111 files changed, 918 insertions, 485 deletions

diff --git a/sys/dev/ath/ah_osdep.c b/sys/dev/ath/ah_osdep.c
index 23d967ec75e3..db9264546d23 100644
--- a/sys/dev/ath/ah_osdep.c
+++ b/sys/dev/ath/ah_osdep.c
@@ -444,7 +444,6 @@ ath_hal_modevent(module_t mod __unused, int type, void *data __unused)
 	default:
 		error = EOPNOTSUPP;
 		break;
-
 	}
 	return (error);
 }
diff --git a/sys/dev/ath/ah_osdep_ar5210.c b/sys/dev/ath/ah_osdep_ar5210.c
index 905befe9ca95..e47a2dc11054 100644
--- a/sys/dev/ath/ah_osdep_ar5210.c
+++ b/sys/dev/ath/ah_osdep_ar5210.c
@@ -64,7 +64,6 @@ ath_hal_ar5210_modevent(module_t mod __unused, int type, void *data __unused)
 	default:
 		error = EOPNOTSUPP;
 		break;
-
 	}
 	return (error);
 }
diff --git a/sys/dev/ath/ah_osdep_ar5211.c b/sys/dev/ath/ah_osdep_ar5211.c
index 92400965e55b..c87f9ff9b0cb 100644
--- a/sys/dev/ath/ah_osdep_ar5211.c
+++ b/sys/dev/ath/ah_osdep_ar5211.c
@@ -64,7 +64,6 @@ ath_hal_ar5211_modevent(module_t mod __unused, int type, void *data __unused)
 	default:
 		error = EOPNOTSUPP;
 		break;
-
 	}
 	return (error);
 }
diff --git a/sys/dev/ath/ah_osdep_ar5212.c b/sys/dev/ath/ah_osdep_ar5212.c
index 3bc21ef803ec..daaa81ff2509 100644
--- a/sys/dev/ath/ah_osdep_ar5212.c
+++ b/sys/dev/ath/ah_osdep_ar5212.c
@@ -85,7 +85,6 @@ ath_hal_ar5212_modevent(module_t mod __unused, int type, void *data __unused)
 	default:
 		error = EOPNOTSUPP;
 		break;
-
 	}
 	return (error);
 }
diff --git a/sys/dev/ath/ah_osdep_ar5416.c b/sys/dev/ath/ah_osdep_ar5416.c
index a735838068b6..058027b44c8f 100644
--- a/sys/dev/ath/ah_osdep_ar5416.c
+++ b/sys/dev/ath/ah_osdep_ar5416.c
@@ -92,7 +92,6 @@ ath_hal_ar5416_modevent(module_t mod __unused, int type, void *data __unused)
 	default:
 		error = EOPNOTSUPP;
 		break;
-
 	}
 	return (error);
 }
diff --git a/sys/dev/ath/ah_osdep_ar9300.c b/sys/dev/ath/ah_osdep_ar9300.c
index f481d7ea2a2d..70dbfc2c3d39 100644
--- a/sys/dev/ath/ah_osdep_ar9300.c
+++ b/sys/dev/ath/ah_osdep_ar9300.c
@@ -64,7 +64,6 @@ ath_hal_ar9300_modevent(module_t mod __unused, int type, void *data __unused)
 	default:
 		error = EOPNOTSUPP;
 		break;
-
 	}
 	return (error);
 }
diff --git a/sys/dev/ath/ath_dfs/null/dfs_null.c b/sys/dev/ath/ath_dfs/null/dfs_null.c
index 1463c8c96648..2c262d1c9ef5 100644
--- a/sys/dev/ath/ath_dfs/null/dfs_null.c
+++ b/sys/dev/ath/ath_dfs/null/dfs_null.c
@@ -54,7 +54,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 
 #include <sys/socket.h>
- 
+
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/if_media.h>
diff --git a/sys/dev/ath/ath_hal/ah.c b/sys/dev/ath/ath_hal/ah.c
index 7f5649ed4e8d..e2305d10b452 100644
--- a/sys/dev/ath/ath_hal/ah.c
+++ b/sys/dev/ath/ath_hal/ah.c
@@ -556,7 +556,6 @@ ath_hal_get_curmode(struct ath_hal *ah, const struct ieee80211_channel *chan)
 	return HAL_MODE_11NG_HT20;
 }
 
-
 typedef enum {
 	WIRELESS_MODE_11a   = 0,
 	WIRELESS_MODE_TURBO = 1,
@@ -971,7 +970,7 @@ ath_hal_getregdump(struct ath_hal *ah, const HAL_REGRANGE *regs,
 	}
 	return (char *) dp - (char *) dstbuf;
 }
- 
+
 static void
 ath_hal_setregs(struct ath_hal *ah, const HAL_REGWRITE *regs, int space)
 {
@@ -1127,7 +1126,6 @@ ath_hal_getTxQProps(struct ath_hal *ah,
 		return AH_FALSE;
 	}
 
-	qInfo->tqi_qflags = qi->tqi_qflags;
 	qInfo->tqi_ver = qi->tqi_ver;
 	qInfo->tqi_subtype = qi->tqi_subtype;
 	qInfo->tqi_qflags = qi->tqi_qflags;
@@ -1141,6 +1139,7 @@ ath_hal_getTxQProps(struct ath_hal *ah,
 	qInfo->tqi_cbrOverflowLimit = qi->tqi_cbrOverflowLimit;
 	qInfo->tqi_burstTime = qi->tqi_burstTime;
 	qInfo->tqi_readyTime = qi->tqi_readyTime;
+	qInfo->tqi_compBuf = qi->tqi_physCompBuf;
 	return AH_TRUE;
 }
 
diff --git a/sys/dev/ath/ath_hal/ah.h b/sys/dev/ath/ath_hal/ah.h
index b887e9f5afb4..e39ff2b7d03d 100644
--- a/sys/dev/ath/ath_hal/ah.h
+++ b/sys/dev/ath/ath_hal/ah.h
@@ -33,6 +33,18 @@
 #include "ah_osdep.h"
 
 /*
+ * Endianness macros; used by various structures and code.
+ */
+#define AH_BIG_ENDIAN           4321
+#define AH_LITTLE_ENDIAN        1234
+
+#if _BYTE_ORDER == _BIG_ENDIAN
+#define AH_BYTE_ORDER   AH_BIG_ENDIAN
+#else
+#define AH_BYTE_ORDER   AH_LITTLE_ENDIAN
+#endif
+
+/*
  * The maximum number of TX/RX chains supported.
  * This is intended to be used by various statistics gathering operations
  * (NF, RSSI, EVM).
@@ -727,7 +739,6 @@ typedef enum {
 	HAL_HT_EXTPROTSPACING_25 = 1,	/* 25 MHz spacing */
 } HAL_HT_EXTPROTSPACING;
 
-
 typedef enum {
 	HAL_RX_CLEAR_CTL_LOW	= 0x1,	/* force control channel to appear busy */
 	HAL_RX_CLEAR_EXT_LOW	= 0x2,	/* force extension channel to appear busy */
@@ -893,11 +904,13 @@ typedef struct {
 } HAL_ANI_STATS;
 
 typedef struct {
-	uint8_t		noiseImmunityLevel;
+	uint8_t		noiseImmunityLevel; /* Global for pre-AR9380; OFDM later*/
+	uint8_t		cckNoiseImmunityLevel; /* AR9380: CCK specific NI */
 	uint8_t		spurImmunityLevel;
 	uint8_t		firstepLevel;
 	uint8_t		ofdmWeakSigDetectOff;
 	uint8_t		cckWeakSigThreshold;
+	uint8_t		mrcCck;		/* MRC CCK is enabled */
 	uint32_t	listenTime;
 
 	/* NB: intentionally ordered so data exported to user space is first */
@@ -956,7 +969,7 @@ typedef struct {
  */
 typedef enum {
 	HAL_ANI_PRESENT = 0,			/* is ANI support present */
-	HAL_ANI_NOISE_IMMUNITY_LEVEL = 1,	/* set level */
+	HAL_ANI_NOISE_IMMUNITY_LEVEL = 1,	/* set level (global or ofdm) */
 	HAL_ANI_OFDM_WEAK_SIGNAL_DETECTION = 2,	/* enable/disable */
 	HAL_ANI_CCK_WEAK_SIGNAL_THR = 3,	/* enable/disable */
 	HAL_ANI_FIRSTEP_LEVEL = 4,		/* set level */
@@ -964,6 +977,7 @@ typedef enum {
 	HAL_ANI_MODE = 6,			/* 0 => manual, 1 => auto (XXX do not change) */
 	HAL_ANI_PHYERR_RESET = 7,		/* reset phy error stats */
 	HAL_ANI_MRC_CCK = 8,
+	HAL_ANI_CCK_NOISE_IMMUNITY_LEVEL = 9,	/* set level (cck) */
 } HAL_ANI_CMD;
 
 #define	HAL_ANI_ALL		0xffffffff
@@ -1038,7 +1052,6 @@ typedef enum {
 	HAL_DFS_MKK4_DOMAIN	= 3,	/* Japan dfs domain */
 } HAL_DFS_DOMAIN;
 
-
 /*
  * MFP decryption options for initializing the MAC.
  */
@@ -1311,7 +1324,7 @@ struct ath_hal {
 	void	  __ahdecl(*ah_setRxDP)(struct ath_hal*, uint32_t rxdp, HAL_RX_QUEUE);
 	void	  __ahdecl(*ah_enableReceive)(struct ath_hal*);
 	HAL_BOOL  __ahdecl(*ah_stopDmaReceive)(struct ath_hal*);
-	void	  __ahdecl(*ah_startPcuReceive)(struct ath_hal*);
+	void	  __ahdecl(*ah_startPcuReceive)(struct ath_hal*, HAL_BOOL);
 	void	  __ahdecl(*ah_stopPcuReceive)(struct ath_hal*);
 	void	  __ahdecl(*ah_setMulticastFilter)(struct ath_hal*,
 				uint32_t filter0, uint32_t filter1);
diff --git a/sys/dev/ath/ath_hal/ah_eeprom_9287.c b/sys/dev/ath/ath_hal/ah_eeprom_9287.c
index 974580d26394..42b3ff8b3252 100644
--- a/sys/dev/ath/ath_hal/ah_eeprom_9287.c
+++ b/sys/dev/ath/ath_hal/ah_eeprom_9287.c
@@ -207,11 +207,11 @@ static uint16_t
 v9287EepromGetSpurChan(struct ath_hal *ah, int ix, HAL_BOOL is2GHz)
 { 
 	HAL_EEPROM_9287 *ee = AH_PRIVATE(ah)->ah_eeprom;
-	
+
 	HALASSERT(is2GHz == AH_TRUE);
 	if (is2GHz != AH_TRUE)
 		return 0;	/* XXX ? */
-	
+
 	HALASSERT(0 <= ix && ix <  AR5416_EEPROM_MODAL_SPURS);
 	return ee->ee_base.modalHeader.spurChans[ix].spurChan;
 }
@@ -234,7 +234,6 @@ fbin2freq(uint8_t fbin, HAL_BOOL is2GHz)
 	return (uint16_t)((is2GHz) ? (2300 + fbin) : (4800 + 5 * fbin));
 }
 
-
 /*
  * Copy EEPROM Conformance Testing Limits contents 
  * into the allocated space
@@ -247,7 +246,7 @@ v9287EepromReadCTLInfo(struct ath_hal *ah, HAL_EEPROM_9287 *ee)
 {
 	RD_EDGES_POWER *rep = ee->ee_rdEdgesPower;
 	int i, j;
-	
+
 	HALASSERT(AR9287_NUM_CTLS <= sizeof(ee->ee_rdEdgesPower)/NUM_EDGES);
 
 	for (i = 0; ee->ee_base.ctlIndex[i] != 0 && i < AR9287_NUM_CTLS; i++) {
@@ -359,7 +358,7 @@ ath_hal_9287EepromAttach(struct ath_hal *ah)
 		len = ee->ee_base.baseEepHeader.length;
 	}
 	len = AH_MIN(len, sizeof(HAL_EEPROM_9287)) / sizeof(uint16_t);
-	
+
 	/* Apply the checksum, done in native eeprom format */
 	/* XXX - Need to check to make sure checksum calculation is done
 	 * in the correct endian format.  Right now, it seems it would
diff --git a/sys/dev/ath/ath_hal/ah_eeprom_9287.h b/sys/dev/ath/ath_hal/ah_eeprom_9287.h
index 891b4841b153..6d15a6df0204 100644
--- a/sys/dev/ath/ath_hal/ah_eeprom_9287.h
+++ b/sys/dev/ath/ath_hal/ah_eeprom_9287.h
@@ -166,5 +166,4 @@ typedef struct {
 typedef struct modal_eep_ar9287_header MODAL_EEP_9287_HEADER;
 typedef struct base_eep_ar9287_header BASE_EEP_9287_HEADER;
 
-
 #endif /* __AH_EEPROM_9287_H__ */
diff --git a/sys/dev/ath/ath_hal/ah_eeprom_v14.c b/sys/dev/ath/ath_hal/ah_eeprom_v14.c
index 3ae81217327d..d8bb96d56b28 100644
--- a/sys/dev/ath/ath_hal/ah_eeprom_v14.c
+++ b/sys/dev/ath/ath_hal/ah_eeprom_v14.c
@@ -249,7 +249,7 @@ static uint16_t
 v14EepromGetSpurChan(struct ath_hal *ah, int ix, HAL_BOOL is2GHz)
 { 
 	HAL_EEPROM_v14 *ee = AH_PRIVATE(ah)->ah_eeprom;
-	
+
 	HALASSERT(0 <= ix && ix <  AR5416_EEPROM_MODAL_SPURS);
 	return ee->ee_base.modalHeader[is2GHz].spurChans[ix].spurChan;
 }
@@ -284,7 +284,7 @@ v14EepromReadCTLInfo(struct ath_hal *ah, HAL_EEPROM_v14 *ee)
 {
 	RD_EDGES_POWER *rep = ee->ee_rdEdgesPower;
 	int i, j;
-	
+
 	HALASSERT(AR5416_NUM_CTLS <= sizeof(ee->ee_rdEdgesPower)/NUM_EDGES);
 
 	for (i = 0; ee->ee_base.ctlIndex[i] != 0 && i < AR5416_NUM_CTLS; i++) {
@@ -342,7 +342,7 @@ ath_hal_v14EepromAttach(struct ath_hal *ah)
 	uint32_t sum;
 
 	HALASSERT(ee == AH_NULL);
- 
+
 	/*
 	 * Don't check magic if we're supplied with an EEPROM block,
 	 * typically this is from Howl but it may also be from later
@@ -398,7 +398,7 @@ ath_hal_v14EepromAttach(struct ath_hal *ah)
 		len = ee->ee_base.baseEepHeader.length;
 	}
 	len = AH_MIN(len, sizeof(struct ar5416eeprom)) / sizeof(uint16_t);
-	
+
 	/* Apply the checksum, done in native eeprom format */
 	/* XXX - Need to check to make sure checksum calculation is done
 	 * in the correct endian format.  Right now, it seems it would
diff --git a/sys/dev/ath/ath_hal/ah_eeprom_v3.c b/sys/dev/ath/ath_hal/ah_eeprom_v3.c
index 9d7d011fcd65..2f1b2940de47 100644
--- a/sys/dev/ath/ath_hal/ah_eeprom_v3.c
+++ b/sys/dev/ath/ath_hal/ah_eeprom_v3.c
@@ -739,14 +739,14 @@ readEepromRawPowerCalInfo2413(struct ath_hal *ah, HAL_EEPROM *ee)
 	int numEEPROMWordsPerChannel;
 	uint32_t off;
 	HAL_BOOL ret = AH_FALSE;
-	
+
 	HALASSERT(ee->ee_version >= AR_EEPROM_VER5_0);
 	HALASSERT(ee->ee_eepMap == 2);
-	
+
 	pCal = ath_hal_malloc(sizeof(EEPROM_DATA_STRUCT_2413));
 	if (pCal == AH_NULL)
 		goto exit;
-	
+
 	off = ee->ee_eepMap2PowerCalStart;
 	if (ee->ee_Amode) {
 		OS_MEMZERO(pCal, sizeof(EEPROM_DATA_STRUCT_2413));
diff --git a/sys/dev/ath/ath_hal/ah_eeprom_v3.h b/sys/dev/ath/ath_hal/ah_eeprom_v3.h
index 2ec54713b261..be71a2486fde 100644
--- a/sys/dev/ath/ath_hal/ah_eeprom_v3.h
+++ b/sys/dev/ath/ath_hal/ah_eeprom_v3.h
@@ -231,7 +231,6 @@ typedef struct cornerCalInfo {
 #define NUM_TARGET_POWER_LOCATIONS_11B  4
 #define NUM_TARGET_POWER_LOCATIONS_11G  6
 
-
 typedef struct {
 	uint16_t	xpd_gain;
 	uint16_t	numPcdacs;
diff --git a/sys/dev/ath/ath_hal/ah_eeprom_v4k.c b/sys/dev/ath/ath_hal/ah_eeprom_v4k.c
index 69142ded5447..a9d16100d917 100644
--- a/sys/dev/ath/ath_hal/ah_eeprom_v4k.c
+++ b/sys/dev/ath/ath_hal/ah_eeprom_v4k.c
@@ -200,7 +200,7 @@ static uint16_t
 v4kEepromGetSpurChan(struct ath_hal *ah, int ix, HAL_BOOL is2GHz)
 { 
 	HAL_EEPROM_v4k *ee = AH_PRIVATE(ah)->ah_eeprom;
-	
+
 	HALASSERT(0 <= ix && ix <  AR5416_EEPROM_MODAL_SPURS);
 	HALASSERT(is2GHz);
 	return ee->ee_base.modalHeader.spurChans[ix].spurChan;
@@ -236,7 +236,7 @@ v4kEepromReadCTLInfo(struct ath_hal *ah, HAL_EEPROM_v4k *ee)
 {
 	RD_EDGES_POWER *rep = ee->ee_rdEdgesPower;
 	int i, j;
-	
+
 	HALASSERT(AR5416_4K_NUM_CTLS <= sizeof(ee->ee_rdEdgesPower)/NUM_EDGES);
 
 	for (i = 0; ee->ee_base.ctlIndex[i] != 0 && i < AR5416_4K_NUM_CTLS; i++) {
@@ -347,7 +347,7 @@ ath_hal_v4kEepromAttach(struct ath_hal *ah)
 		len = ee->ee_base.baseEepHeader.length;
 	}
 	len = AH_MIN(len, sizeof(struct ar5416eeprom_4k)) / sizeof(uint16_t);
-	
+
 	/* Apply the checksum, done in native eeprom format */
 	/* XXX - Need to check to make sure checksum calculation is done
 	 * in the correct endian format.  Right now, it seems it would
diff --git a/sys/dev/ath/ath_hal/ah_internal.h b/sys/dev/ath/ath_hal/ah_internal.h
index 6b584c2454b3..87c67d73ddca 100644
--- a/sys/dev/ath/ath_hal/ah_internal.h
+++ b/sys/dev/ath/ath_hal/ah_internal.h
@@ -849,7 +849,6 @@ typedef struct {
 	uint16_t	ee_data;	/* write data */
 } HAL_DIAG_EEVAL;
 
-
 typedef struct {
 	u_int offset;		/* reg offset */
 	uint32_t val;		/* reg value  */
diff --git a/sys/dev/ath/ath_hal/ah_regdomain.c b/sys/dev/ath/ath_hal/ah_regdomain.c
index 77bf417c2e41..c0ae4a94a4c6 100644
--- a/sys/dev/ath/ath_hal/ah_regdomain.c
+++ b/sys/dev/ath/ath_hal/ah_regdomain.c
@@ -695,7 +695,7 @@ getchannels(struct ath_hal *ah,
 		else if (cm->flags & IEEE80211_CHAN_2GHZ)
 			rd = rd2GHz;
 		else {
-			ath_hal_printf(ah, "%s: Unkonwn HAL flags 0x%x\n",
+			ath_hal_printf(ah, "%s: Unknown HAL flags 0x%x\n",
 			    __func__, cm->flags);
 			return HAL_EINVAL;
 		}
@@ -953,7 +953,6 @@ ath_hal_getctl(struct ath_hal *ah, const struct ieee80211_channel *c)
 	return ctl;
 }
 
-
 /*
  * Update the current dfsDomain setting based on the given
  * country code.
@@ -979,7 +978,6 @@ ath_hal_update_dfsdomain(struct ath_hal *ah)
 	    __func__, AH_PRIVATE(ah)->ah_dfsDomain);
 }
 
-
 /*
  * Return the max allowed antenna gain and apply any regulatory
  * domain specific changes.
diff --git a/sys/dev/ath/ath_hal/ah_regdomain/ah_rd_domains.h b/sys/dev/ath/ath_hal/ah_regdomain/ah_rd_domains.h
index 6555147b4e60..5956a804b03a 100644
--- a/sys/dev/ath/ath_hal/ah_regdomain/ah_rd_domains.h
+++ b/sys/dev/ath/ath_hal/ah_regdomain/ah_rd_domains.h
@@ -64,7 +64,6 @@
 	  W1(_fg) | W1(_fh) | W1(_fi) }
 
 static REG_DOMAIN regDomains[] = {
-
 	{.regDmnEnum		= DEBUG_REG_DMN,
 	 .conformanceTestLimit	= FCC,
 	 .dfsMask		= DFS_FCC3,
diff --git a/sys/dev/ath/ath_hal/ah_regdomain/ah_rd_freqbands.h b/sys/dev/ath/ath_hal/ah_regdomain/ah_rd_freqbands.h
index c7169113c11b..5475c6508972 100644
--- a/sys/dev/ath/ath_hal/ah_regdomain/ah_rd_freqbands.h
+++ b/sys/dev/ath/ath_hal/ah_regdomain/ah_rd_freqbands.h
@@ -198,7 +198,6 @@ static REG_DMN_FREQ_BAND regDmn5GhzFreq[] = {
 #define	W2_5825_5825	AFTER(W2_5180_5240)
 };
 
-
 /*
  * 5GHz Turbo (dynamic & static) tags
  */
@@ -373,7 +372,7 @@ static REG_DMN_FREQ_BAND regDmn2Ghz11gFreq[] = {
 #define	G3_2412_2462	AFTER(G2_2412_2462)
 	{ 2412, 2462, 27, 6,  5, 5, NO_DFS, NO_PSCAN },
 #define	G4_2412_2462	AFTER(G3_2412_2462)
-	
+
 	{ 2432, 2442, 20, 0, 20, 5, NO_DFS, NO_PSCAN },
 #define	G1_2432_2442	AFTER(G4_2412_2462)
 
diff --git a/sys/dev/ath/ath_hal/ah_soc.h b/sys/dev/ath/ath_hal/ah_soc.h
index 3d77b8234857..e391a2c869e8 100644
--- a/sys/dev/ath/ath_hal/ah_soc.h
+++ b/sys/dev/ath/ath_hal/ah_soc.h
@@ -62,18 +62,18 @@ struct ar531x_boarddata {
 #define BD_WLAN1_5G_EN  0x00040000   /* FLAG for radio0_2G */
 	uint16_t resetConfigGpio;   /* Reset factory GPIO pin */
 	uint16_t sysLedGpio;        /* System LED GPIO pin */
-	
+
 	uint32_t cpuFreq;           /* CPU core frequency in Hz */
 	uint32_t sysFreq;           /* System frequency in Hz */
 	uint32_t cntFreq;           /* Calculated C0_COUNT frequency */
-	
+
 	uint8_t  wlan0Mac[6];
 	uint8_t  enet0Mac[6];
 	uint8_t  enet1Mac[6];
-	
+
 	uint16_t pciId;             /* Pseudo PCIID for common code */
 	uint16_t memCap;            /* cap bank1 in MB */
-	
+
 	/* version 3 */
 	uint8_t  wlan1Mac[6];       /* (ar5212) */
 };
diff --git a/sys/dev/ath/ath_hal/ar5210/ar5210.h b/sys/dev/ath/ath_hal/ar5210/ar5210.h
index 756c8e03e51e..373c676e25b3 100644
--- a/sys/dev/ath/ath_hal/ar5210/ar5210.h
+++ b/sys/dev/ath/ath_hal/ar5210/ar5210.h
@@ -195,7 +195,7 @@ extern	uint32_t ar5210GetRxDP(struct ath_hal *, HAL_RX_QUEUE);
 extern	void ar5210SetRxDP(struct ath_hal *, uint32_t rxdp, HAL_RX_QUEUE);
 extern	void ar5210EnableReceive(struct ath_hal *);
 extern	HAL_BOOL ar5210StopDmaReceive(struct ath_hal *);
-extern	void ar5210StartPcuReceive(struct ath_hal *);
+extern	void ar5210StartPcuReceive(struct ath_hal *, HAL_BOOL);
 extern	void ar5210StopPcuReceive(struct ath_hal *);
 extern	void ar5210SetMulticastFilter(struct ath_hal *,
 		uint32_t filter0, uint32_t filter1);
diff --git a/sys/dev/ath/ath_hal/ar5210/ar5210_recv.c b/sys/dev/ath/ath_hal/ar5210/ar5210_recv.c
index 38295b99d1ca..a11e0300721f 100644
--- a/sys/dev/ath/ath_hal/ar5210/ar5210_recv.c
+++ b/sys/dev/ath/ath_hal/ar5210/ar5210_recv.c
@@ -50,7 +50,6 @@ ar5210SetRxDP(struct ath_hal *ah, uint32_t rxdp, HAL_RX_QUEUE qtype)
 	OS_REG_WRITE(ah, AR_RXDP, rxdp);
 }
 
-
 /*
  * Set Receive Enable bits.
  */
@@ -86,7 +85,7 @@ ar5210StopDmaReceive(struct ath_hal *ah)
  * Start Transmit at the PCU engine (unpause receive)
  */
 void
-ar5210StartPcuReceive(struct ath_hal *ah)
+ar5210StartPcuReceive(struct ath_hal *ah, HAL_BOOL is_scanning)
 {
 	ar5210UpdateDiagReg(ah,
 		OS_REG_READ(ah, AR_DIAG_SW) & ~(AR_DIAG_SW_DIS_RX));
diff --git a/sys/dev/ath/ath_hal/ar5210/ar5210_reset.c b/sys/dev/ath/ath_hal/ar5210/ar5210_reset.c
index b5656fb36419..bf1b9683a2cc 100644
--- a/sys/dev/ath/ath_hal/ar5210/ar5210_reset.c
+++ b/sys/dev/ath/ath_hal/ar5210/ar5210_reset.c
@@ -611,7 +611,6 @@ ar5210SetResetReg(struct ath_hal *ah, uint32_t resetMask, u_int delay)
 	return rt;
 }
 
