otus(4), a driver for Atheros AR9001U USB IEEE 802.11 devices.

more work is required but basic operations work.
requires a non-free firmware to operate.

partly based on source code released under the ISC by Atheros
Communications for Linux, although I had to rewrite almost everything
(actually I only used some .h files from the Atheros driver.)
there also exists a rewrite of the Atheros driver for Linux (ar9170)
but the guy decided to make the code less free by wrapping the GPL
around the ISC.

committed over a NETGEAR WNDA3100.

ok deraadt@

5 files changed, 3354 insertions, 3 deletions

diff --git a/share/man/man4/Makefile b/share/man/man4/Makefile
index d465d672a93..85ca2023ff6 100644
--- a/share/man/man4/Makefile
+++ b/share/man/man4/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.478 2009/02/25 03:05:32 kevlo Exp $
+#	$OpenBSD: Makefile,v 1.479 2009/03/23 21:53:58 damien Exp $
 
 MAN=	aac.4 ac97.4 acphy.4 \
 	acpi.4 acpiac.4 acpiasus.4 acpibat.4 acpibtn.4 acpicpu.4 acpidock.4 \
@@ -33,7 +33,8 @@ MAN=	aac.4 ac97.4 acphy.4 \
 	moscom.4 mos.4 mpe.4 mpi.4 mpu.4 msk.4 msts.4 mtd.4 mtdphy.4 \
 	multicast.4 mtio.4 myx.4 ne.4 neo.4 netintro.4 nfe.4 nge.4 nmea.4 \
 	noct.4 nofn.4 nsclpcsio.4 nsgphy.4 nsphy.4 nsphyter.4 null.4 nviic.4 \
-	ohci.4 opl.4 options.4 onewire.4 oosiop.4 osiop.4 owid.4 owsbm.4 \
+	ohci.4 opl.4 options.4 onewire.4 oosiop.4 osiop.4 otus.4 \
+	owid.4 owsbm.4 \
 	owtemp.4 pcagpio.4 pcaled.4 pcdisplay.4 pchb.4 pci.4 pcib.4 pcfadc.4 \
 	pcfiic.4 pciide.4 pckbc.4 pckbd.4 pcmcia.4 pcn.4 pcppi.4 pcscp.4 \
 	pf.4 pflog.4 pflow.4 pfsync.4 pgt.4 piixpm.4 pim.4 \
diff --git a/share/man/man4/otus.4 b/share/man/man4/otus.4
new file mode 100644
index 00000000000..029985a3edf
--- /dev/null
+++ b/share/man/man4/otus.4
@@ -0,0 +1,175 @@
+.\" $OpenBSD: otus.4,v 1.1 2009/03/23 21:53:58 damien Exp $
+.\"
+.\" Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr>
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.Dd $Mdocdate: March 23 2009 $
+.Os
+.Dt OTUS 4
+.Sh NAME
+.Nm otus
+.Nd Atheros USB IEEE 802.11a/b/g/Draft-N wireless network device
+.Sh SYNOPSIS
+.Cd "otus* at uhub? port ?"
+.Sh DESCRIPTION
+The
+.Nm
+driver supports USB 2.0 wireless network devices based on Atheros
+Communications AR9001U chipset.
+.Pp
+The AR9001U chipset is made of an AR9170 MAC/Baseband
+and an AR9101 (1T1R), AR9102 (2T2R) or AR9104 (dual-band 2T2R)
+Radio.
+.Pp
+These are the modes the
+.Nm
+driver can operate in:
+.Bl -tag -width "IBSS-masterXX"
+.It BSS mode
+Also known as
+.Em infrastructure
+mode, this is used when associating with an access point, through
+which all traffic passes.
+This mode is the default.
+.It monitor mode
+In this mode the driver is able to receive packets without
+associating with an access point.
+This disables the internal receive filter and enables the card to
+capture packets from networks which it wouldn't normally have access to,
+or to scan for access points.
+.El
+.Pp
+The
+.Nm
+driver can be configured to use
+Wireless Equivalent Privacy (WEP) or
+Wi-Fi Protected Access (WPA-PSK and WPA2-PSK).
+WPA is the de facto encryption standard for wireless networks.
+It is strongly recommended that WEP
+not be used as the sole mechanism
+to secure wireless communication,
+due to serious weaknesses in it.
+.Pp
+The
+.Nm
+driver can be configured at runtime with
+.Xr ifconfig 8
+or on boot with
+.Xr hostname.if 5 .
+.Sh FILES
+The driver needs at least version 1.0 of the following firmware files,
+which are loaded when an interface is attached:
+.Pp
+.Bl -tag -width Ds -offset indent -compact
+.It /etc/firmware/otus-init
+.It /etc/firmware/otus-main
+.El
+.Pp
+Although these firmware files are freely redistributable, their usage
+is restricted.
+A prepackaged version of the firmware, designed to be used with
+.Xr pkg_add 1 ,
+can be found at:
+.Pp
+.Pa http://damien.bergamini.free.fr/packages/openbsd/otus-firmware-1.0.tgz
+.Sh HARDWARE
+The following adapters should work:
+.Pp
+.Bl -tag -width Ds -offset indent -compact
+.It Arcadyan WN7512
+.It AVM FRITZ!WLAN USB Stick N
+.It D-Link DWA-160A
+.It IO-Data WN-GDN/US2
+.It Netgear WNDA3100
+.It Netgear WN111 v2
+.It Planex GW-US300
+.It TP-Link TL-WN821N
+.It Ubiquiti SR71 USB
+.It Z-Com UB81
+.It Z-Com UB82
+.El
+.Sh EXAMPLES
+The following
+.Xr hostname.if 5
+example configures otus0 to join whatever network is available on boot,
+using WEP key
+.Dq 0x1deadbeef1 ,
+channel 11, obtaining an IP address using DHCP:
+.Bd -literal -offset indent
+dhcp NONE NONE NONE nwkey 0x1deadbeef1 chan 11
+.Ed
+.Pp
+Configure otus0 to join network
+.Dq my_net
+using WPA-PSK with passphrase
+.Dq my_passphrase :
+.Bd -literal -offset indent
+# ifconfig otus0 nwid my_net wpa wpapsk \e
+	`wpa-psk my_net my_passphrase`
+.Ed
+.Pp
+Return otus0 to its default settings:
+.Bd -literal -offset indent
+# ifconfig otus0 -bssid -chan media autoselect \e
+	nwid "" -nwkey -wpa -wpapsk
+.Ed
+.Pp
+Join an existing BSS network,
+.Dq my_net :
+.Bd -literal -offset indent
+# ifconfig otus0 192.168.1.1 netmask 0xffffff00 nwid my_net
+.Ed
+.Sh DIAGNOSTICS
+.Bl -diag
+.It "otus%d: error %d, could not read firmware %s"
+For some reason, the driver was unable to read the microcode file from the
+filesystem.
+The file might be missing or corrupted.
+.It "otus%d: device timeout"
+A frame dispatched to the hardware for transmission did not complete in time.
+The driver will reset the hardware.
+This should not happen.
+.El
+.Sh SEE ALSO
+.Xr arp 4 ,
+.Xr ifmedia 4 ,
+.Xr intro 4 ,
+.Xr netintro 4 ,
+.Xr usb 4 ,
+.Xr hostname.if 5 ,
+.Xr ifconfig 8 ,
+.Xr wpa-psk 8
+.Pp
+Atheros Communications AR9001U-2NX/AR9001U-2NG/AR9001U-NG:
+.Pa http://www.atheros.com/pt/bulletins/AR9001USBBulletin.pdf
+.Sh HISTORY
+The
+.Nm
+driver first appeared in
+.Ox 4.6 .
+.Sh AUTHORS
+The
+.Nm
+driver was written by
+.An Damien Bergamini Aq damien@openbsd.org
+based on source code licensed under the ISC released in 2008 by Atheros
+Communications for Linux.
+.Sh CAVEATS
+The
+.Nm
+driver does not support any of the 802.11n capabilities offered by the
+AR9001U chipset.
+Additional work is required in
+.Xr ieee80211 9
+before those features can be supported.
diff --git a/sys/dev/usb/files.usb b/sys/dev/usb/files.usb
index 13ebb5ce295..faacdb428ff 100644
--- a/sys/dev/usb/files.usb
+++ b/sys/dev/usb/files.usb
@@ -1,4 +1,4 @@
-#	$OpenBSD: files.usb,v 1.81 2009/01/25 02:00:25 fgsch Exp $
+#	$OpenBSD: files.usb,v 1.82 2009/03/23 21:53:57 damien Exp $
 #	$NetBSD: files.usb,v 1.16 2000/02/14 20:29:54 augustss Exp $
 #
 # Config file and device description for machine-independent USB code.
@@ -312,6 +312,11 @@ device	urtw: ether, ifnet, ifmedia, wlan
 attach	urtw at uhub
 file	dev/usb/if_urtw.c		urtw
 
+# Atheros AR9170
+device	otus: ether, ifnet, ifmedia, wlan, firmload
+attach	otus at uhub
+file	dev/usb/if_otus.c		otus
+
 # Analog Devices Eagle driver
 device	ueagle: atm, ifnet, ezload, firmload
 attach	ueagle at uhub
diff --git a/sys/dev/usb/if_otus.c b/sys/dev/usb/if_otus.c
new file mode 100644
index 00000000000..278c3f32f8c
--- /dev/null
+++ b/sys/dev/usb/if_otus.c
@@ -0,0 +1,2225 @@
+/*	$OpenBSD: if_otus.c,v 1.1 2009/03/23 21:53:57 damien Exp $	*/
+
+/*-
+ * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*-
+ * Driver for Atheros AR9001U chipset.
+ * http://www.atheros.com/pt/bulletins/AR9001USBBulletin.pdf
+ */
+
+#include "bpfilter.h"
+
+#include <sys/param.h>
+#include <sys/sockio.h>
+#include <sys/sysctl.h>
+#include <sys/mbuf.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+#include <sys/systm.h>
+#include <sys/timeout.h>
+#include <sys/conf.h>
+#include <sys/device.h>
+
+#include <machine/bus.h>
+#include <machine/endian.h>
+#include <machine/intr.h>
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+#include <net/if.h>
+#include <net/if_arp.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+#include <net/if_types.h>
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/in_var.h>
+#include <netinet/if_ether.h>
+#include <netinet/ip.h>
+
+#include <net80211/ieee80211_var.h>
+#include <net80211/ieee80211_amrr.h>
+#include <net80211/ieee80211_radiotap.h>
+
+#include <dev/usb/usb.h>
+#include <dev/usb/usbdi.h>
+#include <dev/usb/usbdi_util.h>
+#include <dev/usb/usbdevs.h>
+
+#include <dev/usb/if_otusreg.h>
+
+#ifdef USB_DEBUG
+#define OTUS_DEBUG
+#endif
+
+#define OTUS_DEBUG
+
+#ifdef OTUS_DEBUG
+#define DPRINTF(x)	do { if (otus_debug) printf x; } while (0)
+#define DPRINTFN(n, x)	do { if (otus_debug >= (n)) printf x; } while (0)
+int otus_debug = 1;
+#else
+#define DPRINTF(x)
+#define DPRINTFN(n, x)
+#endif
+
+static const struct usb_devno otus_devs[] = {
+	{ USB_VENDOR_ACCTON,	USB_PRODUCT_ACCTON_WN7512 },
+	{ USB_VENDOR_ATHEROS2,	USB_PRODUCT_ATHEROS2_TG121N },
+	{ USB_VENDOR_ATHEROS2,	USB_PRODUCT_ATHEROS2_AR9170 },
+	{ USB_VENDOR_DLINK2,	USB_PRODUCT_DLINK2_DWA160A },
+	{ USB_VENDOR_IODATA,	USB_PRODUCT_IODATA_WNGDNUS2 },
+	{ USB_VENDOR_NETGEAR,	USB_PRODUCT_NETGEAR_WN111V2 },
+	{ USB_VENDOR_NETGEAR,	USB_PRODUCT_NETGEAR_WNDA3100 },
+	{ USB_VENDOR_PLANEX2,	USB_PRODUCT_PLANEX2_GW_US300 },
+	{ USB_VENDOR_ZCOM,	USB_PRODUCT_ZCOM_UB81 },
+	{ USB_VENDOR_ZCOM,	USB_PRODUCT_ZCOM_UB82 },
+	{ USB_VENDOR_ZYDAS,	USB_PRODUCT_ZYDAS_ZD1221 }
+};
+
+int		otus_match(struct device *, void *, void *);
+void		otus_attach(struct device *, struct device *, void *);
+int		otus_detach(struct device *, int);
+void		otus_attachhook(void *);
+void		otus_get_chanlist(struct otus_softc *);
+int		otus_alloc_tx_cmd(struct otus_softc *);
+void		otus_free_tx_cmd(struct otus_softc *);
+int		otus_alloc_tx_data_list(struct otus_softc *);
+void		otus_free_tx_data_list(struct otus_softc *);
+int		otus_alloc_rx_data_list(struct otus_softc *);
+void		otus_free_rx_data_list(struct otus_softc *);
+int		otus_load_firmware(struct otus_softc *, const char *,
+		    uint32_t);
+int		otus_open_pipes(struct otus_softc *);
+void		otus_close_pipes(struct otus_softc *);
+int		otus_cmd(struct otus_softc *, uint8_t, const void *, int,
+		    void *);
+void		otus_write(struct otus_softc *, uint32_t, uint32_t);
+int		otus_write_barrier(struct otus_softc *);
+void		otus_intr(usbd_xfer_handle, usbd_private_handle, usbd_status);
+struct		ieee80211_node *otus_node_alloc(struct ieee80211com *);
+int		otus_media_change(struct ifnet *);
+void		otus_next_scan(void *);
+void		otus_task(void *);
+void		otus_do_async(struct otus_softc *,
+		    void (*)(struct otus_softc *, void *), void *, int);
+int		otus_newstate(struct ieee80211com *, enum ieee80211_state,
+		    int);
+void		otus_newstate_cb(struct otus_softc *, void *);
+int		otus_read_eeprom(struct otus_softc *);
+void		otus_newassoc(struct ieee80211com *, struct ieee80211_node *,
+		    int);
+void		otus_cmd_rxeof(struct otus_softc *, uint8_t *, int);
+void		otus_sub_rxeof(struct otus_softc *, uint8_t *, int);
+void		otus_rxeof(usbd_xfer_handle, usbd_private_handle, usbd_status);
+void		otus_txeof(usbd_xfer_handle, usbd_private_handle, usbd_status);
+int		otus_tx(struct otus_softc *, struct mbuf *,
+		    struct ieee80211_node *);
+void		otus_start(struct ifnet *);
+void		otus_watchdog(struct ifnet *);
+int		otus_ioctl(struct ifnet *, u_long, caddr_t);
+int		otus_set_beacon(struct otus_softc *);
+int		otus_set_multi(struct otus_softc *);
+void		otus_updateedca(struct ieee80211com *);
+void		otus_updateedca_cb(struct otus_softc *, void *);
+void		otus_updateslot(struct ieee80211com *);
+void		otus_updateslot_cb(struct otus_softc *, void *);
+int		otus_init_mac(struct otus_softc *);
+uint32_t	otus_phy_get_def(struct otus_softc *, uint32_t);
+int		otus_set_board_values(struct otus_softc *,
+		    struct ieee80211_channel *);
+int		otus_program_phy(struct otus_softc *,
+		    struct ieee80211_channel *);
+void		otus_get_delta_slope(uint32_t, uint32_t *, uint32_t *);
+int		otus_set_chan(struct otus_softc *, struct ieee80211_channel *);
+int		otus_set_key(struct ieee80211com *, struct ieee80211_node *,
+		    struct ieee80211_key *);
+void		otus_set_key_cb(struct otus_softc *, void *);
+void		otus_delete_key(struct ieee80211com *, struct ieee80211_node *,
+		    struct ieee80211_key *);
+void		otus_delete_key_cb(struct otus_softc *, void *);
+void		otus_calibrate_to(void *);
+int		otus_set_bssid(struct otus_softc *, const uint8_t *);
+int		otus_set_macaddr(struct otus_softc *, const uint8_t *);
+void		otus_led_newstate_type1(struct otus_softc *);
+void		otus_led_newstate_type2(struct otus_softc *);
+void		otus_led_newstate_type3(struct otus_softc *);
+int		otus_init(struct ifnet *);
+void		otus_stop(struct ifnet *);
+
+struct cfdriver otus_cd = {
+	NULL, "otus", DV_IFNET
+};
+
+const struct cfattach otus_ca = {
+	sizeof (struct otus_softc), otus_match, otus_attach, otus_detach
+};
+
+int
+otus_match(struct device *parent, void *match, void *aux)
+{
+	struct usb_attach_arg *uaa = aux;
+
+	if (uaa->iface != NULL)
+		return UMATCH_NONE;
+
+	return (usb_lookup(otus_devs, uaa->vendor, uaa->product) != NULL) ?
