D2655.id6199.diff
No OneTemporary
Actions

Size

351 KB

Referenced Files

None

Subscribers

None

D2655.id6199.diff
View Options

This file is larger than 256 KB, so syntax highlighting was skipped.

	Index: etc/network.subr
	===================================================================
	--- etc/network.subr
	+++ etc/network.subr
	@@ -1249,6 +1249,38 @@
	fi
	}

	+# wlan_up
	+# Create IEEE802.3 interfaces.
	+#
	+wlan_up()
	+{
	+ local _list _iflist wlan parent ifn
	+ _list=
	+ _iflist=$*
	+
	+ for wlan in `set \| egrep ^wlans_[a-z]+[0-9]+=[a-z]+[0-9]+`; do
	+ # Parse wlans_$parent=$ifn
	+ wlan=`echo $wlan \| sed -E 's/wlans_([a-z]+[0-9]+)=([a-z]+[0-9]+)/\1:\2/'`
	+ OIFS=$IFS; IFS=:; set -- $wlan; parent=$1; ifn=$2; IFS=$OIFS
	+ case $_iflist in
	+ ""\|$ifn\|$ifn\ \|\ $ifn\ \|\ $ifn) ;;
	+ *) continue ;;
	+ esac
	+ # Skip if ${ifn} already exists.
	+ if ${IFCONFIG_CMD} $ifn > /dev/null 2>&1; then
	+ continue
	+ fi
	+ ${IFCONFIG_CMD} ${ifn} create wlandev ${parent}
	+ if [ $? -eq 0 ]; then
	+ _list="$_list $ifn"
	+ fi
	+ done
	+ if [ -n "${_list# }" ]; then
	+ echo "Created wlan interfaces: ${_list# }."
	+ fi
	+ debug "Wlans: ${_list# }"
	+}
	+
	# clone_up
	# Create cloneable interfaces.
	#
	Index: etc/rc.d/netif
	===================================================================
	--- etc/rc.d/netif
	+++ etc/rc.d/netif
	@@ -37,6 +37,7 @@
	rcvar="${name}_enable"
	start_cmd="netif_start"
	stop_cmd="netif_stop"
	+wlanup_cmd="wlan_up"
	cloneup_cmd="clone_up"
	clonedown_cmd="clone_down"
	clear_cmd="doclear"
	@@ -65,6 +66,9 @@
	trap : 2
	fi

	+ # Create IEEE802.3 interface
	+ wlan_up $cmdifn
	+
	# Create cloned interfaces
	clone_up $cmdifn

	Index: sys/dev/ath/ath_rate/sample/sample.h
	===================================================================
	--- sys/dev/ath/ath_rate/sample/sample.h
	+++ sys/dev/ath/ath_rate/sample/sample.h
	@@ -134,8 +134,7 @@
	int long_retries, int is_ht40)
	{
	const HAL_RATE_TABLE *rt = sc->sc_currates;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int rts, cts;

	unsigned t_slot = 20;
	Index: sys/dev/ath/ath_rate/sample/sample.c
	===================================================================
	--- sys/dev/ath/ath_rate/sample/sample.c
	+++ sys/dev/ath/ath_rate/sample/sample.c
	@@ -488,8 +488,7 @@
	#define RATE(ix) (DOT11RATE(ix) / 2)
	struct sample_node *sn = ATH_NODE_SAMPLE(an);
	struct sample_softc *ssc = ATH_SOFTC_SAMPLE(sc);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	const HAL_RATE_TABLE *rt = sc->sc_currates;
	const int size_bin = size_to_bin(frameLen);
	int rix, mrr, best_rix, change_rates;
	@@ -856,8 +855,7 @@
	const struct ath_rc_series rc, const struct ath_tx_status ts,
	int frame_size, int nframes, int nbad)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct sample_node *sn = ATH_NODE_SAMPLE(an);
	int final_rix, short_tries, long_tries;
	const HAL_RATE_TABLE *rt = sc->sc_currates;
	@@ -1303,8 +1301,7 @@
	ath_rate_sysctl_stats(SYSCTL_HANDLER_ARGS)
	{
	struct ath_softc *sc = arg1;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int error, v;

	v = 0;
	Index: sys/dev/ath/if_ath.c
	===================================================================
	--- sys/dev/ath/if_ath.c
	+++ sys/dev/ath/if_ath.c
	@@ -151,15 +151,15 @@
	const uint8_t [IEEE80211_ADDR_LEN],
	const uint8_t [IEEE80211_ADDR_LEN]);
	static void ath_vap_delete(struct ieee80211vap *);
	-static void ath_init(void *);
	-static void ath_stop_locked(struct ifnet *);
	-static void ath_stop(struct ifnet *);
	+static void ath_init(struct ath_softc *);
	+static void ath_stop_locked(struct ath_softc *);
	+static void ath_stop(struct ath_softc *);
	static int ath_reset_vap(struct ieee80211vap *, u_long);
	-static int ath_transmit(struct ifnet ifp, struct mbuf m);
	-static void ath_qflush(struct ifnet *ifp);
	+static int ath_transmit(struct ieee80211com , struct mbuf );
	static int ath_media_change(struct ifnet *);
	static void ath_watchdog(void *);
	-static int ath_ioctl(struct ifnet *, u_long, caddr_t);
	+static int ath_ioctl(struct ieee80211com , u_long, void );
	+static void ath_parent(struct ieee80211com *);
	static void ath_fatal_proc(void *, int);
	static void ath_bmiss_vap(struct ieee80211vap *);
	static void ath_bmiss_proc(void *, int);
	@@ -571,34 +571,19 @@
	int
	ath_attach(u_int16_t devid, struct ath_softc *sc)
	{
	- struct ifnet *ifp;
	- struct ieee80211com *ic;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = NULL;
	HAL_STATUS status;
	int error = 0, i;
	u_int wmodes;
	- uint8_t macaddr[IEEE80211_ADDR_LEN];
	int rx_chainmask, tx_chainmask;
	HAL_OPS_CONFIG ah_config;

	DPRINTF(sc, ATH_DEBUG_ANY, "%s: devid 0x%x\n", __func__, devid);

	- CURVNET_SET(vnet0);
	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(sc->sc_dev, "can not if_alloc()\n");
	- error = ENOSPC;
	- CURVNET_RESTORE();
	- goto bad;
	- }
	- ic = ifp->if_l2com;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(sc->sc_dev);

	- if_initname(ifp, device_get_name(sc->sc_dev),
	- device_get_unit(sc->sc_dev));
	- CURVNET_RESTORE();
	-
	/*
	* Configure the initial configuration data.
	*
	@@ -732,8 +717,8 @@

	sc->sc_tq = taskqueue_create("ath_taskq", M_NOWAIT,
	taskqueue_thread_enqueue, &sc->sc_tq);
	- taskqueue_start_threads(&sc->sc_tq, 1, PI_NET,
	- "%s taskq", ifp->if_xname);
	+ taskqueue_start_threads(&sc->sc_tq, 1, PI_NET, "%s taskq",
	+ device_get_nameunit(sc->sc_dev));

	TASK_INIT(&sc->sc_rxtask, 0, sc->sc_rx.recv_tasklet, sc);
	TASK_INIT(&sc->sc_bmisstask, 0, ath_bmiss_proc, sc);
	@@ -876,17 +861,6 @@
	ath_led_config(sc);
	ath_hal_setledstate(ah, HAL_LED_INIT);

	- ifp->if_softc = sc;
	- ifp->if_flags = IFF_SIMPLEX \| IFF_BROADCAST \| IFF_MULTICAST;
	- ifp->if_transmit = ath_transmit;
	- ifp->if_qflush = ath_qflush;
	- ifp->if_ioctl = ath_ioctl;
	- ifp->if_init = ath_init;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	-
	- ic->ic_ifp = ifp;
	/* XXX not right but it's not used anywhere important */
	ic->ic_phytype = IEEE80211_T_OFDM;
	ic->ic_opmode = IEEE80211_M_STA;
	@@ -1208,11 +1182,11 @@
	sc->sc_hasveol = ath_hal_hasveol(ah);

	/* get mac address from kenv first, then hardware */
	- if (ath_fetch_mac_kenv(sc, macaddr) == 0) {
	+ if (ath_fetch_mac_kenv(sc, ic->ic_macaddr) == 0) {
	/* Tell the HAL now about the new MAC */
	- ath_hal_setmac(ah, macaddr);
	+ ath_hal_setmac(ah, ic->ic_macaddr);
	} else {
	- ath_hal_getmac(ah, macaddr);
	+ ath_hal_getmac(ah, ic->ic_macaddr);
	}

	if (sc->sc_hasbmask)
	@@ -1221,12 +1195,15 @@
	/* NB: used to size node table key mapping array */
	ic->ic_max_keyix = sc->sc_keymax;
	/* call MI attach routine. */
	- ieee80211_ifattach(ic, macaddr);
	+ ieee80211_ifattach(ic);
	ic->ic_setregdomain = ath_setregdomain;
	ic->ic_getradiocaps = ath_getradiocaps;
	sc->sc_opmode = HAL_M_STA;

	/* override default methods */
	+ ic->ic_ioctl = ath_ioctl;
	+ ic->ic_parent = ath_parent;
	+ ic->ic_transmit = ath_transmit;
	ic->ic_newassoc = ath_newassoc;
	ic->ic_updateslot = ath_updateslot;
	ic->ic_wme.wme_update = ath_wme_update;
	@@ -1322,16 +1299,6 @@
	bad:
	if (ah)
	ath_hal_detach(ah);
	-
	- /*
	- * To work around scoping issues with CURVNET_SET/CURVNET_RESTORE..
	- */
	- if (ifp != NULL && ifp->if_vnet) {
	- CURVNET_SET(ifp->if_vnet);
	- if_free(ifp);
	- CURVNET_RESTORE();
	- } else if (ifp != NULL)
	- if_free(ifp);
	sc->sc_invalid = 1;
	return error;
	}
	@@ -1339,10 +1306,6 @@
	int
	ath_detach(struct ath_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	-
	- DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
	- __func__, ifp->if_flags);

	/*
	* NB: the order of these is important:
	@@ -1367,14 +1330,14 @@
	ATH_LOCK(sc);
	ath_power_set_power_state(sc, HAL_PM_AWAKE);
	ath_power_setpower(sc, HAL_PM_AWAKE);
	- ATH_UNLOCK(sc);

	/*
	* Stop things cleanly.
	*/
	- ath_stop(ifp);
	+ ath_stop_locked(sc);
	+ ATH_UNLOCK(sc);

	- ieee80211_ifdetach(ifp->if_l2com);
	+ ieee80211_ifdetach(&sc->sc_ic);
	taskqueue_free(sc->sc_tq);
	#ifdef ATH_TX99_DIAG
	if (sc->sc_tx99 != NULL)
	@@ -1394,10 +1357,6 @@
	ath_tx_cleanup(sc);
	ath_hal_detach(sc->sc_ah); /* NB: sets chip in full sleep */

	- CURVNET_SET(ifp->if_vnet);
	- if_free(ifp);
	- CURVNET_RESTORE();
	-
	return 0;
	}

	@@ -1473,7 +1432,7 @@
	const uint8_t bssid[IEEE80211_ADDR_LEN],
	const uint8_t mac0[IEEE80211_ADDR_LEN])
	{
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_vap *avp;
	struct ieee80211vap *vap;
	uint8_t mac[IEEE80211_ADDR_LEN];
	@@ -1581,8 +1540,7 @@
	vap = &avp->av_vap;
	/* XXX can't hold mutex across if_alloc */
	ATH_UNLOCK(sc);
	- error = ieee80211_vap_setup(ic, vap, name, unit, opmode, flags,
	- bssid, mac);
	+ error = ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
	ATH_LOCK(sc);
	if (error != 0) {
	device_printf(sc->sc_dev, "%s: error %d creating vap\n",
	@@ -1716,7 +1674,8 @@
	ATH_UNLOCK(sc);

	/* complete setup */
	- ieee80211_vap_attach(vap, ath_media_change, ieee80211_media_status);
	+ ieee80211_vap_attach(vap, ath_media_change, ieee80211_media_status,
	+ mac);
	return vap;
	bad2:
	reclaim_address(sc, mac);
	@@ -1731,8 +1690,7 @@
	ath_vap_delete(struct ieee80211vap *vap)
	{
	struct ieee80211com *ic = vap->iv_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ath_softc *sc = ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_hal *ah = sc->sc_ah;
	struct ath_vap *avp = ATH_VAP(vap);

	@@ -1741,7 +1699,7 @@
	ATH_UNLOCK(sc);

	DPRINTF(sc, ATH_DEBUG_RESET, "%s: called\n", __func__);
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
	+ if (sc->sc_running) {
	/*
	* Quiesce the hardware while we remove the vap. In
	* particular we need to reclaim all references to
	@@ -1824,7 +1782,7 @@
	#endif
	free(avp, M_80211_VAP);

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
	+ if (sc->sc_running) {
	/*
	* Restart rx+tx machines if still running (RUNNING will
	* be reset if we just destroyed the last vap).
	@@ -1851,13 +1809,9 @@
	void
	ath_suspend(struct ath_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	-
	- DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
	- __func__, ifp->if_flags);
	+ struct ieee80211com *ic = &sc->sc_ic;

	- sc->sc_resume_up = (ifp->if_flags & IFF_UP) != 0;
	+ sc->sc_resume_up = ic->ic_nrunning != 0;

	ieee80211_suspend_all(ic);
	/*
	@@ -1898,8 +1852,7 @@
	static void
	ath_reset_keycache(struct ath_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = sc->sc_ah;
	int i;

	@@ -1941,8 +1894,7 @@
	void
	ath_resume(struct ath_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = sc->sc_ah;
	HAL_STATUS status;

	@@ -2015,12 +1967,8 @@
	void
	ath_shutdown(struct ath_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	-
	- DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
	- __func__, ifp->if_flags);

	- ath_stop(ifp);
	+ ath_stop(sc);
	/* NB: no point powering down chip as we're about to reboot */
	}

	@@ -2031,7 +1979,6 @@
	ath_intr(void *arg)
	{
	struct ath_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	struct ath_hal *ah = sc->sc_ah;
	HAL_INT status = 0;
	uint32_t txqs;
	@@ -2070,12 +2017,11 @@
	ath_power_set_power_state(sc, HAL_PM_AWAKE);
	ATH_UNLOCK(sc);

	- if ((ifp->if_flags & IFF_UP) == 0 \|\|
	- (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	+ if (sc->sc_ic.ic_nrunning == 0 && sc->sc_running == 0) {
	HAL_INT status;

	- DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags 0x%x\n",
	- __func__, ifp->if_flags);
	+ DPRINTF(sc, ATH_DEBUG_ANY, "%s: ic_nrunning %d sc_running %d\n",
	+ __func__, sc->sc_ic.ic_nrunning, sc->sc_running);
	ath_hal_getisr(ah, &status); /* clear ISR */
	ath_hal_intrset(ah, 0); /* disable further intr's */
	ATH_PCU_UNLOCK(sc);
	@@ -2313,7 +2259,6 @@
	ath_fatal_proc(void *arg, int pending)
	{
	struct ath_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	u_int32_t *state;
	u_int32_t len;
	void *sp;
	@@ -2331,13 +2276,13 @@
	"0x%08x 0x%08x 0x%08x, 0x%08x 0x%08x 0x%08x\n", state[0],
	state[1] , state[2], state[3], state[4], state[5]);
	}
	- ath_reset(ifp, ATH_RESET_NOLOSS);
	+ ath_reset(sc, ATH_RESET_NOLOSS);
	}

	static void
	ath_bmiss_vap(struct ieee80211vap *vap)
	{
	- struct ath_softc *sc = vap->iv_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = vap->iv_ic->ic_softc;

	/*
	* Workaround phantom bmiss interrupts by sanity-checking
	@@ -2358,8 +2303,6 @@
	ATH_UNLOCK(sc);

	if ((vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS) == 0) {
	- struct ifnet *ifp = vap->iv_ic->ic_ifp;
	- struct ath_softc *sc = ifp->if_softc;
	u_int64_t lastrx = sc->sc_lastrx;
	u_int64_t tsf = ath_hal_gettsf64(sc->sc_ah);
	/* XXX should take a locked ref to iv_bss */
	@@ -2417,7 +2360,6 @@
	ath_bmiss_proc(void *arg, int pending)
	{
	struct ath_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t hangs;

	DPRINTF(sc, ATH_DEBUG_ANY, "%s: pending %u\n", __func__, pending);
	@@ -2435,12 +2377,12 @@
	* to clear.
	*/
	if (ath_hal_gethangstate(sc->sc_ah, 0xff, &hangs) && hangs != 0) {
	- ath_reset(ifp, ATH_RESET_NOLOSS);
	+ ath_reset(sc, ATH_RESET_NOLOSS);
	device_printf(sc->sc_dev,
	"bb hang detected (0x%x), resetting\n", hangs);
	} else {
	- ath_reset(ifp, ATH_RESET_NOLOSS);
	- ieee80211_beacon_miss(ifp->if_l2com);
	+ ath_reset(sc, ATH_RESET_NOLOSS);
	+ ieee80211_beacon_miss(&sc->sc_ic);
	}

	/* Force a beacon resync, in case they've drifted */
	@@ -2460,8 +2402,7 @@
	static void
	ath_settkipmic(struct ath_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	if ((ic->ic_cryptocaps & IEEE80211_CRYPTO_TKIP) && !sc->sc_wmetkipmic) {
	if (ic->ic_flags & IEEE80211_F_WME) {
	@@ -2475,11 +2416,9 @@
	}

	static void
	-ath_init(void *arg)
	+ath_init(struct ath_softc *sc)
	{
	- struct ath_softc sc = (struct ath_softc ) arg;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = sc->sc_ah;
	HAL_STATUS status;

	@@ -2498,7 +2437,7 @@
	* Stop anything previously setup. This is safe
	* whether this is the first time through or not.
	*/
	- ath_stop_locked(ifp);
	+ ath_stop_locked(sc);

	/*
	* The basic interface to setting the hardware in a good
	@@ -2624,7 +2563,7 @@
	DPRINTF(sc, ATH_DEBUG_RESET, "%s: imask=0x%x\n",
	__func__, sc->sc_imask);

	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	+ sc->sc_running = 1;
	callout_reset(&sc->sc_wd_ch, hz, ath_watchdog, sc);
	ath_hal_intrset(ah, sc->sc_imask);

	@@ -2640,14 +2579,10 @@
	}

	static void
	-ath_stop_locked(struct ifnet *ifp)
	+ath_stop_locked(struct ath_softc *sc)
	{
	- struct ath_softc *sc = ifp->if_softc;
	struct ath_hal *ah = sc->sc_ah;

	- DPRINTF(sc, ATH_DEBUG_ANY, "%s: invalid %u if_flags 0x%x\n",
	- __func__, sc->sc_invalid, ifp->if_flags);
	-
	ATH_LOCK_ASSERT(sc);

	/*
	@@ -2655,7 +2590,7 @@
	*/
	ath_power_set_power_state(sc, HAL_PM_AWAKE);

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
	+ if (sc->sc_running) {
	/*
	* Shutdown the hardware and driver:
	* reset 802.11 state machine
	@@ -2677,7 +2612,7 @@
	#endif
	callout_stop(&sc->sc_wd_ch);
	sc->sc_wd_timer = 0;
	- ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
	+ sc->sc_running = 0;
	if (!sc->sc_invalid) {
	if (sc->sc_softled) {
	callout_stop(&sc->sc_ledtimer);
	@@ -2829,12 +2764,11 @@
	*/

	static void
	-ath_stop(struct ifnet *ifp)
	+ath_stop(struct ath_softc *sc)
	{
	- struct ath_softc *sc = ifp->if_softc;
	-
	+
	ATH_LOCK(sc);
	- ath_stop_locked(ifp);
	+ ath_stop_locked(sc);
	ATH_UNLOCK(sc);
	}

	@@ -2846,10 +2780,9 @@
	* to reset or reload hardware state.
	*/
	int
	-ath_reset(struct ifnet *ifp, ATH_RESET_TYPE reset_type)
	+ath_reset(struct ath_softc *sc, ATH_RESET_TYPE reset_type)
	{
	- struct ath_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = sc->sc_ah;
	HAL_STATUS status;
	int i;
	@@ -3011,15 +2944,6 @@
	}
	}

	- /*
	- * This may have been set during an ath_start() call which
	- * set this once it detected a concurrent TX was going on.
	- * So, clear it.
	- */
	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	-
	ATH_LOCK(sc);
	ath_power_restore_power_state(sc);
	ATH_UNLOCK(sc);
	@@ -3041,8 +2965,7 @@
	ath_reset_vap(struct ieee80211vap *vap, u_long cmd)
	{
	struct ieee80211com *ic = vap->iv_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ath_softc *sc = ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_hal *ah = sc->sc_ah;

	switch (cmd) {
	@@ -3057,7 +2980,7 @@
	return 0;
	}
	/* XXX? Full or NOLOSS? */
	- return ath_reset(ifp, ATH_RESET_FULL);
	+ return ath_reset(sc, ATH_RESET_FULL);
	}

	struct ath_buf *
	@@ -3217,24 +3140,12 @@
	bf = _ath_getbuf_locked(sc, ATH_BUFTYPE_NORMAL);
	ATH_TXBUF_UNLOCK(sc);
	if (bf == NULL) {
	- struct ifnet *ifp = sc->sc_ifp;
	-
	DPRINTF(sc, ATH_DEBUG_XMIT, "%s: stop queue\n", __func__);
	sc->sc_stats.ast_tx_qstop++;
	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	}
	return bf;
	}

	-static void
	-ath_qflush(struct ifnet *ifp)
	-{
	-
	- /* XXX TODO */
	-}
	-
	/*
	* Transmit a single frame.
	*
	@@ -3242,10 +3153,9 @@
	* fails, so don't free the node reference here.
	*/
	static int
	-ath_transmit(struct ifnet ifp, struct mbuf m)
	+ath_transmit(struct ieee80211com ic, struct mbuf m)
	{
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ieee80211_node *ni;
	struct mbuf *next;
	struct ath_buf *bf;
	@@ -3260,10 +3170,7 @@
	DPRINTF(sc, ATH_DEBUG_XMIT,
	"%s: sc_inreset_cnt > 0; bailing\n", __func__);
	ATH_PCU_UNLOCK(sc);
	- IF_LOCK(&ifp->if_snd);
	sc->sc_stats.ast_tx_qstop++;
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	ATH_KTR(sc, ATH_KTR_TX, 0, "ath_start_task: OACTIVE, finish");
	return (ENOBUFS); /* XXX should be EINVAL or? */
	}
	@@ -3303,8 +3210,6 @@
	if ((!(m->m_flags & M_EAPOL)) &&
	(ATH_NODE(ni)->an_swq_depth > sc->sc_txq_node_maxdepth)) {
	sc->sc_stats.ast_tx_nodeq_overflow++;
	- m_freem(m);
	- m = NULL;
	retval = ENOBUFS;
	goto finish;
	}
	@@ -3328,8 +3233,6 @@
	if ((!(m->m_flags & M_EAPOL)) &&
	(sc->sc_txbuf_cnt <= sc->sc_txq_data_minfree)) {
	sc->sc_stats.ast_tx_nobuf++;
	- m_freem(m);
	- m = NULL;
	retval = ENOBUFS;
	goto finish;
	}
	@@ -3357,11 +3260,6 @@
	* above.
	*/
	sc->sc_stats.ast_tx_nobuf++;
	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	- m_freem(m);
	- m = NULL;
	retval = ENOBUFS;
	goto finish;
	}
	@@ -3383,8 +3281,13 @@
	DPRINTF(sc, ATH_DEBUG_XMIT,
	"%s: out of txfrag buffers\n", __func__);
	sc->sc_stats.ast_tx_nofrag++;
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ if_inc_counter(ni->ni_vap->iv_ifp, IFCOUNTER_OERRORS, 1);
	+ /*
	+ * XXXGL: is mbuf valid after ath_txfrag_setup? If yes,
	+ * we shouldn't free it but return back.
	+ */
	ath_freetx(m);
	+ m = NULL;
	goto bad;
	}

	@@ -3426,12 +3329,6 @@
	}
	}

	- /*
	- * Bump the ifp output counter.
	- *
	- * XXX should use atomics?
	- */
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	nextfrag:
	/*
	* Pass the frame to the h/w for transmission.
	@@ -3451,7 +3348,7 @@
	next = m->m_nextpkt;
	if (ath_tx_start(sc, ni, bf, m)) {
	bad:
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ if_inc_counter(ni->ni_vap->iv_ifp, IFCOUNTER_OERRORS, 1);
	reclaim:
	bf->bf_m = NULL;
	bf->bf_node = NULL;
	@@ -3535,8 +3432,7 @@
	static void
	ath_key_update_begin(struct ieee80211vap *vap)
	{
	- struct ifnet *ifp = vap->iv_ic->ic_ifp;
	- struct ath_softc *sc = ifp->if_softc;
	+ struct ath_softc *sc = vap->iv_ic->ic_softc;

	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
	taskqueue_block(sc->sc_tq);
	@@ -3545,8 +3441,7 @@
	static void
	ath_key_update_end(struct ieee80211vap *vap)
	{
	- struct ifnet *ifp = vap->iv_ic->ic_ifp;
	- struct ath_softc *sc = ifp->if_softc;
	+ struct ath_softc *sc = vap->iv_ic->ic_softc;

	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
	taskqueue_unblock(sc->sc_tq);
	@@ -3577,32 +3472,41 @@
	static void
	ath_update_mcast_hw(struct ath_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;
	u_int32_t mfilt[2];

	/* calculate and install multicast filter */
	- if ((ifp->if_flags & IFF_ALLMULTI) == 0) {
	+ if (ic->ic_allmulti == 0) {
	+ struct ieee80211vap *vap;
	+ struct ifnet *ifp;
	struct ifmultiaddr *ifma;
	+
	/*
	* Merge multicast addresses to form the hardware filter.
	*/
	mfilt[0] = mfilt[1] = 0;
	- if_maddr_rlock(ifp); /* XXX need some fiddling to remove? */
	- TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
	- caddr_t dl;
	- u_int32_t val;
	- u_int8_t pos;
	-
	- /* calculate XOR of eight 6bit values */
	- dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
	- val = LE_READ_4(dl + 0);
	- pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
	- val = LE_READ_4(dl + 3);
	- pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
	- pos &= 0x3f;
	- mfilt[pos / 32] \|= (1 << (pos % 32));
	+ TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
	+ ifp = vap->iv_ifp;
	+ if_maddr_rlock(ifp);
	+ TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
	+ caddr_t dl;
	+ uint32_t val;
	+ uint8_t pos;
	+
	+ /* calculate XOR of eight 6bit values */
	+ dl = LLADDR((struct sockaddr_dl *)
	+ ifma->ifma_addr);
	+ val = LE_READ_4(dl + 0);
	+ pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^
	+ val;
	+ val = LE_READ_4(dl + 3);
	+ pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^
	+ val;
	+ pos &= 0x3f;
	+ mfilt[pos / 32] \|= (1 << (pos % 32));
	+ }
	+ if_maddr_runlock(ifp);
	}
	- if_maddr_runlock(ifp);
	} else
	mfilt[0] = mfilt[1] = ~0;

	@@ -3635,7 +3539,7 @@
	void
	ath_mode_init(struct ath_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = sc->sc_ah;
	u_int32_t rfilt;

	@@ -3646,15 +3550,8 @@
	/* configure operational mode */
	ath_hal_setopmode(ah);

	- DPRINTF(sc, ATH_DEBUG_STATE \| ATH_DEBUG_MODE,
	- "%s: ah=%p, ifp=%p, if_addr=%p\n",
	- __func__,
	- ah,
	- ifp,
	- (ifp == NULL) ? NULL : ifp->if_addr);
	-
	/* handle any link-level address change */
	- ath_hal_setmac(ah, IF_LLADDR(ifp));
	+ ath_hal_setmac(ah, ic->ic_macaddr);

	/* calculate and install multicast filter */
	ath_update_mcast_hw(sc);
	@@ -3666,7 +3563,7 @@
	void
	ath_setslottime(struct ath_softc *sc)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = sc->sc_ah;
	u_int usec;

	@@ -3750,12 +3647,11 @@
	ath_reset_proc(void *arg, int pending)
	{
	struct ath_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;

	#if 0
	device_printf(sc->sc_dev, "%s: resetting\n", __func__);
	#endif
	- ath_reset(ifp, ATH_RESET_NOLOSS);
	+ ath_reset(sc, ATH_RESET_NOLOSS);
	}

	/*
	@@ -3765,7 +3661,6 @@
	ath_bstuck_proc(void *arg, int pending)
	{
	struct ath_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t hangs = 0;

	if (ath_hal_gethangstate(sc->sc_ah, 0xff, &hangs) && hangs != 0)
	@@ -3783,7 +3678,7 @@
	* This assumes that there's no simultaneous channel mode change
	* occuring.
	*/
	- ath_reset(ifp, ATH_RESET_NOLOSS);
	+ ath_reset(sc, ATH_RESET_NOLOSS);
	}

	static void
	@@ -4153,7 +4048,7 @@
	ath_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
	{
	struct ieee80211com *ic = vap->iv_ic;
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	const size_t space = sizeof(struct ath_node) + sc->sc_rc->arc_space;
	struct ath_node *an;

	@@ -4180,7 +4075,7 @@
	ath_node_cleanup(struct ieee80211_node *ni)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;

	DPRINTF(sc, ATH_DEBUG_NODE, "%s: %6D: an %p\n", __func__,
	ni->ni_macaddr, ":", ATH_NODE(ni));
	@@ -4195,7 +4090,7 @@
	ath_node_free(struct ieee80211_node *ni)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;

	DPRINTF(sc, ATH_DEBUG_NODE, "%s: %6D: an %p\n", __func__,
	ni->ni_macaddr, ":", ATH_NODE(ni));
	@@ -4207,7 +4102,7 @@
	ath_node_getsignal(const struct ieee80211_node ni, int8_t rssi, int8_t *noise)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_hal *ah = sc->sc_ah;

	*rssi = ic->ic_node_getrssi(ni);
	@@ -4345,8 +4240,7 @@
	{
	#define ATH_EXPONENT_TO_VALUE(v) ((1<<v)-1)
	#define ATH_TXOP_TO_US(v) (v<<5)
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_txq *txq = sc->sc_ac2q[ac];
	struct wmeParams *wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[ac];
	struct ath_hal *ah = sc->sc_ah;
	@@ -4419,7 +4313,7 @@
	int
	ath_wme_update(struct ieee80211com *ic)
	{
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;

	return !ath_txq_update(sc, WME_AC_BE) \|\|
	!ath_txq_update(sc, WME_AC_BK) \|\|
	@@ -4470,8 +4364,7 @@
	struct ath_buf *bf)
	{
	struct ieee80211_node *ni = bf->bf_node;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int sr, lr, pri;

	if (ts->ts_status == 0) {
	@@ -4826,7 +4719,6 @@
	ath_tx_proc_q0(void *arg, int npending)
	{
	struct ath_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t txqs;

	ATH_PCU_LOCK(sc);
	@@ -4847,9 +4739,6 @@
	sc->sc_lastrx = ath_hal_gettsf64(sc->sc_ah);
	if (TXQACTIVE(txqs, sc->sc_cabq->axq_qnum))
	ath_tx_processq(sc, sc->sc_cabq, 1);
	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	sc->sc_wd_timer = 0;

	if (sc->sc_softled)
	@@ -4874,7 +4763,6 @@
	ath_tx_proc_q0123(void *arg, int npending)
	{
	struct ath_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	int nacked;
	uint32_t txqs;

	@@ -4908,9 +4796,6 @@
	if (nacked)
	sc->sc_lastrx = ath_hal_gettsf64(sc->sc_ah);

	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	sc->sc_wd_timer = 0;

	if (sc->sc_softled)
	@@ -4934,7 +4819,6 @@
	ath_tx_proc(void *arg, int npending)
	{
	struct ath_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	int i, nacked;
	uint32_t txqs;

	@@ -4960,10 +4844,6 @@
	if (nacked)
	sc->sc_lastrx = ath_hal_gettsf64(sc->sc_ah);

	- /* XXX check this inside of IF_LOCK? */
	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	sc->sc_wd_timer = 0;

	if (sc->sc_softled)
	@@ -5274,7 +5154,7 @@
	txq->axq_aggr_depth--;
	#ifdef ATH_DEBUG
	if (sc->sc_debug & ATH_DEBUG_RESET) {
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int status = 0;

	/*
	@@ -5419,9 +5299,8 @@
	ath_legacy_tx_drain(struct ath_softc *sc, ATH_RESET_TYPE reset_type)
	{
	struct ath_hal *ah = sc->sc_ah;
	- struct ifnet *ifp = sc->sc_ifp;
	- int i;
	struct ath_buf *bf_last;
	+ int i;

	(void) ath_stoptxdma(sc);

	@@ -5473,15 +5352,12 @@
	ath_printtxbuf(sc, bf, sc->sc_bhalq, 0,
	ath_hal_txprocdesc(ah, bf->bf_lastds,
	&bf->bf_status.ds_txstat) == HAL_OK);
	- ieee80211_dump_pkt(ifp->if_l2com,
	+ ieee80211_dump_pkt(&sc->sc_ic,
	mtod(bf->bf_m, const uint8_t *), bf->bf_m->m_len,
	0, -1);
	}
	}
	#endif /* ATH_DEBUG */
	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	sc->sc_wd_timer = 0;
	}

	@@ -5512,8 +5388,7 @@
	static int
	ath_chan_set(struct ath_softc sc, struct ieee80211_channel chan)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = sc->sc_ah;
	int ret = 0;

	@@ -5648,9 +5523,6 @@
	ath_hal_intrset(ah, sc->sc_imask);
	ATH_PCU_UNLOCK(sc);

	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	ath_txrx_start(sc);
	/* XXX ath_start? */

	@@ -5666,8 +5538,7 @@
	{
	struct ath_softc *sc = arg;
	struct ath_hal *ah = sc->sc_ah;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	HAL_BOOL longCal, isCalDone = AH_TRUE;
	HAL_BOOL aniCal, shortCal = AH_FALSE;
	int nextcal;
	@@ -5793,12 +5664,12 @@
	static void
	ath_scan_start(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ath_softc *sc = ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_hal *ah = sc->sc_ah;
	u_int32_t rfilt;

	/* XXX calibration timer? */
	+ /* XXXGL: is constant ieee80211broadcastaddr a correct choice? */

	ATH_LOCK(sc);
	sc->sc_scanning = 1;
	@@ -5808,18 +5679,17 @@

	ATH_PCU_LOCK(sc);
	ath_hal_setrxfilter(ah, rfilt);
	- ath_hal_setassocid(ah, ifp->if_broadcastaddr, 0);
	+ ath_hal_setassocid(ah, ieee80211broadcastaddr, 0);
	ATH_PCU_UNLOCK(sc);

	DPRINTF(sc, ATH_DEBUG_STATE, "%s: RX filter 0x%x bssid %s aid 0\n",
	- __func__, rfilt, ether_sprintf(ifp->if_broadcastaddr));
	+ __func__, rfilt, ether_sprintf(ieee80211broadcastaddr));
	}

	static void
	ath_scan_end(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ath_softc *sc = ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_hal *ah = sc->sc_ah;
	u_int32_t rfilt;

	@@ -5859,8 +5729,7 @@
	static void
	ath_update_chw(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ath_softc *sc = ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;

	DPRINTF(sc, ATH_DEBUG_STATE, "%s: called\n", __func__);
	ath_set_channel(ic);
	@@ -5870,8 +5739,7 @@
	static void
	ath_set_channel(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ath_softc *sc = ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;

	ATH_LOCK(sc);
	ath_power_set_power_state(sc, HAL_PM_AWAKE);
	@@ -5913,7 +5781,7 @@
	ath_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
	{
	struct ieee80211com *ic = vap->iv_ic;
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_vap *avp = ATH_VAP(vap);
	struct ath_hal *ah = sc->sc_ah;
	struct ieee80211_node *ni = NULL;
	@@ -6249,7 +6117,7 @@
	ath_setup_stationkey(struct ieee80211_node *ni)
	{
	struct ieee80211vap *vap = ni->ni_vap;
	- struct ath_softc *sc = vap->iv_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = vap->iv_ic->ic_softc;
	ieee80211_keyix keyix, rxkeyix;

	/* XXX should take a locked ref to vap->iv_bss */
	@@ -6282,7 +6150,7 @@
	{
	struct ath_node *an = ATH_NODE(ni);
	struct ieee80211vap *vap = ni->ni_vap;
	- struct ath_softc *sc = vap->iv_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = vap->iv_ic->ic_softc;
	const struct ieee80211_txparam *tp = ni->ni_txparms;

	an->an_mcastrix = ath_tx_findrix(sc, tp->mcastrate);
	@@ -6334,7 +6202,7 @@
	ath_setregdomain(struct ieee80211com ic, struct ieee80211_regdomain reg,
	int nchans, struct ieee80211_channel chans[])
	{
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_hal *ah = sc->sc_ah;
	HAL_STATUS status;

	@@ -6358,7 +6226,7 @@
	ath_getradiocaps(struct ieee80211com *ic,
	int maxchans, int *nchans, struct ieee80211_channel chans[])
	{
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_hal *ah = sc->sc_ah;

	DPRINTF(sc, ATH_DEBUG_REGDOMAIN, "%s: use rd %u cc %d\n",
	@@ -6373,8 +6241,7 @@
	static int
	ath_getchannels(struct ath_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = sc->sc_ah;
	HAL_STATUS status;

	@@ -6536,12 +6403,12 @@
	ath_watchdog(void *arg)
	{
	struct ath_softc *sc = arg;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int do_reset = 0;

	ATH_LOCK_ASSERT(sc);

	if (sc->sc_wd_timer != 0 && --sc->sc_wd_timer == 0) {
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t hangs;

	ath_power_set_power_state(sc, HAL_PM_AWAKE);
	@@ -6553,7 +6420,7 @@
	} else
	device_printf(sc->sc_dev, "device timeout\n");
	do_reset = 1;
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ counter_u64_add(ic->ic_oerrors, 1);
	sc->sc_stats.ast_watchdog++;

	ath_power_restore_power_state(sc);
	@@ -6579,7 +6446,7 @@
	ath_ioctl_ratestats(struct ath_softc sc, struct ath_rateioctl rs)
	{
	struct ath_node *an;
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_node *ni;
	int error = 0;

	@@ -6685,31 +6552,23 @@
	}
	#endif /* ATH_DIAGAPI */

	-static int
	-ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+static void
	+ath_parent(struct ieee80211com *ic)
	{
	-#define IS_RUNNING(ifp) \
	- ((ifp->if_flags & IFF_UP) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
	- struct ath_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ifreq ifr = (struct ifreq )data;
	- const HAL_RATE_TABLE *rt;
	- int error = 0;
	+ struct ath_softc *sc = ic->ic_softc;

	- switch (cmd) {
	- case SIOCSIFFLAGS:
	- if (IS_RUNNING(ifp)) {
	- /*
	- * To avoid rescanning another access point,
	- * do not call ath_init() here. Instead,
	- * only reflect promisc mode settings.
	- */
	- ATH_LOCK(sc);
	+ ATH_LOCK(sc);
	+ if (ic->ic_nrunning > 0) {
	+ /*
	+ * To avoid rescanning another access point,
	+ * do not call ath_init() here. Instead,
	+ * only reflect promisc mode settings.
	+ */
	+ if (sc->sc_running) {
	ath_power_set_power_state(sc, HAL_PM_AWAKE);
	ath_mode_init(sc);
	ath_power_restore_power_state(sc);
	- ATH_UNLOCK(sc);
	- } else if (ifp->if_flags & IFF_UP) {
	+ } else if (!sc->sc_invalid) {
	/*
	* Beware of being called during attach/detach
	* to reset promiscuous mode. In that case we
	@@ -6719,26 +6578,40 @@
	* torn down much of our state. There's
	* probably a better way to deal with this.
	*/
	- if (!sc->sc_invalid)
	- ath_init(sc); /* XXX lose error */
	- } else {
	- ATH_LOCK(sc);
	- ath_stop_locked(ifp);
	- if (!sc->sc_invalid)
	- ath_power_setpower(sc, HAL_PM_FULL_SLEEP);
	ATH_UNLOCK(sc);
	+ ath_init(sc); /* XXX lose error */
	+ return;
	}
	- break;
	- case SIOCGIFMEDIA:
	- case SIOCSIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- case SIOCGATHSTATS:
	+ } else {
	+ ath_stop_locked(sc);
	+ if (!sc->sc_invalid)
	+ ath_power_setpower(sc, HAL_PM_FULL_SLEEP);
	+ }
	+ ATH_UNLOCK(sc);
	+}
	+
	+static int
	+ath_ioctl(struct ieee80211com ic, u_long cmd, void data)
	+{
	+ struct ifreq *ifr = data;
	+ struct ath_softc *sc = ic->ic_softc;
	+
	+ switch (cmd) {
	+ case SIOCGATHSTATS: {
	+ struct ieee80211vap *vap;
	+ struct ifnet *ifp;
	+ const HAL_RATE_TABLE *rt;
	+
	/* NB: embed these numbers to get a consistent view */
	- sc->sc_stats.ast_tx_packets = ifp->if_get_counter(ifp,
	- IFCOUNTER_OPACKETS);
	- sc->sc_stats.ast_rx_packets = ifp->if_get_counter(ifp,
	- IFCOUNTER_IPACKETS);
	+ sc->sc_stats.ast_tx_packets = 0;
	+ sc->sc_stats.ast_rx_packets = 0;
	+ TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
	+ ifp = vap->iv_ifp;
	+ sc->sc_stats.ast_tx_packets += ifp->if_get_counter(ifp,
	+ IFCOUNTER_OPACKETS);
	+ sc->sc_stats.ast_rx_packets += ifp->if_get_counter(ifp,
	+ IFCOUNTER_IPACKETS);
	+ }
	sc->sc_stats.ast_tx_rssi = ATH_RSSI(sc->sc_halstats.ns_avgtxrssi);
	sc->sc_stats.ast_rx_rssi = ATH_RSSI(sc->sc_halstats.ns_avgrssi);
	#ifdef IEEE80211_SUPPORT_TDMA
	@@ -6752,10 +6625,13 @@
	sc->sc_stats.ast_tx_rate \|= IEEE80211_RATE_MCS;
	return copyout(&sc->sc_stats,
	ifr->ifr_data, sizeof (sc->sc_stats));
	+ }
	case SIOCGATHAGSTATS:
	return copyout(&sc->sc_aggr_stats,
	ifr->ifr_data, sizeof (sc->sc_aggr_stats));
	- case SIOCZATHSTATS:
	+ case SIOCZATHSTATS: {
	+ int error;
	+
	error = priv_check(curthread, PRIV_DRIVER);
	if (error == 0) {
	memset(&sc->sc_stats, 0, sizeof(sc->sc_stats));
	@@ -6764,30 +6640,21 @@
	memset(&sc->sc_intr_stats, 0,
	sizeof(sc->sc_intr_stats));
	}
	- break;
	+ return (error);
	+ }
	#ifdef ATH_DIAGAPI
	case SIOCGATHDIAG:
	- error = ath_ioctl_diag(sc, (struct ath_diag *) ifr);
	- break;
	+ return (ath_ioctl_diag(sc, data));
	case SIOCGATHPHYERR:
	- error = ath_ioctl_phyerr(sc,(struct ath_diag*) ifr);
	- break;
	+ return (ath_ioctl_phyerr(sc, data));
	#endif
	case SIOCGATHSPECTRAL:
	- error = ath_ioctl_spectral(sc,(struct ath_diag*) ifr);
	- break;
	+ return (ath_ioctl_spectral(sc, data));
	case SIOCGATHNODERATESTATS:
	- error = ath_ioctl_ratestats(sc, (struct ath_rateioctl *) ifr);
	- break;
	- case SIOCGIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	+ return (ath_ioctl_ratestats(sc, data));
	default:
	- error = EINVAL;
	- break;
	+ return (ENOTTY);
	}
	- return error;
	-#undef IS_RUNNING
	}

	/*
	@@ -6828,8 +6695,7 @@
	ath_dfs_tasklet(void *p, int npending)
	{
	struct ath_softc sc = (struct ath_softc ) p;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	/*
	* If previous processing has found a radar event,
	@@ -6861,7 +6727,7 @@
	#ifdef ATH_SW_PSQ
	struct ath_node *an = ATH_NODE(ni);
	struct ieee80211com *ic = ni->ni_ic;
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_vap *avp = ATH_VAP(ni->ni_vap);

	/* XXX and no TXQ locks should be held here */
	@@ -6928,7 +6794,7 @@
	{
	#ifdef ATH_SW_PSQ
	struct ieee80211com *ic = ni->ni_ic;
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_node *an = ATH_NODE(ni);
	struct ath_vap *avp = ATH_VAP(ni->ni_vap);
	int changed = 0;
	@@ -7133,7 +6999,7 @@
	struct ath_node *an;
	struct ath_vap *avp;
	struct ieee80211com *ic = ni->ni_ic;
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	int tid;

	/* Just paranoia */
	Index: sys/dev/ath/if_ath_beacon.c
	===================================================================
	--- sys/dev/ath/if_ath_beacon.c
	+++ sys/dev/ath/if_ath_beacon.c
	@@ -134,7 +134,7 @@
	ath_beaconq_config(struct ath_softc *sc)
	{
	#define ATH_EXPONENT_TO_VALUE(v) ((1<<(v))-1)
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = sc->sc_ah;
	HAL_TXQ_INFO qi;

	@@ -464,7 +464,7 @@
	}

	if (sc->sc_stagbeacons) { /* staggered beacons */
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tsftu;

	tsftu = ath_hal_gettsf32(ah) >> 10;
	@@ -917,7 +917,7 @@
	((((u_int32_t)(_h)) << 22) \| (((u_int32_t)(_l)) >> 10))
	#define FUDGE 2
	struct ath_hal *ah = sc->sc_ah;
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_node *ni;
	u_int32_t nexttbtt, intval, tsftu;
	u_int32_t nexttbtt_u8, intval_u8;
	Index: sys/dev/ath/if_ath_debug.h
	===================================================================
	--- sys/dev/ath/if_ath_debug.h
	+++ sys/dev/ath/if_ath_debug.h
	@@ -91,9 +91,7 @@

	extern uint64_t ath_debug;

	-#define IFF_DUMPPKTS(sc, m) \
	- ((sc->sc_debug & (m)) \|\| \
	- (sc->sc_ifp->if_flags & (IFF_DEBUG\|IFF_LINK2)) == (IFF_DEBUG\|IFF_LINK2))
	+#define IFF_DUMPPKTS(sc, m) ((sc->sc_debug & (m))
	#define DPRINTF(sc, m, fmt, ...) do { \
	if (sc->sc_debug & (m)) \
	device_printf(sc->sc_dev, fmt, __VA_ARGS__); \
	@@ -112,8 +110,7 @@
	#else /* ATH_DEBUG */
	#define ATH_KTR(_sc, _km, _kf, ...) do { } while (0)

	-#define IFF_DUMPPKTS(sc, m) \
	- ((sc->sc_ifp->if_flags & (IFF_DEBUG\|IFF_LINK2)) == (IFF_DEBUG\|IFF_LINK2))
	+#define IFF_DUMPPKTS(sc, m) (0)
	#define DPRINTF(sc, m, fmt, ...) do { \
	(void) sc; \
	} while (0)
	Index: sys/dev/ath/if_ath_keycache.c
	===================================================================
	--- sys/dev/ath/if_ath_keycache.c
	+++ sys/dev/ath/if_ath_keycache.c
	@@ -425,7 +425,7 @@
	ath_key_alloc(struct ieee80211vap vap, struct ieee80211_key k,
	ieee80211_keyix keyix, ieee80211_keyix rxkeyix)
	{
	- struct ath_softc *sc = vap->iv_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = vap->iv_ic->ic_softc;

	/*
	* Group key allocation must be handled specially for
	@@ -493,7 +493,7 @@
	int
	ath_key_delete(struct ieee80211vap vap, const struct ieee80211_key k)
	{
	- struct ath_softc *sc = vap->iv_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = vap->iv_ic->ic_softc;
	struct ath_hal *ah = sc->sc_ah;
	const struct ieee80211_cipher *cip = k->wk_cipher;
	u_int keyix = k->wk_keyix;
	@@ -538,7 +538,7 @@
	ath_key_set(struct ieee80211vap vap, const struct ieee80211_key k,
	const u_int8_t mac[IEEE80211_ADDR_LEN])
	{
	- struct ath_softc *sc = vap->iv_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = vap->iv_ic->ic_softc;

	return ath_keyset(sc, vap, k, vap->iv_bss);
	}
	Index: sys/dev/ath/if_ath_misc.h
	===================================================================
	--- sys/dev/ath/if_ath_misc.h
	+++ sys/dev/ath/if_ath_misc.h
	@@ -65,7 +65,7 @@
	extern void ath_returnbuf_head(struct ath_softc sc, struct ath_buf bf);
	extern void ath_returnbuf_tail(struct ath_softc sc, struct ath_buf bf);

	-extern int ath_reset(struct ifnet *, ATH_RESET_TYPE);
	+extern int ath_reset(struct ath_softc *, ATH_RESET_TYPE);
	extern void ath_tx_default_comp(struct ath_softc sc, struct ath_buf bf,
	int fail);
	extern void ath_tx_update_ratectrl(struct ath_softc *sc,
	Index: sys/dev/ath/if_ath_rx.c
	===================================================================
	--- sys/dev/ath/if_ath_rx.c
	+++ sys/dev/ath/if_ath_rx.c
	@@ -154,8 +154,7 @@
	u_int32_t
	ath_calcrxfilter(struct ath_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	u_int32_t rfilt;

	rfilt = HAL_RX_FILTER_UCAST \| HAL_RX_FILTER_BCAST \| HAL_RX_FILTER_MCAST;
	@@ -164,7 +163,7 @@
	if (ic->ic_opmode != IEEE80211_M_STA)
	rfilt \|= HAL_RX_FILTER_PROBEREQ;
	/* XXX ic->ic_monvaps != 0? */
	- if (ic->ic_opmode == IEEE80211_M_MONITOR \|\| (ifp->if_flags & IFF_PROMISC))
	+ if (ic->ic_opmode == IEEE80211_M_MONITOR \|\| ic->ic_promisc > 0)
	rfilt \|= HAL_RX_FILTER_PROM;

	/*
	@@ -330,7 +329,7 @@
	int subtype, const struct ieee80211_rx_stats *rxs, int rssi, int nf)
	{
	struct ieee80211vap *vap = ni->ni_vap;
	- struct ath_softc *sc = vap->iv_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = vap->iv_ic->ic_softc;
	uint64_t tsf_beacon_old, tsf_beacon;
	uint64_t nexttbtt;
	int64_t tsf_delta;
	@@ -463,10 +462,9 @@

	#ifdef ATH_ENABLE_RADIOTAP_VENDOR_EXT
	static void
	-ath_rx_tap_vendor(struct ifnet ifp, struct mbuf m,
	+ath_rx_tap_vendor(struct ath_softc sc, struct mbuf m,
	const struct ath_rx_status *rs, u_int64_t tsf, int16_t nf)
	{
	- struct ath_softc *sc = ifp->if_softc;

	/* Fill in the extension bitmap */
	sc->sc_rx_th.wr_ext_bitmap = htole32(1 << ATH_RADIOTAP_VENDOR_HEADER);
	@@ -529,14 +527,13 @@
	#endif /* ATH_ENABLE_RADIOTAP_VENDOR_EXT */

	static void
	-ath_rx_tap(struct ifnet ifp, struct mbuf m,
	+ath_rx_tap(struct ath_softc sc, struct mbuf m,
	const struct ath_rx_status *rs, u_int64_t tsf, int16_t nf)
	{
	#define CHAN_HT20 htole32(IEEE80211_CHAN_HT20)
	#define CHAN_HT40U htole32(IEEE80211_CHAN_HT40U)
	#define CHAN_HT40D htole32(IEEE80211_CHAN_HT40D)
	#define CHAN_HT (CHAN_HT20\|CHAN_HT40U\|CHAN_HT40D)
	- struct ath_softc *sc = ifp->if_softc;
	const HAL_RATE_TABLE *rt;
	uint8_t rix;

