 @@ -1,39 +1,41 @@
-/*	$NetBSD: if_urtwn.c,v 1.48 2016/10/12 02:56:45 nat Exp $	*/
+/*	$NetBSD: if_urtwn.c,v 1.49 2016/10/12 03:23:29 nat Exp $	*/
 /*	$OpenBSD: if_urtwn.c,v 1.42 2015/02/10 23:25:46 mpi Exp $	*/
 /*-
  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
  * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
  * Copyright (c) 2016 Nathanial Sloss <nathanialsloss@yahoo.com.au>
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 /*-
- * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
+ * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU
  * RTL8192EU.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v 1.48 2016/10/12 02:56:45 nat Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v 1.49 2016/10/12 03:23:29 nat Exp $");
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
 #endif
 #include <sys/param.h>
 #include <sys/sockio.h>
 #include <sys/sysctl.h>
 #include <sys/mbuf.h>
 #include <sys/kernel.h>
 #include <sys/socket.h>
 #include <sys/systm.h>
 #include <sys/module.h>
 @@ -89,30 +91,33 @@ __KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v
 #define	DBG_RF		__BIT(5)
 #define	DBG_REG		__BIT(6)
 #define	DBG_ALL		0xffffffffU
 u_int urtwn_debug = 0;
 #define DPRINTFN(n, s)	\
 	do { if (urtwn_debug & (n)) printf s; } while (/*CONSTCOND*/0)
 #else
 #define DPRINTFN(n, s)
 #endif
 #define URTWN_DEV(v,p)	{ { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, 0 }
 #define URTWN_RTL8188E_DEV(v,p) \
 	{ { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, FLAG_RTL8188E }
 #define URTWN_RTL8192EU_DEV(v,p) \
 	{ { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, FLAG_RTL8192E }
 static const struct urtwn_dev {
 	struct usb_devno	dev;
 	uint32_t		flags;
 #define	FLAG_RTL8188E	__BIT(0)
 #define	FLAG_RTL8192E	__BIT(1)
 } urtwn_devs[] = {
 	URTWN_DEV(ABOCOM,	RTL8188CU_1),
 	URTWN_DEV(ABOCOM,	RTL8188CU_2),
 	URTWN_DEV(ABOCOM,	RTL8192CU),
 	URTWN_DEV(ASUSTEK,	RTL8192CU),
 	URTWN_DEV(ASUSTEK,	RTL8192CU_3),
 	URTWN_DEV(ASUSTEK,	USBN10NANO),
 	URTWN_DEV(ASUSTEK,	RTL8192CU_3),
 	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
 	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
 	URTWN_DEV(AZUREWAVE,	RTL8188CU),
 	URTWN_DEV(BELKIN,	F7D2102),
 	URTWN_DEV(BELKIN,	RTL8188CU),
 @@ -174,29 +179,33 @@ static const struct urtwn_dev {
 	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
 	URTWN_DEV(SITECOMEU,	RTL8192CU),
 	URTWN_DEV(SITECOMEU,	RTL8192CUR2),
 	URTWN_DEV(TPLINK,	RTL8192CU),
 	URTWN_DEV(TRENDNET,	RTL8188CU),
 	URTWN_DEV(TRENDNET,	RTL8192CU),
 	URTWN_DEV(ZYXEL,	RTL8192CU),
 	/* URTWN_RTL8188E */
 	URTWN_RTL8188E_DEV(DLINK, DWA125D1),
 	URTWN_RTL8188E_DEV(ELECOM, WDC150SU2M),
 	URTWN_RTL8188E_DEV(REALTEK, RTL8188ETV),
 	URTWN_RTL8188E_DEV(REALTEK, RTL8188EU),
 	/* URTWN_RTL8192EU */
 	URTWN_RTL8192EU_DEV(REALTEK,	RTL8192EU),
 };
 #undef URTWN_DEV
 #undef URTWN_RTL8188E_DEV
 #undef URTWN_RTL8192EU_DEV
 static int	urtwn_match(device_t, cfdata_t, void *);
 static void	urtwn_attach(device_t, device_t, void *);
 static int	urtwn_detach(device_t, int);
 static int	urtwn_activate(device_t, enum devact);
 CFATTACH_DECL_NEW(urtwn, sizeof(struct urtwn_softc), urtwn_match,
     urtwn_attach, urtwn_detach, urtwn_activate);
 static int	urtwn_open_pipes(struct urtwn_softc *);
 static void	urtwn_close_pipes(struct urtwn_softc *);
 static int	urtwn_alloc_rx_list(struct urtwn_softc *);
 static void	urtwn_free_rx_list(struct urtwn_softc *);
 @@ -213,26 +222,28 @@ static void	urtwn_write_2(struct urtwn_s
 static void	urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
 static int	urtwn_write_region(struct urtwn_softc *, uint16_t, uint8_t *,
 		    int);
 static int	urtwn_read_region_1(struct urtwn_softc *, uint16_t, uint8_t *,
 		    int);
 static uint8_t	urtwn_read_1(struct urtwn_softc *, uint16_t);
 static uint16_t	urtwn_read_2(struct urtwn_softc *, uint16_t);
 static uint32_t	urtwn_read_4(struct urtwn_softc *, uint16_t);
 static int	urtwn_fw_cmd(struct urtwn_softc *, uint8_t, const void *, int);
 static void	urtwn_r92c_rf_write(struct urtwn_softc *, int, uint8_t,
 		    uint32_t);
 static void	urtwn_r88e_rf_write(struct urtwn_softc *, int, uint8_t,
 		    uint32_t);
 static void	urtwn_r92e_rf_write(struct urtwn_softc *, int, uint8_t,
 		    uint32_t);
 static uint32_t	urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
 static int	urtwn_llt_write(struct urtwn_softc *, uint32_t, uint32_t);
 static uint8_t	urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
 static void	urtwn_efuse_read(struct urtwn_softc *);
 static void	urtwn_efuse_switch_power(struct urtwn_softc *);
 static int	urtwn_read_chipid(struct urtwn_softc *);
 #ifdef URTWN_DEBUG
 static void	urtwn_dump_rom(struct urtwn_softc *, struct r92c_rom *);
 #endif
 static void	urtwn_read_rom(struct urtwn_softc *);
 static void	urtwn_r88e_read_rom(struct urtwn_softc *);
 static int	urtwn_media_change(struct ifnet *);
 static int	urtwn_ra_init(struct urtwn_softc *);
 @@ -252,26 +263,27 @@ static void	urtwn_update_avgrssi(struct
 static int8_t	urtwn_get_rssi(struct urtwn_softc *, int, void *);
 static int8_t	urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
 static void	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int);
 static void	urtwn_rxeof(struct usbd_xfer *, void *, usbd_status);
 static void	urtwn_txeof(struct usbd_xfer *, void *, usbd_status);
 static int	urtwn_tx(struct urtwn_softc *, struct mbuf *,
 		    struct ieee80211_node *, struct urtwn_tx_data *);
 static struct urtwn_tx_data *
 		urtwn_get_tx_data(struct urtwn_softc *, size_t);
 static void	urtwn_start(struct ifnet *);
 static void	urtwn_watchdog(struct ifnet *);
 static int	urtwn_ioctl(struct ifnet *, u_long, void *);
 static int	urtwn_r92c_power_on(struct urtwn_softc *);
 static int	urtwn_r92e_power_on(struct urtwn_softc *);
 static int	urtwn_r88e_power_on(struct urtwn_softc *);
 static int	urtwn_llt_init(struct urtwn_softc *);
 static void	urtwn_fw_reset(struct urtwn_softc *);
 static void	urtwn_r88e_fw_reset(struct urtwn_softc *);
 static int	urtwn_fw_loadpage(struct urtwn_softc *, int, uint8_t *, int);
 static int	urtwn_load_firmware(struct urtwn_softc *);
 static int	urtwn_r92c_dma_init(struct urtwn_softc *);
 static int	urtwn_r88e_dma_init(struct urtwn_softc *);
 static void	urtwn_mac_init(struct urtwn_softc *);
 static void	urtwn_bb_init(struct urtwn_softc *);
 static void	urtwn_rf_init(struct urtwn_softc *);
 static void	urtwn_cam_init(struct urtwn_softc *);
 static void	urtwn_pa_bias_init(struct urtwn_softc *);
 @@ -283,90 +295,94 @@ static void	urtwn_get_txpower(struct urt
 static void	urtwn_r88e_get_txpower(struct urtwn_softc *, size_t, u_int,
 		    u_int, uint16_t[]);
 static void	urtwn_set_txpower(struct urtwn_softc *, u_int, u_int);
 static void	urtwn_set_chan(struct urtwn_softc *, struct ieee80211_channel *,
 		    u_int);
 static void	urtwn_iq_calib(struct urtwn_softc *, bool);
 static void	urtwn_lc_calib(struct urtwn_softc *);
 static void	urtwn_temp_calib(struct urtwn_softc *);
 static int	urtwn_init(struct ifnet *);
 static void	urtwn_stop(struct ifnet *, int);
 static int	urtwn_reset(struct ifnet *);
 static void	urtwn_chip_stop(struct urtwn_softc *);
 static void	urtwn_newassoc(struct ieee80211_node *, int);
 static void	urtwn_delay_ms(struct urtwn_softc *, int ms);
 /* Aliases. */
 #define	urtwn_bb_write	urtwn_write_4
 #define	urtwn_bb_read	urtwn_read_4
 #define	urtwn_lookup(d,v,p)	((const struct urtwn_dev *)usb_lookup(d,v,p))
 static const uint16_t addaReg[] = {
 	R92C_FPGA0_XCD_SWITCHCTL, R92C_BLUETOOTH, R92C_RX_WAIT_CCA,
 	R92C_TX_CCK_RFON, R92C_TX_CCK_BBON, R92C_TX_OFDM_RFON,
 	R92C_TX_OFDM_BBON, R92C_TX_TO_RX, R92C_TX_TO_TX, R92C_RX_CCK,
 	R92C_RX_OFDM, R92C_RX_WAIT_RIFS, R92C_RX_TO_RX,
 	R92C_STANDBY, R92C_SLEEP, R92C_PMPD_ANAEN
 };
 static int
 urtwn_match(device_t parent, cfdata_t match, void *aux)
+{
 	struct usb_attach_arg *uaa = aux;
-	return urtwn_lookup(urtwn_devs, uaa->uaa_vendor, uaa->uaa_product) != NULL ?
+	return urtwn_lookup(urtwn_devs, uaa->uaa_vendor, uaa->uaa_product) !=
-	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
+	    NULL ?  UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
+}
 static void
 urtwn_attach(device_t parent, device_t self, void *aux)
+{
 	struct urtwn_softc *sc = device_private(self);
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ifnet *ifp = &sc->sc_if;
 	struct usb_attach_arg *uaa = aux;
 	char *devinfop;
 	const struct urtwn_dev *dev;
 	usb_device_request_t req;
 	size_t i;
 	int error;
 	sc->sc_dev = self;
 	sc->sc_udev = uaa->uaa_device;
 	sc->chip = 0;
 	dev = urtwn_lookup(urtwn_devs, uaa->uaa_vendor, uaa->uaa_product);
 	if (dev != NULL && ISSET(dev->flags, FLAG_RTL8188E))
 		SET(sc->chip, URTWN_CHIP_88E);
 	if (dev != NULL && ISSET(dev->flags, FLAG_RTL8192E))
 		SET(sc->chip, URTWN_CHIP_92EU);
 	aprint_naive("\n");
 	aprint_normal("\n");
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	devinfop = usbd_devinfo_alloc(sc->sc_udev, 0);
 	aprint_normal_dev(self, "%s\n", devinfop);
 	usbd_devinfo_free(devinfop);
 	req.bmRequestType = UT_WRITE_DEVICE;
 	req.bRequest = UR_SET_FEATURE;
 	USETW(req.wValue, UF_DEVICE_REMOTE_WAKEUP);
 	USETW(req.wIndex, UHF_PORT_SUSPEND);
 	USETW(req.wLength, 0);
 	(void) usbd_do_request(sc->sc_udev, &req, 0);
 	mutex_init(&sc->sc_task_mtx, MUTEX_DEFAULT, IPL_NET);
 	mutex_init(&sc->sc_tx_mtx, MUTEX_DEFAULT, IPL_NONE);
 	mutex_init(&sc->sc_rx_mtx, MUTEX_DEFAULT, IPL_NONE);
 	mutex_init(&sc->sc_fwcmd_mtx, MUTEX_DEFAULT, IPL_NONE);
 	mutex_init(&sc->sc_write_mtx, MUTEX_DEFAULT, IPL_NONE);
 	usb_init_task(&sc->sc_task, urtwn_task, sc, 0);
 	callout_init(&sc->sc_scan_to, 0);
 	callout_setfunc(&sc->sc_scan_to, urtwn_next_scan, sc);
 	callout_init(&sc->sc_calib_to, 0);
 	callout_setfunc(&sc->sc_calib_to, urtwn_calib_to, sc);
 	error = usbd_set_config_no(sc->sc_udev, 1, 0);
 	if (error != 0) {
 		aprint_error_dev(self, "failed to set configuration"
 @@ -381,37 +397,42 @@ urtwn_attach(device_t parent, device_t s
 		goto fail;
+	}
 	error = urtwn_read_chipid(sc);
 	if (error != 0) {
 		aprint_error_dev(self, "unsupported test chip\n");
 		goto fail;
+	}
 	/* Determine number of Tx/Rx chains. */
 	if (sc->chip & URTWN_CHIP_92C) {
 		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
 		sc->nrxchains = 2;
 	} else if (sc->chip & URTWN_CHIP_92EU) {
 		sc->ntxchains = 2;
 		sc->nrxchains = 2;
 	} else {
 		sc->ntxchains = 1;
 		sc->nrxchains = 1;
+	}
-	if (ISSET(sc->chip, URTWN_CHIP_88E))
+	if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 	    ISSET(sc->chip, URTWN_CHIP_92EU))
 		urtwn_r88e_read_rom(sc);
 	else
 		urtwn_read_rom(sc);
 	aprint_normal_dev(self, "MAC/BB RTL%s, RF 6052 %zdT%zdR, address %s\n",
 	    (sc->chip & URTWN_CHIP_92EU) ? "8192EU" :
 	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
 	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
 	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
 	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
 	    "8188CUS", sc->ntxchains, sc->nrxchains,
 	    ether_sprintf(ic->ic_myaddr));
 	error = urtwn_open_pipes(sc);
 	if (error != 0) {
 		aprint_error_dev(sc->sc_dev, "could not open pipes\n");
 		goto fail;
+	}
 	aprint_normal_dev(self, "%d rx pipe%s, %d tx pipe%s\n",
 @@ -529,85 +550,98 @@ urtwn_detach(device_t self, int flags)
 		urtwn_close_pipes(sc);
+	}
 	splx(s);
 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev, sc->sc_dev);
 	callout_destroy(&sc->sc_scan_to);
 	callout_destroy(&sc->sc_calib_to);
 	mutex_destroy(&sc->sc_write_mtx);
 	mutex_destroy(&sc->sc_fwcmd_mtx);
 	mutex_destroy(&sc->sc_tx_mtx);
 	mutex_destroy(&sc->sc_rx_mtx);
 	mutex_destroy(&sc->sc_task_mtx);
 	return 0;
+}
 static int
 urtwn_activate(device_t self, enum devact act)
+{
 	struct urtwn_softc *sc = device_private(self);
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	switch (act) {
 	case DVACT_DEACTIVATE:
 		if_deactivate(sc->sc_ic.ic_ifp);
 		return 0;
 	default:
 		return EOPNOTSUPP;
+	}
+}
 static int
 urtwn_open_pipes(struct urtwn_softc *sc)
+{
 	/* Bulk-out endpoints addresses (from highest to lowest prio). */
-	static const uint8_t epaddr[] = { 0x02, 0x03, 0x05 };
+	static uint8_t epaddr[3];
 	static uint8_t rxepaddr[3];
 	usb_interface_descriptor_t *id;
 	usb_endpoint_descriptor_t *ed;
-	size_t i, ntx = 0;
+	size_t i, ntx = 0, nrx = 0;
 	int error;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	/* Determine the number of bulk-out pipes. */
 	id = usbd_get_interface_descriptor(sc->sc_iface);
 	for (i = 0; i < id->bNumEndpoints; i++) {
 		ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
 		if (ed != NULL &&
 		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK &&
-		    UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT)
+		    UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT) {
 			epaddr[ntx] = ed->bEndpointAddress;
 			ntx++;
+		}
 		if (ed != NULL &&
 		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK &&
 		    UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN) {
 			rxepaddr[nrx] = ed->bEndpointAddress;
 			nrx++;
+		}
+	}
 	DPRINTFN(DBG_INIT, ("%s: %s: found %zd bulk-out pipes\n",
 	    device_xname(sc->sc_dev), __func__, ntx));
 	if (ntx == 0 || ntx > R92C_MAX_EPOUT) {
 		aprint_error_dev(sc->sc_dev,
 		    "%zd: invalid number of Tx bulk pipes\n", ntx);
 		return EIO;
+	}
-	sc->rx_npipe = 1;
+	sc->rx_npipe = nrx;
 	sc->tx_npipe = ntx;
 	/* Open bulk-in pipe at address 0x81. */
-	error = usbd_open_pipe(sc->sc_iface, 0x81, USBD_EXCLUSIVE_USE,
+	for (i = 0; i < nrx; i++) {
-	    &sc->rx_pipe);
+		error = usbd_open_pipe(sc->sc_iface, rxepaddr[i],
-	if (error != 0) {
+		    USBD_EXCLUSIVE_USE, &sc->rx_pipe[i]);
-		aprint_error_dev(sc->sc_dev, "could not open Rx bulk pipe"
+		if (error != 0) {
-		    ": %d\n", error);
+			aprint_error_dev(sc->sc_dev,
-		goto fail;
+			    "could not open Rx bulk pipe 0x%02x: %d\n",
 			    rxepaddr[i], error);
 			goto fail;
+		}
+	}
 	/* Open bulk-out pipes (up to 3). */
 	for (i = 0; i < ntx; i++) {
 		error = usbd_open_pipe(sc->sc_iface, epaddr[i],
 		    USBD_EXCLUSIVE_USE, &sc->tx_pipe[i]);
 		if (error != 0) {
 			aprint_error_dev(sc->sc_dev,
 			    "could not open Tx bulk pipe 0x%02x: %d\n",
 			    epaddr[i], error);
 			goto fail;
+		}
+	}
 @@ -622,84 +656,93 @@ urtwn_open_pipes(struct urtwn_softc *sc)
 	if (error != 0)
 		urtwn_close_pipes(sc);
 	return error;
+}
 static void
 urtwn_close_pipes(struct urtwn_softc *sc)
+{
 	struct usbd_pipe *pipe;
 	size_t i;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
-	/* Close Rx pipe. */
+	/* Close Rx pipes. */
 	CTASSERT(sizeof(pipe) == sizeof(void *));
-	pipe = atomic_swap_ptr(&sc->rx_pipe, NULL);
+	for (i = 0; i < sc->rx_npipe; i++) {
-	if (pipe != NULL) {
+		pipe = atomic_swap_ptr(&sc->rx_pipe[i], NULL);
-		usbd_close_pipe(pipe);
+		if (pipe != NULL) {
 			usbd_close_pipe(pipe);
+		}
+	}
 	/* Close Tx pipes. */
-	for (i = 0; i < R92C_MAX_EPOUT; i++) {
+	for (i = 0; i < sc->tx_npipe; i++) {
 		pipe = atomic_swap_ptr(&sc->tx_pipe[i], NULL);
 		if (pipe != NULL) {
 			usbd_close_pipe(pipe);
+		}
+	}
+}
 static int
 urtwn_alloc_rx_list(struct urtwn_softc *sc)
+{
 	struct urtwn_rx_data *data;
 	size_t i;
 	int error = 0;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
-	for (i = 0; i < URTWN_RX_LIST_COUNT; i++) {
+	for (size_t j = 0; j < sc->rx_npipe; j++) {
-		data = &sc->rx_data[i];
+		TAILQ_INIT(&sc->rx_free_list[j]);
 		for (i = 0; i < URTWN_RX_LIST_COUNT; i++) {
 			data = &sc->rx_data[j][i];
-		data->sc = sc;	/* Backpointer for callbacks. */
+			data->sc = sc;	/* Backpointer for callbacks. */
-		error = usbd_create_xfer(sc->rx_pipe, URTWN_RXBUFSZ,
