Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem

10 files changed, 148 insertions, 57 deletions

diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index d706bf3badc8..5cfa579df476 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -358,11 +358,16 @@
  *      user space application). %NL80211_ATTR_FRAME is used to specify the
  *      frame contents (including header). %NL80211_ATTR_WIPHY_FREQ (and
  *      optionally %NL80211_ATTR_WIPHY_CHANNEL_TYPE) is used to indicate on
- *      which channel the frame is to be transmitted or was received. This
- *      channel has to be the current channel (remain-on-channel or the
- *      operational channel). When called, this operation returns a cookie
- *      (%NL80211_ATTR_COOKIE) that will be included with the TX status event
- *      pertaining to the TX request.
+ *      which channel the frame is to be transmitted or was received. If this
+ *      channel is not the current channel (remain-on-channel or the
+ *      operational channel) the device will switch to the given channel and
+ *      transmit the frame, optionally waiting for a response for the time
+ *      specified using %NL80211_ATTR_DURATION. When called, this operation
+ *      returns a cookie (%NL80211_ATTR_COOKIE) that will be included with the
+ *      TX status event pertaining to the TX request.
+ * @NL80211_CMD_FRAME_WAIT_CANCEL: When an off-channel TX was requested, this
+ *      command may be used with the corresponding cookie to cancel the wait
+ *      time if it is known that it is no longer necessary.
  * @NL80211_CMD_ACTION: Alias for @NL80211_CMD_FRAME for backward compatibility.
  * @NL80211_CMD_FRAME_TX_STATUS: Report TX status of a management frame
  *      transmitted with %NL80211_CMD_FRAME. %NL80211_ATTR_COOKIE identifies
@@ -493,6 +498,8 @@ enum nl80211_commands {
         NL80211_CMD_SET_CHANNEL,
         NL80211_CMD_SET_WDS_PEER,
 
+        NL80211_CMD_FRAME_WAIT_CANCEL,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -828,6 +835,12 @@ enum nl80211_commands {
  *
  * @NL80211_ATTR_MCAST_RATE: Multicast tx rate (in 100 kbps) for IBSS
  *
+ * @NL80211_ATTR_OFFCHANNEL_TX_OK: For management frame TX, the frame may be
+ *      transmitted on another channel when the channel given doesn't match
+ *      the current channel. If the current channel doesn't match and this
+ *      flag isn't set, the frame will be rejected. This is also used as an
+ *      nl80211 capability flag.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1002,6 +1015,8 @@ enum nl80211_attrs {
 
