diff --git a/src/add-ons/kernel/drivers/network/wlan/Jamfile b/src/add-ons/kernel/drivers/network/wlan/Jamfile
index ab73256c95..d03c74de40 100644
--- a/src/add-ons/kernel/drivers/network/wlan/Jamfile
+++ b/src/add-ons/kernel/drivers/network/wlan/Jamfile
@@ -1,11 +1,9 @@
 SubDir HAIKU_TOP src add-ons kernel drivers network wlan ;
 
-# FreeBSD 9.3 drivers
-SubInclude HAIKU_TOP src add-ons kernel drivers network wlan broadcom43xx ;
-
 # FreeBSD 11.1 drivers
 SubInclude HAIKU_TOP src add-ons kernel drivers network wlan aironetwifi ;
 SubInclude HAIKU_TOP src add-ons kernel drivers network wlan atheroswifi ;
+SubInclude HAIKU_TOP src add-ons kernel drivers network wlan broadcom43xx ;
 SubInclude HAIKU_TOP src add-ons kernel drivers network wlan iprowifi2100 ;
 SubInclude HAIKU_TOP src add-ons kernel drivers network wlan iprowifi3945 ;
 SubInclude HAIKU_TOP src add-ons kernel drivers network wlan iprowifi4965 ;
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/Jamfile b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/Jamfile
index e8c340b64a..4723c75800 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/Jamfile
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/Jamfile
@@ -1,19 +1,19 @@
 SubDir HAIKU_TOP src add-ons kernel drivers network wlan broadcom43xx ;
 
-UseHeaders [ FDirName $(HAIKU_TOP) src libs compat freebsd_network compat ]
+UseHeaders [ FDirName $(HAIKU_TOP) src libs compat freebsd11_network compat ]
 	: true ;
-UseHeaders [ FDirName $(HAIKU_TOP) src libs compat freebsd_wlan ] : true ;
+UseHeaders [ FDirName $(HAIKU_TOP) src libs compat freebsd11_wlan ] : true ;
 UsePrivateHeaders net system ;
 UsePrivateKernelHeaders ;
 
 # Enabling C++ structures in C only code
 Includes [ FGristFiles kernel_c++_structs.h ]
 	: <src!system!kernel>kernel_c++_struct_sizes.h ;
-	
-SubDirCcFlags [ FDefines _KERNEL=1 FBSD_DRIVER=1 ] 
-	-Wno-format 
-	-Wno-unused 
-	-Wno-uninitialized 
+
+SubDirCcFlags [ FDefines _KERNEL=1 FBSD_DRIVER=1 ]
+	-Wno-format
+	-Wno-unused
+	-Wno-uninitialized
 	;
 
 UseHeaders [ FDirName $(SUBDIR) ] : true ;
@@ -28,6 +28,6 @@ KernelAddon broadcom43xx :
 	bwirf.c
 	glue.c
 	:
-	libfreebsd_wlan.a
-	libfreebsd_network.a
+	libfreebsd11_wlan.a
+	libfreebsd11_network.a
 	;
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bitops.h b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bitops.h
index 0d6dee8d86..cde732af76 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bitops.h
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bitops.h
@@ -29,7 +29,7 @@
  * OF SUCH DAMAGE.
  *
  * $DragonFly: src/sys/dev/netif/bwi/bitops.h,v 1.1 2007/09/08 06:15:54 sephe Exp $
- * $FreeBSD$
+ * $FreeBSD: releng/11.1/sys/dev/bwi/bitops.h 191762 2009-05-03 04:01:43Z imp $
  */
 
 #ifndef _BITOPS_H
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwimac.c b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwimac.c
index c48d9c3a85..2b583d6f5b 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwimac.c
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwimac.c
@@ -35,10 +35,11 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: releng/11.1/sys/dev/bwi/bwimac.c 288087 2015-09-22 02:44:59Z adrian $");
 
 #include "opt_inet.h"
 #include "opt_bwi.h"
+#include "opt_wlan.h"
 
 #include <sys/param.h>
 #include <sys/endian.h>
@@ -56,6 +57,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/firmware.h>
  
 #include <net/if.h>
+#include <net/if_var.h>
 #include <net/if_dl.h>
 #include <net/if_media.h>
 #include <net/if_types.h>
@@ -99,7 +101,6 @@ static void	bwi_mac_opmode_init(struct bwi_mac *);
 static void	bwi_mac_hostflags_init(struct bwi_mac *);
 static void	bwi_mac_bss_param_init(struct bwi_mac *);
 
-static int	bwi_mac_fw_alloc(struct bwi_mac *);
 static void	bwi_mac_fw_free(struct bwi_mac *);
 static int	bwi_mac_fw_load(struct bwi_mac *);
 static int	bwi_mac_fw_init(struct bwi_mac *);
@@ -323,10 +324,6 @@ bwi_mac_init(struct bwi_mac *mac)
 	/*
 	 * Load and initialize firmwares
 	 */
-	error = bwi_mac_fw_alloc(mac);
-	if (error)
-		return error;
-
 	error = bwi_mac_fw_load(mac);
 	if (error)
 		return error;
@@ -835,11 +832,11 @@ bwi_fwimage_is_valid(struct bwi_softc *sc, const struct firmware *fw,
 		     uint8_t fw_type)
 {
 	const struct bwi_fwhdr *hdr;
-	struct ifnet *ifp = sc->sc_ifp;
 
 	if (fw->datasize < sizeof(*hdr)) {
-		if_printf(ifp, "invalid firmware (%s): invalid size %zu\n",
-			  fw->name, fw->datasize);
+		device_printf(sc->sc_dev,
+		    "invalid firmware (%s): invalid size %zu\n",
+		    fw->name, fw->datasize);
 		return 0;
 	}
 
@@ -850,25 +847,26 @@ bwi_fwimage_is_valid(struct bwi_softc *sc, const struct firmware *fw,
 		 * Don't verify IV's size, it has different meaning
 		 */
 		if (be32toh(hdr->fw_size) != fw->datasize - sizeof(*hdr)) {
-			if_printf(ifp, "invalid firmware (%s): size mismatch, "
-				  "fw %u, real %zu\n", fw->name,
-				  be32toh(hdr->fw_size),
-				  fw->datasize - sizeof(*hdr));
+			device_printf(sc->sc_dev,
+			    "invalid firmware (%s): size mismatch, "
+			    "fw %u, real %zu\n", fw->name,
+			    be32toh(hdr->fw_size), fw->datasize - sizeof(*hdr));
 			return 0;
 		}
 	}
 
 	if (hdr->fw_type != fw_type) {
-		if_printf(ifp, "invalid firmware (%s): type mismatch, "
-			  "fw \'%c\', target \'%c\'\n", fw->name,
-			  hdr->fw_type, fw_type);
+		device_printf(sc->sc_dev,
+		    "invalid firmware (%s): type mismatch, "
+		    "fw \'%c\', target \'%c\'\n", fw->name,
+		    hdr->fw_type, fw_type);
 		return 0;
 	}
 
 	if (hdr->fw_gen != BWI_FW_GEN_1) {
-		if_printf(ifp, "invalid firmware (%s): wrong generation, "
-			  "fw %d, target %d\n", fw->name,
-			  hdr->fw_gen, BWI_FW_GEN_1);
+		device_printf(sc->sc_dev,
+		    "invalid firmware (%s): wrong generation, "
+		    "fw %d, target %d\n", fw->name, hdr->fw_gen, BWI_FW_GEN_1);
 		return 0;
 	}
 	return 1;
@@ -877,11 +875,10 @@ bwi_fwimage_is_valid(struct bwi_softc *sc, const struct firmware *fw,
 /*
  * XXX Error cleanup
  */
-static int
+int
 bwi_mac_fw_alloc(struct bwi_mac *mac)
 {
 	struct bwi_softc *sc = mac->mac_sc;
-	struct ifnet *ifp = sc->sc_ifp;
 	char fwname[64];
 	int idx;
 
@@ -893,10 +890,8 @@ bwi_mac_fw_alloc(struct bwi_mac *mac)
 		snprintf(fwname, sizeof(fwname), BWI_FW_STUB_PATH,
 			 sc->sc_fw_version);
 		mac->mac_stub = firmware_get(fwname);
-		if (mac->mac_stub == NULL) {
-			if_printf(ifp, "request firmware %s failed\n", fwname);
-			return ENOMEM;
-		}
+		if (mac->mac_stub == NULL)
+			goto no_firmware;
 	}
 
 	if (mac->mac_ucode == NULL) {
@@ -905,11 +900,8 @@ bwi_mac_fw_alloc(struct bwi_mac *mac)
 			  mac->mac_rev >= 5 ? 5 : mac->mac_rev);
 
 		mac->mac_ucode = firmware_get(fwname);
-		if (mac->mac_ucode == NULL) {
-			if_printf(ifp, "request firmware %s failed\n", fwname);
-			return ENOMEM;
-		}
-
+		if (mac->mac_ucode == NULL)
+			goto no_firmware;
 		if (!bwi_fwimage_is_valid(sc, mac->mac_ucode, BWI_FW_T_UCODE))
 			return EINVAL;
 	}
@@ -920,11 +912,8 @@ bwi_mac_fw_alloc(struct bwi_mac *mac)
 			  mac->mac_rev < 5 ? 4 : 5);
 
 		mac->mac_pcm = firmware_get(fwname);
-		if (mac->mac_pcm == NULL) {
-			if_printf(ifp, "request firmware %s failed\n", fwname);
-			return ENOMEM;
-		}
-
+		if (mac->mac_pcm == NULL)
+			goto no_firmware;
 		if (!bwi_fwimage_is_valid(sc, mac->mac_pcm, BWI_FW_T_PCM))
 			return EINVAL;
 	}
@@ -936,8 +925,8 @@ bwi_mac_fw_alloc(struct bwi_mac *mac)
 		} else if (mac->mac_rev >= 5 && mac->mac_rev <= 10) {
 			idx = 5;
 		} else {
-			if_printf(ifp, "no suitible IV for MAC rev %d\n",
-				  mac->mac_rev);
+			device_printf(sc->sc_dev,
+			    "no suitible IV for MAC rev %d\n", mac->mac_rev);
 			return ENODEV;
 		}
 
@@ -945,10 +934,8 @@ bwi_mac_fw_alloc(struct bwi_mac *mac)
 			  sc->sc_fw_version, idx);
 
 		mac->mac_iv = firmware_get(fwname);
-		if (mac->mac_iv == NULL) {
-			if_printf(ifp, "request firmware %s failed\n", fwname);
-			return ENOMEM;
-		}
+		if (mac->mac_iv == NULL)
+			goto no_firmware;
 		if (!bwi_fwimage_is_valid(sc, mac->mac_iv, BWI_FW_T_IV))
 			return EINVAL;
 	}
@@ -958,12 +945,12 @@ bwi_mac_fw_alloc(struct bwi_mac *mac)
 		if (mac->mac_rev == 2 || mac->mac_rev == 4 ||
 		    mac->mac_rev >= 11) {
 			/* No extended IV */
-			goto back;
+			return (0);
 		} else if (mac->mac_rev >= 5 && mac->mac_rev <= 10) {
 			idx = 5;
 		} else {
-			if_printf(ifp, "no suitible ExtIV for MAC rev %d\n",
-				  mac->mac_rev);
+			device_printf(sc->sc_dev,
+			    "no suitible ExtIV for MAC rev %d\n", mac->mac_rev);
 			return ENODEV;
 		}
 