+			error = usbd_create_xfer(sc->rx_pipe[j], URTWN_RXBUFSZ,
-		    USBD_SHORT_XFER_OK, 0, &data->xfer);
+			    USBD_SHORT_XFER_OK, 0, &data->xfer);
-		if (error) {
+			if (error) {
-			aprint_error_dev(sc->sc_dev,
+				aprint_error_dev(sc->sc_dev,
-			    "could not allocate xfer\n");
+				    "could not allocate xfer\n");
-			break;
+				break;
+			}
-		data->buf = usbd_get_buffer(data->xfer);
+			data->buf = usbd_get_buffer(data->xfer);
 			TAILQ_INSERT_TAIL(&sc->rx_free_list[j], data, next);
+		}
+	}
 	if (error != 0)
 		urtwn_free_rx_list(sc);
 	return error;
+}
 static void
 urtwn_free_rx_list(struct urtwn_softc *sc)
+{
 	struct usbd_xfer *xfer;
 	size_t i;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	/* NB: Caller must abort pipe first. */
-	for (i = 0; i < URTWN_RX_LIST_COUNT; i++) {
+	for (size_t j = 0; j < sc->rx_npipe; j++) {
-		CTASSERT(sizeof(xfer) == sizeof(void *));
+		for (i = 0; i < URTWN_RX_LIST_COUNT; i++) {
-		xfer = atomic_swap_ptr(&sc->rx_data[i].xfer, NULL);
+			CTASSERT(sizeof(xfer) == sizeof(void *));
-		if (xfer != NULL)
+			xfer = atomic_swap_ptr(&sc->rx_data[j][i].xfer, NULL);
-			usbd_destroy_xfer(xfer);
+			if (xfer != NULL)
 				usbd_destroy_xfer(xfer);
+		}
+	}
+}
 static int
 urtwn_alloc_tx_list(struct urtwn_softc *sc)
+{
 	struct urtwn_tx_data *data;
 	size_t i;
 	int error = 0;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	mutex_enter(&sc->sc_tx_mtx);
 @@ -967,47 +1010,57 @@ urtwn_fw_cmd(struct urtwn_softc *sc, uin
 	    device_xname(sc->sc_dev), __func__, id, buf, len));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	mutex_enter(&sc->sc_fwcmd_mtx);
 	fwcur = sc->fwcur;
 	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
 	mutex_exit(&sc->sc_fwcmd_mtx);
 	/* Wait for current FW box to be empty. */
 	for (ntries = 0; ntries < 100; ntries++) {
 		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << fwcur)))
 			break;
-		DELAY(1);
+		DELAY(10);
+	}
 	if (ntries == 100) {
 		aprint_error_dev(sc->sc_dev,
 		    "could not send firmware command %d\n", id);
 		return ETIMEDOUT;
+	}
 	memset(&cmd, 0, sizeof(cmd));
 	KASSERT(len <= sizeof(cmd.msg));
 	memcpy(cmd.msg, buf, len);
 	/* Write the first word last since that will trigger the FW. */
 	cp = (uint8_t *)&cmd;
 	cmd.id = id;
 	if (len >= 4) {
-		cmd.id = id | R92C_CMD_FLAG_EXT;
+		if (!ISSET(sc->chip, URTWN_CHIP_92EU)) {
-		urtwn_write_region(sc, R92C_HMEBOX_EXT(fwcur), &cp[1], 2);
+			cmd.id |= R92C_CMD_FLAG_EXT;
-		urtwn_write_4(sc, R92C_HMEBOX(fwcur),
+			urtwn_write_region(sc, R92C_HMEBOX_EXT(fwcur),
-		    cp[0] + (cp[3] << 8) + (cp[4] << 16) + (cp[5] << 24));
+			    &cp[1], 2);
 			urtwn_write_4(sc, R92C_HMEBOX(fwcur),
 			    cp[0] + (cp[3] << 8) + (cp[4] << 16) +
 			    (cp[5] << 24));
 		} else {
 			urtwn_write_region(sc, R92E_HMEBOX_EXT(fwcur),
 			    &cp[4], 2);
 			urtwn_write_4(sc, R92C_HMEBOX(fwcur),
 			    cp[0] + (cp[1] << 8) + (cp[2] << 16) +
 			    (cp[3] << 24));
+		}
 	} else {
 		cmd.id = id;
 		urtwn_write_region(sc, R92C_HMEBOX(fwcur), cp, len);
+	}
 	return 0;
+}
 static __inline void
 urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
+{
 	sc->sc_rf_write(sc, chain, addr, val);
+}
 @@ -1019,26 +1072,35 @@ urtwn_r92c_rf_write(struct urtwn_softc *
 	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
 	    SM(R92C_LSSI_PARAM_ADDR, addr) | SM(R92C_LSSI_PARAM_DATA, val));
+}
 static void
 urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
     uint32_t val)
+{
 	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
 	    SM(R88E_LSSI_PARAM_ADDR, addr) | SM(R92C_LSSI_PARAM_DATA, val));
+}
 static void
 urtwn_r92e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
     uint32_t val)
+{
 	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
 	    SM(R88E_LSSI_PARAM_ADDR, addr) | SM(R92C_LSSI_PARAM_DATA, val));
+}
 static uint32_t
 urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
+{
 	uint32_t reg[R92C_MAX_CHAINS], val;
 	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
 	if (chain != 0) {
 		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
+	}
 	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
 	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
 	DELAY(1000);
 @@ -1174,27 +1236,28 @@ urtwn_efuse_switch_power(struct urtwn_so
 	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
 		urtwn_write_2(sc, R92C_SYS_CLKR,
 		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
+	}
+}
 static int
 urtwn_read_chipid(struct urtwn_softc *sc)
+{
 	uint32_t reg;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
-	if (ISSET(sc->chip, URTWN_CHIP_88E))
+	if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 	    ISSET(sc->chip, URTWN_CHIP_92EU))
 		return 0;
 	reg = urtwn_read_4(sc, R92C_SYS_CFG);
 	if (reg & R92C_SYS_CFG_TRP_VAUX_EN) {
 		/* test chip, not supported */
 		return EIO;
+	}
 	if (reg & R92C_SYS_CFG_TYPE_92C) {
 		sc->chip |= URTWN_CHIP_92C;
 		/* Check if it is a castrated 8192C. */
 		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
 		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
 		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R) {
 @@ -1339,27 +1402,27 @@ urtwn_r88e_read_rom(struct urtwn_softc *
 	uint16_t addr = 0;
 	uint8_t off, msk, tmp;
 	int i;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	mutex_enter(&sc->sc_write_mtx);
 	off = 0;
 	urtwn_efuse_switch_power(sc);
 	/* Read full ROM image. */
 	memset(&sc->r88e_rom, 0xff, sizeof(sc->r88e_rom));
-	while (addr < 1024) {
+	while (addr < 4096) {
 		reg = urtwn_efuse_read_1(sc, addr);
 		if (reg == 0xff)
 			break;
 		addr++;
 		if ((reg & 0x1f) == 0x0f) {
 			tmp = (reg & 0xe0) >> 5;
 			reg = urtwn_efuse_read_1(sc, addr);
 			if ((reg & 0x0f) != 0x0f)
 				off = ((reg & 0xf0) >> 1) | tmp;
 			addr++;
 		} else
 			off = reg >> 4;
 		msk = reg & 0xf;
 @@ -1382,28 +1445,33 @@ urtwn_r88e_read_rom(struct urtwn_softc *
 		sc->cck_tx_pwr[i] = sc->r88e_rom[addr++];
 	for (i = 0; i < 5; i++)
 		sc->ht40_tx_pwr[i] = sc->r88e_rom[addr++];
 	sc->bw20_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf0) >> 4;
 	if (sc->bw20_tx_pwr_diff & 0x08)
 		sc->bw20_tx_pwr_diff |= 0xf0;
 	sc->ofdm_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf);
 	if (sc->ofdm_tx_pwr_diff & 0x08)
 		sc->ofdm_tx_pwr_diff |= 0xf0;
 	sc->regulatory = MS(sc->r88e_rom[0xc1], R92C_ROM_RF1_REGULATORY);
 	IEEE80211_ADDR_COPY(ic->ic_myaddr, &sc->r88e_rom[0xd7]);
-	sc->sc_rf_write = urtwn_r88e_rf_write;
+	if (ISSET(sc->chip, URTWN_CHIP_92EU)) {
-	sc->sc_power_on = urtwn_r88e_power_on;
+		sc->sc_power_on = urtwn_r92e_power_on;
 		sc->sc_rf_write = urtwn_r92e_rf_write;
 	} else {
 		sc->sc_power_on = urtwn_r88e_power_on;
 		sc->sc_rf_write = urtwn_r88e_rf_write;
+	}
 	sc->sc_dma_init = urtwn_r88e_dma_init;
 	mutex_exit(&sc->sc_write_mtx);
+}
 static int
 urtwn_media_change(struct ifnet *ifp)
+{
 #ifdef URTWN_DEBUG
 	struct urtwn_softc *sc = ifp->if_softc;
 #endif
 	int error;
 @@ -1423,37 +1491,37 @@ urtwn_media_change(struct ifnet *ifp)
  * Initialize rate adaptation in firmware.
  */
 static int
 urtwn_ra_init(struct urtwn_softc *sc)
+{
 	static const uint8_t map[] = {
 , 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108
 	};
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ieee80211_node *ni = ic->ic_bss;
 	struct ieee80211_rateset *rs = &ni->ni_rates;
 	struct r92c_fw_cmd_macid_cfg cmd;
 	uint32_t rates, basicrates;
-	uint32_t mask;
+	uint32_t mask, rrsr_mask, rrsr_rate;
 	uint8_t mode;
 	size_t maxrate, maxbasicrate, i, j;
 	int error;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	/* Get normal and basic rates mask. */
-	rates = basicrates = 0;
+	rates = basicrates = 1;
 	maxrate = maxbasicrate = 0;
 	for (i = 0; i < rs->rs_nrates; i++) {
 		/* Convert 802.11 rate to HW rate index. */
 		for (j = 0; j < __arraycount(map); j++) {
 			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j]) {
 				break;
+			}
+		}
 		if (j == __arraycount(map)) {
 			/* Unknown rate, skip. */
 			continue;
+		}
 @@ -1468,65 +1536,80 @@ urtwn_ra_init(struct urtwn_softc *sc)
 				maxbasicrate = j;
+			}
+		}
+	}
 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
 		mode = R92C_RAID_11B;
 	} else {
 		mode = R92C_RAID_11BG;
+	}
 	DPRINTFN(DBG_INIT, ("%s: %s: mode=0x%x rates=0x%x, basicrates=0x%x, "
 	    "maxrate=%zx, maxbasicrate=%zx\n",
 	    device_xname(sc->sc_dev), __func__, mode, rates, basicrates,
 	    maxrate, maxbasicrate));
 	if (basicrates == 0) {
-		basicrates |= 1;	/* add 1Mbps */
+	if (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) {
 		maxbasicrate |= R92C_RATE_SHORTGI;
 		maxrate |= R92C_RATE_SHORTGI;
+	}
 	/* Set rates mask for group addressed frames. */
 	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
 	if (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)
 		cmd.macid |= URTWN_MACID_SHORTGI;
 	mask = (mode << 28) | basicrates;
 	cmd.mask[0] = (uint8_t)mask;
 	cmd.mask[1] = (uint8_t)(mask >> 8);
 	cmd.mask[2] = (uint8_t)(mask >> 16);
 	cmd.mask[3] = (uint8_t)(mask >> 24);
 	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
 	if (error != 0) {
 		aprint_error_dev(sc->sc_dev,
 		    "could not add broadcast station\n");
 		return error;
+	}
 	/* Set initial MRR rate. */
 	DPRINTFN(DBG_INIT, ("%s: %s: maxbasicrate=%zd\n",
 	    device_xname(sc->sc_dev), __func__, maxbasicrate));
 	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC), maxbasicrate);
 	/* Set rates mask for unicast frames. */
 	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
 	if (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)
 		cmd.macid |= URTWN_MACID_SHORTGI;
 	mask = (mode << 28) | rates;
 	cmd.mask[0] = (uint8_t)mask;
 	cmd.mask[1] = (uint8_t)(mask >> 8);
 	cmd.mask[2] = (uint8_t)(mask >> 16);
 	cmd.mask[3] = (uint8_t)(mask >> 24);
 	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
 	if (error != 0) {
 		aprint_error_dev(sc->sc_dev, "could not add BSS station\n");
 		return error;
+	}
 	/* Set initial MRR rate. */
 	DPRINTFN(DBG_INIT, ("%s: %s: maxrate=%zd\n", device_xname(sc->sc_dev),
 	    __func__, maxrate));
 	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS), maxrate);
 	rrsr_rate = ic->ic_fixed_rate;
 	if (rrsr_rate == -1)
 		rrsr_rate = 11;
 	rrsr_mask = 0xffff >> (15 - rrsr_rate);
 	urtwn_write_2(sc, R92C_RRSR, rrsr_mask);
 	/* Indicate highest supported rate. */
 	ni->ni_txrate = rs->rs_nrates - 1;
 	return 0;
+}
 static int
 urtwn_get_nettype(struct urtwn_softc *sc)
+{
 	struct ieee80211com *ic = &sc->sc_ic;
 	int type;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 @@ -1593,27 +1676,37 @@ urtwn_tsf_sync_enable(struct urtwn_softc
+}
 static void
 urtwn_set_led(struct urtwn_softc *sc, int led, int on)
+{
 	uint8_t reg;
 	DPRINTFN(DBG_FN, ("%s: %s: led=%d, on=%d\n", device_xname(sc->sc_dev),
 	    __func__, led, on));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	if (led == URTWN_LED_LINK) {
-		if (ISSET(sc->chip, URTWN_CHIP_88E)) {
+		if (ISSET(sc->chip, URTWN_CHIP_92EU)) {
 			urtwn_write_1(sc, 0x64, urtwn_read_1(sc, 0x64) & 0xfe);
 			reg = urtwn_read_1(sc, R92C_LEDCFG1) & R92E_LEDSON;
 			urtwn_write_1(sc, R92C_LEDCFG1, reg |
 			    (R92C_LEDCFG0_DIS << 1));
 			if (on) {
 				reg = urtwn_read_1(sc, R92C_LEDCFG1) &
 				    R92E_LEDSON;
 				urtwn_write_1(sc, R92C_LEDCFG1, reg);
+			}
 		} else if (ISSET(sc->chip, URTWN_CHIP_88E)) {
 			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
 			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
 			if (!on) {
 				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
 				urtwn_write_1(sc, R92C_LEDCFG2,
 				    reg | R92C_LEDCFG0_DIS);
 				reg = urtwn_read_1(sc, R92C_MAC_PINMUX_CFG);
 				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
 				    reg & 0xfe);
+			}
 		} else {
 			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
 			if (!on) {
 @@ -1634,41 +1727,51 @@ urtwn_calib_to(void *arg)
 	if (sc->sc_dying)
 		return;
 	/* Do it in a process context. */
 	urtwn_do_async(sc, urtwn_calib_to_cb, NULL, 0);
+}
 /* ARGSUSED */
 static void
 urtwn_calib_to_cb(struct urtwn_softc *sc, void *arg)
+{
 	struct r92c_fw_cmd_rssi cmd;
 	struct r92e_fw_cmd_rssi cmde;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN)
 		goto restart_timer;
 	mutex_enter(&sc->sc_write_mtx);
 	if (sc->avg_pwdb != -1) {
 		/* Indicate Rx signal strength to FW for rate adaptation. */
 		memset(&cmd, 0, sizeof(cmd));
 		memset(&cmde, 0, sizeof(cmde));
 		cmd.macid = 0;	/* BSS. */
 		cmde.macid = 0;	/* BSS. */
 		cmd.pwdb = sc->avg_pwdb;
 		cmde.pwdb = sc->avg_pwdb;
 		DPRINTFN(DBG_RF, ("%s: %s: sending RSSI command avg=%d\n",
 		    device_xname(sc->sc_dev), __func__, sc->avg_pwdb));
-		urtwn_fw_cmd(sc, R92C_CMD_RSSI_SETTING, &cmd, sizeof(cmd));
+		if (!ISSET(sc->chip, URTWN_CHIP_92EU)) {
 			urtwn_fw_cmd(sc, R92C_CMD_RSSI_SETTING, &cmd,
 			    sizeof(cmd));
 		} else {
 			urtwn_fw_cmd(sc, R92E_CMD_RSSI_REPORT, &cmde,
 			    sizeof(cmde));
+		}
+	}
 	/* Do temperature compensation. */
 	urtwn_temp_calib(sc);
 	mutex_exit(&sc->sc_write_mtx);
  restart_timer:
 	if (!sc->sc_dying) {
 		/* Restart calibration timer. */
 		callout_schedule(&sc->sc_calib_to, hz);
+	}
+}
 @@ -1853,40 +1956,32 @@ urtwn_newstate_cb(struct urtwn_softc *sc
 		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
 		urtwn_set_chan(sc, ic->ic_curchan,
 		    IEEE80211_HTINFO_2NDCHAN_NONE);
 		/* Start periodic scan. */
 		if (!sc->sc_dying)
 			callout_schedule(&sc->sc_scan_to, hz / 5);
 		break;
 	case IEEE80211_S_AUTH:
 		/* Set initial gain under link. */
 		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
 #ifdef doaslinux
 		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
 #else
 		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
 #endif
 		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
 		if (!ISSET(sc->chip, URTWN_CHIP_88E)) {
 			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
 #ifdef doaslinux
 			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
 #else
 			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
 #endif
 			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
+		}
 		/* Set media status to 'No Link'. */
 		urtwn_set_nettype0_msr(sc, R92C_CR_NETTYPE_NOLINK);
 		/* Allow Rx from any BSSID. */
 		urtwn_write_4(sc, R92C_RCR,
 		    urtwn_read_4(sc, R92C_RCR) &
 		      ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
 		urtwn_set_chan(sc, ic->ic_curchan,
 		    IEEE80211_HTINFO_2NDCHAN_NONE);
 @@ -1984,27 +2079,28 @@ urtwn_newstate_cb(struct urtwn_softc *sc
 			break;
+		}
 		urtwn_write_1(sc, R92C_MSR, msr);
 		sifs_time = 10;
 		urtwn_write_1(sc, R92C_SIFS_CCK + 1, sifs_time);
 		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, sifs_time);
 		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, sifs_time);
 		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, sifs_time);
 		urtwn_write_1(sc, R92C_R2T_SIFS + 1, sifs_time);
 		urtwn_write_1(sc, R92C_T2T_SIFS + 1, sifs_time);
 		/* Intialize rate adaptation. */
-		if (ISSET(sc->chip, URTWN_CHIP_88E))
+		if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 		    ISSET(sc->chip, URTWN_CHIP_92EU))
 			ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
 		else
 			urtwn_ra_init(sc);
 		/* Turn link LED on. */
 		urtwn_set_led(sc, URTWN_LED_LINK, 1);
 		/* Reset average RSSI. */
 		sc->avg_pwdb = -1;
 		/* Reset temperature calibration state machine. */
 		sc->thcal_state = 0;
 		sc->thcal_lctemp = 0;
 @@ -2242,27 +2338,27 @@ urtwn_rx_frame(struct urtwn_softc *sc, u
+	}
 	if (__predict_false(pktlen > MCLBYTES)) {
 		DPRINTFN(DBG_RX, ("%s: %s: packet too big %d\n",
 		    device_xname(sc->sc_dev), __func__, pktlen));
