Index: net80211/ieee80211_node.c
===================================================================
--- net80211/ieee80211_node.c	(revision 220181)
+++ net80211/ieee80211_node.c	(working copy)
@@ -1085,7 +1085,26 @@
 node_getmimoinfo(const struct ieee80211_node *ni,
 	struct ieee80211_mimo_info *info)
 {
-	/* XXX zero data? */
+	int i;
+	uint32_t avgrssi;
+	int32_t rssi;
+
+	bzero(info, sizeof(*info));
+
+	for (i = 0; i < ni->ni_mimo_chains; i++) {
+		avgrssi = ni->ni_mimo_rssi_ctl[i];
+		if (avgrssi == IEEE80211_RSSI_DUMMY_MARKER) {
+			info->rssi[i] = 0;
+		} else {
+			rssi = IEEE80211_RSSI_GET(avgrssi);
+			info->rssi[i] = rssi < 0 ? 0 : rssi > 127 ? 127 : rssi;
+		}
+		info->noise[i] = ni->ni_mimo_noise_ctl[i];
+	}
+
+	/* XXX ext radios? */
+
+	/* XXX EVM? */
 }
 
 struct ieee80211_node *
Index: net80211/ieee80211_node.h
===================================================================
--- net80211/ieee80211_node.h	(revision 220181)
+++ net80211/ieee80211_node.h	(working copy)
@@ -166,6 +166,13 @@
 	uint32_t		ni_avgrssi;	/* recv ssi state */
 	int8_t			ni_noise;	/* noise floor */
 
+	/* mimo statistics */
+	uint32_t		ni_mimo_rssi_ctl[IEEE80211_MAX_CHAINS];
+	uint32_t		ni_mimo_rssi_ext[IEEE80211_MAX_CHAINS];
+	uint8_t			ni_mimo_noise_ctl[IEEE80211_MAX_CHAINS];
+	uint8_t			ni_mimo_noise_ext[IEEE80211_MAX_CHAINS];
+	uint8_t			ni_mimo_chains;
+
 	/* header */
 	uint8_t			ni_macaddr[IEEE80211_ADDR_LEN];
 	uint8_t			ni_bssid[IEEE80211_ADDR_LEN];
Index: net80211/_ieee80211.h
===================================================================
--- net80211/_ieee80211.h	(revision 220181)
+++ net80211/_ieee80211.h	(working copy)
@@ -387,9 +387,16 @@
 /*
  * MIMO antenna/radio state.
  */
+
+#define	IEEE80211_MAX_CHAINS		3
+#define	IEEE80211_MAX_EVM_PILOTS	6
+
+/*
+ * XXX This doesn't yet export both ctl/ext chain details
+ */
 struct ieee80211_mimo_info {
-	int8_t		rssi[3];	/* per-antenna rssi */
-	int8_t		noise[3];	/* per-antenna noise floor */
+	int8_t		rssi[IEEE80211_MAX_CHAINS];	/* per-antenna rssi */
+	int8_t		noise[IEEE80211_MAX_CHAINS];	/* per-antenna noise floor */
 	uint8_t		pad[2];
 	uint32_t	evm[3];		/* EVM data */
 };
Index: net80211/ieee80211_input.c
===================================================================
--- net80211/ieee80211_input.c	(revision 220181)
+++ net80211/ieee80211_input.c	(working copy)
@@ -57,9 +57,54 @@
 #include <net/ethernet.h>
 #endif
 