+	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
+}
+
+void
+otus_attach(struct device *parent, struct device *self, void *aux)
+{
+	struct otus_softc *sc = (struct otus_softc *)self;
+	struct usb_attach_arg *uaa = aux;
+	int error;
+
+	sc->sc_udev = uaa->device;
+
+	usb_init_task(&sc->sc_task, otus_task, sc);
+	timeout_set(&sc->scan_to, otus_next_scan, sc);
+	timeout_set(&sc->calib_to, otus_calibrate_to, sc);
+
+	sc->amrr.amrr_min_success_threshold =  1;
+	sc->amrr.amrr_max_success_threshold = 10;
+
+	if (usbd_set_config_no(sc->sc_udev, 1, 0) != 0) {
+		printf("%s: could not set configuration no\n",
+		    sc->sc_dev.dv_xname);
+		return;
+	}
+
+	/* Get the first interface handle. */
+	error = usbd_device2interface_handle(sc->sc_udev, 0, &sc->sc_iface);
+	if (error != 0) {
+		printf("%s: could not get interface handle\n",
+		    sc->sc_dev.dv_xname);
+		return;
+	}
+
+	if ((error = otus_open_pipes(sc)) != 0) {
+		printf("%s: could not open pipes\n", sc->sc_dev.dv_xname);
+		return;
+	}
+
+	if (rootvp == NULL)
+		mountroothook_establish(otus_attachhook, sc);
+	else
+		otus_attachhook(sc);
+
+	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev, &sc->sc_dev);
+}
+
+int
+otus_detach(struct device *self, int flags)
+{
+	struct otus_softc *sc = (struct otus_softc *)self;
+	struct ifnet *ifp = &sc->sc_ic.ic_if;
+	int s;
+
+	s = splnet();
+
+	/* Wait for all queued asynchronous commands to complete. */
+	while (sc->cmdq.queued > 0)
+		tsleep(&sc->cmdq, 0, "cmdq", 0);
+
+	timeout_del(&sc->scan_to);
+	timeout_del(&sc->calib_to);
+
+	if (ifp->if_flags != 0) {	/* if_attach() has been called */
+		ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
+		ieee80211_ifdetach(ifp);
+		if_detach(ifp);
+	}
+
+	otus_close_pipes(sc);
+
+	splx(s);
+
+	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev, &sc->sc_dev);
+
+	return 0;
+}
+
+void
+otus_attachhook(void *xsc)
+{
+	struct otus_softc *sc = xsc;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	usb_device_request_t req;
+	uint32_t in, out;
+	int error;
+
+	error = otus_load_firmware(sc, "otus-init", AR_FW_INIT_ADDR);
+	if (error != 0) {
+		printf("%s: could not load %s firmware\n",
+		    sc->sc_dev.dv_xname, "init");
+		return;
+	}
+
+	usbd_delay_ms(sc->sc_udev, 1000);
+
+	error = otus_load_firmware(sc, "otus-main", AR_FW_MAIN_ADDR);
+	if (error != 0) {
+		printf("%s: could not load %s firmware\n",
+		    sc->sc_dev.dv_xname, "main");
+		return;
+	}
+
+	/* Tell device that firmware transfer is complete. */
+	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
+	req.bRequest = AR_FW_DOWNLOAD_COMPLETE;
+	USETW(req.wValue, 0);
+	USETW(req.wIndex, 0);
+	USETW(req.wLength, 0);
+	if (usbd_do_request(sc->sc_udev, &req, NULL) != 0) {
+		printf("%s: firmware initialization failed\n",
+		    sc->sc_dev.dv_xname);
+		return;
+	}
+
+	/* Send an ECHO command to check that everything is settled. */
+	in = 0xbadc0ffe;
+	if (otus_cmd(sc, AR_CMD_ECHO, &in, sizeof in, &out) != 0) {
+		printf("%s: echo command failed\n", sc->sc_dev.dv_xname);
+		return;
+	}
+	if (in != out) {
+		printf("%s: echo reply mismatch\n", sc->sc_dev.dv_xname);
+		return;
+	}
+
+	/* Read entire EEPROM. */
+	if (otus_read_eeprom(sc) != 0) {
+		printf("%s: could not read EEPROM\n", sc->sc_dev.dv_xname);
+		return;
+	}
+
+	IEEE80211_ADDR_COPY(ic->ic_myaddr, sc->eeprom.baseEepHeader.macAddr);
+
+/* XXX */
+	sc->sc_led_newstate = otus_led_newstate_type3;
+
+	printf("%s: address %s\n", sc->sc_dev.dv_xname,
+	    ether_sprintf(ic->ic_myaddr));
+
+	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
+	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
+	ic->ic_state = IEEE80211_S_INIT;
+
+	/* Set device capabilities. */
+	ic->ic_caps =
+	    IEEE80211_C_MONITOR |	/* monitor mode supported */
+	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
+	    IEEE80211_C_SHSLOT |	/* short slot time supported */
+	    IEEE80211_C_WEP |		/* WEP */
+	    IEEE80211_C_RSN;		/* WPA/RSN */
+
+	/* Set supported .11b and .11g rates. */
+	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
+	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
+
+	/* Build the list of supported channels. */
+	otus_get_chanlist(sc);
+
+	ifp->if_softc = sc;
+	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
+	ifp->if_init = otus_init;
+	ifp->if_ioctl = otus_ioctl;
+	ifp->if_start = otus_start;
+	ifp->if_watchdog = otus_watchdog;
+	IFQ_SET_READY(&ifp->if_snd);
+	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
+
+	if_attach(ifp);
+	ieee80211_ifattach(ifp);
+	ic->ic_node_alloc = otus_node_alloc;
+	ic->ic_newassoc = otus_newassoc;
+	ic->ic_updateslot = otus_updateslot;
+	ic->ic_updateedca = otus_updateedca;
+#ifdef notyet
+	ic->ic_set_key = otus_set_key;
+	ic->ic_delete_key = otus_delete_key;
+#endif
+	/* Override state transition machine. */
+	sc->sc_newstate = ic->ic_newstate;
+	ic->ic_newstate = otus_newstate;
+	ieee80211_media_init(ifp, otus_media_change, ieee80211_media_status);
+
+#if NBPFILTER > 0
+	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
+	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
+
+	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
+	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
+	sc->sc_rxtap.wr_ihdr.it_present = htole32(OTUS_RX_RADIOTAP_PRESENT);
+
+	sc->sc_txtap_len = sizeof sc->sc_txtapu;
+	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
+	sc->sc_txtap.wt_ihdr.it_present = htole32(OTUS_TX_RADIOTAP_PRESENT);
+#endif
+}
+
+void
+otus_get_chanlist(struct otus_softc *sc)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	uint16_t domain;
+	uint8_t chan;
+	int i;
+
+	/* XXX regulatory domain. */
+	domain = letoh16(sc->eeprom.baseEepHeader.regDmn[0]);
+	DPRINTF(("regdomain=0x%04x\n", domain));
+
+	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11G) {
+		for (i = 0; i < 14; i++) {
+			chan = ar_chans[i];
+			ic->ic_channels[chan].ic_freq =
+			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_2GHZ);
+			ic->ic_channels[chan].ic_flags =
+			    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
+			    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
+		}
+	}
+	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11A) {
+		for (i = 14; i < nitems(ar_chans); i++) {
+			chan = ar_chans[i];
+			ic->ic_channels[chan].ic_freq =
+			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_5GHZ);
+			ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_A;
+		}
+	}
+}
+
+int
+otus_load_firmware(struct otus_softc *sc, const char *name, uint32_t addr)
+{
+	usb_device_request_t req;
+	size_t size;
+	u_char *fw, *ptr;
+	int mlen, error;
+
+	/* Read firmware image from the filesystem. */
+	if ((error = loadfirmware(name, &fw, &size)) != 0) {
+		printf("%s: failed loadfirmware of file %s (error %d)\n",
+		    sc->sc_dev.dv_xname, name, error);
+		return error;
+	}
+	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
+	req.bRequest = AR_FW_DOWNLOAD;
+	USETW(req.wIndex, 0);
+
+	ptr = fw;
+	addr >>= 8;
+	while (size > 0) {
+		mlen = MIN(size, 4096);
+
+		USETW(req.wValue, addr);
+		USETW(req.wLength, mlen);
+		if (usbd_do_request(sc->sc_udev, &req, ptr) != 0) {
+			error = EIO;
+			break;
+		}
+		addr += mlen >> 8;
+		ptr  += mlen;
+		size -= mlen;
+	}
+	free(fw, M_DEVBUF);
+	return error;
+}
+
+int
+otus_open_pipes(struct otus_softc *sc)
+{
+	usb_endpoint_descriptor_t *ed;
+	int i, isize, error;
+
+	error = usbd_open_pipe(sc->sc_iface, AR_EPT_BULK_RX_NO, 0,
+	    &sc->data_rx_pipe);
+	if (error != 0) {
+		printf("%s: could not open Rx bulk pipe\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	ed = usbd_get_endpoint_descriptor(sc->sc_iface, AR_EPT_INTR_RX_NO);
+	if (ed == NULL) {
+		printf("%s: could not retrieve Rx intr pipe descriptor\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+	isize = UGETW(ed->wMaxPacketSize);
+	if (isize == 0) {
+		printf("%s: invalid Rx intr pipe descriptor\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+	sc->ibuf = malloc(isize, M_USBDEV, M_NOWAIT);
+	if (sc->ibuf == NULL) {
+		printf("%s: could not allocate Rx intr buffer\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+	error = usbd_open_pipe_intr(sc->sc_iface, AR_EPT_INTR_RX_NO,
+	    USBD_SHORT_XFER_OK, &sc->cmd_rx_pipe, sc, sc->ibuf, isize,
+	    otus_intr, USBD_DEFAULT_INTERVAL);
+	if (error != 0) {
+		printf("%s: could not open Rx intr pipe\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	error = usbd_open_pipe(sc->sc_iface, AR_EPT_BULK_TX_NO, 0,
+	    &sc->data_tx_pipe);
+	if (error != 0) {
+		printf("%s: could not open Tx bulk pipe\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	error = usbd_open_pipe(sc->sc_iface, AR_EPT_INTR_TX_NO, 0,
+	    &sc->cmd_tx_pipe);
+	if (error != 0) {
+		printf("%s: could not open Tx intr pipe\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	if (otus_alloc_tx_cmd(sc) != 0) {
+		printf("%s: could not allocate command xfer\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	if (otus_alloc_tx_data_list(sc) != 0) {
+		printf("%s: could not allocate Tx xfers\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	if (otus_alloc_rx_data_list(sc) != 0) {
+		printf("%s: could not allocate Rx xfers\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	for (i = 0; i < OTUS_RX_DATA_LIST_COUNT; i++) {
+		struct otus_rx_data *data = &sc->rx_data[i];
+
+		usbd_setup_xfer(data->xfer, sc->data_rx_pipe, data, data->buf,
+		    OTUS_RXBUFSZ, USBD_SHORT_XFER_OK | USBD_NO_COPY,
+		    USBD_NO_TIMEOUT, otus_rxeof);
+		error = usbd_transfer(data->xfer);
+		if (error != USBD_IN_PROGRESS && error != 0) {
+			printf("%s: could not queue Rx xfer\n",
+			    sc->sc_dev.dv_xname);
+			goto fail;
+		}
+	}
+	return 0;
+
+ fail:	otus_close_pipes(sc);
+	return error;
+}
+
+void
+otus_close_pipes(struct otus_softc *sc)
+{
+	if (sc->data_rx_pipe != NULL)
+		usbd_close_pipe(sc->data_rx_pipe);
+	if (sc->cmd_rx_pipe != NULL)
+		usbd_close_pipe(sc->cmd_rx_pipe);
+	if (sc->ibuf != NULL)
+		free(sc->ibuf, M_USBDEV);
+	if (sc->data_tx_pipe != NULL)
+		usbd_close_pipe(sc->data_tx_pipe);
+	if (sc->cmd_tx_pipe != NULL)
+		usbd_close_pipe(sc->cmd_tx_pipe);
+
+	otus_free_tx_cmd(sc);
+	otus_free_tx_data_list(sc);
+	otus_free_rx_data_list(sc);
+}
+
+int
+otus_alloc_tx_cmd(struct otus_softc *sc)
+{
+	struct otus_tx_cmd *cmd = &sc->tx_cmd;
+
+	cmd->xfer = usbd_alloc_xfer(sc->sc_udev);
+	if (cmd->xfer == NULL) {
+		printf("%s: could not allocate xfer\n",
+		    sc->sc_dev.dv_xname);
+		return ENOMEM;
+	}
+	cmd->buf = usbd_alloc_buffer(cmd->xfer, OTUS_MAX_TXCMDSZ);
+	if (cmd->buf == NULL) {
+		printf("%s: could not allocate xfer buffer\n",
+		    sc->sc_dev.dv_xname);
+		usbd_free_xfer(cmd->xfer);
+		return ENOMEM;
+	}
+	return 0;
+}
+
+void
+otus_free_tx_cmd(struct otus_softc *sc)
+{
+	/* Make sure no transfer is pending. */
+	usbd_abort_pipe(sc->cmd_tx_pipe);
+
+	if (sc->tx_cmd.xfer != NULL)
+		usbd_free_xfer(sc->tx_cmd.xfer);
+}
+
+int
+otus_alloc_tx_data_list(struct otus_softc *sc)
+{
+	struct otus_tx_data *data;
+	int i, error;
+
+	for (i = 0; i < OTUS_TX_DATA_LIST_COUNT; i++) {
+		data = &sc->tx_data[i];
+
+		data->sc = sc;  /* Backpointer for callbacks. */
+
+		data->xfer = usbd_alloc_xfer(sc->sc_udev);
+		if (data->xfer == NULL) {
+			printf("%s: could not allocate xfer\n",
+			    sc->sc_dev.dv_xname);
+			error = ENOMEM;
+			goto fail;
+		}
+		data->buf = usbd_alloc_buffer(data->xfer, OTUS_TXBUFSZ);
+		if (data->buf == NULL) {
+			printf("%s: could not allocate xfer buffer\n",
+			    sc->sc_dev.dv_xname);
+			error = ENOMEM;
+			goto fail;
+		}
+	}
+	return 0;
+
+fail:	otus_free_tx_data_list(sc);
+	return error;
+}
+
+void
+otus_free_tx_data_list(struct otus_softc *sc)
+{
+	int i;
+
+	/* make sure no transfers are pending */
+	usbd_abort_pipe(sc->data_tx_pipe);
+
+	for (i = 0; i < OTUS_TX_DATA_LIST_COUNT; i++)
+		if (sc->tx_data[i].xfer != NULL)
+			usbd_free_xfer(sc->tx_data[i].xfer);
+}
+
+int
+otus_alloc_rx_data_list(struct otus_softc *sc)
+{
+	struct otus_rx_data *data;
+	int i, error;
+
+	for (i = 0; i < OTUS_RX_DATA_LIST_COUNT; i++) {
+		data = &sc->rx_data[i];
+
+		data->sc = sc;	/* Backpointer for callbacks. */
+
+		data->xfer = usbd_alloc_xfer(sc->sc_udev);
+		if (data->xfer == NULL) {
+			printf("%s: could not allocate xfer\n",
+			    sc->sc_dev.dv_xname);
+			error = ENOMEM;
+			goto fail;
+		}
+		data->buf = usbd_alloc_buffer(data->xfer, OTUS_RXBUFSZ);
+		if (data->buf == NULL) {
+			printf("%s: could not allocate xfer buffer\n",
+			    sc->sc_dev.dv_xname);
+			error = ENOMEM;
+			goto fail;
+		}
+	}
+	return 0;
+
+fail:	otus_free_rx_data_list(sc);
+	return error;
+}
+
+void
+otus_free_rx_data_list(struct otus_softc *sc)
+{
+	int i;
+
+	/* Make sure no transfers are pending. */
+	usbd_abort_pipe(sc->data_rx_pipe);
+
+	for (i = 0; i < OTUS_RX_DATA_LIST_COUNT; i++)
+		if (sc->rx_data[i].xfer != NULL)
+			usbd_free_xfer(sc->rx_data[i].xfer);
+}
+
+void
+otus_next_scan(void *arg)
+{
+	struct otus_softc *sc = arg;
+
+	if (sc->sc_ic.ic_state == IEEE80211_S_SCAN)
+		ieee80211_next_scan(&sc->sc_ic.ic_if);
+}
+
+void
+otus_task(void *arg)
+{
+	struct otus_softc *sc = arg;
+	struct otus_host_cmd_ring *ring = &sc->cmdq;
+	struct otus_host_cmd *cmd;
+	int s;
+
+	/* Process host commands. */
+	s = splusb();
+	while (ring->next != ring->cur) {
+		cmd = &ring->cmd[ring->next];
+		splx(s);
+		/* Callback. */
+		cmd->cb(sc, cmd->data);
+		s = splusb();
+		ring->queued--;
+		ring->next = (ring->next + 1) % OTUS_HOST_CMD_RING_COUNT;
+	}
+	wakeup(ring);
+	splx(s);
+}
+
+void
+otus_do_async(struct otus_softc *sc, void (*cb)(struct otus_softc *, void *),
+    void *arg, int len)
+{
+	struct otus_host_cmd_ring *ring = &sc->cmdq;
+	struct otus_host_cmd *cmd;
+	int s;
+
+	s = splusb();
+	cmd = &ring->cmd[ring->cur];
+	cmd->cb = cb;
+	KASSERT(len <= sizeof (cmd->data));
+	memcpy(cmd->data, arg, len);
+	ring->cur = (ring->cur + 1) % OTUS_HOST_CMD_RING_COUNT;
+
+	/* If there is no pending command already, schedule a task. */
+	if (++ring->queued == 1)
+		usb_add_task(sc->sc_udev, &sc->sc_task);
+	splx(s);
+}
+
+int
+otus_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
+{
+	struct otus_softc *sc = ic->ic_softc;
+	struct otus_cmd_newstate cmd;
+
+	/* Do it in a process context. */
+	cmd.state = nstate;
+	cmd.arg = arg;
+	otus_do_async(sc, otus_newstate_cb, &cmd, sizeof cmd);
+	return 0;
+}
+
+void
+otus_newstate_cb(struct otus_softc *sc, void *arg)
+{
+	struct otus_cmd_newstate *cmd = arg;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ieee80211_node *ni;
+	int s;
+
+	s = splnet();
+
+	switch (cmd->state) {
+	case IEEE80211_S_INIT:
+		break;
+
+	case IEEE80211_S_SCAN:
+		(void)otus_set_chan(sc, ic->ic_bss->ni_chan);
+		timeout_add_msec(&sc->scan_to, 200);
+		break;
+
+	case IEEE80211_S_AUTH:
+	case IEEE80211_S_ASSOC:
+		(void)otus_set_chan(sc, ic->ic_bss->ni_chan);
+		break;
+
+	case IEEE80211_S_RUN:
+		(void)otus_set_chan(sc, ic->ic_bss->ni_chan);
+
+		ni = ic->ic_bss;
+
+		if (ic->ic_opmode == IEEE80211_M_STA) {
+			otus_updateslot(ic);
+			otus_set_bssid(sc, ni->ni_bssid);
+
+			/* Fake a join to init the Tx rate. */
+			otus_newassoc(ic, ni, 1);
+
+			/* Start calibration timer. */
+			timeout_add_sec(&sc->calib_to, 1);
+		}
+		break;
+	}
+
+	sc->sc_led_newstate(sc);
+	(void)sc->sc_newstate(ic, cmd->state, cmd->arg);
+
+	splx(s);
+}
+
+int
+otus_cmd(struct otus_softc *sc, uint8_t code, const void *idata, int ilen,
+    void *odata)
+{
+	struct otus_tx_cmd *cmd = &sc->tx_cmd;
+	struct ar_cmd_hdr *hdr;
+	int s, xferlen, error;
+
+	/* Always bulk-out a multiple of 4 bytes. */
+	xferlen = (sizeof (*hdr) + ilen + 3) & ~3;
+
+	hdr = (struct ar_cmd_hdr *)cmd->buf;
+	hdr->code  = code;
+	hdr->len   = ilen;
+	hdr->token = ++cmd->token;	/* Don't care about endianness. */
+	memcpy((uint8_t *)&hdr[1], idata, ilen);
+
+	DPRINTFN(2, ("sending command code=0x%02x len=%d token=%d\n",
+	    code, ilen, hdr->token));
+
+	s = splusb();
+	cmd->odata = odata;
+	cmd->done = 0;
+
+	usbd_setup_xfer(cmd->xfer, sc->cmd_tx_pipe, cmd, cmd->buf, xferlen,
+	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, OTUS_CMD_TIMEOUT, NULL);
+	error = usbd_sync_transfer(cmd->xfer);
+	if (error != 0) {
+		splx(s);
+		printf("%s: could not send command 0x%x (error=%s)\n",
+		    sc->sc_dev.dv_xname, code, usbd_errstr(error));
+		return EIO;
+	}
+	if (!cmd->done)
+		error = tsleep(cmd, PCATCH, "otuscmd", hz);
+	cmd->odata = NULL;	/* In case answer is received too late. */
+	splx(s);
+	if (error != 0) {
+		printf("%s: timeout waiting for command 0x%02x reply\n",
+		    sc->sc_dev.dv_xname, code);
+	}
+	return error;
+}
+
+void
+otus_write(struct otus_softc *sc, uint32_t reg, uint32_t val)
+{
+	sc->write_buf[sc->write_idx].reg = htole32(reg);
+	sc->write_buf[sc->write_idx].val = htole32(val);
+
+	if (++sc->write_idx > AR_MAX_WRITE_IDX)
+		(void)otus_write_barrier(sc);
+}
+
+int
+otus_write_barrier(struct otus_softc *sc)
+{
+	int error;
+
+	if (sc->write_idx == 0)
+		return 0;	/* Nothing to flush. */
+
+	error = otus_cmd(sc, AR_CMD_WREG, sc->write_buf,
+	    sizeof (sc->write_buf[0]) * sc->write_idx, NULL);
+	sc->write_idx = 0;
+	return error;
+}
+
+/* ARGSUSED */
+void
+otus_intr(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
+{
+	/*
+	 * The Rx intr pipe is unused with current firmware.  Notifications
+	 * and replies to commands are sent through the Rx bulk pipe instead
+	 * (with a magic PLCP header.)
