From Jon Simola <simola@mecha.com>:

Lots of help from Jonathan Gray. bcw_regs has been removed,
and DMA/descriptor style changes that look more normal. Tested,
no loss in current unfunctionality.

4 files changed, 1034 insertions, 653 deletions

diff --git a/sys/dev/ic/bcw.c b/sys/dev/ic/bcw.c
index 40ff18db4b1..52f3ed35448 100644
--- a/sys/dev/ic/bcw.c
+++ b/sys/dev/ic/bcw.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bcw.c,v 1.2 2006/11/17 20:04:52 mglocker Exp $ */
+/*	$OpenBSD: bcw.c,v 1.3 2006/11/21 11:41:14 mglocker Exp $ */
 
 /*
  * Copyright (c) 2006 Jon Simola <jsimola@gmail.com>
@@ -80,7 +80,7 @@ void	bcw_reset(struct bcw_softc *);
 int	bcw_init(struct ifnet *);
 void	bcw_start(struct ifnet *);
 void	bcw_stop(struct ifnet *, int);
-/* Functions copied from bce - */
+
 void	bcw_watchdog(struct ifnet *);
 void	bcw_rxintr(struct bcw_softc *);
 void	bcw_txintr(struct bcw_softc *);
@@ -90,6 +90,16 @@ void	bcw_rxdrain(struct bcw_softc *);
 void	bcw_set_filter(struct ifnet *); 
 void	bcw_tick(void *);
 int	bcw_ioctl(struct ifnet *, u_long, caddr_t);
+
+int	bcw_alloc_rx_ring(struct bcw_softc *sc, struct bcw_rx_ring *ring,
+	    int count);
+void	bcw_reset_rx_ring(struct bcw_softc *sc, struct bcw_rx_ring *ring);
+void	bcw_free_rx_ring(struct bcw_softc *sc, struct bcw_rx_ring *ring);
+int	bcw_alloc_tx_ring(struct bcw_softc *sc, struct bcw_tx_ring *ring,
+	    int count);
+void	bcw_reset_tx_ring(struct bcw_softc *sc, struct bcw_tx_ring *ring);
+void	bcw_free_tx_ring(struct bcw_softc *sc, struct bcw_tx_ring *ring);
+
 /* 80211 functions copied from iwi */
 int	bcw_newstate(struct ieee80211com *, enum ieee80211_state, int);
 int	bcw_media_change(struct ifnet *);
@@ -97,15 +107,6 @@ void	bcw_media_status(struct ifnet *, struct ifmediareq *);
 /* fashionably new functions */
 int	bcw_validatechipaccess(struct bcw_softc *ifp);
 
-/* read/write functions */
-u_int8_t	bcw_read8(void *, u_int32_t);
-u_int16_t	bcw_read16(void *, u_int32_t);
-u_int32_t	bcw_read32(void *, u_int32_t);
-void		bcw_write8(void *, u_int32_t, u_int8_t);
-void		bcw_write16(void *, u_int32_t, u_int16_t);
-void		bcw_write32(void *, u_int32_t, u_int32_t);
-void		bcw_barrier(void *, u_int32_t, u_int32_t, int);
-
 struct cfdriver bcw_cd = {
 	NULL, "bcw", DV_IFNET
 };
@@ -113,19 +114,18 @@ struct cfdriver bcw_cd = {
 void
 bcw_attach(struct bcw_softc *sc)
 {
-	struct ieee80211com *ic = &sc->bcw_ic;
+	struct ieee80211com *ic = &sc->sc_ic;
 	struct ifnet   *ifp = &ic->ic_if;
-	struct bcw_regs *regs = &sc->bcw_regs;
 #if 0
-	struct pci_attach_args *pa = &sc->bcw_pa;
+	struct pci_attach_args *pa = &sc->sc_pa;
 	pci_chipset_tag_t pc = pa->pa_pc;
 	pci_intr_handle_t ih;
 	const char     *intrstr = NULL;
 #endif
+#if 0
 	caddr_t         kva;
 	bus_dma_segment_t seg;
 	int             rseg;
-#if 0
 	pcireg_t        memtype;
 	bus_addr_t      memaddr;
 	bus_size_t      memsize;
@@ -137,18 +137,6 @@ bcw_attach(struct bcw_softc *sc)
 	u_int32_t	sbval;
 	u_int16_t	sbval16;
 	
-	//sc->bcw_pa = *pa;
-	//sc->bcw_dmatag = pa->pa_dmat;
-
-	if (sc->bcw_regs.r_read8 == NULL) {
-		sc->bcw_regs.r_read8 = bcw_read8;
-		sc->bcw_regs.r_read16 = bcw_read16;
-		sc->bcw_regs.r_read32 = bcw_read32;
-		sc->bcw_regs.r_write8 = bcw_write8;
-		sc->bcw_regs.r_write16 = bcw_write16;
-		sc->bcw_regs.r_write32 = bcw_write32;
-		sc->bcw_regs.r_barrier = bcw_barrier;
-	}
 
 	/*
 	 * Reset the chip
@@ -180,83 +168,102 @@ bcw_attach(struct bcw_softc *sc)
 	 *   - Single Core
 	 */
 
-	sbval = BCW_READ32(regs, BCW_ADDR_SPACE0);
+	sbval = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_ADDR_SPACE0);
 	if ((sbval & 0xffff0000) != 0x18000000) {
 		DPRINTF(("%s: Trial Core read was 0x%x, single core only?\n",
-		    sc->bcw_dev.dv_xname, sbval));
-	 	//sc->bcw_singlecore=1;
+		    sc->sc_dev.dv_xname, sbval));
+	 	//sc->sc_singlecore=1;
 	}
 
 	/* 
 	 * Try and change to the ChipCommon Core
 	 */
 	for (i = 0; i < 10; i++) {
-		BCW_WRITE32(regs, BCW_ADDR_SPACE0, BCW_CORE_SELECT(0));
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_ADDR_SPACE0,
+		    BCW_CORE_SELECT(0));
 		delay(10);
-		sbval = BCW_READ32(regs, BCW_ADDR_SPACE0);
+		sbval = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+		    BCW_ADDR_SPACE0);
 		DPRINTF(("%s: Core change read %d = 0x%x\n",
-		    sc->bcw_dev.dv_xname,i,sbval));
+		    sc->sc_dev.dv_xname,i,sbval));
 		if (sbval == BCW_CORE_SELECT(0)) break;
 		delay(10);
 	}
+	/* 
+	 * Try and change to random cores
+	 */
+	for (j = 1; j < 10; j++) {
+		for (i = 0; i < 10; i++) {
+			bus_space_write_4(sc->sc_iot, sc->sc_ioh,
+			    BCW_ADDR_SPACE0, BCW_CORE_SELECT(j));
+			delay(10);
+			sbval = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+			    BCW_ADDR_SPACE0);
+			DPRINTF(("%s: Core change read %d = 0x%x\n",
+			    sc->sc_dev.dv_xname,i,sbval));
+			if (sbval == BCW_CORE_SELECT(j)) break;
+			delay(10);
+		}
+	}
 	//DPRINTF(("\n")); /* Pretty print so the debugs start on new lines */
 	
 	/*
 	 * Core ID REG, this is either the default wireless core (0x812) or
 	 * a ChipCommon core
 	 */
-	sbval = BCW_READ32(regs, BCW_CIR_SBID_HI);
+	sbval = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_CIR_SBID_HI);
 	DPRINTF(("%s: Got Core ID Reg 0x%x, type is 0x%x\n",
-	    sc->bcw_dev.dv_xname, sbval, (sbval & 0x8ff0) >> 4));
+	    sc->sc_dev.dv_xname, sbval, (sbval & 0x8ff0) >> 4));
 	
 	/* If we successfully got a commoncore, and the corerev=4 or >=6
 	   get the number of cores from the chipid reg */
 	if (((sbval & 0x00008ff0) >> 4) == BCW_CORE_COMMON) {
-		sc->bcw_havecommon = 1;
-		sbval = BCW_READ32(regs, BCW_CORE_COMMON_CHIPID);
-		sc->bcw_chipid = (sbval & 0x0000ffff);
-		sc->bcw_corerev =
+		sc->sc_havecommon = 1;
+		sbval = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+		    BCW_CORE_COMMON_CHIPID);
+		sc->sc_chipid = (sbval & 0x0000ffff);
+		sc->sc_corerev =
 		    ((sbval & 0x00007000) >> 8 | (sbval & 0x0000000f));
-		if ((sc->bcw_corerev == 4) || (sc->bcw_corerev >= 6))
-			sc->bcw_numcores = (sbval & 0x0f000000) >> 24;
+		if ((sc->sc_corerev == 4) || (sc->sc_corerev >= 6))
+			sc->sc_numcores = (sbval & 0x0f000000) >> 24;
 		else
-			switch (sc->bcw_chipid) {
+			switch (sc->sc_chipid) {
 				case 0x4710:
 				case 0x4610:
 				case 0x4704:
-					sc->bcw_numcores = 9;
+					sc->sc_numcores = 9;
 					break;
 				case 0x4310:
-					sc->bcw_numcores = 8;
+					sc->sc_numcores = 8;
 					break;
 				case 0x5365:
-					sc->bcw_numcores = 7;
+					sc->sc_numcores = 7;
 					break;
 				case 0x4306:
-					sc->bcw_numcores = 6;
+					sc->sc_numcores = 6;
 					break;
 				case 0x4307:
 				case 0x4301:
-					sc->bcw_numcores = 5;
+					sc->sc_numcores = 5;
 					break;
 				case 0x4402:
-					sc->bcw_numcores = 3;
+					sc->sc_numcores = 3;
 					break;
 				default:
 					/* XXX Educated Guess */
-					sc->bcw_numcores = 0;
+					sc->sc_numcores = 0;
 			} /* end of switch */
 	} else { /* No CommonCore, set chipid,cores,rev based on product id */
-		sc->bcw_havecommon = 0;
-		switch(sc->bcw_prodid) {
+		sc->sc_havecommon = 0;
+		switch(sc->sc_prodid) {
 			case 0x4710:
 			case 0x4711:
 			case 0x4712:
 			case 0x4713:
 			case 0x4714:
 			case 0x4715:
-				sc->bcw_chipid = 0x4710;
-				sc->bcw_numcores = 9;
+				sc->sc_chipid = 0x4710;
+				sc->sc_numcores = 9;
 				break;
 			case 0x4610:
 			case 0x4611:
@@ -264,54 +271,56 @@ bcw_attach(struct bcw_softc *sc)
 			case 0x4613:
 			case 0x4614:
 			case 0x4615:
-				sc->bcw_chipid = 0x4610;
-				sc->bcw_numcores = 9;
+				sc->sc_chipid = 0x4610;
+				sc->sc_numcores = 9;
 				break;
 			case 0x4402:
 			case 0x4403:
-				sc->bcw_chipid = 0x4402;
-				sc->bcw_numcores = 3;
+				sc->sc_chipid = 0x4402;
+				sc->sc_numcores = 3;
 				break;
 			case 0x4305:
 			case 0x4306:
 			case 0x4307:
-				sc->bcw_chipid = 0x4307;
-				sc->bcw_numcores = 5;
+				sc->sc_chipid = 0x4307;
+				sc->sc_numcores = 5;
 				break;
 			case 0x4301:
-				sc->bcw_chipid = 0x4301;
-				sc->bcw_numcores = 5;
+				sc->sc_chipid = 0x4301;
+				sc->sc_numcores = 5;
 				break;
 			default:
-				sc->bcw_chipid = sc->bcw_prodid;
+				sc->sc_chipid = sc->sc_prodid;
 				/* XXX educated guess */
-				sc->bcw_numcores = 1;
+				sc->sc_numcores = 1;
 		} /* end of switch */
 	} /* End of if/else */
 
 	DPRINTF(("%s: ChipID=0x%x, ChipRev=0x%x, NumCores=%d\n",
-	    sc->bcw_dev.dv_xname, sc->bcw_chipid,
-	    sc->bcw_chiprev, sc->bcw_numcores));
+	    sc->sc_dev.dv_xname, sc->sc_chipid,
+	    sc->sc_chiprev, sc->sc_numcores));
 
 	/* Identify each core */
-	if (sc->bcw_numcores >= 2) { /* Exclude single core chips */
- 		for (i = 0; i <= sc->bcw_numcores; i++) {
+	if (sc->sc_numcores >= 2) { /* Exclude single core chips */
+ 		for (i = 0; i <= sc->sc_numcores; i++) {
  			DPRINTF(("%s: Trying core %d - ", 
- 			    sc->bcw_dev.dv_xname, i));
- 			BCW_WRITE32(regs, BCW_ADDR_SPACE0, BCW_CORE_SELECT(i));
+ 			    sc->sc_dev.dv_xname, i));
+ 			bus_space_write_4(sc->sc_iot, sc->sc_ioh,
+			    BCW_ADDR_SPACE0, BCW_CORE_SELECT(i));
 			/* loop to see if the selected core shows up */
 			for (j = 0; j < 10; j++) {
-				sbval=BCW_READ32(regs, BCW_ADDR_SPACE0);
+				sbval=bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+				    BCW_ADDR_SPACE0);
 				DPRINTF(("%s: read %d for core %d = 0x%x ",
-				    sc->bcw_dev.dv_xname, j, i, sbval));
+				    sc->sc_dev.dv_xname, j, i, sbval));
 				if (sbval == BCW_CORE_SELECT(i)) break;
 				delay(10);
 			}
 			if (j < 10) 
 				DPRINTF(("%s: Found core %d of type 0x%x\n",
-				    sc->bcw_dev.dv_xname, i, 
+				    sc->sc_dev.dv_xname, i, 
 				    (sbval & 0x00008ff0) >> 4));
-			//sc->bcw_core[i].id = (sbval & 0x00008ff0) >> 4;
+			//sc->sc_core[i].id = (sbval & 0x00008ff0) >> 4;
 		} /* End of For loop */
 		DPRINTF(("\n")); /* Make pretty debug output */
 	}
@@ -319,38 +328,38 @@ bcw_attach(struct bcw_softc *sc)
 	/*
 	 * Attach cores to the backplane, if we have more than one
 	 */
-	// ??? if (!sc->bcw_singlecore) {
-	if (sc->bcw_havecommon == 1) {
-		sbval = BCW_READ32(regs, BCW_PCICR);
+	// ??? if (!sc->sc_singlecore) {
+	if (sc->sc_havecommon == 1) {
+		sbval = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_PCICR);
 		sbval |= 0x1 << 8; /* XXX hardcoded bitmask of single core */
-		BCW_WRITE32(regs, BCW_PCICR, sbval);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_PCICR, sbval);
 	}
 
 	/*
 	 * Get and display the PHY info from the MIMO
 	 */
-	sbval = BCW_READ16(regs, 0x3E0);
-	sc->bcw_phy_version = (sbval&0xf000)>>12;
-	sc->bcw_phy_rev = sbval&0xf;
-	sc->bcw_phy_type = (sbval&0xf00)>>8;
+	sbval = bus_space_read_2(sc->sc_iot, sc->sc_ioh, 0x3E0);
+	sc->sc_phy_version = (sbval&0xf000)>>12;
+	sc->sc_phy_rev = sbval&0xf;
+	sc->sc_phy_type = (sbval&0xf00)>>8;
 	DPRINTF(("%s: PHY version %d revision %d ",
-	    sc->bcw_dev.dv_xname, sc->bcw_phy_version, sc->bcw_phy_rev));
-	switch (sc->bcw_phy_type) {
+	    sc->sc_dev.dv_xname, sc->sc_phy_version, sc->sc_phy_rev));
+	switch (sc->sc_phy_type) {
 		case BCW_PHY_TYPEA:
-			DPRINTF(("PHY %d (A)\n",sc->bcw_phy_type));
+			DPRINTF(("PHY %d (A)\n",sc->sc_phy_type));
 			break;
 		case BCW_PHY_TYPEB:
-			DPRINTF(("PHY %d (B)\n",sc->bcw_phy_type));
+			DPRINTF(("PHY %d (B)\n",sc->sc_phy_type));
 			break;
 		case BCW_PHY_TYPEG:
-			DPRINTF(("PHY %d (G)\n",sc->bcw_phy_type));
+			DPRINTF(("PHY %d (G)\n",sc->sc_phy_type));
 			break;
 		case BCW_PHY_TYPEN:
-			DPRINTF(("PHY %d (N)\n",sc->bcw_phy_type));
+			DPRINTF(("PHY %d (N)\n",sc->sc_phy_type));
 			break;
 		default:
 			DPRINTF(("Unrecognizeable PHY type %d\n",
-			    sc->bcw_phy_type));
+			    sc->sc_phy_type));
 			break;
 	} /* end of switch */
 
