diff --git a/Readme.md b/Readme.md
index ea9e9afe..ab366c05 100644
--- a/Readme.md
+++ b/Readme.md
@@ -1,7 +1,8 @@
 This repository contains hardware designs and software for HackRF, a project to
 produce a low cost, open source software radio platform.
 
-![Lemondrop and Jellybean](https://github.com/wishi/hackrf/raw/master/doc/lemonAndjelly.jpeg)
+![Jawbreaker](https://raw.github.com/mossmann/hackrf/master/doc/jawbreaker.jpeg)
 
 principal author: Michael Ossmann <mike@ossmann.com>
-source repository: https://github.com/mossmann/hackrf
+
+http://greatscottgadgets.com/hackrf/
diff --git a/doc/jawbreaker.jpeg b/doc/jawbreaker.jpeg
new file mode 100644
index 00000000..6d3a8e78
Binary files /dev/null and b/doc/jawbreaker.jpeg differ
diff --git a/firmware/common/LPC4330_M4_ram_only.ld b/firmware/common/LPC4330_M4_ram_only.ld
deleted file mode 100644
index 4149fbd7..00000000
--- a/firmware/common/LPC4330_M4_ram_only.ld
+++ /dev/null
@@ -1,38 +0,0 @@
-/*
- * Copyright 2012 Michael Ossmann <mike@ossmann.com>
- * Copyright 2012 Jared Boone <jared@sharebrained.com>
- *
- * This file is part of HackRF
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2, or (at your option)
- * any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; see the file COPYING.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street,
- * Boston, MA 02110-1301, USA.
- */
-
-/* Linker script for HackRF Jellybean (LPC4330, 1M SPI flash, 264K SRAM). */
-
-MEMORY
-{
-	ram_local1 (rwx) : ORIGIN = 0x10000000, LENGTH =  128K
-	ram_local2 (rwx) : ORIGIN = 0x10080000, LENGTH =  72K
-	ram_ahb1   (rwx) : ORIGIN = 0x20000000, LENGTH =  16K
-	/* Removed 32K of AHB SRAM for USB buffer. Straddles two blocks of RAM
-	 * to get performance benefit of having two USB buffers addressable
-	 * simultaneously (on two different buses of the AHB multilayer matrix)
-	 */
-	ram_ahb2   (rwx) : ORIGIN = 0x2000C000, LENGTH =  16K
-}
-
-/* Include the common ld script. */
-INCLUDE libopencm3_lpc43xx_ram_only.ld
diff --git a/firmware/common/Makefile_inc.mk b/firmware/common/Makefile_inc.mk
index 8ea2f6be..891495c0 100644
--- a/firmware/common/Makefile_inc.mk
+++ b/firmware/common/Makefile_inc.mk
@@ -75,12 +75,23 @@ all: images
 images: $(BINARY).images
 flash: $(BINARY).flash
 
+program: $(BINARY).dfu
+	$(Q)dfu-util --device 1fc9:000c --alt 0 --download $(BINARY).dfu
+
 %.images: %.bin %.hex %.srec %.list
 	@#echo "*** $* images generated ***"
 
+%.dfu: %.bin
+	$(Q)rm -f _tmp.dfu _header.bin
+	$(Q)cp $(*).bin _tmp.dfu
+	$(Q)dfu-suffix --vid=0x1fc9 --pid=0x000c --did=0x0 -s 0 -a _tmp.dfu
+	$(Q)python -c "import os.path; import struct; print('0000000: da ff ' + ' '.join(map(lambda s: '%02x' % ord(s), struct.pack('<H', os.path.getsize('$(*).bin') / 512 + 1))) + ' ff ff ff ff')" | xxd -g1 -r > _header.bin
+	$(Q)cat _header.bin _tmp.dfu >$(*).dfu
+	$(Q)rm -f _tmp.dfu _header.bin
+
 %.bin: %.elf
 	@#printf "  OBJCOPY $(*).bin\n"
-	$(Q)$(OBJCOPY) -Obinary $(*).elf $(*).bin
+	$(Q)$(OBJCOPY) -Obinary -j .text -j .ARM.exidx $(*).elf $(*).bin
 
 %.hex: %.elf
 	@#printf "  OBJCOPY $(*).hex\n"
@@ -107,6 +118,8 @@ clean:
 	$(Q)rm -f *.d
 	$(Q)rm -f *.elf
 	$(Q)rm -f *.bin
+	$(Q)rm -f *.dfu
+	$(Q)rm -f _tmp.dfu _header.bin
 	$(Q)rm -f *.hex
 	$(Q)rm -f *.srec
 	$(Q)rm -f *.list
diff --git a/firmware/common/max2837.c b/firmware/common/max2837.c
index 633fbca1..464aa8b3 100644
--- a/firmware/common/max2837.c
+++ b/firmware/common/max2837.c
@@ -110,7 +110,7 @@ void max2837_setup(void)
 	set_MAX2837_LNAgain_SPI_EN(1);
 	set_MAX2837_LNAgain(MAX2837_LNAgain_MAX); /* maximum gain */
 	set_MAX2837_VGAgain_SPI_EN(1);
-	set_MAX2837_VGA(0x00); /* minimum attenuation */
+	set_MAX2837_VGA(0x18); /* reasonable gain for noisy 2.4GHz environment */
 