+	 */
+}
+
+struct ieee80211_node *
+otus_node_alloc(struct ieee80211com *ic)
+{
+	return malloc(sizeof (struct otus_node), M_DEVBUF, M_NOWAIT | M_ZERO);
+}
+
+int
+otus_media_change(struct ifnet *ifp)
+{
+	struct otus_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
+	uint8_t rate, ridx;
+	int error;
+
+	error = ieee80211_media_change(ifp);
+	if (error != ENETRESET)
+		return error;
+
+	if (ic->ic_fixed_rate != -1) {
+		rate = ic->ic_sup_rates[ic->ic_curmode].
+		    rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
+		for (ridx = 0; ridx <= OTUS_RIDX_MAX; ridx++)
+			if (otus_rates[ridx].rate == rate)
+				break;
+		sc->fixed_ridx = ridx;
+	}
+
+	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
+		error = otus_init(ifp);
+
+	return error;
+}
+
+int
+otus_read_eeprom(struct otus_softc *sc)
+{
+	uint32_t regs[8], reg;
+	uint8_t *eep;
+	int i, j, error;
+
+	/* Read EEPROM by blocks of 32 bytes. */
+	eep = (uint8_t *)&sc->eeprom;
+	reg = 0x1600;
+	for (i = 0; i < sizeof (sc->eeprom) / 32; i++) {
+		for (j = 0; j < 8; j++, reg += 4)
+			regs[j] = htole32(reg);
+		error = otus_cmd(sc, AR_CMD_RREG, regs, sizeof regs, eep);
+		if (error != 0)
+			break;
+		eep += 32;
+	}
+	return error;
+}
+
+void
+otus_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
+{
+	struct otus_softc *sc = ic->ic_softc;
+	struct otus_node *on = (void *)ni;
+	struct ieee80211_rateset *rs = &ni->ni_rates;
+	uint8_t rate;
+	int ridx, i;
+
+	DPRINTF(("new assoc isnew=%d addr=%s\n",
+	    isnew, ether_sprintf(ni->ni_macaddr)));
+
+	ieee80211_amrr_node_init(&sc->amrr, &on->amn);
+	/* Start at lowest available bit-rate, AMRR will raise. */
+	ni->ni_txrate = 0;
+
+	for (i = 0; i < rs->rs_nrates; i++) {
+		rate = rs->rs_rates[i] & IEEE80211_RATE_VAL;
+		/* Convert 802.11 rate to hardware rate index. */
+		for (ridx = 0; ridx <= OTUS_RIDX_MAX; ridx++)
+			if (otus_rates[ridx].rate == rate)
+				break;
+		on->ridx[i] = ridx;
+		DPRINTF(("rate=0x%02x ridx=%d\n",
+		    rs->rs_rates[i], on->ridx[i]));
+	}
+}
+
+void
+otus_cmd_rxeof(struct otus_softc *sc, uint8_t *buf, int len)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct otus_tx_cmd *cmd;
+	struct ar_cmd_hdr *hdr;
+	int s;
+
+	if (__predict_false(len < sizeof (*hdr))) {
+		DPRINTF(("cmd too small %d\n", len));
+		return;
+	}
+	hdr = (struct ar_cmd_hdr *)buf;
+	if (__predict_false(sizeof (*hdr) + hdr->len > len ||
+	    sizeof (*hdr) + hdr->len > 64)) {
+		DPRINTF(("cmd too large %d\n", hdr->len));
+		return;
+	}
+
+	if ((hdr->code & 0xc0) != 0xc0) {
+		DPRINTFN(2, ("received reply code=0x%02x len=%d token=%d\n",
+		    hdr->code, hdr->len, hdr->token));
+		cmd = &sc->tx_cmd;
+		if (__predict_false(hdr->token != cmd->token))
+			return;
+		/* Copy answer into caller's supplied buffer. */
+		if (cmd->odata != NULL)
+			memcpy(cmd->odata, &hdr[1], hdr->len);
+		cmd->done = 1;
+		wakeup(cmd);
+		return;
+	}
+
+	/* Received unsolicited notification. */
+	DPRINTF(("received notification code=0x%02x len=%d\n",
+	    hdr->code, hdr->len));
+	switch (hdr->code & 0x3f) {
+	case AR_EVT_BEACON:
+		break;
+	case AR_EVT_TX_COMP:
+	{
+		struct ar_evt_tx_comp *tx = (struct ar_evt_tx_comp *)&hdr[1];
+		struct ieee80211_node *ni;
+		struct otus_node *on;
+
+		DPRINTF(("tx completed %s status=%d phy=0x%x\n",
+		    ether_sprintf(tx->macaddr), letoh16(tx->status),
+		    letoh32(tx->phy)));
+		s = splnet();
+#ifdef notyet
+#ifndef IEEE80211_STA_ONLY
+		if (ic->ic_opmode != IEEE80211_M_STA) {
+			ni = ieee80211_find_node(ic, tx->macaddr);
+			if (__predict_false(ni == NULL)) {
+				splx(s);
+				break;
+			}
+		} else
+#endif
+#endif
+			ni = ic->ic_bss;
+		/* Update rate control statistics. */
+		on = (void *)ni;
+		/* NB: we do not set the TX_MAC_RATE_PROBING flag. */
+		if (__predict_true(tx->status != 0))
+			on->amn.amn_retrycnt++;
+		splx(s);
+		break;
+	}
+	case AR_EVT_TBTT:
+		break;
+	}
+}
+
+void
+otus_sub_rxeof(struct otus_softc *sc, uint8_t *buf, int len)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	struct ieee80211_rxinfo rxi;
+	struct ieee80211_node *ni;
+	struct ar_rx_tail *tail;
+	struct ieee80211_frame *wh;
+	struct mbuf *m;
+	uint8_t *plcp;
+	int s, mlen, align;
+
+	if (__predict_false(len < AR_PLCP_HDR_LEN)) {
+		DPRINTF(("sub-xfer too short %d\n", len));
+		return;
+	}
+	plcp = (uint8_t *)buf;
+
+	/* All bits in the PLCP header are set to 1 for non-MPDU. */
+	if (memcmp(plcp, AR_PLCP_HDR_INTR, AR_PLCP_HDR_LEN) == 0) {
+		otus_cmd_rxeof(sc, plcp + AR_PLCP_HDR_LEN,
+		    len - AR_PLCP_HDR_LEN);
+		return;
+	}
+
+	/* Received MPDU. */
+	if (__predict_false(len < AR_PLCP_HDR_LEN + sizeof (*tail))) {
+		DPRINTF(("MPDU too short %d\n", len));
+		return;
+	}
+	tail = (struct ar_rx_tail *)(plcp + len - sizeof (*tail));
+
+	/* Discard error frames. */
+	if (__predict_false(tail->error != 0)) {
+		DPRINTF(("error frame 0x%02x\n", tail->error));
+		return;
+	}
+	/* Compute MPDU's length. */
+	mlen = len - AR_PLCP_HDR_LEN - sizeof (*tail);
+	/* Make sure there's room for an 802.11 header + FCS. */
+	if (__predict_false(mlen < IEEE80211_MIN_LEN))
+		return;
+	mlen -= IEEE80211_CRC_LEN;	/* strip 802.11 FCS */
+
+	wh = (struct ieee80211_frame *)(plcp + AR_PLCP_HDR_LEN);
+	/* Provide a 32-bit aligned protocol header to the stack. */
+	align = (ieee80211_has_qos(wh) ^ ieee80211_has_addr4(wh)) ? 2 : 0;
+
+	MGETHDR(m, M_DONTWAIT, MT_DATA);
+	if (__predict_false(m == NULL)) {
+		ifp->if_ierrors++;
+		return;
+	}
+	if (align + mlen > MHLEN) {
+		MCLGET(m, M_DONTWAIT);
+		if (__predict_false(!(m->m_flags & M_EXT))) {
+			ifp->if_ierrors++;
+			m_freem(m);
+			return;
+		}
+	}
+	/* Finalize mbuf. */
+	m->m_pkthdr.rcvif = ifp;
+	m->m_data += align;
+	memcpy(mtod(m, caddr_t), wh, mlen);
+	m->m_pkthdr.len = m->m_len = mlen;
+
+#if NBPFILTER > 0
+	if (__predict_false(sc->sc_drvbpf != NULL)) {
+		struct otus_rx_radiotap_header *tap = &sc->sc_rxtap;
+		struct mbuf mb;
+
+		tap->wr_flags = 0;
+		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
+		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
+		tap->wr_antsignal = tail->rssi;
+		tap->wr_rate = 2;	/* In case it can't be found below. */
+		switch (tail->status & AR_RX_STATUS_MT_MASK) {
+		case AR_RX_STATUS_MT_CCK:
+			switch (plcp[0]) {
+			case 0x0: tap->wr_rate =   2; break;
+			case 0x1: tap->wr_rate =   4; break;
+			case 0x2: tap->wr_rate =  11; break;
+			case 0x3: tap->wr_rate =  22; break;
+			}
+			if (tail->status & AR_RX_STATUS_SHPREAMBLE)
+				tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
+			break;
+		case AR_RX_STATUS_MT_OFDM:
+			switch (plcp[0] & 0xf) {
+			case 0xb: tap->wr_rate =  12; break;
+			case 0xf: tap->wr_rate =  18; break;
+			case 0xa: tap->wr_rate =  24; break;
+			case 0xe: tap->wr_rate =  36; break;
+			case 0x9: tap->wr_rate =  48; break;
+			case 0xd: tap->wr_rate =  72; break;
+			case 0x8: tap->wr_rate =  96; break;
+			case 0xc: tap->wr_rate = 108; break;
+			}
+			break;
+		}
+		mb.m_data = (caddr_t)tap;
+		mb.m_len = sc->sc_rxtap_len;
+		mb.m_next = m;
+		mb.m_nextpkt = NULL;
+		mb.m_type = 0;
+		mb.m_flags = 0;
+		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
+	}
+#endif
+
+	s = splnet();
+	ni = ieee80211_find_rxnode(ic, wh);
+	rxi.rxi_flags = 0;
+	rxi.rxi_rssi = tail->rssi;
+	rxi.rxi_tstamp = 0;	/* unused */
+	ieee80211_input(ifp, m, ni, &rxi);
+
+	/* Node is no longer needed. */
+	ieee80211_release_node(ic, ni);
+	splx(s);
+}
+
+void
+otus_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
+{
+	struct otus_rx_data *data = priv;
+	struct otus_softc *sc = data->sc;
+	caddr_t buf = data->buf;
+	struct ar_rx_head *head;
+	uint16_t hlen;
+	int len;
+
+	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
+		DPRINTF(("RX status=%d\n", status));
+		if (status == USBD_STALLED)
+			usbd_clear_endpoint_stall_async(sc->data_rx_pipe);
+		if (status != USBD_CANCELLED)
+			goto resubmit;
+		return;
+	}
+	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
+
+	while (len >= sizeof (*head)) {
+		head = (struct ar_rx_head *)buf;
+		if (__predict_false(head->tag != htole16(AR_RX_HEAD_TAG))) {
+			DPRINTF(("tag not valid 0x%x\n", letoh16(head->tag)));
+			break;
+		}
+		hlen = letoh16(head->len);
+		if (__predict_false(sizeof (*head) + hlen > len)) {
+			DPRINTF(("xfer too short %d/%d\n", len, hlen));
+			break;
+		}
+		/* Process sub-xfer. */
+		otus_sub_rxeof(sc, (uint8_t *)&head[1], hlen);
+
+		/* Next sub-xfer is aligned on a 32-bit boundary. */
+		hlen = (sizeof (*head) + hlen + 3) & ~3;
+		buf += hlen;
+		len -= hlen;
+	}
+
+ resubmit:
+	usbd_setup_xfer(xfer, sc->data_rx_pipe, data, data->buf, OTUS_RXBUFSZ,
+	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, otus_rxeof);
+	(void)usbd_transfer(data->xfer);
+}
+
+void
+otus_txeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
+{
+	struct otus_tx_data *data = priv;
+	struct otus_softc *sc = data->sc;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	int s;
+
+	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
+		DPRINTF(("TX status=%d\n", status));
+		if (status == USBD_STALLED)
+			usbd_clear_endpoint_stall_async(sc->data_tx_pipe);
+		ifp->if_oerrors++;
+		return;
+	}
+	s = splnet();
+	sc->tx_queued--;
+	sc->sc_tx_timer = 0;
+	ifp->if_flags &= ~IFF_OACTIVE;
+	otus_start(ifp);
+	splx(s);
+}
+
+int
+otus_tx(struct otus_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct otus_node *on = (void *)ni;
+	struct otus_tx_data *data;
+	struct ieee80211_frame *wh;
+	struct ieee80211_key *k;
+	struct ar_tx_head *head;
+	uint32_t phyctl;
+	uint16_t macctl, qos;
+	int error, ridx, hasqos, xferlen;
+
+	wh = mtod(m, struct ieee80211_frame *);
+	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
+		k = ieee80211_get_txkey(ic, wh, ni);
+		if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
+			return ENOBUFS;
+		wh = mtod(m, struct ieee80211_frame *);
+	}
+
+	if ((hasqos = ieee80211_has_qos(wh)))
+		qos = ieee80211_get_qos(wh);
+
+	/* Pickup a rate index. */
+	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
+	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA)
+		ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
+		    OTUS_RIDX_OFDM6 : OTUS_RIDX_CCK1;
+	else if (ic->ic_fixed_rate != -1)
+		ridx = sc->fixed_ridx;
+	else
+		ridx = on->ridx[ni->ni_txrate];
+
+	phyctl = 0;
+	macctl = AR_TX_MAC_BACKOFF | AR_TX_MAC_HW_DUR;
+#if 0
+	/* XXX this can be used to get Tx notifications of success. */
+	macctl |= AR_TX_MAC_RATE_PROBING;
+#endif
+
+	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
+	    (hasqos && ((qos & IEEE80211_QOS_ACK_POLICY_MASK) ==
+	     IEEE80211_QOS_ACK_POLICY_NOACK)))
+		macctl |= AR_TX_MAC_NOACK;
+
+	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
+	    m->m_pkthdr.len + IEEE80211_CRC_LEN >= ic->ic_rtsthreshold)
+		macctl |= AR_TX_MAC_RTS;
+	else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
+	    ridx >= OTUS_RIDX_OFDM6) {
+		if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
+			macctl |= AR_TX_MAC_CTS;
+		else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
+			macctl |= AR_TX_MAC_RTS;
+	}
+
+	phyctl |= AR_TX_PHY_MCS(otus_rates[ridx].mcs);
+	if (ridx >= OTUS_RIDX_OFDM6) {
+		phyctl |= AR_TX_PHY_MT_OFDM;
+		if (ridx <= OTUS_RIDX_OFDM24)
+			phyctl |= AR_TX_PHY_ANTMSK(5);
+		else
+			phyctl |= AR_TX_PHY_ANTMSK(1);
+	} else {	/* CCK */
+		phyctl |= AR_TX_PHY_MT_CCK;
+		phyctl |= AR_TX_PHY_ANTMSK(5);
+	}
+
+	/* Update rate control stats for frames that need an ACK. */
+	if (!(macctl & AR_TX_MAC_NOACK))
+		((struct otus_node *)ni)->amn.amn_txcnt++;
+
+	data = &sc->tx_data[sc->tx_cur];
+	/* Fill Tx descriptor. */
+	head = (struct ar_tx_head *)data->buf;
+	head->len = htole16(m->m_pkthdr.len + IEEE80211_CRC_LEN);
+	head->macctl = htole16(macctl);
+	head->phyctl = htole32(phyctl);
+
+#if NBPFILTER > 0
+	if (__predict_false(sc->sc_drvbpf != NULL)) {
+		struct otus_tx_radiotap_header *tap = &sc->sc_txtap;
+		struct mbuf mb;
+
+		tap->wt_flags = 0;
+		tap->wt_rate = otus_rates[ridx].rate;
+		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
+		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
+
+		mb.m_data = (caddr_t)tap;
+		mb.m_len = sc->sc_txtap_len;
+		mb.m_next = m;
+		mb.m_nextpkt = NULL;
+		mb.m_type = 0;
+		mb.m_flags = 0;
+		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
+	}
+#endif
+
+	xferlen = sizeof (*head) + m->m_pkthdr.len;
+	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&head[1]);
+	m_freem(m);
+	ieee80211_release_node(ic, ni);
+
+	DPRINTFN(5, ("tx queued=%d len=%d mac=0x%04x phy=0x%08x rate=%d\n",
+	    sc->tx_queued, head->len, head->macctl, head->phyctl,
+	    otus_rates[ridx].rate));
+	usbd_setup_xfer(data->xfer, sc->data_tx_pipe, data, data->buf, xferlen,
+	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, OTUS_TX_TIMEOUT, otus_txeof);
+	error = usbd_transfer(data->xfer);
+	if (__predict_false(error != USBD_IN_PROGRESS && error != 0))
+		return error;
+
+	sc->tx_queued++;
+	sc->tx_cur = (sc->tx_cur + 1) % OTUS_TX_DATA_LIST_COUNT;
+
+	return 0;
+}
+
+void
+otus_start(struct ifnet *ifp)
+{
+	struct otus_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ieee80211_node *ni;
+	struct mbuf *m;
+
+	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
+		return;
+
+	for (;;) {
+		if (sc->tx_queued >= OTUS_TX_DATA_LIST_COUNT) {
+			ifp->if_flags |= IFF_OACTIVE;
+			break;
+		}
+		/* Send pending management frames first. */
+		IF_DEQUEUE(&ic->ic_mgtq, m);
+		if (m != NULL) {
+			ni = (void *)m->m_pkthdr.rcvif;
+			goto sendit;
+		}
+		if (ic->ic_state != IEEE80211_S_RUN)
+			break;
+
+		/* Encapsulate and send data frames. */
+		IFQ_DEQUEUE(&ifp->if_snd, m);
+		if (m == NULL)
+			break;
+#if NBPFILTER > 0
+		if (ifp->if_bpf != NULL)
+			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
+#endif
+		if ((m = ieee80211_encap(ifp, m, &ni)) == NULL)
+			continue;
+sendit:
+#if NBPFILTER > 0
+		if (ic->ic_rawbpf != NULL)
+			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
+#endif
+		if (otus_tx(sc, m, ni) != 0) {
+			ieee80211_release_node(ic, ni);
+			ifp->if_oerrors++;
+			continue;
+		}
+
+		sc->sc_tx_timer = 5;
+		ifp->if_timer = 1;
+	}
+}
+
+void
+otus_watchdog(struct ifnet *ifp)
+{
+	struct otus_softc *sc = ifp->if_softc;
+
+	ifp->if_timer = 0;
+
+	if (sc->sc_tx_timer > 0) {
+		if (--sc->sc_tx_timer == 0) {
+			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
+			/* otus_init(ifp); XXX needs a process context! */
+			ifp->if_oerrors++;
+			return;
+		}
+		ifp->if_timer = 1;
+	}
+	ieee80211_watchdog(ifp);
+}
+
+int
+otus_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
+{
+	struct otus_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifaddr *ifa;
+	struct ifreq *ifr;
+	int s, error = 0;
+
+	s = splnet();
+
+	switch (cmd) {
+	case SIOCSIFADDR:
+		ifa = (struct ifaddr *)data;
+		ifp->if_flags |= IFF_UP;
+#ifdef INET
+		if (ifa->ifa_addr->sa_family == AF_INET)
+			arp_ifinit(&ic->ic_ac, ifa);
+#endif
+		/* FALLTHROUGH */
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			if ((ifp->if_flags & IFF_RUNNING) &&
+			    ((ifp->if_flags ^ sc->sc_if_flags) &
+			     (IFF_ALLMULTI | IFF_PROMISC)) != 0) {
+				otus_set_multi(sc);
+			} else if (!(ifp->if_flags & IFF_RUNNING))
+				otus_init(ifp);
+
+		} else if (ifp->if_flags & IFF_RUNNING)
+			otus_stop(ifp);
+
+		sc->sc_if_flags = ifp->if_flags;
+		break;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+		ifr = (struct ifreq *)data;
+		error = (cmd == SIOCADDMULTI) ?