@@ -971,15 +958,16 @@ bwi_mac_fw_alloc(struct bwi_mac *mac)
 			  sc->sc_fw_version, idx);
 
 		mac->mac_iv_ext = firmware_get(fwname);
-		if (mac->mac_iv_ext == NULL) {
-			if_printf(ifp, "request firmware %s failed\n", fwname);
-			return ENOMEM;
-		}
+		if (mac->mac_iv_ext == NULL)
+			goto no_firmware;
 		if (!bwi_fwimage_is_valid(sc, mac->mac_iv_ext, BWI_FW_T_IV))
 			return EINVAL;
 	}
-back:
-	return 0;
+	return (0);
+
+no_firmware:
+	device_printf(sc->sc_dev, "request firmware %s failed\n", fwname);
+	return (ENOENT);
 }
 
 static void
@@ -1015,7 +1003,6 @@ static int
 bwi_mac_fw_load(struct bwi_mac *mac)
 {
 	struct bwi_softc *sc = mac->mac_sc;
-	struct ifnet *ifp = sc->sc_ifp;
 	const uint32_t *fw;
 	uint16_t fw_rev;
 	int fw_len, i;
@@ -1070,7 +1057,8 @@ bwi_mac_fw_load(struct bwi_mac *mac)
 		DELAY(10);
 	}
 	if (i == NRETRY) {
-		if_printf(ifp, "firmware (ucode&pcm) loading timed out\n");
+		device_printf(sc->sc_dev,
+		    "firmware (ucode&pcm) loading timed out\n");
 		return ETIMEDOUT;
 	}
 
@@ -1080,12 +1068,14 @@ bwi_mac_fw_load(struct bwi_mac *mac)
 
 	fw_rev = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWREV);
 	if (fw_rev > BWI_FW_VERSION3_REVMAX) {
-		if_printf(ifp, "firmware version 4 is not supported yet\n");
+		device_printf(sc->sc_dev,
+		    "firmware version 4 is not supported yet\n");
 		return ENODEV;
 	}
 
-	if_printf(ifp, "firmware rev 0x%04x, patch level 0x%04x\n", fw_rev,
-		  MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWPATCHLV));
+	device_printf(sc->sc_dev,
+	    "firmware rev 0x%04x, patch level 0x%04x\n", fw_rev,
+	    MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWPATCHLV));
 	return 0;
 }
 
@@ -1145,7 +1135,6 @@ static int
 bwi_mac_fw_load_iv(struct bwi_mac *mac, const struct firmware *fw)
 {
 	struct bwi_softc *sc = mac->mac_sc;
-	struct ifnet *ifp = sc->sc_ifp;
 	const struct bwi_fwhdr *hdr;
 	const struct bwi_fw_iv *iv;
 	int n, i, iv_img_size;
@@ -1168,7 +1157,7 @@ bwi_mac_fw_load_iv(struct bwi_mac *mac, const struct firmware *fw)
 		int sz = 0;
 
 		if (iv_img_size < sizeof(iv->iv_ofs)) {
-			if_printf(ifp, "invalid IV image, ofs\n");
+			device_printf(sc->sc_dev, "invalid IV image, ofs\n");
 			return EINVAL;
 		}
 		iv_img_size -= sizeof(iv->iv_ofs);
@@ -1178,7 +1167,7 @@ bwi_mac_fw_load_iv(struct bwi_mac *mac, const struct firmware *fw)
 
 		ofs = __SHIFTOUT(iv_ofs, BWI_FW_IV_OFS_MASK);
 		if (ofs >= 0x1000) {
-			if_printf(ifp, "invalid ofs (0x%04x) "
+			device_printf(sc->sc_dev, "invalid ofs (0x%04x) "
 				  "for %dth iv\n", ofs, i);
 			return EINVAL;
 		}
@@ -1187,7 +1176,8 @@ bwi_mac_fw_load_iv(struct bwi_mac *mac, const struct firmware *fw)
 			uint32_t val32;
 
 			if (iv_img_size < sizeof(iv->iv_val.val32)) {
-				if_printf(ifp, "invalid IV image, val32\n");
+				device_printf(sc->sc_dev,
+				    "invalid IV image, val32\n");
 				return EINVAL;
 			}
 			iv_img_size -= sizeof(iv->iv_val.val32);
@@ -1199,7 +1189,8 @@ bwi_mac_fw_load_iv(struct bwi_mac *mac, const struct firmware *fw)
 			uint16_t val16;
 
 			if (iv_img_size < sizeof(iv->iv_val.val16)) {
-				if_printf(ifp, "invalid IV image, val16\n");
+				device_printf(sc->sc_dev,
+				    "invalid IV image, val16\n");
 				return EINVAL;
 			}
 			iv_img_size -= sizeof(iv->iv_val.val16);
@@ -1213,7 +1204,8 @@ bwi_mac_fw_load_iv(struct bwi_mac *mac, const struct firmware *fw)
 	}
 
 	if (iv_img_size != 0) {
-		if_printf(ifp, "invalid IV image, size left %d\n", iv_img_size);
+		device_printf(sc->sc_dev, "invalid IV image, size left %d\n",
+		    iv_img_size);
 		return EINVAL;
 	}
 	return 0;
@@ -1222,19 +1214,19 @@ bwi_mac_fw_load_iv(struct bwi_mac *mac, const struct firmware *fw)
 static int
 bwi_mac_fw_init(struct bwi_mac *mac)
 {
-	struct ifnet *ifp = mac->mac_sc->sc_ifp;
+	device_t dev = mac->mac_sc->sc_dev;
 	int error;
 
 	error = bwi_mac_fw_load_iv(mac, mac->mac_iv);
 	if (error) {
-		if_printf(ifp, "load IV failed\n");
+		device_printf(dev, "load IV failed\n");
 		return error;
 	}
 
 	if (mac->mac_iv_ext != NULL) {
 		error = bwi_mac_fw_load_iv(mac, mac->mac_iv_ext);
 		if (error)
-			if_printf(ifp, "load ExtIV failed\n");
+			device_printf(dev, "load ExtIV failed\n");
 	}
 	return error;
 }
@@ -1243,8 +1235,7 @@ static void
 bwi_mac_opmode_init(struct bwi_mac *mac)
 {
 	struct bwi_softc *sc = mac->mac_sc;
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211com *ic = &sc->sc_ic;
 	uint32_t mac_status;
 	uint16_t pre_tbtt;
 
@@ -1293,7 +1284,7 @@ bwi_mac_opmode_init(struct bwi_mac *mac)
 		break;
 	}
 
-	if (ic->ic_ifp->if_flags & IFF_PROMISC)
+	if (ic->ic_promisc > 0)
 		mac_status |= BWI_MAC_STATUS_PROMISC;
 
 	CSR_WRITE_4(sc, BWI_MAC_STATUS, mac_status);
@@ -1344,8 +1335,7 @@ bwi_mac_bss_param_init(struct bwi_mac *mac)
 {
 	struct bwi_softc *sc = mac->mac_sc;
 	struct bwi_phy *phy = &mac->mac_phy;
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211com *ic = &sc->sc_ic;
 	const struct ieee80211_rate_table *rt;
 	struct bwi_retry_lim lim;
 	uint16_t cw_min;
@@ -1426,7 +1416,8 @@ bwi_mac_set_ackrates(struct bwi_mac *mac, const struct ieee80211_rate_table *rt,
 		enum ieee80211_phytype modtype;
 		uint16_t ofs;
 
-		modtype = ieee80211_rate2phytype(rt, rs->rs_rates[i]);
+		modtype = ieee80211_rate2phytype(rt,
+		    rs->rs_rates[i] & IEEE80211_RATE_VAL);
 		switch (modtype) {
 		case IEEE80211_T_DS:
 			ofs = 0x4c0;
@@ -1437,7 +1428,9 @@ bwi_mac_set_ackrates(struct bwi_mac *mac, const struct ieee80211_rate_table *rt,
 		default:
 			panic("unsupported modtype %u\n", modtype);
 		}
-		ofs += 2*(ieee80211_rate2plcp(rs->rs_rates[i], modtype) & 0xf);
+		ofs += 2*(ieee80211_rate2plcp(
+		    rs->rs_rates[i] & IEEE80211_RATE_VAL,
+		    modtype) & 0xf);
 
 		MOBJ_WRITE_2(mac, BWI_COMM_MOBJ, ofs + 0x20,
 			     MOBJ_READ_2(mac, BWI_COMM_MOBJ, ofs));
@@ -1664,17 +1657,15 @@ bwi_mac_attach(struct bwi_softc *sc, int id, uint8_t rev)
 	/*
 	 * Test whether the revision of this MAC is supported
 	 */
-#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
-	for (i = 0; i < N(bwi_sup_macrev); ++i) {
+	for (i = 0; i < nitems(bwi_sup_macrev); ++i) {
 		if (bwi_sup_macrev[i] == rev)
 			break;
 	}
-	if (i == N(bwi_sup_macrev)) {
+	if (i == nitems(bwi_sup_macrev)) {
 		device_printf(sc->sc_dev, "MAC rev %u is "
 			      "not supported\n", rev);
 		return ENXIO;
 	}
-#undef N
 
 	BWI_CREATE_MAC(mac, sc, id, rev);
 	sc->sc_nmac++;
@@ -1925,8 +1916,7 @@ static void
 bwi_mac_lock(struct bwi_mac *mac)
 {
 	struct bwi_softc *sc = mac->mac_sc;
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211com *ic = &sc->sc_ic;
 
 	KASSERT((mac->mac_flags & BWI_MAC_F_LOCKED) == 0,
 	    ("mac_flags 0x%x", mac->mac_flags));
@@ -1949,8 +1939,7 @@ static void
 bwi_mac_unlock(struct bwi_mac *mac)
 {
 	struct bwi_softc *sc = mac->mac_sc;
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211com *ic = &sc->sc_ic;
 
 	KASSERT(mac->mac_flags & BWI_MAC_F_LOCKED,
 	    ("mac_flags 0x%x", mac->mac_flags));
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwimac.h b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwimac.h
index 2c5275edfa..a13731fbd3 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwimac.h
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwimac.h
@@ -32,7 +32,7 @@
  * SUCH DAMAGE.
  * 
  * $DragonFly: src/sys/dev/netif/bwi/bwimac.h,v 1.2 2008/02/15 11:15:38 sephe Exp $
- * $FreeBSD$
+ * $FreeBSD: releng/11.1/sys/dev/bwi/bwimac.h 283639 2015-05-27 22:30:21Z glebius $
  */
 
 #ifndef _BWI_MAC_H
@@ -57,6 +57,7 @@ void		bwi_mac_init_tpctl_11bg(struct bwi_mac *);
 void		bwi_mac_dummy_xmit(struct bwi_mac *);
 void		bwi_mac_reset_hwkeys(struct bwi_mac *);
 int		bwi_mac_config_ps(struct bwi_mac *);
+int		bwi_mac_fw_alloc(struct bwi_mac *);
 
 uint16_t	bwi_memobj_read_2(struct bwi_mac *, uint16_t, uint16_t);
 uint32_t	bwi_memobj_read_4(struct bwi_mac *, uint16_t, uint16_t);
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwiphy.c b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwiphy.c
index d817d26034..d5e53a2822 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwiphy.c
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwiphy.c
@@ -35,9 +35,10 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: releng/11.1/sys/dev/bwi/bwiphy.c 288087 2015-09-22 02:44:59Z adrian $");
 
 #include "opt_inet.h"
+#include "opt_wlan.h"
 
 #include <sys/param.h>
 #include <sys/endian.h>
@@ -52,6 +53,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
  
