Merge branch 'master' of git://git.infradead.org/users/linville/wireless-next into for-davem

Conflicts:
	Documentation/feature-removal-schedule.txt

8 files changed, 381 insertions, 15 deletions

diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index b5e0a5c344fd..48363c3c40f8 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -759,6 +759,12 @@ struct ieee80211_mgmt {
                                         u8 action;
                                         u8 smps_control;
                                 } __attribute__ ((packed)) ht_smps;
+                                struct {
+                                        u8 action_code;
+                                        u8 dialog_token;
+                                        __le16 capability;
+                                        u8 variable[0];
+                                } __packed tdls_discover_resp;
                         } u;
                 } __attribute__ ((packed)) action;
         } u;
@@ -805,6 +811,52 @@ struct ieee80211_pspoll {
         u8 ta[6];
 } __attribute__ ((packed));
 
+/* TDLS */
+
+/* Link-id information element */
+struct ieee80211_tdls_lnkie {
+        u8 ie_type; /* Link Identifier IE */
+        u8 ie_len;
+        u8 bssid[6];
+        u8 init_sta[6];
+        u8 resp_sta[6];
+} __packed;
+
+struct ieee80211_tdls_data {
+        u8 da[6];
+        u8 sa[6];
+        __be16 ether_type;
+        u8 payload_type;
+        u8 category;
+        u8 action_code;
+        union {
+                struct {
+                        u8 dialog_token;
+                        __le16 capability;
+                        u8 variable[0];
+                } __packed setup_req;
+                struct {
+                        __le16 status_code;
+                        u8 dialog_token;
+                        __le16 capability;
+                        u8 variable[0];
+                } __packed setup_resp;
+                struct {
+                        __le16 status_code;
+                        u8 dialog_token;
+                        u8 variable[0];
+                } __packed setup_cfm;
+                struct {
+                        __le16 reason_code;
+                        u8 variable[0];
+                } __packed teardown;
+                struct {
+                        u8 dialog_token;
+                        u8 variable[0];
+                } __packed discover_req;
+        } u;
+} __packed;
+
 /**
  * struct ieee80211_bar - HT Block Ack Request
  *
@@ -1196,6 +1248,8 @@ enum ieee80211_eid {
         WLAN_EID_TS_DELAY = 43,
         WLAN_EID_TCLAS_PROCESSING = 44,
         WLAN_EID_QOS_CAPA = 46,
+        /* 802.11z */
+        WLAN_EID_LINK_ID = 101,
         /* 802.11s */
         WLAN_EID_MESH_CONFIG = 113,
         WLAN_EID_MESH_ID = 114,
@@ -1279,6 +1333,7 @@ enum ieee80211_category {
         WLAN_CATEGORY_HT = 7,
         WLAN_CATEGORY_SA_QUERY = 8,
         WLAN_CATEGORY_PROTECTED_DUAL_OF_ACTION = 9,
+        WLAN_CATEGORY_TDLS = 12,
         WLAN_CATEGORY_MESH_ACTION = 13,
         WLAN_CATEGORY_MULTIHOP_ACTION = 14,
         WLAN_CATEGORY_SELF_PROTECTED = 15,
@@ -1342,6 +1397,36 @@ enum ieee80211_key_len {
         WLAN_KEY_LEN_AES_CMAC = 16,
 };
 
