Update with last year of work.

5 files changed, 3170 insertions, 1217 deletions

diff --git a/sys/dev/ath/if_ath.c b/sys/dev/ath/if_ath.c
index dde23cd..e2bd2aa 100644
--- a/sys/dev/ath/if_ath.c
+++ b/sys/dev/ath/if_ath.c
@@ -82,6 +82,7 @@ __FBSDID("$FreeBSD$");
 #define	AR_DEBUG
 #include <dev/ath/if_athvar.h>
 #include <contrib/dev/ath/ah_desc.h>
+#include <contrib/dev/ath/ah_devid.h>		/* XXX for softled */
 
 /* unalligned little endian access */     
 #define LE_READ_2(p)							\
@@ -93,9 +94,10 @@ __FBSDID("$FreeBSD$");
 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
 
 static void	ath_init(void *);
+static void	ath_stop_locked(struct ifnet *);
 static void	ath_stop(struct ifnet *);
 static void	ath_start(struct ifnet *);
-static void	ath_reset(struct ath_softc *);
+static int	ath_reset(struct ifnet *);
 static int	ath_media_change(struct ifnet *);
 static void	ath_watchdog(struct ifnet *);
 static int	ath_ioctl(struct ifnet *, u_long, caddr_t);
@@ -103,39 +105,67 @@ static void	ath_fatal_proc(void *, int);
 static void	ath_rxorn_proc(void *, int);
 static void	ath_bmiss_proc(void *, int);
 static void	ath_initkeytable(struct ath_softc *);
+static int	ath_key_alloc(struct ieee80211com *,
+			const struct ieee80211_key *);
+static int	ath_key_delete(struct ieee80211com *,
+			const struct ieee80211_key *);
+static int	ath_key_set(struct ieee80211com *, const struct ieee80211_key *,
+			const u_int8_t mac[IEEE80211_ADDR_LEN]);
+static void	ath_key_update_begin(struct ieee80211com *);
+static void	ath_key_update_end(struct ieee80211com *);
 static void	ath_mode_init(struct ath_softc *);
+static void	ath_setslottime(struct ath_softc *);
+static void	ath_updateslot(struct ifnet *);
 static int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
+static void	ath_beacon_setup(struct ath_softc *, struct ath_buf *);
 static void	ath_beacon_proc(void *, int);
+static void	ath_bstuck_proc(void *, int);
 static void	ath_beacon_free(struct ath_softc *);
 static void	ath_beacon_config(struct ath_softc *);
+static void	ath_descdma_cleanup(struct ath_softc *sc,
+			struct ath_descdma *, ath_bufhead *);
 static int	ath_desc_alloc(struct ath_softc *);
 static void	ath_desc_free(struct ath_softc *);
-static struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
-static void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
-static void	ath_node_copy(struct ieee80211com *,
-			struct ieee80211_node *, const struct ieee80211_node *);
-static u_int8_t	ath_node_getrssi(struct ieee80211com *,
-			struct ieee80211_node *);
+static struct ieee80211_node *ath_node_alloc(struct ieee80211_node_table *);
+static void	ath_node_free(struct ieee80211_node *);
+static u_int8_t	ath_node_getrssi(const struct ieee80211_node *);
 static int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
+static void	ath_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
+			struct ieee80211_node *ni,
+			int subtype, int rssi, u_int32_t rstamp);
+static void	ath_setdefantenna(struct ath_softc *, u_int);
 static void	ath_rx_proc(void *, int);
+static struct ath_txq *ath_txq_setup(struct ath_softc*, int qtype, int subtype);
+static int	ath_tx_setup(struct ath_softc *, int, int);
+static int	ath_wme_update(struct ieee80211com *);
+static void	ath_tx_cleanupq(struct ath_softc *, struct ath_txq *);
+static void	ath_tx_cleanup(struct ath_softc *);
 static int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
 			     struct ath_buf *, struct mbuf *);
+static void	ath_tx_proc_q0(void *, int);
+static void	ath_tx_proc_q0123(void *, int);
 static void	ath_tx_proc(void *, int);
 static int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
 static void	ath_draintxq(struct ath_softc *);
 static void	ath_stoprecv(struct ath_softc *);
 static int	ath_startrecv(struct ath_softc *);
+static void	ath_chan_change(struct ath_softc *, struct ieee80211_channel *);
 static void	ath_next_scan(void *);
 static void	ath_calibrate(void *);
 static int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
 static void	ath_newassoc(struct ieee80211com *,
 			struct ieee80211_node *, int);
-static int	ath_getchannels(struct ath_softc *, u_int cc, HAL_BOOL outdoor);
+static int	ath_getchannels(struct ath_softc *, u_int cc,
+			HAL_BOOL outdoor, HAL_BOOL xchanmode);
+static void	ath_update_led(struct ath_softc *);
+static void	ath_update_txpow(struct ath_softc *);
 
-static int	ath_rate_setup(struct ath_softc *sc, u_int mode);
+static int	ath_rate_setup(struct ath_softc *, u_int mode);
 static void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
-static void	ath_rate_ctl_reset(struct ath_softc *, enum ieee80211_state);
-static void	ath_rate_ctl(void *, struct ieee80211_node *);
+
+static void	ath_sysctlattach(struct ath_softc *);
+static void	ath_bpfattach(struct ath_softc *);
+static void	ath_announce(struct ath_softc *);
 
 SYSCTL_DECL(_hw_ath);
 
@@ -148,8 +178,12 @@ SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
 	    0, "chip calibration interval (secs)");
 static	int ath_outdoor = AH_TRUE;		/* outdoor operation */
 SYSCTL_INT(_hw_ath, OID_AUTO, outdoor, CTLFLAG_RD, &ath_outdoor,
-	    0, "enable/disable outdoor operation");
+	    0, "outdoor operation");
 TUNABLE_INT("hw.ath.outdoor", &ath_outdoor);
+static	int ath_xchanmode = AH_TRUE;		/* extended channel use */
+SYSCTL_INT(_hw_ath, OID_AUTO, xchanmode, CTLFLAG_RD, &ath_xchanmode,
+	    0, "extended channel mode");
+TUNABLE_INT("hw.ath.xchanmode", &ath_xchanmode);
 static	int ath_countrycode = CTRY_DEFAULT;	/* country code */
 SYSCTL_INT(_hw_ath, OID_AUTO, countrycode, CTLFLAG_RD, &ath_countrycode,
 	    0, "country code");
@@ -159,15 +193,10 @@ SYSCTL_INT(_hw_ath, OID_AUTO, regdomain, CTLFLAG_RD, &ath_regdomain,
 	    0, "regulatory domain");
 
 #ifdef AR_DEBUG
-int	ath_debug = 0;
+static	int ath_debug = 0;
 SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
 	    0, "control debugging printfs");
 TUNABLE_INT("hw.ath.debug", &ath_debug);
-#define	IFF_DUMPPKTS(_ifp, _m) \
-	((ath_debug & _m) || \
-	    ((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
-static	void ath_printrxbuf(struct ath_buf *bf, int);
-static	void ath_printtxbuf(struct ath_buf *bf, int);
 enum {
 	ATH_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
 	ATH_DEBUG_XMIT_DESC	= 0x00000002,	/* xmit descriptors */
@@ -183,29 +212,48 @@ enum {
 	ATH_DEBUG_RX_PROC	= 0x00004000,	/* rx ISR proc */
 	ATH_DEBUG_BEACON_PROC	= 0x00008000,	/* beacon ISR proc */
 	ATH_DEBUG_CALIBRATE	= 0x00010000,	/* periodic calibration */
+	ATH_DEBUG_KEYCACHE	= 0x00020000,	/* key cache management */
+	ATH_DEBUG_STATE		= 0x00040000,	/* 802.11 state transitions */
+	ATH_DEBUG_NODE		= 0x00080000,	/* node management */
+	ATH_DEBUG_FATAL		= 0x80000000,	/* fatal errors */
 	ATH_DEBUG_ANY		= 0xffffffff
 };
-#define	DPRINTF(_m,X)	if (ath_debug & _m) printf X
+#define	IFF_DUMPPKTS(sc, m) \
+	((sc->sc_debug & m) || \
+	    (sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
+#define	DPRINTF(sc, m, fmt, ...) do {				\
+	if (sc->sc_debug & m)					\
+		printf(fmt, __VA_ARGS__);			\
+} while (0)
+#define	KEYPRINTF(sc, ix, hk, mac) do {				\
+	if (sc->sc_debug & ATH_DEBUG_KEYCACHE)			\
+		ath_keyprint(__func__, ix, hk, mac);		\
+} while (0)
+static	void ath_printrxbuf(struct ath_buf *bf, int);
+static	void ath_printtxbuf(struct ath_buf *bf, int);
 #else
-#define	IFF_DUMPPKTS(_ifp, _m) \
-	(((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
-#define	DPRINTF(_m, X)
+#define	IFF_DUMPPKTS(sc, m) \
+	((sc->sc_if.if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
+#define	DPRINTF(m, fmt, ...)
+#define	KEYPRINTF(sc, k, ix, mac)
 #endif
 
+MALLOC_DEFINE(M_ATHDEV, "athdev", "ath driver dma buffers");
+
 int
 ath_attach(u_int16_t devid, struct ath_softc *sc)
 {
+	struct ifnet *ifp = &sc->sc_if;
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
 	struct ath_hal *ah;
 	HAL_STATUS status;
-	int error = 0;
+	int error = 0, i;
 
-	DPRINTF(ATH_DEBUG_ANY, ("%s: devid 0x%x\n", __func__, devid));
+	DPRINTF(sc, ATH_DEBUG_ANY, "%s: devid 0x%x\n", __func__, devid);
 
 	/* set these up early for if_printf use */
 	if_initname(ifp, device_get_name(sc->sc_dev),
-	    device_get_unit(sc->sc_dev));
+		device_get_unit(sc->sc_dev));
 
 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
 	if (ah == NULL) {
@@ -215,39 +263,75 @@ ath_attach(u_int16_t devid, struct ath_softc *sc)
 		goto bad;
 	}
 	if (ah->ah_abi != HAL_ABI_VERSION) {
-		if_printf(ifp, "HAL ABI mismatch detected (0x%x != 0x%x)\n",
+		if_printf(ifp, "HAL ABI mismatch detected "
+			"(HAL:0x%x != driver:0x%x)\n",
 			ah->ah_abi, HAL_ABI_VERSION);
 		error = ENXIO;
 		goto bad;
 	}
-	if_printf(ifp, "mac %d.%d phy %d.%d",
-		ah->ah_macVersion, ah->ah_macRev,
-		ah->ah_phyRev >> 4, ah->ah_phyRev & 0xf);
-	if (ah->ah_analog5GhzRev)
-		printf(" 5ghz radio %d.%d",
-			ah->ah_analog5GhzRev >> 4, ah->ah_analog5GhzRev & 0xf);
-	if (ah->ah_analog2GhzRev)
-		printf(" 2ghz radio %d.%d",
-			ah->ah_analog2GhzRev >> 4, ah->ah_analog2GhzRev & 0xf);
-	printf("\n");
 	sc->sc_ah = ah;
 	sc->sc_invalid = 0;	/* ready to go, enable interrupt handling */
 
 	/*
+	 * Check if the MAC has multi-rate retry support.
+	 * We do this by trying to setup a fake extended
+	 * descriptor.  MAC's that don't have support will
+	 * return false w/o doing anything.  MAC's that do
+	 * support it will return true w/o doing anything.
+	 */
+	sc->sc_mrretry = ath_hal_setupxtxdesc(ah, NULL, 0,0, 0,0, 0,0);
+
+	/*
+	 * Check if the device has hardware counters for PHY
+	 * errors.  If so we need to enable the MIB interrupt
+	 * so we can act on stat triggers.
+	 */
+	if (ath_hal_hwphycounters(ah))
+		sc->sc_needmib = 1;
+
+	/*
+	 * Get the hardware key cache size.
+	 */
+	sc->sc_keymax = ath_hal_keycachesize(ah);
+	if (sc->sc_keymax > sizeof(sc->sc_keymap) * NBBY) {
+		if_printf(ifp, "Warning, using only %u of %u key cache slots\n",
+			sizeof(sc->sc_keymap) * NBBY, sc->sc_keymax);
+		sc->sc_keymax = sizeof(sc->sc_keymap) * NBBY;
+	}
+	/*
+	 * Reset the key cache since some parts do not
+	 * reset the contents on initial power up.
+	 */
+	for (i = 0; i < sc->sc_keymax; i++)
+		ath_hal_keyreset(ah, i);
+	/*
+	 * Mark key cache slots associated with global keys
+	 * as in use.  If we knew TKIP was not to be used we
+	 * could leave the +32, +64, and +32+64 slots free.
+	 * XXX only for splitmic.
+	 */
+	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
+		setbit(sc->sc_keymap, i);
+		setbit(sc->sc_keymap, i+32);
+		setbit(sc->sc_keymap, i+64);
+		setbit(sc->sc_keymap, i+32+64);
+	}
+
+	/*
 	 * Collect the channel list using the default country
 	 * code and including outdoor channels.  The 802.11 layer
 	 * is resposible for filtering this list based on settings
 	 * like the phy mode.
 	 */
-	error = ath_getchannels(sc, ath_countrycode, ath_outdoor);
+	error = ath_getchannels(sc, ath_countrycode,
+			ath_outdoor, ath_xchanmode);
 	if (error != 0)
 		goto bad;
 	/*
-	 * Copy these back; they are set as a side effect
-	 * of constructing the channel list.
+	 * Setup dynamic sysctl's now that country code and
+	 * regdomain are available from the hal.
 	 */
-	ath_regdomain = ath_hal_getregdomain(ah);
-	ath_countrycode = ath_hal_getcountrycode(ah);
+	ath_sysctlattach(sc);
 
 	/*
 	 * Setup rate tables for all potential media types.
@@ -255,8 +339,14 @@ ath_attach(u_int16_t devid, struct ath_softc *sc)
 	ath_rate_setup(sc, IEEE80211_MODE_11A);
 	ath_rate_setup(sc, IEEE80211_MODE_11B);
 	ath_rate_setup(sc, IEEE80211_MODE_11G);
-	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
+	ath_rate_setup(sc, IEEE80211_MODE_TURBO_A);
+	ath_rate_setup(sc, IEEE80211_MODE_TURBO_G);
+	/* NB: setup here so ath_rate_update is happy */
+	ath_setcurmode(sc, IEEE80211_MODE_11A);
 
+	/*
+	 * Allocate tx+rx descriptors and populate the lists.
+	 */
 	error = ath_desc_alloc(sc);
 	if (error != 0) {
 		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
@@ -266,37 +356,100 @@ ath_attach(u_int16_t devid, struct ath_softc *sc)
 	callout_init(&sc->sc_cal_ch, CALLOUT_MPSAFE);
 
 	ATH_TXBUF_LOCK_INIT(sc);
-	ATH_TXQ_LOCK_INIT(sc);
 
-	TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc, sc);
 	TASK_INIT(&sc->sc_rxtask, 0, ath_rx_proc, sc);
 	TASK_INIT(&sc->sc_rxorntask, 0, ath_rxorn_proc, sc);
 	TASK_INIT(&sc->sc_fataltask, 0, ath_fatal_proc, sc);
 	TASK_INIT(&sc->sc_bmisstask, 0, ath_bmiss_proc, sc);
+	TASK_INIT(&sc->sc_bstucktask, 0, ath_bstuck_proc, sc);
 
 	/*
-	 * For now just pre-allocate one data queue and one
-	 * beacon queue.  Note that the HAL handles resetting
-	 * them at the needed time.  Eventually we'll want to
-	 * allocate more tx queues for splitting management
-	 * frames and for QOS support.
+	 * Allocate hardware transmit queues: one queue for
+	 * beacon frames and one data queue for each QoS
+	 * priority.  Note that the hal handles reseting
+	 * these queues at the needed time.
+	 *
+	 * XXX PS-Poll
 	 */
-	sc->sc_txhalq = ath_hal_setuptxqueue(ah,
-		HAL_TX_QUEUE_DATA,
-		AH_TRUE			/* enable interrupts */
-	);
-	if (sc->sc_txhalq == (u_int) -1) {
-		if_printf(ifp, "unable to setup a data xmit queue!\n");
-		goto bad2;
-	}
-	sc->sc_bhalq = ath_hal_setuptxqueue(ah,
-		HAL_TX_QUEUE_BEACON,
-		AH_TRUE			/* enable interrupts */
-	);
+	sc->sc_bhalq = ath_hal_setuptxqueue(ah, HAL_TX_QUEUE_BEACON, NULL);
 	if (sc->sc_bhalq == (u_int) -1) {
 		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
+		error = EIO;
 		goto bad2;
 	}
+	sc->sc_cabq = ath_txq_setup(sc, HAL_TX_QUEUE_CAB, 0);
+	if (sc->sc_cabq == NULL) {
+		if_printf(ifp, "unable to setup CAB xmit queue!\n");
+		error = EIO;
+		goto bad2;
+	}
+	/* NB: insure BK queue is the lowest priority h/w queue */
+	if (!ath_tx_setup(sc, WME_AC_BK, HAL_WME_AC_BK)) {
+		if_printf(ifp, "unable to setup xmit queue for %s traffic!\n",
+			ieee80211_wme_acnames[WME_AC_BK]);
+		error = EIO;
+		goto bad2;
+	}
+	if (!ath_tx_setup(sc, WME_AC_BE, HAL_WME_AC_BE) ||
+	    !ath_tx_setup(sc, WME_AC_VI, HAL_WME_AC_VI) ||
+	    !ath_tx_setup(sc, WME_AC_VO, HAL_WME_AC_VO)) {
+		/* 
+		 * Not enough hardware tx queues to properly do WME;
+		 * just punt and assign them all to the same h/w queue.
+		 * We could do a better job of this if, for example,
+		 * we allocate queues when we switch from station to
+		 * AP mode.
+		 */
+		if (sc->sc_ac2q[WME_AC_VI] != NULL)
+			ath_tx_cleanupq(sc, sc->sc_ac2q[WME_AC_VI]);
+		if (sc->sc_ac2q[WME_AC_BE] != NULL)
+			ath_tx_cleanupq(sc, sc->sc_ac2q[WME_AC_BE]);
+		sc->sc_ac2q[WME_AC_BE] = sc->sc_ac2q[WME_AC_BK];
+		sc->sc_ac2q[WME_AC_VI] = sc->sc_ac2q[WME_AC_BK];
+		sc->sc_ac2q[WME_AC_VO] = sc->sc_ac2q[WME_AC_BK];
+	}
+
+	/* 
+	 * Special case certain configurations.  Note the
+	 * CAB queue is handled by these specially so don't
+	 * include them when checking the txq setup mask.
+	 */
+	switch (sc->sc_txqsetup &~ (1<<sc->sc_cabq->axq_qnum)) {
+	case 0x01:
+		TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc_q0, sc);
+		break;
+	case 0x0f:
+		TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc_q0123, sc);
+		break;
+	default:
+		TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc, sc);
+		break;
+	}
+
+	/*
+	 * Setup rate control.  Some rate control modules
+	 * call back to change the anntena state so expose
+	 * the necessary entry points.
+	 * XXX maybe belongs in struct ath_ratectrl?
+	 */
+	sc->sc_setdefantenna = ath_setdefantenna;
+	sc->sc_rc = ath_rate_attach(sc);
+	if (sc->sc_rc == NULL) {
+		error = EIO;
+		goto bad2;
+	}
+
+	sc->sc_ledstate = 1;
+	/*
+	 * Auto-enable soft led processing for IBM cards and for
+	 * 5211 minipci cards.  Users can also manually enable/disable
+	 * support with a sysctl.
+	 */
+	sc->sc_softled = (devid == AR5212_DEVID_IBM || devid == AR5211_DEVID);
+	if (sc->sc_softled) {
+		ath_hal_gpioCfgOutput(ah, sc->sc_ledpin);
+		ath_hal_gpioset(ah, sc->sc_ledpin, 0);
+	}
 
 	ifp->if_softc = sc;
 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
@@ -308,57 +461,118 @@ ath_attach(u_int16_t devid, struct ath_softc *sc)
 	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
 	IFQ_SET_READY(&ifp->if_snd);
 
-	ic->ic_softc = sc;
+	ic->ic_ifp = ifp;
+	ic->ic_reset = ath_reset;
 	ic->ic_newassoc = ath_newassoc;
+	ic->ic_updateslot = ath_updateslot;
+	ic->ic_wme.wme_update = ath_wme_update;
 	/* XXX not right but it's not used anywhere important */
 	ic->ic_phytype = IEEE80211_T_OFDM;
 	ic->ic_opmode = IEEE80211_M_STA;
-	ic->ic_caps = IEEE80211_C_WEP		/* wep supported */
-		| IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
+	ic->ic_caps =
+		  IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
 		| IEEE80211_C_HOSTAP		/* hostap mode */
 		| IEEE80211_C_MONITOR		/* monitor mode */
 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
+		| IEEE80211_C_SHSLOT		/* short slot time supported */
+		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
 		;
+	/*
+	 * Query the hal to figure out h/w crypto support.
+	 */
+	if (ath_hal_ciphersupported(ah, HAL_CIPHER_WEP))
+		ic->ic_caps |= IEEE80211_C_WEP;
+	if (ath_hal_ciphersupported(ah, HAL_CIPHER_AES_OCB))
+		ic->ic_caps |= IEEE80211_C_AES;
+	if (ath_hal_ciphersupported(ah, HAL_CIPHER_AES_CCM))
+		ic->ic_caps |= IEEE80211_C_AES_CCM;
+	if (ath_hal_ciphersupported(ah, HAL_CIPHER_CKIP))
+		ic->ic_caps |= IEEE80211_C_CKIP;
+	if (ath_hal_ciphersupported(ah, HAL_CIPHER_TKIP)) {
+		ic->ic_caps |= IEEE80211_C_TKIP;
+		/*
+		 * Check if h/w does the MIC and/or whether the
+		 * separate key cache entries are required to
+		 * handle both tx+rx MIC keys.
+		 */
+		if (ath_hal_ciphersupported(ah, HAL_CIPHER_MIC))
+			ic->ic_caps |= IEEE80211_C_TKIPMIC;
+		if (ath_hal_tkipsplit(ah))
+			sc->sc_splitmic = 1;
+	}
+	/*
+	 * TPC support can be done either with a global cap or
+	 * per-packet support.  The latter is not available on
+	 * all parts.  We're a bit pedantic here as all parts
+	 * support a global cap.
+	 */
+	sc->sc_hastpc = ath_hal_hastpc(ah);
+	if (sc->sc_hastpc || ath_hal_hastxpowlimit(ah))
+		ic->ic_caps |= IEEE80211_C_TXPMGT;
+
+	/*
+	 * Mark WME capability only if we have sufficient
+	 * hardware queues to do proper priority scheduling.
+	 */
+	if (sc->sc_ac2q[WME_AC_BE] != sc->sc_ac2q[WME_AC_BK])
+		ic->ic_caps |= IEEE80211_C_WME;
+	/*
+	 * Check for frame bursting capability.
+	 */
+	if (ath_hal_hasbursting(ah))
+		ic->ic_caps |= IEEE80211_C_BURST;
+
+	/*
+	 * Indicate we need the 802.11 header padded to a
+	 * 32-bit boundary for 4-address and QoS frames.
+	 */
+	ic->ic_flags |= IEEE80211_F_DATAPAD;
+
+	/*
+	 * Query the hal about antenna support.
+	 */
+	if (ath_hal_hasdiversity(ah)) {
+		sc->sc_hasdiversity = 1;
+		sc->sc_diversity = ath_hal_getdiversity(ah);
+	}
+	sc->sc_defant = ath_hal_getdefantenna(ah);
+
+	/*
+	 * Not all chips have the VEOL support we want to
+	 * use with IBSS beacons; check here for it.
+	 */
+	sc->sc_hasveol = ath_hal_hasveol(ah);
 
 	/* get mac address from hardware */
 	ath_hal_getmac(ah, ic->ic_myaddr);
 
 	/* call MI attach routine. */
-	ieee80211_ifattach(ifp);
+	ieee80211_ifattach(ic);
 	/* override default methods */
 	ic->ic_node_alloc = ath_node_alloc;
 	sc->sc_node_free = ic->ic_node_free;
 	ic->ic_node_free = ath_node_free;
-	sc->sc_node_copy = ic->ic_node_copy;
-	ic->ic_node_copy = ath_node_copy;
 	ic->ic_node_getrssi = ath_node_getrssi;
+	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
+	ic->ic_recv_mgmt = ath_recv_mgmt;
 	sc->sc_newstate = ic->ic_newstate;
 	ic->ic_newstate = ath_newstate;
+	ic->ic_crypto.cs_key_alloc = ath_key_alloc;
+	ic->ic_crypto.cs_key_delete = ath_key_delete;
+	ic->ic_crypto.cs_key_set = ath_key_set;
+	ic->ic_crypto.cs_key_update_begin = ath_key_update_begin;
+	ic->ic_crypto.cs_key_update_end = ath_key_update_end;
 	/* complete initialization */
-	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
+	ieee80211_media_init(ic, ath_media_change, ieee80211_media_status);
 
-	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
-		sizeof(struct ieee80211_frame) + sizeof(sc->sc_tx_th),
-		&sc->sc_drvbpf);
-	/*
-	 * Initialize constant fields.
-	 * XXX make header lengths a multiple of 32-bits so subsequent
-	 *     headers are properly aligned; this is a kludge to keep
-	 *     certain applications happy.
-	 *
-	 * NB: the channel is setup each time we transition to the
-	 *     RUN state to avoid filling it in for each frame.
-	 */
-	sc->sc_tx_th_len = roundup(sizeof(sc->sc_tx_th), sizeof(u_int32_t));
-	sc->sc_tx_th.wt_ihdr.it_len = htole16(sc->sc_tx_th_len);
-	sc->sc_tx_th.wt_ihdr.it_present = htole32(ATH_TX_RADIOTAP_PRESENT);
-
-	sc->sc_rx_th_len = roundup(sizeof(sc->sc_rx_th), sizeof(u_int32_t));
-	sc->sc_rx_th.wr_ihdr.it_len = htole16(sc->sc_rx_th_len);
-	sc->sc_rx_th.wr_ihdr.it_present = htole32(ATH_RX_RADIOTAP_PRESENT);
+	ath_bpfattach(sc);
 
+	if (bootverbose)
+		ieee80211_announce(ic);
+	ath_announce(sc);
 	return 0;
 bad2:
+	ath_tx_cleanup(sc);
 	ath_desc_free(sc);
 bad:
 	if (ah)
@@ -370,18 +584,30 @@ bad:
 int
 ath_detach(struct ath_softc *sc)
 {
-	struct ifnet *ifp = &sc->sc_ic.ic_if;
+	struct ifnet *ifp = &sc->sc_if;
 
-	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
+	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
+		__func__, ifp->if_flags);
 
 	ath_stop(ifp);
 	bpfdetach(ifp);
+	/* 
+	 * NB: the order of these is important:
+	 * o call the 802.11 layer before detaching the hal to
+	 *   insure callbacks into the driver to delete global
+	 *   key cache entries can be handled
+	 * o reclaim the tx queue data structures after calling
+	 *   the 802.11 layer as we'll get called back to reclaim
+	 *   node state and potentially want to use them
+	 * o to cleanup the tx queues the hal is called, so detach
+	 *   it last
+	 * Other than that, it's straightforward...
+	 */
+	ieee80211_ifdetach(&sc->sc_ic);
+	ath_rate_detach(sc->sc_rc);
 	ath_desc_free(sc);
+	ath_tx_cleanup(sc);
 	ath_hal_detach(sc->sc_ah);
-	ieee80211_ifdetach(ifp);
-
-	ATH_TXBUF_LOCK_DESTROY(sc);
-	ATH_TXQ_LOCK_DESTROY(sc);
 
 	return 0;
 }
@@ -389,9 +615,10 @@ ath_detach(struct ath_softc *sc)
 void
 ath_suspend(struct ath_softc *sc)
 {
-	struct ifnet *ifp = &sc->sc_ic.ic_if;
+	struct ifnet *ifp = &sc->sc_if;
 
-	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
+	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
+		__func__, ifp->if_flags);
 
 	ath_stop(ifp);
 }
@@ -399,9 +626,10 @@ ath_suspend(struct ath_softc *sc)
 void
 ath_resume(struct ath_softc *sc)
 {
-	struct ifnet *ifp = &sc->sc_ic.ic_if;
+	struct ifnet *ifp = &sc->sc_if;
 
-	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
+	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
+		__func__, ifp->if_flags);
 
 	if (ifp->if_flags & IFF_UP) {
 		ath_init(ifp);
@@ -413,19 +641,22 @@ ath_resume(struct ath_softc *sc)
 void
 ath_shutdown(struct ath_softc *sc)
 {
-	struct ifnet *ifp = &sc->sc_ic.ic_if;
+	struct ifnet *ifp = &sc->sc_if;
 
-	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
+	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
+		__func__, ifp->if_flags);
 
 	ath_stop(ifp);
 }
 
+/*
+ * Interrupt handler.  Most of the actual processing is deferred.
+ */
 void
 ath_intr(void *arg)
 {
 	struct ath_softc *sc = arg;
-	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
+	struct ifnet *ifp = &sc->sc_if;
 	struct ath_hal *ah = sc->sc_ah;
 	HAL_INT status;
 
