Import Kevin Lo's port of urtwn(4) from OpenBSD. urtwn(4) is a driver for the

Realtek RTL8188CU/RTL8192CU USB IEEE 802.11b/g/n wireless cards. This driver requires microcode which is available in FreeBSD ports: net/urtwn-firmware-kmod. Hiren ported the urtwn(4) man page from OpenBSD and Glen just commited a port for the firmware. TODO: - 802.11n support - Stability fixes - the driver can sustain lots of traffic but has trouble coping with simultaneous iperf sessions. - fix debugging MFC after: 2 months Tested by: kevlo, hiren, gjb
author: rpaulo <rpaulo@FreeBSD.org> 2013-06-08 16:02:31 +0000
committer: rpaulo <rpaulo@FreeBSD.org> 2013-06-08 16:02:31 +0000
commit: 8f36fe887a99fd6fe01305dac04d9a90a856d40a (patch)
tree: 43c6844c1ee3be1cfbce0283d7b2042e64145bcb
parent: a1d0d1236720cbb9ff6a9548a27707ddd4dd1507 (diff)
download: FreeBSD-src-8f36fe887a99fd6fe01305dac04d9a90a856d40a.zip
FreeBSD-src-8f36fe887a99fd6fe01305dac04d9a90a856d40a.tar.gz
9 files changed, 5132 insertions, 1 deletions
diff --git a/share/man/man4/Makefile b/share/man/man4/Makefile
index 98d88e6..0c2ecad 100644
--- a/share/man/man4/Makefile
+++ b/share/man/man4/Makefile
@@ -516,6 +516,7 @@ MAN=	aac.4 \
 	ural.4 \
 	urio.4 \
 	${_urtw.4} \
+	urtwn.4 \
 	usb.4 \
 	usb_quirk.4 \
 	uslcom.4 \
diff --git a/share/man/man4/urtwn.4 b/share/man/man4/urtwn.4
new file mode 100644
index 0000000..43facb8
--- /dev/null
+++ b/share/man/man4/urtwn.4
@@ -0,0 +1,140 @@
+.\" $OpenBSD: urtwn.4,v 1.20 2013/05/16 10:02:59 sthen Exp $
+.\" $FreeBSD$
+.\"
+.\" Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.Dd July 7, 2013
+.Dt URTWN 4
+.Os
+.Sh NAME
+.Nm urtwn
+.Nd Realtek RTL8188CU/RTL8192CU USB IEEE 802.11b/g/n wireless network device
+.Sh SYNOPSIS
+To compile this driver into the kernel,
+place the following lines in your
+kernel configuration file:
+.Bd -ragged -offset indent
+.Cd "device ehci"
+.Cd "device uhci"
+.Cd "device ohci"
+.Cd "device usb"
+.Cd "device urtwn"
+.Cd "device wlan"
+.Ed
+.Pp
+Alternatively, to load the driver as a
+module at boot time, place the following line in
+.Xr loader.conf 5 :
+.Bd -literal -offset indent
+if_urtwn_load="YES"
+.Ed
+.Sh DESCRIPTION
+The
+.Nm
+driver supports USB 2.0 wireless network devices based on Realtek
+RTL8188CUS, RTL8188CE-VAU, RTL8188RU and RTL8192CU chipsets.
+.Pp
+The RTL8188CUS is a highly integrated 802.11n adapter that combines
+a MAC, a 1T1R capable baseband and an RF in a single chip.
+It operates in the 2GHz spectrum only.
+The RTL8188RU is a high-power variant of the RTL8188CUS.
+The RTL8188CE-VAU is a PCI Express Mini Card adapter that attaches
+to the USB interface.
+.Pp
+The RTL8192CU is a highly integrated multiple-in, multiple-out (MIMO)
+802.11n adapter that combines a MAC, a 2T2R capable baseband and an
+RF in a single chip.
+It operates in the 2GHz spectrum only.
+.Pp
+The driver needs at least version 1.1p0 of the following firmware files,
+which are loaded when an interface is attached:
+.Pp
+.Bl -tag -width Ds -offset indent -compact
+.It urtwn-rtl8192cfwT
+.It urtwn-rtl8192cfwU
+.It urtwn-rtl8723fw
+.El
+.Pp
+The firmware is available as part of the FreeBSD Ports collection in
+net/urtwn-firmware-kmod.
+.Sh HARDWARE
+The following adapters should work:
+.Pp
+.Bl -tag -width Ds -offset indent -compact
+.It Belkin F7D1102 Surf Wireless Micro
+.It Edimax EW-7811Un
+.It Netgear WNA1000M
+.It Realtek RTL8192CU
+.It Realtek RTL8188CUS
+.El
+.Sh EXAMPLES
+Join an existing BSS network (i.e., connect to an access point):
+.Bd -literal -offset indent
+ifconfig wlan create wlandev urtwn0 inet 192.168.0.20 \e
+    netmask 0xffffff00
+.Ed
+.Pp
+Join a specific BSS network with network name
+.Dq Li my_net :
+.Pp
+.Dl "ifconfig wlan create wlandev urtwn0 ssid my_net up"
+.Pp
+Join a specific BSS network with 64-bit WEP encryption:
+.Bd -literal -offset indent
+ifconfig wlan create wlandev urtwn0 ssid my_net \e
+        wepmode on wepkey 0x1234567890 weptxkey 1 up
+.Ed
+.Sh DIAGNOSTICS
+.Bl -diag
+.It "urtwn%d: error %d, could not read firmware %s"
+For some reason, the driver was unable to read the microcode file from the
+filesystem.
+The file might be missing or corrupted.
+.It "urtwn%d: device timeout"
+A frame dispatched to the hardware for transmission did not complete in time.
+The driver will reset the hardware.
+This should not happen.
+.El
+.Sh SEE ALSO
+.Xr intro 4 ,
+.Xr netintro 4 ,
+.Xr usb 4 ,
+.Xr wlan 4 ,
+.Xr wlan_ccmp 4 ,
+.Xr wlan_tkip 4 ,
+.Xr wlan_wep 4 ,
+.Xr ifconfig 8,
+.Xr wpa_supplicant 8
+.Rs
+.%T Realtek
+.%U http://www.realtek.com.tw
+.Re
+.Sh HISTORY
+The
+.Nm
+driver first appeared in
+.Ox 4.9 
+and
+.Fx 10.0 .
+.Sh AUTHORS
+The
+.Nm
+driver was written by
+.An Damien Bergamini Aq damien@openbsd.org .
+.Sh CAVEATS
+The
+.Nm
+driver does not support any of the 802.11n capabilities offered by the
+adapters.
diff --git a/sys/conf/NOTES b/sys/conf/NOTES
index ec41bb6..3961e0f 100644
--- a/sys/conf/NOTES
+++ b/sys/conf/NOTES
@@ -2747,6 +2747,9 @@ device		ural
 # Realtek RTL8187B/L wireless driver
 device		urtw
 #
+# Realtek RTL8188CU/RTL8192CU wireless driver
+device		urtwn
+#
 # ZyDas ZD1211/ZD1211B wireless driver
 device		zyd
 #
diff --git a/sys/conf/files b/sys/conf/files
index 266c6f0..9414851 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -2292,6 +2292,7 @@ dev/usb/wlan/if_uath.c		optional uath
 dev/usb/wlan/if_upgt.c		optional upgt
 dev/usb/wlan/if_ural.c		optional ural
 dev/usb/wlan/if_urtw.c		optional urtw
+dev/usb/wlan/if_urtwn.c		optional urtwn
 dev/usb/wlan/if_zyd.c		optional zyd
 #
 # USB serial and parallel port drivers
diff --git a/sys/dev/usb/usbdevs b/sys/dev/usb/usbdevs
index 278a202..e0e674b 100644
--- a/sys/dev/usb/usbdevs
+++ b/sys/dev/usb/usbdevs
@@ -571,6 +571,7 @@ vendor KONTRON		0x0fe6	Kontron AG
 vendor QUALCOMM		0x1004	Qualcomm
 vendor APACER		0x1005	Apacer
 vendor MOTOROLA4	0x100d	Motorola
+vendor HP3		0x103c	Hewlett Packard
 vendor AIRPLUS		0x1011  Airplus
 vendor DESKNOTE		0x1019	Desknote
 vendor NEC3		0x1033	NEC
@@ -720,6 +721,7 @@ vendor ENCORE		0x203d	Encore
 vendor QIHARDWARE	0x20b7	QI-hardware
 vendor PARA		0x20b8	PARA Industrial
 vendor SIMTEC		0x20df	Simtec Electronics
+vendor TRENDNET		0x20f4  TRENDnet
 vendor RTSYSTEMS	0x2100	RTSYSTEMS
 vendor VIALABS		0x2109	VIA Labs
 vendor ERICSSON		0x2282	Ericsson
@@ -742,6 +744,7 @@ vendor IRIVER		0x4102	iRiver
 vendor DELL		0x413c	Dell
 vendor WCH		0x4348	QinHeng Electronics
 vendor ACEECA		0x4766	Aceeca
+vendor FEIXUN		0x4855	FeiXun Communication
 vendor PAPOUCH		0x5050	Papouch products
 vendor AVERATEC		0x50c2	Averatec
 vendor SWEEX		0x5173	Sweex
@@ -757,6 +760,7 @@ vendor INTEL2		0x8087	Intel
 vendor ALLWIN		0x8516	ALLWIN Tech
 vendor SITECOM2		0x9016	Sitecom
 vendor MOSCHIP		0x9710	MosChip Semiconductor
+vendor NETGEAR4		0x9846  Netgear
 vendor MARVELL		0x9e88	Marvell Technology Group Ltd.
 vendor 3COM3		0xa727	3Com
 vendor EVOLUTION	0xdeee	Evolution Robotics products
@@ -814,6 +818,9 @@ product ABOCOM HWU54DM		0xb21b	HWU54DM
 product ABOCOM RT2573_2		0xb21c	RT2573
 product ABOCOM RT2573_3		0xb21d	RT2573
 product ABOCOM RT2573_4		0xb21e	RT2573
+product ABOCOM RTL8188CU_1	0x8188  RTL8188CU
+product ABOCOM RTL8188CU_2	0x8189  RTL8188CU
+product ABOCOM RTL8192CU	0x8178  RTL8192CU
 product ABOCOM WUG2700		0xb21f	WUG2700
 
 /* Acton Research Corp. */
@@ -1126,6 +1133,7 @@ product ASUS RT2870_4		0x1760	RT2870
 product ASUS RT2870_5		0x1761	RT2870
 product	ASUS USBN13		0x1784	USB-N13
 product	ASUS RT3070_1		0x1790	RT3070
+product ASUS RTL8192CU		0x17ab	RTL8192CU
 product ASUS A730W		0x4202	ASUS MyPal A730W
 product ASUS P535		0x420f	ASUS P535 PDA
 product	ASUS GMSC		0x422f	ASUS Generic Mass Storage
@@ -1173,6 +1181,10 @@ product AZUREWAVE RT2870_2	0x3262	RT2870
 product AZUREWAVE RT3070_1	0x3273	RT3070
 product	AZUREWAVE RT3070_2	0x3284	RT3070
 product	AZUREWAVE RT3070_3	0x3305	RT3070
+product AZUREWAVE RTL8188CU	0x3357	RTL8188CU
+product AZUREWAVE RTL8188CE_1	0x3358  RTL8188CE
+product AZUREWAVE RTL8188CE_2	0x3359  RTL8188CE
+
 
 /* Baltech products */
 product BALTECH CARDREADER	0x9999	Card reader
@@ -1215,6 +1227,9 @@ product BELKIN F5U257		0x0257	F5U257 Serial
 product BELKIN F5U409		0x0409	F5U409 Serial
 product BELKIN F6C550AVR	0x0551	F6C550-AVR UPS
 product BELKIN F5U120		0x1203	F5U120-PC Hub
+product BELKIN RTL8188CU	0x1102  RTL8188CU Wireless Adapter
+product BELKIN RTL8192CU	0x2102	RTL8192CU Wireless Adapter
+product BELKIN F7D2102		0x2103  F7D2102 Wireless Adapter
 product BELKIN ZD1211B		0x4050	ZD1211B
 product BELKIN F5D5055		0x5055	F5D5055
 product BELKIN F5D7050		0x7050	F5D7050 Wireless Adapter
@@ -1294,6 +1309,11 @@ product CHIC CYPRESS		0x0003	Cypress USB Mouse
 product CHICONY KB8933		0x0001	KB-8933 keyboard
 product CHICONY KU0325		0x0116	KU-0325 keyboard
 product CHICONY CNF7129		0xb071	Notebook Web Camera
+product	CHICONY RTL8188CUS_1	0xaff7	RTL8188CUS
+product	CHICONY RTL8188CUS_2	0xaff8	RTL8188CUS
+product	CHICONY RTL8188CUS_3	0xaff9	RTL8188CUS
+product	CHICONY RTL8188CUS_4	0xaffa	RTL8188CUS
+product	CHICONY RTL8188CUS_5	0xaffa	RTL8188CUS
 product CHICONY2 TWINKLECAM	0x600d	TwinkleCam USB camera
 
 /* CH Products */
@@ -1383,6 +1403,7 @@ product COREGA RT2870_2		0x003c	RT2870
 product COREGA RT2870_3		0x003f	RT2870
 product COREGA RT3070		0x0041	RT3070
 product COREGA CGWLUSB300GNM	0x0042	CG-WLUSB300GNM
+product COREGA RTL8192CU	0x0056  RTL8192CU
 
 product COREGA WLUSB_11_STICK	0x7613	WLAN USB Stick 11
 product COREGA FETHER_USB_TXC	0x9601	FEther USB-TXC
@@ -1519,6 +1540,10 @@ product DLINK DSB650		0xabc1	10/100 Ethernet
 product DLINK DUBH7		0xf103	DUB-H7 USB 2.0 7-Port Hub
 product DLINK DWR510_CD		0xa805	DWR-510 CD-ROM Mode
 product DLINK DWR510		0x7e12	DWR-510
+product DLINK RTL8188CU		0x3308	RTL8188CU
+product	DLINK RTL8192CU_1	0x3307	RTL8192CU
+product	DLINK RTL8192CU_2	0x3309	RTL8192CU
+product	DLINK RTL8192CU_3	0x330a	RTL8192CU
 product DLINK2 DWA120		0x3a0c	DWA-120
 product DLINK2 DWA120_NF	0x3a0d	DWA-120 (no firmware)
 product DLINK2 DWLG122C1	0x3c03	DWL-G122 c1
@@ -1559,6 +1584,7 @@ product EDIMAX RT2870_1		0x7711	RT2870
 product EDIMAX EW7717		0x7717	EW-7717
 product EDIMAX EW7718		0x7718	EW-7718
 product EDIMAX EW7811UN		0x7811	EW-7811Un
+product	EDIMAX RTL8192CU	0x7822	RTL8192CU
 
 /* eGalax Products */
 product EGALAX TPANEL		0x0001	Touch Panel
@@ -1691,6 +1717,10 @@ product FEIYA 5IN1		0x1132	5-in-1 Card Reader
 product FEIYA ELANGO		0x6200	MicroSDHC Card Reader
 product FEIYA AC110		0x6300	AC-110 Card Reader
 
+/* FeiXun Communication products */
+product FEIXUN RTL8188CU	0x0090	RTL8188CU
+product FEIXUN RTL8192CU	0x0091	RTL8192CU
+
 /* Festo */
 product FESTO CPX_USB		0x0102	CPX-USB
 product FESTO CMSP		0x0501	CMSP
@@ -2043,6 +2073,7 @@ product GUILLEMOT HWGUSB254	0xe000	HWGUSB2-54 WLAN
 product GUILLEMOT HWGUSB254LB	0xe010	HWGUSB2-54-LB
 product GUILLEMOT HWGUSB254V2AP	0xe020	HWGUSB2-54V2-AP
 product GUILLEMOT HWNU300	0xe030	HWNU-300
+product GUILLEMOT HWNUP150	0xe033	HWNUP-150
 
 /* Hagiwara products */
 product HAGIWARA FGSM		0x0002	FlashGate SmartMedia Card Reader
@@ -2066,6 +2097,7 @@ product HAWKING RT2870_1	0x0001	RT2870
 product HAWKING RT2870_2	0x0003	RT2870
 product HAWKING HWUN2		0x0009	HWUN2
 product HAWKING RT3070		0x000b	RT3070
+product HAWKING RTL8192CU	0x0019  RTL8192CU
 product HAWKING UF100		0x400c	10/100 USB Ethernet
 
 /* HID Global GmbH products */
@@ -2115,6 +2147,7 @@ product HP 5400C		0x1005	Scanjet 5400C
 product HP 2215			0x1016	iPAQ 22xx/Jornada 548
 product HP 568J			0x1116	Jornada 568
 product HP 930C			0x1204	DeskJet 930c
+product HP3 RTL8188CU		0x1629	RTL8188CU
 product HP P2000U		0x1801	Inkjet P-2000U
 product HP HS2300		0x1e1d  HS2300 HSDPA (aka MC8775)
 product HP 640C			0x2004	DeskJet 640c
@@ -3024,6 +3057,8 @@ product NETGEAR WG111V3		0x4260	WG111v3
 product NETGEAR WG111U		0x4300	WG111U
 product NETGEAR WG111U_NF	0x4301	WG111U (no firmware)
 product NETGEAR WG111V2		0x6a00	WG111V2
+product NETGEAR RTL8192CU	0x9021	RTL8192CU
+product NETGEAR WNA1000M	0x9041	WNA1000M
 product NETGEAR2 MA101		0x4100	MA101
 product NETGEAR2 MA101B		0x4102	MA101 Rev B
 product NETGEAR3 WG111T		0x4250	WG111T
@@ -3031,6 +3066,7 @@ product NETGEAR3 WG111T_NF	0x4251	WG111T (no firmware)
 product NETGEAR3 WPN111		0x5f00	WPN111
 product NETGEAR3 WPN111_NF	0x5f01	WPN111 (no firmware)
 product NETGEAR3 WPN111_2	0x5f02	WPN111
+product NETGEAR4 RTL8188CU	0x9041	RTL8188CU
 
 /* NetIndex products */
 product NETINDEX WS002IN	0x2001	Willcom WS002IN
@@ -3046,6 +3082,7 @@ product NIKON D300		0x041a  Digital Camera D300
 /* NovaTech Products */
 product NOVATECH NV902		0x9020	NovaTech NV-902W
 product NOVATECH RT2573		0x9021	RT2573
+product NOVATECH RTL8188CU	0x9071	RTL8188CU
 
 /* Nokia products */
 product NOKIA N958GB		0x0070	Nokia N95 8GBc
@@ -3274,8 +3311,14 @@ product PIENGINEERING PS2USB	0x020b	PS2 to Mac USB Adapter
 
 /* Planex Communications products */
 product PLANEX GW_US11H		0x14ea	GW-US11H WLAN
+product PLANEX2 RTL8188CUS	0x1201	RTL8188CUS
 product PLANEX2 GW_US11S	0x3220	GW-US11S WLAN
 product PLANEX2 GW_US54GXS	0x5303	GW-US54GXS WLAN
+product PLANEX2 RTL8188CU_1	0xab2a	RTL8188CU
+product PLANEX2 RTL8188CU_2	0xed17	RTL8188CU
+product PLANEX2 RTL8188CU_3	0x4902	RTL8188CU
+product PLANEX2 RTL8188CU_4	0xab2e	RTL8188CU
+product PLANEX2 RTL8192CU	0xab2b	RTL8192CU
 product PLANEX2 GWUS54HP	0xab01	GW-US54HP
 product PLANEX2 GWUS300MINIS	0xab24	GW-US300MiniS
 product PLANEX2	RT3070		0xab25	RT3070
@@ -3502,11 +3545,24 @@ product RATOC REXUSB60F		0xb020	USB serial adapter REX-USB60F
 /* Green House and CompUSA OEM this part */
 product REALTEK DUMMY		0x0000	Dummy product
 product REALTEK USB20CRW	0x0158	USB20CRW Card Reader
+product REALTEK RTL8188CTV      0x018a  RTL8188CTV
 product REALTEK USBKR100	0x8150	USBKR100 USB Ethernet
+product REALTEK RTL8188CE_0     0x8170  RTL8188CE
+product REALTEK RTL8188CE_1     0x817e  RTL8188CE
+product REALTEK RTL8188CU_0     0x8176  RTL8188CU
+product REALTEK RTL8188CU_1     0x817a  RTL8188CU
+product REALTEK RTL8188CU_2     0x817b  RTL8188CU
 product REALTEK RTL8187		0x8187	RTL8187 Wireless Adapter
 product REALTEK RTL8187B_0	0x8189	RTL8187B Wireless Adapter
 product REALTEK RTL8187B_1	0x8197	RTL8187B Wireless Adapter
 product REALTEK RTL8187B_2	0x8198	RTL8187B Wireless Adapter
+product REALTEK RTL8188CUS	0x818a	RTL8188CUS
+product REALTEK RTL8188CU_COMBO	0x8754	RTL8188CU
+product REALTEK RTL8191CU	0x8177	RTL8191CU
+product REALTEK RTL8192CU	0x8178	RTL8192CU
+product REALTEK RTL8192CE	0x817c	RTL8192CE
+product REALTEK RTL8188RU_1	0x817d	RTL8188RU
+product REALTEK RTL8188RU_2	0x317f	RTL8188RU
 
 /* RedOctane products */
 product REDOCTANE DUMMY		0x0000	Dummy product
@@ -3881,6 +3937,9 @@ product SITECOMEU RT3072_3	0x0047	RT3072
 product SITECOMEU RT3072_4	0x0048	RT3072
 product SITECOMEU RT3072_5	0x004a	RT3072
 product SITECOMEU RT3072_6	0x004d	RT3072
+product SITECOMEU RTL8188CU_1	0x0052	RTL8188CU
+product SITECOMEU RTL8188CU_2	0x005c	RTL8188CU
+product SITECOMEU RTL8192CU	0x0061	RTL8192CU
 product SITECOMEU LN028		0x061c	LN-028
 product SITECOMEU WL113		0x9071	WL-113
 product SITECOMEU ZD1211B	0x9075	ZD1211B
@@ -4110,6 +4169,10 @@ product TREK THUMBDRIVE		0x1111	ThumbDrive
 product TREK MEMKEY		0x8888	IBM USB Memory Key
 product TREK THUMBDRIVE_8MB	0x9988	ThumbDrive_8MB
 
+/* TRENDnet products */
+product TRENDNET RTL8192CU	0x624d	RTL8192CU
+product TRENDNET RTL8188CU	0x648b	RTL8188CU
+
 /* Tripp-Lite products */
 product TRIPPLITE U209		0x2008	Serial
 
