n",
+                 to_remove, priv,
+                 to_remove->vcc ? to_remove->recv_vcc->vpi : 0,
+                 to_remove->vcc ? to_remove->recv_vcc->vci : 0);
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         hlist_del(&to_remove->next);
@@ -1792,6 +1744,50 @@ static void lec_arp_expire_vcc(unsigned long data)
         lec_arp_put(to_remove);
 }
 
+static bool __lec_arp_check_expire(struct lec_arp_table *entry,
+                                   unsigned long now,
+                                   struct lec_priv *priv)
+{
+        unsigned long time_to_check;
+
+        if ((entry->flags) & LEC_REMOTE_FLAG && priv->topology_change)
+                time_to_check = priv->forward_delay_time;
+        else
+                time_to_check = priv->aging_time;
+
+        pr_debug("About to expire: %lx - %lx > %lx\n",
+                 now, entry->last_used, time_to_check);
+        if (time_after(now, entry->last_used + time_to_check) &&
+            !(entry->flags & LEC_PERMANENT_FLAG) &&
+            !(entry->mac_addr[0] & 0x01)) {     /* LANE2: 7.1.20 */
+                /* Remove entry */
+                pr_debug("Entry timed out\n");
+                lec_arp_remove(priv, entry);
+                lec_arp_put(entry);
+        } else {
+                /* Something else */
+                if ((entry->status == ESI_VC_PENDING ||
+                     entry->status == ESI_ARP_PENDING) &&
+                    time_after_eq(now, entry->timestamp +
+                                       priv->max_unknown_frame_time)) {
+                        entry->timestamp = jiffies;
+                        entry->packets_flooded = 0;
+                        if (entry->status == ESI_VC_PENDING)
+                                send_to_lecd(priv, l_svc_setup,
+                                             entry->mac_addr,
+                                             entry->atm_addr,
+                                             NULL);
+                }
+                if (entry->status == ESI_FLUSH_PENDING &&
+                    time_after_eq(now, entry->timestamp +
+                                       priv->path_switching_delay)) {
+                        lec_arp_hold(entry);
+                        return true;
+                }
+        }
+
+        return false;
+}
 /*
  * Expire entries.
  * 1. Re-set timer
@@ -1816,62 +1812,28 @@ static void lec_arp_check_expire(struct work_struct *work)
         struct hlist_node *node, *next;
         struct lec_arp_table *entry;
         unsigned long now;
-        unsigned long time_to_check;
         int i;
 
-        pr_debug("lec_arp_check_expire %p\n", priv);
+        pr_debug("%p\n", priv);
         now = jiffies;
 restart:
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
-                        if ((entry->flags) & LEC_REMOTE_FLAG &&
-                            priv->topology_change)
-                                time_to_check = priv->forward_delay_time;
-                        else
-                                time_to_check = priv->aging_time;
-
-                        pr_debug("About to expire: %lx - %lx > %lx\n",
-                                now, entry->last_used, time_to_check);
-                        if (time_after(now, entry->last_used + time_to_check)
-                            && !(entry->flags & LEC_PERMANENT_FLAG)
-                            && !(entry->mac_addr[0] & 0x01)) {  /* LANE2: 7.1.20 */
-                                /* Remove entry */
-                                pr_debug("LEC:Entry timed out\n");
-                                lec_arp_remove(priv, entry);
+                hlist_for_each_entry_safe(entry, node, next,
+                                          &priv->lec_arp_tables[i], next) {
+                        if (__lec_arp_check_expire(entry, now, priv)) {
+                                struct sk_buff *skb;
+                                struct atm_vcc *vcc = entry->vcc;
+
+                                spin_unlock_irqrestore(&priv->lec_arp_lock,
+                                                       flags);
+                                while ((skb = skb_dequeue(&entry->tx_wait)))
+                                        lec_send(vcc, skb);
+                                entry->last_used = jiffies;
+                                entry->status = ESI_FORWARD_DIRECT;
                                 lec_arp_put(entry);
-                        } else {
-                                /* Something else */
-                                if ((entry->status == ESI_VC_PENDING ||
-                                     entry->status == ESI_ARP_PENDING)
-                                    && time_after_eq(now,
-                                                     entry->timestamp +
-                                                     priv->
-                                                     max_unknown_frame_time)) {
-                                        entry->timestamp = jiffies;
-                                        entry->packets_flooded = 0;
-                                        if (entry->status == ESI_VC_PENDING)
-                                                send_to_lecd(priv, l_svc_setup,
-                                                             entry->mac_addr,
-                                                             entry->atm_addr,
-                                                             NULL);
-                                }
-                                if (entry->status == ESI_FLUSH_PENDING
-                                    &&
-                                    time_after_eq(now, entry->timestamp +
-                                                  priv->path_switching_delay)) {
-                                        struct sk_buff *skb;
-                                        struct atm_vcc *vcc = entry->vcc;
-
-                                        lec_arp_hold(entry);
-                                        spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
-                                        while ((skb = skb_dequeue(&entry->tx_wait)) != NULL)
-                                                lec_send(vcc, skb);
-                                        entry->last_used = jiffies;
-                                        entry->status = ESI_FORWARD_DIRECT;
-                                        lec_arp_put(entry);
-                                        goto restart;
-                                }
+
+                                goto restart;
                         }
                 }
         }
@@ -1885,7 +1847,8 @@ restart:
  *
  */
 static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
-                                       const unsigned char *mac_to_find, int is_rdesc,
+                                       const unsigned char *mac_to_find,
+                                       int is_rdesc,
                                        struct lec_arp_table **ret_entry)
 {
         unsigned long flags;
@@ -1921,9 +1884,8 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                  * If the LE_ARP cache entry is still pending, reset count to 0
                  * so another LE_ARP request can be made for this frame.
                  */
-                if (entry->status == ESI_ARP_PENDING) {
+                if (entry->status == ESI_ARP_PENDING)
                         entry->no_tries = 0;
-                }
                 /*
                  * Data direct VC not yet set up, check to see if the unknown
                  * frame count is greater than the limit. If the limit has
@@ -1934,7 +1896,7 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                     entry->packets_flooded <
                     priv->maximum_unknown_frame_count) {
                         entry->packets_flooded++;
-                        pr_debug("LEC_ARP: Flooding..\n");
+                        pr_debug("Flooding..\n");
                         found = priv->mcast_vcc;
                         goto out;
                 }
@@ -1945,13 +1907,13 @@ static struct atm_vcc *lec_arp_resolve(struct lec_priv *priv,
                  */
                 lec_arp_hold(entry);
                 *ret_entry = entry;
-                pr_debug("lec: entry->status %d entry->vcc %p\n", entry->status,
-                        entry->vcc);
+                pr_debug("entry->status %d entry->vcc %p\n", entry->status,
+                         entry->vcc);
                 found = NULL;
         } else {
                 /* No matching entry was found */
                 entry = make_entry(priv, mac_to_find);
-                pr_debug("LEC_ARP: Making entry\n");
+                pr_debug("Making entry\n");
                 if (!entry) {
                         found = priv->mcast_vcc;
                         goto out;
@@ -1988,13 +1950,14 @@ lec_addr_delete(struct lec_priv *priv, const unsigned char *atm_addr,
         struct lec_arp_table *entry;
         int i;
 
-        pr_debug("lec_addr_delete\n");
+        pr_debug("\n");
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
-                        if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN)
-                            && (permanent ||
-                                !(entry->flags & LEC_PERMANENT_FLAG))) {
+                hlist_for_each_entry_safe(entry, node, next,
+                                          &priv->lec_arp_tables[i], next) {
+                        if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN) &&
+                            (permanent ||
+                             !(entry->flags & LEC_PERMANENT_FLAG))) {
                                 lec_arp_remove(priv, entry);
                                 lec_arp_put(entry);
                         }
@@ -2019,10 +1982,8 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
         struct lec_arp_table *entry, *tmp;
         int i;
 
-        pr_debug("lec:%s", (targetless_le_arp) ? "targetless " : " ");
-        pr_debug("lec_arp_update mac:%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
-                mac_addr[0], mac_addr[1], mac_addr[2], mac_addr[3],
-                mac_addr[4], mac_addr[5]);
+        pr_debug("%smac:%pM\n",
+                 (targetless_le_arp) ? "targetless " : "", mac_addr);
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         entry = lec_arp_find(priv, mac_addr);
@@ -2032,7 +1993,8 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
                                  * we have no entry in the cache. 7.1.30
                                  */
         if (!hlist_empty(&priv->lec_arp_empty_ones)) {
-                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+                hlist_for_each_entry_safe(entry, node, next,
+                                          &priv->lec_arp_empty_ones, next) {
                         if (memcmp(entry->atm_addr, atm_addr, ATM_ESA_LEN) == 0) {
                                 hlist_del(&entry->next);
                                 del_timer(&entry->timer);
@@ -2076,7 +2038,8 @@ lec_arp_update(struct lec_priv *priv, const unsigned char *mac_addr,
         memcpy(entry->atm_addr, atm_addr, ATM_ESA_LEN);
         del_timer(&entry->timer);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(tmp, node, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry(tmp, node,
+                                     &priv->lec_arp_tables[i], next) {
                         if (entry != tmp &&
                             !memcmp(tmp->atm_addr, atm_addr, ATM_ESA_LEN)) {
                                 /* Vcc to this host exists */
@@ -2121,14 +2084,13 @@ lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
         int i, found_entry = 0;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
+        /* Vcc for Multicast Forward. No timer, LANEv2 7.1.20 and 2.3.5.3 */
         if (ioc_data->receive == 2) {
-                /* Vcc for Multicast Forward. No timer, LANEv2 7.1.20 and 2.3.5.3 */
-
                 pr_debug("LEC_ARP: Attaching mcast forward\n");
 #if 0
                 entry = lec_arp_find(priv, bus_mac);
                 if (!entry) {
-                        printk("LEC_ARP: Multicast entry not found!\n");
+                        pr_info("LEC_ARP: Multicast entry not found!\n");
                         goto out;
                 }
                 memcpy(entry->atm_addr, ioc_data->atm_addr, ATM_ESA_LEN);
@@ -2149,19 +2111,17 @@ lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
                  * Vcc which we don't want to make default vcc,
                  * attach it anyway.
                  */
-                pr_debug
-                    ("LEC_ARP:Attaching data direct, not default: "
-                     "%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
-                     ioc_data->atm_addr[0], ioc_data->atm_addr[1],
-                     ioc_data->atm_addr[2], ioc_data->atm_addr[3],
-                     ioc_data->atm_addr[4], ioc_data->atm_addr[5],
-                     ioc_data->atm_addr[6], ioc_data->atm_addr[7],
-                     ioc_data->atm_addr[8], ioc_data->atm_addr[9],
-                     ioc_data->atm_addr[10], ioc_data->atm_addr[11],
-                     ioc_data->atm_addr[12], ioc_data->atm_addr[13],
-                     ioc_data->atm_addr[14], ioc_data->atm_addr[15],
-                     ioc_data->atm_addr[16], ioc_data->atm_addr[17],
-                     ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
+                pr_debug("LEC_ARP:Attaching data direct, not default: %2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
+                         ioc_data->atm_addr[0], ioc_data->atm_addr[1],
+                         ioc_data->atm_addr[2], ioc_data->atm_addr[3],
+                         ioc_data->atm_addr[4], ioc_data->atm_addr[5],
+                         ioc_data->atm_addr[6], ioc_data->atm_addr[7],
+                         ioc_data->atm_addr[8], ioc_data->atm_addr[9],
+                         ioc_data->atm_addr[10], ioc_data->atm_addr[11],
+                         ioc_data->atm_addr[12], ioc_data->atm_addr[13],
+                         ioc_data->atm_addr[14], ioc_data->atm_addr[15],
+                         ioc_data->atm_addr[16], ioc_data->atm_addr[17],
+                         ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
                 entry = make_entry(priv, bus_mac);
                 if (entry == NULL)
                         goto out;
@@ -2177,29 +2137,28 @@ lec_vcc_added(struct lec_priv *priv, const struct atmlec_ioc *ioc_data,
                 dump_arp_table(priv);
                 goto out;
         }
-        pr_debug
-            ("LEC_ARP:Attaching data direct, default: "
-             "%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
-             ioc_data->atm_addr[0], ioc_data->atm_addr[1],
-             ioc_data->atm_addr[2], ioc_data->atm_addr[3],
-             ioc_data->atm_addr[4], ioc_data->atm_addr[5],
-             ioc_data->atm_addr[6], ioc_data->atm_addr[7],
-             ioc_data->atm_addr[8], ioc_data->atm_addr[9],
-             ioc_data->atm_addr[10], ioc_data->atm_addr[11],
-             ioc_data->atm_addr[12], ioc_data->atm_addr[13],
-             ioc_data->atm_addr[14], ioc_data->atm_addr[15],
-             ioc_data->atm_addr[16], ioc_data->atm_addr[17],
-             ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
+        pr_debug("LEC_ARP:Attaching data direct, default: %2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x\n",
+                 ioc_data->atm_addr[0], ioc_data->atm_addr[1],
+                 ioc_data->atm_addr[2], ioc_data->atm_addr[3],
+                 ioc_data->atm_addr[4], ioc_data->atm_addr[5],
+                 ioc_data->atm_addr[6], ioc_data->atm_addr[7],
+                 ioc_data->atm_addr[8], ioc_data->atm_addr[9],
+                 ioc_data->atm_addr[10], ioc_data->atm_addr[11],
+                 ioc_data->atm_addr[12], ioc_data->atm_addr[13],
+                 ioc_data->atm_addr[14], ioc_data->atm_addr[15],
+                 ioc_data->atm_addr[16], ioc_data->atm_addr[17],
+                 ioc_data->atm_addr[18], ioc_data->atm_addr[19]);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry(entry, node,
+                                     &priv->lec_arp_tables[i], next) {
                         if (memcmp
                             (ioc_data->atm_addr, entry->atm_addr,
                              ATM_ESA_LEN) == 0) {
                                 pr_debug("LEC_ARP: Attaching data direct\n");
                                 pr_debug("Currently -> Vcc: %d, Rvcc:%d\n",
-                                        entry->vcc ? entry->vcc->vci : 0,
-                                        entry->recv_vcc ? entry->recv_vcc->
-                                        vci : 0);
+                                         entry->vcc ? entry->vcc->vci : 0,
+                                         entry->recv_vcc ? entry->recv_vcc->
+                                         vci : 0);
                                 found_entry = 1;
                                 del_timer(&entry->timer);
                                 entry->vcc = vcc;
@@ -2271,19 +2230,21 @@ static void lec_flush_complete(struct lec_priv *priv, unsigned long tran_id)
         struct lec_arp_table *entry;
         int i;
 
-        pr_debug("LEC:lec_flush_complete %lx\n", tran_id);
+        pr_debug("%lx\n", tran_id);
 restart:
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
-                        if (entry->flush_tran_id == tran_id
-                            && entry->status == ESI_FLUSH_PENDING) {
+                hlist_for_each_entry(entry, node,
+                                     &priv->lec_arp_tables[i], next) {
+                        if (entry->flush_tran_id == tran_id &&
+                            entry->status == ESI_FLUSH_PENDING) {
                                 struct sk_buff *skb;
                                 struct atm_vcc *vcc = entry->vcc;
 
                                 lec_arp_hold(entry);
-                                spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
-                                while ((skb = skb_dequeue(&entry->tx_wait)) != NULL)
+                                spin_unlock_irqrestore(&priv->lec_arp_lock,
+                                                       flags);
+                                while ((skb = skb_dequeue(&entry->tx_wait)))
                                         lec_send(vcc, skb);
                                 entry->last_used = jiffies;
                                 entry->status = ESI_FORWARD_DIRECT;
@@ -2308,11 +2269,12 @@ lec_set_flush_tran_id(struct lec_priv *priv,
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++)
-                hlist_for_each_entry(entry, node, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry(entry, node,
+                                     &priv->lec_arp_tables[i], next) {
                         if (!memcmp(atm_addr, entry->atm_addr, ATM_ESA_LEN)) {
                                 entry->flush_tran_id = tran_id;
                                 pr_debug("Set flush transaction id to %lx for %p\n",
-                                        tran_id, entry);
+                                         tran_id, entry);
                         }
                 }
         spin_unlock_irqrestore(&priv->lec_arp_lock, flags);
@@ -2328,7 +2290,8 @@ static int lec_mcast_make(struct lec_priv *priv, struct atm_vcc *vcc)
         struct lec_vcc_priv *vpriv;
         int err = 0;
 
-        if (!(vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL)))
+        vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL);
+        if (!vpriv)
                 return -ENOMEM;
         vpriv->xoff = 0;
         vpriv->old_pop = vcc->pop;
@@ -2368,18 +2331,19 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
 
         for (i = 0; i < LEC_ARP_TABLE_SIZE; i++) {
-                hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_tables[i], next) {
+                hlist_for_each_entry_safe(entry, node, next,
+                                          &priv->lec_arp_tables[i], next) {
                         if (vcc == entry->vcc) {
                                 lec_arp_remove(priv, entry);
                                 lec_arp_put(entry);
-                                if (priv->mcast_vcc == vcc) {
+                                if (priv->mcast_vcc == vcc)
                                         priv->mcast_vcc = NULL;
-                                }
                         }
                 }
         }
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+        hlist_for_each_entry_safe(entry, node, next,
+                                  &priv->lec_arp_empty_ones, next) {
                 if (entry->vcc == vcc) {
                         lec_arp_clear_vccs(entry);
                         del_timer(&entry->timer);
@@ -2388,7 +2352,8 @@ static void lec_vcc_close(struct lec_priv *priv, struct atm_vcc *vcc)
                 }
         }
 
-        hlist_for_each_entry_safe(entry, node, next, &priv->lec_no_forward, next) {
+        hlist_for_each_entry_safe(entry, node, next,
+                                  &priv->lec_no_forward, next) {
                 if (entry->recv_vcc == vcc) {
                         lec_arp_clear_vccs(entry);
                         del_timer(&entry->timer);
@@ -2429,14 +2394,16 @@ lec_arp_check_empties(struct lec_priv *priv,
                 src = hdr->h_source;
 
         spin_lock_irqsave(&priv->lec_arp_lock, flags);
-        hlist_for_each_entry_safe(entry, node, next, &priv->lec_arp_empty_ones, next) {
+        hlist_for_each_entry_safe(entry, node, next,
+                                  &priv->lec_arp_empty_ones, next) {
                 if (vcc == entry->vcc) {
                         del_timer(&entry->timer);
                         memcpy(entry->mac_addr, src, ETH_ALEN);
                         entry->status = ESI_FORWARD_DIRECT;
                         entry->last_used = jiffies;
                         /* We might have got an entry */
-                        if ((tmp = lec_arp_find(priv, src))) {
+                        tmp = lec_arp_find(priv, src);
+                        if (tmp) {
                                 lec_arp_remove(priv, tmp);
                                 lec_arp_put(tmp);
                         }
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 38a6cb0863f0..a6521c8aa88b 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -1,3 +1,5 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/timer.h>
@@ -13,8 +15,8 @@
 #include <net/sock.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
+#include <linux/uaccess.h>
 #include <asm/byteorder.h>
-#include <asm/uaccess.h>
 #include <net/checksum.h>   /* for ip_fast_csum() */
 #include <net/arp.h>
 #include <net/dst.h>
@@ -36,31 +38,47 @@
  */
 
 #if 0
-#define dprintk printk   /* debug */
+#define dprintk(format, args...) \
+        printk(KERN_DEBUG "mpoa:%s: " format, __func__, ##args)
+#define dprintk_cont(format, args...) printk(KERN_CONT format, ##args)
 #else
-#define dprintk(format,args...)
+#define dprintk(format, args...)                                        \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __func__, ##args);\
+        } while (0)
+#define dprintk_cont(format, args...)                   \
+        do { if (0) printk(KERN_CONT format, ##args); } while (0)
 #endif
 
 #if 0
-#define ddprintk printk  /* more debug */
+#define ddprintk(format, args...) \
+        printk(KERN_DEBUG "mpoa:%s: " format, __func__, ##args)
+#define ddprintk_cont(format, args...) printk(KERN_CONT format, ##args)
 #else
-#define ddprintk(format,args...)
+#define ddprintk(format, args...)                                       \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __func__, ##args);\
+        } while (0)
+#define ddprintk_cont(format, args...)                  \
+        do { if (0) printk(KERN_CONT format, ##args); } while (0)
 #endif
 
-
-
 #define MPOA_TAG_LEN 4
 
 /* mpc_daemon -> kernel */
-static void MPOA_trigger_rcvd (struct k_message *msg, struct mpoa_client *mpc);
+static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc);
 static void MPOA_res_reply_rcvd(struct k_message *msg, struct mpoa_client *mpc);
 static void ingress_purge_rcvd(struct k_message *msg, struct mpoa_client *mpc);
 static void egress_purge_rcvd(struct k_message *msg, struct mpoa_client *mpc);
 static void mps_death(struct k_message *msg, struct mpoa_client *mpc);
-static void clean_up(struct k_message *msg, struct mpoa_client *mpc, int action);
-static void MPOA_cache_impos_rcvd(struct k_message *msg, struct mpoa_client *mpc);
-static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc);
-static void set_mps_mac_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc);
+static void clean_up(struct k_message *msg, struct mpoa_client *mpc,
+                     int action);
+static void MPOA_cache_impos_rcvd(struct k_message *msg,
+                                  struct mpoa_client *mpc);
+static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg,
+                                   struct mpoa_client *mpc);
+static void set_mps_mac_addr_rcvd(struct k_message *mesg,
+                                  struct mpoa_client *mpc);
 
 static const uint8_t *copy_macs(struct mpoa_client *mpc,
                                 const uint8_t *router_mac,
@@ -74,10 +92,11 @@ static int msg_from_mpoad(struct atm_vcc *vcc, struct sk_buff *skb);
 
 static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb);
 static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
-                                         struct net_device *dev);
-static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned long event, void *dev);
+                                   struct net_device *dev);
+static int mpoa_event_listener(struct notifier_block *mpoa_notifier,
+                               unsigned long event, void *dev);
 static void mpc_timer_refresh(void);
-static void mpc_cache_check( unsigned long checking_time  );
+static void mpc_cache_check(unsigned long checking_time);
 
 static struct llc_snap_hdr llc_snap_mpoa_ctrl = {
         0xaa, 0xaa, 0x03,
@@ -167,7 +186,7 @@ struct atm_mpoa_qos *atm_mpoa_add_qos(__be32 dst_ip, struct atm_qos *qos)
 
         entry = kmalloc(sizeof(struct atm_mpoa_qos), GFP_KERNEL);
         if (entry == NULL) {
-                printk("mpoa: atm_mpoa_add_qos: out of memory\n");
+                pr_info("mpoa: out of memory\n");
                 return entry;
         }
 
@@ -185,10 +204,9 @@ struct atm_mpoa_qos *atm_mpoa_search_qos(__be32 dst_ip)
         struct atm_mpoa_qos *qos;
 
         qos = qos_head;
-        while( qos != NULL ){
-                if(qos->ipaddr == dst_ip) {
+        while (qos) {
+                if (qos->ipaddr == dst_ip)
                         break;
-                }
                 qos = qos->next;
         }
 
@@ -200,10 +218,10 @@ struct atm_mpoa_qos *atm_mpoa_search_qos(__be32 dst_ip)
  */
 int atm_mpoa_delete_qos(struct atm_mpoa_qos *entry)
 {
-
         struct atm_mpoa_qos *curr;
 
-        if (entry == NULL) return 0;
+        if (entry == NULL)
+                return 0;
         if (entry == qos_head) {
                 qos_head = qos_head->next;
                 kfree(entry);
@@ -234,9 +252,17 @@ void atm_mpoa_disp_qos(struct seq_file *m)
 
         while (qos != NULL) {
                 seq_printf(m, "%pI4\n     %-7d %-7d %-7d %-7d %-7d\n     %-7d %-7d %-7d %-7d %-7d\n",
-                                &qos->ipaddr,
-                                qos->qos.txtp.max_pcr, qos->qos.txtp.pcr, qos->qos.txtp.min_pcr, qos->qos.txtp.max_cdv, qos->qos.txtp.max_sdu,
-                                qos->qos.rxtp.max_pcr, qos->qos.rxtp.pcr, qos->qos.rxtp.min_pcr, qos->qos.rxtp.max_cdv, qos->qos.rxtp.max_sdu);
+                           &qos->ipaddr,
+                           qos->qos.txtp.max_pcr,
+                           qos->qos.txtp.pcr,
+                           qos->qos.txtp.min_pcr,
+                           qos->qos.txtp.max_cdv,
+                           qos->qos.txtp.max_sdu,
+                           qos->qos.rxtp.max_pcr,
+                           qos->qos.rxtp.pcr,
+                           qos->qos.rxtp.min_pcr,
+                           qos->qos.rxtp.max_cdv,
+                           qos->qos.rxtp.max_sdu);
                 qos = qos->next;
         }
 }
@@ -256,7 +282,7 @@ static struct mpoa_client *alloc_mpc(void)
 {
         struct mpoa_client *mpc;
 
-        mpc = kzalloc(sizeof (struct mpoa_client), GFP_KERNEL);
+        mpc = kzalloc(sizeof(struct mpoa_client), GFP_KERNEL);
         if (mpc == NULL)
                 return NULL;
         rwlock_init(&mpc->ingress_lock);
@@ -266,7 +292,7 @@ static struct mpoa_client *alloc_mpc(void)
 
         mpc->parameters.mpc_p1 = MPC_P1;
         mpc->parameters.mpc_p2 = MPC_P2;
-        memset(mpc->parameters.mpc_p3,0,sizeof(mpc->parameters.mpc_p3));
+        memset(mpc->parameters.mpc_p3, 0, sizeof(mpc->parameters.mpc_p3));
         mpc->parameters.mpc_p4 = MPC_P4;
         mpc->parameters.mpc_p5 = MPC_P5;
         mpc->parameters.mpc_p6 = MPC_P6;
@@ -286,9 +312,9 @@ static struct mpoa_client *alloc_mpc(void)
 static void start_mpc(struct mpoa_client *mpc, struct net_device *dev)
 {
 
-        dprintk("mpoa: (%s) start_mpc:\n", mpc->dev->name);
+        dprintk("(%s)\n", mpc->dev->name);
         if (!dev->netdev_ops)
-                printk("mpoa: (%s) start_mpc  not starting\n", dev->name);
+                pr_info("(%s) not starting\n", dev->name);
         else {
                 mpc->old_ops = dev->netdev_ops;
                 mpc->new_ops = *mpc->old_ops;
@@ -300,14 +326,14 @@ static void start_mpc(struct mpoa_client *mpc, struct net_device *dev)
 static void stop_mpc(struct mpoa_client *mpc)
 {
         struct net_device *dev = mpc->dev;
-        dprintk("mpoa: (%s) stop_mpc:", mpc->dev->name);
+        dprintk("(%s)", mpc->dev->name);
 
         /* Lets not nullify lec device's dev->hard_start_xmit */
         if (dev->netdev_ops != &mpc->new_ops) {
-                dprintk(" mpc already stopped, not fatal\n");
+                dprintk_cont(" mpc already stopped, not fatal\n");
                 return;
         }
-        dprintk("\n");
+        dprintk_cont("\n");
 
         dev->netdev_ops = mpc->old_ops;
         mpc->old_ops = NULL;
@@ -319,25 +345,18 @@ static const char *mpoa_device_type_string(char type) __attribute__ ((unused));
 
 static const char *mpoa_device_type_string(char type)
 {
-        switch(type) {
+        switch (type) {
         case NON_MPOA:
                 return "non-MPOA device";
-                break;
         case MPS:
                 return "MPS";
-                break;
         case MPC:
                 return "MPC";
-                break;
         case MPS_AND_MPC:
                 return "both MPS and MPC";
-                break;
-        default:
-                return "unspecified (non-MPOA) device";
-                break;
         }
 
-        return ""; /* not reached */
+        return "unspecified (non-MPOA) device";
 }
 
 /*
@@ -362,26 +381,28 @@ static void lane2_assoc_ind(struct net_device *dev, const u8 *mac_addr,
         struct mpoa_client *mpc;
 
         mpoa_device_type = number_of_mps_macs = 0; /* silence gcc */
-        dprintk("mpoa: (%s) lane2_assoc_ind: received TLV(s), ", dev->name);
+        dprintk("(%s) received TLV(s), ", dev->name);
         dprintk("total length of all TLVs %d\n", sizeoftlvs);
         mpc = find_mpc_by_lec(dev); /* Sampo-Fix: moved here from below */
         if (mpc == NULL) {
-                printk("mpoa: (%s) lane2_assoc_ind: no mpc\n", dev->name);
+                pr_info("(%s) no mpc\n", dev->name);
                 return;
         }
         end_of_tlvs = tlvs + sizeoftlvs;
         while (end_of_tlvs - tlvs >= 5) {
-                type = (tlvs[0] << 24) | (tlvs[1] << 16) | (tlvs[2] << 8) | tlvs[3];
+                type = ((tlvs[0] << 24) | (tlvs[1] << 16) |
+                        (tlvs[2] << 8) | tlvs[3]);
                 length = tlvs[4];
                 tlvs += 5;
                 dprintk("    type 0x%x length %02x\n", type, length);
                 if (tlvs + length > end_of_tlvs) {
-                        printk("TLV value extends past its buffer, aborting parse\n");
+                        pr_info("TLV value extends past its buffer, aborting parse\n");
                         return;
                 }
 
                 if (type == 0) {
-                        printk("mpoa: (%s) lane2_assoc_ind: TLV type was 0, returning\n", dev->name);
+                        pr_info("mpoa: (%s) TLV type was 0, returning\n",
+                                dev->name);
                         return;
                 }
 
@@ -391,39 +412,48 @@ static void lane2_assoc_ind(struct net_device *dev, const u8 *mac_addr,
                 }
                 mpoa_device_type = *tlvs++;
                 number_of_mps_macs = *tlvs++;
-                dprintk("mpoa: (%s) MPOA device type '%s', ", dev->name, mpoa_device_type_string(mpoa_device_type));
+                dprintk("(%s) MPOA device type '%s', ",
+                        dev->name, mpoa_device_type_string(mpoa_device_type));
                 if (mpoa_device_type == MPS_AND_MPC &&
                     length < (42 + number_of_mps_macs*ETH_ALEN)) { /* :) */
-                        printk("\nmpoa: (%s) lane2_assoc_ind: short MPOA Device Type TLV\n",
-                               dev->name);
+                        pr_info("(%s) short MPOA Device Type TLV\n",
+                                dev->name);
                         continue;
                 }
-                if ((mpoa_device_type == MPS || mpoa_device_type == MPC)
-                    && length < 22 + number_of_mps_macs*ETH_ALEN) {
-                        printk("\nmpoa: (%s) lane2_assoc_ind: short MPOA Device Type TLV\n",
-                                dev->name);
+                if ((mpoa_device_type == MPS || mpoa_device_type == MPC) &&
+                    length < 22 + number_of_mps_macs*ETH_ALEN) {
+                        pr_info("(%s) short MPOA Device Type TLV\n", dev->name);
                         continue;
                 }
-                if (mpoa_device_type != MPS && mpoa_device_type != MPS_AND_MPC) {
-                        dprintk("ignoring non-MPS device\n");
-                        if (mpoa_device_type == MPC) tlvs += 20;
+                if (mpoa_device_type != MPS &&
+                    mpoa_device_type != MPS_AND_MPC) {
+                        dprintk("ignoring non-MPS device ");
+                        if (mpoa_device_type == MPC)
+                                tlvs += 20;
                         continue;  /* we are only interested in MPSs */
                 }
-                if (number_of_mps_macs == 0 && mpoa_device_type == MPS_AND_MPC) {
-                        printk("\nmpoa: (%s) lane2_assoc_ind: MPS_AND_MPC has zero MACs\n", dev->name);
+                if (number_of_mps_macs == 0 &&
+                    mpoa_device_type == MPS_AND_MPC) {
+                        pr_info("(%s) MPS_AND_MPC has zero MACs\n", dev->name);
                         continue;  /* someone should read the spec */
                 }
-                dprintk("this MPS has %d MAC addresses\n", number_of_mps_macs);
+                dprintk_cont("this MPS has %d MAC addresses\n",
+                             number_of_mps_macs);
 
-                /* ok, now we can go and tell our daemon the control address of MPS */
+                /*
+                 * ok, now we can go and tell our daemon
+                 * the control address of MPS
+                 */
                 send_set_mps_ctrl_addr(tlvs, mpc);
 
-                tlvs = copy_macs(mpc, mac_addr, tlvs, number_of_mps_macs, mpoa_device_type);
-                if (tlvs == NULL) return;
+                tlvs = copy_macs(mpc, mac_addr, tlvs,
+                                 number_of_mps_macs, mpoa_device_type);
+                if (tlvs == NULL)
+                        return;
         }
         if (end_of_tlvs - tlvs != 0)
-                printk("mpoa: (%s) lane2_assoc_ind: ignoring %Zd bytes of trailing TLV carbage\n",
-                       dev->name, end_of_tlvs - tlvs);
+                pr_info("(%s) ignoring %Zd bytes of trailing TLV garbage\n",
+                        dev->name, end_of_tlvs - tlvs);
         return;
 }
 
@@ -441,11 +471,12 @@ static const uint8_t *copy_macs(struct mpoa_client *mpc,
         num_macs = (mps_macs > 1) ? mps_macs : 1;
 
         if (mpc->number_of_mps_macs != num_macs) { /* need to reallocate? */
-                if (mpc->number_of_mps_macs != 0) kfree(mpc->mps_macs);
+                if (mpc->number_of_mps_macs != 0)
+                        kfree(mpc->mps_macs);
                 mpc->number_of_mps_macs = 0;
-                mpc->mps_macs = kmalloc(num_macs*ETH_ALEN, GFP_KERNEL);
+                mpc->mps_macs = kmalloc(num_macs * ETH_ALEN, GFP_KERNEL);
                 if (mpc->mps_macs == NULL) {
-                        printk("mpoa: (%s) copy_macs: out of mem\n", mpc->dev->name);
+                        pr_info("(%s) out of mem\n", mpc->dev->name);
                         return NULL;
                 }
         }
@@ -478,24 +509,30 @@ static int send_via_shortcut(struct sk_buff *skb, struct mpoa_client *mpc)
         iph = (struct iphdr *)buff;
         ipaddr = iph->daddr;
 
-        ddprintk("mpoa: (%s) send_via_shortcut: ipaddr 0x%x\n", mpc->dev->name, ipaddr);
+        ddprintk("(%s) ipaddr 0x%x\n",
+                 mpc->dev->name, ipaddr);
 
         entry = mpc->in_ops->get(ipaddr, mpc);
         if (entry == NULL) {
                 entry = mpc->in_ops->add_entry(ipaddr, mpc);
-                if (entry != NULL) mpc->in_ops->put(entry);
+                if (entry != NULL)
+                        mpc->in_ops->put(entry);
                 return 1;
         }
-        if (mpc->in_ops->cache_hit(entry, mpc) != OPEN){   /* threshold not exceeded or VCC not ready */
-                ddprintk("mpoa: (%s) send_via_shortcut: cache_hit: returns != OPEN\n", mpc->dev->name);
+        /* threshold not exceeded or VCC not ready */
+        if (mpc->in_ops->cache_hit(entry, mpc) != OPEN) {
+                ddprintk("(%s) cache_hit: returns != OPEN\n",
+                         mpc->dev->name);
                 mpc->in_ops->put(entry);
                 return 1;
         }
 
-        ddprintk("mpoa: (%s) send_via_shortcut: using shortcut\n", mpc->dev->name);
+        ddprintk("(%s) using shortcut\n",
+                 mpc->dev->name);
         /* MPOA spec A.1.4, MPOA client must decrement IP ttl at least by one */
         if (iph->ttl <= 1) {
-                ddprintk("mpoa: (%s) send_via_shortcut: IP ttl = %u, using LANE\n", mpc->dev->name, iph->ttl);
+                ddprintk("(%s) IP ttl = %u, using LANE\n",
+                         mpc->dev->name, iph->ttl);
                 mpc->in_ops->put(entry);
                 return 1;
         }
@@ -504,15 +541,18 @@ static int send_via_shortcut(struct sk_buff *skb, struct mpoa_client *mpc)
         iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
 
         if (entry->ctrl_info.tag != 0) {
-                ddprintk("mpoa: (%s) send_via_shortcut: adding tag 0x%x\n", mpc->dev->name, entry->ctrl_info.tag);
+                ddprintk("(%s) adding tag 0x%x\n",
+                         mpc->dev->name, entry->ctrl_info.tag);
                 tagged_llc_snap_hdr.tag = entry->ctrl_info.tag;
-                skb_pull(skb, ETH_HLEN);                       /* get rid of Eth header */
-                skb_push(skb, sizeof(tagged_llc_snap_hdr));    /* add LLC/SNAP header   */
+                skb_pull(skb, ETH_HLEN);        /* get rid of Eth header */
+                skb_push(skb, sizeof(tagged_llc_snap_hdr));
+                                                /* add LLC/SNAP header   */
                 skb_copy_to_linear_data(skb, &tagged_llc_snap_hdr,
                                         sizeof(tagged_llc_snap_hdr));
         } else {
-                skb_pull(skb, ETH_HLEN);                        /* get rid of Eth header */
-                skb_push(skb, sizeof(struct llc_snap_hdr));     /* add LLC/SNAP header + tag  */
+                skb_pull(skb, ETH_HLEN);        /* get rid of Eth header */
+                skb_push(skb, sizeof(struct llc_snap_hdr));
+                                                /* add LLC/SNAP header + tag  */
                 skb_copy_to_linear_data(skb, &llc_snap_mpoa_data,
                                         sizeof(struct llc_snap_hdr));
         }
@@ -537,8 +577,8 @@ static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
         int i = 0;
 
         mpc = find_mpc_by_lec(dev); /* this should NEVER fail */
-        if(mpc == NULL) {
-                printk("mpoa: (%s) mpc_send_packet: no MPC found\n", dev->name);
+        if (mpc == NULL) {
+                pr_info("(%s) no MPC found\n", dev->name);
                 goto non_ip;
         }
 
@@ -554,14 +594,15 @@ static netdev_tx_t mpc_send_packet(struct sk_buff *skb,
                 goto non_ip;
 
         while (i < mpc->number_of_mps_macs) {
-                if (!compare_ether_addr(eth->h_dest, (mpc->mps_macs + i*ETH_ALEN)))
-                        if ( send_via_shortcut(skb, mpc) == 0 )           /* try shortcut */
-                                return NETDEV_TX_OK;                      /* success!     */
+                if (!compare_ether_addr(eth->h_dest,
+                                        (mpc->mps_macs + i*ETH_ALEN)))
+                        if (send_via_shortcut(skb, mpc) == 0) /* try shortcut */
+                                return NETDEV_TX_OK;
                 i++;
         }
 
- non_ip:
-        return mpc->old_ops->ndo_start_xmit(skb,dev);
+non_ip:
+        return mpc->old_ops->ndo_start_xmit(skb, dev);
 }
 
 static int atm_mpoa_vcc_attach(struct atm_vcc *vcc, void __user *arg)
@@ -574,7 +615,8 @@ static int atm_mpoa_vcc_attach(struct atm_vcc *vcc, void __user *arg)
 
         bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmmpc_ioc));
         if (bytes_left != 0) {
-                printk("mpoa: mpc_vcc_attach: Short read (missed %d bytes) from userland\n", bytes_left);
+                pr_info("mpoa:Short read (missed %d bytes) from userland\n",
+                        bytes_left);
                 return -EFAULT;
         }
         ipaddr = ioc_data.ipaddr;
@@ -587,18 +629,20 @@ static int atm_mpoa_vcc_attach(struct atm_vcc *vcc, void __user *arg)
 
         if (ioc_data.type == MPC_SOCKET_INGRESS) {
                 in_entry = mpc->in_ops->get(ipaddr, mpc);
-                if (in_entry == NULL || in_entry->entry_state < INGRESS_RESOLVED) {
-                        printk("mpoa: (%s) mpc_vcc_attach: did not find RESOLVED entry from ingress cache\n",
+                if (in_entry == NULL ||
+                    in_entry->entry_state < INGRESS_RESOLVED) {
+                        pr_info("(%s) did not find RESOLVED entry from ingress cache\n",
                                 mpc->dev->name);
-                        if (in_entry != NULL) mpc->in_ops->put(in_entry);
+                        if (in_entry != NULL)
+                                mpc->in_ops->put(in_entry);
                         return -EINVAL;
                 }
-                printk("mpoa: (%s) mpc_vcc_attach: attaching ingress SVC, entry = %pI4\n",
-                       mpc->dev->name, &in_entry->ctrl_info.in_dst_ip);
+                pr_info("(%s) attaching ingress SVC, entry = %pI4\n",
+                        mpc->dev->name, &in_entry->ctrl_info.in_dst_ip);
                 in_entry->shortcut = vcc;
                 mpc->in_ops->put(in_entry);
         } else {
-                printk("mpoa: (%s) mpc_vcc_attach: attaching egress SVC\n", mpc->dev->name);
+                pr_info("(%s) attaching egress SVC\n", mpc->dev->name);
         }
 
         vcc->proto_data = mpc->dev;
@@ -618,27 +662,27 @@ static void mpc_vcc_close(struct atm_vcc *vcc, struct net_device *dev)
 
         mpc = find_mpc_by_lec(dev);
         if (mpc == NULL) {
-                printk("mpoa: (%s) mpc_vcc_close: close for unknown MPC\n", dev->name);
+                pr_info("(%s) close for unknown MPC\n", dev->name);
                 return;
         }
 
-        dprintk("mpoa: (%s) mpc_vcc_close:\n", dev->name);
+        dprintk("(%s)\n", dev->name);
         in_entry = mpc->in_ops->get_by_vcc(vcc, mpc);
         if (in_entry) {
-                dprintk("mpoa: (%s) mpc_vcc_close: ingress SVC closed ip = %pI4\n",
-                       mpc->dev->name, &in_entry->ctrl_info.in_dst_ip);
+                dprintk("(%s) ingress SVC closed ip = %pI4\n",
+                        mpc->dev->name, &in_entry->ctrl_info.in_dst_ip);
                 in_entry->shortcut = NULL;
                 mpc->in_ops->put(in_entry);
         }
         eg_entry = mpc->eg_ops->get_by_vcc(vcc, mpc);
         if (eg_entry) {
-                dprintk("mpoa: (%s) mpc_vcc_close: egress SVC closed\n", mpc->dev->name);
+                dprintk("(%s) egress SVC closed\n", mpc->dev->name);
                 eg_entry->shortcut = NULL;
                 mpc->eg_ops->put(eg_entry);
         }
 
         if (in_entry == NULL && eg_entry == NULL)
-                dprintk("mpoa: (%s) mpc_vcc_close:  unused vcc closed\n", dev->name);
+                dprintk("(%s) unused vcc closed\n", dev->name);
 
         return;
 }
@@ -652,18 +696,19 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
         __be32 tag;
         char *tmp;
 
-        ddprintk("mpoa: (%s) mpc_push:\n", dev->name);
+        ddprintk("(%s)\n", dev->name);
         if (skb == NULL) {
-                dprintk("mpoa: (%s) mpc_push: null skb, closing VCC\n", dev->name);
+                dprintk("(%s) null skb, closing VCC\n", dev->name);
                 mpc_vcc_close(vcc, dev);
                 return;
         }
 
         skb->dev = dev;
-        if (memcmp(skb->data, &llc_snap_mpoa_ctrl, sizeof(struct llc_snap_hdr)) == 0) {
+        if (memcmp(skb->data, &llc_snap_mpoa_ctrl,
+                   sizeof(struct llc_snap_hdr)) == 0) {
                 struct sock *sk = sk_atm(vcc);
 
-                dprintk("mpoa: (%s) mpc_push: control packet arrived\n", dev->name);
+                dprintk("(%s) control packet arrived\n", dev->name);
                 /* Pass control packets to daemon */
                 skb_queue_tail(&sk->sk_receive_queue, skb);
                 sk->sk_data_ready(sk, skb->len);
@@ -675,20 +720,22 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
 
         mpc = find_mpc_by_lec(dev);
         if (mpc == NULL) {
-                printk("mpoa: (%s) mpc_push: unknown MPC\n", dev->name);
+                pr_info("(%s) unknown MPC\n", dev->name);
                 return;
         }
 
-        if (memcmp(skb->data, &llc_snap_mpoa_data_tagged, sizeof(struct llc_snap_hdr)) == 0) { /* MPOA tagged data */
-                ddprintk("mpoa: (%s) mpc_push: tagged data packet arrived\n", dev->name);
+        if (memcmp(skb->data, &llc_snap_mpoa_data_tagged,
+                   sizeof(struct llc_snap_hdr)) == 0) { /* MPOA tagged data */
+                ddprintk("(%s) tagged data packet arrived\n", dev->name);
 
-        } else if (memcmp(skb->data, &llc_snap_mpoa_data, sizeof(struct llc_snap_hdr)) == 0) { /* MPOA data */
-                printk("mpoa: (%s) mpc_push: non-tagged data packet arrived\n", dev->name);
-                printk("           mpc_push: non-tagged data unsupported, purging\n");
+        } else if (memcmp(skb->data, &llc_snap_mpoa_data,
+                          sizeof(struct llc_snap_hdr)) == 0) { /* MPOA data */
+                pr_info("(%s) Unsupported non-tagged data packet arrived.  Purging\n",
+                        dev->name);
                 dev_kfree_skb_any(skb);
                 return;
         } else {
-                printk("mpoa: (%s) mpc_push: garbage arrived, purging\n", dev->name);
+                pr_info("(%s) garbage arrived, purging\n", dev->name);
                 dev_kfree_skb_any(skb);
                 return;
         }
@@ -698,8 +745,8 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
 
         eg = mpc->eg_ops->get_by_tag(tag, mpc);
         if (eg == NULL) {
-                printk("mpoa: (%s) mpc_push: Didn't find egress cache entry, tag = %u\n",
-                       dev->name,tag);
+                pr_info("mpoa: (%s) Didn't find egress cache entry, tag = %u\n",
+                        dev->name, tag);
                 purge_egress_shortcut(vcc, NULL);
                 dev_kfree_skb_any(skb);
                 return;
@@ -711,13 +758,15 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
          */
         if (eg->shortcut == NULL) {
                 eg->shortcut = vcc;
-                printk("mpoa: (%s) mpc_push: egress SVC in use\n", dev->name);
+                pr_info("(%s) egress SVC in use\n", dev->name);
         }
 
-        skb_pull(skb, sizeof(struct llc_snap_hdr) + sizeof(tag)); /* get rid of LLC/SNAP header */
-        new_skb = skb_realloc_headroom(skb, eg->ctrl_info.DH_length); /* LLC/SNAP is shorter than MAC header :( */
+        skb_pull(skb, sizeof(struct llc_snap_hdr) + sizeof(tag));
+                                        /* get rid of LLC/SNAP header */
+        new_skb = skb_realloc_headroom(skb, eg->ctrl_info.DH_length);
+                                        /* LLC/SNAP is shorter than MAC header :( */
         dev_kfree_skb_any(skb);
-        if (new_skb == NULL){
+        if (new_skb == NULL) {
                 mpc->eg_ops->put(eg);
                 return;
         }
@@ -750,7 +799,7 @@ static struct atm_dev mpc_dev = {
         /* members not explicitly initialised will be 0 */
 };
 
-static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
+static int atm_mpoa_mpoad_attach(struct atm_vcc *vcc, int arg)
 {
         struct mpoa_client *mpc;
         struct lec_priv *priv;
@@ -770,15 +819,16 @@ static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
 
         mpc = find_mpc_by_itfnum(arg);
         if (mpc == NULL) {
-                dprintk("mpoa: mpoad_attach: allocating new mpc for itf %d\n", arg);
+                dprintk("allocating new mpc for itf %d\n", arg);
                 mpc = alloc_mpc();
                 if (mpc == NULL)
                         return -ENOMEM;
                 mpc->dev_num = arg;
-                mpc->dev = find_lec_by_itfnum(arg); /* NULL if there was no lec */
+                mpc->dev = find_lec_by_itfnum(arg);
+                                        /* NULL if there was no lec */
         }
         if (mpc->mpoad_vcc) {
-                printk("mpoa: mpoad_attach: mpoad is already present for itf %d\n", arg);
+                pr_info("mpoad is already present for itf %d\n", arg);
                 return -EADDRINUSE;
         }
 
@@ -794,8 +844,8 @@ static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
         mpc->mpoad_vcc = vcc;
         vcc->dev = &mpc_dev;
         vcc_insert_socket(sk_atm(vcc));
-        set_bit(ATM_VF_META,&vcc->flags);
-        set_bit(ATM_VF_READY,&vcc->flags);
+        set_bit(ATM_VF_META, &vcc->flags);
+        set_bit(ATM_VF_READY, &vcc->flags);
 
         if (mpc->dev) {
                 char empty[ATM_ESA_LEN];
@@ -805,7 +855,7 @@ static int atm_mpoa_mpoad_attach (struct atm_vcc *vcc, int arg)
                 /* set address if mpcd e.g. gets killed and restarted.
                  * If we do not do it now we have to wait for the next LE_ARP
                  */
-                if ( memcmp(mpc->mps_ctrl_addr, empty, ATM_ESA_LEN) != 0 )
+                if (memcmp(mpc->mps_ctrl_addr, empty, ATM_ESA_LEN) != 0)
                         send_set_mps_ctrl_addr(mpc->mps_ctrl_addr, mpc);
         }
 
@@ -817,7 +867,7 @@ static void send_set_mps_ctrl_addr(const char *addr, struct mpoa_client *mpc)
 {
         struct k_message mesg;
 
-        memcpy (mpc->mps_ctrl_addr, addr, ATM_ESA_LEN);
+        memcpy(mpc->mps_ctrl_addr, addr, ATM_ESA_LEN);
 
         mesg.type = SET_MPS_CTRL_ADDR;
         memcpy(mesg.MPS_ctrl, addr, ATM_ESA_LEN);
@@ -833,11 +883,11 @@ static void mpoad_close(struct atm_vcc *vcc)
 
         mpc = find_mpc_by_vcc(vcc);
         if (mpc == NULL) {
-                printk("mpoa: mpoad_close: did not find MPC\n");
+                pr_info("did not find MPC\n");
                 return;
         }
         if (!mpc->mpoad_vcc) {
-                printk("mpoa: mpoad_close: close for non-present mpoad\n");
+                pr_info("close for non-present mpoad\n");
                 return;
         }
 
@@ -857,7 +907,7 @@ static void mpoad_close(struct atm_vcc *vcc)
                 kfree_skb(skb);
         }
 
-        printk("mpoa: (%s) going down\n",
+        pr_info("(%s) going down\n",
                 (mpc->dev) ? mpc->dev->name : "<unknown>");
         module_put(THIS_MODULE);
 
@@ -871,61 +921,61 @@ static int msg_from_mpoad(struct atm_vcc *vcc, struct sk_buff *skb)
 {
 
         struct mpoa_client *mpc = find_mpc_by_vcc(vcc);
-        struct k_message *mesg = (struct k_message*)skb->data;
+        struct k_message *mesg = (struct k_message *)skb->data;
         atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
 
         if (mpc == NULL) {
-                printk("mpoa: msg_from_mpoad: no mpc found\n");
+                pr_info("no mpc found\n");
                 return 0;
         }
-        dprintk("mpoa: (%s) msg_from_mpoad:", (mpc->dev) ? mpc->dev->name : "<unknown>");
-        switch(mesg->type) {
+        dprintk("(%s)", mpc->dev ? mpc->dev->name : "<unknown>");
+        switch (mesg->type) {
         case MPOA_RES_REPLY_RCVD:
-                dprintk(" mpoa_res_reply_rcvd\n");
+                dprintk_cont("mpoa_res_reply_rcvd\n");
                 MPOA_res_reply_rcvd(mesg, mpc);
                 break;
         case MPOA_TRIGGER_RCVD:
-                dprintk(" mpoa_trigger_rcvd\n");
+                dprintk_cont("mpoa_trigger_rcvd\n");
                 MPOA_trigger_rcvd(mesg, mpc);
                 break;
         case INGRESS_PURGE_RCVD:
-                dprintk(" nhrp_purge_rcvd\n");
+                dprintk_cont("nhrp_purge_rcvd\n");
                 ingress_purge_rcvd(mesg, mpc);
                 break;
         case EGRESS_PURGE_RCVD:
-                dprintk(" egress_purge_reply_rcvd\n");
+                dprintk_cont("egress_purge_reply_rcvd\n");
                 egress_purge_rcvd(mesg, mpc);
                 break;
         case MPS_DEATH:
-                dprintk(" mps_death\n");
+                dprintk_cont("mps_death\n");
                 mps_death(mesg, mpc);
                 break;
         case CACHE_IMPOS_RCVD:
-                dprintk(" cache_impos_rcvd\n");
+                dprintk_cont("cache_impos_rcvd\n");
                 MPOA_cache_impos_rcvd(mesg, mpc);
                 break;
         case SET_MPC_CTRL_ADDR:
-                dprintk(" set_mpc_ctrl_addr\n");
+                dprintk_cont("set_mpc_ctrl_addr\n");
                 set_mpc_ctrl_addr_rcvd(mesg, mpc);
                 break;
         case SET_MPS_MAC_ADDR:
-                dprintk(" set_mps_mac_addr\n");
+                dprintk_cont("set_mps_mac_addr\n");
                 set_mps_mac_addr_rcvd(mesg, mpc);
                 break;
         case CLEAN_UP_AND_EXIT:
-                dprintk(" clean_up_and_exit\n");
+                dprintk_cont("clean_up_and_exit\n");
                 clean_up(mesg, mpc, DIE);
                 break;
         case RELOAD:
-                dprintk(" reload\n");
+                dprintk_cont("reload\n");
                 clean_up(mesg, mpc, RELOAD);
                 break;
         case SET_MPC_PARAMS:
-                dprintk(" set_mpc_params\n");
+                dprintk_cont("set_mpc_params\n");
                 mpc->parameters = mesg->content.params;
                 break;
         default:
-                dprintk(" unknown message %d\n", mesg->type);
+                dprintk_cont("unknown message %d\n", mesg->type);
                 break;
         }
         kfree_skb(skb);
@@ -940,7 +990,7 @@ int msg_to_mpoad(struct k_message *mesg, struct mpoa_client *mpc)
         struct sock *sk;
 
         if (mpc == NULL || !mpc->mpoad_vcc) {
-                printk("mpoa: msg_to_mpoad: mesg %d to a non-existent mpoad\n", mesg->type);
+                pr_info("mesg %d to a non-existent mpoad\n", mesg->type);
                 return -ENXIO;
         }
 
@@ -958,7 +1008,8 @@ int msg_to_mpoad(struct k_message *mesg, struct mpoa_client *mpc)
         return 0;
 }
 
-static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned long event, void *dev_ptr)
+static int mpoa_event_listener(struct notifier_block *mpoa_notifier,
+                               unsigned long event, void *dev_ptr)
 {
         struct net_device *dev;
         struct mpoa_client *mpc;
@@ -980,25 +1031,24 @@ static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned lo
                 priv->lane2_ops->associate_indicator = lane2_assoc_ind;
                 mpc = find_mpc_by_itfnum(priv->itfnum);
                 if (mpc == NULL) {
-                        dprintk("mpoa: mpoa_event_listener: allocating new mpc for %s\n",
-                               dev->name);
+                        dprintk("allocating new mpc for %s\n", dev->name);
                         mpc = alloc_mpc();
                         if (mpc == NULL) {
-                                printk("mpoa: mpoa_event_listener: no new mpc");
+                                pr_info("no new mpc");
                                 break;
                         }
                 }
                 mpc->dev_num = priv->itfnum;
                 mpc->dev = dev;
                 dev_hold(dev);
-                dprintk("mpoa: (%s) was initialized\n", dev->name);
+                dprintk("(%s) was initialized\n", dev->name);
                 break;
         case NETDEV_UNREGISTER:
                 /* the lec device was deallocated */
                 mpc = find_mpc_by_lec(dev);
                 if (mpc == NULL)
                         break;
-                dprintk("mpoa: device (%s) was deallocated\n", dev->name);
+                dprintk("device (%s) was deallocated\n", dev->name);
                 stop_mpc(mpc);
                 dev_put(mpc->dev);
                 mpc->dev = NULL;
@@ -1008,9 +1058,8 @@ static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned lo
                 mpc = find_mpc_by_lec(dev);
                 if (mpc == NULL)
                         break;
-                if (mpc->mpoad_vcc != NULL) {
+                if (mpc->mpoad_vcc != NULL)
                         start_mpc(mpc, dev);
-                }
                 break;
         case NETDEV_DOWN:
                 /* the dev was ifconfig'ed down */
@@ -1020,9 +1069,8 @@ static int mpoa_event_listener(struct notifier_block *mpoa_notifier, unsigned lo
                 mpc = find_mpc_by_lec(dev);
                 if (mpc == NULL)
                         break;
-                if (mpc->mpoad_vcc != NULL) {
+                if (mpc->mpoad_vcc != NULL)
                         stop_mpc(mpc);
-                }
                 break;
         case NETDEV_REBOOT:
         case NETDEV_CHANGE:
@@ -1049,7 +1097,7 @@ static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         in_cache_entry *entry;
 
         entry = mpc->in_ops->get(dst_ip, mpc);
-        if(entry == NULL){
+        if (entry == NULL) {
                 entry = mpc->in_ops->add_entry(dst_ip, mpc);
                 entry->entry_state = INGRESS_RESOLVING;
                 msg->type = SND_MPOA_RES_RQST;
@@ -1060,7 +1108,7 @@ static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc)
                 return;
         }
 
-        if(entry->entry_state == INGRESS_INVALID){
+        if (entry->entry_state == INGRESS_INVALID) {
                 entry->entry_state = INGRESS_RESOLVING;
                 msg->type = SND_MPOA_RES_RQST;
                 msg->content.in_info = entry->ctrl_info;
@@ -1070,7 +1118,7 @@ static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc)
                 return;
         }
 
-        printk("mpoa: (%s) MPOA_trigger_rcvd: entry already in resolving state\n",
+        pr_info("(%s) entry already in resolving state\n",
                 (mpc->dev) ? mpc->dev->name : "<unknown>");
         mpc->in_ops->put(entry);
         return;
@@ -1080,23 +1128,25 @@ static void MPOA_trigger_rcvd(struct k_message *msg, struct mpoa_client *mpc)
  * Things get complicated because we have to check if there's an egress
  * shortcut with suitable traffic parameters we could use.
  */
-static void check_qos_and_open_shortcut(struct k_message *msg, struct mpoa_client *client, in_cache_entry *entry)
+static void check_qos_and_open_shortcut(struct k_message *msg,
+                                        struct mpoa_client *client,
+                                        in_cache_entry *entry)
 {
         __be32 dst_ip = msg->content.in_info.in_dst_ip;
         struct atm_mpoa_qos *qos = atm_mpoa_search_qos(dst_ip);
         eg_cache_entry *eg_entry = client->eg_ops->get_by_src_ip(dst_ip, client);
 
-        if(eg_entry && eg_entry->shortcut){
-                if(eg_entry->shortcut->qos.txtp.traffic_class &
-                   msg->qos.txtp.traffic_class &
-                   (qos ? qos->qos.txtp.traffic_class : ATM_UBR | ATM_CBR)){
-                            if(eg_entry->shortcut->qos.txtp.traffic_class == ATM_UBR)
-                                    entry->shortcut = eg_entry->shortcut;
-                            else if(eg_entry->shortcut->qos.txtp.max_pcr > 0)
-                                    entry->shortcut = eg_entry->shortcut;
+        if (eg_entry && eg_entry->shortcut) {
+                if (eg_entry->shortcut->qos.txtp.traffic_class &
+                    msg->qos.txtp.traffic_class &
+                    (qos ? qos->qos.txtp.traffic_class : ATM_UBR | ATM_CBR)) {
+                        if (eg_entry->shortcut->qos.txtp.traffic_class == ATM_UBR)
+                                entry->shortcut = eg_entry->shortcut;
+                        else if (eg_entry->shortcut->qos.txtp.max_pcr > 0)
+                                entry->shortcut = eg_entry->shortcut;
                 }
-                if(entry->shortcut){
-                        dprintk("mpoa: (%s) using egress SVC to reach %pI4\n",
+                if (entry->shortcut) {
+                        dprintk("(%s) using egress SVC to reach %pI4\n",
                                 client->dev->name, &dst_ip);
                         client->eg_ops->put(eg_entry);
                         return;
@@ -1107,12 +1157,13 @@ static void check_qos_and_open_shortcut(struct k_message *msg, struct mpoa_clien
 
         /* No luck in the egress cache we must open an ingress SVC */
         msg->type = OPEN_INGRESS_SVC;
-        if (qos && (qos->qos.txtp.traffic_class == msg->qos.txtp.traffic_class))
-        {
+        if (qos &&
+            (qos->qos.txtp.traffic_class == msg->qos.txtp.traffic_class)) {
                 msg->qos = qos->qos;
-                printk("mpoa: (%s) trying to get a CBR shortcut\n",client->dev->name);
-        }
-        else memset(&msg->qos,0,sizeof(struct atm_qos));
+                pr_info("(%s) trying to get a CBR shortcut\n",
+                        client->dev->name);
+        } else
+                memset(&msg->qos, 0, sizeof(struct atm_qos));
         msg_to_mpoad(msg, client);
         return;
 }
@@ -1122,17 +1173,19 @@ static void MPOA_res_reply_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         __be32 dst_ip = msg->content.in_info.in_dst_ip;
         in_cache_entry *entry = mpc->in_ops->get(dst_ip, mpc);
 
-        dprintk("mpoa: (%s) MPOA_res_reply_rcvd: ip %pI4\n",
+        dprintk("(%s) ip %pI4\n",
                 mpc->dev->name, &dst_ip);
-        ddprintk("mpoa: (%s) MPOA_res_reply_rcvd() entry = %p", mpc->dev->name, entry);
-        if(entry == NULL){
-                printk("\nmpoa: (%s) ARGH, received res. reply for an entry that doesn't exist.\n", mpc->dev->name);
+        ddprintk("(%s) entry = %p",
+                 mpc->dev->name, entry);
+        if (entry == NULL) {
+                pr_info("(%s) ARGH, received res. reply for an entry that doesn't exist.\n",
+                        mpc->dev->name);
                 return;
         }
-        ddprintk(" entry_state = %d ", entry->entry_state);
+        ddprintk_cont(" entry_state = %d ", entry->entry_state);
 
         if (entry->entry_state == INGRESS_RESOLVED) {
-                printk("\nmpoa: (%s) MPOA_res_reply_rcvd for RESOLVED entry!\n", mpc->dev->name);
+                pr_info("(%s) RESOLVED entry!\n", mpc->dev->name);
                 mpc->in_ops->put(entry);
                 return;
         }
@@ -1141,17 +1194,18 @@ static void MPOA_res_reply_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         do_gettimeofday(&(entry->tv));
         do_gettimeofday(&(entry->reply_wait)); /* Used in refreshing func from now on */
         entry->refresh_time = 0;
-        ddprintk("entry->shortcut = %p\n", entry->shortcut);
+        ddprintk_cont("entry->shortcut = %p\n", entry->shortcut);
 
-        if(entry->entry_state == INGRESS_RESOLVING && entry->shortcut != NULL){
+        if (entry->entry_state == INGRESS_RESOLVING &&
+            entry->shortcut != NULL) {
                 entry->entry_state = INGRESS_RESOLVED;
                 mpc->in_ops->put(entry);
                 return; /* Shortcut already open... */
         }
 
         if (entry->shortcut != NULL) {
-                printk("mpoa: (%s) MPOA_res_reply_rcvd: entry->shortcut != NULL, impossible!\n",
-                       mpc->dev->name);
+                pr_info("(%s) entry->shortcut != NULL, impossible!\n",
+                        mpc->dev->name);
                 mpc->in_ops->put(entry);
                 return;
         }
@@ -1170,14 +1224,14 @@ static void ingress_purge_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         __be32 mask = msg->ip_mask;
         in_cache_entry *entry = mpc->in_ops->get_with_mask(dst_ip, mpc, mask);
 
-        if(entry == NULL){
-                printk("mpoa: (%s) ingress_purge_rcvd: purge for a non-existing entry, ip = %pI4\n",
-                       mpc->dev->name, &dst_ip);
+        if (entry == NULL) {
+                pr_info("(%s) purge for a non-existing entry, ip = %pI4\n",
+                        mpc->dev->name, &dst_ip);
                 return;
         }
 
         do {
-                dprintk("mpoa: (%s) ingress_purge_rcvd: removing an ingress entry, ip = %pI4\n",
+                dprintk("(%s) removing an ingress entry, ip = %pI4\n",
                         mpc->dev->name, &dst_ip);
                 write_lock_bh(&mpc->ingress_lock);
                 mpc->in_ops->remove_entry(entry, mpc);
@@ -1195,7 +1249,8 @@ static void egress_purge_rcvd(struct k_message *msg, struct mpoa_client *mpc)
         eg_cache_entry *entry = mpc->eg_ops->get_by_cache_id(cache_id, mpc);
 
         if (entry == NULL) {
-                dprintk("mpoa: (%s) egress_purge_rcvd: purge for a non-existing entry\n", mpc->dev->name);
+                dprintk("(%s) purge for a non-existing entry\n",
+                        mpc->dev->name);
                 return;
         }
 
@@ -1214,15 +1269,15 @@ static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry)
         struct k_message *purge_msg;
         struct sk_buff *skb;
 
-        dprintk("mpoa: purge_egress_shortcut: entering\n");
+        dprintk("entering\n");
         if (vcc == NULL) {
-                printk("mpoa: purge_egress_shortcut: vcc == NULL\n");
+                pr_info("vcc == NULL\n");
                 return;
         }
 
         skb = alloc_skb(sizeof(struct k_message), GFP_ATOMIC);
         if (skb == NULL) {
-                 printk("mpoa: purge_egress_shortcut: out of memory\n");
+                pr_info("out of memory\n");
                 return;
         }
 
@@ -1238,7 +1293,7 @@ static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry)
         sk = sk_atm(vcc);
         skb_queue_tail(&sk->sk_receive_queue, skb);
         sk->sk_data_ready(sk, skb->len);
-        dprintk("mpoa: purge_egress_shortcut: exiting:\n");
+        dprintk("exiting\n");
 
         return;
 }
@@ -1247,14 +1302,14 @@ static void purge_egress_shortcut(struct atm_vcc *vcc, eg_cache_entry *entry)
  * Our MPS died. Tell our daemon to send NHRP data plane purge to each
  * of the egress shortcuts we have.
  */
-static void mps_death( struct k_message * msg, struct mpoa_client * mpc )
+static void mps_death(struct k_message *msg, struct mpoa_client *mpc)
 {
         eg_cache_entry *entry;
 
-        dprintk("mpoa: (%s) mps_death:\n", mpc->dev->name);
+        dprintk("(%s)\n", mpc->dev->name);
 
-        if(memcmp(msg->MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN)){
-                printk("mpoa: (%s) mps_death: wrong MPS\n", mpc->dev->name);
+        if (memcmp(msg->MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN)) {
+                pr_info("(%s) wrong MPS\n", mpc->dev->name);
                 return;
         }
 
@@ -1273,20 +1328,21 @@ static void mps_death( struct k_message * msg, struct mpoa_client * mpc )
         return;
 }
 
-static void MPOA_cache_impos_rcvd( struct k_message * msg, struct mpoa_client * mpc)
+static void MPOA_cache_impos_rcvd(struct k_message *msg,
+                                  struct mpoa_client *mpc)
 {
         uint16_t holding_time;
         eg_cache_entry *entry = mpc->eg_ops->get_by_cache_id(msg->content.eg_info.cache_id, mpc);
 
         holding_time = msg->content.eg_info.holding_time;
-        dprintk("mpoa: (%s) MPOA_cache_impos_rcvd: entry = %p, holding_time = %u\n",
-               mpc->dev->name, entry, holding_time);
-        if(entry == NULL && holding_time) {
+        dprintk("(%s) entry = %p, holding_time = %u\n",
+                mpc->dev->name, entry, holding_time);
+        if (entry == NULL && holding_time) {
                 entry = mpc->eg_ops->add_entry(msg, mpc);
                 mpc->eg_ops->put(entry);
                 return;
         }
-        if(holding_time){
+        if (holding_time) {
                 mpc->eg_ops->update(entry, holding_time);
                 return;
         }
@@ -1300,7 +1356,8 @@ static void MPOA_cache_impos_rcvd( struct k_message * msg, struct mpoa_client *
         return;
 }
 
-static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg, struct mpoa_client *mpc)
+static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg,
+                                   struct mpoa_client *mpc)
 {
         struct lec_priv *priv;
         int i, retval ;
@@ -1315,34 +1372,39 @@ static void set_mpc_ctrl_addr_rcvd(struct k_message *mesg, struct mpoa_client *m
         memcpy(&tlv[7], mesg->MPS_ctrl, ATM_ESA_LEN); /* MPC ctrl ATM addr */
         memcpy(mpc->our_ctrl_addr, mesg->MPS_ctrl, ATM_ESA_LEN);
 
-        dprintk("mpoa: (%s) setting MPC ctrl ATM address to ",
-               (mpc->dev) ? mpc->dev->name : "<unknown>");
+        dprintk("(%s) setting MPC ctrl ATM address to",
+                mpc->dev ? mpc->dev->name : "<unknown>");
         for (i = 7; i < sizeof(tlv); i++)
-                dprintk("%02x ", tlv[i]);
-        dprintk("\n");
+                dprintk_cont(" %02x", tlv[i]);
+        dprintk_cont("\n");
 
         if (mpc->dev) {
                 priv = netdev_priv(mpc->dev);
-                retval = priv->lane2_ops->associate_req(mpc->dev, mpc->dev->dev_addr, tlv, sizeof(tlv));
+                retval = priv->lane2_ops->associate_req(mpc->dev,
+                                                        mpc->dev->dev_addr,
+                                                        tlv, sizeof(tlv));
                 if (retval == 0)
-                        printk("mpoa: (%s) MPOA device type TLV association failed\n", mpc->dev->name);
+                        pr_info("(%s) MPOA device type TLV association failed\n",
+                                mpc->dev->name);
                 retval = priv->lane2_ops->resolve(mpc->dev, NULL, 1, NULL, NULL);
                 if (retval < 0)
-                        printk("mpoa: (%s) targetless LE_ARP request failed\n", mpc->dev->name);
+                        pr_info("(%s) targetless LE_ARP request failed\n",
+                                mpc->dev->name);
         }
 
         return;
 }
 
-static void set_mps_mac_addr_rcvd(struct k_message *msg, struct mpoa_client *client)
+static void set_mps_mac_addr_rcvd(struct k_message *msg,
+                                  struct mpoa_client *client)
 {
 
-        if(client->number_of_mps_macs)
+        if (client->number_of_mps_macs)
                 kfree(client->mps_macs);
         client->number_of_mps_macs = 0;
         client->mps_macs = kmemdup(msg->MPS_ctrl, ETH_ALEN, GFP_KERNEL);
         if (client->mps_macs == NULL) {
-                printk("mpoa: set_mps_mac_addr_rcvd: out of memory\n");
+                pr_info("out of memory\n");
                 return;
         }
         client->number_of_mps_macs = 1;
@@ -1363,11 +1425,11 @@ static void clean_up(struct k_message *msg, struct mpoa_client *mpc, int action)
         /* FIXME: This knows too much of the cache structure */
         read_lock_irq(&mpc->egress_lock);
         entry = mpc->eg_cache;
-        while (entry != NULL){
-                    msg->content.eg_info = entry->ctrl_info;
-                    dprintk("mpoa: cache_id %u\n", entry->ctrl_info.cache_id);
-                    msg_to_mpoad(msg, mpc);
-                    entry = entry->next;
+        while (entry != NULL) {
+                msg->content.eg_info = entry->ctrl_info;
+                dprintk("cache_id %u\n", entry->ctrl_info.cache_id);
+                msg_to_mpoad(msg, mpc);
+                entry = entry->next;
         }
         read_unlock_irq(&mpc->egress_lock);
 
@@ -1386,20 +1448,22 @@ static void mpc_timer_refresh(void)
         return;
 }
 
-static void mpc_cache_check( unsigned long checking_time  )
+static void mpc_cache_check(unsigned long checking_time)
 {
         struct mpoa_client *mpc = mpcs;
         static unsigned long previous_resolving_check_time;
         static unsigned long previous_refresh_time;
 
-        while( mpc != NULL ){
+        while (mpc != NULL) {
                 mpc->in_ops->clear_count(mpc);
                 mpc->eg_ops->clear_expired(mpc);
-                if(checking_time - previous_resolving_check_time > mpc->parameters.mpc_p4 * HZ ){
+                if (checking_time - previous_resolving_check_time >
+                    mpc->parameters.mpc_p4 * HZ) {
                         mpc->in_ops->check_resolving(mpc);
                         previous_resolving_check_time = checking_time;
                 }
-                if(checking_time - previous_refresh_time > mpc->parameters.mpc_p5 * HZ ){
+                if (checking_time - previous_refresh_time >
+                    mpc->parameters.mpc_p5 * HZ) {
                         mpc->in_ops->refresh(mpc);
                         previous_refresh_time = checking_time;
                 }
@@ -1410,7 +1474,8 @@ static void mpc_cache_check( unsigned long checking_time  )
         return;
 }
 
-static int atm_mpoa_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+static int atm_mpoa_ioctl(struct socket *sock, unsigned int cmd,
+                          unsigned long arg)
 {
         int err = 0;
         struct atm_vcc *vcc = ATM_SD(sock);
@@ -1422,21 +1487,20 @@ static int atm_mpoa_ioctl(struct socket *sock, unsigned int cmd, unsigned long a
                 return -EPERM;
 
         switch (cmd) {
-                case ATMMPC_CTRL:
-                        err = atm_mpoa_mpoad_attach(vcc, (int)arg);
-                        if (err >= 0)
-                                sock->state = SS_CONNECTED;
-                        break;
-                case ATMMPC_DATA:
-                        err = atm_mpoa_vcc_attach(vcc, (void __user *)arg);
-                        break;
-                default:
-                        break;
+        case ATMMPC_CTRL:
+                err = atm_mpoa_mpoad_attach(vcc, (int)arg);
+                if (err >= 0)
+                        sock->state = SS_CONNECTED;
+                break;
+        case ATMMPC_DATA:
+                err = atm_mpoa_vcc_attach(vcc, (void __user *)arg);
+                break;
+        default:
+                break;
         }
         return err;
 }
 
-
 static struct atm_ioctl atm_ioctl_ops = {
         .owner  = THIS_MODULE,
         .ioctl  = atm_mpoa_ioctl,
@@ -1447,9 +1511,9 @@ static __init int atm_mpoa_init(void)
         register_atm_ioctl(&atm_ioctl_ops);
 
         if (mpc_proc_init() != 0)
-                printk(KERN_INFO "mpoa: failed to initialize /proc/mpoa\n");
+                pr_info("failed to initialize /proc/mpoa\n");
 
-        printk("mpc.c: " __DATE__ " " __TIME__ " initialized\n");
+        pr_info("mpc.c: " __DATE__ " " __TIME__ " initialized\n");
 
         return 0;
 }
@@ -1476,15 +1540,15 @@ static void __exit atm_mpoa_cleanup(void)
                         if (priv->lane2_ops != NULL)
                                 priv->lane2_ops->associate_indicator = NULL;
                 }
-                ddprintk("mpoa: cleanup_module: about to clear caches\n");
+                ddprintk("about to clear caches\n");
                 mpc->in_ops->destroy_cache(mpc);
                 mpc->eg_ops->destroy_cache(mpc);
-                ddprintk("mpoa: cleanup_module: caches cleared\n");
+                ddprintk("caches cleared\n");
                 kfree(mpc->mps_macs);
                 memset(mpc, 0, sizeof(struct mpoa_client));
-                ddprintk("mpoa: cleanup_module: about to kfree %p\n", mpc);
+                ddprintk("about to kfree %p\n", mpc);
                 kfree(mpc);
-                ddprintk("mpoa: cleanup_module: next mpc is at %p\n", tmp);
+                ddprintk("next mpc is at %p\n", tmp);
                 mpc = tmp;
         }
 
@@ -1492,7 +1556,7 @@ static void __exit atm_mpoa_cleanup(void)
         qos_head = NULL;
         while (qos != NULL) {
                 nextqos = qos->next;
-                dprintk("mpoa: cleanup_module: freeing qos entry %p\n", qos);
+                dprintk("freeing qos entry %p\n", qos);
                 kfree(qos);
                 qos = nextqos;
         }
diff --git a/net/atm/mpoa_caches.c b/net/atm/mpoa_caches.c
index 4504a4b339bb..4c141810eb6d 100644
--- a/net/atm/mpoa_caches.c
+++ b/net/atm/mpoa_caches.c
@@ -11,15 +11,23 @@
  */
 
 #if 0
-#define dprintk printk    /* debug */
+#define dprintk(format, args...)                                        \
+        printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args)  /* debug */
 #else
-#define dprintk(format,args...)
+#define dprintk(format, args...)                                        \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args);\
+        } while (0)
 #endif
 
 #if 0
-#define ddprintk printk  /* more debug */
+#define ddprintk(format, args...)                                       \
+        printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args)  /* debug */
 #else
-#define ddprintk(format,args...)
+#define ddprintk(format, args...)                                       \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args);\
+        } while (0)
 #endif
 
 static in_cache_entry *in_cache_get(__be32 dst_ip,
@@ -29,8 +37,8 @@ static in_cache_entry *in_cache_get(__be32 dst_ip,
 
         read_lock_bh(&client->ingress_lock);
         entry = client->in_cache;
-        while(entry != NULL){
-                if( entry->ctrl_info.in_dst_ip == dst_ip ){
+        while (entry != NULL) {
+                if (entry->ctrl_info.in_dst_ip == dst_ip) {
                         atomic_inc(&entry->use);
                         read_unlock_bh(&client->ingress_lock);
                         return entry;
@@ -50,8 +58,8 @@ static in_cache_entry *in_cache_get_with_mask(__be32 dst_ip,
 
         read_lock_bh(&client->ingress_lock);
         entry = client->in_cache;
-        while(entry != NULL){
-                if((entry->ctrl_info.in_dst_ip & mask)  == (dst_ip & mask )){
+        while (entry != NULL) {
+                if ((entry->ctrl_info.in_dst_ip & mask) == (dst_ip & mask)) {
                         atomic_inc(&entry->use);
                         read_unlock_bh(&client->ingress_lock);
                         return entry;
@@ -65,14 +73,14 @@ static in_cache_entry *in_cache_get_with_mask(__be32 dst_ip,
 }
 
 static in_cache_entry *in_cache_get_by_vcc(struct atm_vcc *vcc,
-                                           struct mpoa_client *client )
+                                           struct mpoa_client *client)
 {
         in_cache_entry *entry;
 
         read_lock_bh(&client->ingress_lock);
         entry = client->in_cache;
-        while(entry != NULL){
-                if(entry->shortcut == vcc) {
+        while (entry != NULL) {
+                if (entry->shortcut == vcc) {
                         atomic_inc(&entry->use);
                         read_unlock_bh(&client->ingress_lock);
                         return entry;
@@ -90,14 +98,14 @@ static in_cache_entry *in_cache_add_entry(__be32 dst_ip,
         in_cache_entry *entry = kzalloc(sizeof(in_cache_entry), GFP_KERNEL);
 
         if (entry == NULL) {
-                printk("mpoa: mpoa_caches.c: new_in_cache_entry: out of memory\n");
+                pr_info("mpoa: mpoa_caches.c: new_in_cache_entry: out of memory\n");
                 return NULL;
         }
 
-        dprintk("mpoa: mpoa_caches.c: adding an ingress entry, ip = %pI4\n", &dst_ip);
+        dprintk("adding an ingress entry, ip = %pI4\n", &dst_ip);
 
         atomic_set(&entry->use, 1);
-        dprintk("mpoa: mpoa_caches.c: new_in_cache_entry: about to lock\n");
+        dprintk("new_in_cache_entry: about to lock\n");
         write_lock_bh(&client->ingress_lock);
         entry->next = client->in_cache;
         entry->prev = NULL;
@@ -115,7 +123,7 @@ static in_cache_entry *in_cache_add_entry(__be32 dst_ip,
         atomic_inc(&entry->use);
 
         write_unlock_bh(&client->ingress_lock);
-        dprintk("mpoa: mpoa_caches.c: new_in_cache_entry: unlocked\n");
+        dprintk("new_in_cache_entry: unlocked\n");
 
         return entry;
 }
@@ -126,39 +134,41 @@ static int cache_hit(in_cache_entry *entry, struct mpoa_client *mpc)
         struct k_message msg;
 
         entry->count++;
-        if(entry->entry_state == INGRESS_RESOLVED && entry->shortcut != NULL)
+        if (entry->entry_state == INGRESS_RESOLVED && entry->shortcut != NULL)
                 return OPEN;
 
-        if(entry->entry_state == INGRESS_REFRESHING){
-                if(entry->count > mpc->parameters.mpc_p1){
+        if (entry->entry_state == INGRESS_REFRESHING) {
+                if (entry->count > mpc->parameters.mpc_p1) {
                         msg.type = SND_MPOA_RES_RQST;
                         msg.content.in_info = entry->ctrl_info;
                         memcpy(msg.MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN);
                         qos = atm_mpoa_search_qos(entry->ctrl_info.in_dst_ip);
-                        if (qos != NULL) msg.qos = qos->qos;
+                        if (qos != NULL)
+                                msg.qos = qos->qos;
                         msg_to_mpoad(&msg, mpc);
                         do_gettimeofday(&(entry->reply_wait));
                         entry->entry_state = INGRESS_RESOLVING;
                 }
-                if(entry->shortcut != NULL)
+                if (entry->shortcut != NULL)
                         return OPEN;
                 return CLOSED;
         }
 
-        if(entry->entry_state == INGRESS_RESOLVING && entry->shortcut != NULL)
+        if (entry->entry_state == INGRESS_RESOLVING && entry->shortcut != NULL)
                 return OPEN;
 
-        if( entry->count > mpc->parameters.mpc_p1 &&
-            entry->entry_state == INGRESS_INVALID){
-                dprintk("mpoa: (%s) mpoa_caches.c: threshold exceeded for ip %pI4, sending MPOA res req\n",
+        if (entry->count > mpc->parameters.mpc_p1 &&
+            entry->entry_state == INGRESS_INVALID) {
+                dprintk("(%s) threshold exceeded for ip %pI4, sending MPOA res req\n",
                         mpc->dev->name, &entry->ctrl_info.in_dst_ip);
                 entry->entry_state = INGRESS_RESOLVING;
-                msg.type =  SND_MPOA_RES_RQST;
-                memcpy(msg.MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN );
+                msg.type = SND_MPOA_RES_RQST;
+                memcpy(msg.MPS_ctrl, mpc->mps_ctrl_addr, ATM_ESA_LEN);
                 msg.content.in_info = entry->ctrl_info;
                 qos = atm_mpoa_search_qos(entry->ctrl_info.in_dst_ip);
-                if (qos != NULL) msg.qos = qos->qos;
-                msg_to_mpoad( &msg, mpc);
+                if (qos != NULL)
+                        msg.qos = qos->qos;
+                msg_to_mpoad(&msg, mpc);
                 do_gettimeofday(&(entry->reply_wait));
         }
 
@@ -185,7 +195,7 @@ static void in_cache_remove_entry(in_cache_entry *entry,
         struct k_message msg;
 
         vcc = entry->shortcut;
-        dprintk("mpoa: mpoa_caches.c: removing an ingress entry, ip = %pI4\n",
+        dprintk("removing an ingress entry, ip = %pI4\n",
                 &entry->ctrl_info.in_dst_ip);
 
         if (entry->prev != NULL)
@@ -195,14 +205,15 @@ static void in_cache_remove_entry(in_cache_entry *entry,
         if (entry->next != NULL)
                 entry->next->prev = entry->prev;
         client->in_ops->put(entry);
-        if(client->in_cache == NULL && client->eg_cache == NULL){
+        if (client->in_cache == NULL && client->eg_cache == NULL) {
                 msg.type = STOP_KEEP_ALIVE_SM;
-                msg_to_mpoad(&msg,client);
+                msg_to_mpoad(&msg, client);
         }
 
