+@@ -1106,10 +1121,8 @@ static void ath_tx_fill_desc(struct ath_
+ struct ath_txq *txq, int len)
+ {
+ struct ath_hw *ah = sc->sc_ah;
+- struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(bf->bf_mpdu);
+- struct ath_buf *bf_first = bf;
++ struct ath_buf *bf_first = NULL;
+ struct ath_tx_info info;
+- bool aggr = !!(bf->bf_state.bf_type & BUF_AGGR);
+
+ memset(&info, 0, sizeof(info));
+ info.is_first = true;
+@@ -1117,24 +1130,14 @@ static void ath_tx_fill_desc(struct ath_
+ info.txpower = MAX_RATE_POWER;
+ info.qcu = txq->axq_qnum;
+
+- info.flags = ATH9K_TXDESC_INTREQ;
+- if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
+- info.flags |= ATH9K_TXDESC_NOACK;
+- if (tx_info->flags & IEEE80211_TX_CTL_LDPC)
+- info.flags |= ATH9K_TXDESC_LDPC;
+-
+- ath_buf_set_rate(sc, bf, &info, len);
+-
+- if (tx_info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT)
+- info.flags |= ATH9K_TXDESC_CLRDMASK;
+-
+ if (bf->bf_state.bfs_paprd)
+ info.flags |= (u32) bf->bf_state.bfs_paprd << ATH9K_TXDESC_PAPRD_S;
+
+-
+ while (bf) {
+ struct sk_buff *skb = bf->bf_mpdu;
++ struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
+ struct ath_frame_info *fi = get_frame_info(skb);
++ bool aggr = !!(bf->bf_state.bf_type & BUF_AGGR);
+
+ info.type = get_hw_packet_type(skb);
+ if (bf->bf_next)
+@@ -1142,6 +1145,25 @@ static void ath_tx_fill_desc(struct ath_
+ else
+ info.link = 0;
+
++ if (!bf_first) {
++ bf_first = bf;
++
++ info.flags = ATH9K_TXDESC_INTREQ;
++ if ((tx_info->flags & IEEE80211_TX_CTL_CLEAR_PS_FILT) ||
++ txq == sc->tx.uapsdq)
++ info.flags |= ATH9K_TXDESC_CLRDMASK;
++
++ if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
++ info.flags |= ATH9K_TXDESC_NOACK;
++ if (tx_info->flags & IEEE80211_TX_CTL_LDPC)
++ info.flags |= ATH9K_TXDESC_LDPC;
++
++ ath_buf_set_rate(sc, bf, &info, len);
++
++ if (txq == sc->beacon.cabq)
++ sc->beacon.cabq_dur += info.rates[0].PktDuration;
++ }
++
+ info.buf_addr[0] = bf->bf_buf_addr;
+ info.buf_len[0] = skb->len;
+ info.pkt_len = fi->framelen;
+@@ -1151,7 +1173,7 @@ static void ath_tx_fill_desc(struct ath_
+ if (aggr) {
+ if (bf == bf_first)
+ info.aggr = AGGR_BUF_FIRST;
+- else if (!bf->bf_next)
++ else if (bf == bf_first->bf_lastbf)
+ info.aggr = AGGR_BUF_LAST;
+ else
+ info.aggr = AGGR_BUF_MIDDLE;
+@@ -1160,6 +1182,9 @@ static void ath_tx_fill_desc(struct ath_
+ info.aggr_len = len;
+ }
+
++ if (bf == bf_first->bf_lastbf)
++ bf_first = NULL;
++
+ ath9k_hw_set_txdesc(ah, bf->bf_desc, &info);
+ bf = bf->bf_next;
+ }
+@@ -1224,9 +1249,6 @@ int ath_tx_aggr_start(struct ath_softc *
+ an = (struct ath_node *)sta->drv_priv;
+ txtid = ATH_AN_2_TID(an, tid);
+
+- if (txtid->state & (AGGR_CLEANUP | AGGR_ADDBA_COMPLETE))
+- return -EAGAIN;
+-
+ /* update ampdu factor/density, they may have changed. This may happen
+ * in HT IBSS when a beacon with HT-info is received after the station
+ * has already been added.
+@@ -1238,7 +1260,7 @@ int ath_tx_aggr_start(struct ath_softc *
+ an->mpdudensity = density;
+ }
+
+- txtid->state |= AGGR_ADDBA_PROGRESS;
++ txtid->active = true;
+ txtid->paused = true;
+ *ssn = txtid->seq_start = txtid->seq_next;
+ txtid->bar_index = -1;
+@@ -1255,28 +1277,9 @@ void ath_tx_aggr_stop(struct ath_softc *
+ struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
+ struct ath_txq *txq = txtid->ac->txq;
+
+- if (txtid->state & AGGR_CLEANUP)
+- return;
+-
+- if (!(txtid->state & AGGR_ADDBA_COMPLETE)) {
+- txtid->state &= ~AGGR_ADDBA_PROGRESS;
+- return;
+- }
+-
+ ath_txq_lock(sc, txq);
++ txtid->active = false;
+ txtid->paused = true;
+-
+- /*
+- * If frames are still being transmitted for this TID, they will be
+- * cleaned up during tx completion. To prevent race conditions, this
+- * TID can only be reused after all in-progress subframes have been
+- * completed.