-
 /*
  * Returns: the pcdac value
  */
diff --git a/sys/dev/ath/ath_hal/ar5211/ar5211.h b/sys/dev/ath/ath_hal/ar5211/ar5211.h
index 7188966ef9ea..186e69e9cd84 100644
--- a/sys/dev/ath/ath_hal/ar5211/ar5211.h
+++ b/sys/dev/ath/ath_hal/ar5211/ar5211.h
@@ -218,7 +218,7 @@ extern	uint32_t ar5211GetRxDP(struct ath_hal *, HAL_RX_QUEUE);
 extern	void ar5211SetRxDP(struct ath_hal *, uint32_t rxdp, HAL_RX_QUEUE);
 extern	void ar5211EnableReceive(struct ath_hal *);
 extern	HAL_BOOL ar5211StopDmaReceive(struct ath_hal *);
-extern	void ar5211StartPcuReceive(struct ath_hal *);
+extern	void ar5211StartPcuReceive(struct ath_hal *, HAL_BOOL);
 extern	void ar5211StopPcuReceive(struct ath_hal *);
 extern	void ar5211SetMulticastFilter(struct ath_hal *,
 		uint32_t filter0, uint32_t filter1);
diff --git a/sys/dev/ath/ath_hal/ar5211/ar5211_keycache.c b/sys/dev/ath/ath_hal/ar5211/ar5211_keycache.c
index 8d703023edb3..7a8ed460ff80 100644
--- a/sys/dev/ath/ath_hal/ar5211/ar5211_keycache.c
+++ b/sys/dev/ath/ath_hal/ar5211/ar5211_keycache.c
@@ -163,7 +163,6 @@ ar5211SetKeyCacheEntry(struct ath_hal *ah, uint16_t entry,
 	if (k->kv_len <= 104 / NBBY)
 		key4 &= 0xff;
 
-
 	/*
 	 * Note: WEP key cache hardware requires that each double-word
 	 * pair be written in even/odd order (since the destination is
diff --git a/sys/dev/ath/ath_hal/ar5211/ar5211_misc.c b/sys/dev/ath/ath_hal/ar5211/ar5211_misc.c
index 4395818ab2bd..ea1327b11a6a 100644
--- a/sys/dev/ath/ath_hal/ar5211/ar5211_misc.c
+++ b/sys/dev/ath/ath_hal/ar5211/ar5211_misc.c
@@ -708,7 +708,6 @@ ar5211Get11nExtBusy(struct ath_hal *ah)
 	return (0);
 }
 
-
 /*
  * There's no channel survey support for the AR5211.
  */
diff --git a/sys/dev/ath/ath_hal/ar5211/ar5211_phy.c b/sys/dev/ath/ath_hal/ar5211/ar5211_phy.c
index 6507c879ed92..42d9665396a1 100644
--- a/sys/dev/ath/ath_hal/ar5211/ar5211_phy.c
+++ b/sys/dev/ath/ath_hal/ar5211/ar5211_phy.c
@@ -81,7 +81,6 @@ HAL_RATE_TABLE ar5211_11b_table = {
 #undef	CCK
 #undef	TURBO
 
-
 const HAL_RATE_TABLE *
 ar5211GetRateTable(struct ath_hal *ah, u_int mode)
 {
diff --git a/sys/dev/ath/ath_hal/ar5211/ar5211_recv.c b/sys/dev/ath/ath_hal/ar5211/ar5211_recv.c
index 9b3bb677d5d6..1922f8775d54 100644
--- a/sys/dev/ath/ath_hal/ar5211/ar5211_recv.c
+++ b/sys/dev/ath/ath_hal/ar5211/ar5211_recv.c
@@ -51,7 +51,6 @@ ar5211SetRxDP(struct ath_hal *ah, uint32_t rxdp, HAL_RX_QUEUE qtype)
 	HALASSERT(OS_REG_READ(ah, AR_RXDP) == rxdp);
 }
 
-
 /*
  * Set Receive Enable bits.
  */
@@ -87,7 +86,7 @@ ar5211StopDmaReceive(struct ath_hal *ah)
  * Start Transmit at the PCU engine (unpause receive)
  */
 void
-ar5211StartPcuReceive(struct ath_hal *ah)
+ar5211StartPcuReceive(struct ath_hal *ah, HAL_BOOL is_scanning)
 {
 	OS_REG_WRITE(ah, AR_DIAG_SW,
 		OS_REG_READ(ah, AR_DIAG_SW) & ~(AR_DIAG_SW_DIS_RX));
diff --git a/sys/dev/ath/ath_hal/ar5211/ar5211_xmit.c b/sys/dev/ath/ath_hal/ar5211/ar5211_xmit.c
index 4bcb8fd6497a..9b32c4de496e 100644
--- a/sys/dev/ath/ath_hal/ar5211/ar5211_xmit.c
+++ b/sys/dev/ath/ath_hal/ar5211/ar5211_xmit.c
@@ -193,7 +193,6 @@ setTxQInterrupts(struct ath_hal *ah, HAL_TX_QUEUE_INFO *qi)
 		AR_IMR_S2_QCU_TXURN, ahp->ah_txUrnInterruptMask);
 }
 
-
 /*
  * Free a tx DCU/QCU combination.
  */
@@ -677,7 +676,6 @@ ar5211GetTxCompletionRates(struct ath_hal *ah, const struct ath_desc *ds0, int *
 	return AH_FALSE;
 }
 
-
 void
 ar5211SetTxDescLink(struct ath_hal *ah, void *ds, uint32_t link)
 {
diff --git a/sys/dev/ath/ath_hal/ar5211/ar5211phy.h b/sys/dev/ath/ath_hal/ar5211/ar5211phy.h
index c344cdc9b054..9e44b903b085 100644
--- a/sys/dev/ath/ath_hal/ar5211/ar5211phy.h
+++ b/sys/dev/ath/ath_hal/ar5211/ar5211phy.h
@@ -48,7 +48,6 @@
 #define	AR_PHY_PLL_CTL_40	0x18	/* 40 MHz */
 #define	AR_PHY_PLL_CTL_20	0x13	/* 20 MHz half rate 11a for emulation */
 
-
 #define	AR_PHY_RX_DELAY	0x9914	/* PHY analog_power_on_time, in 100ns increments */
 #define	AR_PHY_RX_DELAY_M	0x00003FFF	/* Mask for delay from active assertion (wake up) */
 				/* to enable_receiver */
diff --git a/sys/dev/ath/ath_hal/ar5211/ar5211reg.h b/sys/dev/ath/ath_hal/ar5211/ar5211reg.h
index ef2fb863d815..3cbdacc972c1 100644
--- a/sys/dev/ath/ath_hal/ar5211/ar5211reg.h
+++ b/sys/dev/ath/ath_hal/ar5211/ar5211reg.h
@@ -808,7 +808,6 @@
 #define	AR5211_USEC_RX_LAT_M	0x1F800000	/* Rx latency */
 #define	AR5211_USEC_RX_LAT_S	23
 
-
 #define	AR_BEACON_PERIOD	0x0000FFFF	/* Beacon period in TU/msec */
 #define	AR_BEACON_PERIOD_S	0		/* Byte offset of PERIOD start*/
 #define	AR_BEACON_TIM		0x007F0000	/* Byte offset of TIM start */
diff --git a/sys/dev/ath/ath_hal/ar5212/ar2316.c b/sys/dev/ath/ath_hal/ar5212/ar2316.c
index 186e72e9856c..1259c777d99c 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar2316.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar2316.c
@@ -629,7 +629,7 @@ ar2316GetMaxPower(struct ath_hal *ah, const RAW_DATA_PER_CHANNEL_2316 *data)
 {
 	uint32_t ii;
 	uint16_t Pmax=0,numVpd;
-	
+
 	for (ii=0; ii< MAX_NUM_PDGAINS_PER_CHANNEL; ii++) {
 		/* work forwards cuase lowest pdGain for highest power */
 		numVpd = data->pDataPerPDGain[ii].numVpd;
@@ -664,7 +664,7 @@ ar2316GetChannelMaxMinPower(struct ath_hal *ah,
 
 	numChannels = pRawDataset->numChannels;
 	data = pRawDataset->pDataPerChannel;
-	
+
 	/* Make sure the channel is in the range of the TP values 
 	 *  (freq piers)
 	 */
diff --git a/sys/dev/ath/ath_hal/ar5212/ar2317.c b/sys/dev/ath/ath_hal/ar5212/ar2317.c
index 29a9b369f3a5..814e4318b39d 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar2317.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar2317.c
@@ -608,7 +608,7 @@ ar2317GetMaxPower(struct ath_hal *ah, const RAW_DATA_PER_CHANNEL_2317 *data)
 	uint32_t ii;
 	uint16_t Pmax=0,numVpd;
 	uint16_t vpdmax;
-	
+
 	for (ii=0; ii< MAX_NUM_PDGAINS_PER_CHANNEL; ii++) {
 		/* work forwards cuase lowest pdGain for highest power */
 		numVpd = data->pDataPerPDGain[ii].numVpd;
@@ -644,7 +644,7 @@ ar2317GetChannelMaxMinPower(struct ath_hal *ah,
 
 	numChannels = pRawDataset->numChannels;
 	data = pRawDataset->pDataPerChannel;
-	
+
 	/* Make sure the channel is in the range of the TP values 
 	 *  (freq piers)
 	 */
diff --git a/sys/dev/ath/ath_hal/ar5212/ar2413.c b/sys/dev/ath/ath_hal/ar5212/ar2413.c
index e2a8d0203360..3c1ce6805a2a 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar2413.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar2413.c
@@ -624,7 +624,7 @@ ar2413GetMaxPower(struct ath_hal *ah, const RAW_DATA_PER_CHANNEL_2413 *data)
 {
 	uint32_t ii;
 	uint16_t Pmax=0,numVpd;
-	
+
 	for (ii=0; ii< MAX_NUM_PDGAINS_PER_CHANNEL; ii++) {
 		/* work forwards cuase lowest pdGain for highest power */
 		numVpd = data->pDataPerPDGain[ii].numVpd;
@@ -659,7 +659,7 @@ ar2413GetChannelMaxMinPower(struct ath_hal *ah,
 
 	numChannels = pRawDataset->numChannels;
 	data = pRawDataset->pDataPerChannel;
-	
+
 	/* Make sure the channel is in the range of the TP values 
 	 *  (freq piers)
 	 */
diff --git a/sys/dev/ath/ath_hal/ar5212/ar2425.c b/sys/dev/ath/ath_hal/ar5212/ar2425.c
index 9159ad2370d1..979f45b3619e 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar2425.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar2425.c
@@ -492,7 +492,6 @@ ar2425getGainBoundariesAndPdadcsForPowers(struct ath_hal *ah, uint16_t channel,
 	HALDEBUG(ah, HAL_DEBUG_RFPARAM, "<==%s\n", __func__);
 }
 
-
 /* Same as 2413 set power table */
 static HAL_BOOL
 ar2425SetPowerTable(struct ath_hal *ah,
@@ -586,7 +585,7 @@ ar2425GetMaxPower(struct ath_hal *ah, const RAW_DATA_PER_CHANNEL_2413 *data)
 {
 	uint32_t ii;
 	uint16_t Pmax=0,numVpd;
-	
+
 	for (ii=0; ii< MAX_NUM_PDGAINS_PER_CHANNEL; ii++) {
 		/* work forwards cuase lowest pdGain for highest power */
 		numVpd = data->pDataPerPDGain[ii].numVpd;
@@ -622,7 +621,7 @@ ar2425GetChannelMaxMinPower(struct ath_hal *ah,
 
 	numChannels = pRawDataset->numChannels;
 	data = pRawDataset->pDataPerChannel;
-	
+
 	/* Make sure the channel is in the range of the TP values 
 	 *  (freq piers)
 	 */
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5111.c b/sys/dev/ath/ath_hal/ar5212/ar5111.c
index 128332266b52..fe8acccd0691 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5111.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5111.c
@@ -336,7 +336,6 @@ ar5111SetRfRegs(struct ath_hal *ah, const struct ieee80211_channel *chan,
         	ar5212ModifyRfBuffer(rfReg, rfWaitS, 5, 19, 0);
         	ar5212ModifyRfBuffer(rfReg, rfWaitI, 5, 24, 0);
         	ar5212ModifyRfBuffer(rfReg, rfMaxTime, 2, 49, 0);
-
 	}
 
 	HAL_INI_WRITE_BANK(ah, ar5212Bank7_5111, rfReg, regWrites);
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5112.c b/sys/dev/ath/ath_hal/ar5212/ar5112.c
index 1e9e20355677..0c3a6032e5fa 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5112.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5112.c
@@ -281,7 +281,7 @@ ar5112SetRfRegs(struct ath_hal *ah,
 		ar5212ModifyRfBuffer(priv->Bank6Data, ob5GHz, 3, 279, 0);
 		ar5212ModifyRfBuffer(priv->Bank6Data, db5GHz, 3, 282, 0);
 	}
-	
+
 	/* Lower synth voltage for X112 Rev 2.0 only */
 	if (IS_RADX112_REV2(ah)) {
 		/* Non-Reversed analyg registers - so values are pre-reversed */
@@ -763,7 +763,7 @@ ar5112GetMinPower(struct ath_hal *ah, const EXPN_DATA_PER_CHANNEL_5112 *data)
 	retVal = minPwr - (minPcdac*2);
 	return(retVal);
 }
-	
+
 static HAL_BOOL
 ar5112GetChannelMaxMinPower(struct ath_hal *ah,
 	const struct ieee80211_channel *chan,
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5212.h b/sys/dev/ath/ath_hal/ar5212/ar5212.h
index 0baba50c55e6..f80f88c5df85 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5212.h
+++ b/sys/dev/ath/ath_hal/ar5212/ar5212.h
@@ -539,7 +539,7 @@ extern	uint32_t ar5212GetRxDP(struct ath_hal *ath, HAL_RX_QUEUE);
 extern	void ar5212SetRxDP(struct ath_hal *ah, uint32_t rxdp, HAL_RX_QUEUE);
 extern	void ar5212EnableReceive(struct ath_hal *ah);
 extern	HAL_BOOL ar5212StopDmaReceive(struct ath_hal *ah);
-extern	void ar5212StartPcuReceive(struct ath_hal *ah);
+extern	void ar5212StartPcuReceive(struct ath_hal *ah, HAL_BOOL);
 extern	void ar5212StopPcuReceive(struct ath_hal *ah);
 extern	void ar5212SetMulticastFilter(struct ath_hal *ah,
 		uint32_t filter0, uint32_t filter1);
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5212_ani.c b/sys/dev/ath/ath_hal/ar5212/ar5212_ani.c
index 4e2cd683df8c..eb9999e1ca5d 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5212_ani.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5212_ani.c
@@ -225,7 +225,7 @@ ar5212AniControl(struct ath_hal *ah, HAL_ANI_CMD cmd, int param)
 	struct ath_hal_5212 *ahp = AH5212(ah);
 	struct ar5212AniState *aniState = ahp->ah_curani;
 	const struct ar5212AniParams *params = AH_NULL;
-	
+
 	/*
 	 * This function may be called before there's a current
 	 * channel (eg to disable ANI.)
@@ -784,7 +784,7 @@ ar5212AniLowerImmunity(struct ath_hal *ah)
 	struct ath_hal_5212 *ahp = AH5212(ah);
 	struct ar5212AniState *aniState;
 	const struct ar5212AniParams *params;
-	
+
 	HALASSERT(ANI_ENA(ah));
 
 	aniState = ahp->ah_curani;
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5212_interrupts.c b/sys/dev/ath/ath_hal/ar5212/ar5212_interrupts.c
index ead62adfce48..b52045baea19 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5212_interrupts.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5212_interrupts.c
@@ -27,7 +27,6 @@
 #include "ar5212/ar5212reg.h"
 #include "ar5212/ar5212phy.h"
 
-
 /*
  * Checks to see if an interrupt is pending on our NIC
  *
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5212_keycache.c b/sys/dev/ath/ath_hal/ar5212/ar5212_keycache.c
index fa6936231952..8daaf250ec0b 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5212_keycache.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5212_keycache.c
@@ -245,7 +245,6 @@ ar5212SetKeyCacheEntry(struct ath_hal *ah, uint16_t entry,
 		OS_REG_WRITE(ah, AR_KEYTABLE_TYPE(entry), keyType);
 		(void) ar5212SetKeyCacheEntryMac(ah, entry, mac);
 
-
 		/*
 		 * Write MIC entry according to new or old key layout.
 		 * The MISC_MODE register is assumed already set so
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5212_misc.c b/sys/dev/ath/ath_hal/ar5212/ar5212_misc.c
index 6450c8d6f426..577e1e7491b3 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5212_misc.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5212_misc.c
@@ -623,7 +623,7 @@ ar5212SetCoverageClass(struct ath_hal *ah, uint8_t coverageclass, int now)
 		 * timeouts. This value is in core clocks.
   		 */
 		timeout = ACK_CTS_TIMEOUT_11A + (coverageclass * 3 * clkRate);
-	
+
 		/*
 		 * Write the values: slot, eifs, ack/cts timeouts.
 		 */
@@ -1194,7 +1194,6 @@ ar5212EnableDfs(struct ath_hal *ah, HAL_PHYERR_PARAM *pe)
 		val &= ~ AR_PHY_RADAR_0_ENA;
 
 	if (IS_5413(ah)) {
-
 		if (pe->pe_blockradar == 1)
 			OS_REG_SET_BIT(ah, AR_PHY_RADAR_2,
 			    AR_PHY_RADAR_2_BLOCKOFDMWEAK);
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5212_phy.c b/sys/dev/ath/ath_hal/ar5212/ar5212_phy.c
index 6f9c9dc1744b..ba56477fa506 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5212_phy.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5212_phy.c
@@ -129,7 +129,6 @@ HAL_RATE_TABLE ar5212_11b_table = {
 	},
 };
 
-
 /* Venice TODO: roundUpRate() is broken when the rate table does not represent rates
  * in increasing order  e.g.  5.5, 11, 6, 9.    
  * An average rate of 6 Mbps will currently map to 11 Mbps. 
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5212_recv.c b/sys/dev/ath/ath_hal/ar5212/ar5212_recv.c
index a2e36be5f70e..8ead1250fb87 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5212_recv.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5212_recv.c
@@ -87,7 +87,7 @@ ar5212StopDmaReceive(struct ath_hal *ah)
  * Start Transmit at the PCU engine (unpause receive)
  */
 void
-ar5212StartPcuReceive(struct ath_hal *ah)
+ar5212StartPcuReceive(struct ath_hal *ah, HAL_BOOL is_scanning)
 {
 	struct ath_hal_private *ahp = AH_PRIVATE(ah);
 
@@ -95,8 +95,8 @@ ar5212StartPcuReceive(struct ath_hal *ah)
 	OS_REG_WRITE(ah, AR_DIAG_SW,
 		OS_REG_READ(ah, AR_DIAG_SW) &~ AR_DIAG_RX_DIS);
 	ar5212EnableMibCounters(ah);
-	/* NB: restore current settings */
-	ar5212AniReset(ah, ahp->ah_curchan, ahp->ah_opmode, AH_TRUE);
+	/* NB: restore current settings if we're not scanning */
+	ar5212AniReset(ah, ahp->ah_curchan, ahp->ah_opmode, !is_scanning);
 }
 
 /*
@@ -265,7 +265,6 @@ ar5212ProcRxDesc(struct ath_hal *ah, struct ath_desc *ds,
 	rs->rs_datalen = ads->ds_rxstatus0 & AR_DataLen;
 	rs->rs_tstamp = MS(ads->ds_rxstatus1, AR_RcvTimestamp);
 	rs->rs_status = 0;
-	/* XXX what about KeyCacheMiss? */
 	rs->rs_rssi = MS(ads->ds_rxstatus0, AR_RcvSigStrength);
 	/* discard invalid h/w rssi data */
 	if (rs->rs_rssi == -128)
@@ -274,6 +273,8 @@ ar5212ProcRxDesc(struct ath_hal *ah, struct ath_desc *ds,
 		rs->rs_keyix = MS(ads->ds_rxstatus1, AR_KeyIdx);
 	else
 		rs->rs_keyix = HAL_RXKEYIX_INVALID;
+	if (ads->ds_rxstatus1 & AR_KeyCacheMiss)
+		rs->rs_status |= HAL_RXERR_KEYMISS;
 	/* NB: caller expected to do rate table mapping */
 	rs->rs_rate = MS(ads->ds_rxstatus0, AR_RcvRate);
 	rs->rs_antenna  = MS(ads->ds_rxstatus0, AR_RcvAntenna);
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5212_reset.c b/sys/dev/ath/ath_hal/ar5212/ar5212_reset.c
index a5e9ca65d056..12fe41b0c19f 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5212_reset.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5212_reset.c
@@ -692,7 +692,7 @@ done:
 	HALDEBUG(ah, HAL_DEBUG_RESET, "%s: done\n", __func__);
 
 	RESTORE_CCK(ah, chan, isBmode);
-	
+
 	OS_MARK(ah, AH_MARK_RESET_DONE, 0);
 
 	return AH_TRUE;
@@ -1192,7 +1192,6 @@ ar5212MacStop(struct ath_hal *ah)
 	return status;
 }
 
-
 /*
  * Write the given reset bit mask into the reset register
  */
@@ -1923,7 +1922,6 @@ ar5212SetSpurMitigation(struct ath_hal *ah,
 #undef CHAN_TO_SPUR
 }
 
-
 /*
  * Delta slope coefficient computation.
  * Required for OFDM operation.
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5212_xmit.c b/sys/dev/ath/ath_hal/ar5212/ar5212_xmit.c
index 6b8730b0d063..cebaa989ef8d 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5212_xmit.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5212_xmit.c
@@ -107,7 +107,6 @@ ar5212GetTxQueueProps(struct ath_hal *ah, int q, HAL_TXQ_INFO *qInfo)
 	struct ath_hal_5212 *ahp = AH5212(ah);
 	HAL_CAPABILITIES *pCap = &AH_PRIVATE(ah)->ah_caps;
 
-
 	if (q >= pCap->halTotalQueues) {
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: invalid queue num %u\n",
 		    __func__, q);
@@ -346,7 +345,7 @@ ar5212ResetTxQueue(struct ath_hal *ah, u_int q)
 			  SM(qi->tqi_readyTime, AR_Q_RDYTIMECFG_INT)
 			| AR_Q_RDYTIMECFG_ENA);
 	}
-	
+
 	OS_REG_WRITE(ah, AR_DCHNTIME(q),
 		  SM(qi->tqi_burstTime, AR_D_CHNTIME_DUR)
 		| (qi->tqi_burstTime ? AR_D_CHNTIME_EN : 0));
@@ -473,7 +472,7 @@ ar5212ResetTxQueue(struct ath_hal *ah, u_int q)
 			     OS_REG_READ(ah, AR_Q0_MISC + 4*q)
 			     | AR_Q_MISC_QCU_COMP_EN);
 	}
-	
+
 	/*
 	 * Always update the secondary interrupt mask registers - this
 	 * could be a new queue getting enabled in a running system or
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5212phy.h b/sys/dev/ath/ath_hal/ar5212/ar5212phy.h
index a91f2c10ee87..74ccb268fa0d 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5212phy.h
+++ b/sys/dev/ath/ath_hal/ar5212/ar5212phy.h
@@ -78,7 +78,6 @@
 #define AR_PHY_TSTDAC_CONST_Q_S	9
 #define AR_PHY_TSTDAC_CONST_I	0x000001FF
 
-
 #define	AR_PHY_SETTLING		0x9844
 #define AR_PHY_SETTLING_AGC 0x0000007F
 #define AR_PHY_SETTLING_AGC_S   0
diff --git a/sys/dev/ath/ath_hal/ar5212/ar5413.c b/sys/dev/ath/ath_hal/ar5212/ar5413.c
index 1d57b9ec7450..1b1817c6c3c4 100644
--- a/sys/dev/ath/ath_hal/ar5212/ar5413.c
+++ b/sys/dev/ath/ath_hal/ar5212/ar5413.c
@@ -241,7 +241,6 @@ ar5413SetRfRegs(struct ath_hal *ah,
 	} else {
         	ar5212ModifyRfBuffer(priv->Bank6Data, ob5GHz, 3, 247, 0);
         	ar5212ModifyRfBuffer(priv->Bank6Data, db5GHz, 3, 244, 0);
-
 	}
 
 	/* Bank 7 Setup */
@@ -668,7 +667,7 @@ ar5413GetMaxPower(struct ath_hal *ah, const RAW_DATA_PER_CHANNEL_2413 *data)
 {
 	uint32_t ii;
 	uint16_t Pmax=0,numVpd;
-	
+
 	for (ii=0; ii< MAX_NUM_PDGAINS_PER_CHANNEL; ii++) {
 		/* work forwards cuase lowest pdGain for highest power */
 		numVpd = data->pDataPerPDGain[ii].numVpd;
@@ -705,7 +704,7 @@ ar5413GetChannelMaxMinPower(struct ath_hal *ah,
 
 	numChannels = pRawDataset->numChannels;
 	data = pRawDataset->pDataPerChannel;
-	
+
 	/* Make sure the channel is in the range of the TP values 
 	 *  (freq piers)
 	 */
diff --git a/sys/dev/ath/ath_hal/ar5312/ar5312_eeprom.c b/sys/dev/ath/ath_hal/ar5312/ar5312_eeprom.c
index 9b79c36c323f..74a7394665ee 100644
--- a/sys/dev/ath/ath_hal/ar5312/ar5312_eeprom.c
+++ b/sys/dev/ath/ath_hal/ar5312/ar5312_eeprom.c
@@ -20,7 +20,6 @@
  */
 #include "opt_ah.h"
 