	@@ -560,7 +557,7 @@
	else if (IEEE80211_IS_CHAN_HT20(sc->sc_curchan))
	sc->sc_rx_th.wr_chan_flags \|= CHAN_HT20;
	} else if (sc->sc_rx_th.wr_rate & IEEE80211_RATE_MCS) { /* HT rate */
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	if ((rs->rs_flags & HAL_RX_2040) == 0)
	sc->sc_rx_th.wr_chan_flags \|= CHAN_HT20;
	@@ -617,8 +614,7 @@
	{
	uint64_t rstamp;
	int len, type;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_node *ni;
	int is_good = 0;
	struct ath_rx_edma *re = &sc->sc_rxedma[qtype];
	@@ -704,7 +700,7 @@
	rs->rs_keyix-32 : rs->rs_keyix);
	}
	}
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	rx_error:
	/*
	* Cleanup any pending partial frame.
	@@ -724,9 +720,9 @@
	/* NB: bpf needs the mbuf length setup */
	len = rs->rs_datalen;
	m->m_pkthdr.len = m->m_len = len;
	- ath_rx_tap(ifp, m, rs, rstamp, nf);
	+ ath_rx_tap(sc, m, rs, rstamp, nf);
	#ifdef ATH_ENABLE_RADIOTAP_VENDOR_EXT
	- ath_rx_tap_vendor(ifp, m, rs, rstamp, nf);
	+ ath_rx_tap_vendor(sc, m, rs, rstamp, nf);
	#endif /* ATH_ENABLE_RADIOTAP_VENDOR_EXT */
	ieee80211_radiotap_rx_all(ic, m);
	}
	@@ -749,7 +745,6 @@
	sc->sc_stats.ast_rx_toobig++;
	m_freem(re->m_rxpending);
	}
	- m->m_pkthdr.rcvif = ifp;
	m->m_pkthdr.len = len;
	re->m_rxpending = m;
	m = NULL;
	@@ -766,10 +761,8 @@
	re->m_rxpending = NULL;
	} else {
	/*
	- * Normal single-descriptor receive; setup
	- * the rcvif and packet length.
	+ * Normal single-descriptor receive; setup packet length.
	*/
	- m->m_pkthdr.rcvif = ifp;
	m->m_pkthdr.len = len;
	}

	@@ -830,7 +823,6 @@
	rs->rs_antenna \|= 0x4;
	}

	- if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
	sc->sc_stats.ast_ant_rx[rs->rs_antenna]++;

	/*
	@@ -841,9 +833,9 @@
	* noise setting is filled in above.
	*/
	if (ieee80211_radiotap_active(ic)) {
	- ath_rx_tap(ifp, m, rs, rstamp, nf);
	+ ath_rx_tap(sc, m, rs, rstamp, nf);
	#ifdef ATH_ENABLE_RADIOTAP_VENDOR_EXT
	- ath_rx_tap_vendor(ifp, m, rs, rstamp, nf);
	+ ath_rx_tap_vendor(sc, m, rs, rstamp, nf);
	#endif /* ATH_ENABLE_RADIOTAP_VENDOR_EXT */
	}

	@@ -991,10 +983,9 @@
	((struct ath_desc *)((caddr_t)(_sc)->sc_rxdma.dd_desc + \
	((_pa) - (_sc)->sc_rxdma.dd_desc_paddr)))
	struct ath_buf *bf;
	- struct ifnet *ifp = sc->sc_ifp;
	struct ath_hal *ah = sc->sc_ah;
	#ifdef IEEE80211_SUPPORT_SUPERG
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	#endif
	struct ath_desc *ds;
	struct ath_rx_status *rs;
	@@ -1189,15 +1180,10 @@
	ATH_PCU_UNLOCK(sc);
	}

	- /* XXX check this inside of IF_LOCK? */
	- if (resched && (ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0) {
	#ifdef IEEE80211_SUPPORT_SUPERG
	+ if (resched)
	ieee80211_ff_age_all(ic, 100);
	#endif
	- if (!IFQ_IS_EMPTY(&ifp->if_snd))
	- ath_tx_kick(sc);
	- }
	-#undef PA2DESC

	/*
	* Put the hardware to sleep again if we're done with it.
	@@ -1219,7 +1205,7 @@
	sc->sc_rxproc_cnt--;
	ATH_PCU_UNLOCK(sc);
	}
	-
	+#undef PA2DESC
	#undef ATH_RX_MAX

	/*
	Index: sys/dev/ath/if_ath_rx_edma.c
	===================================================================
	--- sys/dev/ath/if_ath_rx_edma.c
	+++ sys/dev/ath/if_ath_rx_edma.c
	@@ -579,9 +579,8 @@
	ath_edma_recv_tasklet(void *arg, int npending)
	{
	struct ath_softc sc = (struct ath_softc ) arg;
	- struct ifnet *ifp = sc->sc_ifp;
	#ifdef IEEE80211_SUPPORT_SUPERG
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	#endif

	DPRINTF(sc, ATH_DEBUG_EDMA_RX, "%s: called; npending=%d\n",
	@@ -617,14 +616,9 @@
	ath_power_restore_power_state(sc);
	ATH_UNLOCK(sc);

	- /* XXX inside IF_LOCK ? */
	- if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0) {
	#ifdef IEEE80211_SUPPORT_SUPERG
	- ieee80211_ff_age_all(ic, 100);
	+ ieee80211_ff_age_all(ic, 100);
	#endif
	- if (! IFQ_IS_EMPTY(&ifp->if_snd))
	- ath_tx_kick(sc);
	- }
	if (ath_dfs_tasklet_needed(sc, sc->sc_curchan))
	taskqueue_enqueue(sc->sc_tq, &sc->sc_dfstask);

	Index: sys/dev/ath/if_ath_sysctl.c
	===================================================================
	--- sys/dev/ath/if_ath_sysctl.c
	+++ sys/dev/ath/if_ath_sysctl.c
	@@ -288,7 +288,6 @@
	ath_sysctl_tpscale(SYSCTL_HANDLER_ARGS)
	{
	struct ath_softc *sc = arg1;
	- struct ifnet *ifp = sc->sc_ifp;
	u_int32_t scale;
	int error;

	@@ -297,8 +296,7 @@
	if (error \|\| !req->newptr)
	return error;
	return !ath_hal_settpscale(sc->sc_ah, scale) ? EINVAL :
	- (ifp->if_drv_flags & IFF_DRV_RUNNING) ?
	- ath_reset(ifp, ATH_RESET_NOLOSS) : 0;
	+ (sc->sc_running) ? ath_reset(sc, ATH_RESET_NOLOSS) : 0;
	}

	static int
	@@ -318,7 +316,6 @@
	ath_sysctl_rfkill(SYSCTL_HANDLER_ARGS)
	{
	struct ath_softc *sc = arg1;
	- struct ifnet *ifp = sc->sc_ifp;
	struct ath_hal *ah = sc->sc_ah;
	u_int rfkill = ath_hal_getrfkill(ah);
	int error;
	@@ -330,8 +327,7 @@
	return 0;
	if (!ath_hal_setrfkill(ah, rfkill))
	return EINVAL;
	- return (ifp->if_drv_flags & IFF_DRV_RUNNING) ?
	- ath_reset(ifp, ATH_RESET_FULL) : 0;
	+ return (sc->sc_running ? ath_reset(sc, ATH_RESET_FULL) : 0);
	}

	static int
	@@ -508,8 +504,8 @@
	* doesn't reset ANI related registers, so it'll leave
	* things in an inconsistent state.
	*/
	- if (sc->sc_ifp->if_drv_flags & IFF_DRV_RUNNING)
	- ath_reset(sc->sc_ifp, ATH_RESET_NOLOSS);
	+ if (sc->sc_running)
	+ ath_reset(sc, ATH_RESET_NOLOSS);

	return 0;
	}
	Index: sys/dev/ath/if_ath_tdma.c
	===================================================================
	--- sys/dev/ath/if_ath_tdma.c
	+++ sys/dev/ath/if_ath_tdma.c
	@@ -359,7 +359,7 @@
	#define TU_TO_TSF(_tu) (((u_int64_t)(_tu)) << 10)
	struct ieee80211vap *vap = ni->ni_vap;
	struct ieee80211com *ic = ni->ni_ic;
	- struct ath_softc *sc = ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_hal *ah = sc->sc_ah;
	const HAL_RATE_TABLE *rt = sc->sc_currates;
	u_int64_t tsf, rstamp, nextslot, nexttbtt, nexttbtt_full;
	Index: sys/dev/ath/if_ath_tx.c
	===================================================================
	--- sys/dev/ath/if_ath_tx.c
	+++ sys/dev/ath/if_ath_tx.c
	@@ -1051,8 +1051,7 @@
	uint16_t flags;
	int shortPreamble;
	const HAL_RATE_TABLE *rt = sc->sc_currates;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	flags = bf->bf_state.bfs_txflags;
	rix = bf->bf_state.bfs_rc[0].rix;
	@@ -1545,8 +1544,7 @@
	{
	struct ieee80211vap *vap = ni->ni_vap;
	struct ath_hal *ah = sc->sc_ah;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	const struct chanAccParams *cap = &ic->ic_wme.wme_chanParams;
	int error, iswep, ismcast, isfrag, ismrr;
	int keyix, hdrlen, pktlen, try0 = 0;
	@@ -2074,8 +2072,7 @@
	struct ath_buf bf, struct mbuf m0,
	const struct ieee80211_bpf_params *params)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ath_hal *ah = sc->sc_ah;
	struct ieee80211vap *vap = ni->ni_vap;
	int error, ismcast, ismrr;
	@@ -2340,8 +2337,7 @@
	const struct ieee80211_bpf_params *params)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ath_softc *sc = ifp->if_softc;
	+ struct ath_softc *sc = ic->ic_softc;
	struct ath_buf *bf;
	struct ieee80211_frame wh = mtod(m, struct ieee80211_frame );
	int error = 0;
	@@ -2364,10 +2360,9 @@

	ATH_TX_LOCK(sc);

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 \|\| sc->sc_invalid) {
	- DPRINTF(sc, ATH_DEBUG_XMIT, "%s: discard frame, %s", __func__,
	- (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 ?
	- "!running" : "invalid");
	+ if (!sc->sc_running \|\| sc->sc_invalid) {
	+ DPRINTF(sc, ATH_DEBUG_XMIT, "%s: discard frame, r/i: %d/%d",
	+ __func__, sc->sc_running, sc->sc_invalid);
	m_freem(m);
	error = ENETDOWN;
	goto bad;
	@@ -2424,7 +2419,6 @@
	}
	}
	sc->sc_wd_timer = 5;
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	sc->sc_stats.ast_tx_raw++;

	/*
	@@ -2473,7 +2467,6 @@
	badbad:
	ATH_KTR(sc, ATH_KTR_TX, 2, "ath_raw_xmit: bad0: m=%p, params=%p",
	m, params);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	sc->sc_stats.ast_tx_raw_fail++;
	ieee80211_free_node(ni);

	@@ -5731,7 +5724,7 @@
	ath_addba_request(struct ieee80211_node ni, struct ieee80211_tx_ampdu tap,
	int dialogtoken, int baparamset, int batimeout)
	{
	- struct ath_softc *sc = ni->ni_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ni->ni_ic->ic_softc;
	int tid = tap->txa_tid;
	struct ath_node *an = ATH_NODE(ni);
	struct ath_tid *atid = &an->an_tid[tid];
	@@ -5809,7 +5802,7 @@
	ath_addba_response(struct ieee80211_node ni, struct ieee80211_tx_ampdu tap,
	int status, int code, int batimeout)
	{
	- struct ath_softc *sc = ni->ni_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ni->ni_ic->ic_softc;
	int tid = tap->txa_tid;
	struct ath_node *an = ATH_NODE(ni);
	struct ath_tid *atid = &an->an_tid[tid];
	@@ -5856,7 +5849,7 @@
	void
	ath_addba_stop(struct ieee80211_node ni, struct ieee80211_tx_ampdu tap)
	{
	- struct ath_softc *sc = ni->ni_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ni->ni_ic->ic_softc;
	int tid = tap->txa_tid;
	struct ath_node *an = ATH_NODE(ni);
	struct ath_tid *atid = &an->an_tid[tid];
	@@ -5991,7 +5984,7 @@
	ath_bar_response(struct ieee80211_node ni, struct ieee80211_tx_ampdu tap,
	int status)
	{
	- struct ath_softc *sc = ni->ni_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ni->ni_ic->ic_softc;
	int tid = tap->txa_tid;
	struct ath_node *an = ATH_NODE(ni);
	struct ath_tid *atid = &an->an_tid[tid];
	@@ -6064,7 +6057,7 @@
	ath_addba_response_timeout(struct ieee80211_node *ni,
	struct ieee80211_tx_ampdu *tap)
	{
	- struct ath_softc *sc = ni->ni_ic->ic_ifp->if_softc;
	+ struct ath_softc *sc = ni->ni_ic->ic_softc;
	int tid = tap->txa_tid;
	struct ath_node *an = ATH_NODE(ni);
	struct ath_tid *atid = &an->an_tid[tid];
	Index: sys/dev/ath/if_ath_tx_edma.c
	===================================================================
	--- sys/dev/ath/if_ath_tx_edma.c
	+++ sys/dev/ath/if_ath_tx_edma.c
	@@ -537,7 +537,6 @@
	static void
	ath_edma_tx_drain(struct ath_softc *sc, ATH_RESET_TYPE reset_type)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	int i;

	DPRINTF(sc, ATH_DEBUG_RESET, "%s: called\n", __func__);
	@@ -579,9 +578,6 @@

	/* XXX dump out the frames */

	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	sc->sc_wd_timer = 0;
	}

	@@ -834,12 +830,6 @@

	sc->sc_wd_timer = 0;

	- if (idx > 0) {
	- IF_LOCK(&sc->sc_ifp->if_snd);
	- sc->sc_ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- IF_UNLOCK(&sc->sc_ifp->if_snd);
	- }
	-
	/* Kick software scheduler */
	/*
	* XXX It's inefficient to do this if the FIFO queue is full,
	Index: sys/dev/ath/if_athvar.h
	===================================================================
	--- sys/dev/ath/if_athvar.h
	+++ sys/dev/ath/if_athvar.h
	@@ -555,8 +555,8 @@
	};

	struct ath_softc {
	- struct ifnet sc_ifp; / interface common */
	- struct ath_stats sc_stats; /* interface statistics */
	+ struct ieee80211com sc_ic;
	+ struct ath_stats sc_stats; /* device statistics */
	struct ath_tx_aggr_stats sc_aggr_stats;
	struct ath_intr_stats sc_intr_stats;
	uint64_t sc_debug;
	@@ -650,7 +650,8 @@
	/*
	* Second set of flags.
	*/
	- u_int32_t sc_use_ent : 1,
	+ u_int32_t sc_running : 1, /* initialized */
	+ sc_use_ent : 1,
	sc_rx_stbc : 1,
	sc_tx_stbc : 1,
	sc_hasenforcetxop : 1, /* support enforce TxOP */
	Index: sys/dev/bwi/bwimac.c
	===================================================================
	--- sys/dev/bwi/bwimac.c
	+++ sys/dev/bwi/bwimac.c
	@@ -832,11 +832,11 @@
	uint8_t fw_type)
	{
	const struct bwi_fwhdr *hdr;
	- struct ifnet *ifp = sc->sc_ifp;

	if (fw->datasize < sizeof(*hdr)) {
	- if_printf(ifp, "invalid firmware (%s): invalid size %zu\n",
	- fw->name, fw->datasize);
	+ device_printf(sc->sc_dev,
	+ "invalid firmware (%s): invalid size %zu\n",
	+ fw->name, fw->datasize);
	return 0;
	}

	@@ -847,25 +847,26 @@
	* Don't verify IV's size, it has different meaning
	*/
	if (be32toh(hdr->fw_size) != fw->datasize - sizeof(*hdr)) {
	- if_printf(ifp, "invalid firmware (%s): size mismatch, "
	- "fw %u, real %zu\n", fw->name,
	- be32toh(hdr->fw_size),
	- fw->datasize - sizeof(*hdr));
	+ device_printf(sc->sc_dev,
	+ "invalid firmware (%s): size mismatch, "
	+ "fw %u, real %zu\n", fw->name,
	+ be32toh(hdr->fw_size), fw->datasize - sizeof(*hdr));
	return 0;
	}
	}

	if (hdr->fw_type != fw_type) {
	- if_printf(ifp, "invalid firmware (%s): type mismatch, "
	- "fw \'%c\', target \'%c\'\n", fw->name,
	- hdr->fw_type, fw_type);
	+ device_printf(sc->sc_dev,
	+ "invalid firmware (%s): type mismatch, "
	+ "fw \'%c\', target \'%c\'\n", fw->name,
	+ hdr->fw_type, fw_type);
	return 0;
	}

	if (hdr->fw_gen != BWI_FW_GEN_1) {
	- if_printf(ifp, "invalid firmware (%s): wrong generation, "
	- "fw %d, target %d\n", fw->name,
	- hdr->fw_gen, BWI_FW_GEN_1);
	+ device_printf(sc->sc_dev,
	+ "invalid firmware (%s): wrong generation, "
	+ "fw %d, target %d\n", fw->name, hdr->fw_gen, BWI_FW_GEN_1);
	return 0;
	}
	return 1;
	@@ -1002,7 +1003,6 @@
	bwi_mac_fw_load(struct bwi_mac *mac)
	{
	struct bwi_softc *sc = mac->mac_sc;
	- struct ifnet *ifp = sc->sc_ifp;
	const uint32_t *fw;
	uint16_t fw_rev;
	int fw_len, i;
	@@ -1057,7 +1057,8 @@
	DELAY(10);
	}
	if (i == NRETRY) {
	- if_printf(ifp, "firmware (ucode&pcm) loading timed out\n");
	+ device_printf(sc->sc_dev,
	+ "firmware (ucode&pcm) loading timed out\n");
	return ETIMEDOUT;
	}

	@@ -1067,12 +1068,14 @@

	fw_rev = MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWREV);
	if (fw_rev > BWI_FW_VERSION3_REVMAX) {
	- if_printf(ifp, "firmware version 4 is not supported yet\n");
	+ device_printf(sc->sc_dev,
	+ "firmware version 4 is not supported yet\n");
	return ENODEV;
	}

	- if_printf(ifp, "firmware rev 0x%04x, patch level 0x%04x\n", fw_rev,
	- MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWPATCHLV));
	+ device_printf(sc->sc_dev,
	+ "firmware rev 0x%04x, patch level 0x%04x\n", fw_rev,
	+ MOBJ_READ_2(mac, BWI_COMM_MOBJ, BWI_COMM_MOBJ_FWPATCHLV));
	return 0;
	}

	@@ -1132,7 +1135,6 @@
	bwi_mac_fw_load_iv(struct bwi_mac mac, const struct firmware fw)
	{
	struct bwi_softc *sc = mac->mac_sc;
	- struct ifnet *ifp = sc->sc_ifp;
	const struct bwi_fwhdr *hdr;
	const struct bwi_fw_iv *iv;
	int n, i, iv_img_size;
	@@ -1155,7 +1157,7 @@
	int sz = 0;

	if (iv_img_size < sizeof(iv->iv_ofs)) {
	- if_printf(ifp, "invalid IV image, ofs\n");
	+ device_printf(sc->sc_dev, "invalid IV image, ofs\n");
	return EINVAL;
	}
	iv_img_size -= sizeof(iv->iv_ofs);
	@@ -1165,7 +1167,7 @@

	ofs = __SHIFTOUT(iv_ofs, BWI_FW_IV_OFS_MASK);
	if (ofs >= 0x1000) {
	- if_printf(ifp, "invalid ofs (0x%04x) "
	+ device_printf(sc->sc_dev, "invalid ofs (0x%04x) "
	"for %dth iv\n", ofs, i);
	return EINVAL;
	}
	@@ -1174,7 +1176,8 @@
	uint32_t val32;

	if (iv_img_size < sizeof(iv->iv_val.val32)) {
	- if_printf(ifp, "invalid IV image, val32\n");
	+ device_printf(sc->sc_dev,
	+ "invalid IV image, val32\n");
	return EINVAL;
	}
	iv_img_size -= sizeof(iv->iv_val.val32);
	@@ -1186,7 +1189,8 @@
	uint16_t val16;

	if (iv_img_size < sizeof(iv->iv_val.val16)) {
	- if_printf(ifp, "invalid IV image, val16\n");
	+ device_printf(sc->sc_dev,
	+ "invalid IV image, val16\n");
	return EINVAL;
	}
	iv_img_size -= sizeof(iv->iv_val.val16);
	@@ -1200,7 +1204,8 @@
	}

	if (iv_img_size != 0) {
	- if_printf(ifp, "invalid IV image, size left %d\n", iv_img_size);
	+ device_printf(sc->sc_dev, "invalid IV image, size left %d\n",
	+ iv_img_size);
	return EINVAL;
	}
	return 0;
	@@ -1209,19 +1214,19 @@
	static int
	bwi_mac_fw_init(struct bwi_mac *mac)
	{
	- struct ifnet *ifp = mac->mac_sc->sc_ifp;
	+ device_t dev = mac->mac_sc->sc_dev;
	int error;

	error = bwi_mac_fw_load_iv(mac, mac->mac_iv);
	if (error) {
	- if_printf(ifp, "load IV failed\n");
	+ device_printf(dev, "load IV failed\n");
	return error;
	}

	if (mac->mac_iv_ext != NULL) {
	error = bwi_mac_fw_load_iv(mac, mac->mac_iv_ext);
	if (error)
	- if_printf(ifp, "load ExtIV failed\n");
	+ device_printf(dev, "load ExtIV failed\n");
	}
	return error;
	}
	@@ -1230,8 +1235,7 @@
	bwi_mac_opmode_init(struct bwi_mac *mac)
	{
	struct bwi_softc *sc = mac->mac_sc;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t mac_status;
	uint16_t pre_tbtt;

	@@ -1280,7 +1284,7 @@
	break;
	}

	- if (ic->ic_ifp->if_flags & IFF_PROMISC)
	+ if (ic->ic_promisc > 0)
	mac_status \|= BWI_MAC_STATUS_PROMISC;

	CSR_WRITE_4(sc, BWI_MAC_STATUS, mac_status);
	@@ -1331,8 +1335,7 @@
	{
	struct bwi_softc *sc = mac->mac_sc;
	struct bwi_phy *phy = &mac->mac_phy;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	const struct ieee80211_rate_table *rt;
	struct bwi_retry_lim lim;
	uint16_t cw_min;
	@@ -1915,8 +1918,7 @@
	bwi_mac_lock(struct bwi_mac *mac)
	{
	struct bwi_softc *sc = mac->mac_sc;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	KASSERT((mac->mac_flags & BWI_MAC_F_LOCKED) == 0,
	("mac_flags 0x%x", mac->mac_flags));
	@@ -1939,8 +1941,7 @@
	bwi_mac_unlock(struct bwi_mac *mac)
	{
	struct bwi_softc *sc = mac->mac_sc;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	KASSERT(mac->mac_flags & BWI_MAC_F_LOCKED,
	("mac_flags 0x%x", mac->mac_flags));
	Index: sys/dev/bwi/bwiphy.c
	===================================================================
	--- sys/dev/bwi/bwiphy.c
	+++ sys/dev/bwi/bwiphy.c
	@@ -429,7 +429,7 @@
	bwi_phy_init_11b_rev2(struct bwi_mac *mac)
	{
	/* TODO:11B */
	- if_printf(mac->mac_sc->sc_ifp,
	+ device_printf(mac->mac_sc->sc_dev,
	"%s is not implemented yet\n", __func__);
	}

	Index: sys/dev/bwi/bwirf.c
	===================================================================
	--- sys/dev/bwi/bwirf.c
	+++ sys/dev/bwi/bwirf.c
	@@ -1260,7 +1260,6 @@
	bwi_rf_lo_update_11g(struct bwi_mac *mac)
	{
	struct bwi_softc *sc = mac->mac_sc;
	- struct ifnet *ifp = sc->sc_ifp;
	struct bwi_rf *rf = &mac->mac_rf;
	struct bwi_phy *phy = &mac->mac_phy;
	struct bwi_tpctl *tpctl = &mac->mac_tpctl;
	@@ -1329,7 +1328,7 @@
	PHY_WRITE(mac, 0x812, 0xb2);
	}

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
	+ if ((sc->sc_flags & BWI_F_RUNNING) == 0)
	tpctl->tp_ctrl2 = bwi_rf_get_tp_ctrl2(mac);
	PHY_WRITE(mac, 0x80f, 0x8078);

	@@ -1352,7 +1351,7 @@
	PHY_WRITE(mac, 0x15, devi_ctrl \| 0xefa0);
	}

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
	+ if ((sc->sc_flags & BWI_F_RUNNING) == 0)
	tpctl = NULL;
	bwi_rf_lo_adjust(mac, tpctl);

	@@ -1462,7 +1461,7 @@
	static const int rf_lo_measure_order[RF_ATTEN_LISTSZ] =
	{ 3, 1, 5, 7, 9, 2, 0, 4, 6, 8, 10, 11, 12, 13 };

	- struct ifnet *ifp = mac->mac_sc->sc_ifp;
	+ struct bwi_softc *sc = mac->mac_sc;
	struct bwi_rf_lo lo_save, *lo;
	uint8_t devi_ctrl = 0;
	int idx, adj_rf7a = 0;
	@@ -1476,7 +1475,7 @@
	for (bbp_atten = 0; bbp_atten < BBP_ATTEN_MAX; ++bbp_atten) {
	uint16_t tp_ctrl2, rf7a;

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	+ if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
	if (idx == 0) {
	bzero(&lo_save, sizeof(lo_save));
	} else if (init_rf_atten < 0) {
	Index: sys/dev/bwi/if_bwi.c
	===================================================================
	--- sys/dev/bwi/if_bwi.c
	+++ sys/dev/bwi/if_bwi.c
	@@ -102,10 +102,10 @@
	const uint8_t [IEEE80211_ADDR_LEN],
	const uint8_t [IEEE80211_ADDR_LEN]);
	static void bwi_vap_delete(struct ieee80211vap *);
	-static void bwi_init(void *);
	-static int bwi_ioctl(struct ifnet *, u_long, caddr_t);
	-static void bwi_start(struct ifnet *);
	-static void bwi_start_locked(struct ifnet *);
	+static void bwi_init(struct bwi_softc *);
	+static void bwi_parent(struct ieee80211com *);
	+static int bwi_transmit(struct ieee80211com , struct mbuf );
	+static void bwi_start_locked(struct bwi_softc *);
	static int bwi_raw_xmit(struct ieee80211_node , struct mbuf ,
	const struct ieee80211_bpf_params *);
	static void bwi_watchdog(void *);
	@@ -352,14 +352,12 @@
	int
	bwi_attach(struct bwi_softc *sc)
	{
	- struct ieee80211com *ic;
	+ struct ieee80211com *ic = &sc->sc_ic;
	device_t dev = sc->sc_dev;
	- struct ifnet *ifp;
	struct bwi_mac *mac;
	struct bwi_phy *phy;
	int i, error;
	uint8_t bands;
	- uint8_t macaddr[IEEE80211_ADDR_LEN];

	BWI_LOCK_INIT(sc);

	@@ -371,8 +369,8 @@
	taskqueue_start_threads(&sc->sc_tq, 1, PI_NET, "%s taskq",
	device_get_nameunit(dev));
	TASK_INIT(&sc->sc_restart_task, 0, bwi_restart, sc);
	-
	callout_init_mtx(&sc->sc_calib_ch, &sc->sc_mtx, 0);
	+ mbufq_init(&sc->sc_snd, ifqmaxlen);

	/*
	* Initialize sysctl variables
	@@ -450,25 +448,6 @@
	if (error)
	goto fail;

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(dev, "can not if_alloc()\n");
	- error = ENOSPC;
	- goto fail;
	- }
	- ic = ifp->if_l2com;
	-
	- /* set these up early for if_printf use */
	- if_initname(ifp, device_get_name(dev), device_get_unit(dev));
	-
	- ifp->if_softc = sc;
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = bwi_init;
	- ifp->if_ioctl = bwi_ioctl;
	- ifp->if_start = bwi_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	callout_init_mtx(&sc->sc_watchdog_timer, &sc->sc_mtx, 0);

	/*
	@@ -485,13 +464,13 @@
	setbit(&bands, IEEE80211_MODE_11G);
	}

	- bwi_get_eaddr(sc, BWI_SPROM_11BG_EADDR, macaddr);
	- if (IEEE80211_IS_MULTICAST(macaddr)) {
	- bwi_get_eaddr(sc, BWI_SPROM_11A_EADDR, macaddr);
	- if (IEEE80211_IS_MULTICAST(macaddr)) {
	+ bwi_get_eaddr(sc, BWI_SPROM_11BG_EADDR, ic->ic_macaddr);
	+ if (IEEE80211_IS_MULTICAST(ic->ic_macaddr)) {
	+ bwi_get_eaddr(sc, BWI_SPROM_11A_EADDR, ic->ic_macaddr);
	+ if (IEEE80211_IS_MULTICAST(ic->ic_macaddr)) {
	device_printf(dev,
	"invalid MAC address: %6D\n",
	- macaddr, ":");
	+ ic->ic_macaddr, ":");
	}
	}
	} else if (phy->phy_mode == IEEE80211_MODE_11A) {
	@@ -510,7 +489,6 @@
	/* XXX use locale */
	ieee80211_init_channels(ic, NULL, &bands);

	- ic->ic_ifp = ifp;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(dev);
	ic->ic_caps = IEEE80211_C_STA \|
	@@ -520,7 +498,7 @@
	IEEE80211_C_BGSCAN \|
	IEEE80211_C_MONITOR;
	ic->ic_opmode = IEEE80211_M_STA;
	- ieee80211_ifattach(ic, macaddr);
	+ ieee80211_ifattach(ic);

	ic->ic_headroom = sizeof(struct bwi_txbuf_hdr);

	@@ -532,6 +510,8 @@
	ic->ic_scan_start = bwi_scan_start;
	ic->ic_scan_end = bwi_scan_end;
	ic->ic_set_channel = bwi_set_channel;
	+ ic->ic_transmit = bwi_transmit;
	+ ic->ic_parent = bwi_parent;

	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);

	@@ -577,8 +557,7 @@
	int
	bwi_detach(struct bwi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int i;

	bwi_stop(sc, 1);
	@@ -590,7 +569,6 @@
	for (i = 0; i < sc->sc_nmac; ++i)
	bwi_mac_detach(&sc->sc_mac[i]);
	bwi_dma_free(sc);
	- if_free(ifp);
	taskqueue_free(sc->sc_tq);

	BWI_LOCK_DESTROY(sc);
	@@ -609,14 +587,11 @@

	if (!TAILQ_EMPTY(&ic->ic_vaps)) /* only one at a time */
	return NULL;
	- bvp = (struct bwi_vap *) malloc(sizeof(struct bwi_vap),
	- M_80211_VAP, M_WAITOK \| M_ZERO);
	- if (bvp == NULL)
	- return NULL;
	+ bvp = malloc(sizeof(struct bwi_vap), M_80211_VAP, M_WAITOK \| M_ZERO);
	vap = &bvp->bv_vap;
	/* enable s/w bmiss handling for sta mode */
	ieee80211_vap_setup(ic, vap, name, unit, opmode,
	- flags \| IEEE80211_CLONE_NOBEACONS, bssid, mac);
	+ flags \| IEEE80211_CLONE_NOBEACONS, bssid);

	/* override default methods */
	bvp->bv_newstate = vap->iv_newstate;
	@@ -627,7 +602,8 @@
	ieee80211_ratectl_init(vap);

	/* complete setup */
	- ieee80211_vap_attach(vap, bwi_media_change, ieee80211_media_status);
	+ ieee80211_vap_attach(vap, bwi_media_change, ieee80211_media_status,
	+ mac);
	ic->ic_opmode = opmode;
	return vap;
	}
	@@ -651,9 +627,8 @@
	void
	bwi_resume(struct bwi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;

	- if (ifp->if_flags & IFF_UP)
	+ if (sc->sc_ic.ic_nrunning > 0)
	bwi_init(sc);
	}

	@@ -1217,27 +1192,26 @@
	}

	static void
	-bwi_init(void *xsc)
	+bwi_init(struct bwi_softc *sc)
	{
	- struct bwi_softc *sc = xsc;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	BWI_LOCK(sc);
	bwi_init_statechg(sc, 1);
	BWI_UNLOCK(sc);

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	+ if (sc->sc_flags & BWI_F_RUNNING)
	ieee80211_start_all(ic); /* start all vap's */
	}

	static void
	bwi_init_statechg(struct bwi_softc *sc, int statechg)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct bwi_mac *mac;
	int error;

	+ BWI_ASSERT_LOCKED(sc);
	+
	bwi_stop_locked(sc, statechg);

	bwi_bbp_power_on(sc, BWI_CLOCK_MODE_FAST);
	@@ -1247,20 +1221,21 @@
	mac = &sc->sc_mac[0];
	error = bwi_regwin_switch(sc, &mac->mac_regwin, NULL);
	if (error) {
	- if_printf(ifp, "%s: error %d on regwin switch\n",
	+ device_printf(sc->sc_dev, "%s: error %d on regwin switch\n",
	__func__, error);
	goto bad;
	}
	error = bwi_mac_init(mac);
	if (error) {
	- if_printf(ifp, "%s: error %d on MAC init\n", __func__, error);
	+ device_printf(sc->sc_dev, "%s: error %d on MAC init\n",
	+ __func__, error);
	goto bad;
	}

	bwi_bbp_power_on(sc, BWI_CLOCK_MODE_DYN);

	bwi_set_bssid(sc, bwi_zero_addr); /* Clear BSSID */
	- bwi_set_addr_filter(sc, BWI_ADDR_FILTER_MYADDR, IF_LLADDR(ifp));
	+ bwi_set_addr_filter(sc, BWI_ADDR_FILTER_MYADDR, sc->sc_ic.ic_macaddr);

	bwi_mac_reset_hwkeys(mac);

	@@ -1278,7 +1253,8 @@
	CSR_READ_4(sc, BWI_TXSTATUS1);
	}
	if (i == NRETRY)
	- if_printf(ifp, "%s: can't drain TX status\n", __func__);
	+ device_printf(sc->sc_dev,
	+ "%s: can't drain TX status\n", __func__);
	#undef NRETRY
	}

	@@ -1288,14 +1264,14 @@
	/* Start MAC */
	error = bwi_mac_start(mac);
	if (error) {
	- if_printf(ifp, "%s: error %d starting MAC\n", __func__, error);
	+ device_printf(sc->sc_dev, "%s: error %d starting MAC\n",
	+ __func__, error);
	goto bad;
	}

	/* Clear stop flag before enabling interrupt */
	sc->sc_flags &= ~BWI_F_STOP;
	-
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	+ sc->sc_flags \|= BWI_F_RUNNING;
	callout_reset(&sc->sc_watchdog_timer, hz, bwi_watchdog, sc);

	/* Enable intrs */
	@@ -1305,135 +1281,110 @@
	bwi_stop_locked(sc, 1);
	}

	-static int
	-bwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+static void
	+bwi_parent(struct ieee80211com *ic)
	{
	-#define IS_RUNNING(ifp) \
	- ((ifp->if_flags & IFF_UP) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
	- struct bwi_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ifreq ifr = (struct ifreq ) data;
	- int error = 0, startall = 0;
	+ struct bwi_softc *sc = ic->ic_softc;
	+ int startall = 0;

	- switch (cmd) {
	- case SIOCSIFFLAGS:
	- BWI_LOCK(sc);
	- if (IS_RUNNING(ifp)) {
	- struct bwi_mac *mac;
	- int promisc = -1;
	-
	- KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC,
	- ("current regwin type %d",
	- sc->sc_cur_regwin->rw_type));
	- mac = (struct bwi_mac *)sc->sc_cur_regwin;
	-
	- if ((ifp->if_flags & IFF_PROMISC) &&
	- (sc->sc_flags & BWI_F_PROMISC) == 0) {
	- promisc = 1;
	- sc->sc_flags \|= BWI_F_PROMISC;
	- } else if ((ifp->if_flags & IFF_PROMISC) == 0 &&
	- (sc->sc_flags & BWI_F_PROMISC)) {
	- promisc = 0;
	- sc->sc_flags &= ~BWI_F_PROMISC;
	- }
	+ BWI_LOCK(sc);
	+ if (ic->ic_nrunning > 0) {
	+ struct bwi_mac *mac;
	+ int promisc = -1;

	- if (promisc >= 0)
	- bwi_mac_set_promisc(mac, promisc);
	- }
	+ KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC,
	+ ("current regwin type %d",
	+ sc->sc_cur_regwin->rw_type));
	+ mac = (struct bwi_mac *)sc->sc_cur_regwin;

	- if (ifp->if_flags & IFF_UP) {
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	- bwi_init_statechg(sc, 1);
	- startall = 1;
	- }
	- } else {
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- bwi_stop_locked(sc, 1);
	+ if (ic->ic_promisc > 0 && (sc->sc_flags & BWI_F_PROMISC) == 0) {
	+ promisc = 1;
	+ sc->sc_flags \|= BWI_F_PROMISC;
	+ } else if (ic->ic_promisc == 0 &&
	+ (sc->sc_flags & BWI_F_PROMISC) != 0) {
	+ promisc = 0;
	+ sc->sc_flags &= ~BWI_F_PROMISC;
	+ }
	+
	+ if (promisc >= 0)
	+ bwi_mac_set_promisc(mac, promisc);
	+ }
	+ if (ic->ic_nrunning > 0) {
	+ if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
	+ bwi_init_statechg(sc, 1);
	+ startall = 1;
	}
	- BWI_UNLOCK(sc);
	- if (startall)
	- ieee80211_start_all(ic);
	- break;
	- case SIOCGIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- case SIOCGIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	- default:
	- error = EINVAL;
	- break;
	- }
	- return error;
	-#undef IS_RUNNING
	+ } else if (sc->sc_flags & BWI_F_RUNNING)
	+ bwi_stop_locked(sc, 1);
	+ BWI_UNLOCK(sc);
	+ if (startall)
	+ ieee80211_start_all(ic);
	}

	-static void
	-bwi_start(struct ifnet *ifp)
	+static int
	+bwi_transmit(struct ieee80211com ic, struct mbuf m)
	{
	- struct bwi_softc *sc = ifp->if_softc;
	+ struct bwi_softc *sc = ic->ic_softc;
	+ int error;

	BWI_LOCK(sc);
	- bwi_start_locked(ifp);
	+ if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
	+ BWI_UNLOCK(sc);
	+ return (ENXIO);
	+ }
	+ error = mbufq_enqueue(&sc->sc_snd, m);
	+ if (error) {
	+ BWI_UNLOCK(sc);
	+ return (error);
	+ }
	+ bwi_start_locked(sc);
	BWI_UNLOCK(sc);
	+ return (0);
	}

	static void
	-bwi_start_locked(struct ifnet *ifp)
	+bwi_start_locked(struct bwi_softc *sc)
	{
	- struct bwi_softc *sc = ifp->if_softc;
	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
	struct ieee80211_frame *wh;
	struct ieee80211_node *ni;
	- struct ieee80211_key *k;
	struct mbuf *m;
	int trans, idx;

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
	- return;
	+ BWI_ASSERT_LOCKED(sc);

	trans = 0;
	idx = tbd->tbd_idx;

	- while (tbd->tbd_buf[idx].tb_mbuf == NULL) {
	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m); /* XXX: LOCK */
	- if (m == NULL)
	- break;
	-
	+ while (tbd->tbd_buf[idx].tb_mbuf == NULL &&
	+ tbd->tbd_used + BWI_TX_NSPRDESC < BWI_TX_NDESC &&
	+ (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
	ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
	wh = mtod(m, struct ieee80211_frame *);
	- if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
	- k = ieee80211_crypto_encap(ni, m);
	- if (k == NULL) {
	- ieee80211_free_node(ni);
	- m_freem(m);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	- continue;
	- }
	+ if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) != 0 &&
	+ ieee80211_crypto_encap(ni, m) == NULL) {
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	+ ieee80211_free_node(ni);
	+ m_freem(m);
	+ continue;
	}
	- wh = NULL; /* Catch any invalid use */
	-
	if (bwi_encap(sc, idx, m, ni) != 0) {
	/* 'm' is freed in bwi_encap() if we reach here */
	- if (ni != NULL)
	+ if (ni != NULL) {
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ } else
	+ counter_u64_add(sc->sc_ic.ic_oerrors, 1);
	continue;
	}
	-
	trans = 1;
	tbd->tbd_used++;
	idx = (idx + 1) % BWI_TX_NDESC;
	-
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	-
	- if (tbd->tbd_used + BWI_TX_NSPRDESC >= BWI_TX_NDESC) {
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- break;
	- }
	}
	- tbd->tbd_idx = idx;

	+ tbd->tbd_idx = idx;
	if (trans)
	sc->sc_tx_timer = 5;
	}
	@@ -1443,13 +1394,12 @@
	const struct ieee80211_bpf_params *params)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct bwi_softc *sc = ifp->if_softc;
	+ struct bwi_softc *sc = ic->ic_softc;
	/* XXX wme? */
	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
	int idx, error;

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	+ if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
	ieee80211_free_node(ni);
	m_freem(m);
	return ENETDOWN;
	@@ -1472,16 +1422,12 @@
	error = bwi_encap_raw(sc, idx, m, ni, params);
	}
	if (error == 0) {
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	- if (++tbd->tbd_used + BWI_TX_NSPRDESC >= BWI_TX_NDESC)
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	+ tbd->tbd_used++;
	tbd->tbd_idx = (idx + 1) % BWI_TX_NDESC;
	sc->sc_tx_timer = 5;
	- } else {
	+ } else
	/* NB: m is reclaimed on encap failure */
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	- }
	BWI_UNLOCK(sc);
	return error;
	}
	@@ -1490,14 +1436,12 @@
	bwi_watchdog(void *arg)
	{
	struct bwi_softc *sc;
	- struct ifnet *ifp;

	sc = arg;
	- ifp = sc->sc_ifp;
	BWI_ASSERT_LOCKED(sc);
	if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0) {
	- if_printf(ifp, "watchdog timeout\n");
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ device_printf(sc->sc_dev, "watchdog timeout\n");
	+ counter_u64_add(sc->sc_ic.ic_oerrors, 1);
	taskqueue_enqueue(sc->sc_tq, &sc->sc_restart_task);
	}
	callout_reset(&sc->sc_watchdog_timer, hz, bwi_watchdog, sc);
	@@ -1514,7 +1458,6 @@
	static void
	bwi_stop_locked(struct bwi_softc *sc, int statechg)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct bwi_mac *mac;
	int i, error, pwr_off = 0;

	@@ -1525,7 +1468,7 @@
	sc->sc_led_blinking = 0;
	sc->sc_flags \|= BWI_F_STOP;

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
	+ if (sc->sc_flags & BWI_F_RUNNING) {
	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC,
	("current regwin type %d", sc->sc_cur_regwin->rw_type));
	mac = (struct bwi_mac *)sc->sc_cur_regwin;
	@@ -1557,14 +1500,13 @@

	sc->sc_tx_timer = 0;
	callout_stop(&sc->sc_watchdog_timer);
	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	+ sc->sc_flags &= ~BWI_F_RUNNING;
	}

	void
	bwi_intr(void *xsc)
	{
	struct bwi_softc *sc = xsc;
	- struct ifnet *ifp = sc->sc_ifp;
	struct bwi_mac *mac;
	uint32_t intr_status;
	uint32_t txrx_intr_status[BWI_TXRX_NRING];
	@@ -1572,7 +1514,7 @@

	BWI_LOCK(sc);

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 \|\|
	+ if ((sc->sc_flags & BWI_F_RUNNING) == 0 \|\|
	(sc->sc_flags & BWI_F_STOP)) {
	BWI_UNLOCK(sc);
	return;
	@@ -1615,7 +1557,7 @@
	i, txrx_intr_status[i]);

	if (txrx_intr_status[i] & BWI_TXRX_INTR_ERROR) {
	- if_printf(ifp,
	+ device_printf(sc->sc_dev,
	"%s: intr fatal TX/RX (%d) error 0x%08x\n",
	__func__, i, txrx_intr_status[i]);
	txrx_error = 1;
	@@ -1653,7 +1595,8 @@
	*/
	if (intr_status & BWI_INTR_PHY_TXERR) {
	if (mac->mac_flags & BWI_MAC_F_PHYE_RESET) {
	- if_printf(ifp, "%s: intr PHY TX error\n", __func__);
	+ device_printf(sc->sc_dev, "%s: intr PHY TX error\n",
	+ __func__);
	taskqueue_enqueue(sc->sc_tq, &sc->sc_restart_task);
	BWI_UNLOCK(sc);
	return;
	@@ -1668,7 +1611,7 @@
	bwi_mac_config_ps(mac);

	if (intr_status & BWI_INTR_EO_ATIM)
	- if_printf(ifp, "EO_ATIM\n");
	+ device_printf(sc->sc_dev, "EO_ATIM\n");

	if (intr_status & BWI_INTR_PMQ) {
	for (;;) {
	@@ -1679,7 +1622,7 @@
	}

	if (intr_status & BWI_INTR_NOISE)
	- if_printf(ifp, "intr noise\n");
	+ device_printf(sc->sc_dev, "intr noise\n");

	if (txrx_intr_status[0] & BWI_TXRX_INTR_RX) {
	rx_data = sc->sc_rxeof(sc);
	@@ -1728,7 +1671,7 @@
	static void
	bwi_scan_start(struct ieee80211com *ic)
	{
	- struct bwi_softc *sc = ic->ic_ifp->if_softc;
	+ struct bwi_softc *sc = ic->ic_softc;

	BWI_LOCK(sc);
	/* Enable MAC beacon promiscuity */
	@@ -1739,7 +1682,7 @@
	static void
	bwi_set_channel(struct ieee80211com *ic)
	{
	- struct bwi_softc *sc = ic->ic_ifp->if_softc;
	+ struct bwi_softc *sc = ic->ic_softc;
	struct ieee80211_channel *c = ic->ic_curchan;
	struct bwi_mac *mac;

	@@ -1765,7 +1708,7 @@
	static void
	bwi_scan_end(struct ieee80211com *ic)
	{
	- struct bwi_softc *sc = ic->ic_ifp->if_softc;
	+ struct bwi_softc *sc = ic->ic_softc;

	BWI_LOCK(sc);
	CSR_CLRBITS_4(sc, BWI_MAC_STATUS, BWI_MAC_STATUS_PASS_BCN);
	@@ -1777,9 +1720,8 @@
	{
	struct bwi_vap *bvp = BWI_VAP(vap);
	struct ieee80211com *ic= vap->iv_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	+ struct bwi_softc *sc = ic->ic_softc;
	enum ieee80211_state ostate = vap->iv_state;
	- struct bwi_softc *sc = ifp->if_softc;
	struct bwi_mac *mac;
	int error;

	@@ -2625,8 +2567,7 @@
	{
	struct bwi_ring_data *rd = &sc->sc_rx_rdata;
	struct bwi_rxbuf_data *rbd = &sc->sc_rx_bdata;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int idx, rx_data = 0;

	idx = rbd->rbd_idx;
	@@ -2645,7 +2586,7 @@
	BUS_DMASYNC_POSTREAD);

	if (bwi_newbuf(sc, idx, 0)) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto next;
	}

	@@ -2659,9 +2600,10 @@

	buflen = le16toh(hdr->rxh_buflen);
	if (buflen < BWI_FRAME_MIN_LEN(wh_ofs)) {
	- if_printf(ifp, "%s: zero length data, hdr_extra %d\n",
	- __func__, hdr_extra);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ device_printf(sc->sc_dev,
	+ "%s: zero length data, hdr_extra %d\n",
	+ __func__, hdr_extra);
	+ counter_u64_add(ic->ic_ierrors, 1);
	m_freem(m);
	goto next;
	}
	@@ -2670,7 +2612,6 @@
	rssi = bwi_calc_rssi(sc, hdr);
	noise = bwi_calc_noise(sc);

	- m->m_pkthdr.rcvif = ifp;
	m->m_len = m->m_pkthdr.len = buflen + sizeof(*hdr);
	m_adj(m, sizeof(*hdr) + wh_ofs);

	@@ -2804,7 +2745,6 @@
	{
	struct bwi_ring_data *rd;
	struct bwi_txbuf_data *tbd;
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t state, val;
	int i;

	@@ -2825,8 +2765,9 @@
	DELAY(1000);
	}
	if (i == NRETRY) {
	- if_printf(ifp, "%s: wait for TX ring(%d) stable timed out\n",
	- __func__, ring_idx);
	+ device_printf(sc->sc_dev,
	+ "%s: wait for TX ring(%d) stable timed out\n",
	+ __func__, ring_idx);
	}

	CSR_WRITE_4(sc, rd->rdata_txrx_ctrl + BWI_TX32_CTRL, 0);
	@@ -2839,7 +2780,7 @@
	DELAY(1000);
	}
	if (i == NRETRY)
	- if_printf(ifp, "%s: reset TX ring (%d) timed out\n",
	+ device_printf(sc->sc_dev, "%s: reset TX ring (%d) timed out\n",
	__func__, ring_idx);

	#undef NRETRY
	@@ -2947,8 +2888,7 @@
	struct ieee80211_node *ni)
	{
	struct ieee80211vap *vap = ni->ni_vap;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct bwi_ring_data *rd = &sc->sc_tx_rdata[BWI_TX_DATA_RING];
	struct bwi_txbuf_data *tbd = &sc->sc_tx_bdata[BWI_TX_DATA_RING];
	struct bwi_txbuf *tb = &tbd->tbd_buf[idx];
	@@ -3024,7 +2964,8 @@
	*/
	M_PREPEND(m, sizeof(*hdr), M_NOWAIT);
	if (m == NULL) {
	- if_printf(ifp, "%s: prepend TX header failed\n", __func__);
	+ device_printf(sc->sc_dev, "%s: prepend TX header failed\n",
	+ __func__);
	return ENOBUFS;
	}
	hdr = mtod(m, struct bwi_txbuf_hdr *);
	@@ -3073,7 +3014,7 @@
	error = bus_dmamap_load_mbuf(sc->sc_buf_dtag, tb->tb_dmap, m,
	bwi_dma_buf_addr, &paddr, BUS_DMA_NOWAIT);
	if (error && error != EFBIG) {
	- if_printf(ifp, "%s: can't load TX buffer (1) %d\n",
	+ device_printf(sc->sc_dev, "%s: can't load TX buffer (1) %d\n",
	__func__, error);
	goto back;
	}
	@@ -3083,8 +3024,8 @@

	m_new = m_defrag(m, M_NOWAIT);
	if (m_new == NULL) {
	- if_printf(ifp, "%s: can't defrag TX buffer\n",
	- __func__);
	+ device_printf(sc->sc_dev,
	+ "%s: can't defrag TX buffer\n", __func__);
	error = ENOBUFS;
	goto back;
	} else {
	@@ -3095,7 +3036,8 @@
	bwi_dma_buf_addr, &paddr,
	BUS_DMA_NOWAIT);
	if (error) {
	- if_printf(ifp, "%s: can't load TX buffer (2) %d\n",
	+ device_printf(sc->sc_dev,
	+ "%s: can't load TX buffer (2) %d\n",
	__func__, error);
	goto back;
	}
	@@ -3137,7 +3079,6 @@
	bwi_encap_raw(struct bwi_softc sc, int idx, struct mbuf m,
	struct ieee80211_node ni, const struct ieee80211_bpf_params params)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct ieee80211vap *vap = ni->ni_vap;
	struct ieee80211com *ic = ni->ni_ic;
	struct bwi_ring_data *rd = &sc->sc_tx_rdata[BWI_TX_DATA_RING];
	@@ -3204,7 +3145,8 @@
	*/
	M_PREPEND(m, sizeof(*hdr), M_NOWAIT);
	if (m == NULL) {
	- if_printf(ifp, "%s: prepend TX header failed\n", __func__);
	+ device_printf(sc->sc_dev, "%s: prepend TX header failed\n",
	+ __func__);
	return ENOBUFS;
	}
	hdr = mtod(m, struct bwi_txbuf_hdr *);
	@@ -3252,14 +3194,15 @@
	struct mbuf *m_new;

	if (error != EFBIG) {
	- if_printf(ifp, "%s: can't load TX buffer (1) %d\n",
	+ device_printf(sc->sc_dev,
	+ "%s: can't load TX buffer (1) %d\n",
	__func__, error);
	goto back;
	}
	m_new = m_defrag(m, M_NOWAIT);
	if (m_new == NULL) {
	- if_printf(ifp, "%s: can't defrag TX buffer\n",
	- __func__);
	+ device_printf(sc->sc_dev,
	+ "%s: can't defrag TX buffer\n", __func__);
	error = ENOBUFS;
	goto back;
	}
	@@ -3268,7 +3211,8 @@
	bwi_dma_buf_addr, &paddr,
	BUS_DMA_NOWAIT);
	if (error) {
	- if_printf(ifp, "%s: can't load TX buffer (2) %d\n",
	+ device_printf(sc->sc_dev,
	+ "%s: can't load TX buffer (2) %d\n",
	__func__, error);
	goto back;
	}
	@@ -3312,7 +3256,6 @@
	static void
	bwi_txeof_status32(struct bwi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t val, ctrl_base;
	int end_idx;

	@@ -3327,8 +3270,7 @@
	CSR_WRITE_4(sc, ctrl_base + BWI_RX32_INDEX,
	end_idx * sizeof(struct bwi_desc32));

	- if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
	- ifp->if_start(ifp);
	+ bwi_start_locked(sc);
	}

	static void
	@@ -3340,7 +3282,6 @@
	static void
	_bwi_txeof(struct bwi_softc *sc, uint16_t tx_id, int acked, int data_txcnt)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct bwi_txbuf_data *tbd;
	struct bwi_txbuf *tb;
	int ring_idx, buf_idx;
	@@ -3348,7 +3289,7 @@
	struct ieee80211vap *vap;

	if (tx_id == 0) {
	- if_printf(ifp, "%s: zero tx id\n", __func__);
	+ device_printf(sc->sc_dev, "%s: zero tx id\n", __func__);
	return;
	}