@@ -434,29 +665,34 @@ ath_intr(void *arg)
 		 * The hardware is not ready/present, don't touch anything.
 		 * Note this can happen early on if the IRQ is shared.
 		 */
-		DPRINTF(ATH_DEBUG_ANY, ("%s: invalid; ignored\n", __func__));
+		DPRINTF(sc, ATH_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
 		return;
 	}
 	if (!ath_hal_intrpend(ah))		/* shared irq, not for us */
 		return;
 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
-		DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags 0x%x\n",
-			__func__, ifp->if_flags));
+		DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags 0x%x\n",
+			__func__, ifp->if_flags);
 		ath_hal_getisr(ah, &status);	/* clear ISR */
 		ath_hal_intrset(ah, 0);		/* disable further intr's */
 		return;
 	}
+	/*
+	 * Figure out the reason(s) for the interrupt.  Note
+	 * that the hal returns a pseudo-ISR that may include
+	 * bits we haven't explicitly enabled so we mask the
+	 * value to insure we only process bits we requested.
+	 */
 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
-	DPRINTF(ATH_DEBUG_INTR, ("%s: status 0x%x\n", __func__, status));
-#ifdef AR_DEBUG
-	if (ath_debug &&
-	    (status & (HAL_INT_FATAL|HAL_INT_RXORN|HAL_INT_BMISS))) {
-		if_printf(ifp, "ath_intr: status 0x%x\n", status);
-		ath_hal_dumpstate(ah);
-	}
-#endif /* AR_DEBUG */
+	DPRINTF(sc, ATH_DEBUG_INTR, "%s: status 0x%x\n", __func__, status);
 	status &= sc->sc_imask;			/* discard unasked for bits */
 	if (status & HAL_INT_FATAL) {
+		/*
+		 * Fatal errors are unrecoverable.  Typically
+		 * these are caused by DMA errors.  Unfortunately
+		 * the exact reason is not (presently) returned
+		 * by the hal.
+		 */
 		sc->sc_stats.ast_hardware++;
 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
 		taskqueue_enqueue(taskqueue_swi, &sc->sc_fataltask);
@@ -465,6 +701,15 @@ ath_intr(void *arg)
 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
 		taskqueue_enqueue(taskqueue_swi, &sc->sc_rxorntask);
 	} else {
+		if (status & HAL_INT_SWBA) {
+			/*
+			 * Software beacon alert--time to send a beacon.
+			 * Handle beacon transmission directly; deferring
+			 * this is too slow to meet timing constraints
+			 * under load.
+			 */
+			ath_beacon_proc(sc, 0);
+		}
 		if (status & HAL_INT_RXEOL) {
 			/*
 			 * NB: the hardware should re-read the link when
@@ -483,18 +728,25 @@ ath_intr(void *arg)
 			taskqueue_enqueue(taskqueue_swi, &sc->sc_rxtask);
 		if (status & HAL_INT_TX)
 			taskqueue_enqueue(taskqueue_swi, &sc->sc_txtask);
-		if (status & HAL_INT_SWBA) {
-			/*
-			 * Handle beacon transmission directly; deferring
-			 * this is too slow to meet timing constraints
-			 * under load.
-			 */
-			ath_beacon_proc(sc, 0);
-		}
 		if (status & HAL_INT_BMISS) {
 			sc->sc_stats.ast_bmiss++;
 			taskqueue_enqueue(taskqueue_swi, &sc->sc_bmisstask);
 		}
+		if (status & HAL_INT_MIB) {
+			sc->sc_stats.ast_mib++;
+			/*
+			 * Disable interrupts until we service the MIB
+			 * interrupt; otherwise it will continue to fire.
+			 */
+			ath_hal_intrset(ah, 0);
+			/*
+			 * Let the hal handle the event.  We assume it will
+			 * clear whatever condition caused the interrupt.
+			 */
+			ath_hal_mibevent(ah,
+				&ATH_NODE(sc->sc_ic.ic_bss)->an_halstats);
+			ath_hal_intrset(ah, sc->sc_imask);
+		}
 	}
 }
 
@@ -502,18 +754,20 @@ static void
 ath_fatal_proc(void *arg, int pending)
 {
 	struct ath_softc *sc = arg;
+	struct ifnet *ifp = &sc->sc_if;
 
-	device_printf(sc->sc_dev, "hardware error; resetting\n");
-	ath_reset(sc);
+	if_printf(ifp, "hardware error; resetting\n");
+	ath_reset(ifp);
 }
 
 static void
 ath_rxorn_proc(void *arg, int pending)
 {
 	struct ath_softc *sc = arg;
+	struct ifnet *ifp = &sc->sc_if;
 
-	device_printf(sc->sc_dev, "rx FIFO overrun; resetting\n");
-	ath_reset(sc);
+	if_printf(ifp, "rx FIFO overrun; resetting\n");
+	ath_reset(ifp);
 }
 
 static void
@@ -522,7 +776,7 @@ ath_bmiss_proc(void *arg, int pending)
 	struct ath_softc *sc = arg;
 	struct ieee80211com *ic = &sc->sc_ic;
 
-	DPRINTF(ATH_DEBUG_ANY, ("%s: pending %u\n", __func__, pending));
+	DPRINTF(sc, ATH_DEBUG_ANY, "%s: pending %u\n", __func__, pending);
 	KASSERT(ic->ic_opmode == IEEE80211_M_STA,
 		("unexpect operating mode %u", ic->ic_opmode));
 	if (ic->ic_state == IEEE80211_S_RUN) {
@@ -541,14 +795,22 @@ ath_bmiss_proc(void *arg, int pending)
 static u_int
 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
 {
+#define	N(a)	(sizeof(a) / sizeof(a[0]))
 	static const u_int modeflags[] = {
 		0,			/* IEEE80211_MODE_AUTO */
 		CHANNEL_A,		/* IEEE80211_MODE_11A */
 		CHANNEL_B,		/* IEEE80211_MODE_11B */
 		CHANNEL_PUREG,		/* IEEE80211_MODE_11G */
-		CHANNEL_T		/* IEEE80211_MODE_TURBO */
+		0,			/* IEEE80211_MODE_FH */
+		CHANNEL_T,		/* IEEE80211_MODE_TURBO_A */
+		CHANNEL_108G		/* IEEE80211_MODE_TURBO_G */
 	};
-	return modeflags[ieee80211_chan2mode(ic, chan)];
+	enum ieee80211_phymode mode = ieee80211_chan2mode(ic, chan);
+
+	KASSERT(mode < N(modeflags), ("unexpected phy mode %u", mode));
+	KASSERT(modeflags[mode] != 0, ("mode %u undefined", mode));
+	return modeflags[mode];
+#undef N
 }
 
 static void
@@ -556,22 +818,21 @@ ath_init(void *arg)
 {
 	struct ath_softc *sc = (struct ath_softc *) arg;
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
+	struct ifnet *ifp = &sc->sc_if;
 	struct ieee80211_node *ni;
 	enum ieee80211_phymode mode;
 	struct ath_hal *ah = sc->sc_ah;
 	HAL_STATUS status;
-	HAL_CHANNEL hchan;
 
-	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags 0x%x\n",
-		__func__, ifp->if_flags));
+	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags 0x%x\n",
+		__func__, ifp->if_flags);
 
 	ATH_LOCK(sc);
 	/*
 	 * Stop anything previously setup.  This is safe
 	 * whether this is the first time through or not.
 	 */
-	ath_stop(ifp);
+	ath_stop_locked(ifp);
 
 	/*
 	 * The basic interface to setting the hardware in a good
@@ -580,23 +841,28 @@ ath_init(void *arg)
 	 * be followed by initialization of the appropriate bits
 	 * and then setup of the interrupt mask.
 	 */
-	hchan.channel = ic->ic_ibss_chan->ic_freq;
-	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
-	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_FALSE, &status)) {
+	sc->sc_curchan.channel = ic->ic_ibss_chan->ic_freq;
+	sc->sc_curchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
+	if (!ath_hal_reset(ah, ic->ic_opmode, &sc->sc_curchan, AH_FALSE, &status)) {
 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
 			status);
 		goto done;
 	}
 
 	/*
+	 * This is needed only to setup initial state
+	 * but it's best done after a reset.
+	 */
+	ath_update_txpow(sc);
+
+	/*
 	 * Setup the hardware after reset: the key cache
 	 * is filled as needed and the receive engine is
 	 * set going.  Frame transmit is handled entirely
 	 * in the frame output path; there's nothing to do
 	 * here except setup the interrupt mask.
 	 */
-	if (ic->ic_flags & IEEE80211_F_WEPON)
-		ath_initkeytable(sc);
+	ath_initkeytable(sc);		/* XXX still needed? */
 	if (ath_startrecv(sc) != 0) {
 		if_printf(ifp, "unable to start recv logic\n");
 		goto done;
@@ -608,6 +874,12 @@ ath_init(void *arg)
 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
 		  | HAL_INT_RXEOL | HAL_INT_RXORN
 		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
+	/*
+	 * Enable MIB interrupts when there are hardware phy counters.
+	 * Note we only do this (at the moment) for station mode.
+	 */
+	if (sc->sc_needmib && ic->ic_opmode == IEEE80211_M_STA)
+		sc->sc_imask |= HAL_INT_MIB;
 	ath_hal_intrset(ah, sc->sc_imask);
 
 	ifp->if_flags |= IFF_RUNNING;
@@ -623,54 +895,79 @@ ath_init(void *arg)
 	mode = ieee80211_chan2mode(ic, ni->ni_chan);
 	if (mode != sc->sc_curmode)
 		ath_setcurmode(sc, mode);
-	if (ic->ic_opmode != IEEE80211_M_MONITOR)
-		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
-	else
+	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
+		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
+			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
+	} else
 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 done:
 	ATH_UNLOCK(sc);
 }
 
 static void
-ath_stop(struct ifnet *ifp)
+ath_stop_locked(struct ifnet *ifp)
 {
-	struct ieee80211com *ic = (struct ieee80211com *) ifp;
 	struct ath_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
 	struct ath_hal *ah = sc->sc_ah;
 
-	DPRINTF(ATH_DEBUG_ANY, ("%s: invalid %u if_flags 0x%x\n",
-		__func__, sc->sc_invalid, ifp->if_flags));
+	DPRINTF(sc, ATH_DEBUG_ANY, "%s: invalid %u if_flags 0x%x\n",
+		__func__, sc->sc_invalid, ifp->if_flags);
 
-	ATH_LOCK(sc);
+	ATH_LOCK_ASSERT(sc);
 	if (ifp->if_flags & IFF_RUNNING) {
 		/*
 		 * Shutdown the hardware and driver:
-		 *    disable interrupts
+		 *    reset 802.11 state machine
 		 *    turn off timers
+		 *    disable interrupts
+		 *    turn off the radio
 		 *    clear transmit machinery
 		 *    clear receive machinery
 		 *    drain and release tx queues
 		 *    reclaim beacon resources
-		 *    reset 802.11 state machine
 		 *    power down hardware
 		 *
 		 * Note that some of this work is not possible if the
 		 * hardware is gone (invalid).
 		 */
+		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 		ifp->if_flags &= ~IFF_RUNNING;
 		ifp->if_timer = 0;
-		if (!sc->sc_invalid)
+		if (!sc->sc_invalid) {
+			if (sc->sc_softled)
+				ath_hal_gpioset(ah, sc->sc_ledpin, 1);
 			ath_hal_intrset(ah, 0);
+		}
 		ath_draintxq(sc);
-		if (!sc->sc_invalid)
+		if (!sc->sc_invalid) {
 			ath_stoprecv(sc);
-		else
+			ath_hal_phydisable(ah);
+		} else
 			sc->sc_rxlink = NULL;
 		IFQ_DRV_PURGE(&ifp->if_snd);
 		ath_beacon_free(sc);
-		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
-		if (!sc->sc_invalid)
-			ath_hal_setpower(ah, HAL_PM_FULL_SLEEP, 0);
+	}
+}
+
+static void
+ath_stop(struct ifnet *ifp)
+{
+	struct ath_softc *sc = ifp->if_softc;
+
+	ATH_LOCK(sc);
+	ath_stop_locked(ifp);
+	if (!sc->sc_invalid) {
+		/*
+		 * Set the chip in full sleep mode.  Note that we are
+		 * careful to do this only when bringing the interface
+		 * completely to a stop.  When the chip is in this state
+		 * it must be carefully woken up or references to
+		 * registers in the PCI clock domain may freeze the bus
+		 * (and system).  This varies by chip and is mostly an
+		 * issue with newer parts that go to sleep more quickly.
+		 */
+		ath_hal_setpower(sc->sc_ah, HAL_PM_FULL_SLEEP, 0);
 	}
 	ATH_UNLOCK(sc);
 }
@@ -679,40 +976,48 @@ ath_stop(struct ifnet *ifp)
  * Reset the hardware w/o losing operational state.  This is
  * basically a more efficient way of doing ath_stop, ath_init,
  * followed by state transitions to the current 802.11
- * operational state.  Used to recover from errors rx overrun
- * and to reset the hardware when rf gain settings must be reset.
+ * operational state.  Used to recover from various errors and
+ * to reset or reload hardware state.
  */
-static void
-ath_reset(struct ath_softc *sc)
+static int
+ath_reset(struct ifnet *ifp)
 {
+	struct ath_softc *sc = ifp->if_softc;
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
 	struct ath_hal *ah = sc->sc_ah;
 	struct ieee80211_channel *c;
 	HAL_STATUS status;
-	HAL_CHANNEL hchan;
 
 	/*
 	 * Convert to a HAL channel description with the flags
 	 * constrained to reflect the current operating mode.
 	 */
 	c = ic->ic_ibss_chan;
-	hchan.channel = c->ic_freq;
-	hchan.channelFlags = ath_chan2flags(ic, c);
+	sc->sc_curchan.channel = c->ic_freq;
+	sc->sc_curchan.channelFlags = ath_chan2flags(ic, c);
 
 	ath_hal_intrset(ah, 0);		/* disable interrupts */
 	ath_draintxq(sc);		/* stop xmit side */
 	ath_stoprecv(sc);		/* stop recv side */
 	/* NB: indicate channel change so we do a full reset */
-	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status))
+	if (!ath_hal_reset(ah, ic->ic_opmode, &sc->sc_curchan, AH_TRUE, &status))
 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
 			__func__, status);
-	ath_hal_intrset(ah, sc->sc_imask);
+	ath_update_txpow(sc);		/* update tx power state */
 	if (ath_startrecv(sc) != 0)	/* restart recv */
 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
-	ath_start(ifp);			/* restart xmit */
+	/*
+	 * We may be doing a reset in response to an ioctl
+	 * that changes the channel so update any state that
+	 * might change as a result.
+	 */
+	ath_chan_change(sc, c);
 	if (ic->ic_state == IEEE80211_S_RUN)
 		ath_beacon_config(sc);	/* restart beacons */
+	ath_hal_intrset(ah, sc->sc_imask);
+
+	ath_start(ifp);			/* restart xmit */
+	return 0;
 }
 
 static void
@@ -725,6 +1030,7 @@ ath_start(struct ifnet *ifp)
 	struct ath_buf *bf;
 	struct mbuf *m;
 	struct ieee80211_frame *wh;
+	struct ether_header *eh;
 
 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
 		return;
@@ -733,13 +1039,13 @@ ath_start(struct ifnet *ifp)
 		 * Grab a TX buffer and associated resources.
 		 */
 		ATH_TXBUF_LOCK(sc);
-		bf = TAILQ_FIRST(&sc->sc_txbuf);
+		bf = STAILQ_FIRST(&sc->sc_txbuf);
 		if (bf != NULL)
-			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
+			STAILQ_REMOVE_HEAD(&sc->sc_txbuf, bf_list);
 		ATH_TXBUF_UNLOCK(sc);
 		if (bf == NULL) {
-			DPRINTF(ATH_DEBUG_ANY, ("%s: out of xmit buffers\n",
-				__func__));
+			DPRINTF(sc, ATH_DEBUG_ANY, "%s: out of xmit buffers\n",
+				__func__);
 			sc->sc_stats.ast_tx_qstop++;
 			ifp->if_flags |= IFF_OACTIVE;
 			break;
@@ -754,38 +1060,68 @@ ath_start(struct ifnet *ifp)
 			 * No data frames go out unless we're associated.
 			 */
 			if (ic->ic_state != IEEE80211_S_RUN) {
-				DPRINTF(ATH_DEBUG_ANY,
-					("%s: ignore data packet, state %u\n",
-					__func__, ic->ic_state));
+				DPRINTF(sc, ATH_DEBUG_ANY,
+					"%s: ignore data packet, state %u\n",
+					__func__, ic->ic_state);
 				sc->sc_stats.ast_tx_discard++;
 				ATH_TXBUF_LOCK(sc);
-				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+				STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
 				ATH_TXBUF_UNLOCK(sc);
 				break;
 			}
 			IFQ_DRV_DEQUEUE(&ifp->if_snd, m);	/* XXX: LOCK */
 			if (m == NULL) {
 				ATH_TXBUF_LOCK(sc);
-				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+				STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
 				ATH_TXBUF_UNLOCK(sc);
 				break;
 			}
+			/* 
+			 * Find the node for the destination so we can do
+			 * things like power save and fast frames aggregation.
+			 */
+			if (m->m_len < sizeof(struct ether_header) &&
+			   (m = m_pullup(m, sizeof(struct ether_header))) == NULL) {
+				ic->ic_stats.is_tx_nobuf++;	/* XXX */
+				ni = NULL;
+				goto bad;
+			}
+			eh = mtod(m, struct ether_header *);
+			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
+			if (ni == NULL) {
+				/* NB: ieee80211_find_txnode does stat+msg */
+				goto bad;
+			}
+			if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) &&
+			    (m->m_flags & M_PWR_SAV) == 0) {
+				/*
+				 * Station in power save mode; pass the frame
+				 * to the 802.11 layer and continue.  We'll get
+				 * the frame back when the time is right.
+				 */
+				ieee80211_pwrsave(ic, ni, m);
+				goto reclaim;
+			}
+			/* calculate priority so we can find the tx queue */
+			if (ieee80211_classify(ic, m, ni)) {
+				DPRINTF(sc, ATH_DEBUG_XMIT,
+					"%s: discard, classification failure\n",
+					__func__);
+				goto bad;
+			}
 			ifp->if_opackets++;
 			BPF_MTAP(ifp, m);
 			/*
 			 * Encapsulate the packet in prep for transmission.
 			 */
-			m = ieee80211_encap(ifp, m, &ni);
+			m = ieee80211_encap(ic, m, ni);
 			if (m == NULL) {
-				DPRINTF(ATH_DEBUG_ANY,
-					("%s: encapsulation failure\n",
-					__func__));
+				DPRINTF(sc, ATH_DEBUG_ANY,
+					"%s: encapsulation failure\n",
+					__func__);
 				sc->sc_stats.ast_tx_encap++;
 				goto bad;
 			}
-			wh = mtod(m, struct ieee80211_frame *);
-			if (ic->ic_flags & IEEE80211_F_WEPON)
-				wh->i_fc[1] |= IEEE80211_FC1_WEP;
 		} else {
 			/*
 			 * Hack!  The referenced node pointer is in the
@@ -818,12 +1154,13 @@ ath_start(struct ifnet *ifp)
 
 		if (ath_tx_start(sc, ni, bf, m)) {
 	bad:
+			ifp->if_oerrors++;
+	reclaim:
 			ATH_TXBUF_LOCK(sc);
-			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+			STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
 			ATH_TXBUF_UNLOCK(sc);
-			ifp->if_oerrors++;
-			if (ni && ni != ic->ic_bss)
-				ieee80211_free_node(ic, ni);
+			if (ni != NULL)
+				ieee80211_free_node(ni);
 			continue;
 		}
 
@@ -835,129 +1172,142 @@ ath_start(struct ifnet *ifp)
 static int
 ath_media_change(struct ifnet *ifp)
 {
+#define	IS_UP(ifp) \
+	((ifp->if_flags & (IFF_RUNNING|IFF_UP)) == (IFF_RUNNING|IFF_UP))
 	int error;
 
 	error = ieee80211_media_change(ifp);
 	if (error == ENETRESET) {
-		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
-		    (IFF_RUNNING|IFF_UP))
+		if (IS_UP(ifp))
 			ath_init(ifp);		/* XXX lose error */
 		error = 0;
 	}
 	return error;
+#undef IS_UP
 }
 
+#ifdef AR_DEBUG
 static void
-ath_watchdog(struct ifnet *ifp)
+ath_keyprint(const char *tag, u_int ix,
+	const HAL_KEYVAL *hk, const u_int8_t mac[IEEE80211_ADDR_LEN])
 {
-	struct ath_softc *sc = ifp->if_softc;
-	struct ieee80211com *ic = &sc->sc_ic;
-
-	ifp->if_timer = 0;
-	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
-		return;
-	if (sc->sc_tx_timer) {
-		if (--sc->sc_tx_timer == 0) {
-			if_printf(ifp, "device timeout\n");
-#ifdef AR_DEBUG
-			if (ath_debug & ATH_DEBUG_WATCHDOG)
-				ath_hal_dumpstate(sc->sc_ah);
-#endif /* AR_DEBUG */
-			ath_reset(sc);
-			ifp->if_oerrors++;
-			sc->sc_stats.ast_watchdog++;
-			return;
-		}
-		ifp->if_timer = 1;
-	}
-	if (ic->ic_fixed_rate == -1) {
-		/*
-		 * Run the rate control algorithm if we're not
-		 * locked at a fixed rate.
-		 */
-		if (ic->ic_opmode == IEEE80211_M_STA)
-			ath_rate_ctl(sc, ic->ic_bss);
-		else
-			ieee80211_iterate_nodes(ic, ath_rate_ctl, sc);
+	static const char *ciphers[] = {
+		"WEP",
+		"AES-OCB",
+		"AES-CCM",
+		"CKIP",
+		"TKIP",
+		"CLR",
+	};
+	int i, n;
+
+	printf("%s: [%02u] %-7s ", tag, ix, ciphers[hk->kv_type]);
+	for (i = 0, n = hk->kv_len; i < n; i++)
+		printf("%02x", hk->kv_val[i]);
+	printf(" mac %s", ether_sprintf(mac));
+	if (hk->kv_type == HAL_CIPHER_TKIP) {
+		printf(" mic ");
+		for (i = 0; i < sizeof(hk->kv_mic); i++)
+			printf("%02x", hk->kv_mic[i]);
 	}
-	ieee80211_watchdog(ifp);
+	printf("\n");
 }
+#endif
 
+/*
+ * Set a TKIP key into the hardware.  This handles the
+ * potential distribution of key state to multiple key
+ * cache slots for TKIP.
+ */
 static int
-ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
+ath_keyset_tkip(struct ath_softc *sc, const struct ieee80211_key *k,
+	HAL_KEYVAL *hk, const u_int8_t mac[IEEE80211_ADDR_LEN])
 {
-	struct ath_softc *sc = ifp->if_softc;
-	struct ifreq *ifr = (struct ifreq *)data;
-	int error = 0;
+#define	IEEE80211_KEY_XR	(IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV)
+	static const u_int8_t zerobssid[IEEE80211_ADDR_LEN];
+	struct ath_hal *ah = sc->sc_ah;
 
-	ATH_LOCK(sc);
-	switch (cmd) {
-	case SIOCSIFFLAGS:
-		if (ifp->if_flags & IFF_UP) {
-			if (ifp->if_flags & IFF_RUNNING) {
-				/*
-				 * To avoid rescanning another access point,
-				 * do not call ath_init() here.  Instead,
-				 * only reflect promisc mode settings.
-				 */
-				ath_mode_init(sc);
-			} else {
-				/*
-				 * Beware of being called during detach to
-				 * reset promiscuous mode.  In that case we
-				 * will still be marked UP but not RUNNING.
-				 * However trying to re-init the interface
-				 * is the wrong thing to do as we've already
-				 * torn down much of our state.  There's
-				 * probably a better way to deal with this.
-				 */
-				if (!sc->sc_invalid)
-					ath_init(ifp);	/* XXX lose error */
-			}
-		} else
-			ath_stop(ifp);
-		break;
-	case SIOCADDMULTI:
-	case SIOCDELMULTI:
+	KASSERT(k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP,
+		("got a non-TKIP key, cipher %u", k->wk_cipher->ic_cipher));
+	KASSERT(sc->sc_splitmic, ("key cache !split"));
+	if ((k->wk_flags & IEEE80211_KEY_XR) == IEEE80211_KEY_XR) {
 		/*
-		 * The upper layer has already installed/removed
-		 * the multicast address(es), just recalculate the
-		 * multicast filter for the card.
+		 * TX key goes at first index, RX key at +32.
+		 * The hal handles the MIC keys at index+64.
 		 */
-		if (ifp->if_flags & IFF_RUNNING)
-			ath_mode_init(sc);
-		break;
-	case SIOCGATHSTATS:
-		error = copyout(&sc->sc_stats,
-				ifr->ifr_data, sizeof (sc->sc_stats));
-		break;
-	case SIOCGATHDIAG: {
-		struct ath_diag *ad = (struct ath_diag *)data;
-		struct ath_hal *ah = sc->sc_ah;
-		void *data;
-		u_int size;
-
-		if (ath_hal_getdiagstate(ah, ad->ad_id, &data, &size)) {
-			if (size < ad->ad_size)
-				ad->ad_size = size;
-			if (data)
-				error = copyout(data, ad->ad_data, ad->ad_size);
-		} else
-			error = EINVAL;
-		break;
+		memcpy(hk->kv_mic, k->wk_txmic, sizeof(hk->kv_mic));
+		KEYPRINTF(sc, k->wk_keyix, hk, zerobssid);
+		if (!ath_hal_keyset(ah, k->wk_keyix, hk, zerobssid))
+			return 0;
+
+		memcpy(hk->kv_mic, k->wk_rxmic, sizeof(hk->kv_mic));
+		KEYPRINTF(sc, k->wk_keyix+32, hk, mac);
+		/* XXX delete tx key on failure? */
+		return ath_hal_keyset(ah, k->wk_keyix+32, hk, mac);
+	} else if (k->wk_flags & IEEE80211_KEY_XR) {
+		/*
+		 * TX/RX key goes at first index.
+		 * The hal handles the MIC keys are index+64.
+		 */
+		KASSERT(k->wk_keyix < IEEE80211_WEP_NKID,
+			("group key at index %u", k->wk_keyix));
+		memcpy(hk->kv_mic, k->wk_flags & IEEE80211_KEY_XMIT ?
+			k->wk_txmic : k->wk_rxmic, sizeof(hk->kv_mic));
+		KEYPRINTF(sc, k->wk_keyix, hk, zerobssid);
+		return ath_hal_keyset(ah, k->wk_keyix, hk, zerobssid);
 	}
-	default:
-		error = ieee80211_ioctl(ifp, cmd, data);
-		if (error == ENETRESET) {
-			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
-			    (IFF_RUNNING|IFF_UP))
-				ath_init(ifp);		/* XXX lose error */
-			error = 0;
-		}
-		break;
+	/* XXX key w/o xmit/recv; need this for compression? */
+	return 0;
+#undef IEEE80211_KEY_XR
+}
+
+/*
+ * Set a net80211 key into the hardware.  This handles the
+ * potential distribution of key state to multiple key
+ * cache slots for TKIP with hardware MIC support.
+ */
+static int
+ath_keyset(struct ath_softc *sc, const struct ieee80211_key *k,
+	const u_int8_t mac[IEEE80211_ADDR_LEN])
+{
+#define	N(a)	(sizeof(a)/sizeof(a[0]))
+	static const u_int8_t ciphermap[] = {
+		HAL_CIPHER_WEP,		/* IEEE80211_CIPHER_WEP */
+		HAL_CIPHER_TKIP,	/* IEEE80211_CIPHER_TKIP */
+		HAL_CIPHER_AES_OCB,	/* IEEE80211_CIPHER_AES_OCB */
+		HAL_CIPHER_AES_CCM,	/* IEEE80211_CIPHER_AES_CCM */
+		(u_int8_t) -1,		/* 4 is not allocated */
+		HAL_CIPHER_CKIP,	/* IEEE80211_CIPHER_CKIP */
+		HAL_CIPHER_CLR,		/* IEEE80211_CIPHER_NONE */
+	};
+	struct ath_hal *ah = sc->sc_ah;
+	const struct ieee80211_cipher *cip = k->wk_cipher;
+	HAL_KEYVAL hk;
+
+	memset(&hk, 0, sizeof(hk));
+	/*
+	 * Software crypto uses a "clear key" so non-crypto
+	 * state kept in the key cache are maintained and
+	 * so that rx frames have an entry to match.
+	 */
+	if ((k->wk_flags & IEEE80211_KEY_SWCRYPT) == 0) {
+		KASSERT(cip->ic_cipher < N(ciphermap),
+			("invalid cipher type %u", cip->ic_cipher));
+		hk.kv_type = ciphermap[cip->ic_cipher];
+		hk.kv_len = k->wk_keylen;
+		memcpy(hk.kv_val, k->wk_key, k->wk_keylen);
+	} else
+		hk.kv_type = HAL_CIPHER_CLR;
+
+	if (hk.kv_type == HAL_CIPHER_TKIP &&
+	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 &&
+	    sc->sc_splitmic) {
+		return ath_keyset_tkip(sc, k, &hk, mac);
+	} else {
+		KEYPRINTF(sc, k->wk_keyix, &hk, mac);
+		return ath_hal_keyset(ah, k->wk_keyix, &hk, mac);
 	}
-	ATH_UNLOCK(sc);
-	return error;
+#undef N
 }
 
 /*
@@ -967,26 +1317,232 @@ static void
 ath_initkeytable(struct ath_softc *sc)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &sc->sc_if;
 	struct ath_hal *ah = sc->sc_ah;
+	const u_int8_t *bssid;
 	int i;
 
+	/* XXX maybe should reset all keys when !PRIVACY */
+	if (ic->ic_state == IEEE80211_S_SCAN)
+		bssid = ifp->if_broadcastaddr;
+	else
+		bssid = ic->ic_bss->ni_bssid;
 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
-		struct ieee80211_wepkey *k = &ic->ic_nw_keys[i];
-		if (k->wk_len == 0)
+		struct ieee80211_key *k = &ic->ic_nw_keys[i];
+
+		if (k->wk_keylen == 0) {
 			ath_hal_keyreset(ah, i);
-		else
-			/* XXX return value */
-			/* NB: this uses HAL_KEYVAL == ieee80211_wepkey */
-			ath_hal_keyset(ah, i, (const HAL_KEYVAL *) k);
+			DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: reset key %u\n",
+				__func__, i);
+		} else {
+			ath_keyset(sc, k, bssid);
+		}
+	}
+}
+
+/*
+ * Allocate tx/rx key slots for TKIP.  We allocate two slots for
+ * each key, one for decrypt/encrypt and the other for the MIC.
+ */
+static u_int16_t
+key_alloc_2pair(struct ath_softc *sc)
+{
+#define	N(a)	(sizeof(a)/sizeof(a[0]))
+	u_int i, keyix;
+
+	KASSERT(sc->sc_splitmic, ("key cache !split"));
+	/* XXX could optimize */
+	for (i = 0; i < N(sc->sc_keymap)/4; i++) {
+		u_int8_t b = sc->sc_keymap[i];
+		if (b != 0xff) {
+			/*
+			 * One or more slots in this byte are free.
+			 */
+			keyix = i*NBBY;
+			while (b & 1) {
+		again:
+				keyix++;
+				b >>= 1;
+			}
+			/* XXX IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV */
+			if (isset(sc->sc_keymap, keyix+32) ||
+			    isset(sc->sc_keymap, keyix+64) ||
+			    isset(sc->sc_keymap, keyix+32+64)) {
+				/* full pair unavailable */
+				/* XXX statistic */
+				if (keyix == (i+1)*NBBY) {
+					/* no slots were appropriate, advance */
+					continue;
+				}
+				goto again;
+			}
+			setbit(sc->sc_keymap, keyix);
+			setbit(sc->sc_keymap, keyix+64);
+			setbit(sc->sc_keymap, keyix+32);
+			setbit(sc->sc_keymap, keyix+32+64);
+			DPRINTF(sc, ATH_DEBUG_KEYCACHE,
+				"%s: key pair %u,%u %u,%u\n",
+				__func__, keyix, keyix+64,
+				keyix+32, keyix+32+64);
+			return keyix;
+		}
+	}
+	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: out of pair space\n", __func__);
+	return IEEE80211_KEYIX_NONE;
+#undef N
+}
+
+/*
+ * Allocate a single key cache slot.
+ */
+static u_int16_t
+key_alloc_single(struct ath_softc *sc)
+{
+#define	N(a)	(sizeof(a)/sizeof(a[0]))
+	u_int i, keyix;
+
+	/* XXX try i,i+32,i+64,i+32+64 to minimize key pair conflicts */
+	for (i = 0; i < N(sc->sc_keymap); i++) {
+		u_int8_t b = sc->sc_keymap[i];
+		if (b != 0xff) {
+			/*
+			 * One or more slots are free.
+			 */
+			keyix = i*NBBY;
+			while (b & 1)
+				keyix++, b >>= 1;
+			setbit(sc->sc_keymap, keyix);
+			DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: key %u\n",
+				__func__, keyix);
+			return keyix;
+		}
+	}
+	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: out of space\n", __func__);
+	return IEEE80211_KEYIX_NONE;
+#undef N
+}
+
+/*
+ * Allocate one or more key cache slots for a uniacst key.  The
+ * key itself is needed only to identify the cipher.  For hardware
+ * TKIP with split cipher+MIC keys we allocate two key cache slot
+ * pairs so that we can setup separate TX and RX MIC keys.  Note
+ * that the MIC key for a TKIP key at slot i is assumed by the
+ * hardware to be at slot i+64.  This limits TKIP keys to the first
+ * 64 entries.
+ */
+static int
+ath_key_alloc(struct ieee80211com *ic, const struct ieee80211_key *k)
+{
+	struct ath_softc *sc = ic->ic_ifp->if_softc;
+
+	/*
+	 * We allocate two pair for TKIP when using the h/w to do
+	 * the MIC.  For everything else, including software crypto,
+	 * we allocate a single entry.  Note that s/w crypto requires
+	 * a pass-through slot on the 5211 and 5212.  The 5210 does
+	 * not support pass-through cache entries and we map all
+	 * those requests to slot 0.
+	 */
+	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
+		return key_alloc_single(sc);
+	} else if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP &&
+	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 && sc->sc_splitmic) {
+		return key_alloc_2pair(sc);
+	} else {
+		return key_alloc_single(sc);
 	}
 }
 