+- */
+- if (txtid->baw_head != txtid->baw_tail)
+- txtid->state |= AGGR_CLEANUP;
+- else
+- txtid->state &= ~AGGR_ADDBA_COMPLETE;
+-
+ ath_tx_flush_tid(sc, txtid);
+ ath_txq_unlock_complete(sc, txq);
+ }
+@@ -1342,18 +1345,92 @@ void ath_tx_aggr_wakeup(struct ath_softc
+ }
+ }
+
+-void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid)
++void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta,
++ u16 tidno)
+ {
+- struct ath_atx_tid *txtid;
++ struct ath_atx_tid *tid;
+ struct ath_node *an;
++ struct ath_txq *txq;
+
+ an = (struct ath_node *)sta->drv_priv;
++ tid = ATH_AN_2_TID(an, tidno);
++ txq = tid->ac->txq;
+
+- txtid = ATH_AN_2_TID(an, tid);
+- txtid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
+- txtid->state |= AGGR_ADDBA_COMPLETE;
+- txtid->state &= ~AGGR_ADDBA_PROGRESS;
+- ath_tx_resume_tid(sc, txtid);
++ ath_txq_lock(sc, txq);
++
++ tid->baw_size = IEEE80211_MIN_AMPDU_BUF << sta->ht_cap.ampdu_factor;
++ tid->paused = false;
++
++ if (!skb_queue_empty(&tid->buf_q)) {
++ ath_tx_queue_tid(txq, tid);
++ ath_txq_schedule(sc, txq);
++ }
++
++ ath_txq_unlock_complete(sc, txq);
++}
++
++void ath9k_release_buffered_frames(struct ieee80211_hw *hw,
++ struct ieee80211_sta *sta,
++ u16 tids, int nframes,
++ enum ieee80211_frame_release_type reason,
++ bool more_data)
++{
++ struct ath_softc *sc = hw->priv;
++ struct ath_node *an = (struct ath_node *)sta->drv_priv;
++ struct ath_txq *txq = sc->tx.uapsdq;
++ struct ieee80211_tx_info *info;
++ struct list_head bf_q;
++ struct ath_buf *bf_tail = NULL, *bf;
++ int sent = 0;
++ int i;
++
++ INIT_LIST_HEAD(&bf_q);
++ for (i = 0; tids && nframes; i++, tids >>= 1) {
++ struct ath_atx_tid *tid;
++
++ if (!(tids & 1))
++ continue;
++
++ tid = ATH_AN_2_TID(an, i);
++ if (tid->paused)
++ continue;
++
++ ath_txq_lock(sc, tid->ac->txq);
++ while (!skb_queue_empty(&tid->buf_q) && nframes > 0) {
++ bf = ath_tx_get_tid_subframe(sc, sc->tx.uapsdq, tid);
++ if (!bf)
++ break;
++
++ __skb_unlink(bf->bf_mpdu, &tid->buf_q);
++ list_add_tail(&bf->list, &bf_q);
++ ath_set_rates(tid->an->vif, tid->an->sta, bf);
++ ath_tx_addto_baw(sc, tid, bf->bf_state.seqno);
++ bf->bf_state.bf_type &= ~BUF_AGGR;
++ if (bf_tail)
++ bf_tail->bf_next = bf;
++
++ bf_tail = bf;
++ nframes--;
++ sent++;
++ TX_STAT_INC(txq->axq_qnum, a_queued_hw);
++
++ if (skb_queue_empty(&tid->buf_q))
++ ieee80211_sta_set_buffered(an->sta, i, false);
++ }
++ ath_txq_unlock_complete(sc, tid->ac->txq);
++ }
++
++ if (list_empty(&bf_q))
++ return;
++
++ info = IEEE80211_SKB_CB(bf_tail->bf_mpdu);
++ info->flags |= IEEE80211_TX_STATUS_EOSP;
++
++ bf = list_first_entry(&bf_q, struct ath_buf, list);
++ ath_txq_lock(sc, txq);
++ ath_tx_fill_desc(sc, bf, txq, 0);
++ ath_tx_txqaddbuf(sc, txq, &bf_q, false);
++ ath_txq_unlock(sc, txq);
+ }
+
+ /********************/
+@@ -1709,8 +1786,9 @@ static void ath_tx_txqaddbuf(struct ath_
+ }
+ }
+
+-static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_atx_tid *tid,
+- struct sk_buff *skb, struct ath_tx_control *txctl)
++static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_txq *txq,
++ struct ath_atx_tid *tid, struct sk_buff *skb,
++ struct ath_tx_control *txctl)
+ {
+ struct ath_frame_info *fi = get_frame_info(skb);
+ struct list_head bf_head;
+@@ -1723,26 +1801,28 @@ static void ath_tx_send_ampdu(struct ath
+ * - seqno is not within block-ack window
+ * - h/w queue depth exceeds low water mark
+ */
+- if (!skb_queue_empty(&tid->buf_q) || tid->paused ||
+- !BAW_WITHIN(tid->seq_start, tid->baw_size, tid->seq_next) ||
+- txctl->txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) {
++ if ((!skb_queue_empty(&tid->buf_q) || tid->paused ||
++ !BAW_WITHIN(tid->seq_start, tid->baw_size, tid->seq_next) ||
++ txq->axq_ampdu_depth >= ATH_AGGR_MIN_QDEPTH) &&
++ txq != sc->tx.uapsdq) {
+ /*
+ * Add this frame to software queue for scheduling later
+ * for aggregation.
+ */
+- TX_STAT_INC(txctl->txq->axq_qnum, a_queued_sw);
++ TX_STAT_INC(txq->axq_qnum, a_queued_sw);
+ __skb_queue_tail(&tid->buf_q, skb);
+ if (!txctl->an || !txctl->an->sleeping)
+- ath_tx_queue_tid(txctl->txq, tid);
++ ath_tx_queue_tid(txq, tid);
+ return;
+ }
+
+- bf = ath_tx_setup_buffer(sc, txctl->txq, tid, skb);
++ bf = ath_tx_setup_buffer(sc, txq, tid, skb);
+ if (!bf) {
+ ieee80211_free_txskb(sc->hw, skb);