	@@ -3369,8 +3310,7 @@

	bus_dmamap_unload(sc->sc_buf_dtag, tb->tb_dmap);

	- ni = tb->tb_ni;
	- if (tb->tb_ni != NULL) {
	+ if ((ni = tb->tb_ni) != NULL) {
	const struct bwi_txbuf_hdr *hdr =
	mtod(tb->tb_mbuf, const struct bwi_txbuf_hdr *);
	vap = ni->ni_vap;
	@@ -3388,24 +3328,14 @@
	(data_txcnt > 1) ? IEEE80211_RATECTL_TX_SUCCESS :
	IEEE80211_RATECTL_TX_FAILURE, &acked, NULL);
	}
	-
	- /*
	- * Do any tx complete callback. Note this must
	- * be done before releasing the node reference.
	- */
	- if (tb->tb_mbuf->m_flags & M_TXCB)
	- ieee80211_process_callback(ni, tb->tb_mbuf, !acked);
	-
	- ieee80211_free_node(tb->tb_ni);
	+ ieee80211_tx_complete(ni, tb->tb_mbuf, !acked);
	tb->tb_ni = NULL;
	- }
	- m_freem(tb->tb_mbuf);
	+ } else
	+ m_freem(tb->tb_mbuf);
	tb->tb_mbuf = NULL;

	if (tbd->tbd_used == 0)
	sc->sc_tx_timer = 0;
	-
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	}

	static void
	@@ -3437,7 +3367,6 @@
	static void
	bwi_txeof(struct bwi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;

	for (;;) {
	uint32_t tx_status0, tx_status1;
	@@ -3460,8 +3389,7 @@
	data_txcnt);
	}

	- if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0)
	- ifp->if_start(ifp);
	+ bwi_start_locked(sc);
	}

	static int
	@@ -3709,7 +3637,6 @@
	static void
	bwi_set_bssid(struct bwi_softc sc, const uint8_t bssid)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct bwi_mac *mac;
	struct bwi_myaddr_bssid buf;
	const uint8_t *p;
	@@ -3722,7 +3649,7 @@

	bwi_set_addr_filter(sc, BWI_ADDR_FILTER_BSSID, bssid);

	- bcopy(IF_LLADDR(ifp), buf.myaddr, sizeof(buf.myaddr));
	+ bcopy(sc->sc_ic.ic_macaddr, buf.myaddr, sizeof(buf.myaddr));
	bcopy(bssid, buf.bssid, sizeof(buf.bssid));

	n = sizeof(buf) / sizeof(val);
	@@ -3745,7 +3672,7 @@
	struct bwi_mac *mac;

	BWI_LOCK(sc);
	- if (ic->ic_ifp->if_drv_flags & IFF_DRV_RUNNING) {
	+ if (sc->sc_flags & BWI_F_RUNNING) {
	DPRINTF(sc, BWI_DBG_80211, "%s\n", __func__);

	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC,
	@@ -3761,16 +3688,12 @@
	bwi_calibrate(void *xsc)
	{
	struct bwi_softc *sc = xsc;
	-#ifdef INVARIANTS
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	-#endif
	struct bwi_mac *mac;

	BWI_ASSERT_LOCKED(sc);

	- KASSERT(ic->ic_opmode != IEEE80211_M_MONITOR,
	- ("opmode %d", ic->ic_opmode));
	+ KASSERT(sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR,
	+ ("opmode %d", sc->sc_ic.ic_opmode));

	KASSERT(sc->sc_cur_regwin->rw_type == BWI_REGWIN_T_MAC,
	("current regwin type %d", sc->sc_cur_regwin->rw_type));
	@@ -3912,8 +3835,7 @@
	static void
	bwi_led_newstate(struct bwi_softc *sc, enum ieee80211_state nstate)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint16_t val;
	int i;

	@@ -3922,7 +3844,7 @@
	sc->sc_led_blinking = 0;
	}

	- if ((ic->ic_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
	+ if ((sc->sc_flags & BWI_F_RUNNING) == 0)
	return;

	val = CSR_READ_2(sc, BWI_MAC_GPIO_CTRL);
	@@ -4050,13 +3972,12 @@
	bwi_restart(void *xsc, int pending)
	{
	struct bwi_softc *sc = xsc;
	- struct ifnet *ifp = sc->sc_ifp;

	- if_printf(ifp, "%s begin, help!\n", __func__);
	+ device_printf(sc->sc_dev, "%s begin, help!\n", __func__);
	BWI_LOCK(sc);
	- bwi_init_statechg(xsc, 0);
	+ bwi_init_statechg(sc, 0);
	#if 0
	- bwi_start_locked(ifp);
	+ bwi_start_locked(sc);
	#endif
	BWI_UNLOCK(sc);
	}
	Index: sys/dev/bwi/if_bwivar.h
	===================================================================
	--- sys/dev/bwi/if_bwivar.h
	+++ sys/dev/bwi/if_bwivar.h
	@@ -541,10 +541,11 @@
	#define BWI_VAP(vap) ((struct bwi_vap *)(vap))

	struct bwi_softc {
	- struct ifnet *sc_ifp;
	uint32_t sc_flags; /* BWI_F_ */
	device_t sc_dev;
	struct mtx sc_mtx;
	+ struct ieee80211com sc_ic;
	+ struct mbufq sc_snd;
	int sc_invalid;

	uint32_t sc_cap; /* BWI_CAP_ */
	@@ -647,6 +648,7 @@
	#define BWI_F_BUS_INITED 0x1
	#define BWI_F_PROMISC 0x2
	#define BWI_F_STOP 0x4
	+#define BWI_F_RUNNING 0x8

	#define BWI_DBG_MAC 0x00000001
	#define BWI_DBG_RF 0x00000002
	Index: sys/dev/iwi/if_iwi.c
	===================================================================
	--- sys/dev/iwi/if_iwi.c
	+++ sys/dev/iwi/if_iwi.c
	@@ -166,14 +166,15 @@
	static void iwi_intr(void *);
	static int iwi_cmd(struct iwi_softc , uint8_t, void , uint8_t);
	static void iwi_write_ibssnode(struct iwi_softc *, const u_int8_t [], int);
	-static int iwi_tx_start(struct ifnet , struct mbuf ,
	+static int iwi_tx_start(struct iwi_softc , struct mbuf ,
	struct ieee80211_node *, int);
	static int iwi_raw_xmit(struct ieee80211_node , struct mbuf ,
	const struct ieee80211_bpf_params *);
	-static void iwi_start_locked(struct ifnet *);
	-static void iwi_start(struct ifnet *);
	+static void iwi_start(struct iwi_softc *);
	+static int iwi_transmit(struct ieee80211com , struct mbuf );
	static void iwi_watchdog(void *);
	-static int iwi_ioctl(struct ifnet *, u_long, caddr_t);
	+static int iwi_ioctl(struct ieee80211com , u_long, void );
	+static void iwi_parent(struct ieee80211com *);
	static void iwi_stop_master(struct iwi_softc *);
	static int iwi_reset(struct iwi_softc *);
	static int iwi_load_ucode(struct iwi_softc , const struct iwi_fw );
	@@ -269,23 +270,15 @@
	iwi_attach(device_t dev)
	{
	struct iwi_softc *sc = device_get_softc(dev);
	- struct ifnet *ifp;
	- struct ieee80211com *ic;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint16_t val;
	int i, error;
	uint8_t bands;
	- uint8_t macaddr[IEEE80211_ADDR_LEN];

	sc->sc_dev = dev;

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(dev, "can not if_alloc()\n");
	- return ENXIO;
	- }
	- ic = ifp->if_l2com;
	-
	IWI_LOCK_INIT(sc);
	+ mbufq_init(&sc->sc_snd, ifqmaxlen);

	sc->sc_unr = new_unrhdr(1, IWI_MAX_IBSSNODE-1, &sc->sc_mtx);

	@@ -353,17 +346,6 @@

	iwi_wme_init(sc);

	- ifp->if_softc = sc;
	- if_initname(ifp, device_get_name(dev), device_get_unit(dev));
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = iwi_init;
	- ifp->if_ioctl = iwi_ioctl;
	- ifp->if_start = iwi_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	-
	- ic->ic_ifp = ifp;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(dev);
	ic->ic_opmode = IEEE80211_M_STA;
	@@ -385,14 +367,14 @@

	/* read MAC address from EEPROM */
	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 0);
	- macaddr[0] = val & 0xff;
	- macaddr[1] = val >> 8;
	+ ic->ic_macaddr[0] = val & 0xff;
	+ ic->ic_macaddr[1] = val >> 8;
	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 1);
	- macaddr[2] = val & 0xff;
	- macaddr[3] = val >> 8;
	+ ic->ic_macaddr[2] = val & 0xff;
	+ ic->ic_macaddr[3] = val >> 8;
	val = iwi_read_prom_word(sc, IWI_EEPROM_MAC + 2);
	- macaddr[4] = val & 0xff;
	- macaddr[5] = val >> 8;
	+ ic->ic_macaddr[4] = val & 0xff;
	+ ic->ic_macaddr[5] = val >> 8;

	bands = 0;
	setbit(&bands, IEEE80211_MODE_11B);
	@@ -401,7 +383,7 @@
	setbit(&bands, IEEE80211_MODE_11A);
	ieee80211_init_channels(ic, NULL, &bands);

	- ieee80211_ifattach(ic, macaddr);
	+ ieee80211_ifattach(ic);
	/* override default methods */
	ic->ic_node_alloc = iwi_node_alloc;
	sc->sc_node_free = ic->ic_node_free;
	@@ -416,6 +398,9 @@

	ic->ic_vap_create = iwi_vap_create;
	ic->ic_vap_delete = iwi_vap_delete;
	+ ic->ic_ioctl = iwi_ioctl;
	+ ic->ic_transmit = iwi_transmit;
	+ ic->ic_parent = iwi_parent;

	ieee80211_radiotap_attach(ic,
	&sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
	@@ -450,8 +435,7 @@
	iwi_detach(device_t dev)
	{
	struct iwi_softc *sc = device_get_softc(dev);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	bus_teardown_intr(dev, sc->irq, sc->sc_ih);

	@@ -482,11 +466,10 @@
	sc->mem);

	delete_unrhdr(sc->sc_unr);
	+ mbufq_drain(&sc->sc_snd);

	IWI_LOCK_DESTROY(sc);

	- if_free(ifp);
	-
	return 0;
	}

	@@ -496,8 +479,7 @@
	const uint8_t bssid[IEEE80211_ADDR_LEN],
	const uint8_t mac[IEEE80211_ADDR_LEN])
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct iwi_softc *sc = ifp->if_softc;
	+ struct iwi_softc *sc = ic->ic_softc;
	struct iwi_vap *ivp;
	struct ieee80211vap *vap;
	int i;
	@@ -519,12 +501,9 @@
	if (iwi_init_fw_dma(sc, i))
	return NULL;

	- ivp = (struct iwi_vap *) malloc(sizeof(struct iwi_vap),
	- M_80211_VAP, M_NOWAIT \| M_ZERO);
	- if (ivp == NULL)
	- return NULL;
	+ ivp = malloc(sizeof(struct iwi_vap), M_80211_VAP, M_WAITOK \| M_ZERO);
	vap = &ivp->iwi_vap;
	- ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
	+ ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
	/* override the default, the setting comes from the linux driver */
	vap->iv_bmissthreshold = 24;
	/* override with driver methods */
	@@ -532,7 +511,8 @@
	vap->iv_newstate = iwi_newstate;

	/* complete setup */
	- ieee80211_vap_attach(vap, ieee80211_media_change, iwi_media_status);
	+ ieee80211_vap_attach(vap, ieee80211_media_change, iwi_media_status,
	+ mac);
	ic->ic_opmode = opmode;
	return vap;
	}
	@@ -859,7 +839,7 @@
	iwi_suspend(device_t dev)
	{
	struct iwi_softc *sc = device_get_softc(dev);
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	ieee80211_suspend_all(ic);
	return 0;
	@@ -869,7 +849,7 @@
	iwi_resume(device_t dev)
	{
	struct iwi_softc *sc = device_get_softc(dev);
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	pci_write_config(dev, 0x41, 0, 1);

	@@ -895,7 +875,7 @@
	iwi_node_free(struct ieee80211_node *ni)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct iwi_softc *sc = ic->ic_ifp->if_softc;
	+ struct iwi_softc *sc = ic->ic_softc;
	struct iwi_node in = (struct iwi_node )ni;

	if (in->in_station != -1) {
	@@ -939,7 +919,7 @@
	{
	struct ieee80211vap *vap = ifp->if_softc;
	struct ieee80211com *ic = vap->iv_ic;
	- struct iwi_softc *sc = ic->ic_ifp->if_softc;
	+ struct iwi_softc *sc = ic->ic_softc;
	struct ieee80211_node *ni;

	/* read current transmission rate from adapter */
	@@ -955,8 +935,7 @@
	{
	struct iwi_vap *ivp = IWI_VAP(vap);
	struct ieee80211com *ic = vap->iv_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct iwi_softc *sc = ifp->if_softc;
	+ struct iwi_softc *sc = ic->ic_softc;
	IWI_LOCK_DECL;

	DPRINTF(("%s: %s -> %s flags 0x%x\n", __func__,
	@@ -1061,7 +1040,7 @@
	static int
	iwi_wme_setparams(struct iwi_softc *sc)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	const struct wmeParams *wmep;
	int ac;

	@@ -1095,7 +1074,7 @@
	static int
	iwi_wme_update(struct ieee80211com *ic)
	{
	- struct iwi_softc *sc = ic->ic_ifp->if_softc;
	+ struct iwi_softc *sc = ic->ic_softc;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	/*
	@@ -1189,8 +1168,7 @@
	static void
	iwi_setcurchan(struct iwi_softc *sc, int chan)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	sc->curchan = chan;
	ieee80211_radiotap_chan_change(ic);
	@@ -1200,8 +1178,7 @@
	iwi_frame_intr(struct iwi_softc sc, struct iwi_rx_data data, int i,
	struct iwi_frame *frame)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct mbuf mnew, m;
	struct ieee80211_node *ni;
	int type, error, framelen;
	@@ -1237,7 +1214,7 @@
	*/
	mnew = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
	if (mnew == NULL) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	return;
	}

	@@ -1258,7 +1235,7 @@
	panic("%s: could not load old rx mbuf",
	device_get_name(sc->sc_dev));
	}
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	return;
	}

	@@ -1271,7 +1248,6 @@
	CSR_WRITE_4(sc, data->reg, data->physaddr);

	/* finalize mbuf */
	- m->m_pkthdr.rcvif = ifp;
	m->m_pkthdr.len = m->m_len = sizeof (struct iwi_hdr) +
	sizeof (struct iwi_frame) + framelen;

	@@ -1410,8 +1386,7 @@
	static void
	iwi_notification_intr(struct iwi_softc sc, struct iwi_notif notif)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	struct iwi_notif_scan_channel *chan;
	struct iwi_notif_scan_complete *scan;
	@@ -1632,47 +1607,33 @@
	static void
	iwi_tx_intr(struct iwi_softc sc, struct iwi_tx_ring txq)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct iwi_tx_data *data;
	uint32_t hw;

	hw = CSR_READ_4(sc, txq->csr_ridx);

	- for (; txq->next != hw;) {
	+ while (txq->next != hw) {
	data = &txq->data[txq->next];
	-
	+ DPRINTFN(15, ("tx done idx=%u\n", txq->next));
	bus_dmamap_sync(txq->data_dmat, data->map,
	BUS_DMASYNC_POSTWRITE);
	bus_dmamap_unload(txq->data_dmat, data->map);
	- if (data->m->m_flags & M_TXCB)
	- ieee80211_process_callback(data->ni, data->m, 0/XXX/);
	- m_freem(data->m);
	- data->m = NULL;
	- ieee80211_free_node(data->ni);
	+ ieee80211_tx_complete(data->ni, data->m, 0);
	data->ni = NULL;
	-
	- DPRINTFN(15, ("tx done idx=%u\n", txq->next));
	-
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	-
	+ data->m = NULL;
	txq->queued--;
	txq->next = (txq->next + 1) % IWI_TX_RING_COUNT;
	}
	-
	sc->sc_tx_timer = 0;
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	-
	if (sc->sc_softled)
	iwi_led_event(sc, IWI_LED_TX);
	-
	- iwi_start_locked(ifp);
	+ iwi_start(sc);
	}

	static void
	iwi_fatal_error_intr(struct iwi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	device_printf(sc->sc_dev, "firmware error\n");
	@@ -1688,10 +1649,8 @@
	static void
	iwi_radio_off_intr(struct iwi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;

	- ieee80211_runtask(ic, &sc->sc_radiofftask);
	+ ieee80211_runtask(&sc->sc_ic, &sc->sc_radiofftask);
	}

	static void
	@@ -1806,10 +1765,9 @@
	}

	static int
	-iwi_tx_start(struct ifnet ifp, struct mbuf m0, struct ieee80211_node *ni,
	+iwi_tx_start(struct iwi_softc sc, struct mbuf m0, struct ieee80211_node *ni,
	int ac)
	{
	- struct iwi_softc *sc = ifp->if_softc;
	struct ieee80211vap *vap = ni->ni_vap;
	struct ieee80211com *ic = ni->ni_ic;
	struct iwi_node in = (struct iwi_node )ni;
	@@ -1852,9 +1810,10 @@
	in->in_station = alloc_unr(sc->sc_unr);
	if (in->in_station == -1) {
	/* h/w table is full */
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	m_freem(m0);
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	return 0;
	}
	iwi_write_ibssnode(sc,
	@@ -1980,141 +1939,139 @@
	return 0;
	}

	+static int
	+iwi_transmit(struct ieee80211com ic, struct mbuf m)
	+{
	+ struct iwi_softc *sc = ic->ic_softc;
	+ int error;
	+ IWI_LOCK_DECL;
	+
	+ IWI_LOCK(sc);
	+ if (!sc->sc_running) {
	+ IWI_UNLOCK(sc);
	+ return (ENXIO);
	+ }
	+ error = mbufq_enqueue(&sc->sc_snd, m);
	+ if (error) {
	+ IWI_UNLOCK(sc);
	+ return (error);
	+ }
	+ iwi_start(sc);
	+ IWI_UNLOCK(sc);
	+ return (0);
	+}
	+
	static void
	-iwi_start_locked(struct ifnet *ifp)
	+iwi_start(struct iwi_softc *sc)
	{
	- struct iwi_softc *sc = ifp->if_softc;
	struct mbuf *m;
	struct ieee80211_node *ni;
	int ac;

	IWI_LOCK_ASSERT(sc);

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
	- return;
	-
	- for (;;) {
	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
	- if (m == NULL)
	- break;
	+ while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
	ac = M_WME_GETAC(m);
	if (sc->txq[ac].queued > IWI_TX_RING_COUNT - 8) {
	/* there is no place left in this ring; tail drop */
	/* XXX tail drop */
	- IFQ_DRV_PREPEND(&ifp->if_snd, m);
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	+ mbufq_prepend(&sc->sc_snd, m);
	break;
	}
	-
	ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
	- if (iwi_tx_start(ifp, m, ni, ac) != 0) {
	+ if (iwi_tx_start(sc, m, ni, ac) != 0) {
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	break;
	}
	-
	sc->sc_tx_timer = 5;
	}
	}

	static void
	-iwi_start(struct ifnet *ifp)
	-{
	- struct iwi_softc *sc = ifp->if_softc;
	- IWI_LOCK_DECL;
	-
	- IWI_LOCK(sc);
	- iwi_start_locked(ifp);
	- IWI_UNLOCK(sc);
	-}
	-
	-static void
	iwi_watchdog(void *arg)
	{
	struct iwi_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	IWI_LOCK_ASSERT(sc);

	if (sc->sc_tx_timer > 0) {
	if (--sc->sc_tx_timer == 0) {
	- if_printf(ifp, "device timeout\n");
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ device_printf(sc->sc_dev, "device timeout\n");
	+ counter_u64_add(ic->ic_oerrors, 1);
	ieee80211_runtask(ic, &sc->sc_restarttask);
	}
	}
	if (sc->sc_state_timer > 0) {
	if (--sc->sc_state_timer == 0) {
	- if_printf(ifp, "firmware stuck in state %d, resetting\n",
	+ device_printf(sc->sc_dev,
	+ "firmware stuck in state %d, resetting\n",
	sc->fw_state);
	- if (sc->fw_state == IWI_FW_SCANNING) {
	- struct ieee80211com *ic = ifp->if_l2com;
	+ if (sc->fw_state == IWI_FW_SCANNING)
	ieee80211_cancel_scan(TAILQ_FIRST(&ic->ic_vaps));
	- }
	ieee80211_runtask(ic, &sc->sc_restarttask);
	sc->sc_state_timer = 3;
	}
	}
	if (sc->sc_busy_timer > 0) {
	if (--sc->sc_busy_timer == 0) {
	- if_printf(ifp, "firmware command timeout, resetting\n");
	+ device_printf(sc->sc_dev,
	+ "firmware command timeout, resetting\n");
	ieee80211_runtask(ic, &sc->sc_restarttask);
	}
	}
	callout_reset(&sc->sc_wdtimer, hz, iwi_watchdog, sc);
	}

	+static void
	+iwi_parent(struct ieee80211com *ic)
	+{
	+ struct iwi_softc *sc = ic->ic_softc;
	+ int startall = 0;
	+ IWI_LOCK_DECL;
	+
	+ IWI_LOCK(sc);
	+ if (ic->ic_nrunning > 0) {
	+ if (!sc->sc_running) {
	+ iwi_init_locked(sc);
	+ startall = 1;
	+ }
	+ } else if (sc->sc_running)
	+ iwi_stop_locked(sc);
	+ IWI_UNLOCK(sc);
	+ if (startall)
	+ ieee80211_start_all(ic);
	+}
	+
	static int
	-iwi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+iwi_ioctl(struct ieee80211com ic, u_long cmd, void data)
	{
	- struct iwi_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ifreq ifr = (struct ifreq ) data;
	- int error = 0, startall = 0;
	+ struct ifreq *ifr = data;
	+ struct iwi_softc *sc = ic->ic_softc;
	+ int error;
	IWI_LOCK_DECL;

	+ IWI_LOCK(sc);
	switch (cmd) {
	- case SIOCSIFFLAGS:
	- IWI_LOCK(sc);
	- if (ifp->if_flags & IFF_UP) {
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	- iwi_init_locked(sc);
	- startall = 1;
	- }
	- } else {
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- iwi_stop_locked(sc);
	- }
	- IWI_UNLOCK(sc);
	- if (startall)
	- ieee80211_start_all(ic);
	- break;
	- case SIOCGIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- case SIOCGIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	case SIOCGIWISTATS:
	- IWI_LOCK(sc);
	/* XXX validate permissions/memory/etc? */
	error = copyout(&sc->sc_linkqual, ifr->ifr_data,
	sizeof(struct iwi_notif_link_quality));
	- IWI_UNLOCK(sc);
	break;
	case SIOCZIWISTATS:
	- IWI_LOCK(sc);
	memset(&sc->sc_linkqual, 0,
	sizeof(struct iwi_notif_link_quality));
	- IWI_UNLOCK(sc);
	error = 0;
	break;
	default:
	- error = EINVAL;
	+ error = ENOTTY;
	break;
	}
	- return error;
	+ IWI_UNLOCK(sc);
	+
	+ return (error);
	}

	static void
	@@ -2593,8 +2550,7 @@
	static int
	iwi_config(struct iwi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct iwi_configuration config;
	struct iwi_rateset rs;
	struct iwi_txpower power;
	@@ -2603,8 +2559,8 @@

	IWI_LOCK_ASSERT(sc);

	- DPRINTF(("Setting MAC address to %6D\n", IF_LLADDR(ifp), ":"));
	- error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, IF_LLADDR(ifp),
	+ DPRINTF(("Setting MAC address to %6D\n", ic->ic_macaddr, ":"));
	+ error = iwi_cmd(sc, IWI_CMD_SET_MAC_ADDRESS, ic->ic_macaddr,
	IEEE80211_ADDR_LEN);
	if (error != 0)
	return error;
	@@ -2724,7 +2680,7 @@
	static int
	iwi_scanchan(struct iwi_softc *sc, unsigned long maxdwell, int allchan)
	{
	- struct ieee80211com *ic;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_channel *chan;
	struct ieee80211_scan_state *ss;
	struct iwi_scan_ext scan;
	@@ -2741,7 +2697,6 @@
	}
	IWI_STATE_BEGIN(sc, IWI_FW_SCANNING);

	- ic = sc->sc_ifp->if_l2com;
	ss = ic->ic_scan;

	memset(&scan, 0, sizeof scan);
	@@ -3128,7 +3083,6 @@
	static void
	iwi_init_locked(struct iwi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct iwi_rx_data *data;
	int i;

	@@ -3202,8 +3156,7 @@
	}

	callout_reset(&sc->sc_wdtimer, hz, iwi_watchdog, sc);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	+ sc->sc_running = 1;
	return;
	fail:
	IWI_STATE_END(sc, IWI_FW_LOADING);
	@@ -3215,15 +3168,14 @@
	iwi_init(void *priv)
	{
	struct iwi_softc *sc = priv;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	IWI_LOCK_DECL;

	IWI_LOCK(sc);
	iwi_init_locked(sc);
	IWI_UNLOCK(sc);

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	+ if (sc->sc_running)
	ieee80211_start_all(ic);
	}

	@@ -3231,11 +3183,10 @@
	iwi_stop_locked(void *priv)
	{
	struct iwi_softc *sc = priv;
	- struct ifnet *ifp = sc->sc_ifp;

	IWI_LOCK_ASSERT(sc);

	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	+ sc->sc_running = 0;

	if (sc->sc_softled) {
	callout_stop(&sc->sc_ledtimer);
	@@ -3296,7 +3247,7 @@
	iwi_radio_on(void *arg, int pending)
	{
	struct iwi_softc *sc = arg;
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	device_printf(sc->sc_dev, "radio turned on\n");

	@@ -3317,10 +3268,7 @@
	* it is enabled so we must poll for the latter.
	*/
	if (!iwi_getrfkill(sc)) {
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	-
	- ieee80211_runtask(ic, &sc->sc_radiontask);
	+ ieee80211_runtask(&sc->sc_ic, &sc->sc_radiontask);
	return;
	}
	callout_reset(&sc->sc_rftimer, 2*hz, iwi_rfkill_poll, sc);
	@@ -3330,7 +3278,7 @@
	iwi_radio_off(void *arg, int pending)
	{
	struct iwi_softc *sc = arg;
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	IWI_LOCK_DECL;

	device_printf(sc->sc_dev, "radio turned off\n");
	@@ -3594,8 +3542,8 @@
	static void
	iwi_set_channel(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct iwi_softc *sc = ifp->if_softc;
	+ struct iwi_softc *sc = ic->ic_softc;
	+
	if (sc->fw_state == IWI_FW_IDLE)
	iwi_setcurchan(sc, ic->ic_curchan->ic_ieee);
	}
	@@ -3604,8 +3552,7 @@
	iwi_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
	{
	struct ieee80211vap *vap = ss->ss_vap;
	- struct ifnet *ifp = vap->iv_ic->ic_ifp;
	- struct iwi_softc *sc = ifp->if_softc;
	+ struct iwi_softc *sc = vap->iv_ic->ic_softc;
	IWI_LOCK_DECL;

	IWI_LOCK(sc);
	@@ -3623,8 +3570,7 @@
	static void
	iwi_scan_end(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct iwi_softc *sc = ifp->if_softc;
	+ struct iwi_softc *sc = ic->ic_softc;
	IWI_LOCK_DECL;

	IWI_LOCK(sc);
	Index: sys/dev/iwi/if_iwivar.h
	===================================================================
	--- sys/dev/iwi/if_iwivar.h
	+++ sys/dev/iwi/if_iwivar.h
	@@ -125,11 +125,13 @@
	#define IWI_VAP(vap) ((struct iwi_vap *)(vap))

	struct iwi_softc {
	- struct ifnet *sc_ifp;
	- void (sc_node_free)(struct ieee80211_node );
	+ struct mtx sc_mtx;
	+ struct ieee80211com sc_ic;
	+ struct mbufq sc_snd;
	device_t sc_dev;

	- struct mtx sc_mtx;
	+ void (sc_node_free)(struct ieee80211_node );
	+
	uint8_t sc_mcast[IEEE80211_ADDR_LEN];
	struct unrhdr *sc_unr;

	@@ -193,7 +195,8 @@
	struct task sc_wmetask; /* set wme parameters */
	struct task sc_monitortask;

	- unsigned int sc_softled : 1, /* enable LED gpio status */
	+ unsigned int sc_running : 1, /* initialized */
	+ sc_softled : 1, /* enable LED gpio status */
	sc_ledstate: 1, /* LED on/off state */
	sc_blinking: 1; /* LED blink operation active */
	u_int sc_nictype; /* NIC type from EEPROM */
	Index: sys/dev/iwn/if_iwn.c
	===================================================================
	--- sys/dev/iwn/if_iwn.c
	+++ sys/dev/iwn/if_iwn.c
	@@ -234,10 +234,11 @@
	const struct ieee80211_bpf_params *params);
	static int iwn_raw_xmit(struct ieee80211_node , struct mbuf ,
	const struct ieee80211_bpf_params *);
	-static void iwn_start(struct ifnet *);
	-static void iwn_start_locked(struct ifnet *);
	+static int iwn_transmit(struct ieee80211com , struct mbuf );
	+static void iwn_start_locked(struct iwn_softc *);
	static void iwn_watchdog(void *);
	-static int iwn_ioctl(struct ifnet *, u_long, caddr_t);
	+static int iwn_ioctl(struct ieee80211com , u_long , void );
	+static void iwn_parent(struct ieee80211com *);
	static int iwn_cmd(struct iwn_softc , int, const void , int, int);
	static int iwn4965_add_node(struct iwn_softc , struct iwn_node_info ,
	int);
	@@ -335,7 +336,7 @@
	static void iwn_radio_off(void *, int);
	static void iwn_panicked(void *, int);
	static void iwn_init_locked(struct iwn_softc *);
	-static void iwn_init(void *);
	+static void iwn_init(struct iwn_softc *);
	static void iwn_stop_locked(struct iwn_softc *);
	static void iwn_stop(struct iwn_softc *);
	static void iwn_scan_start(struct ieee80211com *);
	@@ -405,9 +406,7 @@
	{
	struct iwn_softc sc = (struct iwn_softc )device_get_softc(dev);
	struct ieee80211com *ic;
	- struct ifnet *ifp;
	int i, error, rid;
	- uint8_t macaddr[IEEE80211_ADDR_LEN];

	sc->sc_dev = dev;

	@@ -463,6 +462,7 @@
	}

	IWN_LOCK_INIT(sc);
	+ mbufq_init(&sc->sc_snd, ifqmaxlen);

	/* Read hardware revision and attach. */
	sc->hw_type = (IWN_READ(sc, IWN_HW_REV) >> IWN_HW_REV_TYPE_SHIFT)
	@@ -548,14 +548,7 @@
	/* Clear pending interrupts. */
	IWN_WRITE(sc, IWN_INT, 0xffffffff);

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(dev, "can not allocate ifnet structure\n");
	- goto fail;
	- }
	-
	- ic = ifp->if_l2com;
	- ic->ic_ifp = ifp;
	+ ic = &sc->sc_ic;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(dev);
	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
	@@ -580,7 +573,7 @@
	;

	/* Read MAC address, channels, etc from EEPROM. */
	- if ((error = iwn_read_eeprom(sc, macaddr)) != 0) {
	+ if ((error = iwn_read_eeprom(sc, ic->ic_macaddr)) != 0) {
	device_printf(dev, "could not read EEPROM, error %d\n",
	error);
	goto fail;
	@@ -598,7 +591,7 @@
	if (bootverbose) {
	device_printf(dev, "MIMO %dT%dR, %.4s, address %6D\n",
	sc->ntxchains, sc->nrxchains, sc->eeprom_domain,
	- macaddr, ":");
	+ ic->ic_macaddr, ":");
	}

	if (sc->sc_flags & IWN_FLAG_HAS_11N) {
	@@ -639,19 +632,12 @@
	;
	}

	- if_initname(ifp, device_get_name(dev), device_get_unit(dev));
	- ifp->if_softc = sc;
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = iwn_init;
	- ifp->if_ioctl = iwn_ioctl;
	- ifp->if_start = iwn_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	-
	- ieee80211_ifattach(ic, macaddr);
	+ ieee80211_ifattach(ic);
	ic->ic_vap_create = iwn_vap_create;
	+ ic->ic_ioctl = iwn_ioctl;
	+ ic->ic_parent = iwn_parent;
	ic->ic_vap_delete = iwn_vap_delete;
	+ ic->ic_transmit = iwn_transmit;
	ic->ic_raw_xmit = iwn_raw_xmit;
	ic->ic_node_alloc = iwn_node_alloc;
	sc->sc_ampdu_rx_start = ic->ic_ampdu_rx_start;
	@@ -1289,10 +1275,9 @@
	static void
	iwn_radiotap_attach(struct iwn_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+
	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);
	- ieee80211_radiotap_attach(ic,
	+ ieee80211_radiotap_attach(&sc->sc_ic,
	&sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
	IWN_TX_RADIOTAP_PRESENT,
	&sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
	@@ -1322,21 +1307,14 @@
	struct iwn_softc *sc = ic->ic_softc;
	struct iwn_vap *ivp;
	struct ieee80211vap *vap;
	- uint8_t mac1[IEEE80211_ADDR_LEN];

	if (!TAILQ_EMPTY(&ic->ic_vaps)) /* only one at a time */
	return NULL;

	- IEEE80211_ADDR_COPY(mac1, mac);
	-
	- ivp = (struct iwn_vap *) malloc(sizeof(struct iwn_vap),
	- M_80211_VAP, M_NOWAIT \| M_ZERO);
	- if (ivp == NULL)
	- return NULL;
	+ ivp = malloc(sizeof(struct iwn_vap), M_80211_VAP, M_WAITOK \| M_ZERO);
	vap = &ivp->iv_vap;
	- ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac1);
	+ ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
	ivp->ctx = IWN_RXON_BSS_CTX;
	- IEEE80211_ADDR_COPY(ivp->macaddr, mac1);
	vap->iv_bmissthreshold = 10; /* override default */
	/* Override with driver methods. */
	ivp->iv_newstate = vap->iv_newstate;
	@@ -1345,7 +1323,8 @@

	ieee80211_ratectl_init(vap);
	/* Complete setup. */
	- ieee80211_vap_attach(vap, iwn_media_change, ieee80211_media_status);
	+ ieee80211_vap_attach(vap, iwn_media_change, ieee80211_media_status,
	+ mac);
	ic->ic_opmode = opmode;
	return vap;
	}
	@@ -1364,19 +1343,14 @@
	iwn_detach(device_t dev)
	{
	struct iwn_softc *sc = device_get_softc(dev);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic;
	int qid;

	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);

	- if (ifp != NULL) {
	- ic = ifp->if_l2com;
	-
	- ieee80211_draintask(ic, &sc->sc_reinit_task);
	- ieee80211_draintask(ic, &sc->sc_radioon_task);
	- ieee80211_draintask(ic, &sc->sc_radiooff_task);
	-
	+ if (sc->sc_ic.ic_softc != NULL) {
	+ ieee80211_draintask(&sc->sc_ic, &sc->sc_reinit_task);
	+ ieee80211_draintask(&sc->sc_ic, &sc->sc_radioon_task);
	+ ieee80211_draintask(&sc->sc_ic, &sc->sc_radiooff_task);
	iwn_stop(sc);

	taskqueue_drain_all(sc->sc_tq);
	@@ -1384,9 +1358,11 @@

	callout_drain(&sc->watchdog_to);
	callout_drain(&sc->calib_to);
	- ieee80211_ifdetach(ic);
	+ ieee80211_ifdetach(&sc->sc_ic);
	}

	+ mbufq_drain(&sc->sc_snd);
	+
	/* Uninstall interrupt handler. */
	if (sc->irq != NULL) {
	bus_teardown_intr(dev, sc->irq, sc->sc_ih);
	@@ -1409,9 +1385,6 @@
	bus_release_resource(dev, SYS_RES_MEMORY,
	rman_get_rid(sc->mem), sc->mem);

	- if (ifp != NULL)
	- if_free(ifp);
	-
	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n", __func__);
	IWN_LOCK_DESTROY(sc);
	return 0;
	@@ -1430,9 +1403,8 @@
	iwn_suspend(device_t dev)
	{
	struct iwn_softc *sc = device_get_softc(dev);
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;

	- ieee80211_suspend_all(ic);
	+ ieee80211_suspend_all(&sc->sc_ic);
	return 0;
	}

	@@ -1440,12 +1412,11 @@
	iwn_resume(device_t dev)
	{
	struct iwn_softc *sc = device_get_softc(dev);
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;

	/* Clear device-specific "PCI retry timeout" register (41h). */
	pci_write_config(dev, 0x41, 0, 1);

	- ieee80211_resume_all(ic);
	+ ieee80211_resume_all(&sc->sc_ic);
	return 0;
	}

	@@ -2354,8 +2325,7 @@
	static void
	iwn_read_eeprom_band(struct iwn_softc *sc, int n)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct iwn_eeprom_chan *channels = sc->eeprom_channels[n];
	const struct iwn_chan_band *band = &iwn_bands[n];
	struct ieee80211_channel *c;
	@@ -2414,8 +2384,7 @@
	static void
	iwn_read_eeprom_ht40(struct iwn_softc *sc, int n)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct iwn_eeprom_chan *channels = sc->eeprom_channels[n];
	const struct iwn_chan_band *band = &iwn_bands[n];
	struct ieee80211_channel c, cent, *extc;
	@@ -2483,8 +2452,7 @@
	static void
	iwn_read_eeprom_channels(struct iwn_softc *sc, int n, uint32_t addr)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	iwn_read_prom_data(sc, addr, &sc->eeprom_channels[n],
	iwn_bands[n].nchan * sizeof (struct iwn_eeprom_chan));
	@@ -2552,8 +2520,7 @@
	iwn_read_eeprom_enhinfo(struct iwn_softc *sc)
	{
	struct iwn_eeprom_enhinfo enhinfo[35];
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_channel *c;
	uint16_t val, base;
	int8_t maxpwr;
	@@ -2924,8 +2891,7 @@
	struct iwn_rx_data *data)
	{
	struct iwn_ops *ops = &sc->ops;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct iwn_rx_ring *ring = &sc->rxq;
	struct ieee80211_frame *wh;
	struct ieee80211_node *ni;
	@@ -2972,14 +2938,14 @@
	if ((flags & IWN_RX_NOERROR) != IWN_RX_NOERROR) {
	DPRINTF(sc, IWN_DEBUG_RECV, "%s: RX flags error %x\n",
	__func__, flags);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	return;
	}
	/* Discard frames that are too short. */
	if (len < sizeof (struct ieee80211_frame_ack)) {
	DPRINTF(sc, IWN_DEBUG_RECV, "%s: frame too short: %d\n",
	__func__, len);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	return;
	}

	@@ -2987,7 +2953,7 @@
	if (m1 == NULL) {
	DPRINTF(sc, IWN_DEBUG_ANY, "%s: no mbuf to restock ring\n",
	__func__);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	return;
	}
	bus_dmamap_unload(ring->data_dmat, data->map);
	@@ -3010,7 +2976,7 @@
	ring->desc[ring->cur] = htole32(paddr >> 8);
	bus_dmamap_sync(ring->data_dmat, ring->desc_dma.map,
	BUS_DMASYNC_PREWRITE);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	return;
	}

	@@ -3022,7 +2988,6 @@
	BUS_DMASYNC_PREWRITE);

	/* Finalize mbuf. */
	- m->m_pkthdr.rcvif = ifp;
	m->m_data = head;
	m->m_pkthdr.len = m->m_len = len;

	@@ -3090,7 +3055,6 @@
	struct iwn_rx_data *data)
	{
	struct iwn_ops *ops = &sc->ops;
	- struct ifnet *ifp = sc->sc_ifp;
	struct iwn_node *wn;
	struct ieee80211_node *ni;
	struct iwn_compressed_ba ba = (struct iwn_compressed_ba )(desc + 1);
	@@ -3171,12 +3135,10 @@
	bitmap = (le64toh(ba->bitmap) >> shift) & wn->agg[tid].bitmap;
	for (i = 0; bitmap; i++) {
	if ((bitmap & 1) == 0) {
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	tx_err ++;
	ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
	IEEE80211_RATECTL_TX_FAILURE, &ackfailcnt, NULL);
	} else {
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	tx_ok ++;
	ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
	IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
	@@ -3322,8 +3284,7 @@
	struct iwn_rx_data *data)
	{
	struct iwn_ops *ops = &sc->ops;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	struct iwn_calib_state *calib = &sc->calib;
	struct iwn_stats stats = (struct iwn_stats )(desc + 1);
	@@ -3496,7 +3457,6 @@
	iwn_tx_done(struct iwn_softc sc, struct iwn_rx_desc desc, int ackfailcnt,
	uint8_t status)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct iwn_tx_ring *ring = &sc->txq[desc->qid & 0xf];
	struct iwn_tx_data *data = &ring->data[desc->idx];
	struct mbuf *m;
	@@ -3517,15 +3477,12 @@
	/*
	* Update rate control statistics for the node.
	*/
	- if (status & IWN_TX_FAIL) {
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ if (status & IWN_TX_FAIL)
	ieee80211_ratectl_tx_complete(vap, ni,
	IEEE80211_RATECTL_TX_FAILURE, &ackfailcnt, NULL);
	- } else {
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	+ else
	ieee80211_ratectl_tx_complete(vap, ni,
	IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
	- }

	/*
	* Channels marked for "radar" require traffic to be received
	@@ -3551,11 +3508,8 @@
	sc->sc_tx_timer = 0;
	if (--ring->queued < IWN_TX_RING_LOMARK) {
	sc->qfullmsk &= ~(1 << ring->qid);
	- if (sc->qfullmsk == 0 &&
	- (ifp->if_drv_flags & IFF_DRV_OACTIVE)) {
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- iwn_start_locked(ifp);
	- }
	+ if (sc->qfullmsk == 0)
	+ iwn_start_locked(sc);
	}

	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
	@@ -3600,7 +3554,6 @@
	int ackfailcnt, void *stat)
	{
	struct iwn_ops *ops = &sc->ops;
	- struct ifnet *ifp = sc->sc_ifp;
	struct iwn_tx_ring *ring = &sc->txq[qid];
	struct iwn_tx_data *data;
	struct mbuf *m;
	@@ -3739,11 +3692,8 @@
	sc->sc_tx_timer = 0;
	if (ring->queued < IWN_TX_RING_LOMARK) {
	sc->qfullmsk &= ~(1 << ring->qid);
	- if (sc->qfullmsk == 0 &&
	- (ifp->if_drv_flags & IFF_DRV_OACTIVE)) {
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- iwn_start_locked(ifp);
	- }
	+ if (sc->qfullmsk == 0)
	+ iwn_start_locked(sc);
	}

	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);
	@@ -3757,8 +3707,7 @@
	iwn_notif_intr(struct iwn_softc *sc)
	{
	struct iwn_ops *ops = &sc->ops;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint16_t hw;

	@@ -3952,8 +3901,7 @@
	static void
	iwn_rftoggle_intr(struct iwn_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp = IWN_READ(sc, IWN_GP_CNTRL);

	IWN_LOCK_ASSERT(sc);
	@@ -4032,7 +3980,6 @@
	iwn_intr(void *arg)
	{
	struct iwn_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t r1, r2, tmp;

	IWN_LOCK(sc);
	@@ -4125,7 +4072,7 @@

	done:
	/* Re-enable interrupts. */
	- if (ifp->if_flags & IFF_UP)
	+ if (sc->sc_flags & IWN_FLAG_RUNNING)
	IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);

	IWN_UNLOCK(sc);
	@@ -4609,9 +4556,7 @@
	struct ieee80211_node ni, const struct ieee80211_bpf_params params)
	{
	struct iwn_ops *ops = &sc->ops;
	-// struct ifnet *ifp = sc->sc_ifp;
	struct ieee80211vap *vap = ni->ni_vap;
	-// struct ieee80211com *ic = ifp->if_l2com;
	struct iwn_tx_cmd *cmd;
	struct iwn_cmd_data *tx;
	struct ieee80211_frame *wh;
	@@ -4807,13 +4752,12 @@
	const struct ieee80211_bpf_params *params)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct iwn_softc *sc = ifp->if_softc;
	+ struct iwn_softc *sc = ic->ic_softc;
	int error = 0;

	DPRINTF(sc, IWN_DEBUG_XMIT \| IWN_DEBUG_TRACE, "->%s begin\n", __func__);

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	+ if ((sc->sc_flags & IWN_FLAG_RUNNING) == 0) {
	ieee80211_free_node(ni);
	m_freem(m);
	return ENETDOWN;
	@@ -4836,7 +4780,6 @@
	if (error != 0) {
	/* NB: m is reclaimed on tx failure */
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	} else
	sc->sc_tx_timer = 5;

	@@ -4847,47 +4790,48 @@
	return error;
	}

	-static void
	-iwn_start(struct ifnet *ifp)
	+static int
	+iwn_transmit(struct ieee80211com ic, struct mbuf m)
	{
	- struct iwn_softc *sc = ifp->if_softc;
	+ struct iwn_softc *sc;
	+ int error;
	+
	+ sc = ic->ic_softc;

	IWN_LOCK(sc);
	- iwn_start_locked(ifp);
	+ if ((sc->sc_flags & IWN_FLAG_RUNNING) == 0) {
	+ IWN_UNLOCK(sc);
	+ return (ENXIO);
	+ }
	+ error = mbufq_enqueue(&sc->sc_snd, m);
	+ if (error) {
	+ IWN_UNLOCK(sc);
	+ return (error);
	+ }
	+ iwn_start_locked(sc);
	IWN_UNLOCK(sc);
	+ return (0);
	}

	static void
	-iwn_start_locked(struct ifnet *ifp)
	+iwn_start_locked(struct iwn_softc *sc)
	{
	- struct iwn_softc *sc = ifp->if_softc;
	struct ieee80211_node *ni;
	struct mbuf *m;

	IWN_LOCK_ASSERT(sc);

	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: called\n", __func__);
	-
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 \|\|
	- (ifp->if_drv_flags & IFF_DRV_OACTIVE))
	- return;
	-
	- for (;;) {
	- if (sc->qfullmsk != 0) {
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- break;
	- }
	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
	- if (m == NULL)
	- break;
	+ while (sc->qfullmsk == 0 &&
	+ (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
	if (iwn_tx_data(sc, m, ni) != 0) {
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	} else
	sc->sc_tx_timer = 5;
	}
	-
	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: done\n", __func__);
	}

	@@ -4895,12 +4839,11 @@
	iwn_watchdog(void *arg)
	{
	struct iwn_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	IWN_LOCK_ASSERT(sc);

	- KASSERT(ifp->if_drv_flags & IFF_DRV_RUNNING, ("not running"));
	+ KASSERT(sc->sc_flags & IWN_FLAG_RUNNING, ("not running"));

	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);

	@@ -4915,41 +4858,13 @@
	}

	static int
	-iwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+iwn_ioctl(struct ieee80211com ic, u_long cmd, void data)
	{
	- struct iwn_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	- struct ifreq ifr = (struct ifreq ) data;
	- int error = 0, startall = 0, stop = 0;
	-
	+ struct ifreq *ifr = data;
	+ struct iwn_softc *sc = ic->ic_softc;
	+ int error = 0;
	+
	switch (cmd) {
	- case SIOCGIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	- case SIOCSIFFLAGS:
	- IWN_LOCK(sc);
	- if (ifp->if_flags & IFF_UP) {
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	- iwn_init_locked(sc);
	- if (IWN_READ(sc, IWN_GP_CNTRL) & IWN_GP_CNTRL_RFKILL)
	- startall = 1;
	- else
	- stop = 1;
	- }
	- } else {
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- iwn_stop_locked(sc);
	- }
	- IWN_UNLOCK(sc);
	- if (startall)
	- ieee80211_start_all(ic);
	- else if (vap != NULL && stop)
	- ieee80211_stop(vap);
	- break;
	- case SIOCGIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	case SIOCGIWNSTATS:
	IWN_LOCK(sc);
	/* XXX validate permissions/memory/etc? */
	@@ -4963,10 +4878,35 @@
	IWN_UNLOCK(sc);
	break;
	default:
	- error = EINVAL;
	+ error = ENOTTY;
	break;
	}
	- return error;
	+ return (error);
	+}
	+
	+static void
	+iwn_parent(struct ieee80211com *ic)
	+{
	+ struct iwn_softc *sc = ic->ic_softc;
	+ struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	+ int startall = 0, stop = 0;
	+
	+ IWN_LOCK(sc);
	+ if (ic->ic_nrunning > 0) {
	+ if (!(sc->sc_flags & IWN_FLAG_RUNNING)) {
	+ iwn_init_locked(sc);
	+ if (IWN_READ(sc, IWN_GP_CNTRL) & IWN_GP_CNTRL_RFKILL)
	+ startall = 1;
	+ else
	+ stop = 1;
	+ }
	+ } else if (sc->sc_flags & IWN_FLAG_RUNNING)
	+ iwn_stop_locked(sc);
	+ IWN_UNLOCK(sc);
	+ if (startall)
	+ ieee80211_start_all(ic);
	+ else if (vap != NULL && stop)
	+ ieee80211_stop(vap);
	}

	/*
	@@ -5200,8 +5140,7 @@
	iwn_add_broadcast_node(struct iwn_softc *sc, int async)
	{
	struct iwn_ops *ops = &sc->ops;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct iwn_node_info node;
	struct iwn_cmd_link_quality linkq;
	uint8_t txant;
	@@ -5212,7 +5151,7 @@
	sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];

	memset(&node, 0, sizeof node);
	- IEEE80211_ADDR_COPY(node.macaddr, ifp->if_broadcastaddr);
	+ IEEE80211_ADDR_COPY(node.macaddr, ieee80211broadcastaddr);
	node.id = sc->broadcast_id;
	DPRINTF(sc, IWN_DEBUG_RESET, "%s: adding broadcast node\n", __func__);
	if ((error = ops->add_node(sc, &node, async)) != 0)
	@@ -5361,8 +5300,7 @@
	static void
	iwn4965_power_calibration(struct iwn_softc *sc, int temp)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);

	@@ -5732,8 +5670,7 @@
	{
	struct iwn_ops *ops = &sc->ops;
	struct iwn_calib_state *calib = &sc->calib;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t val;
	int i;

	@@ -6367,8 +6304,9 @@
	iwn_config(struct iwn_softc *sc)
	{
	struct iwn_ops *ops = &sc->ops;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	+ struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	+ const uint8_t *macaddr;
	uint32_t txmask;
	uint16_t rxchain;
	int error;
	@@ -6450,8 +6388,9 @@
	/* Set mode, channel, RX filter and enable RX. */
	sc->rxon = &sc->rx_on[IWN_RXON_BSS_CTX];
	memset(sc->rxon, 0, sizeof (struct iwn_rxon));
	- IEEE80211_ADDR_COPY(sc->rxon->myaddr, IF_LLADDR(ifp));
	- IEEE80211_ADDR_COPY(sc->rxon->wlap, IF_LLADDR(ifp));
	+ macaddr = vap ? vap->iv_myaddr : ic->ic_macaddr;
	+ IEEE80211_ADDR_COPY(sc->rxon->myaddr, macaddr);
	+ IEEE80211_ADDR_COPY(sc->rxon->wlap, macaddr);
	sc->rxon->chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
	sc->rxon->flags = htole32(IWN_RXON_TSF \| IWN_RXON_CTS_TO_SELF);
	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan))
	@@ -6559,7 +6498,7 @@
	static uint16_t
	iwn_limit_dwell(struct iwn_softc *sc, uint16_t dwell_time)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = NULL;
	int bintval = 0;

	@@ -6607,8 +6546,7 @@
	iwn_scan(struct iwn_softc sc, struct ieee80211vap vap,
	struct ieee80211_scan_state ss, struct ieee80211_channel c)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_node *ni = vap->iv_bss;
	struct iwn_scan_hdr *hdr;
	struct iwn_cmd_data *tx;
	@@ -6746,9 +6684,9 @@
	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 \| IEEE80211_FC0_TYPE_MGT \|
	IEEE80211_FC0_SUBTYPE_PROBE_REQ;
	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
	- IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
	- IEEE80211_ADDR_COPY(wh->i_addr2, IF_LLADDR(ifp));
	- IEEE80211_ADDR_COPY(wh->i_addr3, ifp->if_broadcastaddr);
	+ IEEE80211_ADDR_COPY(wh->i_addr1, vap->iv_ifp->if_broadcastaddr);
	+ IEEE80211_ADDR_COPY(wh->i_addr2, IF_LLADDR(vap->iv_ifp));
	+ IEEE80211_ADDR_COPY(wh->i_addr3, vap->iv_ifp->if_broadcastaddr);
	(uint16_t )&wh->i_dur[0] = 0; /* filled by HW */
	(uint16_t )&wh->i_seq[0] = 0; /* filled by HW */

