Snap shot check in.

The code doesn't compile (I'll do that in a minute), but functionally
it gets to receveing the interrupt from the start or join net command.

There is a lot of code to deal with the limitations of the PCCard memory
mapping code - I'm changing some of it hence the check in to preserve something
that worked.

2 files changed, 1304 insertions, 180 deletions

diff --git a/sys/dev/ray/if_ray.c b/sys/dev/ray/if_ray.c
index 5844652..08d1c98 100644
--- a/sys/dev/ray/if_ray.c
+++ b/sys/dev/ray/if_ray.c
@@ -34,29 +34,38 @@
 
 #define XXX 0
 
+/*
+ * XXX build options - move to LINT
+ */
+#define RAY_NEED_STARTJOIN_TIMEO	/* Might be needed with build 4 */
+#define RAY_DEBUG		100	/* Big numbers get more verbose */
+#define RAY_CCS_TIMEOUT		(hz/2)	/* Timeout for CCS commands - only used for downloading startup parameters */
+/*
+ * XXX build options - move to LINT
+ */
+
+/*
+ * Debugging odds and odds
+ */
 #ifndef RAY_DEBUG
-#define RAY_DEBUG 100
+#define RAY_DEBUG 0
 #endif /* RAY_DEBUG */
-#define HEXDUMP_8(p, l) do {					\
+
+#if RAY_DEBUG > 0
+#define RAY_DHEX8(p, l) do { if (RAY_DEBUG > 10) {		\
     u_int8_t *i;						\
-    int j;							\
-    for (i = p; i < (u_int8_t *)(p+l); i += 8) {		\
-	printf("  0x%08lx %02x", (unsigned long)i, *i);		\
-	for (j = 1; j < 8; j++)					\
-	    printf(" %02x", *(i+j));				\
-	printf("\n");						\
-    }								\
-} while (0)
-#define HEXDUMP_16(p, l) do {					\
-    u_int16_t *i;						\
-    int j;							\
-    for (i = p; i < (u_int16_t *)(p+l); i += 8) {		\
-	printf("  0x%08lx %02x", (unsigned long)i, *i);		\
-	for (j = 1; j < 8; j++)					\
-	    printf(" %02x", *(i+j));				\
-	printf("\n");						\
-    }								\
-} while (0)
+    for (i = p; i < (u_int8_t *)(p+l); i += 8)			\
+    	printf("  0x%08lx %8D\n",				\
+		(unsigned long)i, (unsigned char *)i, " ");	\
+} } while (0)
+#define RAY_DPRINTF(x)	do { if (RAY_DEBUG) {			\
+    printf x ;							\
+    } } while (0)
+#else
+#define RAY_HEX8(p, l)
+#define RAY_HEX16(p, l)
+#define RAY_DPRINTF(x)
+#endif /* RAY_DEBUG */
 
 #include "ray.h"
 #include "card.h"
@@ -77,12 +86,16 @@
 #include <sys/sockio.h>
 #include <sys/systm.h>
 #include <sys/uio.h>
+#include <sys/proc.h>
+#include <sys/ucred.h>
 
 #include <net/if.h>
 #include <net/if_arp.h>
 #include <net/ethernet.h>
 #include <net/if_dl.h>
 #include <net/if_media.h>
+#include <net/if_mib.h>
+#include <i386/isa/if_ieee80211.h>
 
 #if NBPFILTER > 0
 #include <net/bpf.h>
@@ -96,6 +109,7 @@
 #include <i386/isa/isa.h>
 #include <i386/isa/isa_device.h>
 #include <i386/isa/if_rayreg.h>
+#include <i386/isa/if_raymib.h>
 
 #if NCARD > 0
 #include <pccard/cardinfo.h>
@@ -113,24 +127,77 @@
  */
 struct ray_softc {
 
-    struct arpcom		arpcom;		/* Ethernet common */
-    struct ifmedia		ifmedia;	/* Ifnet common */
-
-    char			*card_type;	/* Card model name */
-    char			*vendor;	/* Card manufacturer */
-
-    int				unit;		/* Unit number */
-    u_char			gone;		/* 1 = Card bailed out */
-    int				slotnum;	/* Slot number XXX only for attr read/write */
-    int				irq;		/* Assigned IRQ */
-    caddr_t			maddr;		/* Shared RAM Address */
-    int				msize;		/* Shared RAM Size */
-
-    struct ray_ecf_startup_v5	sc_ecf_startup; /* Startup info from card */
+    struct arpcom	arpcom;		/* Ethernet common */
+    struct ifmedia	ifmedia;	/* Ifnet common */
+    struct callout_handle \
+    			timerh;		/* Handle for timer */
+#ifdef RAY_NEED_STARTJOIN_TIMEO
+    struct callout_handle \
+    			sj_timerh;	/* Handle for start_join timer */
+#endif /* RAY_NEED_STARTJOIN_TIMEO */
+
+    char		*card_type;	/* Card model name */
+    char		*vendor;	/* Card manufacturer */
+
+    int			unit;		/* Unit number */
+    u_char		gone;		/* 1 = Card bailed out */
+    int			irq;		/* Assigned IRQ */
+    caddr_t		maddr;		/* Shared RAM Address */
+    int			msize;		/* Shared RAM Size */
+
+    /* XXX these can go when attribute reading is fixed */
+    int			slotnum;	/* Slot number */
+    struct mem_desc	md;		/* Map info for common memory */
+
+    struct ray_ecf_startup_v5	\
+    			sc_ecf_startup; /* Startup info from card */
+
+    u_int8_t		sc_ccsinuse[64];/* ccs in use -- not for tx */
+    size_t		sc_ccs;		/* ccs used by non-scheduled,
+    					 * non-overlapping procedures */
+
+    u_int8_t		sc_bssid[ETHER_ADDR_LEN];	/* Current net values */
+    u_int8_t		sc_cnwid[IEEE80211_NWID_LEN];	/* Last nwid */
+    u_int8_t		sc_dnwid[IEEE80211_NWID_LEN];	/* Desired nwid */
+    u_int8_t		sc_omode;	/* Old operating mode SC_MODE_xx */
+    u_int8_t		sc_mode;	/* Current operating mode SC_MODE_xx */
+    u_int8_t		sc_countrycode;	/* Current country code */
+    u_int8_t		sc_dcountrycode;/* Desired country code */
+    int			sc_havenet;	/* true if we have aquired a network */
 };
 static struct ray_softc ray_softc[NRAY];
 