 /*
+ * Delete an entry in the key cache allocated by ath_key_alloc.
+ */
+static int
+ath_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
+{
+	struct ath_softc *sc = ic->ic_ifp->if_softc;
+	struct ath_hal *ah = sc->sc_ah;
+	const struct ieee80211_cipher *cip = k->wk_cipher;
+	u_int keyix = k->wk_keyix;
+
+	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: delete key %u\n", __func__, keyix);
+
+	ath_hal_keyreset(ah, keyix);
+	/*
+	 * Handle split tx/rx keying required for TKIP with h/w MIC.
+	 */
+	if (cip->ic_cipher == IEEE80211_CIPHER_TKIP &&
+	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 && sc->sc_splitmic)
+		ath_hal_keyreset(ah, keyix+32);		/* RX key */
+	if (keyix >= IEEE80211_WEP_NKID) {
+		/*
+		 * Don't touch keymap entries for global keys so
+		 * they are never considered for dynamic allocation.
+		 */
+		clrbit(sc->sc_keymap, keyix);
+		if (cip->ic_cipher == IEEE80211_CIPHER_TKIP &&
+		    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 &&
+		    sc->sc_splitmic) {
+			clrbit(sc->sc_keymap, keyix+64);	/* TX key MIC */
+			clrbit(sc->sc_keymap, keyix+32);	/* RX key */
+			clrbit(sc->sc_keymap, keyix+32+64);	/* RX key MIC */
+		}
+	}
+	return 1;
+}
+
+/*
+ * Set the key cache contents for the specified key.  Key cache
+ * slot(s) must already have been allocated by ath_key_alloc.
+ */
+static int
+ath_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
+	const u_int8_t mac[IEEE80211_ADDR_LEN])
+{
+	struct ath_softc *sc = ic->ic_ifp->if_softc;
+
+	return ath_keyset(sc, k, mac);
+}
+
+/*
+ * Block/unblock tx+rx processing while a key change is done.
+ * We assume the caller serializes key management operations
+ * so we only need to worry about synchronization with other
+ * uses that originate in the driver.
+ */
+static void
+ath_key_update_begin(struct ieee80211com *ic)
+{
+	struct ifnet *ifp = ic->ic_ifp;
+	struct ath_softc *sc = ifp->if_softc;
+
+	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
+#if 0
+	tasklet_disable(&sc->sc_rxtq);
+#endif
+	IF_LOCK(&ifp->if_snd);		/* NB: doesn't block mgmt frames */
+}
+
+static void
+ath_key_update_end(struct ieee80211com *ic)
+{
+	struct ifnet *ifp = ic->ic_ifp;
+	struct ath_softc *sc = ifp->if_softc;
+
+	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
+	IF_UNLOCK(&ifp->if_snd);
+#if 0
+	tasklet_enable(&sc->sc_rxtq);
+#endif
+}
+
+/*
  * Calculate the receive filter according to the
  * operating mode and state:
  *
  * o always accept unicast, broadcast, and multicast traffic
- * o maintain current state of phy error reception
+ * o maintain current state of phy error reception (the hal
+ *   may enable phy error frames for noise immunity work)
  * o probe request frames are accepted only when operating in
  *   hostap, adhoc, or monitor modes
  * o enable promiscuous mode according to the interface state
@@ -998,11 +1554,11 @@ ath_initkeytable(struct ath_softc *sc)
  *   - when scanning
  */
 static u_int32_t
-ath_calcrxfilter(struct ath_softc *sc)
+ath_calcrxfilter(struct ath_softc *sc, enum ieee80211_state state)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ath_hal *ah = sc->sc_ah;
-	struct ifnet *ifp = &ic->ic_if;
+	struct ifnet *ifp = &sc->sc_if;
 	u_int32_t rfilt;
 
 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
@@ -1014,7 +1570,7 @@ ath_calcrxfilter(struct ath_softc *sc)
 		rfilt |= HAL_RX_FILTER_PROM;
 	if (ic->ic_opmode == IEEE80211_M_STA ||
 	    ic->ic_opmode == IEEE80211_M_IBSS ||
-	    ic->ic_state == IEEE80211_S_SCAN)
+	    state == IEEE80211_S_SCAN)
 		rfilt |= HAL_RX_FILTER_BEACON;
 	return rfilt;
 }
@@ -1024,17 +1580,28 @@ ath_mode_init(struct ath_softc *sc)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ath_hal *ah = sc->sc_ah;
-	struct ifnet *ifp = &ic->ic_if;
+	struct ifnet *ifp = &sc->sc_if;
 	u_int32_t rfilt, mfilt[2], val;
 	u_int8_t pos;
 	struct ifmultiaddr *ifma;
 
 	/* configure rx filter */
-	rfilt = ath_calcrxfilter(sc);
+	rfilt = ath_calcrxfilter(sc, ic->ic_state);
 	ath_hal_setrxfilter(ah, rfilt);
 
 	/* configure operational mode */
-	ath_hal_setopmode(ah, ic->ic_opmode);
+	ath_hal_setopmode(ah);
+
+	/*
+	 * Handle any link-level address change.  Note that we only
+	 * need to force ic_myaddr; any other addresses are handled
+	 * as a byproduct of the ifnet code marking the interface
+	 * down then up.
+	 *
+	 * XXX should get from lladdr instead of arpcom but that's more work
+	 */
+	IEEE80211_ADDR_COPY(ic->ic_myaddr, IFP2AC(ifp)->ac_enaddr);
+	ath_hal_setmac(ah, ic->ic_myaddr);
 
 	/* calculate and install multicast filter */
 	if ((ifp->if_flags & IFF_ALLMULTI) == 0) {
@@ -1055,8 +1622,8 @@ ath_mode_init(struct ath_softc *sc)
 		mfilt[0] = mfilt[1] = ~0;
 	}
 	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
-	DPRINTF(ATH_DEBUG_MODE, ("%s: RX filter 0x%x, MC filter %08x:%08x\n",
-		__func__, rfilt, mfilt[0], mfilt[1]));
+	DPRINTF(sc, ATH_DEBUG_MODE, "%s: RX filter 0x%x, MC filter %08x:%08x\n",
+		__func__, rfilt, mfilt[0], mfilt[1]);
 }
 
 static void
@@ -1065,29 +1632,68 @@ ath_mbuf_load_cb(void *arg, bus_dma_segment_t *seg, int nseg, bus_size_t mapsize
 	struct ath_buf *bf = arg;
 
 	KASSERT(nseg <= ATH_MAX_SCATTER,
-		("ath_mbuf_load_cb: too many DMA segments %u", nseg));
+		("%s: too many DMA segments %u", __func__, nseg));
+	KASSERT(error == 0,
+		("%s: error %u on bus_dma callback", __func__, error));
 	bf->bf_mapsize = mapsize;
 	bf->bf_nseg = nseg;
 	bcopy(seg, bf->bf_segs, nseg * sizeof (seg[0]));
 }
 
-static int
-ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
+/*
+ * Set the slot time based on the current setting.
+ */
+static void
+ath_setslottime(struct ath_softc *sc)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
 	struct ath_hal *ah = sc->sc_ah;
-	struct ieee80211_frame *wh;
+
+	if (ic->ic_flags & IEEE80211_F_SHSLOT)
+		ath_hal_setslottime(ah, HAL_SLOT_TIME_9);
+	else
+		ath_hal_setslottime(ah, HAL_SLOT_TIME_20);
+	sc->sc_updateslot = OK;
+}
+
+/*
+ * Callback from the 802.11 layer to update the
+ * slot time based on the current setting.
+ */
+static void
+ath_updateslot(struct ifnet *ifp)
+{
+	struct ath_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
+
+	/*
+	 * When not coordinating the BSS, change the hardware
+	 * immediately.  For other operation we defer the change
+	 * until beacon updates have propagated to the stations.
+	 */
+	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
+		sc->sc_updateslot = UPDATE;
+	else
+		ath_setslottime(sc);
+}
+
+/*
+ * Allocate and setup an initial beacon frame.
+ */
+static int
+ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
+{
+	struct ieee80211com *ic = ni->ni_ic;
 	struct ath_buf *bf;
-	struct ath_desc *ds;
 	struct mbuf *m;
-	int error, pktlen;
-	u_int8_t *frm, rate;
-	u_int16_t capinfo;
-	struct ieee80211_rateset *rs;
-	const HAL_RATE_TABLE *rt;
+	int error;
 
-	bf = sc->sc_bcbuf;
+	bf = STAILQ_FIRST(&sc->sc_bbuf);
+	if (bf == NULL) {
+		DPRINTF(sc, ATH_DEBUG_BEACON, "%s: no dma buffers\n", __func__);
+		sc->sc_stats.ast_be_nombuf++;	/* XXX */
+		return ENOMEM;			/* XXX */
+	}
 	if (bf->bf_m != NULL) {
 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
 		m_freem(bf->bf_m);
@@ -1099,179 +1705,255 @@ ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
 	 * we assume the mbuf routines will return us something
 	 * with this alignment (perhaps should assert).
 	 */
-	rs = &ni->ni_rates;
-	pktlen = sizeof (struct ieee80211_frame)
-	       + 8 + 2 + 2 + 2+ni->ni_esslen + 2+rs->rs_nrates + 3 + 6;
-	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
-		pktlen += 2;
-	if (pktlen <= MHLEN)
-		MGETHDR(m, M_DONTWAIT, MT_DATA);
-	else
-		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
+	m = ieee80211_beacon_alloc(ic, ni, &sc->sc_boff);
 	if (m == NULL) {
-		DPRINTF(ATH_DEBUG_BEACON,
-			("%s: cannot get mbuf/cluster; size %u\n",
-			__func__, pktlen));
+		DPRINTF(sc, ATH_DEBUG_BEACON, "%s: cannot get mbuf\n",
+			__func__);
 		sc->sc_stats.ast_be_nombuf++;
 		return ENOMEM;
 	}
-
-	wh = mtod(m, struct ieee80211_frame *);
-	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
-	    IEEE80211_FC0_SUBTYPE_BEACON;
-	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
-	*(u_int16_t *)wh->i_dur = 0;
-	memcpy(wh->i_addr1, ifp->if_broadcastaddr, IEEE80211_ADDR_LEN);
-	memcpy(wh->i_addr2, ic->ic_myaddr, IEEE80211_ADDR_LEN);
-	memcpy(wh->i_addr3, ni->ni_bssid, IEEE80211_ADDR_LEN);
-	*(u_int16_t *)wh->i_seq = 0;
-
-	/*
-	 * beacon frame format
-	 *	[8] time stamp
-	 *	[2] beacon interval
-	 *	[2] cabability information
-	 *	[tlv] ssid
-	 *	[tlv] supported rates
-	 *	[tlv] parameter set (IBSS)
-	 *	[tlv] extended supported rates
-	 */
-	frm = (u_int8_t *)&wh[1];
-	memset(frm, 0, 8);	/* timestamp is set by hardware */
-	frm += 8;
-	*(u_int16_t *)frm = htole16(ni->ni_intval);
-	frm += 2;
-	if (ic->ic_opmode == IEEE80211_M_IBSS)
-		capinfo = IEEE80211_CAPINFO_IBSS;
-	else
-		capinfo = IEEE80211_CAPINFO_ESS;
-	if (ic->ic_flags & IEEE80211_F_WEPON)
-		capinfo |= IEEE80211_CAPINFO_PRIVACY;
-	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
-	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
-		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
-	if (ic->ic_flags & IEEE80211_F_SHSLOT)
-		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
-	*(u_int16_t *)frm = htole16(capinfo);
-	frm += 2;
-	*frm++ = IEEE80211_ELEMID_SSID;
-	*frm++ = ni->ni_esslen;
-	memcpy(frm, ni->ni_essid, ni->ni_esslen);
-	frm += ni->ni_esslen;
-	frm = ieee80211_add_rates(frm, rs);
-	*frm++ = IEEE80211_ELEMID_DSPARMS;
-	*frm++ = 1;
-	*frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
-	if (ic->ic_opmode == IEEE80211_M_IBSS) {
-		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
-		*frm++ = 2;
-		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
-	} else {
-		/* TODO: TIM */
-		*frm++ = IEEE80211_ELEMID_TIM;
-		*frm++ = 4;	/* length */
-		*frm++ = 0;	/* DTIM count */ 
-		*frm++ = 1;	/* DTIM period */
-		*frm++ = 0;	/* bitmap control */
-		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
-	}
-	frm = ieee80211_add_xrates(frm, rs);
-	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
-	KASSERT(m->m_pkthdr.len <= pktlen,
-		("beacon bigger than expected, len %u calculated %u",
-		m->m_pkthdr.len, pktlen));
-
-	DPRINTF(ATH_DEBUG_BEACON, ("%s: m %p len %u\n", __func__, m, m->m_len));
 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
 				     ath_mbuf_load_cb, bf,
 				     BUS_DMA_NOWAIT);
-	if (error != 0) {
+	if (error == 0) {
+		bf->bf_m = m;
+		bf->bf_node = ni;		/* NB: no held reference */
+	} else {
 		m_freem(m);
-		return error;
 	}
-	KASSERT(bf->bf_nseg == 1,
-		("%s: multi-segment packet; nseg %u", __func__, bf->bf_nseg));
-	bf->bf_m = m;
+	return error;
+}
+
+/*
+ * Setup the beacon frame for transmit.
+ */
+static void
+ath_beacon_setup(struct ath_softc *sc, struct ath_buf *bf)
+{
+#define	USE_SHPREAMBLE(_ic) \
+	(((_ic)->ic_flags & (IEEE80211_F_SHPREAMBLE | IEEE80211_F_USEBARKER))\
+		== IEEE80211_F_SHPREAMBLE)
+	struct ieee80211_node *ni = bf->bf_node;
+	struct ieee80211com *ic = ni->ni_ic;
+	struct mbuf *m = bf->bf_m;
+	struct ath_hal *ah = sc->sc_ah;
+	struct ath_node *an = ATH_NODE(ni);
+	struct ath_desc *ds;
+	int flags, antenna;
+	u_int8_t rate;
+
+	DPRINTF(sc, ATH_DEBUG_BEACON, "%s: m %p len %u\n",
+		__func__, m, m->m_len);
 
 	/* setup descriptors */
 	ds = bf->bf_desc;
 
-	ds->ds_link = 0;
+	flags = HAL_TXDESC_NOACK;
+	if (ic->ic_opmode == IEEE80211_M_IBSS && sc->sc_hasveol) {
+		ds->ds_link = bf->bf_daddr;	/* self-linked */
+		flags |= HAL_TXDESC_VEOL;
+		/*
+		 * Let hardware handle antenna switching.
+		 */
+		antenna = 0;
+	} else {
+		ds->ds_link = 0;
+		/*
+		 * Switch antenna every 4 beacons.
+		 * XXX assumes two antenna
+		 */
+		antenna = (sc->sc_stats.ast_be_xmit & 4 ? 2 : 1);
+	}
+
+	KASSERT(bf->bf_nseg == 1,
+		("multi-segment beacon frame; nseg %u", bf->bf_nseg));
 	ds->ds_data = bf->bf_segs[0].ds_addr;
 	/*
 	 * Calculate rate code.
 	 * XXX everything at min xmit rate
 	 */
-	rt = sc->sc_currates;
-	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
-	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
-		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
+	if (USE_SHPREAMBLE(ic))
+		rate = an->an_tx_mgtratesp;
 	else
-		rate = rt->info[0].rateCode;
+		rate = an->an_tx_mgtrate;
 	ath_hal_setuptxdesc(ah, ds
-		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
-		, sizeof(struct ieee80211_frame)	/* header length */
+		, m->m_len + IEEE80211_CRC_LEN	/* frame length */
+		, sizeof(struct ieee80211_frame)/* header length */
 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
-		, 0x20				/* txpower XXX */
+		, ni->ni_txpower		/* txpower XXX */
 		, rate, 1			/* series 0 rate/tries */
 		, HAL_TXKEYIX_INVALID		/* no encryption */
-		, 0				/* antenna mode */
-		, HAL_TXDESC_NOACK		/* no ack for beacons */
+		, antenna			/* antenna mode */
+		, flags				/* no ack, veol for beacons */
 		, 0				/* rts/cts rate */
 		, 0				/* rts/cts duration */
 	);
 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
-	/* XXX verify mbuf data area covers this roundup */
 	ath_hal_filltxdesc(ah, ds
-		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
-		, AH_TRUE				/* first segment */
-		, AH_TRUE				/* last segment */
+		, roundup(m->m_len, 4)		/* buffer length */
+		, AH_TRUE			/* first segment */
+		, AH_TRUE			/* last segment */
+		, ds				/* first descriptor */
 	);
-
-	return 0;
+#undef USE_SHPREAMBLE
 }
 
+/*
+ * Transmit a beacon frame at SWBA.  Dynamic updates to the
+ * frame contents are done as needed and the slot time is
+ * also adjusted based on current state.
+ */
 static void
 ath_beacon_proc(void *arg, int pending)
 {
 	struct ath_softc *sc = arg;
-	struct ieee80211com *ic = &sc->sc_ic;
-	struct ath_buf *bf = sc->sc_bcbuf;
+	struct ath_buf *bf = STAILQ_FIRST(&sc->sc_bbuf);
+	struct ieee80211_node *ni = bf->bf_node;
+	struct ieee80211com *ic = ni->ni_ic;
 	struct ath_hal *ah = sc->sc_ah;
+	struct mbuf *m;
+	int ncabq, error, otherant;
+
+	DPRINTF(sc, ATH_DEBUG_BEACON_PROC, "%s: pending %u\n",
+		__func__, pending);
 
-	DPRINTF(ATH_DEBUG_BEACON_PROC, ("%s: pending %u\n", __func__, pending));
 	if (ic->ic_opmode == IEEE80211_M_STA ||
+	    ic->ic_opmode == IEEE80211_M_MONITOR ||
 	    bf == NULL || bf->bf_m == NULL) {
-		DPRINTF(ATH_DEBUG_ANY, ("%s: ic_flags=%x bf=%p bf_m=%p\n",
-			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
+		DPRINTF(sc, ATH_DEBUG_ANY, "%s: ic_flags=%x bf=%p bf_m=%p\n",
+			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL);
 		return;
 	}
-	/* TODO: update beacon to reflect PS poll state */
+	/*
+	 * Check if the previous beacon has gone out.  If
+	 * not don't don't try to post another, skip this
+	 * period and wait for the next.  Missed beacons
+	 * indicate a problem and should not occur.  If we
+	 * miss too many consecutive beacons reset the device.
+	 */
+	if (ath_hal_numtxpending(ah, sc->sc_bhalq) != 0) {
+		sc->sc_bmisscount++;
+		DPRINTF(sc, ATH_DEBUG_BEACON_PROC,
+			"%s: missed %u consecutive beacons\n",
+			__func__, sc->sc_bmisscount);
+		if (sc->sc_bmisscount > 3)		/* NB: 3 is a guess */
+			taskqueue_enqueue(taskqueue_swi, &sc->sc_bstucktask);
+		return;
+	}
+	if (sc->sc_bmisscount != 0) {
+		DPRINTF(sc, ATH_DEBUG_BEACON,
+			"%s: resume beacon xmit after %u misses\n",
+			__func__, sc->sc_bmisscount);
+		sc->sc_bmisscount = 0;
+	}
+
+	/*
+	 * Update dynamic beacon contents.  If this returns
+	 * non-zero then we need to remap the memory because
+	 * the beacon frame changed size (probably because
+	 * of the TIM bitmap).
+	 */
+	m = bf->bf_m;
+	ncabq = ath_hal_numtxpending(ah, sc->sc_cabq->axq_qnum);
+	if (ieee80211_beacon_update(ic, bf->bf_node, &sc->sc_boff, m, ncabq)) {
+		/* XXX too conservative? */
+		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
+		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
+					     ath_mbuf_load_cb, bf,
+					     BUS_DMA_NOWAIT);
+		if (error != 0) {
+			if_printf(ic->ic_ifp,
+			    "%s: bus_dmamap_load_mbuf failed, error %u\n",
+			    __func__, error);
+			return;
+		}
+	}
+
+	/*
+	 * Handle slot time change when a non-ERP station joins/leaves
+	 * an 11g network.  The 802.11 layer notifies us via callback,
+	 * we mark updateslot, then wait one beacon before effecting
+	 * the change.  This gives associated stations at least one
+	 * beacon interval to note the state change.
+	 */
+	/* XXX locking */
+	if (sc->sc_updateslot == UPDATE)
+		sc->sc_updateslot = COMMIT;	/* commit next beacon */
+	else if (sc->sc_updateslot == COMMIT)
+		ath_setslottime(sc);		/* commit change to h/w */
+
+	/*
+	 * Check recent per-antenna transmit statistics and flip
+	 * the default antenna if noticeably more frames went out
+	 * on the non-default antenna.
+	 * XXX assumes 2 anntenae
+	 */
+	otherant = sc->sc_defant & 1 ? 2 : 1;
+	if (sc->sc_ant_tx[otherant] > sc->sc_ant_tx[sc->sc_defant] + 2)
+		ath_setdefantenna(sc, otherant);
+	sc->sc_ant_tx[1] = sc->sc_ant_tx[2] = 0;
+
+	/*
+	 * Construct tx descriptor.
+	 */
+	ath_beacon_setup(sc, bf);
+
+	/*
+	 * Stop any current dma and put the new frame on the queue.
+	 * This should never fail since we check above that no frames
+	 * are still pending on the queue.
+	 */
 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
-		DPRINTF(ATH_DEBUG_ANY, ("%s: beacon queue %u did not stop?\n",
-			__func__, sc->sc_bhalq));
-		/* NB: the HAL still stops DMA, so proceed */
+		DPRINTF(sc, ATH_DEBUG_ANY,
+			"%s: beacon queue %u did not stop?\n",
+			__func__, sc->sc_bhalq);
 	}
 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
 
+	/*
+	 * Enable the CAB queue before the beacon queue to
+	 * insure cab frames are triggered by this beacon.
+	 */
+	if (sc->sc_boff.bo_tim[4] & 1)		/* NB: only at DTIM */
+		ath_hal_txstart(ah, sc->sc_cabq->axq_qnum);
 	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
 	ath_hal_txstart(ah, sc->sc_bhalq);
-	DPRINTF(ATH_DEBUG_BEACON_PROC,
-		("%s: TXDP%u = %p (%p)\n", __func__,
-		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
+	DPRINTF(sc, ATH_DEBUG_BEACON_PROC,
+		"%s: TXDP[%u] = %p (%p)\n", __func__,
+		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc);
+
+	sc->sc_stats.ast_be_xmit++;
 }
 
+/*
+ * Reset the hardware after detecting beacons have stopped.
+ */
+static void
+ath_bstuck_proc(void *arg, int pending)
+{
+	struct ath_softc *sc = arg;
+	struct ifnet *ifp = &sc->sc_if;
+
+	if_printf(ifp, "stuck beacon; resetting (bmiss count %u)\n",
+		sc->sc_bmisscount);
+	ath_reset(ifp);
+}
+
+/*
+ * Reclaim beacon resources.
+ */
 static void
 ath_beacon_free(struct ath_softc *sc)
 {
-	struct ath_buf *bf = sc->sc_bcbuf;
+	struct ath_buf *bf;
 
-	if (bf->bf_m != NULL) {
-		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
-		m_freem(bf->bf_m);
-		bf->bf_m = NULL;
-		bf->bf_node = NULL;
-	}
+	STAILQ_FOREACH(bf, &sc->sc_bbuf, bf_list)
+		if (bf->bf_m != NULL) {
+			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
+			m_freem(bf->bf_m);
+			bf->bf_m = NULL;
+			bf->bf_node = NULL;
+		}
 }
 
 /*
@@ -1295,23 +1977,38 @@ ath_beacon_config(struct ath_softc *sc)
 	struct ath_hal *ah = sc->sc_ah;
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ieee80211_node *ni = ic->ic_bss;
-	u_int32_t nexttbtt;
+	u_int32_t nexttbtt, intval;
 
-	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
-	    (LE_READ_4(ni->ni_tstamp) >> 10);
-	DPRINTF(ATH_DEBUG_BEACON, ("%s: nexttbtt=%u\n", __func__, nexttbtt));
+	nexttbtt = (LE_READ_4(ni->ni_tstamp.data + 4) << 22) |
+	    (LE_READ_4(ni->ni_tstamp.data) >> 10);
+	DPRINTF(sc, ATH_DEBUG_BEACON, "%s: nexttbtt %u intval %u\n",
+		__func__, nexttbtt, ni->ni_intval);
 	nexttbtt += ni->ni_intval;
+	intval = ni->ni_intval & HAL_BEACON_PERIOD;
 	if (ic->ic_opmode == IEEE80211_M_STA) {
 		HAL_BEACON_STATE bs;
 		u_int32_t bmisstime;
 
 		/* NB: no PCF support right now */
 		memset(&bs, 0, sizeof(bs));
-		bs.bs_intval = ni->ni_intval;
+		/*
+		 * Reset our tsf so the hardware will update the
+		 * tsf register to reflect timestamps found in
+		 * received beacons.
+		 */
+		bs.bs_intval = intval | HAL_BEACON_RESET_TSF;
 		bs.bs_nexttbtt = nexttbtt;
 		bs.bs_dtimperiod = bs.bs_intval;
 		bs.bs_nextdtim = nexttbtt;
 		/*
+		 * The 802.11 layer records the offset to the DTIM
+		 * bitmap while receiving beacons; use it here to
+		 * enable h/w detection of our AID being marked in
+		 * the bitmap vector (to indicate frames for us are
+		 * pending at the AP).
+		 */
+		bs.bs_timoffset = ni->ni_timoff;
+		/*
 		 * Calculate the number of consecutive beacons to miss
 		 * before taking a BMISS interrupt.  The configuration
 		 * is specified in ms, so we need to convert that to
@@ -1339,8 +2036,8 @@ ath_beacon_config(struct ath_softc *sc)
 		if (bs.bs_sleepduration > bs.bs_dtimperiod)
 			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
 
-		DPRINTF(ATH_DEBUG_BEACON, 
-			("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u\n"
+		DPRINTF(sc, ATH_DEBUG_BEACON, 
+			"%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u cfp:period %u maxdur %u next %u timoffset %u\n"
 			, __func__
 			, bs.bs_intval
 			, bs.bs_nexttbtt
@@ -1348,26 +2045,47 @@ ath_beacon_config(struct ath_softc *sc)
 			, bs.bs_nextdtim
 			, bs.bs_bmissthreshold
 			, bs.bs_sleepduration
-		));
+			, bs.bs_cfpperiod
+			, bs.bs_cfpmaxduration
+			, bs.bs_cfpnext
+			, bs.bs_timoffset
+		);
 		ath_hal_intrset(ah, 0);
-		/*
-		 * Reset our tsf so the hardware will update the
-		 * tsf register to reflect timestamps found in
-		 * received beacons.
-		 */
-		ath_hal_resettsf(ah);
-		ath_hal_beacontimers(ah, &bs, 0/*XXX*/, 0, 0);
+		ath_hal_beacontimers(ah, &bs);
 		sc->sc_imask |= HAL_INT_BMISS;
 		ath_hal_intrset(ah, sc->sc_imask);
 	} else {
-		DPRINTF(ATH_DEBUG_BEACON, ("%s: intval %u nexttbtt %u\n",
-			__func__, ni->ni_intval, nexttbtt));
 		ath_hal_intrset(ah, 0);
-		ath_hal_beaconinit(ah, ic->ic_opmode,
-			nexttbtt, ni->ni_intval);
-		if (ic->ic_opmode != IEEE80211_M_MONITOR)
+		if (nexttbtt == ni->ni_intval)
+			intval |= HAL_BEACON_RESET_TSF;
+		if (ic->ic_opmode == IEEE80211_M_IBSS) {
+			/*
+			 * In IBSS mode enable the beacon timers but only
+			 * enable SWBA interrupts if we need to manually
+			 * prepare beacon frames.  Otherwise we use a
+			 * self-linked tx descriptor and let the hardware
+			 * deal with things.
+			 */
+			intval |= HAL_BEACON_ENA;
+			if (!sc->sc_hasveol)
+				sc->sc_imask |= HAL_INT_SWBA;
+		} else if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
+			/*
+			 * In AP mode we enable the beacon timers and
+			 * SWBA interrupts to prepare beacon frames.
+			 */
+			intval |= HAL_BEACON_ENA;
 			sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
+		}
+		ath_hal_beaconinit(ah, nexttbtt, intval);
+		sc->sc_bmisscount = 0;
 		ath_hal_intrset(ah, sc->sc_imask);
+		/*
+		 * When using a self-linked beacon descriptor in
+		 * ibss mode load it once here.
+		 */
+		if (ic->ic_opmode == IEEE80211_M_IBSS && sc->sc_hasveol)
+			ath_beacon_proc(sc, 0);
 	}
 }
 
@@ -1375,200 +2093,276 @@ static void
 ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 {
 	bus_addr_t *paddr = (bus_addr_t*) arg;
+	KASSERT(error == 0,
+		("%s: error %u on bus_dma callback", __func__, error));
 	*paddr = segs->ds_addr;
 }
 
 static int
-ath_desc_alloc(struct ath_softc *sc)
+ath_descdma_setup(struct ath_softc *sc,
+	struct ath_descdma *dd, ath_bufhead *head,
+	const char *name, int nbuf, int ndesc)
 {
-	int i, bsize, error;
+#define	DS2PHYS(_dd, _ds) \
+	((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
+	struct ifnet *ifp = &sc->sc_if;
 	struct ath_desc *ds;
 	struct ath_buf *bf;
+	int i, bsize, error;
 