 	/* maximum rx output common-mode voltage */
 	set_MAX2837_BUFF_VCM(MAX2837_BUFF_VCM_1_25);
@@ -121,10 +121,9 @@ void max2837_setup(void)
 /* SPI register read. */
 uint16_t max2837_spi_read(uint8_t r) {
 	gpio_clear(PORT_XCVR_CS, PIN_XCVR_CS);
-	// FIXME: Unimplemented.
-	r=r;
+	const uint16_t value = ssp_transfer(SSP1_NUM, (uint16_t)((1 << 15) | (r << 10)));
 	gpio_set(PORT_XCVR_CS, PIN_XCVR_CS);
-	return 0;
+	return value & 0x3ff;
 }
 
 /* SPI register write */
@@ -137,7 +136,7 @@ void max2837_spi_write(uint8_t r, uint16_t v) {
 	LOG("0x%03x -> reg%d\n", v, r);
 #else
 	gpio_clear(PORT_XCVR_CS, PIN_XCVR_CS);
-	ssp_write(SSP1_NUM, (uint16_t)((r << 10) | (v & 0x3ff)));
+	ssp_transfer(SSP1_NUM, (uint16_t)((r << 10) | (v & 0x3ff)));
 	gpio_set(PORT_XCVR_CS, PIN_XCVR_CS);
 #endif
 }
diff --git a/firmware/common/max2837_regs.def b/firmware/common/max2837_regs.def
index 96291866..42dbec34 100644
--- a/firmware/common/max2837_regs.def
+++ b/firmware/common/max2837_regs.def
@@ -133,7 +133,7 @@ __MREG__(MAX2837_LPF_MODE_SEL,6,9,1) // set to enable mode in reg 2 ModeCtrl
 
 /* REG 8 */
 __MREG__(MAX2837_LNAgain_SPI_EN,8,0,1)  // set to override pin control of LNA
-__MREG__(MAX2837_VGAgain_SPI_EN,8,1,0)  // set to override pin control of VGA
+__MREG__(MAX2837_VGAgain_SPI_EN,8,1,1)  // set to override pin control of VGA
 __MREG__(MAX2837_EN_Bias_Trim,8,2,1)    // route bias current to bondpad
 __MREG__(MAX2837_BIAS_TRIM_SPI,8,7,3)   // down=00000, up=11111, nom=10000
 __MREG__(MAX2837_BIAS_TRIM_CNTRL,8,8,1) // enable BIAS_TRIM_SPI value
@@ -255,7 +255,7 @@ __MREG__(MAX2837_SYN_BIAS_TRIM,20,9,2) // 00=max 10=default 11=min
 /* REG 21 */
 __MREG__(MAX2837_SYN_CP_COMMON_MODE_EN,21,0,1)
 __MREG__(MAX2837_SYN_PRESCALER_BIAS_BOOST,21,1,1)  // 0=default 1=+20%
-__MREG__(MAX2837_SYN_CP_BETA_EN,21,2,0)
+__MREG__(MAX2837_SYN_CP_BETA_EN,21,2,1)
 __MREG__(MAX2837_SYN_SD_CLOCK_SEL,21,3,1)
 #define MAX2837_SYN_SD_CLOCK_PFD 0  // from PFD reset
 #define MAX2837_SYN_SD_CLOCK_PRE 1  // from prescaler
diff --git a/firmware/common/max5864.c b/firmware/common/max5864.c
index a0f5dcff..094ed700 100644
--- a/firmware/common/max5864.c
+++ b/firmware/common/max5864.c
@@ -29,7 +29,7 @@
 
 void max5864_spi_write(uint_fast8_t value) {
 	gpio_clear(PORT_AD_CS, PIN_AD_CS);
-	ssp_write(SSP1_NUM, value);
+	ssp_transfer(SSP1_NUM, value);
 	gpio_set(PORT_AD_CS, PIN_AD_CS);
 }
 
diff --git a/firmware/usb_performance/Makefile b/firmware/usb_performance/Makefile
index 7222a2f4..cdde8dd1 100644
--- a/firmware/usb_performance/Makefile
+++ b/firmware/usb_performance/Makefile
@@ -35,5 +35,4 @@ SRC = $(BINARY).c \
 	../common/max5864.c \
 	../common/rffc5071.c
 