         /* Check if the egress side still uses this VCC */
         if (vcc != NULL) {
-                eg_cache_entry *eg_entry = client->eg_ops->get_by_vcc(vcc, client);
+                eg_cache_entry *eg_entry = client->eg_ops->get_by_vcc(vcc,
+                                                                      client);
                 if (eg_entry != NULL) {
                         client->eg_ops->put(eg_entry);
                         return;
@@ -213,7 +224,6 @@ static void in_cache_remove_entry(in_cache_entry *entry,
         return;
 }
 
-
 /* Call this every MPC-p2 seconds... Not exactly correct solution,
    but an easy one... */
 static void clear_count_and_expired(struct mpoa_client *client)
@@ -225,12 +235,12 @@ static void clear_count_and_expired(struct mpoa_client *client)
 
         write_lock_bh(&client->ingress_lock);
         entry = client->in_cache;
-        while(entry != NULL){
-                entry->count=0;
+        while (entry != NULL) {
+                entry->count = 0;
                 next_entry = entry->next;
-                if((now.tv_sec - entry->tv.tv_sec)
-                   > entry->ctrl_info.holding_time){
-                        dprintk("mpoa: mpoa_caches.c: holding time expired, ip = %pI4\n",
+                if ((now.tv_sec - entry->tv.tv_sec)
+                   > entry->ctrl_info.holding_time) {
+                        dprintk("holding time expired, ip = %pI4\n",
                                 &entry->ctrl_info.in_dst_ip);
                         client->in_ops->remove_entry(entry, client);
                 }
@@ -250,33 +260,38 @@ static void check_resolving_entries(struct mpoa_client *client)
         struct timeval now;
         struct k_message msg;
 
-        do_gettimeofday( &now );
+        do_gettimeofday(&now);
 
         read_lock_bh(&client->ingress_lock);
         entry = client->in_cache;
-        while( entry != NULL ){
-                if(entry->entry_state == INGRESS_RESOLVING){
-                        if(now.tv_sec - entry->hold_down.tv_sec < client->parameters.mpc_p6){
-                                entry = entry->next;                      /* Entry in hold down */
+        while (entry != NULL) {
+                if (entry->entry_state == INGRESS_RESOLVING) {
+                        if ((now.tv_sec - entry->hold_down.tv_sec) <
+                            client->parameters.mpc_p6) {
+                                entry = entry->next;    /* Entry in hold down */
                                 continue;
                         }
-                        if( (now.tv_sec - entry->reply_wait.tv_sec) >
-                            entry->retry_time ){
-                                entry->retry_time = MPC_C1*( entry->retry_time );
-                                if(entry->retry_time > client->parameters.mpc_p5){
-                                        /* Retry time maximum exceeded, put entry in hold down. */
+                        if ((now.tv_sec - entry->reply_wait.tv_sec) >
+                            entry->retry_time) {
+                                entry->retry_time = MPC_C1 * (entry->retry_time);
+                                /*
+                                 * Retry time maximum exceeded,
+                                 * put entry in hold down.
+                                 */
+                                if (entry->retry_time > client->parameters.mpc_p5) {
                                         do_gettimeofday(&(entry->hold_down));
                                         entry->retry_time = client->parameters.mpc_p4;
                                         entry = entry->next;
                                         continue;
                                 }
                                 /* Ask daemon to send a resolution request. */
-                                memset(&(entry->hold_down),0,sizeof(struct timeval));
+                                memset(&(entry->hold_down), 0, sizeof(struct timeval));
                                 msg.type = SND_MPOA_RES_RTRY;
                                 memcpy(msg.MPS_ctrl, client->mps_ctrl_addr, ATM_ESA_LEN);
                                 msg.content.in_info = entry->ctrl_info;
                                 qos = atm_mpoa_search_qos(entry->ctrl_info.in_dst_ip);
-                                if (qos != NULL) msg.qos = qos->qos;
+                                if (qos != NULL)
+                                        msg.qos = qos->qos;
                                 msg_to_mpoad(&msg, client);
                                 do_gettimeofday(&(entry->reply_wait));
                         }
@@ -292,16 +307,17 @@ static void refresh_entries(struct mpoa_client *client)
         struct timeval now;
         struct in_cache_entry *entry = client->in_cache;
 
-        ddprintk("mpoa: mpoa_caches.c: refresh_entries\n");
+        ddprintk("refresh_entries\n");
         do_gettimeofday(&now);
 
         read_lock_bh(&client->ingress_lock);
-        while( entry != NULL ){
-                if( entry->entry_state == INGRESS_RESOLVED ){
-                        if(!(entry->refresh_time))
-                                entry->refresh_time = (2*(entry->ctrl_info.holding_time))/3;
-                        if( (now.tv_sec - entry->reply_wait.tv_sec) > entry->refresh_time ){
-                                dprintk("mpoa: mpoa_caches.c: refreshing an entry.\n");
+        while (entry != NULL) {
+                if (entry->entry_state == INGRESS_RESOLVED) {
+                        if (!(entry->refresh_time))
+                                entry->refresh_time = (2 * (entry->ctrl_info.holding_time))/3;
+                        if ((now.tv_sec - entry->reply_wait.tv_sec) >
+                            entry->refresh_time) {
+                                dprintk("refreshing an entry.\n");
                                 entry->entry_state = INGRESS_REFRESHING;
 
                         }
@@ -314,21 +330,22 @@ static void refresh_entries(struct mpoa_client *client)
 static void in_destroy_cache(struct mpoa_client *mpc)
 {
         write_lock_irq(&mpc->ingress_lock);
-        while(mpc->in_cache != NULL)
+        while (mpc->in_cache != NULL)
                 mpc->in_ops->remove_entry(mpc->in_cache, mpc);
         write_unlock_irq(&mpc->ingress_lock);
 
         return;
 }
 
-static eg_cache_entry *eg_cache_get_by_cache_id(__be32 cache_id, struct mpoa_client *mpc)
+static eg_cache_entry *eg_cache_get_by_cache_id(__be32 cache_id,
+                                                struct mpoa_client *mpc)
 {
         eg_cache_entry *entry;
 
         read_lock_irq(&mpc->egress_lock);
         entry = mpc->eg_cache;
-        while(entry != NULL){
-                if(entry->ctrl_info.cache_id == cache_id){
+        while (entry != NULL) {
+                if (entry->ctrl_info.cache_id == cache_id) {
                         atomic_inc(&entry->use);
                         read_unlock_irq(&mpc->egress_lock);
                         return entry;
@@ -348,7 +365,7 @@ static eg_cache_entry *eg_cache_get_by_tag(__be32 tag, struct mpoa_client *mpc)
 
         read_lock_irqsave(&mpc->egress_lock, flags);
         entry = mpc->eg_cache;
-        while (entry != NULL){
+        while (entry != NULL) {
                 if (entry->ctrl_info.tag == tag) {
                         atomic_inc(&entry->use);
                         read_unlock_irqrestore(&mpc->egress_lock, flags);
@@ -362,14 +379,15 @@ static eg_cache_entry *eg_cache_get_by_tag(__be32 tag, struct mpoa_client *mpc)
 }
 
 /* This can be called from any context since it saves CPU flags */
-static eg_cache_entry *eg_cache_get_by_vcc(struct atm_vcc *vcc, struct mpoa_client *mpc)
+static eg_cache_entry *eg_cache_get_by_vcc(struct atm_vcc *vcc,
+                                           struct mpoa_client *mpc)
 {
         unsigned long flags;
         eg_cache_entry *entry;
 
         read_lock_irqsave(&mpc->egress_lock, flags);
         entry = mpc->eg_cache;
-        while (entry != NULL){
+        while (entry != NULL) {
                 if (entry->shortcut == vcc) {
                         atomic_inc(&entry->use);
                         read_unlock_irqrestore(&mpc->egress_lock, flags);
@@ -382,14 +400,15 @@ static eg_cache_entry *eg_cache_get_by_vcc(struct atm_vcc *vcc, struct mpoa_clie
         return NULL;
 }
 
-static eg_cache_entry *eg_cache_get_by_src_ip(__be32 ipaddr, struct mpoa_client *mpc)
+static eg_cache_entry *eg_cache_get_by_src_ip(__be32 ipaddr,
+                                              struct mpoa_client *mpc)
 {
         eg_cache_entry *entry;
 
         read_lock_irq(&mpc->egress_lock);
         entry = mpc->eg_cache;
-        while(entry != NULL){
-                if(entry->latest_ip_addr == ipaddr) {
+        while (entry != NULL) {
+                if (entry->latest_ip_addr == ipaddr) {
                         atomic_inc(&entry->use);
                         read_unlock_irq(&mpc->egress_lock);
                         return entry;
@@ -421,7 +440,7 @@ static void eg_cache_remove_entry(eg_cache_entry *entry,
         struct k_message msg;
 
         vcc = entry->shortcut;
-        dprintk("mpoa: mpoa_caches.c: removing an egress entry.\n");
+        dprintk("removing an egress entry.\n");
         if (entry->prev != NULL)
                 entry->prev->next = entry->next;
         else
@@ -429,9 +448,9 @@ static void eg_cache_remove_entry(eg_cache_entry *entry,
         if (entry->next != NULL)
                 entry->next->prev = entry->prev;
         client->eg_ops->put(entry);
-        if(client->in_cache == NULL && client->eg_cache == NULL){
+        if (client->in_cache == NULL && client->eg_cache == NULL) {
                 msg.type = STOP_KEEP_ALIVE_SM;
-                msg_to_mpoad(&msg,client);
+                msg_to_mpoad(&msg, client);
         }
 
         /* Check if the ingress side still uses this VCC */
@@ -447,20 +466,21 @@ static void eg_cache_remove_entry(eg_cache_entry *entry,
         return;
 }
 
-static eg_cache_entry *eg_cache_add_entry(struct k_message *msg, struct mpoa_client *client)
+static eg_cache_entry *eg_cache_add_entry(struct k_message *msg,
+                                          struct mpoa_client *client)
 {
         eg_cache_entry *entry = kzalloc(sizeof(eg_cache_entry), GFP_KERNEL);
 
         if (entry == NULL) {
-                printk("mpoa: mpoa_caches.c: new_eg_cache_entry: out of memory\n");
+                pr_info("out of memory\n");
                 return NULL;
         }
 
-        dprintk("mpoa: mpoa_caches.c: adding an egress entry, ip = %pI4, this should be our IP\n",
+        dprintk("adding an egress entry, ip = %pI4, this should be our IP\n",
                 &msg->content.eg_info.eg_dst_ip);
 
         atomic_set(&entry->use, 1);
-        dprintk("mpoa: mpoa_caches.c: new_eg_cache_entry: about to lock\n");
+        dprintk("new_eg_cache_entry: about to lock\n");
         write_lock_irq(&client->egress_lock);
         entry->next = client->eg_cache;
         entry->prev = NULL;
@@ -472,18 +492,18 @@ static eg_cache_entry *eg_cache_add_entry(struct k_message *msg, struct mpoa_cli
         entry->ctrl_info = msg->content.eg_info;
         do_gettimeofday(&(entry->tv));
         entry->entry_state = EGRESS_RESOLVED;
-        dprintk("mpoa: mpoa_caches.c: new_eg_cache_entry cache_id %lu\n", ntohl(entry->ctrl_info.cache_id));
-        dprintk("mpoa: mpoa_caches.c: mps_ip = %pI4\n",
-                &entry->ctrl_info.mps_ip);
+        dprintk("new_eg_cache_entry cache_id %u\n",
+                ntohl(entry->ctrl_info.cache_id));
+        dprintk("mps_ip = %pI4\n", &entry->ctrl_info.mps_ip);
         atomic_inc(&entry->use);
 
         write_unlock_irq(&client->egress_lock);
-        dprintk("mpoa: mpoa_caches.c: new_eg_cache_entry: unlocked\n");
+        dprintk("new_eg_cache_entry: unlocked\n");
 
         return entry;
 }
 
-static void update_eg_cache_entry(eg_cache_entry * entry, uint16_t holding_time)
+static void update_eg_cache_entry(eg_cache_entry *entry, uint16_t holding_time)
 {
         do_gettimeofday(&(entry->tv));
         entry->entry_state = EGRESS_RESOLVED;
@@ -502,13 +522,14 @@ static void clear_expired(struct mpoa_client *client)
 
         write_lock_irq(&client->egress_lock);
         entry = client->eg_cache;
-        while(entry != NULL){
+        while (entry != NULL) {
                 next_entry = entry->next;
-                if((now.tv_sec - entry->tv.tv_sec)
-                   > entry->ctrl_info.holding_time){
+                if ((now.tv_sec - entry->tv.tv_sec)
+                   > entry->ctrl_info.holding_time) {
                         msg.type = SND_EGRESS_PURGE;
                         msg.content.eg_info = entry->ctrl_info;
-                        dprintk("mpoa: mpoa_caches.c: egress_cache: holding time expired, cache_id = %lu.\n",ntohl(entry->ctrl_info.cache_id));
+                        dprintk("egress_cache: holding time expired, cache_id = %u.\n",
+                                ntohl(entry->ctrl_info.cache_id));
                         msg_to_mpoad(&msg, client);
                         client->eg_ops->remove_entry(entry, client);
                 }
@@ -522,7 +543,7 @@ static void clear_expired(struct mpoa_client *client)
 static void eg_destroy_cache(struct mpoa_client *mpc)
 {
         write_lock_irq(&mpc->egress_lock);
-        while(mpc->eg_cache != NULL)
+        while (mpc->eg_cache != NULL)
                 mpc->eg_ops->remove_entry(mpc->eg_cache, mpc);
         write_unlock_irq(&mpc->egress_lock);
 
@@ -530,7 +551,6 @@ static void eg_destroy_cache(struct mpoa_client *mpc)
 }
 
 
-
 static struct in_cache_ops ingress_ops = {
         in_cache_add_entry,               /* add_entry       */
         in_cache_get,                     /* get             */
diff --git a/net/atm/mpoa_proc.c b/net/atm/mpoa_proc.c
index 1a0f5ccea9c4..b9bdb98427e4 100644
--- a/net/atm/mpoa_proc.c
+++ b/net/atm/mpoa_proc.c
@@ -1,3 +1,4 @@
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #ifdef CONFIG_PROC_FS
 #include <linux/errno.h>
@@ -8,7 +9,7 @@
 #include <linux/proc_fs.h>
 #include <linux/time.h>
 #include <linux/seq_file.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 #include <linux/atmmpc.h>
 #include <linux/atm.h>
 #include "mpc.h"
@@ -20,9 +21,23 @@
  */
 
 #if 1
-#define dprintk printk   /* debug */
+#define dprintk(format, args...)                                        \
+        printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args)  /* debug */
 #else
-#define dprintk(format,args...)
+#define dprintk(format, args...)                                        \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args);\
+        } while (0)
+#endif
+
+#if 0
+#define ddprintk(format, args...)                                       \
+        printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args)  /* debug */
+#else
+#define ddprintk(format, args...)                                       \
+        do { if (0)                                                     \
+                printk(KERN_DEBUG "mpoa:%s: " format, __FILE__, ##args);\
+        } while (0)
 #endif
 
 #define STAT_FILE_NAME "mpc"     /* Our statistic file's name */
@@ -51,42 +66,37 @@ static const struct file_operations mpc_file_operations = {
 /*
  * Returns the state of an ingress cache entry as a string
  */
-static const char *ingress_state_string(int state){
-        switch(state) {
+static const char *ingress_state_string(int state)
+{
+        switch (state) {
         case INGRESS_RESOLVING:
                 return "resolving  ";
-                break;
         case INGRESS_RESOLVED:
                 return "resolved   ";
-                break;
         case INGRESS_INVALID:
                 return "invalid    ";
-                break;
         case INGRESS_REFRESHING:
                 return "refreshing ";
-                break;
-        default:
-               return "";
         }
+
+        return "";
 }
 
 /*
  * Returns the state of an egress cache entry as a string
  */
-static const char *egress_state_string(int state){
-        switch(state) {
+static const char *egress_state_string(int state)
+{
+        switch (state) {
         case EGRESS_RESOLVED:
                 return "resolved   ";
-                break;
         case EGRESS_PURGE:
                 return "purge      ";
-                break;
         case EGRESS_INVALID:
                 return "invalid    ";
-                break;
-        default:
-               return "";
         }
+
+        return "";
 }
 
 /*
@@ -123,7 +133,6 @@ static void mpc_stop(struct seq_file *m, void *v)
 static int mpc_show(struct seq_file *m, void *v)
 {
         struct mpoa_client *mpc = v;
-        unsigned char *temp;
         int i;
         in_cache_entry *in_entry;
         eg_cache_entry *eg_entry;
@@ -140,15 +149,17 @@ static int mpc_show(struct seq_file *m, void *v)
         do_gettimeofday(&now);
 
         for (in_entry = mpc->in_cache; in_entry; in_entry = in_entry->next) {
-                temp = (unsigned char *)&in_entry->ctrl_info.in_dst_ip;
-                sprintf(ip_string,"%d.%d.%d.%d", temp[0], temp[1], temp[2], temp[3]);
+                sprintf(ip_string, "%pI4", &in_entry->ctrl_info.in_dst_ip);
                 seq_printf(m, "%-16s%s%-14lu%-12u",
-                              ip_string,
-                              ingress_state_string(in_entry->entry_state),
-                              in_entry->ctrl_info.holding_time-(now.tv_sec-in_entry->tv.tv_sec),
-                              in_entry->packets_fwded);
+                           ip_string,
+                           ingress_state_string(in_entry->entry_state),
+                           in_entry->ctrl_info.holding_time -
+                           (now.tv_sec-in_entry->tv.tv_sec),
+                           in_entry->packets_fwded);
                 if (in_entry->shortcut)
-                        seq_printf(m, "   %-3d  %-3d",in_entry->shortcut->vpi,in_entry->shortcut->vci);
+                        seq_printf(m, "   %-3d  %-3d",
+                                   in_entry->shortcut->vpi,
+                                   in_entry->shortcut->vci);
                 seq_printf(m, "\n");
         }
 
@@ -156,21 +167,23 @@ static int mpc_show(struct seq_file *m, void *v)
         seq_printf(m, "Egress Entries:\nIngress MPC ATM addr\nCache-id        State      Holding time  Packets recvd  Latest IP addr   VPI VCI\n");
         for (eg_entry = mpc->eg_cache; eg_entry; eg_entry = eg_entry->next) {
                 unsigned char *p = eg_entry->ctrl_info.in_MPC_data_ATM_addr;
-                for(i = 0; i < ATM_ESA_LEN; i++)
+                for (i = 0; i < ATM_ESA_LEN; i++)
                         seq_printf(m, "%02x", p[i]);
                 seq_printf(m, "\n%-16lu%s%-14lu%-15u",
                            (unsigned long)ntohl(eg_entry->ctrl_info.cache_id),
                            egress_state_string(eg_entry->entry_state),
-                           (eg_entry->ctrl_info.holding_time-(now.tv_sec-eg_entry->tv.tv_sec)),
+                           (eg_entry->ctrl_info.holding_time -
+                            (now.tv_sec-eg_entry->tv.tv_sec)),
                            eg_entry->packets_rcvd);
 
                 /* latest IP address */
-                temp = (unsigned char *)&eg_entry->latest_ip_addr;
-                sprintf(ip_string, "%d.%d.%d.%d", temp[0], temp[1], temp[2], temp[3]);
+                sprintf(ip_string, "%pI4", &eg_entry->latest_ip_addr);
                 seq_printf(m, "%-16s", ip_string);
 
                 if (eg_entry->shortcut)
-                        seq_printf(m, " %-3d %-3d",eg_entry->shortcut->vpi,eg_entry->shortcut->vci);
+                        seq_printf(m, " %-3d %-3d",
+                                   eg_entry->shortcut->vpi,
+                                   eg_entry->shortcut->vci);
                 seq_printf(m, "\n");
         }
         seq_printf(m, "\n");
@@ -258,12 +271,9 @@ static int parse_qos(const char *buff)
         qos.rxtp.max_pcr = rx_pcr;
         qos.rxtp.max_sdu = rx_sdu;
         qos.aal = ATM_AAL5;
-        dprintk("mpoa: mpoa_proc.c: parse_qos(): setting qos paramameters to tx=%d,%d rx=%d,%d\n",
-                qos.txtp.max_pcr,
-                qos.txtp.max_sdu,
-                qos.rxtp.max_pcr,
-                qos.rxtp.max_sdu
-                );
+        dprintk("parse_qos(): setting qos paramameters to tx=%d,%d rx=%d,%d\n",
+                qos.txtp.max_pcr, qos.txtp.max_sdu,
+                qos.rxtp.max_pcr, qos.rxtp.max_sdu);
 
         atm_mpoa_add_qos(ipaddr, &qos);
         return 1;
@@ -278,7 +288,7 @@ int mpc_proc_init(void)
 
         p = proc_create(STAT_FILE_NAME, 0, atm_proc_root, &mpc_file_operations);
         if (!p) {
-                printk(KERN_ERR "Unable to initialize /proc/atm/%s\n", STAT_FILE_NAME);
+                pr_err("Unable to initialize /proc/atm/%s\n", STAT_FILE_NAME);
                 return -ENOMEM;
         }
         return 0;
@@ -289,10 +299,9 @@ int mpc_proc_init(void)
  */
 void mpc_proc_clean(void)
 {
-        remove_proc_entry(STAT_FILE_NAME,atm_proc_root);
+        remove_proc_entry(STAT_FILE_NAME, atm_proc_root);
 }
 
-
 #endif /* CONFIG_PROC_FS */
 
 
diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c
index 0af84cd4f65b..400839273c67 100644
--- a/net/atm/pppoatm.c
+++ b/net/atm/pppoatm.c
@@ -33,6 +33,8 @@
  * These hooks are not yet available in ppp_generic
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/skbuff.h>
@@ -132,7 +134,7 @@ static void pppoatm_unassign_vcc(struct atm_vcc *atmvcc)
 static void pppoatm_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
 {
         struct pppoatm_vcc *pvcc = atmvcc_to_pvcc(atmvcc);
-        pr_debug("pppoatm push\n");
+        pr_debug("\n");
         if (skb == NULL) {                      /* VCC was closed */
                 pr_debug("removing ATMPPP VCC %p\n", pvcc);
                 pppoatm_unassign_vcc(atmvcc);
@@ -165,17 +167,17 @@ static void pppoatm_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
                         pvcc->chan.mtu += LLC_LEN;
                         break;
                 }
-                pr_debug("Couldn't autodetect yet "
-                    "(skb: %02X %02X %02X %02X %02X %02X)\n",
-                    skb->data[0], skb->data[1], skb->data[2],
-                    skb->data[3], skb->data[4], skb->data[5]);
+                pr_debug("Couldn't autodetect yet (skb: %02X %02X %02X %02X %02X %02X)\n",
+                         skb->data[0], skb->data[1], skb->data[2],
+                         skb->data[3], skb->data[4], skb->data[5]);
                 goto error;
         case e_vc:
                 break;
         }
         ppp_input(&pvcc->chan, skb);
         return;
-    error:
+
+error:
         kfree_skb(skb);
         ppp_input_error(&pvcc->chan, 0);
 }
@@ -194,7 +196,7 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
 {
         struct pppoatm_vcc *pvcc = chan_to_pvcc(chan);
         ATM_SKB(skb)->vcc = pvcc->atmvcc;
-        pr_debug("pppoatm_send (skb=0x%p, vcc=0x%p)\n", skb, pvcc->atmvcc);
+        pr_debug("(skb=0x%p, vcc=0x%p)\n", skb, pvcc->atmvcc);
         if (skb->data[0] == '\0' && (pvcc->flags & SC_COMP_PROT))
                 (void) skb_pull(skb, 1);
         switch (pvcc->encaps) {         /* LLC encapsulation needed */
@@ -208,7 +210,8 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
                                 goto nospace;
                         }
                         kfree_skb(skb);
-                        if ((skb = n) == NULL)
+                        skb = n;
+                        if (skb == NULL)
                                 return DROP_PACKET;
                 } else if (!atm_may_send(pvcc->atmvcc, skb->truesize))
                         goto nospace;
@@ -226,11 +229,11 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb)
 
         atomic_add(skb->truesize, &sk_atm(ATM_SKB(skb)->vcc)->sk_wmem_alloc);
         ATM_SKB(skb)->atm_options = ATM_SKB(skb)->vcc->atm_options;
-        pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, ATM_SKB(skb)->vcc,
-            ATM_SKB(skb)->vcc->dev);
+        pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n",
+                 skb, ATM_SKB(skb)->vcc, ATM_SKB(skb)->vcc->dev);
         return ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb)
             ? DROP_PACKET : 1;
-    nospace:
+nospace:
         /*
          * We don't have space to send this SKB now, but we might have
          * already applied SC_COMP_PROT compression, so may need to undo
@@ -289,7 +292,8 @@ static int pppoatm_assign_vcc(struct atm_vcc *atmvcc, void __user *arg)
             (be.encaps == e_vc ? 0 : LLC_LEN);
         pvcc->wakeup_tasklet = tasklet_proto;
         pvcc->wakeup_tasklet.data = (unsigned long) &pvcc->chan;
-        if ((err = ppp_register_channel(&pvcc->chan)) != 0) {
+        err = ppp_register_channel(&pvcc->chan);
+        if (err != 0) {
                 kfree(pvcc);
                 return err;
         }
diff --git a/net/atm/proc.c b/net/atm/proc.c
index ab8419a324b6..476779d845eb 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -24,15 +24,15 @@
 #include <linux/init.h> /* for __init */
 #include <net/net_namespace.h>
 #include <net/atmclip.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
+#include <linux/param.h> /* for HZ */
 #include <asm/atomic.h>
-#include <asm/param.h> /* for HZ */
 #include "resources.h"
 #include "common.h" /* atm_proc_init prototype */
 #include "signaling.h" /* to get sigd - ugly too */
 
-static ssize_t proc_dev_atm_read(struct file *file,char __user *buf,size_t count,
-    loff_t *pos);
+static ssize_t proc_dev_atm_read(struct file *file, char __user *buf,
+                                 size_t count, loff_t *pos);
 
 static const struct file_operations proc_atm_dev_ops = {
         .owner =        THIS_MODULE,
@@ -43,9 +43,9 @@ static void add_stats(struct seq_file *seq, const char *aal,
   const struct k_atm_aal_stats *stats)
 {
         seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
-            atomic_read(&stats->tx),atomic_read(&stats->tx_err),
-            atomic_read(&stats->rx),atomic_read(&stats->rx_err),
-            atomic_read(&stats->rx_drop));
+                   atomic_read(&stats->tx), atomic_read(&stats->tx_err),
+                   atomic_read(&stats->rx), atomic_read(&stats->rx_err),
+                   atomic_read(&stats->rx_drop));
 }
 
 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
@@ -151,8 +151,8 @@ static void *vcc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 
 static void pvc_info(struct seq_file *seq, struct atm_vcc *vcc)
 {
-        static const char *const class_name[] =
-                {"off","UBR","CBR","VBR","ABR"};
+        static const char *const class_name[] = {
+                "off", "UBR", "CBR", "VBR", "ABR"};
         static const char *const aal_name[] = {
                 "---",  "1",    "2",    "3/4",  /*  0- 3 */
                 "???",  "5",    "???",  "???",  /*  4- 7 */
@@ -160,11 +160,12 @@ static void pvc_info(struct seq_file *seq, struct atm_vcc *vcc)
                 "???",  "0",    "???",  "???"}; /* 12-15 */
 
         seq_printf(seq, "%3d %3d %5d %-3s %7d %-5s %7d %-6s",
-            vcc->dev->number,vcc->vpi,vcc->vci,
-            vcc->qos.aal >= ARRAY_SIZE(aal_name) ? "err" :
-            aal_name[vcc->qos.aal],vcc->qos.rxtp.min_pcr,
-            class_name[vcc->qos.rxtp.traffic_class],vcc->qos.txtp.min_pcr,
-            class_name[vcc->qos.txtp.traffic_class]);
+                   vcc->dev->number, vcc->vpi, vcc->vci,
+                   vcc->qos.aal >= ARRAY_SIZE(aal_name) ? "err" :
+                   aal_name[vcc->qos.aal], vcc->qos.rxtp.min_pcr,
+                   class_name[vcc->qos.rxtp.traffic_class],
+                   vcc->qos.txtp.min_pcr,
+                   class_name[vcc->qos.txtp.traffic_class]);
         if (test_bit(ATM_VF_IS_CLIP, &vcc->flags)) {
                 struct clip_vcc *clip_vcc = CLIP_VCC(vcc);
                 struct net_device *dev;
@@ -195,19 +196,20 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
                 seq_printf(seq, "%3d %3d %5d ", vcc->dev->number, vcc->vpi,
                         vcc->vci);
         switch (sk->sk_family) {
-                case AF_ATMPVC:
-                        seq_printf(seq, "PVC");
-                        break;
-                case AF_ATMSVC:
-                        seq_printf(seq, "SVC");
-                        break;
-                default:
-                        seq_printf(seq, "%3d", sk->sk_family);
+        case AF_ATMPVC:
+                seq_printf(seq, "PVC");
+                break;
+        case AF_ATMSVC:
+                seq_printf(seq, "SVC");
+                break;
+        default:
+                seq_printf(seq, "%3d", sk->sk_family);
         }
-        seq_printf(seq, " %04lx  %5d %7d/%7d %7d/%7d [%d]\n", vcc->flags, sk->sk_err,
-                  sk_wmem_alloc_get(sk), sk->sk_sndbuf,
-                  sk_rmem_alloc_get(sk), sk->sk_rcvbuf,
-                  atomic_read(&sk->sk_refcnt));
+        seq_printf(seq, " %04lx  %5d %7d/%7d %7d/%7d [%d]\n",
+                   vcc->flags, sk->sk_err,
+                   sk_wmem_alloc_get(sk), sk->sk_sndbuf,
+                   sk_rmem_alloc_get(sk), sk->sk_rcvbuf,
+                   atomic_read(&sk->sk_refcnt));
 }
 
 static void svc_info(struct seq_file *seq, struct atm_vcc *vcc)
@@ -376,32 +378,35 @@ static ssize_t proc_dev_atm_read(struct file *file, char __user *buf,
         unsigned long page;
         int length;
 
-        if (count == 0) return 0;
+        if (count == 0)
+                return 0;
         page = get_zeroed_page(GFP_KERNEL);
-        if (!page) return -ENOMEM;
+        if (!page)
+                return -ENOMEM;
         dev = PDE(file->f_path.dentry->d_inode)->data;
         if (!dev->ops->proc_read)
                 length = -EINVAL;
         else {
-                length = dev->ops->proc_read(dev,pos,(char *) page);
-                if (length > count) length = -EINVAL;
+                length = dev->ops->proc_read(dev, pos, (char *)page);
+                if (length > count)
+                        length = -EINVAL;
         }
         if (length >= 0) {
-                if (copy_to_user(buf,(char *) page,length)) length = -EFAULT;
+                if (copy_to_user(buf, (char *)page, length))
+                        length = -EFAULT;
                 (*pos)++;
         }
         free_page(page);
         return length;
 }
 
-
 struct proc_dir_entry *atm_proc_root;
 EXPORT_SYMBOL(atm_proc_root);
 
 
 int atm_proc_dev_register(struct atm_dev *dev)
 {
-        int digits,num;
+        int digits, num;
         int error;
 
         /* No proc info */
@@ -410,26 +415,28 @@ int atm_proc_dev_register(struct atm_dev *dev)
 
         error = -ENOMEM;
         digits = 0;
-        for (num = dev->number; num; num /= 10) digits++;
-        if (!digits) digits++;
+        for (num = dev->number; num; num /= 10)
+                digits++;
+        if (!digits)
+                digits++;
 
         dev->proc_name = kmalloc(strlen(dev->type) + digits + 2, GFP_KERNEL);
         if (!dev->proc_name)
                 goto err_out;
-        sprintf(dev->proc_name,"%s:%d",dev->type, dev->number);
+        sprintf(dev->proc_name, "%s:%d", dev->type, dev->number);
 
         dev->proc_entry = proc_create_data(dev->proc_name, 0, atm_proc_root,
                                            &proc_atm_dev_ops, dev);
         if (!dev->proc_entry)
                 goto err_free_name;
         return 0;
+
 err_free_name:
         kfree(dev->proc_name);
 err_out:
         return error;
 }
 
-
 void atm_proc_dev_deregister(struct atm_dev *dev)
 {
         if (!dev->ops->proc_read)
diff --git a/net/atm/pvc.c b/net/atm/pvc.c
index 8d74e62b0d79..437ee70c5e62 100644
--- a/net/atm/pvc.c
+++ b/net/atm/pvc.c
@@ -17,32 +17,35 @@
 #include "common.h"             /* common for PVCs and SVCs */
 
 
-static int pvc_shutdown(struct socket *sock,int how)
+static int pvc_shutdown(struct socket *sock, int how)
 {
         return 0;
 }
 
-
-static int pvc_bind(struct socket *sock,struct sockaddr *sockaddr,
-    int sockaddr_len)
+static int pvc_bind(struct socket *sock, struct sockaddr *sockaddr,
+                    int sockaddr_len)
 {
         struct sock *sk = sock->sk;
         struct sockaddr_atmpvc *addr;
         struct atm_vcc *vcc;
         int error;
 
-        if (sockaddr_len != sizeof(struct sockaddr_atmpvc)) return -EINVAL;
-        addr = (struct sockaddr_atmpvc *) sockaddr;
-        if (addr->sap_family != AF_ATMPVC) return -EAFNOSUPPORT;
+        if (sockaddr_len != sizeof(struct sockaddr_atmpvc))
+                return -EINVAL;
+        addr = (struct sockaddr_atmpvc *)sockaddr;
+        if (addr->sap_family != AF_ATMPVC)
+                return -EAFNOSUPPORT;
         lock_sock(sk);
         vcc = ATM_SD(sock);
         if (!test_bit(ATM_VF_HASQOS, &vcc->flags)) {
                 error = -EBADFD;
                 goto out;
         }
-        if (test_bit(ATM_VF_PARTIAL,&vcc->flags)) {
-                if (vcc->vpi != ATM_VPI_UNSPEC) addr->sap_addr.vpi = vcc->vpi;
-                if (vcc->vci != ATM_VCI_UNSPEC) addr->sap_addr.vci = vcc->vci;
+        if (test_bit(ATM_VF_PARTIAL, &vcc->flags)) {
+                if (vcc->vpi != ATM_VPI_UNSPEC)
+                        addr->sap_addr.vpi = vcc->vpi;
+                if (vcc->vci != ATM_VCI_UNSPEC)
+                        addr->sap_addr.vci = vcc->vci;
         }
         error = vcc_connect(sock, addr->sap_addr.itf, addr->sap_addr.vpi,
                             addr->sap_addr.vci);
@@ -51,11 +54,10 @@ out:
         return error;
 }
 
-
-static int pvc_connect(struct socket *sock,struct sockaddr *sockaddr,
-    int sockaddr_len,int flags)
+static int pvc_connect(struct socket *sock, struct sockaddr *sockaddr,
+                       int sockaddr_len, int flags)
 {
-        return pvc_bind(sock,sockaddr,sockaddr_len);
+        return pvc_bind(sock, sockaddr, sockaddr_len);
 }
 
 static int pvc_setsockopt(struct socket *sock, int level, int optname,
@@ -70,7 +72,6 @@ static int pvc_setsockopt(struct socket *sock, int level, int optname,
         return error;
 }
 
-
 static int pvc_getsockopt(struct socket *sock, int level, int optname,
                           char __user *optval, int __user *optlen)
 {
@@ -83,16 +84,16 @@ static int pvc_getsockopt(struct socket *sock, int level, int optname,
         return error;
 }
 
-
-static int pvc_getname(struct socket *sock,struct sockaddr *sockaddr,
-    int *sockaddr_len,int peer)
+static int pvc_getname(struct socket *sock, struct sockaddr *sockaddr,
+                       int *sockaddr_len, int peer)
 {
         struct sockaddr_atmpvc *addr;
         struct atm_vcc *vcc = ATM_SD(sock);
 
-        if (!vcc->dev || !test_bit(ATM_VF_ADDR,&vcc->flags)) return -ENOTCONN;
+        if (!vcc->dev || !test_bit(ATM_VF_ADDR, &vcc->flags))
+                return -ENOTCONN;
         *sockaddr_len = sizeof(struct sockaddr_atmpvc);
-        addr = (struct sockaddr_atmpvc *) sockaddr;
+        addr = (struct sockaddr_atmpvc *)sockaddr;
         addr->sap_family = AF_ATMPVC;
         addr->sap_addr.itf = vcc->dev->number;
         addr->sap_addr.vpi = vcc->vpi;
@@ -100,7 +101,6 @@ static int pvc_getname(struct socket *sock,struct sockaddr *sockaddr,
         return 0;
 }
 
-
 static const struct proto_ops pvc_proto_ops = {
         .family =       PF_ATMPVC,
         .owner =        THIS_MODULE,
@@ -137,7 +137,6 @@ static int pvc_create(struct net *net, struct socket *sock, int protocol,
         return vcc_create(net, sock, protocol, PF_ATMPVC);
 }
 
-
 static const struct net_proto_family pvc_family_ops = {
         .family = PF_ATMPVC,
         .create = pvc_create,
diff --git a/net/atm/raw.c b/net/atm/raw.c
index cbfcc71a17b1..d0c4bd047dc4 100644
--- a/net/atm/raw.c
+++ b/net/atm/raw.c
@@ -2,6 +2,7 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/module.h>
 #include <linux/atmdev.h>
@@ -17,7 +18,7 @@
  * SKB == NULL indicates that the link is being closed
  */
 
-static void atm_push_raw(struct atm_vcc *vcc,struct sk_buff *skb)
+static void atm_push_raw(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         if (skb) {
                 struct sock *sk = sk_atm(vcc);
@@ -27,36 +28,33 @@ static void atm_push_raw(struct atm_vcc *vcc,struct sk_buff *skb)
         }
 }
 
-
-static void atm_pop_raw(struct atm_vcc *vcc,struct sk_buff *skb)
+static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         struct sock *sk = sk_atm(vcc);
 
-        pr_debug("APopR (%d) %d -= %d\n", vcc->vci,
-                sk_wmem_alloc_get(sk), skb->truesize);
+        pr_debug("(%d) %d -= %d\n",
+                 vcc->vci, sk_wmem_alloc_get(sk), skb->truesize);
         atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
         dev_kfree_skb_any(skb);
         sk->sk_write_space(sk);
 }
 
-
-static int atm_send_aal0(struct atm_vcc *vcc,struct sk_buff *skb)
+static int atm_send_aal0(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         /*
          * Note that if vpi/vci are _ANY or _UNSPEC the below will
          * still work
          */
         if (!capable(CAP_NET_ADMIN) &&
-            (((u32 *) skb->data)[0] & (ATM_HDR_VPI_MASK | ATM_HDR_VCI_MASK)) !=
-            ((vcc->vpi << ATM_HDR_VPI_SHIFT) | (vcc->vci << ATM_HDR_VCI_SHIFT)))
-            {
+            (((u32 *)skb->data)[0] & (ATM_HDR_VPI_MASK | ATM_HDR_VCI_MASK)) !=
+            ((vcc->vpi << ATM_HDR_VPI_SHIFT) |
+             (vcc->vci << ATM_HDR_VCI_SHIFT))) {
                 kfree_skb(skb);
                 return -EADDRNOTAVAIL;
         }
-        return vcc->dev->ops->send(vcc,skb);
+        return vcc->dev->ops->send(vcc, skb);
 }
 
-
 int atm_init_aal0(struct atm_vcc *vcc)
 {
         vcc->push = atm_push_raw;
@@ -66,7 +64,6 @@ int atm_init_aal0(struct atm_vcc *vcc)
         return 0;
 }
 
-
 int atm_init_aal34(struct atm_vcc *vcc)
 {
         vcc->push = atm_push_raw;
@@ -76,7 +73,6 @@ int atm_init_aal34(struct atm_vcc *vcc)
         return 0;
 }
 
-
 int atm_init_aal5(struct atm_vcc *vcc)
 {
         vcc->push = atm_push_raw;
@@ -85,6 +81,4 @@ int atm_init_aal5(struct atm_vcc *vcc)
         vcc->send = vcc->dev->ops->send;
         return 0;
 }
-
-
 EXPORT_SYMBOL(atm_init_aal5);
diff --git a/net/atm/resources.c b/net/atm/resources.c
index 56b7322ff461..447ed89205d8 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -7,6 +7,7 @@
  * 2002/01 - don't free the whole struct sock on sk->destruct time,
  *           use the default destruct function initialized by sock_init_data */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/ctype.h>
 #include <linux/string.h>
@@ -70,7 +71,7 @@ struct atm_dev *atm_dev_lookup(int number)
         mutex_unlock(&atm_dev_mutex);
         return dev;
 }
-
+EXPORT_SYMBOL(atm_dev_lookup);
 
 struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
                                  int number, unsigned long *flags)
@@ -79,13 +80,13 @@ struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
 
         dev = __alloc_atm_dev(type);
         if (!dev) {
-                printk(KERN_ERR "atm_dev_register: no space for dev %s\n",
-                    type);
+                pr_err("no space for dev %s\n", type);
                 return NULL;
         }
         mutex_lock(&atm_dev_mutex);
         if (number != -1) {
-                if ((inuse = __atm_dev_lookup(number))) {
+                inuse = __atm_dev_lookup(number);
+                if (inuse) {
                         atm_dev_put(inuse);
                         mutex_unlock(&atm_dev_mutex);
                         kfree(dev);
@@ -109,16 +110,12 @@ struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
         atomic_set(&dev->refcnt, 1);
 
         if (atm_proc_dev_register(dev) < 0) {
-                printk(KERN_ERR "atm_dev_register: "
-                       "atm_proc_dev_register failed for dev %s\n",
-                       type);
+                pr_err("atm_proc_dev_register failed for dev %s\n", type);
                 goto out_fail;
         }
 
         if (atm_register_sysfs(dev) < 0) {
-                printk(KERN_ERR "atm_dev_register: "
-                       "atm_register_sysfs failed for dev %s\n",
-                       type);
+                pr_err("atm_register_sysfs failed for dev %s\n", type);
                 atm_proc_dev_deregister(dev);
                 goto out_fail;
         }
@@ -134,7 +131,7 @@ out_fail:
         dev = NULL;
         goto out;
 }
-
+EXPORT_SYMBOL(atm_dev_register);
 
 void atm_dev_deregister(struct atm_dev *dev)
 {
@@ -156,7 +153,7 @@ void atm_dev_deregister(struct atm_dev *dev)
 
         atm_dev_put(dev);
 }
-
+EXPORT_SYMBOL(atm_dev_deregister);
 
 static void copy_aal_stats(struct k_atm_aal_stats *from,
     struct atm_aal_stats *to)
@@ -166,7 +163,6 @@ static void copy_aal_stats(struct k_atm_aal_stats *from,
 #undef __HANDLE_ITEM
 }
 
-
 static void subtract_aal_stats(struct k_atm_aal_stats *from,
     struct atm_aal_stats *to)
 {
@@ -175,8 +171,8 @@ static void subtract_aal_stats(struct k_atm_aal_stats *from,
 #undef __HANDLE_ITEM
 }
 
-
-static int fetch_stats(struct atm_dev *dev, struct atm_dev_stats __user *arg, int zero)
+static int fetch_stats(struct atm_dev *dev, struct atm_dev_stats __user *arg,
+                       int zero)
 {
         struct atm_dev_stats tmp;
         int error = 0;
@@ -194,7 +190,6 @@ static int fetch_stats(struct atm_dev *dev, struct atm_dev_stats __user *arg, in
         return error ? -EFAULT : 0;
 }
 
-
 int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)
 {
         void __user *buf;
@@ -210,50 +205,49 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)
 #endif
 
         switch (cmd) {
-                case ATM_GETNAMES:
-
-                        if (compat) {
+        case ATM_GETNAMES:
+                if (compat) {
 #ifdef CONFIG_COMPAT
-                                struct compat_atm_iobuf __user *ciobuf = arg;
-                                compat_uptr_t cbuf;
-                                iobuf_len = &ciobuf->length;
-                                if (get_user(cbuf, &ciobuf->buffer))
-                                        return -EFAULT;
-                                buf = compat_ptr(cbuf);
+                        struct compat_atm_iobuf __user *ciobuf = arg;
+                        compat_uptr_t cbuf;
+                        iobuf_len = &ciobuf->length;
+                        if (get_user(cbuf, &ciobuf->buffer))
+                                return -EFAULT;
+                        buf = compat_ptr(cbuf);
 #endif
-                        } else {
-                                struct atm_iobuf __user *iobuf = arg;
-                                iobuf_len = &iobuf->length;
-                                if (get_user(buf, &iobuf->buffer))
-                                        return -EFAULT;
-                        }
-                        if (get_user(len, iobuf_len))
+                } else {
+                        struct atm_iobuf __user *iobuf = arg;
+                        iobuf_len = &iobuf->length;
+                        if (get_user(buf, &iobuf->buffer))
                                 return -EFAULT;
-                        mutex_lock(&atm_dev_mutex);
-                        list_for_each(p, &atm_devs)
-                                size += sizeof(int);
-                        if (size > len) {
-                                mutex_unlock(&atm_dev_mutex);
-                                return -E2BIG;
-                        }
-                        tmp_buf = kmalloc(size, GFP_ATOMIC);
-                        if (!tmp_buf) {
-                                mutex_unlock(&atm_dev_mutex);
-                                return -ENOMEM;
-                        }
-                        tmp_p = tmp_buf;
-                        list_for_each(p, &atm_devs) {
-                                dev = list_entry(p, struct atm_dev, dev_list);
-                                *tmp_p++ = dev->number;
-                        }
+                }
+                if (get_user(len, iobuf_len))
+                        return -EFAULT;
+                mutex_lock(&atm_dev_mutex);
+                list_for_each(p, &atm_devs)
+                        size += sizeof(int);
+                if (size > len) {
                         mutex_unlock(&atm_dev_mutex);
-                        error = ((copy_to_user(buf, tmp_buf, size)) ||
-                                        put_user(size, iobuf_len))
-                                                ? -EFAULT : 0;
-                        kfree(tmp_buf);
-                        return error;
-                default:
-                        break;
+                        return -E2BIG;
+                }
+                tmp_buf = kmalloc(size, GFP_ATOMIC);
+                if (!tmp_buf) {
+                        mutex_unlock(&atm_dev_mutex);
+                        return -ENOMEM;
+                }
+                tmp_p = tmp_buf;
+                list_for_each(p, &atm_devs) {
+                        dev = list_entry(p, struct atm_dev, dev_list);
+                        *tmp_p++ = dev->number;
+                }
+                mutex_unlock(&atm_dev_mutex);
+                error = ((copy_to_user(buf, tmp_buf, size)) ||
+                         put_user(size, iobuf_len))
+                        ? -EFAULT : 0;
+                kfree(tmp_buf);
+                return error;
+        default:
+                break;
         }
 
         if (compat) {
@@ -282,166 +276,167 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)
                 if (get_user(number, &sioc->number))
                         return -EFAULT;
         }
-        if (!(dev = try_then_request_module(atm_dev_lookup(number),
-                                            "atm-device-%d", number)))
+
+        dev = try_then_request_module(atm_dev_lookup(number), "atm-device-%d",
+                                      number);
+        if (!dev)
                 return -ENODEV;
 
         switch (cmd) {
-                case ATM_GETTYPE:
-                        size = strlen(dev->type) + 1;
-                        if (copy_to_user(buf, dev->type, size)) {
-                                error = -EFAULT;
-                                goto done;
-                        }
-                        break;
-                case ATM_GETESI:
-                        size = ESI_LEN;
-                        if (copy_to_user(buf, dev->esi, size)) {
-                                error = -EFAULT;
-                                goto done;
-                        }
-                        break;
-                case ATM_SETESI:
-                        {
-                                int i;
-
-                                for (i = 0; i < ESI_LEN; i++)
-                                        if (dev->esi[i]) {
-                                                error = -EEXIST;
-                                                goto done;
-                                        }
-                        }
-                        /* fall through */
-                case ATM_SETESIF:
-                        {
-                                unsigned char esi[ESI_LEN];
-
-                                if (!capable(CAP_NET_ADMIN)) {
-                                        error = -EPERM;
-                                        goto done;
-                                }
-                                if (copy_from_user(esi, buf, ESI_LEN)) {
-                                        error = -EFAULT;
-                                        goto done;
-                                }
-                                memcpy(dev->esi, esi, ESI_LEN);
-                                error =  ESI_LEN;
-                                goto done;
-                        }
-                case ATM_GETSTATZ:
-                        if (!capable(CAP_NET_ADMIN)) {
-                                error = -EPERM;
-                                goto done;
-                        }
-                        /* fall through */
-                case ATM_GETSTAT:
-                        size = sizeof(struct atm_dev_stats);
-                        error = fetch_stats(dev, buf, cmd == ATM_GETSTATZ);
-                        if (error)
-                                goto done;
-                        break;
-                case ATM_GETCIRANGE:
-                        size = sizeof(struct atm_cirange);
-                        if (copy_to_user(buf, &dev->ci_range, size)) {
-                                error = -EFAULT;
-                                goto done;
-                        }
-                        break;
-                case ATM_GETLINKRATE:
-                        size = sizeof(int);
-                        if (copy_to_user(buf, &dev->link_rate, size)) {
-                                error = -EFAULT;
-                                goto done;
-                        }
-                        break;
-                case ATM_RSTADDR:
-                        if (!capable(CAP_NET_ADMIN)) {
-                                error = -EPERM;
-                                goto done;
-                        }
-                        atm_reset_addr(dev, ATM_ADDR_LOCAL);
-                        break;
-                case ATM_ADDADDR:
-                case ATM_DELADDR:
-                case ATM_ADDLECSADDR:
-                case ATM_DELLECSADDR:
-                        if (!capable(CAP_NET_ADMIN)) {
-                                error = -EPERM;
-                                goto done;
-                        }
-                        {
-                                struct sockaddr_atmsvc addr;
-
-                                if (copy_from_user(&addr, buf, sizeof(addr))) {
-                                        error = -EFAULT;
-                                        goto done;
-                                }
-                                if (cmd == ATM_ADDADDR || cmd == ATM_ADDLECSADDR)
-                                        error = atm_add_addr(dev, &addr,
-                                                             (cmd == ATM_ADDADDR ?
-                                                              ATM_ADDR_LOCAL : ATM_ADDR_LECS));
-                                else
-                                        error = atm_del_addr(dev, &addr,
-                                                             (cmd == ATM_DELADDR ?
-                                                              ATM_ADDR_LOCAL : ATM_ADDR_LECS));
+        case ATM_GETTYPE:
+                size = strlen(dev->type) + 1;
+                if (copy_to_user(buf, dev->type, size)) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                break;
+        case ATM_GETESI:
+                size = ESI_LEN;
+                if (copy_to_user(buf, dev->esi, size)) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                break;
+        case ATM_SETESI:
+        {
+                int i;
+
+                for (i = 0; i < ESI_LEN; i++)
+                        if (dev->esi[i]) {
+                                error = -EEXIST;
                                 goto done;
                         }
-                case ATM_GETADDR:
-                case ATM_GETLECSADDR:
-                        error = atm_get_addr(dev, buf, len,
-                                             (cmd == ATM_GETADDR ?
+        }
+        /* fall through */
+        case ATM_SETESIF:
+        {
+                unsigned char esi[ESI_LEN];
+
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
+                        goto done;
+                }
+                if (copy_from_user(esi, buf, ESI_LEN)) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                memcpy(dev->esi, esi, ESI_LEN);
+                error =  ESI_LEN;
+                goto done;
+        }
+        case ATM_GETSTATZ:
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
+                        goto done;
+                }
+                /* fall through */
+        case ATM_GETSTAT:
+                size = sizeof(struct atm_dev_stats);
+                error = fetch_stats(dev, buf, cmd == ATM_GETSTATZ);
+                if (error)
+                        goto done;
+                break;
+        case ATM_GETCIRANGE:
+                size = sizeof(struct atm_cirange);
+                if (copy_to_user(buf, &dev->ci_range, size)) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                break;
+        case ATM_GETLINKRATE:
+                size = sizeof(int);
+                if (copy_to_user(buf, &dev->link_rate, size)) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                break;
+        case ATM_RSTADDR:
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
+                        goto done;
+                }
+                atm_reset_addr(dev, ATM_ADDR_LOCAL);
+                break;
+        case ATM_ADDADDR:
+        case ATM_DELADDR:
+        case ATM_ADDLECSADDR:
+        case ATM_DELLECSADDR:
+        {
+                struct sockaddr_atmsvc addr;
+
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
+                        goto done;
+                }
+
+                if (copy_from_user(&addr, buf, sizeof(addr))) {
+                        error = -EFAULT;
+                        goto done;
+                }
+                if (cmd == ATM_ADDADDR || cmd == ATM_ADDLECSADDR)
+                        error = atm_add_addr(dev, &addr,
+                                             (cmd == ATM_ADDADDR ?
                                               ATM_ADDR_LOCAL : ATM_ADDR_LECS));
-                        if (error < 0)
-                                goto done;
-                        size = error;
-                        /* may return 0, but later on size == 0 means "don't
-                           write the length" */
-                        error = put_user(size, sioc_len)
-                                ? -EFAULT : 0;
+                else
+                        error = atm_del_addr(dev, &addr,
+                                             (cmd == ATM_DELADDR ?
+                                              ATM_ADDR_LOCAL : ATM_ADDR_LECS));
+                goto done;
+        }
+        case ATM_GETADDR:
+        case ATM_GETLECSADDR:
+                error = atm_get_addr(dev, buf, len,
+                                     (cmd == ATM_GETADDR ?
+                                      ATM_ADDR_LOCAL : ATM_ADDR_LECS));
+                if (error < 0)
+                        goto done;
+                size = error;
+                /* may return 0, but later on size == 0 means "don't
+                   write the length" */
+                error = put_user(size, sioc_len) ? -EFAULT : 0;
+                goto done;
+        case ATM_SETLOOP:
+                if (__ATM_LM_XTRMT((int) (unsigned long) buf) &&
+                    __ATM_LM_XTLOC((int) (unsigned long) buf) >
+                    __ATM_LM_XTRMT((int) (unsigned long) buf)) {
+                        error = -EINVAL;
                         goto done;
-                case ATM_SETLOOP:
-                        if (__ATM_LM_XTRMT((int) (unsigned long) buf) &&
-                            __ATM_LM_XTLOC((int) (unsigned long) buf) >
-                            __ATM_LM_XTRMT((int) (unsigned long) buf)) {
+                }
+                /* fall through */
+        case ATM_SETCIRANGE:
+        case SONET_GETSTATZ:
+        case SONET_SETDIAG:
+        case SONET_CLRDIAG:
+        case SONET_SETFRAMING:
+                if (!capable(CAP_NET_ADMIN)) {
+                        error = -EPERM;
+                        goto done;
+                }
+                /* fall through */
+        default:
+                if (compat) {
+#ifdef CONFIG_COMPAT
+                        if (!dev->ops->compat_ioctl) {
                                 error = -EINVAL;
                                 goto done;
                         }
-                        /* fall through */
-                case ATM_SETCIRANGE:
-                case SONET_GETSTATZ:
-                case SONET_SETDIAG:
-                case SONET_CLRDIAG:
-                case SONET_SETFRAMING:
-                        if (!capable(CAP_NET_ADMIN)) {
-                                error = -EPERM;
-                                goto done;
-                        }
-                        /* fall through */
-                default:
-                        if (compat) {
-#ifdef CONFIG_COMPAT
-                                if (!dev->ops->compat_ioctl) {
-                                        error = -EINVAL;
-                                        goto done;
-                                }
-                                size = dev->ops->compat_ioctl(dev, cmd, buf);
+                        size = dev->ops->compat_ioctl(dev, cmd, buf);
 #endif
-                        } else {
-                                if (!dev->ops->ioctl) {
-                                        error = -EINVAL;
-                                        goto done;
-                                }
-                                size = dev->ops->ioctl(dev, cmd, buf);
-                        }
-                        if (size < 0) {
-                                error = (size == -ENOIOCTLCMD ? -EINVAL : size);
+                } else {
+                        if (!dev->ops->ioctl) {
+                                error = -EINVAL;
                                 goto done;
                         }
+                        size = dev->ops->ioctl(dev, cmd, buf);
+                }
+                if (size < 0) {
+                        error = (size == -ENOIOCTLCMD ? -EINVAL : size);
+                        goto done;
+                }
         }
 
         if (size)
-                error = put_user(size, sioc_len)
-                        ? -EFAULT : 0;
+                error = put_user(size, sioc_len) ? -EFAULT : 0;
         else
                 error = 0;
 done:
@@ -449,7 +444,7 @@ done:
         return error;
 }
 
-static __inline__ void *dev_get_idx(loff_t left)
+static inline void *dev_get_idx(loff_t left)
 {
         struct list_head *p;
 
@@ -478,8 +473,3 @@ void *atm_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                 ? atm_devs.next : ((struct list_head *)v)->next;
         return (v == &atm_devs) ? NULL : v;
 }
-
-
-EXPORT_SYMBOL(atm_dev_register);
-EXPORT_SYMBOL(atm_dev_deregister);
-EXPORT_SYMBOL(atm_dev_lookup);
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index 229921400522..ad1d28ae512b 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -2,6 +2,7 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/errno.h>        /* error codes */
 #include <linux/kernel.h>       /* printk */
@@ -17,7 +18,6 @@
 #include "resources.h"
 #include "signaling.h"
 
-
 #undef WAIT_FOR_DEMON           /* #define this if system calls on SVC sockets
                                    should block until the demon runs.
                                    Danger: may cause nasty hangs if the demon
@@ -28,60 +28,59 @@ struct atm_vcc *sigd = NULL;
 static DECLARE_WAIT_QUEUE_HEAD(sigd_sleep);
 #endif
 
-
 static void sigd_put_skb(struct sk_buff *skb)
 {
 #ifdef WAIT_FOR_DEMON
-        DECLARE_WAITQUEUE(wait,current);
+        DECLARE_WAITQUEUE(wait, current);
 
-        add_wait_queue(&sigd_sleep,&wait);
+        add_wait_queue(&sigd_sleep, &wait);
         while (!sigd) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
-                pr_debug("atmsvc: waiting for signaling demon...\n");
+                pr_debug("atmsvc: waiting for signaling daemon...\n");
                 schedule();
         }
         current->state = TASK_RUNNING;
-        remove_wait_queue(&sigd_sleep,&wait);
+        remove_wait_queue(&sigd_sleep, &wait);
 #else
         if (!sigd) {
-                pr_debug("atmsvc: no signaling demon\n");
+                pr_debug("atmsvc: no signaling daemon\n");
                 kfree_skb(skb);
                 return;
         }
 #endif
-        atm_force_charge(sigd,skb->truesize);
-        skb_queue_tail(&sk_atm(sigd)->sk_receive_queue,skb);
+        atm_force_charge(sigd, skb->truesize);
+        skb_queue_tail(&sk_atm(sigd)->sk_receive_queue, skb);
         sk_atm(sigd)->sk_data_ready(sk_atm(sigd), skb->len);
 }
 
-
-static void modify_qos(struct atm_vcc *vcc,struct atmsvc_msg *msg)
+static void modify_qos(struct atm_vcc *vcc, struct atmsvc_msg *msg)
 {
         struct sk_buff *skb;
 
-        if (test_bit(ATM_VF_RELEASED,&vcc->flags) ||
-            !test_bit(ATM_VF_READY,&vcc->flags))
+        if (test_bit(ATM_VF_RELEASED, &vcc->flags) ||
+            !test_bit(ATM_VF_READY, &vcc->flags))
                 return;
         msg->type = as_error;
-        if (!vcc->dev->ops->change_qos) msg->reply = -EOPNOTSUPP;
+        if (!vcc->dev->ops->change_qos)
+                msg->reply = -EOPNOTSUPP;
         else {
                 /* should lock VCC */
-                msg->reply = vcc->dev->ops->change_qos(vcc,&msg->qos,
-                    msg->reply);
-                if (!msg->reply) msg->type = as_okay;
+                msg->reply = vcc->dev->ops->change_qos(vcc, &msg->qos,
+                                                       msg->reply);
+                if (!msg->reply)
+                        msg->type = as_okay;
         }
         /*
          * Should probably just turn around the old skb. But the, the buffer
          * space accounting needs to follow the change too. Maybe later.
          */
-        while (!(skb = alloc_skb(sizeof(struct atmsvc_msg),GFP_KERNEL)))
+        while (!(skb = alloc_skb(sizeof(struct atmsvc_msg), GFP_KERNEL)))
                 schedule();
-        *(struct atmsvc_msg *) skb_put(skb,sizeof(struct atmsvc_msg)) = *msg;
+        *(struct atmsvc_msg *)skb_put(skb, sizeof(struct atmsvc_msg)) = *msg;
         sigd_put_skb(skb);
 }
 
-
-static int sigd_send(struct atm_vcc *vcc,struct sk_buff *skb)
+static int sigd_send(struct atm_vcc *vcc, struct sk_buff *skb)
 {
         struct atmsvc_msg *msg;
         struct atm_vcc *session_vcc;
@@ -90,69 +89,68 @@ static int sigd_send(struct atm_vcc *vcc,struct sk_buff *skb)
         msg = (struct atmsvc_msg *) skb->data;
         atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
         vcc = *(struct atm_vcc **) &msg->vcc;
-        pr_debug("sigd_send %d (0x%lx)\n",(int) msg->type,
-          (unsigned long) vcc);
+        pr_debug("%d (0x%lx)\n", (int)msg->type, (unsigned long)vcc);
         sk = sk_atm(vcc);
 
         switch (msg->type) {
-                case as_okay:
-                        sk->sk_err = -msg->reply;
-                        clear_bit(ATM_VF_WAITING, &vcc->flags);
-                        if (!*vcc->local.sas_addr.prv &&
-                            !*vcc->local.sas_addr.pub) {
-                                vcc->local.sas_family = AF_ATMSVC;
-                                memcpy(vcc->local.sas_addr.prv,
-                                    msg->local.sas_addr.prv,ATM_ESA_LEN);
-                                memcpy(vcc->local.sas_addr.pub,
-                                    msg->local.sas_addr.pub,ATM_E164_LEN+1);
-                        }
-                        session_vcc = vcc->session ? vcc->session : vcc;
-                        if (session_vcc->vpi || session_vcc->vci) break;
-                        session_vcc->itf = msg->pvc.sap_addr.itf;
-                        session_vcc->vpi = msg->pvc.sap_addr.vpi;
-                        session_vcc->vci = msg->pvc.sap_addr.vci;
-                        if (session_vcc->vpi || session_vcc->vci)
-                                session_vcc->qos = msg->qos;
-                        break;
-                case as_error:
-                        clear_bit(ATM_VF_REGIS,&vcc->flags);
-                        clear_bit(ATM_VF_READY,&vcc->flags);
-                        sk->sk_err = -msg->reply;
-                        clear_bit(ATM_VF_WAITING, &vcc->flags);
+        case as_okay:
+                sk->sk_err = -msg->reply;
+                clear_bit(ATM_VF_WAITING, &vcc->flags);
+                if (!*vcc->local.sas_addr.prv && !*vcc->local.sas_addr.pub) {
+                        vcc->local.sas_family = AF_ATMSVC;
+                        memcpy(vcc->local.sas_addr.prv,
+                               msg->local.sas_addr.prv, ATM_ESA_LEN);
+                        memcpy(vcc->local.sas_addr.pub,
+                               msg->local.sas_addr.pub, ATM_E164_LEN + 1);
+                }
+                session_vcc = vcc->session ? vcc->session : vcc;
+                if (session_vcc->vpi || session_vcc->vci)
                         break;
-                case as_indicate:
-                        vcc = *(struct atm_vcc **) &msg->listen_vcc;
-                        sk = sk_atm(vcc);
-                        pr_debug("as_indicate!!!\n");
-                        lock_sock(sk);
-                        if (sk_acceptq_is_full(sk)) {
-                                sigd_enq(NULL,as_reject,vcc,NULL,NULL);
-                                dev_kfree_skb(skb);
-                                goto as_indicate_complete;
-                        }
-                        sk->sk_ack_backlog++;
-                        skb_queue_tail(&sk->sk_receive_queue, skb);
-                        pr_debug("waking sk->sk_sleep 0x%p\n", sk->sk_sleep);
-                        sk->sk_state_change(sk);
+                session_vcc->itf = msg->pvc.sap_addr.itf;
+                session_vcc->vpi = msg->pvc.sap_addr.vpi;
+                session_vcc->vci = msg->pvc.sap_addr.vci;
+                if (session_vcc->vpi || session_vcc->vci)
+                        session_vcc->qos = msg->qos;
+                break;
+        case as_error:
+                clear_bit(ATM_VF_REGIS, &vcc->flags);
+                clear_bit(ATM_VF_READY, &vcc->flags);
+                sk->sk_err = -msg->reply;
+                clear_bit(ATM_VF_WAITING, &vcc->flags);
+                break;
+        case as_indicate:
+                vcc = *(struct atm_vcc **)&msg->listen_vcc;
+                sk = sk_atm(vcc);
+                pr_debug("as_indicate!!!\n");
+                lock_sock(sk);
+                if (sk_acceptq_is_full(sk)) {
+                        sigd_enq(NULL, as_reject, vcc, NULL, NULL);
+                        dev_kfree_skb(skb);
+                        goto as_indicate_complete;
+                }
+                sk->sk_ack_backlog++;
+                skb_queue_tail(&sk->sk_receive_queue, skb);
+                pr_debug("waking sk->sk_sleep 0x%p\n", sk->sk_sleep);
+                sk->sk_state_change(sk);
 as_indicate_complete:
-                        release_sock(sk);
-                        return 0;
-                case as_close:
-                        set_bit(ATM_VF_RELEASED,&vcc->flags);
-                        vcc_release_async(vcc, msg->reply);
-                        goto out;
-                case as_modify:
-                        modify_qos(vcc,msg);
-                        break;
-                case as_addparty:
-                case as_dropparty:
-                        sk->sk_err_soft = msg->reply;   /* < 0 failure, otherwise ep_ref */
-                        clear_bit(ATM_VF_WAITING, &vcc->flags);
-                        break;
-                default:
-                        printk(KERN_ALERT "sigd_send: bad message type %d\n",
-                            (int) msg->type);
-                        return -EINVAL;
+                release_sock(sk);
+                return 0;
+        case as_close:
+                set_bit(ATM_VF_RELEASED, &vcc->flags);
+                vcc_release_async(vcc, msg->reply);
+                goto out;
+        case as_modify:
+                modify_qos(vcc, msg);
+                break;
+        case as_addparty:
+        case as_dropparty:
+                sk->sk_err_soft = msg->reply;
+                                        /* < 0 failure, otherwise ep_ref */
+                clear_bit(ATM_VF_WAITING, &vcc->flags);
+                break;
+        default:
+                pr_alert("bad message type %d\n", (int)msg->type);
+                return -EINVAL;
         }
         sk->sk_state_change(sk);
 out:
@@ -160,48 +158,52 @@ out:
         return 0;
 }
 
-
-void sigd_enq2(struct atm_vcc *vcc,enum atmsvc_msg_type type,
-    struct atm_vcc *listen_vcc,const struct sockaddr_atmpvc *pvc,
-    const struct sockaddr_atmsvc *svc,const struct atm_qos *qos,int reply)
+void sigd_enq2(struct atm_vcc *vcc, enum atmsvc_msg_type type,
+               struct atm_vcc *listen_vcc, const struct sockaddr_atmpvc *pvc,
+               const struct sockaddr_atmsvc *svc, const struct atm_qos *qos,
+               int reply)
 {
         struct sk_buff *skb;
         struct atmsvc_msg *msg;
         static unsigned session = 0;
 
-        pr_debug("sigd_enq %d (0x%p)\n",(int) type,vcc);
-        while (!(skb = alloc_skb(sizeof(struct atmsvc_msg),GFP_KERNEL)))
+        pr_debug("%d (0x%p)\n", (int)type, vcc);
+        while (!(skb = alloc_skb(sizeof(struct atmsvc_msg), GFP_KERNEL)))
                 schedule();
-        msg = (struct atmsvc_msg *) skb_put(skb,sizeof(struct atmsvc_msg));
-        memset(msg,0,sizeof(*msg));
+        msg = (struct atmsvc_msg *)skb_put(skb, sizeof(struct atmsvc_msg));
+        memset(msg, 0, sizeof(*msg));
         msg->type = type;
         *(struct atm_vcc **) &msg->vcc = vcc;
         *(struct atm_vcc **) &msg->listen_vcc = listen_vcc;
         msg->reply = reply;
-        if (qos) msg->qos = *qos;
-        if (vcc) msg->sap = vcc->sap;
-        if (svc) msg->svc = *svc;
-        if (vcc) msg->local = vcc->local;
-        if (pvc) msg->pvc = *pvc;
+        if (qos)
+                msg->qos = *qos;
+        if (vcc)
+                msg->sap = vcc->sap;
+        if (svc)
+                msg->svc = *svc;
+        if (vcc)
+                msg->local = vcc->local;
+        if (pvc)
+                msg->pvc = *pvc;
         if (vcc) {
                 if (type == as_connect && test_bit(ATM_VF_SESSION, &vcc->flags))
                         msg->session = ++session;
                         /* every new pmp connect gets the next session number */
         }
         sigd_put_skb(skb);
-        if (vcc) set_bit(ATM_VF_REGIS,&vcc->flags);
+        if (vcc)
+                set_bit(ATM_VF_REGIS, &vcc->flags);
 }
 
-
-void sigd_enq(struct atm_vcc *vcc,enum atmsvc_msg_type type,
-    struct atm_vcc *listen_vcc,const struct sockaddr_atmpvc *pvc,
-    const struct sockaddr_atmsvc *svc)
+void sigd_enq(struct atm_vcc *vcc, enum atmsvc_msg_type type,
+              struct atm_vcc *listen_vcc, const struct sockaddr_atmpvc *pvc,
+              const struct sockaddr_atmsvc *svc)
 {
-        sigd_enq2(vcc,type,listen_vcc,pvc,svc,vcc ? &vcc->qos : NULL,0);
+        sigd_enq2(vcc, type, listen_vcc, pvc, svc, vcc ? &vcc->qos : NULL, 0);
         /* other ISP applications may use "reply" */
 }
 
-
 static void purge_vcc(struct atm_vcc *vcc)
 {
         if (sk_atm(vcc)->sk_family == PF_ATMSVC &&
@@ -212,21 +214,20 @@ static void purge_vcc(struct atm_vcc *vcc)
         }
 }
 
-
 static void sigd_close(struct atm_vcc *vcc)
 {
         struct hlist_node *node;
         struct sock *s;
         int i;
 
-        pr_debug("sigd_close\n");
+        pr_debug("\n");
         sigd = NULL;
         if (skb_peek(&sk_atm(vcc)->sk_receive_queue))
-                printk(KERN_ERR "sigd_close: closing with requests pending\n");
+                pr_err("closing with requests pending\n");
         skb_queue_purge(&sk_atm(vcc)->sk_receive_queue);
 
         read_lock(&vcc_sklist_lock);
-        for(i = 0; i < VCC_HTABLE_SIZE; ++i) {
+        for (i = 0; i < VCC_HTABLE_SIZE; ++i) {
                 struct hlist_head *head = &vcc_hash[i];
 
                 sk_for_each(s, node, head) {
@@ -238,13 +239,11 @@ static void sigd_close(struct atm_vcc *vcc)
         read_unlock(&vcc_sklist_lock);
 }
 
-
 static struct atmdev_ops sigd_dev_ops = {
         .close = sigd_close,
         .send = sigd_send
 };
 
-
 static struct atm_dev sigd_dev = {
         .ops =          &sigd_dev_ops,
         .type =         "sig",
@@ -252,16 +251,16 @@ static struct atm_dev sigd_dev = {
         .lock =         __SPIN_LOCK_UNLOCKED(sigd_dev.lock)
 };
 
-
 int sigd_attach(struct atm_vcc *vcc)
 {
-        if (sigd) return -EADDRINUSE;
-        pr_debug("sigd_attach\n");
+        if (sigd)
+                return -EADDRINUSE;
+        pr_debug("\n");
         sigd = vcc;
         vcc->dev = &sigd_dev;
         vcc_insert_socket(sk_atm(vcc));
-        set_bit(ATM_VF_META,&vcc->flags);
-        set_bit(ATM_VF_READY,&vcc->flags);
+        set_bit(ATM_VF_META, &vcc->flags);
+        set_bit(ATM_VF_READY, &vcc->flags);
 #ifdef WAIT_FOR_DEMON
         wake_up(&sigd_sleep);
 #endif
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 66e1d9b3e5de..3ba9a45a51ac 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -2,6 +2,7 @@
 
 /* Written 1995-2000 by Werner Almesberger, EPFL LRC/ICA */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ":%s: " fmt, __func__
 
 #include <linux/string.h>
 #include <linux/net.h>          /* struct socket, struct proto_ops */
@@ -18,14 +19,15 @@
 #include <linux/atmdev.h>
 #include <linux/bitops.h>
 #include <net/sock.h>           /* for sock_no_* */
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 #include "resources.h"
 #include "common.h"             /* common for PVCs and SVCs */
 #include "signaling.h"
 #include "addr.h"
 
-static int svc_create(struct net *net, struct socket *sock, int protocol, int kern);
+static int svc_create(struct net *net, struct socket *sock, int protocol,
+                      int kern);
 
 /*
  * Note: since all this is still nicely synchronized with the signaling demon,
@@ -34,25 +36,25 @@ static int svc_create(struct net *net, struct socket *sock, int protocol, int ke
  */
 
 
-static int svc_shutdown(struct socket *sock,int how)
+static int svc_shutdown(struct socket *sock, int how)
 {
         return 0;
 }
 
-
 static void svc_disconnect(struct atm_vcc *vcc)
 {
         DEFINE_WAIT(wait);
         struct sk_buff *skb;
         struct sock *sk = sk_atm(vcc);
 
-        pr_debug("svc_disconnect %p\n",vcc);
-        if (test_bit(ATM_VF_REGIS,&vcc->flags)) {
+        pr_debug("%p\n", vcc);
+        if (test_bit(ATM_VF_REGIS, &vcc->flags)) {
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
-                sigd_enq(vcc,as_close,NULL,NULL,NULL);
-                while (!test_bit(ATM_VF_RELEASED,&vcc->flags) && sigd) {
+                sigd_enq(vcc, as_close, NULL, NULL, NULL);
+                while (!test_bit(ATM_VF_RELEASED, &vcc->flags) && sigd) {
                         schedule();
-                        prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+                        prepare_to_wait(sk->sk_sleep, &wait,
+                                        TASK_UNINTERRUPTIBLE);
                 }
                 finish_wait(sk->sk_sleep, &wait);
         }
@@ -61,35 +63,35 @@ static void svc_disconnect(struct atm_vcc *vcc)
         while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
                 atm_return(vcc, skb->truesize);
                 pr_debug("LISTEN REL\n");
-                sigd_enq2(NULL,as_reject,vcc,NULL,NULL,&vcc->qos,0);
+                sigd_enq2(NULL, as_reject, vcc, NULL, NULL, &vcc->qos, 0);
                 dev_kfree_skb(skb);
         }
         clear_bit(ATM_VF_REGIS, &vcc->flags);
         /* ... may retry later */
 }
 
-
 static int svc_release(struct socket *sock)
 {
         struct sock *sk = sock->sk;
         struct atm_vcc *vcc;
 
-        if (sk)  {
+        if (sk) {
                 vcc = ATM_SD(sock);
-                pr_debug("svc_release %p\n", vcc);
+                pr_debug("%p\n", vcc);
                 clear_bit(ATM_VF_READY, &vcc->flags);
-                /* VCC pointer is used as a reference, so we must not free it
-                   (thereby subjecting it to re-use) before all pending connections
-                   are closed */
+                /*
+                 * VCC pointer is used as a reference,
+                 * so we must not free it (thereby subjecting it to re-use)
+                 * before all pending connections are closed
+                 */
                 svc_disconnect(vcc);
                 vcc_release(sock);
         }
         return 0;
 }
 
-
-static int svc_bind(struct socket *sock,struct sockaddr *sockaddr,
-    int sockaddr_len)
+static int svc_bind(struct socket *sock, struct sockaddr *sockaddr,
+                    int sockaddr_len)
 {
         DEFINE_WAIT(wait);
         struct sock *sk = sock->sk;
@@ -114,38 +116,37 @@ static int svc_bind(struct socket *sock,struct sockaddr *sockaddr,
                 error = -EAFNOSUPPORT;
                 goto out;
         }
-        clear_bit(ATM_VF_BOUND,&vcc->flags);
+        clear_bit(ATM_VF_BOUND, &vcc->flags);
             /* failing rebind will kill old binding */
         /* @@@ check memory (de)allocation on rebind */
-        if (!test_bit(ATM_VF_HASQOS,&vcc->flags)) {
+        if (!test_bit(ATM_VF_HASQOS, &vcc->flags)) {
                 error = -EBADFD;
                 goto out;
         }
         vcc->local = *addr;
         set_bit(ATM_VF_WAITING, &vcc->flags);
         prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
-        sigd_enq(vcc,as_bind,NULL,NULL,&vcc->local);
+        sigd_enq(vcc, as_bind, NULL, NULL, &vcc->local);
         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                 schedule();
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
         }
         finish_wait(sk->sk_sleep, &wait);
-        clear_bit(ATM_VF_REGIS,&vcc->flags); /* doesn't count */
+        clear_bit(ATM_VF_REGIS, &vcc->flags); /* doesn't count */
         if (!sigd) {
                 error = -EUNATCH;
                 goto out;
         }
         if (!sk->sk_err)
-                set_bit(ATM_VF_BOUND,&vcc->flags);
+                set_bit(ATM_VF_BOUND, &vcc->flags);
         error = -sk->sk_err;
 out:
         release_sock(sk);
         return error;
 }
 
-
-static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
-    int sockaddr_len,int flags)
+static int svc_connect(struct socket *sock, struct sockaddr *sockaddr,
+                       int sockaddr_len, int flags)
 {
         DEFINE_WAIT(wait);
         struct sock *sk = sock->sk;
@@ -153,7 +154,7 @@ static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
         struct atm_vcc *vcc = ATM_SD(sock);
         int error;
 
-        pr_debug("svc_connect %p\n",vcc);
+        pr_debug("%p\n", vcc);
         lock_sock(sk);
         if (sockaddr_len != sizeof(struct sockaddr_atmsvc)) {
                 error = -EINVAL;
@@ -201,7 +202,7 @@ static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
                 vcc->remote = *addr;
                 set_bit(ATM_VF_WAITING, &vcc->flags);
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
-                sigd_enq(vcc,as_connect,NULL,NULL,&vcc->remote);
+                sigd_enq(vcc, as_connect, NULL, NULL, &vcc->remote);
                 if (flags & O_NONBLOCK) {
                         finish_wait(sk->sk_sleep, &wait);
                         sock->state = SS_CONNECTING;
@@ -212,7 +213,8 @@ static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
                 while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                         schedule();
                         if (!signal_pending(current)) {
-                                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                                prepare_to_wait(sk->sk_sleep, &wait,
+                                                TASK_INTERRUPTIBLE);
                                 continue;
                         }
                         pr_debug("*ABORT*\n");
@@ -228,20 +230,22 @@ static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
                          *   Kernel <--okay---- Demon
                          *   Kernel <--close--- Demon
                          */
-                        sigd_enq(vcc,as_close,NULL,NULL,NULL);
+                        sigd_enq(vcc, as_close, NULL, NULL, NULL);
                         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
-                                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                                prepare_to_wait(sk->sk_sleep, &wait,
+                                                TASK_INTERRUPTIBLE);
                                 schedule();
                         }
                         if (!sk->sk_err)
-                                while (!test_bit(ATM_VF_RELEASED,&vcc->flags)
-                                    && sigd) {
-                                        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                                while (!test_bit(ATM_VF_RELEASED, &vcc->flags) &&
+                                       sigd) {
+                                        prepare_to_wait(sk->sk_sleep, &wait,
+                                                        TASK_INTERRUPTIBLE);
                                         schedule();
                                 }
-                        clear_bit(ATM_VF_REGIS,&vcc->flags);
-                        clear_bit(ATM_VF_RELEASED,&vcc->flags);
-                        clear_bit(ATM_VF_CLOSE,&vcc->flags);
+                        clear_bit(ATM_VF_REGIS, &vcc->flags);
+                        clear_bit(ATM_VF_RELEASED, &vcc->flags);
+                        clear_bit(ATM_VF_CLOSE, &vcc->flags);
                             /* we're gone now but may connect later */
                         error = -EINTR;
                         break;
@@ -269,37 +273,37 @@ static int svc_connect(struct socket *sock,struct sockaddr *sockaddr,
 /*
  * #endif
  */
-        if (!(error = vcc_connect(sock, vcc->itf, vcc->vpi, vcc->vci)))
+        error = vcc_connect(sock, vcc->itf, vcc->vpi, vcc->vci);
+        if (!error)
                 sock->state = SS_CONNECTED;
         else
-                (void) svc_disconnect(vcc);
+                (void)svc_disconnect(vcc);
 out:
         release_sock(sk);
         return error;
 }
 
-
-static int svc_listen(struct socket *sock,int backlog)
+static int svc_listen(struct socket *sock, int backlog)
 {
         DEFINE_WAIT(wait);
         struct sock *sk = sock->sk;
         struct atm_vcc *vcc = ATM_SD(sock);
         int error;
 
-        pr_debug("svc_listen %p\n",vcc);
+        pr_debug("%p\n", vcc);
         lock_sock(sk);
         /* let server handle listen on unbound sockets */
-        if (test_bit(ATM_VF_SESSION,&vcc->flags)) {
+        if (test_bit(ATM_VF_SESSION, &vcc->flags)) {
                 error = -EINVAL;
                 goto out;
         }
         if (test_bit(ATM_VF_LISTEN, &vcc->flags)) {
                 error = -EADDRINUSE;
                 goto out;
-        }
+        }
         set_bit(ATM_VF_WAITING, &vcc->flags);
         prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
-        sigd_enq(vcc,as_listen,NULL,NULL,&vcc->local);
+        sigd_enq(vcc, as_listen, NULL, NULL, &vcc->local);
         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                 schedule();
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
@@ -309,7 +313,7 @@ static int svc_listen(struct socket *sock,int backlog)
                 error = -EUNATCH;
                 goto out;
         }
-        set_bit(ATM_VF_LISTEN,&vcc->flags);
+        set_bit(ATM_VF_LISTEN, &vcc->flags);
         vcc_insert_socket(sk);
         sk->sk_max_ack_backlog = backlog > 0 ? backlog : ATM_BACKLOG_DEFAULT;
         error = -sk->sk_err;
@@ -318,8 +322,7 @@ out:
         return error;
 }
 
-
-static int svc_accept(struct socket *sock,struct socket *newsock,int flags)
+static int svc_accept(struct socket *sock, struct socket *newsock, int flags)
 {
         struct sock *sk = sock->sk;
         struct sk_buff *skb;
@@ -336,15 +339,16 @@ static int svc_accept(struct socket *sock,struct socket *newsock,int flags)
 
         new_vcc = ATM_SD(newsock);
 
-        pr_debug("svc_accept %p -> %p\n",old_vcc,new_vcc);
+        pr_debug("%p -> %p\n", old_vcc, new_vcc);
         while (1) {
                 DEFINE_WAIT(wait);
 