+		    ether_addmulti(ifr, &ic->ic_ac) :
+		    ether_delmulti(ifr, &ic->ic_ac);
+		if (error == ENETRESET)
+			error = 0;
+		break;
+	default:
+		error = ieee80211_ioctl(ifp, cmd, data);
+	}
+
+	if (error == ENETRESET) {
+		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
+		    (IFF_UP | IFF_RUNNING))
+			otus_init(ifp);
+		error = 0;
+	}
+
+	splx(s);
+	return error;
+}
+
+int
+otus_set_multi(struct otus_softc *sc)
+{
+	struct arpcom *ac = &sc->sc_ic.ic_ac;
+	struct ifnet *ifp = &ac->ac_if;
+	struct ether_multi *enm;
+	struct ether_multistep step;
+	uint32_t lo, hi;
+	uint8_t bit;
+
+	if ((ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC)) != 0) {
+		lo = hi = 0xffffffff;
+		goto done;
+	}
+	lo = hi = 0;
+	ETHER_FIRST_MULTI(step, ac, enm);
+	while (enm != NULL) {
+		if (bcmp(enm->enm_addrlo, enm->enm_addrhi, ETHER_ADDR_LEN)) {
+			ifp->if_flags |= IFF_ALLMULTI;
+			lo = hi = 0xffffffff;
+			goto done;
+		}
+		bit = enm->enm_addrlo[5] >> 2;
+		if (bit < 32)
+			lo |= 1 << bit;
+		else
+			hi |= 1 << (bit - 32);
+		ETHER_NEXT_MULTI(step, enm);
+	}
+ done:
+	hi |= 1 << 31;	/* make sure the broadcast bit is set */
+	otus_write(sc, AR_MAC_REG_GROUP_HASH_TBL_L, lo);
+	otus_write(sc, AR_MAC_REG_GROUP_HASH_TBL_H, hi);
+	return otus_write_barrier(sc);
+}
+
+void
+otus_updateedca(struct ieee80211com *ic)
+{
+	/* Do it in a process context. */
+	otus_do_async(ic->ic_softc, otus_updateedca_cb, NULL, 0);
+}
+
+/* ARGSUSED */
+void
+otus_updateedca_cb(struct otus_softc *sc, void *arg)
+{
+#define EXP2(val)	((1 << (val)) - 1)
+#define AIFS(val)	((val) * 9 + 10)
+	struct ieee80211com *ic = &sc->sc_ic;
+	const struct ieee80211_edca_ac_params *edca;
+	int s;
+
+	s = splnet();
+
+	edca = (ic->ic_flags & IEEE80211_F_QOS) ?
+	    ic->ic_edca_ac : otus_edca_def;
+
+	/* Set CWmin/CWmax values. */
+	otus_write(sc, AR_MAC_REG_AC0_CW,
+	    EXP2(edca[EDCA_AC_BE].ac_ecwmax) << 16 |
+	    EXP2(edca[EDCA_AC_BE].ac_ecwmin));
+	otus_write(sc, AR_MAC_REG_AC1_CW,
+	    EXP2(edca[EDCA_AC_BK].ac_ecwmax) << 16 |
+	    EXP2(edca[EDCA_AC_BK].ac_ecwmin));
+	otus_write(sc, AR_MAC_REG_AC2_CW,
+	    EXP2(edca[EDCA_AC_VI].ac_ecwmax) << 16 |
+	    EXP2(edca[EDCA_AC_VI].ac_ecwmin));
+	otus_write(sc, AR_MAC_REG_AC3_CW,
+	    EXP2(edca[EDCA_AC_VO].ac_ecwmax) << 16 |
+	    EXP2(edca[EDCA_AC_VO].ac_ecwmin));
+	otus_write(sc, AR_MAC_REG_AC4_CW,		/* Special TXQ. */
+	    EXP2(edca[EDCA_AC_VO].ac_ecwmax) << 16 |
+	    EXP2(edca[EDCA_AC_VO].ac_ecwmin));
+
+	/* Set AIFSN values. */
+	otus_write(sc, AR_MAC_REG_AC1_AC0_AIFS,
+	    AIFS(edca[EDCA_AC_VI].ac_aifsn) << 24 |
+	    AIFS(edca[EDCA_AC_BK].ac_aifsn) << 12 |
+	    AIFS(edca[EDCA_AC_BE].ac_aifsn));
+	otus_write(sc, AR_MAC_REG_AC3_AC2_AIFS,
+	    AIFS(edca[EDCA_AC_VO].ac_aifsn) << 16 |	/* Special TXQ. */
+	    AIFS(edca[EDCA_AC_VO].ac_aifsn) <<  4 |
+	    AIFS(edca[EDCA_AC_VI].ac_aifsn) >>  8);
+
+	/* Set TXOP limit. */
+	otus_write(sc, AR_MAC_REG_AC1_AC0_TXOP,
+	    edca[EDCA_AC_BK].ac_txoplimit << 16 |
+	    edca[EDCA_AC_BE].ac_txoplimit);
+	otus_write(sc, AR_MAC_REG_AC3_AC2_TXOP,
+	    edca[EDCA_AC_VO].ac_txoplimit << 16 |
+	    edca[EDCA_AC_VI].ac_txoplimit);
+
+	splx(s);
+
+	(void)otus_write_barrier(sc);
+#undef AIFS
+#undef EXP2
+}
+
+void
+otus_updateslot(struct ieee80211com *ic)
+{
+	/* Do it in a process context. */
+	otus_do_async(ic->ic_softc, otus_updateslot_cb, NULL, 0);
+}
+
+/* ARGSUSED */
+void
+otus_updateslot_cb(struct otus_softc *sc, void *arg)
+{
+	uint32_t slottime;
+
+	slottime = (sc->sc_ic.ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
+	otus_write(sc, AR_MAC_REG_SLOT_TIME, slottime << 10);
+	(void)otus_write_barrier(sc);
+}
+
+int
+otus_init_mac(struct otus_softc *sc)
+{
+	int error;
+
+	otus_write(sc, AR_MAC_REG_ACK_EXTENSION, 0x40);
+	otus_write(sc, AR_MAC_REG_RETRY_MAX, 0);
+	otus_write(sc, AR_MAC_REG_SNIFFER, 0x2000000);
+	otus_write(sc, AR_MAC_REG_RX_THRESHOLD, 0xc1f80);
+	otus_write(sc, AR_MAC_REG_RX_PE_DELAY, 0x70);
+	otus_write(sc, AR_MAC_REG_EIFS_AND_SIFS, 0xa144000);
+	otus_write(sc, AR_MAC_REG_SLOT_TIME, 9 << 10);
+	otus_write(sc, 0x1c3b2c, 0x19000000);
+	/* NAV protects ACK only (in TXOP). */
+	otus_write(sc, 0x1c3b38, 0x201);
+	/* Set beacon Tx power to 0x7. */
+	otus_write(sc, AR_MAC_REG_BCN_HT1, 0x8000170);
+	otus_write(sc, AR_MAC_REG_BACKOFF_PROTECT, 0x105);
+	otus_write(sc, 0x1c3b9c, 0x10000a);
+	/* Filter any control frames, BAR is bit 24. */
+	otus_write(sc, 0x1c368c, 0x0500ffff);
+	otus_write(sc, 0x1c3c40, 0x1);
+	otus_write(sc, AR_MAC_REG_BASIC_RATE, 0x150f);
+	otus_write(sc, AR_MAC_REG_MANDATORY_RATE, 0x150f);
+	otus_write(sc, AR_MAC_REG_RTS_CTS_RATE, 0x10b01bb);
+	otus_write(sc, 0x1c3694, 0x4003c1e);
+	/* Enable LED0 and LED1. */
+	otus_write(sc, 0x1d0100, 0x3);
+	otus_write(sc, 0x1d0104, 0x3);
+	/* Switch MAC to OTUS interface. */
+	otus_write(sc, 0x1c3600, 0x3);
+	otus_write(sc, 0x1c3c50, 0xffff);
+	otus_write(sc, 0x1c3680, 0xf00008);
+	/* Disable Rx timeout (workaround). */
+	otus_write(sc, 0x1c362c, 0);
+
+	/* Set USB Rx stream mode maximum frame number to 2. */
+	otus_write(sc, 0x1e1110, 0x4);
+	/* Set USB Rx stream mode timeout to 10us. */
+	otus_write(sc, 0x1e1114, 0x80);
+
+	/* Set clock frequency to 88/80MHz. */
+	otus_write(sc, 0x1d4008, 0x73);
+	/* Set WLAN DMA interrupt mode: generate intr per packet. */
+	otus_write(sc, 0x1c3d7c, 0x110011);
+	otus_write(sc, 0x1c3bb0, 0x4);
+	otus_write(sc, AR_MAC_REG_TXOP_NOT_ENOUGH_INDICATION, 0x141e0f48);
+
+	/* Disable HW decryption for now. */
+	otus_write(sc, 0x1c3678, 0x78);
+
+	if ((error = otus_write_barrier(sc)) != 0)
+		return error;
+
+	/* Set default EDCA parameters. */
+	otus_updateedca_cb(sc, NULL);
+
+	return 0;
+}
+
+static __inline void
+otus_phy_write(struct otus_softc *sc, uint32_t reg, uint32_t val)
+{
+	otus_write(sc, 0x1bc000 + reg, val);
+}
+
+/*
+ * Return default value for PHY register based on current operating mode.
+ */
+uint32_t
+otus_phy_get_def(struct otus_softc *sc, uint32_t reg)
+{
+	int i;
+
+	for (i = 0; i < nitems(ar5416_phy_regs); i++)
+		if (AR_PHY(ar5416_phy_regs[i]) == reg)
+			return sc->phy_vals[i];
+	return 0;	/* register not found */
+}
+
+/*
+ * Update PHY's programming based on vendor-specific data stored in EEPROM.
+ * This is for FEM-type devices only.
