Index: sys/mips/atheros/ar71xxreg.h
===================================================================
--- sys/mips/atheros/ar71xxreg.h	(revision 362824)
+++ sys/mips/atheros/ar71xxreg.h	(working copy)
@@ -515,6 +515,12 @@
 #define			DMA_INTR_TX_UNDERRUN		(1 << 1)
 #define			DMA_INTR_TX_PKT_SENT		(1 << 0)
 
+/* This is implemented in at least AR7240 */
+#define		AR71XX_DMA_ETH_FREE_TIMER	0x1B8
+#define		AR71XX_DMA_ETH_FREE_TIMER_MASK	0x0001ffff
+/* Note: 0 = update at AHB_CLK; 1 = update at AHB_CLK/4 */
+#define		AR71XX_DMA_ETH_FREE_TIMER_UPDATE	(1 << 31)
+
 #define	AR71XX_SPI_BASE	0x1f000000
 #define		AR71XX_SPI_FS		0x00
 #define		AR71XX_SPI_CTRL		0x04
Index: sys/mips/atheros/if_arge.c
===================================================================
--- sys/mips/atheros/if_arge.c	(revision 362824)
+++ sys/mips/atheros/if_arge.c	(working copy)
@@ -725,6 +725,11 @@
 	}
 
 	/*
+	 * XXX TODO: AR7240 at least has a hardware timestamp available for
+	 * each MAC; maybe we should include support for it!
+	 */
+
+	/*
 	 * Some units (eg the TP-Link WR-1043ND) do not have a convenient
 	 * EEPROM location to read the ethernet MAC address from.
 	 * OpenWRT simply snaffles it from a fixed location.
@@ -2653,6 +2658,8 @@
 
 	if (status & DMA_INTR_TX_PKT_SENT)
 		arge_tx_locked(sc);
+
+#if 1
 	/*
 	 * Underrun turns off TX. Clear underrun indication.
 	 * If there's anything left in the ring, reactivate the tx.
@@ -2667,6 +2674,7 @@
 			    DMA_TX_CONTROL_EN);
 		}
 	}
+#endif
 
 	/*
 	 * If we've finished RX /or/ TX and there's space for more packets
Index: sys/mips/conf/AR71XX_BASE
===================================================================
--- sys/mips/conf/AR71XX_BASE	(revision 362824)
+++ sys/mips/conf/AR71XX_BASE	(working copy)
@@ -27,8 +27,8 @@
 
 options 	SCHED_4BSD		#4BSD scheduler
 options 	INET			#InterNETworking
-options 	INET6			# IPv6
-options 	TCP_HHOOK		# hhook(9) framework for TCP
+#options 	INET6			# IPv6
+#options 	TCP_HHOOK		# hhook(9) framework for TCP
 
 # options 	NFSCL		#Network Filesystem Client
 
@@ -37,12 +37,12 @@
 
 # options 	NFS_LEGACYRPC
 # Debugging for use in -current
-options 	INVARIANTS
-options 	INVARIANT_SUPPORT
-options 	WITNESS
-options 	WITNESS_SKIPSPIN
-options 	DEBUG_REDZONE
-options 	DEBUG_MEMGUARD
+#options 	INVARIANTS
+#options 	INVARIANT_SUPPORT
+#options 	WITNESS
+#options 	WITNESS_SKIPSPIN
+#options 	DEBUG_REDZONE
+#options 	DEBUG_MEMGUARD
 
 options         FFS                     #Berkeley Fast Filesystem
 # options         SOFTUPDATES             #Enable FFS soft updates support
@@ -56,12 +56,12 @@
 device		pci
 device		ar71xx_pci
 
-device		usb
-device		ehci
+#device		usb
+#device		ehci
 
-device		scbus
-device		umass
-device		da
+#device		scbus
+#device		umass
+#device		da
 
 device		uart_ar71xx
 device		ar71xx_apb
Index: sys/mips/conf/std.AR5312
===================================================================
--- sys/mips/conf/std.AR5312	(revision 362824)
+++ sys/mips/conf/std.AR5312	(working copy)
@@ -43,12 +43,12 @@
 
