diff --git a/sys/dev/rtwn/if_rtwn.c b/sys/dev/rtwn/if_rtwn.c
index acfa1c603a42..fa8e8063237b 100644
--- a/sys/dev/rtwn/if_rtwn.c
+++ b/sys/dev/rtwn/if_rtwn.c
@@ -382,7 +382,8 @@ rtwn_sysctlattach(struct rtwn_softc *sc)
 	if (sc->sc_hwcrypto >= RTWN_CRYPTO_MAX)
 		sc->sc_hwcrypto = RTWN_CRYPTO_FULL;
 
-	sc->sc_ratectl_sysctl = RTWN_RATECTL_NET80211;
+//	sc->sc_ratectl_sysctl = RTWN_RATECTL_NET80211;
+	sc->sc_ratectl_sysctl = RTWN_RATECTL_FW;
 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
 	    "ratectl", CTLFLAG_RDTUN, &sc->sc_ratectl_sysctl,
 	    sc->sc_ratectl_sysctl, "Select rate control mechanism: "
@@ -964,6 +965,7 @@ rtwn_tsf_sync_adhoc_task(void *arg, int pending)
 	sc->sc_flags |= RTWN_RCR_LOCKED;
 
 	/* Enable synchronization. */
+	/* XXX HALify */
 	rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
 	    R92C_BCN_CTRL_DIS_TSF_UDT0, 0);
 
@@ -971,6 +973,7 @@ rtwn_tsf_sync_adhoc_task(void *arg, int pending)
 	rtwn_delay(sc, ni->ni_intval * 5 * 1000);
 
 	/* Disable synchronization. */
+	/* XXX HALify */
 	rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
 	    0, R92C_BCN_CTRL_DIS_TSF_UDT0);
 
@@ -997,6 +1000,7 @@ rtwn_tsf_sync_enable(struct rtwn_softc *sc, struct ieee80211vap *vap)
 	switch (vap->iv_opmode) {
 	case IEEE80211_M_STA:
 		/* Enable TSF synchronization. */
+		/* XXX HALify */
 		rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
 		    R92C_BCN_CTRL_DIS_TSF_UDT0, 0);
 		/* Enable TSF beacon handling, needed for RA */
@@ -1143,6 +1147,7 @@ rtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 		/* Disable TSF synchronization / beaconing. */
 		rtwn_beacon_enable(sc, uvp->id, 0);
 		rtwn_sta_beacon_enable(sc, uvp->id, 0);
+		/* XXX HALify */
 		rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
 		    0, R92C_BCN_CTRL_DIS_TSF_UDT0);
 
@@ -1854,6 +1859,12 @@ rtwn_node_free(struct ieee80211_node *ni)
 static void
 rtwn_init_beacon_reg(struct rtwn_softc *sc)
 {
+
+	/*
+	 * Note: R92C_BCN_CTRL_EN_BCN needs to be set in at least
+	 * BCN_CTRL(0) or BCN_CTRL(1) for firmware rate control to
+	 * function.
+	 */
 	rtwn_write_1(sc, R92C_BCN_CTRL(0), R92C_BCN_CTRL_DIS_TSF_UDT0);
 	rtwn_write_1(sc, R92C_BCN_CTRL(1), R92C_BCN_CTRL_DIS_TSF_UDT0);
 	rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
diff --git a/sys/dev/rtwn/if_rtwn_rx.c b/sys/dev/rtwn/if_rtwn_rx.c
index b1465dd80ee7..cfdc391e9661 100644
--- a/sys/dev/rtwn/if_rtwn_rx.c
+++ b/sys/dev/rtwn/if_rtwn_rx.c
@@ -132,6 +132,11 @@ rtwn_set_basicrates(struct rtwn_softc *sc, uint32_t rates)
 	RTWN_DPRINTF(sc, RTWN_DEBUG_RA, "%s: rates 0x%08X\n", __func__, rates);
 