+ */
+int
+otus_set_board_values(struct otus_softc *sc, struct ieee80211_channel *c)
+{
+	const struct ModalEepHeader *eep;
+	uint32_t tmp, offset;
+
+	if (IEEE80211_IS_CHAN_5GHZ(c))
+		eep = &sc->eeprom.modalHeader[0];
+	else
+		eep = &sc->eeprom.modalHeader[1];
+
+	/* Offset of chain 2. */
+	offset = 2 * 0x1000;
+
+	tmp = letoh32(eep->antCtrlCommon);
+	otus_phy_write(sc, AR_PHY_SWITCH_COM, tmp);
+
+	tmp = letoh32(eep->antCtrlChain[0]);
+	otus_phy_write(sc, AR_PHY_SWITCH_CHAIN_0, tmp);
+
+	tmp = letoh32(eep->antCtrlChain[1]);
+	otus_phy_write(sc, AR_PHY_SWITCH_CHAIN_0 + offset, tmp);
+
+	if (1 /* sc->sc_sco == AR_SCO_SCN */) {
+		tmp = otus_phy_get_def(sc, AR_PHY_SETTLING);
+		tmp &= ~(0x7f << 7);
+		tmp |= (eep->switchSettling & 0x7f) << 7;
+		otus_phy_write(sc, AR_PHY_SETTLING, tmp);
+	}
+
+	tmp = otus_phy_get_def(sc, AR_PHY_DESIRED_SZ);
+	tmp &= ~0xffff;
+	tmp |= eep->pgaDesiredSize << 8 | eep->adcDesiredSize;
+	otus_phy_write(sc, AR_PHY_DESIRED_SZ, tmp);
+
+	tmp = eep->txEndToXpaOff << 24 | eep->txEndToXpaOff << 16 |
+	      eep->txFrameToXpaOn << 8 | eep->txFrameToXpaOn;
+	otus_phy_write(sc, AR_PHY_RF_CTL4, tmp);
+
+	tmp = otus_phy_get_def(sc, AR_PHY_RF_CTL3);
+	tmp &= ~(0xff << 16);
+	tmp |= eep->txEndToRxOn << 16;
+	otus_phy_write(sc, AR_PHY_RF_CTL3, tmp);
+
+	tmp = otus_phy_get_def(sc, AR_PHY_CCA);
+	tmp &= ~(0x7f << 12);
+	tmp |= (eep->thresh62 & 0x7f) << 12;
+	otus_phy_write(sc, AR_PHY_CCA, tmp);
+
+	tmp = otus_phy_get_def(sc, AR_PHY_RXGAIN);
+	tmp &= ~(0x3f << 12);
+	tmp |= (eep->txRxAttenCh[0] & 0x3f) << 12;
+	otus_phy_write(sc, AR_PHY_RXGAIN, tmp);
+
+	tmp = otus_phy_get_def(sc, AR_PHY_RXGAIN + offset);
+	tmp &= ~(0x3f << 12);
+	tmp |= (eep->txRxAttenCh[1] & 0x3f) << 12;
+	otus_phy_write(sc, AR_PHY_RXGAIN + offset, tmp);
+
+	tmp = otus_phy_get_def(sc, AR_PHY_GAIN_2GHZ);
+	tmp &= ~(0x3f << 18);
+	tmp |= (eep->rxTxMarginCh[0] & 0x3f) << 18;
+	if (IEEE80211_IS_CHAN_5GHZ(c)) {
+		tmp &= ~(0xf << 10);
+		tmp |= (eep->bswMargin[0] & 0xf) << 10;
+	}
+	otus_phy_write(sc, AR_PHY_GAIN_2GHZ, tmp);
+
+	tmp = otus_phy_get_def(sc, AR_PHY_GAIN_2GHZ + offset);
+	tmp &= ~(0x3f << 18);
+	tmp |= (eep->rxTxMarginCh[1] & 0x3f) << 18;
+	otus_phy_write(sc, AR_PHY_GAIN_2GHZ + offset, tmp);
+
+	tmp = otus_phy_get_def(sc, AR_PHY_TIMING_CTRL4);
+	tmp &= ~(0x3f << 5 | 0x1f);
+	tmp |= (eep->iqCalICh[0] & 0x3f) << 5 | (eep->iqCalQCh[0] & 0x1f);
+	otus_phy_write(sc, AR_PHY_TIMING_CTRL4, tmp);
+
+	tmp = otus_phy_get_def(sc, AR_PHY_TIMING_CTRL4 + offset);
+	tmp &= ~(0x3f << 5 | 0x1f);
+	tmp |= (eep->iqCalICh[1] & 0x3f) << 5 | (eep->iqCalQCh[1] & 0x1f);
+	otus_phy_write(sc, AR_PHY_TIMING_CTRL4 + offset, tmp);
+
+	tmp = otus_phy_get_def(sc, 0xa258);
+	tmp &= ~(0xf << 16);
+	tmp |= (eep->xpd & 0xf) << 16;
+	otus_phy_write(sc, 0xa258, tmp);
+
+	return otus_write_barrier(sc);
+}
+
+int
+otus_program_phy(struct otus_softc *sc, struct ieee80211_channel *c)
+{
+	const uint32_t *vals;
+	int error, i;
+
+	/* Select PHY programming based on band and bandwidth. */
+	if (IEEE80211_IS_CHAN_2GHZ(c))
+		vals = ar5416_phy_vals_2ghz_20mhz;
+	else
+		vals = ar5416_phy_vals_5ghz_20mhz;
+	for (i = 0; i < nitems(ar5416_phy_regs); i++)
+		otus_phy_write(sc, AR_PHY(ar5416_phy_regs[i]), vals[i]);
+	sc->phy_vals = vals;
+
+	if (sc->eeprom.baseEepHeader.deviceType == 0x80)	/* FEM */
+		if ((error = otus_set_board_values(sc, c)) != 0)
+			return error;
+
+	/* Initial Tx power settings. */
+	otus_phy_write(sc, AR_PHY( 79), 0x7f);
+	otus_phy_write(sc, AR_PHY( 77), 0x3f3f3f3f);
+	otus_phy_write(sc, AR_PHY( 78), 0x3f3f3f3f);
+	otus_phy_write(sc, AR_PHY(653), 0x3f3f3f3f);
+	otus_phy_write(sc, AR_PHY(654), 0x3f3f3f3f);
+	otus_phy_write(sc, AR_PHY(739), 0x3f3f3f3f);
+	otus_phy_write(sc, AR_PHY(740), 0x3f3f3f3f);
+	otus_phy_write(sc, AR_PHY(755), 0x3f3f3f3f);
+	otus_phy_write(sc, AR_PHY(756), 0x3f3f3f3f);
+	otus_phy_write(sc, AR_PHY(757), 0x3f3f3f3f);
+
+	if (IEEE80211_IS_CHAN_2GHZ(c))
+		otus_write(sc, 0x1d4014, 0x5163);
+	else
+		otus_write(sc, 0x1d4014, 0x5143);
+
+	return otus_write_barrier(sc);
+}
+
+static __inline uint8_t
+otus_reverse_bits(uint8_t v)
+{
+	v = ((v >> 1) & 0x55) | ((v & 0x55) << 1);
+	v = ((v >> 2) & 0x33) | ((v & 0x33) << 2);
+	v = ((v >> 4) & 0x0f) | ((v & 0x0f) << 4);
+	return v;
+}
+
+void
+otus_get_delta_slope(uint32_t coeff, uint32_t *exponent, uint32_t *mantissa)
+{
+#define COEFF_SCALE_SHIFT	24
+	uint32_t exp, man;
+
+	/* exponent = 14 - floor(log2(coeff)) */
+	for (exp = 31; exp > 0; exp--)
+		if (coeff & (1 << exp))
+			break;
+	KASSERT(exp != 0);
+	exp = 14 - (exp - COEFF_SCALE_SHIFT);
+
+	/* mantissa = floor(coeff * 2^exponent + 0.5) */
+	man = coeff + (1 << (COEFF_SCALE_SHIFT - exp - 1));
+
+	*mantissa = man >> (COEFF_SCALE_SHIFT - exp);
+	*exponent = exp - 16;
+#undef COEFF_SCALE_SHIFT
+}
+
+int
+otus_set_chan(struct otus_softc *sc, struct ieee80211_channel *c)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ar_cmd_frequency cmd;
+	struct ar_rsp_frequency rsp;
+	const uint32_t *vals;
+	uint32_t coeff, exp, man, tmp;
+	uint16_t data;
+	uint8_t code, chansel, d0, d1;
+	int error, chan, i;
+
+	chan = ieee80211_chan2ieee(ic, c);
+	DPRINTF(("setting channel %d\n", chan));
+
+	tmp = IEEE80211_IS_CHAN_2GHZ(c) ? 0x105 : 0x104;
+	otus_write(sc, AR_MAC_REG_DYNAMIC_SIFS_ACK, tmp);
+	(void)otus_write_barrier(sc);
+
+	/* clear bb_heavy_clip_enable */
+	otus_phy_write(sc, 0x99e0, 0x200);
+	(void)otus_write_barrier(sc);
+
+	error = otus_cmd(sc, AR_CMD_FREQ_STRAT, NULL, 0, NULL);
+	if (error != 0)
+		return error;
+
+	/* Reprogram PHY and RF on band or channel bandwidth changes. */
+	if (1 || c->ic_flags != sc->sc_curchan->ic_flags) {
+		DPRINTF(("band switch\n"));
+
+		/* Reset BB/ADDA. */
+		otus_write(sc, 0x1d4004, 0x400);	/* XXX cold/warm */
+		(void)otus_write_barrier(sc);
+		otus_write(sc, 0x1d4004, 0);
+		(void)otus_write_barrier(sc);
+
+		if ((error = otus_program_phy(sc, c)) != 0) {
+			printf("%s: could not program PHY\n",
+			    sc->sc_dev.dv_xname);
+			return error;
+		}
+
+		/* Select RF programming based on band. */
+		if (IEEE80211_IS_CHAN_5GHZ(c))
+			vals = ar5416_banks_vals_5ghz;
+		else
+			vals = ar5416_banks_vals_2ghz;
+		for (i = 0; i < nitems(ar5416_banks_regs); i++) {
+			otus_phy_write(sc, AR_PHY(ar5416_banks_regs[i]),
+			    vals[i]);
+		}
+		if ((error = otus_write_barrier(sc)) != 0)
+			return error;
+
+		code = AR_CMD_RF_INIT;
+	} else {
+		code = AR_CMD_FREQUENCY;
+	}
+
+	d0 = 0;
+	if (IEEE80211_IS_CHAN_5GHZ(c)) {
+		chansel = (c->ic_freq - 4800) / 5;
+		if (chansel & 1)
+			d0 |= AR_BANK4_AMODE_REFSEL(2);
+		else
+			d0 |= AR_BANK4_AMODE_REFSEL(1);
+	} else {
+		d0 |= AR_BANK4_AMODE_REFSEL(2);
+		if (chan == 14) {
+			d0 |= AR_BANK4_BMODE_LF_SYNTH_FREQ;
+			chansel = 10 + (c->ic_freq - 2274) / 5;
+		} else
+			chansel = 16 + (c->ic_freq - 2272) / 5;
+		chansel <<= 2;
+	}
+	d0 |= AR_BANK4_ADDR(1) | AR_BANK4_CHUP;
+	d1 = otus_reverse_bits(chansel);
+
+	/* write bits 0-4 of d0 and d1 */
+	data = (d1 & 0x1f) << 5 | (d0 & 0x1f);
+	otus_phy_write(sc, AR_PHY(44), data);
+	/* write bits 5-7 of d0 and d1 */
+	data = (d1 >> 5) << 5 | (d0 >> 5);
+	otus_phy_write(sc, AR_PHY(58), data);
+
+	if ((error = otus_write_barrier(sc)) != 0)
+		return error;
+	usbd_delay_ms(sc->sc_udev, 10);
+
+	otus_phy_write(sc, AR_PHY(1), 0x100 | 0x240);	/* XXX UB83 */
+	(void)otus_write_barrier(sc);
+
+	/* Send firmware command to set channel. */
+	cmd.freq = htole32((uint32_t)c->ic_freq * 1000);
+	cmd.dynht2040 = htole32(0);
+	cmd.htena = htole32(1);
+	/* Set Delta Slope (exponent and mantissa). */
+	coeff = (100 << 24) / c->ic_freq;
+	otus_get_delta_slope(coeff, &exp, &man);
+	cmd.delta_slope_coeff_exp = htole32(exp);
+	cmd.delta_slope_coeff_man = htole32(man);
+	/* For Short GI, coeff is 9/10 of normal coeff. */
+	coeff = (9 * coeff) / 10;
+	otus_get_delta_slope(coeff, &exp, &man);
+	cmd.delta_slope_coeff_exp_shgi = htole32(exp);
+	cmd.delta_slope_coeff_man_shgi = htole32(man);
+	/* Set wait time for AGC and noise calibration (100ms). */
+	cmd.check_loop_count = htole32(1000);
+	DPRINTF(("%s: exp=%d man=%d exp_shgi=%d man_shgi=%d\n",
+	    (code == AR_CMD_RF_INIT) ? "RF_INIT" : "FREQUENCY",
+	    letoh32(cmd.delta_slope_coeff_exp),
+	    letoh32(cmd.delta_slope_coeff_man),
+	    letoh32(cmd.delta_slope_coeff_exp_shgi),
+	    letoh32(cmd.delta_slope_coeff_man_shgi)));
+	error = otus_cmd(sc, code, &cmd, sizeof (cmd), &rsp);
+	if (error != 0)
+		return error;
+
+	DPRINTF(("status=0x%x\n", letoh32(rsp.status)));
+	sc->sc_curchan = c;
+
+	return 0;
+}
+
+#ifdef notyet
+int
+otus_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
+    struct ieee80211_key *k)
+{
+	struct otus_softc *sc = ic->ic_softc;
+	struct otus_cmd_key cmd;
+
+	/* Do it in a process context. */
+	cmd.key = *k;
+	cmd.associd = (ni != NULL) ? ni->ni_associd : 0;
+	otus_do_async(sc, otus_set_key_cb, &cmd, sizeof cmd);
+	return 0;
+}
+
+void
+otus_set_key_cb(struct otus_softc *sc, void *arg)
+{
+	struct otus_cmd_key *cmd = arg;
+	struct ieee80211_key *k = &cmd->key;
+	struct ar_cmd_ekey key;
+	uint16_t cipher;
+	int error;
+
+	memset(&key, 0, sizeof key);
+	if (k->k_flags & IEEE80211_KEY_GROUP) {
+		key.uid = htole16(k->k_id);
+		IEEE80211_ADDR_COPY(key.macaddr, sc->sc_ic.ic_myaddr);
+	} else {
+		key.uid = htole16(OTUS_UID(cmd->associd));
+		IEEE80211_ADDR_COPY(key.macaddr, ni->ni_macaddr);
+	}
+	key.kid = htole16(0);
+	/* Map net80211 cipher to hardware. */
+	switch (k->k_cipher) {
+	case IEEE80211_CIPHER_WEP40:
+		cipher = AR_CIPHER_WEP64;
+		break;
+	case IEEE80211_CIPHER_WEP104:
+		cipher = AR_CIPHER_WEP128;
+		break;
+	case IEEE80211_CIPHER_TKIP:
+		cipher = AR_CIPHER_TKIP;
+		break;
+	case IEEE80211_CIPHER_CCMP:
+		cipher = AR_CIPHER_AES;
+		break;
+	default:
+		return;
+	}
+	key.cipher = htole16(cipher);
+	memcpy(key.key, k->k_key, MIN(k->k_len, 16));
+	error = otus_cmd(sc, AR_CMD_EKEY, &key, sizeof key, NULL);
+	if (error != 0 || k->k_cipher != IEEE80211_CIPHER_TKIP)
+		return;
+
+	/* TKIP: set Tx/Rx MIC Key. */
+	key.kid = htole16(1);
+	memcpy(key.key, k->k_key + 16, 16);
+	(void)otus_cmd(sc, AR_CMD_EKEY, &key, sizeof key, NULL);
+}
+
+void
+otus_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
+    struct ieee80211_key *k)
+{
+	struct otus_softc *sc = ic->ic_softc;
+	struct otus_cmd_key cmd;
+
+	if (!(ic->ic_if.if_flags & IFF_RUNNING) ||
+	    ic->ic_state != IEEE80211_S_RUN)
+		return;	/* Nothing to do. */
+
+	/* Do it in a process context. */
+	cmd.key = *k;
+	cmd.associd = (ni != NULL) ? ni->ni_associd : 0;
+	otus_do_async(sc, otus_delete_key_cb, &cmd, sizeof cmd);
+}
+
+void
+otus_delete_key_cb(struct otus_softc *sc, void *arg)
+{
+	struct otus_cmd_key *cmd = arg;
+	struct ieee80211_key *k = &cmd->key;
+	uint32_t uid;
+
+	if (k->k_flags & IEEE80211_KEY_GROUP)
+		uid = htole32(k->k_id);
+	else
+		uid = htole32(OTUS_UID(cmd->associd));
+	(void)otus_cmd(sc, AR_CMD_DKEY, &uid, sizeof uid, NULL);
+}
+#endif
+
+void
+otus_calibrate_to(void *arg)
+{
+	struct otus_softc *sc = arg;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ieee80211_node *ni;
+	int s;
+
+	s = splnet();
+	ni = ic->ic_bss;
+	ieee80211_amrr_choose(&sc->amrr, ni, &((struct otus_node *)ni)->amn);
+	splx(s);
+
+	timeout_add_sec(&sc->calib_to, 1);
+}
+
+int
+otus_set_bssid(struct otus_softc *sc, const uint8_t *bssid)
+{
+	otus_write(sc, 0x1c3618,
+	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
+	otus_write(sc, 0x1c361c,
+	    bssid[4] | bssid[5] << 8);
+	return otus_write_barrier(sc);
+}
+
+int
+otus_set_macaddr(struct otus_softc *sc, const uint8_t *addr)
+{
+	otus_write(sc, AR_MAC_REG_MAC_ADDR_L,
+	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
+	otus_write(sc, AR_MAC_REG_MAC_ADDR_H,
+	    addr[4] | addr[5] << 8);
+	return otus_write_barrier(sc);
+}
+
+/* Default single-LED. */
+void
+otus_led_newstate_type1(struct otus_softc *sc)
+{
+	/* TBD */
+}
+
+/* NETGEAR, dual-LED. */
+void
+otus_led_newstate_type2(struct otus_softc *sc)
+{
+	/* TBD */
+}
+
+/* NETGEAR, single-LED/3 colors (blue, red, purple.) */
+void
+otus_led_newstate_type3(struct otus_softc *sc)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	uint32_t state = sc->led_state;
+
+	if (ic->ic_state == IEEE80211_S_INIT) {
+		state = 0;	/* LED off. */
+	} else if (ic->ic_state == IEEE80211_S_RUN) {
+		/* Associated, LED always on. */
+		if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan))
+			state = AR_LED0_ON;	/* 2GHz=>Red. */
+		else
+			state = AR_LED1_ON;	/* 5GHz=>Blue. */
+	} else {
+		/* Scanning, blink LED. */
+		state ^= AR_LED0_ON | AR_LED1_ON;
+		if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan))
+			state &= ~AR_LED1_ON;
+		else
+			state &= ~AR_LED0_ON;
+	}
+	if (state != sc->led_state) {
+		otus_write(sc, 0x1d0104, state);
+		if (otus_write_barrier(sc) == 0)
+			sc->led_state = state;
+	}
+}
+
+int
+otus_init(struct ifnet *ifp)
+{
+	struct otus_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
+	int error;
+
+	/* Init host command ring. */
+	sc->cmdq.cur = sc->cmdq.next = sc->cmdq.queued = 0;
+
+	if ((error = otus_init_mac(sc)) != 0) {
+		printf("%s: could not initialize MAC\n", sc->sc_dev.dv_xname);
+		return error;
+	}
+
+	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
+	(void)otus_set_macaddr(sc, ic->ic_myaddr);
+
+	switch (ic->ic_opmode) {
+#ifdef notyet
+#ifndef IEEE80211_STA_ONLY
+	case IEEE80211_M_HOSTAP:
+		otus_write(sc, 0x1c3700, 0x0f0000a1);
+		otus_write(sc, 0x1c3c40, 0x1);
+		break;
+	case IEEE80211_M_IBSS:
+		otus_write(sc, 0x1c3700, 0x0f000000);
+		otus_write(sc, 0x1c3c40, 0x1);
+		break;
+#endif
+#endif
+	case IEEE80211_M_STA:
+		otus_write(sc, 0x1c3700, 0x0f000002);
+		otus_write(sc, 0x1c3c40, 0x1);
+		break;
+	default:
+		break;
+	}
+	otus_write(sc, AR_MAC_REG_SNIFFER,
+	    (ic->ic_opmode == IEEE80211_M_MONITOR) ? 0x2000001 : 0x2000000);
+	(void)otus_write_barrier(sc);
+
+	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
+	sc->sc_curchan = &ic->ic_channels[0];	/* Force band switch. */
+	if ((error = otus_set_chan(sc, ic->ic_ibss_chan)) != 0) {
+		printf("%s: could not set channel\n", sc->sc_dev.dv_xname);
+		return error;
+	}
+
+	/* Start Rx. */
+	otus_write(sc, 0x1c3d30, 0x100);
+	otus_write_barrier(sc);
+
+	ifp->if_flags &= ~IFF_OACTIVE;
+	ifp->if_flags |= IFF_RUNNING;
+
+	if (ic->ic_opmode == IEEE80211_M_MONITOR)
+		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
+	else
+		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
+
+	return 0;
+}
+
+void
+otus_stop(struct ifnet *ifp)
+{
+	struct otus_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
+	int s;
+
+	sc->sc_tx_timer = 0;
+	ifp->if_timer = 0;
+	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
+
+	timeout_del(&sc->scan_to);
+	timeout_del(&sc->calib_to);
+
+	s = splusb();
+	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
+	/* Wait for all queued asynchronous commands to complete. */
+	while (sc->cmdq.queued > 0)
+		tsleep(&sc->cmdq, 0, "cmdq", 0);
+	splx(s);
+
+	/* Stop Rx. */
+	otus_write(sc, 0x1c3d30, 0);
+	(void)otus_write_barrier(sc);
+
+	sc->tx_queued = 0;
+}
diff --git a/sys/dev/usb/if_otusreg.h b/sys/dev/usb/if_otusreg.h
new file mode 100644
index 00000000000..401bd1d4d26
--- /dev/null
+++ b/sys/dev/usb/if_otusreg.h
@@ -0,0 +1,945 @@
+/*	$OpenBSD: if_otusreg.h,v 1.1 2009/03/23 21:53:57 damien Exp $	*/
+
+/*-
+ * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr>
+ * Copyright (c) 2007-2008 Atheros Communications, Inc.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* USB Endpoints addresses. */
+#define AR_EPT_BULK_TX_NO	(UE_DIR_OUT | 1)
+#define AR_EPT_BULK_RX_NO	(UE_DIR_IN  | 2)
+#define AR_EPT_INTR_RX_NO	(UE_DIR_IN  | 3)
+#define AR_EPT_INTR_TX_NO	(UE_DIR_OUT | 4)
+
+/* USB Requests. */
+#define AR_FW_DOWNLOAD			0x30
+#define AR_FW_DOWNLOAD_COMPLETE		0x31
+
+/* Maximum number of writes that can fit in a single FW command is 7. */
+#define AR_MAX_WRITE_IDX	6	/* 56 bytes */
+
+#define AR_FW_INIT_ADDR			0x102800
+#define AR_FW_MAIN_ADDR			0x200000
+#define AR_USB_MODE_CTRL		0x1e1108
+
+/*
+ * AR9170 MAC registers.