-
 #ifdef AH_SUPPORT_AR5312
 
 #include "ah.h"
@@ -39,7 +38,7 @@ ar5312EepromRead(struct ath_hal *ah, u_int off, uint16_t *dataIn)
         int i,offset;
 	const char *eepromAddr = AR5312_RADIOCONFIG(ah);
 	uint8_t *data;
-	
+
 	data = (uint8_t *) dataIn;
 	for (i=0,offset=2*off; i<2; i++,offset++) {
 		data[i] = eepromAddr[offset];
diff --git a/sys/dev/ath/ath_hal/ar5312/ar5312_gpio.c b/sys/dev/ath/ath_hal/ar5312/ar5312_gpio.c
index 809904d649b5..84bfd50099c3 100644
--- a/sys/dev/ath/ath_hal/ar5312/ar5312_gpio.c
+++ b/sys/dev/ath/ath_hal/ar5312/ar5312_gpio.c
@@ -129,5 +129,4 @@ ar5312GpioSetIntr(struct ath_hal *ah, u_int gpio, uint32_t ilevel)
 	(void) ar5212SetInterrupts(ah, AH5212(ah)->ah_maskReg | HAL_INT_GPIO);
 }
 
-
 #endif /* AH_SUPPORT_AR5312 */
diff --git a/sys/dev/ath/ath_hal/ar5312/ar5312_interrupts.c b/sys/dev/ath/ath_hal/ar5312/ar5312_interrupts.c
index 43cdda719db6..926fcc2863e1 100644
--- a/sys/dev/ath/ath_hal/ar5312/ar5312_interrupts.c
+++ b/sys/dev/ath/ath_hal/ar5312/ar5312_interrupts.c
@@ -29,7 +29,6 @@
 #include "ar5312/ar5312reg.h"
 #include "ar5312/ar5312phy.h"
 
-
 /*
  * Checks to see if an interrupt is pending on our NIC
  *
diff --git a/sys/dev/ath/ath_hal/ar5312/ar5312_reset.c b/sys/dev/ath/ath_hal/ar5312/ar5312_reset.c
index ebc12277a736..2daea4007c98 100644
--- a/sys/dev/ath/ath_hal/ar5312/ar5312_reset.c
+++ b/sys/dev/ath/ath_hal/ar5312/ar5312_reset.c
@@ -271,7 +271,7 @@ ar5312Reset(struct ath_hal *ah, HAL_OPMODE opmode,
 		/* Set the mute mask to the correct default */
 		OS_REG_WRITE(ah, AR_SEQ_MASK, 0x0000000F);
 	}
-	
+
 	if (AH_PRIVATE(ah)->ah_phyRev >= AR_PHY_CHIP_ID_REV_3) {
 		/* Clear reg to alllow RX_CLEAR line debug */
 		OS_REG_WRITE(ah, AR_PHY_BLUETOOTH,  0);
@@ -827,12 +827,10 @@ ar5312MacReset(struct ath_hal *ah, unsigned int RCMask)
 			OS_REG_READ(ah,
 						(AR5315_RSTIMER_BASE- ((uint32_t) ah->ah_sh) +AR5315_RESET));
 
-
 		} 
         else 
 #endif
 		{
-
 			switch(wlanNum) {
 			case 0:
 				resetBB = AR5312_RC_BB0_CRES | AR5312_RC_WBB0_RES;
diff --git a/sys/dev/ath/ath_hal/ar5312/ar5312reg.h b/sys/dev/ath/ath_hal/ar5312/ar5312reg.h
index 0e78a52dfe9e..34c8aef51ef1 100644
--- a/sys/dev/ath/ath_hal/ar5312/ar5312reg.h
+++ b/sys/dev/ath/ath_hal/ar5312/ar5312reg.h
@@ -29,7 +29,6 @@
 /* Register base addresses for modules which are not wmac modules */
 /* 531X has a fixed memory map */
 
-
 #define REG_WRITE(_reg,_val)		*((volatile uint32_t *)(_reg)) = (_val);
 #define REG_READ(_reg)		*((volatile uint32_t *)(_reg))
 /* 
@@ -129,7 +128,6 @@
 #define AR5312_RC_WMAC1_RES  0x00020000  /* Warm reset to WMAC1 */
 #define AR5312_RC_WBB1_RES   0x00040000  /* Warm reset to WBB */
 
-
 #define AR_RAD2112_SREV_MAJOR   0x40    /* 2112 Major Rev */
 
 enum AR5312PowerMode {
diff --git a/sys/dev/ath/ath_hal/ar5312/ar5315_gpio.c b/sys/dev/ath/ath_hal/ar5312/ar5315_gpio.c
index 5fe8eec6c225..41a7bd6cfb38 100644
--- a/sys/dev/ath/ath_hal/ar5312/ar5315_gpio.c
+++ b/sys/dev/ath/ath_hal/ar5312/ar5315_gpio.c
@@ -128,5 +128,4 @@ ar5315GpioSetIntr(struct ath_hal *ah, u_int gpio, uint32_t ilevel)
 	(void) ar5212SetInterrupts(ah, AH5212(ah)->ah_maskReg | HAL_INT_GPIO);
 }
 
-
 #endif /* AH_SUPPORT_2316 || AH_SUPPORT_2317 */
diff --git a/sys/dev/ath/ath_hal/ar5416/ar2133.c b/sys/dev/ath/ath_hal/ar5416/ar2133.c
index c4ac3e9fee05..1cb5432609d7 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar2133.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar2133.c
@@ -278,7 +278,7 @@ ar2133SetRfRegs(struct ath_hal *ah, const struct ieee80211_channel *chan,
 
 	/* Setup Bank 6 Write */
 	ath_hal_ini_bank_setup(priv->Bank6Data, &AH5416(ah)->ah_ini_bank6, modesIndex);
-	
+
 	/* Only the 5 or 2 GHz OB/DB need to be set for a mode */
 	if (IEEE80211_IS_CHAN_2GHZ(chan)) {
 		HALDEBUG(ah, HAL_DEBUG_EEPROM, "%s: 2ghz: OB_2:%d, DB_2:%d\n",
@@ -419,6 +419,7 @@ ar2133GetChannelMaxMinPower(struct ath_hal *ah,
             return(AH_FALSE);
     }
 #else
+    // XXX TODO: actually go implement for 11n chips!
     *maxPow = *minPow = 0;
 	return AH_FALSE;
 #endif
@@ -472,7 +473,6 @@ ar2133GetNoiseFloor(struct ath_hal *ah, int16_t nfarray[])
 		    "NF calibrated [ctl] [chain 1] is %d\n", nf);
 		nfarray[1] = nf;
 
-
 		nf = MS(OS_REG_READ(ah, AR_PHY_CH1_EXT_CCA), AR_PHY_CH1_EXT_MINCCA_PWR);
 		if (nf & 0x100)
 			nf = 0 - ((nf ^ 0x1ff) + 1);
@@ -521,7 +521,7 @@ ar2133RfDetach(struct ath_hal *ah)
 	ath_hal_free(ahp->ah_rfHal);
 	ahp->ah_rfHal = AH_NULL;
 }
-	
+
 /*
  * Allocate memory for analog bank scratch buffers
  * Scratch Buffer will be reinitialized every reset so no need to zero now
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416.h b/sys/dev/ath/ath_hal/ar5416/ar5416.h
index d71d2f922919..3f0787ec17c3 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416.h
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416.h
@@ -289,7 +289,7 @@ extern	HAL_BOOL ar5416SetKeyCacheEntry(struct ath_hal *ah, uint16_t entry,
 extern	uint32_t ar5416GetRxFilter(struct ath_hal *ah);
 extern	void ar5416SetRxFilter(struct ath_hal *ah, uint32_t bits);
 extern	HAL_BOOL ar5416StopDmaReceive(struct ath_hal *ah);
-extern	void ar5416StartPcuReceive(struct ath_hal *ah);
+extern	void ar5416StartPcuReceive(struct ath_hal *ah, HAL_BOOL);
 extern	void ar5416StopPcuReceive(struct ath_hal *ah);
 extern	HAL_BOOL ar5416SetupRxDesc(struct ath_hal *,
 		struct ath_desc *, uint32_t size, u_int flags);
@@ -306,7 +306,8 @@ extern	HAL_BOOL ar5416PhyDisable(struct ath_hal *ah);
 extern	HAL_RFGAIN ar5416GetRfgain(struct ath_hal *ah);
 extern	HAL_BOOL ar5416Disable(struct ath_hal *ah);
 extern	HAL_BOOL ar5416ChipReset(struct ath_hal *ah,
-		const struct ieee80211_channel *);
+		const struct ieee80211_channel *,
+		HAL_RESET_TYPE);
 extern	int ar5416GetRegChainOffset(struct ath_hal *ah, int i);
 extern	HAL_BOOL ar5416SetBoardValues(struct ath_hal *,
 		const struct ieee80211_channel *);
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_ani.c b/sys/dev/ath/ath_hal/ar5416/ar5416_ani.c
index a10d884aaaf8..340d67f2e52b 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_ani.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_ani.c
@@ -223,7 +223,6 @@ ar5416AniControl(struct ath_hal *ah, HAL_ANI_CMD cmd, int param)
 		return AH_FALSE;
 	}
 
-
 	switch (cmd) {
 	case HAL_ANI_NOISE_IMMUNITY_LEVEL: {
 		u_int level = param;
@@ -727,7 +726,7 @@ ar5416AniLowerImmunity(struct ath_hal *ah)
 	struct ath_hal_5212 *ahp = AH5212(ah);
 	struct ar5212AniState *aniState;
 	const struct ar5212AniParams *params;
-	
+
 	HALASSERT(ANI_ENA(ah));
 
 	aniState = ahp->ah_curani;
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_attach.c b/sys/dev/ath/ath_hal/ar5416/ar5416_attach.c
index 8957dedb39dc..369e4b0bb551 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_attach.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_attach.c
@@ -376,7 +376,7 @@ ar5416Attach(uint16_t devid, HAL_SOFTC sc,
 	if (ecode != HAL_OK)
 		goto bad;
 
-	if (!ar5416ChipReset(ah, AH_NULL)) {	/* reset chip */
+	if (!ar5416ChipReset(ah, AH_NULL, HAL_RESET_NORMAL)) {	/* reset chip */
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: chip reset failed\n",
 		    __func__);
 		ecode = HAL_EIO;
@@ -721,7 +721,6 @@ ar5416SpurMitigate(struct ath_hal *ah, const struct ieee80211_channel *chan)
         SM(spur_delta_phase, AR_PHY_TIMING11_SPUR_DELTA_PHASE));
     OS_REG_WRITE(ah, AR_PHY_TIMING11, new);
 
-
     /*
      * ============================================
      * pilot mask 1 [31:0] = +6..-26, no 0 bin
@@ -893,7 +892,7 @@ ar5416FillCapabilityInfo(struct ath_hal *ah)
 	struct ath_hal_private *ahpriv = AH_PRIVATE(ah);
 	HAL_CAPABILITIES *pCap = &ahpriv->ah_caps;
 	uint16_t val;
-	
+
 	/* Construct wireless mode from EEPROM */
 	pCap->halWirelessModes = 0;
 	if (ath_hal_eepromGetFlag(ah, AR_EEP_AMODE)) {
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_beacon.c b/sys/dev/ath/ath_hal/ar5416/ar5416_beacon.c
index 7de707b3293c..e1b61bb3ccb4 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_beacon.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_beacon.c
@@ -155,7 +155,7 @@ ar5416SetStaBeaconTimers(struct ath_hal *ah, const HAL_BEACON_STATE *bs)
 	uint32_t nextTbtt, nextdtim,beaconintval, dtimperiod;
 
 	HALASSERT(bs->bs_intval != 0);
-	
+
 	/* NB: no cfp setting since h/w automatically takes care */
 
 	OS_REG_WRITE(ah, AR_NEXT_TBTT, TU_TO_USEC(bs->bs_nexttbtt));
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_cal.c b/sys/dev/ath/ath_hal/ar5416/ar5416_cal.c
index 106833fe6303..44b436c4f389 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_cal.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_cal.c
@@ -196,7 +196,6 @@ ar5416RunInitCals(struct ath_hal *ah, int init_cal_count)
 }
 #endif
 
-
 /*
  * AGC calibration for the AR5416, AR9130, AR9160, AR9280.
  */
@@ -623,7 +622,6 @@ ar5416LoadNF(struct ath_hal *ah, const struct ieee80211_channel *chan)
 	h = AH5416(ah)->ah_cal.nfCalHist;
 	HALDEBUG(ah, HAL_DEBUG_NFCAL, "CCA: ");
 	for (i = 0; i < AR5416_NUM_NF_READINGS; i ++) {
-
 		/* Don't write to EXT radio CCA registers unless in HT/40 mode */
 		/* XXX this check should really be cleaner! */
 		if (i > 2 && !IEEE80211_IS_CHAN_HT40(chan))
@@ -674,7 +672,6 @@ ar5416LoadNF(struct ath_hal *ah, const struct ieee80211_channel *chan)
 	 * of next noise floor calibration the baseband does.  
 	 */
 	for (i = 0; i < AR5416_NUM_NF_READINGS; i ++) {
-
 		/* Don't write to EXT radio CCA registers unless in HT/40 mode */
 		/* XXX this check should really be cleaner! */
 		if (i > 2 && !IEEE80211_IS_CHAN_HT40(chan))
@@ -781,7 +778,6 @@ ar5416SanitizeNF(struct ath_hal *ah, int16_t *nf)
         }
 }
 
-
 /*
  * Read the NF and check it against the noise floor threshold
  *
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_cal.h b/sys/dev/ath/ath_hal/ar5416/ar5416_cal.h
index 5cf1ed0ef108..73a6a87499eb 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_cal.h
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_cal.h
@@ -20,7 +20,7 @@
  */
 #ifndef _ATH_AR5416_CAL_H_
 #define _ATH_AR5416_CAL_H_
- 
+
 typedef enum {
 	ADC_DC_INIT_CAL	= 0x1,
 	ADC_GAIN_CAL	= 0x2,
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_gpio.c b/sys/dev/ath/ath_hal/ar5416/ar5416_gpio.c
index 1695eda2c5f6..e1d1320d0852 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_gpio.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_gpio.c
@@ -131,7 +131,7 @@ ar5416GpioCfgOutput(struct ath_hal *ah, uint32_t gpio, HAL_GPIO_MUX_TYPE type)
 	return AH_TRUE;
 #undef	N
 }
- 
+
 /*
  * Configure GPIO Input lines
  */
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_power.c b/sys/dev/ath/ath_hal/ar5416/ar5416_power.c
index bcd5fd9807a8..ac1366fedefa 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_power.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_power.c
@@ -114,7 +114,7 @@ static void
 ar5416SetPowerModeNetworkSleep(struct ath_hal *ah, int setChip)
 {
 	OS_REG_SET_BIT(ah, AR_STA_ID1, AR_STA_ID1_PWR_SAV);
-	
+
 	if (setChip)
 		OS_REG_CLR_BIT(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_EN);
 }
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_recv.c b/sys/dev/ath/ath_hal/ar5416/ar5416_recv.c
index 372e2795dc20..f58f29a12602 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_recv.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_recv.c
@@ -106,14 +106,14 @@ ar5416StopDmaReceive(struct ath_hal *ah)
  * Start receive at the PCU engine
  */
 void
-ar5416StartPcuReceive(struct ath_hal *ah)
+ar5416StartPcuReceive(struct ath_hal *ah, HAL_BOOL is_scanning)
 {
 	struct ath_hal_private *ahp = AH_PRIVATE(ah);
 
 	HALDEBUG(ah, HAL_DEBUG_RX, "%s: Start PCU Receive \n", __func__);
 	ar5212EnableMibCounters(ah);
-	/* NB: restore current settings */
-	ar5416AniReset(ah, ahp->ah_curchan, ahp->ah_opmode, AH_TRUE);
+	/* NB: restore current settings if we're not scanning */
+	ar5416AniReset(ah, ahp->ah_curchan, ahp->ah_opmode, ! is_scanning);
 	/*
 	 * NB: must do after enabling phy errors to avoid rx
 	 *     frames w/ corrupted descriptor status.
@@ -183,8 +183,6 @@ ar5416ProcRxDesc(struct ath_hal *ah, struct ath_desc *ds,
 	rs->rs_datalen = ads->ds_rxstatus1 & AR_DataLen;
 	rs->rs_tstamp =  ads->AR_RcvTimestamp;
 
-	/* XXX what about KeyCacheMiss? */
-
 	rs->rs_rssi = MS(ads->ds_rxstatus4, AR_RxRSSICombined);
 	rs->rs_rssi_ctl[0] = MS(ads->ds_rxstatus0, AR_RxRSSIAnt00);
 	rs->rs_rssi_ctl[1] = MS(ads->ds_rxstatus0, AR_RxRSSIAnt01);
@@ -277,5 +275,8 @@ ar5416ProcRxDesc(struct ath_hal *ah, struct ath_desc *ds,
 			rs->rs_status |= HAL_RXERR_MIC;
 	}
 
+	if (ads->ds_rxstatus8 & AR_KeyMiss)
+		rs->rs_status |= HAL_RXERR_KEYMISS;
+
 	return HAL_OK;
 }
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_reset.c b/sys/dev/ath/ath_hal/ar5416/ar5416_reset.c
index 6c5cf53c325b..f3d6fcab0d68 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_reset.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_reset.c
@@ -170,13 +170,15 @@ ar5416Reset(struct ath_hal *ah, HAL_OPMODE opmode,
 	if (AR_SREV_HOWL(ah) ||
 	    (AR_SREV_MERLIN(ah) &&
 	     ath_hal_eepromGetFlag(ah, AR_EEP_OL_PWRCTRL)) ||
+	    (resetType == HAL_RESET_FORCE_COLD) ||
+	    (resetType == HAL_RESET_BBPANIC) ||
 	    (ah->ah_config.ah_force_full_reset))
 		tsf = ar5416GetTsf64(ah);
 
 	/* Mark PHY as inactive; marked active in ar5416InitBB() */
 	ar5416MarkPhyInactive(ah);
 
-	if (!ar5416ChipReset(ah, chan)) {
+	if (!ar5416ChipReset(ah, chan, resetType)) {
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: chip reset failed\n", __func__);
 		FAIL(HAL_EIO);
 	}
@@ -384,7 +386,6 @@ ar5416Reset(struct ath_hal *ah, HAL_OPMODE opmode,
 		    AR_PCU_MISC_MODE2_ENABLE_AGGWEP);
 	}
 
-
 	/*
 	 * disable seq number generation in hw
 	 */
@@ -604,7 +605,7 @@ ar5416InitDMA(struct ath_hal *ah)
 	 * Setup receive FIFO threshold to hold off TX activities
 	 */
 	OS_REG_WRITE(ah, AR_RXFIFO_CFG, 0x200);
-	
+
 	/*
 	 * reduce the number of usable entries in PCU TXBUF to avoid
 	 * wrap around.
@@ -643,7 +644,7 @@ ar5416InitBB(struct ath_hal *ah, const struct ieee80211_channel *chan)
 
 	/* Activate the PHY (includes baseband activate and synthesizer on) */
 	OS_REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
-	
+
 	/* 
 	 * If the AP starts the calibration before the base band timeout
 	 * completes  we could get rx_clear false triggering.  Add an
@@ -775,7 +776,8 @@ ar5416SetRfMode(struct ath_hal *ah, const struct ieee80211_channel *chan)
  * Places the hardware into reset and then pulls it out of reset
  */
 HAL_BOOL
-ar5416ChipReset(struct ath_hal *ah, const struct ieee80211_channel *chan)
+ar5416ChipReset(struct ath_hal *ah, const struct ieee80211_channel *chan,
+    HAL_RESET_TYPE resetType)
 {
 	OS_MARK(ah, AH_MARK_CHIPRESET, chan ? chan->ic_freq : 0);
 	/*
@@ -788,6 +790,13 @@ ar5416ChipReset(struct ath_hal *ah, const struct ieee80211_channel *chan)
 	} else if (ah->ah_config.ah_force_full_reset) {
 		if (!ar5416SetResetReg(ah, HAL_RESET_POWER_ON))
 			return AH_FALSE;
+	} else if ((resetType == HAL_RESET_FORCE_COLD) ||
+	    (resetType == HAL_RESET_BBPANIC)) {
+		HALDEBUG(ah, HAL_DEBUG_RESET,
+		    "%s: full reset; resetType=%d\n",
+		    __func__, resetType);
+		if (!ar5416SetResetReg(ah, HAL_RESET_POWER_ON))
+			return AH_FALSE;
 	} else {
 		if (!ar5416SetResetReg(ah, HAL_RESET_WARM))
 			return AH_FALSE;
@@ -1039,7 +1048,6 @@ ar5416WriteTxPowerRateRegisters(struct ath_hal *ah,
 #undef POW_SM
 }
 
-
 /**************************************************************
  * ar5416SetTransmitPower
  *
@@ -1086,7 +1094,7 @@ ar5416SetTransmitPower(struct ath_hal *ah,
     if (IS_EEP_MINOR_V2(ah)) {
         AH5416(ah)->ah_ht40PowerIncForPdadc = pModal->ht40PowerIncForPdadc;
     }
- 
+
     if (!ar5416SetPowerPerRateTable(ah, pEepData,  chan,
                                     &AH5416(ah)->ah_ratesArray[0],
 				    cfgCtl,
@@ -1515,7 +1523,7 @@ ar5416InitPLL(struct ath_hal *ah, const struct ieee80211_channel *chan)
 			pll |= SM(0xb, AR_RTC_PLL_DIV);
 	} else
 		pll |= SM(0xb, AR_RTC_PLL_DIV);
-	
+
 	OS_REG_WRITE(ah, AR_RTC_PLL_CONTROL, pll);
 
 	/* TODO:
@@ -1647,7 +1655,6 @@ ar5416SetBoardValues(struct ath_hal *ah, const struct ieee80211_channel *chan)
 
         if ((i == 0) || AR_SREV_5416_V20_OR_LATER(ah))
 	    ar5416SetDefGainValues(ah, pModal, eep, txRxAttenLocal, regChainOffset, i);
-
     }
 
 	if (AR_SREV_MERLIN_10_OR_LATER(ah)) {
@@ -2794,7 +2801,6 @@ ar5416MarkPhyInactive(struct ath_hal *ah)
 #define	AR5416_HALF_RATE_USEC_44	21 /* ((44 / 2) - 1 ) */
 #define	AR5416_QUARTER_RATE_USEC_44	10  /* ((44 / 4) - 1 ) */
 
-
 /* XXX What should these be for 40/44MHz clocks (and half/quarter) ? */
 #define	AR5416_RX_NON_FULL_RATE_LATENCY		63
 #define	AR5416_TX_HALF_RATE_LATENCY		108
@@ -2893,4 +2899,3 @@ ar5416SetIFSTiming(struct ath_hal *ah, const struct ieee80211_channel *chan)
 	OS_REG_RMW_FIELD(ah, AR_D_GBL_IFS_MISC,
 	    AR_D_GBL_IFS_MISC_USEC_DURATION, init_usec);
 }
-
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_spectral.c b/sys/dev/ath/ath_hal/ar5416/ar5416_spectral.c
index a5f1251607a8..496abbf4e9b4 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_spectral.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_spectral.c
@@ -243,4 +243,3 @@ ar5416RestoreSpectralConfig(struct ath_hal *ah, uint32_t restoreval)
 	}
 	return;
 }
-
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416_xmit.c b/sys/dev/ath/ath_hal/ar5416/ar5416_xmit.c
index 869d5fbea30a..e3330fe820b8 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416_xmit.c
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416_xmit.c
@@ -266,7 +266,6 @@ ar5416GetTxRatePower(struct ath_hal *ah, uint8_t rate, uint8_t tx_chainmask,
 	 */
 	if (AR_SREV_MERLIN_20_OR_LATER(ah) &&
 	    ath_hal_eepromGetFlag(ah, AR_EEP_OL_PWRCTRL)) {
-
 		if (rate == 0x19 || rate == 0x1a || rate == 0x1b ||
 		    rate == (0x19 | 0x04) || rate == (0x1a | 0x04) ||
 		    rate == (0x1b | 0x04)) {
@@ -543,7 +542,7 @@ ar5416ChainTxDesc(struct ath_hal *ah, struct ath_desc *ds,
 
 	int isaggr = 0;
 	uint32_t last_aggr = 0;
-	
+
 	(void) hdrLen;
 	(void) ah;
 
@@ -613,7 +612,7 @@ ar5416ChainTxDesc(struct ath_hal *ah, struct ath_desc *ds,
 	}
 	ds_txstatus[0] = ds_txstatus[1] = 0;
 	ds_txstatus[9] &= ~AR_TxDone;
-	
+
 	return AH_TRUE;
 }
 
@@ -631,7 +630,7 @@ ar5416SetupFirstTxDesc(struct ath_hal *ah, struct ath_desc *ds,
 	HALASSERT(isValidTxRate(txRate0));
 	HALASSERT((flags & RTSCTS) != RTSCTS);
 	/* XXX validate antMode */
-	
+
 	txPower = (txPower + ahp->ah_txPowerIndexOffset );
 	if(txPower > 63)  txPower=63;
 
@@ -646,7 +645,7 @@ ar5416SetupFirstTxDesc(struct ath_hal *ah, struct ath_desc *ds,
 		| SM(AH5416(ah)->ah_tx_chainmask, AR_ChainSel1)
 		| SM(AH5416(ah)->ah_tx_chainmask, AR_ChainSel2) 
 		| SM(AH5416(ah)->ah_tx_chainmask, AR_ChainSel3);
-	
+
 	/* NB: no V1 WAR */
 	ads->ds_ctl8 = SM(0, AR_AntCtl0);
 	ads->ds_ctl9 = SM(0, AR_AntCtl1) | SM(txPower, AR_XmitPower1);
@@ -673,7 +672,7 @@ ar5416SetupFirstTxDesc(struct ath_hal *ah, struct ath_desc *ds,
 		ads->ds_ctl10 = SM(0, AR_AntCtl2) | SM(0, AR_XmitPower2);
 		ads->ds_ctl11 = SM(0, AR_AntCtl3) | SM(0, AR_XmitPower3);
 	}
-	
+
 	return AH_TRUE;
 #undef RTSCTS
 }
@@ -1114,7 +1113,6 @@ ar5416GetTxCompletionRates(struct ath_hal *ah, const struct ath_desc *ds0, int *
 	return AH_TRUE;
 }
 