         NL80211_ATTR_MCAST_RATE,
 
+        NL80211_ATTR_OFFCHANNEL_TX_OK,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 623b704fdc42..9659eff52ca2 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -55,6 +55,10 @@ struct ssb_sprom {
         u8 tri5gl;              /* 5.2GHz TX isolation */
         u8 tri5g;               /* 5.3GHz TX isolation */
         u8 tri5gh;              /* 5.8GHz TX isolation */
+        u8 txpid2g[4];          /* 2GHz TX power index */
+        u8 txpid5gl[4];         /* 4.9 - 5.1GHz TX power index */
+        u8 txpid5g[4];          /* 5.1 - 5.5GHz TX power index */
+        u8 txpid5gh[4];         /* 5.5 - ...GHz TX power index */
         u8 rxpo2g;              /* 2GHz RX power offset */
         u8 rxpo5g;              /* 5GHz RX power offset */
         u8 rssisav2g;           /* 2GHz RSSI params */
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index 11daf9c140e7..489f7b6d61c5 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -299,6 +299,46 @@
 #define  SSB_SPROM4_AGAIN2_SHIFT        0
 #define  SSB_SPROM4_AGAIN3              0xFF00  /* Antenna 3 */
 #define  SSB_SPROM4_AGAIN3_SHIFT        8
+#define SSB_SPROM4_TXPID2G01            0x0062  /* TX Power Index 2GHz */
+#define  SSB_SPROM4_TXPID2G0            0x00FF
+#define  SSB_SPROM4_TXPID2G0_SHIFT      0
+#define  SSB_SPROM4_TXPID2G1            0xFF00
+#define  SSB_SPROM4_TXPID2G1_SHIFT      8
+#define SSB_SPROM4_TXPID2G23            0x0064  /* TX Power Index 2GHz */
+#define  SSB_SPROM4_TXPID2G2            0x00FF
+#define  SSB_SPROM4_TXPID2G2_SHIFT      0
+#define  SSB_SPROM4_TXPID2G3            0xFF00
+#define  SSB_SPROM4_TXPID2G3_SHIFT      8
+#define SSB_SPROM4_TXPID5G01            0x0066  /* TX Power Index 5GHz middle subband */
+#define  SSB_SPROM4_TXPID5G0            0x00FF
+#define  SSB_SPROM4_TXPID5G0_SHIFT      0
+#define  SSB_SPROM4_TXPID5G1            0xFF00
+#define  SSB_SPROM4_TXPID5G1_SHIFT      8
+#define SSB_SPROM4_TXPID5G23            0x0068  /* TX Power Index 5GHz middle subband */
+#define  SSB_SPROM4_TXPID5G2            0x00FF
+#define  SSB_SPROM4_TXPID5G2_SHIFT      0
+#define  SSB_SPROM4_TXPID5G3            0xFF00
+#define  SSB_SPROM4_TXPID5G3_SHIFT      8
+#define SSB_SPROM4_TXPID5GL01           0x006A  /* TX Power Index 5GHz low subband */
+#define  SSB_SPROM4_TXPID5GL0           0x00FF
+#define  SSB_SPROM4_TXPID5GL0_SHIFT     0
+#define  SSB_SPROM4_TXPID5GL1           0xFF00
+#define  SSB_SPROM4_TXPID5GL1_SHIFT     8
+#define SSB_SPROM4_TXPID5GL23           0x006C  /* TX Power Index 5GHz low subband */
+#define  SSB_SPROM4_TXPID5GL2           0x00FF
+#define  SSB_SPROM4_TXPID5GL2_SHIFT     0
+#define  SSB_SPROM4_TXPID5GL3           0xFF00
+#define  SSB_SPROM4_TXPID5GL3_SHIFT     8
+#define SSB_SPROM4_TXPID5GH01           0x006E  /* TX Power Index 5GHz high subband */
+#define  SSB_SPROM4_TXPID5GH0           0x00FF
+#define  SSB_SPROM4_TXPID5GH0_SHIFT     0
+#define  SSB_SPROM4_TXPID5GH1           0xFF00
+#define  SSB_SPROM4_TXPID5GH1_SHIFT     8
+#define SSB_SPROM4_TXPID5GH23           0x0070  /* TX Power Index 5GHz high subband */
+#define  SSB_SPROM4_TXPID5GH2           0x00FF
+#define  SSB_SPROM4_TXPID5GH2_SHIFT     0
+#define  SSB_SPROM4_TXPID5GH3           0xFF00
+#define  SSB_SPROM4_TXPID5GH3_SHIFT     8
 #define SSB_SPROM4_MAXP_BG              0x0080  /* Max Power BG in path 1 */
 #define  SSB_SPROM4_MAXP_BG_MASK        0x00FF  /* Mask for Max Power BG */
 #define  SSB_SPROM4_ITSSI_BG            0xFF00  /* Mask for path 1 itssi_bg */
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index e30e00834340..f3c5ed6d7bda 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -1,4 +1,4 @@
-/* 
+/*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (C) 2000-2001 Qualcomm Incorporated
 
@@ -12,13 +12,13 @@
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
    SOFTWARE IS DISCLAIMED.
 */
 
@@ -489,7 +489,7 @@ struct hci_rp_read_local_name {
 
 #define HCI_OP_WRITE_PG_TIMEOUT         0x0c18
 
-#define HCI_OP_WRITE_SCAN_ENABLE        0x0c1a
+#define HCI_OP_WRITE_SCAN_ENABLE        0x0c1a
         #define SCAN_DISABLED           0x00
         #define SCAN_INQUIRY            0x01
         #define SCAN_PAGE               0x02
@@ -874,7 +874,7 @@ struct hci_ev_si_security {
 
 struct hci_command_hdr {
         __le16  opcode;         /* OCF & OGF */
-        __u8    plen;
+        __u8    plen;
 } __packed;
 
 struct hci_event_hdr {
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ebec8c9a929d..9c08625617a1 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -44,15 +44,15 @@ struct inquiry_data {
 };
 
 struct inquiry_entry {
-        struct inquiry_entry    *next;
+        struct inquiry_entry    *next;
         __u32                   timestamp;
         struct inquiry_data     data;
 };
 
 struct inquiry_cache {
-        spinlock_t              lock;
+        spinlock_t              lock;
         __u32                   timestamp;
-        struct inquiry_entry    *list;
+        struct inquiry_entry    *list;
 };
 
 struct hci_conn_hash {
@@ -141,7 +141,7 @@ struct hci_dev {
         void                    *driver_data;
         void                    *core_data;
 