 		ifp->if_ierrors++;
 		return;
+	}
 	rate = MS(rxdw3, R92C_RXDW3_RATE);
 	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
 	/* Get RSSI from PHY status descriptor if present. */
 	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
-		if (ISSET(sc->chip, URTWN_CHIP_88E))
+		if (!ISSET(sc->chip, URTWN_CHIP_92C))
 			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
 		else
 			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
 		/* Update our average RSSI. */
 		urtwn_update_avgrssi(sc, rate, rssi);
+	}
 	DPRINTFN(DBG_RX, ("%s: %s: Rx frame len=%d rate=%d infosz=%d rssi=%d\n",
 	    device_xname(sc->sc_dev), __func__, pktlen, rate, infosz, rssi));
 	MGETHDR(m, M_DONTWAIT, MT_DATA);
 	if (__predict_false(m == NULL)) {
 		aprint_error_dev(sc->sc_dev, "couldn't allocate rx mbuf\n");
 @@ -2328,36 +2424,43 @@ urtwn_rx_frame(struct urtwn_softc *sc, u
 	/* Node is no longer needed. */
 	ieee80211_free_node(ni);
 	splx(s);
+}
 static void
 urtwn_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
+{
 	struct urtwn_rx_data *data = priv;
 	struct urtwn_softc *sc = data->sc;
 	struct r92c_rx_stat *stat;
 	size_t pidx = data->pidx;
 	uint32_t rxdw0;
 	uint8_t *buf;
 	int len, totlen, pktlen, infosz, npkts;
 	DPRINTFN(DBG_FN|DBG_RX, ("%s: %s: status=%d\n",
 	    device_xname(sc->sc_dev), __func__, status));
 	mutex_enter(&sc->sc_rx_mtx);
 	TAILQ_REMOVE(&sc->rx_free_list[pidx], data, next);
 	TAILQ_INSERT_TAIL(&sc->rx_free_list[pidx], data, next);
 	/* Put this Rx buffer back to our free list. */
 	mutex_exit(&sc->sc_rx_mtx);
 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
 		if (status == USBD_STALLED)
-			usbd_clear_endpoint_stall_async(sc->rx_pipe);
+			usbd_clear_endpoint_stall_async(sc->rx_pipe[pidx]);
 		else if (status != USBD_CANCELLED)
 			goto resubmit;
 		return;
+	}
 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
 	if (__predict_false(len < (int)sizeof(*stat))) {
 		DPRINTFN(DBG_RX, ("%s: %s: xfer too short %d\n",
 		    device_xname(sc->sc_dev), __func__, len));
 		goto resubmit;
+	}
 	buf = data->buf;
 @@ -2429,55 +2532,60 @@ urtwn_txeof(struct usbd_xfer *xfer, void
 	TAILQ_INSERT_TAIL(&sc->tx_free_list[pidx], data, next);
 	mutex_exit(&sc->sc_tx_mtx);
 	s = splnet();
 	sc->tx_timer = 0;
 	ifp->if_flags &= ~IFF_OACTIVE;
 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
 		if (status != USBD_NOT_STARTED && status != USBD_CANCELLED) {
 			if (status == USBD_STALLED) {
 				struct usbd_pipe *pipe = sc->tx_pipe[pidx];
 				usbd_clear_endpoint_stall_async(pipe);
+			}
 			printf("ERROR1\n");
 			ifp->if_oerrors++;
+		}
 		splx(s);
 		return;
+	}
 	ifp->if_opackets++;
 	urtwn_start(ifp);
 	splx(s);
+}
 static int
 urtwn_tx(struct urtwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
     struct urtwn_tx_data *data)
+{
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ieee80211_frame *wh;
 	struct ieee80211_key *k = NULL;
 	struct r92c_tx_desc *txd;
-	size_t i, padsize, xferlen;
+	size_t i, padsize, xferlen, txd_len;
 	uint16_t seq, sum;
 	uint8_t raid, type, tid;
 	int s, hasqos, error;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	wh = mtod(m, struct ieee80211_frame *);
 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 	txd_len = sizeof(*txd);
 	if (!ISSET(sc->chip, URTWN_CHIP_92EU))
 		txd_len = 32;
 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 		k = ieee80211_crypto_encap(ic, ni, m);
 		if (k == NULL)
 			return ENOBUFS;
 		/* packet header may have moved, reset our local pointer */
 		wh = mtod(m, struct ieee80211_frame *);
+	}
 	if (__predict_false(sc->sc_drvbpf != NULL)) {
 		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
 @@ -2492,74 +2600,84 @@ urtwn_tx(struct urtwn_softc *sc, struct
 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m);
+	}
 	/* non-qos data frames */
 	tid = R92C_TXDW1_QSEL_BE;
 	if ((hasqos = ieee80211_has_qos(wh))) {
 		/* data frames in 11n mode */
 		struct ieee80211_qosframe *qwh = (void *)wh;
 		tid = qwh->i_qos[0] & IEEE80211_QOS_TID;
 	} else if (type != IEEE80211_FC0_TYPE_DATA) {
 		tid = R92C_TXDW1_QSEL_MGNT;
+	}
-	if (((sizeof(*txd) + m->m_pkthdr.len) % 64) == 0) /* XXX: 64 */
+	if (((txd_len + m->m_pkthdr.len) % 64) == 0) /* XXX: 64 */
 		padsize = 8;
 	else
 		padsize = 0;
 	if (ISSET(sc->chip, URTWN_CHIP_92EU))
 		padsize = 0;
 	/* Fill Tx descriptor. */
 	txd = (struct r92c_tx_desc *)data->buf;
-	memset(txd, 0, sizeof(*txd) + padsize);
+	memset(txd, 0, txd_len + padsize);
 	txd->txdw0 |= htole32(
 	    SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len) |
-	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
+	    SM(R92C_TXDW0_OFFSET, txd_len));
-	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
+	if (!ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		txd->txdw0 |= htole32(
 		    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
+	}
 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
 		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
 	/* fix pad field */
 	if (padsize > 0) {
 		DPRINTFN(DBG_TX, ("%s: %s: padding: size=%zd\n",
 		    device_xname(sc->sc_dev), __func__, padsize));
 		txd->txdw1 |= htole32(SM(R92C_TXDW1_PKTOFF, (padsize / 8)));
+	}
 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
 	    type == IEEE80211_FC0_TYPE_DATA) {
 		if (ic->ic_curmode == IEEE80211_MODE_11B)
 			raid = R92C_RAID_11B;
 		else
 			raid = R92C_RAID_11BG;
 		DPRINTFN(DBG_TX,
 		    ("%s: %s: data packet: tid=%d, raid=%d\n",
 		    device_xname(sc->sc_dev), __func__, tid, raid));
-		if (ISSET(sc->chip, URTWN_CHIP_88E)) {
+		if (!ISSET(sc->chip, URTWN_CHIP_92C)) {
 			txd->txdw1 |= htole32(
 			    SM(R88E_TXDW1_MACID, URTWN_MACID_BSS) |
 			    SM(R92C_TXDW1_QSEL, tid) |
 			    SM(R92C_TXDW1_RAID, raid) |
 			    R92C_TXDW1_AGGBK);
 			txd->txdw2 |= htole32(R88E_TXDW2_AGGBK);
 		} else
 			txd->txdw1 |= htole32(
 			    SM(R92C_TXDW1_MACID, URTWN_MACID_BSS) |
 			    SM(R92C_TXDW1_QSEL, tid) |
 			    SM(R92C_TXDW1_RAID, raid) |
 			    R92C_TXDW1_AGGBK);
 		if (ISSET(sc->chip, URTWN_CHIP_88E))
 			txd->txdw2 |= htole32(R88E_TXDW2_AGGBK);
 		if (ISSET(sc->chip, URTWN_CHIP_92EU))
 			txd->txdw3 |= htole32(R92E_TXDW3_AGGBK);
 		if (hasqos) {
 			txd->txdw4 |= htole32(R92C_TXDW4_QOS);
+		}
 		if (ic->ic_flags & IEEE80211_F_USEPROT) {
 			/* for 11g */
 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
 				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
 				    R92C_TXDW4_HWRTSEN);
 			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
 				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
 				    R92C_TXDW4_HWRTSEN);
+			}
 @@ -2587,45 +2705,54 @@ urtwn_tx(struct urtwn_softc *sc, struct
 	} else {
 		/* broadcast or multicast packets */
 		DPRINTFN(DBG_TX, ("%s: %s: bc or mc packet\n",
 		    device_xname(sc->sc_dev), __func__));
 		txd->txdw1 |= htole32(
 		    SM(R92C_TXDW1_MACID, URTWN_MACID_BC) |
 		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
 		/* Force CCK1. */
 		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
 		/* Use 1Mbps */
 		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
+	}
 	/* Set sequence number */
 	seq = LE_READ_2(&wh->i_seq[0]) >> IEEE80211_SEQ_SEQ_SHIFT;
-	txd->txdseq |= htole16(seq);
+	if (!ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		txd->txdseq |= htole16(seq);
-	if (!hasqos) {
+		if (!hasqos) {
-		/* Use HW sequence numbering for non-QoS frames. */
+			/* Use HW sequence numbering for non-QoS frames. */
-		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
+			txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
-		txd->txdseq |= htole16(0x8000);		/* WTF? */
+			txd->txdseq |= htole16(R92C_HWSEQ_EN);
+		}
 	} else {
 		txd->txdseq2 |= htole16((seq & R92E_HWSEQ_MASK) <<
 		    R92E_HWSEQ_SHIFT);
 		if (!hasqos) {
 			/* Use HW sequence numbering for non-QoS frames. */
 			txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
 			txd->txdw7 |= htole16(R92C_HWSEQ_EN);
+		}
+	}
 	/* Compute Tx descriptor checksum. */
 	sum = 0;
-	for (i = 0; i < sizeof(*txd) / 2; i++)
+	for (i = 0; i < R92C_TXDESC_SUMSIZE / 2; i++)
 		sum ^= ((uint16_t *)txd)[i];
 	txd->txdsum = sum;	/* NB: already little endian. */
-	xferlen = sizeof(*txd) + m->m_pkthdr.len + padsize;
+	xferlen = txd_len + m->m_pkthdr.len + padsize;
-	m_copydata(m, 0, m->m_pkthdr.len, (char *)&txd[1] + padsize);
+	m_copydata(m, 0, m->m_pkthdr.len, (char *)&txd[0] + txd_len + padsize);
 	s = splnet();
 	usbd_setup_xfer(data->xfer, data, data->buf, xferlen,
 	    USBD_FORCE_SHORT_XFER, URTWN_TX_TIMEOUT,
 	    urtwn_txeof);
 	error = usbd_transfer(data->xfer);
 	if (__predict_false(error != USBD_NORMAL_COMPLETION &&
 	    error != USBD_IN_PROGRESS)) {
 		splx(s);
 		DPRINTFN(DBG_TX, ("%s: %s: transfer failed %d\n",
 		    device_xname(sc->sc_dev), __func__, error));
 		return error;
+	}
 @@ -2704,73 +2831,78 @@ urtwn_start(struct ifnet *ifp)
+		}
 		data = urtwn_get_tx_data(sc, sc->ac2idx[qid]);
 		if (data == NULL) {
 			ifp->if_flags |= IFF_OACTIVE;
 			DPRINTFN(DBG_TX, ("%s: empty tx_free_list\n",
 				    device_xname(sc->sc_dev)));
 			return;
+		}
 		IFQ_DEQUEUE(&ifp->if_snd, m);
 		if (m->m_len < (int)sizeof(*eh) &&
 		    (m = m_pullup(m, sizeof(*eh))) == NULL) {
 			printf("ERROR6\n");
 			ifp->if_oerrors++;
 			continue;
+		}
 		eh = mtod(m, struct ether_header *);
 		ni = ieee80211_find_txnode(ic, eh->ether_dhost);
 		if (ni == NULL) {
 			m_freem(m);
 			printf("ERROR5\n");
 			ifp->if_oerrors++;
 			continue;
+		}
 		bpf_mtap(ifp, m);
 		if ((m = ieee80211_encap(ic, m, ni)) == NULL) {
 			ieee80211_free_node(ni);
 			printf("ERROR4\n");
 			ifp->if_oerrors++;
 			continue;
+		}
  sendit:
 		bpf_mtap3(ic->ic_rawbpf, m);
 		if (urtwn_tx(sc, m, ni, data) != 0) {
 			m_freem(m);
 			ieee80211_free_node(ni);
 			printf("ERROR3\n");
 			ifp->if_oerrors++;
 			continue;
+		}
 		m_freem(m);
 		ieee80211_free_node(ni);
 		sc->tx_timer = 5;
 		ifp->if_timer = 1;
+	}
+}
 static void
 urtwn_watchdog(struct ifnet *ifp)
+{
 	struct urtwn_softc *sc = ifp->if_softc;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	ifp->if_timer = 0;
 	if (sc->tx_timer > 0) {
 		if (--sc->tx_timer == 0) {
 			aprint_error_dev(sc->sc_dev, "device timeout\n");
 			/* urtwn_init(ifp); XXX needs a process context! */
 			printf("ERROR2\n");
 			ifp->if_oerrors++;
 			return;
+		}
 		ifp->if_timer = 1;
+	}
 	ieee80211_watchdog(&sc->sc_ic);
+}
 static int
 urtwn_ioctl(struct ifnet *ifp, u_long cmd, void *data)
+{
 	struct urtwn_softc *sc = ifp->if_softc;
 	struct ieee80211com *ic = &sc->sc_ic;
 @@ -2848,46 +2980,46 @@ urtwn_r92c_power_on(struct urtwn_softc *
 			break;
 		DELAY(5);
+	}
 	if (ntries == 1000) {
 		aprint_error_dev(sc->sc_dev,
 		    "timeout waiting for chip autoload\n");
 		return ETIMEDOUT;
+	}
 	/* Unlock ISO/CLK/Power control register. */
 	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
 	/* Move SPS into PWM mode. */
 	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
-	DELAY(100);
+	DELAY(5);
 	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
 	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
 		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
 		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
 		DELAY(100);
 		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
 		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
 		    ~R92C_SYS_ISO_CTRL_MD2PP);
+	}
 	/* Auto enable WLAN. */
 	urtwn_write_2(sc, R92C_APS_FSMCO,
 	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
 	for (ntries = 0; ntries < 1000; ntries++) {
 		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
 		    R92C_APS_FSMCO_APFM_ONMAC))
 			break;
-		DELAY(5);
+		DELAY(100);
+	}
 	if (ntries == 1000) {
 		aprint_error_dev(sc->sc_dev,
 		    "timeout waiting for MAC auto ON\n");
 		return ETIMEDOUT;
+	}
 	/* Enable radio, GPIO and LED functions. */
 	KASSERT((R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_PDN_EN |
 	    R92C_APS_FSMCO_PFM_ALDN) == 0x0812);
 	urtwn_write_2(sc, R92C_APS_FSMCO,
 	    R92C_APS_FSMCO_AFSM_HSUS |
 	    R92C_APS_FSMCO_PDN_EN |
 @@ -2915,26 +3047,106 @@ urtwn_r92c_power_on(struct urtwn_softc *
 	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
 	reg = urtwn_read_2(sc, R92C_CR);
 	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
 	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
 	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
 	    R92C_CR_ENSEC;
 	urtwn_write_2(sc, R92C_CR, reg);
 	urtwn_write_1(sc, 0xfe10, 0x19);
 	return 0;
+}
 static int
 urtwn_r92e_power_on(struct urtwn_softc *sc)
+{
 	uint32_t reg;
 	uint32_t val;
 	int ntries;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	/* Enable radio, GPIO and LED functions. */
 	KASSERT((R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_PDN_EN |
 	    R92C_APS_FSMCO_PFM_ALDN) == 0x0812);
 	urtwn_write_2(sc, R92C_APS_FSMCO,
 	    R92C_APS_FSMCO_AFSM_HSUS |
 	    R92C_APS_FSMCO_PDN_EN |
 	    R92C_APS_FSMCO_PFM_ALDN);
 	if (urtwn_read_4(sc, R92E_SYS_CFG1_8192E) & R92E_SPSLDO_SEL){
 		/* LDO. */
 		urtwn_write_1(sc, R92E_LDO_SWR_CTRL, 0xc3);
+	}
 	else	{
 		urtwn_write_2(sc, R92C_SYS_SWR_CTRL2, urtwn_read_2(sc,
 		    R92C_SYS_SWR_CTRL2) & 0xffff);
 		urtwn_write_1(sc, R92E_LDO_SWR_CTRL, 0x83);
+	}
 	for (ntries = 0; ntries < 2; ntries++) {
 		urtwn_write_1(sc, R92C_AFE_PLL_CTRL,
 		    urtwn_read_1(sc, R92C_AFE_PLL_CTRL));
 		urtwn_write_2(sc, R92C_AFE_CTRL4, urtwn_read_2(sc,
 		    R92C_AFE_CTRL4));
+	}
 	/* Reset BB. */
 	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
 	urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
 	    R92C_SYS_FUNC_EN_BB_GLB_RST));
 	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2, urtwn_read_1(sc,
 	    R92C_AFE_XTAL_CTRL + 2) | 0x80);
 	/* Disable HWPDN. */
 	urtwn_write_2(sc, R92C_APS_FSMCO, urtwn_read_2(sc,
 	    R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
 	/* Disable WL suspend. */
 	urtwn_write_2(sc, R92C_APS_FSMCO, urtwn_read_2(sc,
 	    R92C_APS_FSMCO) & ~(R92C_APS_FSMCO_AFSM_PCIE |
 	    R92C_APS_FSMCO_AFSM_HSUS));
 	urtwn_write_4(sc, R92C_APS_FSMCO, urtwn_read_4(sc,
 	    R92C_APS_FSMCO) | R92C_APS_FSMCO_RDY_MACON);
 	urtwn_write_2(sc, R92C_APS_FSMCO, urtwn_read_2(sc,
 	    R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
 	for (ntries = 0; ntries < 10000; ntries++) {
 		val = urtwn_read_2(sc, R92C_APS_FSMCO) &
 		 R92C_APS_FSMCO_APFM_ONMAC;
 		if (val == 0x0)
 			break;
 		DELAY(10);
+	}
 	if (ntries == 10000) {
 		aprint_error_dev(sc->sc_dev,
 		    "timeout waiting for chip power up\n");
 		return ETIMEDOUT;
+	}
 	urtwn_write_2(sc, R92C_CR, 0x00);
 	reg = urtwn_read_2(sc, R92C_CR);
 	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
 	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
 	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC;
 	urtwn_write_2(sc, R92C_CR, reg);
 	return 0;
+}
 static int
 urtwn_r88e_power_on(struct urtwn_softc *sc)
+{
 	uint32_t reg;
 	uint8_t val;
 	int ntries;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	/* Wait for power ready bit. */
 	for (ntries = 0; ntries < 5000; ntries++) {
 		val = urtwn_read_1(sc, 0x6) & 0x2;
 @@ -2978,36 +3190,55 @@ urtwn_r88e_power_on(struct urtwn_softc *
 	reg = urtwn_read_2(sc, R92C_CR);
 	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
 	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
 	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
 	urtwn_write_2(sc, R92C_CR, reg);
 	return 0;
+}
 static int
 urtwn_llt_init(struct urtwn_softc *sc)
+{
 	size_t i, page_count, pktbuf_count;
 	uint32_t val;
 	int error;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
-	page_count = (sc->chip & URTWN_CHIP_88E) ?