-	/* allocate descriptors */
-	sc->sc_desc_len = sizeof(struct ath_desc) *
-				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
-	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &sc->sc_ddmamap);
-	if (error != 0)
+	DPRINTF(sc, ATH_DEBUG_RESET, "%s: %s DMA: %u buffers %u desc/buf\n",
+	    __func__, name, nbuf, ndesc);
+
+	dd->dd_name = name;
+	dd->dd_desc_len = sizeof(struct ath_desc) * nbuf * ndesc;
+
+	/*
+	 * Setup DMA descriptor area.
+	 */
+	error = bus_dma_tag_create(NULL,	/* parent */
+		       PAGE_SIZE, 0,		/* alignment, bounds */
+		       BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
+		       BUS_SPACE_MAXADDR,	/* highaddr */
+		       NULL, NULL,		/* filter, filterarg */
+		       dd->dd_desc_len,		/* maxsize */
+		       1,			/* nsegments */
+		       BUS_SPACE_MAXADDR,	/* maxsegsize */
+		       BUS_DMA_ALLOCNOW,	/* flags */
+		       NULL,			/* lockfunc */
+		       NULL,			/* lockarg */
+		       &dd->dd_dmat);
+	if (error != 0) {
+		if_printf(ifp, "cannot allocate %s DMA tag\n", dd->dd_name);
 		return error;
+	}
 
-	error = bus_dmamem_alloc(sc->sc_dmat, (void**) &sc->sc_desc,
-				 BUS_DMA_NOWAIT, &sc->sc_ddmamap);
-	if (error != 0)
+	/* allocate descriptors */
+	error = bus_dmamap_create(dd->dd_dmat, BUS_DMA_NOWAIT, &dd->dd_dmamap);
+	if (error != 0) {
+		if_printf(ifp, "unable to create dmamap for %s descriptors, "
+			"error %u\n", dd->dd_name, error);
 		goto fail0;
+	}
 
-	error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap,
-				sc->sc_desc, sc->sc_desc_len,
-				ath_load_cb, &sc->sc_desc_paddr,
-				BUS_DMA_NOWAIT);
-	if (error != 0)
+	error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
+				 BUS_DMA_NOWAIT, &dd->dd_dmamap);
+	if (error != 0) {
+		if_printf(ifp, "unable to alloc memory for %u %s descriptors, "
+			"error %u\n", nbuf * ndesc, dd->dd_name, error);
 		goto fail1;
+	}
 
-	ds = sc->sc_desc;
-	DPRINTF(ATH_DEBUG_ANY, ("%s: DMA map: %p (%lu) -> %p (%lu)\n",
-	    __func__, ds, (u_long) sc->sc_desc_len, (caddr_t) sc->sc_desc_paddr,
-	    /*XXX*/ (u_long) sc->sc_desc_len));
-
-	/* allocate buffers */
-	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
-	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
-	if (bf == NULL)
+	error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
+				dd->dd_desc, dd->dd_desc_len,
+				ath_load_cb, &dd->dd_desc_paddr,
+				BUS_DMA_NOWAIT);
+	if (error != 0) {
+		if_printf(ifp, "unable to map %s descriptors, error %u\n",
+			dd->dd_name, error);
 		goto fail2;
-	sc->sc_bufptr = bf;
+	}
 
-	TAILQ_INIT(&sc->sc_rxbuf);
-	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
-		bf->bf_desc = ds;
-		bf->bf_daddr = sc->sc_desc_paddr +
-		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
-		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
-					  &bf->bf_dmamap);
-		if (error != 0)
-			break;
-		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
+	ds = dd->dd_desc;
+	DPRINTF(sc, ATH_DEBUG_RESET, "%s: %s DMA map: %p (%lu) -> %p (%lu)\n",
+	    __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
+	    (caddr_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
+
+	/* allocate rx buffers */
+	bsize = sizeof(struct ath_buf) * nbuf;
+	bf = malloc(bsize, M_ATHDEV, M_NOWAIT | M_ZERO);
+	if (bf == NULL) {
+		if_printf(ifp, "malloc of %s buffers failed, size %u\n",
+			dd->dd_name, bsize);
+		goto fail3;
 	}
+	dd->dd_bufptr = bf;
 
-	TAILQ_INIT(&sc->sc_txbuf);
-	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
+	STAILQ_INIT(head);
+	for (i = 0; i < nbuf; i++, bf++, ds += ndesc) {
 		bf->bf_desc = ds;
-		bf->bf_daddr = sc->sc_desc_paddr +
-		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
+		bf->bf_daddr = DS2PHYS(dd, ds);
 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
-					  &bf->bf_dmamap);
-		if (error != 0)
-			break;
-		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+				&bf->bf_dmamap);
+		if (error != 0) {
+			if_printf(ifp, "unable to create dmamap for %s "
+				"buffer %u, error %u\n", dd->dd_name, i, error);
+			ath_descdma_cleanup(sc, dd, head);
+			return error;
+		}
+		STAILQ_INSERT_TAIL(head, bf, bf_list);
 	}
-	TAILQ_INIT(&sc->sc_txq);
-
-	/* beacon buffer */
-	bf->bf_desc = ds;
-	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
-	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &bf->bf_dmamap);
-	if (error != 0)
-		return error;
-	sc->sc_bcbuf = bf;
 	return 0;
-
+fail3:
+	bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
 fail2:
-	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
+	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
 fail1:
-	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
+	bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
 fail0:
-	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
-	sc->sc_ddmamap = NULL;
+	bus_dma_tag_destroy(dd->dd_dmat);
+	memset(dd, 0, sizeof(*dd));
 	return error;
+#undef DS2PHYS
 }
 
 static void
-ath_desc_free(struct ath_softc *sc)
+ath_descdma_cleanup(struct ath_softc *sc,
+	struct ath_descdma *dd, ath_bufhead *head)
 {
 	struct ath_buf *bf;
+	struct ieee80211_node *ni;
 
-	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
-	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
-	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
+	bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
+	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
+	bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
+	bus_dma_tag_destroy(dd->dd_dmat);
 
-	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
-		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
-		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
-		m_freem(bf->bf_m);
-	}
-	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
-		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
-	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
+	STAILQ_FOREACH(bf, head, bf_list) {
 		if (bf->bf_m) {
-			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
-			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
 			m_freem(bf->bf_m);
 			bf->bf_m = NULL;
 		}
+		if (bf->bf_dmamap != NULL) {
+			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
+			bf->bf_dmamap = NULL;
+		}
+		ni = bf->bf_node;
+		bf->bf_node = NULL;
+		if (ni != NULL) {
+			/*
+			 * Reclaim node reference.
+			 */
+			ieee80211_free_node(ni);
+		}
 	}
-	if (sc->sc_bcbuf != NULL) {
-		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
-		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
-		sc->sc_bcbuf = NULL;
+
+	STAILQ_INIT(head);
+	free(dd->dd_bufptr, M_ATHDEV);
+	memset(dd, 0, sizeof(*dd));
+}
+
+static int
+ath_desc_alloc(struct ath_softc *sc)
+{
+	int error;
+
+	error = ath_descdma_setup(sc, &sc->sc_rxdma, &sc->sc_rxbuf,
+			"rx", ATH_RXBUF, 1);
+	if (error != 0)
+		return error;
+
+	error = ath_descdma_setup(sc, &sc->sc_txdma, &sc->sc_txbuf,
+			"tx", ATH_TXBUF, ATH_TXDESC);
+	if (error != 0) {
+		ath_descdma_cleanup(sc, &sc->sc_rxdma, &sc->sc_rxbuf);
+		return error;
 	}
 
-	TAILQ_INIT(&sc->sc_rxbuf);
-	TAILQ_INIT(&sc->sc_txbuf);
-	TAILQ_INIT(&sc->sc_txq);
-	free(sc->sc_bufptr, M_DEVBUF);
-	sc->sc_bufptr = NULL;
+	error = ath_descdma_setup(sc, &sc->sc_bdma, &sc->sc_bbuf,
+			"beacon", 1, 1);
+	if (error != 0) {
+		ath_descdma_cleanup(sc, &sc->sc_txdma, &sc->sc_txbuf);
+		ath_descdma_cleanup(sc, &sc->sc_rxdma, &sc->sc_rxbuf);
+		return error;
+	}
+	return 0;
+}
+
+static void
+ath_desc_free(struct ath_softc *sc)
+{
+
+	if (sc->sc_bdma.dd_desc_len != 0)
+		ath_descdma_cleanup(sc, &sc->sc_bdma, &sc->sc_bbuf);
+	if (sc->sc_txdma.dd_desc_len != 0)
+		ath_descdma_cleanup(sc, &sc->sc_txdma, &sc->sc_txbuf);
+	if (sc->sc_rxdma.dd_desc_len != 0)
+		ath_descdma_cleanup(sc, &sc->sc_rxdma, &sc->sc_rxbuf);
 }
 
 static struct ieee80211_node *
-ath_node_alloc(struct ieee80211com *ic)
+ath_node_alloc(struct ieee80211_node_table *nt)
 {
-	struct ath_node *an =
-		malloc(sizeof(struct ath_node), M_80211_NODE, M_NOWAIT|M_ZERO);
-	if (an) {
-		int i;
-		for (i = 0; i < ATH_RHIST_SIZE; i++)
-			an->an_rx_hist[i].arh_ticks = ATH_RHIST_NOTIME;
-		an->an_rx_hist_next = ATH_RHIST_SIZE-1;
-		return &an->an_node;
-	} else
+	struct ieee80211com *ic = nt->nt_ic;
+	struct ath_softc *sc = ic->ic_ifp->if_softc;
+	const size_t space = sizeof(struct ath_node) + sc->sc_rc->arc_space;
+	struct ath_node *an;
+
+	an = malloc(space, M_80211_NODE, M_NOWAIT|M_ZERO);
+	if (an == NULL) {
+		/* XXX stat+msg */
 		return NULL;
+	}
+	an->an_avgrssi = ATH_RSSI_DUMMY_MARKER;
+	an->an_halstats.ns_avgbrssi = ATH_RSSI_DUMMY_MARKER;
+	an->an_halstats.ns_avgrssi = ATH_RSSI_DUMMY_MARKER;
+	an->an_halstats.ns_avgtxrssi = ATH_RSSI_DUMMY_MARKER;
+	ath_rate_node_init(sc, an);
+
+	DPRINTF(sc, ATH_DEBUG_NODE, "%s: an %p\n", __func__, an);
+	return &an->an_node;
 }
 
+/*
+ * Clear any references to a node in a transmit queue.
+ * This happens when the node is cleaned so we don't
+ * need to worry about the reference count going to zero;
+ * we just reclaim the reference w/o dropping the txq lock.
+ * Then we null the pointer and the right thing happens
+ * when the buffer is cleaned in ath_tx_processq.
+ */
 static void
-ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
+ath_tx_cleanq(struct ieee80211com *ic, struct ath_txq *txq,
+	struct ieee80211_node *ni)
 {
-        struct ath_softc *sc = ic->ic_if.if_softc;
 	struct ath_buf *bf;
 
-	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
-		if (bf->bf_node == ni)
-			bf->bf_node = NULL;
+	ATH_TXQ_LOCK(txq);
+	STAILQ_FOREACH(bf, &txq->axq_q, bf_list) {
+		if (bf->bf_node == ni) {
+			/* NB: this clears the pointer too */
+			ieee80211_unref_node(&bf->bf_node);
+		}
 	}
-	(*sc->sc_node_free)(ic, ni);
+	ATH_TXQ_UNLOCK(txq);
 }
 
 static void
-ath_node_copy(struct ieee80211com *ic,
-	struct ieee80211_node *dst, const struct ieee80211_node *src)
+ath_node_free(struct ieee80211_node *ni)
 {
-        struct ath_softc *sc = ic->ic_if.if_softc;
+	struct ieee80211com *ic = ni->ni_ic;
+        struct ath_softc *sc = ic->ic_ifp->if_softc;
+	int i;
 
-	memcpy(&dst[1], &src[1],
-		sizeof(struct ath_node) - sizeof(struct ieee80211_node));
-	(*sc->sc_node_copy)(ic, dst, src);
-}
+	DPRINTF(sc, ATH_DEBUG_NODE, "%s: ni %p\n", __func__, ni);
 
+	/* XXX can this happen since refcnt must be zero for us to be called? */
+	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
+		if (ATH_TXQ_SETUP(sc, i))
+			ath_tx_cleanq(ic, &sc->sc_txq[i], ni);
+	ath_rate_node_cleanup(sc, ATH_NODE(ni));
+	sc->sc_node_free(ni);
+}
 
 static u_int8_t
-ath_node_getrssi(struct ieee80211com *ic, struct ieee80211_node *ni)
+ath_node_getrssi(const struct ieee80211_node *ni)
 {
-	struct ath_node *an = ATH_NODE(ni);
-	int i, now, nsamples, rssi;
+#define	HAL_EP_RND(x, mul) \
+	((((x)%(mul)) >= ((mul)/2)) ? ((x) + ((mul) - 1)) / (mul) : (x)/(mul))
+	u_int32_t avgrssi = ATH_NODE_CONST(ni)->an_avgrssi;
+	int32_t rssi;
 
 	/*
-	 * Calculate the average over the last second of sampled data.
-	 */
-	now = ticks;
-	nsamples = 0;
-	rssi = 0;
-	i = an->an_rx_hist_next;
-	do {
-		struct ath_recv_hist *rh = &an->an_rx_hist[i];
-		if (rh->arh_ticks == ATH_RHIST_NOTIME)
-			goto done;
-		if (now - rh->arh_ticks > hz)
-			goto done;
-		rssi += rh->arh_rssi;
-		nsamples++;
-		if (i == 0)
-			i = ATH_RHIST_SIZE-1;
-		else
-			i--;
-	} while (i != an->an_rx_hist_next);
-done:
-	/*
-	 * Return either the average or the last known
-	 * value if there is no recent data.
+	 * When only one frame is received there will be no state in
+	 * avgrssi so fallback on the value recorded by the 802.11 layer.
 	 */
-	return (nsamples ? rssi / nsamples : an->an_rx_hist[i].arh_rssi);
+	if (avgrssi != ATH_RSSI_DUMMY_MARKER)
+		rssi = HAL_EP_RND(avgrssi, HAL_RSSI_EP_MULTIPLIER);
+	else
+		rssi = ni->ni_rssi;
+	/* NB: theoretically we shouldn't need this, but be paranoid */
+	return rssi < 0 ? 0 : rssi > 127 ? 127 : rssi;
+#undef HAL_EP_RND
 }
 
 static int
@@ -1590,27 +2384,28 @@ ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
 		 */
 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
 		if (m == NULL) {
-			DPRINTF(ATH_DEBUG_ANY,
-				("%s: no mbuf/cluster\n", __func__));
+			DPRINTF(sc, ATH_DEBUG_ANY,
+				"%s: no mbuf/cluster\n", __func__);
 			sc->sc_stats.ast_rx_nombuf++;
 			return ENOMEM;
 		}
+		KASSERT(m->m_next == NULL, ("m_next %p (1)", m->m_next));
 		bf->bf_m = m;
 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
 
-		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
+		error = bus_dmamap_load_mbuf(sc->sc_dmat,
+					     bf->bf_dmamap, m,
 					     ath_mbuf_load_cb, bf,
 					     BUS_DMA_NOWAIT);
 		if (error != 0) {
-			DPRINTF(ATH_DEBUG_ANY,
-				("%s: bus_dmamap_load_mbuf failed; error %d\n",
-				__func__, error));
+			DPRINTF(sc, ATH_DEBUG_ANY,
+				"%s: bus_dmamap_load_mbuf failed; error %d\n",
+				__func__, error);
 			sc->sc_stats.ast_rx_busdma++;
 			return error;
 		}
-		KASSERT(bf->bf_nseg == 1,
-			("ath_rxbuf_init: multi-segment packet; nseg %u",
-			bf->bf_nseg));
+		KASSERT(bf->bf_nseg == 1, ("%s: multi-segment packet; nseg %u",
+			__func__, bf->bf_nseg));
 	}
 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREREAD);
 
@@ -1618,7 +2413,7 @@ ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
 	 * Setup descriptors.  For receive we always terminate
 	 * the descriptor list with a self-linked entry so we'll
 	 * not get overrun under high load (as can happen with a
-	 * 5212 when ANI processing enables PHY errors).
+	 * 5212 when ANI processing enables PHY error frames).
 	 *
 	 * To insure the last descriptor is self-linked we create
 	 * each descriptor as self-linked and add it to the end.  As
@@ -1643,34 +2438,91 @@ ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
 	return 0;
 }
 
+/*
+ * Intercept management frames to collect beacon rssi data
+ * and to do ibss merges.
+ */
+static void
+ath_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
+	struct ieee80211_node *ni,
+	int subtype, int rssi, u_int32_t rstamp)
+{
+	struct ath_softc *sc = ic->ic_ifp->if_softc;
+
+	/*
+	 * Call up first so subsequent work can use information
+	 * potentially stored in the node (e.g. for ibss merge).
+	 */
+	sc->sc_recv_mgmt(ic, m, ni, subtype, rssi, rstamp);
+	switch (subtype) {
+	case IEEE80211_FC0_SUBTYPE_BEACON:
+		/* update rssi statistics for use by the hal */
+		ATH_RSSI_LPF(ATH_NODE(ni)->an_halstats.ns_avgbrssi, rssi);
+		/* fall thru... */
+	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
+		if (ic->ic_opmode == IEEE80211_M_IBSS &&
+		    ic->ic_state == IEEE80211_S_RUN) {
+			struct ath_hal *ah = sc->sc_ah;
+			/* XXX extend rstamp */
+			u_int64_t tsf = ath_hal_gettsf64(ah);
+
+			/*
+			 * Handle ibss merge as needed; check the tsf on the
+			 * frame before attempting the merge.  The 802.11 spec
+			 * says the station should change it's bssid to match
+			 * the oldest station with the same ssid, where oldest
+			 * is determined by the tsf.
+			 */
+			if (le64toh(ni->ni_tstamp.tsf) >= tsf &&
+			    ieee80211_ibss_merge(ic, ni))
+				ath_hal_setassocid(ah, ic->ic_bss->ni_bssid, 0);
+		}
+		break;
+	}
+}
+
+/*
+ * Set the default antenna.
+ */
+static void
+ath_setdefantenna(struct ath_softc *sc, u_int antenna)
+{
+	struct ath_hal *ah = sc->sc_ah;
+
+	/* XXX block beacon interrupts */
+	ath_hal_setdefantenna(ah, antenna);
+	if (sc->sc_defant != antenna)
+		sc->sc_stats.ast_ant_defswitch++;
+	sc->sc_defant = antenna;
+	sc->sc_rxotherant = 0;
+}
+
 static void
 ath_rx_proc(void *arg, int npending)
 {
 #define	PA2DESC(_sc, _pa) \
-	((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
-		((_pa) - (_sc)->sc_desc_paddr)))
+	((struct ath_desc *)((caddr_t)(_sc)->sc_rxdma.dd_desc + \
+		((_pa) - (_sc)->sc_rxdma.dd_desc_paddr)))
 	struct ath_softc *sc = arg;
 	struct ath_buf *bf;
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
+	struct ifnet *ifp = &sc->sc_if;
 	struct ath_hal *ah = sc->sc_ah;
 	struct ath_desc *ds;
 	struct mbuf *m;
-	struct ieee80211_frame *wh, whbuf;
 	struct ieee80211_node *ni;
 	struct ath_node *an;
-	struct ath_recv_hist *rh;
 	int len;
 	u_int phyerr;
 	HAL_STATUS status;
 
 	NET_LOCK_GIANT();		/* XXX */
 
-	DPRINTF(ATH_DEBUG_RX_PROC, ("%s: pending %u\n", __func__, npending));
+	DPRINTF(sc, ATH_DEBUG_RX_PROC, "%s: pending %u\n", __func__, npending);
 	do {
-		bf = TAILQ_FIRST(&sc->sc_rxbuf);
+		bf = STAILQ_FIRST(&sc->sc_rxbuf);
 		if (bf == NULL) {		/* NB: shouldn't happen */
-			if_printf(ifp, "ath_rx_proc: no buffer!\n");
+			if_printf(ifp, "%s: no buffer!\n", __func__);
 			break;
 		}
 		ds = bf->bf_desc;
@@ -1680,7 +2532,7 @@ ath_rx_proc(void *arg, int npending)
 		}
 		m = bf->bf_m;
 		if (m == NULL) {		/* NB: shouldn't happen */
-			if_printf(ifp, "ath_rx_proc: no mbuf!\n");
+			if_printf(ifp, "%s: no mbuf!\n", __func__);
 			continue;
 		}
 		/* XXX sync descriptor memory */
@@ -1698,53 +2550,112 @@ ath_rx_proc(void *arg, int npending)
 		status = ath_hal_rxprocdesc(ah, ds,
 				bf->bf_daddr, PA2DESC(sc, ds->ds_link));
 #ifdef AR_DEBUG
-		if (ath_debug & ATH_DEBUG_RECV_DESC)
+		if (sc->sc_debug & ATH_DEBUG_RECV_DESC)
 			ath_printrxbuf(bf, status == HAL_OK); 
 #endif
 		if (status == HAL_EINPROGRESS)
 			break;
-		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
-		if (ds->ds_rxstat.rs_status != 0) {
+		STAILQ_REMOVE_HEAD(&sc->sc_rxbuf, bf_list);
+		if (ds->ds_rxstat.rs_more) {
+			/*
+			 * Frame spans multiple descriptors; this
+			 * cannot happen yet as we don't support
+			 * jumbograms.  If not in monitor mode,
+			 * discard the frame.
+			 */
+			if (ic->ic_opmode != IEEE80211_M_MONITOR) {
+				sc->sc_stats.ast_rx_toobig++;
+				goto rx_next;
+			}
+			/* fall thru for monitor mode handling... */
+		} else if (ds->ds_rxstat.rs_status != 0) {
 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
 				sc->sc_stats.ast_rx_crcerr++;
 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
 				sc->sc_stats.ast_rx_fifoerr++;
-			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
-				sc->sc_stats.ast_rx_badcrypt++;
 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
 				sc->sc_stats.ast_rx_phyerr++;
 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
 				sc->sc_stats.ast_rx_phy[phyerr]++;
-			} else {
+				goto rx_next;
+			}
+			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT) {
 				/*
-				 * NB: don't count PHY errors as input errors;
-				 * we enable them on the 5212 to collect info
-				 * about environmental noise and, in that
-				 * setting, they don't really reflect tx/rx
-				 * errors.
+				 * Decrypt error.  If the error occurred
+				 * because there was no hardware key, then
+				 * let the frame through so the upper layers
+				 * can process it.  This is necessary for 5210
+				 * parts which have no way to setup a ``clear''
+				 * key cache entry.
+				 *
+				 * XXX do key cache faulting
 				 */
-				ifp->if_ierrors++;
+				if (ds->ds_rxstat.rs_keyix == HAL_RXKEYIX_INVALID)
+					goto rx_accept;
+				sc->sc_stats.ast_rx_badcrypt++;
 			}
-			goto rx_next;
-		}
-
-		len = ds->ds_rxstat.rs_datalen;
-		if (len < IEEE80211_MIN_LEN) {
-			DPRINTF(ATH_DEBUG_RECV, ("%s: short packet %d\n",
-				__func__, len));
-			sc->sc_stats.ast_rx_tooshort++;
-			goto rx_next;
+			if (ds->ds_rxstat.rs_status & HAL_RXERR_MIC) {
+				sc->sc_stats.ast_rx_badmic++;
+				/*
+				 * Do minimal work required to hand off
+				 * the 802.11 header for notifcation.
+				 */
+				/* XXX frag's and qos frames */
+				len = ds->ds_rxstat.rs_datalen;
+				if (len >= sizeof (struct ieee80211_frame)) {
+					bus_dmamap_sync(sc->sc_dmat,
+					    bf->bf_dmamap,
+					    BUS_DMASYNC_POSTREAD);
+					ieee80211_notify_michael_failure(ic,
+					    mtod(m, struct ieee80211_frame *),
+					    ds->ds_rxstat.rs_keyix);
+				}
+			}
+			ifp->if_ierrors++;
+			/*
+			 * Reject error frames, we normally don't want
+			 * to see them in monitor mode (in monitor mode
+			 * allow through packets that have crypto problems).
+			 */
+			if ((ds->ds_rxstat.rs_status &~
+				(HAL_RXERR_DECRYPT|HAL_RXERR_MIC)) ||
+			    sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
+				goto rx_next;
 		}
-
-		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 
+rx_accept:
+		KASSERT(m->m_next == NULL, ("m_next %p (3)", m->m_next));
+		/*
+		 * Sync and unmap the frame.  At this point we're
+		 * committed to passing the mbuf somewhere so clear
+		 * bf_m; this means a new sk_buff must be allocated
+		 * when the rx descriptor is setup again to receive
+		 * another frame.
+		 */
+		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
 		    BUS_DMASYNC_POSTREAD);
-
 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
 		bf->bf_m = NULL;
+
 		m->m_pkthdr.rcvif = ifp;
+		len = ds->ds_rxstat.rs_datalen;
 		m->m_pkthdr.len = m->m_len = len;
 
+		if (sc->sc_softled)
+			ath_update_led(sc);
+		sc->sc_stats.ast_ant_rx[ds->ds_rxstat.rs_antenna]++;
+
 		if (sc->sc_drvbpf) {
+			/*
+			 * Discard anything shorter than an ack or cts.
+			 */
+			if (len < IEEE80211_ACK_LEN) {
+				DPRINTF(sc, ATH_DEBUG_RECV,
+					"%s: runt packet %d\n",
+					__func__, len);
+				sc->sc_stats.ast_rx_tooshort++;
+				m_freem(m);
+				goto rx_next;
+			}
 			sc->sc_rx_th.wr_rate =
 				sc->sc_hwmap[ds->ds_rxstat.rs_rate];
 			sc->sc_rx_th.wr_antsignal = ds->ds_rxstat.rs_rssi;
@@ -1755,79 +2666,233 @@ ath_rx_proc(void *arg, int npending)
 				&sc->sc_rx_th, sc->sc_rx_th_len, m);
 		}
 
-		m_adj(m, -IEEE80211_CRC_LEN);
-		wh = mtod(m, struct ieee80211_frame *);
-		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
-			/*
-			 * WEP is decrypted by hardware. Clear WEP bit
-			 * and trim WEP header for ieee80211_input().
-			 */
-			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
-			memcpy(&whbuf, wh, sizeof(whbuf));
-			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
-			wh = mtod(m, struct ieee80211_frame *);
-			memcpy(wh, &whbuf, sizeof(whbuf));
-			/*
-			 * Also trim WEP ICV from the tail.
-			 */
-			m_adj(m, -IEEE80211_WEP_CRCLEN);
+		/*
+		 * From this point on we assume the frame is at least
+		 * as large as ieee80211_frame_min; verify that.
+		 */
+		if (len < IEEE80211_MIN_LEN) {
+			DPRINTF(sc, ATH_DEBUG_RECV, "%s: short packet %d\n",
+				__func__, len);
+			sc->sc_stats.ast_rx_tooshort++;
+			m_freem(m);
+			goto rx_next;
+		}
+
+		if (IFF_DUMPPKTS(sc, ATH_DEBUG_RECV)) {
+			ieee80211_dump_pkt(mtod(m, caddr_t), len,
+				   sc->sc_hwmap[ds->ds_rxstat.rs_rate],
+				   ds->ds_rxstat.rs_rssi);
 		}
 
+		m_adj(m, -IEEE80211_CRC_LEN);
+
 		/*
-		 * Locate the node for sender, track state, and
-		 * then pass this node (referenced) up to the 802.11
-		 * layer for its use.  We are required to pass
-		 * something so we fall back to ic_bss when this frame
-		 * is from an unknown sender.
+		 * Locate the node for sender, track state, and then
+		 * pass the (referenced) node up to the 802.11 layer
+		 * for its use.
 		 */
-		if (ic->ic_opmode != IEEE80211_M_STA) {
-			ni = ieee80211_find_node(ic, wh->i_addr2);
-			if (ni == NULL)
-				ni = ieee80211_ref_node(ic->ic_bss);
-		} else
-			ni = ieee80211_ref_node(ic->ic_bss);
+		ni = ieee80211_find_rxnode(ic,
+			mtod(m, const struct ieee80211_frame_min *));
 
 		/*
-		 * Record driver-specific state.
+		 * Track rx rssi and do any rx antenna management.
 		 */
 		an = ATH_NODE(ni);
-		if (++(an->an_rx_hist_next) == ATH_RHIST_SIZE)
-			an->an_rx_hist_next = 0;
-		rh = &an->an_rx_hist[an->an_rx_hist_next];
-		rh->arh_ticks = ticks;
-		rh->arh_rssi = ds->ds_rxstat.rs_rssi;
-		rh->arh_antenna = ds->ds_rxstat.rs_antenna;
+		ATH_RSSI_LPF(an->an_avgrssi, ds->ds_rxstat.rs_rssi);
+		if (sc->sc_diversity) {
+			/*
+			 * When using fast diversity, change the default rx
+			 * antenna if diversity chooses the other antenna 3
+			 * times in a row.
+			 */
+			if (sc->sc_defant != ds->ds_rxstat.rs_antenna) {
+				if (++sc->sc_rxotherant >= 3)
+					ath_setdefantenna(sc,
+						ds->ds_rxstat.rs_antenna);
+			} else
+				sc->sc_rxotherant = 0;
+		}
 
 		/*
 		 * Send frame up for processing.
 		 */
-		ieee80211_input(ifp, m, ni,
+		ieee80211_input(ic, m, ni,
 			ds->ds_rxstat.rs_rssi, ds->ds_rxstat.rs_tstamp);
 
 		/*
-		 * The frame may have caused the node to be marked for
-		 * reclamation (e.g. in response to a DEAUTH message)
-		 * so use free_node here instead of unref_node.
+		 * Reclaim node reference.
 		 */
-		if (ni == ic->ic_bss)
-			ieee80211_unref_node(&ni);
-		else
-			ieee80211_free_node(ic, ni);
-  rx_next:
-		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
+		ieee80211_free_node(ni);
+rx_next:
+		STAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
 	} while (ath_rxbuf_init(sc, bf) == 0);
 
-	ath_hal_rxmonitor(ah);			/* rx signal state monitoring */
-	ath_hal_rxena(ah);			/* in case of RXEOL */
+	/* rx signal state monitoring */
+	ath_hal_rxmonitor(ah, &ATH_NODE(ic->ic_bss)->an_halstats);
 