 	rtwn_setbits_4(sc, R92C_RRSR, R92C_RRSR_RATE_BITMAP_M, rates);
+
+	/* TODO: R92C_INIRTS_RATE_SEL */
+
+	/* XXX TODO: default to OFDM18? */
+	rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, RTWN_RIDX_OFDM18);
 }
 
 static void
diff --git a/sys/dev/rtwn/if_rtwn_tx.c b/sys/dev/rtwn/if_rtwn_tx.c
index c59d1de1dea8..a8fd4cf3e075 100644
--- a/sys/dev/rtwn/if_rtwn_tx.c
+++ b/sys/dev/rtwn/if_rtwn_tx.c
@@ -120,6 +120,7 @@ rtwn_tx_data(struct rtwn_softc *sc, struct ieee80211_node *ni,
 	bool force_rate = false;
 	u_int cipher;
 	int ismcast;
+	bool force_rate = false;
 
 	RTWN_ASSERT_LOCKED(sc);
 
diff --git a/sys/dev/rtwn/rtl8192c/r92c_chan.c b/sys/dev/rtwn/rtl8192c/r92c_chan.c
index f93159a3c94e..eb6e1ac82b7a 100644
--- a/sys/dev/rtwn/rtl8192c/r92c_chan.c
+++ b/sys/dev/rtwn/rtl8192c/r92c_chan.c
@@ -316,7 +316,11 @@ r92c_set_bw40(struct rtwn_softc *sc, uint8_t chan, int prichlo)
 	struct r92c_softc *rs = sc->sc_priv;
 
 	rtwn_setbits_1(sc, R92C_BWOPMODE, R92C_BWOPMODE_20MHZ, 0);
-	rtwn_setbits_1(sc, R92C_RRSR + 2, 0x6f, (prichlo ? 1 : 2) << 5);
+
+	/* This is specifically for the RTL8192C; different for the RTL8188E */
+	/* TODO: triple / quadruple check this */
+	rtwn_setbits_4(sc, R92C_RRSR, R92C_RRSR_RSC_SUBCHNL_MASK,
+	    (prichlo ? R92C_RRSR_RSC_UPSUBCHNL : R92C_RRSR_RSC_LOWSUBCHNL));
 
 	rtwn_bb_setbits(sc, R92C_FPGA0_RFMOD, 0, R92C_RFMOD_40MHZ);
 	rtwn_bb_setbits(sc, R92C_FPGA1_RFMOD, 0, R92C_RFMOD_40MHZ);
diff --git a/sys/dev/rtwn/rtl8192c/r92c_fw.c b/sys/dev/rtwn/rtl8192c/r92c_fw.c
index dca50dbf0396..173151f4f3d3 100644
--- a/sys/dev/rtwn/rtl8192c/r92c_fw.c
+++ b/sys/dev/rtwn/rtl8192c/r92c_fw.c
@@ -177,10 +177,16 @@ r92c_send_ra_cmd(struct rtwn_softc *sc, int macid, uint32_t rates,
 		mode = R92C_RAID_11BG;
 	else
 		mode = R92C_RAID_11B;
+
 	cmd.macid = macid | R92C_CMD_MACID_VALID;
 	if (shortgi)
 		cmd.macid |= R92C_CMD_MACID_SGI;
-	cmd.mask = htole32(mode << 28 | rates);
+	cmd.mask = htole32(mode << 28 | rates & 0x0fffffff);
+
+	device_printf(sc->sc_dev,
+	    "%s: macid=0x%02x, mask=0x%08x\n",
+	    __func__, cmd.macid, cmd.mask);
+
 	error = r92c_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
 	if (error != 0) {
 		device_printf(sc->sc_dev,
@@ -225,6 +231,10 @@ r92c_init_ra(struct rtwn_softc *sc, int macid)
 	un->ht_rate_mask = htrates;
 	RTWN_NT_UNLOCK(sc);
 