+	if (sc->chip & URTWN_CHIP_88E)
-	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
+		page_count = R88E_TX_PAGE_COUNT;
-	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
+	else if (sc->chip & URTWN_CHIP_92EU)
-	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
+		page_count = R92E_TX_PAGE_COUNT;
 	else
 		page_count = R92C_TX_PAGE_COUNT;
 	if (sc->chip & URTWN_CHIP_88E)
 		pktbuf_count = R88E_TXPKTBUF_COUNT;
 	else if (sc->chip & URTWN_CHIP_92EU)
 		pktbuf_count = R88E_TXPKTBUF_COUNT;
 	else
 		pktbuf_count = R92C_TXPKTBUF_COUNT;
 	if (sc->chip & URTWN_CHIP_92EU) {
 		val = urtwn_read_4(sc, R92E_AUTO_LLT) | R92E_AUTO_LLT_EN;
 		urtwn_write_4(sc, R92E_AUTO_LLT, val);
 		DELAY(100);
 		val = urtwn_read_4(sc, R92E_AUTO_LLT);
 		if (val & R92E_AUTO_LLT_EN)
 			return EIO;
 		return 0;
+	}
 	/* Reserve pages [0; page_count]. */
 	for (i = 0; i < page_count; i++) {
 		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
 			return error;
+	}
 	/* NB: 0xff indicates end-of-list. */
 	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
 		return error;
 	/*
 	 * Use pages [page_count + 1; pktbuf_count - 1]
 	 * as ring buffer.
 	 */
 @@ -3044,29 +3275,45 @@ urtwn_fw_reset(struct urtwn_softc *sc)
 	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
 	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) & ~R92C_SYS_FUNC_EN_CPUEN);
+}
 static void
 urtwn_r88e_fw_reset(struct urtwn_softc *sc)
+{
 	uint16_t reg;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	if (ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		reg = urtwn_read_2(sc, R92C_RSV_CTRL) & ~R92E_RSV_MIO_EN;
 		urtwn_write_2(sc,R92C_RSV_CTRL, reg);
+	}
 	DELAY(50);
 	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
 	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
 	DELAY(50);
 	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
 	DELAY(50);
 	if (ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		reg = urtwn_read_2(sc, R92C_RSV_CTRL) | R92E_RSV_MIO_EN;
 		urtwn_write_2(sc,R92C_RSV_CTRL, reg);
+	}
 	DELAY(50);
+}
 static int
 urtwn_fw_loadpage(struct urtwn_softc *sc, int page, uint8_t *buf, int len)
+{
 	uint32_t reg;
 	int off, mlen, error = 0;
 	DPRINTFN(DBG_FN, ("%s: %s: page=%d, buf=%p, len=%d\n",
 	    device_xname(sc->sc_dev), __func__, page, buf, len));
 	reg = urtwn_read_4(sc, R92C_MCUFWDL);
 	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
 @@ -3098,26 +3345,28 @@ urtwn_load_firmware(struct urtwn_softc *
 	const char *name;
 	u_char *fw, *ptr;
 	size_t len;
 	uint32_t reg;
 	int mlen, ntries, page, error;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	/* Read firmware image from the filesystem. */
 	if (ISSET(sc->chip, URTWN_CHIP_88E))
 		name = "rtl8188eufw.bin";
 	else if (ISSET(sc->chip, URTWN_CHIP_92EU))
 		name = "rtl8192eefw.bin";
 	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
 	    URTWN_CHIP_UMC_A_CUT)
 		name = "rtl8192cfwU.bin";
 	else
 		name = "rtl8192cfw.bin";
 	if ((error = firmware_open("if_urtwn", name, &fwh)) != 0) {
 		aprint_error_dev(sc->sc_dev,
 		    "failed load firmware of file %s (error %d)\n", name,
 		    error);
 		return error;
+	}
 	const size_t fwlen = len = firmware_get_size(fwh);
 	fw = firmware_malloc(len);
 @@ -3126,63 +3375,67 @@ urtwn_load_firmware(struct urtwn_softc *
 		    "failed to allocate firmware memory\n");
 		firmware_close(fwh);
 		return ENOMEM;
+	}
 	error = firmware_read(fwh, 0, fw, len);
 	firmware_close(fwh);
 	if (error != 0) {
 		aprint_error_dev(sc->sc_dev,
 		    "failed to read firmware (error %d)\n", error);
 		firmware_free(fw, fwlen);
 		return error;
+	}
 	len = fwlen;
 	ptr = fw;
 	hdr = (const struct r92c_fw_hdr *)ptr;
 	/* Check if there is a valid FW header and skip it. */
 	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
 	    (le16toh(hdr->signature) >> 4) == 0x88e ||
 	    (le16toh(hdr->signature) >> 4) == 0x92e ||
 	    (le16toh(hdr->signature) >> 4) == 0x92c) {
 		DPRINTFN(DBG_INIT, ("%s: %s: FW V%d.%d %02d-%02d %02d:%02d\n",
 		    device_xname(sc->sc_dev), __func__,
 		    le16toh(hdr->version), le16toh(hdr->subversion),
 		    hdr->month, hdr->date, hdr->hour, hdr->minute));
 		ptr += sizeof(*hdr);
 		len -= sizeof(*hdr);
+	}
 	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
-		if (ISSET(sc->chip, URTWN_CHIP_88E))
+		if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 		    ISSET(sc->chip, URTWN_CHIP_92EU))
 			urtwn_r88e_fw_reset(sc);
 		else
 			urtwn_fw_reset(sc);
 		urtwn_write_1(sc, R92C_MCUFWDL, 0);
+	}
-	if (!ISSET(sc->chip, URTWN_CHIP_88E)) {
+	if (!ISSET(sc->chip, URTWN_CHIP_88E) &&
 	    !ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
 		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
 		    R92C_SYS_FUNC_EN_CPUEN);
+	}
 	/* download enabled */
 	urtwn_write_1(sc, R92C_MCUFWDL,
 	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
 	urtwn_write_1(sc, R92C_MCUFWDL + 2,
 	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
 	/* Reset the FWDL checksum. */
 	urtwn_write_1(sc, R92C_MCUFWDL,
-	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
+   	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
 	DELAY(50);
 	/* download firmware */
 	for (page = 0; len > 0; page++) {
 		mlen = MIN(len, R92C_FW_PAGE_SIZE);
 		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
 		if (error != 0) {
 			aprint_error_dev(sc->sc_dev,
 			    "could not load firmware page %d\n", page);
 			goto fail;
+		}
 		ptr += mlen;
 		len -= mlen;
+	}
 @@ -3198,27 +3451,28 @@ urtwn_load_firmware(struct urtwn_softc *
 		DELAY(5);
+	}
 	if (ntries == 1000) {
 		aprint_error_dev(sc->sc_dev,
 		    "timeout waiting for checksum report\n");
 		error = ETIMEDOUT;
 		goto fail;
+	}
 	/* Wait for firmware readiness. */
 	reg = urtwn_read_4(sc, R92C_MCUFWDL);
 	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
 	urtwn_write_4(sc, R92C_MCUFWDL, reg);
-	if (ISSET(sc->chip, URTWN_CHIP_88E))
+	if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 	    ISSET(sc->chip, URTWN_CHIP_92EU))
 		urtwn_r88e_fw_reset(sc);
 	for (ntries = 0; ntries < 1000; ntries++) {
 		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
 			break;
 		DELAY(5);
+	}
 	if (ntries == 1000) {
 		aprint_error_dev(sc->sc_dev,
 		    "timeout waiting for firmware readiness\n");
 		error = ETIMEDOUT;
 		goto fail;
+	}
  fail:
 @@ -3380,98 +3634,106 @@ static void
 urtwn_mac_init(struct urtwn_softc *sc)
+{
 	size_t i;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	/* Write MAC initialization values. */
 	if (ISSET(sc->chip, URTWN_CHIP_88E)) {
 		for (i = 0; i < __arraycount(rtl8188eu_mac); i++)
 			urtwn_write_1(sc, rtl8188eu_mac[i].reg,
 			    rtl8188eu_mac[i].val);
  	} else if (ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		for (i = 0; i < __arraycount(rtl8192eu_mac); i++)
 			urtwn_write_1(sc, rtl8192eu_mac[i].reg,
 			    rtl8192eu_mac[i].val);
 	} else {
 		for (i = 0; i < __arraycount(rtl8192cu_mac); i++)
 			urtwn_write_1(sc, rtl8192cu_mac[i].reg,
 			    rtl8192cu_mac[i].val);
+	}
+}
 static void
 urtwn_bb_init(struct urtwn_softc *sc)
+{
 	const struct urtwn_bb_prog *prog;
 	uint32_t reg;
 	uint8_t crystalcap;
 	size_t i;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	/* Enable BB and RF. */
 	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
 	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
 	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
 	    R92C_SYS_FUNC_EN_DIO_RF);
-	if (!ISSET(sc->chip, URTWN_CHIP_88E)) {
+	if (!ISSET(sc->chip, URTWN_CHIP_88E) &&
 	    !ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		urtwn_write_1(sc, R92C_AFE_PLL_CTRL, 0x83);
 		urtwn_write_1(sc, R92C_AFE_PLL_CTRL + 1, 0xdb);
+	}
 	urtwn_write_1(sc, R92C_RF_CTRL,
 	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
 	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
 	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
 	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
-	if (!ISSET(sc->chip, URTWN_CHIP_88E)) {
+	if (!ISSET(sc->chip, URTWN_CHIP_88E) &&
 	    !ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
 		urtwn_write_1(sc, 0x15, 0xe9);
 		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
+	}
 	/* Select BB programming based on board type. */
 	if (ISSET(sc->chip, URTWN_CHIP_88E))
 		prog = &rtl8188eu_bb_prog;
 	else if (ISSET(sc->chip, URTWN_CHIP_92EU))
 		prog = &rtl8192eu_bb_prog;
 	else if (!(sc->chip & URTWN_CHIP_92C)) {
 		if (sc->board_type == R92C_BOARD_TYPE_MINICARD) {
 			prog = &rtl8188ce_bb_prog;
 		} else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA) {
 			prog = &rtl8188ru_bb_prog;
 		} else {
 			prog = &rtl8188cu_bb_prog;
+		}
 	} else {
 		if (sc->board_type == R92C_BOARD_TYPE_MINICARD) {
 			prog = &rtl8192ce_bb_prog;
 		} else {
 			prog = &rtl8192cu_bb_prog;
+		}
+	}
 	/* Write BB initialization values. */
 	for (i = 0; i < prog->count; i++) {
 		/* additional delay depend on registers */
 		switch (prog->regs[i]) {
 		case 0xfe:
-			usbd_delay_ms(sc->sc_udev, 50);
+			urtwn_delay_ms(sc, 50);
 			break;
 		case 0xfd:
-			usbd_delay_ms(sc->sc_udev, 5);
+			urtwn_delay_ms(sc, 5);
 			break;
 		case 0xfc:
-			usbd_delay_ms(sc->sc_udev, 1);
+			urtwn_delay_ms(sc, 1);
 			break;
 		case 0xfb:
 			DELAY(50);
 			break;
 		case 0xfa:
 			DELAY(5);
 			break;
 		case 0xf9:
 			DELAY(1);
 			break;
+		}
 		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
 		DELAY(1);
 @@ -3512,32 +3774,38 @@ urtwn_bb_init(struct urtwn_softc *sc)
 		reg = (reg & ~0x0c000000) | (2 << 26);
 		urtwn_bb_write(sc, 0xe80, reg);
 		reg = urtwn_bb_read(sc, 0xe88);
 		reg = (reg & ~0x0c000000) | (2 << 26);
 		urtwn_bb_write(sc, 0xe88, reg);
+	}
 	/* Write AGC values. */
 	for (i = 0; i < prog->agccount; i++) {
 		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE, prog->agcvals[i]);
 		DELAY(1);
+	}
-	if (ISSET(sc->chip, URTWN_CHIP_88E)) {
+	if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 	    ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
 		DELAY(1);
 		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
 		DELAY(1);
 		if (ISSET(sc->chip, URTWN_CHIP_92EU)) {
 			urtwn_write_2(sc, R92C_AFE_CTRL3, urtwn_read_2(sc,
 			    R92C_AFE_CTRL3));
+		}
 		crystalcap = sc->r88e_rom[0xb9];
 		if (crystalcap == 0xff)
 			crystalcap = 0x20;
 		crystalcap &= 0x3f;
 		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
 		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
 		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
 		    crystalcap | crystalcap << 6));
 	} else {
 		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
 		    R92C_HSSI_PARAM2_CCK_HIPWR) {
 			SET(sc->sc_flags, URTWN_FLAG_CCK_HIPWR);
+		}
 @@ -3546,79 +3814,81 @@ urtwn_bb_init(struct urtwn_softc *sc)
 static void
 urtwn_rf_init(struct urtwn_softc *sc)
+{
 	const struct urtwn_rf_prog *prog;
 	uint32_t reg, mask, saved;
 	size_t i, j, idx;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	/* Select RF programming based on board type. */
 	if (ISSET(sc->chip, URTWN_CHIP_88E))
 		prog = rtl8188eu_rf_prog;
 	else if (ISSET(sc->chip, URTWN_CHIP_92EU))
 		prog = rtl8192eu_rf_prog;
 	else if (!(sc->chip & URTWN_CHIP_92C)) {
 		if (sc->board_type == R92C_BOARD_TYPE_MINICARD) {
 			prog = rtl8188ce_rf_prog;
 		} else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA) {
 			prog = rtl8188ru_rf_prog;
 		} else {
 			prog = rtl8188cu_rf_prog;
+		}
 	} else {
 		prog = rtl8192ce_rf_prog;
+	}
 	for (i = 0; i < sc->nrxchains; i++) {
 		/* Save RF_ENV control type. */
 		idx = i / 2;
 		mask = 0xffffU << ((i % 2) * 16);
 		saved = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx)) & mask;
 		/* Set RF_ENV enable. */
 		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
 		reg |= 0x100000;
 		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
-		DELAY(1);
+		DELAY(50);
 		/* Set RF_ENV output high. */
 		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
 		reg |= 0x10;
 		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
-		DELAY(1);
+		DELAY(50);
 		/* Set address and data lengths of RF registers. */
 		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
 		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
 		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
-		DELAY(1);
+		DELAY(50);
 		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
 		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
 		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
-		DELAY(1);
+		DELAY(50);
 		/* Write RF initialization values for this chain. */
 		for (j = 0; j < prog[i].count; j++) {
 			if (prog[i].regs[j] >= 0xf9 &&
 			    prog[i].regs[j] <= 0xfe) {
 				/*
 				 * These are fake RF registers offsets that
 				 * indicate a delay is required.