+#define	sc_station_addr	sc_ecf_startup.e_station_addr
 #define	sc_version	sc_ecf_startup.e_fw_build_string
+#define	sc_tibsize	sc_ecf_startup.e_tibsize
+
+/* Modes of operation */
+/*XXX must these be tied with defaults on the station type? or do they
+ * decribe the network mode and not the station type? */
+#define	SC_MODE_ADHOC	0	/* ad-hoc mode */
+#define	SC_MODE_INFRA	1	/* infrastructure mode */
+
+/* Commands -- priority given to LSB */
+#define	SCP_FIRST		0x0001
+#define	SCP_UPDATESUBCMD	0x0001
+#define	SCP_STARTASSOC		0x0002
+#define	SCP_REPORTPARAMS	0x0004
+#define	SCP_IFSTART		0x0008
+
+/* Update sub commands -- issues are serialized priority to LSB */
+#define	SCP_UPD_FIRST		0x0100
+#define	SCP_UPD_STARTUP		0x0100
+#define	SCP_UPD_STARTJOIN	0x0200
+#define	SCP_UPD_PROMISC		0x0400
+#define	SCP_UPD_MCAST		0x0800
+#define	SCP_UPD_UPDATEPARAMS	0x1000
+#define	SCP_UPD_SHIFT		8
+#define	SCP_UPD_MASK		0xff00
+
+/* These command (a subset of the update set) require timeout checking */
+#define	SCP_TIMOCHECK_CMD_MASK	\
+	(SCP_UPD_UPDATEPARAMS | SCP_UPD_STARTUP | SCP_UPD_MCAST | \
+	SCP_UPD_PROMISC)
 
 /*
  * PCMCIA driver definition
@@ -163,32 +230,97 @@ static void      ray_init		__P((void *xsc));
 static void      ray_stop		__P((struct ray_softc *sc));
 
 /*
- * Misc. internal utilites
+ * Internal utilites
+ */
+static int	ray_alloc_ccs		__P((struct ray_softc *sc, size_t *ccsp, u_int cmd, u_int track));
+static void	ray_ccs_done		__P((struct ray_softc *sc, size_t ccs));
+static void	ray_download_params	__P((struct ray_softc *sc));
+static void	ray_download_timo	__P((void *xsc));
+static u_int8_t	ray_free_ccs 		__P((struct ray_softc *sc, size_t ccs));
+static int	ray_issue_cmd		__P((struct ray_softc *sc, size_t ccs, u_int track));
+static void	ray_rcs_intr		__P((struct ray_softc *sc, size_t ccs));
+static void	ray_start_join_timo	__P((void *xsc));
+/*
+ * Indirections for reading/writing shared memory - from NetBSD/if_ray.c
+ */
+#ifndef offsetof
+#define offsetof(type, member) \
+    ((size_t)(&((type *)0)->member))
+#endif /* offsetof */
+
+#define	SRAM_READ_1(sc, off) \
+    (u_int8_t)*((sc)->maddr + (off))
+/* ((u_int8_t)bus_space_read_1((sc)->sc_memt, (sc)->sc_memh, (off))) */
+
+#define	SRAM_READ_FIELD_1(sc, off, s, f) \
+    SRAM_READ_1(sc, (off) + offsetof(struct s, f))
+
+#define	SRAM_READ_FIELD_2(sc, off, s, f)			\
+    ((((u_int16_t)SRAM_READ_1(sc, (off) + offsetof(struct s, f)) << 8) \
+    |(SRAM_READ_1(sc, (off) + 1 + offsetof(struct s, f)))))
+
+#define	SRAM_READ_FIELD_N(sc, off, s, f, p, n)	\
+    ray_read_region(sc, (off) + offsetof(struct s, f), (p), (n))
+
+#define ray_read_region(sc, off, vp, n) \
+    bcopy((sc)->maddr + (off), (vp), (n))
+
+#define	SRAM_WRITE_1(sc, off, val)	\
+    *((sc)->maddr + (off)) = (val)
+/* bus_space_write_1((sc)->sc_memt, (sc)->sc_memh, (off), (val)) */
+
+#define	SRAM_WRITE_FIELD_1(sc, off, s, f, v) 	\
+    SRAM_WRITE_1(sc, (off) + offsetof(struct s, f), (v))
+
+#define	SRAM_WRITE_FIELD_2(sc, off, s, f, v) do {	\
+    SRAM_WRITE_1(sc, (off) + offsetof(struct s, f), (((v) >> 8 ) & 0xff)); \
+    SRAM_WRITE_1(sc, (off) + 1 + offsetof(struct s, f), ((v) & 0xff)); \
+} while (0)
+
+#define	SRAM_WRITE_FIELD_N(sc, off, s, f, p, n)	\
+    ray_write_region(sc, (off) + offsetof(struct s, f), (p), (n))
+
+#define ray_write_region(sc, off, vp, n) \
+    bcopy((vp), (sc)->maddr + (off), (n))
+
+/*
+ * Macro's
  */
+#ifndef RAY_CCS_TIMEOUT
+#define RAY_CCS_TIMEOUT		(hz / 2)
+#endif
+#define	RAY_ECF_READY(sc) 	ray_ecf_ready((sc))
+#define	RAY_ECF_START_CMD(sc)	ray_attr_write((sc), RAY_ECFIR, RAY_ECFIR_IRQ)
+#define	RAY_HCS_CLEAR_INTR(sc)	ray_attr_write((sc), RAY_HCSIR, 0)
+#define RAY_HCS_INTR(sc)	ray_hcs_intr((sc))
 