+	device_printf(sc->sc_dev,
+	    "%s: rates=0x%08x, htrates=0x%08x, maxrate=%d\n",
+	    __func__, rates, htrates, maxrate);
+
 #ifndef RTWN_WITHOUT_UCODE
 	if (sc->sc_ratectl == RTWN_RATECTL_FW) {
 		uint32_t fw_rates;
@@ -349,12 +359,20 @@ r92c_set_rssi(struct rtwn_softc *sc)
 		rn = RTWN_NODE(ni);
 		cmd.macid = i;
 		cmd.pwdb = rn->avg_pwdb;
-		RTWN_DPRINTF(sc, RTWN_DEBUG_RSSI,
-		    "%s: sending RSSI command (macid %d, rssi %d)\n",
-		    __func__, i, rn->avg_pwdb);
 
 		RTWN_NT_UNLOCK(sc);
+
+		RTWN_DPRINTF(sc, RTWN_DEBUG_RSSI | RTWN_DEBUG_RA,
+		    "%s: sending RSSI command (macid %d, rssi %d), "
+		    "inidata ridx=0x%02x\n",
+		    __func__, i, rn->avg_pwdb,
+		    rtwn_read_1(sc, R92C_INIDATA_RATE_SEL(i)));
+
+		/*
+		 * Send RSSI command
+		 */
 		r92c_fw_cmd(sc, R92C_CMD_RSSI_SETTING, &cmd, sizeof(cmd));
+
 		RTWN_NT_LOCK(sc);
 	}
 	RTWN_NT_UNLOCK(sc);
@@ -369,12 +387,14 @@ r92c_ratectl_tx_complete(struct rtwn_softc *sc, uint8_t *buf, int len)
 	uint8_t macid;
 	int ntries;
 
+#if 0
 	if (sc->sc_ratectl != RTWN_RATECTL_NET80211) {
 		/* shouldn't happen */
 		device_printf(sc->sc_dev, "%s called while ratectl = %d!\n",
 		    __func__, sc->sc_ratectl);
 		return;
 	}
+#endif
 
 	rpt = (struct r92c_c2h_tx_rpt *)buf;
 	if (len != sizeof(*rpt)) {
@@ -390,6 +410,12 @@ r92c_ratectl_tx_complete(struct rtwn_softc *sc, uint8_t *buf, int len)
 	    __func__, rpt->rptb0, rpt->rptb1, rpt->queue_time_low,
 	    rpt->queue_time_high, rpt->rptb4, rpt->rptb5, rpt->rptb6,
 	    rpt->rptb7);
+	RTWN_DPRINTF(sc, RTWN_DEBUG_INTR,
+	    "%s: ok=%d life_expire=%d retry_over=%d\n",
+	    __func__,
+	    !! (rpt->rptb7 & R92C_RPTB7_PKT_OK),
+	    !! (rpt->rptb6 & R92C_RPTB6_LIFE_EXPIRE),
+	    !! (rpt->rptb6 & R92C_RPTB6_RETRY_OVER));
 
 	macid = MS(rpt->rptb5, R92C_RPTB5_MACID);
 	if (macid > sc->macid_limit) {
@@ -419,7 +445,8 @@ r92c_ratectl_tx_complete(struct rtwn_softc *sc, uint8_t *buf, int len)
 			txs.status = IEEE80211_RATECTL_TX_FAIL_EXPIRED;
 		else
 			txs.status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
-		ieee80211_ratectl_tx_complete(ni, &txs);
+		if (sc->sc_ratectl == RTWN_RATECTL_NET80211)
+			ieee80211_ratectl_tx_complete(ni, &txs);
 	} else {
 		RTWN_DPRINTF(sc, RTWN_DEBUG_INTR, "%s: macid %u, ni is NULL\n",
 		    __func__, macid);
diff --git a/sys/dev/rtwn/rtl8192c/r92c_tx.c b/sys/dev/rtwn/rtl8192c/r92c_tx.c
index d5cbc3ad9db9..e5a468308a7e 100644
--- a/sys/dev/rtwn/rtl8192c/r92c_tx.c
+++ b/sys/dev/rtwn/rtl8192c/r92c_tx.c
@@ -61,11 +61,18 @@ r92c_tx_get_sco(struct rtwn_softc *sc, struct ieee80211_channel *c)
 		return (R92C_TXDW4_SCO_SCB);
 }
 