-
 /*
  * TX queue management routines - AR5416 and later chipsets
  */
@@ -1326,7 +1324,7 @@ ar5416ResetTxQueue(struct ath_hal *ah, u_int q)
 			  SM(qi->tqi_readyTime, AR_Q_RDYTIMECFG_INT)
 			| AR_Q_RDYTIMECFG_ENA);
 	}
-	
+
 	OS_REG_WRITE(ah, AR_DCHNTIME(q),
 		  SM(qi->tqi_burstTime, AR_D_CHNTIME_DUR)
 		| (qi->tqi_burstTime ? AR_D_CHNTIME_EN : 0));
@@ -1464,7 +1462,7 @@ ar5416ResetTxQueue(struct ath_hal *ah, u_int q)
 			     OS_REG_READ(ah, AR_Q0_MISC + 4*q)
 			     | AR_Q_MISC_QCU_COMP_EN);
 	}
-	
+
 	/*
 	 * Always update the secondary interrupt mask registers - this
 	 * could be a new queue getting enabled in a running system or
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416desc.h b/sys/dev/ath/ath_hal/ar5416/ar5416desc.h
index 0e58bc61eba8..efe56a11965f 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416desc.h
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416desc.h
@@ -64,7 +64,6 @@ struct ar5416_rx_desc { /* rx desc has 2 control words + 9 status words */
 	uint32_t	status8;
 };
 
-
 struct ar5416_desc {
 	uint32_t   ds_link;    /* link pointer */
 	uint32_t   ds_data;    /* data buffer pointer */
diff --git a/sys/dev/ath/ath_hal/ar5416/ar5416reg.h b/sys/dev/ath/ath_hal/ar5416/ar5416reg.h
index ff4f558efa83..85c1d6454952 100644
--- a/sys/dev/ath/ath_hal/ar5416/ar5416reg.h
+++ b/sys/dev/ath/ath_hal/ar5416/ar5416reg.h
@@ -669,7 +669,6 @@
 #define	AR_XSREV_VERSION_OWL_PCI	0x0D
 #define	AR_XSREV_VERSION_OWL_PCIE	0x0C
 
-
 /*
  * These are from ath9k/Atheros and assume an AR_SREV version mask
  * of 0x07, rather than 0x0F which is being used in the FreeBSD HAL.
@@ -808,7 +807,6 @@
 	(AR_SREV_KIWI(_ah) && \
 	 AH_PRIVATE((_ah))->ah_macRev >= AR_XSREV_REVISION_KIWI_13)
 
-
 /* Not yet implemented chips */
 #define	AR_SREV_9271(_ah)	0
 
diff --git a/sys/dev/ath/ath_hal/ar9001/ar9130_attach.c b/sys/dev/ath/ath_hal/ar9001/ar9130_attach.c
index 1d78b053c372..70277cc6ca2a 100644
--- a/sys/dev/ath/ath_hal/ar9001/ar9130_attach.c
+++ b/sys/dev/ath/ath_hal/ar9001/ar9130_attach.c
@@ -173,7 +173,7 @@ ar9130Attach(uint16_t devid, HAL_SOFTC sc,
 	if (ecode != HAL_OK)
 		goto bad;
 
-	if (!ar5416ChipReset(ah, AH_NULL)) {	/* reset chip */
+	if (!ar5416ChipReset(ah, AH_NULL, HAL_RESET_NORMAL)) {	/* reset chip */
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: chip reset failed\n", __func__);
 		ecode = HAL_EIO;
 		goto bad;
@@ -243,7 +243,6 @@ ar9130Attach(uint16_t devid, HAL_SOFTC sc,
 	AH_PRIVATE(ah)->ah_currentRDext =
 	    ath_hal_eepromGet(ah, AR_EEP_REGDMN_1, AH_NULL);
 
-
 	/*
 	 * ah_miscMode is populated by ar5416FillCapabilityInfo()
 	 * starting from griffin. Set here to make sure that
diff --git a/sys/dev/ath/ath_hal/ar9001/ar9160_attach.c b/sys/dev/ath/ath_hal/ar9001/ar9160_attach.c
index f74da22d1e7c..b67699358aab 100644
--- a/sys/dev/ath/ath_hal/ar9001/ar9160_attach.c
+++ b/sys/dev/ath/ath_hal/ar9001/ar9160_attach.c
@@ -200,7 +200,7 @@ ar9160Attach(uint16_t devid, HAL_SOFTC sc,
 	HAL_INI_INIT(&AH5416(ah)->ah_ini_pcieserdes, ar9160PciePhy, 2);
 	ar5416AttachPCIE(ah);
 
-	if (!ar5416ChipReset(ah, AH_NULL)) {	/* reset chip */
+	if (!ar5416ChipReset(ah, AH_NULL, HAL_RESET_NORMAL)) {	/* reset chip */
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: chip reset failed\n", __func__);
 		ecode = HAL_EIO;
 		goto bad;
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9280_attach.c b/sys/dev/ath/ath_hal/ar9002/ar9280_attach.c
index 92479214e5a5..17604e720cef 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9280_attach.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9280_attach.c
@@ -259,7 +259,7 @@ ar9280Attach(uint16_t devid, HAL_SOFTC sc,
 	if (ecode != HAL_OK)
 		goto bad;
 
-	if (!ar5416ChipReset(ah, AH_NULL)) {	/* reset chip */
+	if (!ar5416ChipReset(ah, AH_NULL, HAL_RESET_NORMAL)) {	/* reset chip */
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: chip reset failed\n", __func__);
 		ecode = HAL_EIO;
 		goto bad;
@@ -434,7 +434,6 @@ ar9280ConfigPCIE(struct ath_hal *ah, HAL_BOOL restore, HAL_BOOL power_off)
 		OS_DELAY(1000);
 	}
 
-
 	/*
 	 * Set PCIe workaround bits
 	 *
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9280_olc.c b/sys/dev/ath/ath_hal/ar9002/ar9280_olc.c
index 5eeb420d5d3a..9d75e3b43131 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9280_olc.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9280_olc.c
@@ -171,7 +171,6 @@ ar9280olcTemperatureCompensation(struct ath_hal *ah)
 	}
 }
 
-
 static int16_t
 ar9280ChangeGainBoundarySettings(struct ath_hal *ah, uint16_t *gb,
     uint16_t numXpdGain, uint16_t pdGainOverlap_t2, int8_t pwr_table_offset,
@@ -302,7 +301,6 @@ ar9280SetPowerCalTable(struct ath_hal *ah, struct ar5416eeprom *pEepData,
 
 	(void) ath_hal_eepromGet(ah, AR_EEP_PWR_TABLE_OFFSET, &pwr_table_offset);
 
-
 	if (IS_EEP_MINOR_V2(ah)) {
 		pdGainOverlap_t2 = pEepData->modalHeader[IEEE80211_IS_CHAN_2GHZ(chan)].pdGainOverlap;
 	} else { 
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9285.c b/sys/dev/ath/ath_hal/ar9002/ar9285.c
index c4362637c173..0044f73a97c5 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9285.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9285.c
@@ -52,7 +52,6 @@ ar9285GetNoiseFloor(struct ath_hal *ah, int16_t nfarray[])
 	    "NF calibrated [ctl] [chain 0] is %d\n", nf);
 	nfarray[0] = nf;
 
-
 	nf = MS(OS_REG_READ(ah, AR_PHY_EXT_CCA), AR9280_PHY_EXT_MINCCA_PWR);
 	if (nf & 0x100)
 		nf = 0 - ((nf ^ 0x1ff) + 1);
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9285_attach.c b/sys/dev/ath/ath_hal/ar9002/ar9285_attach.c
index 5c140b98dbb1..7fc6b96a25c9 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9285_attach.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9285_attach.c
@@ -196,7 +196,7 @@ ar9285Attach(uint16_t devid, HAL_SOFTC sc,
 	AH5416(ah)->ah_writeIni		= ar9285WriteIni;
 	AH5416(ah)->ah_rx_chainmask	= AR9285_DEFAULT_RXCHAINMASK;
 	AH5416(ah)->ah_tx_chainmask	= AR9285_DEFAULT_TXCHAINMASK;
-	
+
 	ahp->ah_maxTxTrigLev		= MAX_TX_FIFO_THRESHOLD >> 1;
 
 	if (!ar5416SetResetReg(ah, HAL_RESET_POWER_ON)) {
@@ -249,7 +249,7 @@ ar9285Attach(uint16_t devid, HAL_SOFTC sc,
 	if (ecode != HAL_OK)
 		goto bad;
 
-	if (!ar5416ChipReset(ah, AH_NULL)) {	/* reset chip */
+	if (!ar5416ChipReset(ah, AH_NULL, HAL_RESET_NORMAL)) {	/* reset chip */
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: chip reset failed\n",
 		    __func__);
 		ecode = HAL_EIO;
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9285_btcoex.c b/sys/dev/ath/ath_hal/ar9002/ar9285_btcoex.c
index 3a168ae45ead..0596f19c3b64 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9285_btcoex.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9285_btcoex.c
@@ -150,5 +150,3 @@ ar9285BTCoexSetParameter(struct ath_hal *ah, u_int32_t type, u_int32_t value)
 		break;
 	}
 }
-
-
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9285_diversity.c b/sys/dev/ath/ath_hal/ar9002/ar9285_diversity.c
index 3da59311e5dc..25ae031da2af 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9285_diversity.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9285_diversity.c
@@ -77,7 +77,7 @@ ar9285SetAntennaSwitch(struct ath_hal *ah, HAL_ANT_SETTING settings)
 	/* Store settings */
 	AH5212(ah)->ah_antControl = settings;
 	AH5212(ah)->ah_diversity = (settings == HAL_ANT_VARIABLE);
-	
+
 	/* XXX don't fiddle if the PHY is in sleep mode or ! chan */
 
 	/* Begin setting the relevant registers */
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9285_reset.c b/sys/dev/ath/ath_hal/ar9002/ar9285_reset.c
index 961e25e89efa..7b598a05720c 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9285_reset.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9285_reset.c
@@ -107,7 +107,7 @@ ar9285SetTransmitPower(struct ath_hal *ah,
     if (IS_EEP_MINOR_V2(ah)) {
         AH5416(ah)->ah_ht40PowerIncForPdadc = pModal->ht40PowerIncForPdadc;
     }
- 
+
     if (!ar9285SetPowerPerRateTable(ah, pEepData,  chan,
                                     &AH5416(ah)->ah_ratesArray[0],cfgCtl,
                                     twiceAntennaReduction,
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9287_attach.c b/sys/dev/ath/ath_hal/ar9002/ar9287_attach.c
index 8341535bdb97..3cd13f73b772 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9287_attach.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9287_attach.c
@@ -146,7 +146,6 @@ ar9287Attach(uint16_t devid, HAL_SOFTC sc,
 		ah->ah_eepromdata = eepromdata;
 	}
 
-
 	/* XXX override with 9280 specific state */
 	/* override 5416 methods for our needs */
 	AH5416(ah)->ah_initPLL = ar9280InitPLL;
@@ -242,7 +241,7 @@ ar9287Attach(uint16_t devid, HAL_SOFTC sc,
 	if (ecode != HAL_OK)
 		goto bad;
 
-	if (!ar5416ChipReset(ah, AH_NULL)) {	/* reset chip */
+	if (!ar5416ChipReset(ah, AH_NULL, HAL_RESET_NORMAL)) {	/* reset chip */
 		HALDEBUG(ah, HAL_DEBUG_ANY, "%s: chip reset failed\n", __func__);
 		ecode = HAL_EIO;
 		goto bad;
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9287_cal.c b/sys/dev/ath/ath_hal/ar9002/ar9287_cal.c
index 09940a187e7d..3bdb4c7f0810 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9287_cal.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9287_cal.c
@@ -41,7 +41,6 @@
 
 #include "ar9002/ar9287_cal.h"
 
-
 void
 ar9287PACal(struct ath_hal *ah, HAL_BOOL is_reset)
 {
@@ -55,7 +54,7 @@ HAL_BOOL
 ar9287InitCalHardware(struct ath_hal *ah, const struct ieee80211_channel *chan)
 {
 	OS_REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
-	
+
 	/* Calibrate the AGC */
 	OS_REG_WRITE(ah, AR_PHY_AGC_CONTROL,
 	    OS_REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_CAL);
diff --git a/sys/dev/ath/ath_hal/ar9002/ar9287_reset.c b/sys/dev/ath/ath_hal/ar9002/ar9287_reset.c
index 372d6c476d12..e4b6eed5bfec 100644
--- a/sys/dev/ath/ath_hal/ar9002/ar9287_reset.c
+++ b/sys/dev/ath/ath_hal/ar9002/ar9287_reset.c
@@ -113,7 +113,6 @@ ar9287SetPowerCalTable(struct ath_hal *ah,
 	*pTxPowerIndexOffset = 0;
 }
 
-
 /* XXX hard-coded values? */
 #define REDUCE_SCALED_POWER_BY_TWO_CHAIN     6
 
diff --git a/sys/dev/ath/ath_rate/amrr/amrr.c b/sys/dev/ath/ath_rate/amrr/amrr.c
index 9a7518373c19..b04b728b2bc5 100644
--- a/sys/dev/ath/ath_rate/amrr/amrr.c
+++ b/sys/dev/ath/ath_rate/amrr/amrr.c
@@ -64,7 +64,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 
 #include <sys/socket.h>
- 
+
 #include <net/if.h>
 #include <net/if_media.h>
 #include <net/if_arp.h>
@@ -104,8 +104,9 @@ ath_rate_node_cleanup(struct ath_softc *sc, struct ath_node *an)
 
 void
 ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
-	int shortPreamble, size_t frameLen,
-	u_int8_t *rix, int *try0, u_int8_t *txrate)
+	int shortPreamble, size_t frameLen, int tid, int is_aggr,
+	u_int8_t *rix, int *try0, u_int8_t *txrate, int *maxdur,
+	int *maxpktlen)
 {
 	struct amrr_node *amn = ATH_NODE_AMRR(an);
 
@@ -115,6 +116,8 @@ ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
 		*txrate = amn->amn_tx_rate0sp;
 	else
 		*txrate = amn->amn_tx_rate0;
+	maxdur = -1;
+	maxpktlen = -1;
 }
 
 /*
@@ -125,7 +128,7 @@ ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
  */
 void
 ath_rate_getxtxrates(struct ath_softc *sc, struct ath_node *an,
-    uint8_t rix0, struct ath_rc_series *rc)
+    uint8_t rix0, int is_aggr, struct ath_rc_series *rc)
 {
 	struct amrr_node *amn = ATH_NODE_AMRR(an);
 
@@ -142,7 +145,6 @@ ath_rate_getxtxrates(struct ath_softc *sc, struct ath_node *an,
 	rc[3].tries = amn->amn_tx_try3;
 }
 
-
 void
 ath_rate_setupxtxdesc(struct ath_softc *sc, struct ath_node *an,
 	struct ath_desc *ds, int shortPreamble, u_int8_t rix)
@@ -159,7 +161,7 @@ ath_rate_setupxtxdesc(struct ath_softc *sc, struct ath_node *an,
 void
 ath_rate_tx_complete(struct ath_softc *sc, struct ath_node *an,
 	const struct ath_rc_series *rc, const struct ath_tx_status *ts,
-	int frame_size, int nframes, int nbad)
+	int frame_size, int rc_framesize, int nframes, int nbad)
 {
 	struct amrr_node *amn = ATH_NODE_AMRR(an);
 	int sr = ts->ts_shortretry;
@@ -196,6 +198,11 @@ ath_rate_newassoc(struct ath_softc *sc, struct ath_node *an, int isnew)
 		ath_rate_ctl_start(sc, &an->an_node);
 }
 
+void
+ath_rate_update_rx_rssi(struct ath_softc *sc, struct ath_node *an, int rssi)
+{
+}
+
 static void 
 node_reset(struct amrr_node *amn)
 {
@@ -209,7 +216,6 @@ node_reset(struct amrr_node *amn)
   	amn->amn_success_threshold = ath_rate_min_success_threshold;
 }
 
-
 /**
  * The code below assumes that we are dealing with hardware multi rate retry
  * I have no idea what will happen if you try to use this module with another
@@ -408,7 +414,6 @@ ath_rate_ctl(void *arg, struct ieee80211_node *ni)
    		} else {
 			amn->amn_recovery = 0;
 		}
-
    	}
 	if (is_enough (amn) || rix != amn->amn_rix) {
 		/* reset counters. */
diff --git a/sys/dev/ath/ath_rate/onoe/onoe.c b/sys/dev/ath/ath_rate/onoe/onoe.c
index 05604c08823c..5229feaeebfd 100644
--- a/sys/dev/ath/ath_rate/onoe/onoe.c
+++ b/sys/dev/ath/ath_rate/onoe/onoe.c
@@ -52,7 +52,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 
 #include <sys/socket.h>
- 
+
 #include <net/if.h>
 #include <net/if_media.h>
 #include <net/if_arp.h>
@@ -112,8 +112,9 @@ ath_rate_node_cleanup(struct ath_softc *sc, struct ath_node *an)
 
 void
 ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
-	int shortPreamble, size_t frameLen,
-	u_int8_t *rix, int *try0, u_int8_t *txrate)
+	int shortPreamble, size_t frameLen, int tid, int is_aggr,
+	u_int8_t *rix, int *try0, u_int8_t *txrate, int *maxdur,
+	int *maxpktlen)
 {
 	struct onoe_node *on = ATH_NODE_ONOE(an);
 
@@ -123,6 +124,8 @@ ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
 		*txrate = on->on_tx_rate0sp;
 	else
 		*txrate = on->on_tx_rate0;
+	*maxdur = -1;
+	*maxpktlen = -1;
 }
 
 /*
@@ -133,7 +136,7 @@ ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
  */
 void
 ath_rate_getxtxrates(struct ath_softc *sc, struct ath_node *an,
-    uint8_t rix0, struct ath_rc_series *rc)
+    uint8_t rix0, int is_aggr, struct ath_rc_series *rc)
 {
 	struct onoe_node *on = ATH_NODE_ONOE(an);
 
@@ -166,7 +169,7 @@ ath_rate_setupxtxdesc(struct ath_softc *sc, struct ath_node *an,
 void
 ath_rate_tx_complete(struct ath_softc *sc, struct ath_node *an,
 	const struct ath_rc_series *rc, const struct ath_tx_status *ts,
-	int frame_size, int nframes, int nbad)
+	int frame_size, int rc_framesize, int nframes, int nbad)
 {
 	struct onoe_node *on = ATH_NODE_ONOE(an);
 
@@ -189,6 +192,11 @@ ath_rate_newassoc(struct ath_softc *sc, struct ath_node *an, int isnew)
 		ath_rate_ctl_start(sc, &an->an_node);
 }
 
+void
+ath_rate_update_rx_rssi(struct ath_softc *sc, struct ath_node *an, int rssi)
+{
+}
+
 static void
 ath_rate_update(struct ath_softc *sc, struct ieee80211_node *ni, int rate)
 {
@@ -218,7 +226,7 @@ ath_rate_update(struct ath_softc *sc, struct ieee80211_node *ni, int rate)
 	ni->ni_txrate = ni->ni_rates.rs_rates[rate] & IEEE80211_RATE_VAL;
 	on->on_tx_rix0 = sc->sc_rixmap[ni->ni_txrate];
 	on->on_tx_rate0 = rt->info[on->on_tx_rix0].rateCode;
-	
+
 	on->on_tx_rate0sp = on->on_tx_rate0 |
 		rt->info[on->on_tx_rix0].shortPreamble;
 	if (sc->sc_mrretry) {
diff --git a/sys/dev/ath/ath_rate/sample/sample.c b/sys/dev/ath/ath_rate/sample/sample.c
index 45fad2786849..31df8a60c976 100644
--- a/sys/dev/ath/ath_rate/sample/sample.c
+++ b/sys/dev/ath/ath_rate/sample/sample.c
@@ -62,7 +62,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 
 #include <sys/socket.h>
- 
+
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/if_media.h>
@@ -107,6 +107,140 @@ __FBSDID("$FreeBSD$");
  * a few different packet sizes independently for each link.
  */
 
+/* XXX TODO: move this into ath_hal/net80211 so it can be shared */
+
+#define	MCS_HT20	0
+#define	MCS_HT20_SGI	1
+#define	MCS_HT40	2
+#define	MCS_HT40_SGI	3
+
+/*
+ * This is currently a copy/paste from the 11n tx code.
+ *
+ * It's used to determine the maximum frame length allowed for the
+ * given rate.  For now this ignores SGI/LGI and will assume long-GI.
+ * This only matters for lower rates that can't fill a full 64k A-MPDU.
+ *
+ * (But it's also important because right now rate control doesn't set
+ * flags like SGI/LGI, STBC, LDPC, TX power, etc.)
+ *
+ * When selecting a set of rates the rate control code will iterate
+ * over the HT20/HT40 max frame length and tell the caller the maximum
+ * length (@ LGI.)  It will also choose a bucket that's the minimum
+ * of this value and the provided aggregate length.  That way the
+ * rate selection will closely match what the eventual formed aggregate
+ * will be rather than "not at all".
+ */
+
+static int ath_rate_sample_max_4ms_framelen[4][32] = {
+        [MCS_HT20] = {
+                3212,  6432,  9648,  12864,  19300,  25736,  28952,  32172,
+                6424,  12852, 19280, 25708,  38568,  51424,  57852,  64280,
+                9628,  19260, 28896, 38528,  57792,  65532,  65532,  65532,
+                12828, 25656, 38488, 51320,  65532,  65532,  65532,  65532,
+        },
+        [MCS_HT20_SGI] = {
+                3572,  7144,  10720,  14296,  21444,  28596,  32172,  35744,
+                7140,  14284, 21428,  28568,  42856,  57144,  64288,  65532,
+                10700, 21408, 32112,  42816,  64228,  65532,  65532,  65532,
+                14256, 28516, 42780,  57040,  65532,  65532,  65532,  65532,
+        },
+        [MCS_HT40] = {
+                6680,  13360,  20044,  26724,  40092,  53456,  60140,  65532,
+                13348, 26700,  40052,  53400,  65532,  65532,  65532,  65532,
+                20004, 40008,  60016,  65532,  65532,  65532,  65532,  65532,
+                26644, 53292,  65532,  65532,  65532,  65532,  65532,  65532,
+        },
+        [MCS_HT40_SGI] = {
+                7420,  14844,  22272,  29696,  44544,  59396,  65532,  65532,
+                14832, 29668,  44504,  59340,  65532,  65532,  65532,  65532,
+                22232, 44464,  65532,  65532,  65532,  65532,  65532,  65532,
+                29616, 59232,  65532,  65532,  65532,  65532,  65532,  65532,
+        }
+};
+
+/*
+ * Given the (potentially MRR) transmit schedule, calculate the maximum
+ * allowed packet size for forming aggregates based on the lowest
+ * MCS rate in the transmit schedule.
+ *
+ * Returns -1 if it's a legacy rate or no MRR.
+ *
+ * XXX TODO: this needs to be limited by the RTS/CTS AR5416 8KB bug limit!
+ * (by checking rts/cts flags and applying sc_rts_aggr_limit)
+ *
+ * XXX TODO: apply per-node max-ampdu size and driver ampdu size limits too.
+ */
+static int
+ath_rate_sample_find_min_pktlength(struct ath_softc *sc,
+    struct ath_node *an, uint8_t rix0, int is_aggr)
+{
+#define	MCS_IDX(ix)		(rt->info[ix].dot11Rate)
+	const HAL_RATE_TABLE *rt = sc->sc_currates;
+	struct sample_node *sn = ATH_NODE_SAMPLE(an);
+	const struct txschedule *sched = &sn->sched[rix0];
+	int max_pkt_length = 65530; // ATH_AGGR_MAXSIZE
+	// Note: this may not be true in all cases; need to check?
+	int is_ht40 = (an->an_node.ni_chw == 40);
+	// Note: not great, but good enough..
+	int idx = is_ht40 ? MCS_HT40 : MCS_HT20;
+
+	if (rt->info[rix0].phy != IEEE80211_T_HT) {
+		return -1;
+	}
+
+	if (! sc->sc_mrretry) {
+		return -1;
+	}
+
+	KASSERT(rix0 == sched->r0, ("rix0 (%x) != sched->r0 (%x)!\n",
+	    rix0, sched->r0));
+
+	/*
+	 * Update based on sched->r{0,1,2,3} if sched->t{0,1,2,3}
+	 * is not zero.
+	 *
+	 * Note: assuming all four PHYs are HT!
+	 *
+	 * XXX TODO: right now I hardcode here and in getxtxrates() that
+	 * rates 2 and 3 in the tx schedule are ignored.  This is important
+	 * for forming larger aggregates because right now (a) the tx schedule
+	 * per rate is fixed, and (b) reliable packet transmission at those
+	 * higher rates kinda needs a lower MCS rate in there somewhere.
+	 * However, this means we can only form shorter aggregates.
+	 * If we've negotiated aggregation then we can actually just
+	 * rely on software retransmit rather than having things fall
+	 * back to like MCS0/1 in hardware, and rate control will hopefully
+	 * do the right thing.
+	 *
+	 * Once the whole rate schedule is passed into ath_rate_findrate(),
+	 * the ath_rc_series is populated ,the fixed tx schedule stuff
+	 * is removed AND getxtxrates() is removed then we can remove this
+	 * check as it can just NOT populate t2/t3.  It also means
+	 * probing can actually use rix0 for probeing and rix1 for the
+	 * current best rate..
+	 */
+	if (sched->t0 != 0) {
+		max_pkt_length = MIN(max_pkt_length,
+		    ath_rate_sample_max_4ms_framelen[idx][MCS_IDX(sched->r0)]);
+	}
+	if (sched->t1 != 0) {
+		max_pkt_length = MIN(max_pkt_length,
+		    ath_rate_sample_max_4ms_framelen[idx][MCS_IDX(sched->r1)]);
+	}
+	if (sched->t2 != 0 && (! is_aggr)) {
+		max_pkt_length = MIN(max_pkt_length,
+		    ath_rate_sample_max_4ms_framelen[idx][MCS_IDX(sched->r2)]);
+	}
+	if (sched->t3 != 0 && (! is_aggr)) {
+		max_pkt_length = MIN(max_pkt_length,
+		    ath_rate_sample_max_4ms_framelen[idx][MCS_IDX(sched->r3)]);
+	}
+
+	return max_pkt_length;
+#undef	MCS
+}
+
 static void	ath_rate_ctl_reset(struct ath_softc *, struct ieee80211_node *);
 
 static __inline int
@@ -125,6 +259,22 @@ size_to_bin(int size)
 		return 2;
 #endif
 #if NUM_PACKET_SIZE_BINS > 4
+	if (size <= packet_size_bins[3])
+		return 3;
+#endif
+#if NUM_PACKET_SIZE_BINS > 5
+	if (size <= packet_size_bins[4])
+		return 4;
+#endif
+#if NUM_PACKET_SIZE_BINS > 6
+	if (size <= packet_size_bins[5])
+		return 5;
+#endif
+#if NUM_PACKET_SIZE_BINS > 7
+	if (size <= packet_size_bins[6])
+		return 6;
+#endif
+#if NUM_PACKET_SIZE_BINS > 8
 #error "add support for more packet sizes"
 #endif
 	return NUM_PACKET_SIZE_BINS-1;
@@ -167,12 +317,12 @@ pick_best_rate(struct ath_node *an, const HAL_RATE_TABLE *rt,
     int size_bin, int require_acked_before)
 {
 	struct sample_node *sn = ATH_NODE_SAMPLE(an);
-        int best_rate_rix, best_rate_tt, best_rate_pct;
+	int best_rate_rix, best_rate_tt, best_rate_pct;
 	uint64_t mask;
 	int rix, tt, pct;
 