 /*
+ * XXX
  * As described in if_xe.c...
  *
- * Horrid stuff for accessing CIS tuples
+ * Horrid stuff for accessing CIS tuples and remapping common memory...
+ * XXX
  */
 #define CARD_MAJOR		50
-static int	ray_attr_write		__P((struct ray_softc *sc, off_t offset, u_char byte));
-static int	ray_attr_read		__P((struct ray_softc *sc, off_t offset, u_char *buf, int size));
+static void	ray_attr_getmap	__P((struct ray_softc *sc));
+static void	ray_attr_cm	__P((struct ray_softc *sc));
+static int	ray_attr_write	__P((struct ray_softc *sc, off_t offset, u_int8_t byte));
+static int	ray_attr_read	__P((struct ray_softc *sc, off_t offset, u_int8_t *buf, int size));
+static int	ray_ecf_ready	__P((struct ray_softc *sc));
+#define	RAY_MAP_CM(sc)		ray_attr_cm(sc)
 
 /*
  * PCCard initialise.
  */
 static int
-ray_pccard_init(dev_p)
+ray_pccard_init (dev_p)
     struct pccard_devinfo   *dev_p;
 {
     struct ray_softc	*sc;
     u_int32_t		irq;
     int			j;
 
-#if RAY_DEBUG > 0
-    printf("ray%d: PCCard probe\n", dev_p->isahd.id_unit);
-#endif
+    RAY_DPRINTF(("ray%d: PCCard probe\n", dev_p->isahd.id_unit));
 
     if (dev_p->isahd.id_unit >= NRAY)
 	return(ENODEV);
@@ -212,6 +344,8 @@ ray_pccard_init(dev_p)
     printf("ray%d: <Raylink/IEEE 802.11> maddr 0x%lx msize 0x%x irq %d on isa (PC-Card slot %d)\n",
 	sc->unit, (unsigned long)sc->maddr, sc->msize, sc->irq, sc->slotnum);
 
+    ray_attr_getmap(sc); /* XXX remove when attribute/common mapping fixed */
+
     if (ray_attach(&dev_p->isahd))
 	return(ENXIO);
 
@@ -222,15 +356,13 @@ ray_pccard_init(dev_p)
  * PCCard unload.
  */
 static void
-ray_pccard_unload(dev_p)
+ray_pccard_unload (dev_p)
     struct pccard_devinfo	*dev_p;
 {
     struct ray_softc		*sc;
     struct ifnet		*ifp;
 
-#if RAY_DEBUG > 0
-    printf("ray%d: PCCard unload\n", dev_p->isahd.id_unit);
-#endif
+    RAY_DPRINTF(("ray%d: PCCard unload\n", dev_p->isahd.id_unit));
 
     sc = &ray_softc[dev_p->isahd.id_unit];
 
@@ -239,16 +371,12 @@ ray_pccard_unload(dev_p)
 	return;
     }
 
-    /*
-     * Cleardown interface
-     */
+    /* Cleardown interface */
     ifp = &sc->arpcom.ac_if;
     ifp->if_flags &= ~(IFF_RUNNING|IFF_OACTIVE);
-    if_down(ifp);
+    if_down(ifp); /* XXX probably should be if_detach but I don't know if it works in 3.1 */
 
-    /*
-     * Mark card as gone
-     */
+    /* Mark card as gone */
     sc->gone = 1;
     printf("ray%d: unloaded\n", sc->unit);
 
@@ -260,36 +388,70 @@ ray_pccard_unload(dev_p)
  */
 /* XXX return 1 if we take interrupt, 0 otherwise */
 static int
-ray_pccard_intr(dev_p)
+ray_pccard_intr (dev_p)
     struct pccard_devinfo	*dev_p;
 {
     struct ray_softc		*sc;
+    int				ccsi, handled;
 
-#if RAY_DEBUG > 0
-    printf("ray%d: PCCard intr\n", dev_p->isahd.id_unit);
-#endif
+    RAY_DPRINTF(("ray%d: PCCard intr\n", dev_p->isahd.id_unit));
 
     sc = &ray_softc[dev_p->isahd.id_unit];
+    RAY_MAP_CM(sc);
 
     if (sc->gone) {
 	printf("ray%d: unloaded before interrupt!\n", sc->unit);
 	return(0);
     }
 
-    return(1);
+    /*
+     * Check that the interrupt was for us, if so get the rcs/ccs and vector
+     * on the command contained within it.
+     */
+    if (!RAY_HCS_INTR(sc)) {
+
+	handled = 0;
+
+    } else {
+
+	handled = 1;
+	ccsi = SRAM_READ_1(sc, RAY_SCB_RCSI);
+	if (ccsi <= RAY_CCS_LAST)
+	    ray_ccs_done(sc, RAY_CCS_ADDRESS(ccsi));
+	else if (ccsi <= RAY_RCS_LAST)
+	    ray_rcs_intr(sc, RAY_CCS_ADDRESS(ccsi));
+	else
+	    printf("ray%d: ray_intr bad ccs index %d\n", sc->unit, ccsi);
+
+#if XXX
+	ccs_done and rcs_intr return function pointers - why dont
+	they just do it themselves? its not as if each command only
+	requires a single function call - things like start_join_net
+	call a couple on the way...
+	if (rcmd)
+	    (*rcmd)(sc);
+#endif
+
+    }
+
+    if (handled)
+	RAY_HCS_CLEAR_INTR(sc);
+
+    RAY_DPRINTF(("ray%d: interrupt %s handled\n",
+    		sc->unit, handled?"was":"not"));
+
+    return(handled);
 }
 