 				 */
-				usbd_delay_ms(sc->sc_udev, 50);
+				urtwn_delay_ms(sc, 50);
 				continue;
+			}
 			urtwn_rf_write(sc, i, prog[i].regs[j], prog[i].vals[j]);
-			DELAY(1);
+			DELAY(5);
+		}
 		/* Restore RF_ENV control type. */
 		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx)) & ~mask;
 		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg | saved);
+	}
 	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
 	    URTWN_CHIP_UMC_A_CUT) {
 		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
 		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
+	}
 @@ -3628,26 +3898,28 @@ urtwn_rf_init(struct urtwn_softc *sc)
+	}
+}
 static void
 urtwn_cam_init(struct urtwn_softc *sc)
+{
 	uint32_t content, command;
 	uint8_t idx;
 	size_t i;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	if (ISSET(sc->chip, URTWN_CHIP_92EU))
 		return;
 	for (idx = 0; idx < R92C_CAM_ENTRY_COUNT; idx++) {
 		content = (idx & 3)
 		    | (R92C_CAM_ALGO_AES << R92C_CAM_ALGO_S)
 		    | R92C_CAM_VALID;
 		command = R92C_CAMCMD_POLLING
 		    | R92C_CAMCMD_WRITE
 		    | R92C_CAM_CTL0(idx);
 		urtwn_write_4(sc, R92C_CAMWRITE, content);
 		urtwn_write_4(sc, R92C_CAMCMD, command);
+	}
 @@ -3998,27 +4270,28 @@ urtwn_r88e_get_txpower(struct urtwn_soft
+	}
+}
 static void
 urtwn_set_txpower(struct urtwn_softc *sc, u_int chan, u_int ht40m)
+{
 	uint16_t power[URTWN_RIDX_COUNT];
 	size_t i;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	for (i = 0; i < sc->ntxchains; i++) {
 		/* Compute per-rate Tx power values. */
-		if (ISSET(sc->chip, URTWN_CHIP_88E))
+		if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 		    ISSET(sc->chip, URTWN_CHIP_92EU))
 			urtwn_r88e_get_txpower(sc, i, chan, ht40m, power);
 		else
 			urtwn_get_txpower(sc, i, chan, ht40m, power);
 		/* Write per-rate Tx power values to hardware. */
 		urtwn_write_txpower(sc, i, power);
+	}
+}
 static void
 urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c, u_int ht40m)
+{
 	struct ieee80211com *ic = &sc->sc_ic;
 	u_int chan;
 @@ -4081,36 +4354,38 @@ urtwn_set_chan(struct urtwn_softc *sc, s
 		/* Select 40MHz bandwidth. */
 		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
 		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
 	} else {
 		urtwn_write_1(sc, R92C_BWOPMODE,
 		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
 		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
 		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
 		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
 		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
-		if (!ISSET(sc->chip, URTWN_CHIP_88E)) {
+		if (!ISSET(sc->chip, URTWN_CHIP_88E) &&
 		    !ISSET(sc->chip, URTWN_CHIP_92EU)) {
 			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
 			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
 			    R92C_FPGA0_ANAPARAM2_CBW20);
+		}
 		/* Select 20MHz bandwidth. */
 		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
 		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
-		    (ISSET(sc->chip, URTWN_CHIP_88E) ?
+		    (ISSET(sc->chip, URTWN_CHIP_88E) ||
 		     ISSET(sc->chip, URTWN_CHIP_92EU) ?
 		      R88E_RF_CHNLBW_BW20 : R92C_RF_CHNLBW_BW20));
+	}
+}
 static void
 urtwn_iq_calib(struct urtwn_softc *sc, bool inited)
+{
 	DPRINTFN(DBG_FN, ("%s: %s: inited=%d\n", device_xname(sc->sc_dev),
 	    __func__, inited));
 	uint32_t addaBackup[16], iqkBackup[4], piMode;
 @@ -4274,66 +4549,71 @@ urtwn_lc_calib(struct urtwn_softc *sc)
 			urtwn_rf_write(sc, i, R92C_RF_AC,
 			    RW(rf_ac[i], R92C_RF_AC_MODE,
 				R92C_RF_AC_MODE_STANDBY));
+		}
 	} else {
 		/* Block all Tx queues. */
 		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
+	}
 	/* Start calibration. */
 	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
 	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
 	/* Give calibration the time to complete. */
-	usbd_delay_ms(sc->sc_udev, 100);
+	urtwn_delay_ms(sc, 100);
 	/* Restore configuration. */
 	if ((txmode & 0x70) != 0) {
 		/* Restore Tx mode. */
 		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
 		/* Restore RF mode. */
 		for (i = 0; i < sc->nrxchains; i++) {
 			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
+		}
 	} else {
 		/* Unblock all Tx queues. */
 		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
+	}
+}
 static void
 urtwn_temp_calib(struct urtwn_softc *sc)
+{
-	int temp;
+	int temp, t_meter_reg;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	KASSERT(mutex_owned(&sc->sc_write_mtx));
 	if (!ISSET(sc->chip, URTWN_CHIP_92EU))
 		t_meter_reg = R92C_RF_T_METER;
 	else
 		t_meter_reg = R92E_RF_T_METER;
 	if (sc->thcal_state == 0) {
 		/* Start measuring temperature. */
 		DPRINTFN(DBG_RF, ("%s: %s: start measuring temperature\n",
 		    device_xname(sc->sc_dev), __func__));
-		urtwn_rf_write(sc, 0, R92C_RF_T_METER, 0x60);
+		urtwn_rf_write(sc, 0, t_meter_reg, 0x60);
 		sc->thcal_state = 1;
 		return;
+	}
 	sc->thcal_state = 0;
 	/* Read measured temperature. */
 	temp = urtwn_rf_read(sc, 0, R92C_RF_T_METER) & 0x1f;
 	DPRINTFN(DBG_RF, ("%s: %s: temperature=%d\n", device_xname(sc->sc_dev),
 	    __func__, temp));
-	if (temp == 0)	/* Read failed, skip. */
+	if (temp == 0)		/* Read failed, skip. */
 		return;
 	/*
 	 * Redo LC calibration if temperature changed significantly since
 	 * last calibration.
 	 */
 	if (sc->thcal_lctemp == 0) {
 		/* First LC calibration is performed in urtwn_init(). */
 		sc->thcal_lctemp = temp;
 	} else if (abs(temp - sc->thcal_lctemp) > 1) {
 		DPRINTFN(DBG_RF,
 		    ("%s: %s: LC calib triggered by temp: %d -> %d\n",
 		    device_xname(sc->sc_dev), __func__, sc->thcal_lctemp,
 @@ -4388,35 +4668,40 @@ urtwn_init(struct ifnet *ifp)
 	error = urtwn_power_on(sc);
 	if (error != 0)
 		goto fail;
 	/* Initialize DMA. */
 	error = urtwn_dma_init(sc);
 	if (error != 0)
 		goto fail;
 	/* Set info size in Rx descriptors (in 64-bit words). */
 	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
 	/* Init interrupts. */
-	if (ISSET(sc->chip, URTWN_CHIP_88E)) {
+	if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 	     ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		urtwn_write_4(sc, R88E_HISR, 0xffffffff);
 		urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
 		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
 		urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
 		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
-		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
+		if (ISSET(sc->chip, URTWN_CHIP_88E)) {
-		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
+			urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
-		      R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
+			    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
 			      R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
+		}
 		if (ISSET(sc->chip, URTWN_CHIP_92EU))
 			urtwn_write_1(sc, R92C_USB_HRPWM, 0);
 	} else {
 		urtwn_write_4(sc, R92C_HISR, 0xffffffff);
 		urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
+	}
 	/* Set MAC address. */
 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
 	urtwn_write_region(sc, R92C_MACID, ic->ic_myaddr, IEEE80211_ADDR_LEN);
 	/* Set initial network type. */
 	reg = urtwn_read_4(sc, R92C_CR);
 	switch (ic->ic_opmode) {
 	case IEEE80211_M_STA:
 @@ -4437,159 +4722,170 @@ urtwn_init(struct ifnet *ifp)
 	/* SIFS (used in NAV) */
 	urtwn_write_2(sc, R92C_SPEC_SIFS,
 	    SM(R92C_SPEC_SIFS_CCK, 0x10) | SM(R92C_SPEC_SIFS_OFDM, 0x10));
 	/* Set short/long retry limits. */
 	urtwn_write_2(sc, R92C_RL,
 	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
 	/* Initialize EDCA parameters. */
 	urtwn_edca_init(sc);
 	/* Setup rate fallback. */
-	if (!ISSET(sc->chip, URTWN_CHIP_88E)) {
+	if (!ISSET(sc->chip, URTWN_CHIP_88E) &&
 	    !ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
 		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
 		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
 		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
+	}
 	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
 	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
 	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
 	/* Set ACK timeout. */
 	urtwn_write_1(sc, R92C_ACKTO, 0x40);
 	/* Setup USB aggregation. */
 	/* Tx */
 	reg = urtwn_read_4(sc, R92C_TDECTRL);
 	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
 	urtwn_write_4(sc, R92C_TDECTRL, reg);
 	/* Rx */
 	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
 	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
 	      R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
 	urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
 	    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) &
 	      ~R92C_USB_SPECIAL_OPTION_AGG_EN);
 	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
-	if (ISSET(sc->chip, URTWN_CHIP_88E))
+	if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 	    ISSET(sc->chip, URTWN_CHIP_92EU))
 		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
 	else
 		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
 	/* Initialize beacon parameters. */
 	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
 	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
 	urtwn_write_1(sc, R92C_DRVERLYINT, R92C_DRIVER_EARLY_INT_TIME);
 	urtwn_write_1(sc, R92C_BCNDMATIM, R92C_DMA_ATIME_INT_TIME);
 	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
-	if (!ISSET(sc->chip, URTWN_CHIP_88E)) {
+	if (!ISSET(sc->chip, URTWN_CHIP_88E) &&
 	    !ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		/* Setup AMPDU aggregation. */
 		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
 		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
 		urtwn_write_2(sc, 0x4ca, 0x0708);
 		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
 		urtwn_write_1(sc, R92C_BCN_CTRL, R92C_BCN_CTRL_DIS_TSF_UDT0);
+	}
 	/* Load 8051 microcode. */
 	error = urtwn_load_firmware(sc);
 	if (error != 0)
 		goto fail;
 	SET(sc->sc_flags, URTWN_FLAG_FWREADY);
 	/* Initialize MAC/BB/RF blocks. */
 	/*
 	 * XXX: urtwn_mac_init() sets R92C_RCR[0:15] = R92C_RCR_APM |
 	 * R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_AICV | R92C_RCR_AMF.
 	 * XXX: This setting should be removed from rtl8192cu_mac[].
 	 */
 	urtwn_mac_init(sc);		// sets R92C_RCR[0:15]
 	urtwn_rxfilter_init(sc);	// reset R92C_RCR
 	urtwn_bb_init(sc);
 	urtwn_rf_init(sc);
-	if (ISSET(sc->chip, URTWN_CHIP_88E)) {
+	if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 	    ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		urtwn_write_2(sc, R92C_CR,
 		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
 		      R92C_CR_MACRXEN);
+	}
 	/* Turn CCK and OFDM blocks on. */
 	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
 	reg |= R92C_RFMOD_CCK_EN;
 	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
 	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
 	reg |= R92C_RFMOD_OFDM_EN;
 	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
 	/* Clear per-station keys table. */
 	urtwn_cam_init(sc);
 	/* Enable hardware sequence numbering. */
 	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
 	/* Perform LO and IQ calibrations. */
 	urtwn_iq_calib(sc, sc->iqk_inited);
 	sc->iqk_inited = true;
 	/* Perform LC calibration. */
 	urtwn_lc_calib(sc);
-	if (!ISSET(sc->chip, URTWN_CHIP_88E)) {
+	if (!ISSET(sc->chip, URTWN_CHIP_88E) &&
 	    !ISSET(sc->chip, URTWN_CHIP_92EU)) {
 		/* Fix USB interference issue. */
 		urtwn_write_1(sc, 0xfe40, 0xe0);
 		urtwn_write_1(sc, 0xfe41, 0x8d);
 		urtwn_write_1(sc, 0xfe42, 0x80);
 		urtwn_write_4(sc, 0x20c, 0xfd0320);
 		urtwn_pa_bias_init(sc);
+	}
-	if (!(sc->chip & (URTWN_CHIP_92C | URTWN_CHIP_92C_1T2R))) {
+	if (!(sc->chip & (URTWN_CHIP_92C | URTWN_CHIP_92C_1T2R)) ||
 	    !(sc->chip & URTWN_CHIP_92EU)) {
 		/* 1T1R */
 		urtwn_bb_write(sc, R92C_FPGA0_RFPARAM(0),
 		    urtwn_bb_read(sc, R92C_FPGA0_RFPARAM(0)) | __BIT(13));
+	}
 	/* Initialize GPIO setting. */
 	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
 	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
 	/* Fix for lower temperature. */
-	if (!ISSET(sc->chip, URTWN_CHIP_88E))
+	if (!ISSET(sc->chip, URTWN_CHIP_88E) &&
 	    !ISSET(sc->chip, URTWN_CHIP_92EU))
 		urtwn_write_1(sc, 0x15, 0xe9);
 	/* Set default channel. */
 	urtwn_set_chan(sc, ic->ic_curchan, IEEE80211_HTINFO_2NDCHAN_NONE);
 	/* Queue Rx xfers. */
-	for (i = 0; i < URTWN_RX_LIST_COUNT; i++) {
+	for (size_t j = 0; j < sc->rx_npipe; j++) {
-		data = &sc->rx_data[i];
+		for (i = 0; i < URTWN_RX_LIST_COUNT; i++) {
-		usbd_setup_xfer(data->xfer, data, data->buf, URTWN_RXBUFSZ,
+			data = &sc->rx_data[j][i];
-		    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtwn_rxeof);
+			usbd_setup_xfer(data->xfer, data, data->buf,
-		error = usbd_transfer(data->xfer);
+			    URTWN_RXBUFSZ, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT,
-		if (__predict_false(error != USBD_NORMAL_COMPLETION &&
+			    urtwn_rxeof);
-		    error != USBD_IN_PROGRESS))
+			error = usbd_transfer(data->xfer);
-			goto fail;
+			if (__predict_false(error != USBD_NORMAL_COMPLETION &&
 			    error != USBD_IN_PROGRESS))
 				goto fail;
+		}
+	}
 	/* We're ready to go. */
 	ifp->if_flags &= ~IFF_OACTIVE;
 	ifp->if_flags |= IFF_RUNNING;
 	sc->sc_running = true;
 	mutex_exit(&sc->sc_write_mtx);
 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 	else if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 	urtwn_wait_async(sc);
 	return 0;
  fail:
 	mutex_exit(&sc->sc_write_mtx);
 @@ -4611,64 +4907,71 @@ urtwn_stop(struct ifnet *ifp, int disabl
 	s = splusb();
 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
 	urtwn_wait_async(sc);
 	splx(s);
 	sc->tx_timer = 0;
 	ifp->if_timer = 0;
 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 	callout_stop(&sc->sc_scan_to);
 	callout_stop(&sc->sc_calib_to);
 	/* Abort Tx. */
-	for (i = 0; i < R92C_MAX_EPOUT; i++) {
+	for (i = 0; i < sc->tx_npipe; i++) {
 		if (sc->tx_pipe[i] != NULL)
 			usbd_abort_pipe(sc->tx_pipe[i]);
+	}
 	/* Stop Rx pipe. */
-	usbd_abort_pipe(sc->rx_pipe);
+	for (i = 0; i < sc->rx_npipe; i++) {
 		if (sc->rx_pipe[i] != NULL)
 			usbd_abort_pipe(sc->rx_pipe[i]);
+	}
 	/* Free Tx/Rx buffers. */
 	urtwn_free_tx_list(sc);
 	urtwn_free_rx_list(sc);
 	sc->sc_running = false;
 	if (disable)
 		urtwn_chip_stop(sc);
+}
 static int
 urtwn_reset(struct ifnet *ifp)
+{
 	struct urtwn_softc *sc = ifp->if_softc;
 	struct ieee80211com *ic = &sc->sc_ic;
 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
 		return ENETRESET;
 	urtwn_set_chan(sc, ic->ic_curchan, IEEE80211_HTINFO_2NDCHAN_NONE);
 	return 0;
+}
 static void
 urtwn_chip_stop(struct urtwn_softc *sc)
+{
 	uint32_t reg;
 	bool disabled = true;
 	DPRINTFN(DBG_FN, ("%s: %s\n", device_xname(sc->sc_dev), __func__));
 	if (ISSET(sc->chip, URTWN_CHIP_92EU))
 		return;
 	mutex_enter(&sc->sc_write_mtx);
 	/*
 	 * RF Off Sequence
 	 */
 	/* Pause MAC TX queue */
 	urtwn_write_1(sc, R92C_TXPAUSE, 0xFF);
 	/* Disable RF */
 	urtwn_rf_write(sc, 0, 0, 0);
 	urtwn_write_1(sc, R92C_APSD_CTRL, R92C_APSD_CTRL_OFF);
 @@ -4678,27 +4981,28 @@ urtwn_chip_stop(struct urtwn_softc *sc)
 	    R92C_SYS_FUNC_EN_USBA |
 	    R92C_SYS_FUNC_EN_BB_GLB_RST);
 	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
 	    R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA);
 	/*
 	 * Reset digital sequence
 	 */
 	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY) {
 		/* Reset MCU ready status */
 		urtwn_write_1(sc, R92C_MCUFWDL, 0);
 		/* If firmware in ram code, do reset */
 		if (ISSET(sc->sc_flags, URTWN_FLAG_FWREADY)) {
-			if (ISSET(sc->chip, URTWN_CHIP_88E))
+			if (ISSET(sc->chip, URTWN_CHIP_88E) ||
 			    ISSET(sc->chip, URTWN_CHIP_92EU))
 				urtwn_r88e_fw_reset(sc);
 			else
 				urtwn_fw_reset(sc);
 			CLR(sc->sc_flags, URTWN_FLAG_FWREADY);
+		}
+	}
 	/* Reset MAC and Enable 8051 */
 	urtwn_write_1(sc, R92C_SYS_FUNC_EN + 1, 0x54);
 	/* Reset MCU ready status */
 	urtwn_write_1(sc, R92C_MCUFWDL, 0);
 @@ -4759,26 +5063,35 @@ urtwn_chip_stop(struct urtwn_softc *sc)
 	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x23);
 	/* Set USB suspend */
 	urtwn_write_2(sc, R92C_APS_FSMCO,
 	    R92C_APS_FSMCO_APDM_HOST |
 	    R92C_APS_FSMCO_AFSM_HSUS |
 	    R92C_APS_FSMCO_PFM_ALDN);
 	urtwn_write_1(sc, R92C_RSV_CTRL, 0x0E);
 	mutex_exit(&sc->sc_write_mtx);
+}
 static void
 urtwn_delay_ms(struct urtwn_softc *sc, int ms)
+{
 	if (sc->sc_running == false)
 		DELAY(ms * 1000);
 	else
 		usbd_delay_ms(sc->sc_udev, ms);
+}
 MODULE(MODULE_CLASS_DRIVER, if_urtwn, "bpf");
 #ifdef _MODULE
 #include "ioconf.c"
 #endif
 static int
 if_urtwn_modcmd(modcmd_t cmd, void *aux)
+{
 	int error = 0;
 	switch (cmd) {
 	case MODULE_CMD_INIT:

 @@ -1,53 +1,54 @@
-.\" $NetBSD: urtwn.4,v 1.14 2014/07/25 15:07:03 nonaka Exp $
+.\" $NetBSD: urtwn.4,v 1.15 2016/10/12 03:23:29 nat Exp $
 .\" $OpenBSD: urtwn.4,v 1.15 2011/11/26 06:39:33 ckuethe Exp $
 .\"
 .\" Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
 .\"
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
 .\" copyright notice and this permission notice appear in all copies.