 #include <net/if.h>
+#include <net/if_var.h>
 #include <net/if_dl.h>
 #include <net/if_media.h>
 #include <net/if_types.h>
@@ -183,19 +185,17 @@ bwi_phy_attach(struct bwi_mac *mac)
 		phy->phy_tbl_data_hi = BWI_PHYR_TBL_DATA_HI_11A;
 		break;
 	case BWI_PHYINFO_TYPE_11B:
-#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
-		for (i = 0; i < N(bwi_sup_bphy); ++i) {
+		for (i = 0; i < nitems(bwi_sup_bphy); ++i) {
 			if (phyrev == bwi_sup_bphy[i].rev) {
 				phy->phy_init = bwi_sup_bphy[i].init;
 				break;
 			}
 		}
-		if (i == N(bwi_sup_bphy)) {
+		if (i == nitems(bwi_sup_bphy)) {
 			device_printf(sc->sc_dev, "unsupported 11B PHY, "
 				      "rev %u\n", phyrev);
 			return ENXIO;
 		}
-#undef N
 		phy->phy_mode = IEEE80211_MODE_11B;
 		break;
 	case BWI_PHYINFO_TYPE_11G:
@@ -427,7 +427,7 @@ static void
 bwi_phy_init_11b_rev2(struct bwi_mac *mac)
 { 
 	/* TODO:11B */
-	if_printf(mac->mac_sc->sc_ifp,
+	device_printf(mac->mac_sc->sc_dev,
 		  "%s is not implemented yet\n", __func__);
 }
 
@@ -743,8 +743,6 @@ bwi_phy_init_11b_rev6(struct bwi_mac *mac)
 	}
 }
 
-#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
-
 static void
 bwi_phy_config_11g(struct bwi_mac *mac)
 {
@@ -761,19 +759,19 @@ bwi_phy_config_11g(struct bwi_mac *mac)
 		PHY_WRITE(mac, 0x427, 0x1a);
 
 		/* Fill frequency table */
-		for (i = 0; i < N(bwi_phy_freq_11g_rev1); ++i) {
+		for (i = 0; i < nitems(bwi_phy_freq_11g_rev1); ++i) {
 			bwi_tbl_write_2(mac, BWI_PHYTBL_FREQ + i,
 					bwi_phy_freq_11g_rev1[i]);
 		}
 
 		/* Fill noise table */
-		for (i = 0; i < N(bwi_phy_noise_11g_rev1); ++i) {
+		for (i = 0; i < nitems(bwi_phy_noise_11g_rev1); ++i) {
 			bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE + i,
 					bwi_phy_noise_11g_rev1[i]);
 		}
 
 		/* Fill rotor table */
-		for (i = 0; i < N(bwi_phy_rotor_11g_rev1); ++i) {
+		for (i = 0; i < nitems(bwi_phy_rotor_11g_rev1); ++i) {
 			/* NB: data length is 4 bytes */
 			bwi_tbl_write_4(mac, BWI_PHYTBL_ROTOR + i,
 					bwi_phy_rotor_11g_rev1[i]);
@@ -796,7 +794,7 @@ bwi_phy_config_11g(struct bwi_mac *mac)
 			bwi_tbl_write_2(mac, BWI_PHYTBL_RSSI + i, i);
 
 		/* Fill noise table */
-		for (i = 0; i < N(bwi_phy_noise_11g); ++i) {
+		for (i = 0; i < nitems(bwi_phy_noise_11g); ++i) {
 			bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE + i,
 					bwi_phy_noise_11g[i]);
 		}
@@ -807,13 +805,13 @@ bwi_phy_config_11g(struct bwi_mac *mac)
 	 */
 	if (phy->phy_rev <= 2) {
 		tbl = bwi_phy_noise_scale_11g_rev2;
-		n = N(bwi_phy_noise_scale_11g_rev2);
+		n = nitems(bwi_phy_noise_scale_11g_rev2);
 	} else if (phy->phy_rev >= 7 && (PHY_READ(mac, 0x449) & 0x200)) {
 		tbl = bwi_phy_noise_scale_11g_rev7;
-		n = N(bwi_phy_noise_scale_11g_rev7);
+		n = nitems(bwi_phy_noise_scale_11g_rev7);
 	} else {
 		tbl = bwi_phy_noise_scale_11g;
-		n = N(bwi_phy_noise_scale_11g);
+		n = nitems(bwi_phy_noise_scale_11g);
 	}
 	for (i = 0; i < n; ++i)
 		bwi_tbl_write_2(mac, BWI_PHYTBL_NOISE_SCALE + i, tbl[i]);
@@ -823,10 +821,10 @@ bwi_phy_config_11g(struct bwi_mac *mac)
 	 */
 	if (phy->phy_rev == 2) {
 		tbl = bwi_phy_sigma_sq_11g_rev2;
-		n = N(bwi_phy_sigma_sq_11g_rev2);
+		n = nitems(bwi_phy_sigma_sq_11g_rev2);
 	} else if (phy->phy_rev > 2 && phy->phy_rev <= 8) {
 		tbl = bwi_phy_sigma_sq_11g_rev7;
-		n = N(bwi_phy_sigma_sq_11g_rev7);
+		n = nitems(bwi_phy_sigma_sq_11g_rev7);
 	} else {
 		tbl = NULL;
 		n = 0;
@@ -836,7 +834,7 @@ bwi_phy_config_11g(struct bwi_mac *mac)
 
 	if (phy->phy_rev == 1) {
 		/* Fill delay table */
-		for (i = 0; i < N(bwi_phy_delay_11g_rev1); ++i) {
+		for (i = 0; i < nitems(bwi_phy_delay_11g_rev1); ++i) {
 			bwi_tbl_write_4(mac, BWI_PHYTBL_DELAY + i,
 					bwi_phy_delay_11g_rev1[i]);
 		}
@@ -875,8 +873,6 @@ bwi_phy_config_11g(struct bwi_mac *mac)
 		PHY_WRITE(mac, 0x46e, 0x3cf);
 }
 
-#undef N
-
 /*
  * Configure Automatic Gain Controller
  */
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwiphy.h b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwiphy.h
index f865f1f36c..e291732ce9 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwiphy.h
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwiphy.h
@@ -32,7 +32,7 @@
  * SUCH DAMAGE.
  * 
  * $DragonFly: src/sys/dev/netif/bwi/bwiphy.h,v 1.1 2007/09/08 06:15:54 sephe Exp $
- * $FreeBSD$
+ * $FreeBSD: releng/11.1/sys/dev/bwi/bwiphy.h 191762 2009-05-03 04:01:43Z imp $
  */
 
 #ifndef _BWI_PHY_H
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwirf.c b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwirf.c
index cb881eb5de..080cf40acc 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwirf.c
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwirf.c
@@ -35,10 +35,11 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: releng/11.1/sys/dev/bwi/bwirf.c 298307 2016-04-19 23:37:24Z pfg $");
 
 #include "opt_inet.h"
 #include "opt_bwi.h"
+#include "opt_wlan.h"
 
 #include <sys/param.h>
 #include <sys/endian.h>
@@ -53,6 +54,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
  
 #include <net/if.h>
+#include <net/if_var.h>
 #include <net/if_dl.h>
 #include <net/if_media.h>
 #include <net/if_types.h>
@@ -1016,8 +1018,7 @@ bwi_rf_calibval(struct bwi_mac *mac)
 
 	val = RF_READ(mac, BWI_RFR_BBP_ATTEN);
 	idx = __SHIFTOUT(val, BWI_RFR_BBP_ATTEN_CALIB_IDX);
-	KASSERT(idx < (int)(sizeof(rf_calibvals) / sizeof(rf_calibvals[0])),
-	    ("idx %d", idx));
+	KASSERT(idx < (int)nitems(rf_calibvals), ("idx %d", idx));
 
 	calib = rf_calibvals[idx] << 1;
 	if (val & BWI_RFR_BBP_ATTEN_CALIB_BIT)
@@ -1153,7 +1154,6 @@ bwi_rf_map_txpower(struct bwi_mac *mac)
 	}
 
 #define IS_VALID_PA_PARAM(p)	((p) != 0 && (p) != -1)
-#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
 
 	/*
 	 * Extract PA parameters
@@ -1162,10 +1162,10 @@ bwi_rf_map_txpower(struct bwi_mac *mac)
 		sprom_ofs = BWI_SPROM_PA_PARAM_11A;
 	else
 		sprom_ofs = BWI_SPROM_PA_PARAM_11BG;
-	for (i = 0; i < N(pa_params); ++i)
+	for (i = 0; i < nitems(pa_params); ++i)
 		pa_params[i] = (int16_t)bwi_read_sprom(sc, sprom_ofs + (i * 2));
 
-	for (i = 0; i < N(pa_params); ++i) {
+	for (i = 0; i < nitems(pa_params); ++i) {
 		/*
 		 * If one of the PA parameters from SPROM is not valid,
 		 * fall back to the default values, if there are any.
@@ -1198,8 +1198,6 @@ bwi_rf_map_txpower(struct bwi_mac *mac)
 		}
 	}
 
-#undef N
-
 	/*
 	 * All of the PA parameters from SPROM are valid.
 	 */
@@ -1258,7 +1256,6 @@ static void
 bwi_rf_lo_update_11g(struct bwi_mac *mac)
 {
 	struct bwi_softc *sc = mac->mac_sc;
-	struct ifnet *ifp = sc->sc_ifp;
 	struct bwi_rf *rf = &mac->mac_rf;
 	struct bwi_phy *phy = &mac->mac_phy;
 	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
@@ -1327,7 +1324,7 @@ bwi_rf_lo_update_11g(struct bwi_mac *mac)
 		PHY_WRITE(mac, 0x812, 0xb2);
 	}
 
-	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
+	if ((sc->sc_flags & BWI_F_RUNNING) == 0)
 		tpctl->tp_ctrl2 = bwi_rf_get_tp_ctrl2(mac);
 	PHY_WRITE(mac, 0x80f, 0x8078);
 
@@ -1350,7 +1347,7 @@ bwi_rf_lo_update_11g(struct bwi_mac *mac)
 		PHY_WRITE(mac, 0x15, devi_ctrl | 0xefa0);
 	}
 
-	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
+	if ((sc->sc_flags & BWI_F_RUNNING) == 0)
 		tpctl = NULL;
 	bwi_rf_lo_adjust(mac, tpctl);
 
@@ -1460,7 +1457,7 @@ _bwi_rf_lo_update_11g(struct bwi_mac *mac, uint16_t orig_rf7a)
 	static const int rf_lo_measure_order[RF_ATTEN_LISTSZ] =
 	{ 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 10, 11, 12, 13 };
 
-	struct ifnet *ifp = mac->mac_sc->sc_ifp;
+	struct bwi_softc *sc = mac->mac_sc;
 	struct bwi_rf_lo lo_save, *lo;
 	uint8_t devi_ctrl = 0;
 	int idx, adj_rf7a = 0;
@@ -1474,7 +1471,7 @@ _bwi_rf_lo_update_11g(struct bwi_mac *mac, uint16_t orig_rf7a)
 		for (bbp_atten = 0; bbp_atten < BBP_ATTEN_MAX; ++bbp_atten) {
 			uint16_t tp_ctrl2, rf7a;
 
-			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
+			if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
 				if (idx == 0) {
 					bzero(&lo_save, sizeof(lo_save));
 				} else if (init_rf_atten < 0) {
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwirf.h b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwirf.h
index af2ce1745c..bb293394bb 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwirf.h
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/bwirf.h
@@ -32,7 +32,7 @@
  * SUCH DAMAGE.
  * 
  * $DragonFly: src/sys/dev/netif/bwi/bwirf.h,v 1.3 2007/10/03 04:53:19 sephe Exp $
- * $FreeBSD$
+ * $FreeBSD: releng/11.1/sys/dev/bwi/bwirf.h 191762 2009-05-03 04:01:43Z imp $
  */
 