+/* Public action codes */
+enum ieee80211_pub_actioncode {
+        WLAN_PUB_ACTION_TDLS_DISCOVER_RES = 14,
+};
+
+/* TDLS action codes */
+enum ieee80211_tdls_actioncode {
+        WLAN_TDLS_SETUP_REQUEST = 0,
+        WLAN_TDLS_SETUP_RESPONSE = 1,
+        WLAN_TDLS_SETUP_CONFIRM = 2,
+        WLAN_TDLS_TEARDOWN = 3,
+        WLAN_TDLS_PEER_TRAFFIC_INDICATION = 4,
+        WLAN_TDLS_CHANNEL_SWITCH_REQUEST = 5,
+        WLAN_TDLS_CHANNEL_SWITCH_RESPONSE = 6,
+        WLAN_TDLS_PEER_PSM_REQUEST = 7,
+        WLAN_TDLS_PEER_PSM_RESPONSE = 8,
+        WLAN_TDLS_PEER_TRAFFIC_RESPONSE = 9,
+        WLAN_TDLS_DISCOVERY_REQUEST = 10,
+};
+
+/*
+ * TDLS capabililites to be enabled in the 5th byte of the
+ * @WLAN_EID_EXT_CAPABILITY information element
+ */
+#define WLAN_EXT_CAPA5_TDLS_ENABLED     BIT(5)
+#define WLAN_EXT_CAPA5_TDLS_PROHIBITED  BIT(6)
+
+/* TDLS specific payload type in the LLC/SNAP header */
+#define WLAN_TDLS_SNAP_RFTYPE   0x2
+
 /**
  * enum - mesh path selection protocol identifier
  *
diff --git a/include/linux/if_ether.h b/include/linux/if_ether.h
index c63bbd754a84..e473003e4bda 100644
--- a/include/linux/if_ether.h
+++ b/include/linux/if_ether.h
@@ -83,6 +83,7 @@
 #define ETH_P_8021AH    0x88E7          /* 802.1ah Backbone Service Tag */
 #define ETH_P_1588      0x88F7          /* IEEE 1588 Timesync */
 #define ETH_P_FCOE      0x8906          /* Fibre Channel over Ethernet  */
+#define ETH_P_TDLS      0x890D          /* TDLS */
 #define ETH_P_FIP       0x8914          /* FCoE Initialization Protocol */
 #define ETH_P_QINQ1     0x9100          /* deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] */
 #define ETH_P_QINQ2     0x9200          /* deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ] */
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index c73582fb9d20..9d797f253d8e 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -506,6 +506,9 @@
  * @NL80211_CMD_PMKSA_CANDIDATE: This is used as an event to inform userspace
  *      of PMKSA caching dandidates.
  *
+ * @NL80211_CMD_TDLS_OPER: Perform a high-level TDLS command (e.g. link setup).
+ * @NL80211_CMD_TDLS_MGMT: Send a TDLS management frame.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -632,6 +635,9 @@ enum nl80211_commands {
 
         NL80211_CMD_PMKSA_CANDIDATE,
 
+        NL80211_CMD_TDLS_OPER,
+        NL80211_CMD_TDLS_MGMT,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -1089,6 +1095,20 @@ enum nl80211_commands {
  *      This attribute is used with %NL80211_CMD_TRIGGER_SCAN and
  *      %NL80211_CMD_FRAME commands.
  *
+ * @NL80211_ATTR_TDLS_ACTION: Low level TDLS action code (e.g. link setup
+ *      request, link setup confirm, link teardown, etc.). Values are
+ *      described in the TDLS (802.11z) specification.
+ * @NL80211_ATTR_TDLS_DIALOG_TOKEN: Non-zero token for uniquely identifying a
+ *      TDLS conversation between two devices.
+ * @NL80211_ATTR_TDLS_OPERATION: High level TDLS operation; see
+ *      &enum nl80211_tdls_operation, represented as a u8.
+ * @NL80211_ATTR_TDLS_SUPPORT: A flag indicating the device can operate
+ *      as a TDLS peer sta.
+ * @NL80211_ATTR_TDLS_EXTERNAL_SETUP: The TDLS discovery/setup and teardown
+ *      procedures should be performed by sending TDLS packets via
+ *      %NL80211_CMD_TDLS_MGMT. Otherwise %NL80211_CMD_TDLS_OPER should be
+ *      used for asking the driver to perform a TDLS operation.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1311,6 +1331,12 @@ enum nl80211_attrs {
 
         NL80211_ATTR_TX_NO_CCK_RATE,
 
+        NL80211_ATTR_TDLS_ACTION,
+        NL80211_ATTR_TDLS_DIALOG_TOKEN,
+        NL80211_ATTR_TDLS_OPERATION,
+        NL80211_ATTR_TDLS_SUPPORT,
+        NL80211_ATTR_TDLS_EXTERNAL_SETUP,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1408,6 +1434,7 @@ enum nl80211_iftype {
  * @NL80211_STA_FLAG_WME: station is WME/QoS capable
  * @NL80211_STA_FLAG_MFP: station uses management frame protection
  * @NL80211_STA_FLAG_AUTHENTICATED: station is authenticated
+ * @NL80211_STA_FLAG_TDLS_PEER: station is a TDLS peer
  * @NL80211_STA_FLAG_MAX: highest station flag number currently defined
  * @__NL80211_STA_FLAG_AFTER_LAST: internal use
  */
@@ -1418,6 +1445,7 @@ enum nl80211_sta_flags {
         NL80211_STA_FLAG_WME,
         NL80211_STA_FLAG_MFP,
         NL80211_STA_FLAG_AUTHENTICATED,
+        NL80211_STA_FLAG_TDLS_PEER,
 