-LDSCRIPT = ../common/LPC4330_M4_ram_only.ld
 include ../common/Makefile_inc.mk
diff --git a/firmware/usb_performance/usb.h b/firmware/usb_performance/usb.h
index 7b9c9390..ccaa9184 100644
--- a/firmware/usb_performance/usb.h
+++ b/firmware/usb_performance/usb.h
@@ -28,9 +28,8 @@
 
 #include "usb_type.h"
 
-#define ATTR_ALIGNED(x)	__attribute__ ((aligned(x)))
-#define ATTR_SECTION(x) __attribute__ ((section(x)))
-
+// TODO: This is a lame move, requiring an extern to be defined to complete
+// the interface between this API and the application.
 extern bool usb_set_configuration(
 	usb_device_t* const device,
 	const uint_fast8_t configuration_number
diff --git a/firmware/usb_performance/usb_request.c b/firmware/usb_performance/usb_request.c
index df6ae427..bfa4ea75 100644
--- a/firmware/usb_performance/usb_request.c
+++ b/firmware/usb_performance/usb_request.c
@@ -19,6 +19,7 @@
  * Boston, MA 02110-1301, USA.
  */
 
+#include "usb.h"
 #include "usb_request.h"
 
 #include <stdbool.h>
@@ -49,6 +50,9 @@ static void usb_request(
 	
 	if( handler ) {
 		handler(endpoint, stage);
+	} else {
+		// USB 2.0 section 9.2.7 "Request Error"
+		usb_endpoint_stall(endpoint);
 	}
 }
 
diff --git a/firmware/usb_performance/usb_request.h b/firmware/usb_performance/usb_request.h
index a637924f..2d32bcea 100644
--- a/firmware/usb_performance/usb_request.h
+++ b/firmware/usb_performance/usb_request.h
@@ -38,7 +38,7 @@ typedef enum {
 } usb_transfer_stage_t;
 
 typedef void (*usb_request_handler_fn)(
-	usb_endpoint_t* const response,
+	usb_endpoint_t* const endpoint,
 	const usb_transfer_stage_t stage
 );
 
diff --git a/firmware/usb_performance/usb_standard_request.c b/firmware/usb_performance/usb_standard_request.c
index 1b42bd5e..286d783b 100644
--- a/firmware/usb_performance/usb_standard_request.c
+++ b/firmware/usb_performance/usb_standard_request.c
@@ -67,7 +67,7 @@ static void usb_send_descriptor(
 	usb_endpoint_t* const endpoint,
 	uint8_t* const descriptor_data
 ) {
-	const uint32_t setup_length = (endpoint->setup.length_h << 8) | endpoint->setup.length_l;
+	const uint32_t setup_length = endpoint->setup.length;
 	uint32_t descriptor_length = descriptor_data[0];
 	if( descriptor_data[1] == USB_DESCRIPTOR_TYPE_CONFIGURATION ) {
 		descriptor_length = (descriptor_data[3] << 8) | descriptor_data[2];
@@ -221,7 +221,7 @@ static void usb_standard_request_set_configuration(
 static void usb_standard_request_get_configuration_setup(
 	usb_endpoint_t* const endpoint
 ) {
-	if( (endpoint->setup.length_h == 0) && (endpoint->setup.length_l == 1) ) {
+	if( endpoint->setup.length == 1 ) {
 		endpoint->buffer[0] = 0;
 		if( endpoint->device->configuration ) {
 			endpoint->buffer[0] = endpoint->device->configuration->number;
diff --git a/firmware/usb_performance/usb_type.h b/firmware/usb_performance/usb_type.h
index 54287fd5..fed3172b 100644
--- a/firmware/usb_performance/usb_type.h
+++ b/firmware/usb_performance/usb_type.h
@@ -25,15 +25,35 @@
 #include <stdint.h>
 #include <stdbool.h>
 
-typedef struct {
+// TODO: Move this to some common compiler-tricks location.
+#define ATTR_PACKED __attribute__((packed))
+#define ATTR_ALIGNED(x)	__attribute__ ((aligned(x)))
+#define ATTR_SECTION(x) __attribute__ ((section(x)))
+
+typedef struct ATTR_PACKED {
 	uint8_t request_type;
 	uint8_t request;
-	uint8_t value_l;
-	uint8_t value_h;
-	uint8_t index_l;
-	uint8_t index_h;
-	uint8_t length_l;
-	uint8_t length_h;
+	union {
+		struct {
+			uint8_t value_l;
+			uint8_t value_h;
+		};
+		uint16_t value;
+	};
+	union {
+		struct {
+			uint8_t index_l;
+			uint8_t index_h;
+		};
+		uint16_t index;
+	};
+	union {
+		struct {
+			uint8_t length_l;
+			uint8_t length_h;
+		};
+		uint16_t length;
+	};
 } usb_setup_t;
 
 typedef enum {