 #ifndef _BWI_RF_H
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwi.c b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwi.c
index bd53240585..c02fbc60fb 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwi.c
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwi.c
@@ -1,13 +1,13 @@
 /*
  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
- * 
+ *
  * This code is derived from software contributed to The DragonFly Project
  * by Sepherosa Ziehau <sepherosa@gmail.com>
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ -17,7 +17,7 @@
  * 3. Neither the name of The DragonFly Project nor the names of its
  *    contributors may be used to endorse or promote products derived
  *    from this software without specific, prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
@@ -30,15 +30,16 @@
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- * 
+ *
  * $DragonFly: src/sys/dev/netif/bwi/if_bwi.c,v 1.19 2008/02/15 11:15:38 sephe Exp $
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: releng/11.1/sys/dev/bwi/if_bwi.c 300755 2016-05-26 16:48:20Z avos $");
 
 #include "opt_inet.h"
 #include "opt_bwi.h"
+#include "opt_wlan.h"
 
 #include <sys/param.h>
 #include <sys/endian.h>
@@ -52,8 +53,9 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysctl.h>
 #include <sys/systm.h>
 #include <sys/taskqueue.h>
- 
+
 #include <net/if.h>
+#include <net/if_var.h>
 #include <net/if_dl.h>
 #include <net/if_media.h>
 #include <net/if_types.h>
@@ -70,7 +72,7 @@ __FBSDID("$FreeBSD$");
 #include <net/bpf.h>
 
 #ifdef INET
-#include <netinet/in.h> 
+#include <netinet/in.h>
 #include <netinet/if_ether.h>
 #endif
 
@@ -100,18 +102,20 @@ static struct ieee80211vap *bwi_vap_create(struct ieee80211com *,
 		    const uint8_t [IEEE80211_ADDR_LEN],
 		    const uint8_t [IEEE80211_ADDR_LEN]);
 static void	bwi_vap_delete(struct ieee80211vap *);
-static void	bwi_init(void *);
-static int	bwi_ioctl(struct ifnet *, u_long, caddr_t);
-static void	bwi_start(struct ifnet *);
-static void	bwi_start_locked(struct ifnet *);
+static void	bwi_init(struct bwi_softc *);
+static void	bwi_parent(struct ieee80211com *);
+static int	bwi_transmit(struct ieee80211com *, struct mbuf *);
+static void	bwi_start_locked(struct bwi_softc *);
 static int	bwi_raw_xmit(struct ieee80211_node *, struct mbuf *,
 			const struct ieee80211_bpf_params *);
 static void	bwi_watchdog(void *);
 static void	bwi_scan_start(struct ieee80211com *);
+static void	bwi_getradiocaps(struct ieee80211com *, int, int *,
+		    struct ieee80211_channel[]);
 static void	bwi_set_channel(struct ieee80211com *);
 static void	bwi_scan_end(struct ieee80211com *);
 static int	bwi_newstate(struct ieee80211vap *, enum ieee80211_state, int);
-static void	bwi_updateslot(struct ifnet *);
+static void	bwi_updateslot(struct ieee80211com *);
 static int	bwi_media_change(struct ifnet *);
 
 static void	bwi_calibrate(void *);
@@ -301,6 +305,9 @@ static const struct {
 	[108]	= { 7, 3 }
 };
 
+static const uint8_t bwi_chan_2ghz[] =
+	{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
+
 #ifdef BWI_DEBUG
 #ifdef BWI_DEBUG_VERBOSE
 static uint32_t bwi_debug = BWI_DBG_ATTACH | BWI_DBG_INIT | BWI_DBG_TXPOWER;
@@ -350,14 +357,11 @@ bwi_setup_desc32(struct bwi_softc *sc, struct bwi_desc32 *desc_array,
 int
 bwi_attach(struct bwi_softc *sc)
 {
-	struct ieee80211com *ic;
+	struct ieee80211com *ic = &sc->sc_ic;
 	device_t dev = sc->sc_dev;
-	struct ifnet *ifp;
 	struct bwi_mac *mac;
 	struct bwi_phy *phy;
 	int i, error;
-	uint8_t bands;
-	uint8_t macaddr[IEEE80211_ADDR_LEN];
 
 	BWI_LOCK_INIT(sc);
 
@@ -369,8 +373,8 @@ bwi_attach(struct bwi_softc *sc)
 	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET, "%s taskq",
 		device_get_nameunit(dev));
 	TASK_INIT(&sc->sc_restart_task, 0, bwi_restart, sc);
-
 	callout_init_mtx(&sc->sc_calib_ch, &sc->sc_mtx, 0);
+	mbufq_init(&sc->sc_snd, ifqmaxlen);
 
 	/*
 	 * Initialize sysctl variables
@@ -444,53 +448,34 @@ bwi_attach(struct bwi_softc *sc)
 	if (error)
 		goto fail;
 
-	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
-	if (ifp == NULL) {
-		device_printf(dev, "can not if_alloc()\n");
-		error = ENOSPC;
+	error = bwi_mac_fw_alloc(mac);
+	if (error)
 		goto fail;
-	}
-	ic = ifp->if_l2com;
 
-	/* set these up early for if_printf use */
-	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
-
-	ifp->if_softc = sc;
-	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
-	ifp->if_init = bwi_init;
-	ifp->if_ioctl = bwi_ioctl;
-	ifp->if_start = bwi_start;
-	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
-	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
-	IFQ_SET_READY(&ifp->if_snd);
 	callout_init_mtx(&sc->sc_watchdog_timer, &sc->sc_mtx, 0);
 
 	/*
 	 * Setup ratesets, phytype, channels and get MAC address
 	 */
-	bands = 0;
 	if (phy->phy_mode == IEEE80211_MODE_11B ||
 	    phy->phy_mode == IEEE80211_MODE_11G) {
-		setbit(&bands, IEEE80211_MODE_11B);
 		if (phy->phy_mode == IEEE80211_MODE_11B) {
 			ic->ic_phytype = IEEE80211_T_DS;
 		} else {
 			ic->ic_phytype = IEEE80211_T_OFDM;
-			setbit(&bands, IEEE80211_MODE_11G);
 		}
 
-		bwi_get_eaddr(sc, BWI_SPROM_11BG_EADDR, macaddr);
-		if (IEEE80211_IS_MULTICAST(macaddr)) {
-			bwi_get_eaddr(sc, BWI_SPROM_11A_EADDR, macaddr);
-			if (IEEE80211_IS_MULTICAST(macaddr)) {
+		bwi_get_eaddr(sc, BWI_SPROM_11BG_EADDR, ic->ic_macaddr);
+		if (IEEE80211_IS_MULTICAST(ic->ic_macaddr)) {
+			bwi_get_eaddr(sc, BWI_SPROM_11A_EADDR, ic->ic_macaddr);
+			if (IEEE80211_IS_MULTICAST(ic->ic_macaddr)) {
 				device_printf(dev,
 				    "invalid MAC address: %6D\n",
-				    macaddr, ":");
+				    ic->ic_macaddr, ":");
 			}
 		}
 	} else if (phy->phy_mode == IEEE80211_MODE_11A) {
 		/* TODO:11A */
-		setbit(&bands, IEEE80211_MODE_11A);
 		error = ENXIO;
 		goto fail;
 	} else {
@@ -502,9 +487,11 @@ bwi_attach(struct bwi_softc *sc)
 				   BWI_SPROM_CARD_INFO_LOCALE);
 	DPRINTF(sc, BWI_DBG_ATTACH, "locale: %d\n", sc->sc_locale);
 	/* XXX use locale */
-	ieee80211_init_channels(ic, NULL, &bands);
+	bwi_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
+	    ic->ic_channels);
 
-	ic->ic_ifp = ifp;
+	ic->ic_softc = sc;
+	ic->ic_name = device_get_nameunit(dev);
 	ic->ic_caps = IEEE80211_C_STA |
 		      IEEE80211_C_SHSLOT |
 		      IEEE80211_C_SHPREAMBLE |
@@ -512,7 +499,7 @@ bwi_attach(struct bwi_softc *sc)
 		      IEEE80211_C_BGSCAN |
 		      IEEE80211_C_MONITOR;
 	ic->ic_opmode = IEEE80211_M_STA;
-	ieee80211_ifattach(ic, macaddr);
+	ieee80211_ifattach(ic);
 
 	ic->ic_headroom = sizeof(struct bwi_txbuf_hdr);
 
@@ -523,7 +510,10 @@ bwi_attach(struct bwi_softc *sc)
 	ic->ic_updateslot = bwi_updateslot;
 	ic->ic_scan_start = bwi_scan_start;
 	ic->ic_scan_end = bwi_scan_end;
+	ic->ic_getradiocaps = bwi_getradiocaps;
 	ic->ic_set_channel = bwi_set_channel;
+	ic->ic_transmit = bwi_transmit;
+	ic->ic_parent = bwi_parent;
 
 	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
 
@@ -569,8 +559,7 @@ fail:
 int
 bwi_detach(struct bwi_softc *sc)
 {
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211com *ic = &sc->sc_ic;
 	int i;
 
 	bwi_stop(sc, 1);
@@ -582,8 +571,8 @@ bwi_detach(struct bwi_softc *sc)
 	for (i = 0; i < sc->sc_nmac; ++i)
 		bwi_mac_detach(&sc->sc_mac[i]);
 	bwi_dma_free(sc);
-	if_free(ifp);
 	taskqueue_free(sc->sc_tq);
+	mbufq_drain(&sc->sc_snd);
 
 	BWI_LOCK_DESTROY(sc);
 
@@ -601,14 +590,11 @@ bwi_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 
 	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
 		return NULL;
-	bvp = (struct bwi_vap *) malloc(sizeof(struct bwi_vap),
-	    M_80211_VAP, M_WAITOK | M_ZERO);
-	if (bvp == NULL)
-		return NULL;
+	bvp = malloc(sizeof(struct bwi_vap), M_80211_VAP, M_WAITOK | M_ZERO);
 	vap = &bvp->bv_vap;
 	/* enable s/w bmiss handling for sta mode */
 	ieee80211_vap_setup(ic, vap, name, unit, opmode,
-	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
+	    flags | IEEE80211_CLONE_NOBEACONS, bssid);
 
 	/* override default methods */
 	bvp->bv_newstate = vap->iv_newstate;
@@ -619,7 +605,8 @@ bwi_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 	ieee80211_ratectl_init(vap);
 
 	/* complete setup */
-	ieee80211_vap_attach(vap, bwi_media_change, ieee80211_media_status);
+	ieee80211_vap_attach(vap, bwi_media_change, ieee80211_media_status,
+	    mac);
 	ic->ic_opmode = opmode;
 	return vap;
 }
@@ -643,9 +630,8 @@ bwi_suspend(struct bwi_softc *sc)
 void
 bwi_resume(struct bwi_softc *sc)
 {
-	struct ifnet *ifp = sc->sc_ifp;
 
-	if (ifp->if_flags & IFF_UP)
+	if (sc->sc_ic.ic_nrunning > 0)
 		bwi_init(sc);
 }
 