+ */
+#define AR_MAC_REG_BASE			0x1c3000
+#define AR_MAC_REG_MAC_ADDR_L		(AR_MAC_REG_BASE + 0x610)
+#define AR_MAC_REG_MAC_ADDR_H		(AR_MAC_REG_BASE + 0x614)
+#define AR_MAC_REG_GROUP_HASH_TBL_L	(AR_MAC_REG_BASE + 0x624)
+#define AR_MAC_REG_GROUP_HASH_TBL_H	(AR_MAC_REG_BASE + 0x628)
+#define AR_MAC_REG_BASIC_RATE		(AR_MAC_REG_BASE + 0x630)
+#define AR_MAC_REG_MANDATORY_RATE	(AR_MAC_REG_BASE + 0x634)
+#define AR_MAC_REG_RTS_CTS_RATE		(AR_MAC_REG_BASE + 0x638)
+#define AR_MAC_REG_BACKOFF_PROTECT	(AR_MAC_REG_BASE + 0x63c)
+#define AR_MAC_REG_RX_THRESHOLD		(AR_MAC_REG_BASE + 0x640)
+#define AR_MAC_REG_RX_PE_DELAY		(AR_MAC_REG_BASE + 0x64c)
+#define AR_MAC_REG_DYNAMIC_SIFS_ACK	(AR_MAC_REG_BASE + 0x658)
+#define AR_MAC_REG_SNIFFER		(AR_MAC_REG_BASE + 0x674)
+#define AR_MAC_REG_ACK_EXTENSION	(AR_MAC_REG_BASE + 0x690)
+#define AR_MAC_REG_EIFS_AND_SIFS	(AR_MAC_REG_BASE + 0x698)
+#define AR_MAC_REG_SLOT_TIME		(AR_MAC_REG_BASE + 0x6f0)
+#define AR_MAC_REG_AC0_CW		(AR_MAC_REG_BASE + 0xb00)
+#define AR_MAC_REG_AC1_CW		(AR_MAC_REG_BASE + 0xb04)
+#define AR_MAC_REG_AC2_CW		(AR_MAC_REG_BASE + 0xb08)
+#define AR_MAC_REG_AC3_CW		(AR_MAC_REG_BASE + 0xb0c)
+#define AR_MAC_REG_AC4_CW		(AR_MAC_REG_BASE + 0xb10)
+#define AR_MAC_REG_AC1_AC0_AIFS		(AR_MAC_REG_BASE + 0xb14)
+#define AR_MAC_REG_AC3_AC2_AIFS		(AR_MAC_REG_BASE + 0xb18)
+#define AR_MAC_REG_RETRY_MAX		(AR_MAC_REG_BASE + 0xb28)
+#define AR_MAC_REG_TXOP_NOT_ENOUGH_INDICATION	\
+					(AR_MAC_REG_BASE + 0xb30)
+#define AR_MAC_REG_AC1_AC0_TXOP		(AR_MAC_REG_BASE + 0xb44)
+#define AR_MAC_REG_AC3_AC2_TXOP		(AR_MAC_REG_BASE + 0xb48)
+#define AR_MAC_REG_BCN_HT1		(AR_MAC_REG_BASE + 0xda0)
+
+/* Possible values for register AR_USB_MODE_CTRL. */
+#define AR_USB_DS_ENA		(1 << 0)
+#define AR_USB_US_ENA		(1 << 1)
+#define AR_USB_US_PACKET_MODE	(1 << 3)
+#define AR_USB_RX_STREAM_4K	(0 << 4)
+#define AR_USB_RX_STREAM_8K	(1 << 4)
+#define AR_USB_RX_STREAM_16K	(2 << 4)
+#define AR_USB_RX_STREAM_32K	(3 << 4)
+#define AR_USB_TX_STREAM_MODE	(1 << 6)
+
+#define AR_LED0_ON	(1 << 0)
+#define AR_LED1_ON	(1 << 1)
+
+/*
+ * PHY registers.
+ */
+#define AR_PHY(reg)		(0x9800 + (reg) * 4)
+#define AR_PHY_SWITCH_COM	0x9964
+#define AR_PHY_SWITCH_CHAIN_0	0x9960
+#define AR_PHY_SETTLING		0x9844
+#define AR_PHY_DESIRED_SZ	0x9850
+#define AR_PHY_RF_CTL4		0x9834
+#define AR_PHY_RF_CTL3		0x9828
+#define AR_PHY_RXGAIN		0x9848
+#define AR_PHY_TIMING_CTRL4	0x9920
+#define AR_PHY_GAIN_2GHZ	0xa20c
+#define AR_PHY_CCA		0xc864
+
+#define AR_SEEPROM_HW_TYPE_OFFSET	0x1374
+
+#define AR_BANK4_CHUP			(1 << 0)
+#define AR_BANK4_BMODE_LF_SYNTH_FREQ	(1 << 1)
+#define AR_BANK4_AMODE_REFSEL(x)	((x) << 2)
+#define AR_BANK4_ADDR(x)		((x) << 5)
+
+/* Tx descriptor. */
+struct ar_tx_head {
+	uint16_t	len;
+	uint16_t	macctl;
+#define AR_TX_MAC_RTS		(1 <<  0)
+#define AR_TX_MAC_CTS		(1 <<  1)
+#define AR_TX_MAC_BACKOFF	(1 <<  3)
+#define AR_TX_MAC_NOACK		(1 <<  2)
+#define AR_TX_MAC_HW_DUR	(1 <<  9)
+#define AR_TX_MAC_RATE_PROBING	(1 << 15)
+
+	uint32_t	phyctl;
+/* Modulation type. */
+#define AR_TX_PHY_MT_CCK	0
+#define AR_TX_PHY_MT_OFDM	1
+#define AR_TX_PHY_MT_HT		2
+#define AR_TX_PHY_GF		(1 << 2)
+#define AR_TX_PHY_BW_SHIFT	3
+#define AR_TX_PHY_TPC_SHIFT	9
+#define AR_TX_PHY_ANTMSK(msk)	((msk) << 15)
+#define AR_TX_PHY_MCS(mcs)	((mcs) << 18)
+#define AR_TX_PHY_SHGI		(1 << 31)
+} __packed;
+
+/* USB Rx stream mode header. */
+struct ar_rx_head {
+	uint16_t	len;
+	uint16_t	tag;
+#define AR_RX_HEAD_TAG	0x4e00
+} __packed;
+
+/* Rx descriptor. */
+struct ar_rx_tail {
+	uint8_t	rssi_ant[3];
+	uint8_t	rssi_ant_ext[3];
+	uint8_t	rssi;		/* Combined RSSI. */
+	uint8_t	evm[2][6];	/* Error Vector Magnitude. */
+	uint8_t	phy_err;
+	uint8_t	sa_idx;
+	uint8_t	da_idx;
+	uint8_t	error;
+#define AR_RX_ERROR_FCS		(1 << 3)
+
+	uint8_t	status;
+/* Modulation type (same as AR_TX_PHY_MT). */
+#define AR_RX_STATUS_MT_MASK	0x3
+#define AR_RX_STATUS_MT_CCK	0
+#define AR_RX_STATUS_MT_OFDM	1
+#define AR_RX_STATUS_MT_HT	2
+#define AR_RX_STATUS_SHPREAMBLE	(1 << 3)
+} __packed;
+
+#define AR_PLCP_HDR_LEN	12
+/* Magic PLCP header for firmware notifications through Rx bulk pipe. */
+static uint8_t AR_PLCP_HDR_INTR[] = {
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+};
+
+/* Firmware command/reply header. */
+struct ar_cmd_hdr {
+	uint8_t		len;
+	uint8_t		code;
+#define AR_CMD_RREG		0x00
+#define AR_CMD_WREG		0x01
+#define AR_CMD_RMEM		0x02
+#define AR_CMD_WMEM		0x03
+#define AR_CMD_BITAND		0x04
+#define AR_CMD_BITOR		0x05
+#define AR_CMD_EKEY		0x28
+#define AR_CMD_DKEY		0x29
+#define AR_CMD_FREQUENCY	0x30
+#define AR_CMD_RF_INIT		0x31
+#define AR_CMD_SYNTH		0x32
+#define AR_CMD_FREQ_STRAT	0x33
+#define AR_CMD_ECHO		0x80
+#define AR_CMD_TALLY		0x81
+#define AR_CMD_TALLY_APD	0x82
+#define AR_CMD_CONFIG		0x83
+#define AR_CMD_RESET		0x90
+#define AR_CMD_DKRESET		0x91
+#define AR_CMD_DKTX_STATUS	0x92
+#define AR_CMD_FDC		0xa0
+#define AR_CMD_WREEPROM		0xb0
+#define AR_CMD_WFLASH		AR_CMD_WREEPROM
+#define AR_CMD_FLASH_ERASE	0xb1
+#define AR_CMD_FLASH_PROG	0xb2
+#define AR_CMD_FLASH_CHKSUM	0xb3
+#define AR_CMD_FLASH_READ	0xb4
+#define AR_CMD_FW_DL_INIT	0xb5
+#define AR_CMD_MEM_WREEPROM	0xbb
+/* Those have the 2 MSB set to 1. */
+#define AR_EVT_BEACON		0x00
+#define AR_EVT_TX_COMP		0x01
+#define AR_EVT_TBTT		0x02
+#define AR_EVT_ATIM		0x03
+
+	uint16_t	token;	/* Driver private data. */
+} __packed;
+
+/* Structure for command AR_CMD_RF_INIT/AR_CMD_FREQUENCY. */
+struct ar_cmd_frequency {
+	uint32_t	freq;
+	uint32_t	dynht2040;
+	uint32_t	htena;
+	uint32_t	delta_slope_coeff_exp;
+	uint32_t	delta_slope_coeff_man;
+	uint32_t	delta_slope_coeff_exp_shgi;
+	uint32_t	delta_slope_coeff_man_shgi;
+	uint32_t	check_loop_count;
+} __packed;
+
+/* Firmware reply for command AR_CMD_FREQUENCY. */
+struct ar_rsp_frequency {
+	uint32_t	status;
+	int32_t		noisefloor[6];
+} __packed;
+
+/* Structure for command AR_CMD_EKEY. */
+struct ar_cmd_ekey {
+	uint16_t	uid;	/* user ID */
+	uint16_t	kid;
+	uint16_t	cipher;
+#define AR_CIPHER_NONE		0
+#define AR_CIPHER_WEP64		1
+#define AR_CIPHER_TKIP		2
+#define AR_CIPHER_AES		4
+#define AR_CIPHER_WEP128	5
+#define AR_CIPHER_WEP256	6
+#define AR_CIPHER_CENC		7
+
+	uint8_t		macaddr[IEEE80211_ADDR_LEN];
+	uint8_t		key[16];
+} __packed;
+
+/* Structure for event AR_EVT_TX_COMP. */
+struct ar_evt_tx_comp {
+	uint8_t		macaddr[IEEE80211_ADDR_LEN];
+	uint32_t	phy;
+	uint16_t	status;
+#define AR_TX_STATUS_COMP	0
+#define AR_TX_STATUS_RETRY_COMP	1
+#define AR_TX_STATUS_FAILED	2
+} __packed;
+
+/* List of supported channels. */
+static const uint8_t ar_chans[] = {
+	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
+	36, 40, 44, 48, 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124,
+	128, 132, 136, 140, 149, 153, 157, 161, 165, 34, 38, 42, 46
+};
+
+/*
+ * This data is automatically generated from the "otus.ini" file.
+ * It is stored in a different way though, to reduce kernel's .rodata
+ * section overhead (5.1KB instead of 8.5KB).