@@ -4319,3 +4382,4 @@ product ZYXEL G220V2		0x340f	G-220 v2
 product ZYXEL G202		0x3410	G-202
 product ZYXEL RT2870_1		0x3416	RT2870
 product ZYXEL RT2870_2		0x341a	RT2870
+product ZYXEL RTL8192CU		0x341f	RTL8192CU
diff --git a/sys/dev/usb/wlan/if_urtwn.c b/sys/dev/usb/wlan/if_urtwn.c
new file mode 100644
index 0000000..dedf387
--- /dev/null
+++ b/sys/dev/usb/wlan/if_urtwn.c
@@ -0,0 +1,3016 @@
+/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
+
+/*-
+ * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+/*
+ * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188RU/RTL8192CU.
+ */
+
+#include <sys/param.h>
+#include <sys/sockio.h>
+#include <sys/sysctl.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/mbuf.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+#include <sys/module.h>
+#include <sys/bus.h>
+#include <sys/endian.h>
+#include <sys/linker.h>
+#include <sys/firmware.h>
+#include <sys/kdb.h>
+
+#include <machine/bus.h>
+#include <machine/resource.h>
+#include <sys/rman.h>
+
+#include <net/bpf.h>
+#include <net/if.h>
+#include <net/if_arp.h>
+#include <net/ethernet.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+#include <net/if_types.h>
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/in_var.h>
+#include <netinet/if_ether.h>
+#include <netinet/ip.h>
+
+#include <net80211/ieee80211_var.h>
+#include <net80211/ieee80211_regdomain.h>
+#include <net80211/ieee80211_radiotap.h>
+#include <net80211/ieee80211_ratectl.h>
+
+#include <dev/usb/usb.h>
+#include <dev/usb/usbdi.h>
+#include "usbdevs.h"
+
+#define USB_DEBUG_VAR urtwn_debug
+#include <dev/usb/usb_debug.h>
+
+#include <dev/usb/wlan/if_urtwnreg.h>
+
+#ifdef USB_DEBUG
+static int urtwn_debug = 0;
+
+SYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
+SYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RW, &urtwn_debug, 0,
+    "Debug level");
+#endif
+
+#define	IEEE80211_HAS_ADDR4(wh)	\
+	(((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
+
+/* various supported device vendors/products */
+static const struct usb_device_id urtwn_devs[] = {
+#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
+	URTWN_DEV(ABOCOM,	RTL8188CU_1),
+	URTWN_DEV(ABOCOM,	RTL8188CU_2),
+	URTWN_DEV(ABOCOM,	RTL8192CU),
+	URTWN_DEV(ASUS,		RTL8192CU),
+	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
+	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
+	URTWN_DEV(AZUREWAVE,	RTL8188CU),
+	URTWN_DEV(BELKIN,	F7D2102),
+	URTWN_DEV(BELKIN,	RTL8188CU),
+	URTWN_DEV(BELKIN,	RTL8192CU),
+	URTWN_DEV(CHICONY,	RTL8188CUS_1),
+	URTWN_DEV(CHICONY,	RTL8188CUS_2),
+	URTWN_DEV(CHICONY,	RTL8188CUS_3),
+	URTWN_DEV(CHICONY,	RTL8188CUS_4),
+	URTWN_DEV(CHICONY,	RTL8188CUS_5),
+	URTWN_DEV(COREGA,	RTL8192CU),
+	URTWN_DEV(DLINK,	RTL8188CU),
+	URTWN_DEV(DLINK,	RTL8192CU_1),
+	URTWN_DEV(DLINK,	RTL8192CU_2),
+	URTWN_DEV(DLINK,	RTL8192CU_3),
+	URTWN_DEV(EDIMAX,	EW7811UN),
+	URTWN_DEV(EDIMAX,	RTL8192CU),
+	URTWN_DEV(FEIXUN,	RTL8188CU),
+	URTWN_DEV(FEIXUN,	RTL8192CU),
+	URTWN_DEV(GUILLEMOT,	HWNUP150),
+	URTWN_DEV(HAWKING,	RTL8192CU),
+	URTWN_DEV(HP3,		RTL8188CU),
+	URTWN_DEV(NETGEAR,	WNA1000M),
+	URTWN_DEV(NETGEAR,	RTL8192CU),
+	URTWN_DEV(NETGEAR4,	RTL8188CU),
+	URTWN_DEV(NOVATECH,	RTL8188CU),
+	URTWN_DEV(PLANEX2,	RTL8188CU_1),
+	URTWN_DEV(PLANEX2,	RTL8188CU_2),
+	URTWN_DEV(PLANEX2,	RTL8188CU_3),
+	URTWN_DEV(PLANEX2,	RTL8188CU_4),
+	URTWN_DEV(PLANEX2,	RTL8188CUS),
+	URTWN_DEV(PLANEX2,	RTL8192CU),
+	URTWN_DEV(REALTEK,	RTL8188CE_0),
+	URTWN_DEV(REALTEK,	RTL8188CE_1),
+	URTWN_DEV(REALTEK,	RTL8188CTV),
+	URTWN_DEV(REALTEK,	RTL8188CU_0),
+	URTWN_DEV(REALTEK,	RTL8188CU_1),
+	URTWN_DEV(REALTEK,	RTL8188CU_2),
+	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
+	URTWN_DEV(REALTEK,	RTL8188CUS),
+	URTWN_DEV(REALTEK,	RTL8188RU_1),
+	URTWN_DEV(REALTEK,	RTL8188RU_2),
+	URTWN_DEV(REALTEK,	RTL8191CU),
+	URTWN_DEV(REALTEK,	RTL8192CE),
+	URTWN_DEV(REALTEK,	RTL8192CU),
+	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
+	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
+	URTWN_DEV(SITECOMEU,	RTL8192CU),
+	URTWN_DEV(TRENDNET,	RTL8188CU),
+	URTWN_DEV(TRENDNET,	RTL8192CU),
+	URTWN_DEV(ZYXEL,	RTL8192CU),
+#undef URTWN_DEV
+};
+
+static device_probe_t	urtwn_match;
+static device_attach_t	urtwn_attach;
+static device_detach_t	urtwn_detach;
+
+static usb_callback_t   urtwn_bulk_tx_callback;
+static usb_callback_t	urtwn_bulk_rx_callback;
+
+static usb_error_t	urtwn_do_request(struct urtwn_softc *sc,
+			    struct usb_device_request *req, void *data);
+static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
+		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
+                    const uint8_t [IEEE80211_ADDR_LEN],
+                    const uint8_t [IEEE80211_ADDR_LEN]);
+static void		urtwn_vap_delete(struct ieee80211vap *);
+static struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int, 
+			    int *);
+static struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *, 
+			    int *, int8_t *);
+static void		urtwn_txeof(struct usb_xfer *, struct urtwn_data *);
+static int		urtwn_alloc_list(struct urtwn_softc *, 
+			    struct urtwn_data[], int, int);
+static int		urtwn_alloc_rx_list(struct urtwn_softc *);
+static int		urtwn_alloc_tx_list(struct urtwn_softc *);
+static void		urtwn_free_tx_list(struct urtwn_softc *);
+static void		urtwn_free_rx_list(struct urtwn_softc *);
+static void		urtwn_free_list(struct urtwn_softc *,
+			    struct urtwn_data data[], int);
+static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
+static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
+static int		urtwn_write_region_1(struct urtwn_softc *, uint16_t, 
+			    uint8_t *, int);
+static void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
+static void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
+static void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
+static int		urtwn_read_region_1(struct urtwn_softc *, uint16_t, 
+			    uint8_t *, int);
+static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
+static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
+static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
+static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t, 
+			    const void *, int);
+static void		urtwn_rf_write(struct urtwn_softc *, int, uint8_t, 
+			    uint32_t);
+static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
+static int		urtwn_llt_write(struct urtwn_softc *, uint32_t, 
+			    uint32_t);
+static uint8_t		urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
+static void		urtwn_efuse_read(struct urtwn_softc *);
+static int		urtwn_read_chipid(struct urtwn_softc *);
+static void		urtwn_read_rom(struct urtwn_softc *);
+static int		urtwn_ra_init(struct urtwn_softc *);
+static void		urtwn_tsf_sync_enable(struct urtwn_softc *);
+static void		urtwn_set_led(struct urtwn_softc *, int, int);
+static int		urtwn_newstate(struct ieee80211vap *, 
+			    enum ieee80211_state, int);
+static void		urtwn_watchdog(void *);
+static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
+static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
+static int		urtwn_tx_start(struct urtwn_softc *,
+			    struct ieee80211_node *, struct mbuf *,
+			    struct urtwn_data *);
+static void		urtwn_start(struct ifnet *);
+static int		urtwn_ioctl(struct ifnet *, u_long, caddr_t);
+static int		urtwn_power_on(struct urtwn_softc *);
+static int		urtwn_llt_init(struct urtwn_softc *);
+static void		urtwn_fw_reset(struct urtwn_softc *);
+static int		urtwn_fw_loadpage(struct urtwn_softc *, int, 
+			    const uint8_t *, int);
+static int		urtwn_load_firmware(struct urtwn_softc *);
+static int		urtwn_dma_init(struct urtwn_softc *);
+static void		urtwn_mac_init(struct urtwn_softc *);
+static void		urtwn_bb_init(struct urtwn_softc *);
+static void		urtwn_rf_init(struct urtwn_softc *);
+static void		urtwn_cam_init(struct urtwn_softc *);
+static void		urtwn_pa_bias_init(struct urtwn_softc *);
+static void		urtwn_rxfilter_init(struct urtwn_softc *);
+static void		urtwn_edca_init(struct urtwn_softc *);
+static void		urtwn_write_txpower(struct urtwn_softc *, int, 
+			    uint16_t[]);
+static void		urtwn_get_txpower(struct urtwn_softc *, int,
+		      	    struct ieee80211_channel *, 
+			    struct ieee80211_channel *, uint16_t[]);
+static void		urtwn_set_txpower(struct urtwn_softc *,
+		    	    struct ieee80211_channel *, 
+			    struct ieee80211_channel *);
+static void		urtwn_scan_start(struct ieee80211com *);
+static void		urtwn_scan_end(struct ieee80211com *);
+static void		urtwn_set_channel(struct ieee80211com *);
+static void		urtwn_set_chan(struct urtwn_softc *,
+		    	    struct ieee80211_channel *, 
+			    struct ieee80211_channel *);
+static void		urtwn_update_mcast(struct ifnet *);
+static void		urtwn_iq_calib(struct urtwn_softc *);
+static void		urtwn_lc_calib(struct urtwn_softc *);
+static void		urtwn_init(void *);
+static void		urtwn_init_locked(void *);
+static void		urtwn_stop(struct ifnet *, int);
+static void		urtwn_stop_locked(struct ifnet *, int);
+static void		urtwn_abort_xfers(struct urtwn_softc *);
+static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
+			    const struct ieee80211_bpf_params *);
+
+/* Aliases. */
+#define	urtwn_bb_write	urtwn_write_4
+#define urtwn_bb_read	urtwn_read_4
+
+static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
+	[URTWN_BULK_RX] = {
+		.type = UE_BULK,
+		.endpoint = UE_ADDR_ANY,
+		.direction = UE_DIR_IN,
+		.bufsize = URTWN_RXBUFSZ,
+		.flags = {
+			.pipe_bof = 1,
+			.short_xfer_ok = 1
+		},
+		.callback = urtwn_bulk_rx_callback,
+	},
+	[URTWN_BULK_TX_BE] = {
+		.type = UE_BULK,
+		.endpoint = 0x03,
+		.direction = UE_DIR_OUT,
+		.bufsize = URTWN_TXBUFSZ,
+		.flags = {
+			.ext_buffer = 1,
+			.pipe_bof = 1,
+			.force_short_xfer = 1
+		},
+		.callback = urtwn_bulk_tx_callback,
+		.timeout = URTWN_TX_TIMEOUT,	/* ms */
+	},
+	[URTWN_BULK_TX_BK] = {
+		.type = UE_BULK,
+		.endpoint = 0x03,
+		.direction = UE_DIR_OUT,
+		.bufsize = URTWN_TXBUFSZ,
+		.flags = {
+			.ext_buffer = 1,
+			.pipe_bof = 1,
+			.force_short_xfer = 1,
+		},
+		.callback = urtwn_bulk_tx_callback,
+		.timeout = URTWN_TX_TIMEOUT,	/* ms */
+	},
+	[URTWN_BULK_TX_VI] = {
+		.type = UE_BULK,
+		.endpoint = 0x02,
+		.direction = UE_DIR_OUT,
+		.bufsize = URTWN_TXBUFSZ,
+		.flags = {
+			.ext_buffer = 1,
+			.pipe_bof = 1,
+			.force_short_xfer = 1
+		},
+		.callback = urtwn_bulk_tx_callback,
+		.timeout = URTWN_TX_TIMEOUT,	/* ms */
+	},
+	[URTWN_BULK_TX_VO] = {
+		.type = UE_BULK,
+		.endpoint = 0x02,
+		.direction = UE_DIR_OUT,
+		.bufsize = URTWN_TXBUFSZ,
+		.flags = {
+			.ext_buffer = 1,
+			.pipe_bof = 1,
+			.force_short_xfer = 1
+		},
+		.callback = urtwn_bulk_tx_callback,
+		.timeout = URTWN_TX_TIMEOUT,	/* ms */
+	},
+};
+
+static int
+urtwn_match(device_t self)
+{
+	struct usb_attach_arg *uaa = device_get_ivars(self);
+
+	if (uaa->usb_mode != USB_MODE_HOST)
+		return (ENXIO);
+	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
+		return (ENXIO);
+	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
+		return (ENXIO);
+
+	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
+}
+
+static int
+urtwn_attach(device_t self)
+{
+	struct usb_attach_arg *uaa = device_get_ivars(self);
+	struct urtwn_softc *sc = device_get_softc(self);
+	struct ifnet *ifp;
+	struct ieee80211com *ic;
+	uint8_t iface_index, bands;
+	int error;
+
+	device_set_usb_desc(self);
+	sc->sc_udev = uaa->device;
+	sc->sc_dev = self;
+
+	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
+	    MTX_NETWORK_LOCK, MTX_DEF);
+	callout_init(&sc->sc_watchdog_ch, 0);
+
+	iface_index = URTWN_IFACE_INDEX;
+	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
+	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
+	if (error) {
+		device_printf(self, "could not allocate USB transfers, "
+		    "err=%s\n", usbd_errstr(error));
+		goto detach;
+	}
+
+	URTWN_LOCK(sc);
+
+	error = urtwn_read_chipid(sc);
+	if (error) {
+		device_printf(sc->sc_dev, "unsupported test chip\n");
+		URTWN_UNLOCK(sc);
+		goto detach;
+	}
+
+	/* Determine number of Tx/Rx chains. */
+	if (sc->chip & URTWN_CHIP_92C) {
+		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
+		sc->nrxchains = 2;
+	} else {
+		sc->ntxchains = 1;
+		sc->nrxchains = 1;
+	}
+	urtwn_read_rom(sc);
+
+	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
+	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
+	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
+	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
+	    "8188CUS", sc->ntxchains, sc->nrxchains);
+
+	URTWN_UNLOCK(sc);
+
+	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
+	if (ifp == NULL) {
+		device_printf(sc->sc_dev, "can not if_alloc()\n");
+		goto detach;
+	}
+	ic = ifp->if_l2com;
+
+	ifp->if_softc = sc;
+	if_initname(ifp, "urtwn", device_get_unit(sc->sc_dev));
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_init = urtwn_init;
+	ifp->if_ioctl = urtwn_ioctl;
+	ifp->if_start = urtwn_start;
+	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
+	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
+	IFQ_SET_READY(&ifp->if_snd);
+
+	ic->ic_ifp = ifp;
+	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
+	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
+
+	/* set device capabilities */
+	ic->ic_caps =
+		  IEEE80211_C_STA		/* station mode */
+		| IEEE80211_C_MONITOR		/* monitor mode */
+		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
+		| IEEE80211_C_SHSLOT		/* short slot time supported */
+		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
+		| IEEE80211_C_WPA		/* 802.11i */
+		;
+
+	bands = 0;
+	setbit(&bands, IEEE80211_MODE_11B);
+	setbit(&bands, IEEE80211_MODE_11G);
+	ieee80211_init_channels(ic, NULL, &bands);
+
+	ieee80211_ifattach(ic, sc->sc_bssid);
+	ic->ic_raw_xmit = urtwn_raw_xmit;
+	ic->ic_scan_start = urtwn_scan_start;
+	ic->ic_scan_end = urtwn_scan_end;
+	ic->ic_set_channel = urtwn_set_channel;
+
+	ic->ic_vap_create = urtwn_vap_create;
+	ic->ic_vap_delete = urtwn_vap_delete;
+	ic->ic_update_mcast = urtwn_update_mcast;
+
+	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr, 
+	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
+	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
+	    URTWN_RX_RADIOTAP_PRESENT);
+
+	if (bootverbose)
+		ieee80211_announce(ic);
+
+	return (0);
+
+detach:
+	urtwn_detach(self);
+	return (ENXIO);			/* failure */
+}
+
+static int
+urtwn_detach(device_t self)
+{
+	struct urtwn_softc *sc = device_get_softc(self);
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211com *ic = ifp->if_l2com;
+	
+	if (!device_is_attached(self))
+		return (0);
+
+	urtwn_stop(ifp, 1);
+
+	callout_drain(&sc->sc_watchdog_ch);
+
+	/* stop all USB transfers */
+	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
+	ieee80211_ifdetach(ic);
+
+	urtwn_free_tx_list(sc);
+	urtwn_free_rx_list(sc);
+
+	if_free(ifp);
+	mtx_destroy(&sc->sc_mtx);
+
+	return (0);
+}
+
+static void
+urtwn_free_tx_list(struct urtwn_softc *sc)
+{
+	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
+}
+
+static void
+urtwn_free_rx_list(struct urtwn_softc *sc)
+{
+	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
+}
+
+static void
+urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
+{
+	int i;
+
+	for (i = 0; i < ndata; i++) {
+		struct urtwn_data *dp = &data[i];
+
+		if (dp->buf != NULL) {
+			free(dp->buf, M_USBDEV);
+			dp->buf = NULL;
+		}
+		if (dp->ni != NULL) {
+			ieee80211_free_node(dp->ni);
+			dp->ni = NULL;
+		}
+	}
+}
+
+static usb_error_t
+urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
+    void *data)
+{
+	usb_error_t err;
+	int ntries = 10;
+
+	URTWN_ASSERT_LOCKED(sc);
+
+	while (ntries--) {
+		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
+		    req, data, 0, NULL, 250 /* ms */);
+		if (err == 0)
+			break;
+
+		DPRINTFN(1, "Control request failed, %s (retrying)\n",
+		    usbd_errstr(err));
+		usb_pause_mtx(&sc->sc_mtx, hz / 100);
+	}
+	return (err);
+}
+
+static struct ieee80211vap *
+urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
+    enum ieee80211_opmode opmode, int flags,
+    const uint8_t bssid[IEEE80211_ADDR_LEN],
+    const uint8_t mac[IEEE80211_ADDR_LEN])
+{
+	struct urtwn_vap *uvp;
+	struct ieee80211vap *vap;
+
+	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
+		return (NULL);
+
+	uvp = (struct urtwn_vap *) malloc(sizeof(struct urtwn_vap),
+	    M_80211_VAP, M_NOWAIT | M_ZERO);
+	if (uvp == NULL)
+		return (NULL);
+	vap = &uvp->vap;
+	/* enable s/w bmiss handling for sta mode */
+	ieee80211_vap_setup(ic, vap, name, unit, opmode, 
+	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
+
+	/* override state transition machine */
+	uvp->newstate = vap->iv_newstate;
+	vap->iv_newstate = urtwn_newstate;
+
+	/* complete setup */
+	ieee80211_vap_attach(vap, ieee80211_media_change,
+	    ieee80211_media_status);
+	ic->ic_opmode = opmode;
+	return (vap);
+}
+
+static void
+urtwn_vap_delete(struct ieee80211vap *vap)
+{
+	struct urtwn_vap *uvp = URTWN_VAP(vap);
+
+	ieee80211_vap_detach(vap);
+	free(uvp, M_80211_VAP);
+}
+
+static struct mbuf *
+urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
+{
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211_frame *wh;
+	struct mbuf *m;
+	struct r92c_rx_stat *stat;
+	uint32_t rxdw0, rxdw3;
+	uint8_t rate;
+	int8_t rssi = 0;
+	int infosz;
+
+	/*
+	 * don't pass packets to the ieee80211 framework if the driver isn't
+	 * RUNNING.
+	 */
+	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
+		return (NULL);
+
+	stat = (struct r92c_rx_stat *)buf;
+	rxdw0 = le32toh(stat->rxdw0);
+	rxdw3 = le32toh(stat->rxdw3);
+
+	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
+		/*
+		 * This should not happen since we setup our Rx filter
+		 * to not receive these frames.
+		 */
+		ifp->if_ierrors++;
+		return (NULL);
+	}
+
+	rate = MS(rxdw3, R92C_RXDW3_RATE);
+	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
+
+	/* Get RSSI from PHY status descriptor if present. */
+	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
+		rssi = urtwn_get_rssi(sc, rate, &stat[1]);
+		/* Update our average RSSI. */
+		urtwn_update_avgrssi(sc, rate, rssi);
+	}
+
+	m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
+	if (m == NULL) {
+		device_printf(sc->sc_dev, "could not create RX mbuf\n");
+		return (NULL);
+	}
+
+	/* Finalize mbuf. */
+	m->m_pkthdr.rcvif = ifp;
+	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
+	memcpy(mtod(m, uint8_t *), wh, pktlen);
+	m->m_pkthdr.len = m->m_len = pktlen;
+
+	if (ieee80211_radiotap_active(ic)) {
+		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
+
+		tap->wr_flags = 0;
+		/* Map HW rate index to 802.11 rate. */
+		if (!(rxdw3 & R92C_RXDW3_HT)) {
+			switch (rate) {
+			/* CCK. */
+			case  0: tap->wr_rate =   2; break;
+			case  1: tap->wr_rate =   4; break;
+			case  2: tap->wr_rate =  11; break;
+			case  3: tap->wr_rate =  22; break;
+			/* OFDM. */
+			case  4: tap->wr_rate =  12; break;
+			case  5: tap->wr_rate =  18; break;
+			case  6: tap->wr_rate =  24; break;
+			case  7: tap->wr_rate =  36; break;
+			case  8: tap->wr_rate =  48; break;
+			case  9: tap->wr_rate =  72; break;
+			case 10: tap->wr_rate =  96; break;
+			case 11: tap->wr_rate = 108; break;
+			}
+		} else if (rate >= 12) {	/* MCS0~15. */
+			/* Bit 7 set means HT MCS instead of rate. */
+			tap->wr_rate = 0x80 | (rate - 12);
+		}
+		tap->wr_dbm_antsignal = rssi;
+		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
+		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
+	}
+
+	*rssi_p = rssi;
+
+	return (m);
+}
+
+static struct mbuf *
+urtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
+    int8_t *nf)
+{
+	struct urtwn_softc *sc = data->sc;
+	struct ifnet *ifp = sc->sc_ifp;
+	struct r92c_rx_stat *stat;
+	struct mbuf *m, *m0 = NULL, *prevm = NULL;
+	uint32_t rxdw0;
+	uint8_t *buf;
+	int len, totlen, pktlen, infosz, npkts;
+
+	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
+
+	if (len < sizeof(*stat)) {
+		ifp->if_ierrors++;
+		return (NULL);
+	}
+
+	buf = data->buf;
+	/* Get the number of encapsulated frames. */
+	stat = (struct r92c_rx_stat *)buf;
+	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
+	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
+
+	/* Process all of them. */
+	while (npkts-- > 0) {
+		if (len < sizeof(*stat))
+			break;
+		stat = (struct r92c_rx_stat *)buf;
+		rxdw0 = le32toh(stat->rxdw0);
+
+		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
+		if (pktlen == 0)
+			break;
+
+		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
+
+		/* Make sure everything fits in xfer. */
+		totlen = sizeof(*stat) + infosz + pktlen;
+		if (totlen > len)
+			break;
+
+		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
+		if (m0 == NULL)
+			m0 = m;
+		if (prevm == NULL)
+			prevm = m;
+		else {
+			prevm->m_next = m;
+			prevm = m;
+		}
+
+		/* Next chunk is 128-byte aligned. */
+		totlen = (totlen + 127) & ~127;
+		buf += totlen;
+		len -= totlen;
+	}
+
+	return (m0);
+}
+
+static void
+urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
+{
+	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211_frame *wh;
+	struct ieee80211_node *ni;
+	struct mbuf *m = NULL, *next;
+	struct urtwn_data *data;
+	int8_t nf;
+	int rssi = 1;
+
+	URTWN_ASSERT_LOCKED(sc);
+
+	switch (USB_GET_STATE(xfer)) {
+	case USB_ST_TRANSFERRED:
+		data = STAILQ_FIRST(&sc->sc_rx_active);
+		if (data == NULL)
+			goto tr_setup;
+		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
+		m = urtwn_rxeof(xfer, data, &rssi, &nf);
+		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
+		/* FALLTHROUGH */
+	case USB_ST_SETUP:
+tr_setup:
+		data = STAILQ_FIRST(&sc->sc_rx_inactive);
+		if (data == NULL) {
+			KASSERT(m == NULL, ("mbuf isn't NULL"));
+			return;
+		}
+		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
+		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
+		usbd_xfer_set_frame_data(xfer, 0, data->buf,
+		    usbd_xfer_max_len(xfer));
+		usbd_transfer_submit(xfer);
+
+		/*
+		 * To avoid LOR we should unlock our private mutex here to call
+		 * ieee80211_input() because here is at the end of a USB
+		 * callback and safe to unlock.
+		 */
+		URTWN_UNLOCK(sc);
+		while (m != NULL) {
+			next = m->m_next;
+			m->m_next = NULL;
+			wh = mtod(m, struct ieee80211_frame *);
+			ni = ieee80211_find_rxnode(ic,
+			    (struct ieee80211_frame_min *)wh);
+			nf = URTWN_NOISE_FLOOR;
+			if (ni != NULL) {
+				(void)ieee80211_input(ni, m, rssi, nf);
+				ieee80211_free_node(ni);
+			} else
+				(void)ieee80211_input_all(ic, m, rssi, nf);
+			m = next;
+		}
+		URTWN_LOCK(sc);
+		break;
+	default:
+		/* needs it to the inactive queue due to a error. */
+		data = STAILQ_FIRST(&sc->sc_rx_active);
+		if (data != NULL) {
+			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
+			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
+		}
+		if (error != USB_ERR_CANCELLED) {
+			usbd_xfer_set_stall(xfer);
+			ifp->if_ierrors++;
+			goto tr_setup;
+		}
+		break;
+	}
+}
+
+static void
+urtwn_txeof(struct usb_xfer *xfer, struct urtwn_data *data)
+{
+	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
+	struct ifnet *ifp = sc->sc_ifp;
+	struct mbuf *m;
+
+	URTWN_ASSERT_LOCKED(sc);
+
+	/*
+	 * Do any tx complete callback.  Note this must be done before releasing
+	 * the node reference.
+	 */
+	if (data->m) {
+		m = data->m;
+		if (m->m_flags & M_TXCB) {
+			/* XXX status? */
+			ieee80211_process_callback(data->ni, m, 0);
+		}
+		m_freem(m);
+		data->m = NULL;
+	}
+	if (data->ni) {
+		ieee80211_free_node(data->ni);
+		data->ni = NULL;
+	}
+	sc->sc_txtimer = 0;
+	ifp->if_opackets++;
+	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
+}
+
+static void
+urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
+{
+	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
+	struct ifnet *ifp = sc->sc_ifp;
+	struct urtwn_data *data;
+
+	URTWN_ASSERT_LOCKED(sc);
+
+	switch (USB_GET_STATE(xfer)){
+	case USB_ST_TRANSFERRED:
+		data = STAILQ_FIRST(&sc->sc_tx_active);
+		if (data == NULL)
+			goto tr_setup;
+		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
+		urtwn_txeof(xfer, data);
+		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
+		/* FALLTHROUGH */
+	case USB_ST_SETUP:
+tr_setup:
+		data = STAILQ_FIRST(&sc->sc_tx_pending);
+		if (data == NULL) {
+			DPRINTF("%s: empty pending queue\n", __func__);
+			return;
+		}
+		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
+		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
+
+		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
+		usbd_transfer_submit(xfer);
+
+		URTWN_UNLOCK(sc);
+		urtwn_start(ifp);
+		URTWN_LOCK(sc);
+		break;
+	default:
+		data = STAILQ_FIRST(&sc->sc_tx_active);
+		if (data == NULL)
+			goto tr_setup;
+		if (data->ni != NULL) {
+			ieee80211_free_node(data->ni);
+			data->ni = NULL;
+			ifp->if_oerrors++;
+		}
+		if (error != USB_ERR_CANCELLED) {
+			usbd_xfer_set_stall(xfer);
+			goto tr_setup;
+		}
+		break;
+	}
+}
+
+static struct urtwn_data *
+_urtwn_getbuf(struct urtwn_softc *sc)
+{
+	struct urtwn_data *bf;
+
+	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
+	if (bf != NULL)
+		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
+	else
+		bf = NULL;
+	if (bf == NULL)
+		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
+	return (bf);
+}
+
+static struct urtwn_data *
+urtwn_getbuf(struct urtwn_softc *sc)
+{
+        struct urtwn_data *bf;
+
+	URTWN_ASSERT_LOCKED(sc);
+
+	bf = _urtwn_getbuf(sc);
+	if (bf == NULL) {
+		struct ifnet *ifp = sc->sc_ifp;
+		DPRINTF("%s: stop queue\n", __func__);
+		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
+	}
+	return (bf);
+}
+
+static int
+urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
+    int len)
+{
+	usb_device_request_t req;
+
+	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
+	req.bRequest = R92C_REQ_REGS;