-        best_rate_rix = 0;
-        best_rate_tt = 0;
+	best_rate_rix = 0;
+	best_rate_tt = 0;
 	best_rate_pct = 0;
 	for (mask = sn->ratemask, rix = 0; mask != 0; mask >>= 1, rix++) {
 		if ((mask & 1) == 0)		/* not a supported rate */
@@ -194,8 +344,7 @@ pick_best_rate(struct ath_node *an, const HAL_RATE_TABLE *rt,
 		if (sn->stats[size_bin][rix].total_packets > 0) {
 			pct = sn->stats[size_bin][rix].ewma_pct;
 		} else {
-			/* XXX for now, assume 95% ok */
-			pct = 95;
+			pct = -1; /* No percent yet to compare against! */
 		}
 
 		/* don't use a bit-rate that has been failing */
@@ -203,18 +352,35 @@ pick_best_rate(struct ath_node *an, const HAL_RATE_TABLE *rt,
 			continue;
 
 		/*
-		 * For HT, Don't use a bit rate that is much more
-		 * lossy than the best.
+		 * For HT, Don't use a bit rate that is more
+		 * lossy than the best.  Give a bit of leeway.
 		 *
-		 * XXX this isn't optimal; it's just designed to
-		 * eliminate rates that are going to be obviously
-		 * worse.
+		 * Don't consider best rates that we haven't seen
+		 * packets for yet; let sampling start inflence that.
 		 */
 		if (an->an_node.ni_flags & IEEE80211_NODE_HT) {
+			if (pct == -1)
+				continue;
+#if 0
+			IEEE80211_NOTE(an->an_node.ni_vap,
+			    IEEE80211_MSG_RATECTL,
+			    &an->an_node,
+			    "%s: size %d comparing best rate 0x%x pkts/ewma/tt (%ju/%d/%d) "
+			    "to 0x%x pkts/ewma/tt (%ju/%d/%d)",
+			    __func__,
+			    bin_to_size(size_bin),
+			    rt->info[best_rate_rix].dot11Rate,
+			    sn->stats[size_bin][best_rate_rix].total_packets,
+			    best_rate_pct,
+			    best_rate_tt,
+			    rt->info[rix].dot11Rate,
+			    sn->stats[size_bin][rix].total_packets,
+			    pct,
+			    tt);
+#endif
 			if (best_rate_pct > (pct + 50))
 				continue;
 		}
-
 		/*
 		 * For non-MCS rates, use the current average txtime for
 		 * comparison.
@@ -228,19 +394,19 @@ pick_best_rate(struct ath_node *an, const HAL_RATE_TABLE *rt,
 		}
 
 		/*
-		 * Since 2 stream rates have slightly higher TX times,
+		 * Since 2 and 3 stream rates have slightly higher TX times,
 		 * allow a little bit of leeway. This should later
 		 * be abstracted out and properly handled.
 		 */
 		if (an->an_node.ni_flags & IEEE80211_NODE_HT) {
-			if (best_rate_tt == 0 || (tt * 8 <= best_rate_tt * 10)) {
+			if (best_rate_tt == 0 || ((tt * 10) <= (best_rate_tt * 10))) {
 				best_rate_tt = tt;
 				best_rate_rix = rix;
 				best_rate_pct = pct;
 			}
 		}
-        }
-        return (best_rate_tt ? best_rate_rix : -1);
+	}
+	return (best_rate_tt ? best_rate_rix : -1);
 }
 
 /*
@@ -256,11 +422,11 @@ pick_sample_rate(struct sample_softc *ssc , struct ath_node *an,
 	int current_rix, rix;
 	unsigned current_tt;
 	uint64_t mask;
-	
+
 	current_rix = sn->current_rix[size_bin];
 	if (current_rix < 0) {
 		/* no successes yet, send at the lowest bit-rate */
-		/* XXX should return MCS0 if HT */
+		/* XXX TODO should return MCS0 if HT */
 		return 0;
 	}
 
@@ -316,10 +482,22 @@ pick_sample_rate(struct sample_softc *ssc , struct ath_node *an,
 		/*
 		 * For HT, only sample a few rates on either side of the
 		 * current rix; there's quite likely a lot of them.
+		 *
+		 * This is limited to testing rate indexes on either side of
+		 * this MCS, but for all spatial streams.
+		 *
+		 * Otherwise we'll (a) never really sample higher MCS
+		 * rates if we're stuck low, and we'll make weird moves
+		 * like sample MCS8 if we're using MCS7.
 		 */
 		if (an->an_node.ni_flags & IEEE80211_NODE_HT) {
-			if (rix < (current_rix - 3) ||
-			    rix > (current_rix + 3)) {
+			uint8_t current_mcs, rix_mcs;
+
+			current_mcs = MCS(current_rix) & 0x7;
+			rix_mcs = MCS(rix) & 0x7;
+
+			if (rix_mcs < (current_mcs - 2) ||
+			    rix_mcs > (current_mcs + 2)) {
 				mask &= ~((uint64_t) 1<<rix);
 				goto nextrate;
 			}
@@ -459,11 +637,11 @@ ath_rate_pick_seed_rate_ht(struct ath_softc *sc, struct ath_node *an,
 			continue;
 
 		/*
-		 * Pick a medium-speed rate regardless of stream count
-		 * which has not seen any failures. Higher rates may fail;
-		 * we'll try them later.
+		 * Pick a medium-speed rate at 1 spatial stream
+		 * which has not seen any failures.
+		 * Higher rates may fail; we'll try them later.
 		 */
-		if (((MCS(rix) & 0x7) <= 4) &&
+		if (((MCS(rix)& 0x7f) <= 4) &&
 		    sn->stats[size_bin][rix].successive_failures == 0) {
 			break;
 		}
@@ -479,11 +657,11 @@ ath_rate_pick_seed_rate_ht(struct ath_softc *sc, struct ath_node *an,
 #undef	DOT11RATE
 }
 
-
 void
 ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
-		  int shortPreamble, size_t frameLen,
-		  u_int8_t *rix0, int *try0, u_int8_t *txrate)
+		  int shortPreamble, size_t frameLen, int tid,
+		  int is_aggr, u_int8_t *rix0, int *try0,
+		  u_int8_t *txrate, int *maxdur, int *maxpktlen)
 {
 #define	DOT11RATE(ix)	(rt->info[ix].dot11Rate & IEEE80211_RATE_VAL)
 #define	MCS(ix)		(rt->info[ix].dot11Rate | IEEE80211_RATE_MCS)
@@ -492,12 +670,22 @@ ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
 	struct sample_softc *ssc = ATH_SOFTC_SAMPLE(sc);
 	struct ieee80211com *ic = &sc->sc_ic;
 	const HAL_RATE_TABLE *rt = sc->sc_currates;
-	const int size_bin = size_to_bin(frameLen);
+	int size_bin = size_to_bin(frameLen);
 	int rix, mrr, best_rix, change_rates;
 	unsigned average_tx_time;
+	int max_pkt_len;
 
 	ath_rate_update_static_rix(sc, &an->an_node);
 
+	/* For now don't take TID, is_aggr into account */
+	/* Also for now don't calculate a max duration; that'll come later */
+	*maxdur = -1;
+
+	/*
+	 * For now just set it to the frame length; we'll optimise it later.
+	 */
+	*maxpktlen = frameLen;
+
 	if (sn->currates != sc->sc_currates) {
 		device_printf(sc->sc_dev, "%s: currates != sc_currates!\n",
 		    __func__);
@@ -509,28 +697,62 @@ ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
 	if (sn->static_rix != -1) {
 		rix = sn->static_rix;
 		*try0 = ATH_TXMAXTRY;
+
+		/*
+		 * Ensure we limit max packet length here too!
+		 */
+		max_pkt_len = ath_rate_sample_find_min_pktlength(sc, an,
+		    sn->static_rix,
+		    is_aggr);
+		if (max_pkt_len > 0) {
+			*maxpktlen = frameLen = MIN(frameLen, max_pkt_len);
+			size_bin = size_to_bin(frameLen);
+		}
 		goto done;
 	}
 
 	mrr = sc->sc_mrretry;
 	/* XXX check HT protmode too */
+	/* XXX turn into a cap; 11n MACs support MRR+RTSCTS */
 	if (mrr && (ic->ic_flags & IEEE80211_F_USEPROT && !sc->sc_mrrprot))
 		mrr = 0;
 
 	best_rix = pick_best_rate(an, rt, size_bin, !mrr);
+
+	/*
+	 * At this point we've chosen the best rix, so now we
+	 * need to potentially update our maximum packet length
+	 * and size_bin if we're doing 11n rates.
+	 */
+	max_pkt_len = ath_rate_sample_find_min_pktlength(sc, an, best_rix,
+	    is_aggr);
+	if (max_pkt_len > 0) {
+#if 0
+		device_printf(sc->sc_dev,
+		    "Limiting maxpktlen from %d to %d bytes\n",
+		    (int) frameLen, max_pkt_len);
+#endif
+		*maxpktlen = frameLen = MIN(frameLen, max_pkt_len);
+		size_bin = size_to_bin(frameLen);
+	}
+
 	if (best_rix >= 0) {
 		average_tx_time = sn->stats[size_bin][best_rix].average_tx_time;
 	} else {
 		average_tx_time = 0;
 	}
+
 	/*
 	 * Limit the time measuring the performance of other tx
 	 * rates to sample_rate% of the total transmission time.
 	 */
-	if (sn->sample_tt[size_bin] < average_tx_time * (sn->packets_since_sample[size_bin]*ssc->sample_rate/100)) {
+	if (sn->sample_tt[size_bin] <
+	    average_tx_time *
+	    (sn->packets_since_sample[size_bin]*ssc->sample_rate/100)) {
 		rix = pick_sample_rate(ssc, an, rt, size_bin);
 		IEEE80211_NOTE(an->an_node.ni_vap, IEEE80211_MSG_RATECTL,
-		     &an->an_node, "att %d sample_tt %d size %u sample rate %d %s current rate %d %s",
+		     &an->an_node, "att %d sample_tt %d size %u "
+		     "sample rate %d %s current rate %d %s",
 		     average_tx_time,
 		     sn->sample_tt[size_bin],
 		     bin_to_size(size_bin),
@@ -581,9 +803,9 @@ ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
 			int cur_rix = sn->current_rix[size_bin];
 			int cur_att = sn->stats[size_bin][cur_rix].average_tx_time;
 			/*
-			 * If the node is HT, upgrade it if the MCS rate is
-			 * higher and the average tx time is within 20% of
-			 * the current rate. It can fail a little.
+			 * If the node is HT, it if the rate isn't the
+			 * same and the average tx time is within 10%
+			 * of the current rate. It can fail a little.
 			 *
 			 * This is likely not optimal!
 			 */
@@ -591,13 +813,16 @@ ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
 			printf("cur rix/att %x/%d, best rix/att %x/%d\n",
 			    MCS(cur_rix), cur_att, MCS(best_rix), average_tx_time);
 #endif
-			if ((MCS(best_rix) > MCS(cur_rix)) &&
-			    (average_tx_time * 8) <= (cur_att * 10)) {
+			if ((best_rix != cur_rix) &&
+			    (average_tx_time * 9) <= (cur_att * 10)) {
 				IEEE80211_NOTE(an->an_node.ni_vap,
 				    IEEE80211_MSG_RATECTL, &an->an_node,
-				    "%s: HT: best_rix 0x%d > cur_rix 0x%x, average_tx_time %d, cur_att %d",
-				    __func__,
-				    MCS(best_rix), MCS(cur_rix), average_tx_time, cur_att);
+				    "%s: HT: size %d best_rix 0x%x > "
+				    " cur_rix 0x%x, average_tx_time %d,"
+				    " cur_att %d",
+				    __func__, bin_to_size(size_bin),
+				    MCS(best_rix), MCS(cur_rix),
+				    average_tx_time, cur_att);
 				change_rates = 1;
 			}
 		}
@@ -609,15 +834,19 @@ ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
 				IEEE80211_NOTE(an->an_node.ni_vap,
 				    IEEE80211_MSG_RATECTL,
 				    &an->an_node,
-"%s: size %d switch rate %d (%d/%d) -> %d (%d/%d) after %d packets mrr %d",
+"%s: size %d switch rate %d %s (%d/%d) EWMA %d -> %d %s (%d/%d) EWMA %d after %d packets mrr %d",
 				    __func__,
 				    bin_to_size(size_bin),
-				    RATE(sn->current_rix[size_bin]),
+				    dot11rate(rt, sn->current_rix[size_bin]),
+				    dot11rate_label(rt, sn->current_rix[size_bin]),
 				    sn->stats[size_bin][sn->current_rix[size_bin]].average_tx_time,
 				    sn->stats[size_bin][sn->current_rix[size_bin]].perfect_tx_time,
-				    RATE(best_rix),
+				    sn->stats[size_bin][sn->current_rix[size_bin]].ewma_pct,
+				    dot11rate(rt, best_rix),
+				    dot11rate_label(rt, best_rix),
 				    sn->stats[size_bin][best_rix].average_tx_time,
 				    sn->stats[size_bin][best_rix].perfect_tx_time,
+				    sn->stats[size_bin][best_rix].ewma_pct,
 				    sn->packets_since_switch[size_bin],
 				    mrr);
 			}
@@ -627,7 +856,9 @@ ath_rate_findrate(struct ath_softc *sc, struct ath_node *an,
 			/* 
 			 * Set the visible txrate for this node.
 			 */
-			an->an_node.ni_txrate = (rt->info[best_rix].phy == IEEE80211_T_HT) ?  MCS(best_rix) : DOT11RATE(best_rix);
+			an->an_node.ni_txrate =
+			    (rt->info[best_rix].phy == IEEE80211_T_HT) ?
+			     MCS(best_rix) : DOT11RATE(best_rix);
 		}
 		rix = sn->current_rix[size_bin];
 		sn->packets_since_switch[size_bin]++;
@@ -654,6 +885,7 @@ done:
 	*txrate = rt->info[rix].rateCode
 		| (shortPreamble ? rt->info[rix].shortPreamble : 0);
 	sn->packets_sent[size_bin]++;
+
 #undef DOT11RATE
 #undef MCS
 #undef RATE
@@ -665,7 +897,7 @@ done:
  */
 void
 ath_rate_getxtxrates(struct ath_softc *sc, struct ath_node *an,
-    uint8_t rix0, struct ath_rc_series *rc)
+    uint8_t rix0, int is_aggr, struct ath_rc_series *rc)
 {
 	struct sample_node *sn = ATH_NODE_SAMPLE(an);
 	const struct txschedule *sched = &sn->sched[rix0];
@@ -682,8 +914,13 @@ ath_rate_getxtxrates(struct ath_softc *sc, struct ath_node *an,
 
 	rc[0].tries = sched->t0;
 	rc[1].tries = sched->t1;
-	rc[2].tries = sched->t2;
-	rc[3].tries = sched->t3;
+
+	if (is_aggr) {
+		rc[2].tries = rc[3].tries = 0;
+	} else {
+		rc[2].tries = sched->t2;
+		rc[3].tries = sched->t3;
+	}
 }
 
 void
@@ -711,13 +948,22 @@ ath_rate_setupxtxdesc(struct ath_softc *sc, struct ath_node *an,
 	    s3code, sched->t3);		/* series 3 */
 }
 
+/*
+ * Update the current statistics.
+ *
+ * Note that status is for the FINAL transmit status, not this
+ * particular attempt.  So, check if tries > tries0 and if so
+ * assume this status failed.
+ *
+ * This is important because some failures are due to both
+ * short AND long retries; if the final issue was a short
+ * retry failure then we still want to account for the
+ * bad long retry attempts.
+ */
 static void
 update_stats(struct ath_softc *sc, struct ath_node *an, 
 		  int frame_size,
 		  int rix0, int tries0,
-		  int rix1, int tries1,
-		  int rix2, int tries2,
-		  int rix3, int tries3,
 		  int short_tries, int tries, int status,
 		  int nframes, int nbad)
 {
@@ -728,38 +974,39 @@ update_stats(struct ath_softc *sc, struct ath_node *an,
 #endif
 	const int size_bin = size_to_bin(frame_size);
 	const int size = bin_to_size(size_bin);
-	int tt, tries_so_far;
+	int tt;
 	int is_ht40 = (an->an_node.ni_chw == 40);
 	int pct;
 
 	if (!IS_RATE_DEFINED(sn, rix0))
 		return;
-	tt = calc_usecs_unicast_packet(sc, size, rix0, short_tries,
-		MIN(tries0, tries) - 1, is_ht40);
-	tries_so_far = tries0;
 
-	if (tries1 && tries_so_far < tries) {
-		if (!IS_RATE_DEFINED(sn, rix1))
-			return;
-		tt += calc_usecs_unicast_packet(sc, size, rix1, short_tries,
-			MIN(tries1 + tries_so_far, tries) - tries_so_far - 1, is_ht40);
-		tries_so_far += tries1;
+	/*
+	 * Treat long retries as us exceeding retries, even
+	 * if the eventual attempt at some other MRR schedule
+	 * succeeded.
+	 */
+	if (tries > tries0) {
+		status = HAL_TXERR_XRETRY;
 	}
 
-	if (tries2 && tries_so_far < tries) {
-		if (!IS_RATE_DEFINED(sn, rix2))
-			return;
-		tt += calc_usecs_unicast_packet(sc, size, rix2, short_tries,
-			MIN(tries2 + tries_so_far, tries) - tries_so_far - 1, is_ht40);
-		tries_so_far += tries2;
-	}
+	/*
+	 * If status is FAIL then we treat all frames as bad.
+	 * This better accurately tracks EWMA and average TX time
+	 * because even if the eventual transmission succeeded,
+	 * transmission at this rate did not.
+	 */
+	if (status != 0)
+		nbad = nframes;
 
-	if (tries3 && tries_so_far < tries) {
-		if (!IS_RATE_DEFINED(sn, rix3))
-			return;
-		tt += calc_usecs_unicast_packet(sc, size, rix3, short_tries,
-			MIN(tries3 + tries_so_far, tries) - tries_so_far - 1, is_ht40);
-	}
+	/*
+	 * Ignore short tries count as contributing to failure.
+	 * Right now there's no way to know if it's part of any
+	 * given rate attempt, and outside of the RTS/CTS management
+	 * rate, it doesn't /really/ help.
+	 */
+	tt = calc_usecs_unicast_packet(sc, size, rix0,
+	    0 /* short_tries */, MIN(tries0, tries) - 1, is_ht40);
 
 	if (sn->stats[size_bin][rix0].total_packets < ssc->smoothing_minpackets) {
 		/* just average the first few packets */
@@ -772,34 +1019,9 @@ update_stats(struct ath_softc *sc, struct ath_node *an,
 			((sn->stats[size_bin][rix0].average_tx_time * ssc->smoothing_rate) + 
 			 (tt * (100 - ssc->smoothing_rate))) / 100;
 	}
-	
-	/*
-	 * XXX Don't mark the higher bit rates as also having failed; as this
-	 * unfortunately stops those rates from being tasted when trying to
-	 * TX. This happens with 11n aggregation.
-	 *
-	 * This is valid for higher CCK rates, higher OFDM rates, and higher
-	 * HT rates within the current number of streams (eg MCS0..7, 8..15,
-	 * etc.)
-	 */
+
 	if (nframes == nbad) {
-#if 0
-		int y;
-#endif
 		sn->stats[size_bin][rix0].successive_failures += nbad;
-#if 0
-		for (y = size_bin+1; y < NUM_PACKET_SIZE_BINS; y++) {
-			/*
-			 * Also say larger packets failed since we
-			 * assume if a small packet fails at a
-			 * bit-rate then a larger one will also.
-			 */
-			sn->stats[y][rix0].successive_failures += nbad;
-			sn->stats[y][rix0].last_tx = ticks;
-			sn->stats[y][rix0].tries += tries;
-			sn->stats[y][rix0].total_packets += nframes;
-		}
-#endif
 	} else {
 		sn->stats[size_bin][rix0].packets_acked += (nframes - nbad);
 		sn->stats[size_bin][rix0].successive_failures = 0;
@@ -828,20 +1050,31 @@ update_stats(struct ath_softc *sc, struct ath_node *an,
 			 (pct * (100 - ssc->smoothing_rate))) / 100;
 	}
 
+	/*
+	 * Only update the sample time for the initial sample rix.
+	 * We've updated the statistics on each of the other retries
+	 * fine, but we should only update the sample_tt with what
+	 * was actually sampled.
+	 *
+	 * However, to aide in debugging, log all the failures for
+	 * each of the buckets
+	 */
+	IEEE80211_NOTE(an->an_node.ni_vap, IEEE80211_MSG_RATECTL,
+	   &an->an_node,
+	    "%s: size %d %s %s rate %d %s tries (%d/%d) tt %d "
+	    "avg_tt (%d/%d) nfrm %d nbad %d",
+	    __func__,
+	    size,
+	    status ? "FAIL" : "OK",
+	    rix0 == sn->current_sample_rix[size_bin] ? "sample" : "mrr",
+	    dot11rate(rt, rix0),
+	    dot11rate_label(rt, rix0),
+	    short_tries, tries, tt, 
+	    sn->stats[size_bin][rix0].average_tx_time,
+	    sn->stats[size_bin][rix0].perfect_tx_time,
+	    nframes, nbad);
 
 	if (rix0 == sn->current_sample_rix[size_bin]) {
-		IEEE80211_NOTE(an->an_node.ni_vap, IEEE80211_MSG_RATECTL,
-		   &an->an_node,
-"%s: size %d %s sample rate %d %s tries (%d/%d) tt %d avg_tt (%d/%d) nfrm %d nbad %d", 
-		    __func__, 
-		    size,
-		    status ? "FAIL" : "OK",
-		    dot11rate(rt, rix0),
-		    dot11rate_label(rt, rix0),
-		    short_tries, tries, tt, 
-		    sn->stats[size_bin][rix0].average_tx_time,
-		    sn->stats[size_bin][rix0].perfect_tx_time,
-		    nframes, nbad);
 		sn->sample_tt[size_bin] = tt;
 		sn->current_sample_rix[size_bin] = -1;
 	}
@@ -859,7 +1092,7 @@ badrate(struct ath_softc *sc, int series, int hwrate, int tries, int status)
 void
 ath_rate_tx_complete(struct ath_softc *sc, struct ath_node *an,
 	const struct ath_rc_series *rc, const struct ath_tx_status *ts,
-	int frame_size, int nframes, int nbad)
+	int frame_size, int rc_framesize, int nframes, int nbad)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct sample_node *sn = ATH_NODE_SAMPLE(an);
@@ -879,6 +1112,40 @@ ath_rate_tx_complete(struct ath_softc *sc, struct ath_node *an,
 
 	if (frame_size == 0)		    /* NB: should not happen */
 		frame_size = 1500;
+	if (rc_framesize == 0)		    /* NB: should not happen */
+		rc_framesize = 1500;
+
+	/*
+	 * There are still some places where what rate control set as
+	 * a limit but the hardware decided, for some reason, to transmit
+	 * at a smaller size that fell into a different bucket.
+	 *
+	 * The eternal question here is - which size_bin should it go in?
+	 * The one that was requested, or the one that was transmitted?
+	 *
+	 * Here's the problem - if we use the one that was transmitted,
+	 * we may continue to hit corner cases where we make a rate
+	 * selection using a higher bin but only update the smaller bin;
+	 * thus never really "adapting".
+	 *
+	 * If however we update the larger bin, we're not accurately
+	 * representing the channel state at that frame/aggregate size.
+	 * However if we keep hitting the larger request but completing
+	 * a smaller size, we at least updates based on what the
+	 * request was /for/.
+	 *
+	 * I'm going to err on the side of caution and choose the
+	 * latter.
+	 */
+	if (size_to_bin(frame_size) != size_to_bin(rc_framesize)) {
+#if 0
+		device_printf(sc->sc_dev,
+		    "%s: completed but frame size buckets mismatch "
+		    "(completed %d tx'ed %d)\n",
+		    __func__, frame_size, rc_framesize);
+#endif
+		frame_size = rc_framesize;
+	}
 
 	if (sn->ratemask == 0) {
 		IEEE80211_NOTE(an->an_node.ni_vap, IEEE80211_MSG_RATECTL,
@@ -916,9 +1183,6 @@ ath_rate_tx_complete(struct ath_softc *sc, struct ath_node *an,
 		     short_tries, long_tries, nframes, nbad);
 		update_stats(sc, an, frame_size, 
 			     final_rix, long_tries,
-			     0, 0,
-			     0, 0,
-			     0, 0,
 			     short_tries, long_tries, status,
 			     nframes, nbad);
 
@@ -957,20 +1221,15 @@ ath_rate_tx_complete(struct ath_softc *sc, struct ath_node *an,
 		}
 