         /* keep last */
         __NL80211_STA_FLAG_AFTER_LAST,
@@ -2604,4 +2632,20 @@ enum nl80211_pmksa_candidate_attr {
         MAX_NL80211_PMKSA_CANDIDATE = NUM_NL80211_PMKSA_CANDIDATE - 1
 };
 
+/**
+ * enum nl80211_tdls_operation - values for %NL80211_ATTR_TDLS_OPERATION
+ * @NL80211_TDLS_DISCOVERY_REQ: Send a TDLS discovery request
+ * @NL80211_TDLS_SETUP: Setup TDLS link
+ * @NL80211_TDLS_TEARDOWN: Teardown a TDLS link which is already established
+ * @NL80211_TDLS_ENABLE_LINK: Enable TDLS link
+ * @NL80211_TDLS_DISABLE_LINK: Disable TDLS link
+ */
+enum nl80211_tdls_operation {
+        NL80211_TDLS_DISCOVERY_REQ,
+        NL80211_TDLS_SETUP,
+        NL80211_TDLS_TEARDOWN,
+        NL80211_TDLS_ENABLE_LINK,
+        NL80211_TDLS_DISABLE_LINK,
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/include/linux/rfkill-gpio.h b/include/linux/rfkill-gpio.h
index a175d0598033..4d09f6eab359 100644
--- a/include/linux/rfkill-gpio.h
+++ b/include/linux/rfkill-gpio.h
@@ -30,6 +30,8 @@
  * @reset_gpio:         GPIO which is used for reseting rfkill switch
  * @shutdown_gpio:      GPIO which is used for shutdown of rfkill switch
  * @power_clk_name:     [optional] name of clk to turn off while blocked
+ * @gpio_runtime_close: clean up platform specific gpio configuration
+ * @gpio_runtime_setup: set up platform specific gpio configuration
  */
 
 struct rfkill_gpio_platform_data {
@@ -38,6 +40,8 @@ struct rfkill_gpio_platform_data {
         int                     shutdown_gpio;
         const char              *power_clk_name;
         enum rfkill_type        type;
+        void    (*gpio_runtime_close)(struct platform_device *);
+        int     (*gpio_runtime_setup)(struct platform_device *);
 };
 
 #endif /* __RFKILL_GPIO_H */
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 7f878b9d5642..ab90ae0970a6 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -354,8 +354,8 @@ struct l2cap_chan {
         __u8            retry_count;
         __u8            num_acked;
         __u16           sdu_len;
-        __u16           partial_sdu_len;
         struct sk_buff  *sdu;
+        struct sk_buff  *sdu_last_frag;
 
         __u8            remote_tx_win;
         __u8            remote_max_tx;
@@ -448,7 +448,6 @@ enum {
 #define L2CAP_CONF_MAX_CONF_RSP 2
 
 enum {
-        CONN_SAR_SDU,
         CONN_SREJ_SENT,
         CONN_WAIT_F,
         CONN_SREJ_ACT,
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 31d823a3092b..74f4f85be32f 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -424,6 +424,17 @@ enum plink_actions {
 };
 
 /**
+ * enum station_parameters_apply_mask - station parameter values to apply
+ * @STATION_PARAM_APPLY_UAPSD: apply new uAPSD parameters (uapsd_queues, max_sp)
+ *
+ * Not all station parameters have in-band "no change" signalling,
+ * for those that don't these flags will are used.
+ */
+enum station_parameters_apply_mask {
+        STATION_PARAM_APPLY_UAPSD = BIT(0),
+};
+
+/**
  * struct station_parameters - station parameters
  *
  * Used to change and create a new station.
@@ -450,6 +461,7 @@ struct station_parameters {
         u8 *supported_rates;
         struct net_device *vlan;
         u32 sta_flags_mask, sta_flags_set;
+        u32 sta_modify_mask;
         int listen_interval;
         u16 aid;
         u8 supported_rates_len;
@@ -1410,6 +1422,9 @@ struct cfg80211_gtk_rekey_data {
  * @set_ringparam: Set tx and rx ring sizes.
  *
  * @get_ringparam: Get tx and rx ring current and maximum sizes.
+ *
+ * @tdls_mgmt: Transmit a TDLS management frame.
+ * @tdls_oper: Perform a high-level TDLS operation (e.g. TDLS link setup).
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy, struct cfg80211_wowlan *wow);
@@ -1593,6 +1608,12 @@ struct cfg80211_ops {
 
