- Fix some compiler warnings in subr_pe.c

- Add explicit cardbus attachment in if_ndis.c
- Clean up after moving bus_setup_intr() in ndis_attach().
- When setting an ssid, program an empty ssid as a 1-byte string
  with a single 0 byte. The Microsoft documentation says this is
  how you're supposed to tell the NIC to attach to 'any' ssid.
- Keep trace of callout handles for timers externally from the
  ndis_miniport_timer structs, and run through and clobber them
  all after invoking the haltfunc just in case the driver left one
  running. (We need to make sure all timers are cancelled on driver
  unload.)
- Handle the 'cancelled' argument in ndis_cancel_timer() correctly.

sys/compat/ndis/kern_ndis.c

@@ -753,12 +753,15 @@ ndis_halt_nic(arg)
 	ndis_handle		adapter;
 	__stdcall ndis_halt_handler	haltfunc;
 	struct ifnet		*ifp;
+	struct ndis_timer_entry	*ne;
+	struct callout_handle	*ch;
 
 	sc = arg;
 	ifp = &sc->arpcom.ac_if;
 	adapter = sc->ndis_block.nmb_miniportadapterctx;
 	if (adapter == NULL)
 		return(EIO);
+
 	haltfunc = sc->ndis_chars.nmc_halt_func;
 
 	if (haltfunc == NULL)
@@ -774,6 +777,17 @@ ndis_halt_nic(arg)
 
 	sc->ndis_block.nmb_miniportadapterctx = NULL;
 
+	/* Clobber all the timers in case the driver left one running. */
+
+	while (!TAILQ_EMPTY(&sc->ndis_block.nmb_timerlist)) {
+		ne = TAILQ_FIRST(&sc->ndis_block.nmb_timerlist);
+		TAILQ_REMOVE(&sc->ndis_block.nmb_timerlist, ne, link);
+		ch = &ne->nte_ch;
+		if (ch->callout != NULL)
+			untimeout(ch->callout->c_func, ch->callout->c_arg, *ch);
+		free(ne, M_DEVBUF);
+	}
+
 	return(0);
 }
 
@@ -821,6 +835,8 @@ ndis_init_nic(arg)
 	block = &sc->ndis_block;
 	initfunc = sc->ndis_chars.nmc_init_func;
 
+	TAILQ_INIT(&block->nmb_timerlist);
+
 	for (i = 0; i < NdisMediumMax; i++)
 		mediumarray[i] = i;
 

sys/compat/ndis/ndis_var.h

@@ -994,6 +994,14 @@ struct ndis_reference {
 
 typedef struct ndis_reference ndis_reference;
 
+struct ndis_timer_entry {
+	struct callout_handle	nte_ch;
+	ndis_miniport_timer	*nte_timer;
+	TAILQ_ENTRY(ndis_timer_entry)	link;
+};
+
+TAILQ_HEAD(nte_head, ndis_timer_entry);
+
 /*
  * The miniport block is basically the internal NDIS handle. We need
  * to define this because, unfortunately, it is not entirely opaque
@@ -1116,6 +1124,7 @@ struct ndis_miniport_block {
 	ndis_resource_list	*nmb_rlist;
 	ndis_status		nmb_getstat;
 	ndis_status		nmb_setstat;
+	struct nte_head		nmb_timerlist;
 };
 
 typedef ndis_status (*ndis_init_handler)(ndis_status *, uint32_t *,

sys/compat/ndis/subr_ndis.c

@@ -872,10 +872,17 @@ ndis_create_timer(timer, handle, func, ctx)
 	ndis_timer_function	func;
 	void			*ctx;
 {
-	struct callout_handle	*ch;
+	struct ndis_timer_entry	*ne = NULL;
+	ndis_miniport_block	*block;
+	block = (ndis_miniport_block *)handle;
 
-	ch = (struct callout_handle *)&timer->nmt_dpc;
-	callout_handle_init(ch);
+	ne = malloc(sizeof(struct ndis_timer_entry), M_DEVBUF, M_NOWAIT);
+	callout_handle_init(&ne->nte_ch);
+	TAILQ_INSERT_TAIL(&block->nmb_timerlist, ne, link);
+	ne->nte_timer = timer;
+
+	timer->nmt_ktimer.nk_header.dh_sigstate = TRUE;
+	timer->nmt_dpc.nk_deferredctx = &ne->nte_ch;
 	timer->nmt_timerfunc = func;
 	timer->nmt_timerctx = ctx;
 
