scb_ampdu->release = min_t(u8, scb_ampdu->max_pdu, AMPDU_SCB_MAX_RELEASE);
 
-       if (scb_ampdu->max_rxlen)
-               scb_ampdu->release =
-                   min_t(u8, scb_ampdu->release, scb_ampdu->max_rxlen / 1600);
+       if (scb_ampdu->max_rx_ampdu_bytes)
+               scb_ampdu->release = min_t(u8, scb_ampdu->release,
+                       scb_ampdu->max_rx_ampdu_bytes / 1600);
 
        scb_ampdu->release = min(scb_ampdu->release,
                                 ampdu->fifo_tb[TX_AC_BE_FIFO].
 
 void
 brcms_c_ampdu_tx_operational(struct brcms_c_info *wlc, u8 tid,
-                 u8 ba_wsize)          /* negotiated ba window size (in pdu) */
+       u8 ba_wsize,            /* negotiated ba window size (in pdu) */
+       uint max_rx_ampdu_bytes) /* from ht_cap in beacon */
 {
        scb_ampdu_t *scb_ampdu;
        scb_ampdu_tid_ini_t *ini;
        ini->tid = tid;
        ini->scb = scb_ampdu->scb;
        ini->ba_wsize = ba_wsize;
+       scb_ampdu->max_rx_ampdu_bytes = max_rx_ampdu_bytes;
 }
 
 int
        bool rr = true, fbr = false;
        uint i, count = 0, fifo, seg_cnt = 0;
        u16 plen, len, seq = 0, mcl, mch, index, frameid, dma_len = 0;
-       u32 ampdu_len, maxlen = 0;
+       u32 ampdu_len, max_ampdu_bytes = 0;
        d11txh_t *txh = NULL;
        u8 *plcp;
        struct ieee80211_hdr *h;
                        is40 = (plcp0 & MIMO_PLCP_40MHZ) ? 1 : 0;
                        sgi = PLCP3_ISSGI(plcp3) ? 1 : 0;
                        mcs = plcp0 & ~MIMO_PLCP_40MHZ;
-                       maxlen =
-                           min(scb_ampdu->max_rxlen,
+                       max_ampdu_bytes =
+                           min(scb_ampdu->max_rx_ampdu_bytes,
                                ampdu->max_txlen[mcs][is40][sgi]);
 
-                       /* XXX Fix me to honor real max_rxlen */
-                       /* can fix this as soon as ampdu_action() in mac80211.h
-                        * gets extra u8buf_size par */
-                       maxlen = 64 * 1024;
-
                        if (is40)
                                mimo_ctlchbw =
                                    CHSPEC_SB_UPPER(WLC_BAND_PI_RADIO_CHANSPEC)
                                       AMPDU_MAX_MPDU_OVERHEAD;
                                plen = max(scb_ampdu->min_len, plen);
 
-                               if ((plen + ampdu_len) > maxlen) {
+                               if ((plen + ampdu_len) > max_ampdu_bytes) {
                                        p = NULL;
-                                       wiphy_err(wiphy, "%s: Bogus plen #1\n",
-                                               __func__);
                                        continue;
                                }
 
 
                /*
                 * BA window size from ADDBA response ('buf_size') defines how
                 * many outstanding MPDUs are allowed for the BA stream by
-                * recipient and traffic class.
+                * recipient and traffic class. 'ampdu_factor' gives maximum
+                * AMPDU size.
                 */
                LOCK(wl);
-               brcms_c_ampdu_tx_operational(wl->wlc, tid, buf_size);
+               brcms_c_ampdu_tx_operational(wl->wlc, tid, buf_size,
+                       (1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
+                        sta->ht_cap.ampdu_factor)) - 1);
                UNLOCK(wl);
                /* Power save wakeup */
                break;
 
 extern void brcms_c_ampdu_flush(struct brcms_c_info *wlc,
                            struct ieee80211_sta *sta, u16 tid);
 extern void brcms_c_ampdu_tx_operational(struct brcms_c_info *wlc, u8 tid,
-                                        u8 ba_wsize);
+                                        u8 ba_wsize, uint max_rx_ampdu_bytes);
 extern int brcms_c_set_par(struct brcms_c_info *wlc, enum wlc_par_id par_id,
                           int val);
 extern int brcms_c_get_par(struct brcms_c_info *wlc, enum wlc_par_id par_id,
 
        u8 max_pdu;             /* max pdus allowed in ampdu */
        u8 release;             /* # of mpdus released at a time */
        u16 min_len;            /* min mpdu len to support the density */
-       u32 max_rxlen;  /* max ampdu rcv length; 8k, 16k, 32k, 64k */
+       u32 max_rx_ampdu_bytes; /* max ampdu rcv length; 8k, 16k, 32k, 64k */
        struct pktq txq;        /* sdu transmit queue pending aggregation */
 
        /* This could easily be a ini[] pointer and we keep this info in wl itself instead