+	USETW(req.wValue, addr);
+	USETW(req.wIndex, 0);
+	USETW(req.wLength, len);
+	return (urtwn_do_request(sc, &req, buf));
+}
+
+static void
+urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
+{
+	urtwn_write_region_1(sc, addr, &val, 1);
+}
+
+
+static void
+urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
+{
+	val = htole16(val);
+	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
+}
+
+static void
+urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
+{
+	val = htole32(val);
+	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
+}
+
+static int
+urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
+    int len)
+{
+	usb_device_request_t req;
+
+	req.bmRequestType = UT_READ_VENDOR_DEVICE;
+	req.bRequest = R92C_REQ_REGS;
+	USETW(req.wValue, addr);
+	USETW(req.wIndex, 0);
+	USETW(req.wLength, len);
+	return (urtwn_do_request(sc, &req, buf));
+}
+
+static uint8_t
+urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
+{
+	uint8_t val;
+
+	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
+		return (0xff);
+	return (val);
+}
+
+static uint16_t
+urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
+{
+	uint16_t val;
+
+	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
+		return (0xffff);
+	return (le16toh(val));
+}
+
+static uint32_t
+urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
+{
+	uint32_t val;
+
+	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
+		return (0xffffffff);
+	return (le32toh(val));
+}
+
+static int
+urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
+{
+	struct r92c_fw_cmd cmd;
+	int ntries;
+
+	/* Wait for current FW box to be empty. */
+	for (ntries = 0; ntries < 100; ntries++) {
+		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
+			break;
+		DELAY(1);
+	}
+	if (ntries == 100) {
+		device_printf(sc->sc_dev,
+		    "could not send firmware command\n");
+		return (ETIMEDOUT);
+	}
+	memset(&cmd, 0, sizeof(cmd));
+	cmd.id = id;
+	if (len > 3)
+		cmd.id |= R92C_CMD_FLAG_EXT;
+	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
+	memcpy(cmd.msg, buf, len);
+
+	/* Write the first word last since that will trigger the FW. */
+	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
+	    (uint8_t *)&cmd + 4, 2);
+	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
+	    (uint8_t *)&cmd + 0, 4);
+
+	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
+	return (0);
+}
+
+static void
+urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
+{
+	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
+	    SM(R92C_LSSI_PARAM_ADDR, addr) |
+	    SM(R92C_LSSI_PARAM_DATA, val));
+}
+
+static uint32_t
+urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
+{
+	uint32_t reg[R92C_MAX_CHAINS], val;
+
+	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
+	if (chain != 0)
+		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
+
+	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
+	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
+	DELAY(1000);
+
+	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
+	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
+	    R92C_HSSI_PARAM2_READ_EDGE);
+	DELAY(1000);
+
+	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
+	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
+	DELAY(1000);
+
+	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
+		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
+	else
+		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
+	return (MS(val, R92C_LSSI_READBACK_DATA));
+}
+
+static int
+urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
+{
+	int ntries;
+
+	urtwn_write_4(sc, R92C_LLT_INIT,
+	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
+	    SM(R92C_LLT_INIT_ADDR, addr) |
+	    SM(R92C_LLT_INIT_DATA, data));
+	/* Wait for write operation to complete. */
+	for (ntries = 0; ntries < 20; ntries++) {
+		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
+		    R92C_LLT_INIT_OP_NO_ACTIVE)
+			return (0);
+		DELAY(5);
+	}
+	return (ETIMEDOUT);
+}
+
+static uint8_t
+urtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
+{
+	uint32_t reg;
+	int ntries;
+
+	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
+	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
+	reg &= ~R92C_EFUSE_CTRL_VALID;
+	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
+	/* Wait for read operation to complete. */
+	for (ntries = 0; ntries < 100; ntries++) {
+		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
+		if (reg & R92C_EFUSE_CTRL_VALID)
+			return (MS(reg, R92C_EFUSE_CTRL_DATA));
+		DELAY(5);
+	}
+	device_printf(sc->sc_dev, 
+	    "could not read efuse byte at address 0x%x\n", addr);
+	return (0xff);
+}
+
+static void
+urtwn_efuse_read(struct urtwn_softc *sc)
+{
+	uint8_t *rom = (uint8_t *)&sc->rom;
+	uint16_t addr = 0;
+	uint32_t reg;
+	uint8_t off, msk;
+	int i;
+
+	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
+	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
+		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
+		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
+	}
+	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
+	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
+		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
+		    reg | R92C_SYS_FUNC_EN_ELDR);
+	}
+	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
+	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
+	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
+		urtwn_write_2(sc, R92C_SYS_CLKR,
+		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
+	}
+	memset(&sc->rom, 0xff, sizeof(sc->rom));
+	while (addr < 512) {
+		reg = urtwn_efuse_read_1(sc, addr);
+		if (reg == 0xff)
+			break;
+		addr++;
+		off = reg >> 4;
+		msk = reg & 0xf;
+		for (i = 0; i < 4; i++) {
+			if (msk & (1 << i))
+				continue;
+			rom[off * 8 + i * 2 + 0] =
+			    urtwn_efuse_read_1(sc, addr);
+			addr++;
+			rom[off * 8 + i * 2 + 1] =
+			    urtwn_efuse_read_1(sc, addr);
+			addr++;
+		}
+	}
+#ifdef URTWN_DEBUG
+	if (urtwn_debug >= 2) {
+		/* Dump ROM content. */
+		printf("\n");
+		for (i = 0; i < sizeof(sc->rom); i++)
+			printf("%02x:", rom[i]);
+		printf("\n");
+	}
+#endif
+}
+
+static int
+urtwn_read_chipid(struct urtwn_softc *sc)
+{
+	uint32_t reg;
+
+	reg = urtwn_read_4(sc, R92C_SYS_CFG);
+	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
+		return (EIO);
+
+	if (reg & R92C_SYS_CFG_TYPE_92C) {
+		sc->chip |= URTWN_CHIP_92C;
+		/* Check if it is a castrated 8192C. */
+		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
+		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
+		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
+			sc->chip |= URTWN_CHIP_92C_1T2R;
+	}
+	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
+		sc->chip |= URTWN_CHIP_UMC;
+		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
+			sc->chip |= URTWN_CHIP_UMC_A_CUT;
+	}
+	return (0);
+}
+
+static void
+urtwn_read_rom(struct urtwn_softc *sc)
+{
+	struct r92c_rom *rom = &sc->rom;
+
+	/* Read full ROM image. */
+	urtwn_efuse_read(sc);
+
+	/* XXX Weird but this is what the vendor driver does. */
+	sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
+	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
+
+	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
+
+	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
+	DPRINTF("regulatory type=%d\n", sc->regulatory);
+
+	IEEE80211_ADDR_COPY(sc->sc_bssid, rom->macaddr);
+}
+
+/*
+ * Initialize rate adaptation in firmware.
+ */
+static int
+urtwn_ra_init(struct urtwn_softc *sc)
+{
+	static const uint8_t map[] =
+	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
+	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
+	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
+	struct ieee80211_node *ni;
+	struct ieee80211_rateset *rs;
+	struct r92c_fw_cmd_macid_cfg cmd;
+	uint32_t rates, basicrates;
+	uint8_t mode;
+	int maxrate, maxbasicrate, error, i, j;
+
+	ni = ieee80211_ref_node(vap->iv_bss);
+	rs = &ni->ni_rates;
+
+	/* Get normal and basic rates mask. */
+	rates = basicrates = 0;
+	maxrate = maxbasicrate = 0;
+	for (i = 0; i < rs->rs_nrates; i++) {
+		/* Convert 802.11 rate to HW rate index. */
+		for (j = 0; j < nitems(map); j++)
+			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
+				break;
+		if (j == nitems(map))	/* Unknown rate, skip. */
+			continue;
+		rates |= 1 << j;
+		if (j > maxrate)
+			maxrate = j;
+		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
+			basicrates |= 1 << j;
+			if (j > maxbasicrate)
+				maxbasicrate = j;
+		}
+	}
+	if (ic->ic_curmode == IEEE80211_MODE_11B)
+		mode = R92C_RAID_11B;
+	else
+		mode = R92C_RAID_11BG;
+	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
+	    mode, rates, basicrates);
+
+	/* Set rates mask for group addressed frames. */
+	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
+	cmd.mask = htole32(mode << 28 | basicrates);
+	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "could not add broadcast station\n");
+		return (error);
+	}
+	/* Set initial MRR rate. */
+	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
+	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
+	    maxbasicrate);
+
+	/* Set rates mask for unicast frames. */
+	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
+	cmd.mask = htole32(mode << 28 | rates);
+	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
+	if (error != 0) {
+		device_printf(sc->sc_dev, "could not add BSS station\n");
+		return (error);
+	}
+	/* Set initial MRR rate. */
+	DPRINTF("maxrate=%d\n", maxrate);
+	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
+	    maxrate);
+
+	/* Indicate highest supported rate. */
+	ni->ni_txrate = rs->rs_nrates - 1;
+	return (0);
+}
+
+void
+urtwn_tsf_sync_enable(struct urtwn_softc *sc)
+{
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
+	struct ieee80211_node *ni = vap->iv_bss;
+
+	uint64_t tsf;
+
+	/* Enable TSF synchronization. */
+	urtwn_write_1(sc, R92C_BCN_CTRL,
+	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
+
+	urtwn_write_1(sc, R92C_BCN_CTRL,
+	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
+
+	/* Set initial TSF. */
+	memcpy(&tsf, ni->ni_tstamp.data, 8);
+	tsf = le64toh(tsf);
+	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
+	tsf -= IEEE80211_DUR_TU;
+	urtwn_write_4(sc, R92C_TSFTR + 0, tsf);
+	urtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
+
+	urtwn_write_1(sc, R92C_BCN_CTRL,
+	    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
+}
+
+static void
+urtwn_set_led(struct urtwn_softc *sc, int led, int on)
+{
+	uint8_t reg;
+
+	if (led == URTWN_LED_LINK) {
+		reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
+		if (!on)
+			reg |= R92C_LEDCFG0_DIS;
+		urtwn_write_1(sc, R92C_LEDCFG0, reg);
+		sc->ledlink = on;	/* Save LED state. */
+	}
+}
+
+static int
+urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
+{
+	struct urtwn_vap *uvp = URTWN_VAP(vap);
+	struct ieee80211com *ic = vap->iv_ic;
+	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
+	struct ieee80211_node *ni;
+	enum ieee80211_state ostate;
+	uint32_t reg;
+
+	ostate = vap->iv_state;
+	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
+	    ieee80211_state_name[nstate]);
+
+	IEEE80211_UNLOCK(ic);
+	URTWN_LOCK(sc);
+	callout_stop(&sc->sc_watchdog_ch);
+
+	if (ostate == IEEE80211_S_RUN) {
+		/* Turn link LED off. */
+		urtwn_set_led(sc, URTWN_LED_LINK, 0);
+
+		/* Set media status to 'No Link'. */
+		reg = urtwn_read_4(sc, R92C_CR);
+		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
+		urtwn_write_4(sc, R92C_CR, reg);
+
+		/* Stop Rx of data frames. */
+		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
+
+		/* Rest TSF. */
+		urtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
+
+		/* Disable TSF synchronization. */
+		urtwn_write_1(sc, R92C_BCN_CTRL,
+		    urtwn_read_1(sc, R92C_BCN_CTRL) |
+		    R92C_BCN_CTRL_DIS_TSF_UDT0);
+
+		/* Reset EDCA parameters. */
+		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
+		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
+		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
+		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
+	}
+
+	switch (nstate) {
+	case IEEE80211_S_INIT:
+		/* Turn link LED off. */
+		urtwn_set_led(sc, URTWN_LED_LINK, 0);
+		break;
+	case IEEE80211_S_SCAN:
+		if (ostate != IEEE80211_S_SCAN) {
+			/* Allow Rx from any BSSID. */
+			urtwn_write_4(sc, R92C_RCR,
+			    urtwn_read_4(sc, R92C_RCR) &
+			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
+
+			/* Set gain for scanning. */
+			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
+			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
+			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
+
+			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
+			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
+			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
+		}
+
+		/* Make link LED blink during scan. */
+		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
+
+		/* Pause AC Tx queues. */
+		urtwn_write_1(sc, R92C_TXPAUSE,
+		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
+
+		urtwn_set_chan(sc, ic->ic_curchan, NULL);
+		break;
+	case IEEE80211_S_AUTH:
+		/* Set initial gain under link. */
+		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
+		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
+		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
+
+		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
+		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
+		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
+
+		urtwn_set_chan(sc, ic->ic_curchan, NULL);
+		break;
+	case IEEE80211_S_RUN:
+		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
+			/* Enable Rx of data frames. */
+			urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
+
+			/* Turn link LED on. */
+			urtwn_set_led(sc, URTWN_LED_LINK, 1);
+			break;
+		}
+
+		ni = ieee80211_ref_node(vap->iv_bss);
+		/* Set media status to 'Associated'. */
+		reg = urtwn_read_4(sc, R92C_CR);
+		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
+		urtwn_write_4(sc, R92C_CR, reg);
+
+		/* Set BSSID. */
+		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
+		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
+
+		if (ic->ic_curmode == IEEE80211_MODE_11B)
+			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
+		else	/* 802.11b/g */
+			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
+
+		/* Enable Rx of data frames. */
+		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
+
+		/* Flush all AC queues. */
+		urtwn_write_1(sc, R92C_TXPAUSE, 0);
+
+		/* Set beacon interval. */
+		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
+
+		/* Allow Rx from our BSSID only. */
+		urtwn_write_4(sc, R92C_RCR,
+		    urtwn_read_4(sc, R92C_RCR) |
+		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
+
+		/* Enable TSF synchronization. */
+		urtwn_tsf_sync_enable(sc);
+
+		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
+		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
+		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
+		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
+		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
+		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
+
+		/* Intialize rate adaptation. */
+		urtwn_ra_init(sc);
+		/* Turn link LED on. */
+		urtwn_set_led(sc, URTWN_LED_LINK, 1);
+
+		sc->avg_pwdb = -1;	/* Reset average RSSI. */
+		/* Reset temperature calibration state machine. */
+		sc->thcal_state = 0;
+		sc->thcal_lctemp = 0;
+		ieee80211_free_node(ni);
+		break;
+	default:
+		break;
+	}
+	URTWN_UNLOCK(sc);
+	IEEE80211_LOCK(ic);
+	return(uvp->newstate(vap, nstate, arg));
+}
+
+static void
+urtwn_watchdog(void *arg)
+{
+	struct urtwn_softc *sc = arg;
+	struct ifnet *ifp = sc->sc_ifp;
+
+	if (sc->sc_txtimer > 0) {
+		if (--sc->sc_txtimer == 0) {
+			device_printf(sc->sc_dev, "device timeout\n");
+			ifp->if_oerrors++;
+			return;
+		}
+		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
+	}
+}
+
+static void
+urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
+{
+	int pwdb;
+
+	/* Convert antenna signal to percentage. */
+	if (rssi <= -100 || rssi >= 20)
+		pwdb = 0;
+	else if (rssi >= 0)
+		pwdb = 100;
+	else
+		pwdb = 100 + rssi;
+	if (rate <= 3) {
+		/* CCK gain is smaller than OFDM/MCS gain. */
+		pwdb += 6;
+		if (pwdb > 100)
+			pwdb = 100;
+		if (pwdb <= 14)
+			pwdb -= 4;
+		else if (pwdb <= 26)
+			pwdb -= 8;
+		else if (pwdb <= 34)
+			pwdb -= 6;
+		else if (pwdb <= 42)
+			pwdb -= 2;
+	}
+	if (sc->avg_pwdb == -1)	/* Init. */
+		sc->avg_pwdb = pwdb;
+	else if (sc->avg_pwdb < pwdb)
+		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
+	else
+		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
+	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
+}
+
+static int8_t
+urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
+{
+	static const int8_t cckoff[] = { 16, -12, -26, -46 };
+	struct r92c_rx_phystat *phy;
+	struct r92c_rx_cck *cck;
+	uint8_t rpt;
+	int8_t rssi;
+
+	if (rate <= 3) {
+		cck = (struct r92c_rx_cck *)physt;
+		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
+			rpt = (cck->agc_rpt >> 5) & 0x3;
+			rssi = (cck->agc_rpt & 0x1f) << 1;
+		} else {
+			rpt = (cck->agc_rpt >> 6) & 0x3;
+			rssi = cck->agc_rpt & 0x3e;
+		}
+		rssi = cckoff[rpt] - rssi;
+	} else {	/* OFDM/HT. */
+		phy = (struct r92c_rx_phystat *)physt;
+		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
+	}
+	return (rssi);
+}
+
+static int
+urtwn_tx_start(struct urtwn_softc *sc, struct ieee80211_node *ni, 
+    struct mbuf *m0, struct urtwn_data *data)
+{
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211_frame *wh;
+	struct ieee80211_key *k;
+	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211vap *vap = ni->ni_vap;
+	struct usb_xfer *xfer;
+	struct r92c_tx_desc *txd;
+	uint8_t raid, type;
+	uint16_t sum;
+	int i, hasqos, xferlen;
+	struct usb_xfer *urtwn_pipes[4] = {
+		sc->sc_xfer[URTWN_BULK_TX_BE],
+		sc->sc_xfer[URTWN_BULK_TX_BK],
+		sc->sc_xfer[URTWN_BULK_TX_VI],
+		sc->sc_xfer[URTWN_BULK_TX_VO]
+	};
+
+	URTWN_ASSERT_LOCKED(sc);
+
+	/*
+	 * Software crypto.
+	 */
+	wh = mtod(m0, struct ieee80211_frame *);
+	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
+		k = ieee80211_crypto_encap(ni, m0);
+		if (k == NULL) {
+			device_printf(sc->sc_dev,
+			    "ieee80211_crypto_encap returns NULL.\n");
+			/* XXX we don't expect the fragmented frames */
+			m_freem(m0);
+			return (ENOBUFS);
+		}
+
+		/* in case packet header moved, reset pointer */
+		wh = mtod(m0, struct ieee80211_frame *);
+	}
+	
+	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
+	case IEEE80211_FC0_TYPE_CTL:
+	case IEEE80211_FC0_TYPE_MGT:
+		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
+		break;
+	default:
+		KASSERT(M_WME_GETAC(m0) < 4,
+		    ("unsupported WME pipe %d", M_WME_GETAC(m0)));
+		xfer = urtwn_pipes[M_WME_GETAC(m0)];
+		break;
+	}
+			    
+	hasqos = 0;
+
+	/* Fill Tx descriptor. */
+	txd = (struct r92c_tx_desc *)data->buf;
+	memset(txd, 0, sizeof(*txd));
+
+	txd->txdw0 |= htole32(
+	    SM(R92C_TXDW0_PKTLEN, m0->m_pkthdr.len) |
+	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
+	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
+	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
+		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
+
+	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
+	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
+	    type == IEEE80211_FC0_TYPE_DATA) {
+		if (ic->ic_curmode == IEEE80211_MODE_11B)
+			raid = R92C_RAID_11B;
+		else
+			raid = R92C_RAID_11BG;
+		txd->txdw1 |= htole32(
+		    SM(R92C_TXDW1_MACID, URTWN_MACID_BSS) |
+		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
+		    SM(R92C_TXDW1_RAID, raid) |
+		    R92C_TXDW1_AGGBK);
+
+		if (ic->ic_flags & IEEE80211_F_USEPROT) {
+			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
+				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
+				    R92C_TXDW4_HWRTSEN);
+			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
+				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
+				    R92C_TXDW4_HWRTSEN);
+			}
+		}
+		/* Send RTS at OFDM24. */
+		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, 8));
+		txd->txdw5 |= htole32(0x0001ff00);
+		/* Send data at OFDM54. */
+		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 11));
+	} else {
+		txd->txdw1 |= htole32(
+		    SM(R92C_TXDW1_MACID, 0) |
+		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
+		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
+
+		/* Force CCK1. */
+		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
+		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
+	}
+	/* Set sequence number (already little endian). */
+	txd->txdseq |= *(uint16_t *)wh->i_seq;
+
+	if (!hasqos) {
+		/* Use HW sequence numbering for non-QoS frames. */
+		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
+		txd->txdseq |= htole16(0x8000);
+	} else
+		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
+
+	/* Compute Tx descriptor checksum. */
+	sum = 0;
+	for (i = 0; i < sizeof(*txd) / 2; i++)
+		sum ^= ((uint16_t *)txd)[i];
+	txd->txdsum = sum; 	/* NB: already little endian. */
+
+	if (ieee80211_radiotap_active_vap(vap)) {
+		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
+
+		tap->wt_flags = 0;
+		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
+		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
+		ieee80211_radiotap_tx(vap, m0);
+	}
+
+	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
+	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
+
+	data->buflen = xferlen;
+	data->ni = ni;
+	data->m = m0;
+
+	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
+	usbd_transfer_start(xfer);
+	return (0);
+}
+
+static void
+urtwn_start(struct ifnet *ifp)
+{
+	struct urtwn_softc *sc = ifp->if_softc;
+	struct ieee80211_node *ni;
+	struct mbuf *m;
+	struct urtwn_data *bf;
+
+	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
+		return;
+
+	URTWN_LOCK(sc);
+	for (;;) {
+		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
+		if (m == NULL)
+			break;
+		bf = urtwn_getbuf(sc);
+		if (bf == NULL) {
+			IFQ_DRV_PREPEND(&ifp->if_snd, m);
+			break;
+		}
+		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
+		m->m_pkthdr.rcvif = NULL;
+
+		if (urtwn_tx_start(sc, ni, m, bf) != 0) {
+			ifp->if_oerrors++;
+			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
+			ieee80211_free_node(ni);
+			break;
+		}
+
+		sc->sc_txtimer = 5;
+		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
+	}
+	URTWN_UNLOCK(sc);
+}
+
+static int
+urtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
+{
+	struct ieee80211com *ic = ifp->if_l2com;
+	struct ifreq *ifr = (struct ifreq *) data;
+	int error = 0, startall = 0;
+
+	switch (cmd) {
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
+				urtwn_init(ifp->if_softc);
+				startall = 1;
+			}
+		} else {
+			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
+				urtwn_stop(ifp, 1);
+		}
+		if (startall)
+			ieee80211_start_all(ic);
+		break;
+	case SIOCGIFMEDIA:
+		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
+		break;
+	case SIOCGIFADDR:
+		error = ether_ioctl(ifp, cmd, data);
+		break;
+	default:
+		error = EINVAL;
+		break;
+	}
+	return (error);
+}
+
+static int
+urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
+    int ndata, int maxsz)
+{
+	int i, error;
+
+	for (i = 0; i < ndata; i++) {
+		struct urtwn_data *dp = &data[i];
+		dp->sc = sc;
+		dp->m = NULL;
+		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
+		if (dp->buf == NULL) {
+			device_printf(sc->sc_dev,
+			    "could not allocate buffer\n");
+			error = ENOMEM;
+			goto fail;
+		}
+		dp->ni = NULL;
+	}
+
+	return (0);
+fail:
+	urtwn_free_list(sc, data, ndata);
+	return (error);
+}
+
+static int
+urtwn_alloc_rx_list(struct urtwn_softc *sc)
+{
+        int error, i;
+
+	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
+	    URTWN_RXBUFSZ);
+	if (error != 0)
+		return (error);
+
+	STAILQ_INIT(&sc->sc_rx_active);
+	STAILQ_INIT(&sc->sc_rx_inactive);
+
+	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
+		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
+
+	return (0);
+}
+
+static int
+urtwn_alloc_tx_list(struct urtwn_softc *sc)
+{
+	int error, i;
+
+	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
+	    URTWN_TXBUFSZ);
+	if (error != 0)
+		return (error);
+
+	STAILQ_INIT(&sc->sc_tx_active);
+	STAILQ_INIT(&sc->sc_tx_inactive);
+	STAILQ_INIT(&sc->sc_tx_pending);
+
+	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
+		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
+
+	return (0);
+}
+
+static int
+urtwn_power_on(struct urtwn_softc *sc)
+{
+	uint32_t reg;
+	int ntries;
+
+	/* Wait for autoload done bit. */
+	for (ntries = 0; ntries < 1000; ntries++) {
+		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
+			break;
+		DELAY(5);
+	}
+	if (ntries == 1000) {
+		device_printf(sc->sc_dev,
+		    "timeout waiting for chip autoload\n");
+		return (ETIMEDOUT);
+	}
+
+	/* Unlock ISO/CLK/Power control register. */
+	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
+	/* Move SPS into PWM mode. */
+	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
+	DELAY(100);
+
+	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
+	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
+		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
+		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
+		DELAY(100);
+		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
+		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
+		    ~R92C_SYS_ISO_CTRL_MD2PP);
+	}
+
+	/* Auto enable WLAN. */
+	urtwn_write_2(sc, R92C_APS_FSMCO,
+	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
+	for (ntries = 0; ntries < 1000; ntries++) {
+		if (urtwn_read_2(sc, R92C_APS_FSMCO) &