+/*
+ * TODO: this is only applicable for 8188EU (no rate control), or
+ * non-rate control config?
+ */
 static void
 r92c_tx_set_ht40(struct rtwn_softc *sc, void *buf, struct ieee80211_node *ni)
 {
 	struct r92c_tx_desc *txd = (struct r92c_tx_desc *)buf;
 
+	if (sc->sc_ratectl == RTWN_RATECTL_FW)
+		return;
+
 	if (ieee80211_ht_check_tx_ht40(ni)) {
 		int extc_offset;
 
@@ -77,17 +84,34 @@ r92c_tx_set_ht40(struct rtwn_softc *sc, void *buf, struct ieee80211_node *ni)
 
 static void
 r92c_tx_protection(struct rtwn_softc *sc, struct r92c_tx_desc *txd,
-    enum ieee80211_protmode mode, uint8_t ridx)
+    enum ieee80211_protmode mode, uint8_t ridx, bool force_ht)
 {
+#if 0
 	struct ieee80211com *ic = &sc->sc_ic;
 	uint8_t rate;
+#endif
+
+#if 0
+	device_printf(sc->sc_dev,
+	    "%s: called; mode=%d, ridx=%d force_ht=%d\n",
+	    __func__,
+	    mode, ridx, force_ht);
+#endif
+
+	/*
+	 * Note: for firmware rate control we don't know what rate is
+	 * being transmitted, so for HT frames it should be bumped
+	 * to something like OFDM24.
+	 */
 
 	switch (mode) {
 	case IEEE80211_PROT_CTSONLY:
 		txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF);
+//		txd->txdw4 |= htole32(R92C_TXDW4_HWRTSEN);
 		break;
 	case IEEE80211_PROT_RTSCTS:
 		txd->txdw4 |= htole32(R92C_TXDW4_RTSEN);
+//		txd->txdw4 |= htole32(R92C_TXDW4_HWRTSEN);
 		break;
 	default:
 		break;
@@ -95,19 +119,16 @@ r92c_tx_protection(struct rtwn_softc *sc, struct r92c_tx_desc *txd,
 
 	if (mode == IEEE80211_PROT_CTSONLY ||
 	    mode == IEEE80211_PROT_RTSCTS) {
-		if (RTWN_RATE_IS_HT(ridx))
-			rate = rtwn_ctl_mcsrate(ic->ic_rt, ridx);
-		else
-			rate = ieee80211_ctl_rate(ic->ic_rt, ridx2rate[ridx]);
-		ridx = rate2ridx(IEEE80211_RV(rate));
-
+		ridx = RTWN_RIDX_OFDM24;
 		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, ridx));
 		/* RTS rate fallback limit (max). */
 		txd->txdw5 |= htole32(SM(R92C_TXDW5_RTSRATE_FB_LMT, 0xf));
-
-		if (RTWN_RATE_IS_CCK(ridx) && ridx != RTWN_RIDX_CCK1 &&
+#if 0
+		if (force_ht == false && RTWN_RATE_IS_CCK(ridx)
+		    && ridx != RTWN_RIDX_CCK1 &&
 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
 			txd->txdw4 |= htole32(R92C_TXDW4_RTS_SHORT);
+#endif
 	}
 }
 
@@ -257,6 +278,14 @@ r92c_check_enable_ccx_report(struct rtwn_softc *sc, int macid)
 	return true;
 }
 