 		/*
-		 * NB: series > 0 are not penalized for failure
-		 * based on the try counts under the assumption
-		 * that losses are often bursty and since we
-		 * sample higher rates 1 try at a time doing so
-		 * may unfairly penalize them.
+		 * This used to not penalise other tries because loss
+		 * can be bursty, but it's then not accurately keeping
+		 * the avg TX time and EWMA updated.
 		 */
 		if (rc[0].tries) {
 			update_stats(sc, an, frame_size,
 				     rc[0].rix, rc[0].tries,
-				     rc[1].rix, rc[1].tries,
-				     rc[2].rix, rc[2].tries,
-				     rc[3].rix, rc[3].tries,
 				     short_tries, long_tries,
-				     long_tries > rc[0].tries,
+				     status,
 				     nframes, nbad);
 			long_tries -= rc[0].tries;
 		}
@@ -978,9 +1237,6 @@ ath_rate_tx_complete(struct ath_softc *sc, struct ath_node *an,
 		if (rc[1].tries && finalTSIdx > 0) {
 			update_stats(sc, an, frame_size,
 				     rc[1].rix, rc[1].tries,
-				     rc[2].rix, rc[2].tries,
-				     rc[3].rix, rc[3].tries,
-				     0, 0,
 				     short_tries, long_tries,
 				     status,
 				     nframes, nbad);
@@ -990,9 +1246,6 @@ ath_rate_tx_complete(struct ath_softc *sc, struct ath_node *an,
 		if (rc[2].tries && finalTSIdx > 1) {
 			update_stats(sc, an, frame_size,
 				     rc[2].rix, rc[2].tries,
-				     rc[3].rix, rc[3].tries,
-				     0, 0,
-				     0, 0,
 				     short_tries, long_tries,
 				     status,
 				     nframes, nbad);
@@ -1002,9 +1255,6 @@ ath_rate_tx_complete(struct ath_softc *sc, struct ath_node *an,
 		if (rc[3].tries && finalTSIdx > 2) {
 			update_stats(sc, an, frame_size,
 				     rc[3].rix, rc[3].tries,
-				     0, 0,
-				     0, 0,
-				     0, 0,
 				     short_tries, long_tries,
 				     status,
 				     nframes, nbad);
@@ -1019,6 +1269,11 @@ ath_rate_newassoc(struct ath_softc *sc, struct ath_node *an, int isnew)
 		ath_rate_ctl_reset(sc, &an->an_node);
 }
 
+void
+ath_rate_update_rx_rssi(struct ath_softc *sc, struct ath_node *an, int rssi)
+{
+}
+
 static const struct txschedule *mrr_schedules[IEEE80211_MODE_MAX+2] = {
 	NULL,		/* IEEE80211_MODE_AUTO */
 	series_11a,	/* IEEE80211_MODE_11A */
@@ -1375,7 +1630,7 @@ struct ath_ratectrl *
 ath_rate_attach(struct ath_softc *sc)
 {
 	struct sample_softc *ssc;
-	
+
 	ssc = malloc(sizeof(struct sample_softc), M_DEVBUF, M_NOWAIT|M_ZERO);
 	if (ssc == NULL)
 		return NULL;
@@ -1394,6 +1649,6 @@ void
 ath_rate_detach(struct ath_ratectrl *arc)
 {
 	struct sample_softc *ssc = (struct sample_softc *) arc;
-	
+
 	free(ssc, M_DEVBUF);
 }
diff --git a/sys/dev/ath/ath_rate/sample/sample.h b/sys/dev/ath/ath_rate/sample/sample.h
index a4f471e1c188..3b6fe9f6fba2 100644
--- a/sys/dev/ath/ath_rate/sample/sample.h
+++ b/sys/dev/ath/ath_rate/sample/sample.h
@@ -76,12 +76,11 @@ struct txschedule {
 };
 
 /*
- * for now, we track performance for three different packet
- * size buckets
+ * We track performance for eight different packet size buckets.
  */
-#define NUM_PACKET_SIZE_BINS 2
+#define NUM_PACKET_SIZE_BINS 7
 
-static const int packet_size_bins[NUM_PACKET_SIZE_BINS]  = { 250, 1600 };
+static const int packet_size_bins[NUM_PACKET_SIZE_BINS]  = { 250, 1600, 4096, 8192, 16384, 32768, 65536 };
 
 static inline int
 bin_to_size(int index)
@@ -106,7 +105,7 @@ struct sample_node {
 
 	int current_rix[NUM_PACKET_SIZE_BINS];
 	int packets_since_switch[NUM_PACKET_SIZE_BINS];
-	unsigned ticks_since_switch[NUM_PACKET_SIZE_BINS];
+	int ticks_since_switch[NUM_PACKET_SIZE_BINS];
 
 	int packets_since_sample[NUM_PACKET_SIZE_BINS];
 	unsigned sample_tt[NUM_PACKET_SIZE_BINS];
@@ -138,7 +137,7 @@ static unsigned calc_usecs_unicast_packet(struct ath_softc *sc,
 	const HAL_RATE_TABLE *rt = sc->sc_currates;
 	struct ieee80211com *ic = &sc->sc_ic;
 	int rts, cts;
-	
+
 	unsigned t_slot = 20;
 	unsigned t_difs = 50; 
 	unsigned t_sifs = 10; 
@@ -146,7 +145,7 @@ static unsigned calc_usecs_unicast_packet(struct ath_softc *sc,
 	int x = 0;
 	int cw = WIFI_CW_MIN;
 	int cix;
-	
+
 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
 
 	if (rix >= rt->rateCount) {
diff --git a/sys/dev/ath/ath_rate/sample/tx_schedules.h b/sys/dev/ath/ath_rate/sample/tx_schedules.h
index 02805bec6566..c89ba59f111b 100644
--- a/sys/dev/ath/ath_rate/sample/tx_schedules.h
+++ b/sys/dev/ath/ath_rate/sample/tx_schedules.h
@@ -172,30 +172,30 @@ static const struct txschedule series_11ng[] = {
 	{ 4,NG1(  26), 3,NG1(19.5), 4,NG1( 6.5), 2,NG1(6.5) },  /*  26Mb/s */
 	{ 4,NG1(  39), 3,NG1(  26), 4,NG1(19.5), 2,NG1(6.5) },  /*  39Mb/s */
 	{ 4,NG1(  52), 3,NG1(  39), 4,NG1(  26), 2,NG1(6.5) },  /*  52Mb/s */
-	{ 4,NG1(58.5), 3,NG1(  52), 4,NG1(  39), 2,NG1( 13) },  /*58.5Mb/s */
-	{ 4,NG1(  65), 3,NG1(58.5), 4,NG1(  52), 2,NG1( 13) },  /*  65Mb/s */
+	{ 4,NG1(58.5), 3,NG1(  52), 4,NG1(  39), 2,NG1(6.5) },  /*58.5Mb/s */
+	{ 4,NG1(  65), 3,NG1(58.5), 4,NG1(  52), 2,NG1(6.5) },  /*  65Mb/s */
 
 	/* 2 stream rates */
 
-	{ 3,NG2(  13), 3,NG2(  13), 0,NG2(  13), 0,NG2( 13) },  /*  13Mb/s */
-	{ 4,NG2(  26), 3,NG2(  13), 4,NG2(  13), 0,NG2( 13) },  /*  26Mb/s */
-	{ 4,NG2(  39), 3,NG2(  26), 4,NG2(  13), 2,NG2( 13) },  /*  39Mb/s */
-	{ 4,NG2(  52), 3,NG2(  39), 4,NG2(  26), 2,NG2( 13) },  /*  52Mb/s */
-	{ 4,NG2(  78), 3,NG2(  52), 4,NG2(  39), 2,NG2( 13) },  /*  78Mb/s */
-	{ 4,NG2( 104), 3,NG2(  78), 4,NG2(  52), 2,NG2( 13) },  /* 104Mb/s */
-	{ 4,NG2( 117), 3,NG2( 104), 4,NG2(  78), 2,NG2( 26) },  /* 117Mb/s */
-	{ 4,NG2( 130), 3,NG2( 117), 4,NG2( 104), 2,NG2( 26) },  /* 130Mb/s */
+	{ 3,NG2(  13), 3,NG1(6.5), 0,NG2(  13), 0,NG2( 13) },  /*  13Mb/s */
+	{ 4,NG2(  26), 3,NG2(  13), 4,NG1(6.5), 0,NG2( 13) },  /*  26Mb/s */
+	{ 4,NG2(  39), 3,NG2(  26), 4,NG2(  13), 2,NG1(6.5) },  /*  39Mb/s */
+	{ 4,NG2(  52), 3,NG2(  39), 4,NG2(  26), 2,NG1(6.5) },  /*  52Mb/s */
+	{ 4,NG2(  78), 3,NG2(  52), 4,NG2(  39), 2,NG1(6.5) },  /*  78Mb/s */
+	{ 4,NG2( 104), 3,NG2(  78), 4,NG2(  52), 2,NG1(6.5) },  /* 104Mb/s */
+	{ 4,NG2( 117), 3,NG2( 104), 4,NG2(  78), 2,NG1(6.5) },  /* 117Mb/s */
+	{ 4,NG2( 130), 3,NG2( 117), 4,NG2( 104), 2,NG1(6.5) },  /* 130Mb/s */
 
 	/* 3 stream rates */
 
-	{ 3,NG3(19.5), 3,NG3(19.5), 0,NG3(19.5), 0,NG3(19.5) },  /*  19Mb/s */
-	{ 3,NG3(  39), 3,NG3(19.5), 0,NG3(19.5), 0,NG3(19.5) },  /*  39Mb/s */
-	{ 3,NG3(58.5), 3,NG3(  39), 0,NG3(19.5), 0,NG3(19.5) },  /*  58Mb/s */
-	{ 3,NG3(  78), 3,NG3(58.5), 0,NG3(  39), 0,NG3(19.5) },  /*  78Mb/s */
-	{ 3,NG3( 117), 3,NG3(  78), 0,NG3(58.5), 0,NG3(19.5) },  /* 117Mb/s */
-	{ 3,NG3( 156), 3,NG3( 117), 0,NG3(  78), 0,NG3(19.5) },  /*  156Mb/s */
-	{ 3,NG3(175.5), 3,NG3( 156), 0,NG3( 117), 0,NG3(  39) },  /*  175Mb/s */
-	{ 3,NG3( 195), 3,NG3( 195), 0,NG3( 156), 0,NG3(58.5) },  /* 195Mb/s */
+	{ 3,NG3(19.5), 3,NG1(6.5), 0,NG3(19.5), 0,NG3(19.5) },  /*  19Mb/s */
+	{ 3,NG3(  39), 3,NG3(19.5), 4,NG1(6.5), 0,NG3(19.5) },  /*  39Mb/s */
+	{ 3,NG3(58.5), 3,NG3(  39), 4,NG1(6.5), 0,NG3(19.5) },  /*  58Mb/s */
+	{ 3,NG3(  78), 3,NG3(58.5), 4,NG1(6.5), 0,NG3(19.5) },  /*  78Mb/s */
+	{ 3,NG3( 117), 3,NG3(  78), 4,NG1(6.5), 0,NG3(19.5) },  /* 117Mb/s */
+	{ 3,NG3( 156), 3,NG3( 117), 4,NG1(6.5), 0,NG3(19.5) },  /*  156Mb/s */
+	{ 3,NG3(175.5), 3,NG3( 156), 4,NG1(6.5), 0,NG3(  39) },  /*  175Mb/s */
+	{ 3,NG3( 195), 3,NG3( 195), 4,NG1(6.5), 0,NG3(58.5) },  /* 195Mb/s */
 
 };
 #undef G
diff --git a/sys/dev/ath/if_ath.c b/sys/dev/ath/if_ath.c
index 7e6ab3c614b7..34a9311c834a 100644
--- a/sys/dev/ath/if_ath.c
+++ b/sys/dev/ath/if_ath.c
@@ -160,7 +160,6 @@ static int	ath_init(struct ath_softc *);
 static void	ath_stop(struct ath_softc *);
 static int	ath_reset_vap(struct ieee80211vap *, u_long);
 static int	ath_transmit(struct ieee80211com *, struct mbuf *);
-static int	ath_media_change(struct ifnet *);
 static void	ath_watchdog(void *);
 static void	ath_parent(struct ieee80211com *);
 static void	ath_fatal_proc(void *, int);
@@ -1221,7 +1220,6 @@ ath_attach(u_int16_t devid, struct ath_softc *sc)
 					 IEEE80211_HTC_TXLDPC;
 		}
 
-
 		device_printf(sc->sc_dev,
 		    "[HT] %d RX streams; %d TX streams\n", rxs, txs);
 	}
@@ -1767,8 +1765,8 @@ ath_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 	ATH_UNLOCK(sc);
 
 	/* complete setup */
-	ieee80211_vap_attach(vap, ath_media_change, ieee80211_media_status,
-	    mac);
+	ieee80211_vap_attach(vap, ieee80211_media_change,
+	    ieee80211_media_status, mac);
 	return vap;
 bad2:
 	reclaim_address(sc, mac);
@@ -1801,6 +1799,7 @@ ath_vap_delete(struct ieee80211vap *vap)
 		ath_hal_intrset(ah, 0);		/* disable interrupts */
 		/* XXX Do all frames from all vaps/nodes need draining here? */
 		ath_stoprecv(sc, 1);		/* stop recv side */
+		ath_rx_flush(sc);
 		ath_draintxq(sc, ATH_RESET_DEFAULT);		/* stop hw xmit side */
 	}
 
@@ -2379,7 +2378,7 @@ ath_fatal_proc(void *arg, int pending)
 		    "0x%08x 0x%08x 0x%08x, 0x%08x 0x%08x 0x%08x\n", state[0],
 		    state[1] , state[2], state[3], state[4], state[5]);
 	}
-	ath_reset(sc, ATH_RESET_NOLOSS);
+	ath_reset(sc, ATH_RESET_NOLOSS, HAL_RESET_FORCE_COLD);
 }
 
 static void
@@ -2490,11 +2489,11 @@ ath_bmiss_proc(void *arg, int pending)
 	 * to clear.
 	 */
 	if (ath_hal_gethangstate(sc->sc_ah, 0xff, &hangs) && hangs != 0) {
-		ath_reset(sc, ATH_RESET_NOLOSS);
+		ath_reset(sc, ATH_RESET_NOLOSS, HAL_RESET_BBPANIC);
 		device_printf(sc->sc_dev,
 		    "bb hang detected (0x%x), resetting\n", hangs);
 	} else {
-		ath_reset(sc, ATH_RESET_NOLOSS);
+		ath_reset(sc, ATH_RESET_NOLOSS, HAL_RESET_FORCE_COLD);
 		ieee80211_beacon_miss(&sc->sc_ic);
 	}
 
@@ -2893,7 +2892,8 @@ ath_reset_grablock(struct ath_softc *sc, int dowait)
  * to reset or reload hardware state.
  */
 int
-ath_reset(struct ath_softc *sc, ATH_RESET_TYPE reset_type)
+ath_reset(struct ath_softc *sc, ATH_RESET_TYPE reset_type,
+    HAL_RESET_TYPE ah_reset_type)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ath_hal *ah = sc->sc_ah;
@@ -2961,7 +2961,7 @@ ath_reset(struct ath_softc *sc, ATH_RESET_TYPE reset_type)
 	ath_hal_setchainmasks(sc->sc_ah, sc->sc_cur_txchainmask,
 	    sc->sc_cur_rxchainmask);
 	if (!ath_hal_reset(ah, sc->sc_opmode, ic->ic_curchan, AH_TRUE,
-	    HAL_RESET_NORMAL, &status))
+	    ah_reset_type, &status))
 		device_printf(sc->sc_dev,
 		    "%s: unable to reset hardware; hal status %u\n",
 		    __func__, status);
@@ -3097,7 +3097,7 @@ ath_reset_vap(struct ieee80211vap *vap, u_long cmd)
 		return 0;
 	}
 	/* XXX? Full or NOLOSS? */
-	return ath_reset(sc, ATH_RESET_FULL);
+	return ath_reset(sc, ATH_RESET_FULL, HAL_RESET_NORMAL);
 }
 
 struct ath_buf *
@@ -3538,16 +3538,8 @@ finish:
 	ATH_UNLOCK(sc);
 
 	ATH_KTR(sc, ATH_KTR_TX, 0, "ath_transmit: finished");
-	
-	return (retval);
-}
 
-static int
-ath_media_change(struct ifnet *ifp)
-{
-	int error = ieee80211_media_change(ifp);
-	/* NB: only the fixed rate can change and that doesn't need a reset */
-	return (error == ENETRESET ? 0 : error);
+	return (retval);
 }
 
 /*
@@ -3591,6 +3583,25 @@ ath_update_promisc(struct ieee80211com *ic)
 	DPRINTF(sc, ATH_DEBUG_MODE, "%s: RX filter 0x%x\n", __func__, rfilt);
 }
 
+static u_int
+ath_hash_maddr(void *arg, struct sockaddr_dl *sdl, u_int cnt)
+{
+	uint32_t val, *mfilt = arg;
+	char *dl;
+	uint8_t pos;
+
+	/* calculate XOR of eight 6bit values */
+	dl = LLADDR(sdl);
+	val = le32dec(dl + 0);
+	pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
+	val = le32dec(dl + 3);
+	pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
+	pos &= 0x3f;
+	mfilt[pos / 32] |= (1 << (pos % 32));
+
+	return (1);
+}
+
 /*
  * Driver-internal mcast update call.
  *
@@ -3605,35 +3616,13 @@ ath_update_mcast_hw(struct ath_softc *sc)
 	/* calculate and install multicast filter */
 	if (ic->ic_allmulti == 0) {
 		struct ieee80211vap *vap;
-		struct ifnet *ifp;
-		struct ifmultiaddr *ifma;
 
 		/*
 		 * Merge multicast addresses to form the hardware filter.
 		 */
 		mfilt[0] = mfilt[1] = 0;
-		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
-			ifp = vap->iv_ifp;
-			if_maddr_rlock(ifp);
-			CK_STAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
-				caddr_t dl;
-				uint32_t val;
-				uint8_t pos;
-
-				/* calculate XOR of eight 6bit values */
-				dl = LLADDR((struct sockaddr_dl *)
-				    ifma->ifma_addr);
-				val = le32dec(dl + 0);
-				pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^
-				    val;
-				val = le32dec(dl + 3);
-				pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^
-				    val;
-				pos &= 0x3f;
-				mfilt[pos / 32] |= (1 << (pos % 32));
-			}
-			if_maddr_runlock(ifp);
-		}
+		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
+			if_foreach_llmaddr(vap->iv_ifp, ath_hash_maddr, &mfilt);
 	} else
 		mfilt[0] = mfilt[1] = ~0;
 
@@ -3780,7 +3769,7 @@ ath_reset_proc(void *arg, int pending)
 #if 0
 	device_printf(sc->sc_dev, "%s: resetting\n", __func__);
 #endif
-	ath_reset(sc, ATH_RESET_NOLOSS);
+	ath_reset(sc, ATH_RESET_NOLOSS, HAL_RESET_FORCE_COLD);
 }
 
 /*
@@ -3807,7 +3796,7 @@ ath_bstuck_proc(void *arg, int pending)
 	 * This assumes that there's no simultaneous channel mode change
 	 * occurring.
 	 */
-	ath_reset(sc, ATH_RESET_NOLOSS);
+	ath_reset(sc, ATH_RESET_NOLOSS, HAL_RESET_FORCE_COLD);
 }
 
 static int
@@ -3882,6 +3871,10 @@ ath_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
 	/* XXX setup ath_tid */
 	ath_tx_tid_init(sc, an);
 
+	an->an_node_stats.ns_avgbrssi = ATH_RSSI_DUMMY_MARKER;
+	an->an_node_stats.ns_avgrssi = ATH_RSSI_DUMMY_MARKER;
+	an->an_node_stats.ns_avgtxrssi = ATH_RSSI_DUMMY_MARKER;
+
 	DPRINTF(sc, ATH_DEBUG_NODE, "%s: %6D: an %p\n", __func__, mac, ":", an);
 	return &an->an_node;
 }
@@ -4300,7 +4293,7 @@ ath_tx_default_comp(struct ath_softc *sc, struct ath_buf *bf, int fail)
 void
 ath_tx_update_ratectrl(struct ath_softc *sc, struct ieee80211_node *ni,
     struct ath_rc_series *rc, struct ath_tx_status *ts, int frmlen,
-    int nframes, int nbad)
+    int rc_framelen, int nframes, int nbad)
 {
 	struct ath_node *an;
 
@@ -4311,9 +4304,16 @@ ath_tx_update_ratectrl(struct ath_softc *sc, struct ieee80211_node *ni,
 	an = ATH_NODE(ni);
 	ATH_NODE_UNLOCK_ASSERT(an);
 
+	/*
+	 * XXX TODO: teach the rate control about TXERR_FILT and
+	 * see about handling it (eg see how many attempts were
+	 * made before it got filtered and account for that.)
+	 */
+
 	if ((ts->ts_status & HAL_TXERR_FILT) == 0) {
 		ATH_NODE_LOCK(an);
-		ath_rate_tx_complete(sc, an, rc, ts, frmlen, nframes, nbad);
+		ath_rate_tx_complete(sc, an, rc, ts, frmlen, rc_framelen,
+		    nframes, nbad);
 		ATH_NODE_UNLOCK(an);
 	}
 }
@@ -4354,10 +4354,15 @@ ath_tx_process_buf_completion(struct ath_softc *sc, struct ath_txq *txq,
 			/*
 			 * XXX assume this isn't an aggregate
 			 * frame.
+			 *
+			 * XXX TODO: also do this for filtered frames?
+			 * Once rate control knows about them?
 			 */
 			ath_tx_update_ratectrl(sc, ni,
 			     bf->bf_state.bfs_rc, ts,
-			    bf->bf_state.bfs_pktlen, 1,
+			    bf->bf_state.bfs_pktlen,
+			    bf->bf_state.bfs_pktlen,
+			    1,
 			    (ts->ts_status == 0 ? 0 : 1));
 		}
 		ath_tx_default_comp(sc, bf, 0);
@@ -4365,8 +4370,6 @@ ath_tx_process_buf_completion(struct ath_softc *sc, struct ath_txq *txq,
 		bf->bf_comp(sc, bf, 0);
 }
 
-
-
 /*
  * Process completed xmit descriptors from the specified queue.
  * Kick the packet scheduler if needed. This can occur from this
@@ -4493,6 +4496,8 @@ ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq, int dosched)
 			sc->sc_stats.ast_tx_rssi = ts->ts_rssi;
 			ATH_RSSI_LPF(sc->sc_halstats.ns_avgtxrssi,
 				ts->ts_rssi);
+			ATH_RSSI_LPF(ATH_NODE(ni)->an_node_stats.ns_avgtxrssi,
+				ts->ts_rssi);
 		}
 		ATH_TXQ_UNLOCK(txq);
 
@@ -5435,6 +5440,20 @@ ath_calibrate(void *arg)
 				__func__, sc->sc_curchan->ic_freq);
 			sc->sc_stats.ast_per_calfail++;
 		}
+		/*
+		 * XXX TODO: get the NF calibration results from the HAL.
+		 * If we failed NF cal then schedule a hard reset to potentially
+		 * un-freeze the PHY.
+		 *
+		 * Note we have to be careful here to not get stuck in an
+		 * infinite NIC restart.  Ideally we'd not restart if we
+		 * failed the first NF cal - that /can/ fail sometimes in
+		 * a noisy environment.
+		 *
+		 * Instead, we should likely temporarily shorten the longCal
+		 * period to happen pretty quickly and if a subsequent one
+		 * fails, do a full reset.
+		 */
 		if (shortCal)
 			sc->sc_lastshortcal = ticks;
 	}
@@ -6072,7 +6091,6 @@ ath_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 
 		taskqueue_unblock(sc->sc_tq);
 	} else if (nstate == IEEE80211_S_INIT) {
-
 		/* Quiet time handling - ensure we resync */
 		memset(&avp->quiet_ie, 0, sizeof(avp->quiet_ie));
 
@@ -6090,6 +6108,17 @@ ath_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 			taskqueue_block(sc->sc_tq);
 			sc->sc_beacons = 0;
 		}
+
+		/*
+		 * For at least STA mode we likely should clear the ANI
+		 * and NF calibration state and allow the NIC/HAL to figure
+		 * out optimal parameters at runtime.  Otherwise if we
+		 * disassociate due to interference / deafness it may persist
+		 * when we reconnect.
+		 *
+		 * Note: may need to do this for other states too, not just
+		 * _S_INIT.
+		 */
 #ifdef IEEE80211_SUPPORT_TDMA
 		ath_hal_setcca(ah, AH_TRUE);
 #endif
@@ -6119,9 +6148,39 @@ ath_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 			}
 			ATH_UNLOCK(sc);
 		}
+
+		/*
+		 * Note - the ANI/calibration timer isn't re-enabled during
+		 * network sleep for now.  One unfortunate side-effect is that
+		 * the PHY/airtime statistics aren't gathered on the channel
+		 * but I haven't yet tested to see if reading those registers
+		 * CAN occur during network sleep.
+		 *
+		 * This should be revisited in a future commit, even if it's
+		 * just to split out the airtime polling from ANI/calibration.
+		 */
 	} else if (nstate == IEEE80211_S_SCAN) {
 		/* Quiet time handling - ensure we resync */
 		memset(&avp->quiet_ie, 0, sizeof(avp->quiet_ie));
+
+		/*
+		 * If we're in scan mode then startpcureceive() is
+		 * hopefully being called with "reset ANI" for this channel;
+		 * but once we attempt to reassociate we program in the previous
+		 * ANI values and.. not do any calibration until we're running.
+		 * This may mean we stay deaf unless we can associate successfully.
+		 *
+		 * So do kick off the cal timer to get NF/ANI going.
+		 */
+		ATH_LOCK(sc);
+		if (ath_longcalinterval != 0) {
+			/* start periodic recalibration timer */
+			callout_reset(&sc->sc_cal_ch, 1, ath_calibrate, sc);
+		} else {
+			DPRINTF(sc, ATH_DEBUG_CALIBRATE,
+			    "%s: calibration disabled\n", __func__);
+		}
+		ATH_UNLOCK(sc);
 	}
 bad:
 	ieee80211_free_node(ni);
diff --git a/sys/dev/ath/if_ath_ahb.c b/sys/dev/ath/if_ath_ahb.c
index 3c4c05e57846..ea329589f1ab 100644
--- a/sys/dev/ath/if_ath_ahb.c
+++ b/sys/dev/ath/if_ath_ahb.c
@@ -54,7 +54,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/rman.h>
 