         int     (*set_rekey_data)(struct wiphy *wiphy, struct net_device *dev,
                                   struct cfg80211_gtk_rekey_data *data);
+
+        int     (*tdls_mgmt)(struct wiphy *wiphy, struct net_device *dev,
+                             u8 *peer, u8 action_code,  u8 dialog_token,
+                             u16 status_code, const u8 *buf, size_t len);
+        int     (*tdls_oper)(struct wiphy *wiphy, struct net_device *dev,
+                             u8 *peer, enum nl80211_tdls_operation oper);
 };
 
 /*
@@ -1645,6 +1666,12 @@ struct cfg80211_ops {
  * @WIPHY_FLAG_SUPPORTS_FW_ROAM: The device supports roaming feature in the
  *      firmware.
  * @WIPHY_FLAG_AP_UAPSD: The device supports uapsd on AP.
+ * @WIPHY_FLAG_SUPPORTS_TDLS: The device supports TDLS (802.11z) operation.
+ * @WIPHY_FLAG_TDLS_EXTERNAL_SETUP: The device does not handle TDLS (802.11z)
+ *      link setup/discovery operations internally. Setup, discovery and
+ *      teardown packets should be sent through the @NL80211_CMD_TDLS_MGMT
+ *      command. When this flag is not set, @NL80211_CMD_TDLS_OPER should be
+ *      used for asking the driver/firmware to perform a TDLS operation.
  */
 enum wiphy_flags {
         WIPHY_FLAG_CUSTOM_REGULATORY            = BIT(0),
@@ -1661,6 +1688,8 @@ enum wiphy_flags {
         WIPHY_FLAG_ENFORCE_COMBINATIONS         = BIT(12),
         WIPHY_FLAG_SUPPORTS_FW_ROAM             = BIT(13),
         WIPHY_FLAG_AP_UAPSD                     = BIT(14),
+        WIPHY_FLAG_SUPPORTS_TDLS                = BIT(15),
+        WIPHY_FLAG_TDLS_EXTERNAL_SETUP          = BIT(16),
 };
 
 /**
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index b0be5fb9de19..7e2c4d483ad0 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -251,6 +251,7 @@ enum ieee80211_radiotap_type {
                                                  * retries */
 #define IEEE80211_RADIOTAP_F_TX_CTS     0x0002  /* used cts 'protection' */
 #define IEEE80211_RADIOTAP_F_TX_RTS     0x0004  /* used rts/cts handshake */
+#define IEEE80211_RADIOTAP_F_TX_NOACK   0x0008  /* don't expect an ack */
 
 
 /* For IEEE80211_RADIOTAP_MCS */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 1e83afae3c64..cd108dfa1952 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -109,6 +109,7 @@ enum ieee80211_ac_numbers {
         IEEE80211_AC_BE         = 2,
         IEEE80211_AC_BK         = 3,
 };
+#define IEEE80211_NUM_ACS       4
 