	@@ -6867,8 +6805,7 @@
	iwn_auth(struct iwn_softc sc, struct ieee80211vap vap)
	{
	struct iwn_ops *ops = &sc->ops;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_node *ni = vap->iv_bss;
	int error;

	@@ -6936,8 +6873,7 @@
	iwn_run(struct iwn_softc sc, struct ieee80211vap vap)
	{
	struct iwn_ops *ops = &sc->ops;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_node *ni = vap->iv_bss;
	struct iwn_node_info node;
	uint32_t htflags = 0;
	@@ -8523,8 +8459,7 @@
	iwn_radio_on(void *arg0, int pending)
	{
	struct iwn_softc *sc = arg0;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
	@@ -8539,8 +8474,7 @@
	iwn_radio_off(void *arg0, int pending)
	{
	struct iwn_softc *sc = arg0;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
	@@ -8560,8 +8494,7 @@
	iwn_panicked(void *arg0, int pending)
	{
	struct iwn_softc *sc = arg0;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	int error;

	@@ -8589,7 +8522,7 @@
	}

	/* Only run start once the NIC is in a useful state, like associated */
	- iwn_start_locked(sc->sc_ifp);
	+ iwn_start_locked(sc);

	IWN_UNLOCK(sc);
	}
	@@ -8597,13 +8530,14 @@
	static void
	iwn_init_locked(struct iwn_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	int error;

	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s begin\n", __func__);

	IWN_LOCK_ASSERT(sc);

	+ sc->sc_flags \|= IWN_FLAG_RUNNING;
	+
	if ((error = iwn_hw_prepare(sc)) != 0) {
	device_printf(sc->sc_dev, "%s: hardware not ready, error %d\n",
	__func__, error);
	@@ -8651,38 +8585,33 @@
	goto fail;
	}

	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	-
	callout_reset(&sc->watchdog_to, hz, iwn_watchdog, sc);

	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end\n",__func__);

	return;

	-fail: iwn_stop_locked(sc);
	+fail:
	+ sc->sc_flags &= ~IWN_FLAG_RUNNING;
	+ iwn_stop_locked(sc);
	DPRINTF(sc, IWN_DEBUG_TRACE, "->%s: end in error\n",__func__);
	}

	static void
	-iwn_init(void *arg)
	+iwn_init(struct iwn_softc *sc)
	{
	- struct iwn_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;

	IWN_LOCK(sc);
	iwn_init_locked(sc);
	IWN_UNLOCK(sc);

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- ieee80211_start_all(ic);
	+ if (sc->sc_flags & IWN_FLAG_RUNNING)
	+ ieee80211_start_all(&sc->sc_ic);
	}

	static void
	iwn_stop_locked(struct iwn_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;

	IWN_LOCK_ASSERT(sc);

	@@ -8690,7 +8619,7 @@
	sc->sc_tx_timer = 0;
	callout_stop(&sc->watchdog_to);
	callout_stop(&sc->calib_to);
	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	+ sc->sc_flags &= ~IWN_FLAG_RUNNING;

	/* Power OFF hardware. */
	iwn_hw_stop(sc);
	@@ -8710,8 +8639,7 @@
	static void
	iwn_scan_start(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct iwn_softc *sc = ifp->if_softc;
	+ struct iwn_softc *sc = ic->ic_softc;

	IWN_LOCK(sc);
	/* make the link LED blink while we're scanning */
	@@ -8725,8 +8653,7 @@
	static void
	iwn_scan_end(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct iwn_softc *sc = ifp->if_softc;
	+ struct iwn_softc *sc = ic->ic_softc;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	IWN_LOCK(sc);
	@@ -8744,8 +8671,7 @@
	iwn_set_channel(struct ieee80211com *ic)
	{
	const struct ieee80211_channel *c = ic->ic_curchan;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct iwn_softc *sc = ifp->if_softc;
	+ struct iwn_softc *sc = ic->ic_softc;
	int error;

	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);
	@@ -8802,8 +8728,7 @@
	iwn_hw_reset(void *arg0, int pending)
	{
	struct iwn_softc *sc = arg0;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	DPRINTF(sc, IWN_DEBUG_TRACE, "->Doing %s\n", __func__);

	Index: sys/dev/iwn/if_iwnvar.h
	===================================================================
	--- sys/dev/iwn/if_iwnvar.h
	+++ sys/dev/iwn/if_iwnvar.h
	@@ -228,18 +228,16 @@
	enum ieee80211_state, int);
	int ctx;
	int beacon_int;
	- uint8_t macaddr[IEEE80211_ADDR_LEN];

	};
	#define IWN_VAP(_vap) ((struct iwn_vap *)(_vap))

	struct iwn_softc {
	device_t sc_dev;
	-
	- struct ifnet *sc_ifp;
	int sc_debug;
	-
	struct mtx sc_mtx;
	+ struct ieee80211com sc_ic;
	+ struct mbufq sc_snd;

	u_int sc_flags;
	#define IWN_FLAG_HAS_OTPROM (1 << 1)
	@@ -251,6 +249,7 @@
	#define IWN_FLAG_ADV_BTCOEX (1 << 8)
	#define IWN_FLAG_PAN_SUPPORT (1 << 9)
	#define IWN_FLAG_BTCOEX (1 << 10)
	+#define IWN_FLAG_RUNNING (1 << 11)

	uint8_t hw_type;
	/* subdevice_id used to adjust configuration */
	@@ -319,7 +318,6 @@
	struct iwn_calib_state calib;
	int last_calib_ticks;
	struct callout watchdog_to;
	- struct callout ct_kill_exit_to;
	struct iwn_fw_info fw;
	struct iwn_calib_info calibcmd[IWN5000_PHY_CALIB_MAX_RESULT];
	uint32_t errptr;
	Index: sys/dev/ral/if_ral_pci.c
	===================================================================
	--- sys/dev/ral/if_ral_pci.c
	+++ sys/dev/ral/if_ral_pci.c
	@@ -28,6 +28,7 @@
	#include <sys/kernel.h>
	#include <sys/lock.h>
	#include <sys/malloc.h>
	+#include <sys/mbuf.h>
	#include <sys/module.h>
	#include <sys/mutex.h>
	#include <sys/rman.h>
	Index: sys/dev/ral/rt2560.c
	===================================================================
	--- sys/dev/ral/rt2560.c
	+++ sys/dev/ral/rt2560.c
	@@ -127,10 +127,10 @@
	struct ieee80211_node *);
	static int rt2560_tx_data(struct rt2560_softc , struct mbuf ,
	struct ieee80211_node *);
	-static void rt2560_start_locked(struct ifnet *);
	-static void rt2560_start(struct ifnet *);
	+static int rt2560_transmit(struct ieee80211com , struct mbuf );
	+static void rt2560_start(struct rt2560_softc *);
	static void rt2560_watchdog(void *);
	-static int rt2560_ioctl(struct ifnet *, u_long, caddr_t);
	+static void rt2560_parent(struct ieee80211com *);
	static void rt2560_bbp_write(struct rt2560_softc *, uint8_t,
	uint8_t);
	static uint8_t rt2560_bbp_read(struct rt2560_softc *, uint8_t);
	@@ -149,7 +149,8 @@
	const struct ieee80211_rateset *);
	static void rt2560_update_led(struct rt2560_softc *, int, int);
	static void rt2560_set_bssid(struct rt2560_softc , const uint8_t );
	-static void rt2560_set_macaddr(struct rt2560_softc , uint8_t );
	+static void rt2560_set_macaddr(struct rt2560_softc *,
	+ const uint8_t *);
	static void rt2560_get_macaddr(struct rt2560_softc , uint8_t );
	static void rt2560_update_promisc(struct ieee80211com *);
	static const char *rt2560_get_rf(int);
	@@ -197,11 +198,9 @@
	rt2560_attach(device_t dev, int id)
	{
	struct rt2560_softc *sc = device_get_softc(dev);
	- struct ieee80211com *ic;
	- struct ifnet *ifp;
	- int error;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint8_t bands;
	- uint8_t macaddr[IEEE80211_ADDR_LEN];
	+ int error;

	sc->sc_dev = dev;

	@@ -209,6 +208,7 @@
	MTX_DEF \| MTX_RECURSE);

	callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
	+ mbufq_init(&sc->sc_snd, ifqmaxlen);

	/* retrieve RT2560 rev. no */
	sc->asic_rev = RAL_READ(sc, RT2560_CSR0);
	@@ -252,27 +252,9 @@
	goto fail5;
	}

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(sc->sc_dev, "can not if_alloc()\n");
	- goto fail6;
	- }
	- ic = ifp->if_l2com;
	-
	/* retrieve MAC address */
	- rt2560_get_macaddr(sc, macaddr);
	-
	- ifp->if_softc = sc;
	- if_initname(ifp, device_get_name(dev), device_get_unit(dev));
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = rt2560_init;
	- ifp->if_ioctl = rt2560_ioctl;
	- ifp->if_start = rt2560_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	+ rt2560_get_macaddr(sc, ic->ic_macaddr);

	- ic->ic_ifp = ifp;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(dev);
	ic->ic_opmode = IEEE80211_M_STA;
	@@ -303,7 +285,7 @@
	setbit(&bands, IEEE80211_MODE_11A);
	ieee80211_init_channels(ic, NULL, &bands);

	- ieee80211_ifattach(ic, macaddr);
	+ ieee80211_ifattach(ic);
	ic->ic_raw_xmit = rt2560_raw_xmit;
	ic->ic_updateslot = rt2560_update_slot;
	ic->ic_update_promisc = rt2560_update_promisc;
	@@ -313,6 +295,8 @@

	ic->ic_vap_create = rt2560_vap_create;
	ic->ic_vap_delete = rt2560_vap_delete;
	+ ic->ic_parent = rt2560_parent;
	+ ic->ic_transmit = rt2560_transmit;

	ieee80211_radiotap_attach(ic,
	&sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
	@@ -341,7 +325,6 @@

	return 0;

	-fail6: rt2560_free_rx_ring(sc, &sc->rxq);
	fail5: rt2560_free_tx_ring(sc, &sc->bcnq);
	fail4: rt2560_free_tx_ring(sc, &sc->prioq);
	fail3: rt2560_free_tx_ring(sc, &sc->atimq);
	@@ -355,12 +338,12 @@
	rt2560_detach(void *xsc)
	{
	struct rt2560_softc *sc = xsc;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	rt2560_stop(sc);

	ieee80211_ifdetach(ic);
	+ mbufq_drain(&sc->sc_snd);

	rt2560_free_tx_ring(sc, &sc->txq);
	rt2560_free_tx_ring(sc, &sc->atimq);
	@@ -368,8 +351,6 @@
	rt2560_free_tx_ring(sc, &sc->bcnq);
	rt2560_free_rx_ring(sc, &sc->rxq);

	- if_free(ifp);
	-
	mtx_destroy(&sc->sc_mtx);

	return 0;
	@@ -381,7 +362,7 @@
	const uint8_t bssid[IEEE80211_ADDR_LEN],
	const uint8_t mac[IEEE80211_ADDR_LEN])
	{
	- struct ifnet *ifp = ic->ic_ifp;
	+ struct rt2560_softc *sc = ic->ic_softc;
	struct rt2560_vap *rvp;
	struct ieee80211vap *vap;

	@@ -394,7 +375,7 @@
	case IEEE80211_M_MBSS:
	/* XXXRP: TBD */
	if (!TAILQ_EMPTY(&ic->ic_vaps)) {
	- if_printf(ifp, "only 1 vap supported\n");
	+ device_printf(sc->sc_dev, "only 1 vap supported\n");
	return NULL;
	}
	if (opmode == IEEE80211_M_STA)
	@@ -403,7 +384,8 @@
	case IEEE80211_M_WDS:
	if (TAILQ_EMPTY(&ic->ic_vaps) \|\|
	ic->ic_opmode != IEEE80211_M_HOSTAP) {
	- if_printf(ifp, "wds only supported in ap mode\n");
	+ device_printf(sc->sc_dev,
	+ "wds only supported in ap mode\n");
	return NULL;
	}
	/*
	@@ -414,15 +396,12 @@
	flags &= ~IEEE80211_CLONE_BSSID;
	break;
	default:
	- if_printf(ifp, "unknown opmode %d\n", opmode);
	+ device_printf(sc->sc_dev, "unknown opmode %d\n", opmode);
	return NULL;
	}
	- rvp = (struct rt2560_vap *) malloc(sizeof(struct rt2560_vap),
	- M_80211_VAP, M_NOWAIT \| M_ZERO);
	- if (rvp == NULL)
	- return NULL;
	+ rvp = malloc(sizeof(struct rt2560_vap), M_80211_VAP, M_WAITOK \| M_ZERO);
	vap = &rvp->ral_vap;
	- ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
	+ ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);

	/* override state transition machine */
	rvp->ral_newstate = vap->iv_newstate;
	@@ -431,7 +410,8 @@

	ieee80211_ratectl_init(vap);
	/* complete setup */
	- ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
	+ ieee80211_vap_attach(vap, ieee80211_media_change,
	+ ieee80211_media_status, mac);
	if (TAILQ_FIRST(&ic->ic_vaps) == vap)
	ic->ic_opmode = opmode;
	return vap;
	@@ -451,9 +431,8 @@
	rt2560_resume(void *xsc)
	{
	struct rt2560_softc *sc = xsc;
	- struct ifnet *ifp = sc->sc_ifp;

	- if (ifp->if_flags & IFF_UP)
	+ if (sc->sc_ic.ic_nrunning > 0)
	rt2560_init(sc);
	}

	@@ -763,8 +742,7 @@
	rt2560_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
	{
	struct rt2560_vap *rvp = RT2560_VAP(vap);
	- struct ifnet *ifp = vap->iv_ic->ic_ifp;
	- struct rt2560_softc *sc = ifp->if_softc;
	+ struct rt2560_softc *sc = vap->iv_ic->ic_softc;
	int error;

	if (nstate == IEEE80211_S_INIT && vap->iv_state == IEEE80211_S_RUN) {
	@@ -792,7 +770,8 @@
	vap->iv_opmode == IEEE80211_M_MBSS) {
	m = ieee80211_beacon_alloc(ni, &rvp->ral_bo);
	if (m == NULL) {
	- if_printf(ifp, "could not allocate beacon\n");
	+ device_printf(sc->sc_dev,
	+ "could not allocate beacon\n");
	return ENOBUFS;
	}
	ieee80211_ref_node(ni);
	@@ -926,14 +905,13 @@
	static void
	rt2560_tx_intr(struct rt2560_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct rt2560_tx_desc *desc;
	struct rt2560_tx_data *data;
	struct mbuf *m;
	- uint32_t flags;
	- int retrycnt;
	struct ieee80211vap *vap;
	struct ieee80211_node *ni;
	+ uint32_t flags;
	+ int retrycnt, status;

	bus_dmamap_sync(sc->txq.desc_dmat, sc->txq.desc_map,
	BUS_DMASYNC_POSTREAD);
	@@ -961,7 +939,7 @@
	ieee80211_ratectl_tx_complete(vap, ni,
	IEEE80211_RATECTL_TX_SUCCESS,
	&retrycnt, NULL);
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	+ status = 0;
	break;

	case RT2560_TX_SUCCESS_RETRY:
	@@ -973,7 +951,7 @@
	ieee80211_ratectl_tx_complete(vap, ni,
	IEEE80211_RATECTL_TX_SUCCESS,
	&retrycnt, NULL);
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	+ status = 0;
	break;

	case RT2560_TX_FAIL_RETRY:
	@@ -985,7 +963,7 @@
	ieee80211_ratectl_tx_complete(vap, ni,
	IEEE80211_RATECTL_TX_FAILURE,
	&retrycnt, NULL);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ status = 1;
	break;

	case RT2560_TX_FAIL_INVALID:
	@@ -993,16 +971,16 @@
	default:
	device_printf(sc->sc_dev, "sending data frame failed "
	"0x%08x\n", flags);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ status = 1;
	}

	bus_dmamap_sync(sc->txq.data_dmat, data->map,
	BUS_DMASYNC_POSTWRITE);
	bus_dmamap_unload(sc->txq.data_dmat, data->map);
	- m_freem(m);
	- data->m = NULL;
	- ieee80211_free_node(data->ni);
	+
	+ ieee80211_tx_complete(ni, m, status);
	data->ni = NULL;
	+ data->m = NULL;

	/* descriptor is no longer valid */
	desc->flags &= ~htole32(RT2560_TX_VALID);
	@@ -1019,19 +997,13 @@
	if (sc->prioq.queued == 0 && sc->txq.queued == 0)
	sc->sc_tx_timer = 0;

	- if (sc->txq.queued < RT2560_TX_RING_COUNT - 1) {
	- sc->sc_flags &= ~RT2560_F_DATA_OACTIVE;
	- if ((sc->sc_flags &
	- (RT2560_F_DATA_OACTIVE \| RT2560_F_PRIO_OACTIVE)) == 0)
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- rt2560_start_locked(ifp);
	- }
	+ if (sc->txq.queued < RT2560_TX_RING_COUNT - 1)
	+ rt2560_start(sc);
	}

	static void
	rt2560_prio_intr(struct rt2560_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct rt2560_tx_desc *desc;
	struct rt2560_tx_data *data;
	struct ieee80211_node *ni;
	@@ -1103,13 +1075,8 @@
	if (sc->prioq.queued == 0 && sc->txq.queued == 0)
	sc->sc_tx_timer = 0;

	- if (sc->prioq.queued < RT2560_PRIO_RING_COUNT) {
	- sc->sc_flags &= ~RT2560_F_PRIO_OACTIVE;
	- if ((sc->sc_flags &
	- (RT2560_F_DATA_OACTIVE \| RT2560_F_PRIO_OACTIVE)) == 0)
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- rt2560_start_locked(ifp);
	- }
	+ if (sc->prioq.queued < RT2560_PRIO_RING_COUNT)
	+ rt2560_start(sc);
	}

	/*
	@@ -1119,8 +1086,7 @@
	static void
	rt2560_decryption_intr(struct rt2560_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct rt2560_rx_desc *desc;
	struct rt2560_rx_data *data;
	bus_addr_t physaddr;
	@@ -1146,13 +1112,13 @@
	break;

	if (data->drop) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	if ((le32toh(desc->flags) & RT2560_RX_CIPHER_MASK) != 0 &&
	(le32toh(desc->flags) & RT2560_RX_ICV_ERROR)) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	@@ -1165,7 +1131,7 @@
	*/
	mnew = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
	if (mnew == NULL) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	@@ -1188,7 +1154,7 @@
	panic("%s: could not load old rx mbuf",
	device_get_name(sc->sc_dev));
	}
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	@@ -1201,7 +1167,6 @@
	desc->physaddr = htole32(physaddr);

	/* finalize mbuf */
	- m->m_pkthdr.rcvif = ifp;
	m->m_pkthdr.len = m->m_len =
	(le32toh(desc->flags) >> 16) & 0xfff;

	@@ -1321,8 +1286,7 @@
	static void
	rt2560_beacon_expire(struct rt2560_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	struct rt2560_vap *rvp = RT2560_VAP(vap);
	struct rt2560_tx_data *data;
	@@ -1363,7 +1327,6 @@
	rt2560_intr(void *arg)
	{
	struct rt2560_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t r;

	RAL_LOCK(sc);
	@@ -1372,7 +1335,7 @@
	RAL_WRITE(sc, RT2560_CSR8, 0xffffffff);

	/* don't re-enable interrupts if we're shutting down */
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	+ if (!(sc->sc_flags & RT2560_F_RUNNING)) {
	RAL_UNLOCK(sc);
	return;
	}
	@@ -1440,8 +1403,7 @@
	rt2560_setup_tx_desc(struct rt2560_softc sc, struct rt2560_tx_desc desc,
	uint32_t flags, int len, int rate, int encrypt, bus_addr_t physaddr)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint16_t plcp_length;
	int remainder;

	@@ -1916,55 +1878,57 @@
	return 0;
	}

	+static int
	+rt2560_transmit(struct ieee80211com ic, struct mbuf m)
	+{
	+ struct rt2560_softc *sc = ic->ic_softc;
	+ int error;
	+
	+ RAL_LOCK(sc);
	+ if ((sc->sc_flags & RT2560_F_RUNNING) == 0) {
	+ RAL_UNLOCK(sc);
	+ return (ENXIO);
	+ }
	+ error = mbufq_enqueue(&sc->sc_snd, m);
	+ if (error) {
	+ RAL_UNLOCK(sc);
	+ return (error);
	+ }
	+ rt2560_start(sc);
	+ RAL_UNLOCK(sc);
	+
	+ return (0);
	+}
	+
	static void
	-rt2560_start_locked(struct ifnet *ifp)
	+rt2560_start(struct rt2560_softc *sc)
	{
	- struct rt2560_softc *sc = ifp->if_softc;
	- struct mbuf *m;
	struct ieee80211_node *ni;
	+ struct mbuf *m;

	RAL_LOCK_ASSERT(sc);

	- for (;;) {
	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
	- if (m == NULL)
	- break;
	- if (sc->txq.queued >= RT2560_TX_RING_COUNT - 1) {
	- IFQ_DRV_PREPEND(&ifp->if_snd, m);
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- sc->sc_flags \|= RT2560_F_DATA_OACTIVE;
	- break;
	- }
	+ while (sc->txq.queued < RT2560_TX_RING_COUNT - 1 &&
	+ (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
	ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
	if (rt2560_tx_data(sc, m, ni) != 0) {
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	break;
	}
	-
	sc->sc_tx_timer = 5;
	}
	}

	static void
	-rt2560_start(struct ifnet *ifp)
	-{
	- struct rt2560_softc *sc = ifp->if_softc;
	-
	- RAL_LOCK(sc);
	- rt2560_start_locked(ifp);
	- RAL_UNLOCK(sc);
	-}
	-
	-static void
	rt2560_watchdog(void *arg)
	{
	struct rt2560_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;

	RAL_LOCK_ASSERT(sc);

	- KASSERT(ifp->if_drv_flags & IFF_DRV_RUNNING, ("not running"));
	+ KASSERT(sc->sc_flags & RT2560_F_RUNNING, ("not running"));

	if (sc->sc_invalid) /* card ejected */
	return;
	@@ -1973,51 +1937,33 @@
	rt2560_tx_intr(sc);

	if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
	- if_printf(ifp, "device timeout\n");
	+ device_printf(sc->sc_dev, "device timeout\n");
	rt2560_init_locked(sc);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ counter_u64_add(sc->sc_ic.ic_oerrors, 1);
	/* NB: callout is reset in rt2560_init() */
	return;
	}
	callout_reset(&sc->watchdog_ch, hz, rt2560_watchdog, sc);
	}

	-static int
	-rt2560_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+static void
	+rt2560_parent(struct ieee80211com *ic)
	{
	- struct rt2560_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ifreq ifr = (struct ifreq ) data;
	- int error = 0, startall = 0;
	+ struct rt2560_softc *sc = ic->ic_softc;
	+ int startall = 0;

	- switch (cmd) {
	- case SIOCSIFFLAGS:
	- RAL_LOCK(sc);
	- if (ifp->if_flags & IFF_UP) {
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	- rt2560_init_locked(sc);
	- startall = 1;
	- } else
	- rt2560_update_promisc(ic);
	- } else {
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- rt2560_stop_locked(sc);
	- }
	- RAL_UNLOCK(sc);
	- if (startall)
	- ieee80211_start_all(ic);
	- break;
	- case SIOCGIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- case SIOCGIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	- default:
	- error = EINVAL;
	- break;
	- }
	- return error;
	+ RAL_LOCK(sc);
	+ if (ic->ic_nrunning > 0) {
	+ if ((sc->sc_flags & RT2560_F_RUNNING) == 0) {
	+ rt2560_init_locked(sc);
	+ startall = 1;
	+ } else
	+ rt2560_update_promisc(ic);
	+ } else if (sc->sc_flags & RT2560_F_RUNNING)
	+ rt2560_stop_locked(sc);
	+ RAL_UNLOCK(sc);
	+ if (startall)
	+ ieee80211_start_all(ic);
	}

	static void
	@@ -2101,8 +2047,7 @@
	static void
	rt2560_set_chan(struct rt2560_softc sc, struct ieee80211_channel c)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint8_t power, tmp;
	u_int i, chan;

	@@ -2201,8 +2146,7 @@
	static void
	rt2560_set_channel(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2560_softc *sc = ifp->if_softc;
	+ struct rt2560_softc *sc = ic->ic_softc;

	RAL_LOCK(sc);
	rt2560_set_chan(sc, ic->ic_curchan);
	@@ -2238,8 +2182,7 @@
	static void
	rt2560_enable_tsf_sync(struct rt2560_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint16_t logcwmin, preload;
	uint32_t tmp;
	@@ -2280,8 +2223,7 @@
	static void
	rt2560_update_plcp(struct rt2560_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	/* no short preamble for 1Mbps */
	RAL_WRITE(sc, RT2560_PLCP1MCSR, 0x00700400);
	@@ -2360,8 +2302,7 @@
	const struct ieee80211_rateset *rs)
	{
	#define RV(r) ((r) & IEEE80211_RATE_VAL)
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t mask = 0;
	uint8_t rate;
	int i;
	@@ -2406,7 +2347,7 @@
	}

	static void
	-rt2560_set_macaddr(struct rt2560_softc sc, uint8_t addr)
	+rt2560_set_macaddr(struct rt2560_softc sc, const uint8_t addr)
	{
	uint32_t tmp;

	@@ -2444,13 +2385,13 @@
	tmp = RAL_READ(sc, RT2560_RXCSR0);

	tmp &= ~RT2560_DROP_NOT_TO_ME;
	- if (!(ic->ic_ifp->if_flags & IFF_PROMISC))
	+ if (ic->ic_promisc == 0)
	tmp \|= RT2560_DROP_NOT_TO_ME;

	RAL_WRITE(sc, RT2560_RXCSR0, tmp);

	DPRINTF(sc, "%s promiscuous mode\n",
	- (ic->ic_ifp->if_flags & IFF_PROMISC) ? "entering" : "leaving");
	+ (ic->ic_promisc > 0) ? "entering" : "leaving");
	}

	static const char *
	@@ -2516,19 +2457,17 @@
	static void
	rt2560_scan_start(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2560_softc *sc = ifp->if_softc;
	+ struct rt2560_softc *sc = ic->ic_softc;

	/* abort TSF synchronization */
	RAL_WRITE(sc, RT2560_CSR14, 0);
	- rt2560_set_bssid(sc, ifp->if_broadcastaddr);
	+ rt2560_set_bssid(sc, ieee80211broadcastaddr);
	}

	static void
	rt2560_scan_end(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2560_softc *sc = ifp->if_softc;
	+ struct rt2560_softc *sc = ic->ic_softc;
	struct ieee80211vap *vap = ic->ic_scan->ss_vap;

	rt2560_enable_tsf_sync(sc);
	@@ -2622,8 +2561,8 @@
	rt2560_init_locked(struct rt2560_softc *sc)
	{
	#define N(a) (sizeof (a) / sizeof ((a)[0]))
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	+ struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t tmp;
	int i;

	@@ -2654,7 +2593,7 @@
	for (i = 0; i < N(rt2560_def_mac); i++)
	RAL_WRITE(sc, rt2560_def_mac[i].reg, rt2560_def_mac[i].val);

	- rt2560_set_macaddr(sc, IF_LLADDR(ifp));
	+ rt2560_set_macaddr(sc, vap ? vap->iv_myaddr : ic->ic_macaddr);

	/* set basic rate set (will be updated later) */
	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
	@@ -2684,7 +2623,7 @@
	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
	ic->ic_opmode != IEEE80211_M_MBSS)
	tmp \|= RT2560_DROP_TODS;
	- if (!(ifp->if_flags & IFF_PROMISC))
	+ if (ic->ic_promisc == 0)
	tmp \|= RT2560_DROP_NOT_TO_ME;
	}
	RAL_WRITE(sc, RT2560_RXCSR0, tmp);
	@@ -2699,8 +2638,7 @@
	/* enable interrupts */
	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);

	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	+ sc->sc_flags \|= RT2560_F_RUNNING;

	callout_reset(&sc->watchdog_ch, hz, rt2560_watchdog, sc);
	#undef N
	@@ -2710,21 +2648,19 @@
	rt2560_init(void *priv)
	{
	struct rt2560_softc *sc = priv;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	RAL_LOCK(sc);
	rt2560_init_locked(sc);
	RAL_UNLOCK(sc);

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	+ if (sc->sc_flags & RT2560_F_RUNNING)
	ieee80211_start_all(ic); /* start all vap's */
	}

	static void
	rt2560_stop_locked(struct rt2560_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	volatile int *flags = &sc->sc_flags;

	RAL_LOCK_ASSERT(sc);
	@@ -2735,8 +2671,8 @@
	callout_stop(&sc->watchdog_ch);
	sc->sc_tx_timer = 0;

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	+ if (sc->sc_flags & RT2560_F_RUNNING) {
	+ sc->sc_flags &= ~RT2560_F_RUNNING;

	/* abort Tx */
	RAL_WRITE(sc, RT2560_TXCSR0, RT2560_ABORT_TX);
	@@ -2758,7 +2694,6 @@
	rt2560_reset_tx_ring(sc, &sc->bcnq);
	rt2560_reset_rx_ring(sc, &sc->rxq);
	}
	- sc->sc_flags &= ~(RT2560_F_PRIO_OACTIVE \| RT2560_F_DATA_OACTIVE);
	}

	void
	@@ -2776,29 +2711,24 @@
	const struct ieee80211_bpf_params *params)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2560_softc *sc = ifp->if_softc;
	+ struct rt2560_softc *sc = ic->ic_softc;

	RAL_LOCK(sc);

	/* prevent management frames from being sent if we're not ready */
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	+ if (!(sc->sc_flags & RT2560_F_RUNNING)) {
	RAL_UNLOCK(sc);
	m_freem(m);
	ieee80211_free_node(ni);
	return ENETDOWN;
	}
	if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- sc->sc_flags \|= RT2560_F_PRIO_OACTIVE;
	RAL_UNLOCK(sc);
	m_freem(m);
	ieee80211_free_node(ni);
	return ENOBUFS; /* XXX */
	}

	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	-
	if (params == NULL) {
	/*
	* Legacy path; interpret frame contents to decide
	@@ -2820,7 +2750,6 @@

	return 0;
	bad:
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	ieee80211_free_node(ni);
	RAL_UNLOCK(sc);
	return EIO; /* XXX */
	Index: sys/dev/ral/rt2560var.h
	===================================================================
	--- sys/dev/ral/rt2560var.h
	+++ sys/dev/ral/rt2560var.h
	@@ -105,13 +105,13 @@
	#define RT2560_VAP(vap) ((struct rt2560_vap *)(vap))

	struct rt2560_softc {
	- struct ifnet *sc_ifp;
	+ struct ieee80211com sc_ic;
	+ struct mtx sc_mtx;
	+ struct mbufq sc_snd;
	device_t sc_dev;
	bus_space_tag_t sc_st;
	bus_space_handle_t sc_sh;

	- struct mtx sc_mtx;
	-
	struct callout watchdog_ch;

	int sc_tx_timer;
	@@ -152,8 +152,7 @@
	struct rt2560_tx_radiotap_header sc_txtap;
	int sc_txtap_len;
	#define RT2560_F_INPUT_RUNNING 0x1
	-#define RT2560_F_PRIO_OACTIVE 0x2
	-#define RT2560_F_DATA_OACTIVE 0x4
	+#define RT2560_F_RUNNING 0x2
	int sc_flags;
	};

	Index: sys/dev/ral/rt2661.c
	===================================================================
	--- sys/dev/ral/rt2661.c
	+++ sys/dev/ral/rt2661.c
	@@ -121,12 +121,12 @@
	struct ieee80211_node *, int);
	static int rt2661_tx_mgt(struct rt2661_softc , struct mbuf ,
	struct ieee80211_node *);
	-static void rt2661_start_locked(struct ifnet *);
	-static void rt2661_start(struct ifnet *);
	+static int rt2661_transmit(struct ieee80211com , struct mbuf );
	+static void rt2661_start(struct rt2661_softc *);
	static int rt2661_raw_xmit(struct ieee80211_node , struct mbuf ,
	const struct ieee80211_bpf_params *);
	static void rt2661_watchdog(void *);
	-static int rt2661_ioctl(struct ifnet *, u_long, caddr_t);
	+static void rt2661_parent(struct ieee80211com *);
	static void rt2661_bbp_write(struct rt2661_softc *, uint8_t,
	uint8_t);
	static uint8_t rt2661_bbp_read(struct rt2661_softc *, uint8_t);
	@@ -197,27 +197,19 @@
	rt2661_attach(device_t dev, int id)
	{
	struct rt2661_softc *sc = device_get_softc(dev);
	- struct ieee80211com *ic;
	- struct ifnet *ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t val;
	int error, ac, ntries;
	uint8_t bands;
	- uint8_t macaddr[IEEE80211_ADDR_LEN];

	sc->sc_id = id;
	sc->sc_dev = dev;

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(sc->sc_dev, "can not if_alloc()\n");
	- return ENOMEM;
	- }
	- ic = ifp->if_l2com;
	-
	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
	MTX_DEF \| MTX_RECURSE);

	callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
	+ mbufq_init(&sc->sc_snd, ifqmaxlen);

	/* wait for NIC to initialize */
	for (ntries = 0; ntries < 1000; ntries++) {
	@@ -233,7 +225,7 @@
	}

	/* retrieve RF rev. no and various other things from EEPROM */
	- rt2661_read_eeprom(sc, macaddr);
	+ rt2661_read_eeprom(sc, ic->ic_macaddr);

	device_printf(dev, "MAC/BBP RT%X, RF %s\n", val,
	rt2661_get_rf(sc->rf_rev));
	@@ -263,17 +255,6 @@
	goto fail3;
	}

	- ifp->if_softc = sc;
	- if_initname(ifp, device_get_name(dev), device_get_unit(dev));
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = rt2661_init;
	- ifp->if_ioctl = rt2661_ioctl;
	- ifp->if_start = rt2661_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	-
	- ic->ic_ifp = ifp;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(dev);
	ic->ic_opmode = IEEE80211_M_STA;
	@@ -305,7 +286,7 @@
	setbit(&bands, IEEE80211_MODE_11A);
	ieee80211_init_channels(ic, NULL, &bands);

	- ieee80211_ifattach(ic, macaddr);
	+ ieee80211_ifattach(ic);
	#if 0
	ic->ic_wme.wme_update = rt2661_wme_update;
	#endif
	@@ -315,7 +296,8 @@
	ic->ic_updateslot = rt2661_update_slot;
	ic->ic_update_promisc = rt2661_update_promisc;
	ic->ic_raw_xmit = rt2661_raw_xmit;
	-
	+ ic->ic_transmit = rt2661_transmit;
	+ ic->ic_parent = rt2661_parent;
	ic->ic_vap_create = rt2661_vap_create;
	ic->ic_vap_delete = rt2661_vap_delete;

	@@ -339,7 +321,6 @@
	fail2: while (--ac >= 0)
	rt2661_free_tx_ring(sc, &sc->txq[ac]);
	fail1: mtx_destroy(&sc->sc_mtx);
	- if_free(ifp);
	return error;
	}

	@@ -347,14 +328,14 @@
	rt2661_detach(void *xsc)
	{
	struct rt2661_softc *sc = xsc;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	RAL_LOCK(sc);
	rt2661_stop_locked(sc);
	RAL_UNLOCK(sc);

	ieee80211_ifdetach(ic);
	+ mbufq_drain(&sc->sc_snd);

	rt2661_free_tx_ring(sc, &sc->txq[0]);
	rt2661_free_tx_ring(sc, &sc->txq[1]);
	@@ -363,8 +344,6 @@
	rt2661_free_tx_ring(sc, &sc->mgtq);
	rt2661_free_rx_ring(sc, &sc->rxq);

	- if_free(ifp);
	-
	mtx_destroy(&sc->sc_mtx);

	return 0;
	@@ -376,7 +355,7 @@
	const uint8_t bssid[IEEE80211_ADDR_LEN],
	const uint8_t mac[IEEE80211_ADDR_LEN])
	{
	- struct ifnet *ifp = ic->ic_ifp;
	+ struct rt2661_softc *sc = ic->ic_softc;
	struct rt2661_vap *rvp;
	struct ieee80211vap *vap;

	@@ -389,7 +368,7 @@
	case IEEE80211_M_MBSS:
	/* XXXRP: TBD */
	if (!TAILQ_EMPTY(&ic->ic_vaps)) {
	- if_printf(ifp, "only 1 vap supported\n");
	+ device_printf(sc->sc_dev, "only 1 vap supported\n");
	return NULL;
	}
	if (opmode == IEEE80211_M_STA)
	@@ -398,7 +377,8 @@
	case IEEE80211_M_WDS:
	if (TAILQ_EMPTY(&ic->ic_vaps) \|\|
	ic->ic_opmode != IEEE80211_M_HOSTAP) {
	- if_printf(ifp, "wds only supported in ap mode\n");
	+ device_printf(sc->sc_dev,
	+ "wds only supported in ap mode\n");
	return NULL;
	}
	/*
	@@ -409,15 +389,12 @@
	flags &= ~IEEE80211_CLONE_BSSID;
	break;
	default:
	- if_printf(ifp, "unknown opmode %d\n", opmode);
	+ device_printf(sc->sc_dev, "unknown opmode %d\n", opmode);
	return NULL;
	}
	- rvp = (struct rt2661_vap *) malloc(sizeof(struct rt2661_vap),
	- M_80211_VAP, M_NOWAIT \| M_ZERO);
	- if (rvp == NULL)
	- return NULL;
	+ rvp = malloc(sizeof(struct rt2661_vap), M_80211_VAP, M_WAITOK \| M_ZERO);
	vap = &rvp->ral_vap;
	- ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
	+ ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);

	/* override state transition machine */
	rvp->ral_newstate = vap->iv_newstate;
	@@ -428,7 +405,8 @@

	ieee80211_ratectl_init(vap);
	/* complete setup */
	- ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
	+ ieee80211_vap_attach(vap, ieee80211_media_change,
	+ ieee80211_media_status, mac);
	if (TAILQ_FIRST(&ic->ic_vaps) == vap)
	ic->ic_opmode = opmode;
	return vap;
	@@ -464,9 +442,8 @@
	rt2661_resume(void *xsc)
	{
	struct rt2661_softc *sc = xsc;
	- struct ifnet *ifp = sc->sc_ifp;

	- if (ifp->if_flags & IFF_UP)
	+ if (sc->sc_ic.ic_nrunning > 0)
	rt2661_init(sc);
	}

	@@ -770,7 +747,7 @@
	{
	struct rt2661_vap *rvp = RT2661_VAP(vap);
	struct ieee80211com *ic = vap->iv_ic;
	- struct rt2661_softc *sc = ic->ic_ifp->if_softc;
	+ struct rt2661_softc *sc = ic->ic_softc;
	int error;

	if (nstate == IEEE80211_S_INIT && vap->iv_state == IEEE80211_S_RUN) {
	@@ -869,11 +846,10 @@
	static void
	rt2661_tx_intr(struct rt2661_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct rt2661_tx_ring *txq;
	struct rt2661_tx_data *data;
	uint32_t val;
	- int qid, retrycnt;
	+ int error, qid, retrycnt;
	struct ieee80211vap *vap;

	for (;;) {
	@@ -911,7 +887,7 @@
	ieee80211_ratectl_tx_complete(vap, ni,
	IEEE80211_RATECTL_TX_SUCCESS,
	&retrycnt, NULL);
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	+ error = 0;
	break;

	case RT2661_TX_RETRY_FAIL:
	@@ -923,14 +899,14 @@
	ieee80211_ratectl_tx_complete(vap, ni,
	IEEE80211_RATECTL_TX_FAILURE,
	&retrycnt, NULL);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ error = 1;
	break;

	default:
	/* other failure */
	device_printf(sc->sc_dev,
	"sending data frame failed 0x%08x\n", val);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ error = 1;
	}

	DPRINTFN(sc, 15, "tx done q=%d idx=%u\n", qid, txq->stat);
	@@ -939,17 +915,12 @@
	if (++txq->stat >= txq->count) /* faster than % count */
	txq->stat = 0;

	- if (m->m_flags & M_TXCB)
	- ieee80211_process_callback(ni, m,
	- RT2661_TX_RESULT(val) != RT2661_TX_SUCCESS);
	- m_freem(m);
	- ieee80211_free_node(ni);
	+ ieee80211_tx_complete(ni, m, error);
	}

	sc->sc_tx_timer = 0;
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;

	- rt2661_start_locked(ifp);
	+ rt2661_start(sc);
	}

	static void
	@@ -987,8 +958,7 @@
	static void
	rt2661_rx_intr(struct rt2661_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct rt2661_rx_desc *desc;
	struct rt2661_rx_data *data;
	bus_addr_t physaddr;
	@@ -1017,12 +987,12 @@
	*/
	DPRINTFN(sc, 5, "PHY or CRC error flags 0x%08x\n",
	le32toh(desc->flags));
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	if ((le32toh(desc->flags) & RT2661_RX_CIPHER_MASK) != 0) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	@@ -1035,7 +1005,7 @@
	*/
	mnew = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
	if (mnew == NULL) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	@@ -1058,7 +1028,7 @@
	panic("%s: could not load old rx mbuf",
	device_get_name(sc->sc_dev));
	}
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	@@ -1071,7 +1041,6 @@
	desc->physaddr = htole32(physaddr);

	/* finalize mbuf */
	- m->m_pkthdr.rcvif = ifp;
	m->m_pkthdr.len = m->m_len =
	(le32toh(desc->flags) >> 16) & 0xfff;

	@@ -1156,7 +1125,6 @@
	rt2661_intr(void *arg)
	{
	struct rt2661_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t r1, r2;

	RAL_LOCK(sc);
	@@ -1166,7 +1134,7 @@
	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);

	/* don't re-enable interrupts if we're shutting down */
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	+ if (!(sc->sc_flags & RAL_RUNNING)) {
	RAL_UNLOCK(sc);
	return;
	}
	@@ -1242,8 +1210,7 @@
	uint32_t flags, uint16_t xflags, int len, int rate,
	const bus_dma_segment_t *segs, int nsegs, int ac)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint16_t plcp_length;
	int i, remainder;

	@@ -1461,8 +1428,7 @@
	struct ieee80211_node *ni, int ac)
	{
	struct ieee80211vap *vap = ni->ni_vap;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct rt2661_tx_ring *txq = &sc->txq[ac];
	struct rt2661_tx_desc *desc;
	struct rt2661_tx_data *data;
	@@ -1604,10 +1570,31 @@
	return 0;
	}

	+static int
	+rt2661_transmit(struct ieee80211com ic, struct mbuf m)
	+{
	+ struct rt2661_softc *sc = ic->ic_softc;
	+ int error;
	+
	+ RAL_LOCK(sc);
	+ if ((sc->sc_flags & RAL_RUNNING) == 0) {
	+ RAL_UNLOCK(sc);
	+ return (ENXIO);
	+ }
	+ error = mbufq_enqueue(&sc->sc_snd, m);
	+ if (error) {
	+ RAL_UNLOCK(sc);
	+ return (error);
	+ }
	+ rt2661_start(sc);
	+ RAL_UNLOCK(sc);
	+
	+ return (0);
	+}
	+
	static void
	-rt2661_start_locked(struct ifnet *ifp)
	+rt2661_start(struct rt2661_softc *sc)
	{
	- struct rt2661_softc *sc = ifp->if_softc;
	struct mbuf *m;
	struct ieee80211_node *ni;
	int ac;
	@@ -1615,69 +1602,50 @@
	RAL_LOCK_ASSERT(sc);

	/* prevent management frames from being sent if we're not ready */
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING) \|\| sc->sc_invalid)
	+ if (!(sc->sc_flags & RAL_RUNNING) \|\| sc->sc_invalid)
	return;

	- for (;;) {
	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
	- if (m == NULL)
	- break;
	-
	+ while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
	ac = M_WME_GETAC(m);
	if (sc->txq[ac].queued >= RT2661_TX_RING_COUNT - 1) {
	/* there is no place left in this ring */
	- IFQ_DRV_PREPEND(&ifp->if_snd, m);
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	+ mbufq_prepend(&sc->sc_snd, m);
	break;
	}
	ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
	if (rt2661_tx_data(sc, m, ni, ac) != 0) {
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	break;
	}
	-
	sc->sc_tx_timer = 5;
	}
	}

	-static void
	-rt2661_start(struct ifnet *ifp)
	-{
	- struct rt2661_softc *sc = ifp->if_softc;
	-
	- RAL_LOCK(sc);
	- rt2661_start_locked(ifp);
	- RAL_UNLOCK(sc);
	-}
	-
	static int
	rt2661_raw_xmit(struct ieee80211_node ni, struct mbuf m,
	const struct ieee80211_bpf_params *params)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2661_softc *sc = ifp->if_softc;
	+ struct rt2661_softc *sc = ic->ic_softc;

	RAL_LOCK(sc);

	/* prevent management frames from being sent if we're not ready */
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	+ if (!(sc->sc_flags & RAL_RUNNING)) {
	RAL_UNLOCK(sc);
	m_freem(m);
	ieee80211_free_node(ni);
	return ENETDOWN;
	}
	if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	RAL_UNLOCK(sc);
	m_freem(m);
	ieee80211_free_node(ni);
	return ENOBUFS; /* XXX */
	}

	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	-
	/*
	* Legacy path; interpret frame contents to decide
	* precisely how to send the frame.
	@@ -1691,7 +1659,6 @@

	return 0;
	bad:
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	ieee80211_free_node(ni);
	RAL_UNLOCK(sc);
	return EIO; /* XXX */
	@@ -1701,61 +1668,42 @@
	rt2661_watchdog(void *arg)
	{
	struct rt2661_softc sc = (struct rt2661_softc )arg;
	- struct ifnet *ifp = sc->sc_ifp;

	RAL_LOCK_ASSERT(sc);

	- KASSERT(ifp->if_drv_flags & IFF_DRV_RUNNING, ("not running"));
	+ KASSERT(sc->sc_flags & RAL_RUNNING, ("not running"));

	if (sc->sc_invalid) /* card ejected */
	return;

	if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
	- if_printf(ifp, "device timeout\n");
	+ device_printf(sc->sc_dev, "device timeout\n");
	rt2661_init_locked(sc);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ counter_u64_add(sc->sc_ic.ic_oerrors, 1);
	/* NB: callout is reset in rt2661_init() */
	return;
	}
	callout_reset(&sc->watchdog_ch, hz, rt2661_watchdog, sc);
	}

	-static int
	-rt2661_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+static void
	+rt2661_parent(struct ieee80211com *ic)
	{
	- struct rt2661_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ifreq ifr = (struct ifreq ) data;
	- int error = 0, startall = 0;
	+ struct rt2661_softc *sc = ic->ic_softc;
	+ int startall = 0;

	- switch (cmd) {
	- case SIOCSIFFLAGS:
	- RAL_LOCK(sc);
	- if (ifp->if_flags & IFF_UP) {
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	- rt2661_init_locked(sc);
	- startall = 1;
	- } else
	- rt2661_update_promisc(ic);
	- } else {
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- rt2661_stop_locked(sc);
	- }
	- RAL_UNLOCK(sc);
	- if (startall)
	- ieee80211_start_all(ic);
	- break;
	- case SIOCGIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- case SIOCGIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	- default:
	- error = EINVAL;
	- break;
	- }
	- return error;
	+ RAL_LOCK(sc);
	+ if (ic->ic_nrunning > 0) {
	+ if ((sc->sc_flags & RAL_RUNNING) == 0) {
	+ rt2661_init_locked(sc);
	+ startall = 1;
	+ } else
	+ rt2661_update_promisc(ic);
	+ } else if (sc->sc_flags & RAL_RUNNING)
	+ rt2661_stop_locked(sc);
	+ RAL_UNLOCK(sc);
	+ if (startall)
	+ ieee80211_start_all(ic);
	}

	static void
	@@ -1879,8 +1827,7 @@
	static void
	rt2661_enable_mrr(struct rt2661_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp;

	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
	@@ -1896,8 +1843,7 @@
	static void
	rt2661_set_txpreamble(struct rt2661_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp;

	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
	@@ -1914,8 +1860,7 @@
	const struct ieee80211_rateset *rs)
	{
	#define RV(r) ((r) & IEEE80211_RATE_VAL)
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t mask = 0;
	uint8_t rate;
	int i;
	@@ -1984,8 +1929,7 @@
	static void
	rt2661_set_chan(struct rt2661_softc sc, struct ieee80211_channel c)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	const struct rfprog *rfprog;
	uint8_t bbp3, bbp94 = RT2661_BBPR94_DEFAULT;
	int8_t power;
	@@ -2088,13 +2032,13 @@
	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);

	tmp &= ~RT2661_DROP_NOT_TO_ME;
	- if (!(ic->ic_ifp->if_flags & IFF_PROMISC))
	+ if (ic->ic_promisc == 0)
	tmp \|= RT2661_DROP_NOT_TO_ME;

	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);

	DPRINTF(sc, "%s promiscuous mode\n",
	- (ic->ic_ifp->if_flags & IFF_PROMISC) ? "entering" : "leaving");
	+ (ic->ic_promisc > 0) ? "entering" : "leaving");
	}

	/*
	@@ -2103,7 +2047,7 @@
	static int
	rt2661_wme_update(struct ieee80211com *ic)
	{
	- struct rt2661_softc *sc = ic->ic_ifp->if_softc;
	+ struct rt2661_softc *sc = ic->ic_softc;
	const struct wmeParams *wmep;

	wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
	@@ -2301,8 +2245,8 @@
	rt2661_init_locked(struct rt2661_softc *sc)
	{
	#define N(a) (sizeof (a) / sizeof ((a)[0]))
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	+ struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t tmp, sta[3];
	int i, error, ntries;

	@@ -2311,7 +2255,7 @@
	if ((sc->sc_flags & RAL_FW_LOADED) == 0) {
	error = rt2661_load_microcode(sc);
	if (error != 0) {
	- if_printf(ifp,
	+ device_printf(sc->sc_dev,
	"%s: could not load 8051 microcode, error %d\n",
	__func__, error);
	return;
	@@ -2364,7 +2308,7 @@
	for (i = 0; i < N(rt2661_def_mac); i++)
	RAL_WRITE(sc, rt2661_def_mac[i].reg, rt2661_def_mac[i].val);

	- rt2661_set_macaddr(sc, IF_LLADDR(ifp));
	+ rt2661_set_macaddr(sc, vap ? vap->iv_myaddr : ic->ic_macaddr);

	/* set host ready */
	RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
	@@ -2403,7 +2347,7 @@
	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
	ic->ic_opmode != IEEE80211_M_MBSS)
	tmp \|= RT2661_DROP_TODS;
	- if (!(ifp->if_flags & IFF_PROMISC))
	+ if (ic->ic_promisc == 0)
	tmp \|= RT2661_DROP_NOT_TO_ME;
	}

	@@ -2425,8 +2369,7 @@
	/* kick Rx */
	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 1);

	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	+ sc->sc_flags \|= RAL_RUNNING;

	callout_reset(&sc->watchdog_ch, hz, rt2661_watchdog, sc);
	#undef N
	@@ -2436,23 +2379,21 @@
	rt2661_init(void *priv)
	{
	struct rt2661_softc *sc = priv;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	RAL_LOCK(sc);
	rt2661_init_locked(sc);
	RAL_UNLOCK(sc);

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	+ if (sc->sc_flags & RAL_RUNNING)
	ieee80211_start_all(ic); /* start all vap's */
	}

	void
	rt2661_stop_locked(struct rt2661_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- uint32_t tmp;
	volatile int *flags = &sc->sc_flags;
	+ uint32_t tmp;

	while (*flags & RAL_INPUT_RUNNING)
	msleep(sc, &sc->sc_mtx, 0, "ralrunning", hz/10);
	@@ -2460,8 +2401,8 @@
	callout_stop(&sc->watchdog_ch);
	sc->sc_tx_timer = 0;

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	+ if (sc->sc_flags & RAL_RUNNING) {
	+ sc->sc_flags &= ~RAL_RUNNING;

	/* abort Tx (for all 5 Tx rings) */
	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 0x1f << 16);
	@@ -2505,7 +2446,6 @@
	static int
	rt2661_load_microcode(struct rt2661_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	const struct firmware *fp;
	const char *imagename;
	int ntries, error;
	@@ -2517,7 +2457,7 @@
	case 0x0302: imagename = "rt2561fw"; break;
	case 0x0401: imagename = "rt2661fw"; break;
	default:
	- if_printf(ifp, "%s: unexpected pci device id 0x%x, "
	+ device_printf(sc->sc_dev, "%s: unexpected pci device id 0x%x, "
	"don't know how to retrieve firmware\n",
	__func__, sc->sc_id);
	return EINVAL;
	@@ -2526,7 +2466,8 @@
	fp = firmware_get(imagename);
	RAL_LOCK(sc);
	if (fp == NULL) {
	- if_printf(ifp, "%s: unable to retrieve firmware image %s\n",
	+ device_printf(sc->sc_dev,
	+ "%s: unable to retrieve firmware image %s\n",
	__func__, imagename);
	return EINVAL;
	}
	@@ -2557,8 +2498,8 @@
	DELAY(100);
	}
	if (ntries == 500) {
	- if_printf(ifp, "%s: timeout waiting for MCU to initialize\n",
	- __func__);
	+ device_printf(sc->sc_dev,
	+ "%s: timeout waiting for MCU to initialize\n", __func__);
	error = EIO;
	} else
	error = 0;
	@@ -2726,8 +2667,7 @@
	static void
	rt2661_enable_tsf_sync(struct rt2661_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t tmp;