 #include <sys/socket.h>
- 
+
 #include <net/if.h>
 #include <net/if_media.h>
 #include <net/if_arp.h>
@@ -336,7 +336,6 @@ static device_method_t ath_ahb_methods[] = {
 	DEVMETHOD(device_shutdown,	ath_ahb_shutdown),
 	DEVMETHOD(device_suspend,	ath_ahb_suspend),
 	DEVMETHOD(device_resume,	ath_ahb_resume),
-
 	{ 0,0 }
 };
 static driver_t ath_ahb_driver = {
diff --git a/sys/dev/ath/if_ath_beacon.c b/sys/dev/ath/if_ath_beacon.c
index 509e24caf601..ac1244c5f8e7 100644
--- a/sys/dev/ath/if_ath_beacon.c
+++ b/sys/dev/ath/if_ath_beacon.c
@@ -777,7 +777,6 @@ ath_beacon_generate(struct ath_softc *sc, struct ieee80211vap *vap)
 	 * insure cab frames are triggered by this beacon.
 	 */
 	if (vap->iv_bcn_off.bo_tim[4] & 1) {
-
 		/* NB: only at DTIM */
 		ATH_TXQ_LOCK(&avp->av_mcastq);
 		if (nmcastq) {
diff --git a/sys/dev/ath/if_ath_beacon.h b/sys/dev/ath/if_ath_beacon.h
index e4a9e7918af2..cda145ba32e2 100644
--- a/sys/dev/ath/if_ath_beacon.h
+++ b/sys/dev/ath/if_ath_beacon.h
@@ -53,4 +53,3 @@ extern	void ath_beacon_proc(void *arg, int pending);
 extern	void ath_beacon_miss(struct ath_softc *sc);
 
 #endif
-
diff --git a/sys/dev/ath/if_ath_btcoex.c b/sys/dev/ath/if_ath_btcoex.c
index 881a2c8acf95..1f0400b696f5 100644
--- a/sys/dev/ath/if_ath_btcoex.c
+++ b/sys/dev/ath/if_ath_btcoex.c
@@ -55,7 +55,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 
 #include <sys/socket.h>
- 
+
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/if_media.h>
@@ -481,4 +481,3 @@ bad:
 		free(outdata, M_TEMP);
 	return (error);
 }
-
diff --git a/sys/dev/ath/if_ath_dfs.c b/sys/dev/ath/if_ath_dfs.c
index 2078f154981c..8f1bc5b015ae 100644
--- a/sys/dev/ath/if_ath_dfs.c
+++ b/sys/dev/ath/if_ath_dfs.c
@@ -63,7 +63,6 @@ ath_dfs_modevent(module_t mod __unused, int type, void *data __unused)
 	default:
 		error = EOPNOTSUPP;
 		break;
-
 	}
 	return (error);
 }
diff --git a/sys/dev/ath/if_ath_drv.c b/sys/dev/ath/if_ath_drv.c
index cc7b9162fb2c..c4384cb73916 100644
--- a/sys/dev/ath/if_ath_drv.c
+++ b/sys/dev/ath/if_ath_drv.c
@@ -68,7 +68,6 @@ ath_modevent(module_t mod __unused, int type, void *data __unused)
 	default:
 		error = EOPNOTSUPP;
 		break;
-
 	}
 	return (error);
 }
diff --git a/sys/dev/ath/if_ath_ioctl.c b/sys/dev/ath/if_ath_ioctl.c
index 9601ba3456bb..f58742d6e5fb 100644
--- a/sys/dev/ath/if_ath_ioctl.c
+++ b/sys/dev/ath/if_ath_ioctl.c
@@ -204,7 +204,6 @@ ath_ioctl_diag(struct ath_softc *sc, struct ath_diag *ad)
 		}
 	}
 
-
 	ATH_LOCK(sc);
 	if (id != HAL_DIAG_REGS)
 		ath_power_set_power_state(sc, HAL_PM_AWAKE);
@@ -306,4 +305,3 @@ ath_ioctl(struct ieee80211com *ic, u_long cmd, void *data)
 		return (ENOTTY);
 	}
 }
-
diff --git a/sys/dev/ath/if_ath_led.c b/sys/dev/ath/if_ath_led.c
index 3cd519a8d198..8b4ac821f2be 100644
--- a/sys/dev/ath/if_ath_led.c
+++ b/sys/dev/ath/if_ath_led.c
@@ -112,7 +112,6 @@ __FBSDID("$FreeBSD$");
  * XXX TODO: move the LED sysctls here.
  */
 
-
 /*
  * Configure the hardware for software and LED blinking.
  * The user may choose to configure part of each, depending upon the
diff --git a/sys/dev/ath/if_ath_lna_div.c b/sys/dev/ath/if_ath_lna_div.c
index 7b970285b9b7..c89a6b107749 100644
--- a/sys/dev/ath/if_ath_lna_div.c
+++ b/sys/dev/ath/if_ath_lna_div.c
@@ -55,7 +55,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 
 #include <sys/socket.h>
- 
+
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/if_media.h>
@@ -1018,4 +1018,3 @@ div_comb_done:
 	antcomb->main_recv_cnt = 0;
 	antcomb->alt_recv_cnt = 0;
 }
-
diff --git a/sys/dev/ath/if_ath_misc.h b/sys/dev/ath/if_ath_misc.h
index f34bbbfaeebc..b108c29bab4b 100644
--- a/sys/dev/ath/if_ath_misc.h
+++ b/sys/dev/ath/if_ath_misc.h
@@ -58,12 +58,14 @@ extern void ath_freebuf(struct ath_softc *sc, struct ath_buf *bf);
 extern void ath_returnbuf_head(struct ath_softc *sc, struct ath_buf *bf);
 extern void ath_returnbuf_tail(struct ath_softc *sc, struct ath_buf *bf);
 
-extern int ath_reset(struct ath_softc *, ATH_RESET_TYPE);
+extern int ath_reset(struct ath_softc *, ATH_RESET_TYPE,
+	    HAL_RESET_TYPE ah_reset_type);
 extern void ath_tx_default_comp(struct ath_softc *sc, struct ath_buf *bf,
 	    int fail);
 extern void ath_tx_update_ratectrl(struct ath_softc *sc,
 	    struct ieee80211_node *ni, struct ath_rc_series *rc,
-	    struct ath_tx_status *ts, int frmlen, int nframes, int nbad);
+	    struct ath_tx_status *ts, int frmlen, int rc_framelen,
+	    int nframes, int nbad);
 
 extern	int ath_hal_gethangstate(struct ath_hal *ah, uint32_t mask,
 	    uint32_t *hangs);
diff --git a/sys/dev/ath/if_ath_pci.c b/sys/dev/ath/if_ath_pci.c
index 0b35e6670015..d3b130e091dc 100644
--- a/sys/dev/ath/if_ath_pci.c
+++ b/sys/dev/ath/if_ath_pci.c
@@ -52,7 +52,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/rman.h>
 
 #include <sys/socket.h>
- 
+
 #include <net/if.h>
 #include <net/if_media.h>
 #include <net/if_arp.h>
@@ -383,7 +383,6 @@ static device_method_t ath_pci_methods[] = {
 	DEVMETHOD(device_shutdown,	ath_pci_shutdown),
 	DEVMETHOD(device_suspend,	ath_pci_suspend),
 	DEVMETHOD(device_resume,	ath_pci_resume),
-
 	{ 0,0 }
 };
 static driver_t ath_pci_driver = {
diff --git a/sys/dev/ath/if_ath_pci_devlist.h b/sys/dev/ath/if_ath_pci_devlist.h
index dc49ab578d65..ec5bb1405553 100644
--- a/sys/dev/ath/if_ath_pci_devlist.h
+++ b/sys/dev/ath/if_ath_pci_devlist.h
@@ -663,7 +663,5 @@ static const struct pci_device_table ath_pci_id_table[] = {
 	/* PCI-E AR9565 (WB335) */
 	{ PCI_VDEVICE(PCI_VENDOR_ID_ATHEROS, 0x0036),
 	  .driver_data = ATH_PCI_BT_ANT_DIV },
-
 	{ 0 }
 };
-
diff --git a/sys/dev/ath/if_ath_rate.c b/sys/dev/ath/if_ath_rate.c
index 8eb7a518c2a4..ff2e0e1336f1 100644
--- a/sys/dev/ath/if_ath_rate.c
+++ b/sys/dev/ath/if_ath_rate.c
@@ -63,7 +63,6 @@ ath_rate_modevent(module_t mod __unused, int type, void *data __unused)
 	default:
 		error = EOPNOTSUPP;
 		break;
-
 	}
 	return (error);
 }
diff --git a/sys/dev/ath/if_ath_rx.c b/sys/dev/ath/if_ath_rx.c
index b06a3f797dde..141547dac424 100644
--- a/sys/dev/ath/if_ath_rx.c
+++ b/sys/dev/ath/if_ath_rx.c
@@ -363,6 +363,11 @@ ath_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m,
 	ATH_VAP(vap)->av_recv_mgmt(ni, m, subtype, rxs, rssi, nf);
 	switch (subtype) {
 	case IEEE80211_FC0_SUBTYPE_BEACON:
+		/*
+		 * Always update the per-node beacon RSSI if we're hearing
+		 * beacons from that node.
+		 */
+		ATH_RSSI_LPF(ATH_NODE(ni)->an_node_stats.ns_avgbrssi, rssi);
 
 		/*
 		 * Only do the following processing if it's for
@@ -374,12 +379,12 @@ ath_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m,
 		 * trying to sync / merge to BSSes that aren't
 		 * actually us.
 		 */
-		if (IEEE80211_ADDR_EQ(ni->ni_bssid, vap->iv_bss->ni_bssid)) {
+		if ((vap->iv_opmode != IEEE80211_M_HOSTAP) &&
+		    IEEE80211_ADDR_EQ(ni->ni_bssid, vap->iv_bss->ni_bssid)) {
 			/* update rssi statistics for use by the hal */
 			/* XXX unlocked check against vap->iv_bss? */
 			ATH_RSSI_LPF(sc->sc_halstats.ns_avgbrssi, rssi);
 
-
 			tsf_beacon = ((uint64_t) le32dec(ni->ni_tstamp.data + 4)) << 32;
 			tsf_beacon |= le32dec(ni->ni_tstamp.data);
 
@@ -422,8 +427,9 @@ ath_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m,
 				tsf_remainder = (tsf_beacon - tsf_beacon_old) % tsf_intval;
 			}
 
-			DPRINTF(sc, ATH_DEBUG_BEACON, "%s: old_tsf=%llu (%u), new_tsf=%llu (%u), target_tsf=%llu (%u), delta=%lld, bmiss=%d, remainder=%d\n",
+			DPRINTF(sc, ATH_DEBUG_BEACON, "%s: %s: old_tsf=%llu (%u), new_tsf=%llu (%u), target_tsf=%llu (%u), delta=%lld, bmiss=%d, remainder=%d\n",
 			    __func__,
+			    ieee80211_get_vap_ifname(vap),
 			    (unsigned long long) tsf_beacon_old,
 			    (unsigned int) (tsf_beacon_old >> 10),
 			    (unsigned long long) tsf_beacon,
@@ -434,17 +440,28 @@ ath_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m,
 			    tsf_delta_bmiss,
 			    tsf_remainder);
 
-			DPRINTF(sc, ATH_DEBUG_BEACON, "%s: tsf=%llu (%u), nexttbtt=%llu (%u), delta=%d\n",
+			DPRINTF(sc, ATH_DEBUG_BEACON, "%s: %s: ni=%6D bssid=%6D tsf=%llu (%u), nexttbtt=%llu (%u), delta=%d\n",
 			    __func__,
+			    ieee80211_get_vap_ifname(vap),
+			    ni->ni_bssid, ":",
+			    vap->iv_bss->ni_bssid, ":",
 			    (unsigned long long) tsf_beacon,
 			    (unsigned int) (tsf_beacon >> 10),
 			    (unsigned long long) nexttbtt,
 			    (unsigned int) (nexttbtt >> 10),
 			    (int32_t) tsf_beacon - (int32_t) nexttbtt + tsf_intval);
 
-			/* We only do syncbeacon on STA VAPs; not on IBSS */
+			/*
+			 * We only do syncbeacon on STA VAPs; not on IBSS;
+			 * but don't do it with swbmiss enabled or we
+			 * may end up overwriting AP mode beacon config.
+			 *
+			 * The driver (and net80211) should be smarter about
+			 * this..
+			 */
 			if (vap->iv_opmode == IEEE80211_M_STA &&
 			    sc->sc_syncbeacon &&
+			    (!sc->sc_swbmiss) &&
 			    ni == vap->iv_bss &&
 			    (vap->iv_state == IEEE80211_S_RUN || vap->iv_state == IEEE80211_S_SLEEP)) {
 				DPRINTF(sc, ATH_DEBUG_BEACON,
@@ -946,6 +963,21 @@ rx_accept:
 			m->m_flags |= M_AMPDU;
 
 		/*
+		 * Inform rate control about the received RSSI.
+		 * It can then use this information to potentially drastically
+		 * alter the available rate based on the RSSI estimate.
+		 *
+		 * This is super important when associating to a far away station;
+		 * you don't want to waste time trying higher rates at some low
+		 * packet exchange rate (like during DHCP) just to establish
+		 * that higher MCS rates aren't available.
+		 */
+		ATH_RSSI_LPF(ATH_NODE(ni)->an_node_stats.ns_avgrssi,
+		    rs->rs_rssi);
+		ath_rate_update_rx_rssi(sc, ATH_NODE(ni),
+		    ATH_RSSI(ATH_NODE(ni)->an_node_stats.ns_avgrssi));
+
+		/*
 		 * Sending station is known, dispatch directly.
 		 */
 		(void) ieee80211_add_rx_params(m, &rxs);
@@ -973,7 +1005,7 @@ rx_accept:
 	 */
 
 	/*
-	 * Track rx rssi and do any rx antenna management.
+	 * Track legacy station RX rssi and do any rx antenna management.
 	 */
 	ATH_RSSI_LPF(sc->sc_halstats.ns_avgrssi, rs->rs_rssi);
 	if (sc->sc_diversity) {
@@ -1228,7 +1260,7 @@ rx_proc_next:
 		ath_hal_putrxbuf(ah, bf->bf_daddr, HAL_RX_QUEUE_HP);
 		ath_hal_rxena(ah);		/* enable recv descriptors */
 		ath_mode_init(sc);		/* set filters, etc. */
-		ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
+		ath_hal_startpcurecv(ah, (!! sc->sc_scanning));	/* re-enable PCU/DMA engine */
 #endif
 
 		ath_hal_intrset(ah, sc->sc_imask);
@@ -1444,7 +1476,7 @@ ath_legacy_startrecv(struct ath_softc *sc)
 	ath_hal_putrxbuf(ah, bf->bf_daddr, HAL_RX_QUEUE_HP);
 	ath_hal_rxena(ah);		/* enable recv descriptors */
 	ath_mode_init(sc);		/* set filters, etc. */
-	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
+	ath_hal_startpcurecv(ah, (!! sc->sc_scanning));	/* re-enable PCU/DMA engine */
 
 	ATH_RX_UNLOCK(sc);
 	return 0;
diff --git a/sys/dev/ath/if_ath_rx_edma.c b/sys/dev/ath/if_ath_rx_edma.c
index 725447d61739..e528dc8d2e43 100644
--- a/sys/dev/ath/if_ath_rx_edma.c
+++ b/sys/dev/ath/if_ath_rx_edma.c
@@ -162,6 +162,9 @@ ath_edma_stoprecv(struct ath_softc *sc, int dodelay)
 {
 	struct ath_hal *ah = sc->sc_ah;
 
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: called, dodelay=%d\n",
+	    __func__, dodelay);
+
 	ATH_RX_LOCK(sc);
 
 	ath_hal_stoppcurecv(ah);
@@ -191,6 +194,8 @@ ath_edma_stoprecv(struct ath_softc *sc, int dodelay)
 		sc->sc_rxedma[HAL_RX_QUEUE_LP].m_rxpending = NULL;
 	}
 	ATH_RX_UNLOCK(sc);
+
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: done\n", __func__);
 }
 
 /*
@@ -205,6 +210,8 @@ ath_edma_reinit_fifo(struct ath_softc *sc, HAL_RX_QUEUE qtype)
 	struct ath_buf *bf;
 	int i, j;
 
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: called\n", __func__);
+
 	ATH_RX_LOCK_ASSERT(sc);
 
 	i = re->m_fifo_head;
@@ -227,6 +234,7 @@ ath_edma_reinit_fifo(struct ath_softc *sc, HAL_RX_QUEUE qtype)
 		    i,
 		    re->m_fifo_tail);
 	}
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: done\n", __func__);
 }
 
 /*
@@ -237,6 +245,10 @@ ath_edma_startrecv(struct ath_softc *sc)
 {
 	struct ath_hal *ah = sc->sc_ah;
 
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX,
+	    "%s: called; resetted=%d, stopped=%d\n", __func__,
+	    sc->sc_rx_resetted, sc->sc_rx_stopped);
+
 	ATH_RX_LOCK(sc);
 
 	/*
@@ -252,7 +264,7 @@ ath_edma_startrecv(struct ath_softc *sc)
 	/*
 	 * In theory the hardware has been initialised, right?
 	 */
-	if (sc->sc_rx_resetted == 1) {
+	if (sc->sc_rx_resetted == 1 || sc->sc_rx_stopped == 1) {
 		DPRINTF(sc, ATH_DEBUG_EDMA_RX,
 		    "%s: Re-initing HP FIFO\n", __func__);
 		ath_edma_reinit_fifo(sc, HAL_RX_QUEUE_HP);
@@ -262,8 +274,11 @@ ath_edma_startrecv(struct ath_softc *sc)
 		sc->sc_rx_resetted = 0;
 	} else {
 		device_printf(sc->sc_dev,
-		    "%s: called without resetting chip?\n",
-		    __func__);
+		    "%s: called without resetting chip? "
+		    "resetted=%d, stopped=%d\n",
+		    __func__,
+		    sc->sc_rx_resetted,
+		    sc->sc_rx_stopped);
 	}
 
 	/* Add up to m_fifolen entries in each queue */
@@ -282,7 +297,7 @@ ath_edma_startrecv(struct ath_softc *sc)
 	    sc->sc_rxedma[HAL_RX_QUEUE_LP].m_fifolen);
 
 	ath_mode_init(sc);
-	ath_hal_startpcurecv(ah);
+	ath_hal_startpcurecv(ah, (!! sc->sc_scanning));
 
 	/*
 	 * We're now doing RX DMA!
@@ -290,6 +305,7 @@ ath_edma_startrecv(struct ath_softc *sc)
 	sc->sc_rx_stopped = 0;
 
 	ATH_RX_UNLOCK(sc);
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: ready\n", __func__);
 
 	return (0);
 }
@@ -298,6 +314,8 @@ static void
 ath_edma_recv_sched_queue(struct ath_softc *sc, HAL_RX_QUEUE qtype,
     int dosched)
 {
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: called; qtype=%d, dosched=%d\n",
+	    __func__, qtype, dosched);
 
 	ATH_LOCK(sc);
 	ath_power_set_power_state(sc, HAL_PM_AWAKE);
@@ -309,13 +327,19 @@ ath_edma_recv_sched_queue(struct ath_softc *sc, HAL_RX_QUEUE qtype,
 	ath_power_restore_power_state(sc);
 	ATH_UNLOCK(sc);
 
+	/* XXX TODO: methodize */
 	taskqueue_enqueue(sc->sc_tq, &sc->sc_rxtask);
+
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: done\n", __func__);
 }
 
 static void
 ath_edma_recv_sched(struct ath_softc *sc, int dosched)
 {
 
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: called; dosched=%d\n",
+	    __func__, dosched);
+
 	ATH_LOCK(sc);
 	ath_power_set_power_state(sc, HAL_PM_AWAKE);
 	ATH_UNLOCK(sc);
@@ -327,19 +351,27 @@ ath_edma_recv_sched(struct ath_softc *sc, int dosched)
 	ath_power_restore_power_state(sc);
 	ATH_UNLOCK(sc);
 
+	/* XXX TODO: methodize */
 	taskqueue_enqueue(sc->sc_tq, &sc->sc_rxtask);
+
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: done\n", __func__);
 }
 
 static void
 ath_edma_recv_flush(struct ath_softc *sc)
 {
 
-	DPRINTF(sc, ATH_DEBUG_RECV, "%s: called\n", __func__);
+	DPRINTF(sc, ATH_DEBUG_RECV | ATH_DEBUG_EDMA_RX, "%s: called\n", __func__);
 
 	ATH_PCU_LOCK(sc);
 	sc->sc_rxproc_cnt++;
 	ATH_PCU_UNLOCK(sc);
 
+	// XXX TODO: methodize; make it an RX stop/block
+	while (taskqueue_cancel(sc->sc_tq, &sc->sc_rxtask, NULL) != 0) {
+		taskqueue_drain(sc->sc_tq, &sc->sc_rxtask);
+	}
+
 	ATH_LOCK(sc);
 	ath_power_set_power_state(sc, HAL_PM_AWAKE);
 	ATH_UNLOCK(sc);
@@ -368,6 +400,8 @@ ath_edma_recv_flush(struct ath_softc *sc)
 	ATH_PCU_LOCK(sc);
 	sc->sc_rxproc_cnt--;
 	ATH_PCU_UNLOCK(sc);
+
+	DPRINTF(sc, ATH_DEBUG_RECV | ATH_DEBUG_EDMA_RX, "%s: done\n", __func__);
 }
 
 /*
@@ -391,6 +425,8 @@ ath_edma_recv_proc_queue(struct ath_softc *sc, HAL_RX_QUEUE qtype,
 	nf = ath_hal_getchannoise(ah, sc->sc_curchan);
 	sc->sc_stats.ast_rx_noise = nf;
 
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: called; qtype=%d, dosched=%d\n", __func__, qtype, dosched);
+
 	ATH_RX_LOCK(sc);
 
 #if 1
@@ -604,9 +640,6 @@ ath_edma_recv_tasklet(void *arg, int npending)
 	ath_power_set_power_state(sc, HAL_PM_AWAKE);
 	ATH_UNLOCK(sc);
 
-	ath_edma_recv_proc_queue(sc, HAL_RX_QUEUE_HP, 1);
-	ath_edma_recv_proc_queue(sc, HAL_RX_QUEUE_LP, 1);
-
 	ath_edma_recv_proc_deferred_queue(sc, HAL_RX_QUEUE_HP, 1);
 	ath_edma_recv_proc_deferred_queue(sc, HAL_RX_QUEUE_LP, 1);
 
@@ -628,6 +661,8 @@ ath_edma_recv_tasklet(void *arg, int npending)
 	ATH_PCU_LOCK(sc);
 	sc->sc_rxproc_cnt--;
 	ATH_PCU_UNLOCK(sc);
+
+	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: called; done!\n", __func__);
 }
 
 /*
diff --git a/sys/dev/ath/if_ath_spectral.c b/sys/dev/ath/if_ath_spectral.c
index eaf91b9b1cab..44d5064c182d 100644
--- a/sys/dev/ath/if_ath_spectral.c
+++ b/sys/dev/ath/if_ath_spectral.c
@@ -54,7 +54,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 
 #include <sys/socket.h>
- 
+
 #include <net/if.h>
 #include <net/if_var.h>
 #include <net/if_media.h>
@@ -299,4 +299,3 @@ bad:
 
 	return (error);
 }
-
diff --git a/sys/dev/ath/if_ath_sysctl.c b/sys/dev/ath/if_ath_sysctl.c
index 3e4e47246357..fd43ba4f6083 100644
--- a/sys/dev/ath/if_ath_sysctl.c
+++ b/sys/dev/ath/if_ath_sysctl.c
@@ -382,7 +382,8 @@ ath_sysctl_tpscale(SYSCTL_HANDLER_ARGS)
 		goto finish;
 
 	error = !ath_hal_settpscale(sc->sc_ah, scale) ? EINVAL :
-	    (sc->sc_running) ? ath_reset(sc, ATH_RESET_NOLOSS) : 0;
+	    (sc->sc_running) ? ath_reset(sc, ATH_RESET_NOLOSS,
+	    HAL_RESET_NORMAL) : 0;
 
 finish:
 	ATH_LOCK(sc);
@@ -443,7 +444,8 @@ ath_sysctl_rfkill(SYSCTL_HANDLER_ARGS)
 		error = EINVAL;
 		goto finish;
 	}
-	error = sc->sc_running ? ath_reset(sc, ATH_RESET_FULL) : 0;
+	error = sc->sc_running ? ath_reset(sc, ATH_RESET_FULL,
+	    HAL_RESET_NORMAL) : 0;
 
 finish:
 	ATH_LOCK(sc);
@@ -670,7 +672,7 @@ ath_sysctl_intmit(SYSCTL_HANDLER_ARGS)
 	 * things in an inconsistent state.
 	 */
 	if (sc->sc_running)
-		ath_reset(sc, ATH_RESET_NOLOSS);
+		ath_reset(sc, ATH_RESET_NOLOSS, HAL_RESET_NORMAL);
 
 	error = 0;
 
@@ -1062,7 +1064,7 @@ ath_sysctl_stats_attach(struct ath_softc *sc)
 	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
 	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
 	struct sysctl_oid_list *child = SYSCTL_CHILDREN(tree);
- 
+
 	/* Create "clear" node */
 	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
 	    "clear_stats", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
@@ -1296,7 +1298,7 @@ ath_sysctl_stats_attach(struct ath_softc *sc)
 	SYSCTL_ADD_UINT(ctx, child, OID_AUTO, "ast_tx_ldpc",
 	    CTLFLAG_RD, &sc->sc_stats.ast_tx_ldpc, 0,
 	    "Number of LDPC frames transmitted");
-	
+
 	/* Attach the RX phy error array */
 	ath_sysctl_stats_attach_rxphyerr(sc, child);
 
diff --git a/sys/dev/ath/if_ath_tx.c b/sys/dev/ath/if_ath_tx.c
index 8d90a5d27fb1..f8800fab04cd 100644
--- a/sys/dev/ath/if_ath_tx.c
+++ b/sys/dev/ath/if_ath_tx.c
@@ -363,7 +363,7 @@ ath_tx_dmasetup(struct ath_softc *sc, struct ath_buf *bf, struct mbuf *m0)
  */
 static void
 ath_tx_chaindesclist(struct ath_softc *sc, struct ath_desc *ds0,
-    struct ath_buf *bf, int is_aggr, int is_first_subframe,
+    struct ath_buf *bf, bool is_aggr, int is_first_subframe,
     int is_last_subframe)
 {
 	struct ath_hal *ah = sc->sc_ah;
@@ -1307,7 +1307,7 @@ ath_tx_set_rtscts(struct ath_softc *sc, struct ath_buf *bf)
 	/* Squirrel away in ath_buf */
 	bf->bf_state.bfs_ctsrate = ctsrate;
 	bf->bf_state.bfs_ctsduration = ctsduration;
-	
+
 	/*
 	 * Must disable multi-rate retry when using RTS/CTS.
 	 */
@@ -1376,10 +1376,13 @@ ath_tx_setds(struct ath_softc *sc, struct ath_buf *bf)
  * as they may depend upon the rate chosen.
  */
 static void
-ath_tx_do_ratelookup(struct ath_softc *sc, struct ath_buf *bf)
+ath_tx_do_ratelookup(struct ath_softc *sc, struct ath_buf *bf, int tid,
+    int pktlen, int is_aggr)
 {
 	uint8_t rate, rix;
 	int try0;
+	int maxdur; // Note: Unused for now
+	int maxpktlen;
 
 	if (! bf->bf_state.bfs_doratelookup)
 		return;
@@ -1389,7 +1392,7 @@ ath_tx_do_ratelookup(struct ath_softc *sc, struct ath_buf *bf)
 