 .\"
 .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
 .Dd July 25, 2014
 .Dt URTWN 4
 .Os
 .Sh NAME
 .Nm urtwn
-.Nd Realtek RTL8188CU/RTL8188EU/RTL8192CU USB IEEE 802.11b/g/n wireless network device
+.Nd Realtek RTL8188CU/RTL8188EU/RTL8192CU/RTL8192EU USB IEEE 802.11b/g/n wireless network device
 .Sh SYNOPSIS
 .Cd "urtwn* at uhub? port ?"
 .Sh DESCRIPTION
 The
 .Nm
 driver supports USB 2.0 wireless network devices based on Realtek
-RTL8188CUS, RTL8188CE-VAU, RTL8188EUS, RTL8188RU, and RTL8192CU chipsets.
+RTL8188CUS, RTL8188CE-VAU, RTL8188EUS, RTL8188RU, RTL8192CU and RTL8192EU
 chipsets.
 .Pp
 The RTL8188CUS and RTL8188EUS are highly integrated 802.11n adapters that
 combine a MAC, a 1T1R capable baseband and an RF in a single chip.
 They operate in the 2GHz spectrum only.
 The RTL8188RU is a high-power variant of the RTL8188CUS.
 The RTL8188CE-VAU is a PCI Express Mini Card adapter that attaches
 to the USB interface.
 .Pp
-The RTL8192CU is a highly integrated multiple-in, multiple-out (MIMO)
+The RTL8192CU and RTL8192EU are highly integrated multiple-in, multiple-out
-.11n adapter that combines a MAC, a 2T2R capable baseband and an
+(MIMO) 802.11n adapters that combine a MAC, a 2T2R capable baseband and an
 RF in a single chip.
 It operates in the 2GHz spectrum only.
 .Pp
 These are the modes the
 .Nm
 driver can operate in:
 .Bl -tag -width "IBSS-masterXX"
 .It BSS mode
 Also known as
 .Em infrastructure
 mode, this is used when associating with an access point, through
 which all traffic passes.
 This mode is the default.
 @@ -86,26 +87,27 @@ The
 .Nm
 driver can be configured at runtime with
 .Xr ifconfig 8
 or on boot with
 .Xr ifconfig.if 5 .
 .Sh FILES
 The driver needs the following firmware files,
 which are loaded when an interface is attached:
 .Pp
 .Bl -tag -width Ds -offset indent -compact
 .It /libdata/firmware/if_urtwn/rtl8188eufw.bin
 .It /libdata/firmware/if_urtwn/rtl8192cfw.bin
 .It /libdata/firmware/if_urtwn/rtl8192cfwU.bin
 .It /libdata/firmware/if_urtwn/rtl8192efw.bin
 .El
 .Sh HARDWARE
 The following adapters should work:
 .Pp
 .Bl -tag -width Ds -offset indent -compact
 .It Airlink101 AWLL5088
 .It Aus. Linx AL-9604R1S
 .It ASUSTeK USB-N10 NANO
 .It B-Link BL-LW05-5R
 .It Belkin F7D1102 Surf Wireless Micro
 .It D-Link DWA-121
 .It D-Link DWA-133
 .It D-Link DWA-135

 @@ -1,14 +1,14 @@
-/*	$NetBSD: if_urtwnvar.h,v 1.9 2016/04/23 10:15:32 skrll Exp $	*/
+/*	$NetBSD: if_urtwnvar.h,v 1.10 2016/10/12 03:23:29 nat Exp $	*/
 /*	$OpenBSD: if_urtwnreg.h,v 1.3 2010/11/16 18:02:59 damien Exp $	*/
 /*-
  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 @@ -56,29 +56,31 @@ struct urtwn_tx_radiotap_header {
 	struct ieee80211_radiotap_header wt_ihdr;
 	uint8_t		wt_flags;
 	uint16_t	wt_chan_freq;
 	uint16_t	wt_chan_flags;
 } __packed;
 #define URTWN_TX_RADIOTAP_PRESENT			\
 	(1 << IEEE80211_RADIOTAP_FLAGS |		\
 << IEEE80211_RADIOTAP_CHANNEL)
 struct urtwn_softc;
 struct urtwn_rx_data {
-	struct urtwn_softc	*sc;
+	struct urtwn_softc		*sc;
-	struct usbd_xfer	*xfer;
+	size_t				pidx;
-	uint8_t			*buf;
+	struct usbd_xfer		*xfer;
 	uint8_t				*buf;
 	TAILQ_ENTRY(urtwn_rx_data)	next;
 };
 struct urtwn_tx_data {
 	struct urtwn_softc		*sc;
 	size_t				pidx;
 	struct usbd_xfer		*xfer;
 	uint8_t				*buf;
 	TAILQ_ENTRY(urtwn_tx_data)	next;
 };
 struct urtwn_host_cmd {
 	void	(*cb)(struct urtwn_softc *, void *);
 	uint8_t	data[256];
 @@ -119,77 +121,81 @@ struct urtwn_softc {
 	u_int				sc_flags;
 #define URTWN_FLAG_CCK_HIPWR	__BIT(0)
 #define	URTWN_FLAG_ATTACHED	__BIT(1)
 #define	URTWN_FLAG_FWREADY	__BIT(2)
 	int				sc_dying;
 	struct usb_task			sc_task;
 	callout_t			sc_scan_to;
 	callout_t			sc_calib_to;
 	kmutex_t			sc_task_mtx;
 	kmutex_t			sc_fwcmd_mtx;
 	kmutex_t			sc_tx_mtx;
 	kmutex_t			sc_rx_mtx;
 	kmutex_t			sc_write_mtx;
-	struct usbd_pipe *		rx_pipe;
+	struct usbd_pipe *		rx_pipe[R92C_MAX_EPIN];
 	int				rx_npipe;
 	struct usbd_pipe *		tx_pipe[R92C_MAX_EPOUT];
 	int				tx_npipe;
 	int				ac2idx[WME_NUM_AC];
 	u_int				chip;
 #define URTWN_CHIP_92C		0x01
 #define URTWN_CHIP_92C_1T2R	0x02
 #define URTWN_CHIP_UMC		0x04
 #define URTWN_CHIP_UMC_A_CUT	0x08
 #define URTWN_CHIP_88E		0x10
 #define URTWN_CHIP_92EU		0x20
 	void				(*sc_rf_write)(struct urtwn_softc *,
 					    int, uint8_t, uint32_t);
 	int				(*sc_power_on)(struct urtwn_softc *);
 	int				(*sc_dma_init)(struct urtwn_softc *);
 	uint8_t				board_type;
 	uint8_t				regulatory;
 	uint8_t				pa_setting;
 	int				avg_pwdb;
 	int				thcal_state;
 	int				thcal_lctemp;
 	size_t				ntxchains;
 	size_t				nrxchains;
 	int				ledlink;
 	bool				iqk_inited;
 	int				tx_timer;
 	struct urtwn_host_cmd_ring	cmdq;
 	int				fwcur;
-	struct urtwn_rx_data		rx_data[URTWN_RX_LIST_COUNT];
+	struct urtwn_rx_data		rx_data[R92C_MAX_EPIN][URTWN_RX_LIST_COUNT];
 	struct urtwn_tx_data		tx_data[R92C_MAX_EPOUT][URTWN_TX_LIST_COUNT];
 	TAILQ_HEAD(, urtwn_tx_data)	tx_free_list[R92C_MAX_EPOUT];
 	TAILQ_HEAD(, urtwn_rx_data)	rx_free_list[R92C_MAX_EPIN];
 	struct r92c_rom			rom;
-	uint8_t				r88e_rom[512];
+	uint8_t				r88e_rom[4096];
 	uint8_t				cck_tx_pwr[6];
 	uint8_t				ht40_tx_pwr[5];
 	int8_t				bw20_tx_pwr_diff;
 	int8_t				ofdm_tx_pwr_diff;
 	uint32_t			rf_chnlbw[R92C_MAX_CHAINS];
 	struct bpf_if *			sc_drvbpf;
 	union {
 		struct urtwn_rx_radiotap_header th;
 		uint8_t	pad[64];
 	}				sc_rxtapu;
 #define sc_rxtap	sc_rxtapu.th
 	int				sc_rxtap_len;
 	union {
 		struct urtwn_tx_radiotap_header th;
 		uint8_t	pad[64];
 	}				sc_txtapu;
 #define sc_txtap	sc_txtapu.th
 	int				sc_txtap_len;
 	bool				sc_running;
 };
 #endif /* _IF_URTWNVAR_H_ */

 @@ -1,39 +1,67 @@
-/*	$NetBSD: if_urtwn_data.h,v 1.3 2014/07/20 13:25:23 nonaka Exp $	*/
+/*	$NetBSD: if_urtwn_data.h,v 1.4 2016/10/12 03:23:29 nat Exp $	*/
 /*	$OpenBSD: if_urtwnreg.h,v 1.3 2010/11/16 18:02:59 damien Exp $	*/
 /*-
  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
  * Copyright (c) 2016 Nathanial Sloss <nathanialsloss@yahoo.com.au>
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 /*
  * MAC initialization values.
  */
 static const struct {
 	uint16_t	reg;
 	uint8_t		val;
-} rtl8188eu_mac[] = {
+} rtl8192eu_mac[]={
 	{ 0x011, 0xeb }, { 0x012, 0x07 }, { 0x014, 0x75 }, { 0x303, 0xa7 },
 	{ 0x428, 0x0a }, { 0x429, 0x10 }, { 0x430, 0x00 }, { 0x431, 0x00 },
 	{ 0x432, 0x00 }, { 0x433, 0x01 }, { 0x434, 0x04 }, { 0x435, 0x05 },
 	{ 0x436, 0x07 }, { 0x437, 0x08 }, { 0x43c, 0x04 }, { 0x43d, 0x05 },
 	{ 0x43e, 0x07 }, { 0x43f, 0x08 }, { 0x440, 0x5d }, { 0x441, 0x01 },
 	{ 0x442, 0x00 }, { 0x444, 0x10 }, { 0x445, 0x00 }, { 0x446, 0x00 },
 	{ 0x447, 0x00 }, { 0x448, 0x00 }, { 0x449, 0xf0 }, { 0x44a, 0x0f },
 	{ 0x44b, 0x3e }, { 0x44c, 0x10 }, { 0x44d, 0x00 }, { 0x44e, 0x00 },
 	{ 0x44f, 0x00 }, { 0x450, 0x00 }, { 0x451, 0xf0 }, { 0x452, 0x0f },
 	{ 0x453, 0x00 }, { 0x456, 0x5e }, { 0x460, 0x66 }, { 0x461, 0x66 },
 	{ 0x4c8, 0xff }, { 0x4c9, 0x08 }, { 0x4cc, 0xff }, { 0x4cd, 0xff },
 	{ 0x4ce, 0x01 }, { 0x500, 0x26 }, { 0x501, 0xa2 }, { 0x502, 0x2f },
 	{ 0x503, 0x00 }, { 0x504, 0x28 }, { 0x505, 0xa3 }, { 0x506, 0x5e },
 	{ 0x507, 0x00 }, { 0x508, 0x2b }, { 0x509, 0xa4 }, { 0x50a, 0x5e },
 	{ 0x50b, 0x00 }, { 0x50c, 0x4f }, { 0x50d, 0xa4 }, { 0x50e, 0x00 },
 	{ 0x50f, 0x00 }, { 0x512, 0x1c }, { 0x514, 0x0a }, { 0x516, 0x0a },
 	{ 0x525, 0x4f }, { 0x540, 0x12 }, { 0x541, 0x64 }, { 0x550, 0x10 },
 	{ 0x551, 0x10 }, { 0x559, 0x02 }, { 0x55c, 0x50 }, { 0x55d, 0xff },
 	{ 0x605, 0x30 }, { 0x608, 0x0e }, { 0x609, 0x2a }, { 0x620, 0xff },
 	{ 0x621, 0xff }, { 0x622, 0xff }, { 0x623, 0xff }, { 0x624, 0xff },
 	{ 0x625, 0xff }, { 0x626, 0xff }, { 0x627, 0xff }, { 0x638, 0x50 },
 	{ 0x63c, 0x0a }, { 0x63d, 0x0a }, { 0x63e, 0x0e }, { 0x63f, 0x0e },
 	{ 0x640, 0x40 }, { 0x642, 0x40 }, { 0x643, 0x00 }, { 0x652, 0xc8 },
 	{ 0x66e, 0x05 }, { 0x700, 0x21 }, { 0x701, 0x43 }, { 0x702, 0x65 },
 	{ 0x703, 0x87 }, { 0x708, 0x21 }, { 0x709, 0x43 }, { 0x70a, 0x65 },
 	{ 0x70b, 0x87 },
 }, rtl8188eu_mac[] = {
 	{ 0x026, 0x41 }, { 0x027, 0x35 }, { 0x040, 0x00 }, { 0x428, 0x0a },
 	{ 0x429, 0x10 }, { 0x430, 0x00 }, { 0x431, 0x01 }, { 0x432, 0x02 },
 	{ 0x433, 0x04 }, { 0x434, 0x05 }, { 0x435, 0x06 }, { 0x436, 0x07 },
 	{ 0x437, 0x08 }, { 0x438, 0x00 }, { 0x439, 0x00 }, { 0x43a, 0x01 },
 	{ 0x43b, 0x02 }, { 0x43c, 0x04 }, { 0x43d, 0x05 }, { 0x43e, 0x06 },
 	{ 0x43f, 0x07 }, { 0x440, 0x5d }, { 0x441, 0x01 }, { 0x442, 0x00 },
 	{ 0x444, 0x15 }, { 0x445, 0xf0 }, { 0x446, 0x0f }, { 0x447, 0x00 },
 	{ 0x458, 0x41 }, { 0x459, 0xa8 }, { 0x45a, 0x72 }, { 0x45b, 0xb9 },
 	{ 0x460, 0x66 }, { 0x461, 0x66 }, { 0x480, 0x08 }, { 0x4c8, 0xff },
 	{ 0x4c9, 0x08 }, { 0x4cc, 0xff }, { 0x4cd, 0xff }, { 0x4ce, 0x01 },
 	{ 0x4d3, 0x01 }, { 0x500, 0x26 }, { 0x501, 0xa2 }, { 0x502, 0x2f },
 	{ 0x503, 0x00 }, { 0x504, 0x28 }, { 0x505, 0xa3 }, { 0x506, 0x5e },
 	{ 0x507, 0x00 }, { 0x508, 0x2b }, { 0x509, 0xa4 }, { 0x50a, 0x5e },
 @@ -482,26 +510,140 @@ static const uint32_t rtl8188eu_agc_vals
 x43780001, 0x42790001, 0x417a0001, 0x407b0001, 0x407c0001,
 x407d0001, 0x407e0001, 0x407f0001
 };
 static const struct urtwn_bb_prog rtl8188eu_bb_prog = {
 	__arraycount(rtl8188eu_bb_regs),
 	rtl8188eu_bb_regs,
 	rtl8188eu_bb_vals,
 	__arraycount(rtl8188eu_agc_vals),
 	rtl8188eu_agc_vals
 };
 /*
  * RTL819E.