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
                 while (!(skb = skb_dequeue(&sk->sk_receive_queue)) &&
                        sigd) {
-                        if (test_bit(ATM_VF_RELEASED,&old_vcc->flags)) break;
-                        if (test_bit(ATM_VF_CLOSE,&old_vcc->flags)) {
+                        if (test_bit(ATM_VF_RELEASED, &old_vcc->flags))
+                                break;
+                        if (test_bit(ATM_VF_CLOSE, &old_vcc->flags)) {
                                 error = -sk->sk_err;
                                 break;
                         }
@@ -359,7 +363,8 @@ static int svc_accept(struct socket *sock,struct socket *newsock,int flags)
                                 error = -ERESTARTSYS;
                                 break;
                         }
-                        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                        prepare_to_wait(sk->sk_sleep, &wait,
+                                        TASK_INTERRUPTIBLE);
                 }
                 finish_wait(sk->sk_sleep, &wait);
                 if (error)
@@ -368,31 +373,34 @@ static int svc_accept(struct socket *sock,struct socket *newsock,int flags)
                         error = -EUNATCH;
                         goto out;
                 }
-                msg = (struct atmsvc_msg *) skb->data;
+                msg = (struct atmsvc_msg *)skb->data;
                 new_vcc->qos = msg->qos;
-                set_bit(ATM_VF_HASQOS,&new_vcc->flags);
+                set_bit(ATM_VF_HASQOS, &new_vcc->flags);
                 new_vcc->remote = msg->svc;
                 new_vcc->local = msg->local;
                 new_vcc->sap = msg->sap;
                 error = vcc_connect(newsock, msg->pvc.sap_addr.itf,
-                                    msg->pvc.sap_addr.vpi, msg->pvc.sap_addr.vci);
+                                    msg->pvc.sap_addr.vpi,
+                                    msg->pvc.sap_addr.vci);
                 dev_kfree_skb(skb);
                 sk->sk_ack_backlog--;
                 if (error) {
-                        sigd_enq2(NULL,as_reject,old_vcc,NULL,NULL,
-                            &old_vcc->qos,error);
+                        sigd_enq2(NULL, as_reject, old_vcc, NULL, NULL,
+                                  &old_vcc->qos, error);
                         error = error == -EAGAIN ? -EBUSY : error;
                         goto out;
                 }
                 /* wait should be short, so we ignore the non-blocking flag */
                 set_bit(ATM_VF_WAITING, &new_vcc->flags);
-                prepare_to_wait(sk_atm(new_vcc)->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
-                sigd_enq(new_vcc,as_accept,old_vcc,NULL,NULL);
+                prepare_to_wait(sk_atm(new_vcc)->sk_sleep, &wait,
+                                TASK_UNINTERRUPTIBLE);
+                sigd_enq(new_vcc, as_accept, old_vcc, NULL, NULL);
                 while (test_bit(ATM_VF_WAITING, &new_vcc->flags) && sigd) {
                         release_sock(sk);
                         schedule();
                         lock_sock(sk);
-                        prepare_to_wait(sk_atm(new_vcc)->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+                        prepare_to_wait(sk_atm(new_vcc)->sk_sleep, &wait,
+                                        TASK_UNINTERRUPTIBLE);
                 }
                 finish_wait(sk_atm(new_vcc)->sk_sleep, &wait);
                 if (!sigd) {
@@ -412,39 +420,37 @@ out:
         return error;
 }
 
-
-static int svc_getname(struct socket *sock,struct sockaddr *sockaddr,
-    int *sockaddr_len,int peer)
+static int svc_getname(struct socket *sock, struct sockaddr *sockaddr,
+                       int *sockaddr_len, int peer)
 {
         struct sockaddr_atmsvc *addr;
 
         *sockaddr_len = sizeof(struct sockaddr_atmsvc);
         addr = (struct sockaddr_atmsvc *) sockaddr;
-        memcpy(addr,peer ? &ATM_SD(sock)->remote : &ATM_SD(sock)->local,
-            sizeof(struct sockaddr_atmsvc));
+        memcpy(addr, peer ? &ATM_SD(sock)->remote : &ATM_SD(sock)->local,
+               sizeof(struct sockaddr_atmsvc));
         return 0;
 }
 
-
-int svc_change_qos(struct atm_vcc *vcc,struct atm_qos *qos)
+int svc_change_qos(struct atm_vcc *vcc, struct atm_qos *qos)
 {
         struct sock *sk = sk_atm(vcc);
         DEFINE_WAIT(wait);
 
         set_bit(ATM_VF_WAITING, &vcc->flags);
         prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
-        sigd_enq2(vcc,as_modify,NULL,NULL,&vcc->local,qos,0);
+        sigd_enq2(vcc, as_modify, NULL, NULL, &vcc->local, qos, 0);
         while (test_bit(ATM_VF_WAITING, &vcc->flags) &&
                !test_bit(ATM_VF_RELEASED, &vcc->flags) && sigd) {
                 schedule();
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
         }
         finish_wait(sk->sk_sleep, &wait);
-        if (!sigd) return -EUNATCH;
+        if (!sigd)
+                return -EUNATCH;
         return -sk->sk_err;
 }
 
-
 static int svc_setsockopt(struct socket *sock, int level, int optname,
                           char __user *optval, unsigned int optlen)
 {
@@ -454,37 +460,35 @@ static int svc_setsockopt(struct socket *sock, int level, int optname,
 
         lock_sock(sk);
         switch (optname) {
-                case SO_ATMSAP:
-                        if (level != SOL_ATM || optlen != sizeof(struct atm_sap)) {
-                                error = -EINVAL;
-                                goto out;
-                        }
-                        if (copy_from_user(&vcc->sap, optval, optlen)) {
-                                error = -EFAULT;
-                                goto out;
-                        }
-                        set_bit(ATM_VF_HASSAP, &vcc->flags);
-                        break;
-                case SO_MULTIPOINT:
-                        if (level != SOL_ATM || optlen != sizeof(int)) {
-                                error = -EINVAL;
-                                goto out;
-                        }
-                        if (get_user(value, (int __user *) optval)) {
-                                error = -EFAULT;
-                                goto out;
-                        }
-                        if (value == 1) {
-                                set_bit(ATM_VF_SESSION, &vcc->flags);
-                        } else if (value == 0) {
-                                clear_bit(ATM_VF_SESSION, &vcc->flags);
-                        } else {
-                                error = -EINVAL;
-                        }
-                        break;
-                default:
-                        error = vcc_setsockopt(sock, level, optname,
-                                               optval, optlen);
+        case SO_ATMSAP:
+                if (level != SOL_ATM || optlen != sizeof(struct atm_sap)) {
+                        error = -EINVAL;
+                        goto out;
+                }
+                if (copy_from_user(&vcc->sap, optval, optlen)) {
+                        error = -EFAULT;
+                        goto out;
+                }
+                set_bit(ATM_VF_HASSAP, &vcc->flags);
+                break;
+        case SO_MULTIPOINT:
+                if (level != SOL_ATM || optlen != sizeof(int)) {
+                        error = -EINVAL;
+                        goto out;
+                }
+                if (get_user(value, (int __user *)optval)) {
+                        error = -EFAULT;
+                        goto out;
+                }
+                if (value == 1)
+                        set_bit(ATM_VF_SESSION, &vcc->flags);
+                else if (value == 0)
+                        clear_bit(ATM_VF_SESSION, &vcc->flags);
+                else
+                        error = -EINVAL;
+                break;
+        default:
+                error = vcc_setsockopt(sock, level, optname, optval, optlen);
         }
 
 out:
@@ -492,9 +496,8 @@ out:
         return error;
 }
 
-
-static int svc_getsockopt(struct socket *sock,int level,int optname,
-    char __user *optval,int __user *optlen)
+static int svc_getsockopt(struct socket *sock, int level, int optname,
+                          char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
         int error = 0, len;
@@ -521,7 +524,6 @@ out:
         return error;
 }
 
-
 static int svc_addparty(struct socket *sock, struct sockaddr *sockaddr,
                         int sockaddr_len, int flags)
 {
@@ -540,7 +542,7 @@ static int svc_addparty(struct socket *sock, struct sockaddr *sockaddr,
                 error = -EINPROGRESS;
                 goto out;
         }
-        pr_debug("svc_addparty added wait queue\n");
+        pr_debug("added wait queue\n");
         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                 schedule();
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
@@ -552,7 +554,6 @@ out:
         return error;
 }
 
-
 static int svc_dropparty(struct socket *sock, int ep_ref)
 {
         DEFINE_WAIT(wait);
@@ -579,7 +580,6 @@ out:
         return error;
 }
 
-
 static int svc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 {
         int error, ep_ref;
@@ -587,29 +587,31 @@ static int svc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         struct atm_vcc *vcc = ATM_SD(sock);
 
         switch (cmd) {
-                case ATM_ADDPARTY:
-                        if (!test_bit(ATM_VF_SESSION, &vcc->flags))
-                                return -EINVAL;
-                        if (copy_from_user(&sa, (void __user *) arg, sizeof(sa)))
-                                return -EFAULT;
-                        error = svc_addparty(sock, (struct sockaddr *) &sa, sizeof(sa), 0);
-                        break;
-                case ATM_DROPPARTY:
-                        if (!test_bit(ATM_VF_SESSION, &vcc->flags))
-                                return -EINVAL;
-                        if (copy_from_user(&ep_ref, (void __user *) arg, sizeof(int)))
-                                return -EFAULT;
-                        error = svc_dropparty(sock, ep_ref);
-                        break;
-                default:
-                        error = vcc_ioctl(sock, cmd, arg);
+        case ATM_ADDPARTY:
+                if (!test_bit(ATM_VF_SESSION, &vcc->flags))
+                        return -EINVAL;
+                if (copy_from_user(&sa, (void __user *) arg, sizeof(sa)))
+                        return -EFAULT;
+                error = svc_addparty(sock, (struct sockaddr *)&sa, sizeof(sa),
+                                     0);
+                break;
+        case ATM_DROPPARTY:
+                if (!test_bit(ATM_VF_SESSION, &vcc->flags))
+                        return -EINVAL;
+                if (copy_from_user(&ep_ref, (void __user *) arg, sizeof(int)))
+                        return -EFAULT;
+                error = svc_dropparty(sock, ep_ref);
+                break;
+        default:
+                error = vcc_ioctl(sock, cmd, arg);
         }
 
         return error;
 }
 
 #ifdef CONFIG_COMPAT
-static int svc_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+static int svc_compat_ioctl(struct socket *sock, unsigned int cmd,
+                            unsigned long arg)
 {
         /* The definition of ATM_ADDPARTY uses the size of struct atm_iobuf.
            But actually it takes a struct sockaddr_atmsvc, which doesn't need
@@ -660,13 +662,13 @@ static int svc_create(struct net *net, struct socket *sock, int protocol,
 
         sock->ops = &svc_proto_ops;
         error = vcc_create(net, sock, protocol, AF_ATMSVC);
-        if (error) return error;
+        if (error)
+                return error;
         ATM_SD(sock)->local.sas_family = AF_ATMSVC;
         ATM_SD(sock)->remote.sas_family = AF_ATMSVC;
         return 0;
 }
 
-
 static const struct net_proto_family svc_family_ops = {
         .family = PF_ATMSVC,
         .create = svc_create,
diff --git a/net/bluetooth/cmtp/capi.c b/net/bluetooth/cmtp/capi.c
index 97f8d68d574d..3487cfe74aec 100644
--- a/net/bluetooth/cmtp/capi.c
+++ b/net/bluetooth/cmtp/capi.c
@@ -21,7 +21,8 @@
 */
 
 #include <linux/module.h>
-
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
@@ -516,33 +517,37 @@ static char *cmtp_procinfo(struct capi_ctr *ctrl)
         return "CAPI Message Transport Protocol";
 }
 
-static int cmtp_ctr_read_proc(char *page, char **start, off_t off, int count, int *eof, struct capi_ctr *ctrl)
+static int cmtp_proc_show(struct seq_file *m, void *v)
 {
+        struct capi_ctr *ctrl = m->private;
         struct cmtp_session *session = ctrl->driverdata;
         struct cmtp_application *app;
         struct list_head *p, *n;
-        int len = 0;
 
-        len += sprintf(page + len, "%s\n\n", cmtp_procinfo(ctrl));
-        len += sprintf(page + len, "addr %s\n", session->name);
-        len += sprintf(page + len, "ctrl %d\n", session->num);
+        seq_printf(m, "%s\n\n", cmtp_procinfo(ctrl));
+        seq_printf(m, "addr %s\n", session->name);
+        seq_printf(m, "ctrl %d\n", session->num);
 
         list_for_each_safe(p, n, &session->applications) {
                 app = list_entry(p, struct cmtp_application, list);
-                len += sprintf(page + len, "appl %d -> %d\n", app->appl, app->mapping);
+                seq_printf(m, "appl %d -> %d\n", app->appl, app->mapping);
         }
 
-        if (off + count >= len)
-                *eof = 1;
-
-        if (len < off)
-                return 0;
-
-        *start = page + off;
+        return 0;
+}
 
-        return ((count < len - off) ? count : len - off);
+static int cmtp_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, cmtp_proc_show, PDE(inode)->data);
 }
 
+static const struct file_operations cmtp_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = cmtp_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
 
 int cmtp_attach_device(struct cmtp_session *session)
 {
@@ -582,7 +587,7 @@ int cmtp_attach_device(struct cmtp_session *session)
         session->ctrl.send_message  = cmtp_send_message;
 
         session->ctrl.procinfo      = cmtp_procinfo;
-        session->ctrl.ctr_read_proc = cmtp_ctr_read_proc;
+        session->ctrl.proc_fops = &cmtp_proc_fops;
 
         if (attach_capi_ctr(&session->ctrl) < 0) {
                 BT_ERR("Can't attach new controller");
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index a2cbe61f6e65..7bc0604069c7 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -467,7 +467,7 @@ int br_del_if(struct net_bridge *br, struct net_device *dev)
         return 0;
 }
 
-void br_net_exit(struct net *net)
+void __net_exit br_net_exit(struct net *net)
 {
         struct net_device *dev;
         LIST_HEAD(list);
diff --git a/net/can/af_can.c b/net/can/af_can.c
index 51adc4c2b860..bc18b084ffdb 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -77,8 +77,8 @@ static int stats_timer __read_mostly = 1;
 module_param(stats_timer, int, S_IRUGO);
 MODULE_PARM_DESC(stats_timer, "enable timer for statistics (default:on)");
 
-HLIST_HEAD(can_rx_dev_list);
-static struct dev_rcv_lists can_rx_alldev_list;
+/* receive filters subscribed for 'all' CAN devices */
+struct dev_rcv_lists can_rx_alldev_list;
 static DEFINE_SPINLOCK(can_rcvlists_lock);
 
 static struct kmem_cache *rcv_cache __read_mostly;
@@ -292,28 +292,10 @@ EXPORT_SYMBOL(can_send);
 
 static struct dev_rcv_lists *find_dev_rcv_lists(struct net_device *dev)
 {
-        struct dev_rcv_lists *d = NULL;
-        struct hlist_node *n;
-
-        /*
-         * find receive list for this device
-         *
-         * The hlist_for_each_entry*() macros curse through the list
-         * using the pointer variable n and set d to the containing
-         * struct in each list iteration.  Therefore, after list
-         * iteration, d is unmodified when the list is empty, and it
-         * points to last list element, when the list is non-empty
-         * but no match in the loop body is found.  I.e. d is *not*
-         * NULL when no match is found.  We can, however, use the
-         * cursor variable n to decide if a match was found.
-         */
-
-        hlist_for_each_entry_rcu(d, n, &can_rx_dev_list, list) {
-                if (d->dev == dev)
-                        break;
-        }
-
-        return n ? d : NULL;
+        if (!dev)
+                return &can_rx_alldev_list;
+        else
+                return (struct dev_rcv_lists *)dev->ml_priv;
 }
 
 /**
@@ -468,16 +450,6 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask,
 EXPORT_SYMBOL(can_rx_register);
 
 /*
- * can_rx_delete_device - rcu callback for dev_rcv_lists structure removal
- */
-static void can_rx_delete_device(struct rcu_head *rp)
-{
-        struct dev_rcv_lists *d = container_of(rp, struct dev_rcv_lists, rcu);
-
-        kfree(d);
-}
-
-/*
  * can_rx_delete_receiver - rcu callback for single receiver entry removal
  */
 static void can_rx_delete_receiver(struct rcu_head *rp)
@@ -541,7 +513,6 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
                        "dev %s, id %03X, mask %03X\n",
                        DNAME(dev), can_id, mask);
                 r = NULL;
-                d = NULL;
                 goto out;
         }
 
@@ -552,10 +523,10 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
                 can_pstats.rcv_entries--;
 
         /* remove device structure requested by NETDEV_UNREGISTER */
-        if (d->remove_on_zero_entries && !d->entries)
-                hlist_del_rcu(&d->list);
-        else
-                d = NULL;
+        if (d->remove_on_zero_entries && !d->entries) {
+                kfree(d);
+                dev->ml_priv = NULL;
+        }
 
  out:
         spin_unlock(&can_rcvlists_lock);
@@ -563,10 +534,6 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
         /* schedule the receiver item for deletion */
         if (r)
                 call_rcu(&r->rcu, can_rx_delete_receiver);
-
-        /* schedule the device structure for deletion */
-        if (d)
-                call_rcu(&d->rcu, can_rx_delete_device);
 }
 EXPORT_SYMBOL(can_rx_unregister);
 
@@ -780,48 +747,35 @@ static int can_notifier(struct notifier_block *nb, unsigned long msg,
 
         case NETDEV_REGISTER:
 
-                /*
-                 * create new dev_rcv_lists for this device
-                 *
-                 * N.B. zeroing the struct is the correct initialization
-                 * for the embedded hlist_head structs.
-                 * Another list type, e.g. list_head, would require
-                 * explicit initialization.
-                 */
-
+                /* create new dev_rcv_lists for this device */
                 d = kzalloc(sizeof(*d), GFP_KERNEL);
                 if (!d) {
                         printk(KERN_ERR
                                "can: allocation of receive list failed\n");
                         return NOTIFY_DONE;
                 }
-                d->dev = dev;
-
-                spin_lock(&can_rcvlists_lock);
-                hlist_add_head_rcu(&d->list, &can_rx_dev_list);
-                spin_unlock(&can_rcvlists_lock);
+                BUG_ON(dev->ml_priv);
+                dev->ml_priv = d;
 
                 break;
 
         case NETDEV_UNREGISTER:
                 spin_lock(&can_rcvlists_lock);
 
-                d = find_dev_rcv_lists(dev);
+                d = dev->ml_priv;
                 if (d) {
-                        if (d->entries) {
+                        if (d->entries)
                                 d->remove_on_zero_entries = 1;
-                                d = NULL;
-                        } else
-                                hlist_del_rcu(&d->list);
+                        else {
+                                kfree(d);
+                                dev->ml_priv = NULL;
+                        }
                 } else
                         printk(KERN_ERR "can: notifier: receive list not "
                                "found for dev %s\n", dev->name);
 
                 spin_unlock(&can_rcvlists_lock);
 
-                if (d)
-                        call_rcu(&d->rcu, can_rx_delete_device);
-
                 break;
         }
 
@@ -853,21 +807,13 @@ static __init int can_init(void)
 {
         printk(banner);
 
+        memset(&can_rx_alldev_list, 0, sizeof(can_rx_alldev_list));
+
         rcv_cache = kmem_cache_create("can_receiver", sizeof(struct receiver),
                                       0, 0, NULL);
         if (!rcv_cache)
                 return -ENOMEM;
 
-        /*
-         * Insert can_rx_alldev_list for reception on all devices.
-         * This struct is zero initialized which is correct for the
-         * embedded hlist heads, the dev pointer, and the entries counter.
-         */
-
-        spin_lock(&can_rcvlists_lock);
-        hlist_add_head_rcu(&can_rx_alldev_list.list, &can_rx_dev_list);
-        spin_unlock(&can_rcvlists_lock);
-
         if (stats_timer) {
                 /* the statistics are updated every second (timer triggered) */
                 setup_timer(&can_stattimer, can_stat_update, 0);
@@ -887,8 +833,7 @@ static __init int can_init(void)
 
 static __exit void can_exit(void)
 {
-        struct dev_rcv_lists *d;
-        struct hlist_node *n, *next;
+        struct net_device *dev;
 
         if (stats_timer)
                 del_timer(&can_stattimer);
@@ -900,14 +845,19 @@ static __exit void can_exit(void)
         unregister_netdevice_notifier(&can_netdev_notifier);
         sock_unregister(PF_CAN);
 
-        /* remove can_rx_dev_list */
-        spin_lock(&can_rcvlists_lock);
-        hlist_del(&can_rx_alldev_list.list);
-        hlist_for_each_entry_safe(d, n, next, &can_rx_dev_list, list) {
-                hlist_del(&d->list);
-                kfree(d);
+        /* remove created dev_rcv_lists from still registered CAN devices */
+        rcu_read_lock();
+        for_each_netdev_rcu(&init_net, dev) {
+                if (dev->type == ARPHRD_CAN && dev->ml_priv){
+
+                        struct dev_rcv_lists *d = dev->ml_priv;
+
+                        BUG_ON(d->entries);
+                        kfree(d);
+                        dev->ml_priv = NULL;
+                }
         }
-        spin_unlock(&can_rcvlists_lock);
+        rcu_read_unlock();
 
         rcu_barrier(); /* Wait for completion of call_rcu()'s */
 
diff --git a/net/can/af_can.h b/net/can/af_can.h
index 18f91e37cc30..34253b84e30f 100644
--- a/net/can/af_can.h
+++ b/net/can/af_can.h
@@ -63,10 +63,8 @@ struct receiver {
 
 enum { RX_ERR, RX_ALL, RX_FIL, RX_INV, RX_EFF, RX_MAX };
 
+/* per device receive filters linked at dev->ml_priv */
 struct dev_rcv_lists {
-        struct hlist_node list;
-        struct rcu_head rcu;
-        struct net_device *dev;
         struct hlist_head rx[RX_MAX];
         struct hlist_head rx_sff[0x800];
         int remove_on_zero_entries;
diff --git a/net/can/proc.c b/net/can/proc.c
index 9b9ad29be567..f4265cc9c3fb 100644
--- a/net/can/proc.c
+++ b/net/can/proc.c
@@ -45,6 +45,7 @@
 #include <linux/proc_fs.h>
 #include <linux/list.h>
 #include <linux/rcupdate.h>
+#include <linux/if_arp.h>
 #include <linux/can/core.h>
 
 #include "af_can.h"
@@ -84,6 +85,9 @@ static const char rx_list_name[][8] = {
         [RX_EFF] = "rx_eff",
 };
 
+/* receive filters subscribed for 'all' CAN devices */
+extern struct dev_rcv_lists can_rx_alldev_list;
+
 /*
  * af_can statistics stuff
  */
@@ -190,10 +194,6 @@ void can_stat_update(unsigned long data)
 
 /*
  * proc read functions
- *
- * From known use-cases we expect about 10 entries in a receive list to be
- * printed in the proc_fs. So PAGE_SIZE is definitely enough space here.
- *
  */
 
 static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
@@ -202,7 +202,6 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
         struct receiver *r;
         struct hlist_node *n;
 
-        rcu_read_lock();
         hlist_for_each_entry_rcu(r, n, rx_list, list) {
                 char *fmt = (r->can_id & CAN_EFF_FLAG)?
                         "   %-5s  %08X  %08x  %08x  %08x  %8ld  %s\n" :
@@ -212,7 +211,6 @@ static void can_print_rcvlist(struct seq_file *m, struct hlist_head *rx_list,
                                 (unsigned long)r->func, (unsigned long)r->data,
                                 r->matches, r->ident);
         }
-        rcu_read_unlock();
 }
 
 static void can_print_recv_banner(struct seq_file *m)
@@ -346,24 +344,39 @@ static const struct file_operations can_version_proc_fops = {
         .release        = single_release,
 };
 
+static inline void can_rcvlist_proc_show_one(struct seq_file *m, int idx,
+                                             struct net_device *dev,
+                                             struct dev_rcv_lists *d)
+{
+        if (!hlist_empty(&d->rx[idx])) {
+                can_print_recv_banner(m);
+                can_print_rcvlist(m, &d->rx[idx], dev);
+        } else
+                seq_printf(m, "  (%s: no entry)\n", DNAME(dev));
+
+}
+
 static int can_rcvlist_proc_show(struct seq_file *m, void *v)
 {
         /* double cast to prevent GCC warning */
         int idx = (int)(long)m->private;
+        struct net_device *dev;
         struct dev_rcv_lists *d;
-        struct hlist_node *n;
 
         seq_printf(m, "\nreceive list '%s':\n", rx_list_name[idx]);
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(d, n, &can_rx_dev_list, list) {
 
-                if (!hlist_empty(&d->rx[idx])) {
-                        can_print_recv_banner(m);
-                        can_print_rcvlist(m, &d->rx[idx], d->dev);
-                } else
-                        seq_printf(m, "  (%s: no entry)\n", DNAME(d->dev));
+        /* receive list for 'all' CAN devices (dev == NULL) */
+        d = &can_rx_alldev_list;
+        can_rcvlist_proc_show_one(m, idx, NULL, d);
+
+        /* receive list for registered CAN devices */
+        for_each_netdev_rcu(&init_net, dev) {
+                if (dev->type == ARPHRD_CAN && dev->ml_priv)
+                        can_rcvlist_proc_show_one(m, idx, dev, dev->ml_priv);
         }
+
         rcu_read_unlock();
 
         seq_putc(m, '\n');
@@ -383,34 +396,50 @@ static const struct file_operations can_rcvlist_proc_fops = {
         .release        = single_release,
 };
 
+static inline void can_rcvlist_sff_proc_show_one(struct seq_file *m,
+                                                 struct net_device *dev,
+                                                 struct dev_rcv_lists *d)
+{
+        int i;
+        int all_empty = 1;
+
+        /* check wether at least one list is non-empty */
+        for (i = 0; i < 0x800; i++)
+                if (!hlist_empty(&d->rx_sff[i])) {
+                        all_empty = 0;
+                        break;
+                }
+
+        if (!all_empty) {
+                can_print_recv_banner(m);
+                for (i = 0; i < 0x800; i++) {
+                        if (!hlist_empty(&d->rx_sff[i]))
+                                can_print_rcvlist(m, &d->rx_sff[i], dev);
+                }
+        } else
+                seq_printf(m, "  (%s: no entry)\n", DNAME(dev));
+}
+
 static int can_rcvlist_sff_proc_show(struct seq_file *m, void *v)
 {
+        struct net_device *dev;
         struct dev_rcv_lists *d;
-        struct hlist_node *n;
 
         /* RX_SFF */
         seq_puts(m, "\nreceive list 'rx_sff':\n");
 
         rcu_read_lock();
-        hlist_for_each_entry_rcu(d, n, &can_rx_dev_list, list) {
-                int i, all_empty = 1;
-                /* check wether at least one list is non-empty */
-                for (i = 0; i < 0x800; i++)
-                        if (!hlist_empty(&d->rx_sff[i])) {
-                                all_empty = 0;
-                                break;
-                        }
-
-                if (!all_empty) {
-                        can_print_recv_banner(m);
-                        for (i = 0; i < 0x800; i++) {
-                                if (!hlist_empty(&d->rx_sff[i]))
-                                        can_print_rcvlist(m, &d->rx_sff[i],
-                                                          d->dev);
-                        }
-                } else
-                        seq_printf(m, "  (%s: no entry)\n", DNAME(d->dev));
+
+        /* sff receive list for 'all' CAN devices (dev == NULL) */
+        d = &can_rx_alldev_list;
+        can_rcvlist_sff_proc_show_one(m, NULL, d);
+
+        /* sff receive list for registered CAN devices */
+        for_each_netdev_rcu(&init_net, dev) {
+                if (dev->type == ARPHRD_CAN && dev->ml_priv)
+                        can_rcvlist_sff_proc_show_one(m, dev, dev->ml_priv);
         }
+
         rcu_read_unlock();
 
         seq_putc(m, '\n');
diff --git a/net/core/dev.c b/net/core/dev.c
index be9924f60ec3..2cba5c521e56 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1853,6 +1853,14 @@ gso:
 
                 skb->next = nskb->next;
                 nskb->next = NULL;
+
+                /*
+                 * If device doesnt need nskb->dst, release it right now while
+                 * its hot in this cpu cache
+                 */
+                if (dev->priv_flags & IFF_XMIT_DST_RELEASE)
+                        skb_dst_drop(nskb);
+
                 rc = ops->ndo_start_xmit(nskb, dev);
                 if (unlikely(rc != NETDEV_TX_OK)) {
                         if (rc & ~NETDEV_TX_MASK)
@@ -1974,6 +1982,21 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,
         return rc;
 }
 
+/*
+ * Returns true if either:
+ *      1. skb has frag_list and the device doesn't support FRAGLIST, or
+ *      2. skb is fragmented and the device does not support SG, or if
+ *         at least one of fragments is in highmem and device does not
+ *         support DMA from it.
+ */
+static inline int skb_needs_linearize(struct sk_buff *skb,
+                                      struct net_device *dev)
+{
+        return (skb_has_frags(skb) && !(dev->features & NETIF_F_FRAGLIST)) ||
+               (skb_shinfo(skb)->nr_frags && (!(dev->features & NETIF_F_SG) ||
+                                              illegal_highdma(dev, skb)));
+}
+
 /**
  *      dev_queue_xmit - transmit a buffer
  *      @skb: buffer to transmit
@@ -2010,18 +2033,8 @@ int dev_queue_xmit(struct sk_buff *skb)
         if (netif_needs_gso(dev, skb))
                 goto gso;
 
-        if (skb_has_frags(skb) &&
-            !(dev->features & NETIF_F_FRAGLIST) &&
-            __skb_linearize(skb))
-                goto out_kfree_skb;
-
-        /* Fragmented skb is linearized if device does not support SG,
-         * or if at least one of fragments is in highmem and device
-         * does not support DMA from it.
-         */
-        if (skb_shinfo(skb)->nr_frags &&
-            (!(dev->features & NETIF_F_SG) || illegal_highdma(dev, skb)) &&
-            __skb_linearize(skb))
+        /* Convert a paged skb to linear, if required */
+        if (skb_needs_linearize(skb, dev) && __skb_linearize(skb))
                 goto out_kfree_skb;
 
         /* If packet is not checksummed and device does not support
@@ -2422,6 +2435,7 @@ int netif_receive_skb(struct sk_buff *skb)
         struct packet_type *ptype, *pt_prev;
         struct net_device *orig_dev;
         struct net_device *null_or_orig;
+        struct net_device *null_or_bond;
         int ret = NET_RX_DROP;
         __be16 type;
 
@@ -2487,12 +2501,24 @@ ncls:
         if (!skb)
                 goto out;
 
+        /*
+         * Make sure frames received on VLAN interfaces stacked on
+         * bonding interfaces still make their way to any base bonding
+         * device that may have registered for a specific ptype.  The
+         * handler may have to adjust skb->dev and orig_dev.
+         */
+        null_or_bond = NULL;
+        if ((skb->dev->priv_flags & IFF_802_1Q_VLAN) &&
+            (vlan_dev_real_dev(skb->dev)->priv_flags & IFF_BONDING)) {
+                null_or_bond = vlan_dev_real_dev(skb->dev);
+        }
+
         type = skb->protocol;
         list_for_each_entry_rcu(ptype,
                         &ptype_base[ntohs(type) & PTYPE_HASH_MASK], list) {
-                if (ptype->type == type &&
-                    (ptype->dev == null_or_orig || ptype->dev == skb->dev ||
-                     ptype->dev == orig_dev)) {
+                if (ptype->type == type && (ptype->dev == null_or_orig ||
+                     ptype->dev == skb->dev || ptype->dev == orig_dev ||
+                     ptype->dev == null_or_bond)) {
                         if (pt_prev)
                                 ret = deliver_skb(skb, pt_prev, orig_dev);
                         pt_prev = ptype;
@@ -2561,7 +2587,7 @@ out:
         return netif_receive_skb(skb);
 }
 
-void napi_gro_flush(struct napi_struct *napi)
+static void napi_gro_flush(struct napi_struct *napi)
 {
         struct sk_buff *skb, *next;
 
@@ -2574,7 +2600,6 @@ void napi_gro_flush(struct napi_struct *napi)
         napi->gro_count = 0;
         napi->gro_list = NULL;
 }
-EXPORT_SYMBOL(napi_gro_flush);
 
 enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
 {
@@ -3185,7 +3210,7 @@ static void dev_seq_printf_stats(struct seq_file *seq, struct net_device *dev)
 {
         const struct net_device_stats *stats = dev_get_stats(dev);
 
-        seq_printf(seq, "%6s:%8lu %7lu %4lu %4lu %4lu %5lu %10lu %9lu "
+        seq_printf(seq, "%6s: %7lu %7lu %4lu %4lu %4lu %5lu %10lu %9lu "
                    "%8lu %7lu %4lu %4lu %4lu %5lu %7lu %10lu\n",
                    dev->name, stats->rx_bytes, stats->rx_packets,
                    stats->rx_errors,
@@ -3640,10 +3665,10 @@ void __dev_set_rx_mode(struct net_device *dev)
                 /* Unicast addresses changes may only happen under the rtnl,
                  * therefore calling __dev_set_promiscuity here is safe.
                  */
-                if (dev->uc.count > 0 && !dev->uc_promisc) {
+                if (!netdev_uc_empty(dev) && !dev->uc_promisc) {
                         __dev_set_promiscuity(dev, 1);
                         dev->uc_promisc = 1;
-                } else if (dev->uc.count == 0 && dev->uc_promisc) {
+                } else if (netdev_uc_empty(dev) && dev->uc_promisc) {
                         __dev_set_promiscuity(dev, -1);
                         dev->uc_promisc = 0;
                 }
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 02a3b2c69c1e..9a24377146bf 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -708,7 +708,7 @@ static struct notifier_block fib_rules_notifier = {
         .notifier_call = fib_rules_event,
 };
 
-static int fib_rules_net_init(struct net *net)
+static int __net_init fib_rules_net_init(struct net *net)
 {
         INIT_LIST_HEAD(&net->rules_ops);
         spin_lock_init(&net->rules_mod_lock);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f35377b643e4..f2efd72da799 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2417,8 +2417,7 @@ EXPORT_SYMBOL(neigh_seq_stop);
 
 static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
 {
-        struct proc_dir_entry *pde = seq->private;
-        struct neigh_table *tbl = pde->data;
+        struct neigh_table *tbl = seq->private;
         int cpu;
 
         if (*pos == 0)
@@ -2435,8 +2434,7 @@ static void *neigh_stat_seq_start(struct seq_file *seq, loff_t *pos)
 
 static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct proc_dir_entry *pde = seq->private;
-        struct neigh_table *tbl = pde->data;
+        struct neigh_table *tbl = seq->private;
         int cpu;
 
         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
@@ -2455,8 +2453,7 @@ static void neigh_stat_seq_stop(struct seq_file *seq, void *v)
 
 static int neigh_stat_seq_show(struct seq_file *seq, void *v)
 {
-        struct proc_dir_entry *pde = seq->private;
-        struct neigh_table *tbl = pde->data;
+        struct neigh_table *tbl = seq->private;
         struct neigh_statistics *st = v;
 
         if (v == SEQ_START_TOKEN) {
@@ -2501,7 +2498,7 @@ static int neigh_stat_seq_open(struct inode *inode, struct file *file)
 
         if (!ret) {
                 struct seq_file *sf = file->private_data;
-                sf->private = PDE(inode);
+                sf->private = PDE(inode)->data;
         }
         return ret;
 };
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 0b4d0d35ef40..7aa697253765 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -407,11 +407,24 @@ static void arp_reply(struct sk_buff *skb)
         __be32 sip, tip;
         unsigned char *sha;
         struct sk_buff *send_skb;
-        struct netpoll *np = NULL;
+        struct netpoll *np, *tmp;
+        unsigned long flags;
+        int hits = 0;
+
+        if (list_empty(&npinfo->rx_np))
+                return;
+
+        /* Before checking the packet, we do some early
+           inspection whether this is interesting at all */
+        spin_lock_irqsave(&npinfo->rx_lock, flags);
+        list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
+                if (np->dev == skb->dev)
+                        hits++;
+        }
+        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
 
-        if (npinfo->rx_np && npinfo->rx_np->dev == skb->dev)
-                np = npinfo->rx_np;
-        if (!np)
+        /* No netpoll struct is using this dev */
+        if (!hits)
                 return;
 
         /* No arp on this interface */
@@ -437,77 +450,91 @@ static void arp_reply(struct sk_buff *skb)
         arp_ptr += skb->dev->addr_len;
         memcpy(&sip, arp_ptr, 4);
         arp_ptr += 4;
-        /* if we actually cared about dst hw addr, it would get copied here */
+        /* If we actually cared about dst hw addr,
+           it would get copied here */
         arp_ptr += skb->dev->addr_len;
         memcpy(&tip, arp_ptr, 4);
 
         /* Should we ignore arp? */
-        if (tip != np->local_ip ||
-            ipv4_is_loopback(tip) || ipv4_is_multicast(tip))
+        if (ipv4_is_loopback(tip) || ipv4_is_multicast(tip))
                 return;
 
         size = arp_hdr_len(skb->dev);
-        send_skb = find_skb(np, size + LL_ALLOCATED_SPACE(np->dev),
-                            LL_RESERVED_SPACE(np->dev));
 
-        if (!send_skb)
-                return;
-
-        skb_reset_network_header(send_skb);
-        arp = (struct arphdr *) skb_put(send_skb, size);
-        send_skb->dev = skb->dev;
-        send_skb->protocol = htons(ETH_P_ARP);
+        spin_lock_irqsave(&npinfo->rx_lock, flags);
+        list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
+                if (tip != np->local_ip)
+                        continue;
 
-        /* Fill the device header for the ARP frame */
-        if (dev_hard_header(send_skb, skb->dev, ptype,
-                            sha, np->dev->dev_addr,
-                            send_skb->len) < 0) {
-                kfree_skb(send_skb);
-                return;
-        }
+                send_skb = find_skb(np, size + LL_ALLOCATED_SPACE(np->dev),
+                                    LL_RESERVED_SPACE(np->dev));
+                if (!send_skb)
+                        continue;
 
-        /*
-         * Fill out the arp protocol part.
-         *
-         * we only support ethernet device type,
-         * which (according to RFC 1390) should always equal 1 (Ethernet).
-         */
+                skb_reset_network_header(send_skb);
+                arp = (struct arphdr *) skb_put(send_skb, size);
+                send_skb->dev = skb->dev;
+                send_skb->protocol = htons(ETH_P_ARP);
 
-        arp->ar_hrd = htons(np->dev->type);
-        arp->ar_pro = htons(ETH_P_IP);
-        arp->ar_hln = np->dev->addr_len;
-        arp->ar_pln = 4;
-        arp->ar_op = htons(type);
+                /* Fill the device header for the ARP frame */
+                if (dev_hard_header(send_skb, skb->dev, ptype,
+                                    sha, np->dev->dev_addr,
+                                    send_skb->len) < 0) {
+                        kfree_skb(send_skb);
+                        continue;
+                }
 
-        arp_ptr=(unsigned char *)(arp + 1);
-        memcpy(arp_ptr, np->dev->dev_addr, np->dev->addr_len);
-        arp_ptr += np->dev->addr_len;
-        memcpy(arp_ptr, &tip, 4);
-        arp_ptr += 4;
-        memcpy(arp_ptr, sha, np->dev->addr_len);
-        arp_ptr += np->dev->addr_len;
-        memcpy(arp_ptr, &sip, 4);
+                /*
+                 * Fill out the arp protocol part.
+                 *
+                 * we only support ethernet device type,
+                 * which (according to RFC 1390) should
+                 * always equal 1 (Ethernet).
+                 */
 
-        netpoll_send_skb(np, send_skb);
+                arp->ar_hrd = htons(np->dev->type);
+                arp->ar_pro = htons(ETH_P_IP);
+                arp->ar_hln = np->dev->addr_len;
+                arp->ar_pln = 4;
+                arp->ar_op = htons(type);
+
+                arp_ptr = (unsigned char *)(arp + 1);
+                memcpy(arp_ptr, np->dev->dev_addr, np->dev->addr_len);
+                arp_ptr += np->dev->addr_len;
+                memcpy(arp_ptr, &tip, 4);
+                arp_ptr += 4;
+                memcpy(arp_ptr, sha, np->dev->addr_len);
+                arp_ptr += np->dev->addr_len;
+                memcpy(arp_ptr, &sip, 4);
+
+                netpoll_send_skb(np, send_skb);
+
+                /* If there are several rx_hooks for the same address,
+                   we're fine by sending a single reply */
+                break;
+        }
+        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
 }
 
 int __netpoll_rx(struct sk_buff *skb)
 {
         int proto, len, ulen;
+        int hits = 0;
         struct iphdr *iph;
         struct udphdr *uh;
-        struct netpoll_info *npi = skb->dev->npinfo;
-        struct netpoll *np = npi->rx_np;
+        struct netpoll_info *npinfo = skb->dev->npinfo;
+        struct netpoll *np, *tmp;
 
-        if (!np)
+        if (list_empty(&npinfo->rx_np))
                 goto out;
+
         if (skb->dev->type != ARPHRD_ETHER)
                 goto out;
 
         /* check if netpoll clients need ARP */
         if (skb->protocol == htons(ETH_P_ARP) &&
             atomic_read(&trapped)) {
-                skb_queue_tail(&npi->arp_tx, skb);
+                skb_queue_tail(&npinfo->arp_tx, skb);
                 return 1;
         }
 
@@ -551,16 +578,23 @@ int __netpoll_rx(struct sk_buff *skb)
                 goto out;
         if (checksum_udp(skb, uh, ulen, iph->saddr, iph->daddr))
                 goto out;
-        if (np->local_ip && np->local_ip != iph->daddr)
-                goto out;
-        if (np->remote_ip && np->remote_ip != iph->saddr)
-                goto out;
-        if (np->local_port && np->local_port != ntohs(uh->dest))
-                goto out;
 
-        np->rx_hook(np, ntohs(uh->source),
-                    (char *)(uh+1),
-                    ulen - sizeof(struct udphdr));
+        list_for_each_entry_safe(np, tmp, &npinfo->rx_np, rx) {
+                if (np->local_ip && np->local_ip != iph->daddr)
+                        continue;
+                if (np->remote_ip && np->remote_ip != iph->saddr)
+                        continue;
+                if (np->local_port && np->local_port != ntohs(uh->dest))
+                        continue;
+
+                np->rx_hook(np, ntohs(uh->source),
+                               (char *)(uh+1),
+                               ulen - sizeof(struct udphdr));
+                hits++;
+        }
+
+        if (!hits)
+                goto out;
 
         kfree_skb(skb);
         return 1;
@@ -684,6 +718,7 @@ int netpoll_setup(struct netpoll *np)
         struct net_device *ndev = NULL;
         struct in_device *in_dev;
         struct netpoll_info *npinfo;
+        struct netpoll *npe, *tmp;
         unsigned long flags;
         int err;
 
@@ -704,7 +739,7 @@ int netpoll_setup(struct netpoll *np)
                 }
 
                 npinfo->rx_flags = 0;
-                npinfo->rx_np = NULL;
+                INIT_LIST_HEAD(&npinfo->rx_np);
 
                 spin_lock_init(&npinfo->rx_lock);
                 skb_queue_head_init(&npinfo->arp_tx);
@@ -785,7 +820,7 @@ int netpoll_setup(struct netpoll *np)
         if (np->rx_hook) {
                 spin_lock_irqsave(&npinfo->rx_lock, flags);
                 npinfo->rx_flags |= NETPOLL_RX_ENABLED;
-                npinfo->rx_np = np;
+                list_add_tail(&np->rx, &npinfo->rx_np);
                 spin_unlock_irqrestore(&npinfo->rx_lock, flags);
         }
 
@@ -801,9 +836,16 @@ int netpoll_setup(struct netpoll *np)
         return 0;
 
  release:
-        if (!ndev->npinfo)
+        if (!ndev->npinfo) {
+                spin_lock_irqsave(&npinfo->rx_lock, flags);
+                list_for_each_entry_safe(npe, tmp, &npinfo->rx_np, rx) {
+                        npe->dev = NULL;
+                }
+                spin_unlock_irqrestore(&npinfo->rx_lock, flags);
+
                 kfree(npinfo);
-        np->dev = NULL;
+        }
+
         dev_put(ndev);
         return err;
 }
@@ -823,10 +865,11 @@ void netpoll_cleanup(struct netpoll *np)
         if (np->dev) {
                 npinfo = np->dev->npinfo;
                 if (npinfo) {
-                        if (npinfo->rx_np == np) {
+                        if (!list_empty(&npinfo->rx_np)) {
                                 spin_lock_irqsave(&npinfo->rx_lock, flags);
-                                npinfo->rx_np = NULL;
-                                npinfo->rx_flags &= ~NETPOLL_RX_ENABLED;
+                                list_del(&np->rx);
+                                if (list_empty(&npinfo->rx_np))
+                                        npinfo->rx_flags &= ~NETPOLL_RX_ENABLED;
                                 spin_unlock_irqrestore(&npinfo->rx_lock, flags);
                         }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 794bcb897ff0..62f3878a6010 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1386,7 +1386,7 @@ static struct notifier_block rtnetlink_dev_notifier = {
 };
 
 
-static int rtnetlink_net_init(struct net *net)
+static int __net_init rtnetlink_net_init(struct net *net)
 {
         struct sock *sk;
         sk = netlink_kernel_create(net, NETLINK_ROUTE, RTNLGRP_MAX,
@@ -1397,7 +1397,7 @@ static int rtnetlink_net_init(struct net *net)
         return 0;
 }
 
-static void rtnetlink_net_exit(struct net *net)
+static void __net_exit rtnetlink_net_exit(struct net *net)
 {
         netlink_kernel_release(net->rtnl);
         net->rtnl = NULL;
diff --git a/net/core/sock.c b/net/core/sock.c
index e1f6f225f012..ceef50bd131b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -741,7 +741,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 struct timeval tm;
         } v;
 
-        unsigned int lv = sizeof(int);
+        int lv = sizeof(int);
         int len;
 
         if (get_user(len, optlen))
@@ -2140,13 +2140,13 @@ int sock_prot_inuse_get(struct net *net, struct proto *prot)
 }
 EXPORT_SYMBOL_GPL(sock_prot_inuse_get);
 
-static int sock_inuse_init_net(struct net *net)
+static int __net_init sock_inuse_init_net(struct net *net)
 {
         net->core.inuse = alloc_percpu(struct prot_inuse);
         return net->core.inuse ? 0 : -ENOMEM;
 }
 
-static void sock_inuse_exit_net(struct net *net)
+static void __net_exit sock_inuse_exit_net(struct net *net)
 {
         free_percpu(net->core.inuse);
 }
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index dad7bc4878e0..b195c4feaa0a 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -996,7 +996,7 @@ static struct inet_protosw dccp_v4_protosw = {
         .flags          = INET_PROTOSW_ICSK,
 };
 
-static int dccp_v4_init_net(struct net *net)
+static int __net_init dccp_v4_init_net(struct net *net)
 {
         int err;
 
@@ -1005,7 +1005,7 @@ static int dccp_v4_init_net(struct net *net)
         return err;
 }
 
-static void dccp_v4_exit_net(struct net *net)
+static void __net_exit dccp_v4_exit_net(struct net *net)
 {
         inet_ctl_sock_destroy(net->dccp.v4_ctl_sk);
 }
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index baf05cf43c28..1aec6349e858 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -1189,7 +1189,7 @@ static struct inet_protosw dccp_v6_protosw = {
         .flags          = INET_PROTOSW_ICSK,
 };
 
-static int dccp_v6_init_net(struct net *net)
+static int __net_init dccp_v6_init_net(struct net *net)
 {
         int err;
 
@@ -1198,7 +1198,7 @@ static int dccp_v6_init_net(struct net *net)
         return err;
 }
 
-static void dccp_v6_exit_net(struct net *net)
+static void __net_exit dccp_v6_exit_net(struct net *net)
 {
         inet_ctl_sock_destroy(net->dccp.v6_ctl_sk);
 }
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index dd3db88f8f0a..205a1c12f3c0 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -73,8 +73,8 @@ __setup("ether=", netdev_boot_setup);
  * @len:   packet length (<= skb->len)
  *
  *
- * Set the protocol type. For a packet of type ETH_P_802_3 we put the length
- * in here instead. It is up to the 802.2 layer to carry protocol information.
+ * Set the protocol type. For a packet of type ETH_P_802_3/2 we put the length
+ * in here instead.
  */
 int eth_header(struct sk_buff *skb, struct net_device *dev,
                unsigned short type,
@@ -82,7 +82,7 @@ int eth_header(struct sk_buff *skb, struct net_device *dev,
 {
         struct ethhdr *eth = (struct ethhdr *)skb_push(skb, ETH_HLEN);
 
-        if (type != ETH_P_802_3)
+        if (type != ETH_P_802_3 && type != ETH_P_802_2)
                 eth->h_proto = htons(type);
         else
                 eth->h_proto = htons(len);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c95cd93acf29..1940b4df7699 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -70,6 +70,7 @@
  *                                      bonding can change the skb before
  *                                      sending (e.g. insert 8021q tag).
  *              Harald Welte    :       convert to make use of jenkins hash
+ *              Jesper D. Brouer:       Proxy ARP PVLAN RFC 3069 support.
  */
 
 #include <linux/module.h>
@@ -524,12 +525,15 @@ int arp_bind_neighbour(struct dst_entry *dst)
 /*
  * Check if we can use proxy ARP for this path
  */
-
-static inline int arp_fwd_proxy(struct in_device *in_dev, struct rtable *rt)
+static inline int arp_fwd_proxy(struct in_device *in_dev,
+                                struct net_device *dev, struct rtable *rt)
 {
         struct in_device *out_dev;
         int imi, omi = -1;
 
+        if (rt->u.dst.dev == dev)
+                return 0;
+
         if (!IN_DEV_PROXY_ARP(in_dev))
                 return 0;
 
@@ -548,6 +552,43 @@ static inline int arp_fwd_proxy(struct in_device *in_dev, struct rtable *rt)
 }
 
 /*
+ * Check for RFC3069 proxy arp private VLAN (allow to send back to same dev)
+ *
+ * RFC3069 supports proxy arp replies back to the same interface.  This
+ * is done to support (ethernet) switch features, like RFC 3069, where
+ * the individual ports are not allowed to communicate with each
+ * other, BUT they are allowed to talk to the upstream router.  As
+ * described in RFC 3069, it is possible to allow these hosts to
+ * communicate through the upstream router, by proxy_arp'ing.
+ *
+ * RFC 3069: "VLAN Aggregation for Efficient IP Address Allocation"
+ *
+ *  This technology is known by different names:
+ *    In RFC 3069 it is called VLAN Aggregation.
+ *    Cisco and Allied Telesyn call it Private VLAN.
+ *    Hewlett-Packard call it Source-Port filtering or port-isolation.
+ *    Ericsson call it MAC-Forced Forwarding (RFC Draft).
+ *
+ */
+static inline int arp_fwd_pvlan(struct in_device *in_dev,
+                                struct net_device *dev, struct rtable *rt,
+                                __be32 sip, __be32 tip)
+{
+        /* Private VLAN is only concerned about the same ethernet segment */
+        if (rt->u.dst.dev != dev)
+                return 0;
+
+        /* Don't reply on self probes (often done by windowz boxes)*/
+        if (sip == tip)
+                return 0;
+
+        if (IN_DEV_PROXY_ARP_PVLAN(in_dev))
+                return 1;
+        else
+                return 0;
+}
+
+/*
  *      Interface to link layer: send routine and receive handler.
  */
 
@@ -833,8 +874,11 @@ static int arp_process(struct sk_buff *skb)
                         }
                         goto out;
                 } else if (IN_DEV_FORWARD(in_dev)) {
-                            if (addr_type == RTN_UNICAST  && rt->u.dst.dev != dev &&
-                             (arp_fwd_proxy(in_dev, rt) || pneigh_lookup(&arp_tbl, net, &tip, dev, 0))) {
+                        if (addr_type == RTN_UNICAST  &&
+                            (arp_fwd_proxy(in_dev, dev, rt) ||
+                             arp_fwd_pvlan(in_dev, dev, rt, sip, tip) ||
+                             pneigh_lookup(&arp_tbl, net, &tip, dev, 0)))
+                        {
                                 n = neigh_event_ns(&arp_tbl, sha, &sip, dev);
                                 if (n)
                                         neigh_release(n);
@@ -863,7 +907,8 @@ static int arp_process(struct sk_buff *skb)
                    devices (strip is candidate)
                  */
                 if (n == NULL &&
-                    arp->ar_op == htons(ARPOP_REPLY) &&
+                    (arp->ar_op == htons(ARPOP_REPLY) ||
+                     (arp->ar_op == htons(ARPOP_REQUEST) && tip == sip)) &&
                     inet_addr_type(net, sip) == RTN_UNICAST)
                         n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
         }
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 040c4f05b653..cd71a3908391 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1408,6 +1408,7 @@ static struct devinet_sysctl_table {
                 DEVINET_SYSCTL_RW_ENTRY(ARP_IGNORE, "arp_ignore"),
                 DEVINET_SYSCTL_RW_ENTRY(ARP_ACCEPT, "arp_accept"),
                 DEVINET_SYSCTL_RW_ENTRY(ARP_NOTIFY, "arp_notify"),
+                DEVINET_SYSCTL_RW_ENTRY(PROXY_ARP_PVLAN, "proxy_arp_pvlan"),
 
                 DEVINET_SYSCTL_FLUSHING_ENTRY(NOXFRM, "disable_xfrm"),
                 DEVINET_SYSCTL_FLUSHING_ENTRY(NOPOLICY, "disable_policy"),
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 82dbf711d6d0..9b3e28ed5240 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -883,7 +883,7 @@ static void nl_fib_input(struct sk_buff *skb)
         netlink_unicast(net->ipv4.fibnl, skb, pid, MSG_DONTWAIT);
 }
 
-static int nl_fib_lookup_init(struct net *net)
+static int __net_init nl_fib_lookup_init(struct net *net)
 {
         struct sock *sk;
         sk = netlink_kernel_create(net, NETLINK_FIB_LOOKUP, 0,
@@ -1004,7 +1004,7 @@ fail:
         return err;
 }
 
-static void __net_exit ip_fib_net_exit(struct net *net)
+static void ip_fib_net_exit(struct net *net)
 {
         unsigned int i;
 
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index ed19aa6919c2..96b21011a3e4 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -62,8 +62,8 @@ static DEFINE_SPINLOCK(fib_multipath_lock);
 #define for_nexthops(fi) { int nhsel; const struct fib_nh * nh; \
 for (nhsel=0, nh = (fi)->fib_nh; nhsel < (fi)->fib_nhs; nh++, nhsel++)
 
-#define change_nexthops(fi) { int nhsel; struct fib_nh * nh; \
-for (nhsel=0, nh = (struct fib_nh *)((fi)->fib_nh); nhsel < (fi)->fib_nhs; nh++, nhsel++)
+#define change_nexthops(fi) { int nhsel; struct fib_nh *nexthop_nh; \
+for (nhsel=0, nexthop_nh = (struct fib_nh *)((fi)->fib_nh); nhsel < (fi)->fib_nhs; nexthop_nh++, nhsel++)
 
 #else /* CONFIG_IP_ROUTE_MULTIPATH */
 
@@ -72,7 +72,7 @@ for (nhsel=0, nh = (struct fib_nh *)((fi)->fib_nh); nhsel < (fi)->fib_nhs; nh++,
 #define for_nexthops(fi) { int nhsel = 0; const struct fib_nh * nh = (fi)->fib_nh; \
 for (nhsel=0; nhsel < 1; nhsel++)
 
-#define change_nexthops(fi) { int nhsel = 0; struct fib_nh * nh = (struct fib_nh *)((fi)->fib_nh); \
+#define change_nexthops(fi) { int nhsel = 0; struct fib_nh *nexthop_nh = (struct fib_nh *)((fi)->fib_nh); \
 for (nhsel=0; nhsel < 1; nhsel++)
 
 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
@@ -145,9 +145,9 @@ void free_fib_info(struct fib_info *fi)
                 return;
         }
         change_nexthops(fi) {
-                if (nh->nh_dev)
-                        dev_put(nh->nh_dev);
-                nh->nh_dev = NULL;
+                if (nexthop_nh->nh_dev)
+                        dev_put(nexthop_nh->nh_dev);
+                nexthop_nh->nh_dev = NULL;
         } endfor_nexthops(fi);
         fib_info_cnt--;
         release_net(fi->fib_net);
@@ -162,9 +162,9 @@ void fib_release_info(struct fib_info *fi)
                 if (fi->fib_prefsrc)
                         hlist_del(&fi->fib_lhash);
                 change_nexthops(fi) {
-                        if (!nh->nh_dev)
+                        if (!nexthop_nh->nh_dev)
                                 continue;
-                        hlist_del(&nh->nh_hash);
+                        hlist_del(&nexthop_nh->nh_hash);
                 } endfor_nexthops(fi)
                 fi->fib_dead = 1;
                 fib_info_put(fi);
@@ -395,19 +395,20 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
                 if (!rtnh_ok(rtnh, remaining))
                         return -EINVAL;
 
-                nh->nh_flags = (cfg->fc_flags & ~0xFF) | rtnh->rtnh_flags;
-                nh->nh_oif = rtnh->rtnh_ifindex;
-                nh->nh_weight = rtnh->rtnh_hops + 1;
+                nexthop_nh->nh_flags =
+                        (cfg->fc_flags & ~0xFF) | rtnh->rtnh_flags;
+                nexthop_nh->nh_oif = rtnh->rtnh_ifindex;
+                nexthop_nh->nh_weight = rtnh->rtnh_hops + 1;
 
                 attrlen = rtnh_attrlen(rtnh);
                 if (attrlen > 0) {
                         struct nlattr *nla, *attrs = rtnh_attrs(rtnh);
 
                         nla = nla_find(attrs, attrlen, RTA_GATEWAY);
-                        nh->nh_gw = nla ? nla_get_be32(nla) : 0;
+                        nexthop_nh->nh_gw = nla ? nla_get_be32(nla) : 0;
 #ifdef CONFIG_NET_CLS_ROUTE
                         nla = nla_find(attrs, attrlen, RTA_FLOW);
-                        nh->nh_tclassid = nla ? nla_get_u32(nla) : 0;
+                        nexthop_nh->nh_tclassid = nla ? nla_get_u32(nla) : 0;
 #endif
                 }
 
@@ -738,7 +739,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
 
         fi->fib_nhs = nhs;
         change_nexthops(fi) {
-                nh->nh_parent = fi;
+                nexthop_nh->nh_parent = fi;
         } endfor_nexthops(fi)
 
         if (cfg->fc_mx) {
@@ -808,7 +809,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
                         goto failure;
         } else {
                 change_nexthops(fi) {
-                        if ((err = fib_check_nh(cfg, fi, nh)) != 0)
+                        if ((err = fib_check_nh(cfg, fi, nexthop_nh)) != 0)
                                 goto failure;
                 } endfor_nexthops(fi)
         }
@@ -843,11 +844,11 @@ link_it:
                 struct hlist_head *head;
                 unsigned int hash;
 
-                if (!nh->nh_dev)
+                if (!nexthop_nh->nh_dev)
                         continue;
-                hash = fib_devindex_hashfn(nh->nh_dev->ifindex);
+                hash = fib_devindex_hashfn(nexthop_nh->nh_dev->ifindex);
                 head = &fib_info_devhash[hash];
-                hlist_add_head(&nh->nh_hash, head);
+                hlist_add_head(&nexthop_nh->nh_hash, head);
         } endfor_nexthops(fi)
         spin_unlock_bh(&fib_info_lock);
         return fi;
@@ -1080,21 +1081,21 @@ int fib_sync_down_dev(struct net_device *dev, int force)
                 prev_fi = fi;
                 dead = 0;
                 change_nexthops(fi) {
-                        if (nh->nh_flags&RTNH_F_DEAD)
+                        if (nexthop_nh->nh_flags&RTNH_F_DEAD)
                                 dead++;
-                        else if (nh->nh_dev == dev &&
-                                        nh->nh_scope != scope) {
-                                nh->nh_flags |= RTNH_F_DEAD;
+                        else if (nexthop_nh->nh_dev == dev &&
+                                 nexthop_nh->nh_scope != scope) {
+                                nexthop_nh->nh_flags |= RTNH_F_DEAD;
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
                                 spin_lock_bh(&fib_multipath_lock);
-                                fi->fib_power -= nh->nh_power;
-                                nh->nh_power = 0;
+                                fi->fib_power -= nexthop_nh->nh_power;
+                                nexthop_nh->nh_power = 0;
                                 spin_unlock_bh(&fib_multipath_lock);
 #endif
                                 dead++;
                         }
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
-                        if (force > 1 && nh->nh_dev == dev) {
+                        if (force > 1 && nexthop_nh->nh_dev == dev) {
                                 dead = fi->fib_nhs;
                                 break;
                         }
@@ -1144,18 +1145,20 @@ int fib_sync_up(struct net_device *dev)
                 prev_fi = fi;
                 alive = 0;
                 change_nexthops(fi) {
-                        if (!(nh->nh_flags&RTNH_F_DEAD)) {
+                        if (!(nexthop_nh->nh_flags&RTNH_F_DEAD)) {
                                 alive++;
                                 continue;
                         }
-                        if (nh->nh_dev == NULL || !(nh->nh_dev->flags&IFF_UP))
+                        if (nexthop_nh->nh_dev == NULL ||
+                            !(nexthop_nh->nh_dev->flags&IFF_UP))
                                 continue;
-                        if (nh->nh_dev != dev || !__in_dev_get_rtnl(dev))
+                        if (nexthop_nh->nh_dev != dev ||
+                            !__in_dev_get_rtnl(dev))
                                 continue;
                         alive++;
                         spin_lock_bh(&fib_multipath_lock);
-                        nh->nh_power = 0;
-                        nh->nh_flags &= ~RTNH_F_DEAD;
+                        nexthop_nh->nh_power = 0;
+                        nexthop_nh->nh_flags &= ~RTNH_F_DEAD;
                         spin_unlock_bh(&fib_multipath_lock);
                 } endfor_nexthops(fi)
 
@@ -1182,9 +1185,9 @@ void fib_select_multipath(const struct flowi *flp, struct fib_result *res)
         if (fi->fib_power <= 0) {
                 int power = 0;
                 change_nexthops(fi) {
-                        if (!(nh->nh_flags&RTNH_F_DEAD)) {
-                                power += nh->nh_weight;
-                                nh->nh_power = nh->nh_weight;
+                        if (!(nexthop_nh->nh_flags&RTNH_F_DEAD)) {
+                                power += nexthop_nh->nh_weight;
+                                nexthop_nh->nh_power = nexthop_nh->nh_weight;
                         }
                 } endfor_nexthops(fi);
                 fi->fib_power = power;
@@ -1204,9 +1207,10 @@ void fib_select_multipath(const struct flowi *flp, struct fib_result *res)
         w = jiffies % fi->fib_power;
 
         change_nexthops(fi) {
-                if (!(nh->nh_flags&RTNH_F_DEAD) && nh->nh_power) {
-                        if ((w -= nh->nh_power) <= 0) {
-                                nh->nh_power--;
+                if (!(nexthop_nh->nh_flags&RTNH_F_DEAD) &&
+                    nexthop_nh->nh_power) {
+                        if ((w -= nexthop_nh->nh_power) <= 0) {
+                                nexthop_nh->nh_power--;
                                 fi->fib_power--;
                                 res->nh_sel = nhsel;
                                 spin_unlock_bh(&fib_multipath_lock);
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index fe11f60ce41b..4b4c2bcd15db 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -114,7 +114,7 @@ struct icmp_bxm {
 /* An array of errno for error messages from dest unreach. */
 /* RFC 1122: 3.2.2.1 States that NET_UNREACH, HOST_UNREACH and SR_FAILED MUST be considered 'transient errs'. */
 
-struct icmp_err icmp_err_convert[] = {
+const struct icmp_err icmp_err_convert[] = {
         {
                 .errno = ENETUNREACH,   /* ICMP_NET_UNREACH */
                 .fatal = 0,
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 76c08402c933..8f5468393f01 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -2603,7 +2603,7 @@ static const struct file_operations igmp_mcf_seq_fops = {
         .release        =       seq_release_net,
 };
 
-static int igmp_net_init(struct net *net)
+static int __net_init igmp_net_init(struct net *net)
 {
         struct proc_dir_entry *pde;
 
@@ -2621,7 +2621,7 @@ out_igmp:
         return -ENOMEM;
 }
 
-static void igmp_net_exit(struct net *net)
+static void __net_exit igmp_net_exit(struct net *net)
 {
         proc_net_remove(net, "mcfilter");
         proc_net_remove(net, "igmp");
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index ee16475f8fc3..8da6429269dd 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -529,6 +529,8 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                                 syn_ack_recalc(req, thresh, max_retries,
                                                queue->rskq_defer_accept,
                                                &expire, &resend);
+                                if (req->rsk_ops->syn_ack_timeout)
+                                        req->rsk_ops->syn_ack_timeout(parent, req);
                                 if (!expire &&
                                     (!resend ||
                                      !req->rsk_ops->rtx_syn_ack(parent, req, NULL) ||
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 86964b353c31..9f41bd311754 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -32,6 +32,8 @@
 #include <linux/netdevice.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
+#include <net/route.h>
+#include <net/dst.h>
 #include <net/sock.h>
 #include <net/ip.h>
 #include <net/icmp.h>
@@ -205,13 +207,37 @@ static void ip_expire(unsigned long arg)
         if ((qp->q.last_in & INET_FRAG_FIRST_IN) && qp->q.fragments != NULL) {
                 struct sk_buff *head = qp->q.fragments;
 
-                /* Send an ICMP "Fragment Reassembly Timeout" message. */
                 rcu_read_lock();
                 head->dev = dev_get_by_index_rcu(net, qp->iif);
-                if (head->dev)
-                        icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
-                rcu_read_unlock();
+                if (!head->dev)
+                        goto out_rcu_unlock;
+
+                /*
+                 * Only search router table for the head fragment,
+                 * when defraging timeout at PRE_ROUTING HOOK.
+                 */
+                if (qp->user == IP_DEFRAG_CONNTRACK_IN && !skb_dst(head)) {
+                        const struct iphdr *iph = ip_hdr(head);
+                        int err = ip_route_input(head, iph->daddr, iph->saddr,
+                                                 iph->tos, head->dev);
+                        if (unlikely(err))
+                                goto out_rcu_unlock;
+
+                        /*
+                         * Only an end host needs to send an ICMP
+                         * "Fragment Reassembly Timeout" message, per RFC792.
+                         */
+                        if (skb_rtable(head)->rt_type != RTN_LOCAL)
+                                goto out_rcu_unlock;
+
+                }
+
+                /* Send an ICMP "Fragment Reassembly Timeout" message. */
+                icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
         }
+
+out_rcu_unlock:
+        rcu_read_unlock();
 out:
         spin_unlock(&qp->q.lock);
         ipq_put(qp);
@@ -646,7 +672,7 @@ static struct ctl_table ip4_frags_ctl_table[] = {
         { }
 };
 
-static int ip4_frags_ns_ctl_register(struct net *net)
+static int __net_init ip4_frags_ns_ctl_register(struct net *net)
 {
         struct ctl_table *table;
         struct ctl_table_header *hdr;
@@ -676,7 +702,7 @@ err_alloc:
         return -ENOMEM;
 }
 
-static void ip4_frags_ns_ctl_unregister(struct net *net)
+static void __net_exit ip4_frags_ns_ctl_unregister(struct net *net)
 {
         struct ctl_table *table;
 
@@ -704,7 +730,7 @@ static inline void ip4_frags_ctl_register(void)
 }
 #endif
 
-static int ipv4_frags_init_net(struct net *net)
+static int __net_init ipv4_frags_init_net(struct net *net)
 {
         /*
          * Fragment cache limits. We will commit 256K at one time. Should we
@@ -726,7 +752,7 @@ static int ipv4_frags_init_net(struct net *net)
         return ip4_frags_ns_ctl_register(net);
 }
 
-static void ipv4_frags_exit_net(struct net *net)
+static void __net_exit ipv4_frags_exit_net(struct net *net)
 {
         ip4_frags_ns_ctl_unregister(net);
         inet_frags_exit_net(&net->ipv4.frags, &ip4_frags);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index f36ce156cac6..7631b20490f5 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1307,7 +1307,7 @@ static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
         }
 }
 
-static int ipgre_init_net(struct net *net)
+static int __net_init ipgre_init_net(struct net *net)
 {
         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
         int err;
@@ -1334,7 +1334,7 @@ err_alloc_dev:
         return err;
 }
 
-static void ipgre_exit_net(struct net *net)
+static void __net_exit ipgre_exit_net(struct net *net)
 {
         struct ipgre_net *ign;
         LIST_HEAD(list);
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index cafad9baff03..644dc43a55de 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -451,7 +451,8 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                              (1<<IP_TTL) | (1<<IP_HDRINCL) |
                              (1<<IP_MTU_DISCOVER) | (1<<IP_RECVERR) |
                              (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
-                             (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT))) ||
+                             (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |
+                             (1<<IP_MINTTL))) ||
             optname == IP_MULTICAST_TTL ||
             optname == IP_MULTICAST_ALL ||
             optname == IP_MULTICAST_LOOP ||
@@ -936,6 +937,14 @@ mc_msf_out:
                 inet->transparent = !!val;
                 break;
 
+        case IP_MINTTL:
+                if (optlen < 1)
+                        goto e_inval;
+                if (val < 0 || val > 255)
+                        goto e_inval;
+                inet->min_ttl = val;
+                break;
+
         default:
                 err = -ENOPROTOOPT;
                 break;
@@ -1198,6 +1207,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         case IP_TRANSPARENT:
                 val = inet->transparent;
                 break;
+        case IP_MINTTL:
+                val = inet->min_ttl;
+                break;
         default:
                 release_sock(sk);
                 return -ENOPROTOOPT;
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index eda04fed3379..95db732e542b 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -130,7 +130,6 @@ struct ipip_net {
         struct net_device *fb_tunnel_dev;
 };
 
-static void ipip_fb_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_init(struct net_device *dev);
 static void ipip_tunnel_setup(struct net_device *dev);
 
@@ -730,7 +729,7 @@ static void ipip_tunnel_init(struct net_device *dev)
         ipip_tunnel_bind_dev(dev);
 }
 
-static void ipip_fb_tunnel_init(struct net_device *dev)
+static void __net_init ipip_fb_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct iphdr *iph = &tunnel->parms.iph;
@@ -773,7 +772,7 @@ static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
         }
 }
 
-static int ipip_init_net(struct net *net)
+static int __net_init ipip_init_net(struct net *net)
 {
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
         int err;
@@ -806,7 +805,7 @@ err_alloc_dev:
         return err;
 }
 
-static void ipip_exit_net(struct net *net)
+static void __net_exit ipip_exit_net(struct net *net)
 {
         struct ipip_net *ipn = net_generic(net, ipip_net_id);
         LIST_HEAD(list);
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index f25542c48b7d..1b09a6dde7c0 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -127,8 +127,8 @@ static const struct snmp_mib snmp4_ipextstats_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-static struct {
-        char *name;
+static const struct {
+        const char *name;
         int index;
 } icmpmibmap[] = {
         { "DestUnreachs", ICMP_DEST_UNREACH },
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index d62b05d33384..b16dfadbe6d6 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1990,8 +1990,13 @@ static int __mkroute_input(struct sk_buff *skb,
         if (skb->protocol != htons(ETH_P_IP)) {
                 /* Not IP (i.e. ARP). Do not create route, if it is
                  * invalid for proxy arp. DNAT routes are always valid.
+                 *
+                 * Proxy arp feature have been extended to allow, ARP
+                 * replies back to the same interface, to support
+                 * Private VLAN switch technologies. See arp.c.
                  */
-                if (out_dev == in_dev) {
+                if (out_dev == in_dev &&
+                    IN_DEV_PROXY_ARP_PVLAN(in_dev) == 0) {
                         err = -EINVAL;
                         goto cleanup;
                 }
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 66fd80ef2473..5c24db4a3c91 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -358,7 +358,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                   &req->rcv_wnd, &req->window_clamp,
-                                  ireq->wscale_ok, &rcv_wscale);
+                                  ireq->wscale_ok, &rcv_wscale,
+                                  dst_metric(&rt->u.dst, RTAX_INITRWND));
 
         ireq->rcv_wscale  = rcv_wscale;
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index b0a26bb25e2e..d5d69ea8f249 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -536,8 +536,7 @@ static inline void skb_entail(struct sock *sk, struct sk_buff *skb)
                 tp->nonagle &= ~TCP_NAGLE_PUSH;
 }
 
-static inline void tcp_mark_urg(struct tcp_sock *tp, int flags,
-                                struct sk_buff *skb)
+static inline void tcp_mark_urg(struct tcp_sock *tp, int flags)
 {
         if (flags & MSG_OOB)
                 tp->snd_up = tp->write_seq;
@@ -546,13 +545,13 @@ static inline void tcp_mark_urg(struct tcp_sock *tp, int flags,
 static inline void tcp_push(struct sock *sk, int flags, int mss_now,
                             int nonagle)
 {
-        struct tcp_sock *tp = tcp_sk(sk);
-
         if (tcp_send_head(sk)) {
-                struct sk_buff *skb = tcp_write_queue_tail(sk);
+                struct tcp_sock *tp = tcp_sk(sk);
+
                 if (!(flags & MSG_MORE) || forced_push(tp))
-                        tcp_mark_push(tp, skb);
-                tcp_mark_urg(tp, flags, skb);
+                        tcp_mark_push(tp, tcp_write_queue_tail(sk));
+
+                tcp_mark_urg(tp, flags);
                 __tcp_push_pending_frames(sk, mss_now,
                                           (flags & MSG_MORE) ? TCP_NAGLE_CORK : nonagle);
         }
@@ -877,12 +876,12 @@ ssize_t tcp_sendpage(struct socket *sock, struct page *page, int offset,
 #define TCP_PAGE(sk)    (sk->sk_sndmsg_page)
 #define TCP_OFF(sk)     (sk->sk_sndmsg_off)
 
-static inline int select_size(struct sock *sk)
+static inline int select_size(struct sock *sk, int sg)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         int tmp = tp->mss_cache;
 
-        if (sk->sk_route_caps & NETIF_F_SG) {
+        if (sg) {
                 if (sk_can_gso(sk))
                         tmp = 0;
                 else {
@@ -906,7 +905,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         struct sk_buff *skb;
         int iovlen, flags;
         int mss_now, size_goal;
-        int err, copied;
+        int sg, err, copied;
         long timeo;
 
         lock_sock(sk);
@@ -934,6 +933,8 @@ int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                 goto out_err;
 
+        sg = sk->sk_route_caps & NETIF_F_SG;
+
         while (--iovlen >= 0) {
                 int seglen = iov->iov_len;
                 unsigned char __user *from = iov->iov_base;
@@ -959,8 +960,9 @@ new_segment:
                                 if (!sk_stream_memory_free(sk))
                                         goto wait_for_sndbuf;
 
-                                skb = sk_stream_alloc_skb(sk, select_size(sk),
-                                                sk->sk_allocation);
+                                skb = sk_stream_alloc_skb(sk,
+                                                          select_size(sk, sg),
+                                                          sk->sk_allocation);
                                 if (!skb)
                                         goto wait_for_memory;
 
@@ -997,9 +999,7 @@ new_segment:
                                         /* We can extend the last page
                                          * fragment. */
                                         merge = 1;
-                                } else if (i == MAX_SKB_FRAGS ||
-                                           (!i &&
-                                           !(sk->sk_route_caps & NETIF_F_SG))) {
+                                } else if (i == MAX_SKB_FRAGS || !sg) {
                                         /* Need to add new fragment and cannot
                                          * do this because interface is non-SG,
                                          * or because all the page slots are
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 65b8ebfd078a..c3588b4fd979 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -742,9 +742,9 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  *      This still operates on a request_sock only, not on a big
  *      socket.
  */
-static int __tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
-                                struct request_sock *req,
-                                struct request_values *rvp)
+static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
+                              struct request_sock *req,
+                              struct request_values *rvp)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         int err = -1;
@@ -775,10 +775,11 @@ static int __tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
         return err;
 }
 
-static int tcp_v4_send_synack(struct sock *sk, struct request_sock *req,
+static int tcp_v4_rtx_synack(struct sock *sk, struct request_sock *req,
                               struct request_values *rvp)
 {
-        return __tcp_v4_send_synack(sk, NULL, req, rvp);
+        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
+        return tcp_v4_send_synack(sk, NULL, req, rvp);
 }
 
 /*
@@ -1192,10 +1193,11 @@ static int tcp_v4_inbound_md5_hash(struct sock *sk, struct sk_buff *skb)
 struct request_sock_ops tcp_request_sock_ops __read_mostly = {
         .family         =       PF_INET,
         .obj_size       =       sizeof(struct tcp_request_sock),
-        .rtx_syn_ack    =       tcp_v4_send_synack,
+        .rtx_syn_ack    =       tcp_v4_rtx_synack,
         .send_ack       =       tcp_v4_reqsk_send_ack,
         .destructor     =       tcp_v4_reqsk_destructor,
         .send_reset     =       tcp_v4_send_reset,
+        .syn_ack_timeout =      tcp_syn_ack_timeout,
 };
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -1373,8 +1375,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         }
         tcp_rsk(req)->snt_isn = isn;
 
-        if (__tcp_v4_send_synack(sk, dst, req,
-                                 (struct request_values *)&tmp_ext) ||
+        if (tcp_v4_send_synack(sk, dst, req,
+                               (struct request_values *)&tmp_ext) ||
             want_cookie)
                 goto drop_and_free;
 
@@ -1649,6 +1651,9 @@ int tcp_v4_rcv(struct sk_buff *skb)
         if (!sk)
                 goto no_tcp_socket;
 
+        if (iph->ttl < inet_sk(sk)->min_ttl)
+                goto discard_and_relse;
+
 process:
         if (sk->sk_state == TCP_TIME_WAIT)
                 goto do_time_wait;
@@ -2425,12 +2430,12 @@ static struct tcp_seq_afinfo tcp4_seq_afinfo = {
         },
 };
 
-static int tcp4_proc_init_net(struct net *net)
+static int __net_init tcp4_proc_init_net(struct net *net)
 {
         return tcp_proc_register(net, &tcp4_seq_afinfo);
 }
 
-static void tcp4_proc_exit_net(struct net *net)
+static void __net_exit tcp4_proc_exit_net(struct net *net)
 {
         tcp_proc_unregister(net, &tcp4_seq_afinfo);
 }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 383ce237640f..4a1605d3f909 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -183,7 +183,8 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
  */
 void tcp_select_initial_window(int __space, __u32 mss,
                                __u32 *rcv_wnd, __u32 *window_clamp,
-                               int wscale_ok, __u8 *rcv_wscale)
+                               int wscale_ok, __u8 *rcv_wscale,
+                               __u32 init_rcv_wnd)
 {
         unsigned int space = (__space < 0 ? 0 : __space);
 
@@ -232,7 +233,13 @@ void tcp_select_initial_window(int __space, __u32 mss,
                         init_cwnd = 2;
                 else if (mss > 1460)
                         init_cwnd = 3;
-                if (*rcv_wnd > init_cwnd * mss)
+                /* when initializing use the value from init_rcv_wnd
+                 * rather than the default from above
+                 */
+                if (init_rcv_wnd &&
+                    (*rcv_wnd > init_rcv_wnd * mss))
+                        *rcv_wnd = init_rcv_wnd * mss;
+                else if (*rcv_wnd > init_cwnd * mss)
                         *rcv_wnd = init_cwnd * mss;
         }
 
@@ -1794,11 +1801,6 @@ static int tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
 void __tcp_push_pending_frames(struct sock *sk, unsigned int cur_mss,
                                int nonagle)
 {
-        struct sk_buff *skb = tcp_send_head(sk);
-
-        if (!skb)
-                return;
-
         /* If we are closed, the bytes will have to remain here.
          * In time closedown will finish, we empty the write queue and
          * all will be happy.
@@ -2422,7 +2424,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                         &req->rcv_wnd,
                         &req->window_clamp,
                         ireq->wscale_ok,
-                        &rcv_wscale);
+                        &rcv_wscale,
+                        dst_metric(dst, RTAX_INITRWND));
                 ireq->rcv_wscale = rcv_wscale;
         }
 
@@ -2549,7 +2552,8 @@ static void tcp_connect_init(struct sock *sk)
                                   &tp->rcv_wnd,
                                   &tp->window_clamp,
                                   sysctl_tcp_window_scaling,
-                                  &rcv_wscale);
+                                  &rcv_wscale,
+                                  dst_metric(dst, RTAX_INITRWND));
 
         tp->rx_opt.rcv_wscale = rcv_wscale;
         tp->rcv_ssthresh = tp->rcv_wnd;
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 8816a20c2597..de7d1bf9114f 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -474,6 +474,12 @@ static void tcp_synack_timer(struct sock *sk)
                                    TCP_TIMEOUT_INIT, TCP_RTO_MAX);
 }
 
+void tcp_syn_ack_timeout(struct sock *sk, struct request_sock *req)
+{
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEOUTS);
+}
+EXPORT_SYMBOL(tcp_syn_ack_timeout);
+
 void tcp_set_keepalive(struct sock *sk, int val)
 {
         if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index f0126fdd7e04..4f7d2122d818 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2027,12 +2027,12 @@ static struct udp_seq_afinfo udp4_seq_afinfo = {
         },
 };
 
-static int udp4_proc_init_net(struct net *net)
+static int __net_init udp4_proc_init_net(struct net *net)
 {
         return udp_proc_register(net, &udp4_seq_afinfo);
 }
 
-static void udp4_proc_exit_net(struct net *net)
+static void __net_exit udp4_proc_exit_net(struct net *net)
 {
         udp_proc_unregister(net, &udp4_seq_afinfo);
 }
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 66f79513f4a5..6610bf76369f 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -81,12 +81,12 @@ static struct udp_seq_afinfo udplite4_seq_afinfo = {
         },
 };
 
-static int udplite4_proc_init_net(struct net *net)
+static int __net_init udplite4_proc_init_net(struct net *net)
 {
         return udp_proc_register(net, &udplite4_seq_afinfo);
 }
 
-static void udplite4_proc_exit_net(struct net *net)
+static void __net_exit udplite4_proc_exit_net(struct net *net)
 {
         udp_proc_unregister(net, &udplite4_seq_afinfo);
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index de7a194a64ab..1593289155ff 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3027,14 +3027,14 @@ static const struct file_operations if6_fops = {
         .release        = seq_release_net,
 };
 
-static int if6_proc_net_init(struct net *net)
+static int __net_init if6_proc_net_init(struct net *net)
 {
         if (!proc_net_fops_create(net, "if_inet6", S_IRUGO, &if6_fops))
                 return -ENOMEM;
         return 0;
 }
 
-static void if6_proc_net_exit(struct net *net)
+static void __net_exit if6_proc_net_exit(struct net *net)
 {
        proc_net_remove(net, "if_inet6");
 }
@@ -4418,7 +4418,7 @@ static void addrconf_sysctl_unregister(struct inet6_dev *idev)
 
 #endif
 
-static int addrconf_init_net(struct net *net)
+static int __net_init addrconf_init_net(struct net *net)
 {
         int err;
         struct ipv6_devconf *all, *dflt;
@@ -4467,7 +4467,7 @@ err_alloc_all:
         return err;
 }
 
-static void addrconf_exit_net(struct net *net)
+static void __net_exit addrconf_exit_net(struct net *net)
 {
 #ifdef CONFIG_SYSCTL
         __addrconf_sysctl_unregister(net->ipv6.devconf_dflt);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 12e69d364dd5..e29160ff4a0f 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -999,7 +999,7 @@ err_udplite_mib:
         return -ENOMEM;
 }
 
-static void __net_exit ipv6_cleanup_mibs(struct net *net)
+static void ipv6_cleanup_mibs(struct net *net)
 {
         snmp_mib_free((void **)net->mib.udp_stats_in6);
         snmp_mib_free((void **)net->mib.udplite_stats_in6);
@@ -1042,7 +1042,7 @@ out:
 #endif
 }
 
-static void inet6_net_exit(struct net *net)
+static void __net_exit inet6_net_exit(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
         udp6_proc_exit(net);
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index f1c74c8ef9de..c4f6ca32fa74 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -538,7 +538,7 @@ static const struct file_operations ac6_seq_fops = {
         .release        =       seq_release_net,
 };
 
-int ac6_proc_init(struct net *net)
+int __net_init ac6_proc_init(struct net *net)
 {
         if (!proc_net_fops_create(net, "anycast6", S_IRUGO, &ac6_seq_fops))
                 return -ENOMEM;
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index b7aa7c64cc4a..551882b9dfd6 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -262,7 +262,7 @@ static struct fib_rules_ops fib6_rules_ops_template = {
         .fro_net                = &init_net,
 };
 