+/*
+ * TODO: this needs quite a bit of cleaning up, and there may be
+ * enough differences between RTL8192CU, RTL8192EU, and RTL8188EU
+ * to justify creating three separate ones.
+ *
+ * Go look at rtl8xxxu and rtlwifi to figure out what's really
+ * necessary.
+ */
 void
 r92c_fill_tx_desc(struct rtwn_softc *sc, struct ieee80211_node *ni,
     struct mbuf *m, void *buf, uint8_t ridx, bool force_rate, int maxretry)
@@ -272,11 +301,13 @@ r92c_fill_tx_desc(struct rtwn_softc *sc, struct ieee80211_node *ni,
 	enum ieee80211_protmode prot;
 	uint8_t type, tid, qos, qsel;
 	int hasqos, ismcast, macid;
+	bool ismgmt;
 
 	wh = mtod(m, struct ieee80211_frame *);
 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 	hasqos = IEEE80211_QOS_HAS_SEQ(wh);
 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
+	ismgmt = IEEE80211_IS_MGMT(wh);
 
 	/* Select TX ring for this frame. */
 	if (hasqos) {
@@ -290,8 +321,17 @@ r92c_fill_tx_desc(struct rtwn_softc *sc, struct ieee80211_node *ni,
 	/* Fill Tx descriptor. */
 	txd = (struct r92c_tx_desc *)buf;
 	txd->flags0 |= R92C_FLAGS0_LSG | R92C_FLAGS0_FSG;
-	if (ismcast)
+	if (ismcast) {
 		txd->flags0 |= R92C_FLAGS0_BMCAST;
+	}
+
+	(void) ismgmt;
+
+	if (ismgmt) {
+		txd->txdw5 |= htole32(R92C_TXDW5_RTY_LMT_ENA);
+		txd->txdw5 |= htole32(SM(R92C_TXDW5_RTY_LMT,
+		    maxretry));
+	}
 
 	if (IEEE80211_IS_QOSDATA(wh))
 		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
@@ -303,12 +343,28 @@ r92c_fill_tx_desc(struct rtwn_softc *sc, struct ieee80211_node *ni,
 		/* Unicast frame, check if an ACK is expected. */
 		if (!qos || (qos & IEEE80211_QOS_ACKPOLICY) !=
 		    IEEE80211_QOS_ACKPOLICY_NOACK) {
-			txd->txdw5 |= htole32(R92C_TXDW5_RTY_LMT_ENA);
-			txd->txdw5 |= htole32(SM(R92C_TXDW5_RTY_LMT,
-			    maxretry));
 		}
 
 		if (type == IEEE80211_FC0_TYPE_DATA) {
+			bool use_shpreamble = false;
+			bool use_ht = false;
+
+			/*
+			 * Calculate whether to use shared preamble / HT
+			 * based on config if its firmware rate control, or
+			 * rate if any other rate control.
+			 */
+			if (sc->sc_ratectl == RTWN_RATECTL_FW && force_rate == false) {
+				if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
+					use_shpreamble = true;
+			} else {
+				if (RTWN_RATE_IS_CCK(ridx) && ridx != RTWN_RIDX_CCK1 &&
+				    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
+					use_shpreamble = true;
+				if (RTWN_RATE_IS_HT(ridx))
+					use_ht = true;
+			}
+
 			qsel = tid % RTWN_MAX_TID;
 
 			rtwn_r92c_tx_enable_ampdu(sc, buf,
@@ -327,17 +383,20 @@ r92c_fill_tx_desc(struct rtwn_softc *sc, struct ieee80211_node *ni,
 #endif
 			}
 