 /*
  * ISA probe routine.
  */
 static int
-ray_probe(dev_p)
+ray_probe (dev_p)
     struct isa_device		*dev_p;
 {
 
-#if RAY_DEBUG > 0
-    printf("ray%d: ISA probe\n", dev_p->id_unit);
-#endif
+    RAY_DPRINTF(("ray%d: ISA probe\n", dev_p->id_unit));
 
     return(0);
 }
@@ -298,18 +460,18 @@ ray_probe(dev_p)
  * ISA/PCCard attach.
  */
 static int
-ray_attach(dev_p)
+ray_attach (dev_p)
     struct isa_device		*dev_p;
 {
     struct ray_softc		*sc;
     struct ray_ecf_startup_v5	*ep;
     struct ifnet		*ifp;
+    char			ifname[IFNAMSIZ];
 
-#if RAY_DEBUG > 0
-    printf("ray%d: ISA/PCCard attach\n", dev_p->id_unit);
-#endif
+    RAY_DPRINTF(("ray%d: ISA/PCCard attach\n", dev_p->id_unit));
 
     sc = &ray_softc[dev_p->id_unit];
+    RAY_MAP_CM(sc);
 
     if (sc->gone) {
 	printf("ray%d: unloaded before attach!\n", sc->unit);
@@ -321,116 +483,122 @@ ray_attach(dev_p)
      * version we are using.
      */
     ep = &sc->sc_ecf_startup;
-    bcopy(sc->maddr + RAY_ECF_TO_HOST_BASE, ep, sizeof(sc->sc_ecf_startup));
+    ray_read_region(sc, RAY_ECF_TO_HOST_BASE, ep, sizeof(sc->sc_ecf_startup));
     if (ep->e_status != RAY_ECFS_CARD_OK) {
-/* XXX freebsd has a nice bit mask print thingy - use it here */
-	printf("ray%d: card failed self test: status 0x%0x\n", sc->unit,
-	    ep->e_status);
-
+	printf("ray%d: card failed self test: status 0x%b\n", sc->unit,
+	    ep->e_status,
+	    "\020"			/* print in hex */
+	    "\001RESERVED0"
+	    "\002PROC_SELF_TEST"
+	    "\003PROG_MEM_CHECKSUM"
+	    "\004DATA_MEM_TEST"
+	    "\005RX_CALIBRATION"
+	    "\006FW_VERSION_COMPAT"
+	    "\007RERSERVED1"
+	    "\008TEST_COMPLETE"
+	);
 	return(0);
     }
-    if (sc->sc_version != RAY_ECFS_BUILD_4 && sc->sc_version != RAY_ECFS_BUILD_5) {
+    if (sc->sc_version != RAY_ECFS_BUILD_4 &&
+        sc->sc_version != RAY_ECFS_BUILD_5
+       ) {
 	printf("ray%d: unsupported firmware version 0x%0x\n", sc->unit,
 	    ep->e_fw_build_string);
 	return(0);
     }
 
-#if RAY_DEBUG > 1
-    printf("ray%d: Start Up Results\n", sc->unit);
-#if RAY_DEBUG > 10
-    HEXDUMP_8((u_int8_t *)sc->maddr + RAY_ECF_TO_HOST_BASE, 0x40);
-#endif
-    if (sc->sc_version == RAY_ECFS_BUILD_4)
-	printf("  Firmware version 4\n");
-    else
-	printf("  Firmware version 5\n");
-    printf("  Status 0x%x\n", ep->e_status);
-    printf("  Ether address %6D\n", ep->e_station_addr, ":");
-    if (sc->sc_version == RAY_ECFS_BUILD_4) {
-	printf("  Program checksum %0x\n", ep->e_resv0);
-	printf("  CIS checksum %0x\n", ep->e_rates[0]);
-    } else {
-	printf("  (reserved word) %0x\n", ep->e_resv0);
-	printf("  Supported rates %8D\n", ep->e_rates, ":");
+    if (bootverbose || RAY_DEBUG) {
+	printf("ray%d: Start Up Results\n", sc->unit);
+	if (RAY_DEBUG > 10)
+	    RAY_DHEX8((u_int8_t *)sc->maddr + RAY_ECF_TO_HOST_BASE, 0x40);
+	if (sc->sc_version == RAY_ECFS_BUILD_4)
+	    printf("  Firmware version 4\n");
+	else
+	    printf("  Firmware version 5\n");
+	printf("  Status 0x%x\n", ep->e_status);
+	printf("  Ether address %6D\n", ep->e_station_addr, ":");
+	if (sc->sc_version == RAY_ECFS_BUILD_4) {
+	    printf("  Program checksum %0x\n", ep->e_resv0);
+	    printf("  CIS checksum %0x\n", ep->e_rates[0]);
+	} else {
+	    printf("  (reserved word) %0x\n", ep->e_resv0);
+	    printf("  Supported rates %8D\n", ep->e_rates, ":");
+	}
+	printf("  Japan call sign %12D\n", ep->e_japan_callsign, ":");
+	if (sc->sc_version == RAY_ECFS_BUILD_5) {
+	    printf("  Program checksum %0x\n", ep->e_prg_cksum);
+	    printf("  CIS checksum %0x\n", ep->e_cis_cksum);
+	    printf("  Firmware version %0x\n", ep->e_fw_build_string);
+	    printf("  Firmware revision %0x\n", ep->e_fw_build);
+	    printf("  (reserved word) %0x\n", ep->e_fw_resv);
+	    printf("  ASIC version %0x\n", ep->e_asic_version);
+	    printf("  TIB size %0x\n", ep->e_tibsize);
+	}
     }
-    printf("  Japan call sign %12D\n", ep->e_japan_callsign, ":");
-    if (sc->sc_version == RAY_ECFS_BUILD_5) {
-	printf("  Program checksum %0x\n", ep->e_prg_cksum);
-	printf("  CIS checksum %0x\n", ep->e_cis_cksum);
-	printf("  Firmware version %0x\n", ep->e_fw_build_string);
-	printf("  Firmware revision %0x\n", ep->e_fw_build);
-	printf("  (reserved word) %0x\n", ep->e_fw_resv);
-	printf("  ASIC version %0x\n", ep->e_asic_version);
-	printf("  TIB size %0x\n", ep->e_tib_size);
-    }
-#endif
+
+    /* Reset any pending interrupts */
+    RAY_HCS_CLEAR_INTR(sc);
 