  */
 static const uint16_t rtl8192eu_bb_regs[] = {
 x800, 0x804, 0x808, 0x80c, 0x810, 0x814, 0x818, 0x81c,
 x820, 0x824, 0x828, 0x82c, 0x830, 0x834, 0x838, 0x83c,
 x840, 0x844, 0x848, 0x84c, 0x850, 0x854, 0x858, 0x85c,
 x860, 0x864, 0x868, 0x86c, 0x870, 0x874, 0x878, 0x87c,
 x880, 0x884, 0x888, 0x88c, 0x890, 0x894, 0x898, 0x900,
 x904, 0x908, 0x90c, 0x910, 0x914, 0x918, 0x91c, 0x924,
 x928, 0x92c, 0x930, 0x934, 0x938, 0x93c, 0x940, 0x944,
 x94c, 0xa00, 0xa04, 0xa08, 0xa0c, 0xa10, 0xa14, 0xa18,
 xa1c, 0xa20, 0xa24, 0xa28, 0xa2c, 0xa70, 0xa74, 0xa78,
 xa7c, 0xa80, 0xb38, 0xc00, 0xc04, 0xc08, 0xc0c, 0xc10,
 xc14, 0xc18, 0xc1c, 0xc20, 0xc24, 0xc28, 0xc2c, 0xc30,
 xc34, 0xc38, 0xc3c, 0xc40, 0xc44, 0xc48, 0xc4c, 0xc50,
 xc54, 0xc58, 0xc5c, 0xc60, 0xc64, 0xc68, 0xc6c, 0xc70,
 xc74, 0xc78, 0xc7c, 0xc80, 0xc84, 0xc88, 0xc8c, 0xc90,
 xc94, 0xc98, 0xc9c, 0xca0, 0xca4, 0xca8, 0xcac, 0xcb0,
 xcb4, 0xcb8, 0xcbc, 0xcc0, 0xcc4, 0xcc8, 0xccc, 0xcd0,
 xcd4, 0xcd8, 0xcdc, 0xce0, 0xce4, 0xce8, 0xcec, 0xd00,
 xd04, 0xd08, 0xd0c, 0xd10, 0xd14, 0xd18, 0xd1c, 0xd2c,
 xd30, 0xd34, 0xd38, 0xd3c, 0xd40, 0xd44, 0xd48, 0xd4c,
 xd50, 0xd54, 0xd58, 0xd5c, 0xd60, 0xd64, 0xd68, 0xd6c,
 xd70, 0xd74, 0xd78, 0xd80, 0xd84, 0xd88, 0xe00, 0xe04,
 xe08, 0xe10, 0xe14, 0xe18, 0xe1c, 0xe28, 0xe30, 0xe34,
 xe38, 0xe3c, 0xe40, 0xe44, 0xe48, 0xe4c, 0xe50, 0xe54,
 xe58, 0xe5c, 0xe60, 0xe68, 0xe6c, 0xe70, 0xe74, 0xe78,
 xe7c, 0xe80, 0xe84, 0xe88, 0xe8c, 0xed0, 0xed4, 0xed8,
 xedc, 0xee0, 0xeec, 0xee4, 0xee8, 0xf14, 0xf4c, 0xf00,
 };
 static const uint32_t rtl8192eu_bb_vals[] = {
 x80040000, 0x00000003, 0x0000fc00, 0x0000000a, 0x10001331,
 x020c3d10, 0x02220385, 0x00000000, 0x01000100, 0x00390204,
 x01000100, 0x00390204, 0x32323232, 0x30303030, 0x30303030,
 x30303030, 0x00010000, 0x00010000, 0x28282828, 0x28282828,
 x00000000, 0x00000000, 0x009a009a, 0x01000014, 0x66f60000,
 x061f0000, 0x30303030, 0x30303030, 0x00000000, 0x55004200,
 x08080808, 0x00000000, 0xb0000c1c, 0x00000001, 0x00000000,
 xcc0000c0, 0x00000800, 0xfffffffe, 0x40302010, 0x00000000,
 x00000023, 0x00000000, 0x81121313, 0x806c0001, 0x00000001,
 x00000000, 0x00010000, 0x00000001, 0x00000000, 0x00000000,
 x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
 x00000000, 0x00000008, 0x00d0c7c8, 0x81ff000c, 0x8c838300,
 x2e68120f, 0x95009b78, 0x1114d028, 0x00881117, 0x89140f00,
 x1a1b0000, 0x090e1317, 0x00000204, 0x00d30000, 0x101fff00,
 x00000007, 0x00000900, 0x225b0606, 0x218075b1, 0x00000000,
 x48071d40, 0x03a05633, 0x000000e4, 0x6c6c6c6c, 0x08800000,
 x40000100, 0x08800000, 0x40000100, 0x00000000, 0x00000000,
 x00000000, 0x00000000, 0x69e9ac47, 0x469652af, 0x49795994,
 x0a97971c, 0x1f7c403f, 0x000100b7, 0xec020107, 0x007f037f,
 x00340020, 0x0080801f, 0x00000020, 0x00248492, 0x00000000,
 x7112848b, 0x47c00bff, 0x00000036, 0x00000600, 0x02013169,
 x0000001f, 0x00b91612, 0x40000100, 0x21f60000, 0x40000100,
 xa0e40000, 0x00121820, 0x00000000, 0x00121820, 0x00007f7f,
 x00000000, 0x000300a0, 0x00000000, 0x00000000, 0x00000000,
 x00000000, 0x00000000, 0x28000000, 0x00000000, 0x00000000,
 x00000000, 0x00000000, 0x00000000, 0x00000000, 0x64b22427,
 x00766932, 0x00222222, 0x00040000, 0x77644302, 0x2f97d40c,
 x00080740, 0x00020403, 0x0000907f, 0x20010201, 0xa0633333,
 x3333bc43, 0x7a8f5b6b, 0x0000007f, 0xcc979975, 0x00000000,
 x80608000, 0x00000000, 0x00127353, 0x00000000, 0x00000000,
 x00000000, 0x00000000, 0x6437140a, 0x00000000, 0x00000282,
 x30032064, 0x4653de68, 0x04518a3c, 0x00002101, 0x2a201c16,
 x1812362e, 0x322c2220, 0x000e3c24, 0x01081008, 0x00000800,
 xf0b50000, 0x30303030, 0x30303030, 0x03903030, 0x30303030,
 x30303030, 0x30303030, 0x30303030, 0x00000000, 0x1000dc1f,
 x10008c1f, 0x02140102, 0x681604c2, 0x01007c00, 0x01004800,
 xfb000000, 0x000028d1, 0x1000dc1f, 0x10008c1f, 0x02140102,
 x28160d05, 0x00000008, 0x0fc05656, 0x03c09696, 0x03c09696,
 x0c005656, 0x0c005656, 0x0c005656, 0x0c005656, 0x03c09696,
 x0c005656, 0x03c09696, 0x03c09696, 0x03c09696, 0x03c09696,
 x0000d6d6, 0x0000d6d6, 0x0fc01616, 0xb0000c1c, 0x00000001,
 x00000003, 0x00000000, 0x00000300,
 };
 static const uint32_t rtl8192eu_agc_vals[] = {
 xfb000001, 0xfb010001, 0xfb020001, 0xfb030001, 0xfb040001,
 xfb050001, 0xfa060001, 0xf9070001, 0xf8080001, 0xf7090001,
 xf60a0001, 0xf50b0001, 0xf40c0001, 0xf30d0001, 0xf20e0001,
 xf10f0001, 0xf0100001, 0xef110001, 0xee120001, 0xed130001,
 xec140001, 0xeb150001, 0xea160001, 0xe9170001, 0xe8180001,
 xe7190001, 0xc81a0001, 0xc71b0001, 0xc61c0001, 0x071d0001,
 x061e0001, 0x051f0001, 0x04200001, 0x03210001, 0xaa220001,
 xa9230001, 0xa8240001, 0xa7250001, 0xa6260001, 0x85270001,
 x84280001, 0x83290001, 0x252a0001, 0x242b0001, 0x232c0001,
 x222d0001, 0x672e0001, 0x662f0001, 0x65300001, 0x64310001,
 x63320001, 0x62330001, 0x61340001, 0x45350001, 0x44360001,
 x43370001, 0x42380001, 0x41390001, 0x403a0001, 0x403b0001,
 x403c0001, 0x403d0001, 0x403e0001, 0x403f0001, 0xfb400001,
 xfb410001, 0xfb420001, 0xfb430001, 0xfb440001, 0xfb450001,
 xfa460001, 0xf9470001, 0xf8480001, 0xf7490001, 0xf64a0001,
 xf54b0001, 0xf44c0001, 0xf34d0001, 0xf24e0001, 0xf14f0001,
 xf0500001, 0xef510001, 0xee520001, 0xed530001, 0xec540001,
 xeb550001, 0xea560001, 0xe9570001, 0xe8580001, 0xe7590001,
 xe65a0001, 0xe55b0001, 0xe45c0001, 0xe35d0001, 0xe25e0001,
 xe15f0001, 0x8a600001, 0x89610001, 0x88620001, 0x87630001,
 x86640001, 0x85650001, 0x84660001, 0x83670001, 0x82680001,
 x6b690001, 0x6a6a0001, 0x696b0001, 0x686c0001, 0x676d0001,
 x666e0001, 0x656f0001, 0x64700001, 0x63710001, 0x62720001,
 x61730001, 0x49740001, 0x48750001, 0x47760001, 0x46770001,
 x45780001, 0x44790001, 0x437a0001, 0x427b0001, 0x417c0001,
 x407d0001, 0x407e0001, 0x407f0001,
 };
 static const struct urtwn_bb_prog rtl8192eu_bb_prog = {
 	__arraycount(rtl8192eu_bb_regs),
 	rtl8192eu_bb_regs,
 	rtl8192eu_bb_vals,
 	__arraycount(rtl8192eu_agc_vals),
 	rtl8192eu_agc_vals
 };
 /*
  * RTL8188RU.
  */
 static const uint16_t rtl8188ru_bb_regs[] = {
 x024, 0x028, 0x040, 0x800, 0x804, 0x808, 0x80c, 0x810, 0x814,
 x818, 0x81c, 0x820, 0x824, 0x828, 0x82c, 0x830, 0x834, 0x838,
 x83c, 0x840, 0x844, 0x848, 0x84c, 0x850, 0x854, 0x858, 0x85c,
 x860, 0x864, 0x868, 0x86c, 0x870, 0x874, 0x878, 0x87c, 0x880,
 x884, 0x888, 0x88c, 0x890, 0x894, 0x898, 0x89c, 0x900, 0x904,
 x908, 0x90c, 0xa00, 0xa04, 0xa08, 0xa0c, 0xa10, 0xa14, 0xa18,
 xa1c, 0xa20, 0xa24, 0xa28, 0xa2c, 0xa70, 0xa74, 0xc00, 0xc04,
 xc08, 0xc0c, 0xc10, 0xc14, 0xc18, 0xc1c, 0xc20, 0xc24, 0xc28,
 xc2c, 0xc30, 0xc34, 0xc38, 0xc3c, 0xc40, 0xc44, 0xc48, 0xc4c,
 xc50, 0xc54, 0xc58, 0xc5c, 0xc60, 0xc64, 0xc68, 0xc6c, 0xc70,
 @@ -745,26 +887,103 @@ static const uint32_t rtl8188cu_rf_vals[
 x00000, 0x00000, 0x80003, 0x00000, 0x00000, 0x44457, 0x80000,
 x30159
 };
 static const struct urtwn_rf_prog rtl8188cu_rf_prog[] = {
+	{
 		__arraycount(rtl8192ce_rf1_regs),
 		rtl8192ce_rf1_regs,
 		rtl8188cu_rf_vals
+	}
 };
 /*
  * RTL8192EU.
  */
 static const uint8_t rtl8192eu_rf_regs[] = {
 x7f, 0x81, 0x00, 0x08, 0x18, 0x19, 0x1b, 0x1e, 0x1f, 0x2f,
 x3f, 0x42, 0x57, 0x58, 0x67, 0x83, 0xb0, 0xb1, 0xb2, 0xb4,
 xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xbb, 0xbf, 0xc2, 0xc3,
 xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9, 0xca, 0xdf, 0xef, 0x51,
 x52, 0x53, 0x56, 0x35, 0x35, 0x35, 0x36, 0x36, 0x36, 0x36,
 x18, 0x5a, 0x19, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34,
 x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34,
 x34, 0x34, 0x34, 0x34, 0x34, 0x00, 0x84, 0x86, 0x87, 0x8e,
 x8f, 0xef, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b,
 x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b,
 xef, 0xfe, 0x18, 0xfe, 0xfe, 0xfe, 0xfe, 0x1e, 0x1f, 0x00,
 };
 static const uint32_t rtl8192eu_rf_vals[] = {
 x00082, 0x3fc00, 0x30000, 0x08400, 0x00407, 0x00012, 0x00064,
 x80009, 0x00880, 0x1a060, 0x00000, 0x060c0, 0xd0000, 0xbe180,
 x01552, 0x00000, 0xff9f1, 0x55418, 0x8cc00, 0x43083, 0x08166,
 x0803e, 0x1c69f, 0x0407f, 0x80001, 0x40001, 0x00400, 0xc0000,
 x02400, 0x00009, 0x40c91, 0x99999, 0x000a3, 0x88820, 0x76c06,
 x00000, 0x80000, 0x00180, 0x001a0, 0x69545, 0x7e45e, 0x00071,
 x51ff3, 0x000a8, 0x001e2, 0x002a8, 0x01c24, 0x09c24, 0x11c24,
 x19c24, 0x00c07, 0x48000, 0x739d0, 0x0a093, 0x0908f, 0x0808c,
 x0704d, 0x0604a, 0x05047, 0x0400a, 0x03007, 0x02004, 0x01001,
 x00000, 0x0add7, 0x09dd4, 0x08dd1, 0x07dce, 0x06dcb, 0x05dc8,
 x04dc5, 0x034cc, 0x0244f, 0x0144c, 0x00014, 0x30159, 0x68180,
 x0014e, 0x48e00, 0x65540, 0x88000, 0x020a0, 0xf07b0, 0xf02b0,
 xef7b0, 0xd4fb0, 0xcf060, 0xb0090, 0xa0080, 0x90080, 0x8f780,
 x787b0, 0x78730, 0x60fb0, 0x5ffa0, 0x40620, 0x37090, 0x20080,
 x1f060, 0x0ffb0, 0x000a0, 0x00000, 0x0fc07, 0x00000, 0x00000,
 x00000, 0x00000, 0x00001, 0x80000, 0x33e70,
 };
 static const uint8_t rtl8192eu_rf2_regs[] = {
 x7f, 0x81, 0x00, 0x08, 0x18, 0x19, 0x1b, 0x1e, 0x1f, 0x2f,
 x3f, 0x42, 0x57, 0x58, 0x67, 0x7f, 0x81, 0x83, 0xdf, 0xef,
 x51, 0x52, 0x53, 0x56, 0x35, 0x35, 0x35, 0x36, 0x36, 0x36,
 x36, 0x18, 0x5a, 0x19, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34,
 x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34,
 x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x00, 0x84, 0x86, 0x87,
 x8e, 0x8f, 0xef, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b,
 x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b,
 x3b, 0xef, 0x00, 0xfe, 0xfe, 0xfe, 0xfe, 0x1e, 0x1f, 0x00,
 };
 static const uint32_t rtl8192eu_rf2_vals[] = {
 x00082, 0x3fc00, 0x30000, 0x08400, 0x00407, 0x00012, 0x00064,
 x80009, 0x00880, 0x1a060, 0x00000, 0x060c0, 0xd0000, 0xbe180,
 x01552, 0x00082, 0x3f000, 0x00000, 0x00180, 0x001a0, 0x69545,
 x7e42e, 0x00071, 0x51ff3, 0x000a8, 0x001e0, 0x002a8, 0x01ca8,
 x09c24, 0x11c24, 0x19c24, 0x00c07, 0x48000, 0x739d0, 0x0a093,
 x0908f, 0x0808c, 0x0704d, 0x0604a, 0x05047, 0x0400a, 0x03007,
 x02004, 0x01001, 0x00000, 0x0add7, 0x09dd4, 0x08dd1, 0x07dce,
 x06dcb, 0x05dc8, 0x04dc5, 0x034cc, 0x0244f, 0x0144c, 0x00014,
 x30159, 0x68180, 0x000ce, 0x48a00, 0x65540, 0x88000, 0x020a0,
 xf07b0, 0xf02b0, 0xef7b0, 0xd4fb0, 0xcf060, 0xb0090, 0xa0080,
 x90080, 0x8f780, 0x787b0, 0x78730, 0x60fb0, 0x5ffa0, 0x40620,
 x37090, 0x20080, 0x1f060, 0x0ffb0, 0x000a0, 0x10159, 0x00000,
 x00000, 0x00000, 0x00000, 0x00001, 0x80000, 0x33e70,
 };
 static const struct urtwn_rf_prog rtl8192eu_rf_prog[] = {
+	{
 		__arraycount(rtl8192eu_rf_regs),
 		rtl8192eu_rf_regs,
 		rtl8192eu_rf_vals
 	},
+	{
 		__arraycount(rtl8192eu_rf2_regs),
 		rtl8192eu_rf2_regs,
 		rtl8192eu_rf2_vals
+	}
 };
 /*
  * RTL8188EU.
  */
 static const uint8_t rtl8188eu_rf_regs[] = {
 x00, 0x08, 0x18, 0x19, 0x1e, 0x1f, 0x2f, 0x3f, 0x42, 0x57,
 x58, 0x67, 0x83, 0xb0, 0xb1, 0xb2, 0xb4, 0xb6, 0xb7, 0xb8,
 xb9, 0xba, 0xbb, 0xbf, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
 xc8, 0xc9, 0xca, 0xdf, 0xef, 0x51, 0x52, 0x53, 0x56,
 x35, 0x35, 0x35, 0x36, 0x36, 0x36, 0x36, 0xb6, 0x18, 0x5a,
 x19, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34, 0x34,
 x34, 0x34, 0x00, 0x84, 0x86, 0x87, 0x8e, 0x8f, 0xef, 0x3b,
 x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0x3b,
 x3b, 0x3b, 0x3b, 0x3b, 0x3b, 0xef, 0x00, 0x18, 0xfe, 0xfe,
 x1f, 0xfe, 0xfe, 0x1e, 0x1f, 0x00

 @@ -1,91 +1,99 @@
-/*	$NetBSD: if_urtwnreg.h,v 1.9 2016/10/12 02:56:45 nat Exp $	*/
+/*	$NetBSD: if_urtwnreg.h,v 1.10 2016/10/12 03:23:29 nat Exp $	*/
 /*	$OpenBSD: if_urtwnreg.h,v 1.3 2010/11/16 18:02:59 damien Exp $	*/
 /*-
  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
+ *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
  * copyright notice and this permission notice appear in all copies.
+ *
  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 #define	URTWN_NOISE_FLOOR	-95
 #define R92C_MAX_CHAINS	2
 /* Maximum number of output pipes is 3. */
 #define R92C_MAX_EPOUT	3
 #define R92C_MAX_EPIN	3
 #define R92C_MAX_TX_PWR	0x3f
 #define R92C_PUBQ_NPAGES	231
 #define R92C_TXPKTBUF_COUNT	256
 #define R92C_TX_PAGE_COUNT	248
 #define R92C_TX_PAGE_BOUNDARY	(R92C_TX_PAGE_COUNT + 1)
 #define R88E_TXPKTBUF_COUNT	177
 #define R88E_TX_PAGE_COUNT	169
 #define R88E_TX_PAGE_BOUNDARY	(R88E_TX_PAGE_COUNT + 1)
 #define R92E_TXPKTBUF_COUNT	256
 #define R92E_TX_PAGE_COUNT	243
 #define R92E_TX_PAGE_BOUNDARY	(R92E_TX_PAGE_COUNT + 1)
 #define R92C_TXDESC_SUMSIZE	32
 #define R92C_H2C_NBOX	4
 /* USB Requests. */
 #define R92C_REQ_REGS	0x05
 /*
  * MAC registers.