@@ -778,7 +764,6 @@ bwi_regwin_info(struct bwi_softc *sc, uint16_t *type, uint8_t *rev)
 static int
 bwi_bbp_attach(struct bwi_softc *sc)
 {
-#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
 	uint16_t bbp_id, rw_type;
 	uint8_t rw_rev;
 	uint32_t info;
@@ -808,7 +793,7 @@ bwi_bbp_attach(struct bwi_softc *sc)
 
 		sc->sc_cap = CSR_READ_4(sc, BWI_CAPABILITY);
 	} else {
-		for (i = 0; i < N(bwi_bbpid_map); ++i) {
+		for (i = 0; i < nitems(bwi_bbpid_map); ++i) {
 			if (sc->sc_pci_did >= bwi_bbpid_map[i].did_min &&
 			    sc->sc_pci_did <= bwi_bbpid_map[i].did_max) {
 				bbp_id = bwi_bbpid_map[i].bbp_id;
@@ -832,7 +817,7 @@ bwi_bbp_attach(struct bwi_softc *sc)
 	if (rw_type == BWI_REGWIN_T_COM && rw_rev >= 4) {
 		nregwin = __SHIFTOUT(info, BWI_INFO_NREGWIN_MASK);
 	} else {
-		for (i = 0; i < N(bwi_regwin_count); ++i) {
+		for (i = 0; i < nitems(bwi_regwin_count); ++i) {
 			if (bwi_regwin_count[i].bbp_id == bbp_id) {
 				nregwin = bwi_regwin_count[i].nregwin;
 				break;
@@ -914,7 +899,6 @@ bwi_bbp_attach(struct bwi_softc *sc)
 		return error;
 
 	return 0;
-#undef N
 }
 
 int
@@ -1209,27 +1193,26 @@ bwi_set_clock_delay(struct bwi_softc *sc)
 }
 
 static void
-bwi_init(void *xsc)
+bwi_init(struct bwi_softc *sc)
 {
-	struct bwi_softc *sc = xsc;
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211com *ic = &sc->sc_ic;
 
 	BWI_LOCK(sc);
 	bwi_init_statechg(sc, 1);
 	BWI_UNLOCK(sc);
 
-	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
+	if (sc->sc_flags & BWI_F_RUNNING)
 		ieee80211_start_all(ic);		/* start all vap's */
 }
 
 static void
 bwi_init_statechg(struct bwi_softc *sc, int statechg)
 {
-	struct ifnet *ifp = sc->sc_ifp;
 	struct bwi_mac *mac;
 	int error;
 
+	BWI_ASSERT_LOCKED(sc);
+
 	bwi_stop_locked(sc, statechg);
 
 	bwi_bbp_power_on(sc, BWI_CLOCK_MODE_FAST);
@@ -1239,20 +1222,21 @@ bwi_init_statechg(struct bwi_softc *sc, int statechg)
 	mac = &sc->sc_mac[0];
 	error = bwi_regwin_switch(sc, &mac->mac_regwin, NULL);
 	if (error) {
-		if_printf(ifp, "%s: error %d on regwin switch\n",
+		device_printf(sc->sc_dev, "%s: error %d on regwin switch\n",
 		    __func__, error);
 		goto bad;
 	}
 	error = bwi_mac_init(mac);
 	if (error) {
-		if_printf(ifp, "%s: error %d on MAC init\n", __func__, error);
+		device_printf(sc->sc_dev, "%s: error %d on MAC init\n",
+		    __func__, error);
 		goto bad;
 	}
 
 	bwi_bbp_power_on(sc, BWI_CLOCK_MODE_DYN);
 
 	bwi_set_bssid(sc, bwi_zero_addr);	/* Clear BSSID */
-	bwi_set_addr_filter(sc, BWI_ADDR_FILTER_MYADDR, IF_LLADDR(ifp));
+	bwi_set_addr_filter(sc, BWI_ADDR_FILTER_MYADDR, sc->sc_ic.ic_macaddr);
 
 	bwi_mac_reset_hwkeys(mac);
 
@@ -1270,7 +1254,8 @@ bwi_init_statechg(struct bwi_softc *sc, int statechg)
 			CSR_READ_4(sc, BWI_TXSTATUS1);
 		}
 		if (i == NRETRY)
-			if_printf(ifp, "%s: can't drain TX status\n", __func__);
+			device_printf(sc->sc_dev,
+			    "%s: can't drain TX status\n", __func__);
 #undef NRETRY
 	}
 
@@ -1280,14 +1265,14 @@ bwi_init_statechg(struct bwi_softc *sc, int statechg)
 	/* Start MAC */
 	error = bwi_mac_start(mac);
 	if (error) {
-		if_printf(ifp, "%s: error %d starting MAC\n", __func__, error);
+		device_printf(sc->sc_dev, "%s: error %d starting MAC\n",
+		    __func__, error);
 		goto bad;
 	}
 
 	/* Clear stop flag before enabling interrupt */
 	sc->sc_flags &= ~BWI_F_STOP;
-
-	ifp->if_drv_flags |= IFF_DRV_RUNNING;
+	sc->sc_flags |= BWI_F_RUNNING;
 	callout_reset(&sc->sc_watchdog_timer, hz, bwi_watchdog, sc);
 
 	/* Enable intrs */
@@ -1297,135 +1282,110 @@ bad:
 	bwi_stop_locked(sc, 1);
 }
 
-static int
-bwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
-{
-#define	IS_RUNNING(ifp) \
-	((ifp->if_flags & IFF_UP) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
-	struct bwi_softc *sc = ifp->if_softc;
-	struct ieee80211com *ic = ifp->if_l2com;
-	struct ifreq *ifr = (struct ifreq *) data;
-	int error = 0, startall = 0;
-
-	switch (cmd) {
-	case SIOCSIFFLAGS:
-		BWI_LOCK(sc);
-		if (IS_RUNNING(ifp)) {
-			struct bwi_mac *mac;
-			int promisc = -1;
-
-			KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC,
-			    ("current regwin type %d",
-			    sc->sc_cur_regwin->rw_type));
-			mac = (struct bwi_mac *)sc->sc_cur_regwin;
-
-			if ((ifp->if_flags & IFF_PROMISC) &&
-			    (sc->sc_flags & BWI_F_PROMISC) == 0) {
-				promisc = 1;
-				sc->sc_flags |= BWI_F_PROMISC;
-			} else if ((ifp->if_flags & IFF_PROMISC) == 0 &&
-				   (sc->sc_flags & BWI_F_PROMISC)) {
-				promisc = 0;
-				sc->sc_flags &= ~BWI_F_PROMISC;
-			}
-
-			if (promisc >= 0)
-				bwi_mac_set_promisc(mac, promisc);
-		}
-
-		if (ifp->if_flags & IFF_UP) {
-			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
-				bwi_init_statechg(sc, 1);
-				startall = 1;
-			}
-		} else {
-			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
-				bwi_stop_locked(sc, 1);
-		}
-		BWI_UNLOCK(sc);
-		if (startall)
-			ieee80211_start_all(ic);
-		break;
-	case SIOCGIFMEDIA:
-		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
-		break;
-	case SIOCGIFADDR:
-		error = ether_ioctl(ifp, cmd, data);
-		break;
-	default:
-		error = EINVAL;
-		break;
-	}
-	return error;
-#undef IS_RUNNING
-}
-
 static void
-bwi_start(struct ifnet *ifp)
+bwi_parent(struct ieee80211com *ic)
 {
-	struct bwi_softc *sc = ifp->if_softc;
+	struct bwi_softc *sc = ic->ic_softc;
+	int startall = 0;
 
 	BWI_LOCK(sc);
-	bwi_start_locked(ifp);
+	if (ic->ic_nrunning > 0) {
+		struct bwi_mac *mac;
+		int promisc = -1;
+
+		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC,
+		    ("current regwin type %d",
+		    sc->sc_cur_regwin->rw_type));
+		mac = (struct bwi_mac *)sc->sc_cur_regwin;
+
+		if (ic->ic_promisc > 0 && (sc->sc_flags & BWI_F_PROMISC) == 0) {
+			promisc = 1;
+			sc->sc_flags |= BWI_F_PROMISC;
+		} else if (ic->ic_promisc == 0 &&
+		    (sc->sc_flags & BWI_F_PROMISC) != 0) {
+			promisc = 0;
+			sc->sc_flags &= ~BWI_F_PROMISC;
+		}
+
+		if (promisc >= 0)
+			bwi_mac_set_promisc(mac, promisc);
+	}
+	if (ic->ic_nrunning > 0) {
+		if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
+			bwi_init_statechg(sc, 1);
+			startall = 1;
+		}
+	} else if (sc->sc_flags & BWI_F_RUNNING)
+		bwi_stop_locked(sc, 1);
 	BWI_UNLOCK(sc);
+	if (startall)
+		ieee80211_start_all(ic);
+}
+
+static int
+bwi_transmit(struct ieee80211com *ic, struct mbuf *m)
+{
+	struct bwi_softc *sc = ic->ic_softc;
+	int error;
+
+	BWI_LOCK(sc);
+	if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
+		BWI_UNLOCK(sc);
+		return (ENXIO);
+	}
+	error = mbufq_enqueue(&sc->sc_snd, m);
+	if (error) {
+		BWI_UNLOCK(sc);
+		return (error);
+	}
+	bwi_start_locked(sc);
+	BWI_UNLOCK(sc);
+	return (0);
 }
 
 static void
-bwi_start_locked(struct ifnet *ifp)
+bwi_start_locked(struct bwi_softc *sc)
 {
-	struct bwi_softc *sc = ifp->if_softc;
 	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
 	struct ieee80211_frame *wh;
 	struct ieee80211_node *ni;
-	struct ieee80211_key *k;
 	struct mbuf *m;
 	int trans, idx;
 
-	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
-		return;
+	BWI_ASSERT_LOCKED(sc);
 
 	trans = 0;
 	idx = tbd->tbd_idx;
 
-	while (tbd->tbd_buf[idx].tb_mbuf == NULL) {
-		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);	/* XXX: LOCK */
-		if (m == NULL)
-			break;
-
+	while (tbd->tbd_buf[idx].tb_mbuf == NULL &&
+	    tbd->tbd_used + BWI_TX_NSPRDESC < BWI_TX_NDESC &&
+	    (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 		wh = mtod(m, struct ieee80211_frame *);
-		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
-			k = ieee80211_crypto_encap(ni, m);
-			if (k == NULL) {
-				ieee80211_free_node(ni);
-				m_freem(m);
-				ifp->if_oerrors++;
-				continue;
-			}
-		}
-		wh = NULL;	/* Catch any invalid use */
-
-		if (bwi_encap(sc, idx, m, ni) != 0) {
-			/* 'm' is freed in bwi_encap() if we reach here */
-			if (ni != NULL)
-				ieee80211_free_node(ni);
-			ifp->if_oerrors++;
+		if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) != 0 &&
+		    ieee80211_crypto_encap(ni, m) == NULL) {
+			if_inc_counter(ni->ni_vap->iv_ifp,
+			    IFCOUNTER_OERRORS, 1);
+			ieee80211_free_node(ni);
+			m_freem(m);
+			continue;
+		}
+		if (bwi_encap(sc, idx, m, ni) != 0) {
+			/* 'm' is freed in bwi_encap() if we reach here */
+			if (ni != NULL) {
+				if_inc_counter(ni->ni_vap->iv_ifp,
+				    IFCOUNTER_OERRORS, 1);
+				ieee80211_free_node(ni);
+			} else
+				counter_u64_add(sc->sc_ic.ic_oerrors, 1);
 			continue;
 		}
-
 		trans = 1;
 		tbd->tbd_used++;
 		idx = (idx + 1) % BWI_TX_NDESC;
-
-		ifp->if_opackets++;
-
-		if (tbd->tbd_used + BWI_TX_NSPRDESC >= BWI_TX_NDESC) {
-			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
-			break;
-		}
 	}
-	tbd->tbd_idx = idx;
 
+	tbd->tbd_idx = idx;
 	if (trans)
 		sc->sc_tx_timer = 5;
 }
@@ -1435,14 +1395,12 @@ bwi_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	const struct ieee80211_bpf_params *params)
 {
 	struct ieee80211com *ic = ni->ni_ic;
-	struct ifnet *ifp = ic->ic_ifp;
-	struct bwi_softc *sc = ifp->if_softc;
+	struct bwi_softc *sc = ic->ic_softc;
 	/* XXX wme? */
 	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
 	int idx, error;
 