-static int fib6_rules_net_init(struct net *net)
+static int __net_init fib6_rules_net_init(struct net *net)
 {
         struct fib_rules_ops *ops;
         int err = -ENOMEM;
@@ -291,7 +291,7 @@ out_fib6_rules_ops:
         goto out;
 }
 
-static void fib6_rules_net_exit(struct net *net)
+static void __net_exit fib6_rules_net_exit(struct net *net)
 {
         fib_rules_unregister(net->ipv6.fib6_rules_ops);
 }
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 4ae661bc3677..217dbc2e28d4 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -951,7 +951,7 @@ ctl_table ipv6_icmp_table_template[] = {
         { },
 };
 
-struct ctl_table *ipv6_icmp_sysctl_init(struct net *net)
+struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
 {
         struct ctl_table *table;
 
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 0e93ca56eb69..f626ea2b304f 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -239,7 +239,7 @@ struct fib6_table *fib6_get_table(struct net *net, u32 id)
         return NULL;
 }
 
-static void fib6_tables_init(struct net *net)
+static void __net_init fib6_tables_init(struct net *net)
 {
         fib6_link_table(net, net->ipv6.fib6_main_tbl);
         fib6_link_table(net, net->ipv6.fib6_local_tbl);
@@ -262,7 +262,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi *fl,
         return (struct dst_entry *) lookup(net, net->ipv6.fib6_main_tbl, fl, flags);
 }
 
-static void fib6_tables_init(struct net *net)
+static void __net_init fib6_tables_init(struct net *net)
 {
         fib6_link_table(net, net->ipv6.fib6_main_tbl);
 }
@@ -1469,7 +1469,7 @@ static void fib6_gc_timer_cb(unsigned long arg)
         fib6_run_gc(0, (struct net *)arg);
 }
 
-static int fib6_net_init(struct net *net)
+static int __net_init fib6_net_init(struct net *net)
 {
         setup_timer(&net->ipv6.ip6_fib_timer, fib6_gc_timer_cb, (unsigned long)net);
 
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 6e7bffa2205e..e41eba8aacf1 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -154,7 +154,7 @@ static void ip6_fl_gc(unsigned long dummy)
         write_unlock(&ip6_fl_lock);
 }
 
-static void ip6_fl_purge(struct net *net)
+static void __net_exit ip6_fl_purge(struct net *net)
 {
         int i;
 
@@ -735,7 +735,7 @@ static const struct file_operations ip6fl_seq_fops = {
         .release        =       seq_release_net,
 };
 
-static int ip6_flowlabel_proc_init(struct net *net)
+static int __net_init ip6_flowlabel_proc_init(struct net *net)
 {
         if (!proc_net_fops_create(net, "ip6_flowlabel",
                                   S_IRUGO, &ip6fl_seq_fops))
@@ -743,7 +743,7 @@ static int ip6_flowlabel_proc_init(struct net *net)
         return 0;
 }
 
-static void ip6_flowlabel_proc_fini(struct net *net)
+static void __net_exit ip6_flowlabel_proc_fini(struct net *net)
 {
         proc_net_remove(net, "ip6_flowlabel");
 }
@@ -754,11 +754,10 @@ static inline int ip6_flowlabel_proc_init(struct net *net)
 }
 static inline void ip6_flowlabel_proc_fini(struct net *net)
 {
-        return ;
 }
 #endif
 
-static inline void ip6_flowlabel_net_exit(struct net *net)
+static void __net_exit ip6_flowlabel_net_exit(struct net *net)
 {
         ip6_fl_purge(net);
         ip6_flowlabel_proc_fini(net);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index d453d07b0dfe..fbd786981aa9 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -74,7 +74,6 @@ MODULE_LICENSE("GPL");
                      (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
                     (HASH_SIZE - 1))
 
-static void ip6_fb_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_setup(struct net_device *dev);
 
@@ -1364,7 +1363,7 @@ static void ip6_tnl_dev_init(struct net_device *dev)
  * Return: 0
  **/
 
-static void ip6_fb_tnl_dev_init(struct net_device *dev)
+static void __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
         struct net *net = dev_net(dev);
@@ -1388,7 +1387,7 @@ static struct xfrm6_tunnel ip6ip6_handler = {
         .priority       =       1,
 };
 
-static void ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
+static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
 {
         int h;
         struct ip6_tnl *t;
@@ -1407,7 +1406,7 @@ static void ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
         unregister_netdevice_many(&list);
 }
 
-static int ip6_tnl_init_net(struct net *net)
+static int __net_init ip6_tnl_init_net(struct net *net)
 {
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
         int err;
@@ -1436,7 +1435,7 @@ err_alloc_dev:
         return err;
 }
 
-static void ip6_tnl_exit_net(struct net *net)
+static void __net_exit ip6_tnl_exit_net(struct net *net)
 {
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 1f9c44442e65..25f6cca79e6b 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2646,7 +2646,7 @@ static const struct file_operations igmp6_mcf_seq_fops = {
         .release        =       seq_release_net,
 };
 
-static int igmp6_proc_init(struct net *net)
+static int __net_init igmp6_proc_init(struct net *net)
 {
         int err;
 
@@ -2666,23 +2666,22 @@ out_proc_net_igmp6:
         goto out;
 }
 
-static void igmp6_proc_exit(struct net *net)
+static void __net_exit igmp6_proc_exit(struct net *net)
 {
         proc_net_remove(net, "mcfilter6");
         proc_net_remove(net, "igmp6");
 }
 #else
-static int igmp6_proc_init(struct net *net)
+static inline int igmp6_proc_init(struct net *net)
 {
         return 0;
 }
-static void igmp6_proc_exit(struct net *net)
+static inline void igmp6_proc_exit(struct net *net)
 {
-        ;
 }
 #endif
 
-static int igmp6_net_init(struct net *net)
+static int __net_init igmp6_net_init(struct net *net)
 {
         int err;
 
@@ -2708,7 +2707,7 @@ out_sock_create:
         goto out;
 }
 
-static void igmp6_net_exit(struct net *net)
+static void __net_exit igmp6_net_exit(struct net *net)
 {
         inet_ctl_sock_destroy(net->ipv6.igmp_sk);
         igmp6_proc_exit(net);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index c45852798092..2dfec6bb8ada 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1772,7 +1772,7 @@ int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *bu
 
 #endif
 
-static int ndisc_net_init(struct net *net)
+static int __net_init ndisc_net_init(struct net *net)
 {
         struct ipv6_pinfo *np;
         struct sock *sk;
@@ -1797,7 +1797,7 @@ static int ndisc_net_init(struct net *net)
         return 0;
 }
 
-static void ndisc_net_exit(struct net *net)
+static void __net_exit ndisc_net_exit(struct net *net)
 {
         inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
 }
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index c9605c3ad91f..bfe2598dd563 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -59,7 +59,7 @@ static const struct file_operations sockstat6_seq_fops = {
         .release = single_release_net,
 };
 
-static struct snmp_mib snmp6_ipstats_list[] = {
+static const struct snmp_mib snmp6_ipstats_list[] = {
 /* ipv6 mib according to RFC 2465 */
         SNMP_MIB_ITEM("Ip6InReceives", IPSTATS_MIB_INPKTS),
         SNMP_MIB_ITEM("Ip6InHdrErrors", IPSTATS_MIB_INHDRERRORS),
@@ -92,7 +92,7 @@ static struct snmp_mib snmp6_ipstats_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-static struct snmp_mib snmp6_icmp6_list[] = {
+static const struct snmp_mib snmp6_icmp6_list[] = {
 /* icmpv6 mib according to RFC 2466 */
         SNMP_MIB_ITEM("Icmp6InMsgs", ICMP6_MIB_INMSGS),
         SNMP_MIB_ITEM("Icmp6InErrors", ICMP6_MIB_INERRORS),
@@ -120,7 +120,7 @@ static const char *const icmp6type2name[256] = {
 };
 
 
-static struct snmp_mib snmp6_udp6_list[] = {
+static const struct snmp_mib snmp6_udp6_list[] = {
         SNMP_MIB_ITEM("Udp6InDatagrams", UDP_MIB_INDATAGRAMS),
         SNMP_MIB_ITEM("Udp6NoPorts", UDP_MIB_NOPORTS),
         SNMP_MIB_ITEM("Udp6InErrors", UDP_MIB_INERRORS),
@@ -128,7 +128,7 @@ static struct snmp_mib snmp6_udp6_list[] = {
         SNMP_MIB_SENTINEL
 };
 
-static struct snmp_mib snmp6_udplite6_list[] = {
+static const struct snmp_mib snmp6_udplite6_list[] = {
         SNMP_MIB_ITEM("UdpLite6InDatagrams", UDP_MIB_INDATAGRAMS),
         SNMP_MIB_ITEM("UdpLite6NoPorts", UDP_MIB_NOPORTS),
         SNMP_MIB_ITEM("UdpLite6InErrors", UDP_MIB_INERRORS),
@@ -170,8 +170,8 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
         return;
 }
 
-static inline void
-snmp6_seq_show_item(struct seq_file *seq, void **mib, struct snmp_mib *itemlist)
+static void snmp6_seq_show_item(struct seq_file *seq, void **mib,
+                                const struct snmp_mib *itemlist)
 {
         int i;
         for (i=0; itemlist[i].name; i++)
@@ -259,7 +259,7 @@ int snmp6_unregister_dev(struct inet6_dev *idev)
         struct net *net = dev_net(idev->dev);
         if (!net->mib.proc_net_devsnmp6)
                 return -ENOENT;
-        if (!idev || !idev->stats.proc_dir_entry)
+        if (!idev->stats.proc_dir_entry)
                 return -EINVAL;
         remove_proc_entry(idev->stats.proc_dir_entry->name,
                           net->mib.proc_net_devsnmp6);
@@ -267,7 +267,7 @@ int snmp6_unregister_dev(struct inet6_dev *idev)
         return 0;
 }
 
-static int ipv6_proc_init_net(struct net *net)
+static int __net_init ipv6_proc_init_net(struct net *net)
 {
         if (!proc_net_fops_create(net, "sockstat6", S_IRUGO,
                         &sockstat6_seq_fops))
@@ -288,7 +288,7 @@ proc_dev_snmp6_fail:
         return -ENOMEM;
 }
 
-static void ipv6_proc_exit_net(struct net *net)
+static void __net_exit ipv6_proc_exit_net(struct net *net)
 {
         proc_net_remove(net, "sockstat6");
         proc_net_remove(net, "dev_snmp6");
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 926ce8eeffaf..ed31c37c6e39 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1275,7 +1275,7 @@ static const struct file_operations raw6_seq_fops = {
         .release =      seq_release_net,
 };
 
-static int raw6_init_net(struct net *net)
+static int __net_init raw6_init_net(struct net *net)
 {
         if (!proc_net_fops_create(net, "raw6", S_IRUGO, &raw6_seq_fops))
                 return -ENOMEM;
@@ -1283,7 +1283,7 @@ static int raw6_init_net(struct net *net)
         return 0;
 }
 
-static void raw6_exit_net(struct net *net)
+static void __net_exit raw6_exit_net(struct net *net)
 {
         proc_net_remove(net, "raw6");
 }
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 2cddea3bd6be..fa38fc7cc6e9 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -672,7 +672,7 @@ static struct ctl_table ip6_frags_ctl_table[] = {
         { }
 };
 
-static int ip6_frags_ns_sysctl_register(struct net *net)
+static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
 {
         struct ctl_table *table;
         struct ctl_table_header *hdr;
@@ -702,7 +702,7 @@ err_alloc:
         return -ENOMEM;
 }
 
-static void ip6_frags_ns_sysctl_unregister(struct net *net)
+static void __net_exit ip6_frags_ns_sysctl_unregister(struct net *net)
 {
         struct ctl_table *table;
 
@@ -745,7 +745,7 @@ static inline void ip6_frags_sysctl_unregister(void)
 }
 #endif
 
-static int ipv6_frags_init_net(struct net *net)
+static int __net_init ipv6_frags_init_net(struct net *net)
 {
         net->ipv6.frags.high_thresh = 256 * 1024;
         net->ipv6.frags.low_thresh = 192 * 1024;
@@ -756,7 +756,7 @@ static int ipv6_frags_init_net(struct net *net)
         return ip6_frags_ns_sysctl_register(net);
 }
 
-static void ipv6_frags_exit_net(struct net *net)
+static void __net_exit ipv6_frags_exit_net(struct net *net)
 {
         ip6_frags_ns_sysctl_unregister(net);
         inet_frags_exit_net(&net->ipv6.frags, &ip6_frags);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c2bd74c5f8d9..8500156f2637 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2612,7 +2612,7 @@ ctl_table ipv6_route_table_template[] = {
         { }
 };
 
-struct ctl_table *ipv6_route_sysctl_init(struct net *net)
+struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
 {
         struct ctl_table *table;
 
@@ -2637,7 +2637,7 @@ struct ctl_table *ipv6_route_sysctl_init(struct net *net)
 }
 #endif
 
-static int ip6_route_net_init(struct net *net)
+static int __net_init ip6_route_net_init(struct net *net)
 {
         int ret = -ENOMEM;
 
@@ -2702,7 +2702,7 @@ out_ip6_dst_ops:
         goto out;
 }
 
-static void ip6_route_net_exit(struct net *net)
+static void __net_exit ip6_route_net_exit(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
         proc_net_remove(net, "ipv6_route");
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 976e68244b99..10207cc8cc0e 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -62,7 +62,6 @@
 #define HASH_SIZE  16
 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 
-static void ipip6_fb_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_setup(struct net_device *dev);
 
@@ -1120,7 +1119,7 @@ static void ipip6_tunnel_init(struct net_device *dev)
         ipip6_tunnel_bind_dev(dev);
 }
 
-static void ipip6_fb_tunnel_init(struct net_device *dev)
+static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct iphdr *iph = &tunnel->parms.iph;
@@ -1145,7 +1144,7 @@ static struct xfrm_tunnel sit_handler = {
         .priority       =       1,
 };
 
-static void sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
+static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
 {
         int prio;
 
@@ -1162,7 +1161,7 @@ static void sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
         }
 }
 
-static int sit_init_net(struct net *net)
+static int __net_init sit_init_net(struct net *net)
 {
         struct sit_net *sitn = net_generic(net, sit_net_id);
         int err;
@@ -1195,7 +1194,7 @@ err_alloc_dev:
         return err;
 }
 
-static void sit_exit_net(struct net *net)
+static void __net_exit sit_exit_net(struct net *net)
 {
         struct sit_net *sitn = net_generic(net, sit_net_id);
         LIST_HEAD(list);
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 7208a06576c6..34d1f0690d7e 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -269,7 +269,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
         tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                   &req->rcv_wnd, &req->window_clamp,
-                                  ireq->wscale_ok, &rcv_wscale);
+                                  ireq->wscale_ok, &rcv_wscale,
+                                  dst_metric(dst, RTAX_INITRWND));
 
         ireq->rcv_wscale = rcv_wscale;
 
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index c690736885b4..f841d93bf987 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -55,7 +55,7 @@ struct ctl_path net_ipv6_ctl_path[] = {
 };
 EXPORT_SYMBOL_GPL(net_ipv6_ctl_path);
 
-static int ipv6_sysctl_net_init(struct net *net)
+static int __net_init ipv6_sysctl_net_init(struct net *net)
 {
         struct ctl_table *ipv6_table;
         struct ctl_table *ipv6_route_table;
@@ -98,7 +98,7 @@ out_ipv6_table:
         goto out;
 }
 
-static void ipv6_sysctl_net_exit(struct net *net)
+static void __net_exit ipv6_sysctl_net_exit(struct net *net)
 {
         struct ctl_table *ipv6_table;
         struct ctl_table *ipv6_route_table;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index febfd595a40d..6963a6b6763e 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -520,6 +520,13 @@ done:
         return err;
 }
 
+static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
+                             struct request_values *rvp)
+{
+        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
+        return tcp_v6_send_synack(sk, req, rvp);
+}
+
 static inline void syn_flood_warning(struct sk_buff *skb)
 {
 #ifdef CONFIG_SYN_COOKIES
@@ -876,7 +883,7 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 
         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
                 if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash %s for (%pI6, %u)->(%pI6, %u)\n",
+                        printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
                                genhash ? "failed" : "mismatch",
                                &ip6h->saddr, ntohs(th->source),
                                &ip6h->daddr, ntohs(th->dest));
@@ -890,10 +897,11 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
         .family         =       AF_INET6,
         .obj_size       =       sizeof(struct tcp6_request_sock),
-        .rtx_syn_ack    =       tcp_v6_send_synack,
+        .rtx_syn_ack    =       tcp_v6_rtx_synack,
         .send_ack       =       tcp_v6_reqsk_send_ack,
         .destructor     =       tcp_v6_reqsk_destructor,
-        .send_reset     =       tcp_v6_send_reset
+        .send_reset     =       tcp_v6_send_reset,
+        .syn_ack_timeout =      tcp_syn_ack_timeout,
 };
 
 #ifdef CONFIG_TCP_MD5SIG
@@ -2105,7 +2113,7 @@ static struct tcp_seq_afinfo tcp6_seq_afinfo = {
         },
 };
 
-int tcp6_proc_init(struct net *net)
+int __net_init tcp6_proc_init(struct net *net)
 {
         return tcp_proc_register(net, &tcp6_seq_afinfo);
 }
@@ -2174,18 +2182,18 @@ static struct inet_protosw tcpv6_protosw = {
                                 INET_PROTOSW_ICSK,
 };
 
-static int tcpv6_net_init(struct net *net)
+static int __net_init tcpv6_net_init(struct net *net)
 {
         return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
                                     SOCK_RAW, IPPROTO_TCP, net);
 }
 
-static void tcpv6_net_exit(struct net *net)
+static void __net_exit tcpv6_net_exit(struct net *net)
 {
         inet_ctl_sock_destroy(net->ipv6.tcp_sk);
 }
 
-static void tcpv6_net_exit_batch(struct list_head *net_exit_list)
+static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
 {
         inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
 }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 69ebdbe78c47..34efb3589ffa 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1396,7 +1396,7 @@ static struct udp_seq_afinfo udp6_seq_afinfo = {
         },
 };
 
-int udp6_proc_init(struct net *net)
+int __net_init udp6_proc_init(struct net *net)
 {
         return udp_proc_register(net, &udp6_seq_afinfo);
 }
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 6ea6938919e6..5f48fadc27f7 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -104,12 +104,12 @@ static struct udp_seq_afinfo udplite6_seq_afinfo = {
         },
 };
 
-static int udplite6_proc_init_net(struct net *net)
+static int __net_init udplite6_proc_init_net(struct net *net)
 {
         return udp_proc_register(net, &udplite6_seq_afinfo);
 }
 
-static void udplite6_proc_exit_net(struct net *net)
+static void __net_exit udplite6_proc_exit_net(struct net *net)
 {
         udp_proc_unregister(net, &udplite6_seq_afinfo);
 }
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 811984d9324b..8b85d774e47f 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -496,9 +496,6 @@ static void ircomm_tty_close(struct tty_struct *tty, struct file *filp)
 
         IRDA_DEBUG(0, "%s()\n", __func__ );
 
-        if (!tty)
-                return;
-
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRCOMM_TTY_MAGIC, return;);
 
@@ -1007,9 +1004,6 @@ static void ircomm_tty_hangup(struct tty_struct *tty)
         IRDA_ASSERT(self != NULL, return;);
         IRDA_ASSERT(self->magic == IRCOMM_TTY_MAGIC, return;);
 
-        if (!tty)
-                return;
-
         /* ircomm_tty_flush_buffer(tty); */
         ircomm_tty_shutdown(self);
 
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 76fa6fef6473..4744b1f6372f 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3738,17 +3738,17 @@ static int __net_init pfkey_init_proc(struct net *net)
         return 0;
 }
 
-static void pfkey_exit_proc(struct net *net)
+static void __net_exit pfkey_exit_proc(struct net *net)
 {
         proc_net_remove(net, "pfkey");
 }
 #else
-static int __net_init pfkey_init_proc(struct net *net)
+static inline int pfkey_init_proc(struct net *net)
 {
         return 0;
 }
 
-static void pfkey_exit_proc(struct net *net)
+static inline void pfkey_exit_proc(struct net *net)
 {
 }
 #endif
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 3a66546cad06..e35d907fba2c 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -47,6 +47,10 @@ static int llc_ui_wait_for_busy_core(struct sock *sk, long timeout);
 #define dprintk(args...)
 #endif
 
+/* Maybe we'll add some more in the future. */
+#define LLC_CMSG_PKTINFO        1
+
+
 /**
  *      llc_ui_next_link_no - return the next unused link number for a sap
  *      @sap: Address of sap to get link number from.
@@ -136,6 +140,7 @@ static struct proto llc_proto = {
         .name     = "LLC",
         .owner    = THIS_MODULE,
         .obj_size = sizeof(struct llc_sock),
+        .slab_flags = SLAB_DESTROY_BY_RCU,
 };
 
 /**
@@ -192,10 +197,8 @@ static int llc_ui_release(struct socket *sock)
                 llc->laddr.lsap, llc->daddr.lsap);
         if (!llc_send_disc(sk))
                 llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
-        if (!sock_flag(sk, SOCK_ZAPPED)) {
-                llc_sap_put(llc->sap);
+        if (!sock_flag(sk, SOCK_ZAPPED))
                 llc_sap_remove_socket(llc->sap, sk);
-        }
         release_sock(sk);
         if (llc->dev)
                 dev_put(llc->dev);
@@ -255,7 +258,14 @@ static int llc_ui_autobind(struct socket *sock, struct sockaddr_llc *addr)
         if (!sock_flag(sk, SOCK_ZAPPED))
                 goto out;
         rc = -ENODEV;
-        llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
+        if (sk->sk_bound_dev_if) {
+                llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+                if (llc->dev && addr->sllc_arphrd != llc->dev->type) {
+                        dev_put(llc->dev);
+                        llc->dev = NULL;
+                }
+        } else
+                llc->dev = dev_getfirstbyhwtype(&init_net, addr->sllc_arphrd);
         if (!llc->dev)
                 goto out;
         rc = -EUSERS;
@@ -306,7 +316,25 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 goto out;
         rc = -ENODEV;
         rtnl_lock();
-        llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd, addr->sllc_mac);
+        if (sk->sk_bound_dev_if) {
+                llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if);
+                if (llc->dev) {
+                        if (!addr->sllc_arphrd)
+                                addr->sllc_arphrd = llc->dev->type;
+                        if (llc_mac_null(addr->sllc_mac))
+                                memcpy(addr->sllc_mac, llc->dev->dev_addr,
+                                       IFHWADDRLEN);
+                        if (addr->sllc_arphrd != llc->dev->type ||
+                            !llc_mac_match(addr->sllc_mac,
+                                           llc->dev->dev_addr)) {
+                                rc = -EINVAL;
+                                dev_put(llc->dev);
+                                llc->dev = NULL;
+                        }
+                }
+        } else
+                llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd,
+                                           addr->sllc_mac);
         rtnl_unlock();
         if (!llc->dev)
                 goto out;
@@ -322,7 +350,6 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
                 rc = -EBUSY; /* some other network layer is using the sap */
                 if (!sap)
                         goto out;
-                llc_sap_hold(sap);
         } else {
                 struct llc_addr laddr, daddr;
                 struct sock *ask;
@@ -591,6 +618,20 @@ static int llc_wait_data(struct sock *sk, long timeo)
         return rc;
 }
 
+static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb)
+{
+        struct llc_sock *llc = llc_sk(skb->sk);
+
+        if (llc->cmsg_flags & LLC_CMSG_PKTINFO) {
+                struct llc_pktinfo info;
+
+                info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex;
+                llc_pdu_decode_dsap(skb, &info.lpi_sap);
+                llc_pdu_decode_da(skb, info.lpi_mac);
+                put_cmsg(msg, SOL_LLC, LLC_OPT_PKTINFO, sizeof(info), &info);
+        }
+}
+
 /**
  *      llc_ui_accept - accept a new incoming connection.
  *      @sock: Socket which connections arrive on.
@@ -812,6 +853,8 @@ copy_uaddr:
                 memcpy(uaddr, llc_ui_skb_cb(skb), sizeof(*uaddr));
                 msg->msg_namelen = sizeof(*uaddr);
         }
+        if (llc_sk(sk)->cmsg_flags)
+                llc_cmsg_rcv(msg, skb);
         goto out;
 }
 
@@ -1030,6 +1073,12 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
                         goto out;
                 llc->rw = opt;
                 break;
+        case LLC_OPT_PKTINFO:
+                if (opt)
+                        llc->cmsg_flags |= LLC_CMSG_PKTINFO;
+                else
+                        llc->cmsg_flags &= ~LLC_CMSG_PKTINFO;
+                break;
         default:
                 rc = -ENOPROTOOPT;
                 goto out;
@@ -1083,6 +1132,9 @@ static int llc_ui_getsockopt(struct socket *sock, int level, int optname,
                 val = llc->k;                           break;
         case LLC_OPT_RX_WIN:
                 val = llc->rw;                          break;
+        case LLC_OPT_PKTINFO:
+                val = (llc->cmsg_flags & LLC_CMSG_PKTINFO) != 0;
+                break;
         default:
                 rc = -ENOPROTOOPT;
                 goto out;
diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
index c6bab39b018e..a8dde9b010da 100644
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -468,6 +468,19 @@ static int llc_exec_conn_trans_actions(struct sock *sk,
         return rc;
 }
 
+static inline bool llc_estab_match(const struct llc_sap *sap,
+                                   const struct llc_addr *daddr,
+                                   const struct llc_addr *laddr,
+                                   const struct sock *sk)
+{
+        struct llc_sock *llc = llc_sk(sk);
+
+        return llc->laddr.lsap == laddr->lsap &&
+                llc->daddr.lsap == daddr->lsap &&
+                llc_mac_match(llc->laddr.mac, laddr->mac) &&
+                llc_mac_match(llc->daddr.mac, daddr->mac);
+}
+
 /**
  *      __llc_lookup_established - Finds connection for the remote/local sap/mac
  *      @sap: SAP
@@ -484,23 +497,35 @@ static struct sock *__llc_lookup_established(struct llc_sap *sap,
                                              struct llc_addr *laddr)
 {
         struct sock *rc;
-        struct hlist_node *node;
-
-        read_lock(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
-
-                if (llc->laddr.lsap == laddr->lsap &&
-                    llc->daddr.lsap == daddr->lsap &&
-                    llc_mac_match(llc->laddr.mac, laddr->mac) &&
-                    llc_mac_match(llc->daddr.mac, daddr->mac)) {
-                        sock_hold(rc);
+        struct hlist_nulls_node *node;
+        int slot = llc_sk_laddr_hashfn(sap, laddr);
+        struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
+
+        rcu_read_lock();
+again:
+        sk_nulls_for_each_rcu(rc, node, laddr_hb) {
+                if (llc_estab_match(sap, daddr, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_estab_match(sap, daddr, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
                         goto found;
                 }
         }
         rc = NULL;
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (unlikely(get_nulls_value(node) != slot))
+                goto again;
 found:
-        read_unlock(&sap->sk_list.lock);
+        rcu_read_unlock();
         return rc;
 }
 
@@ -516,6 +541,53 @@ struct sock *llc_lookup_established(struct llc_sap *sap,
         return sk;
 }
 
+static inline bool llc_listener_match(const struct llc_sap *sap,
+                                      const struct llc_addr *laddr,
+                                      const struct sock *sk)
+{
+        struct llc_sock *llc = llc_sk(sk);
+
+        return sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN &&
+                llc->laddr.lsap == laddr->lsap &&
+                llc_mac_match(llc->laddr.mac, laddr->mac);
+}
+
+static struct sock *__llc_lookup_listener(struct llc_sap *sap,
+                                          struct llc_addr *laddr)
+{
+        struct sock *rc;
+        struct hlist_nulls_node *node;
+        int slot = llc_sk_laddr_hashfn(sap, laddr);
+        struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
+
+        rcu_read_lock();
+again:
+        sk_nulls_for_each_rcu(rc, node, laddr_hb) {
+                if (llc_listener_match(sap, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_listener_match(sap, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
+                        goto found;
+                }
+        }
+        rc = NULL;
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (unlikely(get_nulls_value(node) != slot))
+                goto again;
+found:
+        rcu_read_unlock();
+        return rc;
+}
+
 /**
  *      llc_lookup_listener - Finds listener for local MAC + SAP
  *      @sap: SAP
@@ -529,24 +601,12 @@ struct sock *llc_lookup_established(struct llc_sap *sap,
 static struct sock *llc_lookup_listener(struct llc_sap *sap,
                                         struct llc_addr *laddr)
 {
-        struct sock *rc;
-        struct hlist_node *node;
+        static struct llc_addr null_addr;
+        struct sock *rc = __llc_lookup_listener(sap, laddr);
 
-        read_lock(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
+        if (!rc)
+                rc = __llc_lookup_listener(sap, &null_addr);
 
-                if (rc->sk_type == SOCK_STREAM && rc->sk_state == TCP_LISTEN &&
-                    llc->laddr.lsap == laddr->lsap &&
-                    (llc_mac_match(llc->laddr.mac, laddr->mac) ||
-                     llc_mac_null(llc->laddr.mac))) {
-                        sock_hold(rc);
-                        goto found;
-                }
-        }
-        rc = NULL;
-found:
-        read_unlock(&sap->sk_list.lock);
         return rc;
 }
 
@@ -647,15 +707,22 @@ static int llc_find_offset(int state, int ev_type)
  *      @sap: SAP
  *      @sk: socket
  *
- *      This function adds a socket to sk_list of a SAP.
+ *      This function adds a socket to the hash tables of a SAP.
  */
 void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk)
 {
+        struct llc_sock *llc = llc_sk(sk);
+        struct hlist_head *dev_hb = llc_sk_dev_hash(sap, llc->dev->ifindex);
+        struct hlist_nulls_head *laddr_hb = llc_sk_laddr_hash(sap, &llc->laddr);
+
         llc_sap_hold(sap);
-        write_lock_bh(&sap->sk_list.lock);
         llc_sk(sk)->sap = sap;
-        sk_add_node(sk, &sap->sk_list.list);
-        write_unlock_bh(&sap->sk_list.lock);
+
+        spin_lock_bh(&sap->sk_lock);
+        sap->sk_count++;
+        sk_nulls_add_node_rcu(sk, laddr_hb);
+        hlist_add_head(&llc->dev_hash_node, dev_hb);
+        spin_unlock_bh(&sap->sk_lock);
 }
 
 /**
@@ -663,14 +730,18 @@ void llc_sap_add_socket(struct llc_sap *sap, struct sock *sk)
  *      @sap: SAP
  *      @sk: socket
  *
- *      This function removes a connection from sk_list.list of a SAP if
+ *      This function removes a connection from the hash tables of a SAP if
  *      the connection was in this list.
  */
 void llc_sap_remove_socket(struct llc_sap *sap, struct sock *sk)
 {
-        write_lock_bh(&sap->sk_list.lock);
-        sk_del_node_init(sk);
-        write_unlock_bh(&sap->sk_list.lock);
+        struct llc_sock *llc = llc_sk(sk);
+
+        spin_lock_bh(&sap->sk_lock);
+        sk_nulls_del_node_init_rcu(sk);
+        hlist_del(&llc->dev_hash_node);
+        sap->sk_count--;
+        spin_unlock_bh(&sap->sk_lock);
         llc_sap_put(sap);
 }
 
diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c
index ff4c0ab96a69..78167e81dfeb 100644
--- a/net/llc/llc_core.c
+++ b/net/llc/llc_core.c
@@ -23,7 +23,7 @@
 #include <net/llc.h>
 
 LIST_HEAD(llc_sap_list);
-DEFINE_RWLOCK(llc_sap_list_lock);
+DEFINE_SPINLOCK(llc_sap_list_lock);
 
 /**
  *      llc_sap_alloc - allocates and initializes sap.
@@ -33,40 +33,19 @@ DEFINE_RWLOCK(llc_sap_list_lock);
 static struct llc_sap *llc_sap_alloc(void)
 {
         struct llc_sap *sap = kzalloc(sizeof(*sap), GFP_ATOMIC);
+        int i;
 
         if (sap) {
                 /* sap->laddr.mac - leave as a null, it's filled by bind */
                 sap->state = LLC_SAP_STATE_ACTIVE;
-                rwlock_init(&sap->sk_list.lock);
+                spin_lock_init(&sap->sk_lock);
+                for (i = 0; i < LLC_SK_LADDR_HASH_ENTRIES; i++)
+                        INIT_HLIST_NULLS_HEAD(&sap->sk_laddr_hash[i], i);
                 atomic_set(&sap->refcnt, 1);
         }
         return sap;
 }
 
-/**
- *      llc_add_sap - add sap to station list
- *      @sap: Address of the sap
- *
- *      Adds a sap to the LLC's station sap list.
- */
-static void llc_add_sap(struct llc_sap *sap)
-{
-        list_add_tail(&sap->node, &llc_sap_list);
-}
-
-/**
- *      llc_del_sap - del sap from station list
- *      @sap: Address of the sap
- *
- *      Removes a sap to the LLC's station sap list.
- */
-static void llc_del_sap(struct llc_sap *sap)
-{
-        write_lock_bh(&llc_sap_list_lock);
-        list_del(&sap->node);
-        write_unlock_bh(&llc_sap_list_lock);
-}
-
 static struct llc_sap *__llc_sap_find(unsigned char sap_value)
 {
         struct llc_sap* sap;
@@ -90,13 +69,13 @@ out:
  */
 struct llc_sap *llc_sap_find(unsigned char sap_value)
 {
-        struct llc_sap* sap;
+        struct llc_sap *sap;
 
-        read_lock_bh(&llc_sap_list_lock);
+        rcu_read_lock_bh();
         sap = __llc_sap_find(sap_value);
         if (sap)
                 llc_sap_hold(sap);
-        read_unlock_bh(&llc_sap_list_lock);
+        rcu_read_unlock_bh();
         return sap;
 }
 
@@ -117,7 +96,7 @@ struct llc_sap *llc_sap_open(unsigned char lsap,
 {
         struct llc_sap *sap = NULL;
 
-        write_lock_bh(&llc_sap_list_lock);
+        spin_lock_bh(&llc_sap_list_lock);
         if (__llc_sap_find(lsap)) /* SAP already exists */
                 goto out;
         sap = llc_sap_alloc();
@@ -125,9 +104,9 @@ struct llc_sap *llc_sap_open(unsigned char lsap,
                 goto out;
         sap->laddr.lsap = lsap;
         sap->rcv_func   = func;
-        llc_add_sap(sap);
+        list_add_tail_rcu(&sap->node, &llc_sap_list);
 out:
-        write_unlock_bh(&llc_sap_list_lock);
+        spin_unlock_bh(&llc_sap_list_lock);
         return sap;
 }
 
@@ -142,8 +121,14 @@ out:
  */
 void llc_sap_close(struct llc_sap *sap)
 {
-        WARN_ON(!hlist_empty(&sap->sk_list.list));
-        llc_del_sap(sap);
+        WARN_ON(sap->sk_count);
+
+        spin_lock_bh(&llc_sap_list_lock);
+        list_del_rcu(&sap->node);
+        spin_unlock_bh(&llc_sap_list_lock);
+
+        synchronize_rcu();
+
         kfree(sap);
 }
 
diff --git a/net/llc/llc_output.c b/net/llc/llc_output.c
index 754f4fedc852..b38a1079a98e 100644
--- a/net/llc/llc_output.c
+++ b/net/llc/llc_output.c
@@ -33,48 +33,19 @@
 int llc_mac_hdr_init(struct sk_buff *skb,
                      const unsigned char *sa, const unsigned char *da)
 {
-        int rc = 0;
+        int rc = -EINVAL;
 
         switch (skb->dev->type) {
-#ifdef CONFIG_TR
-        case ARPHRD_IEEE802_TR: {
-                struct net_device *dev = skb->dev;
-                struct trh_hdr *trh;
-
-                skb_push(skb, sizeof(*trh));
-                skb_reset_mac_header(skb);
-                trh = tr_hdr(skb);
-                trh->ac = AC;
-                trh->fc = LLC_FRAME;
-                if (sa)
-                        memcpy(trh->saddr, sa, dev->addr_len);
-                else
-                        memset(trh->saddr, 0, dev->addr_len);
-                if (da) {
-                        memcpy(trh->daddr, da, dev->addr_len);
-                        tr_source_route(skb, trh, dev);
-                        skb_reset_mac_header(skb);
-                }
-                break;
-        }
-#endif
+        case ARPHRD_IEEE802_TR:
         case ARPHRD_ETHER:
-        case ARPHRD_LOOPBACK: {
-                unsigned short len = skb->len;
-                struct ethhdr *eth;
-
-                skb_push(skb, sizeof(*eth));
-                skb_reset_mac_header(skb);
-                eth = eth_hdr(skb);
-                eth->h_proto = htons(len);
-                memcpy(eth->h_dest, da, ETH_ALEN);
-                memcpy(eth->h_source, sa, ETH_ALEN);
+        case ARPHRD_LOOPBACK:
+                rc = dev_hard_header(skb, skb->dev, ETH_P_802_2, da, sa,
+                                     skb->len);
+                if (rc > 0)
+                        rc = 0;
                 break;
-        }
         default:
-                printk(KERN_WARNING "device type not supported: %d\n",
-                       skb->dev->type);
-                rc = -EINVAL;
+                WARN(1, "device type not supported: %d\n", skb->dev->type);
         }
         return rc;
 }
diff --git a/net/llc/llc_proc.c b/net/llc/llc_proc.c
index be47ac427f6b..7af1ff2d1f19 100644
--- a/net/llc/llc_proc.c
+++ b/net/llc/llc_proc.c
@@ -32,21 +32,23 @@ static void llc_ui_format_mac(struct seq_file *seq, u8 *addr)
 
 static struct sock *llc_get_sk_idx(loff_t pos)
 {
-        struct list_head *sap_entry;
         struct llc_sap *sap;
-        struct hlist_node *node;
         struct sock *sk = NULL;
-
-        list_for_each(sap_entry, &llc_sap_list) {
-                sap = list_entry(sap_entry, struct llc_sap, node);
-
-                read_lock_bh(&sap->sk_list.lock);
-                sk_for_each(sk, node, &sap->sk_list.list) {
-                        if (!pos)
-                                goto found;
-                        --pos;
+        int i;
+
+        list_for_each_entry_rcu(sap, &llc_sap_list, node) {
+                spin_lock_bh(&sap->sk_lock);
+                for (i = 0; i < LLC_SK_LADDR_HASH_ENTRIES; i++) {
+                        struct hlist_nulls_head *head = &sap->sk_laddr_hash[i];
+                        struct hlist_nulls_node *node;
+
+                        sk_nulls_for_each(sk, node, head) {
+                                if (!pos)
+                                        goto found; /* keep the lock */
+                                --pos;
+                        }
                 }
-                read_unlock_bh(&sap->sk_list.lock);
+                spin_unlock_bh(&sap->sk_lock);
         }
         sk = NULL;
 found:
@@ -57,10 +59,23 @@ static void *llc_seq_start(struct seq_file *seq, loff_t *pos)
 {
         loff_t l = *pos;
 
-        read_lock_bh(&llc_sap_list_lock);
+        rcu_read_lock_bh();
         return l ? llc_get_sk_idx(--l) : SEQ_START_TOKEN;
 }
 
+static struct sock *laddr_hash_next(struct llc_sap *sap, int bucket)
+{
+        struct hlist_nulls_node *node;
+        struct sock *sk = NULL;
+
+        while (++bucket < LLC_SK_LADDR_HASH_ENTRIES)
+                sk_nulls_for_each(sk, node, &sap->sk_laddr_hash[bucket])
+                        goto out;
+
+out:
+        return sk;
+}
+
 static void *llc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct sock* sk, *next;
@@ -73,25 +88,23 @@ static void *llc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
                 goto out;
         }
         sk = v;
-        next = sk_next(sk);
+        next = sk_nulls_next(sk);
         if (next) {
                 sk = next;
                 goto out;
         }
         llc = llc_sk(sk);
         sap = llc->sap;
-        read_unlock_bh(&sap->sk_list.lock);
-        sk = NULL;
-        for (;;) {
-                if (sap->node.next == &llc_sap_list)
-                        break;
-                sap = list_entry(sap->node.next, struct llc_sap, node);
-                read_lock_bh(&sap->sk_list.lock);
-                if (!hlist_empty(&sap->sk_list.list)) {
-                        sk = sk_head(&sap->sk_list.list);
-                        break;
-                }
-                read_unlock_bh(&sap->sk_list.lock);
+        sk = laddr_hash_next(sap, llc_sk_laddr_hashfn(sap, &llc->laddr));
+        if (sk)
+                goto out;
+        spin_unlock_bh(&sap->sk_lock);
+        list_for_each_entry_continue_rcu(sap, &llc_sap_list, node) {
+                spin_lock_bh(&sap->sk_lock);
+                sk = laddr_hash_next(sap, -1);
+                if (sk)
+                        break; /* keep the lock */
+                spin_unlock_bh(&sap->sk_lock);
         }
 out:
         return sk;
@@ -104,9 +117,9 @@ static void llc_seq_stop(struct seq_file *seq, void *v)
                 struct llc_sock *llc = llc_sk(sk);
                 struct llc_sap *sap = llc->sap;
 
-                read_unlock_bh(&sap->sk_list.lock);
+                spin_unlock_bh(&sap->sk_lock);
         }
-        read_unlock_bh(&llc_sap_list_lock);
+        rcu_read_unlock_bh();
 }
 
 static int llc_seq_socket_show(struct seq_file *seq, void *v)
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index 008de1fc42ca..ad6e6e1cf22f 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -297,6 +297,17 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb,
         llc_sap_state_process(sap, skb);
 }
 
+static inline bool llc_dgram_match(const struct llc_sap *sap,
+                                   const struct llc_addr *laddr,
+                                   const struct sock *sk)
+{
+     struct llc_sock *llc = llc_sk(sk);
+
+     return sk->sk_type == SOCK_DGRAM &&
+          llc->laddr.lsap == laddr->lsap &&
+          llc_mac_match(llc->laddr.mac, laddr->mac);
+}
+
 /**
  *      llc_lookup_dgram - Finds dgram socket for the local sap/mac
  *      @sap: SAP
@@ -309,25 +320,68 @@ static struct sock *llc_lookup_dgram(struct llc_sap *sap,
                                      const struct llc_addr *laddr)
 {
         struct sock *rc;
-        struct hlist_node *node;
-
-        read_lock_bh(&sap->sk_list.lock);
-        sk_for_each(rc, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(rc);
-
-                if (rc->sk_type == SOCK_DGRAM &&
-                    llc->laddr.lsap == laddr->lsap &&
-                    llc_mac_match(llc->laddr.mac, laddr->mac)) {
-                        sock_hold(rc);
+        struct hlist_nulls_node *node;
+        int slot = llc_sk_laddr_hashfn(sap, laddr);
+        struct hlist_nulls_head *laddr_hb = &sap->sk_laddr_hash[slot];
+
+        rcu_read_lock_bh();
+again:
+        sk_nulls_for_each_rcu(rc, node, laddr_hb) {
+                if (llc_dgram_match(sap, laddr, rc)) {
+                        /* Extra checks required by SLAB_DESTROY_BY_RCU */
+                        if (unlikely(!atomic_inc_not_zero(&rc->sk_refcnt)))
+                                goto again;
+                        if (unlikely(llc_sk(rc)->sap != sap ||
+                                     !llc_dgram_match(sap, laddr, rc))) {
+                                sock_put(rc);
+                                continue;
+                        }
                         goto found;
                 }
         }
         rc = NULL;
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (unlikely(get_nulls_value(node) != slot))
+                goto again;
 found:
-        read_unlock_bh(&sap->sk_list.lock);
+        rcu_read_unlock_bh();
         return rc;
 }
 
+static inline bool llc_mcast_match(const struct llc_sap *sap,
+                                   const struct llc_addr *laddr,
+                                   const struct sk_buff *skb,
+                                   const struct sock *sk)
+{
+     struct llc_sock *llc = llc_sk(sk);
+
+     return sk->sk_type == SOCK_DGRAM &&
+          llc->laddr.lsap == laddr->lsap &&
+          llc->dev == skb->dev;
+}
+
+static void llc_do_mcast(struct llc_sap *sap, struct sk_buff *skb,
+                         struct sock **stack, int count)
+{
+        struct sk_buff *skb1;
+        int i;
+
+        for (i = 0; i < count; i++) {
+                skb1 = skb_clone(skb, GFP_ATOMIC);
+                if (!skb1) {
+                        sock_put(stack[i]);
+                        continue;
+                }
+
+                llc_sap_rcv(sap, skb1, stack[i]);
+                sock_put(stack[i]);
+        }
+}
+
 /**
  *      llc_sap_mcast - Deliver multicast PDU's to all matching datagram sockets.
  *      @sap: SAP
@@ -340,32 +394,31 @@ static void llc_sap_mcast(struct llc_sap *sap,
                           const struct llc_addr *laddr,
                           struct sk_buff *skb)
 {
-        struct sock *sk;
+        int i = 0, count = 256 / sizeof(struct sock *);
+        struct sock *sk, *stack[count];
         struct hlist_node *node;
+        struct llc_sock *llc;
+        struct hlist_head *dev_hb = llc_sk_dev_hash(sap, skb->dev->ifindex);
 
-        read_lock_bh(&sap->sk_list.lock);
-        sk_for_each(sk, node, &sap->sk_list.list) {
-                struct llc_sock *llc = llc_sk(sk);
-                struct sk_buff *skb1;
+        spin_lock_bh(&sap->sk_lock);
+        hlist_for_each_entry(llc, node, dev_hb, dev_hash_node) {
 
-                if (sk->sk_type != SOCK_DGRAM)
-                        continue;
+                sk = &llc->sk;
 
-                if (llc->laddr.lsap != laddr->lsap)
+                if (!llc_mcast_match(sap, laddr, skb, sk))
                         continue;
 
-                if (llc->dev != skb->dev)
-                        continue;
-
-                skb1 = skb_clone(skb, GFP_ATOMIC);
-                if (!skb1)
-                        break;
-
                 sock_hold(sk);
-                llc_sap_rcv(sap, skb1, sk);
-                sock_put(sk);
+                if (i < count)
+                        stack[i++] = sk;
+                else {
+                        llc_do_mcast(sap, skb, stack, i);
+                        i = 0;
+                }
         }
-        read_unlock_bh(&sap->sk_list.lock);
+        spin_unlock_bh(&sap->sk_lock);
+
+        llc_do_mcast(sap, skb, stack, i);
 }
 
 
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index a10d508b07e1..a952b7f8c648 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -96,18 +96,6 @@ menuconfig MAC80211_DEBUG_MENU
         ---help---
           This option collects various mac80211 debug settings.
 
-config MAC80211_DEBUG_PACKET_ALIGNMENT
-        bool "Enable packet alignment debugging"
-        depends on MAC80211_DEBUG_MENU
-        ---help---
-          This option is recommended for driver authors and strongly
-          discouraged for everybody else, it will trigger a warning
-          when a driver hands mac80211 a buffer that is aligned in
-          a way that will cause problems with the IP stack on some
-          architectures.
-
-          Say N unless you're writing a mac80211 based driver.
-
 config MAC80211_NOINLINE
         bool "Do not inline TX/RX handlers"
         depends on MAC80211_DEBUG_MENU
diff --git a/net/mac80211/Makefile b/net/mac80211/Makefile
index 298cfcc1bf8d..04420291e7ad 100644
--- a/net/mac80211/Makefile
+++ b/net/mac80211/Makefile
@@ -6,10 +6,10 @@ mac80211-y := \
         sta_info.o \
         wep.o \
         wpa.o \
-        scan.o \
+        scan.o offchannel.o \
         ht.o agg-tx.o agg-rx.o \
         ibss.o \
-        mlme.o \
+        mlme.o work.o \
         iface.o \
         rate.o \
         michael.o \
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 51c7dc3c4c3b..a978e666ed6f 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -41,8 +41,7 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
                sta->sta.addr, tid);
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
-        if (drv_ampdu_action(local, &sta->sdata->vif,
-                             IEEE80211_AMPDU_RX_STOP,
+        if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP,
                              &sta->sta, tid, NULL))
                 printk(KERN_DEBUG "HW problem - can not stop rx "
                                 "aggregation for tid %d\n", tid);
@@ -83,12 +82,11 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid,
                                         u16 initiator, u16 reason)
 {
-        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, ra);
+        sta = sta_info_get(sdata, ra);
         if (!sta) {
                 rcu_read_unlock();
                 return;
@@ -136,7 +134,7 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
 
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer "
-                       "for addba resp frame\n", sdata->dev->name);
+                       "for addba resp frame\n", sdata->name);
                 return;
         }
 
@@ -144,10 +142,10 @@ static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *d
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
 
@@ -281,8 +279,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
                 goto end;
         }
 
-        ret = drv_ampdu_action(local, &sta->sdata->vif,
-                               IEEE80211_AMPDU_RX_START,
+        ret = drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_START,
                                &sta->sta, tid, &start_seq_num);
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "Rx A-MPDU request on tid %d result %d\n", tid, ret);
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 5e3a7eccef5a..718fbcff84d2 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -58,17 +58,17 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
 
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer "
-                                "for addba request frame\n", sdata->dev->name);
+                                "for addba request frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
 
@@ -104,7 +104,7 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         skb = dev_alloc_skb(sizeof(*bar) + local->hw.extra_tx_headroom);
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer for "
-                        "bar frame\n", sdata->dev->name);
+                        "bar frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
@@ -113,7 +113,7 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
         bar->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
                                          IEEE80211_STYPE_BACK_REQ);
         memcpy(bar->ra, ra, ETH_ALEN);
-        memcpy(bar->ta, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(bar->ta, sdata->vif.addr, ETH_ALEN);
         bar_control |= (u16)IEEE80211_BAR_CTRL_ACK_POLICY_NORMAL;
         bar_control |= (u16)IEEE80211_BAR_CTRL_CBMTID_COMPRESSED_BA;
         bar_control |= (u16)(tid << 12);
@@ -144,7 +144,7 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
         *state = HT_AGG_STATE_REQ_STOP_BA_MSK |
                 (initiator << HT_AGG_STATE_INITIATOR_SHIFT);
 
-        ret = drv_ampdu_action(local, &sta->sdata->vif,
+        ret = drv_ampdu_action(local, sta->sdata,
                                IEEE80211_AMPDU_TX_STOP,
                                &sta->sta, tid, NULL);
 
@@ -179,7 +179,8 @@ static void sta_addba_resp_timer_expired(unsigned long data)
 
         /* check if the TID waits for addBA response */
         spin_lock_bh(&sta->lock);
-        if ((*state & (HT_ADDBA_REQUESTED_MSK | HT_ADDBA_RECEIVED_MSK)) !=
+        if ((*state & (HT_ADDBA_REQUESTED_MSK | HT_ADDBA_RECEIVED_MSK |
+                       HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
                                                 HT_ADDBA_REQUESTED_MSK) {
                 spin_unlock_bh(&sta->lock);
                 *state = HT_AGG_STATE_IDLE;
@@ -301,10 +302,9 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid)
          * call back right away, it must see that the flow has begun */
         *state |= HT_ADDBA_REQUESTED_MSK;
 
-        start_seq_num = sta->tid_seq[tid];
+        start_seq_num = sta->tid_seq[tid] >> 4;
 
-        ret = drv_ampdu_action(local, &sdata->vif,
-                               IEEE80211_AMPDU_TX_START,
+        ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START,
                                pubsta, tid, &start_seq_num);
 
         if (ret) {
@@ -420,7 +420,7 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local,
         ieee80211_agg_splice_finish(local, sta, tid);
         spin_unlock(&local->ampdu_lock);
 
-        drv_ampdu_action(local, &sta->sdata->vif,
+        drv_ampdu_action(local, sta->sdata,
                          IEEE80211_AMPDU_TX_OPERATIONAL,
                          &sta->sta, tid, NULL);
 }
@@ -441,7 +441,7 @@ void ieee80211_start_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u16 tid)
         }
 
         rcu_read_lock();
-        sta = sta_info_get(local, ra);
+        sta = sta_info_get(sdata, ra);
         if (!sta) {
                 rcu_read_unlock();
 #ifdef CONFIG_MAC80211_HT_DEBUG
@@ -489,7 +489,7 @@ void ieee80211_start_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping start BA session", skb->dev->name);
+                               "dropping start BA session", sdata->name);
 #endif
                 return;
         }
@@ -564,7 +564,7 @@ void ieee80211_stop_tx_ba_cb(struct ieee80211_vif *vif, u8 *ra, u8 tid)
 #endif /* CONFIG_MAC80211_HT_DEBUG */
 
         rcu_read_lock();
-        sta = sta_info_get(local, ra);
+        sta = sta_info_get(sdata, ra);
         if (!sta) {
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "Could not find station: %pM\n", ra);
@@ -621,7 +621,7 @@ void ieee80211_stop_tx_ba_cb_irqsafe(struct ieee80211_vif *vif,
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 if (net_ratelimit())
                         printk(KERN_WARNING "%s: Not enough memory, "
-                               "dropping stop BA session", skb->dev->name);
+                               "dropping stop BA session", sdata->name);
 #endif
                 return;
         }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 9ae1a4760b58..facf233843e0 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -78,17 +78,15 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
                                   enum nl80211_iftype type, u32 *flags,
                                   struct vif_params *params)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         int ret;
 
-        if (netif_running(dev))
+        if (ieee80211_sdata_running(sdata))
                 return -EBUSY;
 
         if (!nl80211_params_check(type, params))
                 return -EINVAL;
 
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
         ret = ieee80211_if_change_type(sdata, type);
         if (ret)
                 return ret;
@@ -150,7 +148,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
         rcu_read_lock();
 
         if (mac_addr) {
-                sta = sta_info_get(sdata->local, mac_addr);
+                sta = sta_info_get_bss(sdata, mac_addr);
                 if (!sta) {
                         ieee80211_key_free(key);
                         err = -ENOENT;
@@ -181,7 +179,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
         if (mac_addr) {
                 ret = -ENOENT;
 
-                sta = sta_info_get(sdata->local, mac_addr);
+                sta = sta_info_get_bss(sdata, mac_addr);
                 if (!sta)
                         goto out_unlock;
 
@@ -228,7 +226,7 @@ static int ieee80211_get_key(struct wiphy *wiphy, struct net_device *dev,
         rcu_read_lock();
 
         if (mac_addr) {
-                sta = sta_info_get(sdata->local, mac_addr);
+                sta = sta_info_get_bss(sdata, mac_addr);
                 if (!sta)
                         goto out;
 
@@ -415,15 +413,13 @@ static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
 static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *mac, struct station_info *sinfo)
 {
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct sta_info *sta;
         int ret = -ENOENT;
 
         rcu_read_lock();
 
-        /* XXX: verify sta->dev == dev */
-
-        sta = sta_info_get(local, mac);
+        sta = sta_info_get_bss(sdata, mac);
         if (sta) {
                 ret = 0;
                 sta_set_sinfo(sta, sinfo);
@@ -732,7 +728,7 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         } else
                 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        if (compare_ether_addr(mac, dev->dev_addr) == 0)
+        if (compare_ether_addr(mac, sdata->vif.addr) == 0)
                 return -EINVAL;
 
         if (is_multicast_ether_addr(mac))
@@ -779,8 +775,7 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
         if (mac) {
                 rcu_read_lock();
 
-                /* XXX: get sta belonging to dev */
-                sta = sta_info_get(local, mac);
+                sta = sta_info_get_bss(sdata, mac);
                 if (!sta) {
                         rcu_read_unlock();
                         return -ENOENT;
@@ -801,14 +796,14 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                                     u8 *mac,
                                     struct station_parameters *params)
 {
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *vlansdata;
 
         rcu_read_lock();
 
-        /* XXX: get sta belonging to dev */
-        sta = sta_info_get(local, mac);
+        sta = sta_info_get_bss(sdata, mac);
         if (!sta) {
                 rcu_read_unlock();
                 return -ENOENT;
@@ -847,7 +842,6 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *dst, u8 *next_hop)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
         struct sta_info *sta;
@@ -856,7 +850,7 @@ static int ieee80211_add_mpath(struct wiphy *wiphy, struct net_device *dev,
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
         rcu_read_lock();
-        sta = sta_info_get(local, next_hop);
+        sta = sta_info_get(sdata, next_hop);
         if (!sta) {
                 rcu_read_unlock();
                 return -ENOENT;
@@ -895,7 +889,6 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
                                     struct net_device *dev,
                                     u8 *dst, u8 *next_hop)
 {
-        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_sub_if_data *sdata;
         struct mesh_path *mpath;
         struct sta_info *sta;
@@ -904,7 +897,7 @@ static int ieee80211_change_mpath(struct wiphy *wiphy,
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, next_hop);
+        sta = sta_info_get(sdata, next_hop);
         if (!sta) {
                 rcu_read_unlock();
                 return -ENOENT;
@@ -1092,6 +1085,13 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
                         params->use_short_preamble;
                 changed |= BSS_CHANGED_ERP_PREAMBLE;
         }
+
+        if (!sdata->vif.bss_conf.use_short_slot &&
+            sdata->local->hw.conf.channel->band == IEEE80211_BAND_5GHZ) {
+                sdata->vif.bss_conf.use_short_slot = true;
+                changed |= BSS_CHANGED_ERP_SLOT;
+        }
+
         if (params->use_short_slot_time >= 0) {
                 sdata->vif.bss_conf.use_short_slot =
                         params->use_short_slot_time;
@@ -1135,6 +1135,13 @@ static int ieee80211_set_txq_params(struct wiphy *wiphy,
         p.cw_max = params->cwmax;
         p.cw_min = params->cwmin;
         p.txop = params->txop;
+
+        /*
+         * Setting tx queue params disables u-apsd because it's only
+         * called in master mode.
+         */
+        p.uapsd = false;
+
         if (drv_conf_tx(local, params->queue, &p)) {
                 printk(KERN_DEBUG "%s: failed to set TX queue "
                        "parameters for queue %d\n",
@@ -1237,6 +1244,13 @@ static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
         struct ieee80211_local *local = wiphy_priv(wiphy);
         int err;
 
+        if (changed & WIPHY_PARAM_COVERAGE_CLASS) {
+                err = drv_set_coverage_class(local, wiphy->coverage_class);
+
+                if (err)
+                        return err;
+        }
+
         if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
                 err = drv_set_rts_threshold(local, wiphy->rts_threshold);
 
@@ -1324,6 +1338,50 @@ static int ieee80211_testmode_cmd(struct wiphy *wiphy, void *data, int len)
 }
 #endif
 
+int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
+                             enum ieee80211_smps_mode smps_mode)
+{
+        const u8 *ap;
+        enum ieee80211_smps_mode old_req;
+        int err;
+
+        old_req = sdata->u.mgd.req_smps;
+        sdata->u.mgd.req_smps = smps_mode;
+
+        if (old_req == smps_mode &&
+            smps_mode != IEEE80211_SMPS_AUTOMATIC)
+                return 0;
+
+        /*
+         * If not associated, or current association is not an HT
+         * association, there's no need to send an action frame.
+         */
+        if (!sdata->u.mgd.associated ||
+            sdata->local->oper_channel_type == NL80211_CHAN_NO_HT) {
+                mutex_lock(&sdata->local->iflist_mtx);
+                ieee80211_recalc_smps(sdata->local, sdata);
+                mutex_unlock(&sdata->local->iflist_mtx);
+                return 0;
+        }
+
+        ap = sdata->u.mgd.associated->bssid;
+
+        if (smps_mode == IEEE80211_SMPS_AUTOMATIC) {
+                if (sdata->u.mgd.powersave)
+                        smps_mode = IEEE80211_SMPS_DYNAMIC;
+                else
+                        smps_mode = IEEE80211_SMPS_OFF;
+        }
+
+        /* send SM PS frame to AP */
+        err = ieee80211_send_smps_action(sdata, smps_mode,
+                                         ap, ap);
+        if (err)
+                sdata->u.mgd.req_smps = old_req;
+
+        return err;
+}
+
 static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
                                     bool enabled, int timeout)
 {
@@ -1344,6 +1402,11 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         sdata->u.mgd.powersave = enabled;
         conf->dynamic_ps_timeout = timeout;
 
+        /* no change, but if automatic follow powersave */
+        mutex_lock(&sdata->u.mgd.mtx);
+        __ieee80211_request_smps(sdata, sdata->u.mgd.req_smps);
+        mutex_unlock(&sdata->u.mgd.mtx);
+
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
 
@@ -1359,39 +1422,43 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        int i, err = -EINVAL;
-        u32 target_rate;
-        struct ieee80211_supported_band *sband;
+        int i;
 
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
+        /*
+         * This _could_ be supported by providing a hook for
+         * drivers for this function, but at this point it
+         * doesn't seem worth bothering.
+         */
+        if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
+                return -EOPNOTSUPP;
 
-        /* target_rate = -1, rate->fixed = 0 means auto only, so use all rates
-         * target_rate = X, rate->fixed = 1 means only rate X
-         * target_rate = X, rate->fixed = 0 means all rates <= X */
-        sdata->max_ratectrl_rateidx = -1;
-        sdata->force_unicast_rateidx = -1;
 
-        if (mask->fixed)
-                target_rate = mask->fixed / 100;
-        else if (mask->maxrate)
-                target_rate = mask->maxrate / 100;
-        else
-                return 0;
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++)
+                sdata->rc_rateidx_mask[i] = mask->control[i].legacy;
 
-        for (i=0; i< sband->n_bitrates; i++) {
-                struct ieee80211_rate *brate = &sband->bitrates[i];
-                int this_rate = brate->bitrate;
+        return 0;
+}
 
-                if (target_rate == this_rate) {
-                        sdata->max_ratectrl_rateidx = i;
-                        if (mask->fixed)
-                                sdata->force_unicast_rateidx = i;
-                        err = 0;
-                        break;
-                }
-        }
+static int ieee80211_remain_on_channel(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       struct ieee80211_channel *chan,
+                                       enum nl80211_channel_type channel_type,
+                                       unsigned int duration,
+                                       u64 *cookie)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        return err;
+        return ieee80211_wk_remain_on_channel(sdata, chan, channel_type,
+                                              duration, cookie);
+}
+
+static int ieee80211_cancel_remain_on_channel(struct wiphy *wiphy,
+                                              struct net_device *dev,
+                                              u64 cookie)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        return ieee80211_wk_cancel_remain_on_channel(sdata, cookie);
 }
 
 struct cfg80211_ops mac80211_config_ops = {
@@ -1440,4 +1507,6 @@ struct cfg80211_ops mac80211_config_ops = {
         CFG80211_TESTMODE_CMD(ieee80211_testmode_cmd)
         .set_power_mgmt = ieee80211_set_power_mgmt,
         .set_bitrate_mask = ieee80211_set_bitrate_mask,
+        .remain_on_channel = ieee80211_remain_on_channel,
+        .cancel_remain_on_channel = ieee80211_cancel_remain_on_channel,
 };
diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index e4b54093d41b..b3bc32b62a5a 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -158,6 +158,98 @@ static const struct file_operations noack_ops = {
         .open = mac80211_open_file_generic
 };
 
+static ssize_t uapsd_queues_read(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        int res;
+        char buf[10];
+
+        res = scnprintf(buf, sizeof(buf), "0x%x\n", local->uapsd_queues);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+}
+
+static ssize_t uapsd_queues_write(struct file *file,
+                                  const char __user *user_buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        unsigned long val;
+        char buf[10];
+        size_t len;
+        int ret;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+        buf[len] = '\0';
+
+        ret = strict_strtoul(buf, 0, &val);
+
+        if (ret)
+                return -EINVAL;
+
+        if (val & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
+                return -ERANGE;
+
+        local->uapsd_queues = val;
+
+        return count;
+}
+
+static const struct file_operations uapsd_queues_ops = {
+        .read = uapsd_queues_read,
+        .write = uapsd_queues_write,
+        .open = mac80211_open_file_generic
+};
+
+static ssize_t uapsd_max_sp_len_read(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        int res;
+        char buf[10];
+
+        res = scnprintf(buf, sizeof(buf), "0x%x\n", local->uapsd_max_sp_len);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+}
+
+static ssize_t uapsd_max_sp_len_write(struct file *file,
+                                      const char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct ieee80211_local *local = file->private_data;
+        unsigned long val;
+        char buf[10];
+        size_t len;
+        int ret;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+        buf[len] = '\0';
+
+        ret = strict_strtoul(buf, 0, &val);
+
+        if (ret)
+                return -EINVAL;
+
+        if (val & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
+                return -ERANGE;
+
+        local->uapsd_max_sp_len = val;
+
+        return count;
+}
+
+static const struct file_operations uapsd_max_sp_len_ops = {
+        .read = uapsd_max_sp_len_read,
+        .write = uapsd_max_sp_len_write,
+        .open = mac80211_open_file_generic
+};
+
 static ssize_t queues_read(struct file *file, char __user *user_buf,
                            size_t count, loff_t *ppos)
 {
@@ -314,6 +406,8 @@ void debugfs_hw_add(struct ieee80211_local *local)
         DEBUGFS_ADD(queues);
         DEBUGFS_ADD_MODE(reset, 0200);
         DEBUGFS_ADD(noack);
+        DEBUGFS_ADD(uapsd_queues);
+        DEBUGFS_ADD(uapsd_max_sp_len);
 
         statsd = debugfs_create_dir("statistics", phyd);
 
diff --git a/net/mac80211/debugfs_key.c b/net/mac80211/debugfs_key.c
index e0f5224630da..d12e743cb4e1 100644
--- a/net/mac80211/debugfs_key.c
+++ b/net/mac80211/debugfs_key.c
@@ -56,7 +56,7 @@ KEY_CONF_FILE(keyidx, D);
 KEY_CONF_FILE(hw_key_idx, D);
 KEY_FILE(flags, X);
 KEY_FILE(tx_rx_count, D);
-KEY_READ(ifindex, sdata->dev->ifindex, 20, "%d\n");
+KEY_READ(ifindex, sdata->name, IFNAMSIZ + 2, "%s\n");
 KEY_OPS(ifindex);
 
 static ssize_t key_algorithm_read(struct file *file,
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 472b2039906c..9affe2cd185f 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -41,6 +41,30 @@ static ssize_t ieee80211_if_read(
         return ret;
 }
 
+static ssize_t ieee80211_if_write(
+        struct ieee80211_sub_if_data *sdata,
+        const char __user *userbuf,
+        size_t count, loff_t *ppos,
+        ssize_t (*write)(struct ieee80211_sub_if_data *, const char *, int))
+{
+        u8 *buf;
+        ssize_t ret = -ENODEV;
+
+        buf = kzalloc(count, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        if (copy_from_user(buf, userbuf, count))
+                return -EFAULT;
+
+        rtnl_lock();
+        if (sdata->dev->reg_state == NETREG_REGISTERED)
+                ret = (*write)(sdata, buf, count);
+        rtnl_unlock();
+
+        return ret;
+}
+
 #define IEEE80211_IF_FMT(name, field, format_string)                    \
 static ssize_t ieee80211_if_fmt_##name(                                 \
         const struct ieee80211_sub_if_data *sdata, char *buf,           \
@@ -71,7 +95,7 @@ static ssize_t ieee80211_if_fmt_##name(					\
         return scnprintf(buf, buflen, "%pM\n", sdata->field);           \
 }
 
-#define __IEEE80211_IF_FILE(name)                                       \
+#define __IEEE80211_IF_FILE(name, _write)                               \
 static ssize_t ieee80211_if_read_##name(struct file *file,              \
                                         char __user *userbuf,           \
                                         size_t count, loff_t *ppos)     \
@@ -82,22 +106,99 @@ static ssize_t ieee80211_if_read_##name(struct file *file,		\
 }                                                                       \
 static const struct file_operations name##_ops = {                      \
         .read = ieee80211_if_read_##name,                               \
+        .write = (_write),                                              \
         .open = mac80211_open_file_generic,                             \
 }
 
+#define __IEEE80211_IF_FILE_W(name)                                     \
+static ssize_t ieee80211_if_write_##name(struct file *file,             \
+                                         const char __user *userbuf,    \
+                                         size_t count, loff_t *ppos)    \
+{                                                                       \
+        return ieee80211_if_write(file->private_data, userbuf, count,   \
+                                  ppos, ieee80211_if_parse_##name);     \
+}                                                                       \
+__IEEE80211_IF_FILE(name, ieee80211_if_write_##name)
+
+
 #define IEEE80211_IF_FILE(name, field, format)                          \
                 IEEE80211_IF_FMT_##format(name, field)                  \
-                __IEEE80211_IF_FILE(name)
+                __IEEE80211_IF_FILE(name, NULL)
 
 /* common attributes */
 IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
-IEEE80211_IF_FILE(force_unicast_rateidx, force_unicast_rateidx, DEC);
-IEEE80211_IF_FILE(max_ratectrl_rateidx, max_ratectrl_rateidx, DEC);
+IEEE80211_IF_FILE(rc_rateidx_mask_2ghz, rc_rateidx_mask[IEEE80211_BAND_2GHZ],
+                  HEX);
+IEEE80211_IF_FILE(rc_rateidx_mask_5ghz, rc_rateidx_mask[IEEE80211_BAND_5GHZ],
+                  HEX);
 
 /* STA attributes */
 IEEE80211_IF_FILE(bssid, u.mgd.bssid, MAC);
 IEEE80211_IF_FILE(aid, u.mgd.aid, DEC);
-IEEE80211_IF_FILE(capab, u.mgd.capab, HEX);
+
+static int ieee80211_set_smps(struct ieee80211_sub_if_data *sdata,
+                              enum ieee80211_smps_mode smps_mode)
+{
+        struct ieee80211_local *local = sdata->local;
+        int err;
+
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_STATIC_SMPS) &&
+            smps_mode == IEEE80211_SMPS_STATIC)
+                return -EINVAL;
+
+        /* auto should be dynamic if in PS mode */
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS) &&
+            (smps_mode == IEEE80211_SMPS_DYNAMIC ||
+             smps_mode == IEEE80211_SMPS_AUTOMATIC))
+                return -EINVAL;
+
+        /* supported only on managed interfaces for now */
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        mutex_lock(&local->iflist_mtx);
+        err = __ieee80211_request_smps(sdata, smps_mode);
+        mutex_unlock(&local->iflist_mtx);
+
+        return err;
+}
+
+static const char *smps_modes[IEEE80211_SMPS_NUM_MODES] = {
+        [IEEE80211_SMPS_AUTOMATIC] = "auto",
+        [IEEE80211_SMPS_OFF] = "off",
+        [IEEE80211_SMPS_STATIC] = "static",
+        [IEEE80211_SMPS_DYNAMIC] = "dynamic",
+};
+
+static ssize_t ieee80211_if_fmt_smps(const struct ieee80211_sub_if_data *sdata,
+                                     char *buf, int buflen)
+{
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return -EOPNOTSUPP;
+
+        return snprintf(buf, buflen, "request: %s\nused: %s\n",
+                        smps_modes[sdata->u.mgd.req_smps],
+                        smps_modes[sdata->u.mgd.ap_smps]);
+}
+
+static ssize_t ieee80211_if_parse_smps(struct ieee80211_sub_if_data *sdata,
+                                       const char *buf, int buflen)
+{
+        enum ieee80211_smps_mode mode;
+
+        for (mode = 0; mode < IEEE80211_SMPS_NUM_MODES; mode++) {
+                if (strncmp(buf, smps_modes[mode], buflen) == 0) {
+                        int err = ieee80211_set_smps(sdata, mode);
+                        if (!err)
+                                return buflen;
+                        return err;
+                }
+        }
+
+        return -EINVAL;
+}
+
+__IEEE80211_IF_FILE_W(smps);
 
 /* AP attributes */
 IEEE80211_IF_FILE(num_sta_ps, u.ap.num_sta_ps, ATOMIC);
@@ -109,7 +210,7 @@ static ssize_t ieee80211_if_fmt_num_buffered_multicast(
         return scnprintf(buf, buflen, "%u\n",
                          skb_queue_len(&sdata->u.ap.ps_bc_buf));
 }
-__IEEE80211_IF_FILE(num_buffered_multicast);
+__IEEE80211_IF_FILE(num_buffered_multicast, NULL);
 
 /* WDS attributes */
 IEEE80211_IF_FILE(peer, u.wds.remote_addr, MAC);
@@ -154,46 +255,50 @@ IEEE80211_IF_FILE(dot11MeshHWMPRootMode,
 #endif
 
 
-#define DEBUGFS_ADD(name, type) \
+#define DEBUGFS_ADD(name) \
         debugfs_create_file(#name, 0400, sdata->debugfs.dir, \
                             sdata, &name##_ops);
 
+#define DEBUGFS_ADD_MODE(name, mode) \
+        debugfs_create_file(#name, mode, sdata->debugfs.dir, \
+                            sdata, &name##_ops);
+
 static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted, sta);
-        DEBUGFS_ADD(force_unicast_rateidx, sta);
-        DEBUGFS_ADD(max_ratectrl_rateidx, sta);
+        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
+        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 
-        DEBUGFS_ADD(bssid, sta);
-        DEBUGFS_ADD(aid, sta);
-        DEBUGFS_ADD(capab, sta);
+        DEBUGFS_ADD(bssid);
+        DEBUGFS_ADD(aid);
+        DEBUGFS_ADD_MODE(smps, 0600);
 }
 
 static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted, ap);
-        DEBUGFS_ADD(force_unicast_rateidx, ap);
-        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
+        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 
-        DEBUGFS_ADD(num_sta_ps, ap);
-        DEBUGFS_ADD(dtim_count, ap);
-        DEBUGFS_ADD(num_buffered_multicast, ap);
+        DEBUGFS_ADD(num_sta_ps);
+        DEBUGFS_ADD(dtim_count);
+        DEBUGFS_ADD(num_buffered_multicast);
 }
 
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted, wds);
-        DEBUGFS_ADD(force_unicast_rateidx, wds);
-        DEBUGFS_ADD(max_ratectrl_rateidx, wds);
+        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
+        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 
-        DEBUGFS_ADD(peer, wds);
+        DEBUGFS_ADD(peer);
 }
 
 static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
-        DEBUGFS_ADD(drop_unencrypted, vlan);
-        DEBUGFS_ADD(force_unicast_rateidx, vlan);
-        DEBUGFS_ADD(max_ratectrl_rateidx, vlan);
+        DEBUGFS_ADD(drop_unencrypted);
+        DEBUGFS_ADD(rc_rateidx_mask_2ghz);
+        DEBUGFS_ADD(rc_rateidx_mask_5ghz);
 }
 
 static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
@@ -280,16 +385,11 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
         }
 }
 
-static int notif_registered;
-
 void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata)
 {
         char buf[10+IFNAMSIZ];
 
-        if (!notif_registered)
-                return;
-
-        sprintf(buf, "netdev:%s", sdata->dev->name);
+        sprintf(buf, "netdev:%s", sdata->name);
         sdata->debugfs.dir = debugfs_create_dir(buf,
                 sdata->local->hw.wiphy->debugfsdir);
         add_files(sdata);
@@ -304,58 +404,18 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
         sdata->debugfs.dir = NULL;
 }
 
-static int netdev_notify(struct notifier_block *nb,
-                         unsigned long state,
-                         void *ndev)
+void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
 {
-        struct net_device *dev = ndev;
         struct dentry *dir;
-        struct ieee80211_sub_if_data *sdata;
-        char buf[10+IFNAMSIZ];
-
-        if (state != NETDEV_CHANGENAME)
-                return 0;
-
-        if (!dev->ieee80211_ptr || !dev->ieee80211_ptr->wiphy)
-                return 0;
-
-        if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
-                return 0;
-
-        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        char buf[10 + IFNAMSIZ];
 
         dir = sdata->debugfs.dir;
 
         if (!dir)
-                return 0;
+                return;
 
-        sprintf(buf, "netdev:%s", dev->name);
+        sprintf(buf, "netdev:%s", sdata->name);
         if (!debugfs_rename(dir->d_parent, dir, dir->d_parent, buf))
                 printk(KERN_ERR "mac80211: debugfs: failed to rename debugfs "
                        "dir to %s\n", buf);
-
-        return 0;
-}
-
-static struct notifier_block mac80211_debugfs_netdev_notifier = {
-        .notifier_call = netdev_notify,
-};
-
-void ieee80211_debugfs_netdev_init(void)
-{
-        int err;
-
-        err = register_netdevice_notifier(&mac80211_debugfs_netdev_notifier);
-        if (err) {
-                printk(KERN_ERR
-                       "mac80211: failed to install netdev notifier,"
-                       " disabling per-netdev debugfs!\n");
-        } else
-                notif_registered = 1;
-}
-
-void ieee80211_debugfs_netdev_exit(void)
-{
-        unregister_netdevice_notifier(&mac80211_debugfs_netdev_notifier);
-        notif_registered = 0;
 }
diff --git a/net/mac80211/debugfs_netdev.h b/net/mac80211/debugfs_netdev.h
index 7af731f0b731..79025e79f4d6 100644
--- a/net/mac80211/debugfs_netdev.h
+++ b/net/mac80211/debugfs_netdev.h
@@ -6,8 +6,7 @@
 #ifdef CONFIG_MAC80211_DEBUGFS
 void ieee80211_debugfs_add_netdev(struct ieee80211_sub_if_data *sdata);
 void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata);
-void ieee80211_debugfs_netdev_init(void);
-void ieee80211_debugfs_netdev_exit(void);
+void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata);
 #else
 static inline void ieee80211_debugfs_add_netdev(
         struct ieee80211_sub_if_data *sdata)
@@ -15,10 +14,8 @@ static inline void ieee80211_debugfs_add_netdev(
 static inline void ieee80211_debugfs_remove_netdev(
         struct ieee80211_sub_if_data *sdata)
 {}
-static inline void ieee80211_debugfs_netdev_init(void)
-{}
-
-static inline void ieee80211_debugfs_netdev_exit(void)
+static inline void ieee80211_debugfs_rename_netdev(
+        struct ieee80211_sub_if_data *sdata)
 {}
 #endif
 
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 3f41608c8081..0d4a759ba72c 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -44,7 +44,7 @@ static const struct file_operations sta_ ##name## _ops = {		\
                 STA_OPS(name)
 
 STA_FILE(aid, sta.aid, D);
-STA_FILE(dev, sdata->dev->name, S);
+STA_FILE(dev, sdata->name, S);
 STA_FILE(rx_packets, rx_packets, LU);
 STA_FILE(tx_packets, tx_packets, LU);
 STA_FILE(rx_bytes, rx_bytes, LU);
@@ -160,7 +160,12 @@ STA_OPS(agg_status);
 static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
                                 size_t count, loff_t *ppos)
 {
-        char buf[200], *p = buf;
+#define PRINT_HT_CAP(_cond, _str) \
+        do { \
+        if (_cond) \
+                        p += scnprintf(p, sizeof(buf)+buf-p, "\t" _str "\n"); \
+        } while (0)
+        char buf[1024], *p = buf;
         int i;
         struct sta_info *sta = file->private_data;
         struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
@@ -168,15 +173,64 @@ static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
         p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
                         htc->ht_supported ? "" : "not ");
         if (htc->ht_supported) {
-                p += scnprintf(p, sizeof(buf)+buf-p, "cap: %#.2x\n", htc->cap);
+                p += scnprintf(p, sizeof(buf)+buf-p, "cap: %#.4x\n", htc->cap);
+
+                PRINT_HT_CAP((htc->cap & BIT(0)), "RX LDCP");
+                PRINT_HT_CAP((htc->cap & BIT(1)), "HT20/HT40");
+                PRINT_HT_CAP(!(htc->cap & BIT(1)), "HT20");
+
+                PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 0, "Static SM Power Save");
+                PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 1, "Dynamic SM Power Save");
+                PRINT_HT_CAP(((htc->cap >> 2) & 0x3) == 3, "SM Power Save disabled");
+
+                PRINT_HT_CAP((htc->cap & BIT(4)), "RX Greenfield");
+                PRINT_HT_CAP((htc->cap & BIT(5)), "RX HT20 SGI");
+                PRINT_HT_CAP((htc->cap & BIT(6)), "RX HT40 SGI");
+                PRINT_HT_CAP((htc->cap & BIT(7)), "TX STBC");
+
+                PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 0, "No RX STBC");
+                PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 1, "RX STBC 1-stream");
+                PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 2, "RX STBC 2-streams");
+                PRINT_HT_CAP(((htc->cap >> 8) & 0x3) == 3, "RX STBC 3-streams");
+
+                PRINT_HT_CAP((htc->cap & BIT(10)), "HT Delayed Block Ack");
+
+                PRINT_HT_CAP((htc->cap & BIT(11)), "Max AMSDU length: "
+                             "3839 bytes");
+                PRINT_HT_CAP(!(htc->cap & BIT(11)), "Max AMSDU length: "
+                             "7935 bytes");
+
+                /*
+                 * For beacons and probe response this would mean the BSS
+                 * does or does not allow the usage of DSSS/CCK HT40.
+                 * Otherwise it means the STA does or does not use
+                 * DSSS/CCK HT40.
+                 */
+                PRINT_HT_CAP((htc->cap & BIT(12)), "DSSS/CCK HT40");
+                PRINT_HT_CAP(!(htc->cap & BIT(12)), "No DSSS/CCK HT40");
+
+                /* BIT(13) is reserved */
+
+                PRINT_HT_CAP((htc->cap & BIT(14)), "40 MHz Intolerant");
+
+                PRINT_HT_CAP((htc->cap & BIT(15)), "L-SIG TXOP protection");
+
                 p += scnprintf(p, sizeof(buf)+buf-p, "ampdu factor/density: %d/%d\n",
                                 htc->ampdu_factor, htc->ampdu_density);
                 p += scnprintf(p, sizeof(buf)+buf-p, "MCS mask:");
+
                 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
                         p += scnprintf(p, sizeof(buf)+buf-p, " %.2x",
                                         htc->mcs.rx_mask[i]);
-                p += scnprintf(p, sizeof(buf)+buf-p, "\nMCS rx highest: %d\n",
-                                le16_to_cpu(htc->mcs.rx_highest));
+                p += scnprintf(p, sizeof(buf)+buf-p, "\n");
+
+                /* If not set this is meaningless */
+                if (le16_to_cpu(htc->mcs.rx_highest)) {
+                        p += scnprintf(p, sizeof(buf)+buf-p,
+                                       "MCS rx highest: %d Mbps\n",
+                                       le16_to_cpu(htc->mcs.rx_highest));
+                }
+
                 p += scnprintf(p, sizeof(buf)+buf-p, "MCS tx params: %x\n",
                                 htc->mcs.tx_params);
         }
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 921dd9c9ff62..de91d39e0276 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -14,6 +14,8 @@ static inline int drv_start(struct ieee80211_local *local)
 {
         int ret;
 
+        might_sleep();
+
         local->started = true;
         smp_mb();
         ret = local->ops->start(&local->hw);
@@ -23,6 +25,8 @@ static inline int drv_start(struct ieee80211_local *local)
 
 static inline void drv_stop(struct ieee80211_local *local)
 {
+        might_sleep();
+
         local->ops->stop(&local->hw);
         trace_drv_stop(local);
 