     /*
-     * Reset any pending interrupts
+     * Set the parameters that will survive stop/init
      */
-#if 0
-{u_int8_t p[16]; printf("Status pre interrupt clearing\n"); ray_attr_read(sc, RAY_CCR, p, sizeof(p)); HEXDUMP_8(p, sizeof(p)); HEXDUMP_16((u_int16_t *)p, sizeof(p) / 2);}
-#endif
-    ray_attr_write(sc, RAY_HCSIR, 0);
-#if 0
-{u_int8_t p[16]; printf("Status post interrupt clearing\n"); ray_attr_read(sc, RAY_CCR, p, sizeof(p)); HEXDUMP_8(p, sizeof(p)); HEXDUMP_16((u_int16_t *)p, sizeof(p) / 2);}
+#if XXX
+NetBSD
+    bzero(sc->sc_cnwid, sizeof(sc->sc_cnwid));
+    bzero(sc->sc_dnwid, sizeof(sc->sc_dnwid));
+    strncpy(sc->sc_dnwid, RAY_DEF_NWID, sizeof(sc->sc_dnwid));
+    strncpy(sc->sc_cnwid, RAY_DEF_NWID, sizeof(sc->sc_dnwid));
+    sc->sc_omode = sc->sc_mode = RAY_MODE_DEFAULT;
+    sc->sc_countrycode = sc->sc_dcountrycode = RAY_PID_COUNTRY_CODE_DEFAULT;
 #endif
 
     /*
      * Initialise the network interface structure
      */
-#if XXX
-sc->arpcom.ac_enaddr = 
-#endif /* XXX */
+    bcopy((char *)&ep->e_station_addr,
+	  (char *)&sc->arpcom.ac_enaddr, ETHER_ADDR_LEN);
     ifp = &sc->arpcom.ac_if;
     ifp->if_softc = sc;
     ifp->if_name = "ray";
     ifp->if_unit = sc->unit;
     ifp->if_timer = 0;
     ifp->if_flags = (IFF_BROADCAST | IFF_SIMPLEX ); /* XXX - IFF_MULTICAST */
-
-
-#if XXX
-ifp->if_linkmib = &scp->mibdata;
-ifp->if_linkmiblen = sizeof scp->mibdata;
-#endif /* XXX */
-
-printf("type 0x%x\n", ifp->if_type);
-printf("addrlen 0x%x\n", ifp->if_addrlen);
-printf("physical 0x%x\n", ifp->if_physical);
-printf("hdrlen 0x%x\n", ifp->if_hdrlen);
-printf("mtu 0x%lx\n", ifp->if_mtu);
-printf("metic 0x%lx\n", ifp->if_metric);
-printf("baudrate 0x%lx\n", ifp->if_baudrate);
 #if XXX
-if_mtu
-...
-if_rawoutput
+    ifp->if_hdr = ...; make this big enough to hold the .11 and .3 headers
+#endif
+    ifp->if_baudrate = 1000000; /* XXX Is this baud or bps ;-) */
 
     ifp->if_output = ether_output;
     ifp->if_start = ray_start;
     ifp->if_ioctl = ray_ioctl;
     ifp->if_watchdog = ray_watchdog;
     ifp->if_init = ray_init;
-
     ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
 
-xe
-  ifmedia_init(scp->ifm, 0, xe_media_change, xe_media_status);
-  callout_handle_init(&scp->chand);
-
-  ifmedia_add(scp->ifm, IFM_ETHER|IFM_AUTO, 0, NULL);
-
-  if_attach(scp->ifp);
-  ether_ifattach(scp->ifp);
+    /*
+     * If this logical interface has already been attached,
+     * don't attach it again or chaos will ensue.
+     */
+    sprintf(ifname, "ray%d", sc->unit);
+
+    if (ifunit(ifname) == NULL) {
+	callout_handle_init(&sc->timerh);
+#ifdef RAY_NEED_STARTJOIN_TIMEO
+	callout_handle_init(&sc->sj_timerh);
+#endif /* RAY_NEED_STARTJOIN_TIMEO */
+	if_attach(ifp);
+	ether_ifattach(ifp);
+#if NBPFILTER > 0
+	bpfattach(ifp, DLT_EN10MB, sizeof(struct ether_header));
+#endif /* NBFFILTER */
 
+#if XXX
+	this looks like a good idea
+	at_shutdown(ray_shutdown, sc, SHUTDOWN_POST_SYNC);
 #endif /* XXX */
+    }
 
-#if XXX
-    return(1);
-#else
     return(0);
-#endif
 }
 
 /*
@@ -449,11 +617,10 @@ ray_start (ifp)
 {
     struct ray_softc *sc;
 