	@@ -2811,21 +2751,19 @@
	static void
	rt2661_scan_start(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2661_softc *sc = ifp->if_softc;
	+ struct rt2661_softc *sc = ic->ic_softc;
	uint32_t tmp;

	/* abort TSF synchronization */
	tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
	RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0xffffff);
	- rt2661_set_bssid(sc, ifp->if_broadcastaddr);
	+ rt2661_set_bssid(sc, ieee80211broadcastaddr);
	}

	static void
	rt2661_scan_end(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2661_softc *sc = ifp->if_softc;
	+ struct rt2661_softc *sc = ic->ic_softc;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	rt2661_enable_tsf_sync(sc);
	@@ -2836,8 +2774,7 @@
	static void
	rt2661_set_channel(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2661_softc *sc = ifp->if_softc;
	+ struct rt2661_softc *sc = ic->ic_softc;

	RAL_LOCK(sc);
	rt2661_set_chan(sc, ic->ic_curchan);
	Index: sys/dev/ral/rt2661var.h
	===================================================================
	--- sys/dev/ral/rt2661var.h
	+++ sys/dev/ral/rt2661var.h
	@@ -97,13 +97,13 @@
	#define RT2661_VAP(vap) ((struct rt2661_vap *)(vap))

	struct rt2661_softc {
	- struct ifnet *sc_ifp;
	+ struct ieee80211com sc_ic;
	+ struct mtx sc_mtx;
	+ struct mbufq sc_snd;
	device_t sc_dev;
	bus_space_tag_t sc_st;
	bus_space_handle_t sc_sh;

	- struct mtx sc_mtx;
	-
	struct callout watchdog_ch;

	int sc_tx_timer;
	@@ -117,6 +117,7 @@
	int sc_flags;
	#define RAL_FW_LOADED 0x1
	#define RAL_INPUT_RUNNING 0x2
	+#define RAL_RUNNING 0x4
	int sc_id;
	struct ieee80211_channel *sc_curchan;

	Index: sys/dev/ral/rt2860.c
	===================================================================
	--- sys/dev/ral/rt2860.c
	+++ sys/dev/ral/rt2860.c
	@@ -122,10 +122,10 @@
	static int rt2860_tx_raw(struct rt2860_softc , struct mbuf ,
	struct ieee80211_node *,
	const struct ieee80211_bpf_params *params);
	-static void rt2860_start(struct ifnet *);
	-static void rt2860_start_locked(struct ifnet *);
	+static int rt2860_transmit(struct ieee80211com , struct mbuf );
	+static void rt2860_start(struct rt2860_softc *);
	static void rt2860_watchdog(void *);
	-static int rt2860_ioctl(struct ifnet *, u_long, caddr_t);
	+static void rt2860_parent(struct ieee80211com *);
	static void rt2860_mcu_bbp_write(struct rt2860_softc *, uint8_t, uint8_t);
	static uint8_t rt2860_mcu_bbp_read(struct rt2860_softc *, uint8_t);
	static void rt2860_rf_write(struct rt2860_softc *, uint8_t, uint32_t);
	@@ -156,7 +156,7 @@
	static void rt2860_set_macaddr(struct rt2860_softc , const uint8_t );
	static void rt2860_update_promisc(struct ieee80211com *);
	static void rt2860_updateslot(struct ieee80211com *);
	-static void rt2860_updateprot(struct ifnet *);
	+static void rt2860_updateprot(struct rt2860_softc *);
	static int rt2860_updateedca(struct ieee80211com *);
	#ifdef HW_CRYPTO
	static int rt2860_set_key(struct ieee80211com , struct ieee80211_node ,
	@@ -230,27 +230,19 @@
	rt2860_attach(device_t dev, int id)
	{
	struct rt2860_softc *sc = device_get_softc(dev);
	- struct ieee80211com *ic;
	- struct ifnet *ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp;
	int error, ntries, qid;
	uint8_t bands;
	- uint8_t macaddr[IEEE80211_ADDR_LEN];

	sc->sc_dev = dev;
	sc->sc_debug = 0;

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(sc->sc_dev, "can not if_alloc()\n");
	- return ENOMEM;
	- }
	- ic = ifp->if_l2com;
	-
	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
	MTX_DEF \| MTX_RECURSE);

	callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
	+ mbufq_init(&sc->sc_snd, ifqmaxlen);

	/* wait for NIC to initialize */
	for (ntries = 0; ntries < 100; ntries++) {
	@@ -273,11 +265,11 @@
	sc->sc_flags \|= RT2860_ADVANCED_PS;

	/* retrieve RF rev. no and various other things from EEPROM */
	- rt2860_read_eeprom(sc, macaddr);
	+ rt2860_read_eeprom(sc, ic->ic_macaddr);
	device_printf(sc->sc_dev, "MAC/BBP RT%X (rev 0x%04X), "
	"RF %s (MIMO %dT%dR), address %6D\n",
	sc->mac_ver, sc->mac_rev, rt2860_get_rf(sc->rf_rev),
	- sc->ntxchains, sc->nrxchains, macaddr, ":");
	+ sc->ntxchains, sc->nrxchains, ic->ic_macaddr, ":");

	/*
	* Allocate Tx (4 EDCAs + HCCA + Mgt) and Rx rings.
	@@ -304,17 +296,6 @@
	sc->mgtqid = (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) ?
	WME_AC_VO : 5;

	- ifp->if_softc = sc;
	- if_initname(ifp, device_get_name(dev), device_get_unit(dev));
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = rt2860_init;
	- ifp->if_ioctl = rt2860_ioctl;
	- ifp->if_start = rt2860_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	-
	- ic->ic_ifp = ifp;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(dev);
	ic->ic_opmode = IEEE80211_M_STA;
	@@ -345,7 +326,7 @@
	setbit(&bands, IEEE80211_MODE_11A);
	ieee80211_init_channels(ic, NULL, &bands);

	- ieee80211_ifattach(ic, macaddr);
	+ ieee80211_ifattach(ic);

	ic->ic_wme.wme_update = rt2860_updateedca;
	ic->ic_scan_start = rt2860_scan_start;
	@@ -357,7 +338,8 @@
	sc->sc_node_free = ic->ic_node_free;
	ic->ic_node_free = rt2860_node_free;
	ic->ic_newassoc = rt2860_newassoc;
	-
	+ ic->ic_transmit = rt2860_transmit;
	+ ic->ic_parent = rt2860_parent;
	ic->ic_vap_create = rt2860_vap_create;
	ic->ic_vap_delete = rt2860_vap_delete;

	@@ -381,7 +363,6 @@
	fail2: while (--qid >= 0)
	rt2860_free_tx_ring(sc, &sc->txq[qid]);
	fail1: mtx_destroy(&sc->sc_mtx);
	- if_free(ifp);
	return error;
	}

	@@ -389,8 +370,7 @@
	rt2860_detach(void *xsc)
	{
	struct rt2860_softc *sc = xsc;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int qid;

	RAL_LOCK(sc);
	@@ -398,14 +378,12 @@
	RAL_UNLOCK(sc);

	ieee80211_ifdetach(ic);
	-
	+ mbufq_drain(&sc->sc_snd);
	for (qid = 0; qid < 6; qid++)
	rt2860_free_tx_ring(sc, &sc->txq[qid]);
	rt2860_free_rx_ring(sc, &sc->rxq);
	rt2860_free_tx_pool(sc);

	- if_free(ifp);
	-
	mtx_destroy(&sc->sc_mtx);

	return 0;
	@@ -431,9 +409,8 @@
	rt2860_resume(void *xsc)
	{
	struct rt2860_softc *sc = xsc;
	- struct ifnet *ifp = sc->sc_ifp;

	- if (ifp->if_flags & IFF_UP)
	+ if (sc->sc_ic.ic_nrunning > 0)
	rt2860_init(sc);
	}

	@@ -443,7 +420,7 @@
	const uint8_t bssid[IEEE80211_ADDR_LEN],
	const uint8_t mac[IEEE80211_ADDR_LEN])
	{
	- struct ifnet *ifp = ic->ic_ifp;
	+ struct rt2860_softc *sc = ic->ic_softc;
	struct rt2860_vap *rvp;
	struct ieee80211vap *vap;

	@@ -456,7 +433,7 @@
	case IEEE80211_M_MBSS:
	/* XXXRP: TBD */
	if (!TAILQ_EMPTY(&ic->ic_vaps)) {
	- if_printf(ifp, "only 1 vap supported\n");
	+ device_printf(sc->sc_dev, "only 1 vap supported\n");
	return NULL;
	}
	if (opmode == IEEE80211_M_STA)
	@@ -465,7 +442,8 @@
	case IEEE80211_M_WDS:
	if (TAILQ_EMPTY(&ic->ic_vaps) \|\|
	ic->ic_opmode != IEEE80211_M_HOSTAP) {
	- if_printf(ifp, "wds only supported in ap mode\n");
	+ device_printf(sc->sc_dev,
	+ "wds only supported in ap mode\n");
	return NULL;
	}
	/*
	@@ -476,14 +454,12 @@
	flags &= ~IEEE80211_CLONE_BSSID;
	break;
	default:
	- if_printf(ifp, "unknown opmode %d\n", opmode);
	+ device_printf(sc->sc_dev, "unknown opmode %d\n", opmode);
	return NULL;
	}
	- rvp = malloc(sizeof(struct rt2860_vap), M_80211_VAP, M_NOWAIT \| M_ZERO);
	- if (rvp == NULL)
	- return NULL;
	+ rvp = malloc(sizeof(struct rt2860_vap), M_80211_VAP, M_WAITOK \| M_ZERO);
	vap = &rvp->ral_vap;
	- ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
	+ ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);

	/* override state transition machine */
	rvp->ral_newstate = vap->iv_newstate;
	@@ -497,7 +473,8 @@

	ieee80211_ratectl_init(vap);
	/* complete setup */
	- ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
	+ ieee80211_vap_attach(vap, ieee80211_media_change,
	+ ieee80211_media_status, mac);
	if (TAILQ_FIRST(&ic->ic_vaps) == vap)
	ic->ic_opmode = opmode;
	return vap;
	@@ -829,7 +806,7 @@
	static void
	rt2860_updatestats(struct rt2860_softc *sc)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	/*
	* In IBSS or HostAP modes (when the hardware sends beacons), the
	@@ -856,7 +833,7 @@
	rt2860_newassoc(struct ieee80211_node *ni, int isnew)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct rt2860_softc *sc = ic->ic_ifp->if_softc;
	+ struct rt2860_softc *sc = ic->ic_softc;
	uint8_t wcid;

	wcid = IEEE80211_AID(ni->ni_associd);
	@@ -875,7 +852,7 @@
	rt2860_node_free(struct ieee80211_node *ni)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct rt2860_softc *sc = ic->ic_ifp->if_softc;
	+ struct rt2860_softc *sc = ic->ic_softc;
	uint8_t wcid;

	if (ni->ni_associd != 0) {
	@@ -923,7 +900,7 @@
	{
	struct rt2860_vap *rvp = RT2860_VAP(vap);
	struct ieee80211com *ic = vap->iv_ic;
	- struct rt2860_softc *sc = ic->ic_ifp->if_softc;
	+ struct rt2860_softc *sc = ic->ic_softc;
	uint32_t tmp;
	int error;

	@@ -1101,7 +1078,6 @@
	static void
	rt2860_drain_stats_fifo(struct rt2860_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct ieee80211_node *ni;
	uint32_t stat;
	int retrycnt;
	@@ -1137,7 +1113,8 @@
	} else {
	ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
	IEEE80211_RATECTL_TX_FAILURE, &retrycnt, NULL);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	}
	}
	}
	@@ -1145,7 +1122,6 @@
	static void
	rt2860_tx_intr(struct rt2860_softc *sc, int qid)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct rt2860_tx_ring *ring = &sc->txq[qid];
	uint32_t hw;

	@@ -1163,15 +1139,11 @@
	ieee80211_process_callback(data->ni, data->m,
	0);
	}
	- m_freem(data->m);
	- ieee80211_free_node(data->ni);
	- data->m = NULL;
	+ ieee80211_tx_complete(data->ni, data->m, 0);
	data->ni = NULL;
	-
	+ data->m = NULL;
	SLIST_INSERT_HEAD(&sc->data_pool, data, next);
	ring->data[ring->next] = NULL;
	-
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	}
	ring->queued--;
	ring->next = (ring->next + 1) % RT2860_TX_RING_COUNT;
	@@ -1180,8 +1152,7 @@
	sc->sc_tx_timer = 0;
	if (ring->queued < RT2860_TX_RING_COUNT)
	sc->qfullmsk &= ~(1 << qid);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- rt2860_start_locked(ifp);
	+ rt2860_start(sc);
	}

	/*
	@@ -1206,8 +1177,7 @@
	rt2860_rx_intr(struct rt2860_softc *sc)
	{
	struct rt2860_rx_radiotap_header *tap;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_frame *wh;
	struct ieee80211_node *ni;
	struct mbuf m, m1;
	@@ -1234,7 +1204,7 @@

	if (__predict_false(rxd->flags &
	htole32(RT2860_RX_CRCERR \| RT2860_RX_ICVERR))) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	@@ -1243,14 +1213,14 @@
	/* report MIC failures to net80211 for TKIP */
	ic->ic_stats.is_rx_locmicfail++;
	ieee80211_michael_mic_failure(ic, 0/* XXX */);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}
	#endif

	m1 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
	if (__predict_false(m1 == NULL)) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	@@ -1274,7 +1244,7 @@
	}
	/* physical address may have changed */
	rxd->sdp0 = htole32(physaddr);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto skip;
	}

	@@ -1289,7 +1259,6 @@
	rxwi = mtod(m, struct rt2860_rxwi *);

	/* finalize mbuf */
	- m->m_pkthdr.rcvif = ifp;
	m->m_data = (caddr_t)(rxwi + 1);
	m->m_pkthdr.len = m->m_len = le16toh(rxwi->len) & 0xfff;

	@@ -1399,7 +1368,7 @@
	#endif
	/* check if protection mode has changed */
	if ((sc->sc_ic_flags ^ ic->ic_flags) & IEEE80211_F_USEPROT) {
	- rt2860_updateprot(ic);
	+ rt2860_updateprot(sc);
	sc->sc_ic_flags = ic->ic_flags;
	}
	#endif
	@@ -1408,7 +1377,7 @@
	static void
	rt2860_gp_intr(struct rt2860_softc *sc)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	DPRINTFN(2, ("GP timeout state=%d\n", vap->iv_state));
	@@ -1480,8 +1449,7 @@
	static int
	rt2860_tx(struct rt2860_softc sc, struct mbuf m, struct ieee80211_node *ni)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = ni->ni_vap;
	struct rt2860_tx_ring *ring;
	struct rt2860_tx_data *data;
	@@ -1725,14 +1693,13 @@
	const struct ieee80211_bpf_params *params)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2860_softc *sc = ifp->if_softc;
	+ struct rt2860_softc *sc = ic->ic_softc;
	int error;

	RAL_LOCK(sc);

	/* prevent management frames from being sent if we're not ready */
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	+ if (!(sc->sc_flags & RT2860_RUNNNING)) {
	RAL_UNLOCK(sc);
	m_freem(m);
	ieee80211_free_node(ni);
	@@ -1754,7 +1721,6 @@
	if (error != 0) {
	/* NB: m is reclaimed on tx failure */
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	}
	sc->sc_tx_timer = 5;
	RAL_UNLOCK(sc);
	@@ -1765,8 +1731,7 @@
	rt2860_tx_raw(struct rt2860_softc sc, struct mbuf m,
	struct ieee80211_node ni, const struct ieee80211_bpf_params params)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = ni->ni_vap;
	struct rt2860_tx_ring *ring;
	struct rt2860_tx_data *data;
	@@ -1973,41 +1938,46 @@
	return 0;
	}

	-static void
	-rt2860_start(struct ifnet *ifp)
	+static int
	+rt2860_transmit(struct ieee80211com ic, struct mbuf m)
	{
	- struct rt2860_softc *sc = ifp->if_softc;
	+ struct rt2860_softc *sc = ic->ic_softc;
	+ int error;

	RAL_LOCK(sc);
	- rt2860_start_locked(ifp);
	+ if ((sc->sc_flags & RT2860_RUNNNING) == 0) {
	+ RAL_UNLOCK(sc);
	+ return (ENXIO);
	+ }
	+ error = mbufq_enqueue(&sc->sc_snd, m);
	+ if (error) {
	+ RAL_UNLOCK(sc);
	+ return (error);
	+ }
	+ rt2860_start(sc);
	RAL_UNLOCK(sc);
	+
	+ return (0);
	}

	static void
	-rt2860_start_locked(struct ifnet *ifp)
	+rt2860_start(struct rt2860_softc *sc)
	{
	- struct rt2860_softc *sc = ifp->if_softc;
	struct ieee80211_node *ni;
	struct mbuf *m;

	RAL_LOCK_ASSERT(sc);

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 \|\|
	- (ifp->if_drv_flags & IFF_DRV_OACTIVE))
	+ if ((sc->sc_flags & RT2860_RUNNNING) == 0)
	return;

	- for (;;) {
	- if (SLIST_EMPTY(&sc->data_pool) \|\| sc->qfullmsk != 0) {
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- break;
	- }
	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
	- if (m == NULL)
	- break;
	+ while (!SLIST_EMPTY(&sc->data_pool) && sc->qfullmsk == 0 &&
	+ (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
	if (rt2860_tx(sc, m, ni) != 0) {
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	continue;
	}
	sc->sc_tx_timer = 5;
	@@ -2018,61 +1988,42 @@
	rt2860_watchdog(void *arg)
	{
	struct rt2860_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;

	RAL_LOCK_ASSERT(sc);

	- KASSERT(ifp->if_drv_flags & IFF_DRV_RUNNING, ("not running"));
	+ KASSERT(sc->sc_flags & RT2860_RUNNNING, ("not running"));

	if (sc->sc_invalid) /* card ejected */
	return;

	if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
	- if_printf(ifp, "device timeout\n");
	+ device_printf(sc->sc_dev, "device timeout\n");
	rt2860_stop_locked(sc);
	rt2860_init_locked(sc);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ counter_u64_add(sc->sc_ic.ic_oerrors, 1);
	return;
	}
	callout_reset(&sc->watchdog_ch, hz, rt2860_watchdog, sc);
	}

	-static int
	-rt2860_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+static void
	+rt2860_parent(struct ieee80211com *ic)
	{
	- struct rt2860_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ifreq ifr = (struct ifreq )data;
	- int error = 0, startall = 0;
	+ struct rt2860_softc *sc = ic->ic_softc;
	+ int startall = 0;

	- switch (cmd) {
	- case SIOCSIFFLAGS:
	- RAL_LOCK(sc);
	- if (ifp->if_flags & IFF_UP) {
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	- rt2860_init_locked(sc);
	- startall = 1;
	- } else
	- rt2860_update_promisc(ic);
	- } else {
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- rt2860_stop_locked(sc);
	- }
	- RAL_UNLOCK(sc);
	- if (startall)
	- ieee80211_start_all(ic);
	- break;
	- case SIOCGIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- case SIOCSIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	- default:
	- error = EINVAL;
	- break;
	- }
	- return error;
	+ RAL_LOCK(sc);
	+ if (ic->ic_nrunning> 0) {
	+ if (!(sc->sc_flags & RT2860_RUNNNING)) {
	+ rt2860_init_locked(sc);
	+ startall = 1;
	+ } else
	+ rt2860_update_promisc(ic);
	+ } else if (sc->sc_flags & RT2860_RUNNNING)
	+ rt2860_stop_locked(sc);
	+ RAL_UNLOCK(sc);
	+ if (startall)
	+ ieee80211_start_all(ic);
	}

	/*
	@@ -2295,8 +2246,7 @@
	static void
	rt2860_set_txpreamble(struct rt2860_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp;

	tmp = RAL_READ(sc, RT2860_AUTO_RSP_CFG);
	@@ -2311,8 +2261,7 @@
	const struct ieee80211_rateset *rs)
	{
	#define RV(r) ((r) & IEEE80211_RATE_VAL)
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t mask = 0;
	uint8_t rate;
	int i;
	@@ -2333,8 +2282,7 @@
	static void
	rt2860_scan_start(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2860_softc *sc = ifp->if_softc;
	+ struct rt2860_softc *sc = ic->ic_softc;
	uint32_t tmp;

	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
	@@ -2347,8 +2295,7 @@
	static void
	rt2860_scan_end(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2860_softc *sc = ifp->if_softc;
	+ struct rt2860_softc *sc = ic->ic_softc;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	if (vap->iv_state == IEEE80211_S_RUN) {
	@@ -2360,8 +2307,7 @@
	static void
	rt2860_set_channel(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rt2860_softc *sc = ifp->if_softc;
	+ struct rt2860_softc *sc = ic->ic_softc;

	RAL_LOCK(sc);
	rt2860_switch_chan(sc, ic->ic_curchan);
	@@ -3113,10 +3059,9 @@
	}

	static void
	-rt2860_updateprot(struct ifnet *ifp)
	+rt2860_updateprot(struct rt2860_softc *sc)
	{
	- struct rt2860_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp;

	tmp = RT2860_RTSTH_EN \| RT2860_PROT_NAV_SHORT \| RT2860_TXOP_ALLOW_ALL;
	@@ -3145,7 +3090,7 @@

	tmp = RAL_READ(sc, RT2860_RX_FILTR_CFG);
	tmp &= ~RT2860_DROP_NOT_MYBSS;
	- if (!(ic->ic_ifp->if_flags & IFF_PROMISC))
	+ if (ic->ic_promisc == 0)
	tmp \|= RT2860_DROP_NOT_MYBSS;
	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
	}
	@@ -3153,7 +3098,7 @@
	static int
	rt2860_updateedca(struct ieee80211com *ic)
	{
	- struct rt2860_softc *sc = ic->ic_ifp->if_softc;
	+ struct rt2860_softc *sc = ic->ic_softc;
	const struct wmeParams *wmep;
	int aci;

	@@ -3325,8 +3270,7 @@
	static int8_t
	rt2860_rssi2dbm(struct rt2860_softc *sc, uint8_t rssi, uint8_t rxchain)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_channel *c = ic->ic_curchan;
	int delta;

	@@ -3801,8 +3745,7 @@
	static int
	rt2860_txrx_enable(struct rt2860_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp;
	int ntries;

	@@ -3848,22 +3791,21 @@
	rt2860_init(void *arg)
	{
	struct rt2860_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	RAL_LOCK(sc);
	rt2860_init_locked(sc);
	RAL_UNLOCK(sc);

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	+ if (sc->sc_flags & RT2860_RUNNNING)
	ieee80211_start_all(ic);
	}

	static void
	rt2860_init_locked(struct rt2860_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	+ struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t tmp;
	uint8_t bbp1, bbp3;
	int i, qid, ridx, ntries, error;
	@@ -3899,7 +3841,7 @@
	return;
	}

	- rt2860_set_macaddr(sc, IF_LLADDR(ifp));
	+ rt2860_set_macaddr(sc, vap ? vap->iv_myaddr : ic->ic_macaddr);

	/* init Tx power for all Tx rates (from EEPROM) */
	for (ridx = 0; ridx < 5; ridx++) {
	@@ -4096,7 +4038,7 @@
	RAL_WRITE(sc, RT2860_TX_RTS_CFG, tmp);

	/* setup initial protection mode */
	- rt2860_updateprot(ifp);
	+ rt2860_updateprot(sc);

	/* turn radio LED on */
	rt2860_set_leds(sc, RT2860_LED_RADIO);
	@@ -4115,8 +4057,7 @@
	if (sc->sc_flags & RT2860_ADVANCED_PS)
	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_PSLEVEL, sc->pslevel, 0);

	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	+ sc->sc_flags \|= RT2860_RUNNNING;

	callout_reset(&sc->watchdog_ch, hz, rt2860_watchdog, sc);
	}
	@@ -4134,16 +4075,15 @@
	static void
	rt2860_stop_locked(struct rt2860_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t tmp;
	int qid;

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	+ if (sc->sc_flags & RT2860_RUNNNING)
	rt2860_set_leds(sc, 0); /* turn all LEDs off */

	callout_stop(&sc->watchdog_ch);
	sc->sc_tx_timer = 0;
	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	+ sc->sc_flags &= ~RT2860_RUNNNING;

	/* disable interrupts */
	RAL_WRITE(sc, RT2860_INT_MASK, 0);
	@@ -4294,8 +4234,7 @@
	static void
	rt2860_switch_chan(struct rt2860_softc sc, struct ieee80211_channel c)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	u_int chan, group;

	chan = ieee80211_chan2ieee(ic, c);
	@@ -4364,8 +4303,7 @@
	static void
	rt2860_enable_tsf_sync(struct rt2860_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t tmp;

	Index: sys/dev/ral/rt2860var.h
	===================================================================
	--- sys/dev/ral/rt2860var.h
	+++ sys/dev/ral/rt2860var.h
	@@ -115,13 +115,13 @@
	#define RT2860_VAP(vap) ((struct rt2860_vap *)(vap))

	struct rt2860_softc {
	- struct ifnet *sc_ifp;
	+ struct ieee80211com sc_ic;
	+ struct mbufq sc_snd;
	+ struct mtx sc_mtx;
	device_t sc_dev;
	bus_space_tag_t sc_st;
	bus_space_handle_t sc_sh;

	- struct mtx sc_mtx;
	-
	struct callout watchdog_ch;

	int sc_invalid;
	@@ -139,6 +139,7 @@
	#define RT2860_ENABLED (1 << 0)
	#define RT2860_ADVANCED_PS (1 << 1)
	#define RT2860_PCIE (1 << 2)
	+#define RT2860_RUNNNING (1 << 3)

	struct ieee80211_node *wcid2ni[RT2860_WCID_MAX];

	Index: sys/dev/usb/wlan/if_rum.c
	===================================================================
	--- sys/dev/usb/wlan/if_rum.c
	+++ sys/dev/usb/wlan/if_rum.c
	@@ -175,8 +175,9 @@
	const struct ieee80211_bpf_params *);
	static int rum_tx_data(struct rum_softc , struct mbuf ,
	struct ieee80211_node *);
	-static void rum_start(struct ifnet *);
	-static int rum_ioctl(struct ifnet *, u_long, caddr_t);
	+static int rum_transmit(struct ieee80211com , struct mbuf );
	+static void rum_start(struct rum_softc *);
	+static void rum_parent(struct ieee80211com *);
	static void rum_eeprom_read(struct rum_softc , uint16_t, void ,
	int);
	static uint32_t rum_read(struct rum_softc *, uint16_t);
	@@ -198,7 +199,7 @@
	struct ieee80211_channel *);
	static void rum_enable_tsf_sync(struct rum_softc *);
	static void rum_enable_tsf(struct rum_softc *);
	-static void rum_update_slot(struct ifnet *);
	+static void rum_update_slot(struct rum_softc *);
	static void rum_set_bssid(struct rum_softc , const uint8_t );
	static void rum_set_macaddr(struct rum_softc , const uint8_t );
	static void rum_update_mcast(struct ieee80211com *);
	@@ -207,8 +208,7 @@
	static const char *rum_get_rf(int);
	static void rum_read_eeprom(struct rum_softc *);
	static int rum_bbp_init(struct rum_softc *);
	-static void rum_init_locked(struct rum_softc *);
	-static void rum_init(void *);
	+static void rum_init(struct rum_softc *);
	static void rum_stop(struct rum_softc *);
	static void rum_load_microcode(struct rum_softc , const uint8_t ,
	size_t);
	@@ -425,8 +425,7 @@
	{
	struct usb_attach_arg *uaa = device_get_ivars(self);
	struct rum_softc *sc = device_get_softc(self);
	- struct ieee80211com *ic;
	- struct ifnet *ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint8_t iface_index, bands;
	uint32_t tmp;
	int error, ntries;
	@@ -437,6 +436,7 @@

	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
	MTX_NETWORK_LOCK, MTX_DEF);
	+ mbufq_init(&sc->sc_snd, ifqmaxlen);

	iface_index = RT2573_IFACE_INDEX;
	error = usbd_transfer_setup(uaa->device, &iface_index,
	@@ -470,24 +470,6 @@
	rum_load_microcode(sc, rt2573_ucode, sizeof(rt2573_ucode));
	RUM_UNLOCK(sc);

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(sc->sc_dev, "can not if_alloc()\n");
	- goto detach;
	- }
	- ic = ifp->if_l2com;
	-
	- ifp->if_softc = sc;
	- if_initname(ifp, "rum", device_get_unit(sc->sc_dev));
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = rum_init;
	- ifp->if_ioctl = rum_ioctl;
	- ifp->if_start = rum_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	-
	- ic->ic_ifp = ifp;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(self);
	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
	@@ -512,13 +494,14 @@
	setbit(&bands, IEEE80211_MODE_11A);
	ieee80211_init_channels(ic, NULL, &bands);

	- ieee80211_ifattach(ic, sc->sc_bssid);
	+ ieee80211_ifattach(ic);
	ic->ic_update_promisc = rum_update_promisc;
	ic->ic_raw_xmit = rum_raw_xmit;
	ic->ic_scan_start = rum_scan_start;
	ic->ic_scan_end = rum_scan_end;
	ic->ic_set_channel = rum_set_channel;
	-
	+ ic->ic_transmit = rum_transmit;
	+ ic->ic_parent = rum_parent;
	ic->ic_vap_create = rum_vap_create;
	ic->ic_vap_delete = rum_vap_delete;
	ic->ic_update_mcast = rum_update_mcast;
	@@ -543,8 +526,6 @@
	rum_detach(device_t self)
	{
	struct rum_softc *sc = device_get_softc(self);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic;

	/* Prevent further ioctls */
	RUM_LOCK(sc);
	@@ -559,11 +540,9 @@
	rum_unsetup_tx_list(sc);
	RUM_UNLOCK(sc);

	- if (ifp) {
	- ic = ifp->if_l2com;
	- ieee80211_ifdetach(ic);
	- if_free(ifp);
	- }
	+ if (sc->sc_ic.ic_softc == sc)
	+ ieee80211_ifdetach(&sc->sc_ic);
	+ mbufq_drain(&sc->sc_snd);
	mtx_destroy(&sc->sc_mtx);
	return (0);
	}
	@@ -595,21 +574,18 @@
	const uint8_t bssid[IEEE80211_ADDR_LEN],
	const uint8_t mac[IEEE80211_ADDR_LEN])
	{
	- struct rum_softc *sc = ic->ic_ifp->if_softc;
	+ struct rum_softc *sc = ic->ic_softc;
	struct rum_vap *rvp;
	struct ieee80211vap *vap;

	if (!TAILQ_EMPTY(&ic->ic_vaps)) /* only one at a time */
	return NULL;
	- rvp = (struct rum_vap *) malloc(sizeof(struct rum_vap),
	- M_80211_VAP, M_NOWAIT \| M_ZERO);
	- if (rvp == NULL)
	- return NULL;
	+ rvp = malloc(sizeof(struct rum_vap), M_80211_VAP, M_WAITOK \| M_ZERO);
	vap = &rvp->vap;
	/* enable s/w bmiss handling for sta mode */

	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
	- flags \| IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
	+ flags \| IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
	/* out of memory */
	free(rvp, M_80211_VAP);
	return (NULL);
	@@ -624,7 +600,8 @@
	ieee80211_ratectl_init(vap);
	ieee80211_ratectl_setinterval(vap, 1000 /* 1 sec */);
	/* complete setup */
	- ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
	+ ieee80211_vap_attach(vap, ieee80211_media_change,
	+ ieee80211_media_status, mac);
	ic->ic_opmode = opmode;
	return vap;
	}
	@@ -648,13 +625,8 @@
	struct rum_softc *sc = data->sc;

	if (data->m != NULL) {
	- if (data->m->m_flags & M_TXCB)
	- ieee80211_process_callback(data->ni, data->m,
	- txerr ? ETIMEDOUT : 0);
	- m_freem(data->m);
	+ ieee80211_tx_complete(data->ni, data->m, txerr);
	data->m = NULL;
	-
	- ieee80211_free_node(data->ni);
	data->ni = NULL;
	}
	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
	@@ -711,7 +683,7 @@
	{
	struct rum_vap *rvp = RUM_VAP(vap);
	struct ieee80211com *ic = vap->iv_ic;
	- struct rum_softc *sc = ic->ic_ifp->if_softc;
	+ struct rum_softc *sc = ic->ic_softc;
	const struct ieee80211_txparam *tp;
	enum ieee80211_state ostate;
	struct ieee80211_node *ni;
	@@ -745,12 +717,12 @@
	ieee80211_free_node(ni);
	return (-1);
	}
	- rum_update_slot(ic->ic_ifp);
	+ rum_update_slot(sc);
	rum_enable_mrr(sc);
	rum_set_txpreamble(sc);
	rum_set_basicrates(sc);
	- IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
	- rum_set_bssid(sc, sc->sc_bssid);
	+ IEEE80211_ADDR_COPY(ic->ic_macaddr, ni->ni_bssid);
	+ rum_set_bssid(sc, ic->ic_macaddr);
	}

	if (vap->iv_opmode == IEEE80211_M_HOSTAP \|\|
	@@ -780,7 +752,6 @@
	rum_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
	{
	struct rum_softc *sc = usbd_xfer_softc(xfer);
	- struct ifnet *ifp = sc->sc_ifp;
	struct ieee80211vap *vap;
	struct rum_tx_data *data;
	struct mbuf *m;
	@@ -799,9 +770,6 @@
	rum_tx_free(data, 0);
	usbd_xfer_set_priv(xfer, NULL);

	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	-
	/* FALLTHROUGH */
	case USB_ST_SETUP:
	tr_setup:
	@@ -844,16 +812,14 @@

	usbd_transfer_submit(xfer);
	}
	- RUM_UNLOCK(sc);
	- rum_start(ifp);
	- RUM_LOCK(sc);
	+ rum_start(sc);
	break;

	default: /* Error */
	DPRINTFN(11, "transfer error, %s\n",
	usbd_errstr(error));

	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ counter_u64_add(sc->sc_ic.ic_oerrors, 1);
	data = usbd_xfer_get_priv(xfer);
	if (data != NULL) {
	rum_tx_free(data, error);
	@@ -880,8 +846,7 @@
	rum_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
	{
	struct rum_softc *sc = usbd_xfer_softc(xfer);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_node *ni;
	struct mbuf *m = NULL;
	struct usb_page_cache *pc;
	@@ -899,7 +864,7 @@
	if (len < (int)(RT2573_RX_DESC_SIZE + IEEE80211_MIN_LEN)) {
	DPRINTF("%s: xfer too short %d\n",
	device_get_nameunit(sc->sc_dev), len);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto tr_setup;
	}

	@@ -916,21 +881,20 @@
	* filled RUM_TXRX_CSR2:
	*/
	DPRINTFN(5, "PHY or CRC error\n");
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto tr_setup;
	}

	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
	if (m == NULL) {
	DPRINTF("could not allocate mbuf\n");
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto tr_setup;
	}
	usbd_copy_out(pc, RT2573_RX_DESC_SIZE,
	mtod(m, uint8_t *), len);

	/* finalize mbuf */
	- m->m_pkthdr.rcvif = ifp;
	m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;

	if (ieee80211_radiotap_active(ic)) {
	@@ -968,10 +932,8 @@
	(void) ieee80211_input_all(ic, m, rssi,
	RT2573_NOISE_FLOOR);
	}
	- if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
	- !IFQ_IS_EMPTY(&ifp->if_snd))
	- rum_start(ifp);
	RUM_LOCK(sc);
	+ rum_start(sc);
	return;

	default: /* Error */
	@@ -1011,8 +973,7 @@
	rum_setup_tx_desc(struct rum_softc sc, struct rum_tx_desc desc,
	uint32_t flags, uint16_t xflags, int len, int rate)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint16_t plcp_length;
	int remainder;

	@@ -1109,8 +1070,7 @@
	rum_tx_mgt(struct rum_softc sc, struct mbuf m0, struct ieee80211_node *ni)
	{
	struct ieee80211vap *vap = ni->ni_vap;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct rum_tx_data *data;
	struct ieee80211_frame *wh;
	const struct ieee80211_txparam *tp;
	@@ -1221,8 +1181,7 @@
	rum_tx_data(struct rum_softc sc, struct mbuf m0, struct ieee80211_node *ni)
	{
	struct ieee80211vap *vap = ni->ni_vap;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct rum_tx_data *data;
	struct ieee80211_frame *wh;
	const struct ieee80211_txparam *tp;
	@@ -1299,80 +1258,73 @@
	return 0;
	}

	+static int
	+rum_transmit(struct ieee80211com ic, struct mbuf m)
	+{
	+ struct rum_softc *sc = ic->ic_softc;
	+ int error;
	+
	+ RUM_LOCK(sc);
	+ if (!sc->sc_running) {
	+ RUM_UNLOCK(sc);
	+ return (ENXIO);
	+ }
	+ error = mbufq_enqueue(&sc->sc_snd, m);
	+ if (error) {
	+ RUM_UNLOCK(sc);
	+ return (error);
	+ }
	+ rum_start(sc);
	+ RUM_UNLOCK(sc);
	+
	+ return (0);
	+}
	+
	static void
	-rum_start(struct ifnet *ifp)
	+rum_start(struct rum_softc *sc)
	{
	- struct rum_softc *sc = ifp->if_softc;
	struct ieee80211_node *ni;
	struct mbuf *m;

	- RUM_LOCK(sc);
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	- RUM_UNLOCK(sc);
	+ RUM_LOCK_ASSERT(sc, MA_OWNED);
	+
	+ if (!sc->sc_running)
	return;
	- }
	- for (;;) {
	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
	- if (m == NULL)
	- break;
	- if (sc->tx_nfree < RUM_TX_MINFREE) {
	- IFQ_DRV_PREPEND(&ifp->if_snd, m);
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- break;
	- }
	+
	+ while (sc->tx_nfree >= RUM_TX_MINFREE &&
	+ (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
	ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
	if (rum_tx_data(sc, m, ni) != 0) {
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	break;
	}
	}
	- RUM_UNLOCK(sc);
	}

	-static int
	-rum_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+static void
	+rum_parent(struct ieee80211com *ic)
	{
	- struct rum_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ifreq ifr = (struct ifreq ) data;
	- int error;
	+ struct rum_softc *sc = ic->ic_softc;
	int startall = 0;

	RUM_LOCK(sc);
	- error = sc->sc_detached ? ENXIO : 0;
	- RUM_UNLOCK(sc);
	- if (error)
	- return (error);
	-
	- switch (cmd) {
	- case SIOCSIFFLAGS:
	- RUM_LOCK(sc);
	- if (ifp->if_flags & IFF_UP) {
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	- rum_init_locked(sc);
	- startall = 1;
	- } else
	- rum_setpromisc(sc);
	- } else {
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- rum_stop(sc);
	- }
	+ if (sc->sc_detached) {
	RUM_UNLOCK(sc);
	- if (startall)
	- ieee80211_start_all(ic);
	- break;
	- case SIOCGIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- case SIOCGIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	- default:
	- error = EINVAL;
	- break;
	+ return;
	}
	- return error;
	+ if (ic->ic_nrunning > 0) {
	+ if (!sc->sc_running) {
	+ rum_init(sc);
	+ startall = 1;
	+ } else
	+ rum_setpromisc(sc);
	+ } else if (sc->sc_running)
	+ rum_stop(sc);
	+ RUM_UNLOCK(sc);
	+ if (startall)
	+ ieee80211_start_all(ic);
	}

	static void
	@@ -1572,8 +1524,7 @@
	static void
	rum_enable_mrr(struct rum_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp;

	tmp = rum_read(sc, RT2573_TXRX_CSR4);
	@@ -1589,8 +1540,7 @@
	static void
	rum_set_txpreamble(struct rum_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp;

	tmp = rum_read(sc, RT2573_TXRX_CSR4);
	@@ -1605,8 +1555,7 @@
	static void
	rum_set_basicrates(struct rum_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	/* update basic rate set */
	if (ic->ic_curmode == IEEE80211_MODE_11B) {
	@@ -1671,8 +1620,7 @@
	static void
	rum_set_chan(struct rum_softc sc, struct ieee80211_channel c)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	const struct rfprog *rfprog;
	uint8_t bbp3, bbp94 = RT2573_BBPR94_DEFAULT;
	int8_t power;
	@@ -1748,8 +1696,7 @@
	static void
	rum_enable_tsf_sync(struct rum_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t tmp;

	@@ -1784,10 +1731,9 @@
	}

	static void
	-rum_update_slot(struct ifnet *ifp)
	+rum_update_slot(struct rum_softc *sc)
	{
	- struct rum_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint8_t slottime;
	uint32_t tmp;

	@@ -1827,18 +1773,17 @@
	static void
	rum_setpromisc(struct rum_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t tmp;

	tmp = rum_read(sc, RT2573_TXRX_CSR0);

	tmp &= ~RT2573_DROP_NOT_TO_ME;
	- if (!(ifp->if_flags & IFF_PROMISC))
	+ if (sc->sc_ic.ic_promisc == 0)
	tmp \|= RT2573_DROP_NOT_TO_ME;

	rum_write(sc, RT2573_TXRX_CSR0, tmp);

	- DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
	+ DPRINTF("%s promiscuous mode\n", sc->sc_ic.ic_promisc > 0 ?
	"entering" : "leaving");
	}

	@@ -1847,10 +1792,11 @@
	{
	struct rum_softc *sc = ic->ic_softc;

	- if ((ic->ic_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
	- return;
	-
	RUM_LOCK(sc);
	+ if (!sc->sc_running) {
	+ RUM_UNLOCK(sc);
	+ return;
	+ }
	rum_setpromisc(sc);
	RUM_UNLOCK(sc);
	}
	@@ -1887,7 +1833,7 @@
	#endif

	/* read MAC address */
	- rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, sc->sc_bssid, 6);
	+ rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, sc->sc_ic.ic_macaddr, 6);

	rum_eeprom_read(sc, RT2573_EEPROM_ANTENNA, &val, 2);
	val = le16toh(val);
	@@ -1994,10 +1940,10 @@
	}

	static void
	-rum_init_locked(struct rum_softc *sc)
	+rum_init(struct rum_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	+ struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t tmp;
	usb_error_t error;
	int i, ntries;
	@@ -2039,7 +1985,7 @@
	/* clear STA registers */
	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);

	- rum_set_macaddr(sc, IF_LLADDR(ifp));
	+ rum_set_macaddr(sc, vap ? vap->iv_myaddr : ic->ic_macaddr);

	/* initialize ASIC */
	rum_write(sc, RT2573_MAC_CSR1, 4);
	@@ -2058,13 +2004,12 @@
	RT2573_DROP_ACKCTS;
	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
	tmp \|= RT2573_DROP_TODS;
	- if (!(ifp->if_flags & IFF_PROMISC))
	+ if (ic->ic_promisc == 0)
	tmp \|= RT2573_DROP_NOT_TO_ME;
	}
	rum_write(sc, RT2573_TXRX_CSR0, tmp);

	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	+ sc->sc_running = 1;
	usbd_xfer_set_stall(sc->sc_xfer[RUM_BULK_WR]);
	usbd_transfer_start(sc->sc_xfer[RUM_BULK_RD]);
	return;
	@@ -2074,29 +2019,13 @@
	}

	static void
	-rum_init(void *priv)
	-{
	- struct rum_softc *sc = priv;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	-
	- RUM_LOCK(sc);
	- rum_init_locked(sc);
	- RUM_UNLOCK(sc);
	-
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- ieee80211_start_all(ic); /* start all vap's */
	-}
	-
	-static void
	rum_stop(struct rum_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t tmp;

	RUM_LOCK_ASSERT(sc, MA_OWNED);

	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	+ sc->sc_running = 0;

	RUM_UNLOCK(sc);

	@@ -2188,27 +2117,23 @@
	rum_raw_xmit(struct ieee80211_node ni, struct mbuf m,
	const struct ieee80211_bpf_params *params)
	{
	- struct ifnet *ifp = ni->ni_ic->ic_ifp;
	- struct rum_softc *sc = ifp->if_softc;
	+ struct rum_softc *sc = ni->ni_ic->ic_softc;

	RUM_LOCK(sc);
	/* prevent management frames from being sent if we're not ready */
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	+ if (!sc->sc_running) {
	RUM_UNLOCK(sc);
	m_freem(m);
	ieee80211_free_node(ni);
	return ENETDOWN;
	}
	if (sc->tx_nfree < RUM_TX_MINFREE) {
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	RUM_UNLOCK(sc);
	m_freem(m);
	ieee80211_free_node(ni);
	return EIO;
	}

	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	-
	if (params == NULL) {
	/*
	* Legacy path; interpret frame contents to decide
	@@ -2228,7 +2153,6 @@

	return 0;
	bad:
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	RUM_UNLOCK(sc);
	ieee80211_free_node(ni);
	return EIO;
	@@ -2262,8 +2186,7 @@
	struct rum_vap *rvp = arg;
	struct ieee80211vap *vap = &rvp->vap;
	struct ieee80211com *ic = vap->iv_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rum_softc *sc = ifp->if_softc;
	+ struct rum_softc *sc = ic->ic_softc;
	struct ieee80211_node *ni;
	int ok, fail;
	int sum, retrycnt;
	@@ -2283,7 +2206,8 @@
	(void) ieee80211_ratectl_rate(ni, NULL, 0);
	ieee80211_free_node(ni);

	- if_inc_counter(ifp, IFCOUNTER_OERRORS, fail); /* count TX retry-fail as Tx errors */
	+ /* count TX retry-fail as Tx errors */
	+ if_inc_counter(ni->ni_vap->iv_ifp, IFCOUNTER_OERRORS, fail);

	usb_callout_reset(&rvp->ratectl_ch, hz, rum_ratectl_timeout, rvp);
	RUM_UNLOCK(sc);
	@@ -2292,15 +2216,14 @@
	static void
	rum_scan_start(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct rum_softc *sc = ifp->if_softc;
	+ struct rum_softc *sc = ic->ic_softc;
	uint32_t tmp;

	RUM_LOCK(sc);
	/* abort TSF synchronization */
	tmp = rum_read(sc, RT2573_TXRX_CSR9);
	rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
	- rum_set_bssid(sc, ifp->if_broadcastaddr);
	+ rum_set_bssid(sc, ieee80211broadcastaddr);
	RUM_UNLOCK(sc);

	}
	@@ -2308,11 +2231,11 @@
	static void
	rum_scan_end(struct ieee80211com *ic)
	{
	- struct rum_softc *sc = ic->ic_ifp->if_softc;
	+ struct rum_softc *sc = ic->ic_softc;

	RUM_LOCK(sc);
	rum_enable_tsf_sync(sc);
	- rum_set_bssid(sc, sc->sc_bssid);
	+ rum_set_bssid(sc, ic->ic_macaddr);
	RUM_UNLOCK(sc);

	}
	@@ -2320,7 +2243,7 @@
	static void
	rum_set_channel(struct ieee80211com *ic)
	{
	- struct rum_softc *sc = ic->ic_ifp->if_softc;
	+ struct rum_softc *sc = ic->ic_softc;

	RUM_LOCK(sc);
	rum_set_chan(sc, ic->ic_curchan);
	@@ -2330,8 +2253,7 @@
	static int
	rum_get_rssi(struct rum_softc *sc, uint8_t raw)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int lna, agc, rssi;

	lna = (raw >> 5) & 0x3;
	Index: sys/dev/usb/wlan/if_rumvar.h
	===================================================================
	--- sys/dev/usb/wlan/if_rumvar.h
	+++ sys/dev/usb/wlan/if_rumvar.h
	@@ -85,7 +85,8 @@
	};

	struct rum_softc {
	- struct ifnet *sc_ifp;
	+ struct ieee80211com sc_ic;
	+ struct mbufq sc_snd;
	device_t sc_dev;
	struct usb_device *sc_udev;

	@@ -105,8 +106,8 @@
	uint32_t sta[6];
	uint32_t rf_regs[4];
	uint8_t txpow[44];
	- uint8_t sc_bssid[6];
	- uint8_t sc_detached;
	+ u_int sc_detached:1,
	+ sc_running:1;

	struct {
	uint8_t val;
	Index: sys/dev/usb/wlan/if_run.c
	===================================================================
	--- sys/dev/usb/wlan/if_run.c
	+++ sys/dev/usb/wlan/if_run.c
	@@ -410,8 +410,9 @@
	const struct ieee80211_bpf_params *);
	static int run_raw_xmit(struct ieee80211_node , struct mbuf ,
	const struct ieee80211_bpf_params *);
	-static void run_start(struct ifnet *);
	-static int run_ioctl(struct ifnet *, u_long, caddr_t);
	+static int run_transmit(struct ieee80211com , struct mbuf );
	+static void run_start(struct run_softc *);
	+static void run_parent(struct ieee80211com *);
	static void run_iq_calib(struct run_softc *, u_int);
	static void run_set_agc(struct run_softc *, uint8_t);
	static void run_select_chan_group(struct run_softc *, int);
	@@ -457,7 +458,6 @@
	static void run_rt5390_rf_setup(struct run_softc *);
	static int run_txrx_enable(struct run_softc *);
	static void run_adjust_freq_offset(struct run_softc *);
	-static void run_init(void *);
	static void run_init_locked(struct run_softc *);
	static void run_stop(void *);
	static void run_delay(struct run_softc *, u_int);
	@@ -702,8 +702,7 @@
	{
	struct run_softc *sc = device_get_softc(self);
	struct usb_attach_arg *uaa = device_get_ivars(self);
	- struct ieee80211com *ic;
	- struct ifnet *ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t ver;
	int ntries, error;
	uint8_t iface_index, bands;
	@@ -716,6 +715,7 @@

	mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev),
	MTX_NETWORK_LOCK, MTX_DEF);
	+ mbufq_init(&sc->sc_snd, ifqmaxlen);

	iface_index = RT2860_IFACE_INDEX;

	@@ -754,28 +754,10 @@
	device_printf(sc->sc_dev,
	"MAC/BBP RT%04X (rev 0x%04X), RF %s (MIMO %dT%dR), address %s\n",
	sc->mac_ver, sc->mac_rev, run_get_rf(sc->rf_rev),
	- sc->ntxchains, sc->nrxchains, ether_sprintf(sc->sc_bssid));
	+ sc->ntxchains, sc->nrxchains, ether_sprintf(ic->ic_macaddr));

	RUN_UNLOCK(sc);

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(sc->sc_dev, "can not if_alloc()\n");
	- goto detach;
	- }
	- ic = ifp->if_l2com;
	-
	- ifp->if_softc = sc;
	- if_initname(ifp, "run", device_get_unit(sc->sc_dev));
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = run_init;
	- ifp->if_ioctl = run_ioctl;
	- ifp->if_start = run_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	-
	- ic->ic_ifp = ifp;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(self);
	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
	@@ -812,7 +794,7 @@
	setbit(&bands, IEEE80211_MODE_11A);
	ieee80211_init_channels(ic, NULL, &bands);

	- ieee80211_ifattach(ic, sc->sc_bssid);
	+ ieee80211_ifattach(ic);

	ic->ic_scan_start = run_scan_start;
	ic->ic_scan_end = run_scan_end;
	@@ -824,9 +806,10 @@
	ic->ic_wme.wme_update = run_wme_update;
	ic->ic_raw_xmit = run_raw_xmit;
	ic->ic_update_promisc = run_update_promisc;
	-
	ic->ic_vap_create = run_vap_create;
	ic->ic_vap_delete = run_vap_delete;
	+ ic->ic_transmit = run_transmit;
	+ ic->ic_parent = run_parent;

	ieee80211_radiotap_attach(ic,
	&sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
	@@ -852,8 +835,7 @@
	run_detach(device_t self)
	{
	struct run_softc *sc = device_get_softc(self);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int i;

	RUN_LOCK(sc);
	@@ -872,16 +854,15 @@
	run_unsetup_tx_list(sc, &sc->sc_epq[i]);
	RUN_UNLOCK(sc);

	- if (ifp) {
	- ic = ifp->if_l2com;
	+ if (sc->sc_ic.ic_softc == sc) {
	/* drain tasks */
	usb_callout_drain(&sc->ratectl_ch);
	ieee80211_draintask(ic, &sc->cmdq_task);
	ieee80211_draintask(ic, &sc->ratectl_task);
	ieee80211_ifdetach(ic);
	- if_free(ifp);
	}