@@ -362,42 +371,54 @@ bcw_attach(struct bcw_softc *sc)
 	 * Radio registers, and requires seperate 16bit reads from the low 
 	 * and the high data addresses.
 	 */
-	if (sc->bcw_chipid != 0x4317) {
-		BCW_WRITE16(regs, BCW_RADIO_CONTROL, BCW_RADIO_ID);
-		sbval=BCW_READ16(regs, BCW_RADIO_DATAHIGH);
+	if (sc->sc_chipid != 0x4317) {
+		bus_space_write_2(sc->sc_iot, sc->sc_ioh, BCW_RADIO_CONTROL,
+		    BCW_RADIO_ID);
+		sbval=bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+		    BCW_RADIO_DATAHIGH);
 		sbval <<= 16;
-		BCW_WRITE16(regs, BCW_RADIO_CONTROL, BCW_RADIO_ID);
-		sc->bcw_radioid = sbval | BCW_READ16(regs, BCW_RADIO_DATALOW);
+		bus_space_write_2(sc->sc_iot, sc->sc_ioh, BCW_RADIO_CONTROL,
+		    BCW_RADIO_ID);
+		sc->sc_radioid = sbval | bus_space_read_2(sc->sc_iot, 
+		    sc->sc_ioh, BCW_RADIO_DATALOW);
 	} else {
-		switch(sc->bcw_corerev) {
+		switch(sc->sc_corerev) {
 			case 0:	
-				sc->bcw_radioid = 0x3205017F;
+				sc->sc_radioid = 0x3205017F;
 				break;
 			case 1:
-				sc->bcw_radioid = 0x4205017f;
+				sc->sc_radioid = 0x4205017f;
 				break;
 			default:
-				sc->bcw_radioid = 0x5205017f;
+				sc->sc_radioid = 0x5205017f;
 		}
 	}
 
-	sc->bcw_radiorev = (sc->bcw_radioid & 0xf0000000) >> 28;
-	sc->bcw_radiotype = (sc->bcw_radioid & 0x0ffff000) >> 12;
+	sc->sc_radiorev = (sc->sc_radioid & 0xf0000000) >> 28;
+	sc->sc_radiotype = (sc->sc_radioid & 0x0ffff000) >> 12;
 
 	DPRINTF(("%s: Radio Rev %d, Ver 0x%x, Manuf 0x%x\n",
-	    sc->bcw_dev.dv_xname, sc->bcw_radiorev, sc->bcw_radiotype,
-	    sc->bcw_radioid & 0xfff));
+	    sc->sc_dev.dv_xname, sc->sc_radiorev, sc->sc_radiotype,
+	    sc->sc_radioid & 0xfff));
 
 	error = bcw_validatechipaccess(sc);
 	if (error) {
 		printf("%s: failed Chip Access Validation at %d\n",
-		    sc->bcw_dev.dv_xname, error);
+		    sc->sc_dev.dv_xname, error);
 		return;
 	}
 
+	/* Get a copy of the BoardFlags and fix for broken boards */
+	sc->sc_boardflags = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+	    BCW_SPROM_BOARDFLAGS);
+	/*
+	 * Dell, Product ID 0x4301 Revision 0x74, set BCW_BF_BTCOEXIST
+	 * Apple Board Type 0x4e Revision > 0x40, set BCW_BF_PACTRL
+	 */
+
 	/* Test for valid PHY/revision combinations, probably a simpler way */
-	if (sc->bcw_phy_type == BCW_PHY_TYPEA) {
-		switch(sc->bcw_phy_rev) {
+	if (sc->sc_phy_type == BCW_PHY_TYPEA) {
+		switch(sc->sc_phy_rev) {
 			case 2:
 			case 3:
 			case 5:
@@ -405,23 +426,23 @@ bcw_attach(struct bcw_softc *sc)
 			case 7:	break;
 			default: 
 				printf("%s: invalid PHY A revision %d\n",
-				    sc->bcw_dev.dv_xname, sc->bcw_phy_rev);
+				    sc->sc_dev.dv_xname, sc->sc_phy_rev);
 				return;
 		}
 	}
-	if (sc->bcw_phy_type == BCW_PHY_TYPEB) {
-		switch(sc->bcw_phy_rev) {
+	if (sc->sc_phy_type == BCW_PHY_TYPEB) {
+		switch(sc->sc_phy_rev) {
 			case 2:
 			case 4:
 			case 7:	break;
 			default: 
 				printf("%s: invalid PHY B revision %d\n",
-				    sc->bcw_dev.dv_xname, sc->bcw_phy_rev);
+				    sc->sc_dev.dv_xname, sc->sc_phy_rev);
 				return;
 		}
 	}
-	if (sc->bcw_phy_type == BCW_PHY_TYPEG) {
-		switch(sc->bcw_phy_rev) {
+	if (sc->sc_phy_type == BCW_PHY_TYPEG) {
+		switch(sc->sc_phy_rev) {
 			case 1:
 			case 2:
 			case 4:
@@ -430,41 +451,45 @@ bcw_attach(struct bcw_softc *sc)
 			case 8:	break;
 			default: 
 				printf("%s: invalid PHY G revision %d\n",
-				    sc->bcw_dev.dv_xname, sc->bcw_phy_rev);
+				    sc->sc_dev.dv_xname, sc->sc_phy_rev);
 				return;
 		}
 	}
 
 	/* test for valid radio revisions */
-	if ((sc->bcw_phy_type == BCW_PHY_TYPEA) &
-	    (sc->bcw_radiotype != 0x2060)) {
+	if ((sc->sc_phy_type == BCW_PHY_TYPEA) &
+	    (sc->sc_radiotype != 0x2060)) {
 		    	printf("%s: invalid PHY A radio 0x%x\n",
-		    	    sc->bcw_dev.dv_xname, sc->bcw_radiotype);
+		    	    sc->sc_dev.dv_xname, sc->sc_radiotype);
 		    	return;
 	}
-	if ((sc->bcw_phy_type == BCW_PHY_TYPEB) &
-	    ((sc->bcw_radiotype & 0xfff0) != 0x2050)) {
+	if ((sc->sc_phy_type == BCW_PHY_TYPEB) &
+	    ((sc->sc_radiotype & 0xfff0) != 0x2050)) {
 		    	printf("%s: invalid PHY B radio 0x%x\n",
-		    	    sc->bcw_dev.dv_xname, sc->bcw_radiotype);
+		    	    sc->sc_dev.dv_xname, sc->sc_radiotype);
 		    	return;
 	}
-	if ((sc->bcw_phy_type == BCW_PHY_TYPEG) &
-	    (sc->bcw_radiotype != 0x2050)) {
+	if ((sc->sc_phy_type == BCW_PHY_TYPEG) &
+	    (sc->sc_radiotype != 0x2050)) {
 		    	printf("%s: invalid PHY G radio 0x%x\n",
-		    	    sc->bcw_dev.dv_xname, sc->bcw_radiotype);
+		    	    sc->sc_dev.dv_xname, sc->sc_radiotype);
 		    	return;
 	}
 
 	/*
 	 * Switch the radio off - candidate for seperate function
 	 */
-	switch(sc->bcw_phy_type) {
+	switch(sc->sc_phy_type) {
 		case BCW_PHY_TYPEA:
 			/* Magic unexplained values */
-			BCW_WRITE16(regs, BCW_RADIO_CONTROL, 0x04);
-			BCW_WRITE16(regs, BCW_RADIO_DATALOW, 0xff);
-			BCW_WRITE16(regs, BCW_RADIO_CONTROL, 0x05);
-			BCW_WRITE16(regs, BCW_RADIO_DATALOW, 0xfb);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_RADIO_CONTROL, 0x04);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_RADIO_DATALOW, 0xff);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_RADIO_CONTROL, 0x05);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_RADIO_DATALOW, 0xfb);
 			/* 
 			 * "When the term MaskSet is used, it is shorthand 
 			 * for reading a value from a register, applying a 
@@ -475,92 +500,114 @@ bcw_attach(struct bcw_softc *sc)
 			 *    here we read a value, AND it with 0xffff, then
 			 *    OR with 0x8. Why not just set the 0x8 bit?
 			 */
-			BCW_WRITE16(regs, BCW_PHY_CONTROL, 0x10);
-			sbval16 = BCW_READ16(regs, BCW_PHY_DATA);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_PHY_CONTROL, 0x10);
+			sbval16 = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_PHY_DATA);
 			sbval16 |= 0x8;
-			BCW_WRITE16(regs, BCW_PHY_CONTROL, 0x10);
-			BCW_WRITE16(regs, BCW_PHY_DATA, sbval16);
-
-			BCW_WRITE16(regs, BCW_PHY_CONTROL, 0x11);
-			sbval16 = BCW_READ16(regs, BCW_PHY_DATA);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_PHY_CONTROL, 0x10);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_PHY_DATA, sbval16);
+
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_PHY_CONTROL, 0x11);
+			sbval16 = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_PHY_DATA);
 			sbval16 |= 0x8;
-			BCW_WRITE16(regs, BCW_PHY_CONTROL, 0x11);
-			BCW_WRITE16(regs, BCW_PHY_DATA, sbval16);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_PHY_CONTROL, 0x11);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_PHY_DATA, sbval16);
 			break;
 		case BCW_PHY_TYPEG:
-			if (sc->bcw_corerev >= 5) {
-				BCW_WRITE16(regs, BCW_PHY_CONTROL, 0x811);
-				sbval16 = BCW_READ16(regs, BCW_PHY_DATA);
+			if (sc->sc_corerev >= 5) {
+				bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+				    BCW_PHY_CONTROL, 0x811);
+				sbval16 = bus_space_read_2(sc->sc_iot,
+				    sc->sc_ioh, BCW_PHY_DATA);
 				sbval16 |= 0x8c;
-				BCW_WRITE16(regs, BCW_PHY_CONTROL, 0x811);
-				BCW_WRITE16(regs, BCW_PHY_DATA, sbval16);
-
-				BCW_WRITE16(regs, BCW_PHY_CONTROL, 0x812);
-				sbval16 = BCW_READ16(regs, BCW_PHY_DATA);
+				bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+				    BCW_PHY_CONTROL, 0x811);
+				bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+				    BCW_PHY_DATA, sbval16);
+
+				bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+				    BCW_PHY_CONTROL, 0x812);
+				sbval16 = bus_space_read_2(sc->sc_iot,
+				    sc->sc_ioh, BCW_PHY_DATA);
 				sbval16 &= 0xff73;
-				BCW_WRITE16(regs, BCW_PHY_CONTROL, 0x812);
-				BCW_WRITE16(regs, BCW_PHY_DATA, sbval16);
+				bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+				    BCW_PHY_CONTROL, 0x812);
+				bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+				    BCW_PHY_DATA, sbval16);
 			}
 			/* FALL-THROUGH */
 		default:
-			BCW_WRITE16(regs, BCW_PHY_CONTROL, 0x15);
-			BCW_WRITE16(regs, BCW_PHY_DATA, 0xaa00);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_PHY_CONTROL, 0x15);
+			bus_space_write_2(sc->sc_iot, sc->sc_ioh,
+			    BCW_PHY_DATA, 0xaa00);
 	} /* end of switch statement to turn off radio */
 
-	// XXX - Get a copy of the BoardFlags to keep in RAM
-
 	/* Read antenna gain from SPROM and multiply by 4 */
-	sbval = BCW_READ16(regs, BCW_SPROM_ANTGAIN);
+	sbval = bus_space_read_2(sc->sc_iot, sc->sc_ioh, BCW_SPROM_ANTGAIN);
 	/* If unset, assume 2 */
 	if((sbval == 0) || (sbval == 0xffff)) sbval = 0x0202;
-	if(sc->bcw_phy_type == BCW_PHY_TYPEA)
-		sc->bcw_radio_gain = (sbval & 0xff);
+	if(sc->sc_phy_type == BCW_PHY_TYPEA)
+		sc->sc_radio_gain = (sbval & 0xff);
 	else
-		sc->bcw_radio_gain = ((sbval & 0xff00) >> 8);
-	sc->bcw_radio_gain *= 4;
+		sc->sc_radio_gain = ((sbval & 0xff00) >> 8);
+	sc->sc_radio_gain *= 4;
 
 	/*
 	 * Set the paXbY vars, X=0 for PHY A, X=1 for B/G, but we'll
 	 * just grab them all while we're here
 	 */
-	sc->bcw_radio_pa0b0 = BCW_READ16(regs, BCW_SPROM_PA0B0);
-	sc->bcw_radio_pa0b1 = BCW_READ16(regs, BCW_SPROM_PA0B1);
-	sc->bcw_radio_pa0b2 = BCW_READ16(regs, BCW_SPROM_PA0B2);
-	sc->bcw_radio_pa1b0 = BCW_READ16(regs, BCW_SPROM_PA1B0);
-	sc->bcw_radio_pa1b1 = BCW_READ16(regs, BCW_SPROM_PA1B1);
-	sc->bcw_radio_pa1b2 = BCW_READ16(regs, BCW_SPROM_PA1B2);
+	sc->sc_radio_pa0b0 = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+	    BCW_SPROM_PA0B0);
+	sc->sc_radio_pa0b1 = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+	    BCW_SPROM_PA0B1);
+	sc->sc_radio_pa0b2 = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+	    BCW_SPROM_PA0B2);
+	sc->sc_radio_pa1b0 = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+	    BCW_SPROM_PA1B0);
+	sc->sc_radio_pa1b1 = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+	    BCW_SPROM_PA1B1);
+	sc->sc_radio_pa1b2 = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+	    BCW_SPROM_PA1B2);
 
 	/* Get the idle TSSI */
-	sbval = BCW_READ16(regs, BCW_SPROM_IDLETSSI);
-	if(sc->bcw_phy_type == BCW_PHY_TYPEA)
-		sc->bcw_idletssi = (sbval & 0xff);
+	sbval = bus_space_read_2(sc->sc_iot, sc->sc_ioh, BCW_SPROM_IDLETSSI);
+	if(sc->sc_phy_type == BCW_PHY_TYPEA)
+		sc->sc_idletssi = (sbval & 0xff);
 	else
-		sc->bcw_idletssi = ((sbval & 0xff00) >> 8);
+		sc->sc_idletssi = ((sbval & 0xff00) >> 8);
 	