-        atomic_t                promisc;
+        atomic_t                promisc;
 
         struct dentry           *debugfs;
 
@@ -150,7 +150,7 @@ struct hci_dev {
 
         struct rfkill           *rfkill;
 
-        struct module           *owner;
+        struct module           *owner;
 
         int (*open)(struct hci_dev *hdev);
         int (*close)(struct hci_dev *hdev);
@@ -215,8 +215,8 @@ extern rwlock_t hci_dev_list_lock;
 extern rwlock_t hci_cb_list_lock;
 
 /* ----- Inquiry cache ----- */
-#define INQUIRY_CACHE_AGE_MAX   (HZ*30)   // 30 seconds
-#define INQUIRY_ENTRY_AGE_MAX   (HZ*60)   // 60 seconds
+#define INQUIRY_CACHE_AGE_MAX   (HZ*30)   /* 30 seconds */
+#define INQUIRY_ENTRY_AGE_MAX   (HZ*60)   /* 60 seconds */
 
 #define inquiry_cache_lock(c)           spin_lock(&c->lock)
 #define inquiry_cache_unlock(c)         spin_unlock(&c->lock)
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index c819c8bf9b68..7ad25ca60ec0 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -1,4 +1,4 @@
-/* 
+/*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (C) 2000-2001 Qualcomm Incorporated
    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
@@ -14,13 +14,13 @@
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
    SOFTWARE IS DISCLAIMED.
 */
 
@@ -417,11 +417,11 @@ static inline int l2cap_tx_window_full(struct sock *sk)
         return sub == pi->remote_tx_win;
 }
 
-#define __get_txseq(ctrl) ((ctrl) & L2CAP_CTRL_TXSEQ) >> 1
-#define __get_reqseq(ctrl) ((ctrl) & L2CAP_CTRL_REQSEQ) >> 8
-#define __is_iframe(ctrl) !((ctrl) & L2CAP_CTRL_FRAME_TYPE)
-#define __is_sframe(ctrl) (ctrl) & L2CAP_CTRL_FRAME_TYPE
-#define __is_sar_start(ctrl) ((ctrl) & L2CAP_CTRL_SAR) == L2CAP_SDU_START
+#define __get_txseq(ctrl)       (((ctrl) & L2CAP_CTRL_TXSEQ) >> 1)
+#define __get_reqseq(ctrl)      (((ctrl) & L2CAP_CTRL_REQSEQ) >> 8)
+#define __is_iframe(ctrl)       (!((ctrl) & L2CAP_CTRL_FRAME_TYPE))
+#define __is_sframe(ctrl)       ((ctrl) & L2CAP_CTRL_FRAME_TYPE)
+#define __is_sar_start(ctrl)    (((ctrl) & L2CAP_CTRL_SAR) == L2CAP_SDU_START)
 
 void l2cap_load(void);
 
diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 71047bc0af84..6eac4a760c3b 100644
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -1,5 +1,5 @@
-/* 
-   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
+/*
+   RFCOMM implementation for Linux Bluetooth stack (BlueZ)
    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
 
@@ -11,13 +11,13 @@
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
    SOFTWARE IS DISCLAIMED.
 */
 
@@ -105,7 +105,7 @@
 struct rfcomm_hdr {
         u8 addr;
         u8 ctrl;
-        u8 len;    // Actual size can be 2 bytes
+        u8 len;    /* Actual size can be 2 bytes */
 } __packed;
 
 struct rfcomm_cmd {
@@ -228,7 +228,7 @@ struct rfcomm_dlc {
 /* ---- RFCOMM SEND RPN ---- */
 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
                         u8 bit_rate, u8 data_bits, u8 stop_bits,
-                        u8 parity, u8 flow_ctrl_settings, 
+                        u8 parity, u8 flow_ctrl_settings,
                         u8 xon_char, u8 xoff_char, u16 param_mask);
 
 /* ---- RFCOMM DLCs (channels) ---- */
diff --git a/include/net/bluetooth/sco.h b/include/net/bluetooth/sco.h
index e28a2a771471..1e35c43657c8 100644
--- a/include/net/bluetooth/sco.h
+++ b/include/net/bluetooth/sco.h
@@ -1,4 +1,4 @@
-/* 
+/*
    BlueZ - Bluetooth protocol stack for Linux
    Copyright (C) 2000-2001 Qualcomm Incorporated
 
@@ -12,13 +12,13 @@
    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
-   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
-   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
-   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
+   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
+   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
-   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
+   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
+   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
    SOFTWARE IS DISCLAIMED.
 */
 