  */
 /* System Configuration. */
 #define R92C_SYS_ISO_CTRL		0x000
 #define R92C_SYS_FUNC_EN		0x002
 #define R92C_APS_FSMCO			0x004
 #define R92C_SYS_CLKR			0x008
 #define R92C_AFE_MISC			0x010
 #define R92C_SPS0_CTRL			0x011
 #define R92C_SYS_SWR_CTRL2		0x014
 #define R92C_SPS_OCP_CFG		0x018
 #define R92C_RSV_CTRL			0x01c
 #define R92C_RF_CTRL			0x01f
 #define R92C_LDOA15_CTRL		0x020
 #define R92C_LDOV12D_CTRL		0x021
 #define R92C_LDOHCI12_CTRL		0x022
 #define R92C_LPLDO_CTRL			0x023
 #define R92C_AFE_XTAL_CTRL		0x024
 #define R92C_AFE_PLL_CTRL		0x028
 #define R92C_AFE_CTRL3			0x02c
 #define R92C_EFUSE_CTRL			0x030
 #define R92C_EFUSE_TEST			0x034
 #define R92C_PWR_DATA			0x038
 #define R92C_CAL_TIMER			0x03c
 #define R92C_ACLK_MON			0x03e
 #define R92C_GPIO_MUXCFG		0x040
 #define R92C_GPIO_IO_SEL		0x042
 #define R92C_MAC_PINMUX_CFG		0x043
 #define R92C_GPIO_PIN_CTRL		0x044
 #define R92C_GPIO_INTM			0x048
 #define R92C_LEDCFG0			0x04c
 #define R92C_LEDCFG1			0x04d
 #define R92C_LEDCFG2			0x04e
 #define R92C_LEDCFG3			0x04f
 #define R92C_FSIMR			0x050
 #define R92C_FSISR			0x054
 #define R92C_HSIMR			0x058
 #define R92C_HSISR			0x05c
 #define R92C_AFE_CTRL4			0x078
 #define R92C_MCUFWDL			0x080
 #define R92C_HMEBOX_EXT(idx)		(0x088 + (idx) * 2)
 #define R88E_HIMR			0x0b0
 #define R88E_HISR			0x0b4
 #define R88E_HIMRE			0x0b8
 #define R88E_HISRE			0x0bc
 #define R92C_EFUSE_ACCESS		0x0cf
 #define R92C_BIST_SCAN			0x0d0
 #define R92C_BIST_RPT			0x0d4
 #define R92C_BIST_ROM_RPT		0x0d8
 #define R92C_USB_SIE_INTF		0x0e0
 #define R92C_PCIE_MIO_INTF		0x0e4
 #define R92C_PCIE_MIO_INTD		0x0e8
 @@ -115,26 +123,27 @@
 #define R92C_MBIST_DONE			0x178
 #define R92C_MBIST_FAIL			0x17c
 #define R92C_C2HEVT_MSG_NORMAL		0x1a0
 #define R92C_C2HEVT_MSG_TEST		0x1b8
 #define R92C_C2HEVT_CLEAR		0x1bf
 #define R92C_MCUTST_1			0x1c0
 #define R92C_FMETHR			0x1c8
 #define R92C_HMETFR			0x1cc
 #define R92C_HMEBOX(idx)		(0x1d0 + (idx) * 4)
 #define R92C_LLT_INIT			0x1e0
 #define R92C_BB_ACCESS_CTRL		0x1e8
 #define R92C_BB_ACCESS_DATA		0x1ec
 #define R88E_HMEBOX_EXT(idx)		(0x1f0 + (idx) * 4)
 #define R92E_HMEBOX_EXT(idx)		(0x1f0 + (idx) * 4)
 /* Tx DMA Configuration. */
 #define R92C_RQPN			0x200
 #define R92C_FIFOPAGE			0x204
 #define R92C_TDECTRL			0x208
 #define R92C_TXDMA_OFFSET_CHK		0x20c
 #define R92C_TXDMA_STATUS		0x210
 #define R92C_RQPN_NPQ			0x214
 /* Rx DMA Configuration. */
 #define R92C_RXDMA_AGG_PG_TH		0x280
 #define R92C_RXPKT_NUM			0x284
 #define R92C_RXDMA_STATUS		0x288
 /* Protocol Configuration. */
 #define R92C_FWHW_TXQ_CTRL		0x420
 @@ -472,26 +481,27 @@
 #define R92C_TRXDMA_CTRL_QMAP_LQ		0x5550
 #define R92C_TRXDMA_CTRL_QMAP_NQ		0xaaa0
 #define R92C_TRXDMA_CTRL_QMAP_HQ		0xfff0
 /* Bits for R92C_LLT_INIT. */
 #define R92C_LLT_INIT_DATA_M		0x000000ff
 #define R92C_LLT_INIT_DATA_S		0
 #define R92C_LLT_INIT_ADDR_M		0x0000ff00
 #define R92C_LLT_INIT_ADDR_S		8
 #define R92C_LLT_INIT_OP_M		0xc0000000
 #define R92C_LLT_INIT_OP_S		30
 #define R92C_LLT_INIT_OP_NO_ACTIVE	0
 #define R92C_LLT_INIT_OP_WRITE		1
 #define R92C_LLT_INIT_OP_READ		2
 /* Bits for R92C_RQPN. */
 #define R92C_RQPN_HPQ_M		0x000000ff
 #define R92C_RQPN_HPQ_S		0
 #define R92C_RQPN_LPQ_M		0x0000ff00
 #define R92C_RQPN_LPQ_S		8
 #define R92C_RQPN_PUBQ_M	0x00ff0000
 #define R92C_RQPN_PUBQ_S	16
 #define R92C_RQPN_LD		0x80000000
 /* Bits for R92C_TDECTRL. */
 #define R92C_TDECTRL_BLK_DESC_NUM_M	0x0000000f
 #define R92C_TDECTRL_BLK_DESC_NUM_S	4
 @@ -582,27 +592,27 @@
 #define R92C_CAMCMD_POLLING	0x80000000
 /*
  * Baseband registers.
  */
 #define R92C_FPGA0_RFMOD		0x800
 #define R92C_FPGA0_TXINFO		0x804
 #define R92C_HSSI_PARAM1(chain)		(0x820 + (chain) * 8)
 #define R92C_HSSI_PARAM2(chain)		(0x824 + (chain) * 8)
 #define R92C_TXAGC_RATE18_06(i)		(((i) == 0) ? 0xe00 : 0x830)
 #define R92C_TXAGC_RATE54_24(i)		(((i) == 0) ? 0xe04 : 0x834)
 #define R92C_TXAGC_A_CCK1_MCS32		0xe08
-#define	R92C_FPGA0_XA_HSSIPARAM1	0x820
+#define R92C_FPGA0_XA_HSSIPARAM1	0x820
 #define R92C_TXAGC_B_CCK1_55_MCS32	0x838
 #define R92C_FPGA0_XCD_SWITCHCTL	0x85c
 #define R92C_TXAGC_B_CCK11_A_CCK2_11	0x86c
 #define R92C_TXAGC_MCS03_MCS00(i)	(((i) == 0) ? 0xe10 : 0x83c)
 #define R92C_TXAGC_MCS07_MCS04(i)	(((i) == 0) ? 0xe14 : 0x848)
 #define R92C_TXAGC_MCS11_MCS08(i)	(((i) == 0) ? 0xe18 : 0x84c)
 #define R92C_TXAGC_MCS15_MCS12(i)	(((i) == 0) ? 0xe1c : 0x868)
 #define R92C_LSSI_PARAM(chain)		(0x840 + (chain) * 4)
 #define R92C_FPGA0_RFIFACEOE(chain)	(0x860 + (chain) * 4)
 #define R92C_FPGA0_RFIFACESW(idx)	(0x870 + (idx) * 4)
 #define R92C_FPGA0_RFPARAM(idx)		(0x878 + (idx) * 4)
 #define R92C_FPGA0_ANAPARAM2		0x884
 #define R92C_LSSI_READBACK(chain)	(0x8a0 + (chain) * 4)
 @@ -637,27 +647,26 @@
 #define R92C_TX_CCK_BBON		0xe78
 #define R92C_TX_OFDM_RFON		0xe7c
 #define R92C_TX_OFDM_BBON		0xe80
 #define R92C_TX_TO_RX			0xe84
 #define R92C_TX_TO_TX			0xe88
 #define R92C_RX_CCK			0xe8c
 #define R92C_RX_OFDM			0xed0
 #define R92C_RX_WAIT_RIFS 		0xed4
 #define R92C_RX_TO_RX 			0xed8
 #define R92C_STANDBY 			0xedc
 #define R92C_SLEEP 			0xee0
 #define R92C_PMPD_ANAEN			0xeec
 /* Bits for R92C_FPGA[01]_RFMOD. */
 #define R92C_RFMOD_40MHZ	0x00000001
 #define R92C_RFMOD_JAPAN	0x00000002
 #define R92C_RFMOD_CCK_TXSC	0x00000030
 #define R92C_RFMOD_CCK_EN	0x01000000
 #define R92C_RFMOD_OFDM_EN	0x02000000
 /* Bits for R92C_HSSI_PARAM1(i). */
 #define R92C_HSSI_PARAM1_PI	0x00000100
 /* Bits for R92C_HSSI_PARAM2(i). */
 #define R92C_HSSI_PARAM2_CCK_HIPWR	0x00000200
 #define R92C_HSSI_PARAM2_ADDR_LENGTH	0x00000400
 @@ -791,26 +800,29 @@
 #define R92C_USB_SPECIAL_OPTION_INT_BULK_SEL	0x10
 /* Bits for R92C_USB_EP. */
 #define R92C_USB_EP_HQ_M	0x000f
 #define R92C_USB_EP_HQ_S	0
 #define R92C_USB_EP_NQ_M	0x00f0
 #define R92C_USB_EP_NQ_S	4
 #define R92C_USB_EP_LQ_M	0x0f00
 #define R92C_USB_EP_LQ_S	8
 /* Bits for R92C_RD_CTRL. */
 #define R92C_RD_CTRL_DIS_EDCA_CNT_DWN	__BIT(11)
 /* Bits for R92C_INIDATA_RATE_SEL. */
 #define R92C_RATE_SHORTGI	__BIT(6)
 /*
  * Firmware base address.
  */
 #define R92C_FW_START_ADDR	0x1000
 #define R92C_FW_PAGE_SIZE	4096
 /*
  * RF (6052) registers.
  */
 #define R92C_RF_AC		0x00
 #define R92C_RF_IQADJ_G(i)	(0x01 + (i))
 #define R92C_RF_POW_TRSW	0x05
 @@ -866,26 +878,27 @@
 #define R92C_CAM_KEYID_S	0
 #define R92C_CAM_ALGO_M		0x0000001c
 #define R92C_CAM_ALGO_S		2
 #define R92C_CAM_ALGO_NONE	0
 #define R92C_CAM_ALGO_WEP40	1
 #define R92C_CAM_ALGO_TKIP	2
 #define R92C_CAM_ALGO_AES	4
 #define R92C_CAM_ALGO_WEP104	5
 #define R92C_CAM_VALID		0x00008000
 #define R92C_CAM_MACLO_M	0xffff0000
 #define R92C_CAM_MACLO_S	16
 /* Rate adaptation modes. */
 #define R92C_RAID_11BGN 0
 #define R92C_RAID_11GN	1
 #define R92C_RAID_11N	3
 #define R92C_RAID_11BG	4
 #define R92C_RAID_11G	5	/* "pure" 11g */
 #define R92C_RAID_11B	6
 /* Macros to access unaligned little-endian memory. */
 #define LE_READ_2(x)	((x)[0] | ((x)[1]<<8))
 #define LE_READ_4(x)	((x)[0] | ((x)[1]<<8) | ((x)[2]<<16) | ((x)[3]<<24))
 /*
  * Macros to access subfields in registers.
 @@ -932,45 +945,90 @@ struct r92c_fw_hdr {
  */
 struct r92c_fw_cmd {
 	uint8_t	id;
 #define R92C_CMD_AP_OFFLOAD		0
 #define R92C_CMD_SET_PWRMODE		1
 #define R92C_CMD_JOINBSS_RPT		2
 #define R92C_CMD_RSVD_PAGE		3
 #define R92C_CMD_RSSI			4
 #define R92C_CMD_RSSI_SETTING		5
 #define R92C_CMD_MACID_CONFIG		6
 #define R92C_CMD_MACID_PS_MODE		7
 #define R92C_CMD_P2P_PS_OFFLOAD		8
 #define R92C_CMD_SELECTIVE_SUSPEND	9
 #define R92C_CMD_USB_SUSPEND		43
 #define R92C_CMD_FLAG_EXT		0x80
 	uint8_t	msg[5];
 } __packed;
 /* Structure for R92C_CMD_RSSI_SETTING. */
 struct r92c_fw_cmd_rssi {
 	uint8_t	macid;
 	uint8_t	reserved;
 	uint8_t	pwdb;
 } __packed;
 /* Structure for R92C_CMD_MACID_CONFIG. */
 struct r92c_fw_cmd_macid_cfg {
 	uint8_t	mask[4];
 	uint8_t	macid;
 #define URTWN_MACID_BSS		0
 #define URTWN_MACID_BC		4	/* Broadcast. */
 #define URTWN_MACID_VALID	0x80
 #define URTWN_MACID_SHORTGI	0x20
 } __packed;
 /* Structure for R92C_CMD_SET_PWRMODE. */
 struct r92c_fw_cmd_setpwrmode {
 	uint8_t	mode;
 	uint8_t	smartps;
 	uint8_t	bcn_time;	/* 100ms increments */
 } __packed;
 #define R92E_CMD_KEEP_ALIVE	0x03
 #define R92E_CMD_SET_PWRMODE	0x20
 #define R92E_CMD_RSSI_REPORT	0x42
 /* Structure for R92E_CMD_KEEP_ALIVE. */
 struct r92e_fw_cmd_keepalive {
 	uint8_t mode;
 	uint8_t period;
 } __packed;
 /* Structure for R92E_CMD_SET_PWRMODE. */
 struct r92e_fw_cmd_setpwrmode {
 	uint8_t mode;
 #define FWMODE_ACTIVE		0
 #define FWMODE_LOW_POWER	1
 #define FWMODE_WMMPS		2
 	uint8_t	smartps;
 #define SRTPS_LOW_POWER		0
 #define SRTPS_POLL		0x10
 #define SRTPS_WMMPS		0x20
 	uint8_t awake_int;	/* 100ms increments. */
 	uint8_t	all_queue_apsd;
 	uint8_t	pwr_state;
 #define PS_RFOFF		0x0
 #define PS_RFON			0x4
 #define PS_ALLON		0xc
 } __packed;
 /* Structure for R92E_CMD_RSSI_REPORT. */
 struct r92e_fw_cmd_rssi {
 	uint8_t	macid;
 	uint8_t	reserved;
 	uint8_t	pwdb;
 	uint8_t	reserved2;
 } __packed;
 /*
  * RTL8192CU ROM image.
  */
 struct r92c_rom {
 	uint16_t	id;		/* 0x8192 */
 	uint8_t		reserved1[5];
 	uint8_t		dbg_sel;
 	uint16_t	reserved2;
 	uint16_t	vid;
 	uint16_t	pid;
 	uint8_t		usb_opt;
 @@ -1106,52 +1164,75 @@ struct r92c_tx_desc {
 #define R92C_TXDW1_RAID_S	16
 #define R92C_TXDW1_CIPHER_M	0x00c00000
 #define R92C_TXDW1_CIPHER_S	22
 #define R92C_TXDW1_CIPHER_NONE	0
 #define R92C_TXDW1_CIPHER_RC4	1
 #define R92C_TXDW1_CIPHER_AES	3
 #define R92C_TXDW1_PKTOFF_M	0x7c000000
 #define R92C_TXDW1_PKTOFF_S	26
 	uint32_t	txdw2;
 #define R88E_TXDW2_AGGBK	0x00010000
 	uint16_t	txdw3;
 #define R92E_TXDW3_AGGBK	0x00000100
 	uint16_t	txdseq;
 #define R92C_HWSEQ_EN		0x00008000
 	uint32_t	txdw4;
 #define R92C_TXDW4_RTSRATE_M	0x0000003f
 #define R92C_TXDW4_RTSRATE_S	0
 #define R92C_TXDW4_QOS		0x00000040
 #define R92C_TXDW4_HWSEQ	0x00000080
 #define R92C_TXDW4_DRVRATE	0x00000100
 #define R92C_TXDW4_CTS2SELF	0x00000800
 #define R92C_TXDW4_RTSEN	0x00001000
 #define R92C_TXDW4_HWRTSEN	0x00002000
 #define R92C_TXDW4_SCO_M	0x003f0000
 #define R92C_TXDW4_SCO_S	20
 #define R92C_TXDW4_SCO_SCA	1
 #define R92C_TXDW4_SCO_SCB	2
 #define R92C_TXDW4_40MHZ	0x02000000
 	uint32_t	txdw5;
 #define R92C_TXDW5_DATARATE_M	0x0000003f
 #define R92C_TXDW5_DATARATE_S	0
 #define R92C_TXDW5_SGI		0x00000040
 #define R92C_TXDW5_AGGNUM_M	0xff000000
 #define R92C_TXDW5_AGGNUM_S	24
 	uint32_t	txdw6;
 	uint16_t	txdsum;
 	uint16_t	pad;
 	uint32_t	txdw7;
 	uint16_t	txdseq2;
 #define R92E_HWSEQ_SHIFT	11
 #define R92E_HWSEQ_MASK		0x00000fffff
 	uint16_t	txdw8;
 } __packed __aligned(4);
 #define R92E_RF_T_METER		0x042
 #define R92E_STBC_SETTING	0x04c4
 #define R92E_SYS_CFG1_8192E	0x00f0
 #define R92E_LDO_SWR_CTRL	0x007C
 #define R92E_AUTO_LLT		0x224
 #define R92E_AUTO_LLT_EN	__BIT(16)
 #define R92E_RSV_MIO_EN		0x0100
 #define R92E_LEDSON		0x60
 /* Bits for SYS_CFG1_8192E. */
 #define R92E_SPSLDO_SEL		__BIT(24)
 /* Values for R92C_CMD_USB_SUSPEND. */
 #define USB_RESUME		0
 #define USB_SLEEP		1
 /* Values for IQ calibration. */
 #define R92C_IQK_TRXPATHENA	0x5600
 #define R92C_IQK_TRMUXPAR	0x00e4
 #define R92C_IQK_RFIFACESW1	0x8200
 #define R92C_IQK_LSSI_PARAM	0x00010000
 #define R92C_IQK_LSSI_RESTORE	0x00032ed3
 #define R92C_IQK_CONFIG_ANT	0x00080000
 #define R92C_TX_IQK_SETTING	0x01007c00
 #define R92C_RX_IQK_SETTING	0x01004800
 #define R92C_FPGA0_IQK_SETTING	0x80800000