 /**
  * struct ieee80211_tx_queue_params - transmit queue configuration
@@ -338,9 +339,9 @@ struct ieee80211_bss_conf {
  *      used to indicate that a frame was already retried due to PS
  * @IEEE80211_TX_INTFL_DONT_ENCRYPT: completely internal to mac80211,
  *      used to indicate frame should not be encrypted
- * @IEEE80211_TX_CTL_PSPOLL_RESPONSE: (internal?)
- *      This frame is a response to a PS-poll frame and should be sent
- *      although the station is in powersave mode.
+ * @IEEE80211_TX_CTL_POLL_RESPONSE: This frame is a response to a poll
+ *      frame (PS-Poll or uAPSD) and should be sent although the station
+ *      is in powersave mode.
  * @IEEE80211_TX_CTL_MORE_FRAMES: More frames will be passed to the
  *      transmit function after the current frame, this can be used
  *      by drivers to kick the DMA queue only if unset or when the
@@ -366,6 +367,14 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_CTL_NO_CCK_RATE: This frame will be sent at non CCK rate.
  *      This flag is actually used for management frame especially for P2P
  *      frames not being sent at CCK rate in 2GHz band.
+ * @IEEE80211_TX_STATUS_EOSP: This packet marks the end of service period,
+ *      when its status is reported the service period ends. For frames in
+ *      an SP that mac80211 transmits, it is already set; for driver frames
+ *      the driver may set this flag. It is also used to do the same for
+ *      PS-Poll responses.
+ * @IEEE80211_TX_CTL_USE_MINRATE: This frame will be sent at lowest rate.
+ *      This flag is used to send nullfunc frame at minimum rate when
+ *      the nullfunc is used for connection monitoring purpose.
  *
  * Note: If you have to add new flags to the enumeration, then don't
  *       forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
@@ -387,7 +396,7 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_INTFL_NEED_TXPROCESSING    = BIT(14),
         IEEE80211_TX_INTFL_RETRIED              = BIT(15),
         IEEE80211_TX_INTFL_DONT_ENCRYPT         = BIT(16),
-        IEEE80211_TX_CTL_PSPOLL_RESPONSE        = BIT(17),
+        IEEE80211_TX_CTL_POLL_RESPONSE          = BIT(17),
         IEEE80211_TX_CTL_MORE_FRAMES            = BIT(18),
         IEEE80211_TX_INTFL_RETRANSMISSION       = BIT(19),
         IEEE80211_TX_INTFL_HAS_RADIOTAP         = BIT(20),
@@ -397,6 +406,8 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_TX_OFFCHAN             = BIT(25),
         IEEE80211_TX_INTFL_TKIP_MIC_FAILURE     = BIT(26),
         IEEE80211_TX_CTL_NO_CCK_RATE            = BIT(27),
+        IEEE80211_TX_STATUS_EOSP                = BIT(28),
+        IEEE80211_TX_CTL_USE_MINRATE            = BIT(29),
 };
 
 #define IEEE80211_TX_CTL_STBC_SHIFT             23
@@ -410,9 +421,9 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_SEND_AFTER_DTIM | IEEE80211_TX_CTL_AMPDU |           \
         IEEE80211_TX_STAT_TX_FILTERED | IEEE80211_TX_STAT_ACK |               \
         IEEE80211_TX_STAT_AMPDU | IEEE80211_TX_STAT_AMPDU_NO_BACK |           \
-        IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_PSPOLL_RESPONSE | \
+        IEEE80211_TX_CTL_RATE_CTRL_PROBE | IEEE80211_TX_CTL_POLL_RESPONSE |   \
         IEEE80211_TX_CTL_MORE_FRAMES | IEEE80211_TX_CTL_LDPC |                \
-        IEEE80211_TX_CTL_STBC)
+        IEEE80211_TX_CTL_STBC | IEEE80211_TX_STATUS_EOSP)
 
 /**
  * enum mac80211_rate_control_flags - per-rate flags set by the
@@ -1532,6 +1543,95 @@ ieee80211_get_alt_retry_rate(const struct ieee80211_hw *hw,
  */
 