	+ mbufq_drain(&sc->sc_snd);
	mtx_destroy(&sc->sc_mtx);

	return (0);
	@@ -893,14 +874,13 @@
	const uint8_t bssid[IEEE80211_ADDR_LEN],
	const uint8_t mac[IEEE80211_ADDR_LEN])
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct run_softc *sc = ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	struct run_vap *rvp;
	struct ieee80211vap *vap;
	int i;

	if (sc->rvp_cnt >= RUN_VAP_MAX) {
	- if_printf(ifp, "number of VAPs maxed out\n");
	+ device_printf(sc->sc_dev, "number of VAPs maxed out\n");
	return (NULL);
	}

	@@ -926,23 +906,21 @@
	break;
	}
	if (vap == NULL) {
	- if_printf(ifp, "wds only supported in ap mode\n");
	+ device_printf(sc->sc_dev,
	+ "wds only supported in ap mode\n");
	return (NULL);
	}
	break;
	default:
	- if_printf(ifp, "unknown opmode %d\n", opmode);
	+ device_printf(sc->sc_dev, "unknown opmode %d\n", opmode);
	return (NULL);
	}

	- rvp = (struct run_vap *) malloc(sizeof(struct run_vap),
	- M_80211_VAP, M_NOWAIT \| M_ZERO);
	- if (rvp == NULL)
	- return (NULL);
	+ rvp = malloc(sizeof(struct run_vap), M_80211_VAP, M_WAITOK \| M_ZERO);
	vap = &rvp->vap;

	- if (ieee80211_vap_setup(ic, vap, name, unit,
	- opmode, flags, bssid, mac) != 0) {
	+ if (ieee80211_vap_setup(ic, vap, name, unit, opmode, flags,
	+ bssid) != 0) {
	/* out of memory */
	free(rvp, M_80211_VAP);
	return (NULL);
	@@ -969,7 +947,8 @@
	ieee80211_ratectl_setinterval(vap, 1000 /* 1 sec */);

	/* complete setup */
	- ieee80211_vap_attach(vap, run_media_change, ieee80211_media_status);
	+ ieee80211_vap_attach(vap, run_media_change, ieee80211_media_status,
	+ mac);

	/* make sure id is always unique */
	for (i = 0; i < RUN_VAP_MAX; i++) {
	@@ -995,7 +974,6 @@
	run_vap_delete(struct ieee80211vap *vap)
	{
	struct run_vap *rvp = RUN_VAP(vap);
	- struct ifnet *ifp;
	struct ieee80211com *ic;
	struct run_softc *sc;
	uint8_t rvp_id;
	@@ -1004,9 +982,7 @@
	return;

	ic = vap->iv_ic;
	- ifp = ic->ic_ifp;
	-
	- sc = ifp->if_softc;
	+ sc = ic->ic_softc;

	RUN_LOCK(sc);

	@@ -1740,6 +1716,7 @@
	static int
	run_read_eeprom(struct run_softc *sc)
	{
	+ struct ieee80211com *ic = &sc->sc_ic;
	int8_t delta_2ghz, delta_5ghz;
	uint32_t tmp;
	uint16_t val;
	@@ -1760,14 +1737,14 @@

	/* read MAC address */
	run_srom_read(sc, RT2860_EEPROM_MAC01, &val);
	- sc->sc_bssid[0] = val & 0xff;
	- sc->sc_bssid[1] = val >> 8;
	+ ic->ic_macaddr[0] = val & 0xff;
	+ ic->ic_macaddr[1] = val >> 8;
	run_srom_read(sc, RT2860_EEPROM_MAC23, &val);
	- sc->sc_bssid[2] = val & 0xff;
	- sc->sc_bssid[3] = val >> 8;
	+ ic->ic_macaddr[2] = val & 0xff;
	+ ic->ic_macaddr[3] = val >> 8;
	run_srom_read(sc, RT2860_EEPROM_MAC45, &val);
	- sc->sc_bssid[4] = val & 0xff;
	- sc->sc_bssid[5] = val >> 8;
	+ ic->ic_macaddr[4] = val & 0xff;
	+ ic->ic_macaddr[5] = val >> 8;

	if (sc->mac_ver < 0x3593) {
	/* read vender BBP settings */
	@@ -2002,7 +1979,7 @@
	struct ieee80211vap *vap = ifp->if_softc;
	struct ieee80211com *ic = vap->iv_ic;
	const struct ieee80211_txparam *tp;
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	uint8_t rate, ridx;
	int error;

	@@ -2033,7 +2010,7 @@

	#if 0
	if ((ifp->if_flags & IFF_UP) &&
	- (ifp->if_drv_flags & IFF_DRV_RUNNING)){
	+ (ifp->if_drv_flags & RUN_RUNNING)){
	run_init_locked(sc);
	}
	#endif
	@@ -2048,7 +2025,7 @@
	{
	const struct ieee80211_txparam *tp;
	struct ieee80211com *ic = vap->iv_ic;
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	struct run_vap *rvp = RUN_VAP(vap);
	enum ieee80211_state ostate;
	uint32_t sta[3];
	@@ -2144,7 +2121,7 @@
	run_set_txpreamble(sc);
	run_set_basicrates(sc);
	ni = ieee80211_ref_node(vap->iv_bss);
	- IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
	+ IEEE80211_ADDR_COPY(ic->ic_macaddr, ni->ni_bssid);
	run_set_bssid(sc, ni->ni_bssid);
	ieee80211_free_node(ni);
	run_enable_tsf_sync(sc);
	@@ -2181,7 +2158,7 @@
	run_wme_update_cb(void *arg)
	{
	struct ieee80211com *ic = arg;
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	struct ieee80211_wme_state *wmesp = &ic->ic_wme;
	int aci, error = 0;

	@@ -2234,7 +2211,7 @@
	static int
	run_wme_update(struct ieee80211com *ic)
	{
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;

	/* sometime called wothout lock */
	if (mtx_owned(&ic->ic_comlock.mtx)) {
	@@ -2277,7 +2254,7 @@
	struct ieee80211vap *vap = cmdq->arg1;
	struct ieee80211_key *k = cmdq->k;
	struct ieee80211com *ic = vap->iv_ic;
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	struct ieee80211_node *ni;
	uint32_t attr;
	uint16_t base, associd;
	@@ -2399,7 +2376,7 @@
	const uint8_t mac[IEEE80211_ADDR_LEN])
	{
	struct ieee80211com *ic = vap->iv_ic;
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	uint32_t i;

	i = RUN_CMDQ_GET(&sc->cmdq_store);
	@@ -2467,7 +2444,7 @@
	run_key_delete(struct ieee80211vap vap, struct ieee80211_key k)
	{
	struct ieee80211com *ic = vap->iv_ic;
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	struct ieee80211_key *k0;
	uint32_t i;

	@@ -2498,7 +2475,7 @@
	struct run_softc *sc = arg;

	/* do it in a process context, so it can go sleep */
	- ieee80211_runtask(sc->sc_ifp->if_l2com, &sc->ratectl_task);
	+ ieee80211_runtask(&sc->sc_ic, &sc->ratectl_task);
	/* next timeout will be rescheduled in the callback task */
	}

	@@ -2507,7 +2484,7 @@
	run_ratectl_cb(void *arg, int pending)
	{
	struct run_softc *sc = arg;
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	if (vap == NULL)
	@@ -2540,7 +2517,6 @@
	run_drain_fifo(void *arg)
	{
	struct run_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t stat;
	uint16_t (*wstat)[3];
	uint8_t wcid, mcs, pid;
	@@ -2577,7 +2553,7 @@
	if (stat & RT2860_TXQ_OK)
	(*wstat)[RUN_SUCCESS]++;
	else
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ counter_u64_add(sc->sc_ic.ic_oerrors, 1);
	/*
	* Check if there were retries, ie if the Tx success rate is
	* different from the requested rate. Note that it works only
	@@ -2600,8 +2576,6 @@
	{
	struct run_softc *sc = arg;
	struct ieee80211vap *vap = ni->ni_vap;
	- struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	struct run_node rn = (void )ni;
	union run_stats sta[2];
	uint16_t (*wstat)[3];
	@@ -2623,7 +2597,8 @@
	goto fail;

	/* count failed TX as errors */
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, le16toh(sta[0].error.fail));
	+ if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS,
	+ le16toh(sta[0].error.fail));

	retrycnt = le16toh(sta[1].tx.retry);
	success = le16toh(sta[1].tx.success);
	@@ -2661,7 +2636,7 @@
	{
	struct run_cmdq *cmdq = arg;
	struct ieee80211_node *ni = cmdq->arg1;
	- struct run_softc *sc = ni->ni_vap->iv_ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ni->ni_vap->iv_ic->ic_softc;
	uint8_t wcid = cmdq->wcid;

	RUN_LOCK_ASSERT(sc, MA_OWNED);
	@@ -2679,7 +2654,7 @@
	struct ieee80211_rateset *rs = &ni->ni_rates;
	struct ieee80211vap *vap = ni->ni_vap;
	struct ieee80211com *ic = vap->iv_ic;
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	uint8_t rate;
	uint8_t ridx;
	uint8_t wcid;
	@@ -2769,8 +2744,7 @@
	static void
	run_rx_frame(struct run_softc sc, struct mbuf m, uint32_t dmalen)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_frame *wh;
	struct ieee80211_node *ni;
	struct rt2870_rxd *rxd;
	@@ -2789,7 +2763,7 @@
	rxwisize += sizeof(uint32_t);
	if (__predict_false(len > dmalen)) {
	m_freem(m);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	DPRINTF("bad RXWI length %u > %u\n", len, dmalen);
	return;
	}
	@@ -2799,7 +2773,7 @@

	if (__predict_false(flags & (RT2860_RX_CRCERR \| RT2860_RX_ICVERR))) {
	m_freem(m);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	DPRINTF("%s error.\n", (flags & RT2860_RX_CRCERR)?"CRC":"ICV");
	return;
	}
	@@ -2828,7 +2802,7 @@
	ieee80211_notify_michael_failure(ni->ni_vap, wh,
	rxwi->keyidx);
	m_freem(m);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	DPRINTF("MIC error. Someone is lying.\n");
	return;
	}
	@@ -2837,7 +2811,6 @@
	rssi = rxwi->rssi[ant];
	nf = run_rssi2dbm(sc, rssi, ant);

	- m->m_pkthdr.rcvif = ifp;
	m->m_pkthdr.len = m->m_len = len;

	if (ni != NULL) {
	@@ -2890,7 +2863,7 @@
	run_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
	{
	struct run_softc *sc = usbd_xfer_softc(xfer);
	- struct ifnet *ifp = sc->sc_ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct mbuf *m = NULL;
	struct mbuf *m0;
	uint32_t dmalen;
	@@ -2928,7 +2901,7 @@
	}
	if (sc->rx_m == NULL) {
	DPRINTF("could not allocate mbuf - idle with stall\n");
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	usbd_xfer_set_stall(xfer);
	usbd_xfer_set_frames(xfer, 0);
	} else {
	@@ -2948,12 +2921,9 @@
	if (error != USB_ERR_CANCELLED) {
	/* try to clear stall first */
	usbd_xfer_set_stall(xfer);
	-
	if (error == USB_ERR_TIMEOUT)
	device_printf(sc->sc_dev, "device timeout\n");
	-
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	-
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto tr_setup;
	}
	if (sc->rx_m != NULL) {
	@@ -3001,7 +2971,7 @@
	m0 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
	if (__predict_false(m0 == NULL)) {
	DPRINTF("could not allocate mbuf\n");
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	break;
	}
	m_copydata(m, 4 /* skip 32-bit DMA-len header */,
	@@ -3022,22 +2992,13 @@
	}

	static void
	-run_tx_free(struct run_endpoint_queue *pq,
	- struct run_tx_data *data, int txerr)
	+run_tx_free(struct run_endpoint_queue pq, struct run_tx_data data, int txerr)
	{
	+
	if (data->m != NULL) {
	- if (data->m->m_flags & M_TXCB)
	- ieee80211_process_callback(data->ni, data->m,
	- txerr ? ETIMEDOUT : 0);
	- m_freem(data->m);
	+ ieee80211_tx_complete(data->ni, data->m, txerr);
	data->m = NULL;
	-
	- if (data->ni == NULL) {
	- DPRINTF("no node\n");
	- } else {
	- ieee80211_free_node(data->ni);
	- data->ni = NULL;
	- }
	+ data->ni = NULL;
	}

	STAILQ_INSERT_TAIL(&pq->tx_fh, data, next);
	@@ -3048,8 +3009,7 @@
	run_bulk_tx_callbackN(struct usb_xfer *xfer, usb_error_t error, u_int index)
	{
	struct run_softc *sc = usbd_xfer_softc(xfer);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct run_tx_data *data;
	struct ieee80211vap *vap = NULL;
	struct usb_page_cache *pc;
	@@ -3067,14 +3027,9 @@
	"bytes @ index %d\n", actlen, index);

	data = usbd_xfer_get_priv(xfer);
	-
	run_tx_free(pq, data, 0);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	-
	usbd_xfer_set_priv(xfer, NULL);

	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	-
	/* FALLTHROUGH */
	case USB_ST_SETUP:
	tr_setup:
	@@ -3091,11 +3046,7 @@
	size + 3 + 8) > RUN_MAX_TXSZ) {
	DPRINTF("data overflow, %u bytes\n",
	m->m_pkthdr.len);
	-
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	-
	run_tx_free(pq, data, 1);
	-
	goto tr_setup;
	}

	@@ -3132,12 +3083,8 @@

	usbd_xfer_set_frame_len(xfer, 0, size);
	usbd_xfer_set_priv(xfer, data);
	-
	usbd_transfer_submit(xfer);
	-
	- RUN_UNLOCK(sc);
	- run_start(ifp);
	- RUN_LOCK(sc);
	+ run_start(sc);

	break;

	@@ -3147,14 +3094,13 @@

	data = usbd_xfer_get_priv(xfer);

	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	-
	if (data != NULL) {
	if(data->ni != NULL)
	vap = data->ni->ni_vap;
	run_tx_free(pq, data, error);
	usbd_xfer_set_priv(xfer, NULL);
	}
	+
	if (vap == NULL)
	vap = TAILQ_FIRST(&ic->ic_vaps);

	@@ -3220,7 +3166,7 @@
	run_set_tx_desc(struct run_softc sc, struct run_tx_data data)
	{
	struct mbuf *m = data->m;
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = data->ni->ni_vap;
	struct ieee80211_frame *wh;
	struct rt2870_txd *txd;
	@@ -3283,7 +3229,7 @@
	static int
	run_tx(struct run_softc sc, struct mbuf m, struct ieee80211_node *ni)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = ni->ni_vap;
	struct ieee80211_frame *wh;
	struct ieee80211_channel *chan;
	@@ -3451,8 +3397,7 @@
	static int
	run_tx_mgt(struct run_softc sc, struct mbuf m, struct ieee80211_node *ni)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct run_node rn = (void )ni;
	struct run_tx_data *data;
	struct ieee80211_frame *wh;
	@@ -3483,11 +3428,9 @@
	USETW(wh->i_dur, dur);
	}

	- if (sc->sc_epq[0].tx_nfree == 0) {
	+ if (sc->sc_epq[0].tx_nfree == 0)
	/* let caller free mbuf */
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	return (EIO);
	- }
	data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
	STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
	sc->sc_epq[0].tx_nfree--;
	@@ -3555,11 +3498,9 @@
	wflags = RT2860_TX_FRAG;

	/* check that there are free slots before allocating the mbuf */
	- if (sc->sc_epq[0].tx_nfree == 0) {
	+ if (sc->sc_epq[0].tx_nfree == 0)
	/* let caller free mbuf */
	- sc->sc_ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	return (ENOBUFS);
	- }

	if (prot == IEEE80211_PROT_RTSCTS) {
	/* NB: CTS is the same size as an ACK */
	@@ -3570,7 +3511,7 @@
	mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
	}
	if (mprot == NULL) {
	- if_inc_counter(sc->sc_ifp, IFCOUNTER_OERRORS, 1);
	+ if_inc_counter(ni->ni_vap->iv_ifp, IFCOUNTER_OERRORS, 1);
	DPRINTF("could not allocate mbuf\n");
	return (ENOBUFS);
	}
	@@ -3652,7 +3593,6 @@

	if (sc->sc_epq[0].tx_nfree == 0) {
	/* let caller free mbuf */
	- sc->sc_ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	DPRINTF("sending raw frame, but tx ring is full\n");
	return (EIO);
	}
	@@ -3691,36 +3631,31 @@
	run_raw_xmit(struct ieee80211_node ni, struct mbuf m,
	const struct ieee80211_bpf_params *params)
	{
	- struct ifnet *ifp = ni->ni_ic->ic_ifp;
	- struct run_softc *sc = ifp->if_softc;
	+ struct run_softc *sc = ni->ni_ic->ic_softc;
	int error = 0;

	RUN_LOCK(sc);

	/* prevent management frames from being sent if we're not ready */
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	- error = ENETDOWN;
	+ if (!(sc->sc_flags & RUN_RUNNING)) {
	+ error = ENETDOWN;
	goto done;
	}

	if (params == NULL) {
	/* tx mgt packet */
	if ((error = run_tx_mgt(sc, m, ni)) != 0) {
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	DPRINTF("mgt tx failed\n");
	goto done;
	}
	} else {
	/* tx raw packet with param */
	if ((error = run_tx_param(sc, m, ni, params)) != 0) {
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	DPRINTF("tx with param failed\n");
	goto done;
	}
	}

	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	-
	done:
	RUN_UNLOCK(sc);

	@@ -3733,83 +3668,71 @@
	return (error);
	}

	+static int
	+run_transmit(struct ieee80211com ic, struct mbuf m)
	+{
	+ struct run_softc *sc = ic->ic_softc;
	+ int error;
	+
	+ RUN_LOCK(sc);
	+ if ((sc->sc_flags & RUN_RUNNING) == 0) {
	+ RUN_UNLOCK(sc);
	+ return (ENXIO);
	+ }
	+ error = mbufq_enqueue(&sc->sc_snd, m);
	+ if (error) {
	+ RUN_UNLOCK(sc);
	+ return (error);
	+ }
	+ run_start(sc);
	+ RUN_UNLOCK(sc);
	+
	+ return (0);
	+}
	+
	static void
	-run_start(struct ifnet *ifp)
	+run_start(struct run_softc *sc)
	{
	- struct run_softc *sc = ifp->if_softc;
	struct ieee80211_node *ni;
	struct mbuf *m;

	- RUN_LOCK(sc);
	+ RUN_LOCK_ASSERT(sc, MA_OWNED);

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	- RUN_UNLOCK(sc);
	+ if ((sc->sc_flags & RUN_RUNNING) == 0)
	return;
	- }
	-
	- for (;;) {
	- /* send data frames */
	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
	- if (m == NULL)
	- break;

	+ while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
	if (run_tx(sc, m, ni) != 0) {
	- IFQ_DRV_PREPEND(&ifp->if_snd, m);
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	+ mbufq_prepend(&sc->sc_snd, m);
	break;
	}
	}
	-
	- RUN_UNLOCK(sc);
	}

	-static int
	-run_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+static void
	+run_parent(struct ieee80211com *ic)
	{
	- struct run_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	- struct ifreq ifr = (struct ifreq ) data;
	+ struct run_softc *sc = ic->ic_softc;
	int startall = 0;
	- int error;

	RUN_LOCK(sc);
	- error = sc->sc_detached ? ENXIO : 0;
	- RUN_UNLOCK(sc);
	- if (error)
	- return (error);
	-
	- switch (cmd) {
	- case SIOCSIFFLAGS:
	- RUN_LOCK(sc);
	- if (ifp->if_flags & IFF_UP) {
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)){
	- startall = 1;
	- run_init_locked(sc);
	- } else
	- run_update_promisc_locked(sc);
	- } else {
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING &&
	- (ic->ic_nrunning == 0 \|\| sc->rvp_cnt <= 1)) {
	- run_stop(sc);
	- }
	- }
	+ if (sc->sc_detached) {
	RUN_UNLOCK(sc);
	- if (startall)
	- ieee80211_start_all(ic);
	- break;
	- case SIOCGIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- case SIOCGIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	- default:
	- error = EINVAL;
	- break;
	+ return;
	}

	- return (error);
	+ if (ic->ic_nrunning > 0) {
	+ if (!(sc->sc_flags & RUN_RUNNING)) {
	+ startall = 1;
	+ run_init_locked(sc);
	+ } else
	+ run_update_promisc_locked(sc);
	+ } else if ((sc->sc_flags & RUN_RUNNING) && sc->rvp_cnt <= 1)
	+ run_stop(sc);
	+ RUN_UNLOCK(sc);
	+ if (startall)
	+ ieee80211_start_all(ic);
	}

	static void
	@@ -4796,7 +4719,7 @@
	static int
	run_set_chan(struct run_softc sc, struct ieee80211_channel c)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	u_int chan, group;

	chan = ieee80211_chan2ieee(ic, c);
	@@ -4841,7 +4764,7 @@
	static void
	run_set_channel(struct ieee80211com *ic)
	{
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;

	RUN_LOCK(sc);
	run_set_chan(sc, ic->ic_curchan);
	@@ -4853,7 +4776,7 @@
	static void
	run_scan_start(struct ieee80211com *ic)
	{
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	uint32_t tmp;

	RUN_LOCK(sc);
	@@ -4863,7 +4786,7 @@
	run_write(sc, RT2860_BCN_TIME_CFG,
	tmp & ~(RT2860_BCN_TX_EN \| RT2860_TSF_TIMER_EN \|
	RT2860_TBTT_TIMER_EN));
	- run_set_bssid(sc, sc->sc_ifp->if_broadcastaddr);
	+ run_set_bssid(sc, ieee80211broadcastaddr);

	RUN_UNLOCK(sc);

	@@ -4873,13 +4796,13 @@
	static void
	run_scan_end(struct ieee80211com *ic)
	{
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;

	RUN_LOCK(sc);

	run_enable_tsf_sync(sc);
	/* XXX keep local copy */
	- run_set_bssid(sc, sc->sc_bssid);
	+ run_set_bssid(sc, ic->ic_macaddr);

	RUN_UNLOCK(sc);

	@@ -4894,7 +4817,7 @@
	run_update_beacon(struct ieee80211vap *vap, int item)
	{
	struct ieee80211com *ic = vap->iv_ic;
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	struct run_vap *rvp = RUN_VAP(vap);
	int mcast = 0;
	uint32_t i;
	@@ -4939,7 +4862,7 @@
	struct ieee80211vap *vap = arg;
	struct run_vap *rvp = RUN_VAP(vap);
	struct ieee80211com *ic = vap->iv_ic;
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	struct rt2860_txwi txwi;
	struct mbuf *m;
	uint16_t txwisize;
	@@ -4987,7 +4910,7 @@
	static void
	run_updateprot(struct ieee80211com *ic)
	{
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	uint32_t i;

	i = RUN_CMDQ_GET(&sc->cmdq_store);
	@@ -5001,7 +4924,7 @@
	run_updateprot_cb(void *arg)
	{
	struct ieee80211com *ic = arg;
	- struct run_softc *sc = ic->ic_ifp->if_softc;
	+ struct run_softc *sc = ic->ic_softc;
	uint32_t tmp;

	tmp = RT2860_RTSTH_EN \| RT2860_PROT_NAV_SHORT \| RT2860_TXOP_ALLOW_ALL;
	@@ -5025,7 +4948,7 @@
	run_usb_timeout_cb(void *arg)
	{
	struct ieee80211vap *vap = arg;
	- struct run_softc *sc = vap->iv_ic->ic_ifp->if_softc;
	+ struct run_softc *sc = vap->iv_ic->ic_softc;

	RUN_LOCK_ASSERT(sc, MA_OWNED);

	@@ -5071,12 +4994,12 @@
	run_read(sc, RT2860_RX_FILTR_CFG, &tmp);

	tmp \|= RT2860_DROP_UC_NOME;
	- if (sc->sc_ifp->if_flags & IFF_PROMISC)
	+ if (sc->sc_ic.ic_promisc > 0)
	tmp &= ~RT2860_DROP_UC_NOME;

	run_write(sc, RT2860_RX_FILTR_CFG, tmp);

	- DPRINTF("%s promiscuous mode\n", (sc->sc_ifp->if_flags & IFF_PROMISC) ?
	+ DPRINTF("%s promiscuous mode\n", (sc->sc_ic.ic_promisc > 0) ?
	"entering" : "leaving");
	}

	@@ -5085,7 +5008,7 @@
	{
	struct run_softc *sc = ic->ic_softc;

	- if ((ic->ic_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
	+ if ((sc->sc_flags & RUN_RUNNING) == 0)
	return;

	RUN_LOCK(sc);
	@@ -5096,7 +5019,7 @@
	static void
	run_enable_tsf_sync(struct run_softc *sc)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t tmp;

	@@ -5161,7 +5084,7 @@
	static void
	run_set_txpreamble(struct run_softc *sc)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp;

	run_read(sc, RT2860_AUTO_RSP_CFG, &tmp);
	@@ -5175,7 +5098,7 @@
	static void
	run_set_basicrates(struct run_softc *sc)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	/* set basic rates mask */
	if (ic->ic_curmode == IEEE80211_MODE_11B)
	@@ -5220,7 +5143,7 @@
	i = RUN_CMDQ_GET(&sc->cmdq_store);
	DPRINTF("cmdq_store=%d\n", i);
	sc->cmdq[i].func = run_updateslot_cb;
	- sc->cmdq[i].arg0 = ic->ic_ifp;
	+ sc->cmdq[i].arg0 = ic;
	ieee80211_runtask(ic, &sc->cmdq_task);

	return;
	@@ -5230,9 +5153,8 @@
	static void
	run_updateslot_cb(void *arg)
	{
	- struct ifnet *ifp = arg;
	- struct run_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = arg;
	+ struct run_softc *sc = ic->ic_softc;
	uint32_t tmp;

	run_read(sc, RT2860_BKOFF_SLOT_CFG, &tmp);
	@@ -5244,15 +5166,12 @@
	static void
	run_update_mcast(struct ieee80211com *ic)
	{
	-
	- /* h/w filter supports getting everything or nothing */
	- ic->ic_ifp->if_flags \|= IFF_ALLMULTI;
	}

	static int8_t
	run_rssi2dbm(struct run_softc *sc, uint8_t rssi, uint8_t rxchain)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_channel *c = ic->ic_curchan;
	int delta;

	@@ -5902,7 +5821,7 @@
	static int
	run_txrx_enable(struct run_softc *sc)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t tmp;
	int error, ntries;

	@@ -5962,8 +5881,8 @@
	static void
	run_init_locked(struct run_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	+ struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t tmp;
	uint8_t bbp1, bbp3;
	int i;
	@@ -5993,7 +5912,7 @@
	for (i = 0; i != RUN_EP_QUEUES; i++)
	run_setup_tx_list(sc, &sc->sc_epq[i]);

	- run_set_macaddr(sc, IF_LLADDR(ifp));
	+ run_set_macaddr(sc, vap ? vap->iv_myaddr : ic->ic_macaddr);

	for (ntries = 0; ntries < 100; ntries++) {
	if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
	@@ -6166,8 +6085,7 @@
	/* turn radio LED on */
	run_set_leds(sc, RT2860_LED_RADIO);

	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	+ sc->sc_flags \|= RUN_RUNNING;
	sc->cmdq_run = RUN_CMDQ_GO;

	for (i = 0; i != RUN_N_XFER; i++)
	@@ -6185,35 +6103,19 @@
	}

	static void
	-run_init(void *arg)
	-{
	- struct run_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	-
	- RUN_LOCK(sc);
	- run_init_locked(sc);
	- RUN_UNLOCK(sc);
	-
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- ieee80211_start_all(ic);
	-}
	-
	-static void
	run_stop(void *arg)
	{
	struct run_softc sc = (struct run_softc )arg;
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t tmp;
	int i;
	int ntries;

	RUN_LOCK_ASSERT(sc, MA_OWNED);

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	+ if (sc->sc_flags & RUN_RUNNING)
	run_set_leds(sc, 0); /* turn all LEDs off */

	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	+ sc->sc_flags &= ~RUN_RUNNING;

	sc->ratectl_run = RUN_RATECTL_OFF;
	sc->cmdq_run = sc->cmdq_key_set;
	Index: sys/dev/usb/wlan/if_runvar.h
	===================================================================
	--- sys/dev/usb/wlan/if_runvar.h
	+++ sys/dev/usb/wlan/if_runvar.h
	@@ -151,13 +151,16 @@
	};

	struct run_softc {
	+ struct mtx sc_mtx;
	+ struct ieee80211com sc_ic;
	+ struct mbufq sc_snd;
	device_t sc_dev;
	struct usb_device *sc_udev;
	- struct ifnet *sc_ifp;
	int sc_need_fwload;

	int sc_flags;
	#define RUN_FLAG_FWLOAD_NEEDED 0x01
	+#define RUN_RUNNING 0x02

	uint16_t wcid_stats[RT2870_WCID_MAX + 1][3];
	#define RUN_TXCNT 0
	@@ -203,10 +206,6 @@
	uint32_t txpow40mhz_2ghz[5];
	uint32_t txpow40mhz_5ghz[5];

	- uint8_t sc_bssid[6];
	-
	- struct mtx sc_mtx;
	-
	struct run_endpoint_queue sc_epq[RUN_EP_QUEUES];

	struct task ratectl_task;
	Index: sys/dev/usb/wlan/if_ural.c
	===================================================================
	--- sys/dev/usb/wlan/if_ural.c
	+++ sys/dev/usb/wlan/if_ural.c
	@@ -149,8 +149,9 @@
	struct ieee80211_node *);
	static int ural_tx_data(struct ural_softc , struct mbuf ,
	struct ieee80211_node *);
	-static void ural_start(struct ifnet *);
	-static int ural_ioctl(struct ifnet *, u_long, caddr_t);
	+static int ural_transmit(struct ieee80211com , struct mbuf );
	+static void ural_start(struct ural_softc *);
	+static void ural_parent(struct ieee80211com *);
	static void ural_set_testmode(struct ural_softc *);
	static void ural_eeprom_read(struct ural_softc , uint16_t, void ,
	int);
	@@ -171,12 +172,12 @@
	static void ural_disable_rf_tune(struct ural_softc *);
	static void ural_enable_tsf_sync(struct ural_softc *);
	static void ural_enable_tsf(struct ural_softc *);
	-static void ural_update_slot(struct ifnet *);
	+static void ural_update_slot(struct ural_softc *);
	static void ural_set_txpreamble(struct ural_softc *);
	static void ural_set_basicrates(struct ural_softc *,
	const struct ieee80211_channel *);
	static void ural_set_bssid(struct ural_softc , const uint8_t );
	-static void ural_set_macaddr(struct ural_softc , uint8_t );
	+static void ural_set_macaddr(struct ural_softc , const uint8_t );
	static void ural_update_promisc(struct ieee80211com *);
	static void ural_setpromisc(struct ural_softc *);
	static const char *ural_get_rf(int);
	@@ -184,8 +185,7 @@
	static int ural_bbp_init(struct ural_softc *);
	static void ural_set_txantenna(struct ural_softc *, int);
	static void ural_set_rxantenna(struct ural_softc *, int);
	-static void ural_init_locked(struct ural_softc *);
	-static void ural_init(void *);
	+static void ural_init(struct ural_softc *);
	static void ural_stop(struct ural_softc *);
	static int ural_raw_xmit(struct ieee80211_node , struct mbuf ,
	const struct ieee80211_bpf_params *);
	@@ -422,8 +422,7 @@
	{
	struct usb_attach_arg *uaa = device_get_ivars(self);
	struct ural_softc *sc = device_get_softc(self);
	- struct ifnet *ifp;
	- struct ieee80211com *ic;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint8_t iface_index, bands;
	int error;

	@@ -433,6 +432,7 @@

	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
	MTX_NETWORK_LOCK, MTX_DEF);
	+ mbufq_init(&sc->sc_snd, ifqmaxlen);

	iface_index = RAL_IFACE_INDEX;
	error = usbd_transfer_setup(uaa->device,
	@@ -455,24 +455,6 @@
	device_printf(self, "MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
	sc->asic_rev, ural_get_rf(sc->rf_rev));

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(sc->sc_dev, "can not if_alloc()\n");
	- goto detach;
	- }
	- ic = ifp->if_l2com;
	-
	- ifp->if_softc = sc;
	- if_initname(ifp, "ural", device_get_unit(sc->sc_dev));
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = ural_init;
	- ifp->if_ioctl = ural_ioctl;
	- ifp->if_start = ural_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	-
	- ic->ic_ifp = ifp;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(self);
	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
	@@ -497,13 +479,14 @@
	setbit(&bands, IEEE80211_MODE_11A);
	ieee80211_init_channels(ic, NULL, &bands);

	- ieee80211_ifattach(ic, sc->sc_bssid);
	+ ieee80211_ifattach(ic);
	ic->ic_update_promisc = ural_update_promisc;
	ic->ic_raw_xmit = ural_raw_xmit;
	ic->ic_scan_start = ural_scan_start;
	ic->ic_scan_end = ural_scan_end;
	ic->ic_set_channel = ural_set_channel;
	-
	+ ic->ic_parent = ural_parent;
	+ ic->ic_transmit = ural_transmit;
	ic->ic_vap_create = ural_vap_create;
	ic->ic_vap_delete = ural_vap_delete;

	@@ -527,8 +510,7 @@
	ural_detach(device_t self)
	{
	struct ural_softc *sc = device_get_softc(self);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic;
	+ struct ieee80211com *ic = &sc->sc_ic;

	/* prevent further ioctls */
	RAL_LOCK(sc);
	@@ -543,11 +525,9 @@
	ural_unsetup_tx_list(sc);
	RAL_UNLOCK(sc);

	- if (ifp) {
	- ic = ifp->if_l2com;
	+ if (ic->ic_softc == sc)
	ieee80211_ifdetach(ic);
	- if_free(ifp);
	- }
	+ mbufq_drain(&sc->sc_snd);
	mtx_destroy(&sc->sc_mtx);

	return (0);
	@@ -580,7 +560,7 @@
	const uint8_t bssid[IEEE80211_ADDR_LEN],
	const uint8_t mac[IEEE80211_ADDR_LEN])
	{
	- struct ural_softc *sc = ic->ic_ifp->if_softc;
	+ struct ural_softc *sc = ic->ic_softc;
	struct ural_vap *uvp;
	struct ieee80211vap *vap;

	@@ -594,7 +574,7 @@
	/* enable s/w bmiss handling for sta mode */

	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
	- flags \| IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
	+ flags \| IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
	/* out of memory */
	free(uvp, M_80211_VAP);
	return (NULL);
	@@ -610,7 +590,8 @@
	ieee80211_ratectl_setinterval(vap, 1000 /* 1 sec */);

	/* complete setup */
	- ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
	+ ieee80211_vap_attach(vap, ieee80211_media_change,
	+ ieee80211_media_status, mac);
	ic->ic_opmode = opmode;
	return vap;
	}
	@@ -634,13 +615,8 @@
	struct ural_softc *sc = data->sc;

	if (data->m != NULL) {
	- if (data->m->m_flags & M_TXCB)
	- ieee80211_process_callback(data->ni, data->m,
	- txerr ? ETIMEDOUT : 0);
	- m_freem(data->m);
	+ ieee80211_tx_complete(data->ni, data->m, txerr);
	data->m = NULL;
	-
	- ieee80211_free_node(data->ni);
	data->ni = NULL;
	}
	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
	@@ -697,7 +673,7 @@
	{
	struct ural_vap *uvp = URAL_VAP(vap);
	struct ieee80211com *ic = vap->iv_ic;
	- struct ural_softc *sc = ic->ic_ifp->if_softc;
	+ struct ural_softc *sc = ic->ic_softc;
	const struct ieee80211_txparam *tp;
	struct ieee80211_node *ni;
	struct mbuf *m;
	@@ -731,11 +707,11 @@
	ieee80211_free_node(ni);
	return (-1);
	}
	- ural_update_slot(ic->ic_ifp);
	+ ural_update_slot(sc);
	ural_set_txpreamble(sc);
	ural_set_basicrates(sc, ic->ic_bsschan);
	- IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
	- ural_set_bssid(sc, sc->sc_bssid);
	+ IEEE80211_ADDR_COPY(ic->ic_macaddr, ni->ni_bssid);
	+ ural_set_bssid(sc, ic->ic_macaddr);
	}

	if (vap->iv_opmode == IEEE80211_M_HOSTAP \|\|
	@@ -789,7 +765,6 @@
	ural_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
	{
	struct ural_softc *sc = usbd_xfer_softc(xfer);
	- struct ifnet *ifp = sc->sc_ifp;
	struct ieee80211vap *vap;
	struct ural_tx_data *data;
	struct mbuf *m;
	@@ -807,9 +782,6 @@
	ural_tx_free(data, 0);
	usbd_xfer_set_priv(xfer, NULL);

	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	-
	/* FALLTHROUGH */
	case USB_ST_SETUP:
	tr_setup:
	@@ -852,16 +824,13 @@

	usbd_transfer_submit(xfer);
	}
	- RAL_UNLOCK(sc);
	- ural_start(ifp);
	- RAL_LOCK(sc);
	+ ural_start(sc);
	break;

	default: /* Error */
	DPRINTFN(11, "transfer error, %s\n",
	usbd_errstr(error));

	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	data = usbd_xfer_get_priv(xfer);
	if (data != NULL) {
	ural_tx_free(data, error);
	@@ -883,8 +852,7 @@
	ural_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
	{
	struct ural_softc *sc = usbd_xfer_softc(xfer);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_node *ni;
	struct mbuf *m = NULL;
	struct usb_page_cache *pc;
	@@ -902,7 +870,7 @@
	if (len < (int)(RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN)) {
	DPRINTF("%s: xfer too short %d\n",
	device_get_nameunit(sc->sc_dev), len);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto tr_setup;
	}

	@@ -921,20 +889,19 @@
	* filled RAL_TXRX_CSR2:
	*/
	DPRINTFN(5, "PHY or CRC error\n");
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto tr_setup;
	}

	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
	if (m == NULL) {
	DPRINTF("could not allocate mbuf\n");
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto tr_setup;
	}
	usbd_copy_out(pc, 0, mtod(m, uint8_t *), len);

	/* finalize mbuf */
	- m->m_pkthdr.rcvif = ifp;
	m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;

	if (ieee80211_radiotap_active(ic)) {
	@@ -973,10 +940,8 @@
	} else
	(void) ieee80211_input_all(ic, m, rssi, nf);
	}
	- if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
	- !IFQ_IS_EMPTY(&ifp->if_snd))
	- ural_start(ifp);
	RAL_LOCK(sc);
	+ ural_start(sc);
	return;

	default: /* Error */
	@@ -1016,8 +981,7 @@
	ural_setup_tx_desc(struct ural_softc sc, struct ural_tx_desc desc,
	uint32_t flags, int len, int rate)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint16_t plcp_length;
	int remainder;

	@@ -1066,12 +1030,10 @@
	{
	struct ieee80211vap *vap = ni->ni_vap;
	struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = sc->sc_ifp;
	const struct ieee80211_txparam *tp;
	struct ural_tx_data *data;

	if (sc->tx_nfree == 0) {
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	m_freem(m0);
	ieee80211_free_node(ni);
	return (EIO);
	@@ -1348,78 +1310,73 @@
	return 0;
	}

	+static int
	+ural_transmit(struct ieee80211com ic, struct mbuf m)
	+{
	+ struct ural_softc *sc = ic->ic_softc;
	+ int error;
	+
	+ RAL_LOCK(sc);
	+ if (!sc->sc_running) {
	+ RAL_UNLOCK(sc);
	+ return (ENXIO);
	+ }
	+ error = mbufq_enqueue(&sc->sc_snd, m);
	+ if (error) {
	+ RAL_UNLOCK(sc);
	+ return (error);
	+ }
	+ ural_start(sc);
	+ RAL_UNLOCK(sc);
	+
	+ return (0);
	+}
	+
	static void
	-ural_start(struct ifnet *ifp)
	+ural_start(struct ural_softc *sc)
	{
	- struct ural_softc *sc = ifp->if_softc;
	struct ieee80211_node *ni;
	struct mbuf *m;

	- RAL_LOCK(sc);
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	- RAL_UNLOCK(sc);
	+ RAL_LOCK_ASSERT(sc, MA_OWNED);
	+
	+ if (sc->sc_running == 0)
	return;
	- }
	- for (;;) {
	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
	- if (m == NULL)
	- break;
	- if (sc->tx_nfree < RAL_TX_MINFREE) {
	- IFQ_DRV_PREPEND(&ifp->if_snd, m);
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- break;
	- }
	+
	+ while (sc->tx_nfree >= RAL_TX_MINFREE &&
	+ (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
	ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
	if (ural_tx_data(sc, m, ni) != 0) {
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	break;
	}
	}
	- RAL_UNLOCK(sc);
	}

	-static int
	-ural_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+static void
	+ural_parent(struct ieee80211com *ic)
	{
	- struct ural_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ifreq ifr = (struct ifreq ) data;
	- int error;
	+ struct ural_softc *sc = ic->ic_softc;
	int startall = 0;

	RAL_LOCK(sc);
	- error = sc->sc_detached ? ENXIO : 0;
	- RAL_UNLOCK(sc);
	- if (error)
	- return (error);
	-
	- switch (cmd) {
	- case SIOCSIFFLAGS:
	- RAL_LOCK(sc);
	- if (ifp->if_flags & IFF_UP) {
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	- ural_init_locked(sc);
	- startall = 1;
	- } else
	- ural_setpromisc(sc);
	- } else {
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- ural_stop(sc);
	- }
	+ if (sc->sc_detached) {
	RAL_UNLOCK(sc);
	- if (startall)
	- ieee80211_start_all(ic);
	- break;
	- case SIOCGIFMEDIA:
	- case SIOCSIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- default:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	+ return;
	}
	- return error;
	+ if (ic->ic_nrunning > 0) {
	+ if (sc->sc_running == 0) {
	+ ural_init(sc);
	+ startall = 1;
	+ } else
	+ ural_setpromisc(sc);
	+ } else if (sc->sc_running)
	+ ural_stop(sc);
	+ RAL_UNLOCK(sc);
	+ if (startall)
	+ ieee80211_start_all(ic);
	}

	static void
	@@ -1614,23 +1571,22 @@
	static void
	ural_scan_start(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ural_softc *sc = ifp->if_softc;
	+ struct ural_softc *sc = ic->ic_softc;

	RAL_LOCK(sc);
	ural_write(sc, RAL_TXRX_CSR19, 0);
	- ural_set_bssid(sc, ifp->if_broadcastaddr);
	+ ural_set_bssid(sc, ieee80211broadcastaddr);
	RAL_UNLOCK(sc);
	}

	static void
	ural_scan_end(struct ieee80211com *ic)
	{
	- struct ural_softc *sc = ic->ic_ifp->if_softc;
	+ struct ural_softc *sc = ic->ic_softc;

	RAL_LOCK(sc);
	ural_enable_tsf_sync(sc);
	- ural_set_bssid(sc, sc->sc_bssid);
	+ ural_set_bssid(sc, ic->ic_macaddr);
	RAL_UNLOCK(sc);

	}
	@@ -1638,7 +1594,7 @@
	static void
	ural_set_channel(struct ieee80211com *ic)
	{
	- struct ural_softc *sc = ic->ic_ifp->if_softc;
	+ struct ural_softc *sc = ic->ic_softc;

	RAL_LOCK(sc);
	ural_set_chan(sc, ic->ic_curchan);
	@@ -1648,8 +1604,7 @@
	static void
	ural_set_chan(struct ural_softc sc, struct ieee80211_channel c)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint8_t power, tmp;
	int i, chan;

	@@ -1780,8 +1735,7 @@
	static void
	ural_enable_tsf_sync(struct ural_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint16_t logcwmin, preload, tmp;

	@@ -1817,10 +1771,9 @@

	#define RAL_RXTX_TURNAROUND 5 /* us */
	static void
	-ural_update_slot(struct ifnet *ifp)
	+ural_update_slot(struct ural_softc *sc)
	{
	- struct ural_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint16_t slottime, sifs, eifs;

	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
	@@ -1845,8 +1798,7 @@
	static void
	ural_set_txpreamble(struct ural_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint16_t tmp;

	tmp = ural_read(sc, RAL_TXRX_CSR10);
	@@ -1893,7 +1845,7 @@
	}

	static void
	-ural_set_macaddr(struct ural_softc sc, uint8_t addr)
	+ural_set_macaddr(struct ural_softc sc, const uint8_t addr)
	{
	uint16_t tmp;

	@@ -1912,18 +1864,17 @@
	static void
	ural_setpromisc(struct ural_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t tmp;

	tmp = ural_read(sc, RAL_TXRX_CSR2);

	tmp &= ~RAL_DROP_NOT_TO_ME;
	- if (!(ifp->if_flags & IFF_PROMISC))
	+ if (sc->sc_ic.ic_promisc == 0)
	tmp \|= RAL_DROP_NOT_TO_ME;

	ural_write(sc, RAL_TXRX_CSR2, tmp);

	- DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
	+ DPRINTF("%s promiscuous mode\n", sc->sc_ic.ic_promisc ?
	"entering" : "leaving");
	}

	@@ -1932,11 +1883,9 @@
	{
	struct ural_softc *sc = ic->ic_softc;

	- if ((ic->ic_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
	- return;
	-
	RAL_LOCK(sc);
	- ural_setpromisc(sc);
	+ if (sc->sc_running)
	+ ural_setpromisc(sc);
	RAL_UNLOCK(sc);
	}

	@@ -1958,6 +1907,7 @@
	static void
	ural_read_eeprom(struct ural_softc *sc)
	{
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint16_t val;

	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
	@@ -1970,7 +1920,7 @@
	sc->nb_ant = val & 0x3;

	/* read MAC address */
	- ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_bssid, 6);
	+ ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, ic->ic_macaddr, 6);

	/* read default values for BBP registers */
	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
	@@ -2064,11 +2014,11 @@
	}

	static void
	-ural_init_locked(struct ural_softc *sc)
	+ural_init(struct ural_softc *sc)
	{
	#define N(a) ((int)(sizeof (a) / sizeof ((a)[0])))
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	+ struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint16_t tmp;
	int i, ntries;

	@@ -2115,7 +2065,7 @@
	ural_set_txantenna(sc, sc->tx_ant);
	ural_set_rxantenna(sc, sc->rx_ant);

	- ural_set_macaddr(sc, IF_LLADDR(ifp));
	+ ural_set_macaddr(sc, vap ? vap->iv_myaddr : ic->ic_macaddr);

	/*
	* Allocate Tx and Rx xfer queues.
	@@ -2128,13 +2078,12 @@
	tmp \|= RAL_DROP_CTL \| RAL_DROP_BAD_VERSION;
	if (ic->ic_opmode != IEEE80211_M_HOSTAP)
	tmp \|= RAL_DROP_TODS;
	- if (!(ifp->if_flags & IFF_PROMISC))
	+ if (ic->ic_promisc == 0)
	tmp \|= RAL_DROP_NOT_TO_ME;
	}
	ural_write(sc, RAL_TXRX_CSR2, tmp);

	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	+ sc->sc_running = 1;
	usbd_xfer_set_stall(sc->sc_xfer[URAL_BULK_WR]);
	usbd_transfer_start(sc->sc_xfer[URAL_BULK_RD]);
	return;
	@@ -2144,28 +2093,12 @@
	}

	static void
	-ural_init(void *priv)
	-{
	- struct ural_softc *sc = priv;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	-
	- RAL_LOCK(sc);
	- ural_init_locked(sc);
	- RAL_UNLOCK(sc);
	-
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- ieee80211_start_all(ic); /* start all vap's */
	-}
	-
	-static void
	ural_stop(struct ural_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;

	RAL_LOCK_ASSERT(sc, MA_OWNED);

	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	+ sc->sc_running = 0;

	/*
	* Drain all the transfers, if not already drained:
	@@ -2193,27 +2126,23 @@
	const struct ieee80211_bpf_params *params)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ural_softc *sc = ifp->if_softc;
	+ struct ural_softc *sc = ic->ic_softc;

	RAL_LOCK(sc);
	/* prevent management frames from being sent if we're not ready */
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	+ if (!sc->sc_running) {
	RAL_UNLOCK(sc);
	m_freem(m);
	ieee80211_free_node(ni);
	return ENETDOWN;
	}
	if (sc->tx_nfree < RAL_TX_MINFREE) {
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	RAL_UNLOCK(sc);
	m_freem(m);
	ieee80211_free_node(ni);
	return EIO;
	}

	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	-
	if (params == NULL) {
	/*
	* Legacy path; interpret frame contents to decide
	@@ -2232,7 +2161,6 @@
	RAL_UNLOCK(sc);
	return 0;
	bad:
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	RAL_UNLOCK(sc);
	ieee80211_free_node(ni);
	return EIO; /* XXX */
	@@ -2266,8 +2194,7 @@
	struct ural_vap *uvp = arg;
	struct ieee80211vap *vap = &uvp->vap;
	struct ieee80211com *ic = vap->iv_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ural_softc *sc = ifp->if_softc;
	+ struct ural_softc *sc = ic->ic_softc;
	struct ieee80211_node *ni;
	int ok, fail;
	int sum, retrycnt;
	@@ -2286,7 +2213,8 @@
	ieee80211_ratectl_tx_update(vap, ni, &sum, &ok, &retrycnt);
	(void) ieee80211_ratectl_rate(ni, NULL, 0);

	- if_inc_counter(ifp, IFCOUNTER_OERRORS, fail); /* count TX retry-fail as Tx errors */
	+ /* count TX retry-fail as Tx errors */
	+ if_inc_counter(ni->ni_vap->iv_ifp, IFCOUNTER_OERRORS, fail);

	usb_callout_reset(&uvp->ratectl_ch, hz, ural_ratectl_timeout, uvp);
	RAL_UNLOCK(sc);
	Index: sys/dev/usb/wlan/if_uralvar.h
	===================================================================
	--- sys/dev/usb/wlan/if_uralvar.h
	+++ sys/dev/usb/wlan/if_uralvar.h
	@@ -89,7 +89,8 @@
	};

	struct ural_softc {
	- struct ifnet *sc_ifp;
	+ struct ieee80211com sc_ic;
	+ struct mbufq sc_snd;
	device_t sc_dev;
	struct usb_device *sc_udev;

	@@ -109,8 +110,8 @@
	uint16_t sta[11];
	uint32_t rf_regs[4];
	uint8_t txpow[14];
	- uint8_t sc_bssid[6];
	- uint8_t sc_detached;
	+ u_int sc_detached:1,
	+ sc_running:1;

	struct {
	uint8_t val;
	Index: sys/dev/usb/wlan/if_urtwn.c
	===================================================================
	--- sys/dev/usb/wlan/if_urtwn.c
	+++ sys/dev/usb/wlan/if_urtwn.c
	@@ -169,8 +169,8 @@
	static usb_callback_t urtwn_bulk_tx_callback;
	static usb_callback_t urtwn_bulk_rx_callback;

	-static usb_error_t urtwn_do_request(struct urtwn_softc *sc,
	- struct usb_device_request req, void data);
	+static usb_error_t urtwn_do_request(struct urtwn_softc *,
	+ struct usb_device_request , void );
	static struct ieee80211vap urtwn_vap_create(struct ieee80211com ,
	const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
	const uint8_t [IEEE80211_ADDR_LEN],
	@@ -228,10 +228,9 @@
	static int urtwn_tx_start(struct urtwn_softc *,
	struct ieee80211_node , struct mbuf ,
	struct urtwn_data *);
	-static void urtwn_start(struct ifnet *);
	-static void urtwn_start_locked(struct ifnet *,
	- struct urtwn_softc *);
	-static int urtwn_ioctl(struct ifnet *, u_long, caddr_t);
	+static int urtwn_transmit(struct ieee80211com , struct mbuf );
	+static void urtwn_start(struct urtwn_softc *);
	+static void urtwn_parent(struct ieee80211com *);
	static int urtwn_r92c_power_on(struct urtwn_softc *);
	static int urtwn_r88e_power_on(struct urtwn_softc *);
	static int urtwn_llt_init(struct urtwn_softc *);
	@@ -269,10 +268,8 @@
	static void urtwn_update_mcast(struct ieee80211com *);
	static void urtwn_iq_calib(struct urtwn_softc *);
	static void urtwn_lc_calib(struct urtwn_softc *);
	-static void urtwn_init(void *);
	-static void urtwn_init_locked(void *);
	-static void urtwn_stop(struct ifnet *);
	-static void urtwn_stop_locked(struct ifnet *);
	+static void urtwn_init(struct urtwn_softc *);
	+static void urtwn_stop(struct urtwn_softc *);
	static void urtwn_abort_xfers(struct urtwn_softc *);
	static int urtwn_raw_xmit(struct ieee80211_node , struct mbuf ,
	const struct ieee80211_bpf_params *);
	@@ -368,8 +365,7 @@
	{
	struct usb_attach_arg *uaa = device_get_ivars(self);
	struct urtwn_softc *sc = device_get_softc(self);
	- struct ifnet *ifp;
	- struct ieee80211com *ic;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint8_t iface_index, bands;
	int error;