 	
 	/* Init the Microcode Flags Bitfield */
 	/* http://bcm-specs.sipsolutions.net/MicrocodeFlagsBitfield */
 	
 	sbval = 0;
-	if((sc->bcw_phy_type == BCW_PHY_TYPEA) ||
-	    (sc->bcw_phy_type == BCW_PHY_TYPEB) ||
-	    (sc->bcw_phy_type == BCW_PHY_TYPEG))
+	if((sc->sc_phy_type == BCW_PHY_TYPEA) ||
+	    (sc->sc_phy_type == BCW_PHY_TYPEB) ||
+	    (sc->sc_phy_type == BCW_PHY_TYPEG))
 		sbval |= 2; /* Turned on during init for non N phys */
-	if((sc->bcw_phy_type == BCW_PHY_TYPEG) &&
-	    (sc->bcw_phy_rev == 1))
+	if((sc->sc_phy_type == BCW_PHY_TYPEG) &&
+	    (sc->sc_phy_rev == 1))
 		sbval |= 0x20;
-	/*
-	 * XXX If this is a G PHY with BoardFlags BFL_PACTRL set,
-	 * set bit 0x40
-	 */
-	if((sc->bcw_phy_type == BCW_PHY_TYPEG) &&
-	    (sc->bcw_phy_rev < 3))
+	if ((sc->sc_phy_type == BCW_PHY_TYPEG) &&
+	    ((sc->sc_boardflags & BCW_BF_PACTRL) == BCW_BF_PACTRL))
+		sbval |= 0x40;
+	if((sc->sc_phy_type == BCW_PHY_TYPEG) &&
+	    (sc->sc_phy_rev < 3))
 		sbval |= 0x8; /* MAGIC */
-	/* XXX If BoardFlags BFL_XTAL is set, set bit 0x400 */
-	if(sc->bcw_phy_type == BCW_PHY_TYPEB)
+	if ((sc->sc_boardflags & BCW_BF_XTAL) == BCW_BF_XTAL)
+		sbval |= 0x400;
+	if(sc->sc_phy_type == BCW_PHY_TYPEB)
 		sbval |= 0x4;
-	if((sc->bcw_radiotype == 0x2050) &&
-	    (sc->bcw_radiorev <= 5))
+	if((sc->sc_radiotype == 0x2050) &&
+	    (sc->sc_radiorev <= 5))
 	    	sbval |= 0x40000;
 	/*
 	 * XXX If the device isn't up and this is a PCI bus with revision 
@@ -577,10 +624,12 @@ bcw_attach(struct bcw_softc *sc)
 	 * This explanation could make more sense, but an SHM read/write
 	 * wrapper of some sort would be better.
 	 */
-	BCW_WRITE32(regs, BCW_SHM_CONTROL, 
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_CONTROL, 
 	    (BCW_SHM_CONTROL_SHARED << 16) + BCW_SHM_MICROCODEFLAGSLOW - 2);
-	BCW_WRITE16(regs, BCW_SHM_DATAHIGH, sbval & 0x00ff);
-	BCW_WRITE16(regs, BCW_SHM_DATALOW, (sbval & 0xff00)>>16);
+	bus_space_write_2(sc->sc_iot, sc->sc_ioh, BCW_SHM_DATAHIGH,
+	    sbval & 0x00ff);
+	bus_space_write_2(sc->sc_iot, sc->sc_ioh, BCW_SHM_DATALOW,
+	    (sbval & 0xff00)>>16);
 
 	/* 
 	 * Initialize the TSSI to DBM table
@@ -591,7 +640,7 @@ bcw_attach(struct bcw_softc *sc)
 	
 	/* 
 	 * TODO still for the card attach: 
-	 * - Disable the 80211 Core
+	 * - Disable the 80211 Core (and wrapper for on/off)
 	 * - Powercontrol Crystal Off (and write a wrapper for on/off)
 	 * - Setup LEDs to blink in whatever fashionable manner
 	 */
@@ -599,68 +648,9 @@ bcw_attach(struct bcw_softc *sc)
 	/*
 	 * Allocate DMA-safe memory for ring descriptors.
 	 * The receive, and transmit rings are 4k aligned
-	 * XXX - still not too sure on how this works, it is
-	 * some of the remaining untouched code from if_bce
 	 */
-	if ((error = bus_dmamem_alloc(sc->bcw_dmatag,
-	    2 * PAGE_SIZE, PAGE_SIZE, 2 * PAGE_SIZE,
-	    &seg, 1, &rseg, BUS_DMA_NOWAIT))) {
-		printf("%s: unable to alloc space for ring descriptors, "
-		       "error = %d\n", sc->bcw_dev.dv_xname, error);
-		return;
-	}
-	/* map ring space to kernel */
-	if ((error = bus_dmamem_map(sc->bcw_dmatag, &seg, rseg,
-	    2 * PAGE_SIZE, &kva, BUS_DMA_NOWAIT))) {
-		printf("%s: unable to map DMA buffers, error = %d\n",
-		    sc->bcw_dev.dv_xname, error);
-		bus_dmamem_free(sc->bcw_dmatag, &seg, rseg);
-		return;
-	}
-	/* create a dma map for the ring */
-	if ((error = bus_dmamap_create(sc->bcw_dmatag,
-	    2 * PAGE_SIZE, 1, 2 * PAGE_SIZE, 0, BUS_DMA_NOWAIT,
-	    &sc->bcw_ring_map))) {
-		printf("%s: unable to create ring DMA map, error = %d\n",
-		    sc->bcw_dev.dv_xname, error);
-		bus_dmamem_unmap(sc->bcw_dmatag, kva, 2 * PAGE_SIZE);
-		bus_dmamem_free(sc->bcw_dmatag, &seg, rseg);
-		return;
-	}
-	/* connect the ring space to the dma map */
-	if (bus_dmamap_load(sc->bcw_dmatag, sc->bcw_ring_map, kva,
-	    2 * PAGE_SIZE, NULL, BUS_DMA_NOWAIT)) {
-		bus_dmamap_destroy(sc->bcw_dmatag, sc->bcw_ring_map);
-		bus_dmamem_unmap(sc->bcw_dmatag, kva, 2 * PAGE_SIZE);
-		bus_dmamem_free(sc->bcw_dmatag, &seg, rseg);
-		return;
-	}
-	/* save the ring space in softc */
-	sc->bcw_rx_ring = (struct bcw_dma_slot *) kva;
-	sc->bcw_tx_ring = (struct bcw_dma_slot *) (kva + PAGE_SIZE);
-
-	/* Create the transmit buffer DMA maps. */
-	for (i = 0; i < BCW_NTXDESC; i++) {
-		if ((error = bus_dmamap_create(sc->bcw_dmatag, MCLBYTES,
-		    BCW_NTXFRAGS, MCLBYTES, 0, 0,
-		    &sc->bcw_cdata.bcw_tx_map[i])) != 0) {
-			printf("%s: unable to create tx DMA map, error = %d\n",
-			    sc->bcw_dev.dv_xname, error);
-		}
-		sc->bcw_cdata.bcw_tx_chain[i] = NULL;
-	}
-
-	/* Create the receive buffer DMA maps. */
-	for (i = 0; i < BCW_NRXDESC; i++) {
-		if ((error = bus_dmamap_create(sc->bcw_dmatag, MCLBYTES, 1,
-		    MCLBYTES, 0, 0, &sc->bcw_cdata.bcw_rx_map[i])) != 0) {
-			printf("%s: unable to create rx DMA map, error = %d\n",
-			    sc->bcw_dev.dv_xname, error);
-		}
-		sc->bcw_cdata.bcw_rx_chain[i] = NULL;
-	}
-
-	/* End of the DMA stuff */
+	bcw_alloc_rx_ring(sc, &sc->sc_rxring, BCW_RX_RING_COUNT);
+	bcw_alloc_tx_ring(sc, &sc->sc_txring, BCW_TX_RING_COUNT);
 
 	ic->ic_phytype = IEEE80211_T_OFDM;
 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
@@ -670,24 +660,30 @@ bcw_attach(struct bcw_softc *sc)
 	ic->ic_caps = IEEE80211_C_IBSS; /* IBSS mode supported */
 
 	/* MAC address */
-	if(sc->bcw_phy_type == BCW_PHY_TYPEA) {
-		i=BCW_READ16(regs, BCW_SPROM_ET1MACADDR);
+	if(sc->sc_phy_type == BCW_PHY_TYPEA) {
+		i = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+		    BCW_SPROM_ET1MACADDR);
 		ic->ic_myaddr[0] = (i & 0xff00) >> 8;
 		ic->ic_myaddr[1] = i & 0xff;
-		i=BCW_READ16(regs, BCW_SPROM_ET1MACADDR + 2);
+		i = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+		    BCW_SPROM_ET1MACADDR + 2);
 		ic->ic_myaddr[2] = (i & 0xff00) >> 8;
 		ic->ic_myaddr[3] = i & 0xff;
-		i=BCW_READ16(regs, BCW_SPROM_ET1MACADDR + 4);
+		i = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+		    BCW_SPROM_ET1MACADDR + 4);
 		ic->ic_myaddr[4] = (i & 0xff00) >> 8;
 		ic->ic_myaddr[5] = i & 0xff;
 	} else { /* assume B or G PHY */
-		i=BCW_READ16(regs, BCW_SPROM_IL0MACADDR);
+		i = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+		    BCW_SPROM_IL0MACADDR);
 		ic->ic_myaddr[0] = (i & 0xff00) >> 8;
 		ic->ic_myaddr[1] = i & 0xff;
-		i=BCW_READ16(regs, BCW_SPROM_IL0MACADDR + 2);
+		i = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+		    BCW_SPROM_IL0MACADDR + 2);
 		ic->ic_myaddr[2] = (i & 0xff00) >> 8;
 		ic->ic_myaddr[3] = i & 0xff;
-		i=BCW_READ16(regs, BCW_SPROM_IL0MACADDR + 4);
+		i = bus_space_read_2(sc->sc_iot, sc->sc_ioh,
+		    BCW_SPROM_IL0MACADDR + 4);
 		ic->ic_myaddr[4] = (i & 0xff00) >> 8;
 		ic->ic_myaddr[5] = i & 0xff;
 	}
@@ -718,7 +714,7 @@ bcw_attach(struct bcw_softc *sc)
 	ifp->if_start = bcw_start;
 	ifp->if_watchdog = bcw_watchdog;
 	IFQ_SET_READY(&ifp->if_snd);
-	bcopy(sc->bcw_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
+	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
 
 	/* Attach the interface */
 	if_attach(ifp);
@@ -728,7 +724,7 @@ bcw_attach(struct bcw_softc *sc)
 	ic->ic_newstate = bcw_newstate;
 	ieee80211_media_init(ifp, bcw_media_change, bcw_media_status);
 
-	timeout_set(&sc->bcw_timeout, bcw_tick, sc);
+	timeout_set(&sc->sc_timeout, bcw_tick, sc);
 }
 
 /* handle media, and ethernet requests */
@@ -736,19 +732,12 @@ int
 bcw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 {
 	struct bcw_softc *sc = ifp->if_softc;
-	struct ieee80211com *ic = &sc->bcw_ic;
-	//struct bcw_regs *regs = &sc->bcw_regs;
+	struct ieee80211com *ic = &sc->sc_ic;
 	struct ifreq   *ifr = (struct ifreq *) data;
 	struct ifaddr *ifa = (struct ifaddr *)data;
 	int             s, error = 0;
 
 	s = splnet();
-#if 0
-	if ((error = ether_ioctl(ifp, &sc->bcw_ac, cmd, data)) > 0) {
-		splx(s);
-		return (error);
-	}
-#endif
 
 	switch (cmd) {
 	case SIOCSIFADDR:
@@ -758,7 +747,7 @@ bcw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 #ifdef INET
 		case AF_INET:
 			bcw_init(ifp);
-			arp_ifinit(&sc->bcw_ac, ifa);
+			/* XXX arp_ifinit(&sc->bcw_ac, ifa); */
 			break;
 #endif /* INET */
 		default:
@@ -810,14 +799,13 @@ bcw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 void
 bcw_start(struct ifnet *ifp)
 {
-	struct bcw_softc *sc = ifp->if_softc;
-	struct bcw_regs *regs = &sc->bcw_regs;
-	struct mbuf    *m0;
-	bus_dmamap_t    dmamap;
-	int             txstart;
-	int             txsfree;
+//	struct bcw_softc *sc = ifp->if_softc;
+//	struct mbuf    *m0;
+//	bus_dmamap_t    dmamap;
+//	int             txstart;
+//	int             txsfree;
 	int             newpkts = 0;
-	int             error;
+//	int             error;
 
 	/*
          * do not start another if currently transmitting, and more
@@ -826,11 +814,12 @@ bcw_start(struct ifnet *ifp)
 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
 		return;
 
+#if 0   /* FIXME */
 	/* determine number of descriptors available */
-	if (sc->bcw_txsnext >= sc->bcw_txin)
-		txsfree = BCW_NTXDESC - 1 + sc->bcw_txin - sc->bcw_txsnext;
+	if (sc->sc_txsnext >= sc->sc_txin)
+		txsfree = BCW_NTXDESC - 1 + sc->sc_txin - sc->sc_txsnext;
 	else
-		txsfree = sc->bcw_txin - sc->bcw_txsnext - 1;
+		txsfree = sc->sc_txin - sc->sc_txsnext - 1;
 
 	/*
          * Loop through the send queue, setting up transmit descriptors
@@ -846,7 +835,7 @@ bcw_start(struct ifnet *ifp)
 			break;
 
 		/* get the transmit slot dma map */
-		dmamap = sc->bcw_cdata.bcw_tx_map[sc->bcw_txsnext];
+		dmamap = sc->sc_cdata.bcw_tx_map[sc->sc_txsnext];
 
 		/*
 		 * Load the DMA map.  If this fails, the packet either
@@ -855,11 +844,11 @@ bcw_start(struct ifnet *ifp)
 		 * it will be dropped. If short on resources, it will
 		 * be tried again later.
 		 */
-		error = bus_dmamap_load_mbuf(sc->bcw_dmatag, dmamap, m0,
+		error = bus_dmamap_load_mbuf(sc->sc_dmat, dmamap, m0,
 		    BUS_DMA_WRITE | BUS_DMA_NOWAIT);
 		if (error == EFBIG) {
 			printf("%s: Tx packet consumes too many DMA segments, "
-			    "dropping...\n", sc->bcw_dev.dv_xname);
+			    "dropping...\n", sc->sc_dev.dv_xname);
 			IFQ_DEQUEUE(&ifp->if_snd, m0);
 			m_freem(m0);
 			ifp->if_oerrors++;
@@ -867,13 +856,13 @@ bcw_start(struct ifnet *ifp)
 		} else if (error) {
 			/* short on resources, come back later */
 			printf("%s: unable to load Tx buffer, error = %d\n",
-			    sc->bcw_dev.dv_xname, error);
+			    sc->sc_dev.dv_xname, error);
 			break;
 		}
 		/* If not enough descriptors available, try again later */
 		if (dmamap->dm_nsegs > txsfree) {
 			ifp->if_flags |= IFF_OACTIVE;
-			bus_dmamap_unload(sc->bcw_dmatag, dmamap);
+			bus_dmamap_unload(sc->sc_dmat, dmamap);
 			break;
 		}
 		/* WE ARE NOW COMMITTED TO TRANSMITTING THE PACKET. */
@@ -882,14 +871,14 @@ bcw_start(struct ifnet *ifp)
 		IFQ_DEQUEUE(&ifp->if_snd, m0);
 
 		/* save the pointer so it can be freed later */
-		sc->bcw_cdata.bcw_tx_chain[sc->bcw_txsnext] = m0;
+		sc->sc_cdata.bcw_tx_chain[sc->sc_txsnext] = m0;
 
 		/* Sync the data DMA map. */
-		bus_dmamap_sync(sc->bcw_dmatag, dmamap, 0, dmamap->dm_mapsize,
+		bus_dmamap_sync(sc->sc_dmat, dmamap, 0, dmamap->dm_mapsize,
 		    BUS_DMASYNC_PREWRITE);
 
 		/* Initialize the transmit descriptor(s). */
-		txstart = sc->bcw_txsnext;
+		txstart = sc->sc_txsnext;
 		for (seg = 0; seg < dmamap->dm_nsegs; seg++) {
 			u_int32_t ctrl;
 
@@ -898,28 +887,28 @@ bcw_start(struct ifnet *ifp)
 				ctrl |= CTRL_SOF;
 			if (seg == dmamap->dm_nsegs - 1)
 				ctrl |= CTRL_EOF;
-			if (sc->bcw_txsnext == BCW_NTXDESC - 1)
+			if (sc->sc_txsnext == BCW_NTXDESC - 1)
 				ctrl |= CTRL_EOT;
 			ctrl |= CTRL_IOC;
-			sc->bcw_tx_ring[sc->bcw_txsnext].ctrl = htole32(ctrl);
+			sc->bcw_tx_ring[sc->sc_txsnext].ctrl = htole32(ctrl);
 			/* MAGIC */
-			sc->bcw_tx_ring[sc->bcw_txsnext].addr =
+			sc->bcw_tx_ring[sc->sc_txsnext].addr =
 			    htole32(dmamap->dm_segs[seg].ds_addr + 0x40000000);
-			if (sc->bcw_txsnext + 1 > BCW_NTXDESC - 1)
-				sc->bcw_txsnext = 0;
+			if (sc->sc_txsnext + 1 > BCW_NTXDESC - 1)
+				sc->sc_txsnext = 0;
 			else
-				sc->bcw_txsnext++;
+				sc->sc_txsnext++;
 			txsfree--;
 		}
 		/* sync descriptors being used */
-		bus_dmamap_sync(sc->bcw_dmatag, sc->bcw_ring_map,
+		bus_dmamap_sync(sc->sc_dmat, sc->sc_ring_map,
 			  sizeof(struct bcw_dma_slot) * txstart + PAGE_SIZE,
 			     sizeof(struct bcw_dma_slot) * dmamap->dm_nsegs,
 				BUS_DMASYNC_PREREAD | BUS_DMASYNC_PREWRITE);
 