 /**
+ * DOC: AP support for powersaving clients
+ *
+ * In order to implement AP and P2P GO modes, mac80211 has support for
+ * client powersaving, both "legacy" PS (PS-Poll/null data) and uAPSD.
+ * There currently is no support for sAPSD.
+ *
+ * There is one assumption that mac80211 makes, namely that a client
+ * will not poll with PS-Poll and trigger with uAPSD at the same time.
+ * Both are supported, and both can be used by the same client, but
+ * they can't be used concurrently by the same client. This simplifies
+ * the driver code.
+ *
+ * The first thing to keep in mind is that there is a flag for complete
+ * driver implementation: %IEEE80211_HW_AP_LINK_PS. If this flag is set,
+ * mac80211 expects the driver to handle most of the state machine for
+ * powersaving clients and will ignore the PM bit in incoming frames.
+ * Drivers then use ieee80211_sta_ps_transition() to inform mac80211 of
+ * stations' powersave transitions. In this mode, mac80211 also doesn't
+ * handle PS-Poll/uAPSD.
+ *
+ * In the mode without %IEEE80211_HW_AP_LINK_PS, mac80211 will check the
+ * PM bit in incoming frames for client powersave transitions. When a
+ * station goes to sleep, we will stop transmitting to it. There is,
+ * however, a race condition: a station might go to sleep while there is
+ * data buffered on hardware queues. If the device has support for this
+ * it will reject frames, and the driver should give the frames back to
+ * mac80211 with the %IEEE80211_TX_STAT_TX_FILTERED flag set which will
+ * cause mac80211 to retry the frame when the station wakes up. The
+ * driver is also notified of powersave transitions by calling its
+ * @sta_notify callback.
+ *
+ * When the station is asleep, it has three choices: it can wake up,
+ * it can PS-Poll, or it can possibly start a uAPSD service period.
+ * Waking up is implemented by simply transmitting all buffered (and
+ * filtered) frames to the station. This is the easiest case. When
+ * the station sends a PS-Poll or a uAPSD trigger frame, mac80211
+ * will inform the driver of this with the @allow_buffered_frames
+ * callback; this callback is optional. mac80211 will then transmit
+ * the frames as usual and set the %IEEE80211_TX_CTL_POLL_RESPONSE
+ * on each frame. The last frame in the service period (or the only
+ * response to a PS-Poll) also has %IEEE80211_TX_STATUS_EOSP set to
+ * indicate that it ends the service period; as this frame must have
+ * TX status report it also sets %IEEE80211_TX_CTL_REQ_TX_STATUS.
+ * When TX status is reported for this frame, the service period is
+ * marked has having ended and a new one can be started by the peer.
+ *
+ * Another race condition can happen on some devices like iwlwifi
+ * when there are frames queued for the station and it wakes up
+ * or polls; the frames that are already queued could end up being
+ * transmitted first instead, causing reordering and/or wrong
+ * processing of the EOSP. The cause is that allowing frames to be
+ * transmitted to a certain station is out-of-band communication to
+ * the device. To allow this problem to be solved, the driver can
+ * call ieee80211_sta_block_awake() if frames are buffered when it
+ * is notified that the station went to sleep. When all these frames
+ * have been filtered (see above), it must call the function again
+ * to indicate that the station is no longer blocked.
+ *
+ * If the driver buffers frames in the driver for aggregation in any
+ * way, it must use the ieee80211_sta_set_buffered() call when it is
+ * notified of the station going to sleep to inform mac80211 of any
+ * TIDs that have frames buffered. Note that when a station wakes up
+ * this information is reset (hence the requirement to call it when
+ * informed of the station going to sleep). Then, when a service
+ * period starts for any reason, @release_buffered_frames is called
+ * with the number of frames to be released and which TIDs they are
+ * to come from. In this case, the driver is responsible for setting
+ * the EOSP (for uAPSD) and MORE_DATA bits in the released frames,
+ * to help the @more_data paramter is passed to tell the driver if
+ * there is more data on other TIDs -- the TIDs to release frames
+ * from are ignored since mac80211 doesn't know how many frames the
+ * buffers for those TIDs contain.
+ *
+ * If the driver also implement GO mode, where absence periods may
+ * shorten service periods (or abort PS-Poll responses), it must
+ * filter those response frames except in the case of frames that
+ * are buffered in the driver -- those must remain buffered to avoid
+ * reordering. Because it is possible that no frames are released
+ * in this case, the driver must call ieee80211_sta_eosp_irqsafe()
+ * to indicate to mac80211 that the service period ended anyway.
+ *
+ * Finally, if frames from multiple TIDs are released from mac80211
+ * but the driver might reorder them, it must clear & set the flags
+ * appropriately (only the last frame may have %IEEE80211_TX_STATUS_EOSP)
+ * and also take care of the EOSP and MORE_DATA bits in the frame.
+ * The driver may also use ieee80211_sta_eosp_irqsafe() in this case.
+ */
+
+/**
  * enum ieee80211_filter_flags - hardware filter flags
  *
  * These flags determine what the filter in hardware should be
@@ -1621,6 +1721,17 @@ enum ieee80211_tx_sync_type {
 };
 