 	NET_UNLOCK_GIANT();		/* XXX */
 #undef PA2DESC
 }
 
 /*
- * XXX Size of an ACK control frame in bytes.
+ * Setup a h/w transmit queue.
  */
-#define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
+static struct ath_txq *
+ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
+{
+#define	N(a)	(sizeof(a)/sizeof(a[0]))
+	struct ath_hal *ah = sc->sc_ah;
+	HAL_TXQ_INFO qi;
+	int qnum;
+
+	memset(&qi, 0, sizeof(qi));
+	qi.tqi_subtype = subtype;
+	qi.tqi_aifs = HAL_TXQ_USEDEFAULT;
+	qi.tqi_cwmin = HAL_TXQ_USEDEFAULT;
+	qi.tqi_cwmax = HAL_TXQ_USEDEFAULT;
+	/*
+	 * Enable interrupts only for EOL and DESC conditions.
+	 * We mark tx descriptors to receive a DESC interrupt
+	 * when a tx queue gets deep; otherwise waiting for the
+	 * EOL to reap descriptors.  Note that this is done to
+	 * reduce interrupt load and this only defers reaping
+	 * descriptors, never transmitting frames.  Aside from
+	 * reducing interrupts this also permits more concurrency.
+	 * The only potential downside is if the tx queue backs
+	 * up in which case the top half of the kernel may backup
+	 * due to a lack of tx descriptors.
+	 */
+	qi.tqi_qflags = TXQ_FLAG_TXEOLINT_ENABLE | TXQ_FLAG_TXDESCINT_ENABLE;
+	qnum = ath_hal_setuptxqueue(ah, qtype, &qi);
+	if (qnum == -1) {
+		/*
+		 * NB: don't print a message, this happens 
+		 * ormally on parts with too few tx queues
+		 */
+		return NULL;
+	}
+	if (qnum >= N(sc->sc_txq)) {
+		device_printf(sc->sc_dev, "hal qnum %u out of range, max %u!\n",
+			qnum, N(sc->sc_txq));
+		ath_hal_releasetxqueue(ah, qnum);
+		return NULL;
+	}
+	if (!ATH_TXQ_SETUP(sc, qnum)) {
+		struct ath_txq *txq = &sc->sc_txq[qnum];
+
+		txq->axq_qnum = qnum;
+		txq->axq_depth = 0;
+		txq->axq_intrcnt = 0;
+		txq->axq_link = NULL;
+		STAILQ_INIT(&txq->axq_q);
+		ATH_TXQ_LOCK_INIT(sc, txq);
+		sc->sc_txqsetup |= 1<<qnum;
+	}
+	return &sc->sc_txq[qnum];
+#undef N
+}
+
+/*
+ * Setup a hardware data transmit queue for the specified
+ * access control.  The hal may not support all requested
+ * queues in which case it will return a reference to a
+ * previously setup queue.  We record the mapping from ac's
+ * to h/w queues for use by ath_tx_start and also track
+ * the set of h/w queues being used to optimize work in the
+ * transmit interrupt handler and related routines.
+ */
+static int
+ath_tx_setup(struct ath_softc *sc, int ac, int haltype)
+{
+#define	N(a)	(sizeof(a)/sizeof(a[0]))
+	struct ath_txq *txq;
+
+	if (ac >= N(sc->sc_ac2q)) {
+		device_printf(sc->sc_dev, "AC %u out of range, max %u!\n",
+			ac, N(sc->sc_ac2q));
+		return 0;
+	}
+	txq = ath_txq_setup(sc, HAL_TX_QUEUE_DATA, haltype);
+	if (txq != NULL) {
+		sc->sc_ac2q[ac] = txq;
+		return 1;
+	} else
+		return 0;
+#undef N
+}
+
+/*
+ * Update WME parameters for a transmit queue.
+ */
+static int
+ath_txq_update(struct ath_softc *sc, int ac)
+{
+#define	ATH_EXPONENT_TO_VALUE(v)	((1<<v)-1)
+#define	ATH_TXOP_TO_US(v)		(v<<5)
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ath_txq *txq = sc->sc_ac2q[ac];
+	struct wmeParams *wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[ac];
+	struct ath_hal *ah = sc->sc_ah;
+	HAL_TXQ_INFO qi;
+
+	ath_hal_gettxqueueprops(ah, txq->axq_qnum, &qi);
+	qi.tqi_aifs = wmep->wmep_aifsn;
+	qi.tqi_cwmin = ATH_EXPONENT_TO_VALUE(wmep->wmep_logcwmin);
+	qi.tqi_cwmax = ATH_EXPONENT_TO_VALUE(wmep->wmep_logcwmax);	
+	qi.tqi_burstTime = ATH_TXOP_TO_US(wmep->wmep_txopLimit);
+
+	if (!ath_hal_settxqueueprops(ah, txq->axq_qnum, &qi)) {
+		device_printf(sc->sc_dev, "unable to update hardware queue "
+			"parameters for %s traffic!\n",
+			ieee80211_wme_acnames[ac]);
+		return 0;
+	} else {
+		ath_hal_resettxqueue(ah, txq->axq_qnum); /* push to h/w */
+		return 1;
+	}
+#undef ATH_TXOP_TO_US
+#undef ATH_EXPONENT_TO_VALUE
+}
+
+/*
+ * Callback from the 802.11 layer to update WME parameters.
+ */
+static int 
+ath_wme_update(struct ieee80211com *ic)
+{
+	struct ath_softc *sc = ic->ic_ifp->if_softc;
+
+	return !ath_txq_update(sc, WME_AC_BE) ||
+	    !ath_txq_update(sc, WME_AC_BK) ||
+	    !ath_txq_update(sc, WME_AC_VI) ||
+	    !ath_txq_update(sc, WME_AC_VO) ? EIO : 0;
+}
+
+/*
+ * Reclaim resources for a setup queue.
+ */
+static void
+ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq)
+{
+
+	ath_hal_releasetxqueue(sc->sc_ah, txq->axq_qnum);
+	ATH_TXQ_LOCK_DESTROY(txq);
+	sc->sc_txqsetup &= ~(1<<txq->axq_qnum);
+}
+
+/*
+ * Reclaim all tx queue resources.
+ */
+static void
+ath_tx_cleanup(struct ath_softc *sc)
+{
+	int i;
+
+	ATH_TXBUF_LOCK_DESTROY(sc);
+	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
+		if (ATH_TXQ_SETUP(sc, i))
+			ath_tx_cleanupq(sc, &sc->sc_txq[i]);
+}
 
 static int
 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
@@ -1835,17 +2900,15 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf
 {
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ath_hal *ah = sc->sc_ah;
-	struct ifnet *ifp = &sc->sc_ic.ic_if;
-	int i, error, iswep, hdrlen, pktlen;
-	u_int8_t rix, cix, txrate, ctsrate;
-	struct ath_desc *ds;
+	struct ifnet *ifp = &sc->sc_if;
+	int i, error, iswep, ismcast, keyix, hdrlen, pktlen, try0;
+	u_int8_t rix, txrate, ctsrate;
+	u_int8_t cix = 0xff;		/* NB: silence compiler */
+	struct ath_desc *ds, *ds0;
+	struct ath_txq *txq;
 	struct mbuf *m;
 	struct ieee80211_frame *wh;
-	u_int32_t iv;
-	u_int8_t *ivp;
-	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
-	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
-	u_int subtype, flags, ctsduration, antenna;
+	u_int subtype, flags, ctsduration;
 	HAL_PKT_TYPE atype;
 	const HAL_RATE_TABLE *rt;
 	HAL_BOOL shortPreamble;
@@ -1853,48 +2916,53 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf
 
 	wh = mtod(m0, struct ieee80211_frame *);
 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
-	hdrlen = sizeof(struct ieee80211_frame);
-	pktlen = m0->m_pkthdr.len;
+	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
+	hdrlen = ieee80211_anyhdrsize(wh);
+	/*
+	 * Packet length must not include by any
+	 * pad bytes; deduct it here.
+	 */
+	pktlen = m0->m_pkthdr.len - (hdrlen & 3);
 
 	if (iswep) {
-		memcpy(hdrbuf, mtod(m0, caddr_t), hdrlen);
-		m_adj(m0, hdrlen);
-		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
-		if (m0 == NULL) {
-			sc->sc_stats.ast_tx_nombuf++;
-			return ENOMEM;
-		}
-		ivp = hdrbuf + hdrlen;
-		wh = mtod(m0, struct ieee80211_frame *);
-		/*
-		 * XXX
-		 * IV must not duplicate during the lifetime of the key.
-		 * But no mechanism to renew keys is defined in IEEE 802.11
-		 * WEP.  And IV may be duplicated between other stations
-		 * because of the session key itself is shared.
-		 * So we use pseudo random IV for now, though it is not the
-		 * right way.
-		 */
-                iv = ic->ic_iv;
+		const struct ieee80211_cipher *cip;
+		struct ieee80211_key *k;
+
 		/*
-		 * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
-		 * (B, 255, N) with 3 <= B < 8
+		 * Construct the 802.11 header+trailer for an encrypted
+		 * frame. The only reason this can fail is because of an
+		 * unknown or unsupported cipher/key type.
 		 */
-		if (iv >= 0x03ff00 && (iv & 0xf8ff00) == 0x00ff00)
-			iv += 0x000100;
-		ic->ic_iv = iv + 1;
-		for (i = 0; i < IEEE80211_WEP_IVLEN; i++) {
-			ivp[i] = iv;
-			iv >>= 8;
+		k = ieee80211_crypto_encap(ic, ni, m0);
+		if (k == NULL) {
+			/*
+			 * This can happen when the key is yanked after the
+			 * frame was queued.  Just discard the frame; the
+			 * 802.11 layer counts failures and provides
+			 * debugging/diagnostics.
+			 */
+			return EIO;
 		}
-		ivp[i] = sc->sc_ic.ic_wep_txkey << 6;	/* Key ID and pad */
-		memcpy(mtod(m0, caddr_t), hdrbuf, sizeof(hdrbuf));
 		/*
-		 * The ICV length must be included into hdrlen and pktlen.
+		 * Adjust the packet + header lengths for the crypto
+		 * additions and calculate the h/w key index.  When
+		 * a s/w mic is done the frame will have had any mic
+		 * added to it prior to entry so skb->len above will
+		 * account for it. Otherwise we need to add it to the
+		 * packet length.
 		 */
-		hdrlen = sizeof(hdrbuf) + IEEE80211_WEP_CRCLEN;
-		pktlen = m0->m_pkthdr.len + IEEE80211_WEP_CRCLEN;
-	}
+		cip = k->wk_cipher;
+		hdrlen += cip->ic_header;
+		pktlen += cip->ic_header + cip->ic_trailer;
+		if ((k->wk_flags & IEEE80211_KEY_SWMIC) == 0)
+			pktlen += cip->ic_miclen;
+		keyix = k->wk_keyix;
+
+		/* packet header may have moved, reset our local pointer */
+		wh = mtod(m0, struct ieee80211_frame *);
+	} else
+		keyix = HAL_TXKEYIX_INVALID;
+
 	pktlen += IEEE80211_CRC_LEN;
 
 	/*
@@ -1953,7 +3021,7 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf
 		m_freem(m0);
 		return EIO;
 	}
-	DPRINTF(ATH_DEBUG_XMIT, ("%s: m %p len %u\n", __func__, m0, pktlen));
+	DPRINTF(sc, ATH_DEBUG_XMIT, "%s: m %p len %u\n", __func__, m0, pktlen);
 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
 	bf->bf_m = m0;
 	bf->bf_node = ni;			/* NB: held reference */
@@ -1964,10 +3032,24 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf
 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
 
 	/*
-	 * Calculate Atheros packet type from IEEE80211 packet header
-	 * and setup for rate calculations.
+	 * NB: the 802.11 layer marks whether or not we should
+	 * use short preamble based on the current mode and
+	 * negotiated parameters.
+	 */
+	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
+	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
+		shortPreamble = AH_TRUE;
+		sc->sc_stats.ast_tx_shortpre++;
+	} else {
+		shortPreamble = AH_FALSE;
+	}
+
+	an = ATH_NODE(ni);
+	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for crypto errs */
+	/*
+	 * Calculate Atheros packet type from IEEE80211 packet header,
+	 * setup for rate calculations, and select h/w transmit queue.
 	 */
-	atype = HAL_PKT_TYPE_NORMAL;			/* default */
 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
 	case IEEE80211_FC0_TYPE_MGT:
 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
@@ -1977,54 +3059,104 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf
 			atype = HAL_PKT_TYPE_PROBE_RESP;
 		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
 			atype = HAL_PKT_TYPE_ATIM;
+		else
+			atype = HAL_PKT_TYPE_NORMAL;	/* XXX */
 		rix = 0;			/* XXX lowest rate */
+		try0 = ATH_TXMAXTRY;
+		if (shortPreamble)
+			txrate = an->an_tx_mgtratesp;
+		else
+			txrate = an->an_tx_mgtrate;
+		/* NB: force all management frames to highest queue */
+		if (ni->ni_flags & IEEE80211_NODE_QOS) {
+			/* NB: force all management frames to highest queue */
+			txq = sc->sc_ac2q[WME_AC_VO];
+		} else
+			txq = sc->sc_ac2q[WME_AC_BE];
+		flags |= HAL_TXDESC_INTREQ;	/* force interrupt */
 		break;
 	case IEEE80211_FC0_TYPE_CTL:
-		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
-		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
-			atype = HAL_PKT_TYPE_PSPOLL;
+		atype = HAL_PKT_TYPE_PSPOLL;	/* stop setting of duration */
 		rix = 0;			/* XXX lowest rate */
+		try0 = ATH_TXMAXTRY;
+		if (shortPreamble)
+			txrate = an->an_tx_mgtratesp;
+		else
+			txrate = an->an_tx_mgtrate;
+		/* NB: force all ctl frames to highest queue */
+		if (ni->ni_flags & IEEE80211_NODE_QOS) {
+			/* NB: force all ctl frames to highest queue */
+			txq = sc->sc_ac2q[WME_AC_VO];
+		} else
+			txq = sc->sc_ac2q[WME_AC_BE];
+		flags |= HAL_TXDESC_INTREQ;	/* force interrupt */
 		break;
-	default:
-		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
-				IEEE80211_RATE_VAL];
-		if (rix == 0xff) {
-			if_printf(ifp, "bogus xmit rate 0x%x\n",
-				ni->ni_rates.rs_rates[ni->ni_txrate]);
-			sc->sc_stats.ast_tx_badrate++;
-			m_freem(m0);
-			return EIO;
-		}
+	case IEEE80211_FC0_TYPE_DATA:
+		atype = HAL_PKT_TYPE_NORMAL;		/* default */
+		/*
+		 * Data frames; consult the rate control module.
+		 */
+		ath_rate_findrate(sc, an, shortPreamble, pktlen,
+			&rix, &try0, &txrate);
+		/*
+		 * Default all non-QoS traffic to the background queue.
+		 */
+		if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
+			u_int pri = M_WME_GETAC(m0);
+			txq = sc->sc_ac2q[pri];
+			if (ic->ic_wme.wme_wmeChanParams.cap_wmeParams[pri].wmep_noackPolicy)
+				 flags |= HAL_TXDESC_NOACK;
+		} else
+			txq = sc->sc_ac2q[WME_AC_BE];
 		break;
+	default:
+		if_printf(ifp, "bogus frame type 0x%x (%s)\n",
+			wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
+		/* XXX statistic */
+		m_freem(m0);
+		return EIO;
 	}
+
 	/*
-	 * NB: the 802.11 layer marks whether or not we should
-	 * use short preamble based on the current mode and
-	 * negotiated parameters.
+	 * When servicing one or more stations in power-save mode
+	 * multicast frames must be buffered until after the beacon.
+	 * We use the CAB queue for that.
 	 */
-	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
-	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
-		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
-		shortPreamble = AH_TRUE;
-		sc->sc_stats.ast_tx_shortpre++;
-	} else {
-		txrate = rt->info[rix].rateCode;
-		shortPreamble = AH_FALSE;
+	if (ismcast && ic->ic_ps_sta) {
+		txq = sc->sc_cabq;
+		/* XXX? more bit in 802.11 frame header */
 	}
 
 	/*
 	 * Calculate miscellaneous flags.
 	 */
-	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
-	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
+	if (ismcast) {
 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
 		sc->sc_stats.ast_tx_noack++;
 	} else if (pktlen > ic->ic_rtsthreshold) {
 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
+		cix = rt->info[rix].controlRate;
 		sc->sc_stats.ast_tx_rts++;
 	}
 
 	/*
+	 * If 802.11g protection is enabled, determine whether
+	 * to use RTS/CTS or just CTS.  Note that this is only
+	 * done for OFDM unicast frames.
+	 */
+	if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
+	    rt->info[rix].phy == IEEE80211_T_OFDM &&
+	    (flags & HAL_TXDESC_NOACK) == 0) {
+		/* XXX fragments must use CCK rates w/ protection */
+		if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
+			flags |= HAL_TXDESC_RTSENA;
+		else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
+			flags |= HAL_TXDESC_CTSENA;
+		cix = rt->info[sc->sc_protrix].controlRate;
+		sc->sc_stats.ast_tx_protect++;
+	}
+
+	/*
 	 * Calculate duration.  This logically belongs in the 802.11
 	 * layer but it lacks sufficient information to calculate it.
 	 */
@@ -2034,9 +3166,11 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf
 		/*
 		 * XXX not right with fragmentation.
 		 */
-		dur = ath_hal_computetxtime(ah, rt, IEEE80211_ACK_SIZE,
-				rix, shortPreamble);
-		*((u_int16_t*) wh->i_dur) = htole16(dur);
+		if (shortPreamble)
+			dur = rt->info[rix].spAckDuration;
+		else
+			dur = rt->info[rix].lpAckDuration;
+		*(u_int16_t *)wh->i_dur = htole16(dur);
 	}
 
 	/*
@@ -2049,41 +3183,44 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf
 		 * by looking in the h/w rate table.  We must also factor
 		 * in whether or not a short preamble is to be used.
 		 */
-		cix = rt->info[rix].controlRate;
+		/* NB: cix is set above where RTS/CTS is enabled */
+		KASSERT(cix != 0xff, ("cix not setup"));
 		ctsrate = rt->info[cix].rateCode;
-		if (shortPreamble)
-			ctsrate |= rt->info[cix].shortPreamble;
 		/*
-		 * Compute the transmit duration based on the size
-		 * of an ACK frame.  We call into the HAL to do the
-		 * computation since it depends on the characteristics
-		 * of the actual PHY being used.
+		 * Compute the transmit duration based on the frame
+		 * size and the size of an ACK frame.  We call into the
+		 * HAL to do the computation since it depends on the
+		 * characteristics of the actual PHY being used.
+		 *
+		 * NB: CTS is assumed the same size as an ACK so we can
+		 *     use the precalculated ACK durations.
 		 */
-		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
+		if (shortPreamble) {
+			ctsrate |= rt->info[cix].shortPreamble;
+			if (flags & HAL_TXDESC_RTSENA)		/* SIFS + CTS */
+				ctsduration += rt->info[cix].spAckDuration;
 			ctsduration += ath_hal_computetxtime(ah,
-				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
-		}
-		/* SIFS + data */
-		ctsduration += ath_hal_computetxtime(ah,
-			rt, pktlen, rix, shortPreamble);
-		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
+				rt, pktlen, rix, AH_TRUE);
+			if ((flags & HAL_TXDESC_NOACK) == 0)	/* SIFS + ACK */
+				ctsduration += rt->info[cix].spAckDuration;
+		} else {
+			if (flags & HAL_TXDESC_RTSENA)		/* SIFS + CTS */
+				ctsduration += rt->info[cix].lpAckDuration;
 			ctsduration += ath_hal_computetxtime(ah,
-				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
+				rt, pktlen, rix, AH_FALSE);
+			if ((flags & HAL_TXDESC_NOACK) == 0)	/* SIFS + ACK */
+				ctsduration += rt->info[cix].lpAckDuration;
 		}
+		/*
+		 * Must disable multi-rate retry when using RTS/CTS.
+		 */
+		try0 = ATH_TXMAXTRY;
 	} else
 		ctsrate = 0;
 
-	/*
-	 * For now use the antenna on which the last good
-	 * frame was received on.  We assume this field is
-	 * initialized to 0 which gives us ``auto'' or the
-	 * ``default'' antenna.
-	 */
-	an = (struct ath_node *) ni;
-	if (an->an_tx_antenna)
-		antenna = an->an_tx_antenna;
-	else
-		antenna = an->an_rx_hist[an->an_rx_hist_next].arh_antenna;
+	if (IFF_DUMPPKTS(sc, ATH_DEBUG_XMIT))
+		ieee80211_dump_pkt(mtod(m0, caddr_t), m0->m_len,
+			sc->sc_hwmap[txrate], -1);
 
 	if (ic->ic_rawbpf)
 		bpf_mtap(ic->ic_rawbpf, m0);
@@ -2094,13 +3231,35 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf
 		if (iswep)
 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
 		sc->sc_tx_th.wt_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
-		sc->sc_tx_th.wt_txpower = 60/2;		/* XXX */
-		sc->sc_tx_th.wt_antenna = antenna;
+		sc->sc_tx_th.wt_txpower = ni->ni_txpower;
+		sc->sc_tx_th.wt_antenna = sc->sc_txantenna;
 
 		bpf_mtap2(sc->sc_drvbpf,
 			&sc->sc_tx_th, sc->sc_tx_th_len, m0);
 	}
 
+	/* 
+	 * Determine if a tx interrupt should be generated for
+	 * this descriptor.  We take a tx interrupt to reap
+	 * descriptors when the h/w hits an EOL condition or
+	 * when the descriptor is specifically marked to generate
+	 * an interrupt.  We periodically mark descriptors in this
+	 * way to insure timely replenishing of the supply needed
+	 * for sending frames.  Defering interrupts reduces system
+	 * load and potentially allows more concurrent work to be
+	 * done but if done to aggressively can cause senders to
+	 * backup.
+	 *
+	 * NB: use >= to deal with sc_txintrperiod changing
+	 *     dynamically through sysctl.
+	 */
+	if (flags & HAL_TXDESC_INTREQ) {
+		txq->axq_intrcnt = 0;
+	} else if (++txq->axq_intrcnt >= sc->sc_txintrperiod) {
+		flags |= HAL_TXDESC_INTREQ;
+		txq->axq_intrcnt = 0;
+	}
+
 	/*
 	 * Formulate first tx descriptor with tx controls.
 	 */
@@ -2109,25 +3268,28 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf
 		, pktlen		/* packet length */
 		, hdrlen		/* header length */
 		, atype			/* Atheros packet type */
-		, 60			/* txpower XXX */
-		, txrate, 1+10		/* series 0 rate/tries */
-		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
-		, antenna		/* antenna mode */
+		, ni->ni_txpower	/* txpower */
+		, txrate, try0		/* series 0 rate/tries */
+		, keyix			/* key cache index */
+		, sc->sc_txantenna	/* antenna mode */
 		, flags			/* flags */
 		, ctsrate		/* rts/cts rate */
 		, ctsduration		/* rts/cts duration */
 	);
-#ifdef notyet
-	ath_hal_setupxtxdesc(ah, ds
-		, AH_FALSE		/* short preamble */
-		, 0, 0			/* series 1 rate/tries */
-		, 0, 0			/* series 2 rate/tries */
-		, 0, 0			/* series 3 rate/tries */
-	);
-#endif
+	/*
+	 * Setup the multi-rate retry state only when we're
+	 * going to use it.  This assumes ath_hal_setuptxdesc
+	 * initializes the descriptors (so we don't have to)
+	 * when the hardware supports multi-rate retry and
+	 * we don't use it.
+	 */
+	if (try0 != ATH_TXMAXTRY)
+		ath_rate_setupxtxdesc(sc, an, ds, shortPreamble, rix);
+
 	/*
 	 * Fillin the remainder of the descriptor info.
 	 */
+	ds0 = ds;
 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
 		ds->ds_data = bf->bf_segs[i].ds_addr;
 		if (i == bf->bf_nseg - 1)
@@ -2138,98 +3300,144 @@ ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf
 			, bf->bf_segs[i].ds_len	/* segment length */
 			, i == 0		/* first segment */
 			, i == bf->bf_nseg - 1	/* last segment */
+			, ds0			/* first descriptor */
 		);
-		DPRINTF(ATH_DEBUG_XMIT,
-			("%s: %d: %08x %08x %08x %08x %08x %08x\n",
+		DPRINTF(sc, ATH_DEBUG_XMIT,
+			"%s: %d: %08x %08x %08x %08x %08x %08x\n",
 			__func__, i, ds->ds_link, ds->ds_data,
-			ds->ds_ctl0, ds->ds_ctl1, ds->ds_hw[0], ds->ds_hw[1]));
+			ds->ds_ctl0, ds->ds_ctl1, ds->ds_hw[0], ds->ds_hw[1]);
 	}
-
+#if 0
+	if ((flags & (HAL_TXDESC_RTSENA | HAL_TXDESC_CTSENA)) &&
+  	    !ath_hal_updateCTSForBursting(ah, ds 
+		     , txq->axq_linkbuf != NULL ?
+			txq->axq_linkbuf->bf_desc : NULL
+		     , txq->axq_lastdsWithCTS
+		     , txq->axq_gatingds
+		     , IEEE80211_TXOP_TO_US(ic->ic_chanParams.cap_wmeParams[skb->priority].wmep_txopLimit)
+		     , ath_hal_computetxtime(ah, rt, IEEE80211_ACK_LEN, cix, AH_TRUE))) {
+		ATH_TXQ_LOCK(txq);		     
+		txq->axq_lastdsWithCTS = ds;
+		/* set gating Desc to final desc */
+		txq->axq_gatingds = (struct ath_desc *)txq->axq_link;
+		ATH_TXQ_UNLOCK(txq);
+	}
+#endif
 	/*
 	 * Insert the frame on the outbound list and
 	 * pass it on to the hardware.
 	 */
-	ATH_TXQ_LOCK(sc);
-	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
-	if (sc->sc_txlink == NULL) {
-		ath_hal_puttxbuf(ah, sc->sc_txhalq, bf->bf_daddr);
-		DPRINTF(ATH_DEBUG_XMIT, ("%s: TXDP0 = %p (%p)\n", __func__,
-		    (caddr_t)bf->bf_daddr, bf->bf_desc));
+	ATH_TXQ_LOCK(txq);
+	ATH_TXQ_INSERT_TAIL(txq, bf, bf_list);
+	if (txq->axq_link == NULL) {
+		ath_hal_puttxbuf(ah, txq->axq_qnum, bf->bf_daddr);
+		DPRINTF(sc, ATH_DEBUG_XMIT,
+			"%s: TXDP[%u] = %p (%p) depth %d\n", __func__,
+			txq->axq_qnum, (caddr_t)bf->bf_daddr, bf->bf_desc,
+			txq->axq_depth);
 	} else {
-		*sc->sc_txlink = bf->bf_daddr;
-		DPRINTF(ATH_DEBUG_XMIT, ("%s: link(%p)=%p (%p)\n", __func__,
-		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
+		*txq->axq_link = bf->bf_daddr;
+		DPRINTF(sc, ATH_DEBUG_XMIT,
+			"%s: link[%u](%p)=%p (%p) depth %d\n", __func__,
+			txq->axq_qnum, txq->axq_link,
+			(caddr_t)bf->bf_daddr, bf->bf_desc, txq->axq_depth);
 	}
-	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
-	ATH_TXQ_UNLOCK(sc);
+	txq->axq_link = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
+	ATH_TXQ_UNLOCK(txq);
 
-	ath_hal_txstart(ah, sc->sc_txhalq);
+	if (sc->sc_softled)
+		ath_update_led(sc);
+
+	/*
+	 * The CAB queue is started from the SWBA handler since
+	 * frames only go out on DTIM and to avoid possible races.
+	 */
+	if (txq != sc->sc_cabq)
+		ath_hal_txstart(ah, txq->axq_qnum);
 	return 0;
 }
 
+/*
+ * Process completed xmit descriptors from the specified queue.
+ */
 static void
-ath_tx_proc(void *arg, int npending)
+ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
 {
-	struct ath_softc *sc = arg;
 	struct ath_hal *ah = sc->sc_ah;
-	struct ath_buf *bf;
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
+	struct ath_buf *bf;
 	struct ath_desc *ds;
 	struct ieee80211_node *ni;
 	struct ath_node *an;
-	int sr, lr;
+	int sr, lr, pri;
 	HAL_STATUS status;
 
-	DPRINTF(ATH_DEBUG_TX_PROC, ("%s: pending %u tx queue %p, link %p\n",
-		__func__, npending,
-		(caddr_t)(uintptr_t) ath_hal_gettxbuf(sc->sc_ah, sc->sc_txhalq),
-		sc->sc_txlink));
+	DPRINTF(sc, ATH_DEBUG_TX_PROC, "%s: tx queue %u head %p link %p\n",
+		__func__, txq->axq_qnum,
+		(caddr_t)(uintptr_t) ath_hal_gettxbuf(sc->sc_ah, txq->axq_qnum),
+		txq->axq_link);
 	for (;;) {
-		ATH_TXQ_LOCK(sc);
-		bf = TAILQ_FIRST(&sc->sc_txq);
+		ATH_TXQ_LOCK(txq);
+		txq->axq_intrcnt = 0;	/* reset periodic desc intr count */
+		bf = STAILQ_FIRST(&txq->axq_q);
 		if (bf == NULL) {
-			sc->sc_txlink = NULL;
-			ATH_TXQ_UNLOCK(sc);
+			txq->axq_link = NULL;
+			ATH_TXQ_UNLOCK(txq);
 			break;
 		}
 		/* only the last descriptor is needed */
 		ds = &bf->bf_desc[bf->bf_nseg - 1];
 		status = ath_hal_txprocdesc(ah, ds);
 #ifdef AR_DEBUG
-		if (ath_debug & ATH_DEBUG_XMIT_DESC)
+		if (sc->sc_debug & ATH_DEBUG_XMIT_DESC)
 			ath_printtxbuf(bf, status == HAL_OK);
 #endif
 		if (status == HAL_EINPROGRESS) {
-			ATH_TXQ_UNLOCK(sc);
+			ATH_TXQ_UNLOCK(txq);
 			break;
 		}
-		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
-		ATH_TXQ_UNLOCK(sc);
+#if 0
+		if (bf->bf_desc == txq->axq_lastdsWithCTS)
+			txq->axq_lastdsWithCTS = NULL;
+		if (ds == txq->axq_gatingds)
+			txq->axq_gatingds = NULL;
+#endif
+		ATH_TXQ_REMOVE_HEAD(txq, bf_list);
+		ATH_TXQ_UNLOCK(txq);
 
 		ni = bf->bf_node;
 		if (ni != NULL) {
-			an = (struct ath_node *) ni;
+			an = ATH_NODE(ni);
 			if (ds->ds_txstat.ts_status == 0) {
-				an->an_tx_ok++;
-				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
+				u_int8_t txant = ds->ds_txstat.ts_antenna;
+				sc->sc_stats.ast_ant_tx[txant]++;
+				sc->sc_ant_tx[txant]++;
+				if (ds->ds_txstat.ts_rate & HAL_TXSTAT_ALTRATE)
+					sc->sc_stats.ast_tx_altrate++;
+				sc->sc_stats.ast_tx_rssi =
+					ds->ds_txstat.ts_rssi;
+				ATH_RSSI_LPF(an->an_halstats.ns_avgtxrssi,
+					ds->ds_txstat.ts_rssi);
+				pri = M_WME_GETAC(bf->bf_m);
+				if (pri >= WME_AC_VO)
+					ic->ic_wme.wme_hipri_traffic++;
+				ni->ni_inact = ni->ni_inact_reload;
 			} else {
-				an->an_tx_err++;
-				ifp->if_oerrors++;
 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
 					sc->sc_stats.ast_tx_xretries++;
 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
 					sc->sc_stats.ast_tx_fifoerr++;
 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
 					sc->sc_stats.ast_tx_filtered++;
-				an->an_tx_antenna = 0;	/* invalidate */
 			}
 			sr = ds->ds_txstat.ts_shortretry;
 			lr = ds->ds_txstat.ts_longretry;
 			sc->sc_stats.ast_tx_shortretry += sr;
 			sc->sc_stats.ast_tx_longretry += lr;
-			if (sr + lr)
-				an->an_tx_retr++;
+			/*
+			 * Hand the descriptor to the rate control algorithm.
+			 */
+			ath_rate_tx_complete(sc, an, ds);
 			/*
 			 * Reclaim reference to node.
 			 *
@@ -2237,8 +3445,7 @@ ath_tx_proc(void *arg, int npending)
 			 *     this is a DEAUTH message that was sent and the
 			 *     node was timed out due to inactivity.
 			 */
-			if (ni != ic->ic_bss)
-				ieee80211_free_node(ic, ni);
+			ieee80211_free_node(ni);
 		}
 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
 		    BUS_DMASYNC_POSTWRITE);
@@ -2248,9 +3455,23 @@ ath_tx_proc(void *arg, int npending)
 		bf->bf_node = NULL;
 