+		    R92C_APS_FSMCO_APFM_ONMAC)
+			break;
+		DELAY(5);
+	}
+	if (ntries == 1000) {
+		device_printf(sc->sc_dev,
+		    "timeout waiting for MAC auto ON\n");
+		return (ETIMEDOUT);
+	}
+
+	/* Enable radio, GPIO and LED functions. */
+	urtwn_write_2(sc, R92C_APS_FSMCO,
+	    R92C_APS_FSMCO_AFSM_HSUS |
+	    R92C_APS_FSMCO_PDN_EN |
+	    R92C_APS_FSMCO_PFM_ALDN);
+	/* Release RF digital isolation. */
+	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
+	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
+
+	/* Initialize MAC. */
+	urtwn_write_1(sc, R92C_APSD_CTRL,
+	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
+	for (ntries = 0; ntries < 200; ntries++) {
+		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
+		    R92C_APSD_CTRL_OFF_STATUS))
+			break;
+		DELAY(5);
+	}
+	if (ntries == 200) {
+		device_printf(sc->sc_dev,
+		    "timeout waiting for MAC initialization\n");
+		return (ETIMEDOUT);
+	}
+
+	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
+	reg = urtwn_read_2(sc, R92C_CR);
+	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
+	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
+	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
+	    R92C_CR_ENSEC;
+	urtwn_write_2(sc, R92C_CR, reg);
+
+	urtwn_write_1(sc, 0xfe10, 0x19);
+	return (0);
+}
+
+static int
+urtwn_llt_init(struct urtwn_softc *sc)
+{
+	int i, error;
+
+	/* Reserve pages [0; R92C_TX_PAGE_COUNT]. */
+	for (i = 0; i < R92C_TX_PAGE_COUNT; i++) {
+		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
+			return (error);
+	}
+	/* NB: 0xff indicates end-of-list. */
+	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
+		return (error);
+	/*
+	 * Use pages [R92C_TX_PAGE_COUNT + 1; R92C_TXPKTBUF_COUNT - 1]
+	 * as ring buffer.
+	 */
+	for (++i; i < R92C_TXPKTBUF_COUNT - 1; i++) {
+		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
+			return (error);
+	}
+	/* Make the last page point to the beginning of the ring buffer. */
+	error = urtwn_llt_write(sc, i, R92C_TX_PAGE_COUNT + 1);
+	return (error);
+}
+
+static void
+urtwn_fw_reset(struct urtwn_softc *sc)
+{
+	uint16_t reg;
+	int ntries;
+
+	/* Tell 8051 to reset itself. */
+	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
+
+	/* Wait until 8051 resets by itself. */
+	for (ntries = 0; ntries < 100; ntries++) {
+		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
+		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
+			return;
+		DELAY(50);
+	}
+	/* Force 8051 reset. */
+	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
+}
+
+static int
+urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
+{
+	uint32_t reg;
+	int off, mlen, error = 0;
+
+	reg = urtwn_read_4(sc, R92C_MCUFWDL);
+	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
+	urtwn_write_4(sc, R92C_MCUFWDL, reg);
+
+	off = R92C_FW_START_ADDR;
+	while (len > 0) {
+		if (len > 196)
+			mlen = 196;
+		else if (len > 4)
+			mlen = 4;
+		else
+			mlen = 1;
+		/* XXX fix this deconst */
+		error = urtwn_write_region_1(sc, off, 
+		    __DECONST(uint8_t *, buf), mlen);
+		if (error != 0)
+			break;
+		off += mlen;
+		buf += mlen;
+		len -= mlen;
+	}
+	return (error);
+}
+
+static int
+urtwn_load_firmware(struct urtwn_softc *sc)
+{
+	const struct firmware *fw;
+	const struct r92c_fw_hdr *hdr;
+	const char *imagename;
+	const u_char *ptr;
+	size_t len;
+	uint32_t reg;
+	int mlen, ntries, page, error;
+
+	/* Read firmware image from the filesystem. */
+	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
+	    URTWN_CHIP_UMC_A_CUT)
+		imagename = "urtwn-rtl8192cfwU";
+	else
+		imagename = "urtwn-rtl8192cfwT";
+
+	fw = firmware_get(imagename);
+	if (fw == NULL) {
+		device_printf(sc->sc_dev,
+		    "failed loadfirmware of file %s\n", imagename);
+		return (ENOENT);
+	}
+
+	len = fw->datasize;
+
+	if (len < sizeof(*hdr)) {
+		device_printf(sc->sc_dev, "firmware too short\n");
+		error = EINVAL;
+		goto fail;
+	}
+	ptr = fw->data;
+	hdr = (const struct r92c_fw_hdr *)ptr;
+	/* Check if there is a valid FW header and skip it. */
+	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
+	    (le16toh(hdr->signature) >> 4) == 0x92c) {
+		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
+		    le16toh(hdr->version), le16toh(hdr->subversion),
+		    hdr->month, hdr->date, hdr->hour, hdr->minute);
+		ptr += sizeof(*hdr);
+		len -= sizeof(*hdr);
+	}
+
+	if (urtwn_read_1(sc, R92C_MCUFWDL) & 0x80) {
+		urtwn_fw_reset(sc);
+		urtwn_write_1(sc, R92C_MCUFWDL, 0);
+	}
+	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
+	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
+	    R92C_SYS_FUNC_EN_CPUEN);
+	urtwn_write_1(sc, R92C_MCUFWDL,
+	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
+	urtwn_write_1(sc, R92C_MCUFWDL + 2,
+	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
+
+	for (page = 0; len > 0; page++) {
+		mlen = min(len, R92C_FW_PAGE_SIZE);
+		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
+		if (error != 0) {
+			device_printf(sc->sc_dev,
+			    "could not load firmware page\n");
+			goto fail;
+		}
+		ptr += mlen;
+		len -= mlen;
+	}
+	urtwn_write_1(sc, R92C_MCUFWDL,
+	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
+	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
+
+	/* Wait for checksum report. */
+	for (ntries = 0; ntries < 1000; ntries++) {
+		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
+			break;
+		DELAY(5);
+	}
+	if (ntries == 1000) {
+		device_printf(sc->sc_dev,
+		    "timeout waiting for checksum report\n");
+		error = ETIMEDOUT;
+		goto fail;
+	}
+
+	reg = urtwn_read_4(sc, R92C_MCUFWDL);
+	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
+	urtwn_write_4(sc, R92C_MCUFWDL, reg);
+	/* Wait for firmware readiness. */
+	for (ntries = 0; ntries < 1000; ntries++) {
+		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
+			break;
+		DELAY(5);
+	}
+	if (ntries == 1000) {
+		device_printf(sc->sc_dev,
+		    "timeout waiting for firmware readiness\n");
+		error = ETIMEDOUT;
+		goto fail;
+	}
+fail:
+	firmware_put(fw, FIRMWARE_UNLOAD);
+	return (error);
+}
+
+static int
+urtwn_dma_init(struct urtwn_softc *sc)
+{
+	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
+	uint32_t reg;
+	int error;
+
+	/* Initialize LLT table. */
+	error = urtwn_llt_init(sc);
+	if (error != 0)
+		return (error);
+
+	/* Get Tx queues to USB endpoints mapping. */
+	hashq = hasnq = haslq = 0;
+	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
+	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
+	if (MS(reg, R92C_USB_EP_HQ) != 0)
+		hashq = 1;
+	if (MS(reg, R92C_USB_EP_NQ) != 0)
+		hasnq = 1;
+	if (MS(reg, R92C_USB_EP_LQ) != 0)
+		haslq = 1;
+	nqueues = hashq + hasnq + haslq;
+	if (nqueues == 0)
+		return (EIO);
+	/* Get the number of pages for each queue. */
+	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
+	/* The remaining pages are assigned to the high priority queue. */
+	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
+
+	/* Set number of pages for normal priority queue. */
+	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
+	urtwn_write_4(sc, R92C_RQPN,
+	    /* Set number of pages for public queue. */
+	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
+	    /* Set number of pages for high priority queue. */
+	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
+	    /* Set number of pages for low priority queue. */
+	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
+	    /* Load values. */
+	    R92C_RQPN_LD);
+
+	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
+	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
+	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
+	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
+	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
+
+	/* Set queue to USB pipe mapping. */
+	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
+	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
+	if (nqueues == 1) {
+		if (hashq)
+			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
+		else if (hasnq)
+			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
+		else
+			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
+	} else if (nqueues == 2) {
+		/* All 2-endpoints configs have a high priority queue. */
+		if (!hashq)
+			return (EIO);
+		if (hasnq)
+			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
+		else
+			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
+	} else
+		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
+	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
+
+	/* Set Tx/Rx transfer page boundary. */
+	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
+
+	/* Set Tx/Rx transfer page size. */
+	urtwn_write_1(sc, R92C_PBP,
+	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
+	    SM(R92C_PBP_PSTX, R92C_PBP_128));
+	return (0);
+}
+
+static void
+urtwn_mac_init(struct urtwn_softc *sc)
+{
+	int i;
+
+	/* Write MAC initialization values. */
+	for (i = 0; i < nitems(rtl8192cu_mac); i++)
+		urtwn_write_1(sc, rtl8192cu_mac[i].reg, rtl8192cu_mac[i].val);
+}
+
+static void
+urtwn_bb_init(struct urtwn_softc *sc)
+{
+	const struct urtwn_bb_prog *prog;
+	uint32_t reg;
+	int i;
+
+	/* Enable BB and RF. */
+	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
+	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
+	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
+	    R92C_SYS_FUNC_EN_DIO_RF);
+
+	urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
+
+	urtwn_write_1(sc, R92C_RF_CTRL,
+	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
+	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
+	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
+	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
+
+	urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
+	urtwn_write_1(sc, 0x15, 0xe9);
+	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
+
+	/* Select BB programming based on board type. */
+	if (!(sc->chip & URTWN_CHIP_92C)) {
+		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
+			prog = &rtl8188ce_bb_prog;
+		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
+			prog = &rtl8188ru_bb_prog;
+		else
+			prog = &rtl8188cu_bb_prog;
+	} else {
+		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
+			prog = &rtl8192ce_bb_prog;
+		else
+			prog = &rtl8192cu_bb_prog;
+	}
+	/* Write BB initialization values. */
+	for (i = 0; i < prog->count; i++) {
+		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
+		DELAY(1);
+	}
+
+	if (sc->chip & URTWN_CHIP_92C_1T2R) {
+		/* 8192C 1T only configuration. */
+		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
+		reg = (reg & ~0x00000003) | 0x2;
+		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
+
+		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
+		reg = (reg & ~0x00300033) | 0x00200022;
+		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
+
+		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
+		reg = (reg & ~0xff000000) | 0x45 << 24;
+		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
+
+		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
+		reg = (reg & ~0x000000ff) | 0x23;
+		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
+
+		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
+		reg = (reg & ~0x00000030) | 1 << 4;
+		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
+
+		reg = urtwn_bb_read(sc, 0xe74);
+		reg = (reg & ~0x0c000000) | 2 << 26;
+		urtwn_bb_write(sc, 0xe74, reg);
+		reg = urtwn_bb_read(sc, 0xe78);
+		reg = (reg & ~0x0c000000) | 2 << 26;
+		urtwn_bb_write(sc, 0xe78, reg);
+		reg = urtwn_bb_read(sc, 0xe7c);
+		reg = (reg & ~0x0c000000) | 2 << 26;
+		urtwn_bb_write(sc, 0xe7c, reg);
+		reg = urtwn_bb_read(sc, 0xe80);
+		reg = (reg & ~0x0c000000) | 2 << 26;
+		urtwn_bb_write(sc, 0xe80, reg);
+		reg = urtwn_bb_read(sc, 0xe88);
+		reg = (reg & ~0x0c000000) | 2 << 26;
+		urtwn_bb_write(sc, 0xe88, reg);
+	}
+
+	/* Write AGC values. */
+	for (i = 0; i < prog->agccount; i++) {
+		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
+		    prog->agcvals[i]);
+		DELAY(1);
+	}
+
+	if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
+	    R92C_HSSI_PARAM2_CCK_HIPWR)
+		sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
+}
+
+void
+urtwn_rf_init(struct urtwn_softc *sc)
+{
+	const struct urtwn_rf_prog *prog;
+	uint32_t reg, type;
+	int i, j, idx, off;
+
+	/* Select RF programming based on board type. */
+	if (!(sc->chip & URTWN_CHIP_92C)) {
+		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
+			prog = rtl8188ce_rf_prog;
+		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
+			prog = rtl8188ru_rf_prog;
+		else
+			prog = rtl8188cu_rf_prog;
+	} else
+		prog = rtl8192ce_rf_prog;
+
+	for (i = 0; i < sc->nrxchains; i++) {
+		/* Save RF_ENV control type. */
+		idx = i / 2;
+		off = (i % 2) * 16;
+		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
+		type = (reg >> off) & 0x10;
+
+		/* Set RF_ENV enable. */
+		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
+		reg |= 0x100000;
+		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
+		DELAY(1);
+		/* Set RF_ENV output high. */
+		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
+		reg |= 0x10;
+		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
+		DELAY(1);
+		/* Set address and data lengths of RF registers. */
+		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
+		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
+		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
+		DELAY(1);
+		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
+		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
+		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
+		DELAY(1);
+
+		/* Write RF initialization values for this chain. */
+		for (j = 0; j < prog[i].count; j++) {
+			if (prog[i].regs[j] >= 0xf9 &&
+			    prog[i].regs[j] <= 0xfe) {
+				/*
+				 * These are fake RF registers offsets that
+				 * indicate a delay is required.
+				 */
+				usb_pause_mtx(&sc->sc_mtx, 50);
+				continue;
+			}
+			urtwn_rf_write(sc, i, prog[i].regs[j],
+			    prog[i].vals[j]);
+			DELAY(1);
+		}
+
+		/* Restore RF_ENV control type. */
+		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
+		reg &= ~(0x10 << off) | (type << off);
+		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
+
+		/* Cache RF register CHNLBW. */
+		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
+	}
+
+	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
+	    URTWN_CHIP_UMC_A_CUT) {
+		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
+		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
+	}
+}
+
+static void
+urtwn_cam_init(struct urtwn_softc *sc)
+{
+	/* Invalidate all CAM entries. */
+	urtwn_write_4(sc, R92C_CAMCMD,
+	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
+}
+
+static void
+urtwn_pa_bias_init(struct urtwn_softc *sc)
+{
+	uint8_t reg;
+	int i;
+
+	for (i = 0; i < sc->nrxchains; i++) {
+		if (sc->pa_setting & (1 << i))
+			continue;
+		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
+		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
+		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
+		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
+	}
+	if (!(sc->pa_setting & 0x10)) {
+		reg = urtwn_read_1(sc, 0x16);
+		reg = (reg & ~0xf0) | 0x90;
+		urtwn_write_1(sc, 0x16, reg);
+	}
+}
+
+static void
+urtwn_rxfilter_init(struct urtwn_softc *sc)
+{
+	/* Initialize Rx filter. */
+	/* TODO: use better filter for monitor mode. */
+	urtwn_write_4(sc, R92C_RCR,
+	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
+	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
+	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
+	/* Accept all multicast frames. */
+	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
+	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
+	/* Accept all management frames. */
+	urtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
+	/* Reject all control frames. */
+	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
+	/* Accept all data frames. */
+	urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
+}
+
+static void
+urtwn_edca_init(struct urtwn_softc *sc)
+{
+	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
+	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
+	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
+	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
+	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
+	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
+	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
+	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
+}
+
+void
+urtwn_write_txpower(struct urtwn_softc *sc, int chain,
+    uint16_t power[URTWN_RIDX_COUNT])
+{
+	uint32_t reg;
+
+	/* Write per-CCK rate Tx power. */
+	if (chain == 0) {
+		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
+		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
+		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
+		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
+		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
+		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
+		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
+		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
+	} else {
+		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
+		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
+		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
+		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
+		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
+		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
+		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
+		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
+	}
+	/* Write per-OFDM rate Tx power. */
+	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
+	    SM(R92C_TXAGC_RATE06, power[ 4]) |
+	    SM(R92C_TXAGC_RATE09, power[ 5]) |
+	    SM(R92C_TXAGC_RATE12, power[ 6]) |
+	    SM(R92C_TXAGC_RATE18, power[ 7]));
+	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
+	    SM(R92C_TXAGC_RATE24, power[ 8]) |
+	    SM(R92C_TXAGC_RATE36, power[ 9]) |
+	    SM(R92C_TXAGC_RATE48, power[10]) |
+	    SM(R92C_TXAGC_RATE54, power[11]));
+	/* Write per-MCS Tx power. */
+	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
+	    SM(R92C_TXAGC_MCS00,  power[12]) |
+	    SM(R92C_TXAGC_MCS01,  power[13]) |
+	    SM(R92C_TXAGC_MCS02,  power[14]) |
+	    SM(R92C_TXAGC_MCS03,  power[15]));
+	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
+	    SM(R92C_TXAGC_MCS04,  power[16]) |
+	    SM(R92C_TXAGC_MCS05,  power[17]) |
+	    SM(R92C_TXAGC_MCS06,  power[18]) |
+	    SM(R92C_TXAGC_MCS07,  power[19]));
+	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
+	    SM(R92C_TXAGC_MCS08,  power[20]) |
+	    SM(R92C_TXAGC_MCS08,  power[21]) |
+	    SM(R92C_TXAGC_MCS10,  power[22]) |
+	    SM(R92C_TXAGC_MCS11,  power[23]));
+	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
+	    SM(R92C_TXAGC_MCS12,  power[24]) |
+	    SM(R92C_TXAGC_MCS13,  power[25]) |
+	    SM(R92C_TXAGC_MCS14,  power[26]) |
+	    SM(R92C_TXAGC_MCS15,  power[27]));
+}
+
+void
+urtwn_get_txpower(struct urtwn_softc *sc, int chain,
+    struct ieee80211_channel *c, struct ieee80211_channel *extc,
+    uint16_t power[URTWN_RIDX_COUNT])
+{
+	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
+	struct r92c_rom *rom = &sc->rom;
+	uint16_t cckpow, ofdmpow, htpow, diff, max;
+	const struct urtwn_txpwr *base;
+	int ridx, chan, group;
+
+	/* Determine channel group. */
+	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
+	if (chan <= 3)
+		group = 0;
+	else if (chan <= 9)
+		group = 1;
+	else
+		group = 2;
+
+	/* Get original Tx power based on board type and RF chain. */
+	if (!(sc->chip & URTWN_CHIP_92C)) {
+		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
+			base = &rtl8188ru_txagc[chain];
+		else
+			base = &rtl8192cu_txagc[chain];
+	} else
+		base = &rtl8192cu_txagc[chain];
+
+	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
+	if (sc->regulatory == 0) {
+		for (ridx = 0; ridx <= 3; ridx++)
+			power[ridx] = base->pwr[0][ridx];
+	}
+	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
+		if (sc->regulatory == 3) {
+			power[ridx] = base->pwr[0][ridx];
+			/* Apply vendor limits. */
+			if (extc != NULL)
+				max = rom->ht40_max_pwr[group];
+			else
+				max = rom->ht20_max_pwr[group];
+			max = (max >> (chain * 4)) & 0xf;
+			if (power[ridx] > max)
+				power[ridx] = max;
+		} else if (sc->regulatory == 1) {
+			if (extc == NULL)
+				power[ridx] = base->pwr[group][ridx];
+		} else if (sc->regulatory != 2)
+			power[ridx] = base->pwr[0][ridx];
+	}
+
+	/* Compute per-CCK rate Tx power. */
+	cckpow = rom->cck_tx_pwr[chain][group];
+	for (ridx = 0; ridx <= 3; ridx++) {
+		power[ridx] += cckpow;
+		if (power[ridx] > R92C_MAX_TX_PWR)
+			power[ridx] = R92C_MAX_TX_PWR;
+	}
+
+	htpow = rom->ht40_1s_tx_pwr[chain][group];
+	if (sc->ntxchains > 1) {
+		/* Apply reduction for 2 spatial streams. */
+		diff = rom->ht40_2s_tx_pwr_diff[group];
+		diff = (diff >> (chain * 4)) & 0xf;
+		htpow = (htpow > diff) ? htpow - diff : 0;
+	}
+
+	/* Compute per-OFDM rate Tx power. */
+	diff = rom->ofdm_tx_pwr_diff[group];
+	diff = (diff >> (chain * 4)) & 0xf;
+	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
+	for (ridx = 4; ridx <= 11; ridx++) {
+		power[ridx] += ofdmpow;
+		if (power[ridx] > R92C_MAX_TX_PWR)
+			power[ridx] = R92C_MAX_TX_PWR;
+	}
+
+	/* Compute per-MCS Tx power. */
+	if (extc == NULL) {
+		diff = rom->ht20_tx_pwr_diff[group];
+		diff = (diff >> (chain * 4)) & 0xf;
+		htpow += diff;	/* HT40->HT20 correction. */
+	}
+	for (ridx = 12; ridx <= 27; ridx++) {
+		power[ridx] += htpow;
+		if (power[ridx] > R92C_MAX_TX_PWR)
+			power[ridx] = R92C_MAX_TX_PWR;
+	}
+#ifdef URTWN_DEBUG
+	if (urtwn_debug >= 4) {
+		/* Dump per-rate Tx power values. */
+		printf("Tx power for chain %d:\n", chain);
+		for (ridx = 0; ridx < URTWN_RIDX_COUNT; ridx++)
+			printf("Rate %d = %u\n", ridx, power[ridx]);
+	}
+#endif
+}
+
+void
+urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
+    struct ieee80211_channel *extc)
+{
+	uint16_t power[URTWN_RIDX_COUNT];
+	int i;
+
+	for (i = 0; i < sc->ntxchains; i++) {
+		/* Compute per-rate Tx power values. */
+		urtwn_get_txpower(sc, i, c, extc, power);
+		/* Write per-rate Tx power values to hardware. */
+		urtwn_write_txpower(sc, i, power);
+	}
+}
+
+static void
+urtwn_scan_start(struct ieee80211com *ic)
+{
+	/* XXX do nothing?  */
+}
+
+static void
+urtwn_scan_end(struct ieee80211com *ic)
+{
+	/* XXX do nothing?  */
+}
+
+static void
+urtwn_set_channel(struct ieee80211com *ic)
+{
+	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
+
+	URTWN_LOCK(sc);
+	urtwn_set_chan(sc, ic->ic_curchan, NULL);
+	URTWN_UNLOCK(sc);
+}
+
+static void
+urtwn_update_mcast(struct ifnet *ifp)
+{
+	/* XXX do nothing?  */
+}
+
+static void
+urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
+    struct ieee80211_channel *extc)
+{
+	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
+	uint32_t reg;
+	u_int chan;
+	int i;
+
+	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
+	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
+		device_printf(sc->sc_dev,
+		    "%s: invalid channel %x\n", __func__, chan);
+		return;
+	}
+
+	/* Set Tx power for this new channel. */
+	urtwn_set_txpower(sc, c, extc);
+
+	for (i = 0; i < sc->nrxchains; i++) {
+		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
+		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
+	}
+#ifndef IEEE80211_NO_HT
+	if (extc != NULL) {
+		/* Is secondary channel below or above primary? */
+		int prichlo = c->ic_freq < extc->ic_freq;
+
+		urtwn_write_1(sc, R92C_BWOPMODE,
+		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
+
+		reg = urtwn_read_1(sc, R92C_RRSR + 2);
+		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
+		urtwn_write_1(sc, R92C_RRSR + 2, reg);
+
+		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
+		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
+		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
+		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
+
+		/* Set CCK side band. */
+		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
+		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
+		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
+
+		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
+		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
+		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
+
+		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
+		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
+		    ~R92C_FPGA0_ANAPARAM2_CBW20);
+
+		reg = urtwn_bb_read(sc, 0x818);
+		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
+		urtwn_bb_write(sc, 0x818, reg);
+
+		/* Select 40MHz bandwidth. */
+		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
+		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
+	} else
+#endif
+	{
+		urtwn_write_1(sc, R92C_BWOPMODE,
+		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
+
+		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
+		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
+		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
+		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
+
+		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
+		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
+		    R92C_FPGA0_ANAPARAM2_CBW20);
+
+		/* Select 20MHz bandwidth. */
+		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
+		    (sc->rf_chnlbw[0] & ~0xfff) | R92C_RF_CHNLBW_BW20 | chan);
+	}
+}
+
+static void
+urtwn_iq_calib(struct urtwn_softc *sc)
+{
+	/* TODO */
+}
+
+static void
+urtwn_lc_calib(struct urtwn_softc *sc)
+{
+	uint32_t rf_ac[2];
+	uint8_t txmode;
+	int i;
+
+	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
+	if ((txmode & 0x70) != 0) {
+		/* Disable all continuous Tx. */