 /**
+ * enum ieee80211_frame_release_type - frame release reason
+ * @IEEE80211_FRAME_RELEASE_PSPOLL: frame released for PS-Poll
+ * @IEEE80211_FRAME_RELEASE_UAPSD: frame(s) released due to
+ *      frame received on trigger-enabled AC
+ */
+enum ieee80211_frame_release_type {
+        IEEE80211_FRAME_RELEASE_PSPOLL,
+        IEEE80211_FRAME_RELEASE_UAPSD,
+};
+
+/**
  * struct ieee80211_ops - callbacks from mac80211 to the driver
  *
  * This structure contains various callbacks that the driver may
@@ -1930,6 +2041,45 @@ enum ieee80211_tx_sync_type {
  *      The callback can sleep.
  * @rssi_callback: Notify driver when the average RSSI goes above/below
  *      thresholds that were registered previously. The callback can sleep.
+ *
+ * @release_buffered_frames: Release buffered frames according to the given
+ *      parameters. In the case where the driver buffers some frames for
+ *      sleeping stations mac80211 will use this callback to tell the driver
+ *      to release some frames, either for PS-poll or uAPSD.
+ *      Note that if the @more_data paramter is %false the driver must check
+ *      if there are more frames on the given TIDs, and if there are more than
+ *      the frames being released then it must still set the more-data bit in
+ *      the frame. If the @more_data parameter is %true, then of course the
+ *      more-data bit must always be set.
+ *      The @tids parameter tells the driver which TIDs to release frames
+ *      from, for PS-poll it will always have only a single bit set.
+ *      In the case this is used for a PS-poll initiated release, the
+ *      @num_frames parameter will always be 1 so code can be shared. In
+ *      this case the driver must also set %IEEE80211_TX_STATUS_EOSP flag
+ *      on the TX status (and must report TX status) so that the PS-poll
+ *      period is properly ended. This is used to avoid sending multiple
+ *      responses for a retried PS-poll frame.
+ *      In the case this is used for uAPSD, the @num_frames parameter may be
+ *      bigger than one, but the driver may send fewer frames (it must send
+ *      at least one, however). In this case it is also responsible for
+ *      setting the EOSP flag in the QoS header of the frames. Also, when the
+ *      service period ends, the driver must set %IEEE80211_TX_STATUS_EOSP
+ *      on the last frame in the SP. Alternatively, it may call the function
+ *      ieee80211_sta_eosp_irqsafe() to inform mac80211 of the end of the SP.
+ *      This callback must be atomic.
+ * @allow_buffered_frames: Prepare device to allow the given number of frames
+ *      to go out to the given station. The frames will be sent by mac80211
+ *      via the usual TX path after this call. The TX information for frames
+ *      released will also have the %IEEE80211_TX_CTL_POLL_RESPONSE flag set
+ *      and the last one will also have %IEEE80211_TX_STATUS_EOSP set. In case
+ *      frames from multiple TIDs are released and the driver might reorder
+ *      them between the TIDs, it must set the %IEEE80211_TX_STATUS_EOSP flag
+ *      on the last frame and clear it on all others and also handle the EOSP
+ *      bit in the QoS header correctly. Alternatively, it can also call the
+ *      ieee80211_sta_eosp_irqsafe() function.
+ *      The @tids parameter is a bitmap and tells the driver which TIDs the
+ *      frames will be on; it will at most have two bits set.
+ *      This callback must be atomic.
  */
 struct ieee80211_ops {
         void (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -2002,7 +2152,8 @@ struct ieee80211_ops {
                           struct ieee80211_sta *sta);
         void (*sta_notify)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                         enum sta_notify_cmd, struct ieee80211_sta *sta);
-        int (*conf_tx)(struct ieee80211_hw *hw, u16 queue,
+        int (*conf_tx)(struct ieee80211_hw *hw,
+                       struct ieee80211_vif *vif, u16 queue,
                        const struct ieee80211_tx_queue_params *params);
         u64 (*get_tsf)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
         void (*set_tsf)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
@@ -2044,6 +2195,17 @@ struct ieee80211_ops {
                                 const struct cfg80211_bitrate_mask *mask);
         void (*rssi_callback)(struct ieee80211_hw *hw,
                               enum ieee80211_rssi_event rssi_event);
+
+        void (*allow_buffered_frames)(struct ieee80211_hw *hw,
+                                      struct ieee80211_sta *sta,
+                                      u16 tids, int num_frames,
+                                      enum ieee80211_frame_release_type reason,
+                                      bool more_data);
+        void (*release_buffered_frames)(struct ieee80211_hw *hw,
+                                        struct ieee80211_sta *sta,
+                                        u16 tids, int num_frames,
+                                        enum ieee80211_frame_release_type reason,
+                                        bool more_data);
 };
 