-	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
-		ieee80211_free_node(ni);
+	if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
 		m_freem(m);
 		return ENETDOWN;
 	}
@@ -1464,15 +1422,9 @@ bwi_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 		error = bwi_encap_raw(sc, idx, m, ni, params);
 	}
 	if (error == 0) {
-		ifp->if_opackets++;
-		if (++tbd->tbd_used + BWI_TX_NSPRDESC >= BWI_TX_NDESC)
-			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
+		tbd->tbd_used++;
 		tbd->tbd_idx = (idx + 1) % BWI_TX_NDESC;
 		sc->sc_tx_timer = 5;
-	} else {
-		/* NB: m is reclaimed on encap failure */
-		ieee80211_free_node(ni);
-		ifp->if_oerrors++;
 	}
 	BWI_UNLOCK(sc);
 	return error;
@@ -1482,14 +1434,12 @@ static void
 bwi_watchdog(void *arg)
 {
 	struct bwi_softc *sc;
-	struct ifnet *ifp;
 
 	sc = arg;
-	ifp = sc->sc_ifp;
 	BWI_ASSERT_LOCKED(sc);
 	if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0) {
-		if_printf(ifp, "watchdog timeout\n");
-		ifp->if_oerrors++;
+		device_printf(sc->sc_dev, "watchdog timeout\n");
+		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
 		taskqueue_enqueue(sc->sc_tq, &sc->sc_restart_task);
 	}
 	callout_reset(&sc->sc_watchdog_timer, hz, bwi_watchdog, sc);
@@ -1506,7 +1456,6 @@ bwi_stop(struct bwi_softc *sc, int statechg)
 static void
 bwi_stop_locked(struct bwi_softc *sc, int statechg)
 {
-	struct ifnet *ifp = sc->sc_ifp;
 	struct bwi_mac *mac;
 	int i, error, pwr_off = 0;
 
@@ -1517,7 +1466,7 @@ bwi_stop_locked(struct bwi_softc *sc, int statechg)
 	sc->sc_led_blinking = 0;
 	sc->sc_flags |= BWI_F_STOP;
 
-	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
+	if (sc->sc_flags & BWI_F_RUNNING) {
 		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC,
 		    ("current regwin type %d", sc->sc_cur_regwin->rw_type));
 		mac = (struct bwi_mac *)sc->sc_cur_regwin;
@@ -1549,14 +1498,13 @@ bwi_stop_locked(struct bwi_softc *sc, int statechg)
 
 	sc->sc_tx_timer = 0;
 	callout_stop(&sc->sc_watchdog_timer);
-	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
+	sc->sc_flags &= ~BWI_F_RUNNING;
 }
 
 void
 bwi_intr(void *xsc)
 {
 	struct bwi_softc *sc = xsc;
-	struct ifnet *ifp = sc->sc_ifp;
 	struct bwi_mac *mac;
 	uint32_t intr_status;
 	uint32_t txrx_intr_status[BWI_TXRX_NRING];
@@ -1564,8 +1512,8 @@ bwi_intr(void *xsc)
 
 	BWI_LOCK(sc);
 
-#if !defined(__HAIKU__)
-	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 ||
+#ifndef __HAIKU__
+	if ((sc->sc_flags & BWI_F_RUNNING) == 0 ||
 	    (sc->sc_flags & BWI_F_STOP)) {
 		BWI_UNLOCK(sc);
 		return;
@@ -1611,7 +1559,7 @@ bwi_intr(void *xsc)
 			 i, txrx_intr_status[i]);
 
 		if (txrx_intr_status[i] & BWI_TXRX_INTR_ERROR) {
-			if_printf(ifp,
+			device_printf(sc->sc_dev,
 			    "%s: intr fatal TX/RX (%d) error 0x%08x\n",
 			    __func__, i, txrx_intr_status[i]);
 			txrx_error = 1;
@@ -1651,7 +1599,8 @@ bwi_intr(void *xsc)
 	 */
 	if (intr_status & BWI_INTR_PHY_TXERR) {
 		if (mac->mac_flags & BWI_MAC_F_PHYE_RESET) {
-			if_printf(ifp, "%s: intr PHY TX error\n", __func__);
+			device_printf(sc->sc_dev, "%s: intr PHY TX error\n",
+			    __func__);
 			taskqueue_enqueue(sc->sc_tq, &sc->sc_restart_task);
 			BWI_UNLOCK(sc);
 			return;
@@ -1666,7 +1615,7 @@ bwi_intr(void *xsc)
 		bwi_mac_config_ps(mac);
 
 	if (intr_status & BWI_INTR_EO_ATIM)
-		if_printf(ifp, "EO_ATIM\n");
+		device_printf(sc->sc_dev, "EO_ATIM\n");
 
 	if (intr_status & BWI_INTR_PMQ) {
 		for (;;) {
@@ -1677,7 +1626,7 @@ bwi_intr(void *xsc)
 	}
 
 	if (intr_status & BWI_INTR_NOISE)
-		if_printf(ifp, "intr noise\n");
+		device_printf(sc->sc_dev, "intr noise\n");
 
 	if (txrx_intr_status[0] & BWI_TXRX_INTR_RX) {
 		rx_data = sc->sc_rxeof(sc);
@@ -1726,7 +1675,7 @@ bwi_intr(void *xsc)
 static void
 bwi_scan_start(struct ieee80211com *ic)
 {
-	struct bwi_softc *sc = ic->ic_ifp->if_softc;
+	struct bwi_softc *sc = ic->ic_softc;
 
 	BWI_LOCK(sc);
 	/* Enable MAC beacon promiscuity */
@@ -1734,10 +1683,47 @@ bwi_scan_start(struct ieee80211com *ic)
 	BWI_UNLOCK(sc);
 }
 
+static void
+bwi_getradiocaps(struct ieee80211com *ic,
+    int maxchans, int *nchans, struct ieee80211_channel chans[])
+{
+	struct bwi_softc *sc = ic->ic_softc;
+	struct bwi_mac *mac;
+	struct bwi_phy *phy;
+	uint8_t bands[IEEE80211_MODE_BYTES];
+
+	/*
+	 * XXX First MAC is known to exist
+	 * TODO2
+	 */
+	mac = &sc->sc_mac[0];
+	phy = &mac->mac_phy;
+
+	memset(bands, 0, sizeof(bands));
+	switch (phy->phy_mode) {
+	case IEEE80211_MODE_11G:
+		setbit(bands, IEEE80211_MODE_11G);
+		/* FALLTHROUGH */
+	case IEEE80211_MODE_11B:
+		setbit(bands, IEEE80211_MODE_11B);
+		break;
+	case IEEE80211_MODE_11A:
+		/* TODO:11A */
+		setbit(bands, IEEE80211_MODE_11A);
+		device_printf(sc->sc_dev, "no 11a support\n");
+		return;
+	default:
+		panic("unknown phymode %d\n", phy->phy_mode);
+	}
+
+	ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
+	    bwi_chan_2ghz, nitems(bwi_chan_2ghz), bands, 0);
+}
+
 static void
 bwi_set_channel(struct ieee80211com *ic)
 {
-	struct bwi_softc *sc = ic->ic_ifp->if_softc;
+	struct bwi_softc *sc = ic->ic_softc;
 	struct ieee80211_channel *c = ic->ic_curchan;
 	struct bwi_mac *mac;
 
@@ -1763,7 +1749,7 @@ bwi_set_channel(struct ieee80211com *ic)
 static void
 bwi_scan_end(struct ieee80211com *ic)
 {
-	struct bwi_softc *sc = ic->ic_ifp->if_softc;
+	struct bwi_softc *sc = ic->ic_softc;
 
 	BWI_LOCK(sc);
 	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PASS_BCN);
@@ -1775,9 +1761,8 @@ bwi_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 {
 	struct bwi_vap *bvp = BWI_VAP(vap);
 	struct ieee80211com *ic= vap->iv_ic;
-	struct ifnet *ifp = ic->ic_ifp;
+	struct bwi_softc *sc = ic->ic_softc;
 	enum ieee80211_state ostate = vap->iv_state;
-	struct bwi_softc *sc = ifp->if_softc;
 	struct bwi_mac *mac;
 	int error;
 
@@ -1804,7 +1789,7 @@ bwi_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 			 * the same AP, this will reinialize things
 			 * correctly...
 			 */
-			if (ic->ic_opmode == IEEE80211_M_STA && 
+			if (ic->ic_opmode == IEEE80211_M_STA &&
 			    !(sc->sc_flags & BWI_F_STOP))
 				bwi_set_bssid(sc, bwi_zero_addr);
 		}
@@ -1920,10 +1905,10 @@ bwi_dma_alloc(struct bwi_softc *sc)
 			       lowaddr,			/* lowaddr */
 			       BUS_SPACE_MAXADDR,	/* highaddr */
 			       NULL, NULL,		/* filter, filterarg */
-			       MAXBSIZE,		/* maxsize */
+			       BUS_SPACE_MAXSIZE,	/* maxsize */
 			       BUS_SPACE_UNRESTRICTED,	/* nsegments */
 			       BUS_SPACE_MAXSIZE_32BIT,	/* maxsegsize */
-			       BUS_DMA_ALLOCNOW,	/* flags */
+			       0,			/* flags */
 			       NULL, NULL,		/* lockfunc, lockarg */
 			       &sc->sc_parent_dtag);
 	if (error) {
@@ -1943,8 +1928,8 @@ bwi_dma_alloc(struct bwi_softc *sc)
 				NULL, NULL,
 				tx_ring_sz,
 				1,
-				BUS_SPACE_MAXSIZE_32BIT,
-				BUS_DMA_ALLOCNOW,
+				tx_ring_sz,
+				0,
 				NULL, NULL,
 				&sc->sc_txring_dtag);
 	if (error) {
@@ -1973,8 +1958,8 @@ bwi_dma_alloc(struct bwi_softc *sc)
 				NULL, NULL,
 				rx_ring_sz,
 				1,
-				BUS_SPACE_MAXSIZE_32BIT,
-				BUS_DMA_ALLOCNOW,
+				rx_ring_sz,
+				0,
 				NULL, NULL,
 				&sc->sc_rxring_dtag);
 	if (error) {
@@ -2098,8 +2083,8 @@ bwi_dma_txstats_alloc(struct bwi_softc *sc, uint32_t ctrl_base,
 				NULL, NULL,
 				dma_size,
 				1,
-				BUS_SPACE_MAXSIZE_32BIT,
-				BUS_DMA_ALLOCNOW,
+				dma_size,
+				0,
 				NULL, NULL,
 				&st->stats_ring_dtag);
 	if (error) {
@@ -2146,8 +2131,8 @@ bwi_dma_txstats_alloc(struct bwi_softc *sc, uint32_t ctrl_base,
 				NULL, NULL,
 				dma_size,
 				1,
-				BUS_SPACE_MAXSIZE_32BIT,
-				BUS_DMA_ALLOCNOW,
+				dma_size,
+				0,
 				NULL, NULL,
 				&st->stats_dtag);
 	if (error) {
@@ -2229,7 +2214,7 @@ bwi_dma_mbuf_create(struct bwi_softc *sc)
 				NULL, NULL,
 				MCLBYTES,
 				1,
-				BUS_SPACE_MAXSIZE_32BIT,
+				MCLBYTES,
 				BUS_DMA_ALLOCNOW,
 				NULL, NULL,
 				&sc->sc_buf_dtag);
@@ -2623,8 +2608,7 @@ bwi_rxeof(struct bwi_softc *sc, int end_idx)
 {
 	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
 	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211com *ic = &sc->sc_ic;
 	int idx, rx_data = 0;
 
 	idx = rbd->rbd_idx;
@@ -2643,7 +2627,7 @@ bwi_rxeof(struct bwi_softc *sc, int end_idx)
 				BUS_DMASYNC_POSTREAD);
 
 		if (bwi_newbuf(sc, idx, 0)) {
-			ifp->if_ierrors++;
+			counter_u64_add(ic->ic_ierrors, 1);
 			goto next;
 		}
 