@@ -36,35 +40,47 @@ static inline void drv_stop(struct ieee80211_local *local)
 }
 
 static inline int drv_add_interface(struct ieee80211_local *local,
-                                    struct ieee80211_if_init_conf *conf)
+                                    struct ieee80211_vif *vif)
 {
-        int ret = local->ops->add_interface(&local->hw, conf);
-        trace_drv_add_interface(local, conf->mac_addr, conf->vif, ret);
+        int ret;
+
+        might_sleep();
+
+        ret = local->ops->add_interface(&local->hw, vif);
+        trace_drv_add_interface(local, vif_to_sdata(vif), ret);
         return ret;
 }
 
 static inline void drv_remove_interface(struct ieee80211_local *local,
-                                        struct ieee80211_if_init_conf *conf)
+                                        struct ieee80211_vif *vif)
 {
-        local->ops->remove_interface(&local->hw, conf);
-        trace_drv_remove_interface(local, conf->mac_addr, conf->vif);
+        might_sleep();
+
+        local->ops->remove_interface(&local->hw, vif);
+        trace_drv_remove_interface(local, vif_to_sdata(vif));
 }
 
 static inline int drv_config(struct ieee80211_local *local, u32 changed)
 {
-        int ret = local->ops->config(&local->hw, changed);
+        int ret;
+
+        might_sleep();
+
+        ret = local->ops->config(&local->hw, changed);
         trace_drv_config(local, changed, ret);
         return ret;
 }
 
 static inline void drv_bss_info_changed(struct ieee80211_local *local,
-                                        struct ieee80211_vif *vif,
+                                        struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_bss_conf *info,
                                         u32 changed)
 {
+        might_sleep();
+
         if (local->ops->bss_info_changed)
-                local->ops->bss_info_changed(&local->hw, vif, info, changed);
-        trace_drv_bss_info_changed(local, vif, info, changed);
+                local->ops->bss_info_changed(&local->hw, &sdata->vif, info, changed);
+        trace_drv_bss_info_changed(local, sdata, info, changed);
 }
 
 static inline u64 drv_prepare_multicast(struct ieee80211_local *local,
@@ -106,12 +122,17 @@ static inline int drv_set_tim(struct ieee80211_local *local,
 }
 
 static inline int drv_set_key(struct ieee80211_local *local,
-                              enum set_key_cmd cmd, struct ieee80211_vif *vif,
+                              enum set_key_cmd cmd,
+                              struct ieee80211_sub_if_data *sdata,
                               struct ieee80211_sta *sta,
                               struct ieee80211_key_conf *key)
 {
-        int ret = local->ops->set_key(&local->hw, cmd, vif, sta, key);
-        trace_drv_set_key(local, cmd, vif, sta, key, ret);
+        int ret;
+
+        might_sleep();
+
+        ret = local->ops->set_key(&local->hw, cmd, &sdata->vif, sta, key);
+        trace_drv_set_key(local, cmd, sdata, sta, key, ret);
         return ret;
 }
 
@@ -120,6 +141,8 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
                                        const u8 *address, u32 iv32,
                                        u16 *phase1key)
 {
+        might_sleep();
+
         if (local->ops->update_tkip_key)
                 local->ops->update_tkip_key(&local->hw, conf, address,
                                             iv32, phase1key);
@@ -129,13 +152,19 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
 static inline int drv_hw_scan(struct ieee80211_local *local,
                               struct cfg80211_scan_request *req)
 {
-        int ret = local->ops->hw_scan(&local->hw, req);
+        int ret;
+
+        might_sleep();
+
+        ret = local->ops->hw_scan(&local->hw, req);
         trace_drv_hw_scan(local, req, ret);
         return ret;
 }
 
 static inline void drv_sw_scan_start(struct ieee80211_local *local)
 {
+        might_sleep();
+
         if (local->ops->sw_scan_start)
                 local->ops->sw_scan_start(&local->hw);
         trace_drv_sw_scan_start(local);
@@ -143,6 +172,8 @@ static inline void drv_sw_scan_start(struct ieee80211_local *local)
 
 static inline void drv_sw_scan_complete(struct ieee80211_local *local)
 {
+        might_sleep();
+
         if (local->ops->sw_scan_complete)
                 local->ops->sw_scan_complete(&local->hw);
         trace_drv_sw_scan_complete(local);
@@ -153,6 +184,8 @@ static inline int drv_get_stats(struct ieee80211_local *local,
 {
         int ret = -EOPNOTSUPP;
 
+        might_sleep();
+
         if (local->ops->get_stats)
                 ret = local->ops->get_stats(&local->hw, stats);
         trace_drv_get_stats(local, stats, ret);
@@ -172,26 +205,47 @@ static inline int drv_set_rts_threshold(struct ieee80211_local *local,
                                         u32 value)
 {
         int ret = 0;
+
+        might_sleep();
+
         if (local->ops->set_rts_threshold)
                 ret = local->ops->set_rts_threshold(&local->hw, value);
         trace_drv_set_rts_threshold(local, value, ret);
         return ret;
 }
 
+static inline int drv_set_coverage_class(struct ieee80211_local *local,
+                                         u8 value)
+{
+        int ret = 0;
+        might_sleep();
+
+        if (local->ops->set_coverage_class)
+                local->ops->set_coverage_class(&local->hw, value);
+        else
+                ret = -EOPNOTSUPP;
+
+        trace_drv_set_coverage_class(local, value, ret);
+        return ret;
+}
+
 static inline void drv_sta_notify(struct ieee80211_local *local,
-                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_sub_if_data *sdata,
                                   enum sta_notify_cmd cmd,
                                   struct ieee80211_sta *sta)
 {
         if (local->ops->sta_notify)
-                local->ops->sta_notify(&local->hw, vif, cmd, sta);
-        trace_drv_sta_notify(local, vif, cmd, sta);
+                local->ops->sta_notify(&local->hw, &sdata->vif, cmd, sta);
+        trace_drv_sta_notify(local, sdata, cmd, sta);
 }
 
 static inline int drv_conf_tx(struct ieee80211_local *local, u16 queue,
                               const struct ieee80211_tx_queue_params *params)
 {
         int ret = -EOPNOTSUPP;
+
+        might_sleep();
+
         if (local->ops->conf_tx)
                 ret = local->ops->conf_tx(&local->hw, queue, params);
         trace_drv_conf_tx(local, queue, params, ret);
@@ -209,6 +263,9 @@ static inline int drv_get_tx_stats(struct ieee80211_local *local,
 static inline u64 drv_get_tsf(struct ieee80211_local *local)
 {
         u64 ret = -1ULL;
+
+        might_sleep();
+
         if (local->ops->get_tsf)
                 ret = local->ops->get_tsf(&local->hw);
         trace_drv_get_tsf(local, ret);
@@ -217,6 +274,8 @@ static inline u64 drv_get_tsf(struct ieee80211_local *local)
 
 static inline void drv_set_tsf(struct ieee80211_local *local, u64 tsf)
 {
+        might_sleep();
+
         if (local->ops->set_tsf)
                 local->ops->set_tsf(&local->hw, tsf);
         trace_drv_set_tsf(local, tsf);
@@ -224,6 +283,8 @@ static inline void drv_set_tsf(struct ieee80211_local *local, u64 tsf)
 
 static inline void drv_reset_tsf(struct ieee80211_local *local)
 {
+        might_sleep();
+
         if (local->ops->reset_tsf)
                 local->ops->reset_tsf(&local->hw);
         trace_drv_reset_tsf(local);
@@ -232,6 +293,9 @@ static inline void drv_reset_tsf(struct ieee80211_local *local)
 static inline int drv_tx_last_beacon(struct ieee80211_local *local)
 {
         int ret = 1;
+
+        might_sleep();
+
         if (local->ops->tx_last_beacon)
                 ret = local->ops->tx_last_beacon(&local->hw);
         trace_drv_tx_last_beacon(local, ret);
@@ -239,23 +303,34 @@ static inline int drv_tx_last_beacon(struct ieee80211_local *local)
 }
 
 static inline int drv_ampdu_action(struct ieee80211_local *local,
-                                   struct ieee80211_vif *vif,
+                                   struct ieee80211_sub_if_data *sdata,
                                    enum ieee80211_ampdu_mlme_action action,
                                    struct ieee80211_sta *sta, u16 tid,
                                    u16 *ssn)
 {
         int ret = -EOPNOTSUPP;
         if (local->ops->ampdu_action)
-                ret = local->ops->ampdu_action(&local->hw, vif, action,
+                ret = local->ops->ampdu_action(&local->hw, &sdata->vif, action,
                                                sta, tid, ssn);
-        trace_drv_ampdu_action(local, vif, action, sta, tid, ssn, ret);
+        trace_drv_ampdu_action(local, sdata, action, sta, tid, ssn, ret);
         return ret;
 }
 
 
 static inline void drv_rfkill_poll(struct ieee80211_local *local)
 {
+        might_sleep();
+
         if (local->ops->rfkill_poll)
                 local->ops->rfkill_poll(&local->hw);
 }
+
+static inline void drv_flush(struct ieee80211_local *local, bool drop)
+{
+        might_sleep();
+
+        trace_drv_flush(local, drop);
+        if (local->ops->flush)
+                local->ops->flush(&local->hw, drop);
+}
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index da8497ef7063..d6bd9f517401 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -25,10 +25,12 @@ static inline void trace_ ## name(proto) {}
 #define STA_PR_FMT      " sta:%pM"
 #define STA_PR_ARG      __entry->sta_addr
 
-#define VIF_ENTRY       __field(enum nl80211_iftype, vif_type) __field(void *, vif)
-#define VIF_ASSIGN      __entry->vif_type = vif ? vif->type : 0; __entry->vif = vif
-#define VIF_PR_FMT      " vif:%p(%d)"
-#define VIF_PR_ARG      __entry->vif, __entry->vif_type
+#define VIF_ENTRY       __field(enum nl80211_iftype, vif_type) __field(void *, sdata) \
+                        __string(vif_name, sdata->dev ? sdata->dev->name : "<nodev>")
+#define VIF_ASSIGN      __entry->vif_type = sdata->vif.type; __entry->sdata = sdata; \
+                        __assign_str(vif_name, sdata->dev ? sdata->dev->name : "<nodev>")
+#define VIF_PR_FMT      " vif:%s(%d)"
+#define VIF_PR_ARG      __get_str(vif_name), __entry->vif_type
 
 TRACE_EVENT(drv_start,
         TP_PROTO(struct ieee80211_local *local, int ret),
@@ -70,11 +72,10 @@ TRACE_EVENT(drv_stop,
 
 TRACE_EVENT(drv_add_interface,
         TP_PROTO(struct ieee80211_local *local,
-                 const u8 *addr,
-                 struct ieee80211_vif *vif,
+                 struct ieee80211_sub_if_data *sdata,
                  int ret),
 
-        TP_ARGS(local, addr, vif, ret),
+        TP_ARGS(local, sdata, ret),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -86,7 +87,7 @@ TRACE_EVENT(drv_add_interface,
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
-                memcpy(__entry->addr, addr, 6);
+                memcpy(__entry->addr, sdata->vif.addr, 6);
                 __entry->ret = ret;
         ),
 
@@ -97,10 +98,9 @@ TRACE_EVENT(drv_add_interface,
 );
 
 TRACE_EVENT(drv_remove_interface,
-        TP_PROTO(struct ieee80211_local *local,
-                 const u8 *addr, struct ieee80211_vif *vif),
+        TP_PROTO(struct ieee80211_local *local, struct ieee80211_sub_if_data *sdata),
 
-        TP_ARGS(local, addr, vif),
+        TP_ARGS(local, sdata),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -111,7 +111,7 @@ TRACE_EVENT(drv_remove_interface,
         TP_fast_assign(
                 LOCAL_ASSIGN;
                 VIF_ASSIGN;
-                memcpy(__entry->addr, addr, 6);
+                memcpy(__entry->addr, sdata->vif.addr, 6);
         ),
 
         TP_printk(
@@ -140,6 +140,7 @@ TRACE_EVENT(drv_config,
                 __field(u8, short_frame_max_tx_count)
                 __field(int, center_freq)
                 __field(int, channel_type)
+                __field(int, smps)
         ),
 
         TP_fast_assign(
@@ -155,6 +156,7 @@ TRACE_EVENT(drv_config,
                 __entry->short_frame_max_tx_count = local->hw.conf.short_frame_max_tx_count;
                 __entry->center_freq = local->hw.conf.channel->center_freq;
                 __entry->channel_type = local->hw.conf.channel_type;
+                __entry->smps = local->hw.conf.smps_mode;
         ),
 
         TP_printk(
@@ -165,11 +167,11 @@ TRACE_EVENT(drv_config,
 
 TRACE_EVENT(drv_bss_info_changed,
         TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_vif *vif,
+                 struct ieee80211_sub_if_data *sdata,
                  struct ieee80211_bss_conf *info,
                  u32 changed),
 
-        TP_ARGS(local, vif, info, changed),
+        TP_ARGS(local, sdata, info, changed),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -293,11 +295,11 @@ TRACE_EVENT(drv_set_tim,
 
 TRACE_EVENT(drv_set_key,
         TP_PROTO(struct ieee80211_local *local,
-                 enum set_key_cmd cmd, struct ieee80211_vif *vif,
+                 enum set_key_cmd cmd, struct ieee80211_sub_if_data *sdata,
                  struct ieee80211_sta *sta,
                  struct ieee80211_key_conf *key, int ret),
 
-        TP_ARGS(local, cmd, vif, sta, key, ret),
+        TP_ARGS(local, cmd, sdata, sta, key, ret),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -489,13 +491,36 @@ TRACE_EVENT(drv_set_rts_threshold,
         )
 );
 
+TRACE_EVENT(drv_set_coverage_class,
+        TP_PROTO(struct ieee80211_local *local, u8 value, int ret),
+
+        TP_ARGS(local, value, ret),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(u8, value)
+                __field(int, ret)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->ret = ret;
+                __entry->value = value;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " value:%d ret:%d",
+                LOCAL_PR_ARG, __entry->value, __entry->ret
+        )
+);
+
 TRACE_EVENT(drv_sta_notify,
         TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_vif *vif,
+                 struct ieee80211_sub_if_data *sdata,
                  enum sta_notify_cmd cmd,
                  struct ieee80211_sta *sta),
 
-        TP_ARGS(local, vif, cmd, sta),
+        TP_ARGS(local, sdata, cmd, sta),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -656,12 +681,12 @@ TRACE_EVENT(drv_tx_last_beacon,
 
 TRACE_EVENT(drv_ampdu_action,
         TP_PROTO(struct ieee80211_local *local,
-                 struct ieee80211_vif *vif,
+                 struct ieee80211_sub_if_data *sdata,
                  enum ieee80211_ampdu_mlme_action action,
                  struct ieee80211_sta *sta, u16 tid,
                  u16 *ssn, int ret),
 
-        TP_ARGS(local, vif, action, sta, tid, ssn, ret),
+        TP_ARGS(local, sdata, action, sta, tid, ssn, ret),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
@@ -688,6 +713,27 @@ TRACE_EVENT(drv_ampdu_action,
                 LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->action, __entry->tid, __entry->ret
         )
 );
+
+TRACE_EVENT(drv_flush,
+        TP_PROTO(struct ieee80211_local *local, bool drop),
+
+        TP_ARGS(local, drop),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                __field(bool, drop)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                __entry->drop = drop;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT " drop:%d",
+                LOCAL_PR_ARG, __entry->drop
+        )
+);
 #endif /* !__MAC80211_DRIVER_TRACE || TRACE_HEADER_MULTI_READ */
 
 #undef TRACE_INCLUDE_PATH
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index d7dcee680728..bb677a73b7c9 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -125,7 +125,7 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
 
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer "
-                                        "for delba frame\n", sdata->dev->name);
+                                        "for delba frame\n", sdata->name);
                 return;
         }
 
@@ -133,10 +133,10 @@ void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         if (sdata->vif.type == NL80211_IFTYPE_AP ||
             sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         else if (sdata->vif.type == NL80211_IFTYPE_STATION)
                 memcpy(mgmt->bssid, sdata->u.mgd.bssid, ETH_ALEN);
 
@@ -185,3 +185,50 @@ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
                 spin_unlock_bh(&sta->lock);
         }
 }
+
+int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
+                               enum ieee80211_smps_mode smps, const u8 *da,
+                               const u8 *bssid)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *action_frame;
+
+        /* 27 = header + category + action + smps mode */
+        skb = dev_alloc_skb(27 + local->hw.extra_tx_headroom);
+        if (!skb)
+                return -ENOMEM;
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+        action_frame = (void *)skb_put(skb, 27);
+        memcpy(action_frame->da, da, ETH_ALEN);
+        memcpy(action_frame->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(action_frame->bssid, bssid, ETH_ALEN);
+        action_frame->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_ACTION);
+        action_frame->u.action.category = WLAN_CATEGORY_HT;
+        action_frame->u.action.u.ht_smps.action = WLAN_HT_ACTION_SMPS;
+        switch (smps) {
+        case IEEE80211_SMPS_AUTOMATIC:
+        case IEEE80211_SMPS_NUM_MODES:
+                WARN_ON(1);
+        case IEEE80211_SMPS_OFF:
+                action_frame->u.action.u.ht_smps.smps_control =
+                                WLAN_HT_SMPS_CONTROL_DISABLED;
+                break;
+        case IEEE80211_SMPS_STATIC:
+                action_frame->u.action.u.ht_smps.smps_control =
+                                WLAN_HT_SMPS_CONTROL_STATIC;
+                break;
+        case IEEE80211_SMPS_DYNAMIC:
+                action_frame->u.action.u.ht_smps.smps_control =
+                                WLAN_HT_SMPS_CONTROL_DYNAMIC;
+                break;
+        }
+
+        /* we'll do more on status of this frame */
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_CTL_REQ_TX_STATUS;
+        ieee80211_tx_skb(sdata, skb);
+
+        return 0;
+}
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 1f2db647bb5c..5bcde4c3fba1 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -117,7 +117,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_PROBE_RESP);
         memset(mgmt->da, 0xff, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, ifibss->bssid, ETH_ALEN);
         mgmt->u.beacon.beacon_int = cpu_to_le16(beacon_int);
         mgmt->u.beacon.timestamp = cpu_to_le64(tsf);
@@ -187,15 +187,17 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_bss *bss)
 {
+        struct cfg80211_bss *cbss =
+                container_of((void *)bss, struct cfg80211_bss, priv);
         struct ieee80211_supported_band *sband;
         u32 basic_rates;
         int i, j;
-        u16 beacon_int = bss->cbss.beacon_interval;
+        u16 beacon_int = cbss->beacon_interval;
 
         if (beacon_int < 10)
                 beacon_int = 10;
 
-        sband = sdata->local->hw.wiphy->bands[bss->cbss.channel->band];
+        sband = sdata->local->hw.wiphy->bands[cbss->channel->band];
 
         basic_rates = 0;
 
@@ -212,12 +214,12 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        __ieee80211_sta_join_ibss(sdata, bss->cbss.bssid,
+        __ieee80211_sta_join_ibss(sdata, cbss->bssid,
                                   beacon_int,
-                                  bss->cbss.channel,
+                                  cbss->channel,
                                   basic_rates,
-                                  bss->cbss.capability,
-                                  bss->cbss.tsf);
+                                  cbss->capability,
+                                  cbss->tsf);
 }
 
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
@@ -229,6 +231,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_local *local = sdata->local;
         int freq;
+        struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
         struct sta_info *sta;
         struct ieee80211_channel *channel;
@@ -252,7 +255,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
                 rcu_read_lock();
 
-                sta = sta_info_get(local, mgmt->sa);
+                sta = sta_info_get(sdata, mgmt->sa);
                 if (sta) {
                         u32 prev_rates;
 
@@ -266,7 +269,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                 printk(KERN_DEBUG "%s: updated supp_rates set "
                                     "for %pM based on beacon info (0x%llx | "
                                     "0x%llx -> 0x%llx)\n",
-                                    sdata->dev->name,
+                                    sdata->name,
                                     sta->sta.addr,
                                     (unsigned long long) prev_rates,
                                     (unsigned long long) supp_rates,
@@ -283,8 +286,10 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         if (!bss)
                 return;
 
+        cbss = container_of((void *)bss, struct cfg80211_bss, priv);
+
         /* was just updated in ieee80211_bss_info_update */
-        beacon_timestamp = bss->cbss.tsf;
+        beacon_timestamp = cbss->tsf;
 
         /* check if we need to merge IBSS */
 
@@ -297,11 +302,11 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 goto put_bss;
 
         /* not an IBSS */
-        if (!(bss->cbss.capability & WLAN_CAPABILITY_IBSS))
+        if (!(cbss->capability & WLAN_CAPABILITY_IBSS))
                 goto put_bss;
 
         /* different channel */
-        if (bss->cbss.channel != local->oper_channel)
+        if (cbss->channel != local->oper_channel)
                 goto put_bss;
 
         /* different SSID */
@@ -311,7 +316,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 goto put_bss;
 
         /* same BSSID */
-        if (memcmp(bss->cbss.bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0)
+        if (memcmp(cbss->bssid, sdata->u.ibss.bssid, ETH_ALEN) == 0)
                 goto put_bss;
 
         if (rx_status->flag & RX_FLAG_TSFT) {
@@ -364,7 +369,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "%s: beacon TSF higher than "
                        "local TSF - IBSS merge with BSSID %pM\n",
-                       sdata->dev->name, mgmt->bssid);
+                       sdata->name, mgmt->bssid);
 #endif
                 ieee80211_sta_join_ibss(sdata, bss);
                 ieee80211_ibss_add_sta(sdata, mgmt->bssid, mgmt->sa, supp_rates);
@@ -394,7 +399,7 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
                 if (net_ratelimit())
                         printk(KERN_DEBUG "%s: No room for a new IBSS STA entry %pM\n",
-                               sdata->dev->name, addr);
+                               sdata->name, addr);
                 return NULL;
         }
 
@@ -406,7 +411,7 @@ struct sta_info *ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: Adding new IBSS station %pM (dev=%s)\n",
-               wiphy_name(local->hw.wiphy), addr, sdata->dev->name);
+               wiphy_name(local->hw.wiphy), addr, sdata->name);
 #endif
 
         sta = sta_info_alloc(sdata, addr, GFP_ATOMIC);
@@ -470,7 +475,7 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
                 return;
 
         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
-               "IBSS networks with same SSID (merge)\n", sdata->dev->name);
+               "IBSS networks with same SSID (merge)\n", sdata->name);
 
         ieee80211_request_internal_scan(sdata, ifibss->ssid, ifibss->ssid_len);
 }
@@ -492,13 +497,13 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
                  * random number generator get different BSSID. */
                 get_random_bytes(bssid, ETH_ALEN);
                 for (i = 0; i < ETH_ALEN; i++)
-                        bssid[i] ^= sdata->dev->dev_addr[i];
+                        bssid[i] ^= sdata->vif.addr[i];
                 bssid[0] &= ~0x01;
                 bssid[0] |= 0x02;
         }
 
         printk(KERN_DEBUG "%s: Creating new IBSS network, BSSID %pM\n",
-               sdata->dev->name, bssid);
+               sdata->name, bssid);
 
         sband = local->hw.wiphy->bands[ifibss->channel->band];
 
@@ -518,7 +523,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss;
+        struct cfg80211_bss *cbss;
         struct ieee80211_channel *chan = NULL;
         const u8 *bssid = NULL;
         int active_ibss;
@@ -527,7 +532,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         active_ibss = ieee80211_sta_active_ibss(sdata);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: sta_find_ibss (active_ibss=%d)\n",
-               sdata->dev->name, active_ibss);
+               sdata->name, active_ibss);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
         if (active_ibss)
@@ -542,21 +547,23 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 chan = ifibss->channel;
         if (!is_zero_ether_addr(ifibss->bssid))
                 bssid = ifibss->bssid;
-        bss = (void *)cfg80211_get_bss(local->hw.wiphy, chan, bssid,
-                                       ifibss->ssid, ifibss->ssid_len,
-                                       WLAN_CAPABILITY_IBSS |
-                                       WLAN_CAPABILITY_PRIVACY,
-                                       capability);
+        cbss = cfg80211_get_bss(local->hw.wiphy, chan, bssid,
+                                ifibss->ssid, ifibss->ssid_len,
+                                WLAN_CAPABILITY_IBSS | WLAN_CAPABILITY_PRIVACY,
+                                capability);
+
+        if (cbss) {
+                struct ieee80211_bss *bss;
 
-        if (bss) {
+                bss = (void *)cbss->priv;
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "   sta_find_ibss: selected %pM current "
-                       "%pM\n", bss->cbss.bssid, ifibss->bssid);
+                       "%pM\n", cbss->bssid, ifibss->bssid);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
                 printk(KERN_DEBUG "%s: Selected IBSS BSSID %pM"
                        " based on configured SSID\n",
-                       sdata->dev->name, bss->cbss.bssid);
+                       sdata->name, cbss->bssid);
 
                 ieee80211_sta_join_ibss(sdata, bss);
                 ieee80211_rx_bss_put(local, bss);
@@ -575,7 +582,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         } else if (time_after(jiffies, ifibss->last_scan_completed +
                                         IEEE80211_SCAN_INTERVAL)) {
                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
-                       "join\n", sdata->dev->name);
+                       "join\n", sdata->name);
 
                 ieee80211_request_internal_scan(sdata, ifibss->ssid,
                                                 ifibss->ssid_len);
@@ -589,7 +596,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                 return;
                         }
                         printk(KERN_DEBUG "%s: IBSS not allowed on"
-                               " %d MHz\n", sdata->dev->name,
+                               " %d MHz\n", sdata->name,
                                local->hw.conf.channel->center_freq);
 
                         /* No IBSS found - decrease scan interval and continue
@@ -623,7 +630,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: RX ProbeReq SA=%pM DA=%pM BSSID=%pM"
                " (tx_last_beacon=%d)\n",
-               sdata->dev->name, mgmt->sa, mgmt->da,
+               sdata->name, mgmt->sa, mgmt->da,
                mgmt->bssid, tx_last_beacon);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
 
@@ -641,7 +648,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                 printk(KERN_DEBUG "%s: Invalid SSID IE in ProbeReq "
                        "from %pM\n",
-                       sdata->dev->name, mgmt->sa);
+                       sdata->name, mgmt->sa);
 #endif
                 return;
         }
@@ -661,7 +668,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         memcpy(resp->da, mgmt->sa, ETH_ALEN);
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
         printk(KERN_DEBUG "%s: Sending ProbeResp to %pM\n",
-               sdata->dev->name, resp->da);
+               sdata->name, resp->da);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         ieee80211_tx_skb(sdata, skb);
@@ -675,7 +682,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
         size_t baselen;
         struct ieee802_11_elems elems;
 
-        if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
+        if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
                 return; /* ignore ProbeResp to foreign address */
 
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
@@ -748,7 +755,7 @@ static void ieee80211_ibss_work(struct work_struct *work)
         if (WARN_ON(local->suspended))
                 return;
 
-        if (!netif_running(sdata->dev))
+        if (!ieee80211_sdata_running(sdata))
                 return;
 
         if (local->scanning)
@@ -831,7 +838,7 @@ void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local)
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
                 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
                         continue;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 91dc8636d644..c18f576f1848 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -58,6 +58,15 @@ struct ieee80211_local;
 
 #define TU_TO_EXP_TIME(x)       (jiffies + usecs_to_jiffies((x) * 1024))
 
+#define IEEE80211_DEFAULT_UAPSD_QUEUES \
+        (IEEE80211_WMM_IE_STA_QOSINFO_AC_BK |   \
+         IEEE80211_WMM_IE_STA_QOSINFO_AC_BE |   \
+         IEEE80211_WMM_IE_STA_QOSINFO_AC_VI |   \
+         IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
+
+#define IEEE80211_DEFAULT_MAX_SP_LEN            \
+        IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
+
 struct ieee80211_fragment_entry {
         unsigned long first_frag_time;
         unsigned int seq;
@@ -71,9 +80,6 @@ struct ieee80211_fragment_entry {
 
 
 struct ieee80211_bss {
-        /* Yes, this is a hack */
-        struct cfg80211_bss cbss;
-
         /* don't want to look up all the time */
         size_t ssid_len;
         u8 ssid[IEEE80211_MAX_SSID_LEN];
@@ -81,6 +87,7 @@ struct ieee80211_bss {
         u8 dtim_period;
 
         bool wmm_used;
+        bool uapsd_supported;
 
         unsigned long last_probe_resp;
 
@@ -140,7 +147,6 @@ typedef unsigned __bitwise__ ieee80211_tx_result;
 
 struct ieee80211_tx_data {
         struct sk_buff *skb;
-        struct net_device *dev;
         struct ieee80211_local *local;
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
@@ -228,31 +234,78 @@ struct mesh_preq_queue {
         u8 flags;
 };
 
-enum ieee80211_mgd_state {
-        IEEE80211_MGD_STATE_IDLE,
-        IEEE80211_MGD_STATE_PROBE,
-        IEEE80211_MGD_STATE_AUTH,
-        IEEE80211_MGD_STATE_ASSOC,
+enum ieee80211_work_type {
+        IEEE80211_WORK_ABORT,
+        IEEE80211_WORK_DIRECT_PROBE,
+        IEEE80211_WORK_AUTH,
+        IEEE80211_WORK_ASSOC,
+        IEEE80211_WORK_REMAIN_ON_CHANNEL,
+};
+
+/**
+ * enum work_done_result - indicates what to do after work was done
+ *
+ * @WORK_DONE_DESTROY: This work item is no longer needed, destroy.
+ * @WORK_DONE_REQUEUE: This work item was reset to be reused, and
+ *      should be requeued.
+ */
+enum work_done_result {
+        WORK_DONE_DESTROY,
+        WORK_DONE_REQUEUE,
 };
 
-struct ieee80211_mgd_work {
+struct ieee80211_work {
         struct list_head list;
-        struct ieee80211_bss *bss;
-        int ie_len;
-        u8 prev_bssid[ETH_ALEN];
-        u8 ssid[IEEE80211_MAX_SSID_LEN];
-        u8 ssid_len;
+
+        struct rcu_head rcu_head;
+
+        struct ieee80211_sub_if_data *sdata;
+
+        enum work_done_result (*done)(struct ieee80211_work *wk,
+                                      struct sk_buff *skb);
+
+        struct ieee80211_channel *chan;
+        enum nl80211_channel_type chan_type;
+
         unsigned long timeout;
-        enum ieee80211_mgd_state state;
-        u16 auth_alg, auth_transaction;
+        enum ieee80211_work_type type;
 
-        int tries;
+        u8 filter_ta[ETH_ALEN];
 
-        u8 key[WLAN_KEY_LEN_WEP104];
-        u8 key_len, key_idx;
+        bool started;
+
+        union {
+                struct {
+                        int tries;
+                        u16 algorithm, transaction;
+                        u8 ssid[IEEE80211_MAX_SSID_LEN];
+                        u8 ssid_len;
+                        u8 key[WLAN_KEY_LEN_WEP104];
+                        u8 key_len, key_idx;
+                        bool privacy;
+                } probe_auth;
+                struct {
+                        struct cfg80211_bss *bss;
+                        const u8 *supp_rates;
+                        const u8 *ht_information_ie;
+                        enum ieee80211_smps_mode smps;
+                        int tries;
+                        u16 capability;
+                        u8 prev_bssid[ETH_ALEN];
+                        u8 ssid[IEEE80211_MAX_SSID_LEN];
+                        u8 ssid_len;
+                        u8 supp_rates_len;
+                        bool wmm_used, use_11n, uapsd_used;
+                } assoc;
+                struct {
+                        u32 duration;
+                        bool started;
+                } remain;
+        };
 
+        int ie_len;
         /* must be last */
-        u8 ie[0]; /* for auth or assoc frame, not probe */
+        u8 ie[0];
 };
 
 /* flags used in struct ieee80211_if_managed.flags */
@@ -260,15 +313,10 @@ enum ieee80211_sta_flags {
         IEEE80211_STA_BEACON_POLL       = BIT(0),
         IEEE80211_STA_CONNECTION_POLL   = BIT(1),
         IEEE80211_STA_CONTROL_PORT      = BIT(2),
-        IEEE80211_STA_WMM_ENABLED       = BIT(3),
         IEEE80211_STA_DISABLE_11N       = BIT(4),
         IEEE80211_STA_CSA_RECEIVED      = BIT(5),
         IEEE80211_STA_MFP_ENABLED       = BIT(6),
-};
-
-/* flags for MLME request */
-enum ieee80211_sta_request {
-        IEEE80211_STA_REQ_SCAN,
+        IEEE80211_STA_UAPSD_ENABLED     = BIT(7),
 };
 
 struct ieee80211_if_managed {
@@ -285,21 +333,18 @@ struct ieee80211_if_managed {
         int probe_send_count;
 
         struct mutex mtx;
-        struct ieee80211_bss *associated;
-        struct ieee80211_mgd_work *old_associate_work;
-        struct list_head work_list;
+        struct cfg80211_bss *associated;
 
         u8 bssid[ETH_ALEN];
 
         u16 aid;
-        u16 capab;
 
         struct sk_buff_head skb_queue;
 
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
-
-        unsigned long request;
+        enum ieee80211_smps_mode req_smps, /* requested smps mode */
+                                 ap_smps; /* smps mode AP thinks we're in */
 
         unsigned int flags;
 
@@ -433,6 +478,8 @@ struct ieee80211_sub_if_data {
 
         int drop_unencrypted;
 
+        char name[IFNAMSIZ];
+
         /*
          * keep track of whether the HT opmode (stored in
          * vif.bss_info.ht_operation_mode) is valid.
@@ -458,8 +505,8 @@ struct ieee80211_sub_if_data {
          */
         struct ieee80211_if_ap *bss;
 
-        int force_unicast_rateidx; /* forced TX rateidx for unicast frames */
-        int max_ratectrl_rateidx; /* max TX rateidx for rate control */
+        /* bitmap of allowed (non-MCS) rate indexes for rate control */
+        u32 rc_rateidx_mask[IEEE80211_NUM_BANDS];
 
         union {
                 struct ieee80211_if_ap ap;
@@ -565,6 +612,15 @@ struct ieee80211_local {
         const struct ieee80211_ops *ops;
 
         /*
+         * work stuff, potentially off-channel (in the future)
+         */
+        struct mutex work_mtx;
+        struct list_head work_list;
+        struct timer_list work_timer;
+        struct work_struct work_work;
+        struct sk_buff_head work_skb_queue;
+
+        /*
          * private workqueue to mac80211. mac80211 makes this accessible
          * via ieee80211_queue_work()
          */
@@ -586,6 +642,9 @@ struct ieee80211_local {
         /* used for uploading changed mc list */
         struct work_struct reconfig_filter;
 
+        /* used to reconfigure hardware SM PS */
+        struct work_struct recalc_smps;
+
         /* aggregated multicast list */
         struct dev_addr_list *mc_list;
         int mc_count;
@@ -689,6 +748,10 @@ struct ieee80211_local {
         enum nl80211_channel_type oper_channel_type;
         struct ieee80211_channel *oper_channel, *csa_channel;
 
+        /* Temporary remain-on-channel for off-channel operations */
+        struct ieee80211_channel *tmp_channel;
+        enum nl80211_channel_type tmp_channel_type;
+
         /* SNMP counters */
         /* dot11CountersTable */
         u32 dot11TransmittedFragmentCount;
@@ -745,8 +808,22 @@ struct ieee80211_local {
         int wifi_wme_noack_test;
         unsigned int wmm_acm; /* bit field of ACM bits (BIT(802.1D tag)) */
 
+        /*
+         * Bitmask of enabled u-apsd queues,
+         * IEEE80211_WMM_IE_STA_QOSINFO_AC_BE & co. Needs a new association
+         * to take effect.
+         */
+        unsigned int uapsd_queues;
+
+        /*
+         * Maximum number of buffered frames AP can deliver during a
+         * service period, IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL or similar.
+         * Needs a new association to take effect.
+         */
+        unsigned int uapsd_max_sp_len;
+
         bool pspolling;
-        bool scan_ps_enabled;
+        bool offchannel_ps_enabled;
         /*
          * PS can only be enabled when we have exactly one managed
          * interface (and monitors) in PS, this then points there.
@@ -760,6 +837,8 @@ struct ieee80211_local {
         int user_power_level; /* in dBm */
         int power_constr_level; /* in dBm */
 
+        enum ieee80211_smps_mode smps_mode;
+
         struct work_struct restart_work;
 
 #ifdef CONFIG_MAC80211_DEBUGFS
@@ -874,6 +953,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
 void ieee80211_configure_filter(struct ieee80211_local *local);
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata);
 
+extern bool ieee80211_disable_40mhz_24ghz;
+
 /* STA code */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata);
 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
@@ -937,7 +1018,15 @@ ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss);
 
+/* off-channel helpers */
+void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local);
+void ieee80211_offchannel_stop_station(struct ieee80211_local *local);
+void ieee80211_offchannel_return(struct ieee80211_local *local,
+                                 bool enable_beaconing);
+
 /* interface handling */
+int ieee80211_iface_init(void);
+void ieee80211_iface_exit(void);
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                      struct net_device **new_dev, enum nl80211_iftype type,
                      struct vif_params *params);
@@ -948,6 +1037,11 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local);
 u32 __ieee80211_recalc_idle(struct ieee80211_local *local);
 void ieee80211_recalc_idle(struct ieee80211_local *local);
 
+static inline bool ieee80211_sdata_running(struct ieee80211_sub_if_data *sdata)
+{
+        return netif_running(sdata->dev);
+}
+
 /* tx handling */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local);
 void ieee80211_tx_pending(unsigned long data);
@@ -976,6 +1070,9 @@ void ieee80211_send_bar(struct ieee80211_sub_if_data *sdata, u8 *ra, u16 tid, u1
 void ieee80211_send_delba(struct ieee80211_sub_if_data *sdata,
                           const u8 *da, u16 tid,
                           u16 initiator, u16 reason_code);
+int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
+                               enum ieee80211_smps_mode smps, const u8 *da,
+                               const u8 *bssid);
 
 void ieee80211_sta_stop_rx_ba_session(struct ieee80211_sub_if_data *sdata, u8 *da,
                                 u16 tid, u16 initiator, u16 reason);
@@ -1086,6 +1183,28 @@ void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
                             struct ieee802_11_elems *elems,
                             enum ieee80211_band band);
+int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
+                             enum ieee80211_smps_mode smps_mode);
+void ieee80211_recalc_smps(struct ieee80211_local *local,
+                           struct ieee80211_sub_if_data *forsdata);
+
+size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
+                          const u8 *ids, int n_ids, size_t offset);
+size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset);
+
+/* internal work items */
+void ieee80211_work_init(struct ieee80211_local *local);
+void ieee80211_add_work(struct ieee80211_work *wk);
+void free_work(struct ieee80211_work *wk);
+void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata);
+ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
+                                           struct sk_buff *skb);
+int ieee80211_wk_remain_on_channel(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_channel *chan,
+                                   enum nl80211_channel_type channel_type,
+                                   unsigned int duration, u64 *cookie);
+int ieee80211_wk_cancel_remain_on_channel(
+        struct ieee80211_sub_if_data *sdata, u64 cookie);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 32abae3ce32a..edf21cebeee8 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -62,6 +62,23 @@ static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
         return 0;
 }
 
+static int ieee80211_change_mac(struct net_device *dev, void *addr)
+{
+        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct sockaddr *sa = addr;
+        int ret;
+
+        if (ieee80211_sdata_running(sdata))
+                return -EBUSY;
+
+        ret = eth_mac_addr(dev, sa);
+
+        if (ret == 0)
+                memcpy(sdata->vif.addr, sa->sa_data, ETH_ALEN);
+
+        return ret;
+}
+
 static inline int identical_mac_addr_allowed(int type1, int type2)
 {
         return type1 == NL80211_IFTYPE_MONITOR ||
@@ -82,7 +99,6 @@ static int ieee80211_open(struct net_device *dev)
         struct ieee80211_sub_if_data *nsdata;
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
-        struct ieee80211_if_init_conf conf;
         u32 changed = 0;
         int res;
         u32 hw_reconf_flags = 0;
@@ -97,7 +113,7 @@ static int ieee80211_open(struct net_device *dev)
         list_for_each_entry(nsdata, &local->interfaces, list) {
                 struct net_device *ndev = nsdata->dev;
 
-                if (ndev != dev && netif_running(ndev)) {
+                if (ndev != dev && ieee80211_sdata_running(nsdata)) {
                         /*
                          * Allow only a single IBSS interface to be up at any
                          * time. This is restricted because beacon distribution
@@ -183,7 +199,7 @@ static int ieee80211_open(struct net_device *dev)
                 struct net_device *ndev = nsdata->dev;
 
                 /*
-                 * No need to check netif_running since we do not allow
+                 * No need to check running since we do not allow
                  * it to start up with this invalid address.
                  */
                 if (compare_ether_addr(null_addr, ndev->dev_addr) == 0) {
@@ -234,10 +250,7 @@ static int ieee80211_open(struct net_device *dev)
                 ieee80211_configure_filter(local);
                 break;
         default:
-                conf.vif = &sdata->vif;
-                conf.type = sdata->vif.type;
-                conf.mac_addr = dev->dev_addr;
-                res = drv_add_interface(local, &conf);
+                res = drv_add_interface(local, &sdata->vif);
                 if (res)
                         goto err_stop;
 
@@ -320,7 +333,7 @@ static int ieee80211_open(struct net_device *dev)
 
         return 0;
  err_del_interface:
-        drv_remove_interface(local, &conf);
+        drv_remove_interface(local, &sdata->vif);
  err_stop:
         if (!local->open_count)
                 drv_stop(local);
@@ -335,7 +348,6 @@ static int ieee80211_stop(struct net_device *dev)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_init_conf conf;
         struct sta_info *sta;
         unsigned long flags;
         struct sk_buff *skb, *tmp;
@@ -348,6 +360,11 @@ static int ieee80211_stop(struct net_device *dev)
         netif_tx_stop_all_queues(dev);
 
         /*
+         * Purge work for this interface.
+         */
+        ieee80211_work_purge(sdata);
+
+        /*
          * Now delete all active aggregation sessions.
          */
         rcu_read_lock();
@@ -514,12 +531,9 @@ static int ieee80211_stop(struct net_device *dev)
                                 BSS_CHANGED_BEACON_ENABLED);
                 }
 
-                conf.vif = &sdata->vif;
-                conf.type = sdata->vif.type;
-                conf.mac_addr = dev->dev_addr;
                 /* disable all keys for as long as this netdev is down */
                 ieee80211_disable_keys(sdata);
-                drv_remove_interface(local, &conf);
+                drv_remove_interface(local, &sdata->vif);
         }
 
         sdata->bss = NULL;
@@ -659,7 +673,7 @@ static const struct net_device_ops ieee80211_dataif_ops = {
         .ndo_start_xmit         = ieee80211_subif_start_xmit,
         .ndo_set_multicast_list = ieee80211_set_multicast_list,
         .ndo_change_mtu         = ieee80211_change_mtu,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = ieee80211_change_mac,
         .ndo_select_queue       = ieee80211_netdev_select_queue,
 };
 
@@ -779,7 +793,7 @@ int ieee80211_if_change_type(struct ieee80211_sub_if_data *sdata,
          * and goes into the requested mode.
          */
 
-        if (netif_running(sdata->dev))
+        if (ieee80211_sdata_running(sdata))
                 return -EBUSY;
 
         /* Purge and reset type-dependent state. */
@@ -833,6 +847,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         /* don't use IEEE80211_DEV_TO_SUB_IF because it checks too much */
         sdata = netdev_priv(ndev);
         ndev->ieee80211_ptr = &sdata->wdev;
+        memcpy(sdata->vif.addr, ndev->dev_addr, ETH_ALEN);
+        memcpy(sdata->name, ndev->name, IFNAMSIZ);
 
         /* initialise type-independent data */
         sdata->wdev.wiphy = local->hw.wiphy;
@@ -844,8 +860,12 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
         INIT_LIST_HEAD(&sdata->key_list);
 
-        sdata->force_unicast_rateidx = -1;
-        sdata->max_ratectrl_rateidx = -1;
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                struct ieee80211_supported_band *sband;
+                sband = local->hw.wiphy->bands[i];
+                sdata->rc_rateidx_mask[i] =
+                        sband ? (1 << sband->n_bitrates) - 1 : 0;
+        }
 
         /* setup type-dependent data */
         ieee80211_setup_sdata(sdata, type);
@@ -938,6 +958,8 @@ static u32 ieee80211_idle_on(struct ieee80211_local *local)
                wiphy_name(local->hw.wiphy));
 #endif
 
+        drv_flush(local, false);
+
         local->hw.conf.flags |= IEEE80211_CONF_IDLE;
         return IEEE80211_CONF_CHANGE_IDLE;
 }
@@ -947,16 +969,18 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
         struct ieee80211_sub_if_data *sdata;
         int count = 0;
 
+        if (!list_empty(&local->work_list))
+                return ieee80211_idle_off(local, "working");
+
         if (local->scanning)
                 return ieee80211_idle_off(local, "scanning");
 
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
                 /* do not count disabled managed interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-                    !sdata->u.mgd.associated &&
-                    list_empty(&sdata->u.mgd.work_list))
+                    !sdata->u.mgd.associated)
                         continue;
                 /* do not count unused IBSS interfaces */
                 if (sdata->vif.type == NL80211_IFTYPE_ADHOC &&
@@ -984,3 +1008,41 @@ void ieee80211_recalc_idle(struct ieee80211_local *local)
         if (chg)
                 ieee80211_hw_config(local, chg);
 }
+
+static int netdev_notify(struct notifier_block *nb,
+                         unsigned long state,
+                         void *ndev)
+{
+        struct net_device *dev = ndev;
+        struct ieee80211_sub_if_data *sdata;
+
+        if (state != NETDEV_CHANGENAME)
+                return 0;
+
+        if (!dev->ieee80211_ptr || !dev->ieee80211_ptr->wiphy)
+                return 0;
+
+        if (dev->ieee80211_ptr->wiphy->privid != mac80211_wiphy_privid)
+                return 0;
+
+        sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+
+        memcpy(sdata->name, sdata->name, IFNAMSIZ);
+
+        ieee80211_debugfs_rename_netdev(sdata);
+        return 0;
+}
+
+static struct notifier_block mac80211_netdev_notifier = {
+        .notifier_call = netdev_notify,
+};
+
+int ieee80211_iface_init(void)
+{
+        return register_netdevice_notifier(&mac80211_netdev_notifier);
+}
+
+void ieee80211_iface_exit(void)
+{
+        unregister_netdevice_notifier(&mac80211_netdev_notifier);
+}
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 659a42d529e3..8160d9c5372e 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -139,7 +139,7 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                                      struct ieee80211_sub_if_data,
                                      u.ap);
 
-        ret = drv_set_key(key->local, SET_KEY, &sdata->vif, sta, &key->conf);
+        ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
 
         if (!ret) {
                 spin_lock_bh(&todo_lock);
@@ -181,7 +181,7 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
                                      struct ieee80211_sub_if_data,
                                      u.ap);
 
-        ret = drv_set_key(key->local, DISABLE_KEY, &sdata->vif,
+        ret = drv_set_key(key->local, DISABLE_KEY, sdata,
                           sta, &key->conf);
 
         if (ret)
@@ -421,7 +421,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
                          */
 
                         /* same here, the AP could be using QoS */
-                        ap = sta_info_get(key->local, key->sdata->u.mgd.bssid);
+                        ap = sta_info_get(key->sdata, key->sdata->u.mgd.bssid);
                         if (ap) {
                                 if (test_sta_flags(ap, WLAN_STA_WME))
                                         key->conf.flags |=
@@ -443,7 +443,7 @@ void ieee80211_key_link(struct ieee80211_key *key,
         add_todo(old_key, KEY_FLAG_TODO_DELETE);
 
         add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
-        if (netif_running(sdata->dev))
+        if (ieee80211_sdata_running(sdata))
                 add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
 
         spin_unlock_irqrestore(&sdata->local->key_lock, flags);
@@ -509,7 +509,7 @@ void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata)
 {
         ASSERT_RTNL();
 
-        if (WARN_ON(!netif_running(sdata->dev)))
+        if (WARN_ON(!ieee80211_sdata_running(sdata)))
                 return;
 
         ieee80211_todo_for_each_key(sdata, KEY_FLAG_TODO_HWACCEL_ADD);
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index a49f93b79e92..bdc2968c2bbe 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -59,11 +59,17 @@ enum ieee80211_internal_key_flags {
         KEY_FLAG_TODO_DEFMGMTKEY        = BIT(6),
 };
 
+enum ieee80211_internal_tkip_state {
+        TKIP_STATE_NOT_INIT,
+        TKIP_STATE_PHASE1_DONE,
+        TKIP_STATE_PHASE1_HW_UPLOADED,
+};
+
 struct tkip_ctx {
         u32 iv32;
         u16 iv16;
         u16 p1k[5];
-        int initialized;
+        enum ieee80211_internal_tkip_state state;
 };
 
 struct ieee80211_key {
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 0d2d94881f1f..ec8f767ba95b 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -17,7 +17,6 @@
 #include <linux/skbuff.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
-#include <linux/wireless.h>
 #include <linux/rtnetlink.h>
 #include <linux/bitmap.h>
 #include <linux/pm_qos_params.h>
@@ -32,7 +31,12 @@
 #include "led.h"
 #include "cfg.h"
 #include "debugfs.h"
-#include "debugfs_netdev.h"
+
+
+bool ieee80211_disable_40mhz_24ghz;
+module_param(ieee80211_disable_40mhz_24ghz, bool, 0644);
+MODULE_PARM_DESC(ieee80211_disable_40mhz_24ghz,
+                 "Disable 40MHz support in the 2.4GHz band");
 
 void ieee80211_configure_filter(struct ieee80211_local *local)
 {
@@ -102,6 +106,9 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
         if (scan_chan) {
                 chan = scan_chan;
                 channel_type = NL80211_CHAN_NO_HT;
+        } else if (local->tmp_channel) {
+                chan = scan_chan = local->tmp_channel;
+                channel_type = local->tmp_channel_type;
         } else {
                 chan = local->oper_channel;
                 channel_type = local->oper_channel_type;
@@ -114,6 +121,18 @@ int ieee80211_hw_config(struct ieee80211_local *local, u32 changed)
                 changed |= IEEE80211_CONF_CHANGE_CHANNEL;
         }
 
+        if (!conf_is_ht(&local->hw.conf)) {
+                /*
+                 * mac80211.h documents that this is only valid
+                 * when the channel is set to an HT type, and
+                 * that otherwise STATIC is used.
+                 */
+                local->hw.conf.smps_mode = IEEE80211_SMPS_STATIC;
+        } else if (local->hw.conf.smps_mode != local->smps_mode) {
+                local->hw.conf.smps_mode = local->smps_mode;
+                changed |= IEEE80211_CONF_CHANGE_SMPS;
+        }
+
         if (scan_chan)
                 power = chan->max_power;
         else
@@ -173,7 +192,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
         } else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
                 sdata->vif.bss_conf.bssid = sdata->u.ibss.bssid;
         else if (sdata->vif.type == NL80211_IFTYPE_AP)
-                sdata->vif.bss_conf.bssid = sdata->dev->dev_addr;
+                sdata->vif.bss_conf.bssid = sdata->vif.addr;
         else if (ieee80211_vif_is_mesh(&sdata->vif)) {
                 sdata->vif.bss_conf.bssid = zero;
         } else {
@@ -195,7 +214,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
         }
 
         if (changed & BSS_CHANGED_BEACON_ENABLED) {
-                if (local->quiescing || !netif_running(sdata->dev) ||
+                if (local->quiescing || !ieee80211_sdata_running(sdata) ||
                     test_bit(SCAN_SW_SCANNING, &local->scanning)) {
                         sdata->vif.bss_conf.enable_beacon = false;
                 } else {
@@ -223,8 +242,7 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        drv_bss_info_changed(local, &sdata->vif,
-                             &sdata->vif.bss_conf, changed);
+        drv_bss_info_changed(local, sdata, &sdata->vif.bss_conf, changed);
 }
 
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
@@ -299,6 +317,16 @@ void ieee80211_restart_hw(struct ieee80211_hw *hw)
 }
 EXPORT_SYMBOL(ieee80211_restart_hw);
 
+static void ieee80211_recalc_smps_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, recalc_smps);
+
+        mutex_lock(&local->iflist_mtx);
+        ieee80211_recalc_smps(local, NULL);
+        mutex_unlock(&local->iflist_mtx);
+}
+
 struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                         const struct ieee80211_ops *ops)
 {
@@ -333,9 +361,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                         WIPHY_FLAG_4ADDR_STATION;
         wiphy->privid = mac80211_wiphy_privid;
 
-        /* Yes, putting cfg80211_bss into ieee80211_bss is a hack */
-        wiphy->bss_priv_size = sizeof(struct ieee80211_bss) -
-                               sizeof(struct cfg80211_bss);
+        wiphy->bss_priv_size = sizeof(struct ieee80211_bss);
 
         local = wiphy_priv(wiphy);
 
@@ -358,6 +384,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         local->hw.conf.long_frame_max_tx_count = wiphy->retry_long;
         local->hw.conf.short_frame_max_tx_count = wiphy->retry_short;
         local->user_power_level = -1;
+        local->uapsd_queues = IEEE80211_DEFAULT_UAPSD_QUEUES;
+        local->uapsd_max_sp_len = IEEE80211_DEFAULT_MAX_SP_LEN;
 
         INIT_LIST_HEAD(&local->interfaces);
         mutex_init(&local->iflist_mtx);
@@ -369,9 +397,13 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
 
         INIT_DELAYED_WORK(&local->scan_work, ieee80211_scan_work);
 
+        ieee80211_work_init(local);
+
         INIT_WORK(&local->restart_work, ieee80211_restart_work);
 
         INIT_WORK(&local->reconfig_filter, ieee80211_reconfig_filter);
+        INIT_WORK(&local->recalc_smps, ieee80211_recalc_smps_work);
+        local->smps_mode = IEEE80211_SMPS_OFF;
 
         INIT_WORK(&local->dynamic_ps_enable_work,
                   ieee80211_dynamic_ps_enable_work);
@@ -461,6 +493,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
                 local->hw.wiphy->signal_type = CFG80211_SIGNAL_TYPE_UNSPEC;
 
+        WARN((local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)
+             && (local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK),
+             "U-APSD not supported with HW_PS_NULLFUNC_STACK\n");
+
         /*
          * Calculate scan IE length -- we need this to alloc
          * memory and to subtract from the driver limit. It
@@ -674,11 +710,19 @@ static int __init ieee80211_init(void)
 
         ret = rc80211_pid_init();
         if (ret)
-                return ret;
+                goto err_pid;
 
-        ieee80211_debugfs_netdev_init();
+        ret = ieee80211_iface_init();
+        if (ret)
+                goto err_netdev;
 
         return 0;
+ err_netdev:
+        rc80211_pid_exit();
+ err_pid:
+        rc80211_minstrel_exit();
+
+        return ret;
 }
 
 static void __exit ieee80211_exit(void)
@@ -695,7 +739,7 @@ static void __exit ieee80211_exit(void)
         if (mesh_allocated)
                 ieee80211s_stop();
 
-        ieee80211_debugfs_netdev_exit();
+        ieee80211_iface_exit();
 }
 
 
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 6a4331429598..61080c5fad50 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -457,7 +457,7 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata,
 
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         printk(KERN_DEBUG "%s: running mesh housekeeping\n",
-               sdata->dev->name);
+               sdata->name);
 #endif
 
         ieee80211_sta_expire(sdata, IEEE80211_MESH_PEER_INACTIVITY_LIMIT);
@@ -565,7 +565,7 @@ static void ieee80211_mesh_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
 
         /* ignore ProbeResp to foreign address */
         if (stype == IEEE80211_STYPE_PROBE_RESP &&
-            compare_ether_addr(mgmt->da, sdata->dev->dev_addr))
+            compare_ether_addr(mgmt->da, sdata->vif.addr))
                 return;
 
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
@@ -645,7 +645,7 @@ static void ieee80211_mesh_work(struct work_struct *work)
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
         struct sk_buff *skb;
 
-        if (!netif_running(sdata->dev))
+        if (!ieee80211_sdata_running(sdata))
                 return;
 
         if (local->scanning)
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index d28acb6b1f81..ce84237ebad3 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -128,9 +128,9 @@ static int mesh_path_sel_frame_tx(enum mpath_frame_type action, u8 flags,
                                           IEEE80211_STYPE_ACTION);
 
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         /* BSSID == SA */
-        memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
         mgmt->u.action.category = MESH_PATH_SEL_CATEGORY;
         mgmt->u.action.u.mesh_action.action_code = MESH_PATH_SEL_ACTION;
 
@@ -222,7 +222,7 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
                                           IEEE80211_STYPE_ACTION);
 
         memcpy(mgmt->da, ra, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         /* BSSID is left zeroed, wildcard value */
         mgmt->u.action.category = MESH_PATH_SEL_CATEGORY;
         mgmt->u.action.u.mesh_action.action_code = MESH_PATH_SEL_ACTION;
@@ -335,7 +335,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
         bool process = true;
 
         rcu_read_lock();
-        sta = sta_info_get(local, mgmt->sa);
+        sta = sta_info_get(sdata, mgmt->sa);
         if (!sta) {
                 rcu_read_unlock();
                 return 0;
@@ -374,7 +374,7 @@ static u32 hwmp_route_info_get(struct ieee80211_sub_if_data *sdata,
                 new_metric = MAX_METRIC;
         exp_time = TU_TO_EXP_TIME(orig_lifetime);
 
-        if (memcmp(orig_addr, sdata->dev->dev_addr, ETH_ALEN) == 0) {
+        if (memcmp(orig_addr, sdata->vif.addr, ETH_ALEN) == 0) {
                 /* This MP is the originator, we are not interested in this
                  * frame, except for updating transmitter's path info.
                  */
@@ -486,7 +486,7 @@ static void hwmp_preq_frame_process(struct ieee80211_sub_if_data *sdata,
 
         mhwmp_dbg("received PREQ from %pM\n", orig_addr);
 
-        if (memcmp(target_addr, sdata->dev->dev_addr, ETH_ALEN) == 0) {
+        if (memcmp(target_addr, sdata->vif.addr, ETH_ALEN) == 0) {
                 mhwmp_dbg("PREQ is for us\n");
                 forward = false;
                 reply = true;
@@ -579,7 +579,7 @@ static void hwmp_prep_frame_process(struct ieee80211_sub_if_data *sdata,
          * replies
          */
         target_addr = PREP_IE_TARGET_ADDR(prep_elem);
-        if (memcmp(target_addr, sdata->dev->dev_addr, ETH_ALEN) == 0)
+        if (memcmp(target_addr, sdata->vif.addr, ETH_ALEN) == 0)
                 /* destination, no forwarding required */
                 return;
 
@@ -890,7 +890,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
                 target_flags = MP_F_RF;
 
         spin_unlock_bh(&mpath->state_lock);
-        mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->dev->dev_addr,
+        mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->vif.addr,
                         cpu_to_le32(ifmsh->sn), target_flags, mpath->dst,
                         cpu_to_le32(mpath->sn), broadcast_addr, 0,
                         ttl, cpu_to_le32(lifetime), 0,
@@ -939,7 +939,7 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
                 if (time_after(jiffies,
                                mpath->exp_time -
                                msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
-                    !memcmp(sdata->dev->dev_addr, hdr->addr4, ETH_ALEN) &&
+                    !memcmp(sdata->vif.addr, hdr->addr4, ETH_ALEN) &&
                     !(mpath->flags & MESH_PATH_RESOLVING) &&
                     !(mpath->flags & MESH_PATH_FIXED)) {
                         mesh_queue_preq(mpath,
@@ -1010,7 +1010,7 @@ mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
 
-        mesh_path_sel_frame_tx(MPATH_RANN, 0, sdata->dev->dev_addr,
+        mesh_path_sel_frame_tx(MPATH_RANN, 0, sdata->vif.addr,
                                cpu_to_le32(++ifmsh->sn),
                                0, NULL, 0, broadcast_addr,
                                0, MESH_TTL, 0, 0, 0, sdata);
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 0192cfdacae4..2312efe04c62 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -260,7 +260,7 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
+        if (memcmp(dst, sdata->vif.addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
 
@@ -377,7 +377,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
         int err = 0;
         u32 hash_idx;
 
-        if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
+        if (memcmp(dst, sdata->vif.addr, ETH_ALEN) == 0)
                 /* never add ourselves as neighbours */
                 return -ENOTSUPP;
 
@@ -605,7 +605,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
         struct mesh_path *mpath;
         u32 sn = 0;
 
-        if (memcmp(hdr->addr4, sdata->dev->dev_addr, ETH_ALEN) != 0) {
+        if (memcmp(hdr->addr4, sdata->vif.addr, ETH_ALEN) != 0) {
                 u8 *ra, *da;
 
                 da = hdr->addr3;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 0f7c6e6a4248..7985e5150898 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -169,7 +169,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata,
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
         memcpy(mgmt->da, da, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         /* BSSID is left zeroed, wildcard value */
         mgmt->u.action.category = MESH_PLINK_CATEGORY;
         mgmt->u.action.u.plink_action.action_code = action;
@@ -234,7 +234,7 @@ void mesh_neighbour_update(u8 *hw_addr, u32 rates, struct ieee80211_sub_if_data
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, hw_addr);
+        sta = sta_info_get(sdata, hw_addr);
         if (!sta) {
                 sta = mesh_plink_alloc(sdata, hw_addr, rates);
                 if (!sta) {
@@ -455,7 +455,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, mgmt->sa);
+        sta = sta_info_get(sdata, mgmt->sa);
         if (!sta && ftype != PLINK_OPEN) {
                 mpl_dbg("Mesh plink: cls or cnf from unknown peer\n");
                 rcu_read_unlock();
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 05a18f43e1bf..1e1d16c55ee5 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -75,11 +75,8 @@ enum rx_mgmt_action {
         /* caller must call cfg80211_send_disassoc() */
         RX_MGMT_CFG80211_DISASSOC,
 
-        /* caller must call cfg80211_auth_timeout() & free work */
-        RX_MGMT_CFG80211_AUTH_TO,
-
-        /* caller must call cfg80211_assoc_timeout() & free work */
-        RX_MGMT_CFG80211_ASSOC_TO,
+        /* caller must tell cfg80211 about internal error */
+        RX_MGMT_CFG80211_ASSOC_ERROR,
 };
 
 /* utils */
@@ -122,27 +119,6 @@ static int ecw2cw(int ecw)
         return (1 << ecw) - 1;
 }
 
-static int ieee80211_compatible_rates(struct ieee80211_bss *bss,
-                                      struct ieee80211_supported_band *sband,
-                                      u32 *rates)
-{
-        int i, j, count;
-        *rates = 0;
-        count = 0;
-        for (i = 0; i < bss->supp_rates_len; i++) {
-                int rate = (bss->supp_rates[i] & 0x7F) * 5;
-
-                for (j = 0; j < sband->n_bitrates; j++)
-                        if (sband->bitrates[j].bitrate == rate) {
-                                *rates |= BIT(j);
-                                count++;
-                                break;
-                        }
-        }
-
-        return count;
-}
-
 /*
  * ieee80211_enable_ht should be called only after the operating band
  * has been determined as ht configuration depends on the hw's
@@ -202,7 +178,7 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
                 ieee80211_hw_config(local, 0);
 
                 rcu_read_lock();
-                sta = sta_info_get(local, bssid);
+                sta = sta_info_get(sdata, bssid);
                 if (sta)
                         rate_control_rate_update(local, sband, sta,
                                                  IEEE80211_RC_HT_CHANGED);
@@ -228,209 +204,6 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
 
 /* frame sending functions */
 
-static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
-                                 struct ieee80211_mgd_work *wk)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-        struct sk_buff *skb;
-        struct ieee80211_mgmt *mgmt;
-        u8 *pos;
-        const u8 *ies, *ht_ie;
-        int i, len, count, rates_len, supp_rates_len;
-        u16 capab;
-        int wmm = 0;
-        struct ieee80211_supported_band *sband;
-        u32 rates = 0;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom +
-                            sizeof(*mgmt) + 200 + wk->ie_len +
-                            wk->ssid_len);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
-                       "frame\n", sdata->dev->name);
-                return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
-
-        sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
-
-        capab = ifmgd->capab;
-
-        if (local->hw.conf.channel->band == IEEE80211_BAND_2GHZ) {
-                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
-                        capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
-                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
-                        capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
-        }
-
-        if (wk->bss->cbss.capability & WLAN_CAPABILITY_PRIVACY)
-                capab |= WLAN_CAPABILITY_PRIVACY;
-        if (wk->bss->wmm_used)
-                wmm = 1;
-
-        /* get all rates supported by the device and the AP as
-         * some APs don't like getting a superset of their rates
-         * in the association request (e.g. D-Link DAP 1353 in
-         * b-only mode) */
-        rates_len = ieee80211_compatible_rates(wk->bss, sband, &rates);
-
-        if ((wk->bss->cbss.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
-            (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
-                capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
-
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        memcpy(mgmt->da, wk->bss->cbss.bssid, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-        memcpy(mgmt->bssid, wk->bss->cbss.bssid, ETH_ALEN);
-
-        if (!is_zero_ether_addr(wk->prev_bssid)) {
-                skb_put(skb, 10);
-                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                  IEEE80211_STYPE_REASSOC_REQ);
-                mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.reassoc_req.listen_interval =
-                                cpu_to_le16(local->hw.conf.listen_interval);
-                memcpy(mgmt->u.reassoc_req.current_ap, wk->prev_bssid,
-                       ETH_ALEN);
-        } else {
-                skb_put(skb, 4);
-                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                                  IEEE80211_STYPE_ASSOC_REQ);
-                mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
-                mgmt->u.assoc_req.listen_interval =
-                                cpu_to_le16(local->hw.conf.listen_interval);
-        }
-
-        /* SSID */
-        ies = pos = skb_put(skb, 2 + wk->ssid_len);
-        *pos++ = WLAN_EID_SSID;
-        *pos++ = wk->ssid_len;
-        memcpy(pos, wk->ssid, wk->ssid_len);
-
-        /* add all rates which were marked to be used above */
-        supp_rates_len = rates_len;
-        if (supp_rates_len > 8)
-                supp_rates_len = 8;
-
-        len = sband->n_bitrates;
-        pos = skb_put(skb, supp_rates_len + 2);
-        *pos++ = WLAN_EID_SUPP_RATES;
-        *pos++ = supp_rates_len;
-
-        count = 0;
-        for (i = 0; i < sband->n_bitrates; i++) {
-                if (BIT(i) & rates) {
-                        int rate = sband->bitrates[i].bitrate;
-                        *pos++ = (u8) (rate / 5);
-                        if (++count == 8)
-                                break;
-                }
-        }
-
-        if (rates_len > count) {
-                pos = skb_put(skb, rates_len - count + 2);
-                *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                *pos++ = rates_len - count;
-
-                for (i++; i < sband->n_bitrates; i++) {
-                        if (BIT(i) & rates) {
-                                int rate = sband->bitrates[i].bitrate;
-                                *pos++ = (u8) (rate / 5);
-                        }
-                }
-        }
-
-        if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
-                /* 1. power capabilities */
-                pos = skb_put(skb, 4);
-                *pos++ = WLAN_EID_PWR_CAPABILITY;
-                *pos++ = 2;
-                *pos++ = 0; /* min tx power */
-                *pos++ = local->hw.conf.channel->max_power; /* max tx power */
-
-                /* 2. supported channels */
-                /* TODO: get this in reg domain format */
-                pos = skb_put(skb, 2 * sband->n_channels + 2);
-                *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
-                *pos++ = 2 * sband->n_channels;
-                for (i = 0; i < sband->n_channels; i++) {
-                        *pos++ = ieee80211_frequency_to_channel(
-                                        sband->channels[i].center_freq);
-                        *pos++ = 1; /* one channel in the subband*/
-                }
-        }
-
-        if (wk->ie_len && wk->ie) {
-                pos = skb_put(skb, wk->ie_len);
-                memcpy(pos, wk->ie, wk->ie_len);
-        }
-
-        if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED)) {
-                pos = skb_put(skb, 9);
-                *pos++ = WLAN_EID_VENDOR_SPECIFIC;
-                *pos++ = 7; /* len */
-                *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
-                *pos++ = 0x50;
-                *pos++ = 0xf2;
-                *pos++ = 2; /* WME */
-                *pos++ = 0; /* WME info */
-                *pos++ = 1; /* WME ver */
-                *pos++ = 0;
-        }
-
-        /* wmm support is a must to HT */
-        /*
-         * IEEE802.11n does not allow TKIP/WEP as pairwise
-         * ciphers in HT mode. We still associate in non-ht
-         * mode (11a/b/g) if any one of these ciphers is
-         * configured as pairwise.
-         */
-        if (wmm && (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
-            sband->ht_cap.ht_supported &&
-            (ht_ie = ieee80211_bss_get_ie(&wk->bss->cbss, WLAN_EID_HT_INFORMATION)) &&
-            ht_ie[1] >= sizeof(struct ieee80211_ht_info) &&
-            (!(ifmgd->flags & IEEE80211_STA_DISABLE_11N))) {
-                struct ieee80211_ht_info *ht_info =
-                        (struct ieee80211_ht_info *)(ht_ie + 2);
-                u16 cap = sband->ht_cap.cap;
-                __le16 tmp;
-                u32 flags = local->hw.conf.channel->flags;
-
-                switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
-                case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
-                        if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
-                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                                cap &= ~IEEE80211_HT_CAP_SGI_40;
-                        }
-                        break;
-                case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
-                        if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
-                                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
-                                cap &= ~IEEE80211_HT_CAP_SGI_40;
-                        }
-                        break;
-                }
-
-                tmp = cpu_to_le16(cap);
-                pos = skb_put(skb, sizeof(struct ieee80211_ht_cap)+2);
-                *pos++ = WLAN_EID_HT_CAPABILITY;
-                *pos++ = sizeof(struct ieee80211_ht_cap);
-                memset(pos, 0, sizeof(struct ieee80211_ht_cap));
-                memcpy(pos, &tmp, sizeof(u16));
-                pos += sizeof(u16);
-                /* TODO: needs a define here for << 2 */
-                *pos++ = sband->ht_cap.ampdu_factor |
-                         (sband->ht_cap.ampdu_density << 2);
-                memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
-        }
-
-        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
-        ieee80211_tx_skb(sdata, skb);
-}
-
-
 static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
                                            const u8 *bssid, u16 stype, u16 reason,
                                            void *cookie)
@@ -443,7 +216,7 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt));
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for "
-                       "deauth/disassoc frame\n", sdata->dev->name);
+                       "deauth/disassoc frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
@@ -451,7 +224,7 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
         mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(mgmt, 0, 24);
         memcpy(mgmt->da, bssid, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, bssid, ETH_ALEN);
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | stype);
         skb_put(skb, 2);
@@ -476,30 +249,15 @@ static void ieee80211_send_deauth_disassoc(struct ieee80211_sub_if_data *sdata,
 void ieee80211_send_pspoll(struct ieee80211_local *local,
                            struct ieee80211_sub_if_data *sdata)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_pspoll *pspoll;
         struct sk_buff *skb;
-        u16 fc;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for "
-                       "pspoll frame\n", sdata->dev->name);
+        skb = ieee80211_pspoll_get(&local->hw, &sdata->vif);
+        if (!skb)
                 return;
-        }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
-        memset(pspoll, 0, sizeof(*pspoll));
-        fc = IEEE80211_FTYPE_CTL | IEEE80211_STYPE_PSPOLL | IEEE80211_FCTL_PM;
-        pspoll->frame_control = cpu_to_le16(fc);
-        pspoll->aid = cpu_to_le16(ifmgd->aid);
-
-        /* aid in PS-Poll has its two MSBs each set to 1 */
-        pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
-
-        memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
-        memcpy(pspoll->ta, sdata->dev->dev_addr, ETH_ALEN);
+        pspoll = (struct ieee80211_pspoll *) skb->data;
+        pspoll->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         ieee80211_tx_skb(sdata, skb);
@@ -510,30 +268,47 @@ void ieee80211_send_nullfunc(struct ieee80211_local *local,
                              int powersave)
 {
         struct sk_buff *skb;
+        struct ieee80211_hdr_3addr *nullfunc;
+
+        skb = ieee80211_nullfunc_get(&local->hw, &sdata->vif);
+        if (!skb)
+                return;
+
+        nullfunc = (struct ieee80211_hdr_3addr *) skb->data;
+        if (powersave)
+                nullfunc->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM);
+
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
+}
+
+static void ieee80211_send_4addr_nullfunc(struct ieee80211_local *local,
+                                          struct ieee80211_sub_if_data *sdata)
+{
+        struct sk_buff *skb;
         struct ieee80211_hdr *nullfunc;
         __le16 fc;
 
         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return;
 
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 24);
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + 30);
         if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
-                       "frame\n", sdata->dev->name);
+                printk(KERN_DEBUG "%s: failed to allocate buffer for 4addr "
+                       "nullfunc frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 24);
-        memset(nullfunc, 0, 24);
+        nullfunc = (struct ieee80211_hdr *) skb_put(skb, 30);
+        memset(nullfunc, 0, 30);
         fc = cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_NULLFUNC |
-                         IEEE80211_FCTL_TODS);
-        if (powersave)
-                fc |= cpu_to_le16(IEEE80211_FCTL_PM);
+                         IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
         nullfunc->frame_control = fc;
         memcpy(nullfunc->addr1, sdata->u.mgd.bssid, ETH_ALEN);
-        memcpy(nullfunc->addr2, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(nullfunc->addr2, sdata->vif.addr, ETH_ALEN);
         memcpy(nullfunc->addr3, sdata->u.mgd.bssid, ETH_ALEN);
+        memcpy(nullfunc->addr4, sdata->vif.addr, ETH_ALEN);
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         ieee80211_tx_skb(sdata, skb);
@@ -546,7 +321,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                 container_of(work, struct ieee80211_sub_if_data, u.mgd.chswitch_work);
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        if (!netif_running(sdata->dev))
+        if (!ieee80211_sdata_running(sdata))
                 return;
 
         mutex_lock(&ifmgd->mtx);
@@ -557,7 +332,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         ieee80211_hw_config(sdata->local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         /* XXX: shouldn't really modify cfg80211-owned data! */
-        ifmgd->associated->cbss.channel = sdata->local->oper_channel;
+        ifmgd->associated->channel = sdata->local->oper_channel;
 
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
@@ -584,6 +359,8 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                                       struct ieee80211_channel_sw_ie *sw_elem,
                                       struct ieee80211_bss *bss)
 {
+        struct cfg80211_bss *cbss =
+                container_of((void *)bss, struct cfg80211_bss, priv);
         struct ieee80211_channel *new_ch;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         int new_freq = ieee80211_channel_to_frequency(sw_elem->new_ch_num);
@@ -617,7 +394,7 @@ void ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                 mod_timer(&ifmgd->chswitch_timer,
                           jiffies +
                           msecs_to_jiffies(sw_elem->count *
-                                           bss->cbss.beacon_interval));
+                                           cbss->beacon_interval));
         }
 }
 
@@ -691,8 +468,13 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 return;
         }
 
+        if (!list_empty(&local->work_list)) {
+                local->ps_sdata = NULL;
+                goto change;
+        }
+
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
                 if (sdata->vif.type != NL80211_IFTYPE_STATION)
                         continue;
@@ -701,7 +483,7 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
         }
 
         if (count == 1 && found->u.mgd.powersave &&
-            found->u.mgd.associated && list_empty(&found->u.mgd.work_list) &&
+            found->u.mgd.associated &&
             !(found->u.mgd.flags & (IEEE80211_STA_BEACON_POLL |
                                     IEEE80211_STA_CONNECTION_POLL))) {
                 s32 beaconint_us;
@@ -729,6 +511,7 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 local->ps_sdata = NULL;
         }
 
+ change:
         ieee80211_change_ps(local);
 }
 
@@ -786,9 +569,9 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         struct ieee80211_tx_queue_params params;
         size_t left;
         int count;
-        u8 *pos;
+        u8 *pos, uapsd_queues = 0;
 
-        if (!(ifmgd->flags & IEEE80211_STA_WMM_ENABLED))
+        if (local->hw.queues < 4)
                 return;
 
         if (!wmm_param)
@@ -796,6 +579,10 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
 
         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
                 return;
+
+        if (ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
+                uapsd_queues = local->uapsd_queues;
+
         count = wmm_param[6] & 0x0f;
         if (count == ifmgd->wmm_last_param_set)
                 return;
@@ -810,6 +597,7 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         for (; left >= 4; left -= 4, pos += 4) {
                 int aci = (pos[0] >> 5) & 0x03;
                 int acm = (pos[0] >> 4) & 0x01;
+                bool uapsd = false;
                 int queue;
 
                 switch (aci) {
@@ -817,22 +605,30 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                         queue = 3;
                         if (acm)
                                 local->wmm_acm |= BIT(1) | BIT(2); /* BK/- */
+                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BK)
+                                uapsd = true;
                         break;
                 case 2: /* AC_VI */
                         queue = 1;
                         if (acm)
                                 local->wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
+                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VI)
+                                uapsd = true;
                         break;
                 case 3: /* AC_VO */
                         queue = 0;
                         if (acm)
                                 local->wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
+                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
+                                uapsd = true;
                         break;
                 case 0: /* AC_BE */
                 default:
                         queue = 2;
                         if (acm)
                                 local->wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
+                        if (uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_BE)
+                                uapsd = true;
                         break;
                 }
 
@@ -840,11 +636,14 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
                 params.cw_min = ecw2cw(pos[1] & 0x0f);
                 params.txop = get_unaligned_le16(pos + 2);
+                params.uapsd = uapsd;
+
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 printk(KERN_DEBUG "%s: WMM queue=%d aci=%d acm=%d aifs=%d "
-                       "cWmin=%d cWmax=%d txop=%d\n",
+                       "cWmin=%d cWmax=%d txop=%d uapsd=%d\n",
                        wiphy_name(local->hw.wiphy), queue, aci, acm,
-                       params.aifs, params.cw_min, params.cw_max, params.txop);
+                       params.aifs, params.cw_min, params.cw_max, params.txop,
+                       params.uapsd);
 #endif
                 if (drv_conf_tx(local, queue, &params) && local->ops->conf_tx)
                         printk(KERN_DEBUG "%s: failed to set TX queue "
@@ -871,6 +670,8 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
         }
 
         use_short_slot = !!(capab & WLAN_CAPABILITY_SHORT_SLOT_TIME);
+        if (sdata->local->hw.conf.channel->band == IEEE80211_BAND_5GHZ)
+                use_short_slot = true;
 
         if (use_protection != bss_conf->use_cts_prot) {
                 bss_conf->use_cts_prot = use_protection;
@@ -891,25 +692,24 @@ static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
 }
 
 static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgd_work *wk,
+                                     struct cfg80211_bss *cbss,
                                      u32 bss_info_changed)
 {
+        struct ieee80211_bss *bss = (void *)cbss->priv;
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_bss *bss = wk->bss;
 
         bss_info_changed |= BSS_CHANGED_ASSOC;
         /* set timing information */
-        sdata->vif.bss_conf.beacon_int = bss->cbss.beacon_interval;
-        sdata->vif.bss_conf.timestamp = bss->cbss.tsf;
+        sdata->vif.bss_conf.beacon_int = cbss->beacon_interval;
+        sdata->vif.bss_conf.timestamp = cbss->tsf;
         sdata->vif.bss_conf.dtim_period = bss->dtim_period;
 
         bss_info_changed |= BSS_CHANGED_BEACON_INT;
         bss_info_changed |= ieee80211_handle_bss_capability(sdata,
-                bss->cbss.capability, bss->has_erp_value, bss->erp_value);
+                cbss->capability, bss->has_erp_value, bss->erp_value);
 
-        sdata->u.mgd.associated = bss;
-        sdata->u.mgd.old_associate_work = wk;
-        memcpy(sdata->u.mgd.bssid, bss->cbss.bssid, ETH_ALEN);
+        sdata->u.mgd.associated = cbss;
+        memcpy(sdata->u.mgd.bssid, cbss->bssid, ETH_ALEN);
 
         /* just to be sure */
         sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
@@ -940,99 +740,14 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         mutex_lock(&local->iflist_mtx);
         ieee80211_recalc_ps(local, -1);
+        ieee80211_recalc_smps(local, sdata);
         mutex_unlock(&local->iflist_mtx);
 
         netif_tx_start_all_queues(sdata->dev);
         netif_carrier_on(sdata->dev);
 }
 
-static enum rx_mgmt_action __must_check
-ieee80211_direct_probe(struct ieee80211_sub_if_data *sdata,
-                       struct ieee80211_mgd_work *wk)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-
-        wk->tries++;
-        if (wk->tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: direct probe to AP %pM timed out\n",
-                       sdata->dev->name, wk->bss->cbss.bssid);
-
-                /*
-                 * Most likely AP is not in the range so remove the
-                 * bss struct for that AP.
-                 */
-                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
-
-                /*
-                 * We might have a pending scan which had no chance to run yet
-                 * due to work needing to be done. Hence, queue the STAs work
-                 * again for that.
-                 */
-                ieee80211_queue_work(&local->hw, &ifmgd->work);
-                return RX_MGMT_CFG80211_AUTH_TO;
-        }
-
-        printk(KERN_DEBUG "%s: direct probe to AP %pM (try %d)\n",
-                        sdata->dev->name, wk->bss->cbss.bssid,
-                        wk->tries);
-
-        /*
-         * Direct probe is sent to broadcast address as some APs
-         * will not answer to direct packet in unassociated state.
-         */
-        ieee80211_send_probe_req(sdata, NULL, wk->ssid, wk->ssid_len, NULL, 0);
-
-        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-        run_again(ifmgd, wk->timeout);
-
-        return RX_MGMT_NONE;
-}
-
-
-static enum rx_mgmt_action __must_check
-ieee80211_authenticate(struct ieee80211_sub_if_data *sdata,
-                       struct ieee80211_mgd_work *wk)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-
-        wk->tries++;
-        if (wk->tries > IEEE80211_AUTH_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: authentication with AP %pM"
-                       " timed out\n",
-                       sdata->dev->name, wk->bss->cbss.bssid);
-
-                /*
-                 * Most likely AP is not in the range so remove the
-                 * bss struct for that AP.
-                 */
-                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
-
-                /*
-                 * We might have a pending scan which had no chance to run yet
-                 * due to work needing to be done. Hence, queue the STAs work
-                 * again for that.
-                 */
-                ieee80211_queue_work(&local->hw, &ifmgd->work);
-                return RX_MGMT_CFG80211_AUTH_TO;
-        }
-
-        printk(KERN_DEBUG "%s: authenticate with AP %pM (try %d)\n",
-               sdata->dev->name, wk->bss->cbss.bssid, wk->tries);
-
-        ieee80211_send_auth(sdata, 1, wk->auth_alg, wk->ie, wk->ie_len,
-                            wk->bss->cbss.bssid, NULL, 0, 0);
-        wk->auth_transaction = 2;
-
-        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
-        run_again(ifmgd, wk->timeout);
-
-        return RX_MGMT_NONE;
-}
-
-static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
-                                   bool deauth)
+static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
@@ -1045,21 +760,11 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON(!ifmgd->associated))
                 return;
 
-        memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
+        memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
 
         ifmgd->associated = NULL;
         memset(ifmgd->bssid, 0, ETH_ALEN);
 
-        if (deauth) {
-                kfree(ifmgd->old_associate_work);
-                ifmgd->old_associate_work = NULL;
-        } else {
-                struct ieee80211_mgd_work *wk = ifmgd->old_associate_work;
-
-                wk->state = IEEE80211_MGD_STATE_IDLE;
-                list_add(&wk->list, &ifmgd->work_list);
-        }
-
         /*
          * we need to commit the associated = NULL change because the
          * scan code uses that to determine whether this iface should
@@ -1078,7 +783,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         netif_carrier_off(sdata->dev);
 
         rcu_read_lock();
-        sta = sta_info_get(local, bssid);
+        sta = sta_info_get(sdata, bssid);
         if (sta)
                 ieee80211_sta_tear_down_BA_sessions(sta);
         rcu_read_unlock();
@@ -1115,7 +820,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         rcu_read_lock();
 
-        sta = sta_info_get(local, bssid);
+        sta = sta_info_get(sdata, bssid);
         if (!sta) {
                 rcu_read_unlock();
                 return;
@@ -1128,44 +833,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         sta_info_destroy(sta);
 }
 
-static enum rx_mgmt_action __must_check
-ieee80211_associate(struct ieee80211_sub_if_data *sdata,
-                    struct ieee80211_mgd_work *wk)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-
-        wk->tries++;
-        if (wk->tries > IEEE80211_ASSOC_MAX_TRIES) {
-                printk(KERN_DEBUG "%s: association with AP %pM"
-                       " timed out\n",
-                       sdata->dev->name, wk->bss->cbss.bssid);
-
-                /*
-                 * Most likely AP is not in the range so remove the
-                 * bss struct for that AP.
-                 */
-                cfg80211_unlink_bss(local->hw.wiphy, &wk->bss->cbss);
-
-                /*
-                 * We might have a pending scan which had no chance to run yet
-                 * due to work needing to be done. Hence, queue the STAs work
-                 * again for that.
-                 */
-                ieee80211_queue_work(&local->hw, &ifmgd->work);
-                return RX_MGMT_CFG80211_ASSOC_TO;
-        }
-
-        printk(KERN_DEBUG "%s: associate with AP %pM (try %d)\n",
-               sdata->dev->name, wk->bss->cbss.bssid, wk->tries);
-        ieee80211_send_assoc(sdata, wk);
-
-        wk->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
-        run_again(ifmgd, wk->timeout);
-
-        return RX_MGMT_NONE;
-}
-
 void ieee80211_sta_rx_notify(struct ieee80211_sub_if_data *sdata,
                              struct ieee80211_hdr *hdr)
 {
@@ -1189,8 +856,8 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         const u8 *ssid;
 