 		/* Give the packet to the chip. */
-		BCW_WRITE32(regs, BCW_DMA_DPTR,
-			     sc->bcw_txsnext * sizeof(struct bcw_dma_slot));
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_DPTR,
+			     sc->sc_txsnext * sizeof(struct bcw_dma_slot));
 
 		newpkts++;
 
@@ -933,6 +922,7 @@ bcw_start(struct ifnet *ifp)
 		/* No more slots left; notify upper layer. */
 		ifp->if_flags |= IFF_OACTIVE;
 	}
+#endif /* FIXME */
 	if (newpkts) {
 		/* Set a watchdog timer in case the chip flakes out. */
 		ifp->if_timer = 5;
@@ -945,7 +935,7 @@ bcw_watchdog(struct ifnet *ifp)
 {
 	struct bcw_softc *sc = ifp->if_softc;
 
-	printf("%s: device timeout\n", sc->bcw_dev.dv_xname);
+	printf("%s: device timeout\n", sc->sc_dev.dv_xname);
 	ifp->if_oerrors++;
 
 	(void) bcw_init(ifp);
@@ -958,28 +948,27 @@ int
 bcw_intr(void *xsc)
 {
 	struct bcw_softc *sc;
-	struct bcw_regs *regs;
 	struct ifnet *ifp;
 	u_int32_t intstatus;
 	int wantinit;
 	int handled = 0;
 
 	sc = xsc;
-	regs = &sc->bcw_regs;
-	ifp = &sc->bcw_ac.ac_if;
 
 	for (wantinit = 0; wantinit == 0;) {
-		intstatus = BCW_READ32(regs, BCW_INT_STS);
+		intstatus = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+		    BCW_INT_STS);
 
 		/* ignore if not ours, or unsolicited interrupts */
-		intstatus &= sc->bcw_intmask;
+		intstatus &= sc->sc_intmask;
 		if (intstatus == 0)
 			break;
 
 		handled = 1;
 
 		/* Ack interrupt */
-		BCW_WRITE32(regs, BCW_INT_STS, intstatus);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_INT_STS,
+		    intstatus);
 
 		/* Receive interrupts. */
 		if (intstatus & I_RI)
@@ -991,27 +980,27 @@ bcw_intr(void *xsc)
 		if (intstatus & ~(I_RI | I_XI)) {
 			if (intstatus & I_XU)
 				printf("%s: transmit fifo underflow\n",
-				    sc->bcw_dev.dv_xname);
+				    sc->sc_dev.dv_xname);
 			if (intstatus & I_RO) {
 				printf("%s: receive fifo overflow\n",
-				    sc->bcw_dev.dv_xname);
+				    sc->sc_dev.dv_xname);
 				ifp->if_ierrors++;
 			}
 			if (intstatus & I_RU)
 				printf("%s: receive descriptor underflow\n",
-				       sc->bcw_dev.dv_xname);
+				       sc->sc_dev.dv_xname);
 			if (intstatus & I_DE)
 				printf("%s: descriptor protocol error\n",
-				       sc->bcw_dev.dv_xname);
+				       sc->sc_dev.dv_xname);
 			if (intstatus & I_PD)
 				printf("%s: data error\n",
-				    sc->bcw_dev.dv_xname);
+				    sc->sc_dev.dv_xname);
 			if (intstatus & I_PC)
 				printf("%s: descriptor error\n",
-				    sc->bcw_dev.dv_xname);
+				    sc->sc_dev.dv_xname);
 			if (intstatus & I_TO)
 				printf("%s: general purpose timeout\n",
-				    sc->bcw_dev.dv_xname);
+				    sc->sc_dev.dv_xname);
 			wantinit = 1;
 		}
 	}
@@ -1029,35 +1018,35 @@ bcw_intr(void *xsc)
 void
 bcw_rxintr(struct bcw_softc *sc)
 {
-	struct ifnet *ifp = &sc->bcw_ac.ac_if;
-	struct bcw_regs *regs = &sc->bcw_regs;
-	struct rx_pph *pph;
-	struct mbuf *m;
+//	struct rx_pph *pph;
+//	struct mbuf *m;
 	int curr;
-	int len;
-	int i;
+//	int len;
+//	int i;
 
 	/* get pointer to active receive slot */
-	curr = BCW_READ32(regs, BCW_DMA_RXSTATUS) & RS_CD_MASK;
+	curr = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_RXSTATUS(0)) & 
+	    RS_CD_MASK;
 	curr = curr / sizeof(struct bcw_dma_slot);
-	if (curr >= BCW_NRXDESC)
-		curr = BCW_NRXDESC - 1;
+	if (curr >= BCW_RX_RING_COUNT)
+		curr = BCW_RX_RING_COUNT - 1;
 
+#if 0
 	/* process packets up to but not current packet being worked on */
-	for (i = sc->bcw_rxin; i != curr;
+	for (i = sc->sc_rxin; i != curr;
 	    i + 1 > BCW_NRXDESC - 1 ? i = 0 : i++) {
 		/* complete any post dma memory ops on packet */
-		bus_dmamap_sync(sc->bcw_dmatag, sc->bcw_cdata.bcw_rx_map[i], 0,
-		    sc->bcw_cdata.bcw_rx_map[i]->dm_mapsize,
+		bus_dmamap_sync(sc->sc_dmat, sc->sc_cdata.bcw_rx_map[i], 0,
+		    sc->sc_cdata.bcw_rx_map[i]->dm_mapsize,
 		    BUS_DMASYNC_POSTREAD);
 
 		/*
 		 * If the packet had an error, simply recycle the buffer,
 		 * resetting the len, and flags.
 		 */
-		pph = mtod(sc->bcw_cdata.bcw_rx_chain[i], struct rx_pph *);
+		pph = mtod(sc->sc_cdata.bcw_rx_chain[i], struct rx_pph *);
 		if (pph->flags & (RXF_NO | RXF_RXER | RXF_CRC | RXF_OV)) {
-			ifp->if_ierrors++;
+			/* XXX Increment input error count */
 			pph->len = 0;
 			pph->flags = 0;
 			continue;
@@ -1069,7 +1058,7 @@ bcw_rxintr(struct bcw_softc *sc)
 		pph->len = 0;
 		pph->flags = 0;
 		/* bump past pre header to packet */
-		sc->bcw_cdata.bcw_rx_chain[i]->m_data += 
+		sc->sc_cdata.bcw_rx_chain[i]->m_data += 
 		    BCW_PREPKT_HEADER_SIZE;
 
  		/*
@@ -1095,20 +1084,20 @@ bcw_rxintr(struct bcw_softc *sc)
 				goto dropit;
 			m->m_data += 2;
 			memcpy(mtod(m, caddr_t),
-			    mtod(sc->bcw_cdata.bcw_rx_chain[i], caddr_t), len);
-			sc->bcw_cdata.bcw_rx_chain[i]->m_data -=
+			    mtod(sc->sc_cdata.bcw_rx_chain[i], caddr_t), len);
+			sc->sc_cdata.bcw_rx_chain[i]->m_data -=
 			    BCW_PREPKT_HEADER_SIZE;
 		} else {
-			m = sc->bcw_cdata.bcw_rx_chain[i];
+			m = sc->sc_cdata.bcw_rx_chain[i];
 			if (bcw_add_rxbuf(sc, i) != 0) {
 		dropit:
-				ifp->if_ierrors++;
+				/* XXX increment wireless input error counter */
 				/* continue to use old buffer */
-				sc->bcw_cdata.bcw_rx_chain[i]->m_data -=
+				sc->sc_cdata.bcw_rx_chain[i]->m_data -=
 				    BCW_PREPKT_HEADER_SIZE;
-				bus_dmamap_sync(sc->bcw_dmatag,
-				    sc->bcw_cdata.bcw_rx_map[i], 0,
-				    sc->bcw_cdata.bcw_rx_map[i]->dm_mapsize,
+				bus_dmamap_sync(sc->sc_dmat,
+				    sc->sc_cdata.bcw_rx_map[i], 0,
+				    sc->sc_cdata.bcw_rx_map[i]->dm_mapsize,
 				    BUS_DMASYNC_PREREAD);
 				continue;
 			}
@@ -1116,70 +1105,73 @@ bcw_rxintr(struct bcw_softc *sc)
 
 		m->m_pkthdr.rcvif = ifp;
 		m->m_pkthdr.len = m->m_len = len;
-		ifp->if_ipackets++;
+		/* XXX Increment input packet count */
 
 #if NBPFILTER > 0
 		/*
 		 * Pass this up to any BPF listeners, but only
 		 * pass it up the stack if it's for us.
+		 *
+		 * if (ifp->if_bpf)
+		 *	bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_IN);
 		 */
-		if (ifp->if_bpf)
-			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_IN);
 #endif				/* NBPFILTER > 0 */
 
-		/* Pass it on. */
-		ether_input_mbuf(ifp, m);
+		/* XXX Pass it on. */
+		//ether_input_mbuf(ifp, m);
 
 		/* re-check current in case it changed */
-		curr = (BCW_READ32(regs,
+		curr = (bus_space_read_4(sc->sc_iot, sc->sc_ioh,
 		    BCW_DMA_RXSTATUS) & RS_CD_MASK) /
 		    sizeof(struct bcw_dma_slot);
 		if (curr >= BCW_NRXDESC)
 			curr = BCW_NRXDESC - 1;
 	}
-	sc->bcw_rxin = curr;
+	sc->sc_rxin = curr;
+#endif
 }
 
 /* Transmit interrupt handler */
 void
 bcw_txintr(struct bcw_softc *sc)
 {
-	struct ifnet *ifp = &sc->bcw_ac.ac_if;
-	struct bcw_regs *regs = &sc->bcw_regs;
+//	struct ifnet *ifp = &sc->bcw_ac.ac_if;
 	int curr;
-	int i;
+//	int i;
 
-	ifp->if_flags &= ~IFF_OACTIVE;
+//	ifp->if_flags &= ~IFF_OACTIVE;
 
+#if 0
 	/*
          * Go through the Tx list and free mbufs for those
          * frames which have been transmitted.
          */
-	curr = BCW_READ32(regs, BCW_DMA_TXSTATUS) & RS_CD_MASK;
+	curr = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_TXSTATUS) & RS_CD_MASK;
 	curr = curr / sizeof(struct bcw_dma_slot);
 	if (curr >= BCW_NTXDESC)
 		curr = BCW_NTXDESC - 1;
-	for (i = sc->bcw_txin; i != curr;
+	for (i = sc->sc_txin; i != curr;
 	    i + 1 > BCW_NTXDESC - 1 ? i = 0 : i++) {
 		/* do any post dma memory ops on transmit data */
-		if (sc->bcw_cdata.bcw_tx_chain[i] == NULL)
+		if (sc->sc_cdata.bcw_tx_chain[i] == NULL)
 			continue;
-		bus_dmamap_sync(sc->bcw_dmatag, sc->bcw_cdata.bcw_tx_map[i], 0,
-		    sc->bcw_cdata.bcw_tx_map[i]->dm_mapsize,
+		bus_dmamap_sync(sc->sc_dmat, sc->sc_cdata.bcw_tx_map[i], 0,
+		    sc->sc_cdata.bcw_tx_map[i]->dm_mapsize,
 		    BUS_DMASYNC_POSTWRITE);
-		bus_dmamap_unload(sc->bcw_dmatag, sc->bcw_cdata.bcw_tx_map[i]);
-		m_freem(sc->bcw_cdata.bcw_tx_chain[i]);
-		sc->bcw_cdata.bcw_tx_chain[i] = NULL;
+		bus_dmamap_unload(sc->sc_dmat, sc->sc_cdata.bcw_tx_map[i]);
+		m_freem(sc->sc_cdata.bcw_tx_chain[i]);
+		sc->sc_cdata.bcw_tx_chain[i] = NULL;
 		ifp->if_opackets++;
 	}
-	sc->bcw_txin = curr;
+#endif
+	sc->sc_txin = curr;
 
 	/*
 	 * If there are no more pending transmissions, cancel the watchdog
 	 * timer
 	 */
-	if (sc->bcw_txsnext == sc->bcw_txin)
-		ifp->if_timer = 0;
+//	if (sc->sc_txsnext == sc->sc_txin)
+//		ifp->if_timer = 0;
 }
 
 /* initialize the interface */
@@ -1187,10 +1179,7 @@ int
 bcw_init(struct ifnet *ifp)
 {
 	struct bcw_softc *sc = ifp->if_softc;
-	struct bcw_regs *regs = &sc->bcw_regs;
 	u_int32_t reg_win;
-	int error;
-	int i;
 
 	/* Cancel any pending I/O. */
 	bcw_stop(ifp, 0);
@@ -1202,118 +1191,101 @@ bcw_init(struct ifnet *ifp)
 	 * written for.
 	 */
 
-	/* enable pci inerrupts, bursts, and prefetch */
+	/* enable pci interrupts, bursts, and prefetch */
 
 	/* remap the pci registers to the Sonics config registers */
 
 	/* save the current map, so it can be restored */
-	reg_win = BCW_READ32(regs, BCW_REG0_WIN);
+	reg_win = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_REG0_WIN);
 
 	/* set register window to Sonics registers */
-	BCW_WRITE32(regs, BCW_REG0_WIN, BCW_SONICS_WIN);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_REG0_WIN, BCW_SONICS_WIN);
 
 	/* enable SB to PCI interrupt */
-	BCW_WRITE32(regs, BCW_SBINTVEC,
-	    BCW_READ32(regs, BCW_SBINTVEC) |
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBINTVEC,
+	    bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SBINTVEC) |
 	    SBIV_ENET0);
 
 	/* enable prefetch and bursts for sonics-to-pci translation 2 */
-	BCW_WRITE32(regs, BCW_SPCI_TR2,
-	    BCW_READ32(regs, BCW_SPCI_TR2) |
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SPCI_TR2,
+	    bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SPCI_TR2) |
 	    SBTOPCI_PREF | SBTOPCI_BURST);
 
 	/* restore to ethernet register space */
-	BCW_WRITE32(regs, BCW_REG0_WIN, reg_win);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_REG0_WIN, reg_win);
 
 	/* Reset the chip to a known state. */
 	bcw_reset(sc);
 
+#if 0 /* FIXME */
 	/* Initialize transmit descriptors */
 	memset(sc->bcw_tx_ring, 0, BCW_NTXDESC * sizeof(struct bcw_dma_slot));
-	sc->bcw_txsnext = 0;
-	sc->bcw_txin = 0;
+	sc->sc_txsnext = 0;
+	sc->sc_txin = 0;
+#endif
 
 	/* enable crc32 generation and set proper LED modes */
-	BCW_WRITE32(regs, BCW_MACCTL,
-	    BCW_READ32(regs, BCW_MACCTL) |
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_MACCTL,
+	    bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_MACCTL) |
 	    BCW_EMC_CRC32_ENAB | BCW_EMC_LED);
 
 	/* reset or clear powerdown control bit  */
-	BCW_WRITE32(regs, BCW_MACCTL,
-	    BCW_READ32(regs, BCW_MACCTL) &
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_MACCTL,
+	    bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_MACCTL) &
 	    ~BCW_EMC_PDOWN);
 