+static void
+ieee80211_process_mimo(struct ieee80211_node *ni, struct ieee80211_rx_stats *rx)
+{
+	int i;
+
+	/* Verify the required MIMO bits are set */
+	if ((rx->r_flags & (IEEE80211_R_C_CHAIN | IEEE80211_R_C_NF | IEEE80211_R_C_RSSI)) !=
+	    (IEEE80211_R_C_CHAIN | IEEE80211_R_C_NF | IEEE80211_R_C_RSSI))
+		return;
+
+	/* XXX This assumes the MIMO radios have both ctl and ext chains */
+	for (i = 0; i < MIN(rx->c_chain, IEEE80211_MAX_CHAINS); i++) {
+		IEEE80211_RSSI_LPF(ni->ni_mimo_rssi_ctl[i], rx->c_rssi_ctl[i]);
+		IEEE80211_RSSI_LPF(ni->ni_mimo_rssi_ext[i], rx->c_rssi_ext[i]);
+	}
+
+	/* XXX This also assumes the MIMO radios have both ctl and ext chains */
+	for(i = 0; i < MIN(rx->c_chain, IEEE80211_MAX_CHAINS); i++) {
+		ni->ni_mimo_noise_ctl[i] = rx->c_nf_ctl[i];
+		ni->ni_mimo_noise_ext[i] = rx->c_nf_ext[i];
+	}
+	ni->ni_mimo_chains = rx->c_chain;
+}
+
 int
+ieee80211_input_mimo(struct ieee80211_node *ni, struct mbuf *m,
+    struct ieee80211_rx_stats *rx)
+{
+	/* XXX should assert IEEE80211_R_NF and IEEE80211_R_RSSI are set */
+	ieee80211_process_mimo(ni, rx);
+	return ieee80211_input(ni, m, rx->rssi, rx->nf);
+}
+
+int
 ieee80211_input_all(struct ieee80211com *ic, struct mbuf *m, int rssi, int nf)
 {
+	struct ieee80211_rx_stats rx;
+
+	rx.r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
+	rx.nf = nf;
+	rx.rssi = rssi;
+	return ieee80211_input_mimo_all(ic, m, &rx);
+}
+
+int
+ieee80211_input_mimo_all(struct ieee80211com *ic, struct mbuf *m,
+    struct ieee80211_rx_stats *rx)
+{
 	struct ieee80211vap *vap;
 	int type = -1;
 
@@ -96,7 +141,7 @@
 			m = NULL;
 		}
 		ni = ieee80211_ref_node(vap->iv_bss);
-		type = ieee80211_input(ni, mcopy, rssi, nf);
+		type = ieee80211_input_mimo(ni, mcopy, rx);
 		ieee80211_free_node(ni);
 	}
 	if (m != NULL)			/* no vaps, reclaim mbuf */
Index: net80211/ieee80211_proto.h
===================================================================
--- net80211/ieee80211_proto.h	(revision 220181)
+++ net80211/ieee80211_proto.h	(working copy)
@@ -61,9 +61,36 @@
 void	ieee80211_syncflag_ht(struct ieee80211vap *, int flag);
 void	ieee80211_syncflag_ext(struct ieee80211vap *, int flag);
 
+#define	IEEE80211_R_NF		0x0000001	/* global NF value valid */
+#define	IEEE80211_R_RSSI	0x0000002	/* global RSSI value valid */
+#define	IEEE80211_R_C_CHAIN	0x0000004	/* RX chain count valid */
+#define	IEEE80211_R_C_NF	0x0000008	/* per-chain NF value valid */
+#define	IEEE80211_R_C_RSSI	0x0000010	/* per-chain RSSI value valid */
+#define	IEEE80211_R_C_EVM	0x0000020	/* per-chain EVM valid */
+#define	IEEE80211_R_C_HT40	0x0000040	/* RX'ed packet is 40mhz, pilots 4,5 valid */
+
+struct ieee80211_rx_stats {
+	uint32_t r_flags;		/* IEEE80211_R_* flags */
+	uint8_t c_chain;		/* number of RX chains involved */
+	int16_t	c_nf_ctl[IEEE80211_MAX_CHAINS];	/* per-chain NF */
+	int16_t	c_nf_ext[IEEE80211_MAX_CHAINS];	/* per-chain NF */
+	int16_t	c_rssi_ctl[IEEE80211_MAX_CHAINS];	/* per-chain RSSI */
+	int16_t	c_rssi_ext[IEEE80211_MAX_CHAINS];	/* per-chain RSSI */
+	uint8_t nf;			/* global NF */
+	uint8_t rssi;			/* global RSSI */
+	uint8_t evm[IEEE80211_MAX_CHAINS][IEEE80211_MAX_EVM_PILOTS];
+					/* per-chain, per-pilot EVM values */
+};
+
 #define	ieee80211_input(ni, m, rssi, nf) \
 	((ni)->ni_vap->iv_input(ni, m, rssi, nf))
 int	ieee80211_input_all(struct ieee80211com *, struct mbuf *, int, int);
+
+int	ieee80211_input_mimo(struct ieee80211_node *, struct mbuf *,
+	    struct ieee80211_rx_stats *);
+int	ieee80211_input_mimo_all(struct ieee80211com *, struct mbuf *,
+	    struct ieee80211_rx_stats *);
+
 struct ieee80211_bpf_params;
 int	ieee80211_mgmt_output(struct ieee80211_node *, struct mbuf *, int,
 		struct ieee80211_bpf_params *);
Index: dev/ath/if_ath.c
===================================================================
--- dev/ath/if_ath.c	(revision 220360)
+++ dev/ath/if_ath.c	(working copy)
@@ -3323,12 +3323,25 @@
 	HAL_STATUS status;
 	int16_t nf;
 	u_int64_t tsf;
+	struct ieee80211_rx_stats rxs;
 