-			if (RTWN_RATE_IS_CCK(ridx) && ridx != RTWN_RIDX_CCK1 &&
-			    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
+			if (use_shpreamble)
 				txd->txdw4 |= htole32(R92C_TXDW4_DATA_SHPRE);
 
 			prot = IEEE80211_PROT_NONE;
-			if (RTWN_RATE_IS_HT(ridx)) {
+			/* XXX better way to know whether to set SGI/HT40? */
+			if (use_ht || m->m_flags & M_AMPDU_MPDU) {
 				r92c_tx_set_ht40(sc, txd, ni);
 				r92c_tx_set_sgi(sc, txd, ni);
 				prot = ic->ic_htprotmode;
-			} else if (ic->ic_flags & IEEE80211_F_USEPROT)
+			} else if (ic->ic_flags & IEEE80211_F_USEPROT) {
 				prot = ic->ic_protmode;
+			} else if (IEEE80211_IS_CHAN_HT(ni->ni_chan)) {
+				prot = ic->ic_htprotmode;
+			}
 
 			/* XXX fix last comparison for A-MSDU (in net80211) */
 			/* XXX A-MPDU? */
@@ -348,7 +407,8 @@ r92c_fill_tx_desc(struct rtwn_softc *sc, struct ieee80211_node *ni,
 
 			/* NB: checks for ht40 / short bits (set above). */
 			if (prot != IEEE80211_PROT_NONE)
-				r92c_tx_protection(sc, txd, prot, ridx);
+				r92c_tx_protection(sc, txd, prot, ridx,
+				    !! (m->m_flags & M_AMPDU_MPDU));
 		} else	/* IEEE80211_FC0_TYPE_MGT */
 			qsel = R92C_TXDW1_QSEL_MGNT;
 	} else {
@@ -359,14 +419,30 @@ r92c_fill_tx_desc(struct rtwn_softc *sc, struct ieee80211_node *ni,
 	txd->txdw1 |= htole32(SM(R92C_TXDW1_QSEL, qsel));
 
 	rtwn_r92c_tx_setup_macid(sc, txd, macid);
-	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
+	/*
+	 * XXX TODO: this should be maxrate from either the
+	 * last firmware ratemask H2C, or the last value
+	 * read from INIDATA.
+	 *
+	 * Having it set to 0 here is fine for the RTL8192CU
+	 * if rate control is working, but it's not fine
+	 * if it hasn't yet become active (eg R92C_BCN_CTRL
+	 * isn't 0x18) - it'll just transmit at CCK1.)
+	 */
+	if (sc->sc_ratectl == RTWN_RATECTL_FW && force_rate == false) {
+		//txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 27)); /* XXX MCS15 */
+		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0)); /* XXX MCS15 */
+	} else {
+		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
+	}
+
 	/* Data rate fallback limit (max). */
 	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE_FB_LMT, 0x1f));
 	txd->txdw4 |= htole32(SM(R92C_TXDW4_PORT_ID, uvp->id));
 	r92c_tx_raid(sc, txd, ni, ismcast);
 
 	/* Force this rate if needed. */
-	if (sc->sc_ratectl != RTWN_RATECTL_FW)
+	if (sc->sc_ratectl != RTWN_RATECTL_FW || force_rate == true)
 		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
 
 	if (!hasqos) {
@@ -415,9 +491,11 @@ r92c_fill_tx_desc_raw(struct rtwn_softc *sc, struct ieee80211_node *ni,
 		    params->ibp_try0));
 	}
 	if (params->ibp_flags & IEEE80211_BPF_RTS)
-		r92c_tx_protection(sc, txd, IEEE80211_PROT_RTSCTS, ridx);
+		r92c_tx_protection(sc, txd, IEEE80211_PROT_RTSCTS, ridx,
+		    false);
 	if (params->ibp_flags & IEEE80211_BPF_CTS)
-		r92c_tx_protection(sc, txd, IEEE80211_PROT_CTSONLY, ridx);
+		r92c_tx_protection(sc, txd, IEEE80211_PROT_CTSONLY, ridx,
+		    false);
 
 	rtwn_r92c_tx_setup_macid(sc, txd, RTWN_MACID_BC);
 	txd->txdw1 |= htole32(SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT));
@@ -429,6 +507,9 @@ r92c_fill_tx_desc_raw(struct rtwn_softc *sc, struct ieee80211_node *ni,
 	txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
 	r92c_tx_raid(sc, txd, ni, ismcast);
 