 	/* setup DMA interrupt control */
-	BCW_WRITE32(regs, BCW_DMAI_CTL, 1 << 24);	/* MAGIC */
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMAI_CTL, 1 << 24);	/* MAGIC */
 
 	/* setup packet filter */
 	bcw_set_filter(ifp);
 
 	/* set max frame length, account for possible VLAN tag */
-	BCW_WRITE32(regs, BCW_RX_MAX,
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_RX_MAX,
 	    ETHER_MAX_LEN + ETHER_VLAN_ENCAP_LEN);
-	BCW_WRITE32(regs, BCW_TX_MAX,
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_TX_MAX,
 	    ETHER_MAX_LEN + ETHER_VLAN_ENCAP_LEN);
 
 	/* set tx watermark */
-	BCW_WRITE32(regs, BCW_TX_WATER, 56);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_TX_WATER, 56);
 
 	/* enable transmit */
-	BCW_WRITE32(regs, BCW_DMA_TXCTL, XC_XE);
-	/* MAGIC */
-	BCW_WRITE32(regs, BCW_DMA_TXADDR,
-	    sc->bcw_ring_map->dm_segs[0].ds_addr + PAGE_SIZE + 0x40000000);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_TXCTL, XC_XE);
 
 	/*
          * Give the receive ring to the chip, and
          * start the receive DMA engine.
          */
-	sc->bcw_rxin = 0;
+	sc->sc_rxin = 0;
 
-	/* clear the rx descriptor ring */
-	memset(sc->bcw_rx_ring, 0, BCW_NRXDESC * sizeof(struct bcw_dma_slot));
 	/* enable receive */
-	BCW_WRITE32(regs, BCW_DMA_RXCTL,
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_RXCTL,
 	    BCW_PREPKT_HEADER_SIZE << 1 | 1);
-	BCW_WRITE32(regs, BCW_DMA_RXADDR,
-	    sc->bcw_ring_map->dm_segs[0].ds_addr + 0x40000000);	/* MAGIC */
-
-	/* Initalize receive descriptors */
-	for (i = 0; i < BCW_NRXDESC; i++) {
-		if (sc->bcw_cdata.bcw_rx_chain[i] == NULL) {
-			if ((error = bcw_add_rxbuf(sc, i)) != 0) {
-				printf("%s: unable to allocate or map rx(%d) "
-				    "mbuf, error = %d\n", sc->bcw_dev.dv_xname,
-				    i, error);
-				bcw_rxdrain(sc);
-				return (error);
-			}
-		} else
-			BCW_INIT_RXDESC(sc, i);
-	}
 
 	/* Enable interrupts */
-	sc->bcw_intmask =
+	sc->sc_intmask =
 	    I_XI | I_RI | I_XU | I_RO | I_RU | I_DE | I_PD | I_PC | I_TO;
-	BCW_WRITE32(regs, BCW_INT_MASK,
-	    sc->bcw_intmask);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_INT_MASK,
+	    sc->sc_intmask);
 
+#if 0 /* FIXME */
 	/* start the receive dma */
-	BCW_WRITE32(regs, BCW_DMA_RXDPTR,
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_RXDPTR,
 	    BCW_NRXDESC * sizeof(struct bcw_dma_slot));
+#endif
 
 	/* set media */
 	//mii_mediachg(&sc->bcw_mii);
 
 	/* turn on the ethernet mac */
 #if 0
-	bus_space_write_4(sc->bcw_btag, sc->bcw_bhandle, BCW_ENET_CTL,
-	    bus_space_read_4(sc->bcw_btag, sc->bcw_bhandle,
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_ENET_CTL,
+	    bus_space_read_4(sc->sc_iot, sc->sc_ioh,
 	    BCW_ENET_CTL) | EC_EE);
 #endif
 
 	/* start timer */
-	timeout_add(&sc->bcw_timeout, hz);
+	timeout_add(&sc->sc_timeout, hz);
 
 	/* mark as running, and no outputs active */
 	ifp->if_flags |= IFF_RUNNING;
@@ -1326,6 +1298,7 @@ bcw_init(struct ifnet *ifp)
 int
 bcw_add_rxbuf(struct bcw_softc *sc, int idx)
 {
+#if 0
 	struct mbuf *m;
 	int error;
 
@@ -1338,24 +1311,26 @@ bcw_add_rxbuf(struct bcw_softc *sc, int idx)
 		m_freem(m);
 		return (ENOBUFS);
 	}
-	if (sc->bcw_cdata.bcw_rx_chain[idx] != NULL)
-		bus_dmamap_unload(sc->bcw_dmatag,
-		    sc->bcw_cdata.bcw_rx_map[idx]);
+	if (sc->sc_cdata.bcw_rx_chain[idx] != NULL)
+		bus_dmamap_unload(sc->sc_dmat,
+		    sc->sc_cdata.bcw_rx_map[idx]);
 
-	sc->bcw_cdata.bcw_rx_chain[idx] = m;
+	sc->sc_cdata.bcw_rx_chain[idx] = m;
 
-	error = bus_dmamap_load(sc->bcw_dmatag, sc->bcw_cdata.bcw_rx_map[idx],
+	error = bus_dmamap_load(sc->sc_dmat, sc->sc_cdata.bcw_rx_map[idx],
 	    m->m_ext.ext_buf, m->m_ext.ext_size, NULL,
 	    BUS_DMA_READ | BUS_DMA_NOWAIT);
 	if (error)
 		return (error);
 
-	bus_dmamap_sync(sc->bcw_dmatag, sc->bcw_cdata.bcw_rx_map[idx], 0,
-	    sc->bcw_cdata.bcw_rx_map[idx]->dm_mapsize, BUS_DMASYNC_PREREAD);
+	bus_dmamap_sync(sc->sc_dmat, sc->sc_cdata.bcw_rx_map[idx], 0,
+	    sc->sc_cdata.bcw_rx_map[idx]->dm_mapsize, BUS_DMASYNC_PREREAD);
 
 	BCW_INIT_RXDESC(sc, idx);
 
 	return (0);
+#endif
+	return (1);
 
 }
 
@@ -1363,16 +1338,18 @@ bcw_add_rxbuf(struct bcw_softc *sc, int idx)
 void
 bcw_rxdrain(struct bcw_softc *sc)
 {
+#if 0 /* FIXME */
 	int i;
 
 	for (i = 0; i < BCW_NRXDESC; i++) {
-		if (sc->bcw_cdata.bcw_rx_chain[i] != NULL) {
-			bus_dmamap_unload(sc->bcw_dmatag,
-			    sc->bcw_cdata.bcw_rx_map[i]);
-			m_freem(sc->bcw_cdata.bcw_rx_chain[i]);
-			sc->bcw_cdata.bcw_rx_chain[i] = NULL;
+		if (sc->sc_cdata.bcw_rx_chain[i] != NULL) {
+			bus_dmamap_unload(sc->sc_dmat,
+			    sc->sc_cdata.bcw_rx_map[i]);
+			m_freem(sc->sc_cdata.bcw_rx_chain[i]);
+			sc->sc_cdata.bcw_rx_chain[i] = NULL;
 		}
 	}
+#endif
 }
 
 /* Stop transmission on the interface */
@@ -1380,27 +1357,25 @@ void
 bcw_stop(struct ifnet *ifp, int disable)
 {
 	struct bcw_softc *sc = ifp->if_softc;
-	struct bcw_regs *regs = &sc->bcw_regs;
-	int i;
 	//u_int32_t val;
 
 	/* Stop the 1 second timer */
-	timeout_del(&sc->bcw_timeout);
+	timeout_del(&sc->sc_timeout);
 
 	/* Mark the interface down and cancel the watchdog timer. */
 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 	ifp->if_timer = 0;
 
 	/* Disable interrupts. */
-	BCW_WRITE32(regs, BCW_INT_MASK, 0);
-	sc->bcw_intmask = 0;
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_INT_MASK, 0);
+	sc->sc_intmask = 0;
 	delay(10);
 
 	/* Disable emac */
 #if 0
-	bus_space_write_4(sc->bcw_btag, sc->bcw_bhandle, BCW_ENET_CTL, EC_ED);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_ENET_CTL, EC_ED);
 	for (i = 0; i < 200; i++) {
-		val = bus_space_read_4(sc->bcw_btag, sc->bcw_bhandle,
+		val = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
 		    BCW_ENET_CTL);
 		if (!(val & EC_ED))
 			break;
@@ -1408,19 +1383,21 @@ bcw_stop(struct ifnet *ifp, int disable)
 	}
 #endif
 	/* Stop the DMA */
-	BCW_WRITE32(regs, BCW_DMA_RXCTL, 0);
-	BCW_WRITE32(regs, BCW_DMA_TXCTL, 0);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_RXCONTROL(0), 0);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_TXCONTROL(0), 0);
 	delay(10);
 
+#if 0	/* FIXME */
 	/* Release any queued transmit buffers. */
 	for (i = 0; i < BCW_NTXDESC; i++) {
-		if (sc->bcw_cdata.bcw_tx_chain[i] != NULL) {
-			bus_dmamap_unload(sc->bcw_dmatag,
-			    sc->bcw_cdata.bcw_tx_map[i]);
-			m_freem(sc->bcw_cdata.bcw_tx_chain[i]);
-			sc->bcw_cdata.bcw_tx_chain[i] = NULL;
+		if (sc->sc_cdata.bcw_tx_chain[i] != NULL) {
+			bus_dmamap_unload(sc->sc_dmat,
+			    sc->sc_cdata.bcw_tx_map[i]);
+			m_freem(sc->sc_cdata.bcw_tx_chain[i]);
+			sc->sc_cdata.bcw_tx_chain[i] = NULL;
 		}
 	}
+#endif
 
 	/* drain receive queue */
 	if (disable)
@@ -1431,43 +1408,45 @@ bcw_stop(struct ifnet *ifp, int disable)
 void
 bcw_reset(struct bcw_softc *sc)
 {
-	struct bcw_regs *regs = &sc->bcw_regs;
 	u_int32_t val;
 	u_int32_t sbval;
 	int i;
 	
 	/* if SB core is up, only clock of clock,reset,reject will be set */
-	sbval = BCW_READ32(regs, BCW_SBTMSTATELOW);
+	sbval = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATELOW);
 
 	/* The core isn't running if the if the clock isn't enabled */
 	if ((sbval & (SBTML_RESET | SBTML_REJ | SBTML_CLK)) == SBTML_CLK) {
 
+#if 0
 		// Stop all DMA
-		BCW_WRITE32(regs, BCW_DMAI_CTL, 0);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMAI_CTL, 0);
 
 		/* reset the dma engines */
-		BCW_WRITE32(regs, BCW_DMA_TXCTL, 0);
-		val = BCW_READ32(regs, BCW_DMA_RXSTATUS);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_TXCTL, 0);
+		val = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+		    BCW_DMA_RXSTATUS);
 		/* if error on receive, wait to go idle */
 		if (val & RS_ERROR) {
 			for (i = 0; i < 100; i++) {
-				val = BCW_READ32(regs, BCW_DMA_RXSTATUS);
+				val = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+				    BCW_DMA_RXSTATUS);
 				if (val & RS_DMA_IDLE)
 					break;
 				delay(10);
 			}
 			if (i == 100)
 				printf("%s: receive dma did not go idle after"
-				    " error\n", sc->bcw_dev.dv_xname);
+				    " error\n", sc->sc_dev.dv_xname);
 		}
-		BCW_WRITE32(regs, BCW_DMA_RXSTATUS, 0);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_RXSTATUS, 0);
 
 		/* reset ethernet mac */
-#if 0
-		bus_space_write_4(sc->bcw_btag, sc->bcw_bhandle, BCW_ENET_CTL,
+
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_ENET_CTL,
 		    EC_ES);
 		for (i = 0; i < 200; i++) {
-			val = bus_space_read_4(sc->bcw_btag, sc->bcw_bhandle,
+			val = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
 			    BCW_ENET_CTL);
 			if (!(val & EC_ES))
 				break;
@@ -1475,116 +1454,123 @@ bcw_reset(struct bcw_softc *sc)
 		}
 		if (i == 200)
 			printf("%s: timed out resetting ethernet mac\n",
-			       sc->bcw_dev.dv_xname);
+			       sc->sc_dev.dv_xname);
 #endif
 	} else {
 		u_int32_t reg_win;
 
 		/* remap the pci registers to the Sonics config registers */
-
+#if 0
 		/* save the current map, so it can be restored */
-		reg_win = BCW_READ32(regs, BCW_REG0_WIN);
+		reg_win = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+		    BCW_REG0_WIN);
 		/* set register window to Sonics registers */
-		BCW_WRITE32(regs, BCW_REG0_WIN, BCW_SONICS_WIN);
-
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_REG0_WIN,
+		    BCW_SONICS_WIN);
+#endif
 		/* enable SB to PCI interrupt */
-		BCW_WRITE32(regs, BCW_SBINTVEC,
-		    BCW_READ32(regs,
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBINTVEC,
+		    bus_space_read_4(sc->sc_iot, sc->sc_ioh,
 		        BCW_SBINTVEC) |
 		    SBIV_ENET0);
 
 		/* enable prefetch and bursts for sonics-to-pci translation 2 */
-		BCW_WRITE32(regs, BCW_SPCI_TR2,
-		    BCW_READ32(regs,
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SPCI_TR2,
+		    bus_space_read_4(sc->sc_iot, sc->sc_ioh,
 			BCW_SPCI_TR2) |
 		    SBTOPCI_PREF | SBTOPCI_BURST);
 
 		/* restore to ethernet register space */
-		BCW_WRITE32(regs, BCW_REG0_WIN, reg_win);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_REG0_WIN, reg_win);
 	}
 
 	/* disable SB core if not in reset */
 	if (!(sbval & SBTML_RESET)) {
 
 		/* set the reject bit */
-		BCW_WRITE32(regs, BCW_SBTMSTATELOW, SBTML_REJ | SBTML_CLK);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATELOW,
+		    SBTML_REJ | SBTML_CLK);
 		for (i = 0; i < 200; i++) {
-			val = BCW_READ32(regs, BCW_SBTMSTATELOW);
+			val = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+			    BCW_SBTMSTATELOW);
 			if (val & SBTML_REJ)
 				break;
 			delay(1);
 		}
 		if (i == 200)
 			printf("%s: while resetting core, reject did not set\n",
-			    sc->bcw_dev.dv_xname);
+			    sc->sc_dev.dv_xname);
 		/* wait until busy is clear */
 		for (i = 0; i < 200; i++) {
-			val = BCW_READ32(regs, BCW_SBTMSTATEHI);
+			val = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+			    BCW_SBTMSTATEHI);
 			if (!(val & 0x4))
 				break;
 			delay(1);
 		}
 		if (i == 200)
 			printf("%s: while resetting core, busy did not clear\n",
-			    sc->bcw_dev.dv_xname);
+			    sc->sc_dev.dv_xname);
 		/* set reset and reject while enabling the clocks */
-		BCW_WRITE32(regs, BCW_SBTMSTATELOW,
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATELOW,
 		    SBTML_FGC | SBTML_CLK | SBTML_REJ | SBTML_RESET |
 		    SBTML_80211FLAG);
-		val = BCW_READ32(regs, BCW_SBTMSTATELOW);
+		val = bus_space_read_4(sc->sc_iot, sc->sc_ioh,
+		    BCW_SBTMSTATELOW);
 		delay(10);
-		BCW_WRITE32(regs, BCW_SBTMSTATELOW, SBTML_REJ | SBTML_RESET);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATELOW,
+		    SBTML_REJ | SBTML_RESET);
 		delay(1);
 	}
 	/* This is enabling/resetting the core */
 	/* enable clock */
-	BCW_WRITE32(regs, BCW_SBTMSTATELOW,
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATELOW,
 	    SBTML_FGC | SBTML_CLK | SBTML_RESET | 
 	    SBTML_80211FLAG | SBTML_80211PHY );
-	val = BCW_READ32(regs, BCW_SBTMSTATELOW);
+	val = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATELOW);
 	delay(1);
 