 		ATH_TXBUF_LOCK(sc);
-		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+		STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
 		ATH_TXBUF_UNLOCK(sc);
 	}
+}
+
+/*
+ * Deferred processing of transmit interrupt; special-cased
+ * for a single hardware transmit queue (e.g. 5210 and 5211).
+ */
+static void
+ath_tx_proc_q0(void *arg, int npending)
+{
+	struct ath_softc *sc = arg;
+	struct ifnet *ifp = &sc->sc_if;
+
+	ath_tx_processq(sc, &sc->sc_txq[0]);
+	ath_tx_processq(sc, sc->sc_cabq);
 	ifp->if_flags &= ~IFF_OACTIVE;
 	sc->sc_tx_timer = 0;
 
@@ -2258,42 +3479,77 @@ ath_tx_proc(void *arg, int npending)
 }
 
 /*
- * Drain the transmit queue and reclaim resources.
+ * Deferred processing of transmit interrupt; special-cased
+ * for four hardware queues, 0-3 (e.g. 5212 w/ WME support).
  */
 static void
-ath_draintxq(struct ath_softc *sc)
+ath_tx_proc_q0123(void *arg, int npending)
+{
+	struct ath_softc *sc = arg;
+	struct ifnet *ifp = &sc->sc_if;
+
+	/*
+	 * Process each active queue.
+	 */
+	ath_tx_processq(sc, &sc->sc_txq[0]);
+	ath_tx_processq(sc, &sc->sc_txq[1]);
+	ath_tx_processq(sc, &sc->sc_txq[2]);
+	ath_tx_processq(sc, &sc->sc_txq[3]);
+	ath_tx_processq(sc, sc->sc_cabq);
+
+	ifp->if_flags &= ~IFF_OACTIVE;
+	sc->sc_tx_timer = 0;
+
+	ath_start(ifp);
+}
+
+/*
+ * Deferred processing of transmit interrupt.
+ */
+static void
+ath_tx_proc(void *arg, int npending)
+{
+	struct ath_softc *sc = arg;
+	struct ifnet *ifp = &sc->sc_if;
+	int i;
+
+	/*
+	 * Process each active queue.
+	 */
+	/* XXX faster to read ISR_S0_S and ISR_S1_S to determine q's? */
+	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
+		if (ATH_TXQ_SETUP(sc, i))
+			ath_tx_processq(sc, &sc->sc_txq[i]);
+
+	ifp->if_flags &= ~IFF_OACTIVE;
+	sc->sc_tx_timer = 0;
+
+	ath_start(ifp);
+}
+
+static void
+ath_tx_draintxq(struct ath_softc *sc, struct ath_txq *txq)
 {
 	struct ath_hal *ah = sc->sc_ah;
-	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
 	struct ieee80211_node *ni;
 	struct ath_buf *bf;
 
-	/* XXX return value */
-	if (!sc->sc_invalid) {
-		/* don't touch the hardware if marked invalid */
-		(void) ath_hal_stoptxdma(ah, sc->sc_txhalq);
-		DPRINTF(ATH_DEBUG_RESET,
-		    ("%s: tx queue %p, link %p\n", __func__,
-		    (caddr_t)(uintptr_t) ath_hal_gettxbuf(ah, sc->sc_txhalq),
-		    sc->sc_txlink));
-		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
-		DPRINTF(ATH_DEBUG_RESET,
-		    ("%s: beacon queue %p\n", __func__,
-		    (caddr_t)(uintptr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq)));
-	}
+	/*
+	 * NB: this assumes output has been stopped and
+	 *     we do not need to block ath_tx_tasklet
+	 */
 	for (;;) {
-		ATH_TXQ_LOCK(sc);
-		bf = TAILQ_FIRST(&sc->sc_txq);
+		ATH_TXQ_LOCK(txq);
+		bf = STAILQ_FIRST(&txq->axq_q);
 		if (bf == NULL) {
-			sc->sc_txlink = NULL;
-			ATH_TXQ_UNLOCK(sc);
+			txq->axq_link = NULL;
+			ATH_TXQ_UNLOCK(txq);
 			break;
 		}
-		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
-		ATH_TXQ_UNLOCK(sc);
+		ATH_TXQ_REMOVE_HEAD(txq, bf_list);
+		ATH_TXQ_UNLOCK(txq);
 #ifdef AR_DEBUG
-		if (ath_debug & ATH_DEBUG_RESET)
+		if (sc->sc_debug & ATH_DEBUG_RESET)
 			ath_printtxbuf(bf,
 				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
 #endif /* AR_DEBUG */
@@ -2302,16 +3558,53 @@ ath_draintxq(struct ath_softc *sc)
 		bf->bf_m = NULL;
 		ni = bf->bf_node;
 		bf->bf_node = NULL;
-		if (ni != NULL && ni != ic->ic_bss) {
+		if (ni != NULL) {
 			/*
 			 * Reclaim node reference.
 			 */
-			ieee80211_free_node(ic, ni);
+			ieee80211_free_node(ni);
 		}
 		ATH_TXBUF_LOCK(sc);
-		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+		STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
 		ATH_TXBUF_UNLOCK(sc);
 	}
+}
+
+static void
+ath_tx_stopdma(struct ath_softc *sc, struct ath_txq *txq)
+{
+	struct ath_hal *ah = sc->sc_ah;
+
+	(void) ath_hal_stoptxdma(ah, txq->axq_qnum);
+	DPRINTF(sc, ATH_DEBUG_RESET, "%s: tx queue [%u] %p, link %p\n",
+	    __func__, txq->axq_qnum,
+	    (caddr_t) ath_hal_gettxbuf(ah, txq->axq_qnum), txq->axq_link);
+}
+
+/*
+ * Drain the transmit queues and reclaim resources.
+ */
+static void
+ath_draintxq(struct ath_softc *sc)
+{
+	struct ath_hal *ah = sc->sc_ah;
+	struct ifnet *ifp = &sc->sc_if;
+	int i;
+
+	/* XXX return value */
+	if (!sc->sc_invalid) {
+		/* don't touch the hardware if marked invalid */
+		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
+		DPRINTF(sc, ATH_DEBUG_RESET,
+		    "%s: beacon queue %p\n", __func__,
+		    (caddr_t)(uintptr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq));
+		for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
+			if (ATH_TXQ_SETUP(sc, i))
+				ath_tx_stopdma(sc, &sc->sc_txq[i]);
+	}
+	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
+		if (ATH_TXQ_SETUP(sc, i))
+			ath_tx_draintxq(sc, &sc->sc_txq[i]);
 	ifp->if_flags &= ~IFF_OACTIVE;
 	sc->sc_tx_timer = 0;
 }
@@ -2323,25 +3616,26 @@ static void
 ath_stoprecv(struct ath_softc *sc)
 {
 #define	PA2DESC(_sc, _pa) \
-	((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
-		((_pa) - (_sc)->sc_desc_paddr)))
+	((struct ath_desc *)((caddr_t)(_sc)->sc_rxdma.dd_desc + \
+		((_pa) - (_sc)->sc_rxdma.dd_desc_paddr)))
 	struct ath_hal *ah = sc->sc_ah;
 
 	ath_hal_stoppcurecv(ah);	/* disable PCU */
 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
-	DELAY(3000);			/* long enough for 1 frame */
+	DELAY(3000);			/* 3ms is long enough for 1 frame */
 #ifdef AR_DEBUG
-	if (ath_debug & ATH_DEBUG_RESET) {
+	if (sc->sc_debug & (ATH_DEBUG_RESET | ATH_DEBUG_FATAL)) {
 		struct ath_buf *bf;
 
 		printf("%s: rx queue %p, link %p\n", __func__,
 			(caddr_t)(uintptr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink);
-		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
+		STAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
 			struct ath_desc *ds = bf->bf_desc;
-			if (ath_hal_rxprocdesc(ah, ds, bf->bf_daddr,
-			    PA2DESC(sc, ds->ds_link)) == HAL_OK)
-				ath_printrxbuf(bf, 1);
+			HAL_STATUS status = ath_hal_rxprocdesc(ah, ds,
+				bf->bf_daddr, PA2DESC(sc, ds->ds_link));
+			if (status == HAL_OK || (sc->sc_debug & ATH_DEBUG_FATAL))
+				ath_printrxbuf(bf, status == HAL_OK);
 		}
 	}
 #endif
@@ -2359,17 +3653,17 @@ ath_startrecv(struct ath_softc *sc)
 	struct ath_buf *bf;
 
 	sc->sc_rxlink = NULL;
-	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
+	STAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
 		int error = ath_rxbuf_init(sc, bf);
 		if (error != 0) {
-			DPRINTF(ATH_DEBUG_RECV,
-				("%s: ath_rxbuf_init failed %d\n",
-				__func__, error));
+			DPRINTF(sc, ATH_DEBUG_RECV,
+				"%s: ath_rxbuf_init failed %d\n",
+				__func__, error);
 			return error;
 		}
 	}
 
-	bf = TAILQ_FIRST(&sc->sc_rxbuf);
+	bf = STAILQ_FIRST(&sc->sc_rxbuf);
 	ath_hal_putrxbuf(ah, bf->bf_daddr);
 	ath_hal_rxena(ah);		/* enable recv descriptors */
 	ath_mode_init(sc);		/* set filters, etc. */
@@ -2377,9 +3671,34 @@ ath_startrecv(struct ath_softc *sc)
 	return 0;
 }
 
+/* 
+ * Update internal state after a channel change.
+ */
+static void
+ath_chan_change(struct ath_softc *sc, struct ieee80211_channel *chan)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	enum ieee80211_phymode mode;
+
+	/*
+	 * Change channels and update the h/w rate map
+	 * if we're switching; e.g. 11a to 11b/g.
+	 */
+	mode = ieee80211_chan2mode(ic, chan);
+	if (mode != sc->sc_curmode)
+		ath_setcurmode(sc, mode);
+	/*
+	 * Update BPF state.
+	 */
+	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
+		htole16(chan->ic_freq);
+	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
+		htole16(chan->ic_flags);
+}
+
 /*
  * Set/change channels.  If the channel is really being changed,
- * it's done by resetting the chip.  To accomplish this we must
+ * it's done by reseting the chip.  To accomplish this we must
  * first cleanup any pending DMA, then restart stuff after a la
  * ath_init.
  */
@@ -2388,15 +3707,25 @@ ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
 {
 	struct ath_hal *ah = sc->sc_ah;
 	struct ieee80211com *ic = &sc->sc_ic;
+	HAL_CHANNEL hchan;
 
-	DPRINTF(ATH_DEBUG_ANY, ("%s: %u (%u MHz) -> %u (%u MHz)\n", __func__,
-	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
-		ic->ic_ibss_chan->ic_freq,
-	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
-	if (chan != ic->ic_ibss_chan) {
+	/*
+	 * Convert to a HAL channel description with
+	 * the flags constrained to reflect the current
+	 * operating mode.
+	 */
+	hchan.channel = chan->ic_freq;
+	hchan.channelFlags = ath_chan2flags(ic, chan);
+
+	DPRINTF(sc, ATH_DEBUG_RESET, "%s: %u (%u MHz) -> %u (%u MHz)\n",
+	    __func__,
+	    ath_hal_mhz2ieee(sc->sc_curchan.channel,
+		sc->sc_curchan.channelFlags),
+	    	sc->sc_curchan.channel,
+	    ath_hal_mhz2ieee(hchan.channel, hchan.channelFlags), hchan.channel);
+	if (hchan.channel != sc->sc_curchan.channel ||
+	    hchan.channelFlags != sc->sc_curchan.channelFlags) {
 		HAL_STATUS status;
-		HAL_CHANNEL hchan;
-		enum ieee80211_phymode mode;
 
 		/*
 		 * To switch channels clear any pending DMA operations;
@@ -2407,44 +3736,30 @@ ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
 		ath_hal_intrset(ah, 0);		/* disable interrupts */
 		ath_draintxq(sc);		/* clear pending tx frames */
 		ath_stoprecv(sc);		/* turn off frame recv */
-		/*
-		 * Convert to a HAL channel description with
-		 * the flags constrained to reflect the current
-		 * operating mode.
-		 */
-		hchan.channel = chan->ic_freq;
-		hchan.channelFlags = ath_chan2flags(ic, chan);
 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
-			if_printf(&ic->ic_if, "ath_chan_set: unable to reset "
+			if_printf(ic->ic_ifp, "ath_chan_set: unable to reset "
 				"channel %u (%u Mhz)\n",
 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
 			return EIO;
 		}
+		sc->sc_curchan = hchan;
+		ath_update_txpow(sc);		/* update tx power state */
+
 		/*
 		 * Re-enable rx framework.
 		 */
 		if (ath_startrecv(sc) != 0) {
-			if_printf(&ic->ic_if,
+			if_printf(ic->ic_ifp,
 				"ath_chan_set: unable to restart recv logic\n");
 			return EIO;
 		}
 
 		/*
-		 * Update BPF state.
-		 */
-		sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
-			htole16(chan->ic_freq);
-		sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
-			htole16(chan->ic_flags);
-
-		/*
 		 * Change channels and update the h/w rate map
 		 * if we're switching; e.g. 11a to 11b/g.
 		 */
 		ic->ic_ibss_chan = chan;
-		mode = ieee80211_chan2mode(ic, chan);
-		if (mode != sc->sc_curmode)
-			ath_setcurmode(sc, mode);
+		ath_chan_change(sc, chan);
 
 		/*
 		 * Re-enable interrupts.
@@ -2459,10 +3774,9 @@ ath_next_scan(void *arg)
 {
 	struct ath_softc *sc = arg;
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
 
 	if (ic->ic_state == IEEE80211_S_SCAN)
-		ieee80211_next_scan(ifp);
+		ieee80211_next_scan(ic);
 }
 
 /*
@@ -2474,22 +3788,11 @@ ath_calibrate(void *arg)
 {
 	struct ath_softc *sc = arg;
 	struct ath_hal *ah = sc->sc_ah;
-	struct ieee80211com *ic = &sc->sc_ic;
-	struct ieee80211_channel *c;
-	HAL_CHANNEL hchan;
 
 	sc->sc_stats.ast_per_cal++;
 
-	/*
-	 * Convert to a HAL channel description with the flags
-	 * constrained to reflect the current operating mode.
-	 */
-	c = ic->ic_ibss_chan;
-	hchan.channel = c->ic_freq;
-	hchan.channelFlags = ath_chan2flags(ic, c);
-
-	DPRINTF(ATH_DEBUG_CALIBRATE,
-		("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
+	DPRINTF(sc, ATH_DEBUG_CALIBRATE, "%s: channel %u/%x\n",
+		__func__, sc->sc_curchan.channel, sc->sc_curchan.channelFlags);
 
 	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
 		/*
@@ -2497,21 +3800,21 @@ ath_calibrate(void *arg)
 		 * to load new gain values.
 		 */
 		sc->sc_stats.ast_per_rfgain++;
-		ath_reset(sc);
+		ath_reset(&sc->sc_if);
 	}
-	if (!ath_hal_calibrate(ah, &hchan)) {
-		DPRINTF(ATH_DEBUG_ANY,
-			("%s: calibration of channel %u failed\n",
-			__func__, c->ic_freq));
+	if (!ath_hal_calibrate(ah, &sc->sc_curchan)) {
+		DPRINTF(sc, ATH_DEBUG_ANY,
+			"%s: calibration of channel %u failed\n",
+			__func__, sc->sc_curchan.channel);
 		sc->sc_stats.ast_per_calfail++;
 	}
-	callout_reset(&sc->sc_cal_ch, hz * ath_calinterval, ath_calibrate, sc);
+	callout_reset(&sc->sc_cal_ch, ath_calinterval * hz, ath_calibrate, sc);
 }
 
 static int
 ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 {
-	struct ifnet *ifp = &ic->ic_if;
+	struct ifnet *ifp = ic->ic_ifp;
 	struct ath_softc *sc = ifp->if_softc;
 	struct ath_hal *ah = sc->sc_ah;
 	struct ieee80211_node *ni;
@@ -2526,55 +3829,64 @@ ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 	    HAL_LED_RUN, 	/* IEEE80211_S_RUN */
 	};
 
-	DPRINTF(ATH_DEBUG_ANY, ("%s: %s -> %s\n", __func__,
+	DPRINTF(sc, ATH_DEBUG_STATE, "%s: %s -> %s\n", __func__,
 		ieee80211_state_name[ic->ic_state],
-		ieee80211_state_name[nstate]));
+		ieee80211_state_name[nstate]);
 
+	callout_stop(&sc->sc_scan_ch);
+	callout_stop(&sc->sc_cal_ch);
 	ath_hal_setledstate(ah, leds[nstate]);	/* set LED */
 
 	if (nstate == IEEE80211_S_INIT) {
 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
 		ath_hal_intrset(ah, sc->sc_imask);
-		callout_stop(&sc->sc_scan_ch);
-		callout_stop(&sc->sc_cal_ch);
-		return (*sc->sc_newstate)(ic, nstate, arg);
+		/*
+		 * Notify the rate control algorithm.
+		 */
+		ath_rate_newstate(sc, nstate);
+		goto done;
 	}
 	ni = ic->ic_bss;
 	error = ath_chan_set(sc, ni->ni_chan);
 	if (error != 0)
 		goto bad;
-	rfilt = ath_calcrxfilter(sc);
-	if (nstate == IEEE80211_S_SCAN) {
-		callout_reset(&sc->sc_scan_ch, (hz * ath_dwelltime) / 1000,
-			ath_next_scan, sc);
+	rfilt = ath_calcrxfilter(sc, nstate);
+	if (nstate == IEEE80211_S_SCAN)
 		bssid = ifp->if_broadcastaddr;
-	} else {
-		callout_stop(&sc->sc_scan_ch);
+	else
 		bssid = ni->ni_bssid;
-	}
 	ath_hal_setrxfilter(ah, rfilt);
-	DPRINTF(ATH_DEBUG_ANY, ("%s: RX filter 0x%x bssid %s\n",
-		 __func__, rfilt, ether_sprintf(bssid)));
+	DPRINTF(sc, ATH_DEBUG_STATE, "%s: RX filter 0x%x bssid %s\n",
+		 __func__, rfilt, ether_sprintf(bssid));
 
 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
 		ath_hal_setassocid(ah, bssid, ni->ni_associd);
 	else
 		ath_hal_setassocid(ah, bssid, 0);
-	if (ic->ic_flags & IEEE80211_F_WEPON) {
+	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
 			if (ath_hal_keyisvalid(ah, i))
 				ath_hal_keysetmac(ah, i, bssid);
 	}
 
-	if (nstate == IEEE80211_S_RUN) {
-		DPRINTF(ATH_DEBUG_ANY, ("%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
+	/*
+	 * Notify the rate control algorithm so rates
+	 * are setup should ath_beacon_alloc be called.
+	 */
+	ath_rate_newstate(sc, nstate);
+
+	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
+		/* nothing to do */;
+	} else if (nstate == IEEE80211_S_RUN) {
+		DPRINTF(sc, ATH_DEBUG_STATE,
+			"%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
 			"capinfo=0x%04x chan=%d\n"
 			 , __func__
 			 , ic->ic_flags
 			 , ni->ni_intval
 			 , ether_sprintf(ni->ni_bssid)
 			 , ni->ni_capinfo
-			 , ieee80211_chan2ieee(ic, ni->ni_chan)));
+			 , ieee80211_chan2ieee(ic, ni->ni_chan));
 
 		/*
 		 * Allocate and setup the beacon frame for AP or adhoc mode.
@@ -2590,27 +3902,29 @@ ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 		 * Configure the beacon and sleep timers.
 		 */
 		ath_beacon_config(sc);
-
-		/* start periodic recalibration timer */
-		callout_reset(&sc->sc_cal_ch, hz * ath_calinterval,
-			ath_calibrate, sc);
 	} else {
+		ath_hal_intrset(ah,
+			sc->sc_imask &~ (HAL_INT_SWBA | HAL_INT_BMISS));
 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
-		ath_hal_intrset(ah, sc->sc_imask);
-		callout_stop(&sc->sc_cal_ch);		/* no calibration */
 	}
+done:
 	/*
-	 * Reset the rate control state.
+	 * Invoke the parent method to complete the work.
 	 */
-	ath_rate_ctl_reset(sc, nstate);
+	error = sc->sc_newstate(ic, nstate, arg);
 	/*
-	 * Invoke the parent method to complete the work.
+	 * Finally, start any timers.
 	 */
-	return (*sc->sc_newstate)(ic, nstate, arg);
+	if (nstate == IEEE80211_S_RUN) {
+		/* start periodic recalibration timer */
+		callout_reset(&sc->sc_cal_ch, ath_calinterval * hz,
+			ath_calibrate, sc);
+	} else if (nstate == IEEE80211_S_SCAN) {
+		/* start ap/neighbor scan timer */
+		callout_reset(&sc->sc_scan_ch, (ath_dwelltime * hz) / 1000,
+			ath_next_scan, sc);
+	}
 bad:
-	callout_stop(&sc->sc_scan_ch);
-	callout_stop(&sc->sc_cal_ch);
-	/* NB: do not invoke the parent */
 	return error;
 }
 
@@ -2622,27 +3936,17 @@ bad:
 static void
 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
 {
-	if (isnew) {
-		struct ath_node *an = (struct ath_node *) ni;
+	struct ath_softc *sc = ic->ic_ifp->if_softc;
 
-		an->an_tx_ok = an->an_tx_err =
-			an->an_tx_retr = an->an_tx_upper = 0;
-		/* start with highest negotiated rate */
-		/*
-		 * XXX should do otherwise but only when
-		 * the rate control algorithm is better.
-		 */
-		KASSERT(ni->ni_rates.rs_nrates > 0,
-			("new association w/ no rates!"));
-		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
-	}
+	ath_rate_newassoc(sc, ATH_NODE(ni), isnew);
 }
 
 static int
-ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor)
+ath_getchannels(struct ath_softc *sc, u_int cc,
+	HAL_BOOL outdoor, HAL_BOOL xchanmode)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
-	struct ifnet *ifp = &ic->ic_if;
+	struct ifnet *ifp = &sc->sc_if;
 	struct ath_hal *ah = sc->sc_ah;
 	HAL_CHANNEL *chans;
 	int i, ix, nchan;
@@ -2654,8 +3958,12 @@ ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor)
 		return ENOMEM;
 	}
 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
-	    cc, HAL_MODE_ALL, outdoor)) {
-		if_printf(ifp, "unable to collect channel list from hal\n");
+	    cc, HAL_MODE_ALL, outdoor, xchanmode)) {
+		u_int32_t rd;
+
+		ath_hal_getregdomain(ah, &rd);
+		if_printf(ifp, "unable to collect channel list from hal; "
+			"regdomain likely %u country code %u\n", rd, cc);
 		free(chans, M_TEMP);
 		return EINVAL;
 	}
@@ -2685,6 +3993,50 @@ ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor)
 	return 0;
 }
 
+static void
+ath_update_led(struct ath_softc *sc)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ath_hal *ah = sc->sc_ah;
+	u_int32_t threshold;
+
+	/*
+	 * When not associated, flash LED on for 5s, off for 200ms.
+	 * XXX this assumes 100ms beacon interval.
+	 */
+	if (ic->ic_state != IEEE80211_S_RUN) {
+		threshold = 2 + sc->sc_ledstate * 48;
+	} else {
+		threshold = 2 + sc->sc_ledstate * 18;
+	}
+	if (ic->ic_stats.is_rx_beacon - sc->sc_beacons >= threshold) {
+		ath_hal_gpioCfgOutput(ah, sc->sc_ledpin);
+		ath_hal_gpioset(ah, sc->sc_ledpin, sc->sc_ledstate);
+		sc->sc_ledstate ^= 1;
+		sc->sc_beacons = ic->ic_stats.is_rx_beacon;
+	}
+}
+
+static void
+ath_update_txpow(struct ath_softc *sc)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ath_hal *ah = sc->sc_ah;
+	u_int32_t txpow;
+
+	if (sc->sc_curtxpow != ic->ic_txpowlimit) {
+		ath_hal_settxpowlimit(ah, ic->ic_txpowlimit);
+		/* read back in case value is clamped */
+		ath_hal_gettxpowlimit(ah, &txpow);
+		ic->ic_txpowlimit = sc->sc_curtxpow = txpow;
+	}
+	/* 
+	 * Fetch max tx power level for status requests.
+	 */
+	ath_hal_getmaxtxpow(sc->sc_ah, &txpow);
+	ic->ic_bss->ni_txpower = txpow;
+}
+
 static int
 ath_rate_setup(struct ath_softc *sc, u_int mode)
 {
@@ -2704,21 +4056,24 @@ ath_rate_setup(struct ath_softc *sc, u_int mode)
 	case IEEE80211_MODE_11G:
 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
 		break;
-	case IEEE80211_MODE_TURBO:
+	case IEEE80211_MODE_TURBO_A:
 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
 		break;
+	case IEEE80211_MODE_TURBO_G:
+		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_108G);
+		break;
 	default:
-		DPRINTF(ATH_DEBUG_ANY,
-			("%s: invalid mode %u\n", __func__, mode));
+		DPRINTF(sc, ATH_DEBUG_ANY, "%s: invalid mode %u\n",
+			__func__, mode);
 		return 0;
 	}
 	rt = sc->sc_rates[mode];
 	if (rt == NULL)
 		return 0;
 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
-		DPRINTF(ATH_DEBUG_ANY,
-			("%s: rate table too small (%u > %u)\n",
-			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
+		DPRINTF(sc, ATH_DEBUG_ANY,
+			"%s: rate table too small (%u > %u)\n",
+			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE);
 		maxrates = IEEE80211_RATE_MAXSIZE;
 	} else
 		maxrates = rt->rateCount;
@@ -2741,179 +4096,478 @@ ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
 	for (i = 0; i < rt->rateCount; i++)
 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
 	memset(sc->sc_hwmap, 0, sizeof(sc->sc_hwmap));
-	for (i = 0; i < 32; i++)
-		sc->sc_hwmap[i] = rt->info[rt->rateCodeToIndex[i]].dot11Rate;
+	for (i = 0; i < 32; i++) {
+		u_int8_t ix = rt->rateCodeToIndex[i];
+		if (ix != 0xff)
+			sc->sc_hwmap[i] = rt->info[ix].dot11Rate & IEEE80211_RATE_VAL;
+	}
 	sc->sc_currates = rt;
 	sc->sc_curmode = mode;
+	/*
+	 * All protection frames are transmited at 2Mb/s for
+	 * 11g, otherwise at 1Mb/s.
+	 * XXX select protection rate index from rate table.
+	 */
+	sc->sc_protrix = (mode == IEEE80211_MODE_11G ? 1 : 0);
+	/* NB: caller is responsible for reseting rate control state */
 }
 
-/*
- * Reset the rate control state for each 802.11 state transition.
- */
+#ifdef AR_DEBUG
 static void
-ath_rate_ctl_reset(struct ath_softc *sc, enum ieee80211_state state)
+ath_printrxbuf(struct ath_buf *bf, int done)
 {
-	struct ieee80211com *ic = &sc->sc_ic;
-	struct ieee80211_node *ni;
-	struct ath_node *an;
+	struct ath_desc *ds;
+	int i;
 
-	if (ic->ic_opmode != IEEE80211_M_STA) {
-		/*
-		 * When operating as a station the node table holds
-		 * the AP's that were discovered during scanning.
-		 * For any other operating mode we want to reset the
-		 * tx rate state of each node.
-		 */
-		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
-			ni->ni_txrate = 0;		/* use lowest rate */
-			an = (struct ath_node *) ni;
-			an->an_tx_ok = an->an_tx_err = an->an_tx_retr =
-			    an->an_tx_upper = 0;
-		}
-	}
-	/*
-	 * Reset local xmit state; this is really only meaningful
-	 * when operating in station or adhoc mode.
-	 */
-	ni = ic->ic_bss;
-	an = (struct ath_node *) ni;
-	an->an_tx_ok = an->an_tx_err = an->an_tx_retr = an->an_tx_upper = 0;
-	if (state == IEEE80211_S_RUN) {
-		/* start with highest negotiated rate */
-		KASSERT(ni->ni_rates.rs_nrates > 0,
-			("transition to RUN state w/ no rates!"));
-		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
-	} else {
-		/* use lowest rate */
-		ni->ni_txrate = 0;
+	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
+		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
+		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
+		    ds->ds_link, ds->ds_data,
+		    ds->ds_ctl0, ds->ds_ctl1,
+		    ds->ds_hw[0], ds->ds_hw[1],
+		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
 	}
 }
 
-/* 
- * Examine and potentially adjust the transmit rate.
- */
 static void
-ath_rate_ctl(void *arg, struct ieee80211_node *ni)
+ath_printtxbuf(struct ath_buf *bf, int done)
 {
-	struct ath_softc *sc = arg;
-	struct ath_node *an = (struct ath_node *) ni;
-	struct ieee80211_rateset *rs = &ni->ni_rates;
-	int mod = 0, orate, enough;
+	struct ath_desc *ds;
+	int i;
 
-	/*
-	 * Rate control
-	 * XXX: very primitive version.
-	 */
-	sc->sc_stats.ast_rate_calls++;
+	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
+		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
+		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
+		    ds->ds_link, ds->ds_data,
+		    ds->ds_ctl0, ds->ds_ctl1,
+		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
+		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
+	}
+}
+#endif /* AR_DEBUG */
 