+	/* Get TX feedback */
+	txd->txdw2 |= htole32(R92C_TXDW2_CCX_RPT);
+
 	if (!IEEE80211_QOS_HAS_SEQ(wh)) {
 		/* Use HW sequence numbering for non-QoS frames. */
 		rtwn_r92c_tx_setup_hwseq(sc, txd);
diff --git a/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c b/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c
index 10d812dd7a80..91b1b78edb01 100644
--- a/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c
+++ b/sys/dev/rtwn/rtl8192c/usb/r92cu_init.c
@@ -373,11 +373,7 @@ r92cu_post_init(struct rtwn_softc *sc)
 	if (sc->sc_flags & RTWN_FW_LOADED) {
 		struct r92c_softc *rs = sc->sc_priv;
 
-		if (sc->sc_ratectl_sysctl == RTWN_RATECTL_FW) {
-			/* XXX firmware RA does not work yet */
-			sc->sc_ratectl = RTWN_RATECTL_NET80211;
-		} else
-			sc->sc_ratectl = sc->sc_ratectl_sysctl;
+		sc->sc_ratectl = sc->sc_ratectl_sysctl;
 
 		/* Start C2H event handling. */
 		callout_reset(&rs->rs_c2h_report, rs->rs_c2h_timeout,
diff --git a/sys/modules/rtwn/Makefile b/sys/modules/rtwn/Makefile
index f137c04e5de7..35993add5591 100644
--- a/sys/modules/rtwn/Makefile
+++ b/sys/modules/rtwn/Makefile
@@ -41,7 +41,7 @@ SRCS	+= r21a_beacon.c r21a_calib.c r21a_chan.c r21a_fw.c r21a_init.c \
 
 opt_rtwn.h:
 	@echo "#define RTWN_DEBUG 1" > ${.TARGET}
-#	@echo "#define RTWN_DEBUG_REGIO 1" >> ${.TARGET}
+	@echo "#define RTWN_DEBUG_REGIO 1" >> ${.TARGET}
 .if ${MK_SOURCELESS_UCODE} == "no"
 	@echo "#define RTWN_WITHOUT_UCODE 1" >> ${.TARGET}
 .endif
diff --git a/sys/modules/rtwn_pci/Makefile b/sys/modules/rtwn_pci/Makefile
index ce2144121e88..d1187d64832e 100644
--- a/sys/modules/rtwn_pci/Makefile
+++ b/sys/modules/rtwn_pci/Makefile
@@ -21,6 +21,7 @@ SRCS    += r88ee_attach.c r88ee_init.c r88ee_rx.c \
 
 opt_rtwn.h:
 	@echo "#define RTWN_DEBUG 1" > ${.TARGET}
+	@echo "#define RTWN_DEBUG_REGIO 1" >> ${.TARGET}
 .if ${MK_SOURCELESS_UCODE} == "no"
 	@echo "#define RTWN_WITHOUT_UCODE 1" >> ${.TARGET}
 .endif
diff --git a/sys/modules/rtwn_usb/Makefile b/sys/modules/rtwn_usb/Makefile
index 16899b8a8c49..ffb8f52c73ab 100644
--- a/sys/modules/rtwn_usb/Makefile
+++ b/sys/modules/rtwn_usb/Makefile
@@ -31,6 +31,7 @@ SRCS	+= r21au_attach.c r21au_init.c r21au_dfs.c \
 
 opt_rtwn.h:
 	@echo "#define RTWN_DEBUG 1" > ${.TARGET}
+	@echo "#define RTWN_DEBUG_REGIO 1" >> ${.TARGET}
 .if ${MK_SOURCELESS_UCODE} == "no"
 	@echo "#define RTWN_WITHOUT_UCODE 1" >> ${.TARGET}
 .endif