 	/* clear any error bits that may be on */
-	val = BCW_READ32(regs, BCW_SBTMSTATEHI);
+	val = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATEHI);
 	if (val & 1)
-		BCW_WRITE32(regs, BCW_SBTMSTATEHI, 0);
-	val = BCW_READ32(regs, BCW_SBIMSTATE);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATEHI, 0);
+	val = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SBIMSTATE);
 	if (val & SBIM_MAGIC_ERRORBITS)
-		BCW_WRITE32(regs, BCW_SBIMSTATE,
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBIMSTATE,
 		    val & ~SBIM_MAGIC_ERRORBITS);
 
 	/* clear reset and allow it to propagate throughout the core */
-	BCW_WRITE32(regs, BCW_SBTMSTATELOW,
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATELOW,
 	    SBTML_FGC | SBTML_CLK | SBTML_80211FLAG | SBTML_80211PHY );
-	val = BCW_READ32(regs, BCW_SBTMSTATELOW);
+	val = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATELOW);
 	delay(1);
 
 	/* leave clock enabled */
-	BCW_WRITE32(regs, BCW_SBTMSTATELOW,
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATELOW,
 	    SBTML_CLK | SBTML_80211FLAG | SBTML_80211PHY);
-	val = BCW_READ32(regs, BCW_SBTMSTATELOW);
+	val = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SBTMSTATELOW);
 	delay(1);
-
+#if 0
 	/* Write a 0 to MMIO reg 0x3e6, Baseband attenuation */
-	BCW_WRITE16(regs, 0x3e6,0);
-	
+	bus_space_write_2(sc->sc_iot, sc->sc_ioh, 0x3e6,0);
+#endif
 	/* Set 0x400 in the MMIO StatusBitField reg */
-	sbval=BCW_READ32(regs, 0x120);
+	sbval=bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SBF);
 	sbval |= 0x400; 
-	BCW_WRITE32(regs, 0x120, sbval);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SBF, sbval);
 #if 0
 	/* initialize MDC preamble, frequency */
 	/* MAGIC */
-	bus_space_write_4(sc->bcw_btag, sc->bcw_bhandle, BCW_MI_CTL, 0x8d);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_MI_CTL, 0x8d);
 
 	/* enable phy, differs for internal, and external */
-	val = bus_space_read_4(sc->bcw_btag, sc->bcw_bhandle, BCW_DEVCTL);
+	val = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_DEVCTL);
 	if (!(val & BCW_DC_IP)) {
 		/* select external phy */
-		bus_space_write_4(sc->bcw_btag, sc->bcw_bhandle, BCW_ENET_CTL,
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_ENET_CTL,
 		    EC_EP);
 	} else if (val & BCW_DC_ER) {	/* internal, clear reset bit if on */
-		bus_space_write_4(sc->bcw_btag, sc->bcw_bhandle, BCW_DEVCTL,
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DEVCTL,
 		    val & ~BCW_DC_ER);
 		delay(100);
 	}
@@ -1626,7 +1612,7 @@ bcw_set_filter(struct ifnet *ifp)
 		    0);
 
 		/* add our own address */
-		bcw_add_mac(sc, sc->bcw_ac.ac_enaddr, 0);
+		// bcw_add_mac(sc, sc->bcw_ac.ac_enaddr, 0);
 
 		/* for now accept all multicast */
 		bus_space_write_4(sc->bcw_btag, sc->bcw_bhandle, BCW_RX_CTL,
@@ -1674,9 +1660,9 @@ void
 bcw_media_status(struct ifnet *ifp, struct ifmediareq *imr)
 {
         struct bcw_softc *sc = ifp->if_softc;
-	struct ieee80211com *ic = &sc->bcw_ic;
+	struct ieee80211com *ic = &sc->sc_ic;
 	//uint32_t val;
-	int rate;                                                                        
+	int rate;
 
         imr->ifm_status = IFM_AVALID;
 	imr->ifm_active = IFM_IEEE80211;
@@ -1725,7 +1711,6 @@ bcw_tick(void *v)
 int
 bcw_validatechipaccess(struct bcw_softc *sc)
 {
-	struct bcw_regs *regs = &sc->bcw_regs;
 	u_int32_t save,val;
 
 	/*
@@ -1735,17 +1720,19 @@ bcw_validatechipaccess(struct bcw_softc *sc)
 	 */
 	 
 	/* Backup SHM uCode Revision before we clobber it */
-	BCW_WRITE32(regs, BCW_SHM_CONTROL,
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_CONTROL,
 	    (BCW_SHM_CONTROL_SHARED << 16) + 0);
-	save = BCW_READ32(regs, BCW_SHM_DATA);
+	save = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_DATA);
 	
 	/* write test value */
-	BCW_WRITE32(regs, BCW_SHM_CONTROL, (BCW_SHM_CONTROL_SHARED << 16) + 0);
-	BCW_WRITE32(regs, BCW_SHM_DATA, 0xaa5555aa);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_CONTROL,
+	    (BCW_SHM_CONTROL_SHARED << 16) + 0);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_DATA, 0xaa5555aa);
 	DPRINTF(("Write test 1, "));	
 	/* Read it back */
-	BCW_WRITE32(regs, BCW_SHM_CONTROL, (BCW_SHM_CONTROL_SHARED << 16) + 0);
-	val = BCW_READ32(regs, BCW_SHM_DATA);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_CONTROL,
+	    (BCW_SHM_CONTROL_SHARED << 16) + 0);
+	val = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_DATA);
 	DPRINTF(("Read test 1, "));
 	if (val != 0xaa5555aa) {
 		DPRINTF(("Failed test 1\n"));
@@ -1754,12 +1741,14 @@ bcw_validatechipaccess(struct bcw_softc *sc)
 		DPRINTF(("Passed test 1\n"));
 	
 	/* write 2nd test value */
-	BCW_WRITE32(regs, BCW_SHM_CONTROL, (BCW_SHM_CONTROL_SHARED << 16) + 0);
-	BCW_WRITE32(regs, BCW_SHM_DATA, 0x55aaaa55);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_CONTROL,
+	    (BCW_SHM_CONTROL_SHARED << 16) + 0);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_DATA, 0x55aaaa55);
 	DPRINTF(("Write test 2, "));
 	/* Read it back */
-	BCW_WRITE32(regs, BCW_SHM_CONTROL, (BCW_SHM_CONTROL_SHARED << 16) + 0);
-	val = BCW_READ32(regs, BCW_SHM_DATA);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_CONTROL,
+	    (BCW_SHM_CONTROL_SHARED << 16) + 0);
+	val = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_DATA);
 	DPRINTF(("Read test 2, "));
 	if (val != 0x55aaaa55) {
 		DPRINTF(("Failed test 2\n"));
@@ -1768,10 +1757,11 @@ bcw_validatechipaccess(struct bcw_softc *sc)
 		DPRINTF(("Passed test 2\n"));
 
 	/* Restore the saved value now that we're done */
-	BCW_WRITE32(regs, BCW_SHM_CONTROL, (BCW_SHM_CONTROL_SHARED << 16) + 0);
-	BCW_WRITE32(regs, BCW_SHM_DATA, save);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_CONTROL,
+	    (BCW_SHM_CONTROL_SHARED << 16) + 0);
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_SHM_DATA, save);
 	
-	if (sc->bcw_corerev >= 3) {
+	if (sc->sc_corerev >= 3) {
 		DPRINTF(("Doing corerev >= 3 tests\n"));
 		/* do some test writes and reads against the TSF */
 		/* 
@@ -1780,35 +1770,35 @@ bcw_validatechipaccess(struct bcw_softc *sc)
 		 * say that we're reading/writing silly places, so these regs
 		 * are not quite documented yet 
 		 */
-		BCW_WRITE16(regs, 0x18c, 0xaaaa);
-		BCW_WRITE32(regs, 0x18c, 0xccccbbbb);
-		val = BCW_READ16(regs, 0x604);
+		bus_space_write_2(sc->sc_iot, sc->sc_ioh, 0x18c, 0xaaaa);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, 0x18c, 0xccccbbbb);
+		val = bus_space_read_2(sc->sc_iot, sc->sc_ioh, 0x604);
 		if (val != 0xbbbb) return 3;
-		val = BCW_READ16(regs, 0x606);
+		val = bus_space_read_2(sc->sc_iot, sc->sc_ioh, 0x606);
 		if (val != 0xcccc) return 4;
 		/* re-clear the TSF since we just filled it with garbage */
-		BCW_WRITE32(regs, 0x18c, 0x0);
+		bus_space_write_4(sc->sc_iot, sc->sc_ioh, 0x18c, 0x0);
 	}	
 	
 	/* Check the Status Bit Field for some unknown bits */
-	val = BCW_READ32(regs, BCW_SBF);
+	val = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_SBF);
 	if ((val | 0x80000000) != 0x80000400 ) {
 		printf("%s: Warning, SBF is 0x%x, expected 0x80000400\n",
-		    sc->bcw_dev.dv_xname,val);
+		    sc->sc_dev.dv_xname, val);
 		/* May not be a critical failure, just warn for now */
 		//return (5);
 	}
 	/* Verify there are no interrupts active on the core */
-	val = BCW_READ32(regs, BCW_GIR);
-	if (val!=0) {
-		DPRINTF(("Failed Pending Interrupt test with val=0x%x\n",val));
+	val = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_GIR);
+	if (val != 0) {
+		DPRINTF(("Failed Pending Interrupt test with val=0x%x\n", val));
 		return (6);
 	}
 
 	/* Above G means it's unsupported currently, like N */
-	if (sc->bcw_phy_type > BCW_PHY_TYPEG) {
+	if (sc->sc_phy_type > BCW_PHY_TYPEG) {
 		DPRINTF(("PHY type %d greater than supported type %d\n",
-		    sc->bcw_phy_type, BCW_PHY_TYPEG));
+		    sc->sc_phy_type, BCW_PHY_TYPEG));
 		return (7);
 	}
 	
@@ -1816,55 +1806,367 @@ bcw_validatechipaccess(struct bcw_softc *sc)
 }
 
 
-/*
- * Abstracted reads and writes - from rtw
- */
-u_int8_t
-bcw_read8(void *arg, u_int32_t off)
+
+int
+bcw_detach(void *arg)
 {
-	struct bcw_regs *regs = (struct bcw_regs *)arg;
-	return (bus_space_read_1(regs->r_bt, regs->r_bh, off));
+	struct bcw_softc *sc = arg;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+
+	timeout_del(&sc->sc_scan_to);
+
+	bcw_stop(ifp, 1);
+	ieee80211_ifdetach(ifp);
+	if_detach(ifp);
+	bcw_free_rx_ring(sc, &sc->sc_rxring);
+	bcw_free_tx_ring(sc, &sc->sc_txring);
+
+	return (0);
 }
 
-u_int16_t
-bcw_read16(void *arg, u_int32_t off)
+
+#if 0
+void
+bcw_free_ring(struct bcw_softc *sc, struct bcw_dma_slot *ring)
 {
-	struct bcw_regs *regs = (struct bcw_regs *)arg;
-	return (bus_space_read_2(regs->r_bt, regs->r_bh, off));
+	struct bcw_chain data *data;
+	struct bcw_dma_slot *bcwd;
+	int i;
+
+	if (sc->bcw_rx_chain != NULL) {
+		if (i = 0; i < BCW_NRXDESC; i++) {
+			bcwd = &sc->bcw_rx_ring[i];
+
+			if (sc->bcw_rx_chain[i] != NULL) {
+				bus_dmamap_sync(sc->sc_dmat,
+				    sc->bcw_ring_map,
+				    sizeof(struct bcw_dma_slot) * x,
+				    sizeof(struct bcw_dma_slot),
+				    BUS_DMASYNC_POSTREAD);
+				bus_dmamap_unload(sc->sc_dmat,
+				    sc->bcw_ring_map);
+				m_freem(sc->bcw_rx_chain[i]);
+			}
+
+			if (sc->bcw_ring_map != NULL)
+				bus_dmamap_destroy(sc->sc_dmat,
+				    sc->bcw_ring_map);
+		}
+	}
 }
+#endif
 
-u_int32_t
-bcw_read32(void *arg, u_int32_t off)
+int
+bcw_alloc_rx_ring(struct bcw_softc *sc, struct bcw_rx_ring *ring, int count)
 {
-	struct bcw_regs *regs = (struct bcw_regs *)arg;
-	return (bus_space_read_4(regs->r_bt, regs->r_bh, off));
+	struct bcw_desc *desc;
+	struct bcw_rx_data *data;
+	int i, nsegs, error;
+
+	ring->count = count;
+	ring->cur = ring->next = 0;
+
+	error = bus_dmamap_create(sc->sc_dmat,
+	    count * sizeof(struct bcw_desc), 1,
+	    count * sizeof(struct bcw_desc), 0,
+	    BUS_DMA_NOWAIT, &ring->map);
+	if (error != 0) {
+		printf("%s: could not create desc DMA map\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	error = bus_dmamem_alloc(sc->sc_dmat,
+	    count * sizeof(struct bcw_desc),
+	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
+	if (error != 0) {
+		printf("%s: could not allocate DMA memory\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
+	    count * sizeof(struct bcw_desc), (caddr_t *)&ring->desc,
+	    BUS_DMA_NOWAIT);
+	if (error != 0) {
+		printf("%s: could not map desc DMA memory\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
+	    count * sizeof(struct bcw_desc), NULL, BUS_DMA_NOWAIT);
+	if (error != 0) {
+		printf("%s: could not load desc DMA map\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	bzero(ring->desc, count * sizeof(struct bcw_desc));
+	ring->physaddr = ring->map->dm_segs->ds_addr;
+
+	ring->data = malloc(count * sizeof (struct bcw_rx_data), M_DEVBUF,
+	    M_NOWAIT);
+	if (ring->data == NULL) {
+		printf("%s: could not allocate soft data\n",
+		    sc->sc_dev.dv_xname);
+		error = ENOMEM;
+		goto fail;
+	}
+
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_RXADDR,
+	    ring->physaddr + 0x40000000);
+
+	/*
+	 * Pre-allocate Rx buffers and populate Rx ring.
+	 */
+	bzero(ring->data, count * sizeof (struct bcw_rx_data));
+	for (i = 0; i < count; i++) {
+		desc = &ring->desc[i];
+		data = &ring->data[i];
+
+		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
+		    0, BUS_DMA_NOWAIT, &data->map);
+		if (error != 0) {
+			printf("%s: could not create DMA map\n",
+			    sc->sc_dev.dv_xname);
+			goto fail;
+		}
+
+		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
+		if (data->m == NULL) {
+			printf("%s: could not allocate rx mbuf\n",
+			    sc->sc_dev.dv_xname);
+			error = ENOMEM;
+			goto fail;
+		}
+
+		MCLGET(data->m, M_DONTWAIT);
+		if (!(data->m->m_flags & M_EXT)) {
+			printf("%s: could not allocate rx mbuf cluster\n",
+			    sc->sc_dev.dv_xname);
+			error = ENOMEM;
+			goto fail;
+		}
+
+		error = bus_dmamap_load(sc->sc_dmat, data->map,
+		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
+		if (error != 0) {
+			printf("%s: could not load rx buf DMA map",
+			    sc->sc_dev.dv_xname);
+			goto fail;
+		}
+	
+		desc->addr = htole32(data->map->dm_segs->ds_addr);
+
+		if (i != (count - 1))
+			desc->ctrl = htole32(BCW_RXBUF_LEN);
+		else
+			desc->ctrl = htole32(BCW_RXBUF_LEN | CTRL_EOT);
+	}
+
+	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
+	    BUS_DMASYNC_PREWRITE);
+
+	return (0);
+
+fail:	bcw_free_rx_ring(sc, ring);
+	return (error);
 }
 
 void
-bcw_write8(void *arg, u_int32_t off, u_int8_t val)
+bcw_reset_rx_ring(struct bcw_softc *sc, struct bcw_rx_ring *ring)
 {
-	struct bcw_regs *regs = (struct bcw_regs *)arg;
-	bus_space_write_1(regs->r_bt, regs->r_bh, off, val);
+	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
+	    BUS_DMASYNC_PREWRITE);
+
+	ring->cur = ring->next = 0;
 }
 