@@ -896,6 +903,7 @@ ndis_timercall(arg)
 
 	timer = arg;
 
+	timer->nmt_ktimer.nk_header.dh_sigstate = FALSE;
 	timerfunc = timer->nmt_timerfunc;
 	timerfunc(NULL, timer->nmt_timerctx, NULL, NULL);
 
@@ -919,8 +927,9 @@ ndis_set_timer(timer, msecs)
 	tv.tv_sec = 0;
 	tv.tv_usec = msecs * 1000;
 
-	ch = (struct callout_handle *)&timer->nmt_dpc;
+	ch = timer->nmt_dpc.nk_deferredctx;
 	timer->nmt_dpc.nk_sysarg2 = ndis_timercall;
+	timer->nmt_ktimer.nk_header.dh_sigstate = TRUE;
 	*ch = timeout((timeout_t *)timer->nmt_dpc.nk_sysarg2, (void *)timer,
 	    tvtohz(&tv));
 
@@ -938,6 +947,7 @@ ndis_tick(arg)
 
 	timer = arg;
 
+	timer->nmt_ktimer.nk_header.dh_sigstate = FALSE;
 	timerfunc = timer->nmt_timerfunc;
 	timerfunc(NULL, timer->nmt_timerctx, NULL, NULL);
 
@@ -945,7 +955,8 @@ ndis_tick(arg)
 
 	tv.tv_sec = 0;
 	tv.tv_usec = timer->nmt_ktimer.nk_period * 1000;
-	ch = (struct callout_handle *)&timer->nmt_dpc;
+	ch = timer->nmt_dpc.nk_deferredctx;
+	timer->nmt_ktimer.nk_header.dh_sigstate = TRUE;
 	timer->nmt_dpc.nk_sysarg2 = ndis_tick;
 	*ch = timeout((timeout_t *)timer->nmt_dpc.nk_sysarg2, timer,
 	    tvtohz(&tv));
@@ -965,8 +976,9 @@ ndis_set_periodic_timer(timer, msecs)
 	tv.tv_usec = msecs * 1000;
 
 	timer->nmt_ktimer.nk_period = msecs;
-	ch = (struct callout_handle *)&timer->nmt_dpc;
+	ch = timer->nmt_dpc.nk_deferredctx;
 	timer->nmt_dpc.nk_sysarg2 = ndis_tick;
+	timer->nmt_ktimer.nk_header.dh_sigstate = TRUE;
 	*ch = timeout((timeout_t *)timer->nmt_dpc.nk_sysarg2, timer,
 	    tvtohz(&tv));
 
@@ -980,8 +992,9 @@ ndis_cancel_timer(timer, cancelled)
 {
 	struct callout_handle	*ch;
 
-	ch = (struct callout_handle *)&timer->nmt_dpc;
-	untimeout((timeout_t *)timer->nmt_dpc.nk_sysarg2, timer, *ch);
+	ch = timer->nmt_dpc.nk_deferredctx;
+	untimeout(ch->callout->c_func, ch->callout->c_arg, *ch);
+	*cancelled = timer->nmt_ktimer.nk_header.dh_sigstate;
 
 	return;
 }

sys/compat/ndis/subr_pe.c

@@ -79,7 +79,7 @@ pe_get_dos_header(imgbase, hdr)
 {
 	uint16_t		signature;
 
-	if (imgbase == NULL || hdr == NULL)
+	if (imgbase == 0 || hdr == NULL)
 		return (EINVAL);
 
 	signature = *(uint16_t *)imgbase;
@@ -102,7 +102,7 @@ pe_is_nt_image(imgbase)
 	uint32_t		signature;
 	image_dos_header	*dos_hdr;
 
-	if (imgbase == NULL)
+	if (imgbase == 0)
 		return (EINVAL);
 
 	signature = *(uint16_t *)imgbase;
@@ -130,7 +130,7 @@ pe_get_optional_header(imgbase, hdr)
 	image_dos_header	*dos_hdr;
 	image_nt_header		*nt_hdr;
 