 	DPRINTF(sc, ATH_DEBUG_RX_PROC, "%s: pending %u\n", __func__, npending);
 	ngood = 0;
 	nf = ath_hal_getchannoise(ah, sc->sc_curchan);
 	sc->sc_stats.ast_rx_noise = nf;
 	tsf = ath_hal_gettsf64(ah);
+
+	/* Set these once */
+	rxs.r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
+	rxs.nf = nf;
+#ifdef	ATH_ENABLE_11N
+	if (ic->ic_htcaps & IEEE80211_HTC_HT) {
+		rxs.r_flags |= IEEE80211_R_C_CHAIN | IEEE80211_R_C_NF | IEEE80211_R_C_RSSI;
+		rxs.c_chain = 3;	/* XXX Not at all true! */
+		/* XXX should ensure IEEE80211_MAX_CHAINS >= AH_MIMO_MAX_CHAINS */
+		(void) ath_hal_get_mimo_chan_noise(ah, sc->sc_curchan, rxs.c_nf_ctl, rxs.c_nf_ext);
+	}
+#endif
 	do {
 		bf = STAILQ_FIRST(&sc->sc_rxbuf);
 		if (sc->sc_rxslink && bf == NULL) {	/* NB: shouldn't happen */
@@ -3574,6 +3587,24 @@
 		if (rs->rs_isaggr)
 			sc->sc_stats.ast_rx_agg++;
 
+		/* Set basic RX statistics */
+		rxs.r_flags |= IEEE80211_R_RSSI;
+		rxs.rssi = rs->rs_rssi;
+
+#ifdef	ATH_ENABLE_11N
+		/* Set MIMO statistics if the radio is MIMO */
+		if (ic->ic_htcaps & IEEE80211_HTC_HT) {
+			/* MIMO radio? Add MIMO NF/RSSI */
+			int i;
+			for (i = 0; i < 3; i++) {
+				rxs.c_rssi_ctl[i] = rs->rs_rssi_ctl[i];
+				rxs.c_rssi_ext[i] = rs->rs_rssi_ext[i];
+			}
+			/* XXX HT/40 packet? Set that appropriately */
+			/* XXX MIMO radio? Add EVM, translate ath format to net80211 format? */
+		}
+#endif
+
 		if (ni != NULL) {
 			/*
  			 * Only punt packets for ampdu reorder processing for 11n nodes;
@@ -3585,7 +3616,7 @@
 			/*
 			 * Sending station is known, dispatch directly.
 			 */
-			type = ieee80211_input(ni, m, rs->rs_rssi, nf);
+			type = ieee80211_input_mimo(ni, m, &rxs);
 			ieee80211_free_node(ni);
 			/*
 			 * Arrange to update the last rx timestamp only for
@@ -3597,7 +3628,7 @@
 			    rs->rs_keyix != HAL_RXKEYIX_INVALID)
 				ngood++;
 		} else {
-			type = ieee80211_input_all(ic, m, rs->rs_rssi, nf);
+			type = ieee80211_input_mimo_all(ic, m, &rxs);
 		}
 		/*
 		 * Track rx rssi and do any rx antenna management.