 void
-bcw_write16(void *arg, u_int32_t off, u_int16_t val)
+bcw_free_rx_ring(struct bcw_softc *sc, struct bcw_rx_ring *ring)
 {
-	struct bcw_regs *regs = (struct bcw_regs *)arg;
-	bus_space_write_2(regs->r_bt, regs->r_bh, off, val);
+	struct bcw_rx_data *data;
+	int i;
+
+	if (ring->desc != NULL) {
+		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
+		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
+		bus_dmamap_unload(sc->sc_dmat, ring->map);
+		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
+		    ring->count * sizeof(struct bcw_desc));
+		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
+	}
+
+	if (ring->data != NULL) {
+		for (i = 0; i < ring->count; i++) {
+			data = &ring->data[i];
+
+			if (data->m != NULL) {
+				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
+				    data->map->dm_mapsize,
+				    BUS_DMASYNC_POSTREAD);
+				bus_dmamap_unload(sc->sc_dmat, data->map);
+				m_freem(data->m);
+			}
+
+			if (data->map != NULL)
+				bus_dmamap_destroy(sc->sc_dmat, data->map);
+		}
+		free(ring->data, M_DEVBUF);
+	}
+}
+
+int
+bcw_alloc_tx_ring(struct bcw_softc *sc, struct bcw_tx_ring *ring,
+    int count)
+{
+	int i, nsegs, error;
+
+	ring->count = count;
+	ring->queued = 0;
+	ring->cur = ring->next = ring->stat = 0;
+
+	error = bus_dmamap_create(sc->sc_dmat,
+	    count * sizeof(struct bcw_desc), 1,
+	    count * sizeof(struct bcw_desc), 0, BUS_DMA_NOWAIT, &ring->map);
+	if (error != 0) {
+		printf("%s: could not create desc DMA map\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	error = bus_dmamem_alloc(sc->sc_dmat,
+	    count * sizeof(struct bcw_desc),
+	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
+	if (error != 0) {
+		printf("%s: could not allocate DMA memory\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
+	    count * sizeof(struct bcw_desc), (caddr_t *)&ring->desc,
+	    BUS_DMA_NOWAIT);
+	if (error != 0) {
+		printf("%s: could not map desc DMA memory\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
+	    count * sizeof(struct bcw_desc), NULL, BUS_DMA_NOWAIT);
+	if (error != 0) {
+		printf("%s: could not load desc DMA map\n",
+		    sc->sc_dev.dv_xname);
+		goto fail;
+	}
+
+	memset(ring->desc, 0, count * sizeof(struct bcw_desc));
+	ring->physaddr = ring->map->dm_segs->ds_addr;
+
+	/* MAGIC */
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_DMA_TXADDR,
+	    ring->physaddr + 0x40000000);
+
+	ring->data = malloc(count * sizeof(struct bcw_tx_data), M_DEVBUF,
+	    M_NOWAIT);
+	if (ring->data == NULL) {
+		printf("%s: could not allocate soft data\n",
+		    sc->sc_dev.dv_xname);
+		error = ENOMEM;
+		goto fail;
+	}
+
+	memset(ring->data, 0, count * sizeof(struct bcw_tx_data));
+	for (i = 0; i < count; i++) {
+		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
+		    BCW_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
+		    &ring->data[i].map);
+		if (error != 0) {
+			printf("%s: could not create DMA map\n",
+			    sc->sc_dev.dv_xname);
+			goto fail;
+		}
+	}
+
+	return (0);
+
+fail:	bcw_free_tx_ring(sc, ring);
+	return (error);
 }
 
 void
-bcw_write32(void *arg, u_int32_t off, u_int32_t val)
+bcw_reset_tx_ring(struct bcw_softc *sc, struct bcw_tx_ring *ring)
 {
-	struct bcw_regs *regs = (struct bcw_regs *)arg;
-	bus_space_write_4(regs->r_bt, regs->r_bh, off, val);
+	struct bcw_desc *desc;
+	struct bcw_tx_data *data;
+	int i;
+
+	for (i = 0; i < ring->count; i++) {
+		desc = &ring->desc[i];
+		data = &ring->data[i];
+
+		if (data->m != NULL) {
+			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
+			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
+			bus_dmamap_unload(sc->sc_dmat, data->map);
+			m_freem(data->m);
+			data->m = NULL;
+		}
+
+		/*
+		 * The node has already been freed at that point so don't call
+		 * ieee80211_release_node() here.
+		 */
+		data->ni = NULL;
+	}
+
+	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
+	    BUS_DMASYNC_PREWRITE);
+
+	ring->queued = 0;
+	ring->cur = ring->next = ring->stat = 0;
 }
 
 void
-bcw_barrier(void *arg, u_int32_t reg0, u_int32_t reg1, int flags)
+bcw_free_tx_ring(struct bcw_softc *sc, struct bcw_tx_ring *ring)
 {
-	struct bcw_regs *regs = (struct bcw_regs *)arg;
-	bus_space_barrier(regs->r_bh, regs->r_bt, MIN(reg0, reg1),
-	    MAX(reg0, reg1) - MIN(reg0, reg1) + 4, flags);
+	struct bcw_tx_data *data;
+	int i;
+
+	if (ring->desc != NULL) {
+		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
+		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
+		bus_dmamap_unload(sc->sc_dmat, ring->map);
+		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
+		    ring->count * sizeof(struct bcw_desc));
+		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
+	}
+
+	if (ring->data != NULL) {
+		for (i = 0; i < ring->count; i++) {
+			data = &ring->data[i];
+
+			if (data->m != NULL) {
+				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
+				    data->map->dm_mapsize,
+				    BUS_DMASYNC_POSTWRITE);
+				bus_dmamap_unload(sc->sc_dmat, data->map);
+				m_freem(data->m);
+			}
+
+			/*
+			 * The node has already been freed at that point so
+			 * don't call ieee80211_release_node() here.
+			 */
+			data->ni = NULL;
+
+			if (data->map != NULL)
+				bus_dmamap_destroy(sc->sc_dmat, data->map);
+		}
+		free(ring->data, M_DEVBUF);
+	}
 }
+
diff --git a/sys/dev/ic/bcwreg.h b/sys/dev/ic/bcwreg.h
index ba385b91e01..ee3a266f0a0 100644
--- a/sys/dev/ic/bcwreg.h
+++ b/sys/dev/ic/bcwreg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bcwreg.h,v 1.2 2006/11/17 20:49:27 mglocker Exp $ */
+/*	$OpenBSD: bcwreg.h,v 1.3 2006/11/21 11:41:14 mglocker Exp $ */
 
 /*
  * Copyright (c) 2006 Jon Simola <jsimola@gmail.com>
@@ -116,11 +116,11 @@
 #define XC_LE				0x4	/* loopback enable */
 #define BCW_DMA_TXADDR			0x0204	/* tx ring base address */
 #define BCW_DMA_DPTR			0x0208	/* last tx descriptor */
-#define BCW_DMA_TXSTATUS		0x020C	/* active desc, etc */
+//#define BCW_DMA_TXSTATUS		0x020C	/* active desc, etc */
 #define BCW_DMA_RXCTL			0x0210	/* enable, etc */
 #define BCW_DMA_RXADDR			0x0214	/* rx ring base address */
 #define BCW_DMA_RXDPTR			0x0218	/* last descriptor */
-#define BCW_DMA_RXSTATUS		0x021C	/* active desc, etc */
+//#define BCW_DMA_RXSTATUS		0x021C	/* active desc, etc */
 /* receive status bits */
 #define RS_CD_MASK			0x0fff	/* current descriptor pointer */
 #define RS_DMA_IDLE			0x2000	/* DMA is idle */
@@ -209,9 +209,58 @@
 #define BCW_SHM_MICROCODEFLAGSLOW	0x005e	/* Flags for Microcode ops */
 #define BCW_SHM_MICROCODEFLAGSHIGH	0x0060	/* Flags for Microcode ops */
 /* http://bcm-specs.sipsolutions.net/MicrocodeFlagsBitfield */
-#define BCW_SHM_MICROCODEFLAGS
 
-/* 0x200 DMA Register space */
+/* 0x200 DMA Register space, there are 6 controllers */
+/* 32 bit DMA controllers */
+#define BCW_DMA_TXCONTROL(x)		(0x200 + (x * 0x20))
+						/* DMA Control Word*/
+#define BCW_DMA_TXRINGADDR(x)		(0x204 + (x * 0x20))
+						/* Ring Address */
+#define BCW_DMA_TXSTOPADDR(x)		(0x208 + (x * 0x20))
+						/* Last Descriptor */
+#define BCW_DMA_TXSTATUS(x)		(0x20c + (x * 0x20))
+						/* Transmit Status Word */
+#define BCW_DMA_RXCONTROL(x)		(0x200 + (x * 0x20))
+						/* DMA Control Word*/
+#define BCW_DMA_RXRINGADDR(x)		(0x204 + (x * 0x20))
+						/* Ring Address */
+#define BCW_DMA_RXSTOPADDR(x)		(0x208 + (x * 0x20))
+						/* Last descriptor */
+#define BCW_DMA_RXSTATUS(x)		(0x20c + (x * 0x20))
+						/* Receive Status Word */
+/* 64 bit DMA controllers */
+#define BCW_DMA64_TXCONTROL(x)		(0x200 + (x * 0x40))
+						/* DMA control Word */
+#define BCW_DMA64_TXSTOPADDR(x)		(0x204 + (x * 0x40))
+						/* Last Descriptor */
+#define BCW_DMA64_TXRINGADDRLOW(x)	(0x208 + (x * 0x40))
+						/* Low 32 bits Ring Address */
+#define BCW_DMA64_TXRINGADDRHIGH(x)	(0x20c + (x * 0x40))
+						/* High 32 bits Ring Address */
+#define BCW_DMA64_TXSTATUS(x)		(0x210 + (x * 0x40))
+						/* Transmit Status State */
+#define BCW_DMA64_TXERROR(x)		(0x214 + (x * 0x40))
+						/* Transmit Status Error */
+#define BCW_DMA64_RXCONTROL(x)		(0x220 + (x * 0x40))
+						/* DMA control Word */
+#define BCW_DMA64_RXSTOPADDR(x)		(0x224 + (x * 0x40))
+						/* Last Descriptor */
+#define BCW_DMA64_RXRINGADDRLOW(x)	(0x228 + (x * 0x40))
+						/* Low 32 bits Ring Address */
+#define BCW_DMA64_RXRINGADDRHIGH(x)	(0x22c + (x * 0x40))
+						/* High 32 bits Ring Address */
+#define BCW_DMA64_RXSTATUS(x)		(0x230 + (x * 0x40))
+						/* Transmit Status State */
+#define BCW_DMA64_RXERROR(x)		(0x234 + (x * 0x40))
+						/* Transmit Status Error */
+
+#define BCW_DMA_CONTROL_ENABLE		0x1	/* Enable */
+#define BCW_DMA_CONTROL_SUSPEND		0x2	/* Suspend Request */
+#define BCW_DMA_CONTROL_LOOPBACK	0x4	/* Loopback Enable */
+#define BCW_DMA_CONTROL_FLUSH		0x10	/* Flush Request */
+#define BCW_DMA_CONTROL_ADDREXT		0x30000	/* Address Extension */
+
+
 /* 0x300 PIO Register space */
 
 #define BCW_RADIO_CONTROL		0x3f6	/* Control - 16bit */
@@ -225,19 +274,36 @@
 
 /* SPROM registers are 16 bit and based at MMIO offset 0x1000 */
 #define BCW_MMIO_BASE			0x1000
-
-#define	BCW_SPROM_IL0MACADDR		0x1048	/* 802.11b/g MAC */
+#define BCW_SPROM_IL0MACADDR		0x1048	/* 802.11b/g MAC */
 #define BCW_SPROM_ET0MACADDR		0x104e	/* ethernet MAC */
 #define BCW_SPROM_ET1MACADDR		0x1054	/* 802.11a MAC */
 
 #define BCW_SPROM_PA0B0			0x105e
 #define BCW_SPROM_PA0B1			0x1060
 #define BCW_SPROM_PA0B2			0x1062
-#define BCW_SPROM_PAMAXPOWER		0x1066 /* 7-0 for A, 15-8 for B/G */
+#define BCW_SPROM_PAMAXPOWER		0x1066	/* 7-0 for A, 15-8 for B/G */
 #define BCW_SPROM_PA1B0			0x106a
 #define BCW_SPROM_PA1B1			0x106c
 #define BCW_SPROM_PA1B2			0x106e
 #define BCW_SPROM_IDLETSSI		0x1070  /* As below */
+#define BCW_SPROM_BOARDFLAGS		0x1072	/* lower 16 bits */
+#define  BCW_BF_BTCOEXIST		0x0001	/* Bluetooth Co-existance */
+#define  BCW_BF_PACTRL			0x0002	/* GPIO 9 controls PA */
+#define  BCW_BF_AIRLINEMODE		0x0004	/* GPIO13 -> radio off LED */
+#define  BCW_BF_RSSI			0x0008	/* "something RSSI related */
+#define  BCW_BF_ENETSPI			0x0010	/* EPHY Roboswitch SPI */
+#define  BCW_BF_XTAL			0x0020	/* XTAL doesn't slow clock */
+#define  BCW_BF_CCKHIPWR		0x0040	/* HiPower CCK xmission */
+#define  BCW_BF_ENETADM			0x0080	/* has ADMtek Switch */
+#define  BCW_BF_ENETVLAN		0x0100	/* VLAN capable - huh? */
+#define  BCW_BF_AFTERBURNER		0x0200	/* Afterburner capable */
+#define  BCW_BF_NOPCI			0x0400	/* Board leaves PCI floating */
+#define  BCW_BF_FEM			0x0800	/* Front End Module support */
+#define  BCW_BF_EXTLNA			0x1000	/* has external LNA */
+#define  BCW_BF_HGPA			0x2000	/* has High Gain PA */
+#define  BCW_BF_BTCMOD			0x4000	/* BTCOEXIST in alt GPIOs */
+#define  BCW_BF_ALTIQ			0x8000	/* Alternate I/Q settings */
+
 #define BCW_SPROM_ANTGAIN		0x1074	/* bits 7-0 for an A PHY
 						   bits 15-8 for B/G PHYs */
 
@@ -246,26 +312,3 @@
 #define BCW_PHY_TYPEG			0x2	/* 802.11g PHY */
 #define BCW_PHY_TYPEN			0x4	/* 802.11n PHY */
 
-#define BCW_READ8(regs, ofs)						\
-	((*(regs)->r_read8)(regs, ofs))
-
-#define BCW_READ16(regs, ofs)						\
-	((*(regs)->r_read16)(regs, ofs))
-
-#define BCW_READ32(regs, ofs)						\
-	((*(regs)->r_read32)(regs, ofs))
-
-#define BCW_WRITE8(regs, ofs, val)					\
-	((*(regs)->r_write8)(regs, ofs, val))
-
-#define BCW_WRITE16(regs, ofs, val)					\
-	((*(regs)->r_write16)(regs, ofs, val))
-
-#define BCW_WRITE32(regs, ofs, val)					\
-	((*(regs)->r_write32)(regs, ofs, val))
-
-#define	BCW_ISSET(regs, reg, mask)					\
-	(BCW_READ32((regs), (reg)) & (mask))
-
-#define	BCW_CLR(regs, reg, mask)					\
-	BCW_WRITE32((regs), (reg), BCW_READ32((regs), (reg)) & ~(mask))
diff --git a/sys/dev/ic/bcwvar.h b/sys/dev/ic/bcwvar.h
index bd497ab93ad..9ae42d64b89 100644
--- a/sys/dev/ic/bcwvar.h
+++ b/sys/dev/ic/bcwvar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bcwvar.h,v 1.2 2006/11/17 20:49:27 mglocker Exp $ */
+/*	$OpenBSD: bcwvar.h,v 1.3 2006/11/21 11:41:14 mglocker Exp $ */
 
 /*
  * Copyright (c) 2006 Jon Simola <jsimola@gmail.com>
@@ -50,9 +50,65 @@ struct bcw_core {
 };
 