-	if (imgbase == NULL || hdr == NULL)
+	if (imgbase == 0 || hdr == NULL)
 		return(EINVAL);
 
 	if (pe_is_nt_image(imgbase))
@@ -158,7 +158,7 @@ pe_get_file_header(imgbase, hdr)
 	image_dos_header	*dos_hdr;
 	image_nt_header		*nt_hdr;
 
-	if (imgbase == NULL || hdr == NULL)
+	if (imgbase == 0 || hdr == NULL)
 		return(EINVAL);
 
 	if (pe_is_nt_image(imgbase))
@@ -187,7 +187,7 @@ pe_get_section_header(imgbase, hdr)
 	image_nt_header		*nt_hdr;
 	image_section_header	*sect_hdr;
 
-	if (imgbase == NULL || hdr == NULL)
+	if (imgbase == 0 || hdr == NULL)
 		return(EINVAL);
 
 	if (pe_is_nt_image(imgbase))
@@ -327,7 +327,7 @@ pe_get_section(imgbase, hdr, name)
 
 	int			i, sections;
 
-	if (imgbase == NULL || hdr == NULL)
+	if (imgbase == 0 || hdr == NULL)
 		return(EINVAL);
 
 	if (pe_is_nt_image(imgbase))
@@ -433,7 +433,7 @@ pe_get_import_descriptor(imgbase, desc, module)
 	image_import_descriptor	*imp_desc;
 	char			*modname;
 
-	if (imgbase == NULL || module == NULL || desc == NULL)
+	if (imgbase == 0 || module == NULL || desc == NULL)
 		return(EINVAL);
 
 	offset = pe_directory_offset(imgbase, IMAGE_DIRECTORY_ENTRY_IMPORT);
@@ -509,7 +509,7 @@ pe_patch_imports(imgbase, module, functbl)
 	vm_offset_t		*nptr, *fptr;
 	vm_offset_t		func;
 
-	if (imgbase == NULL || module == NULL || functbl == NULL)
+	if (imgbase == 0 || module == NULL || functbl == NULL)
 		return(EINVAL);
 
 	if (pe_get_import_descriptor(imgbase, &imp_desc, module))

sys/dev/if_ndis/if_ndis.c

@@ -150,6 +150,7 @@ static driver_t ndis_driver = {
 static devclass_t ndis_devclass;
 
 DRIVER_MODULE(ndis, pci, ndis_driver, ndis_devclass, 0, 0);
+DRIVER_MODULE(ndis, cardbus, ndis_driver, ndis_devclass, 0, 0);
 
 /*
  * Program the 64-bit multicast hash filter.
@@ -292,12 +293,12 @@ ndis_attach(dev)
 	 * Hook interrupt early, since calling the driver's
 	 * init routine may trigger an interrupt.
 	 */
+
 	error = bus_setup_intr(dev, sc->ndis_irq, INTR_TYPE_NET,
 	    ndis_intr, sc, &sc->ndis_intrhand);
 
 	if (error) {
-		printf("ndis%d: couldn't register interrupt\n", unit);
-		error = ENXIO;
+		printf("ndis%d: couldn't set up irq\n", unit);
 		goto fail;
 	}
 
@@ -561,12 +562,6 @@ ndis_attach(dev)
 	/* Override the status handler so we can detect link changes. */
 	sc->ndis_block.nmb_status_func = ndis_linksts;
 
-	if (error) {
-		printf("ndis%d: couldn't set up irq\n", unit);
-		ether_ifdetach(ifp);
-		goto fail;
-	}
-
 fail:
 	if (error)
 		ndis_detach(dev);
@@ -605,7 +600,6 @@ ndis_detach(dev)
 	} else
 		NDIS_UNLOCK(sc);
 
-
 	bus_generic_detach(dev);
 
 	if (sc->ndis_intrhand)
@@ -1139,7 +1133,10 @@ ndis_setstate_80211(sc)
 	len = sizeof(ssid);
 	bzero((char *)&ssid, len);
 	ssid.ns_ssidlen = ic->ic_des_esslen;
-	bcopy(ic->ic_des_essid, ssid.ns_ssid, ssid.ns_ssidlen);
+	if (ssid.ns_ssidlen == 0) {
+		ssid.ns_ssidlen = 1;
+	} else
+		bcopy(ic->ic_des_essid, ssid.ns_ssid, ssid.ns_ssidlen);
 	rval = ndis_set_info(sc, OID_802_11_SSID, &ssid, &len);
 
 	if (rval)