+		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
+
+		/* Set RF mode to standby mode. */
+		for (i = 0; i < sc->nrxchains; i++) {
+			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
+			urtwn_rf_write(sc, i, R92C_RF_AC,
+			    RW(rf_ac[i], R92C_RF_AC_MODE,
+				R92C_RF_AC_MODE_STANDBY));
+		}
+	} else {
+		/* Block all Tx queues. */
+		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
+	}
+	/* Start calibration. */
+	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
+	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
+
+	/* Give calibration the time to complete. */
+	usb_pause_mtx(&sc->sc_mtx, 100);
+
+	/* Restore configuration. */
+	if ((txmode & 0x70) != 0) {
+		/* Restore Tx mode. */
+		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
+		/* Restore RF mode. */
+		for (i = 0; i < sc->nrxchains; i++)
+			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
+	} else {
+		/* Unblock all Tx queues. */
+		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
+	}
+}
+
+static void
+urtwn_init_locked(void *arg)
+{
+	struct urtwn_softc *sc = arg;
+	struct ifnet *ifp = sc->sc_ifp;
+	uint32_t reg;
+	int error;
+
+	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
+		urtwn_stop_locked(ifp, 0);
+
+	/* Init firmware commands ring. */
+	sc->fwcur = 0;
+
+	/* Allocate Tx/Rx buffers. */
+	error = urtwn_alloc_rx_list(sc);
+	if (error != 0)
+		goto fail;
+	
+	error = urtwn_alloc_tx_list(sc);
+	if (error != 0)
+		goto fail;
+
+	/* Power on adapter. */
+	error = urtwn_power_on(sc);
+	if (error != 0)
+		goto fail;
+
+	/* Initialize DMA. */
+	error = urtwn_dma_init(sc);
+	if (error != 0)
+		goto fail;
+
+	/* Set info size in Rx descriptors (in 64-bit words). */
+	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
+
+	/* Init interrupts. */
+	urtwn_write_4(sc, R92C_HISR, 0xffffffff);
+	urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
+
+	/* Set MAC address. */
+	urtwn_write_region_1(sc, R92C_MACID, IF_LLADDR(ifp),
+	    IEEE80211_ADDR_LEN);
+
+	/* Set initial network type. */
+	reg = urtwn_read_4(sc, R92C_CR);
+	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
+	urtwn_write_4(sc, R92C_CR, reg);
+
+	urtwn_rxfilter_init(sc);
+
+	reg = urtwn_read_4(sc, R92C_RRSR);
+	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
+	urtwn_write_4(sc, R92C_RRSR, reg);
+
+	/* Set short/long retry limits. */
+	urtwn_write_2(sc, R92C_RL,
+	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
+
+	/* Initialize EDCA parameters. */
+	urtwn_edca_init(sc);
+
+	/* Setup rate fallback. */
+	urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
+	urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
+	urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
+	urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
+
+	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
+	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
+	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
+	/* Set ACK timeout. */
+	urtwn_write_1(sc, R92C_ACKTO, 0x40);
+
+	/* Setup USB aggregation. */
+	reg = urtwn_read_4(sc, R92C_TDECTRL);
+	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
+	urtwn_write_4(sc, R92C_TDECTRL, reg);
+	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
+	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
+	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
+	urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
+	    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
+	    R92C_USB_SPECIAL_OPTION_AGG_EN);
+	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
+	urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
+	urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
+	urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
+
+	/* Initialize beacon parameters. */
+	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
+	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
+	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
+	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
+
+	/* Setup AMPDU aggregation. */
+	urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
+	urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
+	urtwn_write_2(sc, 0x4ca, 0x0708);
+
+	urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
+	urtwn_write_1(sc, R92C_BCN_CTRL, R92C_BCN_CTRL_DIS_TSF_UDT0);
+
+	/* Load 8051 microcode. */
+	error = urtwn_load_firmware(sc);
+	if (error != 0)
+		goto fail;
+
+	/* Initialize MAC/BB/RF blocks. */
+	urtwn_mac_init(sc);
+	urtwn_bb_init(sc);
+	urtwn_rf_init(sc);
+
+	/* Turn CCK and OFDM blocks on. */
+	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
+	reg |= R92C_RFMOD_CCK_EN;
+	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
+	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
+	reg |= R92C_RFMOD_OFDM_EN;
+	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
+
+	/* Clear per-station keys table. */
+	urtwn_cam_init(sc);
+
+	/* Enable hardware sequence numbering. */
+	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
+
+	/* Perform LO and IQ calibrations. */
+	urtwn_iq_calib(sc);
+	/* Perform LC calibration. */
+	urtwn_lc_calib(sc);
+
+	/* Fix USB interference issue. */
+	urtwn_write_1(sc, 0xfe40, 0xe0);
+	urtwn_write_1(sc, 0xfe41, 0x8d);
+	urtwn_write_1(sc, 0xfe42, 0x80);
+
+	urtwn_pa_bias_init(sc);
+
+	/* Initialize GPIO setting. */
+	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
+	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
+
+	/* Fix for lower temperature. */
+	urtwn_write_1(sc, 0x15, 0xe9);
+
+	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
+
+	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
+	ifp->if_drv_flags |= IFF_DRV_RUNNING;
+
+	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
+fail:
+	return;
+}
+
+static void
+urtwn_init(void *arg)
+{
+	struct urtwn_softc *sc = arg;
+
+	URTWN_LOCK(sc);
+	urtwn_init_locked(arg);
+	URTWN_UNLOCK(sc);
+}
+
+static void
+urtwn_stop_locked(struct ifnet *ifp, int disable)
+{
+	struct urtwn_softc *sc = ifp->if_softc;
+
+	(void)disable;
+	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
+
+	callout_stop(&sc->sc_watchdog_ch);
+	urtwn_abort_xfers(sc);
+}
+
+static void
+urtwn_stop(struct ifnet *ifp, int disable)
+{
+	struct urtwn_softc *sc = ifp->if_softc;
+
+	URTWN_LOCK(sc);
+	urtwn_stop_locked(ifp, disable);
+	URTWN_UNLOCK(sc);
+}
+
+static void
+urtwn_abort_xfers(struct urtwn_softc *sc)
+{
+	int i;
+
+	URTWN_ASSERT_LOCKED(sc);
+
+	/* abort any pending transfers */
+	for (i = 0; i < URTWN_N_TRANSFER; i++)
+		usbd_transfer_stop(sc->sc_xfer[i]);
+}
+
+static int
+urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
+    const struct ieee80211_bpf_params *params)
+{
+	struct ieee80211com *ic = ni->ni_ic;
+	struct ifnet *ifp = ic->ic_ifp;
+	struct urtwn_softc *sc = ifp->if_softc;
+	struct urtwn_data *bf;
+
+	/* prevent management frames from being sent if we're not ready */
+	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
+		m_freem(m);
+		ieee80211_free_node(ni);
+		return (ENETDOWN);
+	}
+	URTWN_LOCK(sc);
+	bf = urtwn_getbuf(sc);
+	if (bf == NULL) {
+		ieee80211_free_node(ni);
+		m_freem(m);
+		URTWN_UNLOCK(sc);
+		return (ENOBUFS);
+	}
+
+	ifp->if_opackets++;
+	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
+		ieee80211_free_node(ni);
+		ifp->if_oerrors++;
+		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
+		URTWN_UNLOCK(sc);
+		return (EIO);
+	}
+	URTWN_UNLOCK(sc);
+
+	sc->sc_txtimer = 5;
+	return (0);
+}
+
+static device_method_t urtwn_methods[] = {
+	/* Device interface */
+	DEVMETHOD(device_probe,		urtwn_match),
+	DEVMETHOD(device_attach,	urtwn_attach),
+	DEVMETHOD(device_detach,	urtwn_detach),
+
+	{ 0, 0 }
+};
+
+static driver_t urtwn_driver = {
+	"urtwn",
+	urtwn_methods,
+	sizeof(struct urtwn_softc)
+};
+
+static devclass_t urtwn_devclass;
+
+DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
+MODULE_DEPEND(urtwn, usb, 1, 1, 1);
+MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
+MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
+MODULE_DEPEND(urtwn, urtwn_fw, 1, 1, 1);
+MODULE_VERSION(urtwn, 1);
diff --git a/sys/dev/usb/wlan/if_urtwnreg.h b/sys/dev/usb/wlan/if_urtwnreg.h
new file mode 100644
index 0000000..c827b3e
--- /dev/null
+++ b/sys/dev/usb/wlan/if_urtwnreg.h
@@ -0,0 +1,1896 @@
+/*-
+ * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ * 
+ * $OpenBSD: if_urtwnreg.h,v 1.3 2010/11/16 18:02:59 damien Exp $
+ * $FreeBSD$
+ */
+
+#define URTWN_CONFIG_INDEX	0
+#define URTWN_IFACE_INDEX	0
+
+#define	URTWN_NOISE_FLOOR	-95
+
+#define R92C_MAX_CHAINS	2
+
+/* Maximum number of output pipes is 3. */
+#define R92C_MAX_EPOUT	3
+
+#define R92C_MAX_TX_PWR	0x3f
+
+#define R92C_PUBQ_NPAGES	231
+#define R92C_TXPKTBUF_COUNT	256
+#define R92C_TX_PAGE_COUNT	248
+#define R92C_TX_PAGE_BOUNDARY	(R92C_TX_PAGE_COUNT + 1)
+
+#define R92C_H2C_NBOX	4
+
+/* USB Requests. */
+#define R92C_REQ_REGS	0x05
+
+/*
+ * MAC registers.
+ */
+/* System Configuration. */
+#define R92C_SYS_ISO_CTRL		0x000
+#define R92C_SYS_FUNC_EN		0x002
+#define R92C_APS_FSMCO			0x004
+#define R92C_SYS_CLKR			0x008
+#define R92C_AFE_MISC			0x010
+#define R92C_SPS0_CTRL			0x011
+#define R92C_SPS_OCP_CFG		0x018
+#define R92C_RSV_CTRL			0x01c
+#define R92C_RF_CTRL			0x01f
+#define R92C_LDOA15_CTRL		0x020
+#define R92C_LDOV12D_CTRL		0x021
+#define R92C_LDOHCI12_CTRL		0x022
+#define R92C_LPLDO_CTRL			0x023
+#define R92C_AFE_XTAL_CTRL		0x024
+#define R92C_AFE_PLL_CTRL		0x028
+#define R92C_EFUSE_CTRL			0x030
+#define R92C_EFUSE_TEST			0x034
+#define R92C_PWR_DATA			0x038
+#define R92C_CAL_TIMER			0x03c
+#define R92C_ACLK_MON			0x03e
+#define R92C_GPIO_MUXCFG		0x040
+#define R92C_GPIO_IO_SEL		0x042
+#define R92C_MAC_PINMUX_CFG		0x043
+#define R92C_GPIO_PIN_CTRL		0x044
+#define R92C_GPIO_INTM			0x048
+#define R92C_LEDCFG0			0x04c
+#define R92C_LEDCFG1			0x04d
+#define R92C_LEDCFG2			0x04e
+#define R92C_LEDCFG3			0x04f
+#define R92C_FSIMR			0x050
+#define R92C_FSISR			0x054
+#define R92C_HSIMR			0x058
+#define R92C_HSISR			0x05c
+#define R92C_MCUFWDL			0x080
+#define R92C_HMEBOX_EXT(idx)		(0x088 + (idx) * 2)
+#define R92C_BIST_SCAN			0x0d0
+#define R92C_BIST_RPT			0x0d4
+#define R92C_BIST_ROM_RPT		0x0d8
+#define R92C_USB_SIE_INTF		0x0e0
+#define R92C_PCIE_MIO_INTF		0x0e4
+#define R92C_PCIE_MIO_INTD		0x0e8
+#define R92C_HPON_FSM			0x0ec
+#define R92C_SYS_CFG			0x0f0
+/* MAC General Configuration. */
+#define R92C_CR				0x100
+#define R92C_PBP			0x104
+#define R92C_TRXDMA_CTRL		0x10c
+#define R92C_TRXFF_BNDY			0x114
+#define R92C_TRXFF_STATUS		0x118
+#define R92C_RXFF_PTR			0x11c
+#define R92C_HIMR			0x120
+#define R92C_HISR			0x124
+#define R92C_HIMRE			0x128
+#define R92C_HISRE			0x12c
+#define R92C_CPWM			0x12f
+#define R92C_FWIMR			0x130
+#define R92C_FWISR			0x134
+#define R92C_PKTBUF_DBG_CTRL		0x140
+#define R92C_PKTBUF_DBG_DATA_L		0x144
+#define R92C_PKTBUF_DBG_DATA_H		0x148
+#define R92C_TC0_CTRL(i)		(0x150 + (i) * 4)
+#define R92C_TCUNIT_BASE		0x164
+#define R92C_MBIST_START		0x174
+#define R92C_MBIST_DONE			0x178
+#define R92C_MBIST_FAIL			0x17c
+#define R92C_C2HEVT_MSG_NORMAL		0x1a0
+#define R92C_C2HEVT_MSG_TEST		0x1b8
+#define R92C_C2HEVT_CLEAR		0x1bf
+#define R92C_MCUTST_1			0x1c0
+#define R92C_FMETHR			0x1c8
+#define R92C_HMETFR			0x1cc
+#define R92C_HMEBOX(idx)		(0x1d0 + (idx) * 4)
+#define R92C_LLT_INIT			0x1e0
+#define R92C_BB_ACCESS_CTRL		0x1e8
+#define R92C_BB_ACCESS_DATA		0x1ec
+/* Tx DMA Configuration. */
+#define R92C_RQPN			0x200
+#define R92C_FIFOPAGE			0x204
+#define R92C_TDECTRL			0x208
+#define R92C_TXDMA_OFFSET_CHK		0x20c
+#define R92C_TXDMA_STATUS		0x210
+#define R92C_RQPN_NPQ			0x214
+/* Rx DMA Configuration. */
+#define R92C_RXDMA_AGG_PG_TH		0x280
+#define R92C_RXPKT_NUM			0x284
+#define R92C_RXDMA_STATUS		0x288
+/* Protocol Configuration. */
+#define R92C_FWHW_TXQ_CTRL		0x420
+#define R92C_HWSEQ_CTRL			0x423
+#define R92C_TXPKTBUF_BCNQ_BDNY		0x424
+#define R92C_TXPKTBUF_MGQ_BDNY		0x425
+#define R92C_SPEC_SIFS			0x428
+#define R92C_RL				0x42a
+#define R92C_DARFRC			0x430
+#define R92C_RARFRC			0x438
+#define R92C_RRSR			0x440
+#define R92C_ARFR(i)			(0x444 + (i) * 4)
+#define R92C_AGGLEN_LMT			0x458
+#define R92C_AMPDU_MIN_SPACE		0x45c
+#define R92C_TXPKTBUF_WMAC_LBK_BF_HD	0x45d
+#define R92C_FAST_EDCA_CTRL		0x460
+#define R92C_RD_RESP_PKT_TH		0x463
+#define R92C_INIRTS_RATE_SEL		0x480
+#define R92C_INIDATA_RATE_SEL(macid)	(0x484 + (macid))
+/* EDCA Configuration. */
+#define R92C_EDCA_VO_PARAM		0x500
+#define R92C_EDCA_VI_PARAM		0x504
+#define R92C_EDCA_BE_PARAM		0x508
+#define R92C_EDCA_BK_PARAM		0x50c
+#define R92C_BCNTCFG			0x510
+#define R92C_PIFS			0x512
+#define R92C_RDG_PIFS			0x513
+#define R92C_SIFS_CCK			0x514
+#define R92C_SIFS_OFDM			0x516
+#define R92C_AGGR_BREAK_TIME		0x51a
+#define R92C_SLOT			0x51b
+#define R92C_TX_PTCL_CTRL		0x520
+#define R92C_TXPAUSE			0x522
+#define R92C_DIS_TXREQ_CLR		0x523
+#define R92C_RD_CTRL			0x524
+#define R92C_TBTT_PROHIBIT		0x540
+#define R92C_RD_NAV_NXT			0x544
+#define R92C_NAV_PROT_LEN		0x546
+#define R92C_BCN_CTRL			0x550
+#define R92C_USTIME_TSF			0x551
+#define R92C_MBID_NUM			0x552
+#define R92C_DUAL_TSF_RST		0x553
+#define R92C_BCN_INTERVAL		0x554
+#define R92C_DRVERLYINT			0x558
+#define R92C_BCNDMATIM			0x559
+#define R92C_ATIMWND			0x55a
+#define R92C_BCN_MAX_ERR		0x55d
+#define R92C_RXTSF_OFFSET_CCK		0x55e
+#define R92C_RXTSF_OFFSET_OFDM		0x55f
+#define R92C_TSFTR			0x560
+#define R92C_INIT_TSFTR			0x564
+#define R92C_PSTIMER			0x580
+#define R92C_TIMER0			0x584
+#define R92C_TIMER1			0x588
+#define R92C_ACMHWCTRL			0x5c0
+#define R92C_ACMRSTCTRL			0x5c1
+#define R92C_ACMAVG			0x5c2
+#define R92C_VO_ADMTIME			0x5c4
+#define R92C_VI_ADMTIME			0x5c6
+#define R92C_BE_ADMTIME			0x5c8
+#define R92C_EDCA_RANDOM_GEN		0x5cc
+#define R92C_SCH_TXCMD			0x5d0
+/* WMAC Configuration. */
+#define R92C_APSD_CTRL			0x600
+#define R92C_BWOPMODE			0x603
+#define R92C_RCR			0x608
+#define R92C_RX_DRVINFO_SZ		0x60f
+#define R92C_MACID			0x610
+#define R92C_BSSID			0x618
+#define R92C_MAR			0x620
+#define R92C_MAC_SPEC_SIFS		0x63a
+#define R92C_R2T_SIFS			0x63c
+#define R92C_T2T_SIFS			0x63e
+#define R92C_ACKTO			0x640
+#define R92C_CAMCMD			0x670
+#define R92C_CAMWRITE			0x674
+#define R92C_CAMREAD			0x678
+#define R92C_CAMDBG			0x67c
+#define R92C_SECCFG			0x680
+#define R92C_RXFLTMAP0			0x6a0
+#define R92C_RXFLTMAP1			0x6a2
+#define R92C_RXFLTMAP2			0x6a4
+
+/* Bits for R92C_SYS_ISO_CTRL. */
+#define R92C_SYS_ISO_CTRL_MD2PP		0x0001
+#define R92C_SYS_ISO_CTRL_UA2USB	0x0002
+#define R92C_SYS_ISO_CTRL_UD2CORE	0x0004
+#define R92C_SYS_ISO_CTRL_PA2PCIE	0x0008
+#define R92C_SYS_ISO_CTRL_PD2CORE	0x0010
+#define R92C_SYS_ISO_CTRL_IP2MAC	0x0020
+#define R92C_SYS_ISO_CTRL_DIOP		0x0040
+#define R92C_SYS_ISO_CTRL_DIOE		0x0080
+#define R92C_SYS_ISO_CTRL_EB2CORE	0x0100
+#define R92C_SYS_ISO_CTRL_DIOR		0x0200
+#define R92C_SYS_ISO_CTRL_PWC_EV25V	0x4000
+#define R92C_SYS_ISO_CTRL_PWC_EV12V	0x8000
+
+/* Bits for R92C_SYS_FUNC_EN. */
+#define R92C_SYS_FUNC_EN_BBRSTB		0x0001
+#define R92C_SYS_FUNC_EN_BB_GLB_RST	0x0002
+#define R92C_SYS_FUNC_EN_USBA		0x0004
+#define R92C_SYS_FUNC_EN_UPLL		0x0008
+#define R92C_SYS_FUNC_EN_USBD		0x0010
+#define R92C_SYS_FUNC_EN_DIO_PCIE	0x0020
+#define R92C_SYS_FUNC_EN_PCIEA		0x0040
+#define R92C_SYS_FUNC_EN_PPLL		0x0080
+#define R92C_SYS_FUNC_EN_PCIED		0x0100
+#define R92C_SYS_FUNC_EN_DIOE		0x0200
+#define R92C_SYS_FUNC_EN_CPUEN		0x0400
+#define R92C_SYS_FUNC_EN_DCORE		0x0800
+#define R92C_SYS_FUNC_EN_ELDR		0x1000
+#define R92C_SYS_FUNC_EN_DIO_RF		0x2000
+#define R92C_SYS_FUNC_EN_HWPDN		0x4000
+#define R92C_SYS_FUNC_EN_MREGEN		0x8000
+
+/* Bits for R92C_APS_FSMCO. */
+#define R92C_APS_FSMCO_PFM_LDALL	0x00000001
+#define R92C_APS_FSMCO_PFM_ALDN		0x00000002
+#define R92C_APS_FSMCO_PFM_LDKP		0x00000004
+#define R92C_APS_FSMCO_PFM_WOWL		0x00000008
+#define R92C_APS_FSMCO_PDN_EN		0x00000010
+#define R92C_APS_FSMCO_PDN_PL		0x00000020
+#define R92C_APS_FSMCO_APFM_ONMAC	0x00000100
+#define R92C_APS_FSMCO_APFM_OFF		0x00000200
+#define R92C_APS_FSMCO_APFM_RSM		0x00000400
+#define R92C_APS_FSMCO_AFSM_HSUS	0x00000800
+#define R92C_APS_FSMCO_AFSM_PCIE	0x00001000
+#define R92C_APS_FSMCO_APDM_MAC		0x00002000
+#define R92C_APS_FSMCO_APDM_HOST	0x00004000
+#define R92C_APS_FSMCO_APDM_HPDN	0x00008000
+#define R92C_APS_FSMCO_RDY_MACON	0x00010000
+#define R92C_APS_FSMCO_SUS_HOST		0x00020000
+#define R92C_APS_FSMCO_ROP_ALD		0x00100000
+#define R92C_APS_FSMCO_ROP_PWR		0x00200000
+#define R92C_APS_FSMCO_ROP_SPS		0x00400000
+#define R92C_APS_FSMCO_SOP_MRST		0x02000000
+#define R92C_APS_FSMCO_SOP_FUSE		0x04000000
+#define R92C_APS_FSMCO_SOP_ABG		0x08000000
+#define R92C_APS_FSMCO_SOP_AMB		0x10000000
+#define R92C_APS_FSMCO_SOP_RCK		0x20000000
+#define R92C_APS_FSMCO_SOP_A8M		0x40000000
+#define R92C_APS_FSMCO_XOP_BTCK		0x80000000
+
+/* Bits for R92C_SYS_CLKR. */
+#define R92C_SYS_CLKR_ANAD16V_EN	0x00000001
+#define R92C_SYS_CLKR_ANA8M		0x00000002
+#define R92C_SYS_CLKR_MACSLP		0x00000010
+#define R92C_SYS_CLKR_LOADER_EN		0x00000020
+#define R92C_SYS_CLKR_80M_SSC_DIS	0x00000080
+#define R92C_SYS_CLKR_80M_SSC_EN_HO	0x00000100
+#define R92C_SYS_CLKR_PHY_SSC_RSTB	0x00000200
+#define R92C_SYS_CLKR_SEC_EN		0x00000400
+#define R92C_SYS_CLKR_MAC_EN		0x00000800
+#define R92C_SYS_CLKR_SYS_EN		0x00001000
+#define R92C_SYS_CLKR_RING_EN		0x00002000
+
+/* Bits for R92C_RF_CTRL. */
+#define R92C_RF_CTRL_EN		0x01
+#define R92C_RF_CTRL_RSTB	0x02
+#define R92C_RF_CTRL_SDMRSTB	0x04
+
+/* Bits for R92C_LDOV12D_CTRL. */
+#define R92C_LDOV12D_CTRL_LDV12_EN	0x01
+
+/* Bits for R92C_EFUSE_CTRL. */
+#define R92C_EFUSE_CTRL_DATA_M	0x000000ff
+#define R92C_EFUSE_CTRL_DATA_S	0
+#define R92C_EFUSE_CTRL_ADDR_M	0x0003ff00
+#define R92C_EFUSE_CTRL_ADDR_S	8
+#define R92C_EFUSE_CTRL_VALID	0x80000000
+
+/* Bits for R92C_GPIO_MUXCFG. */
+#define R92C_GPIO_MUXCFG_ENBT	0x0020
+
+/* Bits for R92C_LEDCFG0. */
+#define R92C_LEDCFG0_DIS	0x08
+
+/* Bits for R92C_MCUFWDL. */
+#define R92C_MCUFWDL_EN			0x00000001
+#define R92C_MCUFWDL_RDY		0x00000002
+#define R92C_MCUFWDL_CHKSUM_RPT		0x00000004
+#define R92C_MCUFWDL_MACINI_RDY		0x00000008
+#define R92C_MCUFWDL_BBINI_RDY		0x00000010
+#define R92C_MCUFWDL_RFINI_RDY		0x00000020
+#define R92C_MCUFWDL_WINTINI_RDY	0x00000040
+#define R92C_MCUFWDL_PAGE_M		0x00070000
+#define R92C_MCUFWDL_PAGE_S		16
+#define R92C_MCUFWDL_CPRST		0x00800000
+
+/* Bits for R92C_HPON_FSM. */
+#define R92C_HPON_FSM_CHIP_BONDING_ID_S		22
+#define R92C_HPON_FSM_CHIP_BONDING_ID_M		0x00c00000
+#define R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R	1
+
+/* Bits for R92C_SYS_CFG. */
+#define R92C_SYS_CFG_XCLK_VLD		0x00000001
+#define R92C_SYS_CFG_ACLK_VLD		0x00000002
+#define R92C_SYS_CFG_UCLK_VLD		0x00000004
+#define R92C_SYS_CFG_PCLK_VLD		0x00000008
+#define R92C_SYS_CFG_PCIRSTB		0x00000010
+#define R92C_SYS_CFG_V15_VLD		0x00000020
+#define R92C_SYS_CFG_TRP_B15V_EN	0x00000080
+#define R92C_SYS_CFG_SIC_IDLE		0x00000100
+#define R92C_SYS_CFG_BD_MAC2		0x00000200
+#define R92C_SYS_CFG_BD_MAC1		0x00000400
+#define R92C_SYS_CFG_IC_MACPHY_MODE	0x00000800
+#define R92C_SYS_CFG_CHIP_VER_RTL_M	0x0000f000
+#define R92C_SYS_CFG_CHIP_VER_RTL_S	12
+#define R92C_SYS_CFG_BT_FUNC		0x00010000
+#define R92C_SYS_CFG_VENDOR_UMC		0x00080000
+#define R92C_SYS_CFG_PAD_HWPD_IDN	0x00400000
+#define R92C_SYS_CFG_TRP_VAUX_EN	0x00800000
+#define R92C_SYS_CFG_TRP_BT_EN		0x01000000
+#define R92C_SYS_CFG_BD_PKG_SEL		0x02000000
+#define R92C_SYS_CFG_BD_HCI_SEL		0x04000000
+#define R92C_SYS_CFG_TYPE_92C		0x08000000
+
+/* Bits for R92C_CR. */
+#define R92C_CR_HCI_TXDMA_EN	0x00000001
+#define R92C_CR_HCI_RXDMA_EN	0x00000002
+#define R92C_CR_TXDMA_EN	0x00000004
+#define R92C_CR_RXDMA_EN	0x00000008
+#define R92C_CR_PROTOCOL_EN	0x00000010
+#define R92C_CR_SCHEDULE_EN	0x00000020
+#define R92C_CR_MACTXEN		0x00000040
+#define R92C_CR_MACRXEN		0x00000080
+#define R92C_CR_ENSEC		0x00000200
+#define R92C_CR_NETTYPE_S	16
+#define R92C_CR_NETTYPE_M	0x00030000
+#define R92C_CR_NETTYPE_NOLINK	0
+#define R92C_CR_NETTYPE_ADHOC	1
+#define R92C_CR_NETTYPE_INFRA	2
+#define R92C_CR_NETTYPE_AP	3
+
+/* Bits for R92C_PBP. */
+#define R92C_PBP_PSRX_M		0x0f
+#define R92C_PBP_PSRX_S		0
+#define R92C_PBP_PSTX_M		0xf0
+#define R92C_PBP_PSTX_S		4
+#define R92C_PBP_64		0
+#define R92C_PBP_128		1
+#define R92C_PBP_256		2
+#define R92C_PBP_512		3
+#define R92C_PBP_1024		4
+
+/* Bits for R92C_TRXDMA_CTRL. */
+#define R92C_TRXDMA_CTRL_RXDMA_AGG_EN		0x0004
+#define R92C_TRXDMA_CTRL_TXDMA_VOQ_MAP_M	0x0030
+#define R92C_TRXDMA_CTRL_TXDMA_VOQ_MAP_S	4
+#define R92C_TRXDMA_CTRL_TXDMA_VIQ_MAP_M	0x00c0
+#define R92C_TRXDMA_CTRL_TXDMA_VIQ_MAP_S	6
+#define R92C_TRXDMA_CTRL_TXDMA_BEQ_MAP_M	0x0300
+#define R92C_TRXDMA_CTRL_TXDMA_BEQ_MAP_S	8
+#define R92C_TRXDMA_CTRL_TXDMA_BKQ_MAP_M	0x0c00
+#define R92C_TRXDMA_CTRL_TXDMA_BKQ_MAP_S	10
+#define R92C_TRXDMA_CTRL_TXDMA_MGQ_MAP_M	0x3000
+#define R92C_TRXDMA_CTRL_TXDMA_MGQ_MAP_S	12
+#define R92C_TRXDMA_CTRL_TXDMA_HIQ_MAP_M	0xc000
+#define R92C_TRXDMA_CTRL_TXDMA_HIQ_MAP_S	14
+#define R92C_TRXDMA_CTRL_QUEUE_LOW		1
+#define R92C_TRXDMA_CTRL_QUEUE_NORMAL		2
+#define R92C_TRXDMA_CTRL_QUEUE_HIGH		3
+#define R92C_TRXDMA_CTRL_QMAP_M			0xfff0
+/* Shortcuts. */
+#define R92C_TRXDMA_CTRL_QMAP_3EP		0xf5b0
+#define R92C_TRXDMA_CTRL_QMAP_HQ_LQ		0xf5f0
+#define R92C_TRXDMA_CTRL_QMAP_HQ_NQ		0xfaf0
+#define R92C_TRXDMA_CTRL_QMAP_LQ		0x5550
+#define R92C_TRXDMA_CTRL_QMAP_NQ		0xaaa0
+#define R92C_TRXDMA_CTRL_QMAP_HQ		0xfff0
+
+/* Bits for R92C_LLT_INIT. */
+#define R92C_LLT_INIT_DATA_M		0x000000ff
+#define R92C_LLT_INIT_DATA_S		0
+#define R92C_LLT_INIT_ADDR_M		0x0000ff00
+#define R92C_LLT_INIT_ADDR_S		8
+#define R92C_LLT_INIT_OP_M		0xc0000000
+#define R92C_LLT_INIT_OP_S		30
+#define R92C_LLT_INIT_OP_NO_ACTIVE	0
+#define R92C_LLT_INIT_OP_WRITE		1
+
+/* Bits for R92C_RQPN. */
+#define R92C_RQPN_HPQ_M		0x000000ff
+#define R92C_RQPN_HPQ_S		0
+#define R92C_RQPN_LPQ_M		0x0000ff00
+#define R92C_RQPN_LPQ_S		8
+#define R92C_RQPN_PUBQ_M	0x00ff0000
+#define R92C_RQPN_PUBQ_S	16
+#define R92C_RQPN_LD		0x80000000
+
+/* Bits for R92C_TDECTRL. */
+#define R92C_TDECTRL_BLK_DESC_NUM_M	0x0000000f
+#define R92C_TDECTRL_BLK_DESC_NUM_S	4
+
+/* Bits for R92C_FWHW_TXQ_CTRL. */
+#define R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW	0x80
+
+/* Bits for R92C_SPEC_SIFS. */
+#define R92C_SPEC_SIFS_CCK_M	0x00ff
+#define R92C_SPEC_SIFS_CCK_S	0
+#define R92C_SPEC_SIFS_OFDM_M	0xff00
+#define R92C_SPEC_SIFS_OFDM_S	8
+
+/* Bits for R92C_RL. */
+#define R92C_RL_LRL_M		0x003f
+#define R92C_RL_LRL_S		0
+#define R92C_RL_SRL_M		0x3f00
+#define R92C_RL_SRL_S		8
+
+/* Bits for R92C_RRSR. */
+#define R92C_RRSR_RATE_BITMAP_M		0x000fffff
+#define R92C_RRSR_RATE_BITMAP_S		0
+#define R92C_RRSR_RATE_CCK_ONLY_1M	0xffff1
+#define R92C_RRSR_RSC_LOWSUBCHNL	0x00200000
+#define R92C_RRSR_RSC_UPSUBCHNL		0x00400000
+#define R92C_RRSR_SHORT			0x00800000
+
+/* Bits for R92C_EDCA_XX_PARAM. */
+#define R92C_EDCA_PARAM_AIFS_M		0x000000ff
+#define R92C_EDCA_PARAM_AIFS_S		0
+#define R92C_EDCA_PARAM_ECWMIN_M	0x00000f00
+#define R92C_EDCA_PARAM_ECWMIN_S	8
+#define R92C_EDCA_PARAM_ECWMAX_M	0x0000f000
+#define R92C_EDCA_PARAM_ECWMAX_S	12
+#define R92C_EDCA_PARAM_TXOP_M		0xffff0000
+#define R92C_EDCA_PARAM_TXOP_S		16
+
+/* Bits for R92C_BCN_CTRL. */
+#define R92C_BCN_CTRL_EN_MBSSID		0x02
+#define R92C_BCN_CTRL_TXBCN_RPT		0x04
+#define R92C_BCN_CTRL_EN_BCN		0x08
+#define R92C_BCN_CTRL_DIS_TSF_UDT0	0x10
+
+/* Bits for R92C_APSD_CTRL. */
+#define R92C_APSD_CTRL_OFF		0x40
+#define R92C_APSD_CTRL_OFF_STATUS	0x80
+
+/* Bits for R92C_BWOPMODE. */
+#define R92C_BWOPMODE_11J	0x01
+#define R92C_BWOPMODE_5G	0x02
+#define R92C_BWOPMODE_20MHZ	0x04
+
+/* Bits for R92C_RCR. */
+#define R92C_RCR_AAP		0x00000001
+#define R92C_RCR_APM		0x00000002
+#define R92C_RCR_AM		0x00000004
+#define R92C_RCR_AB		0x00000008
+#define R92C_RCR_ADD3		0x00000010
+#define R92C_RCR_APWRMGT	0x00000020
+#define R92C_RCR_CBSSID_DATA	0x00000040
+#define R92C_RCR_CBSSID_BCN	0x00000080
+#define R92C_RCR_ACRC32		0x00000100
+#define R92C_RCR_AICV		0x00000200
+#define R92C_RCR_ADF		0x00000800
+#define R92C_RCR_ACF		0x00001000
+#define R92C_RCR_AMF		0x00002000
+#define R92C_RCR_HTC_LOC_CTRL	0x00004000
+#define R92C_RCR_MFBEN		0x00400000
+#define R92C_RCR_LSIGEN		0x00800000
+#define R92C_RCR_ENMBID		0x01000000
+#define R92C_RCR_APP_BA_SSN	0x08000000
+#define R92C_RCR_APP_PHYSTS	0x10000000
+#define R92C_RCR_APP_ICV	0x20000000
+#define R92C_RCR_APP_MIC	0x40000000
+#define R92C_RCR_APPFCS		0x80000000
+
+/* Bits for R92C_CAMCMD. */
+#define R92C_CAMCMD_ADDR_M	0x0000ffff
+#define R92C_CAMCMD_ADDR_S	0
+#define R92C_CAMCMD_WRITE	0x00010000
+#define R92C_CAMCMD_CLR		0x40000000
+#define R92C_CAMCMD_POLLING	0x80000000
+
+
+/*
+ * Baseband registers.
+ */
+#define R92C_FPGA0_RFMOD		0x800
+#define R92C_FPGA0_TXINFO		0x804
+#define R92C_HSSI_PARAM1(chain)		(0x820 + (chain) * 8)
+#define R92C_HSSI_PARAM2(chain)		(0x824 + (chain) * 8)
+#define R92C_TXAGC_RATE18_06(i)		(((i) == 0) ? 0xe00 : 0x830)
+#define R92C_TXAGC_RATE54_24(i)		(((i) == 0) ? 0xe04 : 0x834)
+#define R92C_TXAGC_A_CCK1_MCS32		0xe08
+#define R92C_TXAGC_B_CCK1_55_MCS32	0x838
+#define R92C_TXAGC_B_CCK11_A_CCK2_11	0x86c
+#define R92C_TXAGC_MCS03_MCS00(i)	(((i) == 0) ? 0xe10 : 0x83c)
+#define R92C_TXAGC_MCS07_MCS04(i)	(((i) == 0) ? 0xe14 : 0x848)
+#define R92C_TXAGC_MCS11_MCS08(i)	(((i) == 0) ? 0xe18 : 0x84c)
+#define R92C_TXAGC_MCS15_MCS12(i)	(((i) == 0) ? 0xe1c : 0x868)
+#define R92C_LSSI_PARAM(chain)		(0x840 + (chain) * 4)
+#define R92C_FPGA0_RFIFACEOE(chain)	(0x860 + (chain) * 4)
+#define R92C_FPGA0_RFIFACESW(idx)	(0x870 + (idx) * 4)
+#define R92C_FPGA0_RFPARAM(idx)		(0x878 + (idx) * 4)
+#define R92C_FPGA0_ANAPARAM2		0x884
+#define R92C_LSSI_READBACK(chain)	(0x8a0 + (chain) * 4)
+#define R92C_HSPI_READBACK(chain)	(0x8b8 + (chain) * 4)
+#define R92C_FPGA1_RFMOD		0x900
+#define R92C_FPGA1_TXINFO		0x90c
+#define R92C_CCK0_SYSTEM		0xa00
+#define R92C_CCK0_AFESETTING		0xa04