	@@ -382,6 +378,7 @@
	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
	MTX_NETWORK_LOCK, MTX_DEF);
	callout_init(&sc->sc_watchdog_ch, 0);
	+ mbufq_init(&sc->sc_snd, ifqmaxlen);

	iface_index = URTWN_IFACE_INDEX;
	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
	@@ -424,24 +421,6 @@

	URTWN_UNLOCK(sc);

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(sc->sc_dev, "can not if_alloc()\n");
	- goto detach;
	- }
	- ic = ifp->if_l2com;
	-
	- ifp->if_softc = sc;
	- if_initname(ifp, "urtwn", device_get_unit(sc->sc_dev));
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = urtwn_init;
	- ifp->if_ioctl = urtwn_ioctl;
	- ifp->if_start = urtwn_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	-
	- ic->ic_ifp = ifp;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(self);
	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
	@@ -462,12 +441,13 @@
	setbit(&bands, IEEE80211_MODE_11G);
	ieee80211_init_channels(ic, NULL, &bands);

	- ieee80211_ifattach(ic, sc->sc_bssid);
	+ ieee80211_ifattach(ic);
	ic->ic_raw_xmit = urtwn_raw_xmit;
	ic->ic_scan_start = urtwn_scan_start;
	ic->ic_scan_end = urtwn_scan_end;
	ic->ic_set_channel = urtwn_set_channel;
	-
	+ ic->ic_transmit = urtwn_transmit;
	+ ic->ic_parent = urtwn_parent;
	ic->ic_vap_create = urtwn_vap_create;
	ic->ic_vap_delete = urtwn_vap_delete;
	ic->ic_update_mcast = urtwn_update_mcast;
	@@ -491,17 +471,15 @@
	urtwn_detach(device_t self)
	{
	struct urtwn_softc *sc = device_get_softc(self);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	unsigned int x;

	/* Prevent further ioctls. */
	URTWN_LOCK(sc);
	sc->sc_flags \|= URTWN_DETACHED;
	+ urtwn_stop(sc);
	URTWN_UNLOCK(sc);

	- urtwn_stop(ifp);
	-
	callout_drain(&sc->sc_watchdog_ch);

	/* Prevent further allocations from RX/TX data lists. */
	@@ -527,8 +505,7 @@
	/* stop all USB transfers */
	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
	ieee80211_ifdetach(ic);
	-
	- if_free(ifp);
	+ mbufq_drain(&sc->sc_snd);
	mtx_destroy(&sc->sc_mtx);

	return (0);
	@@ -599,15 +576,12 @@
	if (!TAILQ_EMPTY(&ic->ic_vaps)) /* only one at a time */
	return (NULL);

	- uvp = (struct urtwn_vap *) malloc(sizeof(struct urtwn_vap),
	- M_80211_VAP, M_NOWAIT \| M_ZERO);
	- if (uvp == NULL)
	- return (NULL);
	+ uvp = malloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK \| M_ZERO);
	vap = &uvp->vap;
	/* enable s/w bmiss handling for sta mode */

	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
	- flags \| IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
	+ flags \| IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
	/* out of memory */
	free(uvp, M_80211_VAP);
	return (NULL);
	@@ -619,7 +593,7 @@

	/* complete setup */
	ieee80211_vap_attach(vap, ieee80211_media_change,
	- ieee80211_media_status);
	+ ieee80211_media_status, mac);
	ic->ic_opmode = opmode;
	return (vap);
	}
	@@ -636,8 +610,7 @@
	static struct mbuf *
	urtwn_rx_frame(struct urtwn_softc sc, uint8_t buf, int pktlen, int *rssi_p)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_frame *wh;
	struct mbuf *m;
	struct r92c_rx_stat *stat;
	@@ -650,7 +623,7 @@
	* don't pass packets to the ieee80211 framework if the driver isn't
	* RUNNING.
	*/
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
	+ if (!(sc->sc_flags & URTWN_RUNNING))
	return (NULL);

	stat = (struct r92c_rx_stat *)buf;
	@@ -662,11 +635,11 @@
	* This should not happen since we setup our Rx filter
	* to not receive these frames.
	*/
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	return (NULL);
	}
	if (pktlen < sizeof(*wh) \|\| pktlen > MCLBYTES) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	return (NULL);
	}

	@@ -695,7 +668,6 @@
	}

	/* Finalize mbuf. */
	- m->m_pkthdr.rcvif = ifp;
	wh = (struct ieee80211_frame )((uint8_t )&stat[1] + infosz);
	memcpy(mtod(m, uint8_t *), wh, pktlen);
	m->m_pkthdr.len = m->m_len = pktlen;
	@@ -741,7 +713,7 @@
	int8_t *nf)
	{
	struct urtwn_softc *sc = data->sc;
	- struct ifnet *ifp = sc->sc_ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct r92c_rx_stat *stat;
	struct mbuf m, m0 = NULL, *prevm = NULL;
	uint32_t rxdw0;
	@@ -751,7 +723,7 @@
	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);

	if (len < sizeof(*stat)) {
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	return (NULL);
	}

	@@ -802,8 +774,7 @@
	urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
	{
	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_frame *wh;
	struct ieee80211_node *ni;
	struct mbuf m = NULL, next;
	@@ -866,7 +837,7 @@
	}
	if (error != USB_ERR_CANCELLED) {
	usbd_xfer_set_stall(xfer);
	- if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+ counter_u64_add(ic->ic_ierrors, 1);
	goto tr_setup;
	}
	break;
	@@ -877,38 +848,19 @@
	urtwn_txeof(struct usb_xfer xfer, struct urtwn_data data)
	{
	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct mbuf *m;

	URTWN_ASSERT_LOCKED(sc);
	-
	- /*
	- * Do any tx complete callback. Note this must be done before releasing
	- * the node reference.
	- */
	- if (data->m) {
	- m = data->m;
	- if (m->m_flags & M_TXCB) {
	- /* XXX status? */
	- ieee80211_process_callback(data->ni, m, 0);
	- }
	- m_freem(m);
	- data->m = NULL;
	- }
	- if (data->ni) {
	- ieee80211_free_node(data->ni);
	- data->ni = NULL;
	- }
	+ /* XXX status? */
	+ ieee80211_tx_complete(data->ni, data->m, 0);
	+ data->ni = NULL;
	+ data->m = NULL;
	sc->sc_txtimer = 0;
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	}

	static void
	urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
	{
	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
	- struct ifnet *ifp = sc->sc_ifp;
	struct urtwn_data *data;

	URTWN_ASSERT_LOCKED(sc);
	@@ -933,16 +885,17 @@
	STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
	usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
	usbd_transfer_submit(xfer);
	- urtwn_start_locked(ifp, sc);
	+ urtwn_start(sc);
	break;
	default:
	data = STAILQ_FIRST(&sc->sc_tx_active);
	if (data == NULL)
	goto tr_setup;
	if (data->ni != NULL) {
	+ if_inc_counter(data->ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	ieee80211_free_node(data->ni);
	data->ni = NULL;
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	}
	if (error != USB_ERR_CANCELLED) {
	usbd_xfer_set_stall(xfer);
	@@ -975,11 +928,8 @@
	URTWN_ASSERT_LOCKED(sc);

	bf = _urtwn_getbuf(sc);
	- if (bf == NULL) {
	- struct ifnet *ifp = sc->sc_ifp;
	+ if (bf == NULL)
	DPRINTF("%s: stop queue\n", __func__);
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- }
	return (bf);
	}

	@@ -1302,7 +1252,7 @@

	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
	DPRINTF("regulatory type=%d\n", sc->regulatory);
	- IEEE80211_ADDR_COPY(sc->sc_bssid, rom->macaddr);
	+ IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);

	sc->sc_rf_write = urtwn_r92c_rf_write;
	sc->sc_power_on = urtwn_r92c_power_on;
	@@ -1363,7 +1313,7 @@
	if (sc->ofdm_tx_pwr_diff & 0x08)
	sc->ofdm_tx_pwr_diff \|= 0xf0;
	sc->regulatory = MS(sc->r88e_rom[0xc1], R92C_ROM_RF1_REGULATORY);
	- IEEE80211_ADDR_COPY(sc->sc_bssid, &sc->r88e_rom[0xd7]);
	+ IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, &sc->r88e_rom[0xd7]);

	sc->sc_rf_write = urtwn_r88e_rf_write;
	sc->sc_power_on = urtwn_r88e_power_on;
	@@ -1378,7 +1328,7 @@
	{
	static const uint8_t map[] =
	{ 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	struct ieee80211_node *ni;
	struct ieee80211_rateset *rs;
	@@ -1455,8 +1405,7 @@
	void
	urtwn_tsf_sync_enable(struct urtwn_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	struct ieee80211_node *ni = vap->iv_bss;

	@@ -1513,7 +1462,7 @@
	{
	struct urtwn_vap *uvp = URTWN_VAP(vap);
	struct ieee80211com *ic = vap->iv_ic;
	- struct urtwn_softc *sc = ic->ic_ifp->if_softc;
	+ struct urtwn_softc *sc = ic->ic_softc;
	struct ieee80211_node *ni;
	enum ieee80211_state ostate;
	uint32_t reg;
	@@ -1669,12 +1618,11 @@
	urtwn_watchdog(void *arg)
	{
	struct urtwn_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;

	if (sc->sc_txtimer > 0) {
	if (--sc->sc_txtimer == 0) {
	device_printf(sc->sc_dev, "device timeout\n");
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ counter_u64_add(sc->sc_ic.ic_oerrors, 1);
	return;
	}
	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
	@@ -1800,10 +1748,9 @@
	urtwn_tx_start(struct urtwn_softc sc, struct ieee80211_node ni,
	struct mbuf m0, struct urtwn_data data)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct ieee80211_frame *wh;
	struct ieee80211_key *k;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = ni->ni_vap;
	struct usb_xfer *xfer;
	struct r92c_tx_desc *txd;
	@@ -1942,89 +1889,78 @@
	return (0);
	}

	-static void
	-urtwn_start(struct ifnet *ifp)
	+static int
	+urtwn_transmit(struct ieee80211com ic, struct mbuf m)
	{
	- struct urtwn_softc *sc = ifp->if_softc;
	+ struct urtwn_softc *sc = ic->ic_softc;
	+ int error;

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
	- return;
	URTWN_LOCK(sc);
	- urtwn_start_locked(ifp, sc);
	+ if ((sc->sc_flags & URTWN_RUNNING) == 0) {
	+ URTWN_UNLOCK(sc);
	+ return (ENXIO);
	+ }
	+ error = mbufq_enqueue(&sc->sc_snd, m);
	+ if (error) {
	+ URTWN_UNLOCK(sc);
	+ return (error);
	+ }
	+ urtwn_start(sc);
	URTWN_UNLOCK(sc);
	+
	+ return (0);
	}

	static void
	-urtwn_start_locked(struct ifnet ifp, struct urtwn_softc sc)
	+urtwn_start(struct urtwn_softc *sc)
	{
	struct ieee80211_node *ni;
	struct mbuf *m;
	struct urtwn_data *bf;

	URTWN_ASSERT_LOCKED(sc);
	- for (;;) {
	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
	- if (m == NULL)
	- break;
	+ while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
	bf = urtwn_getbuf(sc);
	if (bf == NULL) {
	- IFQ_DRV_PREPEND(&ifp->if_snd, m);
	+ mbufq_prepend(&sc->sc_snd, m);
	break;
	}
	ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
	m->m_pkthdr.rcvif = NULL;
	-
	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ if_inc_counter(ni->ni_vap->iv_ifp,
	+ IFCOUNTER_OERRORS, 1);
	STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
	ieee80211_free_node(ni);
	break;
	}
	-
	sc->sc_txtimer = 5;
	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
	}
	}

	-static int
	-urtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+static void
	+urtwn_parent(struct ieee80211com *ic)
	{
	- struct urtwn_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ifreq ifr = (struct ifreq ) data;
	- int error = 0, startall = 0;
	+ struct urtwn_softc *sc = ic->ic_softc;
	+ int startall = 0;

	URTWN_LOCK(sc);
	- error = (sc->sc_flags & URTWN_DETACHED) ? ENXIO : 0;
	+ if (sc->sc_flags & URTWN_DETACHED) {
	+ URTWN_UNLOCK(sc);
	+ return;
	+ }
	+ if (ic->ic_nrunning > 0) {
	+ if ((sc->sc_flags & URTWN_RUNNING) == 0) {
	+ urtwn_init(sc);
	+ startall = 1;
	+ }
	+ } else if (sc->sc_flags & URTWN_RUNNING)
	+ urtwn_stop(sc);
	URTWN_UNLOCK(sc);
	- if (error != 0)
	- return (error);

	- switch (cmd) {
	- case SIOCSIFFLAGS:
	- if (ifp->if_flags & IFF_UP) {
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	- urtwn_init(ifp->if_softc);
	- startall = 1;
	- }
	- } else {
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- urtwn_stop(ifp);
	- }
	- if (startall)
	- ieee80211_start_all(ic);
	- break;
	- case SIOCGIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- case SIOCGIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	- default:
	- error = EINVAL;
	- break;
	- }
	- return (error);
	+ if (startall)
	+ ieee80211_start_all(ic);
	}

	static int
	@@ -2938,7 +2874,7 @@
	struct ieee80211_channel c, struct ieee80211_channel extc,
	uint16_t power[URTWN_RIDX_COUNT])
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct r92c_rom *rom = &sc->rom;
	uint16_t cckpow, ofdmpow, htpow, diff, max;
	const struct urtwn_txpwr *base;
	@@ -3037,7 +2973,7 @@
	struct ieee80211_channel c, struct ieee80211_channel extc,
	uint16_t power[URTWN_RIDX_COUNT])
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint16_t cckpow, ofdmpow, bw20pow, htpow;
	const struct urtwn_r88e_txpwr *base;
	int ridx, chan, group;
	@@ -3134,7 +3070,7 @@
	static void
	urtwn_set_channel(struct ieee80211com *ic)
	{
	- struct urtwn_softc *sc = ic->ic_ifp->if_softc;
	+ struct urtwn_softc *sc = ic->ic_softc;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	URTWN_LOCK(sc);
	@@ -3156,7 +3092,7 @@
	urtwn_set_chan(struct urtwn_softc sc, struct ieee80211_channel c,
	struct ieee80211_channel *extc)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	uint32_t reg;
	u_int chan;
	int i;
	@@ -3287,17 +3223,18 @@
	}

	static void
	-urtwn_init_locked(void *arg)
	+urtwn_init(struct urtwn_softc *sc)
	{
	- struct urtwn_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;
	+ struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	+ uint8_t macaddr[IEEE80211_ADDR_LEN];
	uint32_t reg;
	int error;

	URTWN_ASSERT_LOCKED(sc);

	- if (ifp->if_drv_flags & IFF_DRV_RUNNING)
	- urtwn_stop_locked(ifp);
	+ if (sc->sc_flags & URTWN_RUNNING)
	+ urtwn_stop(sc);

	/* Init firmware commands ring. */
	sc->fwcur = 0;
	@@ -3340,8 +3277,8 @@
	}

	/* Set MAC address. */
	- urtwn_write_region_1(sc, R92C_MACID, IF_LLADDR(ifp),
	- IEEE80211_ADDR_LEN);
	+ IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
	+ urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);

	/* Set initial network type. */
	reg = urtwn_read_4(sc, R92C_CR);
	@@ -3465,8 +3402,7 @@

	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);

	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	+ sc->sc_flags \|= URTWN_RUNNING;

	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
	fail:
	@@ -3474,39 +3410,16 @@
	}

	static void
	-urtwn_init(void *arg)
	-{
	- struct urtwn_softc *sc = arg;
	-
	- URTWN_LOCK(sc);
	- urtwn_init_locked(arg);
	- URTWN_UNLOCK(sc);
	-}
	-
	-static void
	-urtwn_stop_locked(struct ifnet *ifp)
	+urtwn_stop(struct urtwn_softc *sc)
	{
	- struct urtwn_softc *sc = ifp->if_softc;

	URTWN_ASSERT_LOCKED(sc);
	-
	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	-
	+ sc->sc_flags &= ~URTWN_RUNNING;
	callout_stop(&sc->sc_watchdog_ch);
	urtwn_abort_xfers(sc);
	}

	static void
	-urtwn_stop(struct ifnet *ifp)
	-{
	- struct urtwn_softc *sc = ifp->if_softc;
	-
	- URTWN_LOCK(sc);
	- urtwn_stop_locked(ifp);
	- URTWN_UNLOCK(sc);
	-}
	-
	-static void
	urtwn_abort_xfers(struct urtwn_softc *sc)
	{
	int i;
	@@ -3523,12 +3436,11 @@
	const struct ieee80211_bpf_params *params)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct urtwn_softc *sc = ifp->if_softc;
	+ struct urtwn_softc *sc = ic->ic_softc;
	struct urtwn_data *bf;

	/* prevent management frames from being sent if we're not ready */
	- if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
	+ if (!(sc->sc_flags & URTWN_RUNNING)) {
	m_freem(m);
	ieee80211_free_node(ni);
	return (ENETDOWN);
	@@ -3542,10 +3454,8 @@
	return (ENOBUFS);
	}

	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
	ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
	URTWN_UNLOCK(sc);
	return (EIO);
	Index: sys/dev/usb/wlan/if_urtwnreg.h
	===================================================================
	--- sys/dev/usb/wlan/if_urtwnreg.h
	+++ sys/dev/usb/wlan/if_urtwnreg.h
	@@ -1172,7 +1172,8 @@
	#define URTWN_EP_QUEUES URTWN_BULK_RX

	struct urtwn_softc {
	- struct ifnet *sc_ifp;
	+ struct ieee80211com sc_ic;
	+ struct mbufq sc_snd;
	device_t sc_dev;
	struct usb_device *sc_udev;

	@@ -1180,6 +1181,7 @@
	u_int sc_flags;
	#define URTWN_FLAG_CCK_HIPWR 0x01
	#define URTWN_DETACHED 0x02
	+#define URTWN_RUNNING 0x04

	u_int chip;
	#define URTWN_CHIP_92C 0x01
	@@ -1224,7 +1226,6 @@
	uint8_t ht40_tx_pwr[5];
	int8_t bw20_tx_pwr_diff;
	int8_t ofdm_tx_pwr_diff;
	- uint8_t sc_bssid[IEEE80211_ADDR_LEN];

	struct callout sc_watchdog_ch;
	struct mtx sc_mtx;
	Index: sys/dev/wpi/if_wpi.c
	===================================================================
	--- sys/dev/wpi/if_wpi.c
	+++ sys/dev/wpi/if_wpi.c
	@@ -205,12 +205,12 @@
	const struct ieee80211_bpf_params *);
	static int wpi_raw_xmit(struct ieee80211_node , struct mbuf ,
	const struct ieee80211_bpf_params *);
	-static void wpi_start(struct ifnet *);
	-static void wpi_start_task(void *, int);
	+static int wpi_transmit(struct ieee80211com , struct mbuf );
	+static void wpi_start(void *, int);
	static void wpi_watchdog_rfkill(void *);
	static void wpi_scan_timeout(void *);
	static void wpi_tx_timeout(void *);
	-static int wpi_ioctl(struct ifnet *, u_long, caddr_t);
	+static void wpi_parent(struct ieee80211com *);
	static int wpi_cmd(struct wpi_softc , int, const void , size_t, int);
	static int wpi_mrr_setup(struct wpi_softc *);
	static int wpi_add_node(struct wpi_softc , struct ieee80211_node );
	@@ -272,7 +272,7 @@
	static void wpi_hw_stop(struct wpi_softc *);
	static void wpi_radio_on(void *, int);
	static void wpi_radio_off(void *, int);
	-static void wpi_init(void *);
	+static int wpi_init(struct wpi_softc *);
	static void wpi_stop_locked(struct wpi_softc *);
	static void wpi_stop(struct wpi_softc *);
	static void wpi_scan_start(struct ieee80211com *);
	@@ -329,13 +329,11 @@
	{
	struct wpi_softc sc = (struct wpi_softc )device_get_softc(dev);
	struct ieee80211com *ic;
	- struct ifnet *ifp;
	int i, error, rid;
	#ifdef WPI_DEBUG
	int supportsa = 1;
	const struct wpi_ident *ident;
	#endif
	- uint8_t macaddr[IEEE80211_ADDR_LEN];

	sc->sc_dev = dev;

	@@ -445,14 +443,7 @@
	/* Clear pending interrupts. */
	WPI_WRITE(sc, WPI_INT, 0xffffffff);

	- ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
	- if (ifp == NULL) {
	- device_printf(dev, "can not allocate ifnet structure\n");
	- goto fail;
	- }
	-
	- ic = ifp->if_l2com;
	- ic->ic_ifp = ifp;
	+ ic = &sc->sc_ic;
	ic->ic_softc = sc;
	ic->ic_name = device_get_nameunit(dev);
	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
	@@ -481,7 +472,7 @@
	* Read in the eeprom and also setup the channels for
	* net80211. We don't set the rates as net80211 does this for us
	*/
	- if ((error = wpi_read_eeprom(sc, macaddr)) != 0) {
	+ if ((error = wpi_read_eeprom(sc, ic->ic_macaddr)) != 0) {
	device_printf(dev, "could not read EEPROM, error %d\n",
	error);
	goto fail;
	@@ -503,20 +494,12 @@
	}
	#endif

	- if_initname(ifp, device_get_name(dev), device_get_unit(dev));
	- ifp->if_softc = sc;
	- ifp->if_flags = IFF_BROADCAST \| IFF_SIMPLEX \| IFF_MULTICAST;
	- ifp->if_init = wpi_init;
	- ifp->if_ioctl = wpi_ioctl;
	- ifp->if_start = wpi_start;
	- IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
	- ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
	- IFQ_SET_READY(&ifp->if_snd);
	-
	- ieee80211_ifattach(ic, macaddr);
	+ ieee80211_ifattach(ic);
	ic->ic_vap_create = wpi_vap_create;
	ic->ic_vap_delete = wpi_vap_delete;
	+ ic->ic_parent = wpi_parent;
	ic->ic_raw_xmit = wpi_raw_xmit;
	+ ic->ic_transmit = wpi_transmit;
	ic->ic_node_alloc = wpi_node_alloc;
	sc->sc_node_free = ic->ic_node_free;
	ic->ic_node_free = wpi_node_free;
	@@ -543,7 +526,7 @@
	TASK_INIT(&sc->sc_reinittask, 0, wpi_hw_reset, sc);
	TASK_INIT(&sc->sc_radiooff_task, 0, wpi_radio_off, sc);
	TASK_INIT(&sc->sc_radioon_task, 0, wpi_radio_on, sc);
	- TASK_INIT(&sc->sc_start_task, 0, wpi_start_task, sc);
	+ TASK_INIT(&sc->sc_start_task, 0, wpi_start, sc);

	sc->sc_tq = taskqueue_create("wpi_taskq", M_WAITOK,
	taskqueue_thread_enqueue, &sc->sc_tq);
	@@ -588,14 +571,13 @@
	static void
	wpi_radiotap_attach(struct wpi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct wpi_rx_radiotap_header *rxtap = &sc->sc_rxtap;
	+ struct wpi_tx_radiotap_header *txtap = &sc->sc_txtap;
	+
	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_BEGIN, __func__);
	- ieee80211_radiotap_attach(ic,
	- &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
	- WPI_TX_RADIOTAP_PRESENT,
	- &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
	- WPI_RX_RADIOTAP_PRESENT);
	+ ieee80211_radiotap_attach(&sc->sc_ic,
	+ &txtap->wt_ihdr, sizeof(*txtap), WPI_TX_RADIOTAP_PRESENT,
	+ &rxtap->wr_ihdr, sizeof(*rxtap), WPI_RX_RADIOTAP_PRESENT);
	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_END, __func__);
	}

	@@ -646,12 +628,9 @@
	if (!TAILQ_EMPTY(&ic->ic_vaps)) /* only one at a time */
	return NULL;

	- wvp = (struct wpi_vap *) malloc(sizeof(struct wpi_vap),
	- M_80211_VAP, M_NOWAIT \| M_ZERO);
	- if (wvp == NULL)
	- return NULL;
	+ wvp = malloc(sizeof(struct wpi_vap), M_80211_VAP, M_WAITOK \| M_ZERO);
	vap = &wvp->wv_vap;
	- ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
	+ ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);

	if (opmode == IEEE80211_M_IBSS \|\| opmode == IEEE80211_M_HOSTAP) {
	WPI_VAP_LOCK_INIT(wvp);
	@@ -671,7 +650,7 @@
	ieee80211_ratectl_init(vap);
	/* Complete setup. */
	ieee80211_vap_attach(vap, ieee80211_media_change,
	- ieee80211_media_status);
	+ ieee80211_media_status, mac);
	ic->ic_opmode = opmode;
	return vap;
	}
	@@ -700,22 +679,21 @@
	wpi_detach(device_t dev)
	{
	struct wpi_softc *sc = device_get_softc(dev);
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic;
	+ struct ieee80211com *ic = &sc->sc_ic;
	int qid;

	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_BEGIN, __func__);

	- if (ifp != NULL) {
	- ic = ifp->if_l2com;
	-
	+ if (ic->ic_vap_create == wpi_vap_create) {
	ieee80211_draintask(ic, &sc->sc_radioon_task);
	ieee80211_draintask(ic, &sc->sc_start_task);

	wpi_stop(sc);

	- taskqueue_drain_all(sc->sc_tq);
	- taskqueue_free(sc->sc_tq);
	+ if (sc->sc_tq != NULL) {
	+ taskqueue_drain_all(sc->sc_tq);
	+ taskqueue_free(sc->sc_tq);
	+ }

	callout_drain(&sc->watchdog_rfkill);
	callout_drain(&sc->tx_timeout);
	@@ -748,9 +726,6 @@
	bus_release_resource(dev, SYS_RES_MEMORY,
	rman_get_rid(sc->mem), sc->mem);

	- if (ifp != NULL)
	- if_free(ifp);
	-
	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_END, __func__);
	WPI_TXQ_STATE_LOCK_DESTROY(sc);
	WPI_TXQ_LOCK_DESTROY(sc);
	@@ -774,7 +749,7 @@
	wpi_suspend(device_t dev)
	{
	struct wpi_softc *sc = device_get_softc(dev);
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	ieee80211_suspend_all(ic);
	return 0;
	@@ -784,7 +759,7 @@
	wpi_resume(device_t dev)
	{
	struct wpi_softc *sc = device_get_softc(dev);
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	/* Clear device-specific "PCI retry timeout" register (41h). */
	pci_write_config(dev, 0x41, 0, 1);
	@@ -1191,6 +1166,7 @@
	ring->queued = 0;
	ring->cur = 0;
	ring->update = 0;
	+ mbufq_init(&ring->snd, ifqmaxlen);

	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_BEGIN, __func__);

	@@ -1318,6 +1294,7 @@
	memset(ring->desc, 0, ring->desc_dma.size);
	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
	BUS_DMASYNC_PREWRITE);
	+ mbufq_drain(&ring->snd);
	sc->qfullmsk &= ~(1 << ring->qid);
	ring->queued = 0;
	ring->cur = 0;
	@@ -1448,8 +1425,7 @@
	static void
	wpi_read_eeprom_band(struct wpi_softc *sc, int n)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct wpi_eeprom_chan *channels = sc->eeprom_channels[n];
	const struct wpi_chan_band *band = &wpi_bands[n];
	struct ieee80211_channel *c;
	@@ -1506,8 +1482,7 @@
	static int
	wpi_read_eeprom_channels(struct wpi_softc *sc, int n)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	const struct wpi_chan_band *band = &wpi_bands[n];
	int error;

	@@ -1549,8 +1524,7 @@
	wpi_setregdomain(struct ieee80211com ic, struct ieee80211_regdomain rd,
	int nchan, struct ieee80211_channel chans[])
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct wpi_softc *sc = ifp->if_softc;
	+ struct wpi_softc *sc = ic->ic_softc;
	int i;

	for (i = 0; i < nchan; i++) {
	@@ -1559,8 +1533,7 @@

	channel = wpi_find_eeprom_channel(sc, c);
	if (channel == NULL) {
	- if_printf(ic->ic_ifp,
	- "%s: invalid channel %u freq %u/0x%x\n",
	+ ic_printf(ic, "%s: invalid channel %u freq %u/0x%x\n",
	__func__, c->ic_ieee, c->ic_freq, c->ic_flags);
	return EINVAL;
	}
	@@ -1672,8 +1645,7 @@
	static void
	wpi_node_free(struct ieee80211_node *ni)
	{
	- struct ieee80211com *ic = ni->ni_ic;
	- struct wpi_softc *sc = ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ni->ni_ic->ic_softc;
	struct wpi_node *wn = WPI_NODE(ni);

	if (wn->id != WPI_ID_UNDEFINED) {
	@@ -1700,7 +1672,7 @@
	int rssi, int nf)
	{
	struct ieee80211vap *vap = ni->ni_vap;
	- struct wpi_softc *sc = vap->iv_ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = vap->iv_ic->ic_softc;
	struct wpi_vap *wvp = WPI_VAP(vap);
	uint64_t ni_tstamp, rx_tstamp;

	@@ -1744,7 +1716,7 @@
	static void
	wpi_restore_node_table(struct wpi_softc sc, struct wpi_vap wvp)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	/* Set group keys once. */
	WPI_NT_LOCK(sc);
	@@ -1763,12 +1735,20 @@
	{
	struct wpi_vap *wvp = WPI_VAP(vap);
	struct ieee80211com *ic = vap->iv_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct wpi_softc *sc = ifp->if_softc;
	+ struct wpi_softc *sc = ic->ic_softc;
	int error = 0;

	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_BEGIN, __func__);

	+ WPI_TXQ_LOCK(sc);
	+ if (nstate > IEEE80211_S_INIT && sc->sc_running == 0) {
	+ DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_END_ERR, __func__);
	+ WPI_TXQ_UNLOCK(sc);
	+
	+ return ENXIO;
	+ }
	+ WPI_TXQ_UNLOCK(sc);
	+
	DPRINTF(sc, WPI_DEBUG_STATE, "%s: %s -> %s\n", __func__,
	ieee80211_state_name[vap->iv_state],
	ieee80211_state_name[nstate]);
	@@ -1937,8 +1917,7 @@
	wpi_rx_done(struct wpi_softc sc, struct wpi_rx_desc desc,
	struct wpi_rx_data *data)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct wpi_rx_ring *ring = &sc->rxq;
	struct wpi_rx_stat *stat;
	struct wpi_rx_head *head;
	@@ -2019,7 +1998,6 @@
	BUS_DMASYNC_PREWRITE);

	/* Finalize mbuf. */
	- m->m_pkthdr.rcvif = ifp;
	m->m_data = (caddr_t)(head + 1);
	m->m_pkthdr.len = m->m_len = len;

	@@ -2073,7 +2051,7 @@

	fail2: m_freem(m);

	-fail1: if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
	+fail1: counter_u64_add(ic->ic_ierrors, 1);
	}

	static void
	@@ -2086,7 +2064,6 @@
	static void
	wpi_tx_done(struct wpi_softc sc, struct wpi_rx_desc desc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct wpi_tx_ring *ring = &sc->txq[desc->qid & 0x3];
	struct wpi_tx_data *data = &ring->data[desc->idx];
	struct wpi_tx_stat stat = (struct wpi_tx_stat )(desc + 1);
	@@ -2119,14 +2096,11 @@
	* Update rate control statistics for the node.
	*/
	if (status & WPI_TX_STATUS_FAIL) {
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	ieee80211_ratectl_tx_complete(vap, ni,
	IEEE80211_RATECTL_TX_FAILURE, &ackfailcnt, NULL);
	- } else {
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	+ } else
	ieee80211_ratectl_tx_complete(vap, ni,
	IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
	- }

	ieee80211_tx_complete(ni, m, (status & WPI_TX_STATUS_FAIL) != 0);

	@@ -2135,17 +2109,10 @@
	if (ring->queued > 0) {
	callout_reset(&sc->tx_timeout, 5*hz, wpi_tx_timeout, sc);

	- if (sc->qfullmsk != 0 &&
	- ring->queued < WPI_TX_RING_LOMARK) {
	+ if ((sc->qfullmsk & (1 << ring->qid)) != 0 &&
	+ ring->queued < WPI_TX_RING_LOMARK) {
	sc->qfullmsk &= ~(1 << ring->qid);
	- IF_LOCK(&ifp->if_snd);
	- if (sc->qfullmsk == 0 &&
	- (ifp->if_drv_flags & IFF_DRV_OACTIVE)) {
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	- ieee80211_runtask(ic, &sc->sc_start_task);
	- } else
	- IF_UNLOCK(&ifp->if_snd);
	+ ieee80211_runtask(ic, &sc->sc_start_task);
	}
	} else
	callout_stop(&sc->tx_timeout);
	@@ -2203,8 +2170,7 @@
	static void
	wpi_notif_intr(struct wpi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t hw;

	@@ -2239,7 +2205,7 @@
	/* An 802.11 frame has been received. */
	wpi_rx_done(sc, desc, data);

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	+ if (sc->sc_running == 0) {
	/* wpi_stop() was called. */
	return;
	}
	@@ -2328,6 +2294,7 @@
	device_printf(sc->sc_dev,
	"microcontroller initialization failed\n");
	wpi_stop_locked(sc);
	+ return;
	}
	/* Save the address of the error log in SRAM. */
	sc->errptr = le32toh(uc->errptr);
	@@ -2558,7 +2525,6 @@
	wpi_intr(void *arg)
	{
	struct wpi_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	uint32_t r1, r2;

	WPI_LOCK(sc);
	@@ -2608,7 +2574,7 @@

	done:
	/* Re-enable interrupts. */
	- if (ifp->if_flags & IFF_UP)
	+ if (sc->sc_running)
	WPI_WRITE(sc, WPI_INT_MASK, WPI_INT_MASK_DEF);

	end: WPI_UNLOCK(sc);
	@@ -2617,7 +2583,6 @@
	static int
	wpi_cmd2(struct wpi_softc sc, struct wpi_buf buf)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	struct ieee80211_frame *wh;
	struct wpi_tx_cmd *cmd;
	struct wpi_tx_data *data;
	@@ -2633,7 +2598,7 @@

	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_BEGIN, __func__);

	- if (sc->txq_active == 0) {
	+ if (sc->sc_running == 0) {
	/* wpi_stop() was called */
	error = ENETDOWN;
	goto fail;
	@@ -2730,14 +2695,8 @@
	if (ring->qid < WPI_CMD_QUEUE_NUM) {
	/* Mark TX ring as full if we reach a certain threshold. */
	WPI_TXQ_STATE_LOCK(sc);
	- if (++ring->queued > WPI_TX_RING_HIMARK) {
	+ if (++ring->queued > WPI_TX_RING_HIMARK)
	sc->qfullmsk \|= 1 << ring->qid;
	-
	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags \|= IFF_DRV_OACTIVE;
	- IF_UNLOCK(&ifp->if_snd);
	- }
	-
	callout_reset(&sc->tx_timeout, 5*hz, wpi_tx_timeout, sc);
	WPI_TXQ_STATE_UNLOCK(sc);
	}
	@@ -3031,24 +2990,47 @@
	return wpi_cmd2(sc, &tx_data);
	}

	+static __inline int
	+wpi_tx_ring_is_full(struct wpi_softc *sc, int ac)
	+{
	+ struct wpi_tx_ring *ring = &sc->txq[ac];
	+ int retval;
	+
	+ WPI_TXQ_STATE_LOCK(sc);
	+ retval = (ring->queued > WPI_TX_RING_HIMARK);
	+ WPI_TXQ_STATE_UNLOCK(sc);
	+
	+ return retval;
	+}
	+
	+static __inline void
	+wpi_handle_tx_failure(struct ieee80211_node *ni)
	+{
	+ /* NB: m is reclaimed on tx failure */
	+ if_inc_counter(ni->ni_vap->iv_ifp, IFCOUNTER_OERRORS, 1);
	+ ieee80211_free_node(ni);
	+}
	+
	static int
	wpi_raw_xmit(struct ieee80211_node ni, struct mbuf m,
	const struct ieee80211_bpf_params *params)
	{
	struct ieee80211com *ic = ni->ni_ic;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct wpi_softc *sc = ifp->if_softc;
	- int error = 0;
	+ struct wpi_softc *sc = ic->ic_softc;
	+ int ac, error = 0;

	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_BEGIN, __func__);

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	- ieee80211_free_node(ni);
	+ ac = M_WME_GETAC(m);
	+
	+ WPI_TX_LOCK(sc);
	+
	+ if (sc->sc_running == 0 \|\| wpi_tx_ring_is_full(sc, ac)) {
	m_freem(m);
	- return ENETDOWN;
	+ error = sc->sc_running ? ENOBUFS : ENETDOWN;
	+ goto unlock;
	}

	- WPI_TX_LOCK(sc);
	if (params == NULL) {
	/*
	* Legacy path; interpret frame contents to decide
	@@ -3062,13 +3044,11 @@
	*/
	error = wpi_tx_data_raw(sc, m, ni, params);
	}
	- WPI_TX_UNLOCK(sc);

	- if (error != 0) {
	- /* NB: m is reclaimed on tx failure */
	- ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+unlock: WPI_TX_UNLOCK(sc);

	+ if (error != 0) {
	+ wpi_handle_tx_failure(ni);
	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_END_ERR, __func__);

	return error;
	@@ -3079,57 +3059,88 @@
	return 0;
	}

	-/**
	- * Process data waiting to be sent on the IFNET output queue
	- */
	-static void
	-wpi_start(struct ifnet *ifp)
	+static int
	+wpi_transmit(struct ieee80211com ic, struct mbuf m)
	{
	- struct wpi_softc *sc = ifp->if_softc;
	+ struct wpi_softc *sc = ic->ic_softc;
	struct ieee80211_node *ni;
	- struct mbuf *m;
	+ struct mbufq *sndq;
	+ int ac, error;

	WPI_TX_LOCK(sc);
	DPRINTF(sc, WPI_DEBUG_XMIT, "%s: called\n", __func__);

	- for (;;) {
	- IF_LOCK(&ifp->if_snd);
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 \|\|
	- (ifp->if_drv_flags & IFF_DRV_OACTIVE)) {
	- IF_UNLOCK(&ifp->if_snd);
	- break;
	- }
	- IF_UNLOCK(&ifp->if_snd);
	+ /* Check if interface is up & running. */
	+ if (sc->sc_running == 0) {
	+ error = ENXIO;
	+ goto unlock;
	+ }

	- IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
	- if (m == NULL)
	- break;
	- ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
	- if (wpi_tx_data(sc, m, ni) != 0) {
	- ieee80211_free_node(ni);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	- }
	+ /* Check for available space. */
	+ ac = M_WME_GETAC(m);
	+ sndq = &sc->txq[ac].snd;
	+ if (wpi_tx_ring_is_full(sc, ac) \|\| mbufq_len(sndq) != 0) {
	+ /* wpi_tx_done() will dequeue it. */
	+ error = mbufq_enqueue(sndq, m);
	+ goto unlock;
	+ }
	+
	+ error = 0;
	+ ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
	+ if (wpi_tx_data(sc, m, ni) != 0) {
	+ wpi_handle_tx_failure(ni);
	}

	DPRINTF(sc, WPI_DEBUG_XMIT, "%s: done\n", __func__);
	- WPI_TX_UNLOCK(sc);
	+
	+unlock: WPI_TX_UNLOCK(sc);
	+
	+ return (error);
	}

	+/**
	+ * Process data waiting to be sent on the output queue
	+ */
	static void
	-wpi_start_task(void *arg0, int pending)
	+wpi_start(void *arg0, int pending)
	{
	struct wpi_softc *sc = arg0;
	- struct ifnet *ifp = sc->sc_ifp;
	+ struct ieee80211_node *ni;
	+ struct mbuf *m;
	+ uint8_t i;
	+
	+ WPI_TX_LOCK(sc);
	+ if (sc->sc_running == 0)
	+ goto unlock;

	- wpi_start(ifp);
	+ DPRINTF(sc, WPI_DEBUG_XMIT, "%s: called\n", __func__);
	+
	+ for (i = 0; i < WPI_CMD_QUEUE_NUM; i++) {
	+ struct mbufq *sndq = &sc->txq[i].snd;
	+
	+ for (;;) {
	+ if (wpi_tx_ring_is_full(sc, i))
	+ break;
	+
	+ if ((m = mbufq_dequeue(sndq)) == NULL)
	+ break;
	+
	+ ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
	+ if (wpi_tx_data(sc, m, ni) != 0) {
	+ wpi_handle_tx_failure(ni);
	+ }
	+ }
	+ }
	+
	+ DPRINTF(sc, WPI_DEBUG_XMIT, "%s: done\n", __func__);
	+unlock: WPI_TX_UNLOCK(sc);
	}

	static void
	wpi_watchdog_rfkill(void *arg)
	{
	struct wpi_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;

	DPRINTF(sc, WPI_DEBUG_WATCHDOG, "RFkill Watchdog: tick\n");

	@@ -3146,9 +3157,9 @@
	wpi_scan_timeout(void *arg)
	{
	struct wpi_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;

	- if_printf(ifp, "scan timeout\n");
	+ ic_printf(ic, "scan timeout\n");
	taskqueue_enqueue(sc->sc_tq, &sc->sc_reinittask);
	}

	@@ -3156,44 +3167,28 @@
	wpi_tx_timeout(void *arg)
	{
	struct wpi_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	+ struct ieee80211com *ic = &sc->sc_ic;

	- if_printf(ifp, "device timeout\n");
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	+ ic_printf(ic, "device timeout\n");
	taskqueue_enqueue(sc->sc_tq, &sc->sc_reinittask);
	}

	-static int
	-wpi_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	+static void
	+wpi_parent(struct ieee80211com *ic)
	{
	- struct wpi_softc *sc = ifp->if_softc;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct wpi_softc *sc = ic->ic_softc;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	- struct ifreq ifr = (struct ifreq ) data;
	- int error = 0;

	- switch (cmd) {
	- case SIOCGIFADDR:
	- error = ether_ioctl(ifp, cmd, data);
	- break;
	- case SIOCSIFFLAGS:
	- if (ifp->if_flags & IFF_UP) {
	- wpi_init(sc);
	-
	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 &&
	- vap != NULL)
	- ieee80211_stop(vap);
	- } else if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
	- wpi_stop(sc);
	- break;
	- case SIOCGIFMEDIA:
	- error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
	- break;
	- default:
	- error = EINVAL;
	- break;
	- }
	- return error;
	+ if (ic->ic_nrunning > 0) {
	+ if (wpi_init(sc) == 0) {
	+ ieee80211_notify_radio(ic, 1);
	+ ieee80211_start_all(ic);
	+ } else {
	+ ieee80211_notify_radio(ic, 0);
	+ ieee80211_stop(vap);
	+ }
	+ } else
	+ wpi_stop(sc);
	}

	/*
	@@ -3215,9 +3210,13 @@

	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_BEGIN, __func__);

	- if (sc->txq_active == 0) {
	+ if (sc->sc_running == 0) {
	/* wpi_stop() was called */
	- error = 0;
	+ if (code == WPI_CMD_SCAN)
	+ error = ENETDOWN;
	+ else
	+ error = 0;
	+
	goto fail;
	}

	@@ -3283,10 +3282,7 @@

	WPI_TXQ_UNLOCK(sc);

	- if (async)
	- return 0;
	-
	- return mtx_sleep(cmd, &sc->sc_mtx, PCATCH, "wpicmd", hz);
	+ return async ? 0 : mtx_sleep(cmd, &sc->sc_mtx, PCATCH, "wpicmd", hz);

	fail: DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_END_ERR, __func__);

	@@ -3301,8 +3297,7 @@
	static int
	wpi_mrr_setup(struct wpi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct wpi_mrr_setup mrr;
	int i, error;

	@@ -3399,14 +3394,13 @@
	static int
	wpi_add_broadcast_node(struct wpi_softc *sc, int async)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct wpi_node_info node;

	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_DOING, __func__);

	memset(&node, 0, sizeof node);
	- IEEE80211_ADDR_COPY(node.macaddr, ifp->if_broadcastaddr);
	+ IEEE80211_ADDR_COPY(node.macaddr, ieee80211broadcastaddr);
	node.id = WPI_ID_BROADCAST;
	node.plcp = (ic->ic_curmode == IEEE80211_MODE_11A) ?
	wpi_ridx_to_plcp[WPI_RIDX_OFDM6] : wpi_ridx_to_plcp[WPI_RIDX_CCK1];
	@@ -3492,7 +3486,7 @@
	wpi_updateedca(struct ieee80211com *ic)
	{
	#define WPI_EXP2(x) ((1 << (x)) - 1) /* CWmin = 2^ECWmin - 1 */
	- struct wpi_softc *sc = ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ic->ic_softc;
	struct wpi_edca_params cmd;
	int aci, error;

	@@ -3526,8 +3520,7 @@
	static void
	wpi_set_promisc(struct wpi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	uint32_t promisc_filter;

	@@ -3535,7 +3528,7 @@
	if (vap != NULL && vap->iv_opmode != IEEE80211_M_HOSTAP)
	promisc_filter \|= WPI_FILTER_PROMISC;

	- if (ifp->if_flags & IFF_PROMISC)
	+ if (ic->ic_promisc > 0)
	sc->rxon.filter \|= htole32(promisc_filter);
	else
	sc->rxon.filter &= ~htole32(promisc_filter);
	@@ -3900,8 +3893,7 @@
	static int
	wpi_config(struct wpi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	struct ieee80211_channel *c = ic->ic_curchan;
	int error;
	@@ -4011,7 +4003,7 @@
	static uint16_t
	wpi_limit_dwell(struct wpi_softc *sc, uint16_t dwell_time)
	{
	- struct ieee80211com *ic = sc->sc_ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
	int bintval = 0;

	@@ -4068,8 +4060,7 @@
	static int
	wpi_scan(struct wpi_softc sc, struct ieee80211_channel c)
	{
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211_scan_state *ss = ic->ic_scan;
	struct ieee80211vap *vap = ss->ss_vap;
	struct wpi_scan_hdr *hdr;
	@@ -4171,11 +4162,9 @@
	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 \| IEEE80211_FC0_TYPE_MGT \|
	IEEE80211_FC0_SUBTYPE_PROBE_REQ;
	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
	- IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
	+ IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
	IEEE80211_ADDR_COPY(wh->i_addr2, vap->iv_myaddr);
	- IEEE80211_ADDR_COPY(wh->i_addr3, ifp->if_broadcastaddr);
	- (uint16_t )&wh->i_dur[0] = 0; /* filled by h/w */
	- (uint16_t )&wh->i_seq[0] = 0; /* filled by h/w */
	+ IEEE80211_ADDR_COPY(wh->i_addr3, ieee80211broadcastaddr);

	frm = (uint8_t *)(wh + 1);
	frm = ieee80211_add_ssid(frm, NULL, 0);
	@@ -4206,7 +4195,6 @@
	/*
	* Calculate the active/passive dwell times.
	*/
	-
	dwell_active = wpi_get_active_dwell_time(sc, c, nssid);
	dwell_passive = wpi_get_passive_dwell_time(sc, c);

	@@ -4324,7 +4312,7 @@
	struct ieee80211com *ic = wvp->wv_vap.iv_ic;
	struct ieee80211_beacon_offsets *bo = &wvp->wv_boff;
	struct wpi_buf *bcn = &wvp->wv_bcbuf;
	- struct wpi_softc *sc = ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ic->ic_softc;
	struct wpi_cmd_beacon cmd = (struct wpi_cmd_beacon )&bcn->data;
	struct ieee80211_tim_ie *tie;
	struct mbuf *m;
	@@ -4406,7 +4394,7 @@
	static void
	wpi_update_beacon(struct ieee80211vap *vap, int item)
	{
	- struct wpi_softc *sc = vap->iv_ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = vap->iv_ic->ic_softc;
	struct wpi_vap *wvp = WPI_VAP(vap);
	struct wpi_buf *bcn = &wvp->wv_bcbuf;
	struct ieee80211_beacon_offsets *bo = &wvp->wv_boff;
	@@ -4448,7 +4436,7 @@
	wpi_newassoc(struct ieee80211_node *ni, int isnew)
	{
	struct ieee80211vap *vap = ni->ni_vap;
	- struct wpi_softc *sc = ni->ni_ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ni->ni_ic->ic_softc;
	struct wpi_node *wn = WPI_NODE(ni);
	int error;

	@@ -4575,7 +4563,7 @@
	{
	const struct ieee80211_cipher *cip = k->wk_cipher;
	struct ieee80211vap *vap = ni->ni_vap;
	- struct wpi_softc *sc = ni->ni_ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ni->ni_ic->ic_softc;
	struct wpi_node *wn = WPI_NODE(ni);
	struct wpi_node_info node;
	uint16_t kflags;
	@@ -4639,7 +4627,7 @@
	{
	const struct ieee80211_key *k = arg;
	struct ieee80211vap *vap = ni->ni_vap;
	- struct wpi_softc *sc = ni->ni_ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ni->ni_ic->ic_softc;
	struct wpi_node *wn = WPI_NODE(ni);
	int error;

	@@ -4674,7 +4662,7 @@
	wpi_del_key(struct ieee80211_node ni, const struct ieee80211_key k)
	{
	struct ieee80211vap *vap = ni->ni_vap;
	- struct wpi_softc *sc = ni->ni_ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ni->ni_ic->ic_softc;
	struct wpi_node *wn = WPI_NODE(ni);
	struct wpi_node_info node;
	uint16_t kflags;
	@@ -4724,7 +4712,7 @@
	{
	const struct ieee80211_key *k = arg;
	struct ieee80211vap *vap = ni->ni_vap;
	- struct wpi_softc *sc = ni->ni_ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ni->ni_ic->ic_softc;
	struct wpi_node *wn = WPI_NODE(ni);
	int error;

	@@ -4746,7 +4734,7 @@
	int set)
	{
	struct ieee80211com *ic = vap->iv_ic;
	- struct wpi_softc *sc = ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ic->ic_softc;
	struct wpi_vap *wvp = WPI_VAP(vap);
	struct ieee80211_node *ni;
	int error, ni_ref = 0;
	@@ -5396,34 +5384,29 @@
	wpi_radio_on(void *arg0, int pending)
	{
	struct wpi_softc *sc = arg0;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	device_printf(sc->sc_dev, "RF switch: radio enabled\n");

	- if (vap != NULL) {
	- wpi_init(sc);
	- ieee80211_init(vap);
	- }
	+ WPI_LOCK(sc);
	+ callout_stop(&sc->watchdog_rfkill);
	+ WPI_UNLOCK(sc);

	- if (WPI_READ(sc, WPI_GP_CNTRL) & WPI_GP_CNTRL_RFKILL) {
	- WPI_LOCK(sc);
	- callout_stop(&sc->watchdog_rfkill);
	- WPI_UNLOCK(sc);
	- }
	+ if (vap != NULL)
	+ ieee80211_init(vap);
	}

	static void
	wpi_radio_off(void *arg0, int pending)
	{
	struct wpi_softc *sc = arg0;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	device_printf(sc->sc_dev, "RF switch: radio disabled\n");

	+ ieee80211_notify_radio(ic, 0);
	wpi_stop(sc);
	if (vap != NULL)
	ieee80211_stop(vap);
	@@ -5433,19 +5416,16 @@
	WPI_UNLOCK(sc);
	}

	-static void
	-wpi_init(void *arg)
	+static int
	+wpi_init(struct wpi_softc *sc)
	{
	- struct wpi_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	- int error;
	+ int error = 0;

	WPI_LOCK(sc);

	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_BEGIN, __func__);

	- if ((ifp->if_drv_flags & IFF_DRV_RUNNING) != 0)
	+ if (sc->sc_running != 0)
	goto end;

	/* Check that the radio is not disabled by hardware switch. */
	@@ -5454,6 +5434,7 @@
	"RF switch: radio disabled (%s)\n", __func__);
	callout_reset(&sc->watchdog_rfkill, hz, wpi_watchdog_rfkill,
	sc);
	+ error = EINPROGRESS;
	goto end;
	}

	@@ -5462,9 +5443,11 @@
	device_printf(sc->sc_dev,
	"%s: could not read firmware, error %d\n", __func__,
	error);
	- goto fail;
	+ goto end;
	}

	+ sc->sc_running = 1;
	+
	/* Initialize hardware and upload firmware. */
	error = wpi_hw_init(sc);
	wpi_unload_firmware(sc);
	@@ -5476,7 +5459,6 @@
	}

	/* Configure adapter now that it is ready. */
	- sc->txq_active = 1;
	if ((error = wpi_config(sc)) != 0) {
	device_printf(sc->sc_dev,
	"%s: could not configure device, error %d\n", __func__,
	@@ -5484,34 +5466,34 @@
	goto fail;
	}

	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
	- ifp->if_drv_flags \|= IFF_DRV_RUNNING;
	- IF_UNLOCK(&ifp->if_snd);
	-
	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_END, __func__);

	WPI_UNLOCK(sc);

	- ieee80211_start_all(ic);
	-
	- return;
	+ return 0;

	fail: wpi_stop_locked(sc);
	+
	end: DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_END_ERR, __func__);
	WPI_UNLOCK(sc);
	+
	+ return error;
	}

	static void
	wpi_stop_locked(struct wpi_softc *sc)
	{
	- struct ifnet *ifp = sc->sc_ifp;