 /**
@@ -2361,17 +2523,35 @@ static inline int ieee80211_sta_ps_transition_ni(struct ieee80211_sta *sta,
 #define IEEE80211_TX_STATUS_HEADROOM    13
 
 /**
- * ieee80211_sta_set_tim - set the TIM bit for a sleeping station
+ * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames
  * @sta: &struct ieee80211_sta pointer for the sleeping station
+ * @tid: the TID that has buffered frames
+ * @buffered: indicates whether or not frames are buffered for this TID
  *
  * If a driver buffers frames for a powersave station instead of passing
- * them back to mac80211 for retransmission, the station needs to be told
- * to wake up using the TIM bitmap in the beacon.
+ * them back to mac80211 for retransmission, the station may still need
+ * to be told that there are buffered frames via the TIM bit.
  *
- * This function sets the station's TIM bit - it will be cleared when the
- * station wakes up.
+ * This function informs mac80211 whether or not there are frames that are
+ * buffered in the driver for a given TID; mac80211 can then use this data
+ * to set the TIM bit (NOTE: This may call back into the driver's set_tim
+ * call! Beware of the locking!)
+ *
+ * If all frames are released to the station (due to PS-poll or uAPSD)
+ * then the driver needs to inform mac80211 that there no longer are
+ * frames buffered. However, when the station wakes up mac80211 assumes
+ * that all buffered frames will be transmitted and clears this data,
+ * drivers need to make sure they inform mac80211 about all buffered
+ * frames on the sleep transition (sta_notify() with %STA_NOTIFY_SLEEP).
+ *
+ * Note that technically mac80211 only needs to know this per AC, not per
+ * TID, but since driver buffering will inevitably happen per TID (since
+ * it is related to aggregation) it is easier to make mac80211 map the
+ * TID to the AC as required instead of keeping track in all drivers that
+ * use this API.
  */
-void ieee80211_sta_set_tim(struct ieee80211_sta *sta);
+void ieee80211_sta_set_buffered(struct ieee80211_sta *sta,
+                                u8 tid, bool buffered);
 
 /**
  * ieee80211_tx_status - transmit status callback
@@ -3029,6 +3209,24 @@ void ieee80211_sta_block_awake(struct ieee80211_hw *hw,
                                struct ieee80211_sta *pubsta, bool block);
 
 /**
+ * ieee80211_sta_eosp - notify mac80211 about end of SP
+ * @pubsta: the station
+ *
+ * When a device transmits frames in a way that it can't tell
+ * mac80211 in the TX status about the EOSP, it must clear the
+ * %IEEE80211_TX_STATUS_EOSP bit and call this function instead.
+ * This applies for PS-Poll as well as uAPSD.
+ *
+ * Note that there is no non-_irqsafe version right now as
+ * it wasn't needed, but just like _tx_status() and _rx()
+ * must not be mixed in irqsafe/non-irqsafe versions, this
+ * function must not be mixed with those either. Use the
+ * all irqsafe, or all non-irqsafe, don't mix! If you need
+ * the non-irqsafe version of this, you need to add it.
+ */
+void ieee80211_sta_eosp_irqsafe(struct ieee80211_sta *pubsta);
+
+/**
  * ieee80211_iter_keys - iterate keys programmed into the device
  * @hw: pointer obtained from ieee80211_alloc_hw()
  * @vif: virtual interface to iterate, may be %NULL for all
@@ -3444,4 +3642,9 @@ void ieee80211_enable_rssi_reports(struct ieee80211_vif *vif,
                                    int rssi_max_thold);
 
 void ieee80211_disable_rssi_reports(struct ieee80211_vif *vif);
+
+int ieee80211_add_srates_ie(struct ieee80211_vif *vif, struct sk_buff *skb);
+
+int ieee80211_add_ext_srates_ie(struct ieee80211_vif *vif,
+                                struct sk_buff *skb);
 #endif /* MAC80211_H */