@@ -2657,18 +2641,18 @@ bwi_rxeof(struct bwi_softc *sc, int end_idx)
 
 		buflen = le16toh(hdr->rxh_buflen);
 		if (buflen < BWI_FRAME_MIN_LEN(wh_ofs)) {
-			if_printf(ifp, "%s: zero length data, hdr_extra %d\n",
-				  __func__, hdr_extra);
-			ifp->if_ierrors++;
+			device_printf(sc->sc_dev,
+			    "%s: zero length data, hdr_extra %d\n",
+			    __func__, hdr_extra);
+			counter_u64_add(ic->ic_ierrors, 1);
 			m_freem(m);
 			goto next;
 		}
 
-	        bcopy((uint8_t *)(hdr + 1) + hdr_extra, &plcp, sizeof(plcp));	
+	        bcopy((uint8_t *)(hdr + 1) + hdr_extra, &plcp, sizeof(plcp));
 		rssi = bwi_calc_rssi(sc, hdr);
 		noise = bwi_calc_noise(sc);
 
-		m->m_pkthdr.rcvif = ifp;
 		m->m_len = m->m_pkthdr.len = buflen + sizeof(*hdr);
 		m_adj(m, sizeof(*hdr) + wh_ofs);
 
@@ -2802,7 +2786,6 @@ bwi_free_tx_ring32(struct bwi_softc *sc, int ring_idx)
 {
 	struct bwi_ring_data *rd;
 	struct bwi_txbuf_data *tbd;
-	struct ifnet *ifp = sc->sc_ifp;
 	uint32_t state, val;
 	int i;
 
@@ -2823,8 +2806,9 @@ bwi_free_tx_ring32(struct bwi_softc *sc, int ring_idx)
 		DELAY(1000);
 	}
 	if (i == NRETRY) {
-		if_printf(ifp, "%s: wait for TX ring(%d) stable timed out\n",
-			  __func__, ring_idx);
+		device_printf(sc->sc_dev,
+		    "%s: wait for TX ring(%d) stable timed out\n",
+		    __func__, ring_idx);
 	}
 
 	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_CTRL, 0);
@@ -2837,7 +2821,7 @@ bwi_free_tx_ring32(struct bwi_softc *sc, int ring_idx)
 		DELAY(1000);
 	}
 	if (i == NRETRY)
-		if_printf(ifp, "%s: reset TX ring (%d) timed out\n",
+		device_printf(sc->sc_dev, "%s: reset TX ring (%d) timed out\n",
 		     __func__, ring_idx);
 
 #undef NRETRY
@@ -2945,8 +2929,7 @@ bwi_encap(struct bwi_softc *sc, int idx, struct mbuf *m,
 	  struct ieee80211_node *ni)
 {
 	struct ieee80211vap *vap = ni->ni_vap;
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211com *ic = &sc->sc_ic;
 	struct bwi_ring_data *rd = &sc->sc_tx_rdata[BWI_TX_DATA_RING];
 	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
 	struct bwi_txbuf *tb = &tbd->tbd_buf[idx];
@@ -3005,7 +2988,7 @@ bwi_encap(struct bwi_softc *sc, int idx, struct mbuf *m,
 	 */
 	if (ieee80211_radiotap_active_vap(vap)) {
 		sc->sc_tx_th.wt_flags = 0;
-		if (wh->i_fc[1] & IEEE80211_FC1_WEP)
+		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
 		if (ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_DS &&
 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
@@ -3022,7 +3005,8 @@ bwi_encap(struct bwi_softc *sc, int idx, struct mbuf *m,
 	 */
 	M_PREPEND(m, sizeof(*hdr), M_NOWAIT);
 	if (m == NULL) {
-		if_printf(ifp, "%s: prepend TX header failed\n", __func__);
+		device_printf(sc->sc_dev, "%s: prepend TX header failed\n",
+		    __func__);
 		return ENOBUFS;
 	}
 	hdr = mtod(m, struct bwi_txbuf_hdr *);
@@ -3071,7 +3055,7 @@ bwi_encap(struct bwi_softc *sc, int idx, struct mbuf *m,
 	error = bus_dmamap_load_mbuf(sc->sc_buf_dtag, tb->tb_dmap, m,
 				     bwi_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
 	if (error && error != EFBIG) {
-		if_printf(ifp, "%s: can't load TX buffer (1) %d\n",
+		device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
 		    __func__, error);
 		goto back;
 	}
@@ -3081,8 +3065,8 @@ bwi_encap(struct bwi_softc *sc, int idx, struct mbuf *m,
 
 		m_new = m_defrag(m, M_NOWAIT);
 		if (m_new == NULL) {
-			if_printf(ifp, "%s: can't defrag TX buffer\n",
-			    __func__);
+			device_printf(sc->sc_dev,
+			    "%s: can't defrag TX buffer\n", __func__);
 			error = ENOBUFS;
 			goto back;
 		} else {
@@ -3093,7 +3077,8 @@ bwi_encap(struct bwi_softc *sc, int idx, struct mbuf *m,
 					     bwi_dma_buf_addr, &paddr,
 					     BUS_DMA_NOWAIT);
 		if (error) {
-			if_printf(ifp, "%s: can't load TX buffer (2) %d\n",
+			device_printf(sc->sc_dev,
+			    "%s: can't load TX buffer (2) %d\n",
 			    __func__, error);
 			goto back;
 		}
@@ -3135,7 +3120,6 @@ static int
 bwi_encap_raw(struct bwi_softc *sc, int idx, struct mbuf *m,
 	  struct ieee80211_node *ni, const struct ieee80211_bpf_params *params)
 {
-	struct ifnet *ifp = sc->sc_ifp;
 	struct ieee80211vap *vap = ni->ni_vap;
 	struct ieee80211com *ic = ni->ni_ic;
 	struct bwi_ring_data *rd = &sc->sc_tx_rdata[BWI_TX_DATA_RING];
@@ -3188,7 +3172,7 @@ bwi_encap_raw(struct bwi_softc *sc, int idx, struct mbuf *m,
 	if (ieee80211_radiotap_active_vap(vap)) {
 		sc->sc_tx_th.wt_flags = 0;
 		/* XXX IEEE80211_BPF_CRYPTO */
-		if (wh->i_fc[1] & IEEE80211_FC1_WEP)
+		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
 		if (params->ibp_flags & IEEE80211_BPF_SHORTPRE)
 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
@@ -3202,7 +3186,8 @@ bwi_encap_raw(struct bwi_softc *sc, int idx, struct mbuf *m,
 	 */
 	M_PREPEND(m, sizeof(*hdr), M_NOWAIT);
 	if (m == NULL) {
-		if_printf(ifp, "%s: prepend TX header failed\n", __func__);
+		device_printf(sc->sc_dev, "%s: prepend TX header failed\n",
+		    __func__);
 		return ENOBUFS;
 	}
 	hdr = mtod(m, struct bwi_txbuf_hdr *);
@@ -3250,14 +3235,15 @@ bwi_encap_raw(struct bwi_softc *sc, int idx, struct mbuf *m,
 		struct mbuf *m_new;
 
 		if (error != EFBIG) {
-			if_printf(ifp, "%s: can't load TX buffer (1) %d\n",
+			device_printf(sc->sc_dev,
+			    "%s: can't load TX buffer (1) %d\n",
 			    __func__, error);
 			goto back;
 		}
 		m_new = m_defrag(m, M_NOWAIT);
 		if (m_new == NULL) {
-			if_printf(ifp, "%s: can't defrag TX buffer\n",
-			    __func__);
+			device_printf(sc->sc_dev,
+			    "%s: can't defrag TX buffer\n", __func__);
 			error = ENOBUFS;
 			goto back;
 		}
@@ -3266,7 +3252,8 @@ bwi_encap_raw(struct bwi_softc *sc, int idx, struct mbuf *m,
 					     bwi_dma_buf_addr, &paddr,
 					     BUS_DMA_NOWAIT);
 		if (error) {
-			if_printf(ifp, "%s: can't load TX buffer (2) %d\n",
+			device_printf(sc->sc_dev,
+			    "%s: can't load TX buffer (2) %d\n",
 			    __func__, error);
 			goto back;
 		}
@@ -3310,7 +3297,6 @@ bwi_start_tx64(struct bwi_softc *sc, uint32_t tx_ctrl, int idx)
 static void
 bwi_txeof_status32(struct bwi_softc *sc)
 {
-	struct ifnet *ifp = sc->sc_ifp;
 	uint32_t val, ctrl_base;
 	int end_idx;
 
@@ -3325,8 +3311,7 @@ bwi_txeof_status32(struct bwi_softc *sc)
 	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_INDEX,
 		    end_idx * sizeof(struct bwi_desc32));
 
-	if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
-		ifp->if_start(ifp);
+	bwi_start_locked(sc);
 }
 
 static void
@@ -3338,7 +3323,6 @@ bwi_txeof_status64(struct bwi_softc *sc)
 static void
 _bwi_txeof(struct bwi_softc *sc, uint16_t tx_id, int acked, int data_txcnt)
 {
-	struct ifnet *ifp = sc->sc_ifp;
 	struct bwi_txbuf_data *tbd;
 	struct bwi_txbuf *tb;
 	int ring_idx, buf_idx;
@@ -3346,7 +3330,7 @@ _bwi_txeof(struct bwi_softc *sc, uint16_t tx_id, int acked, int data_txcnt)
 	struct ieee80211vap *vap;
 
 	if (tx_id == 0) {
-		if_printf(ifp, "%s: zero tx id\n", __func__);
+		device_printf(sc->sc_dev, "%s: zero tx id\n", __func__);
 		return;
 	}
 
@@ -3367,8 +3351,7 @@ _bwi_txeof(struct bwi_softc *sc, uint16_t tx_id, int acked, int data_txcnt)
 
 	bus_dmamap_unload(sc->sc_buf_dtag, tb->tb_dmap);
 
-	ni = tb->tb_ni;
-	if (tb->tb_ni != NULL) {
+	if ((ni = tb->tb_ni) != NULL) {
 		const struct bwi_txbuf_hdr *hdr =
 		    mtod(tb->tb_mbuf, const struct bwi_txbuf_hdr *);
 		vap = ni->ni_vap;
@@ -3386,24 +3369,14 @@ _bwi_txeof(struct bwi_softc *sc, uint16_t tx_id, int acked, int data_txcnt)
 			    (data_txcnt > 1) ? IEEE80211_RATECTL_TX_SUCCESS :
 			        IEEE80211_RATECTL_TX_FAILURE, &acked, NULL);
 		}
-
-		/*
-		 * Do any tx complete callback.  Note this must
-		 * be done before releasing the node reference.
-		 */
-		if (tb->tb_mbuf->m_flags & M_TXCB)
-			ieee80211_process_callback(ni, tb->tb_mbuf, !acked);
-
-		ieee80211_free_node(tb->tb_ni);
+		ieee80211_tx_complete(ni, tb->tb_mbuf, !acked);
 		tb->tb_ni = NULL;
-	}
-	m_freem(tb->tb_mbuf);
+	} else
+		m_freem(tb->tb_mbuf);
 	tb->tb_mbuf = NULL;
 
 	if (tbd->tbd_used == 0)
 		sc->sc_tx_timer = 0;
-
-	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
 }
 
 static void
@@ -3435,7 +3408,6 @@ bwi_txeof_status(struct bwi_softc *sc, int end_idx)
 static void
 bwi_txeof(struct bwi_softc *sc)
 {
-	struct ifnet *ifp = sc->sc_ifp;
 
 	for (;;) {
 		uint32_t tx_status0, tx_status1;
@@ -3458,8 +3430,7 @@ bwi_txeof(struct bwi_softc *sc)
 		    data_txcnt);
 	}
 