-#if RAY_DEBUG > 0
-    printf("ray%d: Network start\n", ifp->if_unit);
-#endif
+    RAY_DPRINTF(("ray%d: Network start\n", ifp->if_unit));
 
     sc = ifp->if_softc;
+    RAY_MAP_CM(sc);
 
     if (sc->gone) {
 	printf("ray%d: unloaded before start!\n", sc->unit);
@@ -480,11 +647,10 @@ ray_ioctl (ifp, command, data)
     struct ray_softc *sc;
     int s, error = 0;
 
-#if RAY_DEBUG > 0
-    printf("ray%d: Network ioctl\n", ifp->if_unit);
-#endif
+    RAY_DPRINTF(("ray%d: Network ioctl\n", ifp->if_unit));
 
     sc = ifp->if_softc;
+    RAY_MAP_CM(sc);
 
     if (sc->gone) {
 	printf("ray%d: unloaded before ioctl!\n", sc->unit);
@@ -499,10 +665,12 @@ ray_ioctl (ifp, command, data)
 	case SIOCSIFADDR:
 	case SIOCGIFADDR:
 	case SIOCSIFMTU:
+	    RAY_DPRINTF(("ray%d: ioctl SIFADDR/GIFADDR/SIFMTU\n", sc->unit));
 	    error = ether_ioctl(ifp, command, data);
 	    break;
 
 	case SIOCSIFFLAGS:
+	    RAY_DPRINTF(("ray%d: for SIFFLAGS\n", sc->unit));
 	    /*
 	     * If the interface is marked up and stopped, then start
 	     * it. If it is marked down and running, then stop it.
@@ -519,6 +687,7 @@ ray_ioctl (ifp, command, data)
 #if XXX
 	case SIOCADDMULTI:
 	case SIOCDELMULTI:
+	    RAY_DPRINTF(("ray%d: ioctl called for ADDMULTI/DELMULTI\n, sc->unit"));
 	    /*
 	     * Multicast list has (maybe) changed; set the hardware filter
 	     * accordingly. This also serves to deal with promiscuous mode
@@ -530,12 +699,49 @@ ray_ioctl (ifp, command, data)
 	    error = 0;
 	    break;
 
+case SIOCGIFFLAGS:
+    RAY_DPRINTF(("ray%d: ioctl called for GIFFLAGS\n", sc->unit));
+    error = EINVAL;
+    break;
+case SIOCGIFMETRIC:
+    RAY_DPRINTF(("ray%d: ioctl called for GIFMETRIC\n", sc->unit));
+    error = EINVAL;
+    break;
+case SIOCGIFMTU:
+    RAY_DPRINTF(("ray%d: ioctl called for GIFMTU\n", sc->unit));
+    error = EINVAL;
+    break;
+case SIOCGIFPHYS:
+    RAY_DPRINTF(("ray%d: ioctl called for GIFPYHS\n", sc->unit));
+    error = EINVAL;
+    break;
+case SIOCSIFMEDIA:
+    RAY_DPRINTF(("ray%d: ioctl called for SIFMEDIA\n", sc->unit));
+    error = EINVAL;
+    break;
+case SIOCGIFMEDIA:
+    RAY_DPRINTF(("ray%d: ioctl called for GIFMEDIA\n", sc->unit));
+    error = EINVAL;
+    break;
+
 	default:
 	    error = EINVAL;
     }
 
     (void)splx(s);
 
+    /* XXX This is here to avoid spl's */
+if (command == SIOCGIFMEDIA) {
+    RAY_DPRINTF(("ray%d: RAY_SCB\n", sc->unit));
+    RAY_DHEX8((u_int8_t *)sc->maddr + RAY_SCB_BASE, 0x20);
+    RAY_DPRINTF(("ray%d: RAY_STATUS\n", sc->unit));
+    RAY_DHEX8((u_int8_t *)sc->maddr + RAY_STATUS_BASE, 0x20);
+    RAY_DPRINTF(("ray%d: RAY_ECF_TO_HOST\n", sc->unit));
+    RAY_DHEX8((u_int8_t *)sc->maddr + RAY_ECF_TO_HOST_BASE, 0x40);
+    RAY_DPRINTF(("ray%d: RAY_HOST_TO_ECF\n", sc->unit));
+    RAY_DHEX8((u_int8_t *)sc->maddr + RAY_HOST_TO_ECF_BASE, 0x50);
+}
+
     return error;
 }
 
@@ -545,11 +751,10 @@ ray_watchdog (ifp)
 {
     struct ray_softc *sc;
 
-#if RAY_DEBUG > 0
-    printf("ray%d: Network watchdog\n", ifp->if_unit);
-#endif
+    RAY_DPRINTF(("ray%d: Network watchdog\n", ifp->if_unit));
 
     sc = ifp->if_softc;
+    RAY_MAP_CM(sc);
 
     if (sc->gone) {
 	printf("ray%d: unloaded before watchdog!\n", sc->unit);
@@ -560,7 +765,7 @@ ray_watchdog (ifp)
 
 /* XXX may need to have remedial action here
    for example
-   	ray_reset
+   	ray_reset - may be useful elsewhere
 		ray_stop
 		...
 		ray_init
@@ -574,34 +779,128 @@ ray_watchdog (ifp)
  */
 static void
 ray_init (xsc)
-    void *xsc;
+    void			*xsc;
 {
-    struct ray_softc	*sc = xsc;
-    struct ifnet	*ifp;
-    int			s;
+    struct ray_softc		*sc = xsc;
+    struct ray_ecf_startup_v5	*ep;
+    struct ifnet		*ifp;
+    size_t			ccs;
+    int				i;
 