+#define R92C_OFDM0_TRXPATHENA		0xc04
+#define R92C_OFDM0_TRMUXPAR		0xc08
+#define R92C_OFDM0_AGCCORE1(chain)	(0xc50 + (chain) * 8)
+#define R92C_OFDM0_AGCPARAM1		0xc70
+#define R92C_OFDM0_AGCRSSITABLE		0xc78
+#define R92C_OFDM1_LSTF			0xd00
+
+/* Bits for R92C_FPGA[01]_RFMOD. */
+#define R92C_RFMOD_40MHZ	0x00000001
+#define R92C_RFMOD_JAPAN	0x00000002
+#define R92C_RFMOD_CCK_TXSC	0x00000030
+#define R92C_RFMOD_CCK_EN	0x01000000
+#define R92C_RFMOD_OFDM_EN	0x02000000
+
+/* Bits for R92C_HSSI_PARAM1(i). */
+#define R92C_HSSI_PARAM1_PI	0x00000100
+
+/* Bits for R92C_HSSI_PARAM2(i). */
+#define R92C_HSSI_PARAM2_CCK_HIPWR	0x00000200
+#define R92C_HSSI_PARAM2_ADDR_LENGTH	0x00000400
+#define R92C_HSSI_PARAM2_DATA_LENGTH	0x00000800
+#define R92C_HSSI_PARAM2_READ_ADDR_M	0x7f800000
+#define R92C_HSSI_PARAM2_READ_ADDR_S	23
+#define R92C_HSSI_PARAM2_READ_EDGE	0x80000000
+
+/* Bits for R92C_TXAGC_A_CCK1_MCS32. */
+#define R92C_TXAGC_A_CCK1_M	0x0000ff00
+#define R92C_TXAGC_A_CCK1_S	8
+
+/* Bits for R92C_TXAGC_B_CCK11_A_CCK2_11. */
+#define R92C_TXAGC_B_CCK11_M	0x000000ff
+#define R92C_TXAGC_B_CCK11_S	0
+#define R92C_TXAGC_A_CCK2_M	0x0000ff00
+#define R92C_TXAGC_A_CCK2_S	8
+#define R92C_TXAGC_A_CCK55_M	0x00ff0000
+#define R92C_TXAGC_A_CCK55_S	16
+#define R92C_TXAGC_A_CCK11_M	0xff000000
+#define R92C_TXAGC_A_CCK11_S	24
+
+/* Bits for R92C_TXAGC_B_CCK1_55_MCS32. */
+#define R92C_TXAGC_B_CCK1_M	0x0000ff00
+#define R92C_TXAGC_B_CCK1_S	8
+#define R92C_TXAGC_B_CCK2_M	0x00ff0000
+#define R92C_TXAGC_B_CCK2_S	16
+#define R92C_TXAGC_B_CCK55_M	0xff000000
+#define R92C_TXAGC_B_CCK55_S	24
+
+/* Bits for R92C_TXAGC_RATE18_06(x). */
+#define R92C_TXAGC_RATE06_M	0x000000ff
+#define R92C_TXAGC_RATE06_S	0
+#define R92C_TXAGC_RATE09_M	0x0000ff00
+#define R92C_TXAGC_RATE09_S	8
+#define R92C_TXAGC_RATE12_M	0x00ff0000
+#define R92C_TXAGC_RATE12_S	16
+#define R92C_TXAGC_RATE18_M	0xff000000
+#define R92C_TXAGC_RATE18_S	24
+
+/* Bits for R92C_TXAGC_RATE54_24(x). */
+#define R92C_TXAGC_RATE24_M	0x000000ff
+#define R92C_TXAGC_RATE24_S	0
+#define R92C_TXAGC_RATE36_M	0x0000ff00
+#define R92C_TXAGC_RATE36_S	8
+#define R92C_TXAGC_RATE48_M	0x00ff0000
+#define R92C_TXAGC_RATE48_S	16
+#define R92C_TXAGC_RATE54_M	0xff000000
+#define R92C_TXAGC_RATE54_S	24
+
+/* Bits for R92C_TXAGC_MCS03_MCS00(x). */
+#define R92C_TXAGC_MCS00_M	0x000000ff
+#define R92C_TXAGC_MCS00_S	0
+#define R92C_TXAGC_MCS01_M	0x0000ff00
+#define R92C_TXAGC_MCS01_S	8
+#define R92C_TXAGC_MCS02_M	0x00ff0000
+#define R92C_TXAGC_MCS02_S	16
+#define R92C_TXAGC_MCS03_M	0xff000000
+#define R92C_TXAGC_MCS03_S	24
+
+/* Bits for R92C_TXAGC_MCS07_MCS04(x). */
+#define R92C_TXAGC_MCS04_M	0x000000ff
+#define R92C_TXAGC_MCS04_S	0
+#define R92C_TXAGC_MCS05_M	0x0000ff00
+#define R92C_TXAGC_MCS05_S	8
+#define R92C_TXAGC_MCS06_M	0x00ff0000
+#define R92C_TXAGC_MCS06_S	16
+#define R92C_TXAGC_MCS07_M	0xff000000
+#define R92C_TXAGC_MCS07_S	24
+
+/* Bits for R92C_TXAGC_MCS11_MCS08(x). */
+#define R92C_TXAGC_MCS08_M	0x000000ff
+#define R92C_TXAGC_MCS08_S	0
+#define R92C_TXAGC_MCS09_M	0x0000ff00
+#define R92C_TXAGC_MCS09_S	8
+#define R92C_TXAGC_MCS10_M	0x00ff0000
+#define R92C_TXAGC_MCS10_S	16
+#define R92C_TXAGC_MCS11_M	0xff000000
+#define R92C_TXAGC_MCS11_S	24
+
+/* Bits for R92C_TXAGC_MCS15_MCS12(x). */
+#define R92C_TXAGC_MCS12_M	0x000000ff
+#define R92C_TXAGC_MCS12_S	0
+#define R92C_TXAGC_MCS13_M	0x0000ff00
+#define R92C_TXAGC_MCS13_S	8
+#define R92C_TXAGC_MCS14_M	0x00ff0000
+#define R92C_TXAGC_MCS14_S	16
+#define R92C_TXAGC_MCS15_M	0xff000000
+#define R92C_TXAGC_MCS15_S	24
+
+/* Bits for R92C_LSSI_PARAM(i). */
+#define R92C_LSSI_PARAM_DATA_M	0x000fffff
+#define R92C_LSSI_PARAM_DATA_S	0
+#define R92C_LSSI_PARAM_ADDR_M	0x03f00000
+#define R92C_LSSI_PARAM_ADDR_S	20
+
+/* Bits for R92C_FPGA0_ANAPARAM2. */
+#define R92C_FPGA0_ANAPARAM2_CBW20	0x00000400
+
+/* Bits for R92C_LSSI_READBACK(i). */
+#define R92C_LSSI_READBACK_DATA_M	0x000fffff
+#define R92C_LSSI_READBACK_DATA_S	0
+
+/* Bits for R92C_OFDM0_AGCCORE1(i). */
+#define R92C_OFDM0_AGCCORE1_GAIN_M	0x0000007f
+#define R92C_OFDM0_AGCCORE1_GAIN_S	0
+
+
+/*
+ * USB registers.
+ */
+#define R92C_USB_INFO			0xfe17
+#define R92C_USB_SPECIAL_OPTION		0xfe55
+#define R92C_USB_HCPWM			0xfe57
+#define R92C_USB_HRPWM			0xfe58
+#define R92C_USB_DMA_AGG_TO		0xfe5b
+#define R92C_USB_AGG_TO			0xfe5c
+#define R92C_USB_AGG_TH			0xfe5d
+#define R92C_USB_VID			0xfe60
+#define R92C_USB_PID			0xfe62
+#define R92C_USB_OPTIONAL		0xfe64
+#define R92C_USB_EP			0xfe65
+#define R92C_USB_PHY			0xfe68
+#define R92C_USB_MAC_ADDR		0xfe70
+#define R92C_USB_STRING			0xfe80
+
+/* Bits for R92C_USB_SPECIAL_OPTION. */
+#define R92C_USB_SPECIAL_OPTION_AGG_EN	0x08
+
+/* Bits for R92C_USB_EP. */
+#define R92C_USB_EP_HQ_M	0x000f
+#define R92C_USB_EP_HQ_S	0
+#define R92C_USB_EP_NQ_M	0x00f0
+#define R92C_USB_EP_NQ_S	4
+#define R92C_USB_EP_LQ_M	0x0f00
+#define R92C_USB_EP_LQ_S	8
+
+
+/*
+ * Firmware base address.
+ */
+#define R92C_FW_START_ADDR	0x1000
+#define R92C_FW_PAGE_SIZE	4096
+
+
+/*
+ * RF (6052) registers.
+ */
+#define R92C_RF_AC		0x00
+#define R92C_RF_IQADJ_G(i)	(0x01 + (i))
+#define R92C_RF_POW_TRSW	0x05
+#define R92C_RF_GAIN_RX		0x06
+#define R92C_RF_GAIN_TX		0x07
+#define R92C_RF_TXM_IDAC	0x08
+#define R92C_RF_BS_IQGEN	0x0f
+#define R92C_RF_MODE1		0x10
+#define R92C_RF_MODE2		0x11
+#define R92C_RF_RX_AGC_HP	0x12
+#define R92C_RF_TX_AGC		0x13
+#define R92C_RF_BIAS		0x14
+#define R92C_RF_IPA		0x15
+#define R92C_RF_POW_ABILITY	0x17
+#define R92C_RF_CHNLBW		0x18
+#define R92C_RF_RX_G1		0x1a
+#define R92C_RF_RX_G2		0x1b
+#define R92C_RF_RX_BB2		0x1c
+#define R92C_RF_RX_BB1		0x1d
+#define R92C_RF_RCK1		0x1e
+#define R92C_RF_RCK2		0x1f
+#define R92C_RF_TX_G(i)		(0x20 + (i))
+#define R92C_RF_TX_BB1		0x23
+#define R92C_RF_T_METER		0x24
+#define R92C_RF_SYN_G(i)	(0x25 + (i))
+#define R92C_RF_RCK_OS		0x30
+#define R92C_RF_TXPA_G(i)	(0x31 + (i))
+
+/* Bits for R92C_RF_AC. */
+#define R92C_RF_AC_MODE_M	0x70000
+#define R92C_RF_AC_MODE_S	16
+#define R92C_RF_AC_MODE_STANDBY	1
+
+/* Bits for R92C_RF_CHNLBW. */
+#define R92C_RF_CHNLBW_CHNL_M	0x003ff
+#define R92C_RF_CHNLBW_CHNL_S	0
+#define R92C_RF_CHNLBW_BW20	0x00400
+#define R92C_RF_CHNLBW_LCSTART	0x08000
+
+
+/*
+ * CAM entries.
+ */
+#define R92C_CAM_ENTRY_COUNT	32
+
+#define R92C_CAM_CTL0(entry)	((entry) * 8 + 0)
+#define R92C_CAM_CTL1(entry)	((entry) * 8 + 1)
+#define R92C_CAM_KEY(entry, i)	((entry) * 8 + 2 + (i))
+
+/* Bits for R92C_CAM_CTL0(i). */
+#define R92C_CAM_KEYID_M	0x00000003
+#define R92C_CAM_KEYID_S	0
+#define R92C_CAM_ALGO_M		0x0000001c
+#define R92C_CAM_ALGO_S		2
+#define R92C_CAM_ALGO_NONE	0
+#define R92C_CAM_ALGO_WEP40	1
+#define R92C_CAM_ALGO_TKIP	2
+#define R92C_CAM_ALGO_AES	4
+#define R92C_CAM_ALGO_WEP104	5
+#define R92C_CAM_VALID		0x00008000
+#define R92C_CAM_MACLO_M	0xffff0000
+#define R92C_CAM_MACLO_S	16
+
+/* Rate adaptation modes. */
+#define R92C_RAID_11GN	1
+#define R92C_RAID_11N	3
+#define R92C_RAID_11BG	4
+#define R92C_RAID_11G	5	/* "pure" 11g */
+#define R92C_RAID_11B	6
+
+
+/* Macros to access unaligned little-endian memory. */
+#define LE_READ_2(x)	((x)[0] | (x)[1] << 8)
+#define LE_READ_4(x)	((x)[0] | (x)[1] << 8 | (x)[2] << 16 | (x)[3] << 24)
+
+/*
+ * Macros to access subfields in registers.
+ */
+/* Mask and Shift (getter). */
+#define MS(val, field)							\
+	(((val) & field##_M) >> field##_S)
+
+/* Shift and Mask (setter). */
+#define SM(field, val)							\
+	(((val) << field##_S) & field##_M)
+
+/* Rewrite. */
+#define RW(var, field, val)						\
+	(((var) & ~field##_M) | SM(field, val))
+
+/*
+ * Firmware image header.
+ */
+struct r92c_fw_hdr {
+	/* QWORD0 */
+	uint16_t	signature;
+	uint8_t		category;
+	uint8_t		function;
+	uint16_t	version;
+	uint16_t	subversion;
+	/* QWORD1 */
+	uint8_t		month;
+	uint8_t		date;
+	uint8_t		hour;
+	uint8_t		minute;
+	uint16_t	ramcodesize;
+	uint16_t	reserved2;
+	/* QWORD2 */
+	uint32_t	svnidx;
+	uint32_t	reserved3;
+	/* QWORD3 */
+	uint32_t	reserved4;
+	uint32_t	reserved5;
+} __packed;
+
+/*
+ * Host to firmware commands.
+ */
+struct r92c_fw_cmd {
+	uint8_t	id;
+#define R92C_CMD_AP_OFFLOAD		0
+#define R92C_CMD_SET_PWRMODE		1
+#define R92C_CMD_JOINBSS_RPT		2
+#define R92C_CMD_RSVD_PAGE		3
+#define R92C_CMD_RSSI			4
+#define R92C_CMD_RSSI_SETTING		5
+#define R92C_CMD_MACID_CONFIG		6
+#define R92C_CMD_MACID_PS_MODE		7
+#define R92C_CMD_P2P_PS_OFFLOAD		8
+#define R92C_CMD_SELECTIVE_SUSPEND	9
+#define R92C_CMD_FLAG_EXT		0x80
+
+	uint8_t	msg[5];
+} __packed;
+
+/* Structure for R92C_CMD_RSSI_SETTING. */
+struct r92c_fw_cmd_rssi {
+	uint8_t	macid;
+	uint8_t	reserved;
+	uint8_t	pwdb;
+} __packed;
+
+/* Structure for R92C_CMD_MACID_CONFIG. */
+struct r92c_fw_cmd_macid_cfg {
+	uint32_t	mask;
+	uint8_t		macid;
+#define URTWN_MACID_BSS		0
+#define URTWN_MACID_BC		4	/* Broadcast. */
+#define URTWN_MACID_VALID	0x80
+} __packed;
+
+/*
+ * RTL8192CU ROM image.
+ */
+struct r92c_rom {
+	uint16_t	id;		/* 0x8192 */
+	uint8_t		reserved1[5];
+	uint8_t		dbg_sel;
+	uint16_t	reserved2;
+	uint16_t	vid;
+	uint16_t	pid;
+	uint8_t		usb_opt;
+	uint8_t		ep_setting;
+	uint16_t	reserved3;
+	uint8_t		usb_phy;
+	uint8_t		reserved4[3];
+	uint8_t		macaddr[6];
+	uint8_t		string[61];	/* "Realtek" */
+	uint8_t		subcustomer_id;
+	uint8_t		cck_tx_pwr[R92C_MAX_CHAINS][3];
+	uint8_t		ht40_1s_tx_pwr[R92C_MAX_CHAINS][3];
+	uint8_t		ht40_2s_tx_pwr_diff[3];
+	uint8_t		ht20_tx_pwr_diff[3];
+	uint8_t		ofdm_tx_pwr_diff[3];
+	uint8_t		ht40_max_pwr[3];
+	uint8_t		ht20_max_pwr[3];
+	uint8_t		xtal_calib;
+	uint8_t		tssi[R92C_MAX_CHAINS];
+	uint8_t		thermal_meter;
+	uint8_t		rf_opt1;
+#define R92C_ROM_RF1_REGULATORY_M	0x07
+#define R92C_ROM_RF1_REGULATORY_S	0
+#define R92C_ROM_RF1_BOARD_TYPE_M	0xe0
+#define R92C_ROM_RF1_BOARD_TYPE_S	5
+#define R92C_BOARD_TYPE_DONGLE		0
+#define R92C_BOARD_TYPE_HIGHPA		1
+#define R92C_BOARD_TYPE_MINICARD	2
+#define R92C_BOARD_TYPE_SOLO		3
+#define R92C_BOARD_TYPE_COMBO		4
+
+	uint8_t		rf_opt2;
+	uint8_t		rf_opt3;
+	uint8_t		rf_opt4;
+	uint8_t		channel_plan;
+	uint8_t		version;
+	uint8_t		curstomer_id;
+} __packed;
+
+/* Rx MAC descriptor. */
+struct r92c_rx_stat {
+	uint32_t	rxdw0;
+#define R92C_RXDW0_PKTLEN_M	0x00003fff
+#define R92C_RXDW0_PKTLEN_S	0
+#define R92C_RXDW0_CRCERR	0x00004000
+#define R92C_RXDW0_ICVERR	0x00008000
+#define R92C_RXDW0_INFOSZ_M	0x000f0000
+#define R92C_RXDW0_INFOSZ_S	16
+#define R92C_RXDW0_QOS		0x00800000
+#define R92C_RXDW0_SHIFT_M	0x03000000
+#define R92C_RXDW0_SHIFT_S	24
+#define R92C_RXDW0_PHYST	0x04000000
+#define R92C_RXDW0_DECRYPTED	0x08000000
+
+	uint32_t	rxdw1;
+	uint32_t	rxdw2;
+#define R92C_RXDW2_PKTCNT_M	0x00ff0000
+#define R92C_RXDW2_PKTCNT_S	16
+
+	uint32_t	rxdw3;
+#define R92C_RXDW3_RATE_M	0x0000003f
+#define R92C_RXDW3_RATE_S	0
+#define R92C_RXDW3_HT		0x00000040
+#define R92C_RXDW3_HTC		0x00000400
+
+	uint32_t	rxdw4;
+	uint32_t	rxdw5;
+} __packed __attribute__((aligned(4)));
+
+/* Rx PHY descriptor. */
+struct r92c_rx_phystat {
+	uint32_t	phydw0;
+	uint32_t	phydw1;
+	uint32_t	phydw2;
+	uint32_t	phydw3;
+	uint32_t	phydw4;
+	uint32_t	phydw5;
+	uint32_t	phydw6;
+	uint32_t	phydw7;
+} __packed __attribute__((aligned(4)));
+
+/* Rx PHY CCK descriptor. */
+struct r92c_rx_cck {
+	uint8_t		adc_pwdb[4];
+	uint8_t		sq_rpt;
+	uint8_t		agc_rpt;
+} __packed;
+
+/* Tx MAC descriptor. */
+struct r92c_tx_desc {
+	uint32_t	txdw0;
+#define R92C_TXDW0_PKTLEN_M	0x0000ffff
+#define R92C_TXDW0_PKTLEN_S	0
+#define R92C_TXDW0_OFFSET_M	0x00ff0000
+#define R92C_TXDW0_OFFSET_S	16
+#define R92C_TXDW0_BMCAST	0x01000000
+#define R92C_TXDW0_LSG		0x04000000
+#define R92C_TXDW0_FSG		0x08000000
+#define R92C_TXDW0_OWN		0x80000000
+
+	uint32_t	txdw1;
+#define R92C_TXDW1_MACID_M	0x0000001f
+#define R92C_TXDW1_MACID_S	0
+#define R92C_TXDW1_AGGEN	0x00000020
+#define R92C_TXDW1_AGGBK	0x00000040
+#define R92C_TXDW1_QSEL_M	0x00001f00
+#define R92C_TXDW1_QSEL_S	8
+#define R92C_TXDW1_QSEL_BE	0x00
+#define R92C_TXDW1_QSEL_MGNT	0x12
+#define R92C_TXDW1_RAID_M	0x000f0000
+#define R92C_TXDW1_RAID_S	16
+#define R92C_TXDW1_CIPHER_M	0x00c00000
+#define R92C_TXDW1_CIPHER_S	22
+#define R92C_TXDW1_CIPHER_NONE	0
+#define R92C_TXDW1_CIPHER_RC4	1
+#define R92C_TXDW1_CIPHER_AES	3
+#define R92C_TXDW1_PKTOFF_M	0x7c000000
+#define R92C_TXDW1_PKTOFF_S	26
+
+	uint32_t	txdw2;
+	uint16_t	txdw3;
+	uint16_t	txdseq;
+
+	uint32_t	txdw4;
+#define R92C_TXDW4_RTSRATE_M	0x0000003f
+#define R92C_TXDW4_RTSRATE_S	0
+#define R92C_TXDW4_QOS		0x00000040
+#define R92C_TXDW4_HWSEQ	0x00000080
+#define R92C_TXDW4_DRVRATE	0x00000100
+#define R92C_TXDW4_CTS2SELF	0x00000800
+#define R92C_TXDW4_RTSEN	0x00001000
+#define R92C_TXDW4_HWRTSEN	0x00002000
+#define R92C_TXDW4_SCO_M	0x003f0000
+#define R92C_TXDW4_SCO_S	20
+#define R92C_TXDW4_SCO_SCA	1
+#define R92C_TXDW4_SCO_SCB	2
+#define R92C_TXDW4_40MHZ	0x02000000
+
+	uint32_t	txdw5;
+#define R92C_TXDW5_DATARATE_M	0x0000003f
+#define R92C_TXDW5_DATARATE_S	0
+#define R92C_TXDW5_SGI		0x00000040
+#define R92C_TXDW5_AGGNUM_M	0xff000000
+#define R92C_TXDW5_AGGNUM_S	24
+
+	uint32_t	txdw6;
+	uint16_t	txdsum;
+	uint16_t	pad;
+} __packed __attribute__((aligned(4)));
+
+
+/*
+ * Driver definitions.
+ */
+#define URTWN_RX_LIST_COUNT		1
+#define URTWN_TX_LIST_COUNT		8
+#define URTWN_HOST_CMD_RING_COUNT	32
+
+#define URTWN_RXBUFSZ	(16 * 1024)
+#define URTWN_TXBUFSZ	(sizeof(struct r92c_tx_desc) + IEEE80211_MAX_LEN)
+#define	URTWN_RX_DESC_SIZE	(sizeof(struct r92c_rx_stat))
+#define	URTWN_TX_DESC_SIZE	(sizeof(struct r92c_tx_desc))
+
+#define URTWN_RIDX_COUNT	28
+
+#define URTWN_TX_TIMEOUT	5000	/* ms */
+
+#define URTWN_LED_LINK	0
+#define URTWN_LED_DATA	1
+
+struct urtwn_rx_radiotap_header {
+	struct ieee80211_radiotap_header wr_ihdr;
+	uint8_t		wr_flags;
+	uint8_t		wr_rate;
+	uint16_t	wr_chan_freq;
+	uint16_t	wr_chan_flags;
+	uint8_t		wr_dbm_antsignal;
+} __packed;
+
+#define URTWN_RX_RADIOTAP_PRESENT			\
+	(1 << IEEE80211_RADIOTAP_FLAGS |		\
+	 1 << IEEE80211_RADIOTAP_RATE |			\
+	 1 << IEEE80211_RADIOTAP_CHANNEL |		\
+	 1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL)
+
+struct urtwn_tx_radiotap_header {
+	struct ieee80211_radiotap_header wt_ihdr;
+	uint8_t		wt_flags;
+	uint16_t	wt_chan_freq;
+	uint16_t	wt_chan_flags;
+} __packed;
+
+#define URTWN_TX_RADIOTAP_PRESENT			\
+	(1 << IEEE80211_RADIOTAP_FLAGS |		\
+	 1 << IEEE80211_RADIOTAP_CHANNEL)
+
+struct urtwn_softc;
+
+struct urtwn_data {
+	struct urtwn_softc		*sc;
+	uint8_t				*buf;
+	uint16_t			buflen;
+	struct mbuf			*m;
+	struct ieee80211_node		*ni;
+	STAILQ_ENTRY(urtwn_data)	next;
+};
+typedef STAILQ_HEAD(, urtwn_data) urtwn_datahead;
+
+struct urtwn_cmdq {
+	void			*arg0;
+	void			*arg1;
+	void			(*func)(void *);
+	struct ieee80211_key	*k;
+	struct ieee80211_key	key;
+	uint8_t			mac[IEEE80211_ADDR_LEN];
+	uint8_t			wcid;
+};
+
+struct urtwn_fw_info {
+	const uint8_t		*data;
+	size_t			size;
+};
+
+struct urtwn_vap {
+	struct ieee80211vap		vap;
+	struct ieee80211_beacon_offsets	bo;
+
+	int				(*newstate)(struct ieee80211vap *,
+					    enum ieee80211_state, int);
+};
+#define	URTWN_VAP(vap)	((struct urtwn_vap *)(vap))
+
+struct urtwn_host_cmd {
+	void	(*cb)(struct urtwn_softc *, void *);
+	uint8_t	data[256];
+};
+
+struct urtwn_cmd_newstate {
+	enum ieee80211_state	state;
+	int			arg;
+};
+
+struct urtwn_cmd_key {
+	struct ieee80211_key	key;
+	uint16_t		associd;
+};
+
+enum {
+	URTWN_BULK_RX,
+	URTWN_BULK_TX_BE,	/* = WME_AC_BE */
+	URTWN_BULK_TX_BK,	/* = WME_AC_BK */
+	URTWN_BULK_TX_VI,	/* = WME_AC_VI */
+	URTWN_BULK_TX_VO,	/* = WME_AC_VI */
+	URTWN_N_TRANSFER = 5,
+};
+
+#define	URTWN_EP_QUEUES	URTWN_BULK_RX
+
+struct urtwn_softc {
+	struct ifnet			*sc_ifp;
+	device_t			sc_dev;
+	struct usb_device		*sc_udev;
+
+	int				ac2idx[WME_NUM_AC];
+	u_int				sc_flags;
+#define URTWN_FLAG_CCK_HIPWR	0x01
+
+	u_int				chip;
+#define URTWN_CHIP_92C		0x01
+#define URTWN_CHIP_92C_1T2R	0x02
+#define URTWN_CHIP_UMC		0x04
+#define URTWN_CHIP_UMC_A_CUT	0x08
+
+	uint8_t				board_type;
+	uint8_t				regulatory;
+	uint8_t				pa_setting;
+	int				avg_pwdb;
+	int				thcal_state;
+	int				thcal_lctemp;
+	int				ntxchains;
+	int				nrxchains;
+	int				ledlink;
+	int				sc_txtimer;
+
+	int				fwcur;
+	struct urtwn_data		sc_rx[URTWN_RX_LIST_COUNT];
+	urtwn_datahead			sc_rx_active;
+	urtwn_datahead			sc_rx_inactive;
+	struct urtwn_data		sc_tx[URTWN_TX_LIST_COUNT];
+	urtwn_datahead			sc_tx_active;
+	urtwn_datahead			sc_tx_inactive;
+	urtwn_datahead			sc_tx_pending;
+
+	const char			*fwname;
+	const struct firmware		*fw_fp;
+	struct urtwn_fw_info		fw;
+	void				*fw_virtaddr;
+
+	struct r92c_rom			rom;
+	uint8_t				sc_bssid[IEEE80211_ADDR_LEN];
+		
+	struct callout			sc_watchdog_ch;
+	struct mtx			sc_mtx;
+
+/* need to be power of 2, otherwise URTWN_CMDQ_GET fails */
+#define	URTWN_CMDQ_MAX	16
+#define	URTWN_CMDQ_MASQ	(URTWN_CMDQ_MAX - 1)
+	struct urtwn_cmdq		cmdq[URTWN_CMDQ_MAX];
+	struct task			cmdq_task;
+	uint32_t			cmdq_store;
+	uint8_t                         cmdq_exec;
+	uint8_t                         cmdq_run;
+	uint8_t                         cmdq_key_set;
+#define	URTWN_CMDQ_ABORT	0
+#define	URTWN_CMDQ_GO		1
+
+	uint32_t			rf_chnlbw[R92C_MAX_CHAINS];
+	struct usb_xfer			*sc_xfer[URTWN_N_TRANSFER];
+
+	struct urtwn_rx_radiotap_header	sc_rxtap;
+	int				sc_rxtap_len;
+
+	struct urtwn_tx_radiotap_header	sc_txtap;
+	int				sc_txtap_len;
+};
+
+#define	URTWN_LOCK(sc)			mtx_lock(&(sc)->sc_mtx)
+#define	URTWN_UNLOCK(sc)		mtx_unlock(&(sc)->sc_mtx)
+#define	URTWN_ASSERT_LOCKED(sc)		mtx_assert(&(sc)->sc_mtx, MA_OWNED)
+
+/*
+ * MAC initialization values.
+ */
+static const struct {
+	uint16_t	reg;
+	uint8_t		val;
+} rtl8192cu_mac[] = {
+	{ 0x420, 0x80 }, { 0x423, 0x00 }, { 0x430, 0x00 }, { 0x431, 0x00 },
+	{ 0x432, 0x00 }, { 0x433, 0x01 }, { 0x434, 0x04 }, { 0x435, 0x05 },
+	{ 0x436, 0x06 }, { 0x437, 0x07 }, { 0x438, 0x00 }, { 0x439, 0x00 },
+	{ 0x43a, 0x00 }, { 0x43b, 0x01 }, { 0x43c, 0x04 }, { 0x43d, 0x05 },
+	{ 0x43e, 0x06 }, { 0x43f, 0x07 }, { 0x440, 0x5d }, { 0x441, 0x01 },
+	{ 0x442, 0x00 }, { 0x444, 0x15 }, { 0x445, 0xf0 }, { 0x446, 0x0f },
+	{ 0x447, 0x00 }, { 0x458, 0x41 }, { 0x459, 0xa8 }, { 0x45a, 0x72 },
+	{ 0x45b, 0xb9 }, { 0x460, 0x66 }, { 0x461, 0x66 }, { 0x462, 0x08 },
+	{ 0x463, 0x03 }, { 0x4c8, 0xff }, { 0x4c9, 0x08 }, { 0x4cc, 0xff },
+	{ 0x4cd, 0xff }, { 0x4ce, 0x01 }, { 0x500, 0x26 }, { 0x501, 0xa2 },
+	{ 0x502, 0x2f }, { 0x503, 0x00 }, { 0x504, 0x28 }, { 0x505, 0xa3 },
+	{ 0x506, 0x5e }, { 0x507, 0x00 }, { 0x508, 0x2b }, { 0x509, 0xa4 },
+	{ 0x50a, 0x5e }, { 0x50b, 0x00 }, { 0x50c, 0x4f }, { 0x50d, 0xa4 },
+	{ 0x50e, 0x00 }, { 0x50f, 0x00 }, { 0x512, 0x1c }, { 0x514, 0x0a },
+	{ 0x515, 0x10 }, { 0x516, 0x0a }, { 0x517, 0x10 }, { 0x51a, 0x16 },
+	{ 0x524, 0x0f }, { 0x525, 0x4f }, { 0x546, 0x40 }, { 0x547, 0x00 },
+	{ 0x550, 0x10 }, { 0x551, 0x10 }, { 0x559, 0x02 }, { 0x55a, 0x02 },
+	{ 0x55d, 0xff }, { 0x605, 0x30 }, { 0x608, 0x0e }, { 0x609, 0x2a },
+	{ 0x652, 0x20 }, { 0x63c, 0x0a }, { 0x63d, 0x0e }, { 0x63e, 0x0a },
+	{ 0x63f, 0x0e }, { 0x66e, 0x05 }, { 0x700, 0x21 }, { 0x701, 0x43 },
+	{ 0x702, 0x65 }, { 0x703, 0x87 }, { 0x708, 0x21 }, { 0x709, 0x43 },
+	{ 0x70a, 0x65 }, { 0x70b, 0x87 }
+};
+
+/*
+ * Baseband initialization values.
+ */
+struct urtwn_bb_prog {
+	int		count;
+	const uint16_t	*regs;
+	const uint32_t	*vals;
+	int		agccount;
+	const uint32_t	*agcvals;
+};
+
+/*
+ * RTL8192CU and RTL8192CE-VAU.
+ */
+static const uint16_t rtl8192ce_bb_regs[] = {
+	0x024, 0x028, 0x800, 0x804, 0x808, 0x80c, 0x810, 0x814, 0x818,
+	0x81c, 0x820, 0x824, 0x828, 0x82c, 0x830, 0x834, 0x838, 0x83c,
+	0x840, 0x844, 0x848, 0x84c, 0x850, 0x854, 0x858, 0x85c, 0x860,
+	0x864, 0x868, 0x86c, 0x870, 0x874, 0x878, 0x87c, 0x880, 0x884,
+	0x888, 0x88c, 0x890, 0x894, 0x898, 0x89c, 0x900, 0x904, 0x908,
+	0x90c, 0xa00, 0xa04, 0xa08, 0xa0c, 0xa10, 0xa14, 0xa18, 0xa1c,
+	0xa20, 0xa24, 0xa28, 0xa2c, 0xa70, 0xa74, 0xc00, 0xc04, 0xc08,
+	0xc0c, 0xc10, 0xc14, 0xc18, 0xc1c, 0xc20, 0xc24, 0xc28, 0xc2c,
+	0xc30, 0xc34, 0xc38, 0xc3c, 0xc40, 0xc44, 0xc48, 0xc4c, 0xc50,
+	0xc54, 0xc58, 0xc5c, 0xc60, 0xc64, 0xc68, 0xc6c, 0xc70, 0xc74,
+	0xc78, 0xc7c, 0xc80, 0xc84, 0xc88, 0xc8c, 0xc90, 0xc94, 0xc98,
+	0xc9c, 0xca0, 0xca4, 0xca8, 0xcac, 0xcb0, 0xcb4, 0xcb8, 0xcbc,
+	0xcc0, 0xcc4, 0xcc8, 0xccc, 0xcd0, 0xcd4, 0xcd8, 0xcdc, 0xce0,
+	0xce4, 0xce8, 0xcec, 0xd00, 0xd04, 0xd08, 0xd0c, 0xd10, 0xd14,
+	0xd18, 0xd2c, 0xd30, 0xd34, 0xd38, 0xd3c, 0xd40, 0xd44, 0xd48,
+	0xd4c, 0xd50, 0xd54, 0xd58, 0xd5c, 0xd60, 0xd64, 0xd68, 0xd6c,
+	0xd70, 0xd74, 0xd78, 0xe00, 0xe04, 0xe08, 0xe10, 0xe14, 0xe18,
+	0xe1c, 0xe28, 0xe30, 0xe34, 0xe38, 0xe3c, 0xe40, 0xe44, 0xe48,
+	0xe4c, 0xe50, 0xe54, 0xe58, 0xe5c, 0xe60, 0xe68, 0xe6c, 0xe70,
+	0xe74, 0xe78, 0xe7c, 0xe80, 0xe84, 0xe88, 0xe8c, 0xed0, 0xed4,
+	0xed8, 0xedc, 0xee0, 0xeec, 0xf14, 0xf4c, 0xf00
+};
+
+static const uint32_t rtl8192ce_bb_vals[] = {
+	0x0011800d, 0x00ffdb83, 0x80040002, 0x00000003, 0x0000fc00,
+	0x0000000a, 0x10005388, 0x020c3d10, 0x02200385, 0x00000000,
+	0x01000100, 0x00390004, 0x01000100, 0x00390004, 0x27272727,
+	0x27272727, 0x27272727, 0x27272727, 0x00010000, 0x00010000,
+	0x27272727, 0x27272727, 0x00000000, 0x00000000, 0x569a569a,
+	0x0c1b25a4, 0x66e60230, 0x061f0130, 0x27272727, 0x2b2b2b27,
+	0x07000700, 0x22184000, 0x08080808, 0x00000000, 0xc0083070,
+	0x000004d5, 0x00000000, 0xcc0000c0, 0x00000800, 0xfffffffe,
+	0x40302010, 0x00706050, 0x00000000, 0x00000023, 0x00000000,
+	0x81121313, 0x00d047c8, 0x80ff000c, 0x8c838300, 0x2e68120f,
+	0x9500bb78, 0x11144028, 0x00881117, 0x89140f00, 0x1a1b0000,
+	0x090e1317, 0x00000204, 0x00d30000, 0x101fbf00, 0x00000007,
+	0x48071d40, 0x03a05633, 0x000000e4, 0x6c6c6c6c, 0x08800000,
+	0x40000100, 0x08800000, 0x40000100, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x69e9ac44, 0x469652cf, 0x49795994,
+	0x0a97971c, 0x1f7c403f, 0x000100b7, 0xec020107, 0x007f037f,
+	0x6954341e, 0x43bc0094, 0x6954341e, 0x433c0094, 0x00000000,
+	0x5116848b, 0x47c00bff, 0x00000036, 0x2c7f000d, 0x018610db,
+	0x0000001f, 0x00b91612, 0x40000100, 0x20f60000, 0x40000100,
+	0x20200000, 0x00121820, 0x00000000, 0x00121820, 0x00007f7f,
+	0x00000000, 0x00000080, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x28000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x64b22427,
+	0x00766932, 0x00222222, 0x00000000, 0x37644302, 0x2f97d40c,
+	0x00080740, 0x00020403, 0x0000907f, 0x20010201, 0xa0633333,
+	0x3333bc43, 0x7a8f5b6b, 0xcc979975, 0x00000000, 0x80608000,
+	0x00000000, 0x00027293, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x6437140a, 0x00000000, 0x00000000, 0x30032064,
+	0x4653de68, 0x04518a3c, 0x00002101, 0x2a201c16, 0x1812362e,
+	0x322c2220, 0x000e3c24, 0x2a2a2a2a, 0x2a2a2a2a, 0x03902a2a,
+	0x2a2a2a2a, 0x2a2a2a2a, 0x2a2a2a2a, 0x2a2a2a2a, 0x00000000,
+	0x1000dc1f, 0x10008c1f, 0x02140102, 0x681604c2, 0x01007c00,
+	0x01004800, 0xfb000000, 0x000028d1, 0x1000dc1f, 0x10008c1f,
+	0x02140102, 0x28160d05, 0x00000010, 0x001b25a4, 0x63db25a4,
+	0x63db25a4, 0x0c1b25a4, 0x0c1b25a4, 0x0c1b25a4, 0x0c1b25a4,
+	0x63db25a4, 0x0c1b25a4, 0x63db25a4, 0x63db25a4, 0x63db25a4,
+	0x63db25a4, 0x001b25a4, 0x001b25a4, 0x6fdb25a4, 0x00000003,
+	0x00000000, 0x00000300
+};
+
+static const uint32_t rtl8192ce_agc_vals[] = {
+	0x7b000001, 0x7b010001, 0x7b020001, 0x7b030001, 0x7b040001,
+	0x7b050001, 0x7a060001, 0x79070001, 0x78080001, 0x77090001,
+	0x760a0001, 0x750b0001, 0x740c0001, 0x730d0001, 0x720e0001,
+	0x710f0001, 0x70100001, 0x6f110001, 0x6e120001, 0x6d130001,
+	0x6c140001, 0x6b150001, 0x6a160001, 0x69170001, 0x68180001,
+	0x67190001, 0x661a0001, 0x651b0001, 0x641c0001, 0x631d0001,
+	0x621e0001, 0x611f0001, 0x60200001, 0x49210001, 0x48220001,
+	0x47230001, 0x46240001, 0x45250001, 0x44260001, 0x43270001,
+	0x42280001, 0x41290001, 0x402a0001, 0x262b0001, 0x252c0001,
+	0x242d0001, 0x232e0001, 0x222f0001, 0x21300001, 0x20310001,
+	0x06320001, 0x05330001, 0x04340001, 0x03350001, 0x02360001,
+	0x01370001, 0x00380001, 0x00390001, 0x003a0001, 0x003b0001,
+	0x003c0001, 0x003d0001, 0x003e0001, 0x003f0001, 0x7b400001,
+	0x7b410001, 0x7b420001, 0x7b430001, 0x7b440001, 0x7b450001,
+	0x7a460001, 0x79470001, 0x78480001, 0x77490001, 0x764a0001,
+	0x754b0001, 0x744c0001, 0x734d0001, 0x724e0001, 0x714f0001,
+	0x70500001, 0x6f510001, 0x6e520001, 0x6d530001, 0x6c540001,
+	0x6b550001, 0x6a560001, 0x69570001, 0x68580001, 0x67590001,
+	0x665a0001, 0x655b0001, 0x645c0001, 0x635d0001, 0x625e0001,
+	0x615f0001, 0x60600001, 0x49610001, 0x48620001, 0x47630001,
+	0x46640001, 0x45650001, 0x44660001, 0x43670001, 0x42680001,
+	0x41690001, 0x406a0001, 0x266b0001, 0x256c0001, 0x246d0001,
+	0x236e0001, 0x226f0001, 0x21700001, 0x20710001, 0x06720001,
+	0x05730001, 0x04740001, 0x03750001, 0x02760001, 0x01770001,
+	0x00780001, 0x00790001, 0x007a0001, 0x007b0001, 0x007c0001,
+	0x007d0001, 0x007e0001, 0x007f0001, 0x3800001e, 0x3801001e,
+	0x3802001e, 0x3803001e, 0x3804001e, 0x3805001e, 0x3806001e,
+	0x3807001e, 0x3808001e, 0x3c09001e, 0x3e0a001e, 0x400b001e,
+	0x440c001e, 0x480d001e, 0x4c0e001e, 0x500f001e, 0x5210001e,
+	0x5611001e, 0x5a12001e, 0x5e13001e, 0x6014001e, 0x6015001e,
+	0x6016001e, 0x6217001e, 0x6218001e, 0x6219001e, 0x621a001e,
+	0x621b001e, 0x621c001e, 0x621d001e, 0x621e001e, 0x621f001e
+};
+
+static const struct urtwn_bb_prog rtl8192ce_bb_prog = {
+	nitems(rtl8192ce_bb_regs),
+	rtl8192ce_bb_regs,
+	rtl8192ce_bb_vals,
+	nitems(rtl8192ce_agc_vals),
+	rtl8192ce_agc_vals
+};
+
+/*
+ * RTL8188CU.
+ */
+static const uint32_t rtl8192cu_bb_vals[] = {
+	0x0011800d, 0x00ffdb83, 0x80040002, 0x00000003, 0x0000fc00,
+	0x0000000a, 0x10005388, 0x020c3d10, 0x02200385, 0x00000000,
+	0x01000100, 0x00390004, 0x01000100, 0x00390004, 0x27272727,
+	0x27272727, 0x27272727, 0x27272727, 0x00010000, 0x00010000,
+	0x27272727, 0x27272727, 0x00000000, 0x00000000, 0x569a569a,
+	0x0c1b25a4, 0x66e60230, 0x061f0130, 0x27272727, 0x2b2b2b27,
+	0x07000700, 0x22184000, 0x08080808, 0x00000000, 0xc0083070,
+	0x000004d5, 0x00000000, 0xcc0000c0, 0x00000800, 0xfffffffe,
+	0x40302010, 0x00706050, 0x00000000, 0x00000023, 0x00000000,