-	if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
-		ifp->if_start(ifp);
+	bwi_start_locked(sc);
 }
 
 static int
@@ -3707,7 +3678,6 @@ bwi_regwin_enable(struct bwi_softc *sc, struct bwi_regwin *rw, uint32_t flags)
 static void
 bwi_set_bssid(struct bwi_softc *sc, const uint8_t *bssid)
 {
-	struct ifnet *ifp = sc->sc_ifp;
 	struct bwi_mac *mac;
 	struct bwi_myaddr_bssid buf;
 	const uint8_t *p;
@@ -3720,7 +3690,7 @@ bwi_set_bssid(struct bwi_softc *sc, const uint8_t *bssid)
 
 	bwi_set_addr_filter(sc, BWI_ADDR_FILTER_BSSID, bssid);
 
-	bcopy(IF_LLADDR(ifp), buf.myaddr, sizeof(buf.myaddr));
+	bcopy(sc->sc_ic.ic_macaddr, buf.myaddr, sizeof(buf.myaddr));
 	bcopy(bssid, buf.bssid, sizeof(buf.bssid));
 
 	n = sizeof(buf) / sizeof(val);
@@ -3737,14 +3707,13 @@ bwi_set_bssid(struct bwi_softc *sc, const uint8_t *bssid)
 }
 
 static void
-bwi_updateslot(struct ifnet *ifp)
+bwi_updateslot(struct ieee80211com *ic)
 {
-	struct bwi_softc *sc = ifp->if_softc;
-	struct ieee80211com *ic = ifp->if_l2com;
+	struct bwi_softc *sc = ic->ic_softc;
 	struct bwi_mac *mac;
 
 	BWI_LOCK(sc);
-	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
+	if (sc->sc_flags & BWI_F_RUNNING) {
 		DPRINTF(sc, BWI_DBG_80211, "%s\n", __func__);
 
 		KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC,
@@ -3760,16 +3729,12 @@ static void
 bwi_calibrate(void *xsc)
 {
 	struct bwi_softc *sc = xsc;
-#ifdef INVARIANTS
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
-#endif
 	struct bwi_mac *mac;
 
 	BWI_ASSERT_LOCKED(sc);
 
-	KASSERT(ic->ic_opmode != IEEE80211_M_MONITOR,
-	    ("opmode %d", ic->ic_opmode));
+	KASSERT(sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR,
+	    ("opmode %d", sc->sc_ic.ic_opmode));
 
 	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC,
 	    ("current regwin type %d", sc->sc_cur_regwin->rw_type));
@@ -3824,10 +3789,10 @@ bwi_rx_radiotap(struct bwi_softc *sc, struct mbuf *m,
 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
 
 	wh = mtod(m, const struct ieee80211_frame_min *);
-	if (wh->i_fc[1] & IEEE80211_FC1_WEP)
+	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
 		sc->sc_rx_th.wr_flags |= IEEE80211_RADIOTAP_F_WEP;
 
-	sc->sc_rx_th.wr_tsf = hdr->rxh_tsf; /* No endian convertion */
+	sc->sc_rx_th.wr_tsf = hdr->rxh_tsf; /* No endian conversion */
 	sc->sc_rx_th.wr_rate = rate;
 	sc->sc_rx_th.wr_antsignal = rssi;
 	sc->sc_rx_th.wr_antnoise = noise;
@@ -3840,9 +3805,7 @@ bwi_led_attach(struct bwi_softc *sc)
 	uint16_t gpio, val[BWI_LED_MAX];
 	int i;
 
-#define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
-
-	for (i = 0; i < N(bwi_vendor_led_act); ++i) {
+	for (i = 0; i < nitems(bwi_vendor_led_act); ++i) {
 		if (sc->sc_pci_subvid == bwi_vendor_led_act[i].vid) {
 			led_act = bwi_vendor_led_act[i].led_act;
 			break;
@@ -3851,8 +3814,6 @@ bwi_led_attach(struct bwi_softc *sc)
 	if (led_act == NULL)
 		led_act = bwi_default_led_act;
 
-#undef N
-
 	gpio = bwi_read_sprom(sc, BWI_SPROM_GPIO01);
 	val[0] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_0);
 	val[1] = __SHIFTOUT(gpio, BWI_SPROM_GPIO_1);
@@ -3911,8 +3872,7 @@ bwi_led_onoff(const struct bwi_led *led, uint16_t val, int on)
 static void
 bwi_led_newstate(struct bwi_softc *sc, enum ieee80211_state nstate)
 {
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211com *ic = &sc->sc_ic;
 	uint16_t val;
 	int i;
 
@@ -3921,7 +3881,7 @@ bwi_led_newstate(struct bwi_softc *sc, enum ieee80211_state nstate)
 		sc->sc_led_blinking = 0;
 	}
 
-	if ((ic->ic_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
+	if ((sc->sc_flags & BWI_F_RUNNING) == 0)
 		return;
 
 	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
@@ -4049,13 +4009,12 @@ static void
 bwi_restart(void *xsc, int pending)
 {
 	struct bwi_softc *sc = xsc;
-	struct ifnet *ifp = sc->sc_ifp;
 
-	if_printf(ifp, "%s begin, help!\n", __func__);
+	device_printf(sc->sc_dev, "%s begin, help!\n", __func__);
 	BWI_LOCK(sc);
-	bwi_init_statechg(xsc, 0);
+	bwi_init_statechg(sc, 0);
 #if 0
-	bwi_start_locked(ifp);
+	bwi_start_locked(sc);
 #endif
 	BWI_UNLOCK(sc);
 }
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwi_pci.c b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwi_pci.c
index fdf282b4bb..525145a389 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwi_pci.c
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwi_pci.c
@@ -28,17 +28,20 @@
  */
 
 #include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
+__FBSDID("$FreeBSD: releng/11.1/sys/dev/bwi/if_bwi_pci.c 283637 2015-05-27 22:27:15Z glebius $");
 
 /*
  * PCI/Cardbus front-end for the Broadcom Wireless LAN controller driver.
  */
 
+#include "opt_wlan.h"
+
 #include <sys/param.h>
 #include <sys/systm.h> 
 #include <sys/module.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
+#include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/errno.h>
 
@@ -50,8 +53,10 @@ __FBSDID("$FreeBSD$");
 #include <sys/socket.h>
  
 #include <net/if.h>
+#include <net/if_var.h>
 #include <net/if_media.h>
 #include <net/if_arp.h>
+#include <net/ethernet.h>
 
 #include <net80211/ieee80211_var.h>
 #include <net80211/ieee80211_radiotap.h>
@@ -156,12 +161,6 @@ bwi_pci_attach(device_t dev)
 		device_printf(dev, "could not map interrupt\n");
 		goto bad1;
 	}
-	if (bus_setup_intr(dev, sc->sc_irq_res,
-			   INTR_TYPE_NET | INTR_MPSAFE,
-			   NULL, bwi_intr, sc, &sc->sc_irq_handle)) {
-		device_printf(dev, "could not establish interrupt\n");
-		goto bad2;
-	}
 
 	/* Get more PCI information */
 	sc->sc_pci_did = pci_get_device(dev);
@@ -169,11 +168,17 @@ bwi_pci_attach(device_t dev)
 	sc->sc_pci_subvid = pci_get_subvendor(dev);
 	sc->sc_pci_subdid = pci_get_subdevice(dev);
 
-	error = bwi_attach(sc);
-	if (error == 0)					/* success */
-		return 0;
+	if ((error = bwi_attach(sc)) != 0)
+		goto bad2;
+
+	if (bus_setup_intr(dev, sc->sc_irq_res,
+			   INTR_TYPE_NET | INTR_MPSAFE,
+			   NULL, bwi_intr, sc, &sc->sc_irq_handle)) {
+		device_printf(dev, "could not establish interrupt\n");
+		goto bad2;
+	}
+	return (0);
 
-	bus_teardown_intr(dev, sc->sc_irq_res, sc->sc_irq_handle);
 bad2:
 	bus_release_resource(dev, SYS_RES_IRQ, 0, sc->sc_irq_res);
 bad1:
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwireg.h b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwireg.h
index f376911186..276003ab5b 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwireg.h
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwireg.h
@@ -32,7 +32,7 @@
  * SUCH DAMAGE.
  * 
  * $DragonFly: src/sys/dev/netif/bwi/if_bwireg.h,v 1.4 2007/10/19 14:27:04 sephe Exp $
- * $FreeBSD$
+ * $FreeBSD: releng/11.1/sys/dev/bwi/if_bwireg.h 192279 2009-05-18 01:07:38Z imp $
  */
 
 #ifndef _IF_BWIREG_H
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwivar.h b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwivar.h
index 7a8a59bdf3..10097faa32 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwivar.h
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/if_bwivar.h
@@ -1,13 +1,13 @@
 /*
  * Copyright (c) 2007 The DragonFly Project.  All rights reserved.
- * 
+ *
  * This code is derived from software contributed to The DragonFly Project
  * by Sepherosa Ziehau <sepherosa@gmail.com>
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 
+ *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ -17,7 +17,7 @@
  * 3. Neither the name of The DragonFly Project nor the names of its
  *    contributors may be used to endorse or promote products derived
  *    from this software without specific, prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
@@ -30,9 +30,9 @@
  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
- * 
+ *
  * $DragonFly: src/sys/dev/netif/bwi/if_bwivar.h,v 1.14 2008/02/15 11:15:38 sephe Exp $
- * $FreeBSD$
+ * $FreeBSD: releng/11.1/sys/dev/bwi/if_bwivar.h 287197 2015-08-27 08:56:39Z glebius $
  */
 
 #ifndef _IF_BWIVAR_H
@@ -541,10 +541,11 @@ struct bwi_vap {
 #define	BWI_VAP(vap)	((struct bwi_vap *)(vap))
 
 struct bwi_softc {
-	struct ifnet		*sc_ifp;
 	uint32_t		sc_flags;	/* BWI_F_ */
 	device_t		sc_dev;
 	struct mtx		sc_mtx;
+	struct ieee80211com	sc_ic;
+	struct mbufq		sc_snd;
 	int			sc_invalid;
 
 	uint32_t		sc_cap;		/* BWI_CAP_ */
@@ -651,6 +652,7 @@ struct bwi_softc {
 #define BWI_F_BUS_INITED	0x1
 #define BWI_F_PROMISC		0x2
 #define BWI_F_STOP		0x4
+#define	BWI_F_RUNNING		0x8
 
 #define BWI_DBG_MAC		0x00000001
 #define BWI_DBG_RF		0x00000002
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/opt_wlan.h b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/opt_wlan.h
new file mode 100644
index 0000000000..a7c47a6f79
--- /dev/null
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/dev/bwi/opt_wlan.h
@@ -0,0 +1 @@
+/* nothing here */
\ No newline at end of file
diff --git a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/glue.c b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/glue.c
index 1771169c94..03015362fa 100644
--- a/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/glue.c
+++ b/src/add-ons/kernel/drivers/network/wlan/broadcom43xx/glue.c
@@ -32,10 +32,9 @@ int
 HAIKU_CHECK_DISABLE_INTERRUPTS(device_t dev)
 {
 	struct bwi_softc* sc = (struct bwi_softc*)device_get_softc(dev);
-	struct ifnet* ifp = sc->sc_ifp;
 	uint32 intr_status;
 
-	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0
+	if ((sc->sc_flags & BWI_F_RUNNING) == 0
 		|| (sc->sc_flags & BWI_F_STOP))
 		return 0;