-#if RAY_DEBUG > 0
-    printf("ray%d: Network init\n", sc->unit);
-#endif
+    RAY_DPRINTF(("ray%d: Network init\n", sc->unit));
+    RAY_MAP_CM(sc);
 
     if (sc->gone) {
 	printf("ray%d: unloaded before init!\n", sc->unit);
 	return;
     }
 
+#if XXX
+NetBSD
+    if ((sc->sc_if.if_flags & IFF_RUNNING))
+	ray_stop(sc);
+#endif
+
     ifp = &sc->arpcom.ac_if;
 
-/* XXX stuff here please */
+    /*
+     * Reset instance variables
+     */
+#if XXX
+NetBSD
+    sc->sc_havenet = 0;
+    bzero(sc->sc_bssid, sizeof(sc->sc_bssid));
+    sc->sc_deftxrate = 0;
+    sc->sc_encrypt = 0;
+    sc->sc_promisc = 0;
+    sc->sc_scheduled = 0;
+    sc->sc_running = 0;
+    sc->sc_txfree = RAY_CCS_NTX;
+    sc->sc_checkcounters = 0;
+#endif
+
+    /* Set all ccs to be free */
+    bzero(sc->sc_ccsinuse, sizeof(sc->sc_ccsinuse));
+    sc->sc_ccs = RAY_CCS_LAST + 1;
+    ccs = RAY_CCS_ADDRESS(0);
+    for (i = 0; i < RAY_CCS_LAST; ccs += RAY_CCS_SIZE, i++)
+	    SRAM_WRITE_FIELD_1(sc, ccs, ray_cmd, c_status, RAY_CCS_STATUS_FREE);
+
+    /* Clear any pending interrupts */
+    RAY_HCS_CLEAR_INTR(sc);
+
+    /*
+     * Get startup results - the card may have been reset
+     */
+    ep = &sc->sc_ecf_startup;
+    ray_read_region(sc, RAY_ECF_TO_HOST_BASE, ep, sizeof(sc->sc_ecf_startup));
+    if (ep->e_status != RAY_ECFS_CARD_OK) {
+	printf("ray%d: card failed self test: status 0x%b\n", sc->unit,
+	    ep->e_status,
+	    "\020"			/* print in hex */
+	    "\001RESERVED0"
+	    "\002PROC_SELF_TEST"
+	    "\003PROG_MEM_CHECKSUM"
+	    "\004DATA_MEM_TEST"
+	    "\005RX_CALIBRATION"
+	    "\006FW_VERSION_COMPAT"
+	    "\007RERSERVED1"
+	    "\008TEST_COMPLETE"
+	);
+#if XXX
+	return; /* XXX This doesn't mark the interface as down */
+#endif /* XXX */
+    }
+
+    /*
+     * Fixup tib size to be correct - on build 4 it is garbage
+     */
+    if (sc->sc_version == RAY_ECFS_BUILD_4 && sc->sc_tibsize == 0x55)
+	sc->sc_tibsize = 32;
+
+    /*
+     * We are now up and running. Next we have to download network
+     * configuration into the card. We are busy until download is done.
+     */
+    ifp->if_flags |= IFF_RUNNING | IFF_OACTIVE;
+#if XXX
+    /* set this now so it gets set in the download */
+    sc->sc_promisc = !!(sc->sc_if.if_flags & (IFF_PROMISC|IFF_ALLMULTI));
+#endif /* XXX */
+    ray_download_params(sc);
+
+#if XXX
+    need to understand how the doenload finishes first
+
+    Start up flow is as follows.
+
+    	The kernel calls ray_init when the interface is assigned an address.
+
+	ray_init does a bit of house keeping before calling ray_download_params.
+
+	ray_download_params fills the startup parameter structure out and
+	sends it to the card. The download command simply completes so
+	we use schedule a timeout function call to ray_download_timo.
+	We pass the ccs in use via sc->sc_css.
+
+	ray_download_timo checks the ccs for command completion/errors.
+	Then it tells the card to start an adhoc or join a managed
+	network. This should complete via the interrupt mechanism, but
+	the NetBSD driver includes a timeout for some buggy stuff somewhere.
+	I've left the hooks in but don't use them. The interrupt handler
+	passes control to ray_start_join_done (again the ccs is in
+	sc->sc_css XXX need to see if this is actually needed).
 
+	XXX
     /*
      * Set running and clear output active, then attempt to start output
      */
     ifp->if_flags |= IFF_RUNNING;
-    ifp->if_flags &= ~IFF_OACTIVE;
-/* XXX spl's needed higher up? */
+/* XXX spl's needed higher up? but this is called by ioctl only?*/
     s = splimp();
     ray_start(ifp);
     (void) splx(s);
+#endif
 
     return;
 }
@@ -615,9 +914,8 @@ ray_stop (sc)
 {
     struct ifnet	*ifp;
 
-#if RAY_DEBUG > 0
-    printf("ray%d: Network stop\n", sc->unit);
-#endif
+    RAY_DPRINTF(("ray%d: Network stop\n", sc->unit));
+    RAY_MAP_CM(sc);
 
     if (sc->gone) {
 	printf("ray%d: unloaded before stop!\n", sc->unit);
@@ -628,14 +926,528 @@ ray_stop (sc)
 
 /* XXX stuff here please to kill activity on the card and drain down transmissons */
 