-        ssid = ieee80211_bss_get_ie(&ifmgd->associated->cbss, WLAN_EID_SSID);
-        ieee80211_send_probe_req(sdata, ifmgd->associated->cbss.bssid,
+        ssid = ieee80211_bss_get_ie(ifmgd->associated, WLAN_EID_SSID);
+        ieee80211_send_probe_req(sdata, ifmgd->associated->bssid,
                                  ssid + 2, ssid[1], NULL, 0);
 
         ifmgd->probe_send_count++;
@@ -1204,12 +871,15 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         bool already = false;
 
-        if (!netif_running(sdata->dev))
+        if (!ieee80211_sdata_running(sdata))
                 return;
 
         if (sdata->local->scanning)
                 return;
 
+        if (sdata->local->tmp_channel)
+                return;
+
         mutex_lock(&ifmgd->mtx);
 
         if (!ifmgd->associated)
@@ -1218,7 +888,7 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
         if (beacon && net_ratelimit())
                 printk(KERN_DEBUG "%s: detected beacon loss from AP "
-                       "- sending probe request\n", sdata->dev->name);
+                       "- sending probe request\n", sdata->name);
 #endif
 
         /*
@@ -1271,88 +941,8 @@ void ieee80211_beacon_loss(struct ieee80211_vif *vif)
 }
 EXPORT_SYMBOL(ieee80211_beacon_loss);
 
-static void ieee80211_auth_completed(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgd_work *wk)
-{
-        wk->state = IEEE80211_MGD_STATE_IDLE;
-        printk(KERN_DEBUG "%s: authenticated\n", sdata->dev->name);
-}
-
-
-static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
-                                     struct ieee80211_mgd_work *wk,
-                                     struct ieee80211_mgmt *mgmt,
-                                     size_t len)
-{
-        u8 *pos;
-        struct ieee802_11_elems elems;
-
-        pos = mgmt->u.auth.variable;
-        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-        if (!elems.challenge)
-                return;
-        ieee80211_send_auth(sdata, 3, wk->auth_alg,
-                            elems.challenge - 2, elems.challenge_len + 2,
-                            wk->bss->cbss.bssid,
-                            wk->key, wk->key_len, wk->key_idx);
-        wk->auth_transaction = 4;
-}
-
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
-                       struct ieee80211_mgd_work *wk,
-                       struct ieee80211_mgmt *mgmt, size_t len)
-{
-        u16 auth_alg, auth_transaction, status_code;
-
-        if (wk->state != IEEE80211_MGD_STATE_AUTH)
-                return RX_MGMT_NONE;
-
-        if (len < 24 + 6)
-                return RX_MGMT_NONE;
-
-        if (memcmp(wk->bss->cbss.bssid, mgmt->sa, ETH_ALEN) != 0)
-                return RX_MGMT_NONE;
-
-        if (memcmp(wk->bss->cbss.bssid, mgmt->bssid, ETH_ALEN) != 0)
-                return RX_MGMT_NONE;
-
-        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
-        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
-        status_code = le16_to_cpu(mgmt->u.auth.status_code);
-
-        if (auth_alg != wk->auth_alg ||
-            auth_transaction != wk->auth_transaction)
-                return RX_MGMT_NONE;
-
-        if (status_code != WLAN_STATUS_SUCCESS) {
-                list_del(&wk->list);
-                kfree(wk);
-                return RX_MGMT_CFG80211_AUTH;
-        }
-
-        switch (wk->auth_alg) {
-        case WLAN_AUTH_OPEN:
-        case WLAN_AUTH_LEAP:
-        case WLAN_AUTH_FT:
-                ieee80211_auth_completed(sdata, wk);
-                return RX_MGMT_CFG80211_AUTH;
-        case WLAN_AUTH_SHARED_KEY:
-                if (wk->auth_transaction == 4) {
-                        ieee80211_auth_completed(sdata, wk);
-                        return RX_MGMT_CFG80211_AUTH;
-                } else
-                        ieee80211_auth_challenge(sdata, wk, mgmt, len);
-                break;
-        }
-
-        return RX_MGMT_NONE;
-}
-
-
 static enum rx_mgmt_action __must_check
 ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
-                         struct ieee80211_mgd_work *wk,
                          struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
@@ -1364,23 +954,15 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
 
         ASSERT_MGD_MTX(ifmgd);
 
-        if (wk)
-                bssid = wk->bss->cbss.bssid;
-        else
-                bssid = ifmgd->associated->cbss.bssid;
+        bssid = ifmgd->associated->bssid;
 
         reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
         printk(KERN_DEBUG "%s: deauthenticated from %pM (Reason: %u)\n",
-                        sdata->dev->name, bssid, reason_code);
+                        sdata->name, bssid, reason_code);
 
-        if (!wk) {
-                ieee80211_set_disassoc(sdata, true);
-                ieee80211_recalc_idle(sdata->local);
-        } else {
-                list_del(&wk->list);
-                kfree(wk);
-        }
+        ieee80211_set_disassoc(sdata);
+        ieee80211_recalc_idle(sdata->local);
 
         return RX_MGMT_CFG80211_DEAUTH;
 }
@@ -1401,123 +983,72 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
         if (WARN_ON(!ifmgd->associated))
                 return RX_MGMT_NONE;
 
-        if (WARN_ON(memcmp(ifmgd->associated->cbss.bssid, mgmt->sa, ETH_ALEN)))
+        if (WARN_ON(memcmp(ifmgd->associated->bssid, mgmt->sa, ETH_ALEN)))
                 return RX_MGMT_NONE;
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
         printk(KERN_DEBUG "%s: disassociated from %pM (Reason: %u)\n",
-                        sdata->dev->name, mgmt->sa, reason_code);
+                        sdata->name, mgmt->sa, reason_code);
 
-        ieee80211_set_disassoc(sdata, false);
+        ieee80211_set_disassoc(sdata);
         ieee80211_recalc_idle(sdata->local);
         return RX_MGMT_CFG80211_DISASSOC;
 }
 
 
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_mgd_work *wk,
-                             struct ieee80211_mgmt *mgmt, size_t len,
-                             bool reassoc)
+static bool ieee80211_assoc_success(struct ieee80211_work *wk,
+                                    struct ieee80211_mgmt *mgmt, size_t len)
 {
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_supported_band *sband;
         struct sta_info *sta;
+        struct cfg80211_bss *cbss = wk->assoc.bss;
+        u8 *pos;
         u32 rates, basic_rates;
-        u16 capab_info, status_code, aid;
+        u16 capab_info, aid;
         struct ieee802_11_elems elems;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
-        u8 *pos;
         u32 changed = 0;
-        int i, j;
-        bool have_higher_than_11mbit = false, newsta = false;
+        int i, j, err;
+        bool have_higher_than_11mbit = false;
         u16 ap_ht_cap_flags;
 
-        /*
-         * AssocResp and ReassocResp have identical structure, so process both
-         * of them in this function.
-         */
-
-        if (len < 24 + 6)
-                return RX_MGMT_NONE;
-
-        if (memcmp(wk->bss->cbss.bssid, mgmt->sa, ETH_ALEN) != 0)
-                return RX_MGMT_NONE;
+        /* AssocResp and ReassocResp have identical structure */
 
-        capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
-        status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
         aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
-
-        printk(KERN_DEBUG "%s: RX %sssocResp from %pM (capab=0x%x "
-               "status=%d aid=%d)\n",
-               sdata->dev->name, reassoc ? "Rea" : "A", mgmt->sa,
-               capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
-
-        pos = mgmt->u.assoc_resp.variable;
-        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
-
-        if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
-            elems.timeout_int && elems.timeout_int_len == 5 &&
-            elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
-                u32 tu, ms;
-                tu = get_unaligned_le32(elems.timeout_int + 1);
-                ms = tu * 1024 / 1000;
-                printk(KERN_DEBUG "%s: AP rejected association temporarily; "
-                       "comeback duration %u TU (%u ms)\n",
-                       sdata->dev->name, tu, ms);
-                wk->timeout = jiffies + msecs_to_jiffies(ms);
-                if (ms > IEEE80211_ASSOC_TIMEOUT)
-                        run_again(ifmgd, jiffies + msecs_to_jiffies(ms));
-                return RX_MGMT_NONE;
-        }
-
-        if (status_code != WLAN_STATUS_SUCCESS) {
-                printk(KERN_DEBUG "%s: AP denied association (code=%d)\n",
-                       sdata->dev->name, status_code);
-                wk->state = IEEE80211_MGD_STATE_IDLE;
-                return RX_MGMT_CFG80211_ASSOC;
-        }
+        capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
 
         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
                 printk(KERN_DEBUG "%s: invalid aid value %d; bits 15:14 not "
-                       "set\n", sdata->dev->name, aid);
+                       "set\n", sdata->name, aid);
         aid &= ~(BIT(15) | BIT(14));
 
+        pos = mgmt->u.assoc_resp.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+
         if (!elems.supp_rates) {
                 printk(KERN_DEBUG "%s: no SuppRates element in AssocResp\n",
-                       sdata->dev->name);
-                return RX_MGMT_NONE;
+                       sdata->name);
+                return false;
         }
 
-        printk(KERN_DEBUG "%s: associated\n", sdata->dev->name);
         ifmgd->aid = aid;
 
-        rcu_read_lock();
-
-        /* Add STA entry for the AP */
-        sta = sta_info_get(local, wk->bss->cbss.bssid);
+        sta = sta_info_alloc(sdata, cbss->bssid, GFP_KERNEL);
         if (!sta) {
-                newsta = true;
-
-                rcu_read_unlock();
-
-                sta = sta_info_alloc(sdata, wk->bss->cbss.bssid, GFP_KERNEL);
-                if (!sta) {
-                        printk(KERN_DEBUG "%s: failed to alloc STA entry for"
-                               " the AP\n", sdata->dev->name);
-                        return RX_MGMT_NONE;
-                }
-
-                set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC |
-                                   WLAN_STA_ASSOC_AP);
-                if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
-                        set_sta_flags(sta, WLAN_STA_AUTHORIZED);
-
-                rcu_read_lock();
+                printk(KERN_DEBUG "%s: failed to alloc STA entry for"
+                       " the AP\n", sdata->name);
+                return false;
         }
 
+        set_sta_flags(sta, WLAN_STA_AUTH | WLAN_STA_ASSOC |
+                           WLAN_STA_ASSOC_AP);
+        if (!(ifmgd->flags & IEEE80211_STA_CONTROL_PORT))
+                set_sta_flags(sta, WLAN_STA_AUTHORIZED);
+
         rates = 0;
         basic_rates = 0;
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
@@ -1580,40 +1111,40 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         if (elems.wmm_param)
                 set_sta_flags(sta, WLAN_STA_WME);
 
-        if (newsta) {
-                int err = sta_info_insert(sta);
-                if (err) {
-                        printk(KERN_DEBUG "%s: failed to insert STA entry for"
-                               " the AP (error %d)\n", sdata->dev->name, err);
-                        rcu_read_unlock();
-                        return RX_MGMT_NONE;
-                }
+        err = sta_info_insert(sta);
+        sta = NULL;
+        if (err) {
+                printk(KERN_DEBUG "%s: failed to insert STA entry for"
+                       " the AP (error %d)\n", sdata->name, err);
+                return false;
         }
 
-        rcu_read_unlock();
-
         if (elems.wmm_param)
                 ieee80211_sta_wmm_params(local, ifmgd, elems.wmm_param,
                                          elems.wmm_param_len);
         else
                 ieee80211_set_wmm_default(sdata);
 
+        local->oper_channel = wk->chan;
+
         if (elems.ht_info_elem && elems.wmm_param &&
-            (ifmgd->flags & IEEE80211_STA_WMM_ENABLED) &&
+            (sdata->local->hw.queues >= 4) &&
             !(ifmgd->flags & IEEE80211_STA_DISABLE_11N))
                 changed |= ieee80211_enable_ht(sdata, elems.ht_info_elem,
-                                               wk->bss->cbss.bssid,
-                                               ap_ht_cap_flags);
-
-        /* delete work item -- must be before set_associated for PS */
-        list_del(&wk->list);
+                                               cbss->bssid, ap_ht_cap_flags);
 
         /* set AID and assoc capability,
          * ieee80211_set_associated() will tell the driver */
         bss_conf->aid = aid;
         bss_conf->assoc_capability = capab_info;
-        /* this will take ownership of wk */
-        ieee80211_set_associated(sdata, wk, changed);
+        ieee80211_set_associated(sdata, cbss, changed);
+
+        /*
+         * If we're using 4-addr mode, let the AP know that we're
+         * doing so, so that it can create the STA VLAN on its side
+         */
+        if (ifmgd->use_4addr)
+                ieee80211_send_4addr_nullfunc(local, sdata);
 
         /*
          * Start timer to probe the connection to the AP now.
@@ -1622,7 +1153,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         ieee80211_sta_rx_notify(sdata, (struct ieee80211_hdr *)mgmt);
         mod_beacon_timer(sdata);
 
-        return RX_MGMT_CFG80211_ASSOC;
+        return true;
 }
 
 
@@ -1657,7 +1188,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                 return;
 
         if (elems->ch_switch_elem && (elems->ch_switch_elem_len == 3) &&
-            (memcmp(mgmt->bssid, sdata->u.mgd.associated->cbss.bssid,
+            (memcmp(mgmt->bssid, sdata->u.mgd.associated->bssid,
                                                         ETH_ALEN) == 0)) {
                 struct ieee80211_channel_sw_ie *sw_elem =
                         (struct ieee80211_channel_sw_ie *)elems->ch_switch_elem;
@@ -1667,19 +1198,19 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
 
 
 static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
-                                         struct ieee80211_mgd_work *wk,
-                                         struct ieee80211_mgmt *mgmt, size_t len,
-                                         struct ieee80211_rx_status *rx_status)
+                                         struct sk_buff *skb)
 {
+        struct ieee80211_mgmt *mgmt = (void *)skb->data;
         struct ieee80211_if_managed *ifmgd;
-        size_t baselen;
+        struct ieee80211_rx_status *rx_status = (void *) skb->cb;
+        size_t baselen, len = skb->len;
         struct ieee802_11_elems elems;
 
         ifmgd = &sdata->u.mgd;
 
         ASSERT_MGD_MTX(ifmgd);
 
-        if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
+        if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
                 return; /* ignore ProbeResp to foreign address */
 
         baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
@@ -1691,17 +1222,8 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_rx_bss_info(sdata, mgmt, len, rx_status, &elems, false);
 
-        /* direct probe may be part of the association flow */
-        if (wk && wk->state == IEEE80211_MGD_STATE_PROBE) {
-                printk(KERN_DEBUG "%s: direct probe responded\n",
-                       sdata->dev->name);
-                wk->tries = 0;
-                wk->state = IEEE80211_MGD_STATE_AUTH;
-                WARN_ON(ieee80211_authenticate(sdata, wk) != RX_MGMT_NONE);
-        }
-
         if (ifmgd->associated &&
-            memcmp(mgmt->bssid, ifmgd->associated->cbss.bssid, ETH_ALEN) == 0 &&
+            memcmp(mgmt->bssid, ifmgd->associated->bssid, ETH_ALEN) == 0 &&
             ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                             IEEE80211_STA_CONNECTION_POLL)) {
                 ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
@@ -1774,7 +1296,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         if (!ifmgd->associated)
                 return;
 
-        bssid = ifmgd->associated->cbss.bssid;
+        bssid = ifmgd->associated->bssid;
 
         /*
          * And in theory even frames from a different AP we were just
@@ -1787,7 +1309,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "%s: cancelling probereq poll due "
-                               "to a received beacon\n", sdata->dev->name);
+                               "to a received beacon\n", sdata->name);
                 }
 #endif
                 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
@@ -1865,7 +1387,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
 
                 rcu_read_lock();
 
-                sta = sta_info_get(local, bssid);
+                sta = sta_info_get(sdata, bssid);
                 if (WARN_ON(!sta)) {
                         rcu_read_unlock();
                         return;
@@ -1913,9 +1435,6 @@ ieee80211_rx_result ieee80211_sta_rx_mgmt(struct ieee80211_sub_if_data *sdata,
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_PROBE_RESP:
         case IEEE80211_STYPE_BEACON:
-        case IEEE80211_STYPE_AUTH:
-        case IEEE80211_STYPE_ASSOC_RESP:
-        case IEEE80211_STYPE_REASSOC_RESP:
         case IEEE80211_STYPE_DEAUTH:
         case IEEE80211_STYPE_DISASSOC:
         case IEEE80211_STYPE_ACTION:
@@ -1933,7 +1452,6 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
-        struct ieee80211_mgd_work *wk;
         enum rx_mgmt_action rma = RX_MGMT_NONE;
         u16 fc;
 
@@ -1944,20 +1462,17 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         mutex_lock(&ifmgd->mtx);
 
         if (ifmgd->associated &&
-            memcmp(ifmgd->associated->cbss.bssid, mgmt->bssid,
-                                                        ETH_ALEN) == 0) {
+            memcmp(ifmgd->associated->bssid, mgmt->bssid, ETH_ALEN) == 0) {
                 switch (fc & IEEE80211_FCTL_STYPE) {
                 case IEEE80211_STYPE_BEACON:
                         ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
                                                  rx_status);
                         break;
                 case IEEE80211_STYPE_PROBE_RESP:
-                        ieee80211_rx_mgmt_probe_resp(sdata, NULL, mgmt,
-                                                     skb->len, rx_status);
+                        ieee80211_rx_mgmt_probe_resp(sdata, skb);
                         break;
                 case IEEE80211_STYPE_DEAUTH:
-                        rma = ieee80211_rx_mgmt_deauth(sdata, NULL,
-                                                       mgmt, skb->len);
+                        rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
                         break;
                 case IEEE80211_STYPE_DISASSOC:
                         rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
@@ -1968,7 +1483,7 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
                         ieee80211_sta_process_chanswitch(sdata,
                                         &mgmt->u.action.u.chan_switch.sw_elem,
-                                        ifmgd->associated);
+                                        (void *)ifmgd->associated->priv);
                         break;
                 }
                 mutex_unlock(&ifmgd->mtx);
@@ -1989,58 +1504,11 @@ static void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 goto out;
         }
 
-        list_for_each_entry(wk, &ifmgd->work_list, list) {
-                if (memcmp(wk->bss->cbss.bssid, mgmt->bssid, ETH_ALEN) != 0)
-                        continue;
-
-                switch (fc & IEEE80211_FCTL_STYPE) {
-                case IEEE80211_STYPE_PROBE_RESP:
-                        ieee80211_rx_mgmt_probe_resp(sdata, wk, mgmt, skb->len,
-                                                     rx_status);
-                        break;
-                case IEEE80211_STYPE_AUTH:
-                        rma = ieee80211_rx_mgmt_auth(sdata, wk, mgmt, skb->len);
-                        break;
-                case IEEE80211_STYPE_ASSOC_RESP:
-                        rma = ieee80211_rx_mgmt_assoc_resp(sdata, wk, mgmt,
-                                                           skb->len, false);
-                        break;
-                case IEEE80211_STYPE_REASSOC_RESP:
-                        rma = ieee80211_rx_mgmt_assoc_resp(sdata, wk, mgmt,
-                                                           skb->len, true);
-                        break;
-                case IEEE80211_STYPE_DEAUTH:
-                        rma = ieee80211_rx_mgmt_deauth(sdata, wk, mgmt,
-                                                       skb->len);
-                        break;
-                }
-                /*
-                 * We've processed this frame for that work, so it can't
-                 * belong to another work struct.
-                 * NB: this is also required for correctness because the
-                 * called functions can free 'wk', and for 'rma'!
-                 */
-                break;
-        }
-
         mutex_unlock(&ifmgd->mtx);
 
-        switch (rma) {
-        case RX_MGMT_NONE:
-                /* no action */
-                break;
-        case RX_MGMT_CFG80211_AUTH:
-                cfg80211_send_rx_auth(sdata->dev, (u8 *) mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_ASSOC:
-                cfg80211_send_rx_assoc(sdata->dev, (u8 *) mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_DEAUTH:
+        if (skb->len >= 24 + 2 /* mgmt + deauth reason */ &&
+            (fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_DEAUTH)
                 cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
-                break;
-        default:
-                WARN(1, "unexpected: %d", rma);
-        }
 
  out:
         kfree_skb(skb);
@@ -2068,12 +1536,8 @@ static void ieee80211_sta_work(struct work_struct *work)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd;
         struct sk_buff *skb;
-        struct ieee80211_mgd_work *wk, *tmp;
-        LIST_HEAD(free_work);
-        enum rx_mgmt_action rma;
-        bool anybusy = false;
 
-        if (!netif_running(sdata->dev))
+        if (!ieee80211_sdata_running(sdata))
                 return;
 
         if (local->scanning)
@@ -2104,7 +1568,7 @@ static void ieee80211_sta_work(struct work_struct *work)
             ifmgd->associated) {
                 u8 bssid[ETH_ALEN];
 
-                memcpy(bssid, ifmgd->associated->cbss.bssid, ETH_ALEN);
+                memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
                 if (time_is_after_jiffies(ifmgd->probe_timeout))
                         run_again(ifmgd, ifmgd->probe_timeout);
 
@@ -2126,7 +1590,7 @@ static void ieee80211_sta_work(struct work_struct *work)
                         printk(KERN_DEBUG "No probe response from AP %pM"
                                 " after %dms, disconnecting.\n",
                                 bssid, (1000 * IEEE80211_PROBE_WAIT)/HZ);
-                        ieee80211_set_disassoc(sdata, true);
+                        ieee80211_set_disassoc(sdata);
                         ieee80211_recalc_idle(local);
                         mutex_unlock(&ifmgd->mtx);
                         /*
@@ -2141,87 +1605,7 @@ static void ieee80211_sta_work(struct work_struct *work)
                 }
         }
 
-
-        ieee80211_recalc_idle(local);
-
-        list_for_each_entry_safe(wk, tmp, &ifmgd->work_list, list) {
-                if (time_is_after_jiffies(wk->timeout)) {
-                        /*
-                         * This work item isn't supposed to be worked on
-                         * right now, but take care to adjust the timer
-                         * properly.
-                         */
-                        run_again(ifmgd, wk->timeout);
-                        continue;
-                }
-
-                switch (wk->state) {
-                default:
-                        WARN_ON(1);
-                        /* fall through */
-                case IEEE80211_MGD_STATE_IDLE:
-                        /* nothing */
-                        rma = RX_MGMT_NONE;
-                        break;
-                case IEEE80211_MGD_STATE_PROBE:
-                        rma = ieee80211_direct_probe(sdata, wk);
-                        break;
-                case IEEE80211_MGD_STATE_AUTH:
-                        rma = ieee80211_authenticate(sdata, wk);
-                        break;
-                case IEEE80211_MGD_STATE_ASSOC:
-                        rma = ieee80211_associate(sdata, wk);
-                        break;
-                }
-
-                switch (rma) {
-                case RX_MGMT_NONE:
-                        /* no action required */
-                        break;
-                case RX_MGMT_CFG80211_AUTH_TO:
-                case RX_MGMT_CFG80211_ASSOC_TO:
-                        list_del(&wk->list);
-                        list_add(&wk->list, &free_work);
-                        wk->tries = rma; /* small abuse but only local */
-                        break;
-                default:
-                        WARN(1, "unexpected: %d", rma);
-                }
-        }
-
-        list_for_each_entry(wk, &ifmgd->work_list, list) {
-                if (wk->state != IEEE80211_MGD_STATE_IDLE) {
-                        anybusy = true;
-                        break;
-                }
-        }
-        if (!anybusy &&
-            test_and_clear_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request))
-                ieee80211_queue_delayed_work(&local->hw,
-                                             &local->scan_work,
-                                             round_jiffies_relative(0));
-
         mutex_unlock(&ifmgd->mtx);
-
-        list_for_each_entry_safe(wk, tmp, &free_work, list) {
-                switch (wk->tries) {
-                case RX_MGMT_CFG80211_AUTH_TO:
-                        cfg80211_send_auth_timeout(sdata->dev,
-                                                   wk->bss->cbss.bssid);
-                        break;
-                case RX_MGMT_CFG80211_ASSOC_TO:
-                        cfg80211_send_assoc_timeout(sdata->dev,
-                                                    wk->bss->cbss.bssid);
-                        break;
-                default:
-                        WARN(1, "unexpected: %d", wk->tries);
-                }
-
-                list_del(&wk->list);
-                kfree(wk);
-        }
-
-        ieee80211_recalc_idle(local);
 }
 
 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
@@ -2330,14 +1714,14 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
                     (unsigned long) sdata);
         skb_queue_head_init(&ifmgd->skb_queue);
 
-        INIT_LIST_HEAD(&ifmgd->work_list);
-
-        ifmgd->capab = WLAN_CAPABILITY_ESS;
         ifmgd->flags = 0;
-        if (sdata->local->hw.queues >= 4)
-                ifmgd->flags |= IEEE80211_STA_WMM_ENABLED;
 
         mutex_init(&ifmgd->mtx);
+
+        if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
+                ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
+        else
+                ifmgd->req_smps = IEEE80211_SMPS_OFF;
 }
 
 /* scan finished notification */
@@ -2368,12 +1752,34 @@ int ieee80211_max_network_latency(struct notifier_block *nb,
 }
 
 /* config hooks */
+static enum work_done_result
+ieee80211_probe_auth_done(struct ieee80211_work *wk,
+                          struct sk_buff *skb)
+{
+        if (!skb) {
+                cfg80211_send_auth_timeout(wk->sdata->dev, wk->filter_ta);
+                return WORK_DONE_DESTROY;
+        }
+
+        if (wk->type == IEEE80211_WORK_AUTH) {
+                cfg80211_send_rx_auth(wk->sdata->dev, skb->data, skb->len);
+                return WORK_DONE_DESTROY;
+        }
+
+        mutex_lock(&wk->sdata->u.mgd.mtx);
+        ieee80211_rx_mgmt_probe_resp(wk->sdata, skb);
+        mutex_unlock(&wk->sdata->u.mgd.mtx);
+
+        wk->type = IEEE80211_WORK_AUTH;
+        wk->probe_auth.tries = 0;
+        return WORK_DONE_REQUEUE;
+}
+
 int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
                        struct cfg80211_auth_request *req)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         const u8 *ssid;
-        struct ieee80211_mgd_work *wk;
+        struct ieee80211_work *wk;
         u16 auth_alg;
 
         switch (req->auth_type) {
@@ -2397,7 +1803,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         if (!wk)
                 return -ENOMEM;
 
-        wk->bss = (void *)req->bss;
+        memcpy(wk->filter_ta, req->bss->bssid, ETH_ALEN);
 
         if (req->ie && req->ie_len) {
                 memcpy(wk->ie, req->ie, req->ie_len);
@@ -2405,66 +1811,76 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         }
 
         if (req->key && req->key_len) {
-                wk->key_len = req->key_len;
-                wk->key_idx = req->key_idx;
-                memcpy(wk->key, req->key, req->key_len);
+                wk->probe_auth.key_len = req->key_len;
+                wk->probe_auth.key_idx = req->key_idx;
+                memcpy(wk->probe_auth.key, req->key, req->key_len);
         }
 
         ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
-        memcpy(wk->ssid, ssid + 2, ssid[1]);
-        wk->ssid_len = ssid[1];
+        memcpy(wk->probe_auth.ssid, ssid + 2, ssid[1]);
+        wk->probe_auth.ssid_len = ssid[1];
 
-        wk->state = IEEE80211_MGD_STATE_PROBE;
-        wk->auth_alg = auth_alg;
-        wk->timeout = jiffies; /* run right away */
+        wk->probe_auth.algorithm = auth_alg;
+        wk->probe_auth.privacy = req->bss->capability & WLAN_CAPABILITY_PRIVACY;
 
-        /*
-         * XXX: if still associated need to tell AP that we're going
-         *      to sleep and then change channel etc.
-         */
-        sdata->local->oper_channel = req->bss->channel;
-        ieee80211_hw_config(sdata->local, 0);
-
-        mutex_lock(&ifmgd->mtx);
-        list_add(&wk->list, &sdata->u.mgd.work_list);
-        mutex_unlock(&ifmgd->mtx);
+        wk->type = IEEE80211_WORK_DIRECT_PROBE;
+        wk->chan = req->bss->channel;
+        wk->sdata = sdata;
+        wk->done = ieee80211_probe_auth_done;
 
-        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.work);
+        ieee80211_add_work(wk);
         return 0;
 }
 
-int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
-                        struct cfg80211_assoc_request *req)
+static enum work_done_result ieee80211_assoc_done(struct ieee80211_work *wk,
+                                                  struct sk_buff *skb)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_mgd_work *wk, *found = NULL;
-        int i, err;
+        struct ieee80211_mgmt *mgmt;
+        u16 status;
 
-        mutex_lock(&ifmgd->mtx);
+        if (!skb) {
+                cfg80211_send_assoc_timeout(wk->sdata->dev, wk->filter_ta);
+                return WORK_DONE_DESTROY;
+        }
 
-        list_for_each_entry(wk, &ifmgd->work_list, list) {
-                if (&wk->bss->cbss == req->bss &&
-                    wk->state == IEEE80211_MGD_STATE_IDLE) {
-                        found = wk;
-                        break;
+        mgmt = (void *)skb->data;
+        status = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+
+        if (status == WLAN_STATUS_SUCCESS) {
+                mutex_lock(&wk->sdata->u.mgd.mtx);
+                if (!ieee80211_assoc_success(wk, mgmt, skb->len)) {
+                        mutex_unlock(&wk->sdata->u.mgd.mtx);
+                        /* oops -- internal error -- send timeout for now */
+                        cfg80211_send_assoc_timeout(wk->sdata->dev,
+                                                    wk->filter_ta);
+                        return WORK_DONE_DESTROY;
                 }
+                mutex_unlock(&wk->sdata->u.mgd.mtx);
         }
 
-        if (!found) {
-                err = -ENOLINK;
-                goto out;
-        }
+        cfg80211_send_rx_assoc(wk->sdata->dev, skb->data, skb->len);
+        return WORK_DONE_DESTROY;
+}
 
-        list_del(&found->list);
+int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+                        struct cfg80211_assoc_request *req)
+{
+        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+        struct ieee80211_bss *bss = (void *)req->bss->priv;
+        struct ieee80211_work *wk;
+        const u8 *ssid;
+        int i;
 
-        wk = krealloc(found, sizeof(*wk) + req->ie_len, GFP_KERNEL);
-        if (!wk) {
-                list_add(&found->list, &ifmgd->work_list);
-                err = -ENOMEM;
-                goto out;
+        mutex_lock(&ifmgd->mtx);
+        if (ifmgd->associated) {
+                mutex_unlock(&ifmgd->mtx);
+                return -EALREADY;
         }
+        mutex_unlock(&ifmgd->mtx);
 
-        list_add(&wk->list, &ifmgd->work_list);
+        wk = kzalloc(sizeof(*wk) + req->ie_len, GFP_KERNEL);
+        if (!wk)
+                return -ENOMEM;
 
         ifmgd->flags &= ~IEEE80211_STA_DISABLE_11N;
 
@@ -2474,8 +1890,6 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                     req->crypto.ciphers_pairwise[i] == WLAN_CIPHER_SUITE_WEP104)
                         ifmgd->flags |= IEEE80211_STA_DISABLE_11N;
 
-        sdata->local->oper_channel = req->bss->channel;
-        ieee80211_hw_config(sdata->local, 0);
 
         if (req->ie && req->ie_len) {
                 memcpy(wk->ie, req->ie, req->ie_len);
@@ -2483,12 +1897,55 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         } else
                 wk->ie_len = 0;
 
+        wk->assoc.bss = req->bss;
+
+        memcpy(wk->filter_ta, req->bss->bssid, ETH_ALEN);
+
+        /* new association always uses requested smps mode */
+        if (ifmgd->req_smps == IEEE80211_SMPS_AUTOMATIC) {
+                if (ifmgd->powersave)
+                        ifmgd->ap_smps = IEEE80211_SMPS_DYNAMIC;
+                else
+                        ifmgd->ap_smps = IEEE80211_SMPS_OFF;
+        } else
+                ifmgd->ap_smps = ifmgd->req_smps;
+
+        wk->assoc.smps = ifmgd->ap_smps;
+        /*
+         * IEEE802.11n does not allow TKIP/WEP as pairwise ciphers in HT mode.
+         * We still associate in non-HT mode (11a/b/g) if any one of these
+         * ciphers is configured as pairwise.
+         * We can set this to true for non-11n hardware, that'll be checked
+         * separately along with the peer capabilities.
+         */
+        wk->assoc.use_11n = !(ifmgd->flags & IEEE80211_STA_DISABLE_11N);
+        wk->assoc.capability = req->bss->capability;
+        wk->assoc.wmm_used = bss->wmm_used;
+        wk->assoc.supp_rates = bss->supp_rates;
+        wk->assoc.supp_rates_len = bss->supp_rates_len;
+        wk->assoc.ht_information_ie =
+                ieee80211_bss_get_ie(req->bss, WLAN_EID_HT_INFORMATION);
+
+        if (bss->wmm_used && bss->uapsd_supported &&
+            (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
+                wk->assoc.uapsd_used = true;
+                ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
+        } else {
+                wk->assoc.uapsd_used = false;
+                ifmgd->flags &= ~IEEE80211_STA_UAPSD_ENABLED;
+        }
+
+        ssid = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
+        memcpy(wk->assoc.ssid, ssid + 2, ssid[1]);
+        wk->assoc.ssid_len = ssid[1];
+
         if (req->prev_bssid)
-                memcpy(wk->prev_bssid, req->prev_bssid, ETH_ALEN);
+                memcpy(wk->assoc.prev_bssid, req->prev_bssid, ETH_ALEN);
 
-        wk->state = IEEE80211_MGD_STATE_ASSOC;
-        wk->tries = 0;
-        wk->timeout = jiffies; /* run right away */
+        wk->type = IEEE80211_WORK_ASSOC;
+        wk->chan = req->bss->channel;
+        wk->sdata = sdata;
+        wk->done = ieee80211_assoc_done;
 
         if (req->use_mfp) {
                 ifmgd->mfp = IEEE80211_MFP_REQUIRED;
@@ -2503,69 +1960,59 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         else
                 ifmgd->flags &= ~IEEE80211_STA_CONTROL_PORT;
 
-        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.work);
-
-        err = 0;
-
- out:
-        mutex_unlock(&ifmgd->mtx);
-        return err;
+        ieee80211_add_work(wk);
+        return 0;
 }
 
 int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                          struct cfg80211_deauth_request *req,
                          void *cookie)
 {
+        struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_mgd_work *wk;
-        const u8 *bssid = NULL;
-        bool not_auth_yet = false;
+        struct ieee80211_work *wk;
+        const u8 *bssid = req->bss->bssid;
 
         mutex_lock(&ifmgd->mtx);
 
-        if (ifmgd->associated && &ifmgd->associated->cbss == req->bss) {
+        if (ifmgd->associated == req->bss) {
                 bssid = req->bss->bssid;
-                ieee80211_set_disassoc(sdata, true);
-        } else list_for_each_entry(wk, &ifmgd->work_list, list) {
-                if (&wk->bss->cbss == req->bss) {
-                        bssid = req->bss->bssid;
-                        if (wk->state == IEEE80211_MGD_STATE_PROBE)
-                                not_auth_yet = true;
+                ieee80211_set_disassoc(sdata);
+                mutex_unlock(&ifmgd->mtx);
+        } else {
+                bool not_auth_yet = false;
+
+                mutex_unlock(&ifmgd->mtx);
+
+                mutex_lock(&local->work_mtx);
+                list_for_each_entry(wk, &local->work_list, list) {
+                        if (wk->type != IEEE80211_WORK_DIRECT_PROBE)
+                                continue;
+                        if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
+                                continue;
+                        not_auth_yet = true;
                         list_del(&wk->list);
-                        kfree(wk);
+                        free_work(wk);
                         break;
                 }
-        }
-
-        /*
-         * If somebody requests authentication and we haven't
-         * sent out an auth frame yet there's no need to send
-         * out a deauth frame either. If the state was PROBE,
-         * then this is the case. If it's AUTH we have sent a
-         * frame, and if it's IDLE we have completed the auth
-         * process already.
-         */
-        if (not_auth_yet) {
-                mutex_unlock(&ifmgd->mtx);
-                __cfg80211_auth_canceled(sdata->dev, bssid);
-                return 0;
-        }
+                mutex_unlock(&local->work_mtx);
 
-        /*
-         * cfg80211 should catch this ... but it's racy since
-         * we can receive a deauth frame, process it, hand it
-         * to cfg80211 while that's in a locked section already
-         * trying to tell us that the user wants to disconnect.
-         */
-        if (!bssid) {
-                mutex_unlock(&ifmgd->mtx);
-                return -ENOLINK;
+                /*
+                 * If somebody requests authentication and we haven't
+                 * sent out an auth frame yet there's no need to send
+                 * out a deauth frame either. If the state was PROBE,
+                 * then this is the case. If it's AUTH we have sent a
+                 * frame, and if it's IDLE we have completed the auth
+                 * process already.
+                 */
+                if (not_auth_yet) {
+                        __cfg80211_auth_canceled(sdata->dev, bssid);
+                        return 0;
+                }
         }
 
-        mutex_unlock(&ifmgd->mtx);
-
         printk(KERN_DEBUG "%s: deauthenticating from %pM by local choice (reason=%d)\n",
-               sdata->dev->name, bssid, req->reason_code);
+               sdata->name, bssid, req->reason_code);
 
         ieee80211_send_deauth_disassoc(sdata, bssid,
                         IEEE80211_STYPE_DEAUTH, req->reason_code,
@@ -2590,15 +2037,15 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
          * to cfg80211 while that's in a locked section already
          * trying to tell us that the user wants to disconnect.
          */
-        if (&ifmgd->associated->cbss != req->bss) {
+        if (ifmgd->associated != req->bss) {
                 mutex_unlock(&ifmgd->mtx);
                 return -ENOLINK;
         }
 
         printk(KERN_DEBUG "%s: disassociating from %pM by local choice (reason=%d)\n",
-               sdata->dev->name, req->bss->bssid, req->reason_code);
+               sdata->name, req->bss->bssid, req->reason_code);
 
-        ieee80211_set_disassoc(sdata, false);
+        ieee80211_set_disassoc(sdata);
 
         mutex_unlock(&ifmgd->mtx);
 
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
new file mode 100644
index 000000000000..c36b1911987a
--- /dev/null
+++ b/net/mac80211/offchannel.c
@@ -0,0 +1,170 @@
+/*
+ * Off-channel operation helpers
+ *
+ * Copyright 2003, Jouni Malinen <jkmaline@cc.hut.fi>
+ * Copyright 2004, Instant802 Networks, Inc.
+ * Copyright 2005, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2009       Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <net/mac80211.h>
+#include "ieee80211_i.h"
+
+/*
+ * inform AP that we will go to sleep so that it will buffer the frames
+ * while we scan
+ */
+static void ieee80211_offchannel_ps_enable(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        local->offchannel_ps_enabled = false;
+
+        /* FIXME: what to do when local->pspolling is true? */
+
+        del_timer_sync(&local->dynamic_ps_timer);
+        cancel_work_sync(&local->dynamic_ps_enable_work);
+
+        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                local->offchannel_ps_enabled = true;
+                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        }
+
+        if (!(local->offchannel_ps_enabled) ||
+            !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
+                /*
+                 * If power save was enabled, no need to send a nullfunc
+                 * frame because AP knows that we are sleeping. But if the
+                 * hardware is creating the nullfunc frame for power save
+                 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
+                 * enabled) and power save was enabled, the firmware just
+                 * sent a null frame with power save disabled. So we need
+                 * to send a new nullfunc frame to inform the AP that we
+                 * are again sleeping.
+                 */
+                ieee80211_send_nullfunc(local, sdata, 1);
+}
+
+/* inform AP that we are awake again, unless power save is enabled */
+static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+
+        if (!local->ps_sdata)
+                ieee80211_send_nullfunc(local, sdata, 0);
+        else if (local->offchannel_ps_enabled) {
+                /*
+                 * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
+                 * will send a nullfunc frame with the powersave bit set
+                 * even though the AP already knows that we are sleeping.
+                 * This could be avoided by sending a null frame with power
+                 * save bit disabled before enabling the power save, but
+                 * this doesn't gain anything.
+                 *
+                 * When IEEE80211_HW_PS_NULLFUNC_STACK is enabled, no need
+                 * to send a nullfunc frame because AP already knows that
+                 * we are sleeping, let's just enable power save mode in
+                 * hardware.
+                 */
+                local->hw.conf.flags |= IEEE80211_CONF_PS;
+                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
+        } else if (local->hw.conf.dynamic_ps_timeout > 0) {
+                /*
+                 * If IEEE80211_CONF_PS was not set and the dynamic_ps_timer
+                 * had been running before leaving the operating channel,
+                 * restart the timer now and send a nullfunc frame to inform
+                 * the AP that we are awake.
+                 */
+                ieee80211_send_nullfunc(local, sdata, 0);
+                mod_timer(&local->dynamic_ps_timer, jiffies +
+                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
+        }
+}
+
+void ieee80211_offchannel_stop_beaconing(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
+                /* disable beaconing */
+                if (sdata->vif.type == NL80211_IFTYPE_AP ||
+                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+                        ieee80211_bss_info_change_notify(
+                                sdata, BSS_CHANGED_BEACON_ENABLED);
+
+                /*
+                 * only handle non-STA interfaces here, STA interfaces
+                 * are handled in ieee80211_offchannel_stop_station(),
+                 * e.g., from the background scan state machine.
+                 *
+                 * In addition, do not stop monitor interface to allow it to be
+                 * used from user space controlled off-channel operations.
+                 */
+                if (sdata->vif.type != NL80211_IFTYPE_STATION &&
+                    sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                        netif_tx_stop_all_queues(sdata->dev);
+        }
+        mutex_unlock(&local->iflist_mtx);
+}
+
+void ieee80211_offchannel_stop_station(struct ieee80211_local *local)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        /*
+         * notify the AP about us leaving the channel and stop all STA interfaces
+         */
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        netif_tx_stop_all_queues(sdata->dev);
+                        if (sdata->u.mgd.associated)
+                                ieee80211_offchannel_ps_enable(sdata);
+                }
+        }
+        mutex_unlock(&local->iflist_mtx);
+}
+
+void ieee80211_offchannel_return(struct ieee80211_local *local,
+                                 bool enable_beaconing)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        mutex_lock(&local->iflist_mtx);
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
+                /* Tell AP we're back */
+                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                        if (sdata->u.mgd.associated)
+                                ieee80211_offchannel_ps_disable(sdata);
+                }
+
+                if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
+                        netif_tx_wake_all_queues(sdata->dev);
+
+                /* re-enable beaconing */
+                if (enable_beaconing &&
+                    (sdata->vif.type == NL80211_IFTYPE_AP ||
+                     sdata->vif.type == NL80211_IFTYPE_ADHOC ||
+                     sdata->vif.type == NL80211_IFTYPE_MESH_POINT))
+                        ieee80211_bss_info_change_notify(
+                                sdata, BSS_CHANGED_BEACON_ENABLED);
+        }
+        mutex_unlock(&local->iflist_mtx);
+}
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index e535f1c988fe..47f818959ad7 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -10,7 +10,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_if_init_conf conf;
         struct sta_info *sta;
         unsigned long flags;
 
@@ -65,7 +64,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
+                        drv_sta_notify(local, sdata, STA_NOTIFY_REMOVE,
                                        &sta->sta);
                 }
 
@@ -93,17 +92,14 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
                         break;
                 }
 
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
 
                 /* disable beaconing */
                 ieee80211_bss_info_change_notify(sdata,
                         BSS_CHANGED_BEACON_ENABLED);
 
-                conf.vif = &sdata->vif;
-                conf.type = sdata->vif.type;
-                conf.mac_addr = sdata->dev->dev_addr;
-                drv_remove_interface(local, &conf);
+                drv_remove_interface(local, &sdata->vif);
         }
 
         /* stop hardware - this must stop RX */
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index b9007f80cb92..c74b7c85403c 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -207,6 +207,27 @@ static bool rc_no_data_or_no_ack(struct ieee80211_tx_rate_control *txrc)
         return ((info->flags & IEEE80211_TX_CTL_NO_ACK) || !ieee80211_is_data(fc));
 }
 
+static void rc_send_low_broadcast(s8 *idx, u32 basic_rates, u8 max_rate_idx)
+{
+        u8 i;
+
+        if (basic_rates == 0)
+                return; /* assume basic rates unknown and accept rate */
+        if (*idx < 0)
+                return;
+        if (basic_rates & (1 << *idx))
+                return; /* selected rate is a basic rate */
+
+        for (i = *idx + 1; i <= max_rate_idx; i++) {
+                if (basic_rates & (1 << i)) {
+                        *idx = i;
+                        return;
+                }
+        }
+
+        /* could not find a basic rate; use original selection */
+}
+
 bool rate_control_send_low(struct ieee80211_sta *sta,
                            void *priv_sta,
                            struct ieee80211_tx_rate_control *txrc)
@@ -218,12 +239,48 @@ bool rate_control_send_low(struct ieee80211_sta *sta,
                 info->control.rates[0].count =
                         (info->flags & IEEE80211_TX_CTL_NO_ACK) ?
                         1 : txrc->hw->max_rate_tries;
+                if (!sta && txrc->ap)
+                        rc_send_low_broadcast(&info->control.rates[0].idx,
+                                              txrc->bss_conf->basic_rates,
+                                              txrc->sband->n_bitrates);
                 return true;
         }
         return false;
 }
 EXPORT_SYMBOL(rate_control_send_low);
 
+static void rate_idx_match_mask(struct ieee80211_tx_rate *rate,
+                                int n_bitrates, u32 mask)
+{
+        int j;
+
+        /* See whether the selected rate or anything below it is allowed. */
+        for (j = rate->idx; j >= 0; j--) {
+                if (mask & (1 << j)) {
+                        /* Okay, found a suitable rate. Use it. */
+                        rate->idx = j;
+                        return;
+                }
+        }
+
+        /* Try to find a higher rate that would be allowed */
+        for (j = rate->idx + 1; j < n_bitrates; j++) {
+                if (mask & (1 << j)) {
+                        /* Okay, found a suitable rate. Use it. */
+                        rate->idx = j;
+                        return;
+                }
+        }
+
+        /*
+         * Uh.. No suitable rate exists. This should not really happen with
+         * sane TX rate mask configurations. However, should someone manage to
+         * configure supported rates and TX rate mask in incompatible way,
+         * allow the frame to be transmitted with whatever the rate control
+         * selected.
+         */
+}
+
 void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                            struct sta_info *sta,
                            struct ieee80211_tx_rate_control *txrc)
@@ -233,6 +290,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_sta *ista = NULL;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(txrc->skb);
         int i;
+        u32 mask;
 
         if (sta) {
                 ista = &sta->sta;
@@ -245,23 +303,31 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                 info->control.rates[i].count = 1;
         }
 
-        if (sta && sdata->force_unicast_rateidx > -1) {
-                info->control.rates[0].idx = sdata->force_unicast_rateidx;
-        } else {
-                ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
-                info->flags |= IEEE80211_TX_INTFL_RCALGO;
-        }
+        ref->ops->get_rate(ref->priv, ista, priv_sta, txrc);
 
         /*
-         * try to enforce the maximum rate the user wanted
+         * Try to enforce the rateidx mask the user wanted. skip this if the
+         * default mask (allow all rates) is used to save some processing for
+         * the common case.
          */
-        if (sdata->max_ratectrl_rateidx > -1)
+        mask = sdata->rc_rateidx_mask[info->band];
+        if (mask != (1 << txrc->sband->n_bitrates) - 1) {
+                if (sta) {
+                        /* Filter out rates that the STA does not support */
+                        mask &= sta->sta.supp_rates[info->band];
+                }
+                /*
+                 * Make sure the rate index selected for each TX rate is
+                 * included in the configured mask and change the rate indexes
+                 * if needed.
+                 */
                 for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
+                        /* Rate masking supports only legacy rates for now */
                         if (info->control.rates[i].flags & IEEE80211_TX_RC_MCS)
                                 continue;
-                        info->control.rates[i].idx =
-                                min_t(s8, info->control.rates[i].idx,
-                                      sdata->max_ratectrl_rateidx);
+                        rate_idx_match_mask(&info->control.rates[i],
+                                            txrc->sband->n_bitrates, mask);
+                }
         }
 
         BUG_ON(info->control.rates[0].idx < 0);
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index cb9bd1f65e27..669dddd40521 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -44,10 +44,7 @@ static inline void rate_control_tx_status(struct ieee80211_local *local,
         struct rate_control_ref *ref = local->rate_ctrl;
         struct ieee80211_sta *ista = &sta->sta;
         void *priv_sta = sta->rate_ctrl_priv;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-
-        if (likely(info->flags & IEEE80211_TX_INTFL_RCALGO))
-                ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
+        ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
 }
 
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 82a30c1bf3ab..a8e15b84c05b 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -283,15 +283,15 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
         skb->protocol = htons(ETH_P_802_2);
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
                         continue;
 
                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
                         continue;
 
+                if (!ieee80211_sdata_running(sdata))
+                        continue;
+
                 if (prev_dev) {
                         skb2 = skb_clone(skb, GFP_ATOMIC);
                         if (skb2) {
@@ -361,7 +361,9 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
  * boundary. In the case of regular frames, this simply means aligning the
  * payload to a four-byte boundary (because either the IP header is directly
  * contained, or IV/RFC1042 headers that have a length divisible by four are
- * in front of it).
+ * in front of it).  If the payload data is not properly aligned and the
+ * architecture doesn't support efficient unaligned operations, mac80211
+ * will align the data.
  *
  * With A-MSDU frames, however, the payload data address must yield two modulo
  * four because there are 14-byte 802.3 headers within the A-MSDU frames that
@@ -375,25 +377,10 @@ static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
  */
 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
 {
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
-        int hdrlen;
-
-#ifndef CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT
-        return;
+#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
+        WARN_ONCE((unsigned long)rx->skb->data & 1,
+                  "unaligned packet at 0x%p\n", rx->skb->data);
 #endif
-
-        if (WARN_ONCE((unsigned long)rx->skb->data & 1,
-                      "unaligned packet at 0x%p\n", rx->skb->data))
-                return;
-
-        if (!ieee80211_is_data_present(hdr->frame_control))
-                return;
-
-        hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        if (rx->flags & IEEE80211_RX_AMSDU)
-                hdrlen += ETH_HLEN;
-        WARN_ONCE(((unsigned long)(rx->skb->data + hdrlen)) & 3,
-                  "unaligned IP payload at 0x%p\n", rx->skb->data + hdrlen);
 }
 
 
@@ -476,7 +463,7 @@ ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
         unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        char *dev_addr = rx->sdata->dev->dev_addr;
+        char *dev_addr = rx->sdata->vif.addr;
 
         if (ieee80211_is_data(hdr->frame_control)) {
                 if (is_multicast_ether_addr(hdr->addr1)) {
@@ -1021,10 +1008,10 @@ static void ap_sta_ps_start(struct sta_info *sta)
 
         atomic_inc(&sdata->bss->num_sta_ps);
         set_sta_flags(sta, WLAN_STA_PS_STA);
-        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_SLEEP, &sta->sta);
+        drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d enters power save mode\n",
-               sdata->dev->name, sta->sta.addr, sta->sta.aid);
+               sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
 
@@ -1038,13 +1025,13 @@ static void ap_sta_ps_end(struct sta_info *sta)
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d exits power save mode\n",
-               sdata->dev->name, sta->sta.addr, sta->sta.aid);
+               sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 
         if (test_sta_flags(sta, WLAN_STA_PS_DRIVER)) {
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 printk(KERN_DEBUG "%s: STA %pM aid %d driver-ps-blocked\n",
-                       sdata->dev->name, sta->sta.addr, sta->sta.aid);
+                       sdata->name, sta->sta.addr, sta->sta.aid);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
                 return;
         }
@@ -1124,6 +1111,18 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         if (ieee80211_is_nullfunc(hdr->frame_control) ||
             ieee80211_is_qos_nullfunc(hdr->frame_control)) {
                 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
+
+                /*
+                 * If we receive a 4-addr nullfunc frame from a STA
+                 * that was not moved to a 4-addr STA vlan yet, drop
+                 * the frame to the monitor interface, to make sure
+                 * that hostapd sees it
+                 */
+                if (ieee80211_has_a4(hdr->frame_control) &&
+                    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
+                     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+                      !rx->sdata->u.vlan.sta)))
+                        return RX_DROP_MONITOR;
                 /*
                  * Update counter and free packet here to avoid
                  * counting this as a dropped packed.
@@ -1156,7 +1155,7 @@ ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
                 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
                        "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
                        "addr1=%pM addr2=%pM\n",
-                       sdata->dev->name, idx,
+                       sdata->name, idx,
                        jiffies - entry->first_frag_time, entry->seq,
                        entry->last_frag, hdr->addr1, hdr->addr2);
 #endif
@@ -1424,7 +1423,6 @@ static int
 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = rx->sdata;
-        struct net_device *dev = sdata->dev;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
 
         if (ieee80211_has_a4(hdr->frame_control) &&
@@ -1436,7 +1434,7 @@ __ieee80211_data_to_8023(struct ieee80211_rx_data *rx)
              (sdata->vif.type == NL80211_IFTYPE_STATION && sdata->u.mgd.use_4addr)))
                 return -1;
 
-        return ieee80211_data_to_8023(rx->skb, dev->dev_addr, sdata->vif.type);
+        return ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
 }
 
 /*
@@ -1453,7 +1451,7 @@ static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
          * of whether the frame was encrypted or not.
          */
         if (ehdr->h_proto == htons(ETH_P_PAE) &&
-            (compare_ether_addr(ehdr->h_dest, rx->sdata->dev->dev_addr) == 0 ||
+            (compare_ether_addr(ehdr->h_dest, rx->sdata->vif.addr) == 0 ||
              compare_ether_addr(ehdr->h_dest, pae_group_addr) == 0))
                 return true;
 
@@ -1472,7 +1470,6 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct net_device *dev = sdata->dev;
-        struct ieee80211_local *local = rx->local;
         struct sk_buff *skb, *xmit_skb;
         struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
         struct sta_info *dsta;
@@ -1495,8 +1492,8 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                                 printk(KERN_DEBUG "%s: failed to clone "
                                        "multicast frame\n", dev->name);
                 } else {
-                        dsta = sta_info_get(local, skb->data);
-                        if (dsta && dsta->sdata->dev == dev) {
+                        dsta = sta_info_get(sdata, skb->data);
+                        if (dsta) {
                                 /*
                                  * The destination station is associated to
                                  * this AP (in this VLAN), so send the frame
@@ -1512,7 +1509,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
         if (skb) {
                 int align __maybe_unused;
 
-#if defined(CONFIG_MAC80211_DEBUG_PACKET_ALIGNMENT) || !defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
                 /*
                  * 'align' will only take the values 0 or 2 here
                  * since all frames are required to be aligned
@@ -1556,16 +1553,10 @@ static ieee80211_rx_result debug_noinline
 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
 {
         struct net_device *dev = rx->sdata->dev;
-        struct ieee80211_local *local = rx->local;
-        u16 ethertype;
-        u8 *payload;
-        struct sk_buff *skb = rx->skb, *frame = NULL;
+        struct sk_buff *skb = rx->skb;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         __le16 fc = hdr->frame_control;
-        const struct ethhdr *eth;
-        int remaining, err;
-        u8 dst[ETH_ALEN];
-        u8 src[ETH_ALEN];
+        struct sk_buff_head frame_list;
 
         if (unlikely(!ieee80211_is_data(fc)))
                 return RX_CONTINUE;
@@ -1576,94 +1567,34 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
         if (!(rx->flags & IEEE80211_RX_AMSDU))
                 return RX_CONTINUE;
 
-        err = __ieee80211_data_to_8023(rx);
-        if (unlikely(err))
+        if (ieee80211_has_a4(hdr->frame_control) &&
+            rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+            !rx->sdata->u.vlan.sta)
                 return RX_DROP_UNUSABLE;
 
-        skb->dev = dev;
-
-        dev->stats.rx_packets++;
-        dev->stats.rx_bytes += skb->len;
-
-        /* skip the wrapping header */
-        eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
-        if (!eth)
+        if (is_multicast_ether_addr(hdr->addr1) &&
+            ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+              rx->sdata->u.vlan.sta) ||
+             (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
+              rx->sdata->u.mgd.use_4addr)))
                 return RX_DROP_UNUSABLE;
 
-        while (skb != frame) {
-                u8 padding;
-                __be16 len = eth->h_proto;
-                unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
-
-                remaining = skb->len;
-                memcpy(dst, eth->h_dest, ETH_ALEN);
-                memcpy(src, eth->h_source, ETH_ALEN);
+        skb->dev = dev;
+        __skb_queue_head_init(&frame_list);
 
-                padding = ((4 - subframe_len) & 0x3);
-                /* the last MSDU has no padding */
-                if (subframe_len > remaining)
-                        return RX_DROP_UNUSABLE;
+        ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+                                 rx->sdata->vif.type,
+                                 rx->local->hw.extra_tx_headroom);
 
-                skb_pull(skb, sizeof(struct ethhdr));
-                /* if last subframe reuse skb */
-                if (remaining <= subframe_len + padding)
-                        frame = skb;
-                else {
-                        /*
-                         * Allocate and reserve two bytes more for payload
-                         * alignment since sizeof(struct ethhdr) is 14.
-                         */
-                        frame = dev_alloc_skb(
-                                ALIGN(local->hw.extra_tx_headroom, 4) +
-                                subframe_len + 2);
-
-                        if (frame == NULL)
-                                return RX_DROP_UNUSABLE;
-
-                        skb_reserve(frame,
-                                    ALIGN(local->hw.extra_tx_headroom, 4) +
-                                    sizeof(struct ethhdr) + 2);
-                        memcpy(skb_put(frame, ntohs(len)), skb->data,
-                                ntohs(len));
-
-                        eth = (struct ethhdr *) skb_pull(skb, ntohs(len) +
-                                                        padding);
-                        if (!eth) {
-                                dev_kfree_skb(frame);
-                                return RX_DROP_UNUSABLE;
-                        }
-                }
-
-                skb_reset_network_header(frame);
-                frame->dev = dev;
-                frame->priority = skb->priority;
-                rx->skb = frame;
-
-                payload = frame->data;
-                ethertype = (payload[6] << 8) | payload[7];
-
-                if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
-                            ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
-                           compare_ether_addr(payload,
-                                              bridge_tunnel_header) == 0)) {
-                        /* remove RFC1042 or Bridge-Tunnel
-                         * encapsulation and replace EtherType */
-                        skb_pull(frame, 6);
-                        memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
-                        memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
-                } else {
-                        memcpy(skb_push(frame, sizeof(__be16)),
-                               &len, sizeof(__be16));
-                        memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
-                        memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
-                }
+        while (!skb_queue_empty(&frame_list)) {
+                rx->skb = __skb_dequeue(&frame_list);
 
                 if (!ieee80211_frame_allowed(rx, fc)) {
-                        if (skb == frame) /* last frame */
-                                return RX_DROP_UNUSABLE;
-                        dev_kfree_skb(frame);
+                        dev_kfree_skb(rx->skb);
                         continue;
                 }
+                dev->stats.rx_packets++;
+                dev->stats.rx_bytes += rx->skb->len;
 
                 ieee80211_deliver_skb(rx);
         }
@@ -1721,7 +1652,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 
         /* Frame has reached destination.  Don't forward */
         if (!is_multicast_ether_addr(hdr->addr1) &&
-            compare_ether_addr(sdata->dev->dev_addr, hdr->addr3) == 0)
+            compare_ether_addr(sdata->vif.addr, hdr->addr3) == 0)
                 return RX_CONTINUE;
 
         mesh_hdr->ttl--;
@@ -1738,10 +1669,10 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
 
                         if (!fwd_skb && net_ratelimit())
                                 printk(KERN_DEBUG "%s: failed to clone mesh frame\n",
-                                                   sdata->dev->name);
+                                                   sdata->name);
 
                         fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
-                        memcpy(fwd_hdr->addr2, sdata->dev->dev_addr, ETH_ALEN);
+                        memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
                         info = IEEE80211_SKB_CB(fwd_skb);
                         memset(info, 0, sizeof(*info));
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
@@ -1872,7 +1803,7 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
         struct sk_buff *skb;
         struct ieee80211_mgmt *resp;
 
-        if (compare_ether_addr(mgmt->da, sdata->dev->dev_addr) != 0) {
+        if (compare_ether_addr(mgmt->da, sdata->vif.addr) != 0) {
                 /* Not to own unicast address */
                 return;
         }
@@ -1896,7 +1827,7 @@ static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
         resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
         memset(resp, 0, 24);
         memcpy(resp->da, mgmt->sa, ETH_ALEN);
-        memcpy(resp->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
         resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_ACTION);
@@ -2032,6 +1963,7 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
 {
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
+        ieee80211_rx_result rxs;
 
         if (!(rx->flags & IEEE80211_RX_RA_MATCH))
                 return RX_DROP_MONITOR;
@@ -2039,6 +1971,10 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
         if (ieee80211_drop_unencrypted(rx, mgmt->frame_control))
                 return RX_DROP_MONITOR;
 
+        rxs = ieee80211_work_rx_mgmt(rx->sdata, rx->skb);
+        if (rxs != RX_CONTINUE)
+                return rxs;
+
         if (ieee80211_vif_is_mesh(&sdata->vif))
                 return ieee80211_mesh_rx_mgmt(sdata, rx->skb);
 
@@ -2143,7 +2079,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         skb->protocol = htons(ETH_P_802_2);
 
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
 
                 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
@@ -2280,7 +2216,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                 if (!bssid && !sdata->u.mgd.use_4addr)
                         return 0;
                 if (!multicast &&
-                    compare_ether_addr(sdata->dev->dev_addr, hdr->addr1) != 0) {
+                    compare_ether_addr(sdata->vif.addr, hdr->addr1) != 0) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -2297,7 +2233,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
                 } else if (!multicast &&
-                           compare_ether_addr(sdata->dev->dev_addr,
+                           compare_ether_addr(sdata->vif.addr,
                                               hdr->addr1) != 0) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
@@ -2314,7 +2250,7 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
                 break;
         case NL80211_IFTYPE_MESH_POINT:
                 if (!multicast &&
-                    compare_ether_addr(sdata->dev->dev_addr,
+                    compare_ether_addr(sdata->vif.addr,
                                        hdr->addr1) != 0) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
                                 return 0;
@@ -2325,11 +2261,11 @@ static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_AP:
                 if (!bssid) {
-                        if (compare_ether_addr(sdata->dev->dev_addr,
+                        if (compare_ether_addr(sdata->vif.addr,
                                                hdr->addr1))
                                 return 0;
                 } else if (!ieee80211_bssid_match(bssid,
-                                        sdata->dev->dev_addr)) {
+                                        sdata->vif.addr)) {
                         if (!(rx->flags & IEEE80211_RX_IN_SCAN))
                                 return 0;
                         rx->flags &= ~IEEE80211_RX_RA_MATCH;
@@ -2368,6 +2304,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         int prepares;
         struct ieee80211_sub_if_data *prev = NULL;
         struct sk_buff *skb_new;
+        struct sta_info *sta, *tmp;
+        bool found_sta = false;
 
         hdr = (struct ieee80211_hdr *)skb->data;
         memset(&rx, 0, sizeof(rx));
@@ -2384,68 +2322,76 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
         ieee80211_parse_qos(&rx);
         ieee80211_verify_alignment(&rx);
 
-        rx.sta = sta_info_get(local, hdr->addr2);
-        if (rx.sta)
-                rx.sdata = rx.sta->sdata;
-
-        if (rx.sdata && ieee80211_is_data(hdr->frame_control)) {
-                rx.flags |= IEEE80211_RX_RA_MATCH;
-                prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
-                if (prepares) {
-                        if (status->flag & RX_FLAG_MMIC_ERROR) {
-                                if (rx.flags & IEEE80211_RX_RA_MATCH)
-                                        ieee80211_rx_michael_mic_report(hdr, &rx);
-                        } else
-                                prev = rx.sdata;
+        if (ieee80211_is_data(hdr->frame_control)) {
+                for_each_sta_info(local, hdr->addr2, sta, tmp) {
+                        rx.sta = sta;
+                        found_sta = true;
+                        rx.sdata = sta->sdata;
+
+                        rx.flags |= IEEE80211_RX_RA_MATCH;
+                        prepares = prepare_for_handlers(rx.sdata, &rx, hdr);
+                        if (prepares) {
+                                if (status->flag & RX_FLAG_MMIC_ERROR) {
+                                        if (rx.flags & IEEE80211_RX_RA_MATCH)
+                                                ieee80211_rx_michael_mic_report(hdr, &rx);
+                                } else
+                                        prev = rx.sdata;
+                        }
                 }
-        } else list_for_each_entry_rcu(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
+        }
+        if (!found_sta) {
+                list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+                        if (!ieee80211_sdata_running(sdata))
+                                continue;
 
-                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
-                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
-                        continue;
+                        if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                            sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                                continue;
 
-                rx.flags |= IEEE80211_RX_RA_MATCH;
-                prepares = prepare_for_handlers(sdata, &rx, hdr);
+                        rx.sta = sta_info_get(sdata, hdr->addr2);
 
-                if (!prepares)
-                        continue;
+                        rx.flags |= IEEE80211_RX_RA_MATCH;
+                        prepares = prepare_for_handlers(sdata, &rx, hdr);
 
-                if (status->flag & RX_FLAG_MMIC_ERROR) {
-                        rx.sdata = sdata;
-                        if (rx.flags & IEEE80211_RX_RA_MATCH)
-                                ieee80211_rx_michael_mic_report(hdr, &rx);
-                        continue;
-                }
+                        if (!prepares)
+                                continue;
 
-                /*
-                 * frame is destined for this interface, but if it's not
-                 * also for the previous one we handle that after the
-                 * loop to avoid copying the SKB once too much
-                 */
+                        if (status->flag & RX_FLAG_MMIC_ERROR) {
+                                rx.sdata = sdata;
+                                if (rx.flags & IEEE80211_RX_RA_MATCH)
+                                        ieee80211_rx_michael_mic_report(hdr,
+                                                                        &rx);
+                                continue;
+                        }
 
-                if (!prev) {
-                        prev = sdata;
-                        continue;
-                }
+                        /*
+                         * frame is destined for this interface, but if it's
+                         * not also for the previous one we handle that after
+                         * the loop to avoid copying the SKB once too much
+                         */
 
-                /*
-                 * frame was destined for the previous interface
-                 * so invoke RX handlers for it
-                 */
+                        if (!prev) {
+                                prev = sdata;
+                                continue;
+                        }
 
-                skb_new = skb_copy(skb, GFP_ATOMIC);
-                if (!skb_new) {
-                        if (net_ratelimit())
-                                printk(KERN_DEBUG "%s: failed to copy "
-                                       "multicast frame for %s\n",
-                                       wiphy_name(local->hw.wiphy),
-                                       prev->dev->name);
-                        continue;
+                        /*
+                         * frame was destined for the previous interface
+                         * so invoke RX handlers for it
+                         */
+
+                        skb_new = skb_copy(skb, GFP_ATOMIC);
+                        if (!skb_new) {
+                                if (net_ratelimit())
+                                        printk(KERN_DEBUG "%s: failed to copy "
+                                               "multicast frame for %s\n",
+                                               wiphy_name(local->hw.wiphy),
+                                               prev->name);
+                                continue;
+                        }
+                        ieee80211_invoke_rx_handlers(prev, &rx, skb_new, rate);
+                        prev = sdata;
                 }
-                ieee80211_invoke_rx_handlers(prev, &rx, skb_new, rate);
-                prev = sdata;
         }
         if (prev)
                 ieee80211_invoke_rx_handlers(prev, &rx, skb, rate);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f934c9620b73..9afe2f9885dc 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -12,7 +12,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/wireless.h>
 #include <linux/if_arp.h>
 #include <linux/rtnetlink.h>
 #include <net/mac80211.h>
@@ -29,16 +28,19 @@ struct ieee80211_bss *
 ieee80211_rx_bss_get(struct ieee80211_local *local, u8 *bssid, int freq,
                      u8 *ssid, u8 ssid_len)
 {
-        return (void *)cfg80211_get_bss(local->hw.wiphy,
-                                        ieee80211_get_channel(local->hw.wiphy,
-                                                              freq),
-                                        bssid, ssid, ssid_len,
-                                        0, 0);
+        struct cfg80211_bss *cbss;
+
+        cbss = cfg80211_get_bss(local->hw.wiphy,
+                                ieee80211_get_channel(local->hw.wiphy, freq),
+                                bssid, ssid, ssid_len, 0, 0);
+        if (!cbss)
+                return NULL;
+        return (void *)cbss->priv;
 }
 
 static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
 {
-        struct ieee80211_bss *bss = (void *)cbss;
+        struct ieee80211_bss *bss = (void *)cbss->priv;
 
         kfree(bss_mesh_id(bss));
         kfree(bss_mesh_cfg(bss));
@@ -47,7 +49,26 @@ static void ieee80211_rx_bss_free(struct cfg80211_bss *cbss)
 void ieee80211_rx_bss_put(struct ieee80211_local *local,
                           struct ieee80211_bss *bss)
 {
-        cfg80211_put_bss((struct cfg80211_bss *)bss);
+        if (!bss)
+                return;
+        cfg80211_put_bss(container_of((void *)bss, struct cfg80211_bss, priv));
+}
+
+static bool is_uapsd_supported(struct ieee802_11_elems *elems)
+{
+        u8 qos_info;
+
+        if (elems->wmm_info && elems->wmm_info_len == 7
+            && elems->wmm_info[5] == 1)
+                qos_info = elems->wmm_info[6];
+        else if (elems->wmm_param && elems->wmm_param_len == 24
+                 && elems->wmm_param[5] == 1)
+                qos_info = elems->wmm_param[6];
+        else
+                /* no valid wmm information or parameter element found */
+                return false;
+
+        return qos_info & IEEE80211_WMM_IE_AP_QOSINFO_UAPSD;
 }
 
 struct ieee80211_bss *
@@ -59,6 +80,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                           struct ieee80211_channel *channel,
                           bool beacon)
 {
+        struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
         int clen;
         s32 signal = 0;
@@ -68,13 +90,14 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         else if (local->hw.flags & IEEE80211_HW_SIGNAL_UNSPEC)
                 signal = (rx_status->signal * 100) / local->hw.max_signal;
 
-        bss = (void *)cfg80211_inform_bss_frame(local->hw.wiphy, channel,
-                                                mgmt, len, signal, GFP_ATOMIC);
+        cbss = cfg80211_inform_bss_frame(local->hw.wiphy, channel,
+                                         mgmt, len, signal, GFP_ATOMIC);
 
-        if (!bss)
+        if (!cbss)
                 return NULL;
 
-        bss->cbss.free_priv = ieee80211_rx_bss_free;
+        cbss->free_priv = ieee80211_rx_bss_free;
+        bss = (void *)cbss->priv;
 
         /* save the ERP value so that it is available at association time */
         if (elems->erp_info && elems->erp_info_len >= 1) {
@@ -111,6 +134,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
         }
 
         bss->wmm_used = elems->wmm_param || elems->wmm_info;
+        bss->uapsd_supported = is_uapsd_supported(elems);
 
         if (!beacon)
                 bss->last_probe_resp = jiffies;
@@ -147,7 +171,7 @@ ieee80211_scan_rx(struct ieee80211_sub_if_data *sdata, struct sk_buff *skb)
         presp = ieee80211_is_probe_resp(fc);
         if (presp) {
                 /* ignore ProbeResp to foreign address */
-                if (memcmp(mgmt->da, sdata->dev->dev_addr, ETH_ALEN))
+                if (memcmp(mgmt->da, sdata->vif.addr, ETH_ALEN))
                         return RX_DROP_MONITOR;
 
                 presp = true;
@@ -220,82 +244,9 @@ static bool ieee80211_prep_hw_scan(struct ieee80211_local *local)
         return true;
 }
 
-/*
- * inform AP that we will go to sleep so that it will buffer the frames
- * while we scan
- */
-static void ieee80211_scan_ps_enable(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-
-        local->scan_ps_enabled = false;
-
-        /* FIXME: what to do when local->pspolling is true? */
-
-        del_timer_sync(&local->dynamic_ps_timer);
-        cancel_work_sync(&local->dynamic_ps_enable_work);
-
-        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
-                local->scan_ps_enabled = true;
-                local->hw.conf.flags &= ~IEEE80211_CONF_PS;
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-        }
-
-        if (!(local->scan_ps_enabled) ||
-            !(local->hw.flags & IEEE80211_HW_PS_NULLFUNC_STACK))
-                /*
-                 * If power save was enabled, no need to send a nullfunc
-                 * frame because AP knows that we are sleeping. But if the
-                 * hardware is creating the nullfunc frame for power save
-                 * status (ie. IEEE80211_HW_PS_NULLFUNC_STACK is not
-                 * enabled) and power save was enabled, the firmware just
-                 * sent a null frame with power save disabled. So we need
-                 * to send a new nullfunc frame to inform the AP that we
-                 * are again sleeping.
-                 */
-                ieee80211_send_nullfunc(local, sdata, 1);
-}
-
-/* inform AP that we are awake again, unless power save is enabled */
-static void ieee80211_scan_ps_disable(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_local *local = sdata->local;
-
-        if (!local->ps_sdata)
-                ieee80211_send_nullfunc(local, sdata, 0);
-        else if (local->scan_ps_enabled) {
-                /*
-                 * In !IEEE80211_HW_PS_NULLFUNC_STACK case the hardware
-                 * will send a nullfunc frame with the powersave bit set
-                 * even though the AP already knows that we are sleeping.
-                 * This could be avoided by sending a null frame with power
-                 * save bit disabled before enabling the power save, but
-                 * this doesn't gain anything.
-                 *
-                 * When IEEE80211_HW_PS_NULLFUNC_STACK is enabled, no need
-                 * to send a nullfunc frame because AP already knows that
-                 * we are sleeping, let's just enable power save mode in
-                 * hardware.
-                 */
-                local->hw.conf.flags |= IEEE80211_CONF_PS;
-                ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
-        } else if (local->hw.conf.dynamic_ps_timeout > 0) {
-                /*
-                 * If IEEE80211_CONF_PS was not set and the dynamic_ps_timer
-                 * had been running before leaving the operating channel,
-                 * restart the timer now and send a nullfunc frame to inform
-                 * the AP that we are awake.
-                 */
-                ieee80211_send_nullfunc(local, sdata, 0);
-                mod_timer(&local->dynamic_ps_timer, jiffies +
-                          msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
-        }
-}
-
 void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 {
         struct ieee80211_local *local = hw_to_local(hw);
-        struct ieee80211_sub_if_data *sdata;
         bool was_hw_scan;
 
         mutex_lock(&local->scan_mtx);
@@ -344,41 +295,19 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted)
 
         drv_sw_scan_complete(local);
 
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
-                /* Tell AP we're back */
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.associated) {
-                                ieee80211_scan_ps_disable(sdata);
-                                netif_tx_wake_all_queues(sdata->dev);
-                        }
-                } else
-                        netif_tx_wake_all_queues(sdata->dev);
-
-                /* re-enable beaconing */
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-                        ieee80211_bss_info_change_notify(
-                                sdata, BSS_CHANGED_BEACON_ENABLED);
-        }
-        mutex_unlock(&local->iflist_mtx);
+        ieee80211_offchannel_return(local, true);
 
  done:
         ieee80211_recalc_idle(local);
         ieee80211_mlme_notify_scan_completed(local);
         ieee80211_ibss_notify_scan_completed(local);
         ieee80211_mesh_notify_scan_completed(local);
+        ieee80211_queue_work(&local->hw, &local->work_work);
 }
 EXPORT_SYMBOL(ieee80211_scan_completed);
 
 static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 {
-        struct ieee80211_sub_if_data *sdata;
-
         /*
          * Hardware/driver doesn't support hw_scan, so use software
          * scanning instead. First send a nullfunc frame with power save
@@ -394,33 +323,15 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
          */
         drv_sw_scan_start(local);
 
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
-                /* disable beaconing */
-                if (sdata->vif.type == NL80211_IFTYPE_AP ||
-                    sdata->vif.type == NL80211_IFTYPE_ADHOC ||
-                    sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
-                        ieee80211_bss_info_change_notify(
-                                sdata, BSS_CHANGED_BEACON_ENABLED);
-
-                /*
-                 * only handle non-STA interfaces here, STA interfaces
-                 * are handled in the scan state machine
-                 */
-                if (sdata->vif.type != NL80211_IFTYPE_STATION)
-                        netif_tx_stop_all_queues(sdata->dev);
-        }
-        mutex_unlock(&local->iflist_mtx);
+        ieee80211_offchannel_stop_beaconing(local);
 
         local->next_scan_state = SCAN_DECISION;
         local->scan_channel_idx = 0;
 
+        drv_flush(local, false);
+
         ieee80211_configure_filter(local);
 
-        /* TODO: start scan as soon as all nullfunc frames are ACKed */
         ieee80211_queue_delayed_work(&local->hw,
                                      &local->scan_work,
                                      IEEE80211_CHANNEL_TIME);
@@ -433,7 +344,6 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
                                   struct cfg80211_scan_request *req)
 {
         struct ieee80211_local *local = sdata->local;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         int rc;
 
         if (local->scan_req)
@@ -463,11 +373,8 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         local->scan_req = req;
         local->scan_sdata = sdata;
 
-        if (req != local->int_scan_req &&
-            sdata->vif.type == NL80211_IFTYPE_STATION &&
-            !list_empty(&ifmgd->work_list)) {
-                /* actually wait for the work it's doing to finish/time out */
-                set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
+        if (!list_empty(&local->work_list)) {
+                /* wait for the work to finish/time out */
                 return 0;
         }
 
@@ -526,7 +433,7 @@ static int ieee80211_scan_state_decision(struct ieee80211_local *local,
         /* check if at least one STA interface is associated */
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
 
                 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
@@ -564,56 +471,35 @@ static int ieee80211_scan_state_decision(struct ieee80211_local *local,
 static void ieee80211_scan_state_leave_oper_channel(struct ieee80211_local *local,
                                                     unsigned long *next_delay)
 {
-        struct ieee80211_sub_if_data *sdata;
+        ieee80211_offchannel_stop_station(local);
+
+        __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
 
         /*
-         * notify the AP about us leaving the channel and stop all STA interfaces
+         * What if the nullfunc frames didn't arrive?
          */
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        netif_tx_stop_all_queues(sdata->dev);
-                        if (sdata->u.mgd.associated)
-                                ieee80211_scan_ps_enable(sdata);
-                }
-        }
-        mutex_unlock(&local->iflist_mtx);
-
-        __set_bit(SCAN_OFF_CHANNEL, &local->scanning);
+        drv_flush(local, false);
+        if (local->ops->flush)
+                *next_delay = 0;
+        else
+                *next_delay = HZ / 10;
 
         /* advance to the next channel to be scanned */
-        *next_delay = HZ / 10;
         local->next_scan_state = SCAN_SET_CHANNEL;
 }
 
 static void ieee80211_scan_state_enter_oper_channel(struct ieee80211_local *local,
                                                     unsigned long *next_delay)
 {
-        struct ieee80211_sub_if_data *sdata = local->scan_sdata;
-
         /* switch back to the operating channel */
         local->scan_channel = NULL;
         ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         /*
-         * notify the AP about us being back and restart all STA interfaces
+         * Only re-enable station mode interface now; beaconing will be
+         * re-enabled once the full scan has been completed.
          */
-        mutex_lock(&local->iflist_mtx);
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                if (!netif_running(sdata->dev))
-                        continue;
-
-                /* Tell AP we're back */
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        if (sdata->u.mgd.associated)
-                                ieee80211_scan_ps_disable(sdata);
-                        netif_tx_wake_all_queues(sdata->dev);
-                }
-        }
-        mutex_unlock(&local->iflist_mtx);
+        ieee80211_offchannel_return(local, false);
 
         __clear_bit(SCAN_OFF_CHANNEL, &local->scanning);
 
@@ -727,7 +613,7 @@ void ieee80211_scan_work(struct work_struct *work)
         /*
          * Avoid re-scheduling when the sdata is going away.
          */
-        if (!netif_running(sdata->dev)) {
+        if (!ieee80211_sdata_running(sdata)) {
                 ieee80211_scan_completed(&local->hw, true);
                 return;
         }
diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c
index aa743a895cf9..7733f66ee2c4 100644
--- a/net/mac80211/spectmgmt.c
+++ b/net/mac80211/spectmgmt.c
@@ -35,7 +35,7 @@ static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_da
 
         if (!skb) {
                 printk(KERN_ERR "%s: failed to allocate buffer for "
-                                "measurement report frame\n", sdata->dev->name);
+                                "measurement report frame\n", sdata->name);
                 return;
         }
 
@@ -43,7 +43,7 @@ static void ieee80211_send_refuse_measurement_request(struct ieee80211_sub_if_da
         msr_report = (struct ieee80211_mgmt *)skb_put(skb, 24);
         memset(msr_report, 0, 24);
         memcpy(msr_report->da, da, ETH_ALEN);
-        memcpy(msr_report->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(msr_report->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(msr_report->bssid, bssid, ETH_ALEN);
         msr_report->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                                 IEEE80211_STYPE_ACTION);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 71f370dd24bc..f735826f055c 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -103,13 +103,37 @@ static int sta_info_hash_del(struct ieee80211_local *local,
 }
 
 /* protected by RCU */
-struct sta_info *sta_info_get(struct ieee80211_local *local, const u8 *addr)
+struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr)
 {
+        struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
 
         sta = rcu_dereference(local->sta_hash[STA_HASH(addr)]);
         while (sta) {
-                if (memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
+                if (sta->sdata == sdata &&
+                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
+                        break;
+                sta = rcu_dereference(sta->hnext);
+        }
+        return sta;
+}
+
+/*
+ * Get sta info either from the specified interface
+ * or from one of its vlans
+ */
+struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
+                                  const u8 *addr)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sta_info *sta;
+
+        sta = rcu_dereference(local->sta_hash[STA_HASH(addr)]);
+        while (sta) {
+                if ((sta->sdata == sdata ||
+                     sta->sdata->bss == sdata->bss) &&
+                    memcmp(sta->sta.addr, addr, ETH_ALEN) == 0)
                         break;
                 sta = rcu_dereference(sta->hnext);
         }
@@ -356,6 +380,7 @@ int sta_info_insert(struct sta_info *sta)
 {
         struct ieee80211_local *local = sta->local;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
+        struct station_info sinfo;
         unsigned long flags;
         int err = 0;
 
@@ -364,12 +389,12 @@ int sta_info_insert(struct sta_info *sta)
          * something inserts a STA (on one CPU) without holding the RTNL
          * and another CPU turns off the net device.
          */
-        if (unlikely(!netif_running(sdata->dev))) {
+        if (unlikely(!ieee80211_sdata_running(sdata))) {
                 err = -ENETDOWN;
                 goto out_free;
         }
 
-        if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->dev->dev_addr) == 0 ||
+        if (WARN_ON(compare_ether_addr(sta->sta.addr, sdata->vif.addr) == 0 ||
                     is_multicast_ether_addr(sta->sta.addr))) {
                 err = -EINVAL;
                 goto out_free;
@@ -377,7 +402,7 @@ int sta_info_insert(struct sta_info *sta)
 
         spin_lock_irqsave(&local->sta_lock, flags);
         /* check if STA exists already */
-        if (sta_info_get(local, sta->sta.addr)) {
+        if (sta_info_get(sdata, sta->sta.addr)) {
                 spin_unlock_irqrestore(&local->sta_lock, flags);
                 err = -EEXIST;
                 goto out_free;
@@ -394,7 +419,7 @@ int sta_info_insert(struct sta_info *sta)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD, &sta->sta);
+                drv_sta_notify(local, sdata, STA_NOTIFY_ADD, &sta->sta);
                 sdata = sta->sdata;
         }
 