+	0x81121313, 0x00d047c8, 0x80ff000c, 0x8c838300, 0x2e68120f,
+	0x9500bb78, 0x11144028, 0x00881117, 0x89140f00, 0x1a1b0000,
+	0x090e1317, 0x00000204, 0x00d30000, 0x101fbf00, 0x00000007,
+	0x48071d40, 0x03a05633, 0x000000e4, 0x6c6c6c6c, 0x08800000,
+	0x40000100, 0x08800000, 0x40000100, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x69e9ac44, 0x469652cf, 0x49795994,
+	0x0a97971c, 0x1f7c403f, 0x000100b7, 0xec020107, 0x007f037f,
+	0x6954341e, 0x43bc0094, 0x6954341e, 0x433c0094, 0x00000000,
+	0x5116848b, 0x47c00bff, 0x00000036, 0x2c7f000d, 0x0186115b,
+	0x0000001f, 0x00b99612, 0x40000100, 0x20f60000, 0x40000100,
+	0x20200000, 0x00121820, 0x00000000, 0x00121820, 0x00007f7f,
+	0x00000000, 0x00000080, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x28000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x64b22427,
+	0x00766932, 0x00222222, 0x00000000, 0x37644302, 0x2f97d40c,
+	0x00080740, 0x00020403, 0x0000907f, 0x20010201, 0xa0633333,
+	0x3333bc43, 0x7a8f5b6b, 0xcc979975, 0x00000000, 0x80608000,
+	0x00000000, 0x00027293, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x6437140a, 0x00000000, 0x00000000, 0x30032064,
+	0x4653de68, 0x04518a3c, 0x00002101, 0x2a201c16, 0x1812362e,
+	0x322c2220, 0x000e3c24, 0x2a2a2a2a, 0x2a2a2a2a, 0x03902a2a,
+	0x2a2a2a2a, 0x2a2a2a2a, 0x2a2a2a2a, 0x2a2a2a2a, 0x00000000,
+	0x1000dc1f, 0x10008c1f, 0x02140102, 0x681604c2, 0x01007c00,
+	0x01004800, 0xfb000000, 0x000028d1, 0x1000dc1f, 0x10008c1f,
+	0x02140102, 0x28160d05, 0x00000010, 0x001b25a4, 0x63db25a4,
+	0x63db25a4, 0x0c1b25a4, 0x0c1b25a4, 0x0c1b25a4, 0x0c1b25a4,
+	0x63db25a4, 0x0c1b25a4, 0x63db25a4, 0x63db25a4, 0x63db25a4,
+	0x63db25a4, 0x001b25a4, 0x001b25a4, 0x6fdb25a4, 0x00000003,
+	0x00000000, 0x00000300
+};
+
+static const struct urtwn_bb_prog rtl8192cu_bb_prog = {
+	nitems(rtl8192ce_bb_regs),
+	rtl8192ce_bb_regs,
+	rtl8192cu_bb_vals,
+	nitems(rtl8192ce_agc_vals),
+	rtl8192ce_agc_vals
+};
+
+/*
+ * RTL8188CE-VAU.
+ */
+static const uint32_t rtl8188ce_bb_vals[] = {
+	0x0011800d, 0x00ffdb83, 0x80040000, 0x00000001, 0x0000fc00,
+	0x0000000a, 0x10005388, 0x020c3d10, 0x02200385, 0x00000000,
+	0x01000100, 0x00390004, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00010000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x569a569a,
+	0x001b25a4, 0x66e60230, 0x061f0130, 0x00000000, 0x32323200,
+	0x07000700, 0x22004000, 0x00000808, 0x00000000, 0xc0083070,
+	0x000004d5, 0x00000000, 0xccc000c0, 0x00000800, 0xfffffffe,
+	0x40302010, 0x00706050, 0x00000000, 0x00000023, 0x00000000,
+	0x81121111, 0x00d047c8, 0x80ff000c, 0x8c838300, 0x2e68120f,
+	0x9500bb78, 0x11144028, 0x00881117, 0x89140f00, 0x1a1b0000,
+	0x090e1317, 0x00000204, 0x00d30000, 0x101fbf00, 0x00000007,
+	0x48071d40, 0x03a05611, 0x000000e4, 0x6c6c6c6c, 0x08800000,
+	0x40000100, 0x08800000, 0x40000100, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x69e9ac44, 0x469652cf, 0x49795994,
+	0x0a97971c, 0x1f7c403f, 0x000100b7, 0xec020107, 0x007f037f,
+	0x6954341e, 0x43bc0094, 0x6954341e, 0x433c0094, 0x00000000,
+	0x5116848b, 0x47c00bff, 0x00000036, 0x2c7f000d, 0x018610db,
+	0x0000001f, 0x00b91612, 0x40000100, 0x20f60000, 0x40000100,
+	0x20200000, 0x00121820, 0x00000000, 0x00121820, 0x00007f7f,
+	0x00000000, 0x00000080, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x28000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x64b22427,
+	0x00766932, 0x00222222, 0x00000000, 0x37644302, 0x2f97d40c,
+	0x00080740, 0x00020401, 0x0000907f, 0x20010201, 0xa0633333,
+	0x3333bc43, 0x7a8f5b6b, 0xcc979975, 0x00000000, 0x80608000,
+	0x00000000, 0x00027293, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x6437140a, 0x00000000, 0x00000000, 0x30032064,
+	0x4653de68, 0x04518a3c, 0x00002101, 0x2a201c16, 0x1812362e,
+	0x322c2220, 0x000e3c24, 0x2a2a2a2a, 0x2a2a2a2a, 0x03902a2a,
+	0x2a2a2a2a, 0x2a2a2a2a, 0x2a2a2a2a, 0x2a2a2a2a, 0x00000000,
+	0x1000dc1f, 0x10008c1f, 0x02140102, 0x681604c2, 0x01007c00,
+	0x01004800, 0xfb000000, 0x000028d1, 0x1000dc1f, 0x10008c1f,
+	0x02140102, 0x28160d05, 0x00000008, 0x001b25a4, 0x631b25a0,
+	0x631b25a0, 0x081b25a0, 0x081b25a0, 0x081b25a0, 0x081b25a0,
+	0x631b25a0, 0x081b25a0, 0x631b25a0, 0x631b25a0, 0x631b25a0,
+	0x631b25a0, 0x001b25a0, 0x001b25a0, 0x6b1b25a0, 0x00000003,
+	0x00000000, 0x00000300
+};
+
+static const uint32_t rtl8188ce_agc_vals[] = {
+	0x7b000001, 0x7b010001, 0x7b020001, 0x7b030001, 0x7b040001,
+	0x7b050001, 0x7a060001, 0x79070001, 0x78080001, 0x77090001,
+	0x760a0001, 0x750b0001, 0x740c0001, 0x730d0001, 0x720e0001,
+	0x710f0001, 0x70100001, 0x6f110001, 0x6e120001, 0x6d130001,
+	0x6c140001, 0x6b150001, 0x6a160001, 0x69170001, 0x68180001,
+	0x67190001, 0x661a0001, 0x651b0001, 0x641c0001, 0x631d0001,
+	0x621e0001, 0x611f0001, 0x60200001, 0x49210001, 0x48220001,
+	0x47230001, 0x46240001, 0x45250001, 0x44260001, 0x43270001,
+	0x42280001, 0x41290001, 0x402a0001, 0x262b0001, 0x252c0001,
+	0x242d0001, 0x232e0001, 0x222f0001, 0x21300001, 0x20310001,
+	0x06320001, 0x05330001, 0x04340001, 0x03350001, 0x02360001,
+	0x01370001, 0x00380001, 0x00390001, 0x003a0001, 0x003b0001,
+	0x003c0001, 0x003d0001, 0x003e0001, 0x003f0001, 0x7b400001,
+	0x7b410001, 0x7b420001, 0x7b430001, 0x7b440001, 0x7b450001,
+	0x7a460001, 0x79470001, 0x78480001, 0x77490001, 0x764a0001,
+	0x754b0001, 0x744c0001, 0x734d0001, 0x724e0001, 0x714f0001,
+	0x70500001, 0x6f510001, 0x6e520001, 0x6d530001, 0x6c540001,
+	0x6b550001, 0x6a560001, 0x69570001, 0x68580001, 0x67590001,
+	0x665a0001, 0x655b0001, 0x645c0001, 0x635d0001, 0x625e0001,
+	0x615f0001, 0x60600001, 0x49610001, 0x48620001, 0x47630001,
+	0x46640001, 0x45650001, 0x44660001, 0x43670001, 0x42680001,
+	0x41690001, 0x406a0001, 0x266b0001, 0x256c0001, 0x246d0001,
+	0x236e0001, 0x226f0001, 0x21700001, 0x20710001, 0x06720001,
+	0x05730001, 0x04740001, 0x03750001, 0x02760001, 0x01770001,
+	0x00780001, 0x00790001, 0x007a0001, 0x007b0001, 0x007c0001,
+	0x007d0001, 0x007e0001, 0x007f0001, 0x3800001e, 0x3801001e,
+	0x3802001e, 0x3803001e, 0x3804001e, 0x3805001e, 0x3806001e,
+	0x3807001e, 0x3808001e, 0x3c09001e, 0x3e0a001e, 0x400b001e,
+	0x440c001e, 0x480d001e, 0x4c0e001e, 0x500f001e, 0x5210001e,
+	0x5611001e, 0x5a12001e, 0x5e13001e, 0x6014001e, 0x6015001e,
+	0x6016001e, 0x6217001e, 0x6218001e, 0x6219001e, 0x621a001e,
+	0x621b001e, 0x621c001e, 0x621d001e, 0x621e001e, 0x621f001e
+};
+
+static const struct urtwn_bb_prog rtl8188ce_bb_prog = {
+	nitems(rtl8192ce_bb_regs),
+	rtl8192ce_bb_regs,
+	rtl8188ce_bb_vals,
+	nitems(rtl8188ce_agc_vals),
+	rtl8188ce_agc_vals
+};
+
+static const uint32_t rtl8188cu_bb_vals[] = {
+	0x0011800d, 0x00ffdb83, 0x80040000, 0x00000001, 0x0000fc00,
+	0x0000000a, 0x10005388, 0x020c3d10, 0x02200385, 0x00000000,
+	0x01000100, 0x00390004, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00010000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x569a569a,
+	0x001b25a4, 0x66e60230, 0x061f0130, 0x00000000, 0x32323200,
+	0x07000700, 0x22004000, 0x00000808, 0x00000000, 0xc0083070,
+	0x000004d5, 0x00000000, 0xccc000c0, 0x00000800, 0xfffffffe,
+	0x40302010, 0x00706050, 0x00000000, 0x00000023, 0x00000000,
+	0x81121111, 0x00d047c8, 0x80ff000c, 0x8c838300, 0x2e68120f,
+	0x9500bb78, 0x11144028, 0x00881117, 0x89140f00, 0x1a1b0000,
+	0x090e1317, 0x00000204, 0x00d30000, 0x101fbf00, 0x00000007,
+	0x48071d40, 0x03a05611, 0x000000e4, 0x6c6c6c6c, 0x08800000,
+	0x40000100, 0x08800000, 0x40000100, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x69e9ac44, 0x469652cf, 0x49795994,
+	0x0a97971c, 0x1f7c403f, 0x000100b7, 0xec020107, 0x007f037f,
+	0x6954341e, 0x43bc0094, 0x6954341e, 0x433c0094, 0x00000000,
+	0x5116848b, 0x47c00bff, 0x00000036, 0x2c7f000d, 0x018610db,
+	0x0000001f, 0x00b91612, 0x40000100, 0x20f60000, 0x40000100,
+	0x20200000, 0x00121820, 0x00000000, 0x00121820, 0x00007f7f,
+	0x00000000, 0x00000080, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x28000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x64b22427,
+	0x00766932, 0x00222222, 0x00000000, 0x37644302, 0x2f97d40c,
+	0x00080740, 0x00020401, 0x0000907f, 0x20010201, 0xa0633333,
+	0x3333bc43, 0x7a8f5b6b, 0xcc979975, 0x00000000, 0x80608000,
+	0x00000000, 0x00027293, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x6437140a, 0x00000000, 0x00000000, 0x30032064,
+	0x4653de68, 0x04518a3c, 0x00002101, 0x2a201c16, 0x1812362e,
+	0x322c2220, 0x000e3c24, 0x2a2a2a2a, 0x2a2a2a2a, 0x03902a2a,
+	0x2a2a2a2a, 0x2a2a2a2a, 0x2a2a2a2a, 0x2a2a2a2a, 0x00000000,
+	0x1000dc1f, 0x10008c1f, 0x02140102, 0x681604c2, 0x01007c00,
+	0x01004800, 0xfb000000, 0x000028d1, 0x1000dc1f, 0x10008c1f,
+	0x02140102, 0x28160d05, 0x00000008, 0x001b25a4, 0x631b25a0,
+	0x631b25a0, 0x081b25a0, 0x081b25a0, 0x081b25a0, 0x081b25a0,
+	0x631b25a0, 0x081b25a0, 0x631b25a0, 0x631b25a0, 0x631b25a0,
+	0x631b25a0, 0x001b25a0, 0x001b25a0, 0x6b1b25a0, 0x00000003,
+	0x00000000, 0x00000300
+};
+
+static const struct urtwn_bb_prog rtl8188cu_bb_prog = {
+	nitems(rtl8192ce_bb_regs),
+	rtl8192ce_bb_regs,
+	rtl8188cu_bb_vals,
+	nitems(rtl8188ce_agc_vals),
+	rtl8188ce_agc_vals
+};
+
+/*
+ * RTL8188RU.
+ */
+static const uint16_t rtl8188ru_bb_regs[] = {
+	0x024, 0x028, 0x040, 0x800, 0x804, 0x808, 0x80c, 0x810, 0x814,
+	0x818, 0x81c, 0x820, 0x824, 0x828, 0x82c, 0x830, 0x834, 0x838,
+	0x83c, 0x840, 0x844, 0x848, 0x84c, 0x850, 0x854, 0x858, 0x85c,
+	0x860, 0x864, 0x868, 0x86c, 0x870, 0x874, 0x878, 0x87c, 0x880,
+	0x884, 0x888, 0x88c, 0x890, 0x894, 0x898, 0x89c, 0x900, 0x904,
+	0x908, 0x90c, 0xa00, 0xa04, 0xa08, 0xa0c, 0xa10, 0xa14, 0xa18,
+	0xa1c, 0xa20, 0xa24, 0xa28, 0xa2c, 0xa70, 0xa74, 0xc00, 0xc04,
+	0xc08, 0xc0c, 0xc10, 0xc14, 0xc18, 0xc1c, 0xc20, 0xc24, 0xc28,
+	0xc2c, 0xc30, 0xc34, 0xc38, 0xc3c, 0xc40, 0xc44, 0xc48, 0xc4c,
+	0xc50, 0xc54, 0xc58, 0xc5c, 0xc60, 0xc64, 0xc68, 0xc6c, 0xc70,
+	0xc74, 0xc78, 0xc7c, 0xc80, 0xc84, 0xc88, 0xc8c, 0xc90, 0xc94,
+	0xc98, 0xc9c, 0xca0, 0xca4, 0xca8, 0xcac, 0xcb0, 0xcb4, 0xcb8,
+	0xcbc, 0xcc0, 0xcc4, 0xcc8, 0xccc, 0xcd0, 0xcd4, 0xcd8, 0xcdc,
+	0xce0, 0xce4, 0xce8, 0xcec, 0xd00, 0xd04, 0xd08, 0xd0c, 0xd10,
+	0xd14, 0xd18, 0xd2c, 0xd30, 0xd34, 0xd38, 0xd3c, 0xd40, 0xd44,
+	0xd48, 0xd4c, 0xd50, 0xd54, 0xd58, 0xd5c, 0xd60, 0xd64, 0xd68,
+	0xd6c, 0xd70, 0xd74, 0xd78, 0xe00, 0xe04, 0xe08, 0xe10, 0xe14,
+	0xe18, 0xe1c, 0xe28, 0xe30, 0xe34, 0xe38, 0xe3c, 0xe40, 0xe44,
+	0xe48, 0xe4c, 0xe50, 0xe54, 0xe58, 0xe5c, 0xe60, 0xe68, 0xe6c,
+	0xe70, 0xe74, 0xe78, 0xe7c, 0xe80, 0xe84, 0xe88, 0xe8c, 0xed0,
+	0xed4, 0xed8, 0xedc, 0xee0, 0xeec, 0xee8, 0xf14, 0xf4c, 0xf00
+};
+
+static const uint32_t rtl8188ru_bb_vals[] = {
+	0x0011800d, 0x00ffdb83, 0x000c0004, 0x80040000, 0x00000001,
+	0x0000fc00, 0x0000000a, 0x10005388, 0x020c3d10, 0x02200385,
+	0x00000000, 0x01000100, 0x00390204, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00010000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x569a569a, 0x001b25a4, 0x66e60230, 0x061f0130, 0x00000000,
+	0x32323200, 0x03000300, 0x22004000, 0x00000808, 0x00ffc3f1,
+	0xc0083070, 0x000004d5, 0x00000000, 0xccc000c0, 0x00000800,
+	0xfffffffe, 0x40302010, 0x00706050, 0x00000000, 0x00000023,
+	0x00000000, 0x81121111, 0x00d047c8, 0x80ff000c, 0x8c838300,
+	0x2e68120f, 0x9500bb78, 0x11144028, 0x00881117, 0x89140f00,
+	0x15160000, 0x070b0f12, 0x00000104, 0x00d30000, 0x101fbf00,
+	0x00000007, 0x48071d40, 0x03a05611, 0x000000e4, 0x6c6c6c6c,
+	0x08800000, 0x40000100, 0x08800000, 0x40000100, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x69e9ac44, 0x469652cf,
+	0x49795994, 0x0a97971c, 0x1f7c403f, 0x000100b7, 0xec020107,
+	0x007f037f, 0x6954342e, 0x43bc0094, 0x6954342f, 0x433c0094,
+	0x00000000, 0x5116848b, 0x47c00bff, 0x00000036, 0x2c56000d,
+	0x018610db, 0x0000001f, 0x00b91612, 0x24000090, 0x20f60000,
+	0x24000090, 0x20200000, 0x00121820, 0x00000000, 0x00121820,
+	0x00007f7f, 0x00000000, 0x00000080, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x28000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x64b22427, 0x00766932, 0x00222222, 0x00000000, 0x37644302,
+	0x2f97d40c, 0x00080740, 0x00020401, 0x0000907f, 0x20010201,
+	0xa0633333, 0x3333bc43, 0x7a8f5b6b, 0xcc979975, 0x00000000,
+	0x80608000, 0x00000000, 0x00027293, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x6437140a, 0x00000000, 0x00000000,
+	0x30032064, 0x4653de68, 0x04518a3c, 0x00002101, 0x2a201c16,
+	0x1812362e, 0x322c2220, 0x000e3c24, 0x2a2a2a2a, 0x2a2a2a2a,
+	0x03902a2a, 0x2a2a2a2a, 0x2a2a2a2a, 0x2a2a2a2a, 0x2a2a2a2a,
+	0x00000000, 0x1000dc1f, 0x10008c1f, 0x02140102, 0x681604c2,
+	0x01007c00, 0x01004800, 0xfb000000, 0x000028d1, 0x1000dc1f,
+	0x10008c1f, 0x02140102, 0x28160d05, 0x00000010, 0x001b25a4,
+	0x631b25a0, 0x631b25a0, 0x081b25a0, 0x081b25a0, 0x081b25a0,
+	0x081b25a0, 0x631b25a0, 0x081b25a0, 0x631b25a0, 0x631b25a0,
+	0x631b25a0, 0x631b25a0, 0x001b25a0, 0x001b25a0, 0x6b1b25a0,
+	0x31555448, 0x00000003, 0x00000000, 0x00000300
+};
+
+static const uint32_t rtl8188ru_agc_vals[] = {
+	0x7b000001, 0x7b010001, 0x7b020001, 0x7b030001, 0x7b040001,
+	0x7b050001, 0x7b060001, 0x7b070001, 0x7b080001, 0x7a090001,
+	0x790a0001, 0x780b0001, 0x770c0001, 0x760d0001, 0x750e0001,
+	0x740f0001, 0x73100001, 0x72110001, 0x71120001, 0x70130001,
+	0x6f140001, 0x6e150001, 0x6d160001, 0x6c170001, 0x6b180001,
+	0x6a190001, 0x691a0001, 0x681b0001, 0x671c0001, 0x661d0001,
+	0x651e0001, 0x641f0001, 0x63200001, 0x62210001, 0x61220001,
+	0x60230001, 0x46240001, 0x45250001, 0x44260001, 0x43270001,
+	0x42280001, 0x41290001, 0x402a0001, 0x262b0001, 0x252c0001,
+	0x242d0001, 0x232e0001, 0x222f0001, 0x21300001, 0x20310001,
+	0x06320001, 0x05330001, 0x04340001, 0x03350001, 0x02360001,
+	0x01370001, 0x00380001, 0x00390001, 0x003a0001, 0x003b0001,
+	0x003c0001, 0x003d0001, 0x003e0001, 0x003f0001, 0x7b400001,
+	0x7b410001, 0x7b420001, 0x7b430001, 0x7b440001, 0x7b450001,
+	0x7b460001, 0x7b470001, 0x7b480001, 0x7a490001, 0x794a0001,
+	0x784b0001, 0x774c0001, 0x764d0001, 0x754e0001, 0x744f0001,
+	0x73500001, 0x72510001, 0x71520001, 0x70530001, 0x6f540001,
+	0x6e550001, 0x6d560001, 0x6c570001, 0x6b580001, 0x6a590001,
+	0x695a0001, 0x685b0001, 0x675c0001, 0x665d0001, 0x655e0001,
+	0x645f0001, 0x63600001, 0x62610001, 0x61620001, 0x60630001,
+	0x46640001, 0x45650001, 0x44660001, 0x43670001, 0x42680001,
+	0x41690001, 0x406a0001, 0x266b0001, 0x256c0001, 0x246d0001,
+	0x236e0001, 0x226f0001, 0x21700001, 0x20710001, 0x06720001,
+	0x05730001, 0x04740001, 0x03750001, 0x02760001, 0x01770001,
+	0x00780001, 0x00790001, 0x007a0001, 0x007b0001, 0x007c0001,
+	0x007d0001, 0x007e0001, 0x007f0001, 0x3800001e, 0x3801001e,
+	0x3802001e, 0x3803001e, 0x3804001e, 0x3805001e, 0x3806001e,
+	0x3807001e, 0x3808001e, 0x3c09001e, 0x3e0a001e, 0x400b001e,
+	0x440c001e, 0x480d001e, 0x4c0e001e, 0x500f001e, 0x5210001e,
+	0x5611001e, 0x5a12001e, 0x5e13001e, 0x6014001e, 0x6015001e,
+	0x6016001e, 0x6217001e, 0x6218001e, 0x6219001e, 0x621a001e,
+	0x621b001e, 0x621c001e, 0x621d001e, 0x621e001e, 0x621f001e
+};
+
+static const struct urtwn_bb_prog rtl8188ru_bb_prog = {
+	nitems(rtl8188ru_bb_regs),
+	rtl8188ru_bb_regs,
+	rtl8188ru_bb_vals,
+	nitems(rtl8188ru_agc_vals),
+	rtl8188ru_agc_vals
+};
+
+/*
+ * RF initialization values.
+ */
+struct urtwn_rf_prog {
+	int		count;
+	const uint8_t	*regs;
+	const uint32_t	*vals;
+};
+
+/*
+ * RTL8192CU and RTL8192CE-VAU.
+ */
+static const uint8_t rtl8192ce_rf1_regs[] = {
+	0x00, 0x01, 0x02, 0x03, 0x04, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e,
+	0x0f, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f, 0x20, 0x21, 0x22,
+	0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x2b, 0x2a, 0x2b,
+	0x2a, 0x2b, 0x2b, 0x2c, 0x2a, 0x2b, 0x2b, 0x2c, 0x2a, 0x2b, 0x2b,
+	0x2c, 0x2a, 0x2b, 0x2b, 0x2c, 0x2a, 0x2b, 0x2b, 0x2c, 0x2a, 0x2b,
+	0x2b, 0x2c, 0x2a, 0x2b, 0x2b, 0x2c, 0x2a, 0x2b, 0x2b, 0x2c, 0x2a,
+	0x2b, 0x2b, 0x2c, 0x2a, 0x2b, 0x2b, 0x2c, 0x2a, 0x2b, 0x2b, 0x2c,
+	0x2a, 0x2b, 0x2b, 0x2c, 0x2a, 0x2b, 0x2b, 0x2c, 0x2a, 0x2b, 0x2b,
+	0x2c, 0x2a, 0x10, 0x11, 0x10, 0x11, 0x10, 0x11, 0x10, 0x11, 0x10,
+	0x11, 0x10, 0x11, 0x10, 0x11, 0x12, 0x12, 0x12, 0x12, 0x13, 0x13,
+	0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x14, 0x14,
+	0x14, 0x14, 0x15, 0x15, 0x15, 0x15, 0x16, 0x16, 0x16, 0x16, 0x00,
+	0x18, 0xfe, 0xfe, 0x1f, 0xfe, 0xfe, 0x1e, 0x1f, 0x00
+};
+
+static const uint32_t rtl8192ce_rf1_vals[] = {
+	0x30159, 0x31284, 0x98000, 0x18c63, 0x210e7, 0x2044f, 0x1adb1,
+	0x54867, 0x8992e, 0x0e52c, 0x39ce7, 0x00451, 0x00000, 0x10255,
+	0x60a00, 0xfc378, 0xa1250, 0x4445f, 0x80001, 0x0b614, 0x6c000,
+	0x00000, 0x01558, 0x00060, 0x00483, 0x4f000, 0xec7d9, 0x577c0,
+	0x04783, 0x00001, 0x21334, 0x00000, 0x00054, 0x00001, 0x00808,
+	0x53333, 0x0000c, 0x00002, 0x00808, 0x5b333, 0x0000d, 0x00003,
+	0x00808, 0x63333, 0x0000d, 0x00004, 0x00808, 0x6b333, 0x0000d,
+	0x00005, 0x00808, 0x73333, 0x0000d, 0x00006, 0x00709, 0x5b333,
+	0x0000d, 0x00007, 0x00709, 0x63333, 0x0000d, 0x00008, 0x0060a,
+	0x4b333, 0x0000d, 0x00009, 0x0060a, 0x53333, 0x0000d, 0x0000a,
+	0x0060a, 0x5b333, 0x0000d, 0x0000b, 0x0060a, 0x63333, 0x0000d,
+	0x0000c, 0x0060a, 0x6b333, 0x0000d, 0x0000d, 0x0060a, 0x73333,
+	0x0000d, 0x0000e, 0x0050b, 0x66666, 0x0001a, 0xe0000, 0x4000f,
+	0xe31fc, 0x6000f, 0xff9f8, 0x2000f, 0x203f9, 0x3000f, 0xff500,
+	0x00000, 0x00000, 0x8000f, 0x3f100, 0x9000f, 0x23100, 0x32000,
+	0x71000, 0xb0000, 0xfc000, 0x287af, 0x244b7, 0x204ab, 0x1c49f,
+	0x18493, 0x14297, 0x10295, 0x0c298, 0x0819c, 0x040a8, 0x0001c,
+	0x1944c, 0x59444, 0x9944c, 0xd9444, 0x0f424, 0x4f424, 0x8f424,
+	0xcf424, 0xe0330, 0xa0330, 0x60330, 0x20330, 0x10159, 0x0f401,
+	0x00000, 0x00000, 0x80003, 0x00000, 0x00000, 0x44457, 0x80000,
+	0x30159
+};
+
+static const uint8_t rtl8192ce_rf2_regs[] = {
+	0x00, 0x01, 0x02, 0x03, 0x04, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e,
+	0x0f, 0x12, 0x12, 0x12, 0x12, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13,
+	0x13, 0x13, 0x13, 0x13, 0x13, 0x14, 0x14, 0x14, 0x14, 0x15, 0x15,
+	0x15, 0x15, 0x16, 0x16, 0x16, 0x16
+};
+
+static const uint32_t rtl8192ce_rf2_vals[] = {
+	0x30159, 0x31284, 0x98000, 0x18c63, 0x210e7, 0x2044f, 0x1adb1,
+	0x54867, 0x8992e, 0x0e52c, 0x39ce7, 0x00451, 0x32000, 0x71000,
+	0xb0000, 0xfc000, 0x287af, 0x244b7, 0x204ab, 0x1c49f, 0x18493,
+	0x14297, 0x10295, 0x0c298, 0x0819c, 0x040a8, 0x0001c, 0x1944c,
+	0x59444, 0x9944c, 0xd9444, 0x0f424, 0x4f424, 0x8f424, 0xcf424,
+	0xe0330, 0xa0330, 0x60330, 0x20330
+};
+
+static const struct urtwn_rf_prog rtl8192ce_rf_prog[] = {
+	{
+		nitems(rtl8192ce_rf1_regs),
+		rtl8192ce_rf1_regs,
+		rtl8192ce_rf1_vals
+	},
+	{
+		nitems(rtl8192ce_rf2_regs),
+		rtl8192ce_rf2_regs,
+		rtl8192ce_rf2_vals
+	}
+};
+
+/*
+ * RTL8188CE-VAU.
+ */
+static const uint32_t rtl8188ce_rf_vals[] = {
+	0x30159, 0x31284, 0x98000, 0x18c63, 0x210e7, 0x2044f, 0x1adb1,
+	0x54867, 0x8992e, 0x0e52c, 0x39ce7, 0x00451, 0x00000, 0x10255,
+	0x60a00, 0xfc378, 0xa1250, 0x4445f, 0x80001, 0x0b614, 0x6c000,
+	0x00000, 0x01558, 0x00060, 0x00483, 0x4f200, 0xec7d9, 0x577c0,
+	0x04783, 0x00001, 0x21334, 0x00000, 0x00054, 0x00001, 0x00808,
+	0x53333, 0x0000c, 0x00002, 0x00808, 0x5b333, 0x0000d, 0x00003,
+	0x00808, 0x63333, 0x0000d, 0x00004, 0x00808, 0x6b333, 0x0000d,
+	0x00005, 0x00808, 0x73333, 0x0000d, 0x00006, 0x00709, 0x5b333,
+	0x0000d, 0x00007, 0x00709, 0x63333, 0x0000d, 0x00008, 0x0060a,
+	0x4b333, 0x0000d, 0x00009, 0x0060a, 0x53333, 0x0000d, 0x0000a,
+	0x0060a, 0x5b333, 0x0000d, 0x0000b, 0x0060a, 0x63333, 0x0000d,
+	0x0000c, 0x0060a, 0x6b333, 0x0000d, 0x0000d, 0x0060a, 0x73333,
+	0x0000d, 0x0000e, 0x0050b, 0x66666, 0x0001a, 0xe0000, 0x4000f,
+	0xe31fc, 0x6000f, 0xff9f8, 0x2000f, 0x203f9, 0x3000f, 0xff500,
+	0x00000, 0x00000, 0x8000f, 0x3f100, 0x9000f, 0x23100, 0x32000,
+	0x71000, 0xb0000, 0xfc000, 0x287b3, 0x244b7, 0x204ab, 0x1c49f,
+	0x18493, 0x1429b, 0x10299, 0x0c29c, 0x081a0, 0x040ac, 0x00020,
+	0x1944c, 0x59444, 0x9944c, 0xd9444, 0x0f424, 0x4f424, 0x8f424,
+	0xcf424, 0xe0330, 0xa0330, 0x60330, 0x20330, 0x10159, 0x0f401,
+	0x00000, 0x00000, 0x80003, 0x00000, 0x00000, 0x44457, 0x80000,
+	0x30159
+};
+
+static const struct urtwn_rf_prog rtl8188ce_rf_prog[] = {
+	{
+		nitems(rtl8192ce_rf1_regs),
+		rtl8192ce_rf1_regs,
+		rtl8188ce_rf_vals
+	}
+};
+
+
+/*
+ * RTL8188CU.
+ */
+static const uint32_t rtl8188cu_rf_vals[] = {
+	0x30159, 0x31284, 0x98000, 0x18c63, 0x210e7, 0x2044f, 0x1adb1,
+	0x54867, 0x8992e, 0x0e52c, 0x39ce7, 0x00451, 0x00000, 0x10255,
+	0x60a00, 0xfc378, 0xa1250, 0x4445f, 0x80001, 0x0b614, 0x6c000,
+	0x00000, 0x01558, 0x00060, 0x00483, 0x4f000, 0xec7d9, 0x577c0,
+	0x04783, 0x00001, 0x21334, 0x00000, 0x00054, 0x00001, 0x00808,
+	0x53333, 0x0000c, 0x00002, 0x00808, 0x5b333, 0x0000d, 0x00003,
+	0x00808, 0x63333, 0x0000d, 0x00004, 0x00808, 0x6b333, 0x0000d,
+	0x00005, 0x00808, 0x73333, 0x0000d, 0x00006, 0x00709, 0x5b333,
+	0x0000d, 0x00007, 0x00709, 0x63333, 0x0000d, 0x00008, 0x0060a,
+	0x4b333, 0x0000d, 0x00009, 0x0060a, 0x53333, 0x0000d, 0x0000a,
+	0x0060a, 0x5b333, 0x0000d, 0x0000b, 0x0060a, 0x63333, 0x0000d,
+	0x0000c, 0x0060a, 0x6b333, 0x0000d, 0x0000d, 0x0060a, 0x73333,
+	0x0000d, 0x0000e, 0x0050b, 0x66666, 0x0001a, 0xe0000, 0x4000f,
+	0xe31fc, 0x6000f, 0xff9f8, 0x2000f, 0x203f9, 0x3000f, 0xff500,
+	0x00000, 0x00000, 0x8000f, 0x3f100, 0x9000f, 0x23100, 0x32000,
+	0x71000, 0xb0000, 0xfc000, 0x287b3, 0x244b7, 0x204ab, 0x1c49f,
+	0x18493, 0x1429b, 0x10299, 0x0c29c, 0x081a0, 0x040ac, 0x00020,
+	0x1944c, 0x59444, 0x9944c, 0xd9444, 0x0f405, 0x4f405, 0x8f405,
+	0xcf405, 0xe0330, 0xa0330, 0x60330, 0x20330, 0x10159, 0x0f401,
+	0x00000, 0x00000, 0x80003, 0x00000, 0x00000, 0x44457, 0x80000,
+	0x30159
+};
+
+static const struct urtwn_rf_prog rtl8188cu_rf_prog[] = {
+	{
+		nitems(rtl8192ce_rf1_regs),
+		rtl8192ce_rf1_regs,
+		rtl8188cu_rf_vals
+	}
+};
+
+/*
+ * RTL8188RU.
+ */
+static const uint32_t rtl8188ru_rf_vals[] = {
+	0x30159, 0x31284, 0x98000, 0x18c63, 0x210e7, 0x2044f, 0x1adb0,
+	0x54867, 0x8992e, 0x0e529, 0x39ce7, 0x00451, 0x00000, 0x00255,
+	0x60a00, 0xfc378, 0xa1250, 0x4445f, 0x80001, 0x0b614, 0x6c000,
+	0x0083c, 0x01558, 0x00060, 0x00483, 0x4f000, 0xec7d9, 0x977c0,
+	0x04783, 0x00001, 0x21334, 0x00000, 0x00054, 0x00001, 0x00808,
+	0x53333, 0x0000c, 0x00002, 0x00808, 0x5b333, 0x0000d, 0x00003,
+	0x00808, 0x63333, 0x0000d, 0x00004, 0x00808, 0x6b333, 0x0000d,
+	0x00005, 0x00808, 0x73333, 0x0000d, 0x00006, 0x00709, 0x5b333,
+	0x0000d, 0x00007, 0x00709, 0x63333, 0x0000d, 0x00008, 0x0060a,
+	0x4b333, 0x0000d, 0x00009, 0x0060a, 0x53333, 0x0000d, 0x0000a,
+	0x0060a, 0x5b333, 0x0000d, 0x0000b, 0x0060a, 0x63333, 0x0000d,
+	0x0000c, 0x0060a, 0x6b333, 0x0000d, 0x0000d, 0x0060a, 0x73333,
+	0x0000d, 0x0000e, 0x0050b, 0x66666, 0x0001a, 0xe0000, 0x4000f,
+	0xe31fc, 0x6000f, 0xff9f8, 0x2000f, 0x203f9, 0x3000f, 0xff500,
+	0x00000, 0x00000, 0x8000f, 0x3f100, 0x9000f, 0x23100, 0xd8000,
+	0x90000, 0x51000, 0x12000, 0x28fb4, 0x24fa8, 0x207a4, 0x1c798,
+	0x183a4, 0x14398, 0x101a4, 0x0c198, 0x080a4, 0x04098, 0x00014,
+	0x1944c, 0x59444, 0x9944c, 0xd9444, 0x0f405, 0x4f405, 0x8f405,
+	0xcf405, 0xe0330, 0xa0330, 0x60330, 0x20330, 0x10159, 0x0f401,
+	0x00000, 0x00000, 0x80003, 0x00000, 0x00000, 0x44457, 0x80000,
+	0x30159
+};
+
+static const struct urtwn_rf_prog rtl8188ru_rf_prog[] = {
+	{
+		nitems(rtl8192ce_rf1_regs),
+		rtl8192ce_rf1_regs,
+		rtl8188ru_rf_vals
+	}
+};
+
+struct urtwn_txpwr {
+	uint8_t	pwr[3][28];
+};
+
+/*
+ * Per RF chain/group/rate Tx gain values.
+ */
+static const struct urtwn_txpwr rtl8192cu_txagc[] = {
+	{ {	/* Chain 0. */
+	{	/* Group 0. */
+	0x00, 0x00, 0x00, 0x00,				/* CCK1~11. */
+	0x0c, 0x0c, 0x0c, 0x0a, 0x08, 0x06, 0x04, 0x02,	/* OFDM6~54. */
+	0x0e, 0x0d, 0x0c, 0x0a, 0x08, 0x06, 0x04, 0x02,	/* MCS0~7. */
+	0x0e, 0x0d, 0x0c, 0x0a, 0x08, 0x06, 0x04, 0x02	/* MCS8~15. */
+	},
+	{	/* Group 1. */
+	0x00, 0x00, 0x00, 0x00,				/* CCK1~11. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* OFDM6~54. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* MCS0~7. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00	/* MCS8~15. */
+	},
+	{	/* Group 2. */
+	0x00, 0x00, 0x00, 0x00,				/* CCK1~11. */
+	0x04, 0x04, 0x04, 0x04, 0x04, 0x02, 0x02, 0x00,	/* OFDM6~54. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* MCS0~7. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00	/* MCS8~15. */
+	}
+	} },
+	{ {	/* Chain 1. */
+	{	/* Group 0. */
+	0x00, 0x00, 0x00, 0x00,				/* CCK1~11. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* OFDM6~54. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* MCS0~7. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00	/* MCS8~15. */
+	},
+	{	/* Group 1. */
+	0x00, 0x00, 0x00, 0x00,				/* CCK1~11. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* OFDM6~54. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* MCS0~7. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00	/* MCS8~15. */
+	},
+	{	/* Group 2. */
+	0x00, 0x00, 0x00, 0x00,				/* CCK1~11. */
+	0x04, 0x04, 0x04, 0x04, 0x04, 0x02, 0x02, 0x00,	/* OFDM6~54. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* MCS0~7. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00	/* MCS8~15. */
+	}
+	} }
+};
+
+static const struct urtwn_txpwr rtl8188ru_txagc[] = {
+	{ {	/* Chain 0. */
+	{	/* Group 0. */
+	0x00, 0x00, 0x00, 0x00,				/* CCK1~11. */
+	0x08, 0x08, 0x08, 0x06, 0x06, 0x04, 0x04, 0x00,	/* OFDM6~54. */
+	0x08, 0x06, 0x06, 0x04, 0x04, 0x02, 0x02, 0x00,	/* MCS0~7. */
+	0x08, 0x06, 0x06, 0x04, 0x04, 0x02, 0x02, 0x00	/* MCS8~15. */
+	},
+	{	/* Group 1. */
+	0x00, 0x00, 0x00, 0x00,				/* CCK1~11. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* OFDM6~54. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* MCS0~7. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00	/* MCS8~15. */
+	},
+	{	/* Group 2. */
+	0x00, 0x00, 0x00, 0x00,				/* CCK1~11. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* OFDM6~54. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,	/* MCS0~7. */
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00	/* MCS8~15. */
+	}
+	} }
+};
diff --git a/sys/modules/usb/Makefile b/sys/modules/usb/Makefile
index 6481838..29255e7 100644
--- a/sys/modules/usb/Makefile
+++ b/sys/modules/usb/Makefile
@@ -32,7 +32,7 @@
 