-	enough = (an->an_tx_ok + an->an_tx_err >= 10);
+static void
+ath_watchdog(struct ifnet *ifp)
+{
+	struct ath_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
 
-	/* no packet reached -> down */
-	if (an->an_tx_err > 0 && an->an_tx_ok == 0)
-		mod = -1;
+	ifp->if_timer = 0;
+	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
+		return;
+	if (sc->sc_tx_timer) {
+		if (--sc->sc_tx_timer == 0) {
+			if_printf(ifp, "device timeout\n");
+			ath_reset(ifp);
+			ifp->if_oerrors++;
+			sc->sc_stats.ast_watchdog++;
+		} else
+			ifp->if_timer = 1;
+	}
+	ieee80211_watchdog(ic);
+}
 
-	/* all packets needs retry in average -> down */
-	if (enough && an->an_tx_ok < an->an_tx_retr)
-		mod = -1;
+/*
+ * Diagnostic interface to the HAL.  This is used by various
+ * tools to do things like retrieve register contents for
+ * debugging.  The mechanism is intentionally opaque so that
+ * it can change frequently w/o concern for compatiblity.
+ */
+static int
+ath_ioctl_diag(struct ath_softc *sc, struct ath_diag *ad)
+{
+	struct ath_hal *ah = sc->sc_ah;
+	u_int id = ad->ad_id & ATH_DIAG_ID;
+	void *indata = NULL;
+	void *outdata = NULL;
+	u_int32_t insize = ad->ad_in_size;
+	u_int32_t outsize = ad->ad_out_size;
+	int error = 0;
 
-	/* no error and less than 10% of packets needs retry -> up */
-	if (enough && an->an_tx_err == 0 && an->an_tx_ok > an->an_tx_retr * 10)
-		mod = 1;
+	if (ad->ad_id & ATH_DIAG_IN) {
+		/*
+		 * Copy in data.
+		 */
+		indata = malloc(insize, M_TEMP, M_NOWAIT);
+		if (indata == NULL) {
+			error = ENOMEM;
+			goto bad;
+		}
+		error = copyin(ad->ad_in_data, indata, insize);
+		if (error)
+			goto bad;
+	}
+	if (ad->ad_id & ATH_DIAG_DYN) {
+		/*
+		 * Allocate a buffer for the results (otherwise the HAL
+		 * returns a pointer to a buffer where we can read the
+		 * results).  Note that we depend on the HAL leaving this
+		 * pointer for us to use below in reclaiming the buffer;
+		 * may want to be more defensive.
+		 */
+		outdata = malloc(outsize, M_TEMP, M_NOWAIT);
+		if (outdata == NULL) {
+			error = ENOMEM;
+			goto bad;
+		}
+	}
+	if (ath_hal_getdiagstate(ah, id, indata, insize, &outdata, &outsize)) {
+		if (outsize < ad->ad_out_size)
+			ad->ad_out_size = outsize;
+		if (outdata != NULL)
+			error = copyout(outdata, ad->ad_out_data,
+					ad->ad_out_size);
+	} else {
+		error = EINVAL;
+	}
+bad:
+	if ((ad->ad_id & ATH_DIAG_IN) && indata != NULL)
+		free(indata, M_TEMP);
+	if ((ad->ad_id & ATH_DIAG_DYN) && outdata != NULL)
+		free(outdata, M_TEMP);
+	return error;
+}
 
-	orate = ni->ni_txrate;
-	switch (mod) {
-	case 0:
-		if (enough && an->an_tx_upper > 0)
-			an->an_tx_upper--;
+static int
+ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
+{
+#define	IS_RUNNING(ifp) \
+	((ifp->if_flags & (IFF_RUNNING|IFF_UP)) == (IFF_RUNNING|IFF_UP))
+	struct ath_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifreq *ifr = (struct ifreq *)data;
+	int error = 0;
+
+	ATH_LOCK(sc);
+	switch (cmd) {
+	case SIOCSIFFLAGS:
+		if (IS_RUNNING(ifp)) {
+			/*
+			 * To avoid rescanning another access point,
+			 * do not call ath_init() here.  Instead,
+			 * only reflect promisc mode settings.
+			 */
+			ath_mode_init(sc);
+		} else if (ifp->if_flags & IFF_UP) {
+			/*
+			 * Beware of being called during attach/detach
+			 * to reset promiscuous mode.  In that case we
+			 * will still be marked UP but not RUNNING.
+			 * However trying to re-init the interface
+			 * is the wrong thing to do as we've already
+			 * torn down much of our state.  There's
+			 * probably a better way to deal with this.
+			 */
+			if (!sc->sc_invalid && ic->ic_bss != NULL)
+				ath_init(ifp);	/* XXX lose error */
+		} else
+			ath_stop_locked(ifp);
 		break;
-	case -1:
-		if (ni->ni_txrate > 0) {
-			ni->ni_txrate--;
-			sc->sc_stats.ast_rate_drop++;
-		}
-		an->an_tx_upper = 0;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		/*
+		 * The upper layer has already installed/removed
+		 * the multicast address(es), just recalculate the
+		 * multicast filter for the card.
+		 */
+		if (ifp->if_flags & IFF_RUNNING)
+			ath_mode_init(sc);
 		break;
-	case 1:
-		if (++an->an_tx_upper < 2)
-			break;
-		an->an_tx_upper = 0;
-		if (ni->ni_txrate + 1 < rs->rs_nrates) {
-			ni->ni_txrate++;
-			sc->sc_stats.ast_rate_raise++;
+	case SIOCGATHSTATS:
+		/* NB: embed these numbers to get a consistent view */
+		sc->sc_stats.ast_tx_packets = ifp->if_opackets;
+		sc->sc_stats.ast_rx_packets = ifp->if_ipackets;
+		sc->sc_stats.ast_rx_rssi = ieee80211_getrssi(ic);
+		ATH_UNLOCK(sc);
+		/*
+		 * NB: Drop the softc lock in case of a page fault;
+		 * we'll accept any potential inconsisentcy in the
+		 * statistics.  The alternative is to copy the data
+		 * to a local structure.
+		 */
+		return copyout(&sc->sc_stats,
+				ifr->ifr_data, sizeof (sc->sc_stats));
+	case SIOCGATHDIAG:
+		error = ath_ioctl_diag(sc, (struct ath_diag *) ifr);
+		break;
+	default:
+		error = ieee80211_ioctl(ic, cmd, data);
+		if (error == ENETRESET) {
+			if (IS_RUNNING(ifp) && 
+			    ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
+				ath_init(ifp);	/* XXX lose error */
+			error = 0;
 		}
+		if (error == ERESTART)
+			error = IS_RUNNING(ifp) ? ath_reset(ifp) : 0;
 		break;
 	}
+	ATH_UNLOCK(sc);
+	return error;
+#undef IS_UP
+}
 
-	if (ni->ni_txrate != orate) {
-		DPRINTF(ATH_DEBUG_RATE,
-		    ("%s: %dM -> %dM (%d ok, %d err, %d retr)\n",
-		    __func__,
-		    (rs->rs_rates[orate] & IEEE80211_RATE_VAL) / 2,
-		    (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL) / 2,
-		    an->an_tx_ok, an->an_tx_err, an->an_tx_retr));
-	}
-	if (ni->ni_txrate != orate || enough)
-		an->an_tx_ok = an->an_tx_err = an->an_tx_retr = 0;
+static int
+ath_sysctl_slottime(SYSCTL_HANDLER_ARGS)
+{
+	struct ath_softc *sc = arg1;
+	u_int slottime = ath_hal_getslottime(sc->sc_ah);
+	int error;
+
+	error = sysctl_handle_int(oidp, &slottime, 0, req);
+	if (error || !req->newptr)
+		return error;
+	return !ath_hal_setslottime(sc->sc_ah, slottime) ? EINVAL : 0;
 }
 
-#ifdef AR_DEBUG
 static int
-sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
+ath_sysctl_acktimeout(SYSCTL_HANDLER_ARGS)
 {
-	char dmode[64];
+	struct ath_softc *sc = arg1;
+	u_int acktimeout = ath_hal_getacktimeout(sc->sc_ah);
 	int error;
 
-	strncpy(dmode, "", sizeof(dmode) - 1);
-	dmode[sizeof(dmode) - 1] = '\0';
-	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
+	error = sysctl_handle_int(oidp, &acktimeout, 0, req);
+	if (error || !req->newptr)
+		return error;
+	return !ath_hal_setacktimeout(sc->sc_ah, acktimeout) ? EINVAL : 0;
+}
 
-	if (error == 0 && req->newptr != NULL) {
-		struct ifnet *ifp;
-		struct ath_softc *sc;
+static int
+ath_sysctl_ctstimeout(SYSCTL_HANDLER_ARGS)
+{
+	struct ath_softc *sc = arg1;
+	u_int ctstimeout = ath_hal_getctstimeout(sc->sc_ah);
+	int error;
 
-		ifp = ifunit("ath0");		/* XXX */
-		if (!ifp)
-			return EINVAL;
-		sc = ifp->if_softc;
-		if (strcmp(dmode, "hal") == 0)
-			ath_hal_dumpstate(sc->sc_ah);
-		else
-			return EINVAL;
+	error = sysctl_handle_int(oidp, &ctstimeout, 0, req);
+	if (error || !req->newptr)
+		return error;
+	return !ath_hal_setctstimeout(sc->sc_ah, ctstimeout) ? EINVAL : 0;
+}
+
+static int
+ath_sysctl_softled(SYSCTL_HANDLER_ARGS)
+{
+	struct ath_softc *sc = arg1;
+	int softled = sc->sc_softled;
+	int error;
+
+	error = sysctl_handle_int(oidp, &softled, 0, req);
+	if (error || !req->newptr)
+		return error;
+	if (softled > 1)
+		softled = 1;
+	if (softled != sc->sc_softled) {
+		if (softled)
+			ath_hal_gpioCfgOutput(sc->sc_ah, sc->sc_ledpin);
+		ath_hal_gpioset(sc->sc_ah, sc->sc_ledpin, !softled);
+		sc->sc_softled = softled;
 	}
+	return 0;
+}
+
+static int
+ath_sysctl_rxantenna(SYSCTL_HANDLER_ARGS)
+{
+	struct ath_softc *sc = arg1;
+	u_int defantenna = ath_hal_getdefantenna(sc->sc_ah);
+	int error;
+
+	error = sysctl_handle_int(oidp, &defantenna, 0, req);
+	if (!error && req->newptr)
+		ath_hal_setdefantenna(sc->sc_ah, defantenna);
 	return error;
 }
-SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
-	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
+
+static int
+ath_sysctl_diversity(SYSCTL_HANDLER_ARGS)
+{
+	struct ath_softc *sc = arg1;
+	u_int diversity = sc->sc_diversity;
+	int error;
+
+	error = sysctl_handle_int(oidp, &diversity, 0, req);
+	if (error || !req->newptr)
+		return error;
+	sc->sc_diversity = diversity;
+	return !ath_hal_setdiversity(sc->sc_ah, diversity) ? EINVAL : 0;
+}
+
+static int
+ath_sysctl_diag(SYSCTL_HANDLER_ARGS)
+{
+	struct ath_softc *sc = arg1;
+	u_int32_t diag;
+	int error;
+
+	if (!ath_hal_getdiag(sc->sc_ah, &diag))
+		return EINVAL;
+	error = sysctl_handle_int(oidp, &diag, 0, req);
+	if (error || !req->newptr)
+		return error;
+	return !ath_hal_setdiag(sc->sc_ah, diag) ? EINVAL : 0;
+}
+
+static int
+ath_sysctl_tpscale(SYSCTL_HANDLER_ARGS)
+{
+	struct ath_softc *sc = arg1;
+	struct ifnet *ifp = &sc->sc_if;
+	u_int32_t scale;
+	int error;
+
+	ath_hal_gettpscale(sc->sc_ah, &scale);
+	error = sysctl_handle_int(oidp, &scale, 0, req);
+	if (error || !req->newptr)
+		return error;
+	return !ath_hal_settpscale(sc->sc_ah, scale) ? EINVAL : ath_reset(ifp);
+}
+
+static int
+ath_sysctl_tpc(SYSCTL_HANDLER_ARGS)
+{
+	struct ath_softc *sc = arg1;
+	u_int tpc = ath_hal_gettpc(sc->sc_ah);
+	int error;
+
+	error = sysctl_handle_int(oidp, &tpc, 0, req);
+	if (error || !req->newptr)
+		return error;
+	return !ath_hal_settpc(sc->sc_ah, tpc) ? EINVAL : 0;
+}
 
 static void
-ath_printrxbuf(struct ath_buf *bf, int done)
+ath_sysctlattach(struct ath_softc *sc)
 {
-	struct ath_desc *ds;
-	int i;
+	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
+	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
+
+	ath_hal_getcountrycode(sc->sc_ah, &sc->sc_countrycode);
+	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"countrycode", CTLFLAG_RD, &sc->sc_countrycode, 0,
+		"EEPROM country code");
+	ath_hal_getregdomain(sc->sc_ah, &sc->sc_regdomain);
+	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"regdomain", CTLFLAG_RD, &sc->sc_regdomain, 0,
+		"EEPROM regdomain code");
+	sc->sc_debug = ath_debug;
+	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"debug", CTLFLAG_RW, &sc->sc_debug, 0,
+		"control debugging printfs");
+
+	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"slottime", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
+		ath_sysctl_slottime, "I", "802.11 slot time (us)");
+	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"acktimeout", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
+		ath_sysctl_acktimeout, "I", "802.11 ACK timeout (us)");
+	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"ctstimeout", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
+		ath_sysctl_ctstimeout, "I", "802.11 CTS timeout (us)");
+	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"softled", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
+		ath_sysctl_softled, "I", "enable/disable software LED support");
+	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"ledpin", CTLFLAG_RW, &sc->sc_ledpin, 0,
+		"GPIO pin connected to LED");
+	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"txantenna", CTLFLAG_RW, &sc->sc_txantenna, 0,
+		"tx antenna (0=auto)");
+	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"rxantenna", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
+		ath_sysctl_rxantenna, "I", "default/rx antenna");
+	if (sc->sc_hasdiversity)
+		SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+			"diversity", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
+			ath_sysctl_diversity, "I", "antenna diversity");
+	sc->sc_txintrperiod = ATH_TXINTR_PERIOD;
+	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"txintrperiod", CTLFLAG_RW, &sc->sc_txintrperiod, 0,
+		"tx descriptor batching");
+	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"diag", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
+		ath_sysctl_diag, "I", "h/w diagnostic control");
+	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+		"tpscale", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
+		ath_sysctl_tpscale, "I", "tx power scaling");
+	if (sc->sc_hastpc)
+		SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+			"tpc", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
+			ath_sysctl_tpc, "I", "enable/disable per-packet TPC");
+}
 
-	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
-		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
-		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
-		    ds->ds_link, ds->ds_data,
-		    ds->ds_ctl0, ds->ds_ctl1,
-		    ds->ds_hw[0], ds->ds_hw[1],
-		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
-	}
+static void
+ath_bpfattach(struct ath_softc *sc)
+{
+	struct ifnet *ifp = &sc->sc_if;
+
+	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
+		sizeof(struct ieee80211_frame) + sizeof(sc->sc_tx_th),
+		&sc->sc_drvbpf);
+	/*
+	 * Initialize constant fields.
+	 * XXX make header lengths a multiple of 32-bits so subsequent
+	 *     headers are properly aligned; this is a kludge to keep
+	 *     certain applications happy.
+	 *
+	 * NB: the channel is setup each time we transition to the
+	 *     RUN state to avoid filling it in for each frame.
+	 */
+	sc->sc_tx_th_len = roundup(sizeof(sc->sc_tx_th), sizeof(u_int32_t));
+	sc->sc_tx_th.wt_ihdr.it_len = htole16(sc->sc_tx_th_len);
+	sc->sc_tx_th.wt_ihdr.it_present = htole32(ATH_TX_RADIOTAP_PRESENT);
+
+	sc->sc_rx_th_len = roundup(sizeof(sc->sc_rx_th), sizeof(u_int32_t));
+	sc->sc_rx_th.wr_ihdr.it_len = htole16(sc->sc_rx_th_len);
+	sc->sc_rx_th.wr_ihdr.it_present = htole32(ATH_RX_RADIOTAP_PRESENT);
 }
 
+/*
+ * Announce various information on device/driver attach.
+ */
 static void
-ath_printtxbuf(struct ath_buf *bf, int done)
+ath_announce(struct ath_softc *sc)
 {
-	struct ath_desc *ds;
-	int i;
+#define	HAL_MODE_DUALBAND	(HAL_MODE_11A|HAL_MODE_11B)
+	struct ifnet *ifp = &sc->sc_if;
+	struct ath_hal *ah = sc->sc_ah;
+	u_int modes, cc;
 
-	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
-		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
-		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
-		    ds->ds_link, ds->ds_data,
-		    ds->ds_ctl0, ds->ds_ctl1,
-		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
-		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
+	if_printf(ifp, "mac %d.%d phy %d.%d",
+		ah->ah_macVersion, ah->ah_macRev,
+		ah->ah_phyRev >> 4, ah->ah_phyRev & 0xf);
+	/*
+	 * Print radio revision(s).  We check the wireless modes
+	 * to avoid falsely printing revs for inoperable parts.
+	 * Dual-band radio revs are returned in the 5Ghz rev number.
+	 */
+	ath_hal_getcountrycode(ah, &cc);
+	modes = ath_hal_getwirelessmodes(ah, cc);
+	if ((modes & HAL_MODE_DUALBAND) == HAL_MODE_DUALBAND) {
+		if (ah->ah_analog5GhzRev && ah->ah_analog2GhzRev)
+			printf(" 5ghz radio %d.%d 2ghz radio %d.%d",
+				ah->ah_analog5GhzRev >> 4,
+				ah->ah_analog5GhzRev & 0xf,
+				ah->ah_analog2GhzRev >> 4,
+				ah->ah_analog2GhzRev & 0xf);
+		else
+			printf(" radio %d.%d", ah->ah_analog5GhzRev >> 4,
+				ah->ah_analog5GhzRev & 0xf);
+	} else
+		printf(" radio %d.%d", ah->ah_analog5GhzRev >> 4,
+			ah->ah_analog5GhzRev & 0xf);
+	printf("\n");
+	if (bootverbose) {
+		int i;
+		for (i = 0; i <= WME_AC_VO; i++) {
+			struct ath_txq *txq = sc->sc_ac2q[i];
+			if_printf(ifp, "Use hw queue %u for %s traffic\n",
+				txq->axq_qnum, ieee80211_wme_acnames[i]);
+		}
+		if_printf(ifp, "Use hw queue %u for CAB traffic\n",
+			sc->sc_cabq->axq_qnum);
+		if_printf(ifp, "Use hw queue %u for beacons\n", sc->sc_bhalq);
 	}
+#undef HAL_MODE_DUALBAND
 }
-#endif /* AR_DEBUG */
diff --git a/sys/dev/ath/if_ath_pci.c b/sys/dev/ath/if_ath_pci.c
index 194d167..0e7ead2 100644
--- a/sys/dev/ath/if_ath_pci.c
+++ b/sys/dev/ath/if_ath_pci.c
@@ -41,43 +41,27 @@ __FBSDID("$FreeBSD$");
  * PCI/Cardbus front-end for the Atheros Wireless LAN controller driver.
  */
 
-#include "opt_inet.h"
-
 #include <sys/param.h>
 #include <sys/systm.h> 
-#include <sys/mbuf.h>   
-#include <sys/malloc.h>
 #include <sys/module.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/mutex.h>
-#include <sys/socket.h>
-#include <sys/sockio.h>
 #include <sys/errno.h>
 
 #include <machine/bus.h>
 #include <machine/resource.h>
 #include <sys/bus.h>
 #include <sys/rman.h>
+
+#include <sys/socket.h>
  
 #include <net/if.h>
-#include <net/if_dl.h>
 #include <net/if_media.h>
-#include <net/ethernet.h>
-#include <net/if_llc.h>
 #include <net/if_arp.h>
 
-#include <net80211/ieee80211.h>
-#include <net80211/ieee80211_crypto.h>
-#include <net80211/ieee80211_node.h>
-#include <net80211/ieee80211_proto.h>
 #include <net80211/ieee80211_var.h>
 
-#ifdef INET
-#include <netinet/in.h> 
-#include <netinet/if_ether.h>
-#endif
-
 #include <dev/ath/if_athvar.h>
 #include <contrib/dev/ath/ah.h>
 
@@ -92,7 +76,7 @@ struct ath_pci_softc {
 	struct ath_softc	sc_sc;
 	struct resource		*sc_sr;		/* memory resource */
 	struct resource		*sc_irq;	/* irq resource */
-	void			*sc_ih;		/* intererupt handler */
+	void			*sc_ih;		/* interrupt handler */
 	u_int8_t		sc_saved_intline;
 	u_int8_t		sc_saved_cachelinesz;
 	u_int8_t		sc_saved_lattimer;
@@ -106,7 +90,7 @@ ath_pci_probe(device_t dev)
 	const char* devname;
 
 	devname = ath_hal_probe(pci_get_vendor(dev), pci_get_device(dev));
-	if (devname) {
+	if (devname != NULL) {
 		device_set_desc(dev, devname);
 		return 0;
 	}
@@ -185,7 +169,7 @@ ath_pci_attach(device_t dev)
 			       NULL, NULL,		/* filter, filterarg */
 			       0x3ffff,			/* maxsize XXX */
 			       ATH_MAX_SCATTER,		/* nsegments */
-			       0xffff,			/* maxsegsize XXX */
+			       BUS_SPACE_MAXADDR,	/* maxsegsize */
 			       BUS_DMA_ALLOCNOW,	/* flags */
 			       NULL,			/* lockfunc */
 			       NULL,			/* lockarg */
@@ -300,3 +284,4 @@ DRIVER_MODULE(if_ath, cardbus, ath_pci_driver, ath_devclass, 0, 0);
 MODULE_VERSION(if_ath, 1);
 MODULE_DEPEND(if_ath, ath_hal, 1, 1, 1);	/* Atheros HAL */
 MODULE_DEPEND(if_ath, wlan, 1, 1, 1);		/* 802.11 media layer */
+MODULE_DEPEND(if_ath, ath_rate, 1, 1, 1);	/* rate control algorithm */
diff --git a/sys/dev/ath/if_athioctl.h b/sys/dev/ath/if_athioctl.h
index f0015ee..94056b6 100644
--- a/sys/dev/ath/if_athioctl.h
+++ b/sys/dev/ath/if_athioctl.h
@@ -46,10 +46,13 @@ struct ath_stats {
 	u_int32_t	ast_watchdog;	/* device reset by watchdog */
 	u_int32_t	ast_hardware;	/* fatal hardware error interrupts */
 	u_int32_t	ast_bmiss;	/* beacon miss interrupts */
+	u_int32_t	ast_bstuck;	/* beacon stuck interrupts */
 	u_int32_t	ast_rxorn;	/* rx overrun interrupts */
 	u_int32_t	ast_rxeol;	/* rx eol interrupts */
 	u_int32_t	ast_txurn;	/* tx underrun interrupts */
+	u_int32_t	ast_mib;	/* mib interrupts */
 	u_int32_t	ast_intrcoal;	/* interrupts coalesced */
+	u_int32_t	ast_tx_packets;	/* packet sent on the interface */
 	u_int32_t	ast_tx_mgmt;	/* management frames transmitted */
 	u_int32_t	ast_tx_discard;	/* frames discarded prior to assoc */
 	u_int32_t	ast_tx_qstop;	/* output stopped 'cuz no buffer */
@@ -78,11 +81,17 @@ struct ath_stats {
 	u_int32_t	ast_rx_crcerr;	/* rx failed 'cuz of bad CRC */
 	u_int32_t	ast_rx_fifoerr;	/* rx failed 'cuz of FIFO overrun */
 	u_int32_t	ast_rx_badcrypt;/* rx failed 'cuz decryption */
+	u_int32_t	ast_rx_badmic;	/* rx failed 'cuz MIC failure */
 	u_int32_t	ast_rx_phyerr;	/* rx failed 'cuz of PHY err */
 	u_int32_t	ast_rx_phy[32];	/* rx PHY error per-code counts */
 	u_int32_t	ast_rx_tooshort;/* rx discarded 'cuz frame too short */
 	u_int32_t	ast_rx_toobig;	/* rx discarded 'cuz frame too large */
+	u_int32_t	ast_rx_packets;	/* packet recv on the interface */
+	u_int32_t	ast_rx_mgt;	/* management frames received */
 	u_int32_t	ast_rx_ctl;	/* rx discarded 'cuz ctl frame */
+	int8_t		ast_tx_rssi;	/* tx rssi of last ack */
+	int8_t		ast_rx_rssi;	/* rx rssi from histogram */
+	u_int32_t	ast_be_xmit;	/* beacons transmitted */
 	u_int32_t	ast_be_nombuf;	/* beacon setup failed 'cuz no mbuf */
 	u_int32_t	ast_per_cal;	/* periodic calibration calls */
 	u_int32_t	ast_per_calfail;/* periodic calibration failed */
@@ -90,15 +99,25 @@ struct ath_stats {
 	u_int32_t	ast_rate_calls;	/* rate control checks */
 	u_int32_t	ast_rate_raise;	/* rate control raised xmit rate */
 	u_int32_t	ast_rate_drop;	/* rate control dropped xmit rate */
+	u_int32_t	ast_ant_defswitch;/* rx/default antenna switches */
+	u_int32_t	ast_ant_txswitch;/* tx antenna switches */
+	u_int32_t	ast_ant_rx[8];	/* rx frames with antenna */
+	u_int32_t	ast_ant_tx[8];	/* tx frames with antenna */
 };
 
 #define	SIOCGATHSTATS	_IOWR('i', 137, struct ifreq)
 
 struct ath_diag {
-	char	ad_name[IFNAMSIZ];		/* if name, e.g. "ath0" */
-	u_int	ad_id;
-	caddr_t	ad_data;
-	u_int	ad_size;
+	char	ad_name[IFNAMSIZ];	/* if name, e.g. "ath0" */
+	u_int16_t ad_id;
+#define	ATH_DIAG_DYN	0x8000		/* allocate buffer in caller */
+#define	ATH_DIAG_IN	0x4000		/* copy in parameters */
+#define	ATH_DIAG_OUT	0x0000		/* copy out results (always) */
+#define	ATH_DIAG_ID	0x0fff
+	u_int16_t ad_in_size;		/* pack to fit, yech */
+	caddr_t	ad_in_data;
+	caddr_t	ad_out_data;
+	u_int	ad_out_size;
 
 };
 #define	SIOCGATHDIAG	_IOWR('i', 138, struct ath_diag)
diff --git a/sys/dev/ath/if_athrate.h b/sys/dev/ath/if_athrate.h
new file mode 100644
index 0000000..c12b80e
--- /dev/null
+++ b/sys/dev/ath/if_athrate.h
@@ -0,0 +1,140 @@
+/*-
+ * Copyright (c) 2004 Sam Leffler, Errno Consulting
+ * Copyright (c) 2004 Video54 Technologies, Inc.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer,
+    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
+ *    redistribution must be conditioned upon including a substantially
+ *    similar Disclaimer requirement for further binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $FreeBSD$
+ */
+#ifndef _ATH_RATECTRL_H_
+#define _ATH_RATECTRL_H_
+
+/*
+ * Interface definitions for transmit rate control modules for the
+ * Atheros driver.
+ *
+ * A rate control module is responsible for choosing the transmit rate
+ * for each data frame.  Management+control frames are always sent at
+ * a fixed rate.
+ *
+ * Only one module may be present at a time; the driver references
+ * rate control interfaces by symbol name.  If multiple modules are
+ * to be supported we'll need to switch to a registration-based scheme
+ * as is currently done, for example, for authentication modules.
+ *
+ * An instance of the rate control module is attached to each device
+ * at attach time and detached when the device is destroyed.  The module
+ * may associate data with each device and each node (station).  Both
+ * sets of storage are opaque except for the size of the per-node storage
+ * which must be provided when the module is attached.
+ *
+ * The rate control module is notified for each state transition and
+ * station association/reassociation.  Otherwise it is queried for a
+ * rate for each outgoing frame and provided status from each transmitted
+ * frame.  Any ancillary processing is the responsibility of the module
+ * (e.g. if periodic processing is required then the module should setup
+ * it's own timer).
+ *
+ * In addition to the transmit rate for each frame the module must also
+ * indicate the number of attempts to make at the specified rate.  If this
+ * number is != ATH_TXMAXTRY then an additional callback is made to setup
+ * additional transmit state.  The rate control code is assumed to write
+ * this additional data directly to the transmit descriptor.
+ */
+struct ath_softc;
+struct ath_node;
+struct ath_desc;
+
+struct ath_ratectrl {
+	size_t	arc_space;	/* space required for per-node state */
+};
+/*
+ * Attach/detach a rate control module.
+ */
+struct ath_ratectrl *ath_rate_attach(struct ath_softc *);
+void	ath_rate_detach(struct ath_ratectrl *);
+
+
+/*
+ * State storage handling.
+ */
+/*
+ * Initialize per-node state already allocated for the specified
+ * node; this space can be assumed initialized to zero.
+ */
+void	ath_rate_node_init(struct ath_softc *, struct ath_node *);
+/*
+ * Cleanup any per-node state prior to the node being reclaimed.
+ */
+void	ath_rate_node_cleanup(struct ath_softc *, struct ath_node *);
+/*
+ * Update rate control state on station associate/reassociate 
+ * (when operating as an ap or for nodes discovered when operating
+ * in ibss mode).
+ */
+void	ath_rate_newassoc(struct ath_softc *, struct ath_node *,
+		int isNewAssociation);
+/*
+ * Update/reset rate control state for 802.11 state transitions.
+ * Important mostly as the analog to ath_rate_newassoc when operating
+ * in station mode.
+ */
+void	ath_rate_newstate(struct ath_softc *, enum ieee80211_state);
+
+/*
+ * Transmit handling.
+ */
+/*
+ * Return the transmit info for a data packet.  If multi-rate state
+ * is to be setup then try0 should contain a value other than ATH_TXMATRY
+ * and ath_rate_setupxtxdesc will be called after deciding if the frame
+ * can be transmitted with multi-rate retry.
+ */
+void	ath_rate_findrate(struct ath_softc *, struct ath_node *,
+		HAL_BOOL shortPreamble, size_t frameLen,
+		u_int8_t *rix, int *try0, u_int8_t *txrate);
+/*
+ * Setup any extended (multi-rate) descriptor state for a data packet.
+ * The rate index returned by ath_rate_findrate is passed back in.
+ */
+void	ath_rate_setupxtxdesc(struct ath_softc *, struct ath_node *,
+		struct ath_desc *, HAL_BOOL shortPreamble, u_int8_t rix);
+/*
+ * Update rate control state for a packet associated with the
+ * supplied transmit descriptor.  The routine is invoked both
+ * for packets that were successfully sent and for those that
+ * failed (consult the descriptor for details).
+ */
+void	ath_rate_tx_complete(struct ath_softc *, struct ath_node *,
+		const struct ath_desc *);
+#endif /* _ATH_RATECTRL_H_ */
diff --git a/sys/dev/ath/if_athvar.h b/sys/dev/ath/if_athvar.h
index 0d35989..ffc05f2 100644
--- a/sys/dev/ath/if_athvar.h
+++ b/sys/dev/ath/if_athvar.h
@@ -47,73 +47,150 @@
 #include <contrib/dev/ath/ah.h>
 #include <net80211/ieee80211_radiotap.h>
 #include <dev/ath/if_athioctl.h>
+#include <dev/ath/if_athrate.h>
 