	WPI_LOCK_ASSERT(sc);

	+ if (sc->sc_running == 0)
	+ return;
	+
	+ WPI_TX_LOCK(sc);
	WPI_TXQ_LOCK(sc);
	- sc->txq_active = 0;
	+ sc->sc_running = 0;
	WPI_TXQ_UNLOCK(sc);
	+ WPI_TX_UNLOCK(sc);

	WPI_TXQ_STATE_LOCK(sc);
	callout_stop(&sc->tx_timeout);
	@@ -5522,10 +5504,6 @@
	callout_stop(&sc->calib_to);
	WPI_RXON_UNLOCK(sc);

	- IF_LOCK(&ifp->if_snd);
	- ifp->if_drv_flags &= ~(IFF_DRV_RUNNING \| IFF_DRV_OACTIVE);
	- IF_UNLOCK(&ifp->if_snd);
	-
	/* Power OFF hardware. */
	wpi_hw_stop(sc);
	}
	@@ -5544,7 +5522,7 @@
	static void
	wpi_scan_start(struct ieee80211com *ic)
	{
	- struct wpi_softc *sc = ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ic->ic_softc;

	wpi_set_led(sc, WPI_LED_LINK, 20, 2);
	}
	@@ -5555,8 +5533,7 @@
	static void
	wpi_scan_end(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct wpi_softc *sc = ifp->if_softc;
	+ struct wpi_softc *sc = ic->ic_softc;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	if (vap->iv_state == IEEE80211_S_RUN)
	@@ -5571,8 +5548,7 @@
	wpi_set_channel(struct ieee80211com *ic)
	{
	const struct ieee80211_channel *c = ic->ic_curchan;
	- struct ifnet *ifp = ic->ic_ifp;
	- struct wpi_softc *sc = ifp->if_softc;
	+ struct wpi_softc *sc = ic->ic_softc;
	int error;

	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_DOING, __func__);
	@@ -5618,7 +5594,7 @@
	{
	struct ieee80211vap *vap = ss->ss_vap;
	struct ieee80211com *ic = vap->iv_ic;
	- struct wpi_softc *sc = ic->ic_ifp->if_softc;
	+ struct wpi_softc *sc = ic->ic_softc;
	int error;

	WPI_RXON_LOCK(sc);
	@@ -5644,19 +5620,18 @@
	wpi_hw_reset(void *arg, int pending)
	{
	struct wpi_softc *sc = arg;
	- struct ifnet *ifp = sc->sc_ifp;
	- struct ieee80211com *ic = ifp->if_l2com;
	+ struct ieee80211com *ic = &sc->sc_ic;
	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);

	DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_DOING, __func__);

	+ ieee80211_notify_radio(ic, 0);
	if (vap != NULL && (ic->ic_flags & IEEE80211_F_SCAN))
	ieee80211_cancel_scan(vap);

	wpi_stop(sc);
	- if (vap != NULL)
	+ if (vap != NULL) {
	ieee80211_stop(vap);
	- wpi_init(sc);
	- if (vap != NULL)
	ieee80211_init(vap);
	+ }
	}
	Index: sys/dev/wpi/if_wpivar.h
	===================================================================
	--- sys/dev/wpi/if_wpivar.h
	+++ sys/dev/wpi/if_wpivar.h
	@@ -72,6 +72,7 @@
	struct wpi_tx_cmd *cmd;
	struct wpi_tx_data data[WPI_TX_RING_COUNT];
	bus_dma_tag_t data_dmat;
	+ struct mbufq snd;
	int qid;
	int queued;
	int cur;
	@@ -164,14 +165,15 @@

	struct wpi_softc {
	device_t sc_dev;
	-
	- struct ifnet *sc_ifp;
	int sc_debug;

	int sc_flags;
	#define WPI_PS_PATH (1 << 0)
	+ int sc_running;

	struct mtx sc_mtx;
	+ struct ieee80211com sc_ic;
	+
	struct mtx tx_mtx;

	/* Shared area. */
	@@ -181,7 +183,6 @@
	struct wpi_tx_ring txq[WPI_NTXQUEUES];
	struct mtx txq_mtx;
	struct mtx txq_state_mtx;
	- uint32_t txq_active;

	struct wpi_rx_ring rxq;
	uint64_t rx_tstamp;
	Index: sys/net80211/ieee80211.c
	===================================================================
	--- sys/net80211/ieee80211.c
	+++ sys/net80211/ieee80211.c
	@@ -91,8 +91,6 @@
	static int ieee80211_media_setup(struct ieee80211com *ic,
	struct ifmedia *media, int caps, int addsta,
	ifm_change_cb_t media_change, ifm_stat_cb_t media_stat);
	-static void ieee80211com_media_status(struct ifnet , struct ifmediareq );
	-static int ieee80211com_media_change(struct ifnet *);
	static int media_status(enum ieee80211_opmode,
	const struct ieee80211_channel *);
	static uint64_t ieee80211_get_counter(struct ifnet *, ift_counter);
	@@ -121,7 +119,7 @@
	* all available channels as active, and pick
	* a default channel if not already specified.
	*/
	-static void
	+void
	ieee80211_chan_init(struct ieee80211com *ic)
	{
	#define DEFAULTRATES(m, def) do { \
	@@ -238,29 +236,6 @@
	ic_printf(ic, "need promiscuous mode update callback\n");
	}

	-static int
	-null_transmit(struct ifnet ifp, struct mbuf m)
	-{
	- m_freem(m);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	- return EACCES; /* XXX EIO/EPERM? */
	-}
	-
	-static int
	-null_output(struct ifnet ifp, struct mbuf m,
	- const struct sockaddr dst, struct route ro)
	-{
	- if_printf(ifp, "discard raw packet\n");
	- return null_transmit(ifp, m);
	-}
	-
	-static void
	-null_input(struct ifnet ifp, struct mbuf m)
	-{
	- if_printf(ifp, "if_input should not be called\n");
	- m_freem(m);
	-}
	-
	static void
	null_update_chw(struct ieee80211com *ic)
	{
	@@ -268,6 +243,8 @@
	ic_printf(ic, "%s: need callback\n", __func__);
	}

	+static LIST_HEAD(, ieee80211com) ic_head = LIST_HEAD_INITIALIZER(ic_head);
	+
	int
	ic_printf(struct ieee80211com ic, const char fmt, ...)
	{
	@@ -286,14 +263,8 @@
	* the driver on attach to prior to creating any vap's.
	*/
	void
	-ieee80211_ifattach(struct ieee80211com *ic,
	- const uint8_t macaddr[IEEE80211_ADDR_LEN])
	+ieee80211_ifattach(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct sockaddr_dl *sdl;
	- struct ifaddr *ifa;
	-
	- KASSERT(ifp->if_type == IFT_IEEE80211, ("if_type %d", ifp->if_type));

	IEEE80211_LOCK_INIT(ic, ic->ic_name);
	IEEE80211_TX_LOCK_INIT(ic, ic->ic_name);
	@@ -311,7 +282,7 @@
	* available channels as active, and pick a default
	* channel if not already specified.
	*/
	- ieee80211_media_init(ic);
	+ ieee80211_chan_init(ic);

	ic->ic_update_mcast = null_update_mcast;
	ic->ic_update_promisc = null_update_promisc;
	@@ -336,28 +307,7 @@

	ieee80211_sysctl_attach(ic);

	- ifp->if_addrlen = IEEE80211_ADDR_LEN;
	- ifp->if_hdrlen = 0;
	-
	- CURVNET_SET(vnet0);
	-
	- if_attach(ifp);
	-
	- ifp->if_mtu = IEEE80211_MTU_MAX;
	- ifp->if_broadcastaddr = ieee80211broadcastaddr;
	- ifp->if_output = null_output;
	- ifp->if_input = null_input; /* just in case */
	- ifp->if_resolvemulti = NULL; /* NB: callers check */
	-
	- ifa = ifaddr_byindex(ifp->if_index);
	- KASSERT(ifa != NULL, ("%s: no lladdr!\n", __func__));
	- sdl = (struct sockaddr_dl *)ifa->ifa_addr;
	- sdl->sdl_type = IFT_ETHER; /* XXX IFT_IEEE80211? */
	- sdl->sdl_alen = IEEE80211_ADDR_LEN;
	- IEEE80211_ADDR_COPY(LLADDR(sdl), macaddr);
	- ifa_free(ifa);
	-
	- CURVNET_RESTORE();
	+ LIST_INSERT_HEAD(&ic_head, ic, ic_next);
	}

	/*
	@@ -369,16 +319,9 @@
	void
	ieee80211_ifdetach(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	struct ieee80211vap *vap;

	- /*
	- * This detaches the main interface, but not the vaps.
	- * Each VAP may be in a separate VIMAGE.
	- */
	- CURVNET_SET(ifp->if_vnet);
	- if_detach(ifp);
	- CURVNET_RESTORE();
	+ LIST_REMOVE(ic, ic_next);

	/*
	* The VAP is responsible for setting and clearing
	@@ -402,8 +345,6 @@
	ieee80211_power_detach(ic);
	ieee80211_node_detach(ic);

	- /* XXX VNET needed? */
	- ifmedia_removeall(&ic->ic_media);
	counter_u64_free(ic->ic_ierrors);
	counter_u64_free(ic->ic_oerrors);

	@@ -412,6 +353,17 @@
	IEEE80211_LOCK_DESTROY(ic);
	}

	+struct ieee80211com *
	+ieee80211_find_com(const char *name)
	+{
	+ struct ieee80211com *ic;
	+
	+ LIST_FOREACH(ic, &ic_head, ic_next)
	+ if (strcmp(ic->ic_name, name) == 0)
	+ break;
	+ return (ic);
	+}
	+
	/*
	* Default reset method for use with the ioctl support. This
	* method is invoked after any state change in the 802.11
	@@ -460,8 +412,7 @@
	int
	ieee80211_vap_setup(struct ieee80211com ic, struct ieee80211vap vap,
	const char name[IFNAMSIZ], int unit, enum ieee80211_opmode opmode,
	- int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
	- const uint8_t macaddr[IEEE80211_ADDR_LEN])
	+ int flags, const uint8_t bssid[IEEE80211_ADDR_LEN])
	{
	struct ifnet *ifp;

	@@ -490,6 +441,7 @@
	vap->iv_htextcaps = ic->ic_htextcaps;
	vap->iv_opmode = opmode;
	vap->iv_caps \|= ieee80211_opcap[opmode];
	+ vap->iv_myaddr = ic->ic_macaddr;
	switch (opmode) {
	case IEEE80211_M_WDS:
	/*
	@@ -556,8 +508,6 @@
	*/
	vap->iv_reset = default_reset;

	- IEEE80211_ADDR_COPY(vap->iv_myaddr, macaddr);
	-
	ieee80211_sysctl_vattach(vap);
	ieee80211_crypto_vattach(vap);
	ieee80211_node_vattach(vap);
	@@ -581,8 +531,8 @@
	* from this call the vap is ready for use.
	*/
	int
	-ieee80211_vap_attach(struct ieee80211vap *vap,
	- ifm_change_cb_t media_change, ifm_stat_cb_t media_stat)
	+ieee80211_vap_attach(struct ieee80211vap *vap, ifm_change_cb_t media_change,
	+ ifm_stat_cb_t media_stat, const uint8_t macaddr[IEEE80211_ADDR_LEN])
	{
	struct ifnet *ifp = vap->iv_ifp;
	struct ieee80211com *ic = vap->iv_ic;
	@@ -610,7 +560,8 @@
	if (maxrate)
	ifp->if_baudrate = IF_Mbps(maxrate);

	- ether_ifattach(ifp, vap->iv_myaddr);
	+ ether_ifattach(ifp, macaddr);
	+ vap->iv_myaddr = IF_LLADDR(ifp);
	/* hook output method setup by ether_ifattach */
	vap->iv_output = ifp->if_output;
	ifp->if_output = ieee80211_output;
	@@ -626,8 +577,6 @@
	ieee80211_syncflag_locked(ic, IEEE80211_F_BURST);
	ieee80211_syncflag_ht_locked(ic, IEEE80211_FHT_HT);
	ieee80211_syncflag_ht_locked(ic, IEEE80211_FHT_USEHT40);
	- ieee80211_syncifflag_locked(ic, IFF_PROMISC);
	- ieee80211_syncifflag_locked(ic, IFF_ALLMULTI);
	IEEE80211_UNLOCK(ic);

	return 1;
	@@ -677,8 +626,10 @@
	ieee80211_syncflag_ht_locked(ic, IEEE80211_FHT_USEHT40);
	/* NB: this handles the bpfdetach done below */
	ieee80211_syncflag_ext_locked(ic, IEEE80211_FEXT_BPF);
	- ieee80211_syncifflag_locked(ic, IFF_PROMISC);
	- ieee80211_syncifflag_locked(ic, IFF_ALLMULTI);
	+ if (vap->iv_ifflags & IFF_PROMISC)
	+ ieee80211_promisc(vap, false);
	+ if (vap->iv_ifflags & IFF_ALLMULTI)
	+ ieee80211_allmulti(vap, false);
	IEEE80211_UNLOCK(ic);

	ifmedia_removeall(&vap->iv_media);
	@@ -703,49 +654,57 @@
	}

	/*
	- * Synchronize flag bit state in the parent ifnet structure
	- * according to the state of all vap ifnet's. This is used,
	- * for example, to handle IFF_PROMISC and IFF_ALLMULTI.
	+ * Count number of vaps in promisc, and issue promisc on
	+ * parent respectively.
	*/
	void
	-ieee80211_syncifflag_locked(struct ieee80211com *ic, int flag)
	+ieee80211_promisc(struct ieee80211vap *vap, bool on)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	- struct ieee80211vap *vap;
	- int bit, oflags;
	+ struct ieee80211com *ic = vap->iv_ic;

	- IEEE80211_LOCK_ASSERT(ic);
	+ /*
	+ * XXX the bridge sets PROMISC but we don't want to
	+ * enable it on the device, discard here so all the
	+ * drivers don't need to special-case it
	+ */
	+ if (!(vap->iv_opmode == IEEE80211_M_MONITOR \|\|
	+ (vap->iv_opmode == IEEE80211_M_AHDEMO &&
	+ (vap->iv_caps & IEEE80211_C_TDMA) == 0)))
	+ return;

	- bit = 0;
	- TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
	- if (vap->iv_ifp->if_flags & flag) {
	- /*
	- * XXX the bridge sets PROMISC but we don't want to
	- * enable it on the device, discard here so all the
	- * drivers don't need to special-case it
	- */
	- if (flag == IFF_PROMISC &&
	- !(vap->iv_opmode == IEEE80211_M_MONITOR \|\|
	- (vap->iv_opmode == IEEE80211_M_AHDEMO &&
	- (vap->iv_caps & IEEE80211_C_TDMA) == 0)))
	- continue;
	- bit = 1;
	- break;
	- }
	- oflags = ifp->if_flags;
	- if (bit)
	- ifp->if_flags \|= flag;
	- else
	- ifp->if_flags &= ~flag;
	- if ((ifp->if_flags ^ oflags) & flag) {
	- /* XXX should we return 1/0 and let caller do this? */
	- if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
	- if (flag == IFF_PROMISC)
	- ieee80211_runtask(ic, &ic->ic_promisc_task);
	- else if (flag == IFF_ALLMULTI)
	- ieee80211_runtask(ic, &ic->ic_mcast_task);
	- }
	+ IEEE80211_LOCK(ic);
	+ if (on) {
	+ if (++ic->ic_promisc == 1)
	+ ieee80211_runtask(ic, &ic->ic_promisc_task);
	+ } else {
	+ KASSERT(ic->ic_promisc > 0, ("%s: ic %p not promisc",
	+ __func__, ic));
	+ if (--ic->ic_promisc == 0)
	+ ieee80211_runtask(ic, &ic->ic_promisc_task);
	}
	+ IEEE80211_UNLOCK(ic);
	+}
	+
	+/*
	+ * Count number of vaps in allmulti, and issue allmulti on
	+ * parent respectively.
	+ */
	+void
	+ieee80211_allmulti(struct ieee80211vap *vap, bool on)
	+{
	+ struct ieee80211com *ic = vap->iv_ic;
	+
	+ IEEE80211_LOCK(ic);
	+ if (on) {
	+ if (++ic->ic_allmulti == 1)
	+ ieee80211_runtask(ic, &ic->ic_mcast_task);
	+ } else {
	+ KASSERT(ic->ic_allmulti > 0, ("%s: ic %p not allmulti",
	+ __func__, ic));
	+ if (--ic->ic_allmulti == 0)
	+ ieee80211_runtask(ic, &ic->ic_mcast_task);
	+ }
	+ IEEE80211_UNLOCK(ic);
	}

	/*
	@@ -1234,39 +1193,6 @@
	return maxrate;
	}

	-void
	-ieee80211_media_init(struct ieee80211com *ic)
	-{
	- struct ifnet *ifp = ic->ic_ifp;
	- int maxrate;
	-
	- /* NB: this works because the structure is initialized to zero */
	- if (!LIST_EMPTY(&ic->ic_media.ifm_list)) {
	- /*
	- * We are re-initializing the channel list; clear
	- * the existing media state as the media routines
	- * don't suppress duplicates.
	- */
	- ifmedia_removeall(&ic->ic_media);
	- }
	- ieee80211_chan_init(ic);
	-
	- /*
	- * Recalculate media settings in case new channel list changes
	- * the set of available modes.
	- */
	- maxrate = ieee80211_media_setup(ic, &ic->ic_media, ic->ic_caps, 1,
	- ieee80211com_media_change, ieee80211com_media_status);
	- /* NB: strip explicit mode; we're actually in autoselect */
	- ifmedia_set(&ic->ic_media,
	- media_status(ic->ic_opmode, ic->ic_curchan) &~
	- (IFM_MMASK \| IFM_IEEE80211_TURBO));
	- if (maxrate)
	- ifp->if_baudrate = IF_Mbps(maxrate);
	-
	- /* XXX need to propagate new media settings to vap's */
	-}
	-
	/* XXX inline or eliminate? */
	const struct ieee80211_rateset *
	ieee80211_get_suprates(struct ieee80211com ic, const struct ieee80211_channel c)
	@@ -1395,15 +1321,6 @@
	}

	/*
	- * Handle a media change request on the underlying interface.
	- */
	-int
	-ieee80211com_media_change(struct ifnet *ifp)
	-{
	- return EINVAL;
	-}
	-
	-/*
	* Handle a media change request on the vap interface.
	*/
	int
	@@ -1480,23 +1397,6 @@
	return status;
	}

	-static void
	-ieee80211com_media_status(struct ifnet ifp, struct ifmediareq imr)
	-{
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ieee80211vap *vap;
	-
	- imr->ifm_status = IFM_AVALID;
	- TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
	- if (vap->iv_ifp->if_flags & IFF_UP) {
	- imr->ifm_status \|= IFM_ACTIVE;
	- break;
	- }
	- imr->ifm_active = media_status(ic->ic_opmode, ic->ic_curchan);
	- if (imr->ifm_status & IFM_ACTIVE)
	- imr->ifm_current = imr->ifm_active;
	-}
	-
	void
	ieee80211_media_status(struct ifnet ifp, struct ifmediareq imr)
	{
	Index: sys/net80211/ieee80211_ddb.c
	===================================================================
	--- sys/net80211/ieee80211_ddb.c
	+++ sys/net80211/ieee80211_ddb.c
	@@ -520,7 +520,7 @@
	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
	db_printf(" %s(%p)", vap->iv_ifp->if_xname, vap);
	db_printf("\n");
	- db_printf("\tifp %p(%s)", ic->ic_ifp, ic->ic_ifp->if_xname);
	+ db_printf("\tsoftc %p", ic->ic_softc);
	db_printf("\tname %s", ic->ic_name);
	db_printf(" comlock %p", &ic->ic_comlock);
	db_printf("\n");
	@@ -528,7 +528,6 @@
	db_printf(" phytype %d", ic->ic_phytype);
	db_printf(" opmode %s", ieee80211_opmode_name[ic->ic_opmode]);
	db_printf("\n");
	- db_printf("\tmedia %p", &ic->ic_media);
	db_printf(" inact %p", &ic->ic_inact);
	db_printf("\n");

	Index: sys/net80211/ieee80211_freebsd.c
	===================================================================
	--- sys/net80211/ieee80211_freebsd.c
	+++ sys/net80211/ieee80211_freebsd.c
	@@ -69,58 +69,27 @@
	static const char wlanname[] = "wlan";
	static struct if_clone *wlan_cloner;

	-/*
	- * Allocate/free com structure in conjunction with ifnet;
	- * these routines are registered with if_register_com_alloc
	- * below and are called automatically by the ifnet code
	- * when the ifnet of the parent device is created.
	- */
	-static void *
	-wlan_alloc(u_char type, struct ifnet *ifp)
	-{
	- struct ieee80211com *ic;
	-
	- ic = IEEE80211_MALLOC(sizeof(struct ieee80211com), M_80211_COM,
	- IEEE80211_M_WAITOK \| IEEE80211_M_ZERO);
	- ic->ic_ifp = ifp;
	-
	- return (ic);
	-}
	-
	-static void
	-wlan_free(void *ic, u_char type)
	-{
	- IEEE80211_FREE(ic, M_80211_COM);
	-}
	-
	static int
	wlan_clone_create(struct if_clone *ifc, int unit, caddr_t params)
	{
	struct ieee80211_clone_params cp;
	struct ieee80211vap *vap;
	struct ieee80211com *ic;
	- struct ifnet *ifp;
	int error;

	error = copyin(params, &cp, sizeof(cp));
	if (error)
	return error;
	- ifp = ifunit(cp.icp_parent);
	- if (ifp == NULL)
	+ ic = ieee80211_find_com(cp.icp_parent);
	+ if (ic == NULL)
	return ENXIO;
	- /* XXX move printfs to DIAGNOSTIC before release */
	- if (ifp->if_type != IFT_IEEE80211) {
	- if_printf(ifp, "%s: reject, not an 802.11 device\n", __func__);
	- return ENXIO;
	- }
	if (cp.icp_opmode >= IEEE80211_OPMODE_MAX) {
	- if_printf(ifp, "%s: invalid opmode %d\n",
	- __func__, cp.icp_opmode);
	+ ic_printf(ic, "%s: invalid opmode %d\n", __func__,
	+ cp.icp_opmode);
	return EINVAL;
	}
	- ic = ifp->if_l2com;
	if ((ic->ic_caps & ieee80211_opcap[cp.icp_opmode]) == 0) {
	- if_printf(ifp, "%s mode not supported\n",
	+ ic_printf(ic, "%s mode not supported\n",
	ieee80211_opmode_name[cp.icp_opmode]);
	return EOPNOTSUPP;
	}
	@@ -131,13 +100,13 @@
	(1)
	#endif
	) {
	- if_printf(ifp, "TDMA not supported\n");
	+ ic_printf(ic, "TDMA not supported\n");
	return EOPNOTSUPP;
	}
	vap = ic->ic_vap_create(ic, wlanname, unit,
	cp.icp_opmode, cp.icp_flags, cp.icp_bssid,
	cp.icp_flags & IEEE80211_CLONE_MACADDR ?
	- cp.icp_macaddr : (const uint8_t *)IF_LLADDR(ifp));
	+ cp.icp_macaddr : ic->ic_macaddr);

	return (vap == NULL ? EIO : 0);
	}
	@@ -528,17 +497,19 @@
	* (the callers will first need modifying.)
	*/
	int
	-ieee80211_parent_xmitpkt(struct ieee80211com *ic,
	- struct mbuf *m)
	+ieee80211_parent_xmitpkt(struct ieee80211com ic, struct mbuf m)
	{
	- struct ifnet *parent = ic->ic_ifp;
	+ int error;
	+
	/*
	* Assert the IC TX lock is held - this enforces the
	* processing -> queuing order is maintained
	*/
	IEEE80211_TX_LOCK_ASSERT(ic);
	-
	- return (parent->if_transmit(parent, m));
	+ error = ic->ic_transmit(ic, m);
	+ if (error)
	+ m_freem(m);
	+ return (error);
	}

	/*
	@@ -836,7 +807,6 @@
	}

	static eventhandler_tag wlan_bpfevent;
	-static eventhandler_tag wlan_ifllevent;

	static void
	bpf_track(void arg, struct ifnet ifp, int dlt, int attach)
	@@ -864,33 +834,6 @@
	}
	}

	-static void
	-wlan_iflladdr(void arg __unused, struct ifnet ifp)
	-{
	- struct ieee80211com *ic = ifp->if_l2com;
	- struct ieee80211vap vap, next;
	-
	- if (ifp->if_type != IFT_IEEE80211 \|\| ic == NULL)
	- return;
	-
	- IEEE80211_LOCK(ic);
	- TAILQ_FOREACH_SAFE(vap, &ic->ic_vaps, iv_next, next) {
	- /*
	- * If the MAC address has changed on the parent and it was
	- * copied to the vap on creation then re-sync.
	- */
	- if (vap->iv_ic == ic &&
	- (vap->iv_flags_ext & IEEE80211_FEXT_UNIQMAC) == 0) {
	- IEEE80211_ADDR_COPY(vap->iv_myaddr, IF_LLADDR(ifp));
	- IEEE80211_UNLOCK(ic);
	- if_setlladdr(vap->iv_ifp, IF_LLADDR(ifp),
	- IEEE80211_ADDR_LEN);
	- IEEE80211_LOCK(ic);
	- }
	- }
	- IEEE80211_UNLOCK(ic);
	-}
	-
	/*
	* Module glue.
	*
	@@ -905,17 +848,12 @@
	printf("wlan: <802.11 Link Layer>\n");
	wlan_bpfevent = EVENTHANDLER_REGISTER(bpf_track,
	bpf_track, 0, EVENTHANDLER_PRI_ANY);
	- wlan_ifllevent = EVENTHANDLER_REGISTER(iflladdr_event,
	- wlan_iflladdr, NULL, EVENTHANDLER_PRI_ANY);
	wlan_cloner = if_clone_simple(wlanname, wlan_clone_create,
	wlan_clone_destroy, 0);
	- if_register_com_alloc(IFT_IEEE80211, wlan_alloc, wlan_free);
	return 0;
	case MOD_UNLOAD:
	- if_deregister_com_alloc(IFT_IEEE80211);
	if_clone_detach(wlan_cloner);
	EVENTHANDLER_DEREGISTER(bpf_track, wlan_bpfevent);
	- EVENTHANDLER_DEREGISTER(iflladdr_event, wlan_ifllevent);
	return 0;
	}
	return EINVAL;
	Index: sys/net80211/ieee80211_ioctl.c
	===================================================================
	--- sys/net80211/ieee80211_ioctl.c
	+++ sys/net80211/ieee80211_ioctl.c
	@@ -1329,13 +1329,12 @@
	setmlme_dropsta(struct ieee80211vap *vap,
	const uint8_t mac[IEEE80211_ADDR_LEN], struct mlmeop *mlmeop)
	{
	- struct ieee80211com *ic = vap->iv_ic;
	- struct ieee80211_node_table *nt = &ic->ic_sta;
	+ struct ieee80211_node_table *nt = &vap->iv_ic->ic_sta;
	struct ieee80211_node *ni;
	int error = 0;

	/* NB: the broadcast address means do 'em all */
	- if (!IEEE80211_ADDR_EQ(mac, ic->ic_ifp->if_broadcastaddr)) {
	+ if (!IEEE80211_ADDR_EQ(mac, vap->iv_ifp->if_broadcastaddr)) {
	IEEE80211_NODE_LOCK(nt);
	ni = ieee80211_find_node_locked(nt, mac);
	IEEE80211_NODE_UNLOCK(nt);
	@@ -2529,14 +2528,9 @@
	static __noinline int
	ieee80211_ioctl_scanreq(struct ieee80211vap vap, struct ieee80211req ireq)
	{
	- struct ieee80211com *ic = vap->iv_ic;
	struct ieee80211_scan_req sr; /* XXX off stack? */
	int error;

	- /* NB: parent must be running */
	- if ((ic->ic_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
	- return ENXIO;
	-
	if (ireq->i_len != sizeof(sr))
	return EINVAL;
	error = copyin(ireq->i_data, &sr, sizeof(sr));
	@@ -3300,41 +3294,6 @@
	return error;
	}

	-/*
	- * Rebuild the parent's multicast address list after an add/del
	- * of a multicast address for a vap. We have no way to tell
	- * what happened above to optimize the work so we purge the entire
	- * list and rebuild from scratch. This is way expensive.
	- * Note also the half-baked workaround for if_addmulti calling
	- * back to the parent device; there's no way to insert mcast
	- * entries quietly and/or cheaply.
	- */
	-static void
	-ieee80211_ioctl_updatemulti(struct ieee80211com *ic)
	-{
	- struct ifnet *parent = ic->ic_ifp;
	- struct ieee80211vap *vap;
	- void *ioctl;
	-
	- IEEE80211_LOCK(ic);
	- if_delallmulti(parent);
	- ioctl = parent->if_ioctl; /* XXX WAR if_allmulti */
	- parent->if_ioctl = NULL;
	- TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
	- struct ifnet *ifp = vap->iv_ifp;
	- struct ifmultiaddr *ifma;
	-
	- TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
	- if (ifma->ifma_addr->sa_family != AF_LINK)
	- continue;
	- (void) if_addmulti(parent, ifma->ifma_addr, NULL);
	- }
	- }
	- parent->if_ioctl = ioctl;
	- ieee80211_runtask(ic, &ic->ic_mcast_task);
	- IEEE80211_UNLOCK(ic);
	-}
	-
	int
	ieee80211_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
	{
	@@ -3347,8 +3306,11 @@
	switch (cmd) {
	case SIOCSIFFLAGS:
	IEEE80211_LOCK(ic);
	- ieee80211_syncifflag_locked(ic, IFF_PROMISC);
	- ieee80211_syncifflag_locked(ic, IFF_ALLMULTI);
	+ if ((ifp->if_flags ^ vap->iv_ifflags) & IFF_PROMISC)
	+ ieee80211_promisc(vap, ifp->if_flags & IFF_PROMISC);
	+ if ((ifp->if_flags ^ vap->iv_ifflags) & IFF_ALLMULTI)
	+ ieee80211_allmulti(vap, ifp->if_flags & IFF_ALLMULTI);
	+ vap->iv_ifflags = ifp->if_flags;
	if (ifp->if_flags & IFF_UP) {
	/*
	* Bring ourself up unless we're already operational.
	@@ -3371,7 +3333,7 @@
	break;
	case SIOCADDMULTI:
	case SIOCDELMULTI:
	- ieee80211_ioctl_updatemulti(ic);
	+ ieee80211_runtask(ic, &ic->ic_mcast_task);
	break;
	case SIOCSIFMEDIA:
	case SIOCGIFMEDIA:
	@@ -3427,17 +3389,16 @@
	break;
	}
	break;
	- /* Pass NDIS ioctls up to the driver */
	- case SIOCGDRVSPEC:
	- case SIOCSDRVSPEC:
	- case SIOCGPRIVATE_0: {
	- struct ifnet *parent = vap->iv_ic->ic_ifp;
	- error = parent->if_ioctl(parent, cmd, data);
	- break;
	- }
	default:
	+ /*
	+ * Pass unknown ioctls first to the driver, and if it
	+ * returns ENOTTY, then to the generic Ethernet handler.
	+ */
	+ if (ic->ic_ioctl != NULL &&
	+ (error = ic->ic_ioctl(ic, cmd, data)) != ENOTTY)
	+ break;
	error = ether_ioctl(ifp, cmd, data);
	break;
	}
	- return error;
	+ return (error);
	}
	Index: sys/net80211/ieee80211_output.c
	===================================================================
	--- sys/net80211/ieee80211_output.c
	+++ sys/net80211/ieee80211_output.c
	@@ -254,10 +254,6 @@
	/* NB: IFQ_HANDOFF reclaims mbuf */
	ieee80211_free_node(ni);
	if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	- } else {
	- if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	- if_inc_counter(ifp, IFCOUNTER_OMCASTS, mcast);
	- if_inc_counter(ifp, IFCOUNTER_OBYTES, len);
	}
	ic->ic_lastdata = ticks;

	@@ -430,17 +426,6 @@
	{
	struct ieee80211vap *vap = ifp->if_softc;
	struct ieee80211com *ic = vap->iv_ic;
	- struct ifnet *parent = ic->ic_ifp;
	-
	- /* NB: parent must be up and running */
	- if (!IFNET_IS_UP_RUNNING(parent)) {
	- IEEE80211_DPRINTF(vap, IEEE80211_MSG_OUTPUT,
	- "%s: ignore queue, parent %s not up+running\n",
	- __func__, parent->if_xname);
	- m_freem(m);
	- if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	- return (ENETDOWN);
	- }

	/*
	* No data frames go out unless we're running.
	@@ -507,6 +492,7 @@
	struct mbuf m, const struct ieee80211_bpf_params params)
	{
	struct ieee80211com *ic = vap->iv_ic;
	+ int error;

	/*
	* Set node - the caller has taken a reference, so ensure
	@@ -528,7 +514,10 @@
	if (params)
	(void) ieee80211_add_xmit_params(m, params);

	- return (ic->ic_raw_xmit(ni, m, params));
	+ error = ic->ic_raw_xmit(ni, m, params);
	+ if (error)
	+ if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1);
	+ return (error);
	}

	/*
	@@ -3457,6 +3446,15 @@
	{

	if (ni != NULL) {
	+ struct ifnet *ifp = ni->ni_vap->iv_ifp;
	+
	+ if (status == 0) {
	+ if_inc_counter(ifp, IFCOUNTER_OBYTES, m->m_pkthdr.len);
	+ if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
	+ if (m->m_flags & M_MCAST)
	+ if_inc_counter(ifp, IFCOUNTER_OMCASTS, 1);
	+ } else
	+ if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
	if (m->m_flags & M_TXCB)
	ieee80211_process_callback(ni, m, status);
	ieee80211_free_node(ni);
	Index: sys/net80211/ieee80211_power.c
	===================================================================
	--- sys/net80211/ieee80211_power.c
	+++ sys/net80211/ieee80211_power.c
	@@ -418,7 +418,6 @@
	struct ieee80211com *ic = ni->ni_ic;
	struct ieee80211vap *vap = ni->ni_vap;
	struct ieee80211_psq_head *qhead;
	- struct ifnet parent, ifp;
	struct mbuf parent_q = NULL, ifp_q = NULL;
	struct mbuf *m;

	@@ -429,59 +428,51 @@
	qhead = &psq->psq_head[0]; /* 802.11 frames */
	if (qhead->head != NULL) {
	/* XXX could dispatch through vap and check M_ENCAP */
	- parent = vap->iv_ic->ic_ifp;
	/* XXX need different driver interface */
	/* XXX bypasses q max and OACTIVE */
	parent_q = qhead->head;
	qhead->head = qhead->tail = NULL;
	qhead->len = 0;
	- } else
	- parent = NULL;
	+ }

	qhead = &psq->psq_head[1]; /* 802.3 frames */
	if (qhead->head != NULL) {
	- ifp = vap->iv_ifp;
	/* XXX need different driver interface */
	/* XXX bypasses q max and OACTIVE */
	ifp_q = qhead->head;
	qhead->head = qhead->tail = NULL;
	qhead->len = 0;
	- } else
	- ifp = NULL;
	+ }
	psq->psq_len = 0;
	IEEE80211_PSQ_UNLOCK(psq);

	/* NB: do this outside the psq lock */
	/* XXX packets might get reordered if parent is OACTIVE */
	/* parent frames, should be encapsulated */
	- if (parent != NULL) {
	- while (parent_q != NULL) {
	- m = parent_q;
	- parent_q = m->m_nextpkt;
	- m->m_nextpkt = NULL;
	- /* must be encapsulated */
	- KASSERT((m->m_flags & M_ENCAP),
	- ("%s: parentq with non-M_ENCAP frame!\n",
	- __func__));
	- /*
	- * For encaped frames, we need to free the node
	- * reference upon failure.
	- */
	- if (ieee80211_parent_xmitpkt(ic, m) != 0)
	- ieee80211_free_node(ni);
	- }
	+ while (parent_q != NULL) {
	+ m = parent_q;
	+ parent_q = m->m_nextpkt;
	+ m->m_nextpkt = NULL;
	+ /* must be encapsulated */
	+ KASSERT((m->m_flags & M_ENCAP),
	+ ("%s: parentq with non-M_ENCAP frame!\n",
	+ __func__));
	+ /*
	+ * For encaped frames, we need to free the node
	+ * reference upon failure.
	+ */
	+ if (ieee80211_parent_xmitpkt(ic, m) != 0)
	+ ieee80211_free_node(ni);
	}

	/* VAP frames, aren't encapsulated */
	- if (ifp != NULL) {
	- while (ifp_q != NULL) {
	- m = ifp_q;
	- ifp_q = m->m_nextpkt;
	- m->m_nextpkt = NULL;
	- KASSERT((!(m->m_flags & M_ENCAP)),
	- ("%s: vapq with M_ENCAP frame!\n", __func__));
	- (void) ieee80211_vap_xmitpkt(vap, m);
	- }
	+ while (ifp_q != NULL) {
	+ m = ifp_q;
	+ ifp_q = m->m_nextpkt;
	+ m->m_nextpkt = NULL;
	+ KASSERT((!(m->m_flags & M_ENCAP)),
	+ ("%s: vapq with M_ENCAP frame!\n", __func__));
	+ (void) ieee80211_vap_xmitpkt(vap, m);
	}
	}

	Index: sys/net80211/ieee80211_proto.h
	===================================================================
	--- sys/net80211/ieee80211_proto.h
	+++ sys/net80211/ieee80211_proto.h
	@@ -56,7 +56,8 @@
	void ieee80211_proto_vattach(struct ieee80211vap *);
	void ieee80211_proto_vdetach(struct ieee80211vap *);

	-void ieee80211_syncifflag_locked(struct ieee80211com *, int flag);
	+void ieee80211_promisc(struct ieee80211vap *, bool);
	+void ieee80211_allmulti(struct ieee80211vap *, bool);
	void ieee80211_syncflag(struct ieee80211vap *, int flag);
	void ieee80211_syncflag_ht(struct ieee80211vap *, int flag);
	void ieee80211_syncflag_ext(struct ieee80211vap *, int flag);
	Index: sys/net80211/ieee80211_proto.c
	===================================================================
	--- sys/net80211/ieee80211_proto.c
	+++ sys/net80211/ieee80211_proto.c
	@@ -122,23 +122,23 @@
	void
	ieee80211_proto_attach(struct ieee80211com *ic)
	{
	- struct ifnet *ifp = ic->ic_ifp;
	+ uint8_t hdrlen;

	/* override the 802.3 setting */
	- ifp->if_hdrlen = ic->ic_headroom
	+ hdrlen = ic->ic_headroom
	+ sizeof(struct ieee80211_qosframe_addr4)
	+ IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN
	+ IEEE80211_WEP_EXTIVLEN;
	/* XXX no way to recalculate on ifdetach */
	- if (ALIGN(ifp->if_hdrlen) > max_linkhdr) {
	+ if (ALIGN(hdrlen) > max_linkhdr) {
	/* XXX sanity check... */
	- max_linkhdr = ALIGN(ifp->if_hdrlen);
	+ max_linkhdr = ALIGN(hdrlen);
	max_hdr = max_linkhdr + max_protohdr;
	max_datalen = MHLEN - max_hdr;
	}
	ic->ic_protmode = IEEE80211_PROT_CTSONLY;

	- TASK_INIT(&ic->ic_parent_task, 0, parent_updown, ifp);
	+ TASK_INIT(&ic->ic_parent_task, 0, parent_updown, ic);
	TASK_INIT(&ic->ic_mcast_task, 0, update_mcast, ic);
	TASK_INIT(&ic->ic_promisc_task, 0, update_promisc, ic);
	TASK_INIT(&ic->ic_chan_task, 0, update_channel, ic);
	@@ -188,7 +188,10 @@
	int i;

	/* override the 802.3 setting */
	- ifp->if_hdrlen = ic->ic_ifp->if_hdrlen;
	+ ifp->if_hdrlen = ic->ic_headroom
	+ + sizeof(struct ieee80211_qosframe_addr4)
	+ + IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN
	+ + IEEE80211_WEP_EXTIVLEN;

	vap->iv_rtsthreshold = IEEE80211_RTS_DEFAULT;
	vap->iv_fragthreshold = IEEE80211_FRAG_DEFAULT;
	@@ -1155,9 +1158,9 @@
	static void
	parent_updown(void *arg, int npending)
	{
	- struct ifnet *parent = arg;
	+ struct ieee80211com *ic = arg;

	- parent->if_ioctl(parent, SIOCSIFFLAGS, NULL);
	+ ic->ic_parent(ic);
	}

	static void
	@@ -1224,7 +1227,6 @@
	{
	struct ifnet *ifp = vap->iv_ifp;
	struct ieee80211com *ic = vap->iv_ic;
	- struct ifnet *parent = ic->ic_ifp;

	IEEE80211_LOCK_ASSERT(ic);

	@@ -1246,12 +1248,10 @@
	* We are not running; if this we are the first vap
	* to be brought up auto-up the parent if necessary.
	*/
	- if (ic->ic_nrunning++ == 0 &&
	- (parent->if_drv_flags & IFF_DRV_RUNNING) == 0) {
	+ if (ic->ic_nrunning++ == 0) {
	IEEE80211_DPRINTF(vap,
	IEEE80211_MSG_STATE \| IEEE80211_MSG_DEBUG,
	- "%s: up parent %s\n", __func__, parent->if_xname);
	- parent->if_flags \|= IFF_UP;
	+ "%s: up parent %s\n", __func__, ic->ic_name);
	ieee80211_runtask(ic, &ic->ic_parent_task);
	return;
	}
	@@ -1260,8 +1260,7 @@
	* If the parent is up and running, then kick the
	* 802.11 state machine as appropriate.
	*/
	- if ((parent->if_drv_flags & IFF_DRV_RUNNING) &&
	- vap->iv_roaming != IEEE80211_ROAMING_MANUAL) {
	+ if (vap->iv_roaming != IEEE80211_ROAMING_MANUAL) {
	if (vap->iv_opmode == IEEE80211_M_STA) {
	#if 0
	/* XXX bypasses scan too easily; disable for now */
	@@ -1344,7 +1343,6 @@
	{
	struct ieee80211com *ic = vap->iv_ic;
	struct ifnet *ifp = vap->iv_ifp;
	- struct ifnet *parent = ic->ic_ifp;

	IEEE80211_LOCK_ASSERT(ic);

	@@ -1354,12 +1352,10 @@
	ieee80211_new_state_locked(vap, IEEE80211_S_INIT, -1);
	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
	ifp->if_drv_flags &= ~IFF_DRV_RUNNING; /* mark us stopped */
	- if (--ic->ic_nrunning == 0 &&
	- (parent->if_drv_flags & IFF_DRV_RUNNING)) {
	+ if (--ic->ic_nrunning == 0) {
	IEEE80211_DPRINTF(vap,
	IEEE80211_MSG_STATE \| IEEE80211_MSG_DEBUG,
	- "down parent %s\n", parent->if_xname);
	- parent->if_flags &= ~IFF_UP;
	+ "down parent %s\n", ic->ic_name);
	ieee80211_runtask(ic, &ic->ic_parent_task);
	}
	}
	Index: sys/net80211/ieee80211_regdomain.c
	===================================================================
	--- sys/net80211/ieee80211_regdomain.c
	+++ sys/net80211/ieee80211_regdomain.c
	@@ -35,7 +35,6 @@
	#include <sys/systm.h>
	#include <sys/kernel.h>
	#include <sys/malloc.h>
	-
	#include <sys/socket.h>

	#include <net/if.h>
	@@ -487,7 +486,7 @@
	memset(&ic->ic_channels[ic->ic_nchans], 0,
	(IEEE80211_CHAN_MAX - ic->ic_nchans) *
	sizeof(struct ieee80211_channel));
	- ieee80211_media_init(ic);
	+ ieee80211_chan_init(ic);

	/*
	* Invalidate channel-related state.
	Index: sys/net80211/ieee80211_scan_sta.c
	===================================================================
	--- sys/net80211/ieee80211_scan_sta.c
	+++ sys/net80211/ieee80211_scan_sta.c
	@@ -1706,26 +1706,6 @@
	IEEE80211_SCANNER_ALG(ibss, IEEE80211_M_IBSS, adhoc_default);
	IEEE80211_SCANNER_ALG(ahdemo, IEEE80211_M_AHDEMO, adhoc_default);

	-static void
	-ap_force_promisc(struct ieee80211com *ic)
	-{
	- struct ifnet *ifp = ic->ic_ifp;
	-
	- IEEE80211_LOCK(ic);
	- /* set interface into promiscuous mode */
	- ifp->if_flags \|= IFF_PROMISC;
	- ieee80211_runtask(ic, &ic->ic_promisc_task);
	- IEEE80211_UNLOCK(ic);
	-}
	-
	-static void
	-ap_reset_promisc(struct ieee80211com *ic)
	-{
	- IEEE80211_LOCK(ic);
	- ieee80211_syncifflag_locked(ic, IFF_PROMISC);
	- IEEE80211_UNLOCK(ic);
	-}
	-
	static int
	ap_start(struct ieee80211_scan_state ss, struct ieee80211vap vap)
	{
	@@ -1741,7 +1721,7 @@
	st->st_scangen++;
	st->st_newscan = 1;

	- ap_force_promisc(vap->iv_ic);
	+ ieee80211_promisc(vap, true);
	return 0;
	}

	@@ -1751,7 +1731,7 @@
	static int
	ap_cancel(struct ieee80211_scan_state ss, struct ieee80211vap vap)
	{
	- ap_reset_promisc(vap->iv_ic);
	+ ieee80211_promisc(vap, false);
	return 0;
	}

	@@ -1825,7 +1805,7 @@
	return 0;
	}
	}
	- ap_reset_promisc(ic);
	+ ieee80211_promisc(vap, false);
	if (ss->ss_flags & (IEEE80211_SCAN_NOPICK \| IEEE80211_SCAN_NOJOIN)) {
	/*
	* Manual/background scan, don't select+join the
	Index: sys/net80211/ieee80211_var.h
	===================================================================
	--- sys/net80211/ieee80211_var.h
	+++ sys/net80211/ieee80211_var.h
	@@ -116,16 +116,15 @@
	struct ieee80211_frame;

	struct ieee80211com {
	- struct ifnet ic_ifp; / associated device */
	void ic_softc; / driver softc */
	const char ic_name; / usually device name */
	ieee80211_com_lock_t ic_comlock; /* state update lock */
	ieee80211_tx_lock_t ic_txlock; /* ic/vap TX lock */
	+ LIST_ENTRY(ieee80211com) ic_next; /* on global list */
	TAILQ_HEAD(, ieee80211vap) ic_vaps; /* list of vap instances */
	int ic_headroom; /* driver tx headroom needs */
	enum ieee80211_phytype ic_phytype; /* XXX wrong for multi-mode */
	enum ieee80211_opmode ic_opmode; /* operation mode */
	- struct ifmedia ic_media; /* interface media config */
	struct callout ic_inact; /* inactivity processing */
	struct taskqueue ic_tq; / deferred state thread */
	struct task ic_parent_task; /* deferred parent processing */
	@@ -151,6 +150,7 @@
	uint8_t ic_allmulti; /* vap's needing all multicast*/
	uint8_t ic_nrunning; /* vap's marked running */
	uint8_t ic_curmode; /* current mode */
	+ uint8_t ic_macaddr[IEEE80211_ADDR_LEN];
	uint16_t ic_bintval; /* beacon interval */
	uint16_t ic_lintval; /* listen interval */
	uint16_t ic_holdover; /* PM hold over duration */
	@@ -241,6 +241,11 @@
	const uint8_t [IEEE80211_ADDR_LEN],
	const uint8_t [IEEE80211_ADDR_LEN]);
	void (ic_vap_delete)(struct ieee80211vap );
	+ /* device specific ioctls */
	+ int (ic_ioctl)(struct ieee80211com ,
	+ u_long, void *);
	+ /* start/stop device */
	+ void (ic_parent)(struct ieee80211com );
	/* operating mode attachment */
	ieee80211vap_attach ic_vattach[IEEE80211_OPMODE_MAX];
	/* return hardware/radio capabilities */
	@@ -254,6 +259,9 @@
	int (ic_set_quiet)(struct ieee80211_node ,
	u_int8_t *quiet_elm);

	+ /* regular transmit */
	+ int (ic_transmit)(struct ieee80211com ,
	+ struct mbuf *);
	/* send/recv 802.11 management frame */
	int (ic_send_mgmt)(struct ieee80211_node ,
	int, int);
	@@ -351,14 +359,15 @@

	TAILQ_ENTRY(ieee80211vap) iv_next; /* list of vap instances */
	struct ieee80211com iv_ic; / back ptr to common state */
	+ const uint8_t iv_myaddr; / MAC address: ifp or ic */
	uint32_t iv_debug; /* debug msg flags */
	struct ieee80211_stats iv_stats; /* statistics */

	- uint8_t iv_myaddr[IEEE80211_ADDR_LEN];
	uint32_t iv_flags; /* state flags */
	uint32_t iv_flags_ext; /* extended state flags */
	uint32_t iv_flags_ht; /* HT state flags */
	uint32_t iv_flags_ven; /* vendor state flags */
	+ uint32_t iv_ifflags; /* ifnet flags */
	uint32_t iv_caps; /* capabilities */
	uint32_t iv_htcaps; /* HT capabilities */
	uint32_t iv_htextcaps; /* HT extended capabilities */
	@@ -681,24 +690,24 @@
	"\21AMPDU\22AMSDU\23HT\24SMPS\25RIFS"

	int ic_printf(struct ieee80211com , const char , ...) __printflike(2, 3);
	-void ieee80211_ifattach(struct ieee80211com *,
	- const uint8_t macaddr[IEEE80211_ADDR_LEN]);
	+void ieee80211_ifattach(struct ieee80211com *);
	void ieee80211_ifdetach(struct ieee80211com *);
	int ieee80211_vap_setup(struct ieee80211com , struct ieee80211vap ,
	const char name[IFNAMSIZ], int unit,
	enum ieee80211_opmode opmode, int flags,
	- const uint8_t bssid[IEEE80211_ADDR_LEN],
	- const uint8_t macaddr[IEEE80211_ADDR_LEN]);
	+ const uint8_t bssid[IEEE80211_ADDR_LEN]);
	int ieee80211_vap_attach(struct ieee80211vap *,
	- ifm_change_cb_t, ifm_stat_cb_t);
	+ ifm_change_cb_t, ifm_stat_cb_t,
	+ const uint8_t macaddr[IEEE80211_ADDR_LEN]);
	void ieee80211_vap_detach(struct ieee80211vap *);
	const struct ieee80211_rateset ieee80211_get_suprates(struct ieee80211com ic,
	const struct ieee80211_channel *);
	void ieee80211_announce(struct ieee80211com *);
	void ieee80211_announce_channels(struct ieee80211com *);
	void ieee80211_drain(struct ieee80211com *);
	-void ieee80211_media_init(struct ieee80211com *);
	+void ieee80211_chan_init(struct ieee80211com *);
	struct ieee80211com *ieee80211_find_vap(const uint8_t mac[IEEE80211_ADDR_LEN]);
	+struct ieee80211com ieee80211_find_com(const char name);
	int ieee80211_media_change(struct ifnet *);
	void ieee80211_media_status(struct ifnet , struct ifmediareq );
	int ieee80211_ioctl(struct ifnet *, u_long, caddr_t);
	Index: tools/tools/iwn/iwnstats/main.c
	===================================================================
	--- tools/tools/iwn/iwnstats/main.c
	+++ tools/tools/iwn/iwnstats/main.c
	@@ -50,7 +50,7 @@
	#include "iwnstats.h"
	#include "iwn_ioctl.h"

	-#define IWN_DEFAULT_IF "iwn0"
	+#define IWN_DEFAULT_IF "wlan0"

	static struct iwnstats *
	iwnstats_new(const char *ifname)
	@@ -290,19 +290,6 @@
	if (ifname)
	free(ifname);
	ifname = strdup(optarg);
	- if (strncmp(ifname, "wlan", 4) == 0) {
	- free(ifname);
	- len = 0;
	- asprintf(&sysctlname, "net.wlan.%s.%%parent", ifname + 4);
	- ret = sysctlbyname(sysctlname, NULL, &len, NULL, 0);
	- if (ret != 0)
	- err(1, "sysctl failed");
	- ifname = calloc(len, 1);
	- ret = sysctlbyname(sysctlname, ifname, &len, NULL, 0);
	- if (ret != 0)
	- err(1, "sysctl failed");
	- free(sysctlname);
	- }
	break;
	default:
	case '?':

File Metadata

Mime Type: text/plain
Expires: Wed, Sep 2, 7:23 PM (16 h, 48 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 38003060
Default Alt Text: D2655.id6199.diff (351 KB)

D2655.id6199.diffNo OneTemporaryActions

D2655.id6199.diffView Options

File Metadata

Event Timeline

D2655.id6199.diff
No OneTemporary
Actions

D2655.id6199.diff
View Options