+ */
+
+/* NB: offset from 0x9800. */
+static const uint16_t ar5416_phy_regs[] = {
+	0x000, 0x001, 0x002, 0x003, 0x004, 0x005, 0x006, 0x007, 0x008,
+	0x009, 0x00a, 0x00b, 0x00c, 0x00d, 0x00e, 0x00f, 0x010, 0x011,
+	0x012, 0x013, 0x014, 0x015, 0x016, 0x017, 0x018, 0x01a, 0x01b,
+	0x040, 0x041, 0x042, 0x043, 0x045, 0x046, 0x047, 0x048, 0x049,
+	0x04a, 0x04b, 0x04d, 0x04e, 0x04f, 0x051, 0x052, 0x053, 0x055,
+	0x056, 0x058, 0x059, 0x05c, 0x05d, 0x05e, 0x05f, 0x060, 0x061,
+	0x062, 0x063, 0x064, 0x065, 0x066, 0x067, 0x068, 0x069, 0x06a,
+	0x06b, 0x06c, 0x06d, 0x070, 0x071, 0x072, 0x073, 0x074, 0x075,
+	0x076, 0x077, 0x078, 0x079, 0x07a, 0x07b, 0x07c, 0x07f, 0x080,
+	0x081, 0x082, 0x083, 0x084, 0x085, 0x086, 0x087, 0x088, 0x089,
+	0x08a, 0x08b, 0x08c, 0x08d, 0x08e, 0x08f, 0x090, 0x091, 0x092,
+	0x093, 0x094, 0x095, 0x096, 0x097, 0x098, 0x099, 0x09a, 0x09b,
+	0x09c, 0x09d, 0x09e, 0x09f, 0x0a0, 0x0a1, 0x0a2, 0x0a3, 0x0a4,
+	0x0a5, 0x0a6, 0x0a7, 0x0a8, 0x0a9, 0x0aa, 0x0ab, 0x0ac, 0x0ad,
+	0x0ae, 0x0af, 0x0b0, 0x0b1, 0x0b2, 0x0b3, 0x0b4, 0x0b5, 0x0b6,
+	0x0b7, 0x0b8, 0x0b9, 0x0ba, 0x0bb, 0x0bc, 0x0bd, 0x0be, 0x0bf,
+	0x0c0, 0x0c1, 0x0c2, 0x0c3, 0x0c4, 0x0c5, 0x0c6, 0x0c7, 0x0c8,
+	0x0c9, 0x0ca, 0x0cb, 0x0cc, 0x0cd, 0x0ce, 0x0cf, 0x0d0, 0x0d1,
+	0x0d2, 0x0d3, 0x0d4, 0x0d5, 0x0d6, 0x0d7, 0x0d8, 0x0d9, 0x0da,
+	0x0db, 0x0dc, 0x0dd, 0x0de, 0x0df, 0x0e0, 0x0e1, 0x0e2, 0x0e3,
+	0x0e4, 0x0e5, 0x0e6, 0x0e7, 0x0e8, 0x0e9, 0x0ea, 0x0eb, 0x0ec,
+	0x0ed, 0x0ee, 0x0ef, 0x0f0, 0x0f1, 0x0f2, 0x0f3, 0x0f4, 0x0f5,
+	0x0f6, 0x0f7, 0x0f8, 0x0f9, 0x0fa, 0x0fb, 0x0fc, 0x0fd, 0x0fe,
+	0x0ff, 0x100, 0x103, 0x104, 0x105, 0x106, 0x107, 0x108, 0x109,
+	0x10a, 0x10b, 0x10c, 0x10d, 0x10e, 0x10f, 0x13c, 0x13d, 0x13e,
+	0x13f, 0x280, 0x281, 0x282, 0x283, 0x284, 0x285, 0x286, 0x287,
+	0x288, 0x289, 0x28a, 0x28b, 0x28c, 0x28d, 0x28e, 0x28f, 0x290,
+	0x291, 0x292, 0x293, 0x294, 0x295, 0x296, 0x297, 0x298, 0x299,
+	0x29a, 0x29b, 0x29d, 0x29e, 0x29f, 0x2c0, 0x2c1, 0x2c2, 0x2c3,
+	0x2c4, 0x2c5, 0x2c6, 0x2c7, 0x2c8, 0x2c9, 0x2ca, 0x2cb, 0x2cc,
+	0x2cd, 0x2ce, 0x2cf, 0x2d0, 0x2d1, 0x2d2, 0x2d3, 0x2d4, 0x2d5,
+	0x2d6, 0x2e2, 0x2e3, 0x2e4, 0x2e5, 0x2e6, 0x2e7, 0x2e8, 0x2e9,
+	0x2ea, 0x2eb, 0x2ec, 0x2ed, 0x2ee, 0x2ef, 0x2f0, 0x2f1, 0x2f2,
+	0x2f3, 0x2f4, 0x2f5, 0x2f6, 0x2f7, 0x2f8, 0x412, 0x448, 0x458,
+	0x683, 0x69b, 0x812, 0x848, 0x858, 0xa83, 0xa9b, 0xc19, 0xc57,
+	0xc5a, 0xc6f, 0xe9c, 0xed7, 0xed8, 0xed9, 0xeda, 0xedb, 0xedc,
+	0xedd, 0xede, 0xedf, 0xee0, 0xee1
+};
+
+static const uint32_t ar5416_phy_vals_5ghz_20mhz[] = {
+	0x00000007, 0x00000300, 0x00000000, 0xad848e19, 0x7d14e000,
+	0x9c0a9f6b, 0x00000090, 0x00000000, 0x02020200, 0x00000e0e,
+	0x0a020001, 0x0000a000, 0x00000000, 0x00000e0e, 0x00000007,
+	0x00200400, 0x206a002e, 0x1372161e, 0x001a6a65, 0x1284233c,
+	0x6c48b4e4, 0x00000859, 0x7ec80d2e, 0x31395c5e, 0x0004dd10,
+	0x409a4190, 0x050cb081, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x000007d0, 0x00000118, 0x10000fff, 0x0510081c,
+	0xd0058a15, 0x00000001, 0x00000004, 0x3f3f3f3f, 0x3f3f3f3f,
+	0x0000007f, 0xdfb81020, 0x9280b212, 0x00020028, 0x5d50e188,
+	0x00081fff, 0x00009b40, 0x00001120, 0x190fb515, 0x00000000,
+	0x00000001, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000007, 0x001fff00, 0x006f00c4, 0x03051000,
+	0x00000820, 0x038919be, 0x06336f77, 0x60f6532c, 0x08f186c8,
+	0x00046384, 0x00000000, 0x00000000, 0x00000000, 0x00000200,
+	0x64646464, 0x3c787878, 0x000000aa, 0x00000000, 0x00001042,
+	0x00000000, 0x00000040, 0x00000080, 0x000001a1, 0x000001e1,
+	0x00000021, 0x00000061, 0x00000168, 0x000001a8, 0x000001e8,
+	0x00000028, 0x00000068, 0x00000189, 0x000001c9, 0x00000009,
+	0x00000049, 0x00000089, 0x00000170, 0x000001b0, 0x000001f0,
+	0x00000030, 0x00000070, 0x00000191, 0x000001d1, 0x00000011,
+	0x00000051, 0x00000091, 0x000001b8, 0x000001f8, 0x00000038,
+	0x00000078, 0x00000199, 0x000001d9, 0x00000019, 0x00000059,
+	0x00000099, 0x000000d9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x00000000,
+	0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005,
+	0x00000008, 0x00000009, 0x0000000a, 0x0000000b, 0x0000000c,
+	0x0000000d, 0x00000010, 0x00000011, 0x00000012, 0x00000013,
+	0x00000014, 0x00000015, 0x00000018, 0x00000019, 0x0000001a,
+	0x0000001b, 0x0000001c, 0x0000001d, 0x00000020, 0x00000021,
+	0x00000022, 0x00000023, 0x00000024, 0x00000025, 0x00000028,
+	0x00000029, 0x0000002a, 0x0000002b, 0x0000002c, 0x0000002d,
+	0x00000030, 0x00000031, 0x00000032, 0x00000033, 0x00000034,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000010, 0x0000001a, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000008, 0x00000440, 0xd6be4788, 0x012e8160,
+	0x40806333, 0x00106c10, 0x009c4060, 0x1883800a, 0x018830c6,
+	0x00000400, 0x000009b5, 0x00000000, 0x00000108, 0x3f3f3f3f,
+	0x3f3f3f3f, 0x13c889af, 0x38490a20, 0x00007bb6, 0x0fff3ffc,
+	0x00000001, 0x0000a000, 0x00000000, 0x0cc75380, 0x0f0f0f01,
+	0xdfa91f01, 0x00418a11, 0x00000000, 0x09249126, 0x0a1a9caa,
+	0x1ce739ce, 0x051701ce, 0x18010000, 0x30032602, 0x48073e06,
+	0x560b4c0a, 0x641a600f, 0x7a4f6e1b, 0x8c5b7e5a, 0x9d0f96cf,
+	0xb51fa69f, 0xcb3fbd07, 0x0000d7bf, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x3fffffff, 0x3fffffff, 0x3fffffff, 0x0003ffff, 0x79a8aa1f,
+	0x08000000, 0x3f3f3f3f, 0x3f3f3f3f, 0x1ce739ce, 0x000001ce,
+	0x00000007, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f,
+	0x00000000, 0x1ce739ce, 0x000000c0, 0x00180a65, 0x0510001c,
+	0x00009b40, 0x012e8160, 0x09249126, 0x00180a65, 0x0510001c,
+	0x00009b40, 0x012e8160, 0x09249126, 0x0001c600, 0x004b6a8e,
+	0x000003ce, 0x00181400, 0x00820820, 0x066c420f, 0x0f282207,
+	0x17601685, 0x1f801104, 0x37a00c03, 0x3fc40883, 0x57c00803,
+	0x5fd80682, 0x7fe00482, 0x7f3c7bba, 0xf3307ff0
+};
+
+#ifdef notyet
+static const uint32_t ar5416_phy_vals_5ghz_40mhz[] = {
+	0x00000007, 0x000003c4, 0x00000000, 0xad848e19, 0x7d14e000,
+	0x9c0a9f6b, 0x00000090, 0x00000000, 0x02020200, 0x00000e0e,
+	0x0a020001, 0x0000a000, 0x00000000, 0x00000e0e, 0x00000007,
+	0x00200400, 0x206a002e, 0x13721c1e, 0x001a6a65, 0x1284233c,
+	0x6c48b4e4, 0x00000859, 0x7ec80d2e, 0x31395c5e, 0x0004dd10,
+	0x409a4190, 0x050cb081, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x000007d0, 0x00000230, 0x10000fff, 0x0510081c,
+	0xd0058a15, 0x00000001, 0x00000004, 0x3f3f3f3f, 0x3f3f3f3f,
+	0x0000007f, 0xdfb81020, 0x9280b212, 0x00020028, 0x5d50e188,
+	0x00081fff, 0x00009b40, 0x00001120, 0x190fb515, 0x00000000,
+	0x00000001, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000007, 0x001fff00, 0x006f00c4, 0x03051000,
+	0x00000820, 0x038919be, 0x06336f77, 0x60f6532c, 0x08f186c8,
+	0x00046384, 0x00000000, 0x00000000, 0x00000000, 0x00000200,
+	0x64646464, 0x3c787878, 0x000000aa, 0x00000000, 0x00001042,
+	0x00000000, 0x00000040, 0x00000080, 0x000001a1, 0x000001e1,
+	0x00000021, 0x00000061, 0x00000168, 0x000001a8, 0x000001e8,
+	0x00000028, 0x00000068, 0x00000189, 0x000001c9, 0x00000009,
+	0x00000049, 0x00000089, 0x00000170, 0x000001b0, 0x000001f0,
+	0x00000030, 0x00000070, 0x00000191, 0x000001d1, 0x00000011,
+	0x00000051, 0x00000091, 0x000001b8, 0x000001f8, 0x00000038,
+	0x00000078, 0x00000199, 0x000001d9, 0x00000019, 0x00000059,
+	0x00000099, 0x000000d9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x00000000,
+	0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005,
+	0x00000008, 0x00000009, 0x0000000a, 0x0000000b, 0x0000000c,
+	0x0000000d, 0x00000010, 0x00000011, 0x00000012, 0x00000013,
+	0x00000014, 0x00000015, 0x00000018, 0x00000019, 0x0000001a,
+	0x0000001b, 0x0000001c, 0x0000001d, 0x00000020, 0x00000021,
+	0x00000022, 0x00000023, 0x00000024, 0x00000025, 0x00000028,
+	0x00000029, 0x0000002a, 0x0000002b, 0x0000002c, 0x0000002d,
+	0x00000030, 0x00000031, 0x00000032, 0x00000033, 0x00000034,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000010, 0x0000001a, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000008, 0x00000440, 0xd6be4788, 0x012e8160,
+	0x40806333, 0x00106c10, 0x009c4060, 0x1883800a, 0x018830c6,
+	0x00000400, 0x000009b5, 0x00000000, 0x00000210, 0x3f3f3f3f,
+	0x3f3f3f3f, 0x13c889af, 0x38490a20, 0x00007bb6, 0x0fff3ffc,
+	0x00000001, 0x0000a000, 0x00000000, 0x0cc75380, 0x0f0f0f01,
+	0xdfa91f01, 0x00418a11, 0x00000000, 0x09249126, 0x0a1a9caa,
+	0x1ce739ce, 0x051701ce, 0x18010000, 0x30032602, 0x48073e06,
+	0x560b4c0a, 0x641a600f, 0x7a4f6e1b, 0x8c5b7e5a, 0x9d0f96cf,
+	0xb51fa69f, 0xcb3fbcbf, 0x0000d7bf, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x3fffffff, 0x3fffffff, 0x3fffffff, 0x0003ffff, 0x79a8aa1f,
+	0x08000000, 0x3f3f3f3f, 0x3f3f3f3f, 0x1ce739ce, 0x000001ce,
+	0x00000007, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f,
+	0x00000000, 0x1ce739ce, 0x000000c0, 0x00180a65, 0x0510001c,
+	0x00009b40, 0x012e8160, 0x09249126, 0x00180a65, 0x0510001c,
+	0x00009b40, 0x012e8160, 0x09249126, 0x0001c600, 0x004b6a8e,
+	0x000003ce, 0x00181400, 0x00820820, 0x066c420f, 0x0f282207,
+	0x17601685, 0x1f801104, 0x37a00c03, 0x3fc40883, 0x57c00803,
+	0x5fd80682, 0x7fe00482, 0x7f3c7bba, 0xf3307ff0
+};
+#endif
+
+#ifdef notyet
+static const uint32_t ar5416_phy_vals_2ghz_40mhz[] = {
+	0x00000007, 0x000003c4, 0x00000000, 0xad848e19, 0x7d14e000,
+	0x9c0a9f6b, 0x00000090, 0x00000000, 0x02020200, 0x00000e0e,
+	0x0a020001, 0x0000a000, 0x00000000, 0x00000e0e, 0x00000007,
+	0x00200400, 0x206a002e, 0x13721c24, 0x00197a68, 0x1284233c,
+	0x6c48b0e4, 0x00000859, 0x7ec80d2e, 0x31395c5e, 0x0004dd20,
+	0x409a4190, 0x050cb081, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000898, 0x00000268, 0x10000fff, 0x0510001c,
+	0xd0058a15, 0x00000001, 0x00000004, 0x3f3f3f3f, 0x3f3f3f3f,
+	0x0000007f, 0xdfb81020, 0x9280b212, 0x00020028, 0x5d50e188,
+	0x00081fff, 0x00009b40, 0x00001120, 0x190fb515, 0x00000000,
+	0x00000001, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000007, 0x001fff00, 0x006f00c4, 0x03051000,
+	0x00000820, 0x038919be, 0x06336f77, 0x60f6532c, 0x08f186c8,
+	0x00046384, 0x00000000, 0x00000000, 0x00000000, 0x00000200,
+	0x64646464, 0x3c787878, 0x000000aa, 0x00000000, 0x00001042,
+	0x00000000, 0x00000040, 0x00000080, 0x00000141, 0x00000181,
+	0x000001c1, 0x00000001, 0x00000041, 0x000001a8, 0x000001e8,
+	0x00000028, 0x00000068, 0x000000a8, 0x00000169, 0x000001a9,
+	0x000001e9, 0x00000029, 0x00000069, 0x00000190, 0x000001d0,
+	0x00000010, 0x00000050, 0x00000090, 0x00000151, 0x00000191,
+	0x000001d1, 0x00000011, 0x00000051, 0x00000198, 0x000001d8,
+	0x00000018, 0x00000058, 0x00000098, 0x00000159, 0x00000199,
+	0x000001d9, 0x00000019, 0x00000059, 0x00000099, 0x000000d9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x00000000,
+	0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005,
+	0x00000008, 0x00000009, 0x0000000a, 0x0000000b, 0x0000000c,
+	0x0000000d, 0x00000010, 0x00000011, 0x00000012, 0x00000013,
+	0x00000014, 0x00000015, 0x00000018, 0x00000019, 0x0000001a,
+	0x0000001b, 0x0000001c, 0x0000001d, 0x00000020, 0x00000021,
+	0x00000022, 0x00000023, 0x00000024, 0x00000025, 0x00000028,
+	0x00000029, 0x0000002a, 0x0000002b, 0x0000002c, 0x0000002d,
+	0x00000030, 0x00000031, 0x00000032, 0x00000033, 0x00000034,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000010, 0x0000001a, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x0000000e, 0x00000440, 0xd03e4788, 0x012a8160,
+	0x40806333, 0x00106c10, 0x009c4060, 0x1883800a, 0x018830c6,
+	0x00000400, 0x000009b5, 0x00000000, 0x00000210, 0x3f3f3f3f,
+	0x3f3f3f3f, 0x13c889af, 0x38490a20, 0x00007bb6, 0x0fff3ffc,
+	0x00000001, 0x0000a000, 0x00000000, 0x0cc75380, 0x0f0f0f01,
+	0xdfa91f01, 0x00418a11, 0x00000000, 0x09249126, 0x0a1a7caa,
+	0x1ce739ce, 0x051701ce, 0x18010000, 0x2e032402, 0x4a0a3c06,
+	0x621a540b, 0x764f6c1b, 0x845b7a5a, 0x950f8ccf, 0xa5cf9b4f,
+	0xbddfaf1f, 0xd1ffc93f, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x3fffffff, 0x3fffffff, 0x3fffffff, 0x0003ffff, 0x79a8aa1f,
+	0x08000000, 0x3f3f3f3f, 0x3f3f3f3f, 0x1ce739ce, 0x000001ce,
+	0x00000007, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f,
+	0x00000000, 0x1ce739ce, 0x000000c0, 0x00180a68, 0x0510001c,
+	0x00009b40, 0x012a8160, 0x09249126, 0x00180a68, 0x0510001c,
+	0x00009b40, 0x012a8160, 0x09249126, 0x0001c600, 0x004b6a8e,
+	0x000003ce, 0x00181400, 0x00820820, 0x066c420f, 0x0f282207,
+	0x17601685, 0x1f801104, 0x37a00c03, 0x3fc40883, 0x57c00803,
+	0x5fd80682, 0x7fe00482, 0x7f3c7bba, 0xf3307ff0
+};
+#endif
+
+static const uint32_t ar5416_phy_vals_2ghz_20mhz[] = {
+	0x00000007, 0x00000300, 0x00000000, 0xad848e19, 0x7d14e000,
+	0x9c0a9f6b, 0x00000090, 0x00000000, 0x02020200, 0x00000e0e,
+	0x0a020001, 0x0000a000, 0x00000000, 0x00000e0e, 0x00000007,
+	0x00200400, 0x206a002e, 0x137216a4, 0x00197a68, 0x1284233c,
+	0x6c48b0e4, 0x00000859, 0x7ec80d2e, 0x31395c5e, 0x0004dd20,
+	0x409a4190, 0x050cb081, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000898, 0x00000134, 0x10000fff, 0x0510001c,
+	0xd0058a15, 0x00000001, 0x00000004, 0x3f3f3f3f, 0x3f3f3f3f,
+	0x0000007f, 0xdfb81020, 0x9280b212, 0x00020028, 0x5d50e188,
+	0x00081fff, 0x00009b40, 0x00001120, 0x190fb515, 0x00000000,
+	0x00000001, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000007, 0x001fff00, 0x006f00c4, 0x03051000,
+	0x00000820, 0x038919be, 0x06336f77, 0x60f6532c, 0x08f186c8,
+	0x00046384, 0x00000000, 0x00000000, 0x00000000, 0x00000200,
+	0x64646464, 0x3c787878, 0x000000aa, 0x00000000, 0x00001042,
+	0x00000000, 0x00000040, 0x00000080, 0x00000141, 0x00000181,
+	0x000001c1, 0x00000001, 0x00000041, 0x000001a8, 0x000001e8,
+	0x00000028, 0x00000068, 0x000000a8, 0x00000169, 0x000001a9,
+	0x000001e9, 0x00000029, 0x00000069, 0x00000190, 0x000001d0,
+	0x00000010, 0x00000050, 0x00000090, 0x00000151, 0x00000191,
+	0x000001d1, 0x00000011, 0x00000051, 0x00000198, 0x000001d8,
+	0x00000018, 0x00000058, 0x00000098, 0x00000159, 0x00000199,
+	0x000001d9, 0x00000019, 0x00000059, 0x00000099, 0x000000d9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9,
+	0x000000f9, 0x000000f9, 0x000000f9, 0x000000f9, 0x00000000,
+	0x00000001, 0x00000002, 0x00000003, 0x00000004, 0x00000005,
+	0x00000008, 0x00000009, 0x0000000a, 0x0000000b, 0x0000000c,
+	0x0000000d, 0x00000010, 0x00000011, 0x00000012, 0x00000013,
+	0x00000014, 0x00000015, 0x00000018, 0x00000019, 0x0000001a,
+	0x0000001b, 0x0000001c, 0x0000001d, 0x00000020, 0x00000021,
+	0x00000022, 0x00000023, 0x00000024, 0x00000025, 0x00000028,
+	0x00000029, 0x0000002a, 0x0000002b, 0x0000002c, 0x0000002d,
+	0x00000030, 0x00000031, 0x00000032, 0x00000033, 0x00000034,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000035, 0x00000035, 0x00000035, 0x00000035,
+	0x00000035, 0x00000010, 0x0000001a, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x0000000e, 0x00000440, 0xd03e4788, 0x012a8160,
+	0x40806333, 0x00106c10, 0x009c4060, 0x1883800a, 0x018830c6,
+	0x00000400, 0x000009b5, 0x00000000, 0x00000108, 0x3f3f3f3f,
+	0x3f3f3f3f, 0x13c889af, 0x38490a20, 0x00007bb6, 0x0fff3ffc,
+	0x00000001, 0x0000a000, 0x00000000, 0x0cc75380, 0x0f0f0f01,
+	0xdfa91f01, 0x00418a11, 0x00000000, 0x09249126, 0x0a1a7caa,
+	0x1ce739ce, 0x051701ce, 0x18010000, 0x2e032402, 0x4a0a3c06,
+	0x621a540b, 0x764f6c1b, 0x845b7a5a, 0x950f8ccf, 0xa5cf9b4f,
+	0xbddfaf1f, 0xd1ffc93f, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x3fffffff, 0x3fffffff, 0x3fffffff, 0x0003ffff, 0x79a8aa1f,
+	0x08000000, 0x3f3f3f3f, 0x3f3f3f3f, 0x1ce739ce, 0x000001ce,
+	0x00000007, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00000000, 0x3f3f3f3f, 0x3f3f3f3f, 0x3f3f3f3f,
+	0x00000000, 0x1ce739ce, 0x000000c0, 0x00180a68, 0x0510001c,
+	0x00009b40, 0x012a8160, 0x09249126, 0x00180a68, 0x0510001c,
+	0x00009b40, 0x012a8160, 0x09249126, 0x0001c600, 0x004b6a8e,
+	0x000003ce, 0x00181400, 0x00820820, 0x066c420f, 0x0f282207,
+	0x17601685, 0x1f801104, 0x37a00c03, 0x3fc40883, 0x57c00803,
+	0x5fd80682, 0x7fe00482, 0x7f3c7bba, 0xf3307ff0
+};
+
+/* NB: offset from 0x9800. */
+static const uint8_t ar5416_banks_regs[] = {
+	0x2c, 0x38, 0x2c, 0x3b, 0x2c, 0x38, 0x3c, 0x2c, 0x3a, 0x2c, 0x39,
+	0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c,
+	0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c,
+	0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c,
+	0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c,
+	0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x2c, 0x38, 0x2c, 0x2c,
+	0x2c, 0x3c
+};
+
+static const uint32_t ar5416_banks_vals_5ghz[] = {
+	0x1e5795e5, 0x02008020, 0x02108421, 0x00000008, 0x0e73ff17,
+	0x00000420, 0x01400018, 0x000001a1, 0x00000001, 0x00000013,
+	0x00000002, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00004000, 0x00006c00, 0x00002c00, 0x00004800,
+	0x00004000, 0x00006000, 0x00001000, 0x00004000, 0x00007c00,
+	0x00007c00, 0x00007c00, 0x00007c00, 0x00007c00, 0x00087c00,
+	0x00007c00, 0x00005400, 0x00000c00, 0x00001800, 0x00007c00,
+	0x00006c00, 0x00006c00, 0x00007c00, 0x00002c00, 0x00003c00,
+	0x00003800, 0x00001c00, 0x00000800, 0x00000408, 0x00004c15,
+	0x00004188, 0x0000201e, 0x00010408, 0x00000801, 0x00000c08,
+	0x0000181e, 0x00001016, 0x00002800, 0x00004010, 0x0000081c,
+	0x00000115, 0x00000015, 0x00000066, 0x0000001c, 0x00000000,
+	0x00000004, 0x00000015, 0x0000001f, 0x00000000, 0x000000a0,
+	0x00000000, 0x00000040, 0x0000001c
+};
+
+static const uint32_t ar5416_banks_vals_2ghz[] = {
+	0x1e5795e5, 0x02008020, 0x02108421, 0x00000008, 0x0e73ff17,
+	0x00000420, 0x01c00018, 0x000001a1, 0x00000001, 0x00000013,
+	0x00000002, 0x00000000, 0x00000000, 0x00000000, 0x00000000,
+	0x00000000, 0x00004000, 0x00006c00, 0x00002c00, 0x00004800,
+	0x00004000, 0x00006000, 0x00001000, 0x00004000, 0x00007c00,
+	0x00007c00, 0x00007c00, 0x00007c00, 0x00007c00, 0x00087c00,
+	0x00007c00, 0x00005400, 0x00000c00, 0x00001800, 0x00007c00,
+	0x00006c00, 0x00006c00, 0x00007c00, 0x00002c00, 0x00003c00,
+	0x00003800, 0x00001c00, 0x00000800, 0x00000408, 0x00004c15,
+	0x00004188, 0x0000201e, 0x00010408, 0x00000801, 0x00000c08,
+	0x0000181e, 0x00001016, 0x00002800, 0x00004010, 0x0000081c,
+	0x00000115, 0x00000015, 0x00000066, 0x0000001c, 0x00000000,
+	0x00000004, 0x00000015, 0x0000001f, 0x00000400, 0x000000a0,
+	0x00000000, 0x00000040, 0x0000001c
+};
+
+/*
+ * EEPROM.