 /* number of descriptors used in a ring */
-#define BCW_NRXDESC             128
-#define BCW_NTXDESC             128
+#define BCW_RX_RING_COUNT	128
+#define BCW_TX_RING_COUNT	128
+#define BCW_MAX_SCATTER		8	/* XXX unknown, wild guess */
 
+struct bcw_rx_data {
+	bus_dmamap_t		map;
+	struct mbuf		*m;
+};
+
+struct bcw_tx_data {
+	bus_dmamap_t		map;
+	struct mbuf		*m;
+	uint32_t		softstat;
+	struct ieee80211_node	*ni;
+};
+
+struct bcw_rx_ring {
+	bus_dmamap_t		map;
+	bus_dma_segment_t	seg;
+	bus_addr_t		physaddr;
+	struct bcw_desc		*desc;
+	struct bcw_rx_data	*data;
+	int			count;
+	int			cur;
+	int			next;
+};
+
+struct bcw_tx_ring {
+	bus_dmamap_t		map;
+	bus_dma_segment_t	seg;
+	bus_addr_t		physaddr;
+	struct bcw_desc		*desc;
+	struct bcw_tx_data	*data;
+	int			count;
+	int			queued;
+	int			cur;
+	int			next;
+	int			stat;
+};
+
+struct bcw_desc {
+	u_int32_t ctrl;
+	u_int32_t addr;
+};
+
+/* ring descriptor */
+struct bcw_dma_slot {
+	u_int32_t ctrl;
+	u_int32_t addr;
+};
+
+#define CTRL_BC_MASK	0x1fff		/* buffer byte count */
+#define CTRL_EOT	0x10000000	/* end of descriptor table */
+#define CTRL_IOC	0x20000000	/* interrupt on completion */
+#define CTRL_EOF	0x40000000	/* end of frame */
+#define CTRL_SOF	0x80000000	/* start of frame */
+                
+
+#if 0
 /*
  * Mbuf pointers. We need these to keep track of the virtual addresses   
  * of our mbuf chains since we can only convert from physical to virtual,
@@ -67,77 +123,72 @@ struct bcw_chain_data {
 	bus_dmamap_t    bcw_tx_map[BCW_NTXDESC];  
 	bus_dmamap_t    bcw_rx_map[BCW_NRXDESC];
 };
+#endif
 
-struct bcw_regs {
-	bus_space_tag_t		r_bt;
-	bus_space_handle_t	r_bh;
-//	enum bcw_access		r_access;
-	void			*r_priv;
-	
-	/* bus independent I/O callbacks */
-	u_int8_t		(*r_read8)(void *, u_int32_t);
-	u_int16_t		(*r_read16)(void *, u_int32_t);
-	u_int32_t		(*r_read32)(void *, u_int32_t);
-	void			(*r_write8)(void *, u_int32_t, u_int8_t);
-	void			(*r_write16)(void *, u_int32_t, u_int16_t);
-	void			(*r_write32)(void *, u_int32_t, u_int32_t);
-	void			(*r_barrier)(void *, u_int32_t, u_int32_t, int);
-};
+struct bcw_rx_ring;
+struct bcw_tx_ring;
 
 /* Needs to have garbage removed */
 struct bcw_softc {
-	struct device		bcw_dev;
-	struct ieee80211com	bcw_ic;
-	struct bcw_regs		bcw_regs;
+	struct device		sc_dev;
+	struct ieee80211com	sc_ic;
+	struct bcw_rx_ring	sc_rxring;
+	struct bcw_tx_ring	sc_txring;
+
 	int			(*sc_newstate)(struct ieee80211com *,
 				    enum ieee80211_state, int);
 	int			(*sc_enable)(struct bcw_softc *);
 	void			(*sc_disable)(struct bcw_softc *);
-	bus_space_tag_t		bcw_btag;
-	bus_space_handle_t	bcw_bhandle;
-	bus_dma_tag_t		bcw_dmatag;
-	struct arpcom		bcw_ac;		/* interface info */
+	struct timeout		sc_scan_to;
+
+	bus_dma_tag_t		sc_dmat;
+	bus_space_tag_t		sc_iot;
+	bus_space_handle_t	sc_ioh;
+
 	void			*bcw_intrhand;
 	const char		*bcw_intrstr;	/* interrupt description */
-	struct pci_attach_args	bcw_pa;
-	u_int32_t		bcw_phy;	/* eeprom indicated phy */
+	struct pci_attach_args	sc_pa;
+	u_int32_t		sc_phy;	/* eeprom indicated phy */
 	struct bcw_dma_slot	*bcw_rx_ring;	/* receive ring */
 	struct bcw_dma_slot	*bcw_tx_ring;	/* transmit ring */
-	struct bcw_chain_data	bcw_cdata;	/* mbufs */
-	bus_dmamap_t		bcw_ring_map;
-	u_int32_t		bcw_intmask;	/* current intr mask */
-	u_int32_t		bcw_rxin;	/* last rx descriptor seen */
-	u_int32_t		bcw_txin;	/* last tx descriptor seen */
-	int			bcw_txsfree;	/* no. tx slots available */
-	int			bcw_txsnext;	/* next available tx slot */
-	struct timeout		bcw_timeout;
+//	struct bcw_chain_data	sc_cdata;	/* mbufs */
+	bus_dmamap_t		sc_ring_map;
+	u_int32_t		sc_intmask;	/* current intr mask */
+	u_int32_t		sc_rxin;	/* last rx descriptor seen */
+	u_int32_t		sc_txin;	/* last tx descriptor seen */
+	int			sc_txsfree;	/* no. tx slots available */
+	int			sc_txsnext;	/* next available tx slot */
+	struct timeout		sc_timeout;
 	/* Break these out into seperate structs */
-	u_int16_t		bcw_chipid;	/* Chip ID */
-	u_int16_t		bcw_chiprev;	/* Chip Revision */
-	u_int16_t		bcw_prodid;	/* Product ID */
+	u_int16_t		sc_chipid;	/* Chip ID */
+	u_int16_t		sc_chiprev;	/* Chip Revision */
+	u_int16_t		sc_prodid;	/* Product ID */
 //	struct bcw_core		core[BCW_MAX_CORES];
 //	struct bcw_radio	radio[BCW_MAX_RADIOS];
-	u_int16_t		bcw_phy_version;
-	u_int16_t		bcw_phy_type;
-	u_int16_t		bcw_phy_rev;
-	u_int16_t		bcw_corerev;
-	u_int32_t		bcw_radioid;
-	u_int16_t		bcw_radiorev;
-	u_int16_t		bcw_radiotype;
-	u_int32_t		bcw_phyinfo;
-	u_int16_t		bcw_numcores;
-	u_int16_t		bcw_havecommon;
-	u_int8_t		bcw_radio_gain;
-	u_int16_t		bcw_radio_pa0b0;
-	u_int16_t		bcw_radio_pa0b1;
-	u_int16_t		bcw_radio_pa0b2;
-	u_int16_t		bcw_radio_pa1b0;
-	u_int16_t		bcw_radio_pa1b1;
-	u_int16_t		bcw_radio_pa1b2;
-	u_int8_t		bcw_idletssi;
+	u_int16_t		sc_phy_version;
+	u_int16_t		sc_phy_type;
+	u_int16_t		sc_phy_rev;
+	u_int16_t		sc_corerev;
+	u_int32_t		sc_radioid;
+	u_int16_t		sc_radiorev;
+	u_int16_t		sc_radiotype;
+	u_int32_t		sc_phyinfo;
+	u_int16_t		sc_numcores;
+	u_int16_t		sc_havecommon;
+	u_int8_t		sc_radio_gain;
+	u_int16_t		sc_radio_pa0b0;
+	u_int16_t		sc_radio_pa0b1;
+	u_int16_t		sc_radio_pa0b2;
+	u_int16_t		sc_radio_pa1b0;
+	u_int16_t		sc_radio_pa1b1;
+	u_int16_t		sc_radio_pa1b2;
+	u_int8_t		sc_idletssi;
+	u_int8_t		sc_spromrev;
+	u_int16_t		sc_boardflags;
 };
 
 void	bcw_attach(struct bcw_softc *);
+int	bcw_detach(void *arg);
 int	bcw_intr(void *);
 
 #define BCW_DEBUG
@@ -158,18 +209,6 @@ int	bcw_intr(void *);
 /* transmit buffer max frags allowed */
 #define BCW_NTXFRAGS	16
 
-/* ring descriptor */
-struct bcw_dma_slot {
-	u_int32_t ctrl;
-	u_int32_t addr;
-};
-
-#define CTRL_BC_MASK	0x1fff		/* buffer byte count */
-#define CTRL_EOT	0x10000000	/* end of descriptor table */
-#define CTRL_IOC	0x20000000	/* interrupt on completion */
-#define CTRL_EOF	0x40000000	/* end of frame */
-#define CTRL_SOF	0x80000000	/* start of frame */
-                
 /* Packet status is returned in a pre-packet header */
 struct rx_pph {
 	u_int16_t len;
diff --git a/sys/dev/pci/if_bcw_pci.c b/sys/dev/pci/if_bcw_pci.c
index 18843d93397..7028d6b8d19 100644
--- a/sys/dev/pci/if_bcw_pci.c
+++ b/sys/dev/pci/if_bcw_pci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_bcw_pci.c,v 1.1 2006/11/17 18:58:30 mglocker Exp $ */
+/*	$OpenBSD: if_bcw_pci.c,v 1.2 2006/11/21 11:41:14 mglocker Exp $ */
 
 /*
  * Copyright (c) 2006 Jon Simola <jsimola@gmail.com>
@@ -126,10 +126,10 @@ bcw_pci_enable(struct bcw_softc *sc)
 	
 	/* Establish PCI interrupt */
 	psc->psc_intrcookie = pci_intr_establish(psc->psc_pc, psc->psc_ih,
-	    IPL_NET, bcw_intr, sc, sc->bcw_dev.dv_xname);
+	    IPL_NET, bcw_intr, sc, sc->sc_dev.dv_xname);
 	if(psc->psc_intrcookie == NULL) {
 		printf("%s: unable to establish interrupt\n",
-		    sc->bcw_dev.dv_xname);
+		    sc->sc_dev.dv_xname);
 		return (1);
 	}
 	
@@ -153,7 +153,6 @@ bcw_pci_attach(parent, self, aux)
 {
 	struct bcw_pci_softc *psc = (void *) self;
 	struct bcw_softc *sc = &psc->psc_bcw;
-	struct bcw_regs *regs = &sc->bcw_regs;
 	struct pci_attach_args *pa = (struct pci_attach_args *)aux;
 	pci_chipset_tag_t pc = pa->pa_pc;
 //	const char     *intrstr = NULL;
@@ -185,12 +184,12 @@ bcw_pci_attach(parent, self, aux)
 			 * this state, so punt.
 			 */
 			printf("%s: unable to wake up from power state D3\n",
-			       sc->bcw_dev.dv_xname);
+			       sc->sc_dev.dv_xname);
 			return;
 		}
 		if (pmode != 0) {
 			printf("%s: waking up from power state D%d\n",
-			       sc->bcw_dev.dv_xname, pmode);
+			       sc->sc_dev.dv_xname, pmode);
 			pci_conf_write(pc, pa->pa_tag, pmreg + 4, 0);
 		}
 	}
@@ -204,35 +203,33 @@ bcw_pci_attach(parent, self, aux)
 	switch (memtype) {
 	case PCI_MAPREG_TYPE_MEM | PCI_MAPREG_MEM_TYPE_32BIT:
 	case PCI_MAPREG_TYPE_MEM | PCI_MAPREG_MEM_TYPE_64BIT:
-		if (pci_mapreg_map(pa, BCW_PCI_BAR0, memtype, 0, &sc->bcw_btag,
-		    &sc->bcw_bhandle, &memaddr, &memsize, 0) == 0)
+		if (pci_mapreg_map(pa, BCW_PCI_BAR0, memtype, 0, &sc->sc_iot,
+		    &sc->sc_ioh, &memaddr, &memsize, 0) == 0)
 			break;
 	default:
 		printf("%s: unable to find mem space\n",
-		    sc->bcw_dev.dv_xname);
+		    sc->sc_dev.dv_xname);
 		return;
 	}
-	regs->r_bt = sc->bcw_btag;
-	regs->r_bh = sc->bcw_bhandle;
 
-	sc->bcw_dmatag = pa->pa_dmat;
+	sc->sc_dmat = pa->pa_dmat;
 
 
 	/* Map the PCI interrupt */
 	if (pci_intr_map(pa, &psc->psc_ih)) {
 		printf("%s: couldn't map interrupt\n",
-		    sc->bcw_dev.dv_xname);
+		    sc->sc_dev.dv_xname);
 		return;
 	}
 
 	sc->bcw_intrstr = pci_intr_string(pc, psc->psc_ih);
 
 	psc->psc_intrcookie = pci_intr_establish(pc, psc->psc_ih, IPL_NET, 
-	    bcw_intr, sc, sc->bcw_dev.dv_xname);
+	    bcw_intr, sc, sc->sc_dev.dv_xname);
 
 	if (psc->psc_intrcookie == NULL) {
 		printf("%s: couldn't establish interrupt",
-		    sc->bcw_dev.dv_xname);
+		    sc->sc_dev.dv_xname);
 		if (sc->bcw_intrstr != NULL)
 			printf(" at %s", sc->bcw_intrstr);
 		printf("\n");
@@ -247,23 +244,23 @@ bcw_pci_attach(parent, self, aux)
 	/*
 	 * Get some PCI based info into the softc
 	 */
-	sc->bcw_chiprev=PCI_REVISION(pa->pa_class);
-	sc->bcw_prodid=PCI_PRODUCT(pa->pa_id);
+	sc->sc_chiprev=PCI_REVISION(pa->pa_class);
+	sc->sc_prodid=PCI_PRODUCT(pa->pa_id);
 
 	/*
 	 * Start the card up while we're in PCI land
 	 */
 
 	/* Turn the Crystal On */
-	sbval = bus_space_read_4(sc->bcw_btag, sc->bcw_bhandle, BCW_GPIOI);
+	sbval = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_GPIOI);
 	if ((sbval & BCW_XTALPOWERUP) != BCW_XTALPOWERUP) {
-	    sbval = bus_space_read_4(sc->bcw_btag, sc->bcw_bhandle, BCW_GPIOO);
+	    sbval = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_GPIOO);
 	    sbval |= (BCW_XTALPOWERUP & BCW_PLLPOWERDOWN);
-	    bus_space_write_4(sc->bcw_btag, sc->bcw_bhandle, BCW_GPIOO, sbval);
+	    bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_GPIOO, sbval);
 	    delay(1000);
-	    sbval = bus_space_read_4(sc->bcw_btag, sc->bcw_bhandle, BCW_GPIOO);
+	    sbval = bus_space_read_4(sc->sc_iot, sc->sc_ioh, BCW_GPIOO);
 	    sbval &= ~BCW_PLLPOWERDOWN;
-	    bus_space_write_4(sc->bcw_btag, sc->bcw_bhandle, BCW_GPIOO, sbval);
+	    bus_space_write_4(sc->sc_iot, sc->sc_ioh, BCW_GPIOO, sbval);
 	    delay(5000);
 	}
 	
@@ -271,9 +268,9 @@ bcw_pci_attach(parent, self, aux)
 	 * Clear PCI_STATUS_TARGET_TARGET_ABORT, Docs and Linux call it 
 	 * PCI_STATUS_SIG_TARGET_ABORT - should use pci_conf_read/write?
 	 */
-	bus_space_write_4(sc->bcw_btag, sc->bcw_bhandle,
+	bus_space_write_4(sc->sc_iot, sc->sc_ioh,
 	    PCI_COMMAND_STATUS_REG,
-	    bus_space_read_4(sc->bcw_btag, sc->bcw_bhandle,
+	    bus_space_read_4(sc->sc_iot, sc->sc_ioh,
 	        PCI_COMMAND_STATUS_REG)
 	    & ~PCI_STATUS_TARGET_TARGET_ABORT);