@@ -405,6 +430,10 @@ int sta_info_insert(struct sta_info *sta)
 
         spin_unlock_irqrestore(&local->sta_lock, flags);
 
+        sinfo.filled = 0;
+        sinfo.generation = local->sta_generation;
+        cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_ATOMIC);
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         /*
          * Debugfs entry adding might sleep, so schedule process
@@ -534,7 +563,7 @@ static void __sta_info_unlink(struct sta_info **sta)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                drv_sta_notify(local, &sdata->vif, STA_NOTIFY_REMOVE,
+                drv_sta_notify(local, sdata, STA_NOTIFY_REMOVE,
                                &(*sta)->sta);
                 sdata = (*sta)->sdata;
         }
@@ -828,7 +857,7 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
                 if (time_after(jiffies, sta->last_rx + exp_time)) {
 #ifdef CONFIG_MAC80211_IBSS_DEBUG
                         printk(KERN_DEBUG "%s: expiring inactive STA %pM\n",
-                               sdata->dev->name, sta->sta.addr);
+                               sdata->name, sta->sta.addr);
 #endif
                         __sta_info_unlink(&sta);
                         if (sta)
@@ -843,11 +872,12 @@ void ieee80211_sta_expire(struct ieee80211_sub_if_data *sdata,
 struct ieee80211_sta *ieee80211_find_sta_by_hw(struct ieee80211_hw *hw,
                                                const u8 *addr)
 {
-        struct sta_info *sta = sta_info_get(hw_to_local(hw), addr);
+        struct sta_info *sta, *nxt;
 
-        if (!sta)
-                return NULL;
-        return &sta->sta;
+        /* Just return a random station ... first in list ... */
+        for_each_sta_info(hw_to_local(hw), addr, sta, nxt)
+                return &sta->sta;
+        return NULL;
 }
 EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_hw);
 
@@ -872,7 +902,7 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
         struct ieee80211_local *local = sdata->local;
         int sent, buffered;
 
-        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_AWAKE, &sta->sta);
+        drv_sta_notify(local, sdata, STA_NOTIFY_AWAKE, &sta->sta);
 
         if (!skb_queue_empty(&sta->ps_tx_buf))
                 sta_info_clear_tim_bit(sta);
@@ -885,7 +915,7 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         printk(KERN_DEBUG "%s: STA %pM aid %d sending %d filtered/%d PS frames "
-               "since STA not sleeping anymore\n", sdata->dev->name,
+               "since STA not sleeping anymore\n", sdata->name,
                sta->sta.addr, sta->sta.aid, sent - buffered, buffered);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
 }
@@ -944,7 +974,7 @@ void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta)
                  */
                 printk(KERN_DEBUG "%s: STA %pM sent PS Poll even "
                        "though there are no buffered frames for it\n",
-                       sdata->dev->name, sta->sta.addr);
+                       sdata->name, sta->sta.addr);
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
         }
 }
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index b4810f6aa94f..6f79bba5706e 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -403,9 +403,37 @@ static inline u32 get_sta_flags(struct sta_info *sta)
 #define STA_INFO_CLEANUP_INTERVAL (10 * HZ)
 
 /*
- * Get a STA info, must have be under RCU read lock.
+ * Get a STA info, must be under RCU read lock.
  */
-struct sta_info *sta_info_get(struct ieee80211_local *local, const u8 *addr);
+struct sta_info *sta_info_get(struct ieee80211_sub_if_data *sdata,
+                              const u8 *addr);
+
+struct sta_info *sta_info_get_bss(struct ieee80211_sub_if_data *sdata,
+                                  const u8 *addr);
+
+static inline
+void for_each_sta_info_type_check(struct ieee80211_local *local,
+                                  const u8 *addr,
+                                  struct sta_info *sta,
+                                  struct sta_info *nxt)
+{
+}
+
+#define for_each_sta_info(local, _addr, sta, nxt)                       \
+        for (   /* initialise loop */                                   \
+                sta = rcu_dereference(local->sta_hash[STA_HASH(_addr)]),\
+                nxt = sta ? rcu_dereference(sta->hnext) : NULL;         \
+                /* typecheck */                                         \
+                for_each_sta_info_type_check(local, (_addr), sta, nxt), \
+                /* continue condition */                                \
+                sta;                                                    \
+                /* advance loop */                                      \
+                sta = nxt,                                              \
+                nxt = sta ? rcu_dereference(sta->hnext) : NULL          \
+             )                                                          \
+        /* compare address and run code only if it matches */           \
+        if (memcmp(sta->sta.addr, (_addr), ETH_ALEN) == 0)
+
 /*
  * Get STA info by index, BROKEN!
  */
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index d78f36c64c7b..0ebcdda24200 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -134,6 +134,40 @@ static void ieee80211_handle_filtered_frame(struct ieee80211_local *local,
         dev_kfree_skb(skb);
 }
 
+static void ieee80211_frame_acked(struct sta_info *sta, struct sk_buff *skb)
+{
+        struct ieee80211_mgmt *mgmt = (void *) skb->data;
+        struct ieee80211_local *local = sta->local;
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
+
+        if (ieee80211_is_action(mgmt->frame_control) &&
+            sdata->vif.type == NL80211_IFTYPE_STATION &&
+            mgmt->u.action.category == WLAN_CATEGORY_HT &&
+            mgmt->u.action.u.ht_smps.action == WLAN_HT_ACTION_SMPS) {
+                /*
+                 * This update looks racy, but isn't -- if we come
+                 * here we've definitely got a station that we're
+                 * talking to, and on a managed interface that can
+                 * only be the AP. And the only other place updating
+                 * this variable is before we're associated.
+                 */
+                switch (mgmt->u.action.u.ht_smps.smps_control) {
+                case WLAN_HT_SMPS_CONTROL_DYNAMIC:
+                        sta->sdata->u.mgd.ap_smps = IEEE80211_SMPS_DYNAMIC;
+                        break;
+                case WLAN_HT_SMPS_CONTROL_STATIC:
+                        sta->sdata->u.mgd.ap_smps = IEEE80211_SMPS_STATIC;
+                        break;
+                case WLAN_HT_SMPS_CONTROL_DISABLED:
+                default: /* shouldn't happen since we don't send that */
+                        sta->sdata->u.mgd.ap_smps = IEEE80211_SMPS_OFF;
+                        break;
+                }
+
+                ieee80211_queue_work(&local->hw, &local->recalc_smps);
+        }
+}
+
 void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
         struct sk_buff *skb2;
@@ -146,7 +180,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct ieee80211_tx_status_rtap_hdr *rthdr;
         struct ieee80211_sub_if_data *sdata;
         struct net_device *prev_dev = NULL;
-        struct sta_info *sta;
+        struct sta_info *sta, *tmp;
         int retry_count = -1, i;
         bool injected;
 
@@ -166,9 +200,11 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
 
         sband = local->hw.wiphy->bands[info->band];
 
-        sta = sta_info_get(local, hdr->addr1);
+        for_each_sta_info(local, hdr->addr1, sta, tmp) {
+                /* skip wrong virtual interface */
+                if (memcmp(hdr->addr2, sta->sdata->vif.addr, ETH_ALEN))
+                        continue;
 
-        if (sta) {
                 if (!(info->flags & IEEE80211_TX_STAT_ACK) &&
                     test_sta_flags(sta, WLAN_STA_PS_STA)) {
                         /*
@@ -208,6 +244,10 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 rate_control_tx_status(local, sband, sta, skb);
                 if (ieee80211_vif_is_mesh(&sta->sdata->vif))
                         ieee80211s_update_metric(local, sta, skb);
+
+                if (!(info->flags & IEEE80211_TX_CTL_INJECTED) &&
+                    (info->flags & IEEE80211_TX_STAT_ACK))
+                        ieee80211_frame_acked(sta, skb);
         }
 
         rcu_read_unlock();
@@ -311,7 +351,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         rcu_read_lock();
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
-                        if (!netif_running(sdata->dev))
+                        if (!ieee80211_sdata_running(sdata))
                                 continue;
 
                         if ((sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) &&
diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
index 4921d724b6c7..b73454a507f9 100644
--- a/net/mac80211/tkip.c
+++ b/net/mac80211/tkip.c
@@ -100,7 +100,7 @@ static void tkip_mixing_phase1(const u8 *tk, struct tkip_ctx *ctx,
                 p1k[3] += tkipS(p1k[2] ^ get_unaligned_le16(tk + 12 + j));
                 p1k[4] += tkipS(p1k[3] ^ get_unaligned_le16(tk + 0 + j)) + i;
         }
-        ctx->initialized = 1;
+        ctx->state = TKIP_STATE_PHASE1_DONE;
 }
 
 static void tkip_mixing_phase2(const u8 *tk, struct tkip_ctx *ctx,
@@ -183,7 +183,7 @@ void ieee80211_get_tkip_key(struct ieee80211_key_conf *keyconf,
         /* Update the p1k only when the iv16 in the packet wraps around, this
          * might occur after the wrap around of iv16 in the key in case of
          * fragmented packets. */
-        if (iv16 == 0 || !ctx->initialized)
+        if (iv16 == 0 || ctx->state == TKIP_STATE_NOT_INIT)
                 tkip_mixing_phase1(tk, ctx, hdr->addr2, iv32);
 
         if (type == IEEE80211_TKIP_P1_KEY) {
@@ -209,7 +209,7 @@ void ieee80211_tkip_encrypt_data(struct crypto_blkcipher *tfm,
         const u8 *tk = &key->conf.key[NL80211_TKIP_DATA_OFFSET_ENCR_KEY];
 
         /* Calculate per-packet key */
-        if (ctx->iv16 == 0 || !ctx->initialized)
+        if (ctx->iv16 == 0 || ctx->state == TKIP_STATE_NOT_INIT)
                 tkip_mixing_phase1(tk, ctx, ta, ctx->iv32);
 
         tkip_mixing_phase2(tk, ctx, ctx->iv16, rc4key);
@@ -259,7 +259,7 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
         if ((keyid >> 6) != key->conf.keyidx)
                 return TKIP_DECRYPT_INVALID_KEYIDX;
 
-        if (key->u.tkip.rx[queue].initialized &&
+        if (key->u.tkip.rx[queue].state != TKIP_STATE_NOT_INIT &&
             (iv32 < key->u.tkip.rx[queue].iv32 ||
              (iv32 == key->u.tkip.rx[queue].iv32 &&
               iv16 <= key->u.tkip.rx[queue].iv16))) {
@@ -275,11 +275,11 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
 
         if (only_iv) {
                 res = TKIP_DECRYPT_OK;
-                key->u.tkip.rx[queue].initialized = 1;
+                key->u.tkip.rx[queue].state = TKIP_STATE_PHASE1_HW_UPLOADED;
                 goto done;
         }
 
-        if (!key->u.tkip.rx[queue].initialized ||
+        if (key->u.tkip.rx[queue].state == TKIP_STATE_NOT_INIT ||
             key->u.tkip.rx[queue].iv32 != iv32) {
                 /* IV16 wrapped around - perform TKIP phase 1 */
                 tkip_mixing_phase1(tk, &key->u.tkip.rx[queue], ta, iv32);
@@ -299,18 +299,20 @@ int ieee80211_tkip_decrypt_data(struct crypto_blkcipher *tfm,
                         printk("\n");
                 }
 #endif
-                if (key->local->ops->update_tkip_key &&
-                        key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE) {
-                        static const u8 bcast[ETH_ALEN] =
-                                {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
-                        const u8 *sta_addr = key->sta->sta.addr;
-
-                        if (is_multicast_ether_addr(ra))
-                                sta_addr = bcast;
-
-                        drv_update_tkip_key(key->local, &key->conf, sta_addr,
-                                            iv32, key->u.tkip.rx[queue].p1k);
-                }
+        }
+        if (key->local->ops->update_tkip_key &&
+            key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE &&
+            key->u.tkip.rx[queue].state != TKIP_STATE_PHASE1_HW_UPLOADED) {
+                static const u8 bcast[ETH_ALEN] =
+                {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
+                const u8 *sta_addr = key->sta->sta.addr;
+
+                if (is_multicast_ether_addr(ra))
+                        sta_addr = bcast;
+
+                drv_update_tkip_key(key->local, &key->conf, sta_addr,
+                                iv32, key->u.tkip.rx[queue].p1k);
+                key->u.tkip.rx[queue].state = TKIP_STATE_PHASE1_HW_UPLOADED;
         }
 
         tkip_mixing_phase2(tk, &key->u.tkip.rx[queue], iv16, rc4key);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ac210b586702..daf81048c1f7 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -180,6 +180,71 @@ static int inline is_ieee80211_device(struct ieee80211_local *local,
 }
 
 /* tx handlers */
+static ieee80211_tx_result debug_noinline
+ieee80211_tx_h_dynamic_ps(struct ieee80211_tx_data *tx)
+{
+        struct ieee80211_local *local = tx->local;
+        struct ieee80211_if_managed *ifmgd;
+
+        /* driver doesn't support power save */
+        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
+                return TX_CONTINUE;
+
+        /* hardware does dynamic power save */
+        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
+                return TX_CONTINUE;
+
+        /* dynamic power save disabled */
+        if (local->hw.conf.dynamic_ps_timeout <= 0)
+                return TX_CONTINUE;
+
+        /* we are scanning, don't enable power save */
+        if (local->scanning)
+                return TX_CONTINUE;
+
+        if (!local->ps_sdata)
+                return TX_CONTINUE;
+
+        /* No point if we're going to suspend */
+        if (local->quiescing)
+                return TX_CONTINUE;
+
+        /* dynamic ps is supported only in managed mode */
+        if (tx->sdata->vif.type != NL80211_IFTYPE_STATION)
+                return TX_CONTINUE;
+
+        ifmgd = &tx->sdata->u.mgd;
+
+        /*
+         * Don't wakeup from power save if u-apsd is enabled, voip ac has
+         * u-apsd enabled and the frame is in voip class. This effectively
+         * means that even if all access categories have u-apsd enabled, in
+         * practise u-apsd is only used with the voip ac. This is a
+         * workaround for the case when received voip class packets do not
+         * have correct qos tag for some reason, due the network or the
+         * peer application.
+         *
+         * Note: local->uapsd_queues access is racy here. If the value is
+         * changed via debugfs, user needs to reassociate manually to have
+         * everything in sync.
+         */
+        if ((ifmgd->flags & IEEE80211_STA_UAPSD_ENABLED)
+            && (local->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
+            && skb_get_queue_mapping(tx->skb) == 0)
+                return TX_CONTINUE;
+
+        if (local->hw.conf.flags & IEEE80211_CONF_PS) {
+                ieee80211_stop_queues_by_reason(&local->hw,
+                                                IEEE80211_QUEUE_STOP_REASON_PS);
+                ieee80211_queue_work(&local->hw,
+                                     &local->dynamic_ps_disable_work);
+        }
+
+        mod_timer(&local->dynamic_ps_timer, jiffies +
+                  msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
+
+        return TX_CONTINUE;
+}
 
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
@@ -223,7 +288,7 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                         printk(KERN_DEBUG "%s: dropped data frame to not "
                                "associated station %pM\n",
-                               tx->dev->name, hdr->addr1);
+                               tx->sdata->name, hdr->addr1);
 #endif /* CONFIG_MAC80211_VERBOSE_DEBUG */
                         I802_DEBUG_INC(tx->local->tx_handlers_drop_not_assoc);
                         return TX_DROP;
@@ -331,7 +396,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
                 if (net_ratelimit())
                         printk(KERN_DEBUG "%s: BC TX buffer full - dropping the oldest frame\n",
-                               tx->dev->name);
+                               tx->sdata->name);
 #endif
                 dev_kfree_skb(skb_dequeue(&tx->sdata->bss->ps_bc_buf));
         } else
@@ -391,7 +456,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                         if (net_ratelimit()) {
                                 printk(KERN_DEBUG "%s: STA %pM TX "
                                        "buffer full - dropping oldest frame\n",
-                                       tx->dev->name, sta->sta.addr);
+                                       tx->sdata->name, sta->sta.addr);
                         }
 #endif
                         dev_kfree_skb(old);
@@ -416,7 +481,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
         else if (unlikely(staflags & WLAN_STA_PS_STA)) {
                 printk(KERN_DEBUG "%s: STA %pM in PS mode, but pspoll "
-                       "set -> send frame\n", tx->dev->name,
+                       "set -> send frame\n", tx->sdata->name,
                        sta->sta.addr);
         }
 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
@@ -519,7 +584,12 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         txrc.bss_conf = &tx->sdata->vif.bss_conf;
         txrc.skb = tx->skb;
         txrc.reported_rate.idx = -1;
-        txrc.max_rate_idx = tx->sdata->max_ratectrl_rateidx;
+        txrc.rate_idx_mask = tx->sdata->rc_rateidx_mask[tx->channel->band];
+        if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
+                txrc.max_rate_idx = -1;
+        else
+                txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+        txrc.ap = tx->sdata->vif.type == NL80211_IFTYPE_AP;
 
         /* set up RTS protection if desired */
         if (len > tx->local->hw.wiphy->rts_threshold) {
@@ -549,7 +619,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
                  "%s: Dropped data frame as no usable bitrate found while "
                  "scanning and associated. Target station: "
                  "%pM on %d GHz band\n",
-                 tx->dev->name, hdr->addr1,
+                 tx->sdata->name, hdr->addr1,
                  tx->channel->band ? 5 : 2))
                 return TX_DROP;
 
@@ -1021,7 +1091,6 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
 
         memset(tx, 0, sizeof(*tx));
         tx->skb = skb;
-        tx->dev = sdata->dev; /* use original interface */
         tx->local = local;
         tx->sdata = sdata;
         tx->channel = local->hw.conf.channel;
@@ -1052,10 +1121,13 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
 
         hdr = (struct ieee80211_hdr *) skb->data;
 
-        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+        if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
+                if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
+                        return TX_DROP;
+        }
         if (!tx->sta)
-                tx->sta = sta_info_get(local, hdr->addr1);
+                tx->sta = sta_info_get(sdata, hdr->addr1);
 
         if (tx->sta && ieee80211_is_data_qos(hdr->frame_control) &&
             (local->hw.flags & IEEE80211_HW_AMPDU_AGGREGATION)) {
@@ -1216,6 +1288,7 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
                         goto txh_done;  \
         } while (0)
 
+        CALL_TXH(ieee80211_tx_h_dynamic_ps);
         CALL_TXH(ieee80211_tx_h_check_assoc);
         CALL_TXH(ieee80211_tx_h_ps_buf);
         CALL_TXH(ieee80211_tx_h_select_key);
@@ -1398,34 +1471,6 @@ static int ieee80211_skb_resize(struct ieee80211_local *local,
         return 0;
 }
 
-static bool need_dynamic_ps(struct ieee80211_local *local)
-{
-        /* driver doesn't support power save */
-        if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS))
-                return false;
-
-        /* hardware does dynamic power save */
-        if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
-                return false;
-
-        /* dynamic power save disabled */
-        if (local->hw.conf.dynamic_ps_timeout <= 0)
-                return false;
-
-        /* we are scanning, don't enable power save */
-        if (local->scanning)
-                return false;
-
-        if (!local->ps_sdata)
-                return false;
-
-        /* No point if we're going to suspend */
-        if (local->quiescing)
-                return false;
-
-        return true;
-}
-
 static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
                            struct sk_buff *skb)
 {
@@ -1436,18 +1481,6 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
         int headroom;
         bool may_encrypt;
 
-        if (need_dynamic_ps(local)) {
-                if (local->hw.conf.flags & IEEE80211_CONF_PS) {
-                        ieee80211_stop_queues_by_reason(&local->hw,
-                                        IEEE80211_QUEUE_STOP_REASON_PS);
-                        ieee80211_queue_work(&local->hw,
-                                        &local->dynamic_ps_disable_work);
-                }
-
-                mod_timer(&local->dynamic_ps_timer, jiffies +
-                        msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
-        }
-
         rcu_read_lock();
 
         if (unlikely(sdata->vif.type == NL80211_IFTYPE_MONITOR)) {
@@ -1474,11 +1507,11 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
 
                         list_for_each_entry_rcu(tmp_sdata, &local->interfaces,
                                                 list) {
-                                if (!netif_running(tmp_sdata->dev))
+                                if (!ieee80211_sdata_running(tmp_sdata))
                                         continue;
                                 if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
                                         continue;
-                                if (compare_ether_addr(tmp_sdata->dev->dev_addr,
+                                if (compare_ether_addr(tmp_sdata->vif.addr,
                                                        hdr->addr2) == 0) {
                                         sdata = tmp_sdata;
                                         break;
@@ -1642,7 +1675,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                         /* RA TA DA SA */
                         memcpy(hdr.addr1, sta->sta.addr, ETH_ALEN);
-                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
+                        memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
                         memcpy(hdr.addr3, skb->data, ETH_ALEN);
                         memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
                         hdrlen = 30;
@@ -1656,7 +1689,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS);
                 /* DA BSSID SA */
                 memcpy(hdr.addr1, skb->data, ETH_ALEN);
-                memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
+                memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
                 memcpy(hdr.addr3, skb->data + ETH_ALEN, ETH_ALEN);
                 hdrlen = 24;
                 break;
@@ -1664,7 +1697,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                 /* RA TA DA SA */
                 memcpy(hdr.addr1, sdata->u.wds.remote_addr, ETH_ALEN);
-                memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
+                memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
                 memcpy(hdr.addr3, skb->data, ETH_ALEN);
                 memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
                 hdrlen = 30;
@@ -1678,8 +1711,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         goto fail;
                 }
 
-                if (compare_ether_addr(dev->dev_addr,
-                                          skb->data + ETH_ALEN) == 0) {
+                if (compare_ether_addr(sdata->vif.addr,
+                                       skb->data + ETH_ALEN) == 0) {
                         hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
                                         skb->data, skb->data + ETH_ALEN);
                         meshhdrlen = ieee80211_new_mesh_header(&mesh_hdr,
@@ -1709,7 +1742,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                                 }
                         }
                         hdrlen = ieee80211_fill_mesh_addresses(&hdr, &fc,
-                                        mesh_da, dev->dev_addr);
+                                        mesh_da, sdata->vif.addr);
                         rcu_read_unlock();
                         if (is_mesh_mcast)
                                 meshhdrlen =
@@ -1734,7 +1767,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 if (sdata->u.mgd.use_4addr && ethertype != ETH_P_PAE) {
                         fc |= cpu_to_le16(IEEE80211_FCTL_FROMDS | IEEE80211_FCTL_TODS);
                         /* RA TA DA SA */
-                        memcpy(hdr.addr2, dev->dev_addr, ETH_ALEN);
+                        memcpy(hdr.addr2, sdata->vif.addr, ETH_ALEN);
                         memcpy(hdr.addr3, skb->data, ETH_ALEN);
                         memcpy(hdr.addr4, skb->data + ETH_ALEN, ETH_ALEN);
                         hdrlen = 30;
@@ -1765,9 +1798,8 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
          */
         if (!is_multicast_ether_addr(hdr.addr1)) {
                 rcu_read_lock();
-                sta = sta_info_get(local, hdr.addr1);
-                /* XXX: in the future, use sdata to look up the sta */
-                if (sta && sta->sdata == sdata)
+                sta = sta_info_get(sdata, hdr.addr1);
+                if (sta)
                         sta_flags = get_sta_flags(sta);
                 rcu_read_unlock();
         }
@@ -1786,7 +1818,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 unlikely(!is_multicast_ether_addr(hdr.addr1) &&
                       !(sta_flags & WLAN_STA_AUTHORIZED) &&
                       !(ethertype == ETH_P_PAE &&
-                       compare_ether_addr(dev->dev_addr,
+                       compare_ether_addr(sdata->vif.addr,
                                           skb->data + ETH_ALEN) == 0))) {
 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG
                 if (net_ratelimit())
@@ -1926,7 +1958,7 @@ static bool ieee80211_tx_pending_skb(struct ieee80211_local *local,
                 ieee80211_tx(sdata, skb, true);
         } else {
                 hdr = (struct ieee80211_hdr *)skb->data;
-                sta = sta_info_get(local, hdr->addr1);
+                sta = sta_info_get(sdata, hdr->addr1);
 
                 ret = __ieee80211_tx(local, &skb, sta, true);
                 if (ret != IEEE80211_TX_OK)
@@ -2062,6 +2094,7 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
         struct beacon_data *beacon;
         struct ieee80211_supported_band *sband;
         enum ieee80211_band band = local->hw.conf.channel->band;
+        struct ieee80211_tx_rate_control txrc;
 
         sband = local->hw.wiphy->bands[band];
 
@@ -2150,8 +2183,8 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
                 mgmt->frame_control =
                     cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON);
                 memset(mgmt->da, 0xff, ETH_ALEN);
-                memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
-                memcpy(mgmt->bssid, sdata->dev->dev_addr, ETH_ALEN);
+                memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+                memcpy(mgmt->bssid, sdata->vif.addr, ETH_ALEN);
                 mgmt->u.beacon.beacon_int =
                         cpu_to_le16(sdata->vif.bss_conf.beacon_int);
                 mgmt->u.beacon.capab_info = 0x0; /* 0x0 for MPs */
@@ -2169,21 +2202,25 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
         info = IEEE80211_SKB_CB(skb);
 
         info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        info->flags |= IEEE80211_TX_CTL_NO_ACK;
         info->band = band;
-        /*
-         * XXX: For now, always use the lowest rate
-         */
-        info->control.rates[0].idx = 0;
-        info->control.rates[0].count = 1;
-        info->control.rates[1].idx = -1;
-        info->control.rates[2].idx = -1;
-        info->control.rates[3].idx = -1;
-        info->control.rates[4].idx = -1;
-        BUILD_BUG_ON(IEEE80211_TX_MAX_RATES != 5);
+
+        memset(&txrc, 0, sizeof(txrc));
+        txrc.hw = hw;
+        txrc.sband = sband;
+        txrc.bss_conf = &sdata->vif.bss_conf;
+        txrc.skb = skb;
+        txrc.reported_rate.idx = -1;
+        txrc.rate_idx_mask = sdata->rc_rateidx_mask[band];
+        if (txrc.rate_idx_mask == (1 << sband->n_bitrates) - 1)
+                txrc.max_rate_idx = -1;
+        else
+                txrc.max_rate_idx = fls(txrc.rate_idx_mask) - 1;
+        txrc.ap = true;
+        rate_control_get_rate(sdata, NULL, &txrc);
 
         info->control.vif = vif;
 
-        info->flags |= IEEE80211_TX_CTL_NO_ACK;
         info->flags |= IEEE80211_TX_CTL_CLEAR_PS_FILT;
         info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
  out:
@@ -2192,6 +2229,134 @@ struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_beacon_get_tim);
 
+struct sk_buff *ieee80211_pspoll_get(struct ieee80211_hw *hw,
+                                     struct ieee80211_vif *vif)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_managed *ifmgd;
+        struct ieee80211_pspoll *pspoll;
+        struct ieee80211_local *local;
+        struct sk_buff *skb;
+
+        if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
+                return NULL;
+
+        sdata = vif_to_sdata(vif);
+        ifmgd = &sdata->u.mgd;
+        local = sdata->local;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*pspoll));
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for "
+                       "pspoll template\n", sdata->name);
+                return NULL;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        pspoll = (struct ieee80211_pspoll *) skb_put(skb, sizeof(*pspoll));
+        memset(pspoll, 0, sizeof(*pspoll));
+        pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
+                                            IEEE80211_STYPE_PSPOLL);
+        pspoll->aid = cpu_to_le16(ifmgd->aid);
+
+        /* aid in PS-Poll has its two MSBs each set to 1 */
+        pspoll->aid |= cpu_to_le16(1 << 15 | 1 << 14);
+
+        memcpy(pspoll->bssid, ifmgd->bssid, ETH_ALEN);
+        memcpy(pspoll->ta, vif->addr, ETH_ALEN);
+
+        return skb;
+}
+EXPORT_SYMBOL(ieee80211_pspoll_get);
+
+struct sk_buff *ieee80211_nullfunc_get(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif)
+{
+        struct ieee80211_hdr_3addr *nullfunc;
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_if_managed *ifmgd;
+        struct ieee80211_local *local;
+        struct sk_buff *skb;
+
+        if (WARN_ON(vif->type != NL80211_IFTYPE_STATION))
+                return NULL;
+
+        sdata = vif_to_sdata(vif);
+        ifmgd = &sdata->u.mgd;
+        local = sdata->local;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*nullfunc));
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for nullfunc "
+                       "template\n", sdata->name);
+                return NULL;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        nullfunc = (struct ieee80211_hdr_3addr *) skb_put(skb,
+                                                          sizeof(*nullfunc));
+        memset(nullfunc, 0, sizeof(*nullfunc));
+        nullfunc->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                              IEEE80211_STYPE_NULLFUNC |
+                                              IEEE80211_FCTL_TODS);
+        memcpy(nullfunc->addr1, ifmgd->bssid, ETH_ALEN);
+        memcpy(nullfunc->addr2, vif->addr, ETH_ALEN);
+        memcpy(nullfunc->addr3, ifmgd->bssid, ETH_ALEN);
+
+        return skb;
+}
+EXPORT_SYMBOL(ieee80211_nullfunc_get);
+
+struct sk_buff *ieee80211_probereq_get(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       const u8 *ssid, size_t ssid_len,
+                                       const u8 *ie, size_t ie_len)
+{
+        struct ieee80211_sub_if_data *sdata;
+        struct ieee80211_local *local;
+        struct ieee80211_hdr_3addr *hdr;
+        struct sk_buff *skb;
+        size_t ie_ssid_len;
+        u8 *pos;
+
+        sdata = vif_to_sdata(vif);
+        local = sdata->local;
+        ie_ssid_len = 2 + ssid_len;
+
+        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*hdr) +
+                            ie_ssid_len + ie_len);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
+                       "request template\n", sdata->name);
+                return NULL;
+        }
+
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        hdr = (struct ieee80211_hdr_3addr *) skb_put(skb, sizeof(*hdr));
+        memset(hdr, 0, sizeof(*hdr));
+        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                         IEEE80211_STYPE_PROBE_REQ);
+        memset(hdr->addr1, 0xff, ETH_ALEN);
+        memcpy(hdr->addr2, vif->addr, ETH_ALEN);
+        memset(hdr->addr3, 0xff, ETH_ALEN);
+
+        pos = skb_put(skb, ie_ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = ssid_len;
+        if (ssid)
+                memcpy(pos, ssid, ssid_len);
+        pos += ssid_len;
+
+        if (ie) {
+                pos = skb_put(skb, ie_len);
+                memcpy(pos, ie, ie_len);
+        }
+
+        return skb;
+}
+EXPORT_SYMBOL(ieee80211_probereq_get);
+
 void ieee80211_rts_get(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        const void *frame, size_t frame_len,
                        const struct ieee80211_tx_info *frame_txctl,
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 3848140313f5..ca170b417da6 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -18,7 +18,6 @@
 #include <linux/skbuff.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
-#include <linux/wireless.h>
 #include <linux/bitmap.h>
 #include <linux/crc32.h>
 #include <net/net_namespace.h>
@@ -480,8 +479,8 @@ void ieee80211_iterate_active_interfaces(
                 case NL80211_IFTYPE_MESH_POINT:
                         break;
                 }
-                if (netif_running(sdata->dev))
-                        iterator(data, sdata->dev->dev_addr,
+                if (ieee80211_sdata_running(sdata))
+                        iterator(data, sdata->vif.addr,
                                  &sdata->vif);
         }
 
@@ -514,8 +513,8 @@ void ieee80211_iterate_active_interfaces_atomic(
                 case NL80211_IFTYPE_MESH_POINT:
                         break;
                 }
-                if (netif_running(sdata->dev))
-                        iterator(data, sdata->dev->dev_addr,
+                if (ieee80211_sdata_running(sdata))
+                        iterator(data, sdata->vif.addr,
                                  &sdata->vif);
         }
 
@@ -793,6 +792,8 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
                         break;
                 }
 
+                qparam.uapsd = false;
+
                 drv_conf_tx(local, queue, &qparam);
         }
 }
@@ -860,7 +861,7 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                             sizeof(*mgmt) + 6 + extra_len);
         if (!skb) {
                 printk(KERN_DEBUG "%s: failed to allocate buffer for auth "
-                       "frame\n", sdata->dev->name);
+                       "frame\n", sdata->name);
                 return;
         }
         skb_reserve(skb, local->hw.extra_tx_headroom);
@@ -870,7 +871,7 @@ void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
         mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
                                           IEEE80211_STYPE_AUTH);
         memcpy(mgmt->da, bssid, ETH_ALEN);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
         memcpy(mgmt->bssid, bssid, ETH_ALEN);
         mgmt->u.auth.auth_alg = cpu_to_le16(auth_alg);
         mgmt->u.auth.auth_transaction = cpu_to_le16(transaction);
@@ -893,43 +894,87 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
                              enum ieee80211_band band)
 {
         struct ieee80211_supported_band *sband;
-        u8 *pos, *supp_rates_len, *esupp_rates_len = NULL;
-        int i;
+        u8 *pos;
+        size_t offset = 0, noffset;
+        int supp_rates_len, i;
 
         sband = local->hw.wiphy->bands[band];
 
         pos = buffer;
 
+        supp_rates_len = min_t(int, sband->n_bitrates, 8);
+
         *pos++ = WLAN_EID_SUPP_RATES;
-        supp_rates_len = pos;
-        *pos++ = 0;
-
-        for (i = 0; i < sband->n_bitrates; i++) {
-                struct ieee80211_rate *rate = &sband->bitrates[i];
-
-                if (esupp_rates_len) {
-                        *esupp_rates_len += 1;
-                } else if (*supp_rates_len == 8) {
-                        *pos++ = WLAN_EID_EXT_SUPP_RATES;
-                        esupp_rates_len = pos;
-                        *pos++ = 1;
-                } else
-                        *supp_rates_len += 1;
+        *pos++ = supp_rates_len;
+
+        for (i = 0; i < supp_rates_len; i++) {
+                int rate = sband->bitrates[i].bitrate;
+                *pos++ = (u8) (rate / 5);
+        }
+
+        /* insert "request information" if in custom IEs */
+        if (ie && ie_len) {
+                static const u8 before_extrates[] = {
+                        WLAN_EID_SSID,
+                        WLAN_EID_SUPP_RATES,
+                        WLAN_EID_REQUEST,
+                };
+                noffset = ieee80211_ie_split(ie, ie_len,
+                                             before_extrates,
+                                             ARRAY_SIZE(before_extrates),
+                                             offset);
+                memcpy(pos, ie + offset, noffset - offset);
+                pos += noffset - offset;
+                offset = noffset;
+        }
+
+        if (sband->n_bitrates > i) {
+                *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                *pos++ = sband->n_bitrates - i;
 
-                *pos++ = rate->bitrate / 5;
+                for (; i < sband->n_bitrates; i++) {
+                        int rate = sband->bitrates[i].bitrate;
+                        *pos++ = (u8) (rate / 5);
+                }
+        }
+
+        /* insert custom IEs that go before HT */
+        if (ie && ie_len) {
+                static const u8 before_ht[] = {
+                        WLAN_EID_SSID,
+                        WLAN_EID_SUPP_RATES,
+                        WLAN_EID_REQUEST,
+                        WLAN_EID_EXT_SUPP_RATES,
+                        WLAN_EID_DS_PARAMS,
+                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+                };
+                noffset = ieee80211_ie_split(ie, ie_len,
+                                             before_ht, ARRAY_SIZE(before_ht),
+                                             offset);
+                memcpy(pos, ie + offset, noffset - offset);
+                pos += noffset - offset;
+                offset = noffset;
         }
 
         if (sband->ht_cap.ht_supported) {
-                __le16 tmp = cpu_to_le16(sband->ht_cap.cap);
+                u16 cap = sband->ht_cap.cap;
+                __le16 tmp;
+
+                if (ieee80211_disable_40mhz_24ghz &&
+                    sband->band == IEEE80211_BAND_2GHZ) {
+                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        cap &= ~IEEE80211_HT_CAP_SGI_40;
+                }
 
                 *pos++ = WLAN_EID_HT_CAPABILITY;
                 *pos++ = sizeof(struct ieee80211_ht_cap);
                 memset(pos, 0, sizeof(struct ieee80211_ht_cap));
+                tmp = cpu_to_le16(cap);
                 memcpy(pos, &tmp, sizeof(u16));
                 pos += sizeof(u16);
-                /* TODO: needs a define here for << 2 */
                 *pos++ = sband->ht_cap.ampdu_factor |
-                         (sband->ht_cap.ampdu_density << 2);
+                         (sband->ht_cap.ampdu_density <<
+                                IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
                 memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
                 pos += sizeof(sband->ht_cap.mcs);
                 pos += 2 + 4 + 1; /* ext info, BF cap, antsel */
@@ -940,9 +985,11 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
          * that calculates local->scan_ies_len.
          */
 
-        if (ie) {
-                memcpy(pos, ie, ie_len);
-                pos += ie_len;
+        /* add any remaining custom IEs */
+        if (ie && ie_len) {
+                noffset = ie_len;
+                memcpy(pos, ie + offset, noffset - offset);
+                pos += noffset - offset;
         }
 
         return pos - buffer;
@@ -955,40 +1002,33 @@ void ieee80211_send_probe_req(struct ieee80211_sub_if_data *sdata, u8 *dst,
         struct ieee80211_local *local = sdata->local;
         struct sk_buff *skb;
         struct ieee80211_mgmt *mgmt;
-        u8 *pos;
-
-        skb = dev_alloc_skb(local->hw.extra_tx_headroom + sizeof(*mgmt) + 200 +
-                            ie_len);
-        if (!skb) {
-                printk(KERN_DEBUG "%s: failed to allocate buffer for probe "
-                       "request\n", sdata->dev->name);
+        size_t buf_len;
+        u8 *buf;
+
+        /* FIXME: come up with a proper value */
+        buf = kmalloc(200 + ie_len, GFP_KERNEL);
+        if (!buf) {
+                printk(KERN_DEBUG "%s: failed to allocate temporary IE "
+                       "buffer\n", sdata->name);
                 return;
         }
-        skb_reserve(skb, local->hw.extra_tx_headroom);
 
-        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
-        memset(mgmt, 0, 24);
-        mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
-                                          IEEE80211_STYPE_PROBE_REQ);
-        memcpy(mgmt->sa, sdata->dev->dev_addr, ETH_ALEN);
+        buf_len = ieee80211_build_preq_ies(local, buf, ie, ie_len,
+                                           local->hw.conf.channel->band);
+
+        skb = ieee80211_probereq_get(&local->hw, &sdata->vif,
+                                     ssid, ssid_len,
+                                     buf, buf_len);
+
         if (dst) {
+                mgmt = (struct ieee80211_mgmt *) skb->data;
                 memcpy(mgmt->da, dst, ETH_ALEN);
                 memcpy(mgmt->bssid, dst, ETH_ALEN);
-        } else {
-                memset(mgmt->da, 0xff, ETH_ALEN);
-                memset(mgmt->bssid, 0xff, ETH_ALEN);
         }
-        pos = skb_put(skb, 2 + ssid_len);
-        *pos++ = WLAN_EID_SSID;
-        *pos++ = ssid_len;
-        memcpy(pos, ssid, ssid_len);
-        pos += ssid_len;
-
-        skb_put(skb, ieee80211_build_preq_ies(local, pos, ie, ie_len,
-                                              local->hw.conf.channel->band));
 
         IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
         ieee80211_tx_skb(sdata, skb);
+        kfree(buf);
 }
 
 u32 ieee80211_sta_get_rates(struct ieee80211_local *local,
@@ -1032,16 +1072,15 @@ void ieee80211_stop_device(struct ieee80211_local *local)
         ieee80211_led_radio(local, false);
 
         cancel_work_sync(&local->reconfig_filter);
-        drv_stop(local);
 
         flush_workqueue(local->workqueue);
+        drv_stop(local);
 }
 
 int ieee80211_reconfig(struct ieee80211_local *local)
 {
         struct ieee80211_hw *hw = &local->hw;
         struct ieee80211_sub_if_data *sdata;
-        struct ieee80211_if_init_conf conf;
         struct sta_info *sta;
         unsigned long flags;
         int res;
@@ -1061,7 +1100,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 if (res) {
                         WARN(local->suspended, "Harware became unavailable "
                              "upon resume. This is could be a software issue"
-                             "prior to suspend or a harware issue\n");
+                             "prior to suspend or a hardware issue\n");
                         return res;
                 }
 
@@ -1072,12 +1111,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         list_for_each_entry(sdata, &local->interfaces, list) {
                 if (sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
                     sdata->vif.type != NL80211_IFTYPE_MONITOR &&
-                    netif_running(sdata->dev)) {
-                        conf.vif = &sdata->vif;
-                        conf.type = sdata->vif.type;
-                        conf.mac_addr = sdata->dev->dev_addr;
-                        res = drv_add_interface(local, &conf);
-                }
+                    ieee80211_sdata_running(sdata))
+                        res = drv_add_interface(local, &sdata->vif);
         }
 
         /* add STAs back */
@@ -1090,7 +1125,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                                              struct ieee80211_sub_if_data,
                                              u.ap);
 
-                        drv_sta_notify(local, &sdata->vif, STA_NOTIFY_ADD,
+                        drv_sta_notify(local, sdata, STA_NOTIFY_ADD,
                                        &sta->sta);
                 }
                 spin_unlock_irqrestore(&local->sta_lock, flags);
@@ -1119,7 +1154,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         /* Finally also reconfigure all the BSS information */
         list_for_each_entry(sdata, &local->interfaces, list) {
                 u32 changed = ~0;
-                if (!netif_running(sdata->dev))
+                if (!ieee80211_sdata_running(sdata))
                         continue;
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
@@ -1147,7 +1182,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
 
         /* add back keys */
         list_for_each_entry(sdata, &local->interfaces, list)
-                if (netif_running(sdata->dev))
+                if (ieee80211_sdata_running(sdata))
                         ieee80211_enable_keys(sdata);
 
         ieee80211_wake_queues_by_reason(hw,
@@ -1194,3 +1229,133 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         return 0;
 }
 
+static int check_mgd_smps(struct ieee80211_if_managed *ifmgd,
+                          enum ieee80211_smps_mode *smps_mode)
+{
+        if (ifmgd->associated) {
+                *smps_mode = ifmgd->ap_smps;
+
+                if (*smps_mode == IEEE80211_SMPS_AUTOMATIC) {
+                        if (ifmgd->powersave)
+                                *smps_mode = IEEE80211_SMPS_DYNAMIC;
+                        else
+                                *smps_mode = IEEE80211_SMPS_OFF;
+                }
+
+                return 1;
+        }
+
+        return 0;
+}
+
+/* must hold iflist_mtx */
+void ieee80211_recalc_smps(struct ieee80211_local *local,
+                           struct ieee80211_sub_if_data *forsdata)
+{
+        struct ieee80211_sub_if_data *sdata;
+        enum ieee80211_smps_mode smps_mode = IEEE80211_SMPS_OFF;
+        int count = 0;
+
+        if (forsdata)
+                WARN_ON(!mutex_is_locked(&forsdata->u.mgd.mtx));
+
+        WARN_ON(!mutex_is_locked(&local->iflist_mtx));
+
+        /*
+         * This function could be improved to handle multiple
+         * interfaces better, but right now it makes any
+         * non-station interfaces force SM PS to be turned
+         * off. If there are multiple station interfaces it
+         * could also use the best possible mode, e.g. if
+         * one is in static and the other in dynamic then
+         * dynamic is ok.
+         */
+
+        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (!netif_running(sdata->dev))
+                        continue;
+                if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                        goto set;
+                if (sdata != forsdata) {
+                        /*
+                         * This nested is ok -- we are holding the iflist_mtx
+                         * so can't get here twice or so. But it's required
+                         * since normally we acquire it first and then the
+                         * iflist_mtx.
+                         */
+                        mutex_lock_nested(&sdata->u.mgd.mtx, SINGLE_DEPTH_NESTING);
+                        count += check_mgd_smps(&sdata->u.mgd, &smps_mode);
+                        mutex_unlock(&sdata->u.mgd.mtx);
+                } else
+                        count += check_mgd_smps(&sdata->u.mgd, &smps_mode);
+
+                if (count > 1) {
+                        smps_mode = IEEE80211_SMPS_OFF;
+                        break;
+                }
+        }
+
+        if (smps_mode == local->smps_mode)
+                return;
+
+ set:
+        local->smps_mode = smps_mode;
+        /* changed flag is auto-detected for this */
+        ieee80211_hw_config(local, 0);
+}
+
+static bool ieee80211_id_in_list(const u8 *ids, int n_ids, u8 id)
+{
+        int i;
+
+        for (i = 0; i < n_ids; i++)
+                if (ids[i] == id)
+                        return true;
+        return false;
+}
+
+/**
+ * ieee80211_ie_split - split an IE buffer according to ordering
+ *
+ * @ies: the IE buffer
+ * @ielen: the length of the IE buffer
+ * @ids: an array with element IDs that are allowed before
+ *      the split
+ * @n_ids: the size of the element ID array
+ * @offset: offset where to start splitting in the buffer
+ *
+ * This function splits an IE buffer by updating the @offset
+ * variable to point to the location where the buffer should be
+ * split.
+ *
+ * It assumes that the given IE buffer is well-formed, this
+ * has to be guaranteed by the caller!
+ *
+ * It also assumes that the IEs in the buffer are ordered
+ * correctly, if not the result of using this function will not
+ * be ordered correctly either, i.e. it does no reordering.
+ *
+ * The function returns the offset where the next part of the
+ * buffer starts, which may be @ielen if the entire (remainder)
+ * of the buffer should be used.
+ */
+size_t ieee80211_ie_split(const u8 *ies, size_t ielen,
+                          const u8 *ids, int n_ids, size_t offset)
+{
+        size_t pos = offset;
+
+        while (pos < ielen && ieee80211_id_in_list(ids, n_ids, ies[pos]))
+                pos += 2 + ies[pos + 1];
+
+        return pos;
+}
+
+size_t ieee80211_ie_split_vendor(const u8 *ies, size_t ielen, size_t offset)
+{
+        size_t pos = offset;
+
+        while (pos < ielen && ies[pos] != WLAN_EID_VENDOR_SPECIFIC)
+                pos += 2 + ies[pos + 1];
+
+        return pos;
+}
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index 79d887dae738..34e6d02da779 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -96,7 +96,7 @@ u16 ieee80211_select_queue(struct ieee80211_sub_if_data *sdata,
         }
 
         if (!sta && ra && !is_multicast_ether_addr(ra)) {
-                sta = sta_info_get(local, ra);
+                sta = sta_info_get(sdata, ra);
                 if (sta)
                         sta_flags = get_sta_flags(sta);
         }
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
new file mode 100644
index 000000000000..81bd5d592bb4
--- /dev/null
+++ b/net/mac80211/work.c
@@ -0,0 +1,1098 @@
+/*
+ * mac80211 work implementation
+ *
+ * Copyright 2003-2008, Jouni Malinen <j@w1.fi>
+ * Copyright 2004, Instant802 Networks, Inc.
+ * Copyright 2005, Devicescape Software, Inc.
+ * Copyright 2006-2007  Jiri Benc <jbenc@suse.cz>
+ * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/delay.h>
+#include <linux/if_ether.h>
+#include <linux/skbuff.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/crc32.h>
+#include <net/mac80211.h>
+#include <asm/unaligned.h>
+
+#include "ieee80211_i.h"
+#include "rate.h"
+
+#define IEEE80211_AUTH_TIMEOUT (HZ / 5)
+#define IEEE80211_AUTH_MAX_TRIES 3
+#define IEEE80211_ASSOC_TIMEOUT (HZ / 5)
+#define IEEE80211_ASSOC_MAX_TRIES 3
+#define IEEE80211_MAX_PROBE_TRIES 5
+
+enum work_action {
+        WORK_ACT_NONE,
+        WORK_ACT_TIMEOUT,
+        WORK_ACT_DONE,
+};
+
+
+/* utils */
+static inline void ASSERT_WORK_MTX(struct ieee80211_local *local)
+{
+        WARN_ON(!mutex_is_locked(&local->work_mtx));
+}
+
+/*
+ * We can have multiple work items (and connection probing)
+ * scheduling this timer, but we need to take care to only
+ * reschedule it when it should fire _earlier_ than it was
+ * asked for before, or if it's not pending right now. This
+ * function ensures that. Note that it then is required to
+ * run this function for all timeouts after the first one
+ * has happened -- the work that runs from this timer will
+ * do that.
+ */
+static void run_again(struct ieee80211_local *local,
+                      unsigned long timeout)
+{
+        ASSERT_WORK_MTX(local);
+
+        if (!timer_pending(&local->work_timer) ||
+            time_before(timeout, local->work_timer.expires))
+                mod_timer(&local->work_timer, timeout);
+}
+
+static void work_free_rcu(struct rcu_head *head)
+{
+        struct ieee80211_work *wk =
+                container_of(head, struct ieee80211_work, rcu_head);
+
+        kfree(wk);
+}
+
+void free_work(struct ieee80211_work *wk)
+{
+        call_rcu(&wk->rcu_head, work_free_rcu);
+}
+
+static int ieee80211_compatible_rates(const u8 *supp_rates, int supp_rates_len,
+                                      struct ieee80211_supported_band *sband,
+                                      u32 *rates)
+{
+        int i, j, count;
+        *rates = 0;
+        count = 0;
+        for (i = 0; i < supp_rates_len; i++) {
+                int rate = (supp_rates[i] & 0x7F) * 5;
+
+                for (j = 0; j < sband->n_bitrates; j++)
+                        if (sband->bitrates[j].bitrate == rate) {
+                                *rates |= BIT(j);
+                                count++;
+                                break;
+                        }
+        }
+
+        return count;
+}
+
+/* frame sending functions */
+
+static void ieee80211_add_ht_ie(struct sk_buff *skb, const u8 *ht_info_ie,
+                                struct ieee80211_supported_band *sband,
+                                struct ieee80211_channel *channel,
+                                enum ieee80211_smps_mode smps)
+{
+        struct ieee80211_ht_info *ht_info;
+        u8 *pos;
+        u32 flags = channel->flags;
+        u16 cap = sband->ht_cap.cap;
+        __le16 tmp;
+
+        if (!sband->ht_cap.ht_supported)
+                return;
+
+        if (!ht_info_ie)
+                return;
+
+        if (ht_info_ie[1] < sizeof(struct ieee80211_ht_info))
+                return;
+
+        ht_info = (struct ieee80211_ht_info *)(ht_info_ie + 2);
+
+        /* determine capability flags */
+
+        if (ieee80211_disable_40mhz_24ghz &&
+            sband->band == IEEE80211_BAND_2GHZ) {
+                cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                cap &= ~IEEE80211_HT_CAP_SGI_40;
+        }
+
+        switch (ht_info->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) {
+        case IEEE80211_HT_PARAM_CHA_SEC_ABOVE:
+                if (flags & IEEE80211_CHAN_NO_HT40PLUS) {
+                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        cap &= ~IEEE80211_HT_CAP_SGI_40;
+                }
+                break;
+        case IEEE80211_HT_PARAM_CHA_SEC_BELOW:
+                if (flags & IEEE80211_CHAN_NO_HT40MINUS) {
+                        cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+                        cap &= ~IEEE80211_HT_CAP_SGI_40;
+                }
+                break;
+        }
+
+        /* set SM PS mode properly */
+        cap &= ~IEEE80211_HT_CAP_SM_PS;
+        switch (smps) {
+        case IEEE80211_SMPS_AUTOMATIC:
+        case IEEE80211_SMPS_NUM_MODES:
+                WARN_ON(1);
+        case IEEE80211_SMPS_OFF:
+                cap |= WLAN_HT_CAP_SM_PS_DISABLED <<
+                        IEEE80211_HT_CAP_SM_PS_SHIFT;
+                break;
+        case IEEE80211_SMPS_STATIC:
+                cap |= WLAN_HT_CAP_SM_PS_STATIC <<
+                        IEEE80211_HT_CAP_SM_PS_SHIFT;
+                break;
+        case IEEE80211_SMPS_DYNAMIC:
+                cap |= WLAN_HT_CAP_SM_PS_DYNAMIC <<
+                        IEEE80211_HT_CAP_SM_PS_SHIFT;
+                break;
+        }
+
+        /* reserve and fill IE */
+
+        pos = skb_put(skb, sizeof(struct ieee80211_ht_cap) + 2);
+        *pos++ = WLAN_EID_HT_CAPABILITY;
+        *pos++ = sizeof(struct ieee80211_ht_cap);
+        memset(pos, 0, sizeof(struct ieee80211_ht_cap));
+
+        /* capability flags */
+        tmp = cpu_to_le16(cap);
+        memcpy(pos, &tmp, sizeof(u16));
+        pos += sizeof(u16);
+
+        /* AMPDU parameters */
+        *pos++ = sband->ht_cap.ampdu_factor |
+                 (sband->ht_cap.ampdu_density <<
+                        IEEE80211_HT_AMPDU_PARM_DENSITY_SHIFT);
+
+        /* MCS set */
+        memcpy(pos, &sband->ht_cap.mcs, sizeof(sband->ht_cap.mcs));
+        pos += sizeof(sband->ht_cap.mcs);
+
+        /* extended capabilities */
+        pos += sizeof(__le16);
+
+        /* BF capabilities */
+        pos += sizeof(__le32);
+
+        /* antenna selection */
+        pos += sizeof(u8);
+}
+
+static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
+                                 struct ieee80211_work *wk)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct sk_buff *skb;
+        struct ieee80211_mgmt *mgmt;
+        u8 *pos, qos_info;
+        const u8 *ies;
+        size_t offset = 0, noffset;
+        int i, len, count, rates_len, supp_rates_len;
+        u16 capab;
+        struct ieee80211_supported_band *sband;
+        u32 rates = 0;
+
+        sband = local->hw.wiphy->bands[wk->chan->band];
+
+        /*
+         * Get all rates supported by the device and the AP as
+         * some APs don't like getting a superset of their rates
+         * in the association request (e.g. D-Link DAP 1353 in
+         * b-only mode)...
+         */
+        rates_len = ieee80211_compatible_rates(wk->assoc.supp_rates,
+                                               wk->assoc.supp_rates_len,
+                                               sband, &rates);
+
+        skb = alloc_skb(local->hw.extra_tx_headroom +
+                        sizeof(*mgmt) + /* bit too much but doesn't matter */
+                        2 + wk->assoc.ssid_len + /* SSID */
+                        4 + rates_len + /* (extended) rates */
+                        4 + /* power capability */
+                        2 + 2 * sband->n_channels + /* supported channels */
+                        2 + sizeof(struct ieee80211_ht_cap) + /* HT */
+                        wk->ie_len + /* extra IEs */
+                        9, /* WMM */
+                        GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_DEBUG "%s: failed to allocate buffer for assoc "
+                       "frame\n", sdata->name);
+                return;
+        }
+        skb_reserve(skb, local->hw.extra_tx_headroom);
+
+        capab = WLAN_CAPABILITY_ESS;
+
+        if (sband->band == IEEE80211_BAND_2GHZ) {
+                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_SLOT_INCAPABLE))
+                        capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
+                if (!(local->hw.flags & IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE))
+                        capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+        }
+
+        if (wk->assoc.capability & WLAN_CAPABILITY_PRIVACY)
+                capab |= WLAN_CAPABILITY_PRIVACY;
+
+        if ((wk->assoc.capability & WLAN_CAPABILITY_SPECTRUM_MGMT) &&
+            (local->hw.flags & IEEE80211_HW_SPECTRUM_MGMT))
+                capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
+
+        mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
+        memset(mgmt, 0, 24);
+        memcpy(mgmt->da, wk->filter_ta, ETH_ALEN);
+        memcpy(mgmt->sa, sdata->vif.addr, ETH_ALEN);
+        memcpy(mgmt->bssid, wk->filter_ta, ETH_ALEN);
+
+        if (!is_zero_ether_addr(wk->assoc.prev_bssid)) {
+                skb_put(skb, 10);
+                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_REASSOC_REQ);
+                mgmt->u.reassoc_req.capab_info = cpu_to_le16(capab);
+                mgmt->u.reassoc_req.listen_interval =
+                                cpu_to_le16(local->hw.conf.listen_interval);
+                memcpy(mgmt->u.reassoc_req.current_ap, wk->assoc.prev_bssid,
+                       ETH_ALEN);
+        } else {
+                skb_put(skb, 4);
+                mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                                  IEEE80211_STYPE_ASSOC_REQ);
+                mgmt->u.assoc_req.capab_info = cpu_to_le16(capab);
+                mgmt->u.assoc_req.listen_interval =
+                                cpu_to_le16(local->hw.conf.listen_interval);
+        }
+
+        /* SSID */
+        ies = pos = skb_put(skb, 2 + wk->assoc.ssid_len);
+        *pos++ = WLAN_EID_SSID;
+        *pos++ = wk->assoc.ssid_len;
+        memcpy(pos, wk->assoc.ssid, wk->assoc.ssid_len);
+
+        /* add all rates which were marked to be used above */
+        supp_rates_len = rates_len;
+        if (supp_rates_len > 8)
+                supp_rates_len = 8;
+
+        len = sband->n_bitrates;
+        pos = skb_put(skb, supp_rates_len + 2);
+        *pos++ = WLAN_EID_SUPP_RATES;
+        *pos++ = supp_rates_len;
+
+        count = 0;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                if (BIT(i) & rates) {
+                        int rate = sband->bitrates[i].bitrate;
+                        *pos++ = (u8) (rate / 5);
+                        if (++count == 8)
+                                break;
+                }
+        }
+
+        if (rates_len > count) {
+                pos = skb_put(skb, rates_len - count + 2);
+                *pos++ = WLAN_EID_EXT_SUPP_RATES;
+                *pos++ = rates_len - count;
+
+                for (i++; i < sband->n_bitrates; i++) {
+                        if (BIT(i) & rates) {
+                                int rate = sband->bitrates[i].bitrate;
+                                *pos++ = (u8) (rate / 5);
+                        }
+                }
+        }
+
+        if (capab & WLAN_CAPABILITY_SPECTRUM_MGMT) {
+                /* 1. power capabilities */
+                pos = skb_put(skb, 4);
+                *pos++ = WLAN_EID_PWR_CAPABILITY;
+                *pos++ = 2;
+                *pos++ = 0; /* min tx power */
+                *pos++ = wk->chan->max_power; /* max tx power */
+
+                /* 2. supported channels */
+                /* TODO: get this in reg domain format */
+                pos = skb_put(skb, 2 * sband->n_channels + 2);
+                *pos++ = WLAN_EID_SUPPORTED_CHANNELS;
+                *pos++ = 2 * sband->n_channels;
+                for (i = 0; i < sband->n_channels; i++) {
+                        *pos++ = ieee80211_frequency_to_channel(
+                                        sband->channels[i].center_freq);
+                        *pos++ = 1; /* one channel in the subband*/
+                }
+        }
+
+        /* if present, add any custom IEs that go before HT */
+        if (wk->ie_len && wk->ie) {
+                static const u8 before_ht[] = {
+                        WLAN_EID_SSID,
+                        WLAN_EID_SUPP_RATES,
+                        WLAN_EID_EXT_SUPP_RATES,
+                        WLAN_EID_PWR_CAPABILITY,
+                        WLAN_EID_SUPPORTED_CHANNELS,
+                        WLAN_EID_RSN,
+                        WLAN_EID_QOS_CAPA,
+                        WLAN_EID_RRM_ENABLED_CAPABILITIES,
+                        WLAN_EID_MOBILITY_DOMAIN,
+                        WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
+                };
+                noffset = ieee80211_ie_split(wk->ie, wk->ie_len,
+                                             before_ht, ARRAY_SIZE(before_ht),
+                                             offset);
+                pos = skb_put(skb, noffset - offset);
+                memcpy(pos, wk->ie + offset, noffset - offset);
+                offset = noffset;
+        }
+
+        if (wk->assoc.use_11n && wk->assoc.wmm_used &&
+            local->hw.queues >= 4)
+                ieee80211_add_ht_ie(skb, wk->assoc.ht_information_ie,
+                                    sband, wk->chan, wk->assoc.smps);
+
+        /* if present, add any custom non-vendor IEs that go after HT */
+        if (wk->ie_len && wk->ie) {
+                noffset = ieee80211_ie_split_vendor(wk->ie, wk->ie_len,
+                                                    offset);
+                pos = skb_put(skb, noffset - offset);
+                memcpy(pos, wk->ie + offset, noffset - offset);
+                offset = noffset;
+        }
+
+        if (wk->assoc.wmm_used && local->hw.queues >= 4) {
+                if (wk->assoc.uapsd_used) {
+                        qos_info = local->uapsd_queues;
+                        qos_info |= (local->uapsd_max_sp_len <<
+                                     IEEE80211_WMM_IE_STA_QOSINFO_SP_SHIFT);
+                } else {
+                        qos_info = 0;
+                }
+
+                pos = skb_put(skb, 9);
+                *pos++ = WLAN_EID_VENDOR_SPECIFIC;
+                *pos++ = 7; /* len */
+                *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
+                *pos++ = 0x50;
+                *pos++ = 0xf2;
+                *pos++ = 2; /* WME */
+                *pos++ = 0; /* WME info */
+                *pos++ = 1; /* WME ver */
+                *pos++ = qos_info;
+        }
+
+        /* add any remaining custom (i.e. vendor specific here) IEs */
+        if (wk->ie_len && wk->ie) {
+                noffset = wk->ie_len;
+                pos = skb_put(skb, noffset - offset);
+                memcpy(pos, wk->ie + offset, noffset - offset);
+        }
+
+        IEEE80211_SKB_CB(skb)->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
+        ieee80211_tx_skb(sdata, skb);
+}
+
+static void ieee80211_remove_auth_bss(struct ieee80211_local *local,
+                                      struct ieee80211_work *wk)
+{
+        struct cfg80211_bss *cbss;
+        u16 capa_val = WLAN_CAPABILITY_ESS;
+
+        if (wk->probe_auth.privacy)
+                capa_val |= WLAN_CAPABILITY_PRIVACY;
+
+        cbss = cfg80211_get_bss(local->hw.wiphy, wk->chan, wk->filter_ta,
+                                wk->probe_auth.ssid, wk->probe_auth.ssid_len,
+                                WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_PRIVACY,
+                                capa_val);
+        if (!cbss)
+                return;
+
+        cfg80211_unlink_bss(local->hw.wiphy, cbss);
+        cfg80211_put_bss(cbss);
+}
+
+static enum work_action __must_check
+ieee80211_direct_probe(struct ieee80211_work *wk)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+
+        wk->probe_auth.tries++;
+        if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: direct probe to %pM timed out\n",
+                       sdata->name, wk->filter_ta);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                ieee80211_remove_auth_bss(local, wk);
+
+                return WORK_ACT_TIMEOUT;
+        }
+
+        printk(KERN_DEBUG "%s: direct probe to %pM (try %d)\n",
+                        sdata->name, wk->filter_ta, wk->probe_auth.tries);
+
+        /*
+         * Direct probe is sent to broadcast address as some APs
+         * will not answer to direct packet in unassociated state.
+         */
+        ieee80211_send_probe_req(sdata, NULL, wk->probe_auth.ssid,
+                                 wk->probe_auth.ssid_len, NULL, 0);
+
+        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+        run_again(local, wk->timeout);
+
+        return WORK_ACT_NONE;
+}
+
+
+static enum work_action __must_check
+ieee80211_authenticate(struct ieee80211_work *wk)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+
+        wk->probe_auth.tries++;
+        if (wk->probe_auth.tries > IEEE80211_AUTH_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: authentication with %pM"
+                       " timed out\n", sdata->name, wk->filter_ta);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                ieee80211_remove_auth_bss(local, wk);
+
+                return WORK_ACT_TIMEOUT;
+        }
+
+        printk(KERN_DEBUG "%s: authenticate with %pM (try %d)\n",
+               sdata->name, wk->filter_ta, wk->probe_auth.tries);
+
+        ieee80211_send_auth(sdata, 1, wk->probe_auth.algorithm, wk->ie,
+                            wk->ie_len, wk->filter_ta, NULL, 0, 0);
+        wk->probe_auth.transaction = 2;
+
+        wk->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
+        run_again(local, wk->timeout);
+
+        return WORK_ACT_NONE;
+}
+
+static enum work_action __must_check
+ieee80211_associate(struct ieee80211_work *wk)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+
+        wk->assoc.tries++;
+        if (wk->assoc.tries > IEEE80211_ASSOC_MAX_TRIES) {
+                printk(KERN_DEBUG "%s: association with %pM"
+                       " timed out\n",
+                       sdata->name, wk->filter_ta);
+
+                /*
+                 * Most likely AP is not in the range so remove the
+                 * bss struct for that AP.
+                 */
+                if (wk->assoc.bss)
+                        cfg80211_unlink_bss(local->hw.wiphy, wk->assoc.bss);
+
+                return WORK_ACT_TIMEOUT;
+        }
+
+        printk(KERN_DEBUG "%s: associate with %pM (try %d)\n",
+               sdata->name, wk->filter_ta, wk->assoc.tries);
+        ieee80211_send_assoc(sdata, wk);
+
+        wk->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
+        run_again(local, wk->timeout);
+
+        return WORK_ACT_NONE;
+}
+
+static enum work_action __must_check
+ieee80211_remain_on_channel_timeout(struct ieee80211_work *wk)
+{
+        /*
+         * First time we run, do nothing -- the generic code will
+         * have switched to the right channel etc.
+         */
+        if (!wk->remain.started) {
+                wk->remain.started = true;
+                wk->timeout = jiffies + msecs_to_jiffies(wk->remain.duration);
+
+                cfg80211_ready_on_channel(wk->sdata->dev, (unsigned long) wk,
+                                          wk->chan, wk->chan_type,
+                                          wk->remain.duration, GFP_KERNEL);
+
+                return WORK_ACT_NONE;
+        }
+
+        return WORK_ACT_TIMEOUT;
+}
+
+static void ieee80211_auth_challenge(struct ieee80211_work *wk,
+                                     struct ieee80211_mgmt *mgmt,
+                                     size_t len)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        u8 *pos;
+        struct ieee802_11_elems elems;
+
+        pos = mgmt->u.auth.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+        if (!elems.challenge)
+                return;
+        ieee80211_send_auth(sdata, 3, wk->probe_auth.algorithm,
+                            elems.challenge - 2, elems.challenge_len + 2,
+                            wk->filter_ta, wk->probe_auth.key,
+                            wk->probe_auth.key_len, wk->probe_auth.key_idx);
+        wk->probe_auth.transaction = 4;
+}
+
+static enum work_action __must_check
+ieee80211_rx_mgmt_auth(struct ieee80211_work *wk,
+                       struct ieee80211_mgmt *mgmt, size_t len)
+{
+        u16 auth_alg, auth_transaction, status_code;
+
+        if (wk->type != IEEE80211_WORK_AUTH)
+                return WORK_ACT_NONE;
+
+        if (len < 24 + 6)
+                return WORK_ACT_NONE;
+
+        auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
+        auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
+        status_code = le16_to_cpu(mgmt->u.auth.status_code);
+
+        if (auth_alg != wk->probe_auth.algorithm ||
+            auth_transaction != wk->probe_auth.transaction)
+                return WORK_ACT_NONE;
+
+        if (status_code != WLAN_STATUS_SUCCESS) {
+                printk(KERN_DEBUG "%s: %pM denied authentication (status %d)\n",
+                       wk->sdata->name, mgmt->sa, status_code);
+                return WORK_ACT_DONE;
+        }
+
+        switch (wk->probe_auth.algorithm) {
+        case WLAN_AUTH_OPEN:
+        case WLAN_AUTH_LEAP:
+        case WLAN_AUTH_FT:
+                break;
+        case WLAN_AUTH_SHARED_KEY:
+                if (wk->probe_auth.transaction != 4) {
+                        ieee80211_auth_challenge(wk, mgmt, len);
+                        /* need another frame */
+                        return WORK_ACT_NONE;
+                }
+                break;
+        default:
+                WARN_ON(1);
+                return WORK_ACT_NONE;
+        }
+
+        printk(KERN_DEBUG "%s: authenticated\n", wk->sdata->name);
+        return WORK_ACT_DONE;
+}
+
+static enum work_action __must_check
+ieee80211_rx_mgmt_assoc_resp(struct ieee80211_work *wk,
+                             struct ieee80211_mgmt *mgmt, size_t len,
+                             bool reassoc)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+        u16 capab_info, status_code, aid;
+        struct ieee802_11_elems elems;
+        u8 *pos;
+
+        /*
+         * AssocResp and ReassocResp have identical structure, so process both
+         * of them in this function.
+         */
+
+        if (len < 24 + 6)
+                return WORK_ACT_NONE;
+
+        capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
+        status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
+        aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
+
+        printk(KERN_DEBUG "%s: RX %sssocResp from %pM (capab=0x%x "
+               "status=%d aid=%d)\n",
+               sdata->name, reassoc ? "Rea" : "A", mgmt->sa,
+               capab_info, status_code, (u16)(aid & ~(BIT(15) | BIT(14))));
+
+        pos = mgmt->u.assoc_resp.variable;
+        ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems);
+
+        if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
+            elems.timeout_int && elems.timeout_int_len == 5 &&
+            elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
+                u32 tu, ms;
+                tu = get_unaligned_le32(elems.timeout_int + 1);
+                ms = tu * 1024 / 1000;
+                printk(KERN_DEBUG "%s: %pM rejected association temporarily; "
+                       "comeback duration %u TU (%u ms)\n",
+                       sdata->name, mgmt->sa, tu, ms);
+                wk->timeout = jiffies + msecs_to_jiffies(ms);
+                if (ms > IEEE80211_ASSOC_TIMEOUT)
+                        run_again(local, wk->timeout);
+                return WORK_ACT_NONE;
+        }
+
+        if (status_code != WLAN_STATUS_SUCCESS)
+                printk(KERN_DEBUG "%s: %pM denied association (code=%d)\n",
+                       sdata->name, mgmt->sa, status_code);
+        else
+                printk(KERN_DEBUG "%s: associated\n", sdata->name);
+
+        return WORK_ACT_DONE;
+}
+
+static enum work_action __must_check
+ieee80211_rx_mgmt_probe_resp(struct ieee80211_work *wk,
+                             struct ieee80211_mgmt *mgmt, size_t len,
+                             struct ieee80211_rx_status *rx_status)
+{
+        struct ieee80211_sub_if_data *sdata = wk->sdata;
+        struct ieee80211_local *local = sdata->local;
+        size_t baselen;
+
+        ASSERT_WORK_MTX(local);
+
+        baselen = (u8 *) mgmt->u.probe_resp.variable - (u8 *) mgmt;
+        if (baselen > len)
+                return WORK_ACT_NONE;
+
+        printk(KERN_DEBUG "%s: direct probe responded\n", sdata->name);
+        return WORK_ACT_DONE;
+}
+
+static void ieee80211_work_rx_queued_mgmt(struct ieee80211_local *local,
+                                          struct sk_buff *skb)
+{
+        struct ieee80211_rx_status *rx_status;
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_work *wk;
+        enum work_action rma = WORK_ACT_NONE;
+        u16 fc;
+
+        rx_status = (struct ieee80211_rx_status *) skb->cb;
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        fc = le16_to_cpu(mgmt->frame_control);
+
+        mutex_lock(&local->work_mtx);
+
+        list_for_each_entry(wk, &local->work_list, list) {
+                const u8 *bssid = NULL;
+
+                switch (wk->type) {
+                case IEEE80211_WORK_DIRECT_PROBE:
+                case IEEE80211_WORK_AUTH:
+                case IEEE80211_WORK_ASSOC:
+                        bssid = wk->filter_ta;
+                        break;
+                default:
+                        continue;
+                }
+
+                /*
+                 * Before queuing, we already verified mgmt->sa,
+                 * so this is needed just for matching.
+                 */
+                if (compare_ether_addr(bssid, mgmt->bssid))
+                        continue;
+
+                switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_PROBE_RESP:
+                        rma = ieee80211_rx_mgmt_probe_resp(wk, mgmt, skb->len,
+                                                           rx_status);
+                        break;
+                case IEEE80211_STYPE_AUTH:
+                        rma = ieee80211_rx_mgmt_auth(wk, mgmt, skb->len);
+                        break;
+                case IEEE80211_STYPE_ASSOC_RESP:
+                        rma = ieee80211_rx_mgmt_assoc_resp(wk, mgmt,
+                                                           skb->len, false);
+                        break;
+                case IEEE80211_STYPE_REASSOC_RESP:
+                        rma = ieee80211_rx_mgmt_assoc_resp(wk, mgmt,
+                                                           skb->len, true);
+                        break;
+                default:
+                        WARN_ON(1);
+                }
+                /*
+                 * We've processed this frame for that work, so it can't
+                 * belong to another work struct.
+                 * NB: this is also required for correctness for 'rma'!
+                 */
+                break;
+        }
+
+        switch (rma) {
+        case WORK_ACT_NONE:
+                break;
+        case WORK_ACT_DONE:
+                list_del_rcu(&wk->list);
+                break;
+        default:
+                WARN(1, "unexpected: %d", rma);
+        }
+
+        mutex_unlock(&local->work_mtx);
+
+        if (rma != WORK_ACT_DONE)
+                goto out;
+
+        switch (wk->done(wk, skb)) {
+        case WORK_DONE_DESTROY:
+                free_work(wk);
+                break;
+        case WORK_DONE_REQUEUE:
+                synchronize_rcu();
+                wk->started = false; /* restart */
+                mutex_lock(&local->work_mtx);
+                list_add_tail(&wk->list, &local->work_list);
+                mutex_unlock(&local->work_mtx);
+        }
+
+ out:
+        kfree_skb(skb);
+}
+
+static void ieee80211_work_timer(unsigned long data)
+{
+        struct ieee80211_local *local = (void *) data;
+
+        if (local->quiescing)
+                return;
+
+        ieee80211_queue_work(&local->hw, &local->work_work);
+}
+
+static void ieee80211_work_work(struct work_struct *work)
+{
+        struct ieee80211_local *local =
+                container_of(work, struct ieee80211_local, work_work);
+        struct sk_buff *skb;
+        struct ieee80211_work *wk, *tmp;
+        LIST_HEAD(free_work);
+        enum work_action rma;
+        bool remain_off_channel = false;
+
+        if (local->scanning)
+                return;
+
+        /*
+         * ieee80211_queue_work() should have picked up most cases,
+         * here we'll pick the the rest.
+         */
+        if (WARN(local->suspended, "work scheduled while going to suspend\n"))
+                return;
+
+        /* first process frames to avoid timing out while a frame is pending */
+        while ((skb = skb_dequeue(&local->work_skb_queue)))
+                ieee80211_work_rx_queued_mgmt(local, skb);
+
+        ieee80211_recalc_idle(local);
+
+        mutex_lock(&local->work_mtx);
+
+        list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
+                /* mark work as started if it's on the current off-channel */
+                if (!wk->started && local->tmp_channel &&
+                    wk->chan == local->tmp_channel &&
+                    wk->chan_type == local->tmp_channel_type) {
+                        wk->started = true;
+                        wk->timeout = jiffies;
+                }
+
+                if (!wk->started && !local->tmp_channel) {
+                        /*
+                         * TODO: could optimize this by leaving the
+                         *       station vifs in awake mode if they
+                         *       happen to be on the same channel as
+                         *       the requested channel
+                         */
+                        ieee80211_offchannel_stop_beaconing(local);
+                        ieee80211_offchannel_stop_station(local);
+
+                        local->tmp_channel = wk->chan;
+                        local->tmp_channel_type = wk->chan_type;
+                        ieee80211_hw_config(local, 0);
+                        wk->started = true;
+                        wk->timeout = jiffies;
+                }
+
+                /* don't try to work with items that aren't started */
+                if (!wk->started)
+                        continue;
+
+                if (time_is_after_jiffies(wk->timeout)) {
+                        /*
+                         * This work item isn't supposed to be worked on
+                         * right now, but take care to adjust the timer
+                         * properly.
+                         */
+                        run_again(local, wk->timeout);
+                        continue;
+                }
+
+                switch (wk->type) {
+                default:
+                        WARN_ON(1);
+                        /* nothing */
+                        rma = WORK_ACT_NONE;
+                        break;
+                case IEEE80211_WORK_ABORT:
+                        rma = WORK_ACT_TIMEOUT;
+                case IEEE80211_WORK_DIRECT_PROBE:
+                        rma = ieee80211_direct_probe(wk);
+                        break;
+                case IEEE80211_WORK_AUTH:
+                        rma = ieee80211_authenticate(wk);
+                        break;
+                case IEEE80211_WORK_ASSOC:
+                        rma = ieee80211_associate(wk);
+                        break;
+                case IEEE80211_WORK_REMAIN_ON_CHANNEL:
+                        rma = ieee80211_remain_on_channel_timeout(wk);
+                        break;
+                }
+
+                switch (rma) {
+                case WORK_ACT_NONE:
+                        /* might have changed the timeout */
+                        run_again(local, wk->timeout);
+                        break;
+                case WORK_ACT_TIMEOUT:
+                        list_del_rcu(&wk->list);
+                        synchronize_rcu();
+                        list_add(&wk->list, &free_work);
+                        break;
+                default:
+                        WARN(1, "unexpected: %d", rma);
+                }
+        }
+
+        list_for_each_entry(wk, &local->work_list, list) {
+                if (!wk->started)
+                        continue;
+                if (wk->chan != local->tmp_channel)
+                        continue;
+                if (wk->chan_type != local->tmp_channel_type)
+                        continue;
+                remain_off_channel = true;
+        }
+
+        if (!remain_off_channel && local->tmp_channel) {
+                local->tmp_channel = NULL;
+                ieee80211_hw_config(local, 0);
+                ieee80211_offchannel_return(local, true);
+                /* give connection some time to breathe */
+                run_again(local, jiffies + HZ/2);
+        }
+
+        if (list_empty(&local->work_list) && local->scan_req)
+                ieee80211_queue_delayed_work(&local->hw,
+                                             &local->scan_work,
+                                             round_jiffies_relative(0));
+
+        mutex_unlock(&local->work_mtx);
+
+        ieee80211_recalc_idle(local);
+
+        list_for_each_entry_safe(wk, tmp, &free_work, list) {
+                wk->done(wk, NULL);
+                list_del(&wk->list);
+                kfree(wk);
+        }
+}
+
+void ieee80211_add_work(struct ieee80211_work *wk)
+{
+        struct ieee80211_local *local;
+
+        if (WARN_ON(!wk->chan))
+                return;
+
+        if (WARN_ON(!wk->sdata))
+                return;
+
+        if (WARN_ON(!wk->done))
+                return;
+
+        if (WARN_ON(!ieee80211_sdata_running(wk->sdata)))
+                return;
+
+        wk->started = false;
+
+        local = wk->sdata->local;
+        mutex_lock(&local->work_mtx);
+        list_add_tail(&wk->list, &local->work_list);
+        mutex_unlock(&local->work_mtx);
+
+        ieee80211_queue_work(&local->hw, &local->work_work);
+}
+
+void ieee80211_work_init(struct ieee80211_local *local)
+{
+        mutex_init(&local->work_mtx);
+        INIT_LIST_HEAD(&local->work_list);
+        setup_timer(&local->work_timer, ieee80211_work_timer,
+                    (unsigned long)local);
+        INIT_WORK(&local->work_work, ieee80211_work_work);
+        skb_queue_head_init(&local->work_skb_queue);
+}
+
+void ieee80211_work_purge(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_work *wk;
+
+        mutex_lock(&local->work_mtx);
+        list_for_each_entry(wk, &local->work_list, list) {
+                if (wk->sdata != sdata)
+                        continue;
+                wk->type = IEEE80211_WORK_ABORT;
+                wk->started = true;
+                wk->timeout = jiffies;
+        }
+        mutex_unlock(&local->work_mtx);
+
+        /* run cleanups etc. */
+        ieee80211_work_work(&local->work_work);
+
+        mutex_lock(&local->work_mtx);
+        list_for_each_entry(wk, &local->work_list, list) {
+                if (wk->sdata != sdata)
+                        continue;
+                WARN_ON(1);
+                break;
+        }
+        mutex_unlock(&local->work_mtx);
+}
+
+ieee80211_rx_result ieee80211_work_rx_mgmt(struct ieee80211_sub_if_data *sdata,
+                                           struct sk_buff *skb)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_mgmt *mgmt;
+        struct ieee80211_work *wk;
+        u16 fc;
+
+        if (skb->len < 24)
+                return RX_DROP_MONITOR;
+
+        mgmt = (struct ieee80211_mgmt *) skb->data;
+        fc = le16_to_cpu(mgmt->frame_control);
+
+        list_for_each_entry_rcu(wk, &local->work_list, list) {
+                if (sdata != wk->sdata)
+                        continue;
+                if (compare_ether_addr(wk->filter_ta, mgmt->sa))
+                        continue;
+                if (compare_ether_addr(wk->filter_ta, mgmt->bssid))
+                        continue;
+
+                switch (fc & IEEE80211_FCTL_STYPE) {
+                case IEEE80211_STYPE_AUTH:
+                case IEEE80211_STYPE_PROBE_RESP:
+                case IEEE80211_STYPE_ASSOC_RESP:
+                case IEEE80211_STYPE_REASSOC_RESP:
+                case IEEE80211_STYPE_DEAUTH:
+                case IEEE80211_STYPE_DISASSOC:
+                        skb_queue_tail(&local->work_skb_queue, skb);
+                        ieee80211_queue_work(&local->hw, &local->work_work);
+                        return RX_QUEUED;
+                }
+        }
+
+        return RX_CONTINUE;
+}
+
+static enum work_done_result ieee80211_remain_done(struct ieee80211_work *wk,
+                                                   struct sk_buff *skb)
+{
+        /*
+         * We are done serving the remain-on-channel command.
+         */
+        cfg80211_remain_on_channel_expired(wk->sdata->dev, (unsigned long) wk,
+                                           wk->chan, wk->chan_type,
+                                           GFP_KERNEL);
+
+        return WORK_DONE_DESTROY;
+}
+
+int ieee80211_wk_remain_on_channel(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_channel *chan,
+                                   enum nl80211_channel_type channel_type,
+                                   unsigned int duration, u64 *cookie)
+{
+        struct ieee80211_work *wk;
+
+        wk = kzalloc(sizeof(*wk), GFP_KERNEL);
+        if (!wk)
+                return -ENOMEM;
+
+        wk->type = IEEE80211_WORK_REMAIN_ON_CHANNEL;
+        wk->chan = chan;
+        wk->chan_type = channel_type;
+        wk->sdata = sdata;
+        wk->done = ieee80211_remain_done;
+
+        wk->remain.duration = duration;
+
+        *cookie = (unsigned long) wk;
+
+        ieee80211_add_work(wk);
+
+        return 0;
+}
+
+int ieee80211_wk_cancel_remain_on_channel(struct ieee80211_sub_if_data *sdata,
+                                          u64 cookie)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_work *wk, *tmp;
+        bool found = false;
+
+        mutex_lock(&local->work_mtx);
+        list_for_each_entry_safe(wk, tmp, &local->work_list, list) {
+                if ((unsigned long) wk == cookie) {
+                        wk->timeout = jiffies;
+                        found = true;
+                        break;
+                }
+        }
+        mutex_unlock(&local->work_mtx);
+
+        if (!found)
+                return -ENOENT;
+
+        ieee80211_queue_work(&local->hw, &local->work_work);
+
+        return 0;
+}
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index d07ecda0a92d..a4b6e148c5de 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -681,9 +681,7 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
         int chains_to_skip = cb->args[0];
         int fams_to_skip = cb->args[1];
 
-        for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
-                if (i < chains_to_skip)
-                        continue;
+        for (i = chains_to_skip; i < GENL_FAM_TAB_SIZE; i++) {
                 n = 0;
                 list_for_each_entry(rt, genl_family_chain(i), family_list) {
                         if (!rt->netnsok && !net_eq(net, &init_net))
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f126d18dbdc4..53633c5fdb1d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2457,7 +2457,7 @@ static const struct file_operations packet_seq_fops = {
 
 #endif
 
-static int packet_net_init(struct net *net)
+static int __net_init packet_net_init(struct net *net)
 {
         rwlock_init(&net->packet.sklist_lock);
         INIT_HLIST_HEAD(&net->packet.sklist);
@@ -2468,7 +2468,7 @@ static int packet_net_init(struct net *net)
         return 0;
 }
 
-static void packet_net_exit(struct net *net)
+static void __net_exit packet_net_exit(struct net *net)
 {
         proc_net_remove(net, "packet");
 }
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index 67f072e94d00..387197b579b1 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -75,7 +75,8 @@ static int pn_sendmsg(struct kiocb *iocb, struct sock *sk,
         struct sk_buff *skb;
         int err;
 
-        if (msg->msg_flags & MSG_OOB)
+        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
+                                MSG_CMSG_COMPAT))
                 return -EOPNOTSUPP;
 
         if (msg->msg_name == NULL)
@@ -119,7 +120,8 @@ static int pn_recvmsg(struct kiocb *iocb, struct sock *sk,
         int rval = -EOPNOTSUPP;
         int copylen;
 
-        if (flags & MSG_OOB)
+        if (flags & ~(MSG_PEEK|MSG_TRUNC|MSG_DONTWAIT|MSG_NOSIGNAL|
+                        MSG_CMSG_COMPAT))
                 goto out_nofree;
 
         if (addr_len)
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index d183509d3fa6..d01208968c83 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -96,11 +96,11 @@ static int gprs_recv(struct gprs_dev *gp, struct sk_buff *skb)
                 goto drop;
         }
 
-        if (likely(skb_headroom(skb) & 3)) {
+        if (skb_headroom(skb) & 3) {
                 struct sk_buff *rskb, *fs;
                 int flen = 0;
 
-                /* Phonet Pipe data header is misaligned (3 bytes),
+                /* Phonet Pipe data header may be misaligned (3 bytes),
                  * so wrap the IP packet as a single fragment of an head-less
                  * socket buffer. The network stack will pull what it needs,
                  * but at least, the whole IP payload is not memcpy'd. */
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index b6356f3832f6..360cf377693e 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -354,6 +354,9 @@ static int pipe_do_rcv(struct sock *sk, struct sk_buff *skb)
                 queue = &pn->ctrlreq_queue;
                 goto queue;
 
+        case PNS_PIPE_ALIGNED_DATA:
+                __skb_pull(skb, 1);
+                /* fall through */
         case PNS_PIPE_DATA:
                 __skb_pull(skb, 3); /* Pipe data header */
                 if (!pn_flow_safe(pn->rx_fc)) {
@@ -441,6 +444,7 @@ static int pep_connreq_rcv(struct sock *sk, struct sk_buff *skb)
         struct sockaddr_pn dst;
         u16 peer_type;
         u8 pipe_handle, enabled, n_sb;
+        u8 aligned = 0;
 
         if (!pskb_pull(skb, sizeof(*hdr) + 4))
                 return -EINVAL;
@@ -479,6 +483,9 @@ static int pep_connreq_rcv(struct sock *sk, struct sk_buff *skb)
                                 return -EINVAL;
                         peer_type = (peer_type & 0xff00) | data[0];
                         break;
+                case PN_PIPE_SB_ALIGNED_DATA:
+                        aligned = data[0] != 0;
+                        break;
                 }
                 n_sb--;
         }
@@ -510,6 +517,7 @@ static int pep_connreq_rcv(struct sock *sk, struct sk_buff *skb)
         newpn->rx_credits = 0;
         newpn->rx_fc = newpn->tx_fc = PN_LEGACY_FLOW_CONTROL;
         newpn->init_enable = enabled;
+        newpn->aligned = aligned;
 
         BUG_ON(!skb_queue_empty(&newsk->sk_receive_queue));
         skb_queue_head(&newsk->sk_receive_queue, skb);
@@ -829,11 +837,15 @@ static int pipe_skb_send(struct sock *sk, struct sk_buff *skb)
                 return -ENOBUFS;
         }
 
-        skb_push(skb, 3);
+        skb_push(skb, 3 + pn->aligned);
         skb_reset_transport_header(skb);
         ph = pnp_hdr(skb);
         ph->utid = 0;
-        ph->message_id = PNS_PIPE_DATA;
+        if (pn->aligned) {
+                ph->message_id = PNS_PIPE_ALIGNED_DATA;
+                ph->data[0] = 0; /* padding */
+        } else
+                ph->message_id = PNS_PIPE_DATA;
         ph->pipe_handle = pn->pipe_handle;
 
         return pn_skb_send(sk, skb, &pipe_srv);
@@ -848,7 +860,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
         int flags = msg->msg_flags;
         int err, done;
 
-        if (msg->msg_flags & MSG_OOB || !(msg->msg_flags & MSG_EOR))
+        if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
+                                MSG_CMSG_COMPAT)) ||
+                        !(msg->msg_flags & MSG_EOR))
                 return -EOPNOTSUPP;
 
         skb = sock_alloc_send_skb(sk, MAX_PNPIPE_HEADER + len,
@@ -927,6 +941,9 @@ int pep_write(struct sock *sk, struct sk_buff *skb)
         struct sk_buff *rskb, *fs;
         int flen = 0;
 
+        if (pep_sk(sk)->aligned)
+                return pipe_skb_send(sk, skb);
+
         rskb = alloc_skb(MAX_PNPIPE_HEADER, GFP_ATOMIC);
         if (!rskb) {
                 kfree_skb(skb);
@@ -966,6 +983,10 @@ static int pep_recvmsg(struct kiocb *iocb, struct sock *sk,
         struct sk_buff *skb;
         int err;
 
+        if (flags & ~(MSG_OOB|MSG_PEEK|MSG_TRUNC|MSG_DONTWAIT|MSG_WAITALL|
+                        MSG_NOSIGNAL|MSG_CMSG_COMPAT))
+                return -EOPNOTSUPP;
+
         if (unlikely(1 << sk->sk_state & (TCPF_LISTEN | TCPF_CLOSE)))
                 return -ENOTCONN;
 
@@ -973,6 +994,8 @@ static int pep_recvmsg(struct kiocb *iocb, struct sock *sk,
                 /* Dequeue and acknowledge control request */
                 struct pep_sock *pn = pep_sk(sk);
 
+                if (flags & MSG_PEEK)
+                        return -EOPNOTSUPP;
                 skb = skb_dequeue(&pn->ctrlreq_queue);
                 if (skb) {
                         pep_ctrlreq_error(sk, skb, PN_PIPE_NO_ERROR,
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index bc4a33bf2d3d..c597cc53a6fb 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -311,7 +311,7 @@ static struct notifier_block phonet_device_notifier = {
 };
 
 /* Per-namespace Phonet devices handling */
-static int phonet_init_net(struct net *net)
+static int __net_init phonet_init_net(struct net *net)
 {
         struct phonet_net *pnn = net_generic(net, phonet_net_id);
 
@@ -324,7 +324,7 @@ static int phonet_init_net(struct net *net)
         return 0;
 }
 
-static void phonet_exit_net(struct net *net)
+static void __net_exit phonet_exit_net(struct net *net)
 {
         struct phonet_net *pnn = net_generic(net, phonet_net_id);
         struct net_device *dev;
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index d093cbfeaac4..a5ac6e0a8d9c 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -40,7 +40,7 @@
 #include <net/sctp/sctp.h>
 #include <net/ip.h> /* for snmp_fold_field */
 
-static struct snmp_mib sctp_snmp_list[] = {
+static const struct snmp_mib sctp_snmp_list[] = {
         SNMP_MIB_ITEM("SctpCurrEstab", SCTP_MIB_CURRESTAB),
         SNMP_MIB_ITEM("SctpActiveEstabs", SCTP_MIB_ACTIVEESTABS),
         SNMP_MIB_ITEM("SctpPassiveEstabs", SCTP_MIB_PASSIVEESTABS),
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 67fdac9d2d33..f6d1e59c4151 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6359,7 +6359,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
                     struct sctp_association *asoc)
 {
         struct inet_sock *inet = inet_sk(sk);
-        struct inet_sock *newinet = inet_sk(newsk);
+        struct inet_sock *newinet;
 
         newsk->sk_type = sk->sk_type;
         newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
diff --git a/net/sysctl_net.c b/net/sysctl_net.c
index 0b15d7250c40..53196009160a 100644
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -71,7 +71,7 @@ static struct ctl_table_root net_sysctl_ro_root = {
         .permissions = net_ctl_ro_header_perms,
 };
 
-static int sysctl_net_init(struct net *net)
+static int __net_init sysctl_net_init(struct net *net)
 {
         setup_sysctl_set(&net->sysctls,
                          &net_sysctl_ro_root.default_set,
@@ -79,7 +79,7 @@ static int sysctl_net_init(struct net *net)
         return 0;
 }
 
-static void sysctl_net_exit(struct net *net)
+static void __net_exit sysctl_net_exit(struct net *net)
 {
         WARN_ON(!list_empty(&net->sysctls.list));
         return;
diff --git a/net/tipc/Kconfig b/net/tipc/Kconfig
index 3b30d1130b61..b74f78d0c033 100644
--- a/net/tipc/Kconfig
+++ b/net/tipc/Kconfig
@@ -10,7 +10,7 @@ menuconfig TIPC
           specially designed for intra cluster communication. This protocol
           originates from Ericsson where it has been used in carrier grade
           cluster applications for many years.
-        
+
           For more information about TIPC, see http://tipc.sourceforge.net.
 