 #define	ATH_TIMEOUT		1000
 
 #define	ATH_RXBUF	40		/* number of RX buffers */
 #define	ATH_TXBUF	60		/* number of TX buffers */
 #define	ATH_TXDESC	8		/* number of descriptors per buffer */
+#define	ATH_TXMAXTRY	11		/* max number of transmit attempts */
+#define	ATH_TXINTR_PERIOD 5		/* max number of batched tx descriptors */
 
-struct ath_recv_hist {
-	int		arh_ticks;	/* sample time by system clock */
-	u_int8_t	arh_rssi;	/* rssi */
-	u_int8_t	arh_antenna;	/* antenna */
-};
-#define	ATH_RHIST_SIZE		16	/* number of samples */
-#define	ATH_RHIST_NOTIME	(~0)
-
-/* driver-specific node */
+/* driver-specific node state */
 struct ath_node {
 	struct ieee80211_node an_node;	/* base class */
-	u_int		an_tx_ok;	/* tx ok pkt */
-	u_int		an_tx_err;	/* tx !ok pkt */
-	u_int		an_tx_retr;	/* tx retry count */
-	int		an_tx_upper;	/* tx upper rate req cnt */
-	u_int		an_tx_antenna;	/* antenna for last good frame */
-	u_int		an_rx_antenna;	/* antenna for last rcvd frame */
-	struct ath_recv_hist an_rx_hist[ATH_RHIST_SIZE];
-	u_int		an_rx_hist_next;/* index of next ``free entry'' */
+	u_int8_t	an_tx_mgtrate;	/* h/w rate for management/ctl frames */
+	u_int8_t	an_tx_mgtratesp;/* short preamble h/w rate for " " */
+	u_int32_t	an_avgrssi;	/* average rssi over all rx frames */
+	HAL_NODE_STATS	an_halstats;	/* rssi statistics used by hal */
+	/* variable-length rate control state follows */
 };
-#define	ATH_NODE(_n)	((struct ath_node *)(_n))
+#define	ATH_NODE(ni)	((struct ath_node *)(ni))
+#define	ATH_NODE_CONST(ni)	((const struct ath_node *)(ni))
+
+#define ATH_RSSI_LPF_LEN	10
+#define ATH_RSSI_DUMMY_MARKER	0x127
+#define ATH_EP_MUL(x, mul)	((x) * (mul))
+#define ATH_RSSI_IN(x)		(ATH_EP_MUL((x), HAL_RSSI_EP_MULTIPLIER))
+#define ATH_LPF_RSSI(x, y, len) \
+    ((x != ATH_RSSI_DUMMY_MARKER) ? (((x) * ((len) - 1) + (y)) / (len)) : (y))
+#define ATH_RSSI_LPF(x, y) do {						\
+    if ((y) >= -20)							\
+    	x = ATH_LPF_RSSI((x), ATH_RSSI_IN((y)), ATH_RSSI_LPF_LEN);	\
+} while (0)
 
 struct ath_buf {
-	TAILQ_ENTRY(ath_buf)	bf_list;
+	STAILQ_ENTRY(ath_buf)	bf_list;
 	int			bf_nseg;
-	bus_dmamap_t		bf_dmamap;	/* DMA map of the buffer */
 	struct ath_desc		*bf_desc;	/* virtual addr of desc */
 	bus_addr_t		bf_daddr;	/* physical addr of desc */
+	bus_dmamap_t		bf_dmamap;	/* DMA map for mbuf chain */
 	struct mbuf		*bf_m;		/* mbuf for buf */
 	struct ieee80211_node	*bf_node;	/* pointer to the node */
 	bus_size_t		bf_mapsize;
 #define	ATH_MAX_SCATTER		64
 	bus_dma_segment_t	bf_segs[ATH_MAX_SCATTER];
 };
+typedef STAILQ_HEAD(, ath_buf) ath_bufhead;
+
+/*
+ * DMA state for tx/rx descriptors.
+ */
+struct ath_descdma {
+	const char*		dd_name;
+	struct ath_desc		*dd_desc;	/* descriptors */
+	bus_addr_t		dd_desc_paddr;	/* physical addr of dd_desc */
+	bus_addr_t		dd_desc_len;	/* size of dd_desc */
+	bus_dma_segment_t	dd_dseg;
+	bus_dma_tag_t		dd_dmat;	/* bus DMA tag */
+	bus_dmamap_t		dd_dmamap;	/* DMA map for descriptors */
+	struct ath_buf		*dd_bufptr;	/* associated buffers */
+};
+
+/*
+ * Data transmit queue state.  One of these exists for each
+ * hardware transmit queue.  Packets sent to us from above
+ * are assigned to queues based on their priority.  Not all
+ * devices support a complete set of hardware transmit queues.
+ * For those devices the array sc_ac2q will map multiple
+ * priorities to fewer hardware queues (typically all to one
+ * hardware queue).
+ */
+struct ath_txq {
+	u_int			axq_qnum;	/* hardware q number */
+	u_int			axq_depth;	/* queue depth (stat only) */
+	u_int			axq_intrcnt;	/* interrupt count */
+	u_int32_t		*axq_link;	/* link ptr in last TX desc */
+	STAILQ_HEAD(, ath_buf)	axq_q;		/* transmit queue */
+	struct mtx		axq_lock;	/* lock on q and link */
+};
+
+#define	ATH_TXQ_LOCK_INIT(_sc, _tq) \
+	mtx_init(&(_tq)->axq_lock, \
+		device_get_nameunit((_sc)->sc_dev), "xmit q", MTX_DEF)
+#define	ATH_TXQ_LOCK_DESTROY(_tq)	mtx_destroy(&(_tq)->axq_lock)
+#define	ATH_TXQ_LOCK(_tq)		mtx_lock(&(_tq)->axq_lock)
+#define	ATH_TXQ_UNLOCK(_tq)		mtx_unlock(&(_tq)->axq_lock)
+#define	ATH_TXQ_LOCK_ASSERT(_tq)	mtx_assert(&(_tq)->axq_lock, MA_OWNED)
+
+#define ATH_TXQ_INSERT_TAIL(_tq, _elm, _field) do { \
+	STAILQ_INSERT_TAIL(&(_tq)->axq_q, (_elm), _field); \
+	(_tq)->axq_depth++; \
+} while (0)
+#define ATH_TXQ_REMOVE_HEAD(_tq, _field) do { \
+	STAILQ_REMOVE_HEAD(&(_tq)->axq_q, _field); \
+	(_tq)->axq_depth--; \
+} while (0)
 
 struct ath_softc {
+	struct arpcom		sc_arp;		/* interface common */
+	struct ath_stats	sc_stats;	/* interface statistics */
 	struct ieee80211com	sc_ic;		/* IEEE 802.11 common */
+	int			sc_regdomain;
+	int			sc_countrycode;
+	int			sc_debug;
+	void			(*sc_recv_mgmt)(struct ieee80211com *,
+					struct mbuf *,
+					struct ieee80211_node *,
+					int, int, u_int32_t);
 	int			(*sc_newstate)(struct ieee80211com *,
 					enum ieee80211_state, int);
-	void 			(*sc_node_free)(struct ieee80211com *,
-					struct ieee80211_node *);
-	void			(*sc_node_copy)(struct ieee80211com *,
-					struct ieee80211_node *,
-					const struct ieee80211_node *);
+	void 			(*sc_node_free)(struct ieee80211_node *);
 	device_t		sc_dev;
 	bus_space_tag_t		sc_st;		/* bus space tag */
 	bus_space_handle_t	sc_sh;		/* bus space handle */
 	bus_dma_tag_t		sc_dmat;	/* bus DMA tag */
 	struct mtx		sc_mtx;		/* master lock (recursive) */
 	struct ath_hal		*sc_ah;		/* Atheros HAL */
+	struct ath_ratectrl	*sc_rc;		/* tx rate control support */
+	void			(*sc_setdefantenna)(struct ath_softc *, u_int);
 	unsigned int		sc_invalid  : 1,/* disable hardware accesses */
-				sc_doani    : 1,/* dynamic noise immunity */
-				sc_probing  : 1;/* probing AP on beacon miss */
+				sc_mrretry : 1,	/* multi-rate retry support */
+				sc_softled : 1,	/* enable LED gpio status */
+				sc_splitmic: 1,	/* split TKIP MIC keys */
+				sc_needmib : 1,	/* enable MIB stats intr */
+				sc_hasdiversity : 1,/* rx diversity available */
+				sc_diversity : 1,/* enable rx diversity */
+				sc_hasveol : 1,	/* tx VEOL support */
+				sc_hastpc  : 1;	/* per-packet TPC support */
 						/* rate tables */
 	const HAL_RATE_TABLE	*sc_rates[IEEE80211_MODE_MAX];
 	const HAL_RATE_TABLE	*sc_currates;	/* current rate table */
 	enum ieee80211_phymode	sc_curmode;	/* current phy mode */
+	u_int16_t		sc_curtxpow;	/* current tx power limit */
+	HAL_CHANNEL		sc_curchan;	/* current h/w channel */
 	u_int8_t		sc_rixmap[256];	/* IEEE to h/w rate table ix */
 	u_int8_t		sc_hwmap[32];	/* h/w rate ix to IEEE table */
+	u_int8_t		sc_protrix;	/* protection rate index */
+	u_int			sc_txantenna;	/* tx antenna (fixed or auto) */
 	HAL_INT			sc_imask;	/* interrupt mask copy */
+	u_int			sc_keymax;	/* size of key cache */
+	u_int8_t		sc_keymap[16];	/* bit map of key cache use */
+
+	u_int32_t		sc_beacons;	/* beacon count for LED mgmt */
+	u_int16_t		sc_ledstate;	/* LED on/off state */
+	u_int16_t		sc_ledpin;	/* GPIO pin for driving LED */
 
 	struct bpf_if		*sc_drvbpf;
 	union {
@@ -127,37 +204,45 @@ struct ath_softc {
 	} u_rx_rt;
 	int			sc_rx_th_len;
 
-	struct ath_desc		*sc_desc;	/* TX/RX descriptors */
-	bus_dma_segment_t	sc_dseg;
-	bus_dmamap_t		sc_ddmamap;	/* DMA map for descriptors */
-	bus_addr_t		sc_desc_paddr;	/* physical addr of sc_desc */
-	bus_addr_t		sc_desc_len;	/* size of sc_desc */
-
 	struct task		sc_fataltask;	/* fatal int processing */
-	struct task		sc_rxorntask;	/* rxorn int processing */
 
-	TAILQ_HEAD(, ath_buf)	sc_rxbuf;	/* receive buffer */
+	struct ath_descdma	sc_rxdma;	/* RX descriptos */
+	ath_bufhead		sc_rxbuf;	/* receive buffer */
 	u_int32_t		*sc_rxlink;	/* link ptr in last RX desc */
 	struct task		sc_rxtask;	/* rx int processing */
+	struct task		sc_rxorntask;	/* rxorn int processing */
+	u_int8_t		sc_defant;	/* current default antenna */
+	u_int8_t		sc_rxotherant;	/* rx's on non-default antenna*/
 
-	u_int			sc_txhalq;	/* HAL q for outgoing frames */
-	u_int32_t		*sc_txlink;	/* link ptr in last TX desc */
-	int			sc_tx_timer;	/* transmit timeout */
-	TAILQ_HEAD(, ath_buf)	sc_txbuf;	/* transmit buffer */
+	struct ath_descdma	sc_txdma;	/* TX descriptors */
+	ath_bufhead		sc_txbuf;	/* transmit buffer */
 	struct mtx		sc_txbuflock;	/* txbuf lock */
-	TAILQ_HEAD(, ath_buf)	sc_txq;		/* transmitting queue */
-	struct mtx		sc_txqlock;	/* lock on txq and txlink */
+	int			sc_tx_timer;	/* transmit timeout */
+	u_int			sc_txqsetup;	/* h/w queues setup */
+	u_int			sc_txintrperiod;/* tx interrupt batching */
+	struct ath_txq		sc_txq[HAL_NUM_TX_QUEUES];
+	struct ath_txq		*sc_ac2q[5];	/* WME AC -> h/w q map */ 
 	struct task		sc_txtask;	/* tx int processing */
 
+	struct ath_descdma	sc_bdma;	/* beacon descriptors */
+	ath_bufhead		sc_bbuf;	/* beacon buffers */
 	u_int			sc_bhalq;	/* HAL q for outgoing beacons */
-	struct ath_buf		*sc_bcbuf;	/* beacon buffer */
-	struct ath_buf		*sc_bufptr;	/* allocated buffer ptr */
+	u_int			sc_bmisscount;	/* missed beacon transmits */
+	u_int32_t		sc_ant_tx[8];	/* recent tx frames/antenna */
+	struct ath_txq		*sc_cabq;	/* tx q for cab frames */
+	struct ieee80211_beacon_offsets sc_boff;/* dynamic update state */
 	struct task		sc_bmisstask;	/* bmiss int processing */
+	struct task		sc_bstucktask;	/* stuck beacon processing */
+	enum {
+		OK,				/* no change needed */
+		UPDATE,				/* update pending */
+		COMMIT				/* beacon sent, commit change */
+	} sc_updateslot;			/* slot time update fsm */
 
 	struct callout		sc_cal_ch;	/* callout handle for cals */
 	struct callout		sc_scan_ch;	/* callout handle for scan */
-	struct ath_stats	sc_stats;	/* interface statistics */
 };
+#define	sc_if			sc_arp.ac_if
 #define	sc_tx_th		u_tx_rt.th
 #define	sc_rx_th		u_rx_rt.th
 
@@ -169,6 +254,8 @@ struct ath_softc {
 #define	ATH_UNLOCK(_sc)		mtx_unlock(&(_sc)->sc_mtx)
 #define	ATH_LOCK_ASSERT(_sc)	mtx_assert(&(_sc)->sc_mtx, MA_OWNED)
 
+#define	ATH_TXQ_SETUP(sc, i)	((sc)->sc_txqsetup & (1<<i))
+
 #define	ATH_TXBUF_LOCK_INIT(_sc) \
 	mtx_init(&(_sc)->sc_txbuflock, \
 		device_get_nameunit((_sc)->sc_dev), "xmit buf q", MTX_DEF)
@@ -178,14 +265,6 @@ struct ath_softc {
 #define	ATH_TXBUF_LOCK_ASSERT(_sc) \
 	mtx_assert(&(_sc)->sc_txbuflock, MA_OWNED)
 
-#define	ATH_TXQ_LOCK_INIT(_sc) \
-	mtx_init(&(_sc)->sc_txqlock, \
-		device_get_nameunit((_sc)->sc_dev), "xmit q", MTX_DEF)
-#define	ATH_TXQ_LOCK_DESTROY(_sc)	mtx_destroy(&(_sc)->sc_txqlock)
-#define	ATH_TXQ_LOCK(_sc)		mtx_lock(&(_sc)->sc_txqlock)
-#define	ATH_TXQ_UNLOCK(_sc)		mtx_unlock(&(_sc)->sc_txqlock)
-#define	ATH_TXQ_LOCK_ASSERT(_sc)	mtx_assert(&(_sc)->sc_txqlock, MA_OWNED)
-
 int	ath_attach(u_int16_t, struct ath_softc *);
 int	ath_detach(struct ath_softc *);
 void	ath_resume(struct ath_softc *);
@@ -196,17 +275,16 @@ void	ath_intr(void *);
 /*
  * HAL definitions to comply with local coding convention.
  */
+#define	ath_hal_detach(_ah) \
+	((*(_ah)->ah_detach)((_ah)))
 #define	ath_hal_reset(_ah, _opmode, _chan, _outdoor, _pstatus) \
 	((*(_ah)->ah_reset)((_ah), (_opmode), (_chan), (_outdoor), (_pstatus)))
 #define	ath_hal_getratetable(_ah, _mode) \
 	((*(_ah)->ah_getRateTable)((_ah), (_mode)))
-#define	ath_hal_getregdomain(_ah) \
-	((*(_ah)->ah_getRegDomain)((_ah)))
-#define	ath_hal_getcountrycode(_ah)	(_ah)->ah_countryCode
 #define	ath_hal_getmac(_ah, _mac) \
 	((*(_ah)->ah_getMacAddress)((_ah), (_mac)))
-#define	ath_hal_detach(_ah) \
-	((*(_ah)->ah_detach)((_ah)))
+#define	ath_hal_setmac(_ah, _mac) \
+	((*(_ah)->ah_setMacAddress)((_ah), (_mac)))
 #define	ath_hal_intrset(_ah, _mask) \
 	((*(_ah)->ah_setInterrupts)((_ah), (_mask)))
 #define	ath_hal_intrget(_ah) \
@@ -219,10 +297,12 @@ void	ath_intr(void *);
 	((*(_ah)->ah_updateTxTrigLevel)((_ah), (_inc)))
 #define	ath_hal_setpower(_ah, _mode, _sleepduration) \
 	((*(_ah)->ah_setPowerMode)((_ah), (_mode), AH_TRUE, (_sleepduration)))
+#define	ath_hal_keycachesize(_ah) \
+	((*(_ah)->ah_getKeyCacheSize)((_ah)))
 #define	ath_hal_keyreset(_ah, _ix) \
 	((*(_ah)->ah_resetKeyCacheEntry)((_ah), (_ix)))
-#define	ath_hal_keyset(_ah, _ix, _pk) \
-	((*(_ah)->ah_setKeyCacheEntry)((_ah), (_ix), (_pk), NULL, AH_FALSE))
+#define	ath_hal_keyset(_ah, _ix, _pk, _mac) \
+	((*(_ah)->ah_setKeyCacheEntry)((_ah), (_ix), (_pk), (_mac), AH_FALSE))
 #define	ath_hal_keyisvalid(_ah, _ix) \
 	(((*(_ah)->ah_isKeyCacheEntryValid)((_ah), (_ix))))
 #define	ath_hal_keysetmac(_ah, _ix, _mac) \
@@ -249,6 +329,8 @@ void	ath_intr(void *);
 	((*(_ah)->ah_setTxDP)((_ah), (_q), (_bufaddr)))
 #define	ath_hal_gettxbuf(_ah, _q) \
 	((*(_ah)->ah_getTxDP)((_ah), (_q)))
+#define	ath_hal_numtxpending(_ah, _q) \
+	((*(_ah)->ah_numTxPending)((_ah), (_q)))
 #define	ath_hal_getrxbuf(_ah) \
 	((*(_ah)->ah_getRxDP)((_ah)))
 #define	ath_hal_txstart(_ah, _q) \
@@ -259,17 +341,18 @@ void	ath_intr(void *);
 	((*(_ah)->ah_perCalibration)((_ah), (_chan)))
 #define	ath_hal_setledstate(_ah, _state) \
 	((*(_ah)->ah_setLedState)((_ah), (_state)))
-#define	ath_hal_beaconinit(_ah, _opmode, _nextb, _bperiod) \
-	((*(_ah)->ah_beaconInit)((_ah), (_opmode), (_nextb), (_bperiod)))
+#define	ath_hal_beaconinit(_ah, _nextb, _bperiod) \
+	((*(_ah)->ah_beaconInit)((_ah), (_nextb), (_bperiod)))
 #define	ath_hal_beaconreset(_ah) \
 	((*(_ah)->ah_resetStationBeaconTimers)((_ah)))
-#define	ath_hal_beacontimers(_ah, _bs, _tsf, _dc, _cc) \
-	((*(_ah)->ah_setStationBeaconTimers)((_ah), (_bs), (_tsf), \
-		(_dc), (_cc)))
+#define	ath_hal_beacontimers(_ah, _bs) \
+	((*(_ah)->ah_setStationBeaconTimers)((_ah), (_bs)))
 #define	ath_hal_setassocid(_ah, _bss, _associd) \
-	((*(_ah)->ah_writeAssocid)((_ah), (_bss), (_associd), 0))
-#define	ath_hal_setopmode(_ah, _opmode) \
-	((*(_ah)->ah_setPCUConfig)((_ah), (_opmode)))
+	((*(_ah)->ah_writeAssocid)((_ah), (_bss), (_associd)))
+#define	ath_hal_phydisable(_ah) \
+	((*(_ah)->ah_phyDisable)((_ah)))
+#define	ath_hal_setopmode(_ah) \
+	((*(_ah)->ah_setPCUConfig)((_ah)))
 #define	ath_hal_stoptxdma(_ah, _qnum) \
 	((*(_ah)->ah_stopTxDma)((_ah), (_qnum)))
 #define	ath_hal_stoppcurecv(_ah) \
@@ -278,27 +361,90 @@ void	ath_intr(void *);
 	((*(_ah)->ah_startPcuReceive)((_ah)))
 #define	ath_hal_stopdmarecv(_ah) \
 	((*(_ah)->ah_stopDmaReceive)((_ah)))
-#define	ath_hal_dumpstate(_ah) \
-	((*(_ah)->ah_dumpState)((_ah)))
-#define	ath_hal_getdiagstate(_ah, _id, _data, _size) \
-	((*(_ah)->ah_getDiagState)((_ah), (_id), (_data), (_size)))
+#define	ath_hal_getdiagstate(_ah, _id, _indata, _insize, _outdata, _outsize) \
+	((*(_ah)->ah_getDiagState)((_ah), (_id), \
+		(_indata), (_insize), (_outdata), (_outsize)))
 #define	ath_hal_setuptxqueue(_ah, _type, _irq) \
 	((*(_ah)->ah_setupTxQueue)((_ah), (_type), (_irq)))
 #define	ath_hal_resettxqueue(_ah, _q) \
 	((*(_ah)->ah_resetTxQueue)((_ah), (_q)))
 #define	ath_hal_releasetxqueue(_ah, _q) \
 	((*(_ah)->ah_releaseTxQueue)((_ah), (_q)))
-#define	ath_hal_hasveol(_ah) \
-	((*(_ah)->ah_hasVEOL)((_ah)))
+#define	ath_hal_gettxqueueprops(_ah, _q, _qi) \
+	((*(_ah)->ah_getTxQueueProps)((_ah), (_q), (_qi)))
+#define	ath_hal_settxqueueprops(_ah, _q, _qi) \
+	((*(_ah)->ah_setTxQueueProps)((_ah), (_q), (_qi)))
 #define	ath_hal_getrfgain(_ah) \
 	((*(_ah)->ah_getRfGain)((_ah)))
-#define	ath_hal_rxmonitor(_ah) \
-	((*(_ah)->ah_rxMonitor)((_ah)))
+#define	ath_hal_getdefantenna(_ah) \
+	((*(_ah)->ah_getDefAntenna)((_ah)))
+#define	ath_hal_setdefantenna(_ah, _ant) \
+	((*(_ah)->ah_setDefAntenna)((_ah), (_ant)))
+#define	ath_hal_rxmonitor(_ah, _arg) \
+	((*(_ah)->ah_rxMonitor)((_ah), (_arg)))
+#define	ath_hal_mibevent(_ah, _stats) \
+	((*(_ah)->ah_procMibEvent)((_ah), (_stats)))
+#define	ath_hal_setslottime(_ah, _us) \
+	((*(_ah)->ah_setSlotTime)((_ah), (_us)))
+#define	ath_hal_getslottime(_ah) \
+	((*(_ah)->ah_getSlotTime)((_ah)))
+#define	ath_hal_setacktimeout(_ah, _us) \
+	((*(_ah)->ah_setAckTimeout)((_ah), (_us)))
+#define	ath_hal_getacktimeout(_ah) \
+	((*(_ah)->ah_getAckTimeout)((_ah)))
+#define	ath_hal_setctstimeout(_ah, _us) \
+	((*(_ah)->ah_setCTSTimeout)((_ah), (_us)))
+#define	ath_hal_getctstimeout(_ah) \
+	((*(_ah)->ah_getCTSTimeout)((_ah)))
+#define	ath_hal_getcapability(_ah, _cap, _param, _result) \
+	((*(_ah)->ah_getCapability)((_ah), (_cap), (_param), (_result)))
+#define	ath_hal_setcapability(_ah, _cap, _param, _v, _status) \
+	((*(_ah)->ah_setCapability)((_ah), (_cap), (_param), (_v), (_status)))
+#define	ath_hal_ciphersupported(_ah, _cipher) \
+	(ath_hal_getcapability(_ah, HAL_CAP_CIPHER, _cipher, NULL) == HAL_OK)
+#define	ath_hal_getregdomain(_ah, _prd) \
+	ath_hal_getcapability(_ah, HAL_CAP_REG_DMN, 0, (_prd))
+#define	ath_hal_getcountrycode(_ah, _pcc) \
+	(*(_pcc) = (_ah)->ah_countryCode)
+#define	ath_hal_tkipsplit(_ah) \
+	(ath_hal_getcapability(_ah, HAL_CAP_TKIP_SPLIT, 0, NULL) == HAL_OK)
+#define	ath_hal_hwphycounters(_ah) \
+	(ath_hal_getcapability(_ah, HAL_CAP_PHYCOUNTERS, 0, NULL) == HAL_OK)
+#define	ath_hal_hasdiversity(_ah) \
+	(ath_hal_getcapability(_ah, HAL_CAP_DIVERSITY, 0, NULL) == HAL_OK)
+#define	ath_hal_getdiversity(_ah) \
+	(ath_hal_getcapability(_ah, HAL_CAP_DIVERSITY, 1, NULL) == HAL_OK)
+#define	ath_hal_setdiversity(_ah, _v) \
+	ath_hal_setcapability(_ah, HAL_CAP_DIVERSITY, 1, _v, NULL)
+#define	ath_hal_getdiag(_ah, _pv) \
+	(ath_hal_getcapability(_ah, HAL_CAP_DIAG, 0, _pv) == HAL_OK)
+#define	ath_hal_setdiag(_ah, _v) \
+	ath_hal_setcapability(_ah, HAL_CAP_DIAG, 0, _v, NULL)
+#define	ath_hal_getnumtxqueues(_ah, _pv) \
+	(ath_hal_getcapability(_ah, HAL_CAP_NUM_TXQUEUES, 0, _pv) == HAL_OK)
+#define	ath_hal_hasveol(_ah) \
+	(ath_hal_getcapability(_ah, HAL_CAP_VEOL, 0, NULL) == HAL_OK)
+#define	ath_hal_hastxpowlimit(_ah) \
+	(ath_hal_getcapability(_ah, HAL_CAP_TXPOW, 0, NULL) == HAL_OK)
+#define	ath_hal_settxpowlimit(_ah, _pow) \
+	((*(_ah)->ah_setTxPowerLimit)((_ah), (_pow)))
+#define	ath_hal_gettxpowlimit(_ah, _ppow) \
+	(ath_hal_getcapability(_ah, HAL_CAP_TXPOW, 1, _ppow) == HAL_OK)
+#define	ath_hal_getmaxtxpow(_ah, _ppow) \
+	(ath_hal_getcapability(_ah, HAL_CAP_TXPOW, 2, _ppow) == HAL_OK)
+#define	ath_hal_gettpscale(_ah, _scale) \
+	(ath_hal_getcapability(_ah, HAL_CAP_TXPOW, 3, _scale) == HAL_OK)
+#define	ath_hal_settpscale(_ah, _v) \
+	ath_hal_setcapability(_ah, HAL_CAP_TXPOW, 3, _v, NULL)
+#define	ath_hal_hastpc(_ah) \
+	(ath_hal_getcapability(_ah, HAL_CAP_TPC, 0, NULL) == HAL_OK)
+#define	ath_hal_gettpc(_ah) \
+	(ath_hal_getcapability(_ah, HAL_CAP_TPC, 1, NULL) == HAL_OK)
+#define	ath_hal_settpc(_ah, _v) \
+	ath_hal_setcapability(_ah, HAL_CAP_TPC, 1, _v, NULL)
+#define	ath_hal_hasbursting(_ah) \
+	(ath_hal_getcapability(_ah, HAL_CAP_BURST, 0, NULL) == HAL_OK)
 
-#define	ath_hal_setupbeacondesc(_ah, _ds, _opmode, _flen, _hlen, \
-		_rate, _antmode) \
-	((*(_ah)->ah_setupBeaconDesc)((_ah), (_ds), (_opmode), \
-		(_flen), (_hlen), (_rate), (_antmode)))
 #define	ath_hal_setuprxdesc(_ah, _ds, _size, _intreq) \
 	((*(_ah)->ah_setupRxDesc)((_ah), (_ds), (_size), (_intreq)))
 #define	ath_hal_rxprocdesc(_ah, _ds, _dspa, _dsnext) \
@@ -309,13 +455,22 @@ void	ath_intr(void *);
 	((*(_ah)->ah_setupTxDesc)((_ah), (_ds), (_plen), (_hlen), (_atype), \
 		(_txpow), (_txr0), (_txtr0), (_keyix), (_ant), \
 		(_flags), (_rtsrate), (_rtsdura)))
-#define	ath_hal_setupxtxdesc(_ah, _ds, _short, \
+#define	ath_hal_setupxtxdesc(_ah, _ds, \
 		_txr1, _txtr1, _txr2, _txtr2, _txr3, _txtr3) \
-	((*(_ah)->ah_setupXTxDesc)((_ah), (_ds), (_short), \
+	((*(_ah)->ah_setupXTxDesc)((_ah), (_ds), \
 		(_txr1), (_txtr1), (_txr2), (_txtr2), (_txr3), (_txtr3)))
-#define	ath_hal_filltxdesc(_ah, _ds, _l, _first, _last) \
-	((*(_ah)->ah_fillTxDesc)((_ah), (_ds), (_l), (_first), (_last)))
+#define	ath_hal_filltxdesc(_ah, _ds, _l, _first, _last, _ds0) \
+	((*(_ah)->ah_fillTxDesc)((_ah), (_ds), (_l), (_first), (_last), (_ds0)))
 #define	ath_hal_txprocdesc(_ah, _ds) \
 	((*(_ah)->ah_procTxDesc)((_ah), (_ds)))
+#define	ath_hal_updateCTSForBursting(_ah, _ds, _prevds, _prevdsWithCTS, \
+		_gatingds,  _txOpLimit, _ctsDuration) \
+	((*(_ah)->ah_updateCTSForBursting)((_ah), (_ds), (_prevds), \
+		(_prevdsWithCTS), (_gatingds), (_txOpLimit), (_ctsDuration)))
+
+#define ath_hal_gpioCfgOutput(_ah, _gpio) \
+        ((*(_ah)->ah_gpioCfgOutput)((_ah), (_gpio)))
+#define ath_hal_gpioset(_ah, _gpio, _b) \
+        ((*(_ah)->ah_gpioSet)((_ah), (_gpio), (_b)))
 
 #endif /* _DEV_ATH_ATHVAR_H */