 # options 	NFS_LEGACYRPC
 # Debugging for use in -current
-options 	INVARIANTS
-options 	INVARIANT_SUPPORT
-options 	WITNESS
-options 	WITNESS_SKIPSPIN
-options 	DEBUG_REDZONE
-options 	DEBUG_MEMGUARD
+#options 	INVARIANTS
+#options 	INVARIANT_SUPPORT
+#options 	WITNESS
+#options 	WITNESS_SKIPSPIN
+##options 	DEBUG_REDZONE
+##options 	DEBUG_MEMGUARD
 
 options         FFS                     #Berkeley Fast Filesystem
 # options         SOFTUPDATES             #Enable FFS soft updates support
Index: sys/modules/wlan/Makefile
===================================================================
--- sys/modules/wlan/Makefile	(revision 362824)
+++ sys/modules/wlan/Makefile	(working copy)
@@ -13,6 +13,7 @@
 	ieee80211_ht.c ieee80211_hwmp.c ieee80211_adhoc.c ieee80211_hostap.c \
 	ieee80211_monitor.c ieee80211_sta.c ieee80211_wds.c ieee80211_ddb.c \
 	ieee80211_tdma.c ieee80211_superg.c ieee80211_vht.c
+# SRCS+=	ieee80211_task.c
 SRCS+=	bus_if.h device_if.h opt_ddb.h opt_inet.h opt_inet6.h \
 	opt_tdma.h opt_wlan.h
 
Index: sys/net80211/ieee80211.c
===================================================================
--- sys/net80211/ieee80211.c	(revision 362824)
+++ sys/net80211/ieee80211.c	(working copy)
@@ -1246,9 +1246,10 @@
 		return (ENOBUFS);
 
 #if 0
-	printf("%s: %d: ieee=%d, freq=%d, flags=0x%08x\n",
+	printf("%s: %d: maxchans %d, ieee=%d, freq=%d, flags=0x%08x\n",
 	    __func__,
 	    *nchans,
+	    maxchans,
 	    ieee,
 	    freq,
 	    flags);
@@ -1280,9 +1281,10 @@
 		return (ENOBUFS);
 
 #if 0
-	printf("%s: %d: flags=0x%08x\n",
+	printf("%s: %d: maxchans %d: flags=0x%08x\n",
 	    __func__,
 	    *nchans,
+	    maxchans,
 	    flags);
 #endif
 
@@ -1410,6 +1412,8 @@
 
 	error = addchan(chans, maxchans, nchans, ieee, freq, maxregpower,
 	    flags[0] | chan_flags);
+	if (error != 0)
+		return (error);
 	for (i = 1; flags[i] != 0 && error == 0; i++) {
 		error = copychan_prev(chans, maxchans, nchans,
 		    flags[i] | chan_flags);
Index: sys/net80211/ieee80211_crypto_ccmp.c
===================================================================
--- sys/net80211/ieee80211_crypto_ccmp.c	(revision 362824)
+++ sys/net80211/ieee80211_crypto_ccmp.c	(working copy)
@@ -302,6 +302,10 @@
 
 	/*
 	 * Ok to update rsc now.
+	 *
+	 * XXX Note - for AMSDU driver/hardware decaped frames they will have
+	 * the same PN (or none? Should check) so we should skip bumping the
+	 * PN.
 	 */
 	if (! ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_IV_STRIP))) {
 		k->wk_keyrsc[tid] = pn;
Index: sys/net80211/ieee80211_crypto_tkip.c
===================================================================
--- sys/net80211/ieee80211_crypto_tkip.c	(revision 362824)
+++ sys/net80211/ieee80211_crypto_tkip.c	(working copy)
@@ -441,6 +441,11 @@
 	 * Ok to update rsc now that MIC has been verified.
 	 */
 	tid = ieee80211_gettid(wh);
+
+	/*
+	 * Note - check CCMP comment - don't do this for sub-frames of
+	 * a decap'd AMSDU frame from driver/hardware.
+	 */
 	k->wk_keyrsc[tid] = ctx->rx_rsc;
 