@@ -55,11 +55,11 @@ struct sco_conninfo {
 struct sco_conn {
         struct hci_conn *hcon;
 
-        bdaddr_t        *dst;
-        bdaddr_t        *src;
-        
+        bdaddr_t        *dst;
+        bdaddr_t        *src;
+
         spinlock_t      lock;
-        struct sock     *sk;
+        struct sock     *sk;
 
         unsigned int    mtu;
 };
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 0663945cfa48..6b2af7aeddd3 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1134,7 +1134,9 @@ struct cfg80211_pmksa {
  * @cancel_remain_on_channel: Cancel an on-going remain-on-channel operation.
  *      This allows the operation to be terminated prior to timeout based on
  *      the duration value.
- * @mgmt_tx: Transmit a management frame
+ * @mgmt_tx: Transmit a management frame.
+ * @mgmt_tx_cancel_wait: Cancel the wait time from transmitting a management
+ *      frame on another channel
  *
  * @testmode_cmd: run a test mode command
  *
@@ -1152,6 +1154,13 @@ struct cfg80211_pmksa {
  * @mgmt_frame_register: Notify driver that a management frame type was
  *      registered. Note that this callback may not sleep, and cannot run
  *      concurrently with itself.
+ *
+ * @set_antenna: Set antenna configuration (tx_ant, rx_ant) on the device.
+ *      Parameters are bitmaps of allowed antennas to use for TX/RX. Drivers may
+ *      reject TX/RX mask combinations they cannot support by returning -EINVAL
+ *      (also see nl80211.h @NL80211_ATTR_WIPHY_ANTENNA_TX).
+ *
+ * @get_antenna: Get current antenna configuration from device (tx_ant, rx_ant).
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy);
@@ -1291,10 +1300,13 @@ struct cfg80211_ops {
                                             u64 cookie);
 
         int     (*mgmt_tx)(struct wiphy *wiphy, struct net_device *dev,
-                          struct ieee80211_channel *chan,
+                          struct ieee80211_channel *chan, bool offchan,
                           enum nl80211_channel_type channel_type,
-                          bool channel_type_valid,
+                          bool channel_type_valid, unsigned int wait,
                           const u8 *buf, size_t len, u64 *cookie);
+        int     (*mgmt_tx_cancel_wait)(struct wiphy *wiphy,
+                                       struct net_device *dev,
+                                       u64 cookie);
 
         int     (*set_power_mgmt)(struct wiphy *wiphy, struct net_device *dev,
                                   bool enabled, int timeout);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index eaa4affd40cd..e411cf87fb41 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -2055,8 +2055,8 @@ static inline void ieee80211_rx_ni(struct ieee80211_hw *hw,
  *
  * This function may not be called in IRQ context. Calls to this function
  * for a single hardware must be synchronized against each other. Calls
- * to this function and ieee80211_tx_status_irqsafe() may not be mixed
- * for a single hardware.
+ * to this function, ieee80211_tx_status_ni() and ieee80211_tx_status_irqsafe()
+ * may not be mixed for a single hardware.
  *
  * @hw: the hardware the frame was transmitted by
  * @skb: the frame that was transmitted, owned by mac80211 after this call
@@ -2065,13 +2065,33 @@ void ieee80211_tx_status(struct ieee80211_hw *hw,
                          struct sk_buff *skb);
 
 /**
+ * ieee80211_tx_status_ni - transmit status callback (in process context)
+ *
+ * Like ieee80211_tx_status() but can be called in process context.
+ *
+ * Calls to this function, ieee80211_tx_status() and
+ * ieee80211_tx_status_irqsafe() may not be mixed
+ * for a single hardware.
+ *
+ * @hw: the hardware the frame was transmitted by
+ * @skb: the frame that was transmitted, owned by mac80211 after this call
+ */
+static inline void ieee80211_tx_status_ni(struct ieee80211_hw *hw,
+                                          struct sk_buff *skb)
+{
+        local_bh_disable();
+        ieee80211_tx_status(hw, skb);
+        local_bh_enable();
+}
+
+/**
  * ieee80211_tx_status_irqsafe - IRQ-safe transmit status callback
  *
  * Like ieee80211_tx_status() but can be called in IRQ context
  * (internally defers to a tasklet.)
  *
- * Calls to this function and ieee80211_tx_status() may not be mixed for a
- * single hardware.
+ * Calls to this function, ieee80211_tx_status() and
+ * ieee80211_tx_status_ni() may not be mixed for a single hardware.
  *
  * @hw: the hardware the frame was transmitted by
  * @skb: the frame that was transmitted, owned by mac80211 after this call