           This protocol support is also available as a module ( = code which
@@ -23,91 +23,76 @@ menuconfig TIPC
 if TIPC
 
 config TIPC_ADVANCED
-        bool "TIPC: Advanced configuration"
+        bool "Advanced TIPC configuration"
         default n
         help
-          Saying Y here will open some advanced configuration
-          for TIPC. Most users do not need to bother, so if
-          unsure, just say N.
+          Saying Y here will open some advanced configuration for TIPC.
+          Most users do not need to bother; if unsure, just say N.
 
 config TIPC_ZONES
-        int "Maximum number of zones in network"
+        int "Maximum number of zones in a network"
         depends on TIPC_ADVANCED
+        range 1 255
         default "3"
         help
-         Max number of zones inside TIPC network. Max supported value 
-         is 255 zones, minimum is 1
+          Specifies how many zones can be supported in a TIPC network.
+          Can range from 1 to 255 zones; default is 3.
 
-         Default is 3 zones in a network; setting this to higher
-         allows more zones but might use more memory.
+          Setting this to a smaller value saves some memory;
+          setting it to a higher value allows for more zones.
 
 config TIPC_CLUSTERS
         int "Maximum number of clusters in a zone"
         depends on TIPC_ADVANCED
+        range 1 1
         default "1"
         help
-          ***Only 1 (one cluster in a zone) is supported by current code.
-          Any value set here will be overridden.***
-
-          (Max number of clusters inside TIPC zone. Max supported 
-          value is 4095 clusters, minimum is 1.
+          Specifies how many clusters can be supported in a TIPC zone.
 
-          Default is 1; setting this to smaller value might save 
-          some memory, setting it to higher
-          allows more clusters and might consume more memory.)
+          *** Currently TIPC only supports a single cluster per zone. ***
 
 config TIPC_NODES
-        int "Maximum number of nodes in cluster"
+        int "Maximum number of nodes in a cluster"
         depends on TIPC_ADVANCED
+        range 8 2047
         default "255"
         help
-          Maximum number of nodes inside a TIPC cluster. Maximum 
-          supported value is 2047 nodes, minimum is 8. 
-
-          Setting this to a smaller value saves some memory, 
-          setting it to higher allows more nodes.
-
-config TIPC_SLAVE_NODES
-        int "Maximum number of slave nodes in cluster"
-        depends on TIPC_ADVANCED
-        default "0"
-        help
-          ***This capability is not supported by current code.***
-          
-          Maximum number of slave nodes inside a TIPC cluster. Maximum 
-          supported value is 2047 nodes, minimum is 0. 
+          Specifies how many nodes can be supported in a TIPC cluster.
+          Can range from 8 to 2047 nodes; default is 255.
 
-          Setting this to a smaller value saves some memory, 
-          setting it to higher allows more nodes.
+          Setting this to a smaller value saves some memory;
+          setting it to higher allows for more nodes.
 
 config TIPC_PORTS
         int "Maximum number of ports in a node"
         depends on TIPC_ADVANCED
+        range 127 65535
         default "8191"
         help
-          Maximum number of ports within a node. Maximum 
-          supported value is 64535 nodes, minimum is 127. 
+          Specifies how many ports can be supported by a node.
+          Can range from 127 to 65535 ports; default is 8191.
 
           Setting this to a smaller value saves some memory, 
-          setting it to higher allows more ports.
+          setting it to higher allows for more ports.
 
 config TIPC_LOG
         int "Size of log buffer"
         depends on TIPC_ADVANCED
-        default 0
+        range 0 32768
+        default "0"
         help
-          Size (in bytes) of TIPC's internal log buffer, which records the
-          occurrence of significant events.  Maximum supported value
-          is 32768 bytes, minimum is 0.
+          Size (in bytes) of TIPC's internal log buffer, which records the
+          occurrence of significant events.  Can range from 0 to 32768 bytes;
+          default is 0.
 
           There is no need to enable the log buffer unless the node will be
           managed remotely via TIPC.
 
 config TIPC_DEBUG
-        bool "Enable debugging support"
+        bool "Enable debug messages"
         default n
         help
-          This will enable debugging of TIPC.
+          This enables debugging of TIPC.
 
           Only say Y here if you are having trouble with TIPC.  It will
           enable the display of detailed information about what is going on.
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 3256bd7d398f..52c571fedbe0 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -189,11 +189,11 @@ static int __init tipc_init(void)
         tipc_remote_management = 1;
         tipc_max_publications = 10000;
         tipc_max_subscriptions = 2000;
-        tipc_max_ports = delimit(CONFIG_TIPC_PORTS, 127, 65536);
-        tipc_max_zones = delimit(CONFIG_TIPC_ZONES, 1, 255);
-        tipc_max_clusters = delimit(CONFIG_TIPC_CLUSTERS, 1, 1);
-        tipc_max_nodes = delimit(CONFIG_TIPC_NODES, 8, 2047);
-        tipc_max_slaves = delimit(CONFIG_TIPC_SLAVE_NODES, 0, 2047);
+        tipc_max_ports = CONFIG_TIPC_PORTS;
+        tipc_max_zones = CONFIG_TIPC_ZONES;
+        tipc_max_clusters = CONFIG_TIPC_CLUSTERS;
+        tipc_max_nodes = CONFIG_TIPC_NODES;
+        tipc_max_slaves = CONFIG_TIPC_SLAVE_NODES;
         tipc_net_id = 4711;
 
         if ((res = tipc_core_start()))
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index f25511903115..9bc9b92bc099 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2224,7 +2224,7 @@ static const struct net_proto_family unix_family_ops = {
 };
 
 
-static int unix_net_init(struct net *net)
+static int __net_init unix_net_init(struct net *net)
 {
         int error = -ENOMEM;
 
@@ -2243,7 +2243,7 @@ out:
         return error;
 }
 
-static void unix_net_exit(struct net *net)
+static void __net_exit unix_net_exit(struct net *net)
 {
         unix_sysctl_unregister(net);
         proc_net_remove(net, "unix");
diff --git a/net/unix/sysctl_net_unix.c b/net/unix/sysctl_net_unix.c
index 708f5df6b7f0..d095c7be10d0 100644
--- a/net/unix/sysctl_net_unix.c
+++ b/net/unix/sysctl_net_unix.c
@@ -31,7 +31,7 @@ static struct ctl_path unix_path[] = {
         { },
 };
 
-int unix_sysctl_register(struct net *net)
+int __net_init unix_sysctl_register(struct net *net)
 {
         struct ctl_table *table;
 
diff --git a/net/wireless/.gitignore b/net/wireless/.gitignore
new file mode 100644
index 000000000000..c33451b896d9
--- /dev/null
+++ b/net/wireless/.gitignore
@@ -0,0 +1 @@
+regdb.c
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 90e93a5701aa..d0ee29063e5d 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -94,20 +94,21 @@ config CFG80211_DEBUGFS
 
           If unsure, say N.
 
-config WIRELESS_OLD_REGULATORY
-        bool "Old wireless static regulatory definitions"
+config CFG80211_INTERNAL_REGDB
+        bool "use statically compiled regulatory rules database" if EMBEDDED
         default n
         depends on CFG80211
         ---help---
-          This option enables the old static regulatory information
-          and uses it within the new framework. This option is available
-          for historical reasons and it is advised to leave it off.
+          This option generates an internal data structure representing
+          the wireless regulatory rules described in net/wireless/db.txt
+          and includes code to query that database.  This is an alternative
+          to using CRDA for defining regulatory rules for the kernel.
 
           For details see:
 
           http://wireless.kernel.org/en/developers/Regulatory
 
-          Say N and if you say Y, please tell us why. The default is N.
+          Most distributions have a CRDA package.  So if unsure, say N.
 
 config CFG80211_WEXT
         bool "cfg80211 wireless extensions compatibility"
diff --git a/net/wireless/Makefile b/net/wireless/Makefile
index f07c8dc7aab2..e77e508126fa 100644
--- a/net/wireless/Makefile
+++ b/net/wireless/Makefile
@@ -13,5 +13,11 @@ cfg80211-y += core.o sysfs.o radiotap.o util.o reg.o scan.o nl80211.o
 cfg80211-y += mlme.o ibss.o sme.o chan.o ethtool.o
 cfg80211-$(CONFIG_CFG80211_DEBUGFS) += debugfs.o
 cfg80211-$(CONFIG_CFG80211_WEXT) += wext-compat.o wext-sme.o
+cfg80211-$(CONFIG_CFG80211_INTERNAL_REGDB) += regdb.o
 
 ccflags-y += -D__CHECK_ENDIAN__
+
+$(obj)/regdb.c: $(src)/db.txt $(src)/genregdb.awk
+        @$(AWK) -f $(srctree)/$(src)/genregdb.awk < $< > $@
+
+clean-files := regdb.c
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index a46ac6c9b365..bf1737fc9a7e 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -41,44 +41,57 @@ rdev_fixed_channel(struct cfg80211_registered_device *rdev,
         return result;
 }
 
-int rdev_set_freq(struct cfg80211_registered_device *rdev,
-                  struct wireless_dev *for_wdev,
+struct ieee80211_channel *
+rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
                   int freq, enum nl80211_channel_type channel_type)
 {
         struct ieee80211_channel *chan;
         struct ieee80211_sta_ht_cap *ht_cap;
-        int result;
-
-        if (rdev_fixed_channel(rdev, for_wdev))
-                return -EBUSY;
-
-        if (!rdev->ops->set_channel)
-                return -EOPNOTSUPP;
 
         chan = ieee80211_get_channel(&rdev->wiphy, freq);
 
         /* Primary channel not allowed */
         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
-                return -EINVAL;
+                return NULL;
 
         if (channel_type == NL80211_CHAN_HT40MINUS &&
             chan->flags & IEEE80211_CHAN_NO_HT40MINUS)
-                return -EINVAL;
+                return NULL;
         else if (channel_type == NL80211_CHAN_HT40PLUS &&
                  chan->flags & IEEE80211_CHAN_NO_HT40PLUS)
-                return -EINVAL;
+                return NULL;
 
         ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 
         if (channel_type != NL80211_CHAN_NO_HT) {
                 if (!ht_cap->ht_supported)
-                        return -EINVAL;
+                        return NULL;
 
                 if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
                     ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT)
-                        return -EINVAL;
+                        return NULL;
         }
 
+        return chan;
+}
+
+int rdev_set_freq(struct cfg80211_registered_device *rdev,
+                  struct wireless_dev *for_wdev,
+                  int freq, enum nl80211_channel_type channel_type)
+{
+        struct ieee80211_channel *chan;
+        int result;
+
+        if (rdev_fixed_channel(rdev, for_wdev))
+                return -EBUSY;
+
+        if (!rdev->ops->set_channel)
+                return -EOPNOTSUPP;
+
+        chan = rdev_freq_to_chan(rdev, freq, channel_type);
+        if (!chan)
+                return -EINVAL;
+
         result = rdev->ops->set_channel(&rdev->wiphy, chan, channel_type);
         if (result)
                 return result;
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 92b812442488..20db90246de5 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -402,6 +402,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy.retry_long = 4;
         rdev->wiphy.frag_threshold = (u32) -1;
         rdev->wiphy.rts_threshold = (u32) -1;
+        rdev->wiphy.coverage_class = 0;
 
         return &rdev->wiphy;
 }
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 4ef3efc94106..2d6a6b9c0c43 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -111,7 +111,8 @@ struct cfg80211_internal_bss {
         unsigned long ts;
         struct kref ref;
         atomic_t hold;
-        bool ies_allocated;
+        bool beacon_ies_allocated;
+        bool proberesp_ies_allocated;
 
         /* must be last because of priv member */
         struct cfg80211_bss pub;
@@ -374,10 +375,15 @@ void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev);
 struct ieee80211_channel *
 rdev_fixed_channel(struct cfg80211_registered_device *rdev,
                    struct wireless_dev *for_wdev);
+struct ieee80211_channel *
+rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
+                  int freq, enum nl80211_channel_type channel_type);
 int rdev_set_freq(struct cfg80211_registered_device *rdev,
                   struct wireless_dev *for_wdev,
                   int freq, enum nl80211_channel_type channel_type);
 
+u16 cfg80211_calculate_bitrate(struct rate_info *rate);
+
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
 #define CFG80211_DEV_WARN_ON(cond)      WARN_ON(cond)
 #else
diff --git a/net/wireless/db.txt b/net/wireless/db.txt
new file mode 100644
index 000000000000..a2fc3a09ccdc
--- /dev/null
+++ b/net/wireless/db.txt
@@ -0,0 +1,17 @@
+#
+# This file is a placeholder to prevent accidental build breakage if someone
+# enables CONFIG_CFG80211_INTERNAL_REGDB.  Almost no one actually needs to
+# enable that build option.
+#
+# You should be using CRDA instead.  It is even better if you use the CRDA
+# package provided by your distribution, since they will probably keep it
+# up-to-date on your behalf.
+#
+# If you _really_ intend to use CONFIG_CFG80211_INTERNAL_REGDB then you will
+# need to replace this file with one containing appropriately formatted
+# regulatory rules that cover the regulatory domains you will be using.  Your
+# best option is to extract the db.txt file from the wireless-regdb git
+# repository:
+#
+#   git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-regdb.git
+#
diff --git a/net/wireless/genregdb.awk b/net/wireless/genregdb.awk
new file mode 100644
index 000000000000..3cc9e69880a8
--- /dev/null
+++ b/net/wireless/genregdb.awk
@@ -0,0 +1,118 @@
+#!/usr/bin/awk -f
+#
+# genregdb.awk -- generate regdb.c from db.txt
+#
+# Actually, it reads from stdin (presumed to be db.txt) and writes
+# to stdout (presumed to be regdb.c), but close enough...
+#
+# Copyright 2009 John W. Linville <linville@tuxdriver.com>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+
+BEGIN {
+        active = 0
+        rules = 0;
+        print "/*"
+        print " * DO NOT EDIT -- file generated from data in db.txt"
+        print " */"
+        print ""
+        print "#include <linux/nl80211.h>"
+        print "#include <net/cfg80211.h>"
+        print ""
+        regdb = "const struct ieee80211_regdomain *reg_regdb[] = {\n"
+}
+
+/^[ \t]*#/ {
+        # Ignore
+}
+
+!active && /^[ \t]*$/ {
+        # Ignore
+}
+
+!active && /country/ {
+        country=$2
+        sub(/:/, "", country)
+        printf "static const struct ieee80211_regdomain regdom_%s = {\n", country
+        printf "\t.alpha2 = \"%s\",\n", country
+        printf "\t.reg_rules = {\n"
+        active = 1
+        regdb = regdb "\t&regdom_" country ",\n"
+}
+
+active && /^[ \t]*\(/ {
+        start = $1
+        sub(/\(/, "", start)
+        end = $3
+        bw = $5
+        sub(/\),/, "", bw)
+        gain = $6
+        sub(/\(/, "", gain)
+        sub(/,/, "", gain)
+        power = $7
+        sub(/\)/, "", power)
+        sub(/,/, "", power)
+        # power might be in mW...
+        units = $8
+        sub(/\)/, "", units)
+        sub(/,/, "", units)
+        if (units == "mW") {
+                if (power == 100) {
+                        power = 20
+                } else if (power == 200) {
+                        power = 23
+                } else if (power == 500) {
+                        power = 27
+                } else if (power == 1000) {
+                        power = 30
+                } else {
+                        print "Unknown power value in database!"
+                }
+        }
+        flagstr = ""
+        for (i=8; i<=NF; i++)
+                flagstr = flagstr $i
+        split(flagstr, flagarray, ",")
+        flags = ""
+        for (arg in flagarray) {
+                if (flagarray[arg] == "NO-OFDM") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_OFDM | "
+                } else if (flagarray[arg] == "NO-CCK") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_CCK | "
+                } else if (flagarray[arg] == "NO-INDOOR") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_INDOOR | "
+                } else if (flagarray[arg] == "NO-OUTDOOR") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_OUTDOOR | "
+                } else if (flagarray[arg] == "DFS") {
+                        flags = flags "\n\t\t\tNL80211_RRF_DFS | "
+                } else if (flagarray[arg] == "PTP-ONLY") {
+                        flags = flags "\n\t\t\tNL80211_RRF_PTP_ONLY | "
+                } else if (flagarray[arg] == "PTMP-ONLY") {
+                        flags = flags "\n\t\t\tNL80211_RRF_PTMP_ONLY | "
+                } else if (flagarray[arg] == "PASSIVE-SCAN") {
+                        flags = flags "\n\t\t\tNL80211_RRF_PASSIVE_SCAN | "
+                } else if (flagarray[arg] == "NO-IBSS") {
+                        flags = flags "\n\t\t\tNL80211_RRF_NO_IBSS | "
+                }
+        }
+        flags = flags "0"
+        printf "\t\tREG_RULE(%d, %d, %d, %d, %d, %s),\n", start, end, bw, gain, power, flags
+        rules++
+}
+
+active && /^[ \t]*$/ {
+        active = 0
+        printf "\t},\n"
+        printf "\t.n_reg_rules = %d\n", rules
+        printf "};\n\n"
+        rules = 0;
+}
+
+END {
+        print regdb "};"
+        print ""
+        print "int reg_regdb_size = ARRAY_SIZE(reg_regdb);"
+}
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 82e6002c8d67..94d151f6f73e 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -148,22 +148,23 @@ void __cfg80211_send_deauth(struct net_device *dev,
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
         const u8 *bssid = mgmt->bssid;
         int i;
+        bool found = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
-        nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
-
         if (wdev->current_bss &&
             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
                 cfg80211_unhold_bss(wdev->current_bss);
                 cfg80211_put_bss(&wdev->current_bss->pub);
                 wdev->current_bss = NULL;
+                found = true;
         } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
                 if (wdev->auth_bsses[i] &&
                     memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
                         cfg80211_unhold_bss(wdev->auth_bsses[i]);
                         cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
                         wdev->auth_bsses[i] = NULL;
+                        found = true;
                         break;
                 }
                 if (wdev->authtry_bsses[i] &&
@@ -171,10 +172,16 @@ void __cfg80211_send_deauth(struct net_device *dev,
                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
                         wdev->authtry_bsses[i] = NULL;
+                        found = true;
                         break;
                 }
         }
 
+        if (!found)
+                return;
+
+        nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
+
         if (wdev->sme_state == CFG80211_SME_CONNECTED) {
                 u16 reason_code;
                 bool from_ap;
@@ -684,3 +691,40 @@ void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
                 }
         }
 }
+
+void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
+                               struct ieee80211_channel *chan,
+                               enum nl80211_channel_type channel_type,
+                               unsigned int duration, gfp_t gfp)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_send_remain_on_channel(rdev, dev, cookie, chan, channel_type,
+                                       duration, gfp);
+}
+EXPORT_SYMBOL(cfg80211_ready_on_channel);
+
+void cfg80211_remain_on_channel_expired(struct net_device *dev,
+                                        u64 cookie,
+                                        struct ieee80211_channel *chan,
+                                        enum nl80211_channel_type channel_type,
+                                        gfp_t gfp)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_send_remain_on_channel_cancel(rdev, dev, cookie, chan,
+                                              channel_type, gfp);
+}
+EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
+
+void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
+                      struct station_info *sinfo, gfp_t gfp)
+{
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        nl80211_send_sta_event(rdev, dev, mac_addr, sinfo, gfp);
+}
+EXPORT_SYMBOL(cfg80211_new_sta);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a6028433e3a0..4af7991a9ec8 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -69,6 +69,7 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
+        [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 
         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
@@ -141,6 +142,9 @@ static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
                                  .len = WLAN_PMKID_LEN },
+        [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
+        [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
+        [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 };
 
 /* policy for the attributes */
@@ -442,6 +446,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                     dev->wiphy.frag_threshold);
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
                     dev->wiphy.rts_threshold);
+        NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
+                    dev->wiphy.coverage_class);
 
         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
                    dev->wiphy.max_scan_ssids);
@@ -569,6 +575,8 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
         CMD(set_pmksa, SET_PMKSA);
         CMD(del_pmksa, DEL_PMKSA);
         CMD(flush_pmksa, FLUSH_PMKSA);
+        CMD(remain_on_channel, REMAIN_ON_CHANNEL);
+        CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
                 i++;
                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
@@ -681,6 +689,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
         u32 changed;
         u8 retry_short = 0, retry_long = 0;
         u32 frag_threshold = 0, rts_threshold = 0;
+        u8 coverage_class = 0;
 
         rtnl_lock();
 
@@ -803,9 +812,16 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
         }
 
+        if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
+                coverage_class = nla_get_u8(
+                        info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
+                changed |= WIPHY_PARAM_COVERAGE_CLASS;
+        }
+
         if (changed) {
                 u8 old_retry_short, old_retry_long;
                 u32 old_frag_threshold, old_rts_threshold;
+                u8 old_coverage_class;
 
                 if (!rdev->ops->set_wiphy_params) {
                         result = -EOPNOTSUPP;
@@ -816,6 +832,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 old_retry_long = rdev->wiphy.retry_long;
                 old_frag_threshold = rdev->wiphy.frag_threshold;
                 old_rts_threshold = rdev->wiphy.rts_threshold;
+                old_coverage_class = rdev->wiphy.coverage_class;
 
                 if (changed & WIPHY_PARAM_RETRY_SHORT)
                         rdev->wiphy.retry_short = retry_short;
@@ -825,6 +842,8 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         rdev->wiphy.frag_threshold = frag_threshold;
                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
                         rdev->wiphy.rts_threshold = rts_threshold;
+                if (changed & WIPHY_PARAM_COVERAGE_CLASS)
+                        rdev->wiphy.coverage_class = coverage_class;
 
                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
                 if (result) {
@@ -832,6 +851,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         rdev->wiphy.retry_long = old_retry_long;
                         rdev->wiphy.frag_threshold = old_frag_threshold;
                         rdev->wiphy.rts_threshold = old_rts_threshold;
+                        rdev->wiphy.coverage_class = old_coverage_class;
                 }
         }
 
@@ -1637,42 +1657,9 @@ static int parse_station_flags(struct genl_info *info,
         return 0;
 }
 
-static u16 nl80211_calculate_bitrate(struct rate_info *rate)
-{
-        int modulation, streams, bitrate;
-
-        if (!(rate->flags & RATE_INFO_FLAGS_MCS))
-                return rate->legacy;
-
-        /* the formula below does only work for MCS values smaller than 32 */
-        if (rate->mcs >= 32)
-                return 0;
-
-        modulation = rate->mcs & 7;
-        streams = (rate->mcs >> 3) + 1;
-
-        bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
-                        13500000 : 6500000;
-
-        if (modulation < 4)
-                bitrate *= (modulation + 1);
-        else if (modulation == 4)
-                bitrate *= (modulation + 2);
-        else
-                bitrate *= (modulation + 3);
-
-        bitrate *= streams;
-
-        if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
-                bitrate = (bitrate / 9) * 10;
-
-        /* do NOT round down here */
-        return (bitrate + 50000) / 100000;
-}
-
 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
                                 int flags, struct net_device *dev,
-                                u8 *mac_addr, struct station_info *sinfo)
+                                const u8 *mac_addr, struct station_info *sinfo)
 {
         void *hdr;
         struct nlattr *sinfoattr, *txrate;
@@ -1716,8 +1703,8 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
                 if (!txrate)
                         goto nla_put_failure;
 
-                /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
-                bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
+                /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
+                bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
                 if (bitrate > 0)
                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
 
@@ -2583,12 +2570,6 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 
         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-        /* We ignore world regdom requests with the old regdom setup */
-        if (is_world_regdom(data))
-                return -EINVAL;
-#endif
-
         r = regulatory_hint_user(data);
 
         return r;
@@ -3182,6 +3163,10 @@ static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
                         res->len_information_elements,
                         res->information_elements);
+        if (res->beacon_ies && res->len_beacon_ies &&
+            res->beacon_ies != res->information_elements)
+                NLA_PUT(msg, NL80211_BSS_BEACON_IES,
+                        res->len_beacon_ies, res->beacon_ies);
         if (res->tsf)
                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
         if (res->beacon_interval)
@@ -4322,6 +4307,246 @@ static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
 
 }
 
+static int nl80211_remain_on_channel(struct sk_buff *skb,
+                                     struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        struct ieee80211_channel *chan;
+        struct sk_buff *msg;
+        void *hdr;
+        u64 cookie;
+        enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
+        u32 freq, duration;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
+            !info->attrs[NL80211_ATTR_DURATION])
+                return -EINVAL;
+
+        duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
+
+        /*
+         * We should be on that channel for at least one jiffie,
+         * and more than 5 seconds seems excessive.
+         */
+        if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->remain_on_channel) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
+                channel_type = nla_get_u32(
+                        info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
+                if (channel_type != NL80211_CHAN_NO_HT &&
+                    channel_type != NL80211_CHAN_HT20 &&
+                    channel_type != NL80211_CHAN_HT40PLUS &&
+                    channel_type != NL80211_CHAN_HT40MINUS)
+                        err = -EINVAL;
+                        goto out;
+        }
+
+        freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
+        chan = rdev_freq_to_chan(rdev, freq, channel_type);
+        if (chan == NULL) {
+                err = -EINVAL;
+                goto out;
+        }
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg) {
+                err = -ENOMEM;
+                goto out;
+        }
+
+        hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
+                             NL80211_CMD_REMAIN_ON_CHANNEL);
+
+        if (IS_ERR(hdr)) {
+                err = PTR_ERR(hdr);
+                goto free_msg;
+        }
+
+        err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
+                                           channel_type, duration, &cookie);
+
+        if (err)
+                goto free_msg;
+
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+
+        genlmsg_end(msg, hdr);
+        err = genlmsg_reply(msg, info);
+        goto out;
+
+ nla_put_failure:
+        err = -ENOBUFS;
+ free_msg:
+        nlmsg_free(msg);
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
+                                            struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+        u64 cookie;
+        int err;
+
+        if (!info->attrs[NL80211_ATTR_COOKIE])
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->cancel_remain_on_channel) {
+                err = -EOPNOTSUPP;
+                goto out;
+        }
+
+        if (!netif_running(dev)) {
+                err = -ENETDOWN;
+                goto out;
+        }
+
+        cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
+
+        err = rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
+
+ out:
+        cfg80211_unlock_rdev(rdev);
+        dev_put(dev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
+static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
+                           u8 *rates, u8 rates_len)
+{
+        u8 i;
+        u32 mask = 0;
+
+        for (i = 0; i < rates_len; i++) {
+                int rate = (rates[i] & 0x7f) * 5;
+                int ridx;
+                for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
+                        struct ieee80211_rate *srate =
+                                &sband->bitrates[ridx];
+                        if (rate == srate->bitrate) {
+                                mask |= 1 << ridx;
+                                break;
+                        }
+                }
+                if (ridx == sband->n_bitrates)
+                        return 0; /* rate not found */
+        }
+
+        return mask;
+}
+
+static struct nla_policy
+nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] __read_mostly = {
+        [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
+                                    .len = NL80211_MAX_SUPP_RATES },
+};
+
+static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
+                                       struct genl_info *info)
+{
+        struct nlattr *tb[NL80211_TXRATE_MAX + 1];
+        struct cfg80211_registered_device *rdev;
+        struct cfg80211_bitrate_mask mask;
+        int err, rem, i;
+        struct net_device *dev;
+        struct nlattr *tx_rates;
+        struct ieee80211_supported_band *sband;
+
+        if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
+                return -EINVAL;
+
+        rtnl_lock();
+
+        err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
+        if (err)
+                goto unlock_rtnl;
+
+        if (!rdev->ops->set_bitrate_mask) {
+                err = -EOPNOTSUPP;
+                goto unlock;
+        }
+
+        memset(&mask, 0, sizeof(mask));
+        /* Default to all rates enabled */
+        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                sband = rdev->wiphy.bands[i];
+                mask.control[i].legacy =
+                        sband ? (1 << sband->n_bitrates) - 1 : 0;
+        }
+
+        /*
+         * The nested attribute uses enum nl80211_band as the index. This maps
+         * directly to the enum ieee80211_band values used in cfg80211.
+         */
+        nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
+        {
+                enum ieee80211_band band = nla_type(tx_rates);
+                if (band < 0 || band >= IEEE80211_NUM_BANDS) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
+                sband = rdev->wiphy.bands[band];
+                if (sband == NULL) {
+                        err = -EINVAL;
+                        goto unlock;
+                }
+                nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
+                          nla_len(tx_rates), nl80211_txattr_policy);
+                if (tb[NL80211_TXRATE_LEGACY]) {
+                        mask.control[band].legacy = rateset_to_mask(
+                                sband,
+                                nla_data(tb[NL80211_TXRATE_LEGACY]),
+                                nla_len(tb[NL80211_TXRATE_LEGACY]));
+                        if (mask.control[band].legacy == 0) {
+                                err = -EINVAL;
+                                goto unlock;
+                        }
+                }
+        }
+
+        err = rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
+
+ unlock:
+        dev_put(dev);
+        cfg80211_unlock_rdev(rdev);
+ unlock_rtnl:
+        rtnl_unlock();
+        return err;
+}
+
 static struct genl_ops nl80211_ops[] = {
         {
                 .cmd = NL80211_CMD_GET_WIPHY,
@@ -4584,8 +4809,26 @@ static struct genl_ops nl80211_ops[] = {
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
         },
-
+        {
+                .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
+                .doit = nl80211_remain_on_channel,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
+                .doit = nl80211_cancel_remain_on_channel,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
+                .doit = nl80211_set_tx_bitrate_mask,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
+
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
         .name = "mlme",
 };
@@ -5173,6 +5416,89 @@ nla_put_failure:
         nlmsg_free(msg);
 }
 
+static void nl80211_send_remain_on_chan_event(
+        int cmd, struct cfg80211_registered_device *rdev,
+        struct net_device *netdev, u64 cookie,
+        struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type,
+        unsigned int duration, gfp_t gfp)
+{
+        struct sk_buff *msg;
+        void *hdr;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
+        NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
+        NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
+
+        if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
+                NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
+
+        if (genlmsg_end(msg, hdr) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+        return;
+
+ nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+        nlmsg_free(msg);
+}
+
+void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
+                                    struct net_device *netdev, u64 cookie,
+                                    struct ieee80211_channel *chan,
+                                    enum nl80211_channel_type channel_type,
+                                    unsigned int duration, gfp_t gfp)
+{
+        nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
+                                          rdev, netdev, cookie, chan,
+                                          channel_type, duration, gfp);
+}
+
+void nl80211_send_remain_on_channel_cancel(
+        struct cfg80211_registered_device *rdev, struct net_device *netdev,
+        u64 cookie, struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type, gfp_t gfp)
+{
+        nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
+                                          rdev, netdev, cookie, chan,
+                                          channel_type, 0, gfp);
+}
+
+void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
+                            struct net_device *dev, const u8 *mac_addr,
+                            struct station_info *sinfo, gfp_t gfp)
+{
+        struct sk_buff *msg;
+
+        msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
+        if (!msg)
+                return;
+
+        if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, gfp);
+}
+
 /* initialisation/exit functions */
 
 int nl80211_init(void)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index 44cc2a76a1b0..14855b8fb430 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -59,4 +59,19 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
                              struct net_device *netdev, const u8 *bssid,
                              gfp_t gfp);
 
+void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
+                                    struct net_device *netdev,
+                                    u64 cookie,
+                                    struct ieee80211_channel *chan,
+                                    enum nl80211_channel_type channel_type,
+                                    unsigned int duration, gfp_t gfp);
+void nl80211_send_remain_on_channel_cancel(
+        struct cfg80211_registered_device *rdev, struct net_device *netdev,
+        u64 cookie, struct ieee80211_channel *chan,
+        enum nl80211_channel_type channel_type, gfp_t gfp);
+
+void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
+                            struct net_device *dev, const u8 *mac_addr,
+                            struct station_info *sinfo, gfp_t gfp);
+
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 7a0754c92df4..5f8071de7950 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -40,8 +40,18 @@
 #include <net/cfg80211.h>
 #include "core.h"
 #include "reg.h"
+#include "regdb.h"
 #include "nl80211.h"
 
+#ifdef CONFIG_CFG80211_REG_DEBUG
+#define REG_DBG_PRINT(format, args...) \
+        do { \
+                printk(KERN_DEBUG format , ## args); \
+        } while (0)
+#else
+#define REG_DBG_PRINT(args...)
+#endif
+
 /* Receipt of information from last regulatory request */
 static struct regulatory_request *last_request;
 
@@ -128,78 +138,6 @@ static char *ieee80211_regdom = "00";
 module_param(ieee80211_regdom, charp, 0444);
 MODULE_PARM_DESC(ieee80211_regdom, "IEEE 802.11 regulatory domain code");
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-/*
- * We assume 40 MHz bandwidth for the old regulatory work.
- * We make emphasis we are using the exact same frequencies
- * as before
- */
-
-static const struct ieee80211_regdomain us_regdom = {
-        .n_reg_rules = 6,
-        .alpha2 =  "US",
-        .reg_rules = {
-                /* IEEE 802.11b/g, channels 1..11 */
-                REG_RULE(2412-10, 2462+10, 40, 6, 27, 0),
-                /* IEEE 802.11a, channel 36..48 */
-                REG_RULE(5180-10, 5240+10, 40, 6, 17, 0),
-                /* IEEE 802.11a, channels 48..64 */
-                REG_RULE(5260-10, 5320+10, 40, 6, 20, NL80211_RRF_DFS),
-                /* IEEE 802.11a, channels 100..124 */
-                REG_RULE(5500-10, 5590+10, 40, 6, 20, NL80211_RRF_DFS),
-                /* IEEE 802.11a, channels 132..144 */
-                REG_RULE(5660-10, 5700+10, 40, 6, 20, NL80211_RRF_DFS),
-                /* IEEE 802.11a, channels 149..165, outdoor */
-                REG_RULE(5745-10, 5825+10, 40, 6, 30, 0),
-        }
-};
-
-static const struct ieee80211_regdomain jp_regdom = {
-        .n_reg_rules = 6,
-        .alpha2 =  "JP",
-        .reg_rules = {
-                /* IEEE 802.11b/g, channels 1..11 */
-                REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
-                /* IEEE 802.11b/g, channels 12..13 */
-                REG_RULE(2467-10, 2472+10, 20, 6, 20, 0),
-                /* IEEE 802.11b/g, channel 14 */
-                REG_RULE(2484-10, 2484+10, 20, 6, 20, NL80211_RRF_NO_OFDM),
-                /* IEEE 802.11a, channels 36..48 */
-                REG_RULE(5180-10, 5240+10, 40, 6, 20, 0),
-                /* IEEE 802.11a, channels 52..64 */
-                REG_RULE(5260-10, 5320+10, 40, 6, 20, NL80211_RRF_DFS),
-                /* IEEE 802.11a, channels 100..144 */
-                REG_RULE(5500-10, 5700+10, 40, 6, 23, NL80211_RRF_DFS),
-        }
-};
-
-static const struct ieee80211_regdomain *static_regdom(char *alpha2)
-{
-        if (alpha2[0] == 'U' && alpha2[1] == 'S')
-                return &us_regdom;
-        if (alpha2[0] == 'J' && alpha2[1] == 'P')
-                return &jp_regdom;
-        /* Use world roaming rules for "EU", since it was a pseudo
-           domain anyway... */
-        if (alpha2[0] == 'E' && alpha2[1] == 'U')
-                return &world_regdom;
-        /* Default, world roaming rules */
-        return &world_regdom;
-}
-
-static bool is_old_static_regdom(const struct ieee80211_regdomain *rd)
-{
-        if (rd == &us_regdom || rd == &jp_regdom || rd == &world_regdom)
-                return true;
-        return false;
-}
-#else
-static inline bool is_old_static_regdom(const struct ieee80211_regdomain *rd)
-{
-        return false;
-}
-#endif
-
 static void reset_regdomains(void)
 {
         /* avoid freeing static information or freeing something twice */
@@ -209,8 +147,6 @@ static void reset_regdomains(void)
                 cfg80211_world_regdom = NULL;
         if (cfg80211_regdomain == &world_regdom)
                 cfg80211_regdomain = NULL;
-        if (is_old_static_regdom(cfg80211_regdomain))
-                cfg80211_regdomain = NULL;
 
         kfree(cfg80211_regdomain);
         kfree(cfg80211_world_regdom);
@@ -335,6 +271,98 @@ static bool country_ie_integrity_changes(u32 checksum)
         return false;
 }
 
+static int reg_copy_regd(const struct ieee80211_regdomain **dst_regd,
+                         const struct ieee80211_regdomain *src_regd)
+{
+        struct ieee80211_regdomain *regd;
+        int size_of_regd = 0;
+        unsigned int i;
+
+        size_of_regd = sizeof(struct ieee80211_regdomain) +
+          ((src_regd->n_reg_rules + 1) * sizeof(struct ieee80211_reg_rule));
+
+        regd = kzalloc(size_of_regd, GFP_KERNEL);
+        if (!regd)
+                return -ENOMEM;
+
+        memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
+
+        for (i = 0; i < src_regd->n_reg_rules; i++)
+                memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
+                        sizeof(struct ieee80211_reg_rule));
+
+        *dst_regd = regd;
+        return 0;
+}
+
+#ifdef CONFIG_CFG80211_INTERNAL_REGDB
+struct reg_regdb_search_request {
+        char alpha2[2];
+        struct list_head list;
+};
+
+static LIST_HEAD(reg_regdb_search_list);
+static DEFINE_SPINLOCK(reg_regdb_search_lock);
+
+static void reg_regdb_search(struct work_struct *work)
+{
+        struct reg_regdb_search_request *request;
+        const struct ieee80211_regdomain *curdom, *regdom;
+        int i, r;
+
+        spin_lock(&reg_regdb_search_lock);
+        while (!list_empty(&reg_regdb_search_list)) {
+                request = list_first_entry(&reg_regdb_search_list,
+                                           struct reg_regdb_search_request,
+                                           list);
+                list_del(&request->list);
+
+                for (i=0; i<reg_regdb_size; i++) {
+                        curdom = reg_regdb[i];
+
+                        if (!memcmp(request->alpha2, curdom->alpha2, 2)) {
+                                r = reg_copy_regd(&regdom, curdom);
+                                if (r)
+                                        break;
+                                spin_unlock(&reg_regdb_search_lock);
+                                mutex_lock(&cfg80211_mutex);
+                                set_regdom(regdom);
+                                mutex_unlock(&cfg80211_mutex);
+                                spin_lock(&reg_regdb_search_lock);
+                                break;
+                        }
+                }
+
+                kfree(request);
+        }
+        spin_unlock(&reg_regdb_search_lock);
+}
+
+static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
+
+static void reg_regdb_query(const char *alpha2)
+{
+        struct reg_regdb_search_request *request;
+
+        if (!alpha2)
+                return;
+
+        request = kzalloc(sizeof(struct reg_regdb_search_request), GFP_KERNEL);
+        if (!request)
+                return;
+
+        memcpy(request->alpha2, alpha2, 2);
+
+        spin_lock(&reg_regdb_search_lock);
+        list_add_tail(&request->list, &reg_regdb_search_list);
+        spin_unlock(&reg_regdb_search_lock);
+
+        schedule_work(&reg_regdb_work);
+}
+#else
+static inline void reg_regdb_query(const char *alpha2) {}
+#endif /* CONFIG_CFG80211_INTERNAL_REGDB */
+
 /*
  * This lets us keep regulatory code which is updated on a regulatory
  * basis in userspace.
@@ -354,6 +382,9 @@ static int call_crda(const char *alpha2)
                 printk(KERN_INFO "cfg80211: Calling CRDA to update world "
                         "regulatory domain\n");
 
+        /* query internal regulatory database (if it exists) */
+        reg_regdb_query(alpha2);
+
         country_env[8] = alpha2[0];
         country_env[9] = alpha2[1];
 
@@ -454,12 +485,212 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,
 }
 
 /*
+ * This is a work around for sanity checking ieee80211_channel_to_frequency()'s
+ * work. ieee80211_channel_to_frequency() can for example currently provide a
+ * 2 GHz channel when in fact a 5 GHz channel was desired. An example would be
+ * an AP providing channel 8 on a country IE triplet when it sent this on the
+ * 5 GHz band, that channel is designed to be channel 8 on 5 GHz, not a 2 GHz
+ * channel.
+ *
+ * This can be removed once ieee80211_channel_to_frequency() takes in a band.
+ */
+static bool chan_in_band(int chan, enum ieee80211_band band)
+{
+        int center_freq = ieee80211_channel_to_frequency(chan);
+
+        switch (band) {
+        case IEEE80211_BAND_2GHZ:
+                if (center_freq <= 2484)
+                        return true;
+                return false;
+        case IEEE80211_BAND_5GHZ:
+                if (center_freq >= 5005)
+                        return true;
+                return false;
+        default:
+                return false;
+        }
+}
+
+/*
+ * Some APs may send a country IE triplet for each channel they
+ * support and while this is completely overkill and silly we still
+ * need to support it. We avoid making a single rule for each channel
+ * though and to help us with this we use this helper to find the
+ * actual subband end channel. These type of country IE triplet
+ * scenerios are handled then, all yielding two regulaotry rules from
+ * parsing a country IE:
+ *
+ * [1]
+ * [2]
+ * [36]
+ * [40]
+ *
+ * [1]
+ * [2-4]
+ * [5-12]
+ * [36]
+ * [40-44]
+ *
+ * [1-4]
+ * [5-7]
+ * [36-44]
+ * [48-64]
+ *
+ * [36-36]
+ * [40-40]
+ * [44-44]
+ * [48-48]
+ * [52-52]
+ * [56-56]
+ * [60-60]
+ * [64-64]
+ * [100-100]
+ * [104-104]
+ * [108-108]
+ * [112-112]
+ * [116-116]
+ * [120-120]
+ * [124-124]
+ * [128-128]
+ * [132-132]
+ * [136-136]
+ * [140-140]
+ *
+ * Returns 0 if the IE has been found to be invalid in the middle
+ * somewhere.
+ */
+static int max_subband_chan(enum ieee80211_band band,
+                            int orig_cur_chan,
+                            int orig_end_channel,
+                            s8 orig_max_power,
+                            u8 **country_ie,
+                            u8 *country_ie_len)
+{
+        u8 *triplets_start = *country_ie;
+        u8 len_at_triplet = *country_ie_len;
+        int end_subband_chan = orig_end_channel;
+
+        /*
+         * We'll deal with padding for the caller unless
+         * its not immediate and we don't process any channels
+         */
+        if (*country_ie_len == 1) {
+                *country_ie += 1;
+                *country_ie_len -= 1;
+                return orig_end_channel;
+        }
+
+        /* Move to the next triplet and then start search */
+        *country_ie += 3;
+        *country_ie_len -= 3;
+
+        if (!chan_in_band(orig_cur_chan, band))
+                return 0;
+
+        while (*country_ie_len >= 3) {
+                int end_channel = 0;
+                struct ieee80211_country_ie_triplet *triplet =
+                        (struct ieee80211_country_ie_triplet *) *country_ie;
+                int cur_channel = 0, next_expected_chan;
+
+                /* means last triplet is completely unrelated to this one */
+                if (triplet->ext.reg_extension_id >=
+                                IEEE80211_COUNTRY_EXTENSION_ID) {
+                        *country_ie -= 3;
+                        *country_ie_len += 3;
+                        break;
+                }
+
+                if (triplet->chans.first_channel == 0) {
+                        *country_ie += 1;
+                        *country_ie_len -= 1;
+                        if (*country_ie_len != 0)
+                                return 0;
+                        break;
+                }
+
+                if (triplet->chans.num_channels == 0)
+                        return 0;
+
+                /* Monitonically increasing channel order */
+                if (triplet->chans.first_channel <= end_subband_chan)
+                        return 0;
+
+                if (!chan_in_band(triplet->chans.first_channel, band))
+                        return 0;
+
+                /* 2 GHz */
+                if (triplet->chans.first_channel <= 14) {
+                        end_channel = triplet->chans.first_channel +
+                                triplet->chans.num_channels - 1;
+                }
+                else {
+                        end_channel =  triplet->chans.first_channel +
+                                (4 * (triplet->chans.num_channels - 1));
+                }
+
+                if (!chan_in_band(end_channel, band))
+                        return 0;
+
+                if (orig_max_power != triplet->chans.max_power) {
+                        *country_ie -= 3;
+                        *country_ie_len += 3;
+                        break;
+                }
+
+                cur_channel = triplet->chans.first_channel;
+
+                /* The key is finding the right next expected channel */
+                if (band == IEEE80211_BAND_2GHZ)
+                        next_expected_chan = end_subband_chan + 1;
+                 else
+                        next_expected_chan = end_subband_chan + 4;
+
+                if (cur_channel != next_expected_chan) {
+                        *country_ie -= 3;
+                        *country_ie_len += 3;
+                        break;
+                }
+
+                end_subband_chan = end_channel;
+
+                /* Move to the next one */
+                *country_ie += 3;
+                *country_ie_len -= 3;
+
+                /*
+                 * Padding needs to be dealt with if we processed
+                 * some channels.
+                 */
+                if (*country_ie_len == 1) {
+                        *country_ie += 1;
+                        *country_ie_len -= 1;
+                        break;
+                }
+
+                /* If seen, the IE is invalid */
+                if (*country_ie_len == 2)
+                        return 0;
+        }
+
+        if (end_subband_chan == orig_end_channel) {
+                *country_ie = triplets_start;
+                *country_ie_len = len_at_triplet;
+                return orig_end_channel;
+        }
+
+        return end_subband_chan;
+}
+
+/*
  * Converts a country IE to a regulatory domain. A regulatory domain
  * structure has a lot of information which the IE doesn't yet have,
  * so for the other values we use upper max values as we will intersect
  * with our userspace regulatory agent to get lower bounds.
  */
 static struct ieee80211_regdomain *country_ie_2_rd(
+                                enum ieee80211_band band,
                                 u8 *country_ie,
                                 u8 country_ie_len,
                                 u32 *checksum)
@@ -521,10 +752,29 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                         continue;
                 }
 
+                /*
+                 * APs can add padding to make length divisible
+                 * by two, required by the spec.
+                 */
+                if (triplet->chans.first_channel == 0) {
+                        country_ie++;
+                        country_ie_len--;
+                        /* This is expected to be at the very end only */
+                        if (country_ie_len != 0)
+                                return NULL;
+                        break;
+                }
+
+                if (triplet->chans.num_channels == 0)
+                        return NULL;
+
+                if (!chan_in_band(triplet->chans.first_channel, band))
+                        return NULL;
+
                 /* 2 GHz */
-                if (triplet->chans.first_channel <= 14)
+                if (band == IEEE80211_BAND_2GHZ)
                         end_channel = triplet->chans.first_channel +
-                                triplet->chans.num_channels;
+                                triplet->chans.num_channels - 1;
                 else
                         /*
                          * 5 GHz -- For example in country IEs if the first
@@ -539,6 +789,24 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                                 (4 * (triplet->chans.num_channels - 1));
 
                 cur_channel = triplet->chans.first_channel;
+
+                /*
+                 * Enhancement for APs that send a triplet for every channel
+                 * or for whatever reason sends triplets with multiple channels
+                 * separated when in fact they should be together.
+                 */
+                end_channel = max_subband_chan(band,
+                                               cur_channel,
+                                               end_channel,
+                                               triplet->chans.max_power,
+                                               &country_ie,
+                                               &country_ie_len);
+                if (!end_channel)
+                        return NULL;
+
+                if (!chan_in_band(end_channel, band))
+                        return NULL;
+
                 cur_sub_max_channel = end_channel;
 
                 /* Basic sanity check */
@@ -569,10 +837,13 @@ static struct ieee80211_regdomain *country_ie_2_rd(
 
                 last_sub_max_channel = cur_sub_max_channel;
 
-                country_ie += 3;
-                country_ie_len -= 3;
                 num_rules++;
 
+                if (country_ie_len >= 3) {
+                        country_ie += 3;
+                        country_ie_len -= 3;
+                }
+
                 /*
                  * Note: this is not a IEEE requirement but
                  * simply a memory requirement
@@ -615,6 +886,12 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                         continue;
                 }
 
+                if (triplet->chans.first_channel == 0) {
+                        country_ie++;
+                        country_ie_len--;
+                        break;
+                }
+
                 reg_rule = &rd->reg_rules[i];
                 freq_range = &reg_rule->freq_range;
                 power_rule = &reg_rule->power_rule;
@@ -622,13 +899,20 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                 reg_rule->flags = flags;
 
                 /* 2 GHz */
-                if (triplet->chans.first_channel <= 14)
+                if (band == IEEE80211_BAND_2GHZ)
                         end_channel = triplet->chans.first_channel +
-                                triplet->chans.num_channels;
+                                triplet->chans.num_channels -1;
                 else
                         end_channel =  triplet->chans.first_channel +
                                 (4 * (triplet->chans.num_channels - 1));
 
+                end_channel = max_subband_chan(band,
+                                               triplet->chans.first_channel,
+                                               end_channel,
+                                               triplet->chans.max_power,
+                                               &country_ie,
+                                               &country_ie_len);
+
                 /*
                  * The +10 is since the regulatory domain expects
                  * the actual band edge, not the center of freq for
@@ -649,12 +933,15 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                  */
                 freq_range->max_bandwidth_khz = MHZ_TO_KHZ(40);
                 power_rule->max_antenna_gain = DBI_TO_MBI(100);
-                power_rule->max_eirp = DBM_TO_MBM(100);
+                power_rule->max_eirp = DBM_TO_MBM(triplet->chans.max_power);
 
-                country_ie += 3;
-                country_ie_len -= 3;
                 i++;
 
+                if (country_ie_len >= 3) {
+                        country_ie += 3;
+                        country_ie_len -= 3;
+                }
+
                 BUG_ON(i > NL80211_MAX_SUPP_REG_RULES);
         }
 
@@ -950,25 +1237,21 @@ static void handle_channel(struct wiphy *wiphy, enum ieee80211_band band,
                 if (r == -ERANGE &&
                     last_request->initiator ==
                     NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-#ifdef CONFIG_CFG80211_REG_DEBUG
-                        printk(KERN_DEBUG "cfg80211: Leaving channel %d MHz "
+                        REG_DBG_PRINT("cfg80211: Leaving channel %d MHz "
                                 "intact on %s - no rule found in band on "
                                 "Country IE\n",
-                                chan->center_freq, wiphy_name(wiphy));
-#endif
+                        chan->center_freq, wiphy_name(wiphy));
                 } else {
                 /*
                  * In this case we know the country IE has at least one reg rule
                  * for the band so we respect its band definitions
                  */
-#ifdef CONFIG_CFG80211_REG_DEBUG
                         if (last_request->initiator ==
                             NL80211_REGDOM_SET_BY_COUNTRY_IE)
-                                printk(KERN_DEBUG "cfg80211: Disabling "
+                                REG_DBG_PRINT("cfg80211: Disabling "
                                         "channel %d MHz on %s due to "
                                         "Country IE\n",
                                         chan->center_freq, wiphy_name(wiphy));
-#endif
                         flags |= IEEE80211_CHAN_DISABLED;
                         chan->flags = flags;
                 }
@@ -1342,30 +1625,6 @@ void wiphy_apply_custom_regulatory(struct wiphy *wiphy,
 }
 EXPORT_SYMBOL(wiphy_apply_custom_regulatory);
 
-static int reg_copy_regd(const struct ieee80211_regdomain **dst_regd,
-                         const struct ieee80211_regdomain *src_regd)
-{
-        struct ieee80211_regdomain *regd;
-        int size_of_regd = 0;
-        unsigned int i;
-
-        size_of_regd = sizeof(struct ieee80211_regdomain) +
-          ((src_regd->n_reg_rules + 1) * sizeof(struct ieee80211_reg_rule));
-
-        regd = kzalloc(size_of_regd, GFP_KERNEL);
-        if (!regd)
-                return -ENOMEM;
-
-        memcpy(regd, src_regd, sizeof(struct ieee80211_regdomain));
-
-        for (i = 0; i < src_regd->n_reg_rules; i++)
-                memcpy(&regd->reg_rules[i], &src_regd->reg_rules[i],
-                        sizeof(struct ieee80211_reg_rule));
-
-        *dst_regd = regd;
-        return 0;
-}
-
 /*
  * Return value which can be used by ignore_request() to indicate
  * it has been determined we should intersect two regulatory domains
@@ -1418,8 +1677,6 @@ static int ignore_request(struct wiphy *wiphy,
                 return REG_INTERSECT;
         case NL80211_REGDOM_SET_BY_DRIVER:
                 if (last_request->initiator == NL80211_REGDOM_SET_BY_CORE) {
-                        if (is_old_static_regdom(cfg80211_regdomain))
-                                return 0;
                         if (regdom_changes(pending_request->alpha2))
                                 return 0;
                         return -EALREADY;
@@ -1456,8 +1713,7 @@ static int ignore_request(struct wiphy *wiphy,
                                 return -EAGAIN;
                 }
 
-                if (!is_old_static_regdom(cfg80211_regdomain) &&
-                    !regdom_changes(pending_request->alpha2))
+                if (!regdom_changes(pending_request->alpha2))
                         return -EALREADY;
 
                 return 0;
@@ -1758,8 +2014,9 @@ static bool reg_same_country_ie_hint(struct wiphy *wiphy,
  * therefore cannot iterate over the rdev list here.
  */
 void regulatory_hint_11d(struct wiphy *wiphy,
-                        u8 *country_ie,
-                        u8 country_ie_len)
+                         enum ieee80211_band band,
+                         u8 *country_ie,
+                         u8 country_ie_len)
 {
         struct ieee80211_regdomain *rd = NULL;
         char alpha2[2];
@@ -1805,9 +2062,11 @@ void regulatory_hint_11d(struct wiphy *wiphy,
             wiphy_idx_valid(last_request->wiphy_idx)))
                 goto out;
 
-        rd = country_ie_2_rd(country_ie, country_ie_len, &checksum);
-        if (!rd)
+        rd = country_ie_2_rd(band, country_ie, country_ie_len, &checksum);
+        if (!rd) {
+                REG_DBG_PRINT("cfg80211: Ignoring bogus country IE\n");
                 goto out;
+        }
 
         /*
          * This will not happen right now but we leave it here for the
@@ -1875,13 +2134,12 @@ int regulatory_hint_found_beacon(struct wiphy *wiphy,
         if (!reg_beacon)
                 return -ENOMEM;
 
-#ifdef CONFIG_CFG80211_REG_DEBUG
-        printk(KERN_DEBUG "cfg80211: Found new beacon on "
-                "frequency: %d MHz (Ch %d) on %s\n",
-                beacon_chan->center_freq,
-                ieee80211_frequency_to_channel(beacon_chan->center_freq),
-                wiphy_name(wiphy));
-#endif
+        REG_DBG_PRINT("cfg80211: Found new beacon on "
+                      "frequency: %d MHz (Ch %d) on %s\n",
+                      beacon_chan->center_freq,
+                      ieee80211_frequency_to_channel(beacon_chan->center_freq),
+                      wiphy_name(wiphy));
+
         memcpy(&reg_beacon->chan, beacon_chan,
                 sizeof(struct ieee80211_channel));
 
@@ -2039,8 +2297,7 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
                  * If someone else asked us to change the rd lets only bother
                  * checking if the alpha2 changes if CRDA was already called
                  */
-                if (!is_old_static_regdom(cfg80211_regdomain) &&
-                    !regdom_changes(rd->alpha2))
+                if (!regdom_changes(rd->alpha2))
                         return -EINVAL;
         }
 
@@ -2239,15 +2496,8 @@ int regulatory_init(void)
         spin_lock_init(&reg_requests_lock);
         spin_lock_init(&reg_pending_beacons_lock);
 
-#ifdef CONFIG_WIRELESS_OLD_REGULATORY
-        cfg80211_regdomain = static_regdom(ieee80211_regdom);
-
-        printk(KERN_INFO "cfg80211: Using static regulatory domain info\n");
-        print_regdomain_info(cfg80211_regdomain);
-#else
         cfg80211_regdomain = cfg80211_world_regdom;
 
-#endif
         /* We always try to get an update for the static regdomain */
         err = regulatory_hint_core(cfg80211_regdomain->alpha2);
         if (err) {
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index 3362c7c069b2..3018508226ab 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -41,14 +41,25 @@ int regulatory_hint_found_beacon(struct wiphy *wiphy,
  * regulatory_hint_11d - hints a country IE as a regulatory domain
  * @wiphy: the wireless device giving the hint (used only for reporting
  *      conflicts)
+ * @band: the band on which the country IE was received on. This determines
+ *      the band we'll process the country IE channel triplets for.
  * @country_ie: pointer to the country IE
  * @country_ie_len: length of the country IE
  *
  * We will intersect the rd with the what CRDA tells us should apply
  * for the alpha2 this country IE belongs to, this prevents APs from
  * sending us incorrect or outdated information against a country.
+ *
+ * The AP is expected to provide Country IE channel triplets for the
+ * band it is on. It is technically possible for APs to send channel
+ * country IE triplets even for channels outside of the band they are
+ * in but for that they would have to use the regulatory extension
+ * in combination with a triplet but this behaviour is currently
+ * not observed. For this reason if a triplet is seen with channel
+ * information for a band the BSS is not present in it will be ignored.
  */
 void regulatory_hint_11d(struct wiphy *wiphy,
+                         enum ieee80211_band band,
                          u8 *country_ie,
                          u8 country_ie_len);
 
diff --git a/net/wireless/regdb.h b/net/wireless/regdb.h
new file mode 100644
index 000000000000..818222c92513
--- /dev/null
+++ b/net/wireless/regdb.h
@@ -0,0 +1,7 @@
+#ifndef __REGDB_H__
+#define __REGDB_H__
+
+extern const struct ieee80211_regdomain *reg_regdb[];
+extern int reg_regdb_size;
+
+#endif /* __REGDB_H__ */
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 0c2cbbebca95..06b0231ee5e3 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -100,8 +100,10 @@ static void bss_release(struct kref *ref)
         if (bss->pub.free_priv)
                 bss->pub.free_priv(&bss->pub);
 
-        if (bss->ies_allocated)
-                kfree(bss->pub.information_elements);
+        if (bss->beacon_ies_allocated)
+                kfree(bss->pub.beacon_ies);
+        if (bss->proberesp_ies_allocated)
+                kfree(bss->pub.proberesp_ies);
 
         BUG_ON(atomic_read(&bss->hold));
 
@@ -375,8 +377,7 @@ rb_find_bss(struct cfg80211_registered_device *dev,
 
 static struct cfg80211_internal_bss *
 cfg80211_bss_update(struct cfg80211_registered_device *dev,
-                    struct cfg80211_internal_bss *res,
-                    bool overwrite)
+                    struct cfg80211_internal_bss *res)
 {
         struct cfg80211_internal_bss *found = NULL;
         const u8 *meshid, *meshcfg;
@@ -418,28 +419,64 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
                 found->pub.capability = res->pub.capability;
                 found->ts = res->ts;
 
-                /* overwrite IEs */
-                if (overwrite) {
+                /* Update IEs */
+                if (res->pub.proberesp_ies) {
                         size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
-                        size_t ielen = res->pub.len_information_elements;
+                        size_t ielen = res->pub.len_proberesp_ies;
+
+                        if (found->pub.proberesp_ies &&
+                            !found->proberesp_ies_allocated &&
+                            ksize(found) >= used + ielen) {
+                                memcpy(found->pub.proberesp_ies,
+                                       res->pub.proberesp_ies, ielen);
+                                found->pub.len_proberesp_ies = ielen;
+                        } else {
+                                u8 *ies = found->pub.proberesp_ies;
+
+                                if (found->proberesp_ies_allocated)
+                                        ies = krealloc(ies, ielen, GFP_ATOMIC);
+                                else
+                                        ies = kmalloc(ielen, GFP_ATOMIC);
+
+                                if (ies) {
+                                        memcpy(ies, res->pub.proberesp_ies,
+                                               ielen);
+                                        found->proberesp_ies_allocated = true;
+                                        found->pub.proberesp_ies = ies;
+                                        found->pub.len_proberesp_ies = ielen;
+                                }
+                        }
 
-                        if (!found->ies_allocated && ksize(found) >= used + ielen) {
-                                memcpy(found->pub.information_elements,
-                                       res->pub.information_elements, ielen);
-                                found->pub.len_information_elements = ielen;
+                        /* Override possible earlier Beacon frame IEs */
+                        found->pub.information_elements =
+                                found->pub.proberesp_ies;
+                        found->pub.len_information_elements =
+                                found->pub.len_proberesp_ies;
+                }
+                if (res->pub.beacon_ies) {
+                        size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
+                        size_t ielen = res->pub.len_beacon_ies;
+
+                        if (found->pub.beacon_ies &&
+                            !found->beacon_ies_allocated &&
+                            ksize(found) >= used + ielen) {
+                                memcpy(found->pub.beacon_ies,
+                                       res->pub.beacon_ies, ielen);
+                                found->pub.len_beacon_ies = ielen;
                         } else {
-                                u8 *ies = found->pub.information_elements;
+                                u8 *ies = found->pub.beacon_ies;
 
-                                if (found->ies_allocated)
+                                if (found->beacon_ies_allocated)
                                         ies = krealloc(ies, ielen, GFP_ATOMIC);
                                 else
                                         ies = kmalloc(ielen, GFP_ATOMIC);
 
                                 if (ies) {
-                                        memcpy(ies, res->pub.information_elements, ielen);
-                                        found->ies_allocated = true;
-                                        found->pub.information_elements = ies;
-                                        found->pub.len_information_elements = ielen;
+                                        memcpy(ies, res->pub.beacon_ies,
+                                               ielen);
+                                        found->beacon_ies_allocated = true;
+                                        found->pub.beacon_ies = ies;
+                                        found->pub.len_beacon_ies = ielen;
                                 }
                         }
                 }
@@ -489,14 +526,26 @@ cfg80211_inform_bss(struct wiphy *wiphy,
         res->pub.tsf = timestamp;
         res->pub.beacon_interval = beacon_interval;
         res->pub.capability = capability;
-        /* point to after the private area */
-        res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
-        memcpy(res->pub.information_elements, ie, ielen);
-        res->pub.len_information_elements = ielen;
+        /*
+         * Since we do not know here whether the IEs are from a Beacon or Probe
+         * Response frame, we need to pick one of the options and only use it
+         * with the driver that does not provide the full Beacon/Probe Response
+         * frame. Use Beacon frame pointer to avoid indicating that this should
+         * override the information_elements pointer should we have received an
+         * earlier indication of Probe Response data.
+         *
+         * The initial buffer for the IEs is allocated with the BSS entry and
+         * is located after the private area.
+         */
+        res->pub.beacon_ies = (u8 *)res + sizeof(*res) + privsz;
+        memcpy(res->pub.beacon_ies, ie, ielen);
+        res->pub.len_beacon_ies = ielen;
+        res->pub.information_elements = res->pub.beacon_ies;
+        res->pub.len_information_elements = res->pub.len_beacon_ies;
 
         kref_init(&res->ref);
 
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, 0);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
         if (!res)
                 return NULL;
 
@@ -517,7 +566,6 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         struct cfg80211_internal_bss *res;
         size_t ielen = len - offsetof(struct ieee80211_mgmt,
                                       u.probe_resp.variable);
-        bool overwrite;
         size_t privsz = wiphy->bss_priv_size;
 
         if (WARN_ON(wiphy->signal_type == NL80211_BSS_SIGNAL_UNSPEC &&
@@ -538,16 +586,28 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
         res->pub.tsf = le64_to_cpu(mgmt->u.probe_resp.timestamp);
         res->pub.beacon_interval = le16_to_cpu(mgmt->u.probe_resp.beacon_int);
         res->pub.capability = le16_to_cpu(mgmt->u.probe_resp.capab_info);
-        /* point to after the private area */
-        res->pub.information_elements = (u8 *)res + sizeof(*res) + privsz;
-        memcpy(res->pub.information_elements, mgmt->u.probe_resp.variable, ielen);
-        res->pub.len_information_elements = ielen;
+        /*
+         * The initial buffer for the IEs is allocated with the BSS entry and
+         * is located after the private area.
+         */
+        if (ieee80211_is_probe_resp(mgmt->frame_control)) {
+                res->pub.proberesp_ies = (u8 *) res + sizeof(*res) + privsz;
+                memcpy(res->pub.proberesp_ies, mgmt->u.probe_resp.variable,
+                       ielen);
+                res->pub.len_proberesp_ies = ielen;
+                res->pub.information_elements = res->pub.proberesp_ies;
+                res->pub.len_information_elements = res->pub.len_proberesp_ies;
+        } else {
+                res->pub.beacon_ies = (u8 *) res + sizeof(*res) + privsz;
+                memcpy(res->pub.beacon_ies, mgmt->u.beacon.variable, ielen);
+                res->pub.len_beacon_ies = ielen;
+                res->pub.information_elements = res->pub.beacon_ies;
+                res->pub.len_information_elements = res->pub.len_beacon_ies;
+        }
 
         kref_init(&res->ref);
 
-        overwrite = ieee80211_is_probe_resp(mgmt->frame_control);
-
-        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res, overwrite);
+        res = cfg80211_bss_update(wiphy_to_dev(wiphy), res);
         if (!res)
                 return NULL;
 
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index dc0fc4989d54..745c37e7992e 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -454,6 +454,7 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
          * - and country_ie[1] which is the IE length
          */
         regulatory_hint_11d(wdev->wiphy,
+                            bss->channel->band,
                             country_ie + 2,
                             country_ie[1]);
 }
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 59361fdcb5d0..23557c1d0a9c 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -285,7 +285,7 @@ static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
         }
 }
 
-int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
+int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                            enum nl80211_iftype iftype)
 {
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
@@ -383,7 +383,7 @@ int ieee80211_data_to_8023(struct sk_buff *skb, u8 *addr,
 }
 EXPORT_SYMBOL(ieee80211_data_to_8023);
 
-int ieee80211_data_from_8023(struct sk_buff *skb, u8 *addr,
+int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr,
                              enum nl80211_iftype iftype, u8 *bssid, bool qos)
 {
         struct ieee80211_hdr hdr;
@@ -497,6 +497,101 @@ int ieee80211_data_from_8023(struct sk_buff *skb, u8 *addr,
 }
 EXPORT_SYMBOL(ieee80211_data_from_8023);
 
+
+void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+                              const u8 *addr, enum nl80211_iftype iftype,
+                              const unsigned int extra_headroom)
+{
+        struct sk_buff *frame = NULL;
+        u16 ethertype;
+        u8 *payload;
+        const struct ethhdr *eth;
+        int remaining, err;
+        u8 dst[ETH_ALEN], src[ETH_ALEN];
+
+        err = ieee80211_data_to_8023(skb, addr, iftype);
+        if (err)
+                goto out;
+
+        /* skip the wrapping header */
+        eth = (struct ethhdr *) skb_pull(skb, sizeof(struct ethhdr));
+        if (!eth)
+                goto out;
+
+        while (skb != frame) {
+                u8 padding;
+                __be16 len = eth->h_proto;
+                unsigned int subframe_len = sizeof(struct ethhdr) + ntohs(len);
+
+                remaining = skb->len;
+                memcpy(dst, eth->h_dest, ETH_ALEN);
+                memcpy(src, eth->h_source, ETH_ALEN);
+
+                padding = (4 - subframe_len) & 0x3;
+                /* the last MSDU has no padding */
+                if (subframe_len > remaining)
+                        goto purge;
+
+                skb_pull(skb, sizeof(struct ethhdr));
+                /* reuse skb for the last subframe */
+                if (remaining <= subframe_len + padding)
+                        frame = skb;
+                else {
+                        unsigned int hlen = ALIGN(extra_headroom, 4);
+                        /*
+                         * Allocate and reserve two bytes more for payload
+                         * alignment since sizeof(struct ethhdr) is 14.
+                         */
+                        frame = dev_alloc_skb(hlen + subframe_len + 2);
+                        if (!frame)
+                                goto purge;
+
+                        skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
+                        memcpy(skb_put(frame, ntohs(len)), skb->data,
+                                ntohs(len));
+
+                        eth = (struct ethhdr *)skb_pull(skb, ntohs(len) +
+                                                        padding);
+                        if (!eth) {
+                                dev_kfree_skb(frame);
+                                goto purge;
+                        }
+                }
+
+                skb_reset_network_header(frame);
+                frame->dev = skb->dev;
+                frame->priority = skb->priority;
+
+                payload = frame->data;
+                ethertype = (payload[6] << 8) | payload[7];
+
+                if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
+                            ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
+                           compare_ether_addr(payload,
+                                              bridge_tunnel_header) == 0)) {
+                        /* remove RFC1042 or Bridge-Tunnel
+                         * encapsulation and replace EtherType */
+                        skb_pull(frame, 6);
+                        memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
+                        memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
+                } else {
+                        memcpy(skb_push(frame, sizeof(__be16)), &len,
+                                sizeof(__be16));
+                        memcpy(skb_push(frame, ETH_ALEN), src, ETH_ALEN);
+                        memcpy(skb_push(frame, ETH_ALEN), dst, ETH_ALEN);
+                }
+                __skb_queue_tail(list, frame);
+        }
+
+        return;
+
+ purge:
+        __skb_queue_purge(list);
+ out:
+        dev_kfree_skb(skb);
+}
+EXPORT_SYMBOL(ieee80211_amsdu_to_8023s);
+
 /* Given a data frame determine the 802.1p/1d tag to use. */
 unsigned int cfg80211_classify8021d(struct sk_buff *skb)
 {
@@ -720,3 +815,36 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 
         return err;
 }
+
+u16 cfg80211_calculate_bitrate(struct rate_info *rate)
+{
+        int modulation, streams, bitrate;
+
+        if (!(rate->flags & RATE_INFO_FLAGS_MCS))
+                return rate->legacy;
+
+        /* the formula below does only work for MCS values smaller than 32 */
+        if (rate->mcs >= 32)
+                return 0;
+
+        modulation = rate->mcs & 7;
+        streams = (rate->mcs >> 3) + 1;
+
+        bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
+                        13500000 : 6500000;
+
+        if (modulation < 4)
+                bitrate *= (modulation + 1);
+        else if (modulation == 4)
+                bitrate *= (modulation + 2);
+        else
+                bitrate *= (modulation + 3);
+
+        bitrate *= streams;
+
+        if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
+                bitrate = (bitrate / 9) * 10;
+
+        /* do NOT round down here */
+        return (bitrate + 50000) / 100000;
+}
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 54face3d4424..966d2f01beac 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -1204,21 +1204,47 @@ int cfg80211_wext_siwrate(struct net_device *dev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct cfg80211_bitrate_mask mask;
+        u32 fixed, maxrate;
+        struct ieee80211_supported_band *sband;
+        int band, ridx;
+        bool match = false;
 
         if (!rdev->ops->set_bitrate_mask)
                 return -EOPNOTSUPP;
 
-        mask.fixed = 0;
-        mask.maxrate = 0;
+        memset(&mask, 0, sizeof(mask));
+        fixed = 0;
+        maxrate = 0;
 
         if (rate->value < 0) {
                 /* nothing */
         } else if (rate->fixed) {
-                mask.fixed = rate->value / 1000; /* kbps */
+                fixed = rate->value / 100000;
         } else {
-                mask.maxrate = rate->value / 1000; /* kbps */
+                maxrate = rate->value / 100000;
         }
 
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                sband = wdev->wiphy->bands[band];
+                if (sband == NULL)
+                        continue;
+                for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
+                        struct ieee80211_rate *srate = &sband->bitrates[ridx];
+                        if (fixed == srate->bitrate) {
+                                mask.control[band].legacy = 1 << ridx;
+                                match = true;
+                                break;
+                        }
+                        if (srate->bitrate <= maxrate) {
+                                mask.control[band].legacy |= 1 << ridx;
+                                match = true;
+                        }
+                }
+        }
+
+        if (!match)
+                return -EINVAL;
+
         return rdev->ops->set_bitrate_mask(wdev->wiphy, dev, NULL, &mask);
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwrate);
@@ -1257,10 +1283,7 @@ int cfg80211_wext_giwrate(struct net_device *dev,
         if (!(sinfo.filled & STATION_INFO_TX_BITRATE))
                 return -EOPNOTSUPP;
 
-        rate->value = 0;
-
-        if (!(sinfo.txrate.flags & RATE_INFO_FLAGS_MCS))
-                rate->value = 100000 * sinfo.txrate.legacy;
+        rate->value = 100000 * cfg80211_calculate_bitrate(&sinfo.txrate);
 
         return 0;
 }
diff --git a/net/wireless/wext-proc.c b/net/wireless/wext-proc.c
index 273a7f77c834..8bafa31fa9f8 100644
--- a/net/wireless/wext-proc.c
+++ b/net/wireless/wext-proc.c
@@ -140,7 +140,7 @@ static const struct file_operations wireless_seq_fops = {
         .release = seq_release_net,
 };
 
-int wext_proc_init(struct net *net)
+int __net_init wext_proc_init(struct net *net)
 {
         /* Create /proc/net/wireless entry */
         if (!proc_net_fops_create(net, "wireless", S_IRUGO, &wireless_seq_fops))
@@ -149,7 +149,7 @@ int wext_proc_init(struct net *net)
         return 0;
 }
 
-void wext_proc_exit(struct net *net)
+void __net_exit wext_proc_exit(struct net *net)
 {
         proc_net_remove(net, "wireless");
 }
diff --git a/net/xfrm/xfrm_proc.c b/net/xfrm/xfrm_proc.c
index fef8db553e8d..c083a4e4e796 100644
--- a/net/xfrm/xfrm_proc.c
+++ b/net/xfrm/xfrm_proc.c
@@ -15,7 +15,7 @@
 #include <net/snmp.h>
 #include <net/xfrm.h>
 
-static struct snmp_mib xfrm_mib_list[] = {
+static const struct snmp_mib xfrm_mib_list[] = {
         SNMP_MIB_ITEM("XfrmInError", LINUX_MIB_XFRMINERROR),
         SNMP_MIB_ITEM("XfrmInBufferError", LINUX_MIB_XFRMINBUFFERERROR),
         SNMP_MIB_ITEM("XfrmInHdrError", LINUX_MIB_XFRMINHDRERROR),
diff --git a/net/xfrm/xfrm_sysctl.c b/net/xfrm/xfrm_sysctl.c
index 2e221f2cad7e..2c4d6cdcba49 100644
--- a/net/xfrm/xfrm_sysctl.c
+++ b/net/xfrm/xfrm_sysctl.c
@@ -2,7 +2,7 @@
 #include <net/net_namespace.h>
 #include <net/xfrm.h>
 
-static void __xfrm_sysctl_init(struct net *net)
+static void __net_init __xfrm_sysctl_init(struct net *net)
 {
         net->xfrm.sysctl_aevent_etime = XFRM_AE_ETIME;
         net->xfrm.sysctl_aevent_rseqth = XFRM_AE_SEQT_SIZE;
@@ -64,7 +64,7 @@ out_kmemdup:
         return -ENOMEM;
 }
 
-void xfrm_sysctl_fini(struct net *net)
+void __net_exit xfrm_sysctl_fini(struct net *net)
 {
         struct ctl_table *table;