 finish:
Index: sys/net80211/ieee80211_ioctl.c
===================================================================
--- sys/net80211/ieee80211_ioctl.c	(revision 362824)
+++ sys/net80211/ieee80211_ioctl.c	(working copy)
@@ -715,8 +715,14 @@
 	dc->dc_vhtcaps = ic->ic_vhtcaps;
 	ci = &dc->dc_chaninfo;
 	ic->ic_getradiocaps(ic, maxchans, &ci->ic_nchans, ci->ic_chans);
+
+	/*
+	 * XXX TODO: this assertion is wrong; we should warn and error out
+	 * as maxchans comes from userland!
+	 */
 	KASSERT(ci->ic_nchans <= maxchans,
 	    ("nchans %d maxchans %d", ci->ic_nchans, maxchans));
+
 	ieee80211_sort_channels(ci->ic_chans, ci->ic_nchans);
 	error = copyout(dc, ireq->i_data, IEEE80211_DEVCAPS_SPACE(dc));
 	IEEE80211_FREE(dc, M_TEMP);
Index: tools/tools/ath/athstats/athstats.c
===================================================================
--- tools/tools/ath/athstats/athstats.c	(revision 362824)
+++ tools/tools/ath/athstats/athstats.c	(working copy)
@@ -677,7 +677,8 @@
 	case S_ANI_STEP:	ANI(firstepLevel);
 	case S_ANI_OFDM:	ANI(ofdmWeakSigDetectOff);
 	case S_ANI_CCK:		ANI(cckWeakSigThreshold);
-	case S_ANI_LISTEN:	ANI(listenTime);
+//	case S_ANI_LISTEN:	ANI(listenTime);
+	case S_ANI_LISTEN:	ANISTAT(ltime);
 	case S_ANI_NIUP:	ANISTAT(niup);
 	case S_ANI_NIDOWN:	ANISTAT(nidown);
 	case S_ANI_SIUP:	ANISTAT(spurup);
Index: tools/tools/net80211/wlanstats/wlanstats.c
===================================================================
--- tools/tools/net80211/wlanstats/wlanstats.c	(revision 362824)
+++ tools/tools/net80211/wlanstats/wlanstats.c	(working copy)
@@ -276,11 +276,21 @@
 	{ 8,  "amsdu_decap",	"decap",	"A-MSDU frames received" },
 #define	S_AMSDU_ENCAP		AFTER(S_AMSDU_DECAP)
 	{ 8,  "amsdu_encap",	"encap",	"A-MSDU frames transmitted" },
+<<<<<<< .mine
+#define	S_RX_AMSDU_MORE		AFTER(S_AMSDU_ENCAP)
+	{ 5,  "rx_amsdu_more",	"more",	"A-MSDU frames driver/hardware decap'ed, more coming" },
+#define	S_RX_AMSDU_MORE_END		AFTER(S_RX_AMSDU_MORE)
+	{ 9,  "rx_amsdu_more_end",	"more_end",	"A-MSDU frames driver/hardware decap'ed, end of list" },
+#define	S_AMPDU_REORDER		AFTER(S_RX_AMSDU_MORE_END)
+||||||| .r358490
+#define	S_AMPDU_REORDER		AFTER(S_AMSDU_ENCAP)
+=======
 #define	S_AMSDU_RX_MORE		AFTER(S_AMSDU_ENCAP)
 	{ 13,  "rx_amsdu_more",	"rx_amsdu_more",	"A-MSDU HW intermediary decap'ed received" },
 #define	S_AMSDU_RX_MORE_END		AFTER(S_AMSDU_RX_MORE)
 	{ 17,  "rx_amsdu_more_end",	"rx_amsdu_more_end",	"A-MSDU HW end decap'ed received" },
 #define	S_AMPDU_REORDER		AFTER(S_AMSDU_RX_MORE_END)
+>>>>>>> .r362819
 	{ 8,  "ampdu_reorder",	"reorder","A-MPDU frames held in reorder q" },
 #define	S_AMPDU_FLUSH		AFTER(S_AMPDU_REORDER)
 	{ 8,  "ampdu_flush",	"flush",	"A-MPDU frames sent up from reorder q" },
@@ -782,8 +792,14 @@
 	case S_AMSDU_SPLIT:	STAT(amsdu_split);
 	case S_AMSDU_DECAP:	STAT(amsdu_decap);
 	case S_AMSDU_ENCAP:	STAT(amsdu_encap);
+<<<<<<< .mine
+	case S_RX_AMSDU_MORE:	NSTAT(rx_amsdu_more);
+	case S_RX_AMSDU_MORE_END:NSTAT(rx_amsdu_more_end);
+||||||| .r358490
+=======
 	case S_AMSDU_RX_MORE:	NSTAT(rx_amsdu_more);
 	case S_AMSDU_RX_MORE_END:	NSTAT(rx_amsdu_more_end);
+>>>>>>> .r362819
 	case S_AMPDU_REORDER:	STAT(ampdu_rx_reorder);
 	case S_AMPDU_FLUSH:	STAT(ampdu_rx_flush);
 	case S_AMPDU_BARBAD:	STAT(ampdu_bar_bad);
@@ -947,8 +963,14 @@
 	case S_AMSDU_SPLIT:	STAT(amsdu_split);
 	case S_AMSDU_DECAP:	STAT(amsdu_decap);
 	case S_AMSDU_ENCAP:	STAT(amsdu_encap);
+<<<<<<< .mine
+	case S_RX_AMSDU_MORE:	NSTAT(rx_amsdu_more);
+	case S_RX_AMSDU_MORE_END:NSTAT(rx_amsdu_more_end);
+||||||| .r358490
+=======
 	case S_AMSDU_RX_MORE:	NSTAT(rx_amsdu_more);
 	case S_AMSDU_RX_MORE_END:	NSTAT(rx_amsdu_more_end);
+>>>>>>> .r362819
 	case S_AMPDU_REORDER:	STAT(ampdu_rx_reorder);
 	case S_AMPDU_FLUSH:	STAT(ampdu_rx_flush);
 	case S_AMPDU_BARBAD:	STAT(ampdu_bar_bad);