 SUBDIR = usb
 SUBDIR += ${_dwc_otg} ehci ${_musb} ohci uhci xhci ${_uss820dci} ${_at91dci} ${_atmegadci} ${_avr32dci}
-SUBDIR += ${_rum} run ${_uath} upgt usie ural ${_zyd} ${_urtw}
+SUBDIR += ${_rum} run ${_uath} upgt usie ural ${_zyd} ${_urtw} urtwn
 SUBDIR += atp uhid ukbd ums udbp ufm uep
 SUBDIR += ucom u3g uark ubsa ubser uchcom ucycom ufoma uftdi ugensa uipaq ulpt \
 	  umct umcs umodem umoscom uplcom uslcom uvisor uvscom
diff --git a/sys/modules/usb/urtwn/Makefile b/sys/modules/usb/urtwn/Makefile
new file mode 100644
index 0000000..58c409a
--- /dev/null
+++ b/sys/modules/usb/urtwn/Makefile
@@ -0,0 +1,10 @@
+# $FreeBSD$
+
+.PATH: ${.CURDIR}/../../../dev/usb/wlan
+
+KMOD    = if_urtwn
+SRCS    = if_urtwn.c if_urtwnreg.h \
+	  bus_if.h device_if.h \
+	  opt_bus.h opt_usb.h usb_if.h usbdevs.h
+
+.include <bsd.kmod.mk>
author	rpaulo <rpaulo@FreeBSD.org>	2013-06-08 16:02:31 +0000
committer	rpaulo <rpaulo@FreeBSD.org>	2013-06-08 16:02:31 +0000
commit	8f36fe887a99fd6fe01305dac04d9a90a856d40a (patch)
tree	43c6844c1ee3be1cfbce0283d7b2042e64145bcb
parent	a1d0d1236720cbb9ff6a9548a27707ddd4dd1507 (diff)
download	FreeBSD-src-8f36fe887a99fd6fe01305dac04d9a90a856d40a.zip FreeBSD-src-8f36fe887a99fd6fe01305dac04d9a90a856d40a.tar.gz