+ */
+/* Possible flags for opCapFlags. */
+#define AR5416_OPFLAGS_11A	0x01
+#define AR5416_OPFLAGS_11G	0x02
+#define AR5416_OPFLAGS_5G_HT40	0x04
+#define AR5416_OPFLAGS_2G_HT40	0x08
+#define AR5416_OPFLAGS_5G_HT20	0x10
+#define AR5416_OPFLAGS_2G_HT20	0x20
+
+#define AR5416_NUM_5G_CAL_PIERS		8
+#define AR5416_NUM_2G_CAL_PIERS		4
+#define AR5416_NUM_5G_20_TARGET_POWERS	8
+#define AR5416_NUM_5G_40_TARGET_POWERS	8
+#define AR5416_NUM_2G_CCK_TARGET_POWERS	3
+#define AR5416_NUM_2G_20_TARGET_POWERS	4
+#define AR5416_NUM_2G_40_TARGET_POWERS	4
+#define AR5416_NUM_CTLS			24
+#define AR5416_NUM_BAND_EDGES		8
+#define AR5416_NUM_PD_GAINS		4
+#define AR5416_PD_GAIN_ICEPTS		5
+#define AR5416_EEPROM_MODAL_SPURS	5
+#define AR5416_MAX_CHAINS		2
+
+typedef struct BaseEepHeader {
+	uint16_t	length;
+	uint16_t	checksum;
+	uint16_t	version;
+	uint8_t		opCapFlags;
+	uint8_t		eepMisc;
+	uint16_t	regDmn[2];
+	uint8_t		macAddr[6];
+	uint8_t		rxMask;
+	uint8_t		txMask;
+	uint16_t	rfSilent;
+	uint16_t	blueToothOptions;
+	uint16_t	deviceCap;
+	uint32_t	binBuildNumber;
+	uint8_t		deviceType;
+	uint8_t		futureBase[33];
+} __packed BASE_EEP_HEADER;
+
+typedef struct spurChanStruct {
+	uint16_t	spurChan;
+	uint8_t		spurRangeLow;
+	uint8_t		spurRangeHigh;
+} __packed SPUR_CHAN;
+
+typedef struct ModalEepHeader {
+	uint32_t	antCtrlChain[AR5416_MAX_CHAINS];
+	uint32_t	antCtrlCommon;
+	int8_t		antennaGainCh[AR5416_MAX_CHAINS];
+	uint8_t		switchSettling;
+	uint8_t		txRxAttenCh[AR5416_MAX_CHAINS];
+	uint8_t		rxTxMarginCh[AR5416_MAX_CHAINS];
+	uint8_t		adcDesiredSize;
+	int8_t		pgaDesiredSize;
+	uint8_t		xlnaGainCh[AR5416_MAX_CHAINS];
+	uint8_t		txEndToXpaOff;
+	uint8_t		txEndToRxOn;
+	uint8_t		txFrameToXpaOn;
+	uint8_t		thresh62;
+	uint8_t		noiseFloorThreshCh[AR5416_MAX_CHAINS];
+	uint8_t		xpdGain;
+	uint8_t		xpd;
+	int8_t		iqCalICh[AR5416_MAX_CHAINS];
+	int8_t		iqCalQCh[AR5416_MAX_CHAINS];
+	uint8_t		pdGainOverlap;
+	uint8_t		ob;
+	uint8_t		db;
+	uint8_t		xpaBiasLvl;
+	uint8_t		pwrDecreaseFor2Chain;
+	uint8_t		pwrDecreaseFor3Chain;
+	uint8_t		txFrameToDataStart;
+	uint8_t		txFrameToPaOn;
+	uint8_t		ht40PowerIncForPdadc;
+	uint8_t		bswAtten[AR5416_MAX_CHAINS];
+	uint8_t		bswMargin[AR5416_MAX_CHAINS];
+	uint8_t		swSettleHt40;
+	uint8_t		futureModal[22];
+	SPUR_CHAN	spurChans[AR5416_EEPROM_MODAL_SPURS];
+} __packed MODAL_EEP_HEADER;
+
+typedef struct calDataPerFreq {
+	uint8_t		pwrPdg[AR5416_NUM_PD_GAINS][AR5416_PD_GAIN_ICEPTS];
+	uint8_t		vpdPdg[AR5416_NUM_PD_GAINS][AR5416_PD_GAIN_ICEPTS];
+} __packed CAL_DATA_PER_FREQ;
+
+typedef struct CalTargetPowerLegacy {
+	uint8_t		bChannel;
+	uint8_t		tPow2x[4];
+} __packed CAL_TARGET_POWER_LEG;
+
+typedef struct CalTargetPowerHt {
+	uint8_t		bChannel;
+	uint8_t		tPow2x[8];
+} __packed CAL_TARGET_POWER_HT;
+
+typedef struct CalCtlEdges {
+	uint8_t		bChannel;
+	uint8_t		tPowerFlag;
+} __packed CAL_CTL_EDGES;
+
+typedef struct CalCtlData {
+	CAL_CTL_EDGES	ctlEdges[AR5416_MAX_CHAINS][AR5416_NUM_BAND_EDGES];
+} __packed CAL_CTL_DATA;
+
+typedef struct ar5416eeprom {
+	BASE_EEP_HEADER		baseEepHeader;
+	uint8_t			custData[64];
+	MODAL_EEP_HEADER	modalHeader[2];
+	uint8_t			calFreqPier5G[AR5416_NUM_5G_CAL_PIERS];
+	uint8_t			calFreqPier2G[AR5416_NUM_2G_CAL_PIERS];
+	CAL_DATA_PER_FREQ	calPierData5G[AR5416_MAX_CHAINS]
+					     [AR5416_NUM_5G_CAL_PIERS];
+	CAL_DATA_PER_FREQ	calPierData2G[AR5416_MAX_CHAINS]
+					     [AR5416_NUM_2G_CAL_PIERS];
+	CAL_TARGET_POWER_LEG	calTPow5G[AR5416_NUM_5G_20_TARGET_POWERS];
+	CAL_TARGET_POWER_HT	calTPow5GHT20[AR5416_NUM_5G_20_TARGET_POWERS];
+	CAL_TARGET_POWER_HT	calTPow5GHT40[AR5416_NUM_5G_40_TARGET_POWERS];
+	CAL_TARGET_POWER_LEG	calTPowCck[AR5416_NUM_2G_CCK_TARGET_POWERS];
+	CAL_TARGET_POWER_LEG	calTPow2G[AR5416_NUM_2G_20_TARGET_POWERS];
+	CAL_TARGET_POWER_HT	calTPow2GHT20[AR5416_NUM_2G_20_TARGET_POWERS];
+	CAL_TARGET_POWER_HT	calTPow2GHT40[AR5416_NUM_2G_40_TARGET_POWERS];
+	uint8_t			ctlIndex[AR5416_NUM_CTLS];
+	CAL_CTL_DATA		ctlData[AR5416_NUM_CTLS];
+	uint8_t			padding;
+} __packed AR5416_EEPROM;
+
+/* Default EDCA parameters for when QoS is disabled. */
+static const struct ieee80211_edca_ac_params otus_edca_def[EDCA_NUM_AC] = {
+	{ 4, 10, 3,  0 },
+	{ 4, 10, 7,  0 },
+	{ 3,  4, 2, 94 },
+	{ 2,  3, 2, 47 }
+};
+
+
+
+#define OTUS_TX_DATA_LIST_COUNT	8
+#define OTUS_RX_DATA_LIST_COUNT	1
+
+#define OTUS_CMD_TIMEOUT	1000
+#define OTUS_TX_TIMEOUT		1000
+
+#define OTUS_UID(aid)		(IEEE80211_AID(aid) + 4)
+
+#define OTUS_MAX_TXCMDSZ	64
+#define OTUS_RXBUFSZ		(8 * 1024)
+#define OTUS_TXBUFSZ		(4 * 1024)
+
+#define OTUS_RIDX_CCK1		 0
+#define OTUS_RIDX_OFDM6		 4
+#define OTUS_RIDX_OFDM24	 8
+#define OTUS_RIDX_MAX		11
+static const struct otus_rate {
+	uint8_t	rate;
+	uint8_t	mcs;
+} otus_rates[] = {
+	{   2, 0x0 },
+	{   4, 0x1 },
+	{  11, 0x2 },
+	{  22, 0x3 },
+	{  12, 0xb },
+	{  18, 0xf },
+	{  24, 0xa },
+	{  36, 0xe },
+	{  48, 0x9 },
+	{  72, 0xd },
+	{  96, 0x8 },
+	{ 108, 0xc }
+};
+
+struct otus_rx_radiotap_header {
+	struct ieee80211_radiotap_header wr_ihdr;
+	uint8_t		wr_flags;
+	uint8_t		wr_rate;
+	uint16_t	wr_chan_freq;
+	uint16_t	wr_chan_flags;
+	uint8_t		wr_antsignal;
+} __packed;
+
+#define OTUS_RX_RADIOTAP_PRESENT			\
+	(1 << IEEE80211_RADIOTAP_FLAGS |		\
+	 1 << IEEE80211_RADIOTAP_RATE |			\
+	 1 << IEEE80211_RADIOTAP_CHANNEL |		\
+	 1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL)
+
+struct otus_tx_radiotap_header {
+	struct ieee80211_radiotap_header wt_ihdr;
+	uint8_t		wt_flags;
+	uint8_t		wt_rate;
+	uint16_t	wt_chan_freq;
+	uint16_t	wt_chan_flags;
+} __packed;
+
+#define OTUS_TX_RADIOTAP_PRESENT			\
+	(1 << IEEE80211_RADIOTAP_FLAGS |		\
+	 1 << IEEE80211_RADIOTAP_RATE |			\
+	 1 << IEEE80211_RADIOTAP_CHANNEL)
+
+struct otus_softc;
+
+struct otus_tx_cmd {
+	usbd_xfer_handle	xfer;
+	uint8_t			*buf;
+	void			*odata;
+	uint16_t		token;
+	uint8_t			done;
+};
+
+struct otus_rx_data {
+	struct otus_softc	*sc;
+	usbd_xfer_handle	xfer;
+	uint8_t			*buf;
+};
+
+struct otus_tx_data {
+	struct otus_softc	*sc;
+	usbd_xfer_handle	xfer;
+	uint8_t			*buf;
+};
+
+struct otus_host_cmd {
+	void	(*cb)(struct otus_softc *, void *);
+	uint8_t	data[256];
+};
+
+#define OTUS_HOST_CMD_RING_COUNT	32
+struct otus_host_cmd_ring {
+	struct otus_host_cmd	cmd[OTUS_HOST_CMD_RING_COUNT];
+	int			cur;
+	int			next;
+	int			queued;
+};
+
+struct otus_node {
+	struct ieee80211_node		ni;
+	struct ieee80211_amrr_node	amn;
+	uint8_t				ridx[IEEE80211_RATE_MAXSIZE];
+};
+
+struct otus_cmd_newstate {
+	enum ieee80211_state	state;
+	int			arg;
+};
+
+struct otus_cmd_key {
+	struct ieee80211_key	key;
+	uint16_t		associd;
+};
+
+struct otus_softc {
+	struct device			sc_dev;
+	struct ieee80211com		sc_ic;
+	int				(*sc_newstate)(struct ieee80211com *,
+					    enum ieee80211_state, int);
+	void				(*sc_led_newstate)(struct otus_softc *);
+
+	usbd_device_handle		sc_udev;
+	usbd_interface_handle		sc_iface;
+
+	struct ar5416eeprom		eeprom;
+
+	usbd_pipe_handle		data_tx_pipe;
+	usbd_pipe_handle		data_rx_pipe;
+	usbd_pipe_handle		cmd_tx_pipe;
+	usbd_pipe_handle		cmd_rx_pipe;
+	uint8_t 			*ibuf;
+
+	int				sc_if_flags;
+	int				sc_tx_timer;
+	int				fixed_ridx;
+
+	struct ieee80211_channel	*sc_curchan;
+
+	struct usb_task			sc_task;
+	struct timeout			scan_to;
+	struct timeout			calib_to;
+	struct ieee80211_amrr		amrr;
+
+	int				write_idx;
+	int				tx_cur;
+	int				tx_queued;
+	uint32_t			led_state;
+
+	const uint32_t			*phy_vals;
+
+	struct {
+		uint32_t	reg;
+		uint32_t	val;
+	} __packed			write_buf[AR_MAX_WRITE_IDX + 1];
+
+	struct otus_host_cmd_ring	cmdq;
+	struct otus_tx_cmd		tx_cmd;
+	struct otus_tx_data		tx_data[OTUS_TX_DATA_LIST_COUNT];
+	struct otus_rx_data		rx_data[OTUS_RX_DATA_LIST_COUNT];
+
+#if NBPFILTER > 0
+	caddr_t				sc_drvbpf;
+
+	union {
+		struct otus_rx_radiotap_header th;
+		uint8_t	pad[64];
+	}				sc_rxtapu;
+#define sc_rxtap	sc_rxtapu.th
+	int				sc_rxtap_len;
+
+	union {
+		struct otus_tx_radiotap_header th;
+		uint8_t	pad[64];
+	}				sc_txtapu;
+#define sc_txtap	sc_txtapu.th
+	int				sc_txtap_len;
+#endif
+};