 	ATH_NODE_LOCK(ATH_NODE(bf->bf_node));
 	ath_rate_findrate(sc, ATH_NODE(bf->bf_node), bf->bf_state.bfs_shpream,
-	    bf->bf_state.bfs_pktlen, &rix, &try0, &rate);
+	    pktlen, tid, is_aggr, &rix, &try0, &rate, &maxdur, &maxpktlen);
 
 	/* In case MRR is disabled, make sure rc[0] is setup correctly */
 	bf->bf_state.bfs_rc[0].rix = rix;
@@ -1398,13 +1401,14 @@ ath_tx_do_ratelookup(struct ath_softc *sc, struct ath_buf *bf)
 
 	if (bf->bf_state.bfs_ismrr && try0 != ATH_TXMAXTRY)
 		ath_rate_getxtxrates(sc, ATH_NODE(bf->bf_node), rix,
-		    bf->bf_state.bfs_rc);
+		    is_aggr, bf->bf_state.bfs_rc);
 	ATH_NODE_UNLOCK(ATH_NODE(bf->bf_node));
 
 	sc->sc_txrix = rix;	/* for LED blinking */
 	sc->sc_lastdatarix = rix;	/* for fast frames */
 	bf->bf_state.bfs_try0 = try0;
 	bf->bf_state.bfs_txrate0 = rate;
+	bf->bf_state.bfs_rc_maxpktlen = maxpktlen;
 }
 
 /*
@@ -1482,7 +1486,6 @@ ath_tx_should_swq_frame(struct ath_softc *sc, struct ath_node *an,
 	}
 }
 
-
 /*
  * Transmit the given frame to the hardware.
  *
@@ -1519,7 +1522,7 @@ ath_tx_xmit_normal(struct ath_softc *sc, struct ath_txq *txq,
 	bf->bf_state.bfs_txflags |= HAL_TXDESC_CLRDMASK;
 
 	/* Setup the descriptor before handoff */
-	ath_tx_do_ratelookup(sc, bf);
+	ath_tx_do_ratelookup(sc, bf, tid->tid, bf->bf_state.bfs_pktlen, false);
 	ath_tx_calc_duration(sc, bf);
 	ath_tx_calc_protection(sc, bf);
 	ath_tx_set_rtscts(sc, bf);
@@ -2515,7 +2518,6 @@ ath_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	sc->sc_txstart_cnt--;
 	ATH_PCU_UNLOCK(sc);
 
-
 	/* Put the hardware back to sleep if required */
 	ATH_LOCK(sc);
 	ath_power_restore_power_state(sc);
@@ -2709,7 +2711,6 @@ ath_tx_addto_baw(struct ath_softc *sc, struct ath_node *an,
 	    tap->txa_start, tap->txa_wnd, index, cindex, tid->baw_head,
 	    tid->baw_tail);
 
-
 #if 0
 	assert(tid->tx_buf[cindex] == NULL);
 #endif
@@ -3094,7 +3095,8 @@ ath_tx_xmit_aggr(struct ath_softc *sc, struct ath_node *an,
 	ath_tx_update_clrdmask(sc, tid, bf);
 
 	/* Direct dispatch to hardware */
-	ath_tx_do_ratelookup(sc, bf);
+	ath_tx_do_ratelookup(sc, bf, tid->tid, bf->bf_state.bfs_pktlen,
+	    false);
 	ath_tx_calc_duration(sc, bf);
 	ath_tx_calc_protection(sc, bf);
 	ath_tx_set_rtscts(sc, bf);
@@ -3220,7 +3222,6 @@ ath_tx_swq(struct ath_softc *sc, struct ieee80211_node *ni,
 		 */
 		/* XXX TXQ locking */
 		if (txq->axq_depth + txq->fifo.axq_depth == 0) {
-
 			bf = ATH_TID_FIRST(atid);
 			ATH_TID_REMOVE(atid, bf, bf_list);
 
@@ -4257,7 +4258,9 @@ ath_tx_normal_comp(struct ath_softc *sc, struct ath_buf *bf, int fail)
 	 */
 	if (fail == 0 && ((bf->bf_state.bfs_txflags & HAL_TXDESC_NOACK) == 0))
 		ath_tx_update_ratectrl(sc, ni, bf->bf_state.bfs_rc,
-		    ts, bf->bf_state.bfs_pktlen,
+		    ts,
+		    bf->bf_state.bfs_pktlen,
+		    bf->bf_state.bfs_pktlen,
 		    1, (ts->ts_status == 0) ? 0 : 1);
 
 	ath_tx_default_comp(sc, bf, fail);
@@ -4305,7 +4308,6 @@ ath_tx_comp_cleanup_unaggr(struct ath_softc *sc, struct ath_buf *bf)
 	ath_tx_default_comp(sc, bf, 0);
 }
 
-
 /*
  * This as it currently stands is a bit dumb.  Ideally we'd just
  * fail the frame the normal way and have it permanently fail
@@ -4686,13 +4688,11 @@ ath_tx_comp_aggr_error(struct ath_softc *sc, struct ath_buf *bf_first,
 
 	/*
 	 * Update rate control - all frames have failed.
-	 *
-	 * XXX use the length in the first frame in the series;
-	 * XXX just so things are consistent for now.
 	 */
 	ath_tx_update_ratectrl(sc, ni, bf_first->bf_state.bfs_rc,
 	    &bf_first->bf_status.ds_txstat,
-	    bf_first->bf_state.bfs_pktlen,
+	    bf_first->bf_state.bfs_al,
+	    bf_first->bf_state.bfs_rc_maxpktlen,
 	    bf_first->bf_state.bfs_nframes, bf_first->bf_state.bfs_nframes);
 
 	ATH_TX_LOCK(sc);
@@ -4841,6 +4841,7 @@ ath_tx_aggr_comp_aggr(struct ath_softc *sc, struct ath_buf *bf_first,
 	int drops = 0;
 	int nframes = 0, nbad = 0, nf;
 	int pktlen;
+	int agglen, rc_agglen;
 	/* XXX there's too much on the stack? */
 	struct ath_rc_series rc[ATH_RC_NUM];
 	int txseq;
@@ -4853,6 +4854,8 @@ ath_tx_aggr_comp_aggr(struct ath_softc *sc, struct ath_buf *bf_first,
 	 * has been completed and freed.
 	 */
 	ts = bf_first->bf_status.ds_txstat;
+	agglen = bf_first->bf_state.bfs_al;
+	rc_agglen = bf_first->bf_state.bfs_rc_maxpktlen;
 
 	TAILQ_INIT(&bf_q);
 	TAILQ_INIT(&bf_cq);
@@ -5003,7 +5006,11 @@ ath_tx_aggr_comp_aggr(struct ath_softc *sc, struct ath_buf *bf_first,
 		    "%s: AR5416 bug: hasba=%d; txok=%d, isaggr=%d, "
 		    "seq_st=%d\n",
 		    __func__, hasba, tx_ok, isaggr, seq_st);
-		/* XXX TODO: schedule an interface reset */
+		taskqueue_enqueue(sc->sc_tq, &sc->sc_fataltask);
+		/* And as we can't really trust the BA here .. */
+		ba[0] = 0;
+		ba[1] = 0;
+		seq_st = 0;
 #ifdef ATH_DEBUG
 		ath_printtxbuf(sc, bf_first,
 		    sc->sc_ac2q[atid->ac]->axq_qnum, 0, 0);
@@ -5088,9 +5095,10 @@ ath_tx_aggr_comp_aggr(struct ath_softc *sc, struct ath_buf *bf_first,
 	 * Now we know how many frames were bad, call the rate
 	 * control code.
 	 */
-	if (fail == 0)
-		ath_tx_update_ratectrl(sc, ni, rc, &ts, pktlen, nframes,
-		    nbad);
+	if (fail == 0) {
+		ath_tx_update_ratectrl(sc, ni, rc, &ts, agglen, rc_agglen,
+		    nframes, nbad);
+	}
 
 	/*
 	 * send bar if we dropped any frames
@@ -5181,6 +5189,7 @@ ath_tx_aggr_comp_unaggr(struct ath_softc *sc, struct ath_buf *bf, int fail)
 		ath_tx_update_ratectrl(sc, ni, bf->bf_state.bfs_rc,
 		    &bf->bf_status.ds_txstat,
 		    bf->bf_state.bfs_pktlen,
+		    bf->bf_state.bfs_pktlen,
 		    1, (ts.ts_status == 0) ? 0 : 1);
 
 	/*
@@ -5353,6 +5362,65 @@ ath_tx_aggr_comp(struct ath_softc *sc, struct ath_buf *bf, int fail)
 }
 
 /*
+ * Grab the software queue depth that we COULD transmit.
+ *
+ * This includes checks if it's in the BAW, whether it's a frame
+ * that is supposed to be in the BAW.  Other checks could be done;
+ * but for now let's try and avoid doing the whole of ath_tx_form_aggr()
+ * here.
+ */
+static int
+ath_tx_tid_swq_depth_bytes(struct ath_softc *sc, struct ath_node *an,
+    struct ath_tid *tid)
+{
+	struct ath_buf *bf;
+	struct ieee80211_tx_ampdu *tap;
+	int nbytes = 0;
+
+	ATH_TX_LOCK_ASSERT(sc);
+
+	tap = ath_tx_get_tx_tid(an, tid->tid);
+
+	/*
+	 * Iterate over each buffer and sum the pkt_len.
+	 * Bail if we exceed ATH_AGGR_MAXSIZE bytes; we won't
+	 * ever queue more than that in a single frame.
+	 */
+	TAILQ_FOREACH(bf, &tid->tid_q, bf_list) {
+		/*
+		 * TODO: I'm not sure if we're going to hit cases where
+		 * no frames get sent because the list is empty.
+		 */
+
+		/* Check if it's in the BAW */
+		if (tap != NULL && (! BAW_WITHIN(tap->txa_start, tap->txa_wnd,
+		    SEQNO(bf->bf_state.bfs_seqno)))) {
+			break;
+		}
+
+		/* Check if it's even supposed to be in the BAW */
+		if (! bf->bf_state.bfs_dobaw) {
+			break;
+		}
+
+		nbytes += bf->bf_state.bfs_pktlen;
+		if (nbytes >= ATH_AGGR_MAXSIZE)
+			break;
+
+		/*
+		 * Check if we're likely going to leak a frame
+		 * as part of a PSPOLL.  Break out at this point;
+		 * we're only going to send a single frame anyway.
+		 */
+		if (an->an_leak_count) {
+			break;
+		}
+	}
+
+	return MIN(nbytes, ATH_AGGR_MAXSIZE);
+}
+
+/*
  * Schedule some packets from the given node/TID to the hardware.
  *
  * This is the aggregate version.
@@ -5366,6 +5434,7 @@ ath_tx_tid_hw_queue_aggr(struct ath_softc *sc, struct ath_node *an,
 	struct ieee80211_tx_ampdu *tap;
 	ATH_AGGR_STATUS status;
 	ath_bufhead bf_q;
+	int swq_pktbytes;
 
 	DPRINTF(sc, ATH_DEBUG_SW_TX, "%s: tid=%d\n", __func__, tid->tid);
 	ATH_TX_LOCK_ASSERT(sc);
@@ -5429,7 +5498,8 @@ ath_tx_tid_hw_queue_aggr(struct ath_softc *sc, struct ath_node *an,
 			/* Update CLRDMASK just before this frame is queued */
 			ath_tx_update_clrdmask(sc, tid, bf);
 
-			ath_tx_do_ratelookup(sc, bf);
+			ath_tx_do_ratelookup(sc, bf, tid->tid,
+			    bf->bf_state.bfs_pktlen, false);
 			ath_tx_calc_duration(sc, bf);
 			ath_tx_calc_protection(sc, bf);
 			ath_tx_set_rtscts(sc, bf);
@@ -5446,17 +5516,18 @@ ath_tx_tid_hw_queue_aggr(struct ath_softc *sc, struct ath_node *an,
 		TAILQ_INIT(&bf_q);
 
 		/*
-		 * Do a rate control lookup on the first frame in the
-		 * list. The rate control code needs that to occur
-		 * before it can determine whether to TX.
-		 * It's inaccurate because the rate control code doesn't
-		 * really "do" aggregate lookups, so it only considers
-		 * the size of the first frame.
+		 * Loop over the swq to find out how long
+		 * each packet is (up until 64k) and provide that
+		 * to the rate control lookup.
 		 */
-		ath_tx_do_ratelookup(sc, bf);
-		bf->bf_state.bfs_rc[3].rix = 0;
-		bf->bf_state.bfs_rc[3].tries = 0;
+		swq_pktbytes = ath_tx_tid_swq_depth_bytes(sc, an, tid);
+		ath_tx_do_ratelookup(sc, bf, tid->tid, swq_pktbytes, true);
 
+		/*
+		 * Note this only is used for the fragment paths and
+		 * should really be rethought out if we want to do
+		 * things like an RTS burst across >1 aggregate.
+		 */
 		ath_tx_calc_duration(sc, bf);
 		ath_tx_calc_protection(sc, bf);
 
@@ -5535,7 +5606,6 @@ ath_tx_tid_hw_queue_aggr(struct ath_softc *sc, struct ath_node *an,
 			 * already points to the rest in the chain.
 			 */
 			ath_tx_setds_11n(sc, bf);
-
 		}
 	queuepkt:
 		/* Set completion handler, multi-frame aggregate or not */
@@ -5607,7 +5677,6 @@ ath_tx_tid_hw_queue_norm(struct ath_softc *sc, struct ath_node *an,
 		    __func__, tid->tid);
 
 	for (;;) {
-
 		/*
 		 * If the upper layers have paused the TID, don't
 		 * queue any further packets.
@@ -5644,7 +5713,8 @@ ath_tx_tid_hw_queue_norm(struct ath_softc *sc, struct ath_node *an,
 		ath_tx_update_clrdmask(sc, tid, bf);
 
 		/* Program descriptors + rate control */
-		ath_tx_do_ratelookup(sc, bf);
+		ath_tx_do_ratelookup(sc, bf, tid->tid,
+		    bf->bf_state.bfs_pktlen, false);
 		ath_tx_calc_duration(sc, bf);
 		ath_tx_calc_protection(sc, bf);
 		ath_tx_set_rtscts(sc, bf);
@@ -5838,7 +5908,6 @@ ath_tx_ampdu_pending(struct ath_softc *sc, struct ath_node *an, int tid)
  * Is AMPDU-TX pending for the given TID?
  */
 
-
 /*
  * Method to handle sending an ADDBA request.
  *
@@ -5966,7 +6035,6 @@ ath_addba_response(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap,
 	return r;
 }
 
-
 /*
  * Stop ADDBA on a queue.
  *
diff --git a/sys/dev/ath/if_ath_tx.h b/sys/dev/ath/if_ath_tx.h
index 517007716e9f..2ad2f75e926d 100644
--- a/sys/dev/ath/if_ath_tx.h
+++ b/sys/dev/ath/if_ath_tx.h
@@ -71,7 +71,6 @@
 #define	ATH_BA_ISSET(_bm, _n)	(((_n) < (WME_BA_BMP_SIZE)) &&		\
 	    ((_bm)[(_n) >> 5] & (1 << ((_n) & 31))))
 
-
 /* extracting the seqno from buffer seqno */
 #define	SEQNO(_a)	((_a) >> IEEE80211_SEQ_SEQ_SHIFT)
 
diff --git a/sys/dev/ath/if_ath_tx_edma.c b/sys/dev/ath/if_ath_tx_edma.c
index 375c7ff4bbc8..4ec98b3382c9 100644
--- a/sys/dev/ath/if_ath_tx_edma.c
+++ b/sys/dev/ath/if_ath_tx_edma.c
@@ -654,7 +654,7 @@ ath_edma_setup_txfifo(struct ath_softc *sc, int qnum)
 	 * Set initial "empty" state.
 	 */
 	te->m_fifo_head = te->m_fifo_tail = te->m_fifo_depth = 0;
-	
+
 	return (0);
 }
 
@@ -778,7 +778,6 @@ ath_edma_tx_proc(void *arg, int npending)
 #endif
 	ath_edma_tx_processq(sc, 1);
 
-
 	ATH_PCU_LOCK(sc);
 	sc->sc_txproc_cnt--;
 	ATH_PCU_UNLOCK(sc);
@@ -1012,6 +1011,8 @@ ath_edma_tx_processq(struct ath_softc *sc, int dosched)
 			sc->sc_stats.ast_tx_rssi = ts.ts_rssi;
 			ATH_RSSI_LPF(sc->sc_halstats.ns_avgtxrssi,
 			    ts.ts_rssi);
+			ATH_RSSI_LPF(ATH_NODE(ni)->an_node_stats.ns_avgtxrssi,
+			    ts.ts_rssi);
 		}
 
 		/* Handle frame completion and rate control update */
diff --git a/sys/dev/ath/if_ath_tx_ht.c b/sys/dev/ath/if_ath_tx_ht.c
index 249cbe23b538..c7fa41443d26 100644
--- a/sys/dev/ath/if_ath_tx_ht.c
+++ b/sys/dev/ath/if_ath_tx_ht.c
@@ -840,16 +840,25 @@ ath_tx_form_aggr(struct ath_softc *sc, struct ath_node *an,
 		goto finish;
 	}
 
+	/*
+	 * Limit the maximum number of frames in this A-MPDU
+	 * to half of the window size.  This is done to prevent
+	 * sending a LOT of frames that may fail in one batch
+	 * when operating in higher MCS rates.  If there are more
+	 * frames available to send then up to two A-MPDUs will
+	 * be queued per hardware queue, so we'll "just" get
+	 * a second A-MPDU.
+	 */
 	h_baw = tap->txa_wnd / 2;
 
 	for (;;) {
 		bf = ATH_TID_FIRST(tid);
-		if (bf_first == NULL)
-			bf_first = bf;
 		if (bf == NULL) {
 			status = ATH_AGGR_DONE;
 			break;
-		} else {
+		}
+		if (bf_first == NULL) {
+			bf_first = bf;
 			/*
 			 * It's the first frame;
 			 * set the aggregation limit based on the
@@ -857,6 +866,10 @@ ath_tx_form_aggr(struct ath_softc *sc, struct ath_node *an,
 			 */
 			aggr_limit = ath_get_aggr_limit(sc, &an->an_node,
 			    bf_first);
+			if (bf_first->bf_state.bfs_rc_maxpktlen > 0) {
+				aggr_limit = MIN(aggr_limit,
+				    bf_first->bf_state.bfs_rc_maxpktlen);
+			}
 		}
 
 		/* Set this early just so things don't get confused */
@@ -1013,7 +1026,6 @@ ath_tx_form_aggr(struct ath_softc *sc, struct ath_node *an,
 			break;
 		}
 #endif
-
 	}
 
 finish:
@@ -1022,6 +1034,10 @@ finish:
 	 * dequeue a packet ..
 	 */
 	if (bf_first) {
+		DPRINTF(sc, ATH_DEBUG_SW_TX_AGGR,
+		"%s: al=%d bytes; requested %d bytes\n",
+		__func__, al, bf_first->bf_state.bfs_rc_maxpktlen);
+
 		bf_first->bf_state.bfs_al = al;
 		bf_first->bf_state.bfs_nframes = nframes;
 	}
diff --git a/sys/dev/ath/if_athioctl.h b/sys/dev/ath/if_athioctl.h
index 82decdefe3d4..8367a3ebac18 100644
--- a/sys/dev/ath/if_athioctl.h
+++ b/sys/dev/ath/if_athioctl.h
@@ -193,7 +193,6 @@ struct ath_diag {
 #define	SIOCGATHDIAG	_IOWR('i', 138, struct ath_diag)
 #define	SIOCGATHPHYERR	_IOWR('i', 140, struct ath_diag)
 
-
 /*
  * The rate control ioctl has to support multiple potential rate
  * control classes.  For now, instead of trying to support an
diff --git a/sys/dev/ath/if_athrate.h b/sys/dev/ath/if_athrate.h
index 5aec9e6b3870..45711a1735bc 100644
--- a/sys/dev/ath/if_athrate.h
+++ b/sys/dev/ath/if_athrate.h
@@ -125,17 +125,23 @@ void	ath_rate_newassoc(struct ath_softc *, struct ath_node *,
  * Return the four TX rate index and try counts for the current data packet.
  */
 void	ath_rate_getxtxrates(struct ath_softc *sc, struct ath_node *an,
-		uint8_t rix0, struct ath_rc_series *rc);
+		uint8_t rix0, int is_aggr, struct ath_rc_series *rc);
 
 /*
  * Return the transmit info for a data packet.  If multi-rate state
  * is to be setup then try0 should contain a value other than ATH_TXMATRY
  * and ath_rate_setupxtxdesc will be called after deciding if the frame
  * can be transmitted with multi-rate retry.
+ *
+ * maxdur is an optional return value (or -1 if not set) that defines
+ * the maximum frame duration in microseconds.  This allows the rate
+ * control selection to override the maximum duration (normally 4ms)
+ * that the packet aggregation logic makes.
  */
 void	ath_rate_findrate(struct ath_softc *, struct ath_node *,
-		int shortPreamble, size_t frameLen,
-		u_int8_t *rix, int *try0, u_int8_t *txrate);
+		int shortPreamble, size_t frameLen, int tid, int is_aggr,
+		u_int8_t *rix, int *try0, u_int8_t *txrate, int *maxdur,
+		int *maxpktlen);
 /*
  * Setup any extended (multi-rate) descriptor state for a data packet.
  * The rate index returned by ath_rate_findrate is passed back in.
@@ -154,7 +160,13 @@ void	ath_rate_setupxtxdesc(struct ath_softc *, struct ath_node *,
 struct ath_buf;
 void	ath_rate_tx_complete(struct ath_softc *, struct ath_node *,
 		const struct ath_rc_series *, const struct ath_tx_status *,
-		int pktlen, int nframes, int nbad);
+		int pktlen, int rc_framelen, int nframes, int nbad);
+
+/*
+ * Update rate control with a per-packet receive RSSI value.
+ */
+void	ath_rate_update_rx_rssi(struct ath_softc *, struct ath_node *,
+		int rssi);
 
 /*
  * Fetch the global rate control statistics.
diff --git a/sys/dev/ath/if_athvar.h b/sys/dev/ath/if_athvar.h
index 96d22f511746..c789b2c459c1 100644
--- a/sys/dev/ath/if_athvar.h
+++ b/sys/dev/ath/if_athvar.h
@@ -204,6 +204,7 @@ struct ath_node {
 					   node */
 	int			clrdmask;	/* has clrdmask been set */
 	uint32_t	an_leak_count;	/* How many frames to leak during pause */
+	HAL_NODE_STATS	an_node_stats;	/* HAL node stats for this node */
 	/* variable-length rate control state follows */
 };
 #define	ATH_NODE(ni)	((struct ath_node *)(ni))
@@ -307,6 +308,7 @@ struct ath_buf {
 
 		/* 16 bit? */
 		uint32_t bfs_ctsduration;	/* CTS duration (pre-11n NICs) */
+		int32_t bfs_rc_maxpktlen;	/* max packet length/bucket from ratectrl or -1 */
 		struct ath_rc_series bfs_rc[ATH_RC_NUM];	/* non-11n TX series */
 	} bf_state;
 };
@@ -409,7 +411,6 @@ struct ath_txq {
 #define	ATH_TXQ_UNLOCK_ASSERT(_tq)	mtx_assert(&(_tq)->axq_lock,	\
 					    MA_NOTOWNED)
 
-
 #define	ATH_NODE_LOCK(_an)		mtx_lock(&(_an)->an_mtx)
 #define	ATH_NODE_UNLOCK(_an)		mtx_unlock(&(_an)->an_mtx)
 #define	ATH_NODE_LOCK_ASSERT(_an)	mtx_assert(&(_an)->an_mtx, MA_OWNED)
@@ -1155,8 +1156,8 @@ void	ath_intr(void *);
 	((*(_ah)->ah_stopTxDma)((_ah), (_qnum)))
 #define	ath_hal_stoppcurecv(_ah) \
 	((*(_ah)->ah_stopPcuReceive)((_ah)))
-#define	ath_hal_startpcurecv(_ah) \
-	((*(_ah)->ah_startPcuReceive)((_ah)))
+#define	ath_hal_startpcurecv(_ah, _is_scanning) \
+	((*(_ah)->ah_startPcuReceive)((_ah), (_is_scanning)))
 #define	ath_hal_stopdmarecv(_ah) \
 	((*(_ah)->ah_stopDmaReceive)((_ah)))
 #define	ath_hal_getdiagstate(_ah, _id, _indata, _insize, _outdata, _outsize) \
@@ -1352,7 +1353,7 @@ void	ath_intr(void *);
 	== HAL_OK)
 #define	ath_hal_setrxbufsize(_ah, _req) \
 	(ath_hal_setcapability(_ah, HAL_CAP_RXBUFSIZE, 0, _req, NULL)	\
-	== HAL_OK)
+	== AH_TRUE)
 
 #define	ath_hal_getchannoise(_ah, _c) \
 	((*(_ah)->ah_getChanNoise)((_ah), (_c)))