+    /* Mark as not running */
+    ifp->if_flags &= ~IFF_RUNNING;
+
+    return;
+}
+
+/*
+ * Process CCS command completion - called from ray_intr
+ */
+static void
+ray_ccs_done (sc, ccs)
+    struct ray_softc	*sc;
+    size_t		ccs;
+{
+    struct ifnet	*ifp;
+    u_int		cmd, status;
+    
+    RAY_DPRINTF(("ray%d: Processing ccs %d\n", sc->unit, RAY_CCS_INDEX(ccs)));
+    RAY_MAP_CM(sc);
+
+    ifp = &sc->arpcom.ac_if;
+
+    cmd = SRAM_READ_FIELD_1(sc, ccs, ray_cmd, c_cmd);
+    status = SRAM_READ_FIELD_1(sc, ccs, ray_cmd, c_status);
+    RAY_DPRINTF(("ray%d: ccs idx %d ccs 0x%x cmd 0x%x stat %d\n",
+    		sc->unit, RAY_CCS_INDEX(ccs), ccs, cmd, status));
+
+    /* XXX should we panic on unrecognised commands or just ignore them?
+     * maybe I'll macroize the printf's */
+    switch (cmd) {
+	case RAY_CMD_START_PARAMS:
+	    printf("ray%d: ray_ccs_done got START_PARAMS - why?\n", sc->unit);
+	    break;
+
+	case RAY_CMD_UPDATE_PARAMS:
+	    RAY_DPRINTF(("ray%d: ray_ccs_done got UPDATE_PARAMS\n", sc->unit));
+	    XXX;
+	    break;
+
+	case RAY_CMD_REPORT_PARAMS:
+	    RAY_DPRINTF(("ray%d: ray_ccs_done got REPORT_PARAMS\n", sc->unit));
+	    XXX;
+	    break;
+
+	case RAY_CMD_UPDATE_MCAST:
+	    RAY_DPRINTF(("ray%d: ray_ccs_done got UPDATE_MCAST\n", sc->unit));
+	    XXX;
+	    break;
+
+	case RAY_CMD_UPDATE_APM:
+	    RAY_DPRINTF(("ray%d: ray_ccs_done got UPDATE_APM\n", sc->unit));
+	    XXX;
+	    break;
+
+	case RAY_CMD_START_NET:
+	case RAY_CMD_JOIN_NET:
+	    RAY_DPRINTF(("ray%d: ray_ccs_done got START|JOIN_NET\n", sc->unit));
+#ifdef RAY_NEED_STARTJOIN_TIMEO
+	    untimeout(ray_start_join_timo, sc, sc->sj_timerh);
+#endif /* RAY_NEED_STARTJOIN_TIMEO */
+	    XXX;
+	    break;
+
+	case RAY_CMD_START_ASSOC:
+	    RAY_DPRINTF(("ray%d: ray_ccs_done got START_ASSOC\n", sc->unit));
+	    XXX;
+	    break;
+
+	case RAY_CMD_TX_REQ:
+	    RAY_DPRINTF(("ray%d: ray_ccs_done got TX_REQ\n", sc->unit));
+	    XXX;
+	    break;
+
+	case RAY_CMD_TEST_MEM:
+	    printf("ray%d: ray_ccs_done got TEST_MEM - why?\n", sc->unit);
+	    break;
+
+	case RAY_CMD_SHUTDOWN:
+	    printf("ray%d: ray_ccs_done got SHUTDOWN - why?\n", sc->unit);
+	    break;
+
+	case RAY_CMD_DUMP_MEM:
+	    printf("ray%d: ray_ccs_done got DUMP_MEM - why?\n", sc->unit);
+	    break;
+
+	case RAY_CMD_START_TIMER:
+	    printf("ray%d: ray_ccs_done got START_TIMER - why?\n", sc->unit);
+    	    break;
+
+	default:
+	    printf("ray%d: ray_ccs_done unknown command 0x%x\n", sc->unit, cmd);
+	    break;
+    }
+
+    ray_free_ccs(sc, ccs);
+
+    return;
+}
+
+/*
+ * Process ECF command request - called from ray_intr
+ */
+static void
+ray_rcs_intr (sc, rcs)
+    struct ray_softc	*sc;
+    size_t		rcs;
+{
+    struct ifnet	*ifp;
+    u_int		cmd, status;
+    
+    RAY_DPRINTF(("ray%d: Processing rcs %d\n", sc->unit, RAY_CCS_INDEX(rcs)));
+    RAY_MAP_CM(sc);
+
+    ifp = &sc->arpcom.ac_if;
+
+    cmd = SRAM_READ_FIELD_1(sc, rcs, ray_cmd, c_cmd);
+    status = SRAM_READ_FIELD_1(sc, rcs, ray_cmd, c_status);
+    RAY_DPRINTF(("ray%d: rcs idx %d rcs 0x%x cmd 0x%x stat %d\n",
+    		sc->unit, RAY_CCS_INDEX(rcs), rcs, cmd, status));
+
+    /* XXX should we panic on unrecognised commands or just ignore them?
+     * maybe I'll macroize the printf's */
+    switch (cmd) {
+	case RAY_ECMD_RX_DONE:
+	    printf("ray%d: ray_rcs_intr got RX_DONE\n", sc->unit);
+	    XXX;
+	    break;
+
+	case RAY_ECMD_REJOIN_DONE:
+	    RAY_DPRINTF(("ray%d: ray_rcs_intr got UPDATE_PARAMS\n", sc->unit));
+	    XXX;
+	    break;
+
+	case RAY_ECMD_ROAM_START:
+	    RAY_DPRINTF(("ray%d: ray_rcs_intr got ROAM_START\n", sc->unit));
+	    XXX;
+	    break;
+
+	case RAY_ECMD_JAPAN_CALL_SIGNAL:
+	    printf("ray%d: ray_rcs_intr got JAPAN_CALL_SIGNAL - why?\n",
+	    		sc->unit);
+	    break;
+
+	default:
+	    printf("ray%d: ray_rcs_intr unknown command 0x%x\n",
+	    		sc->unit, cmd);
+	    break;
+    }
+
+    SRAM_WRITE_FIELD_1(sc, rcs, ray_cmd, c_status, RAY_CCS_STATUS_FREE);
+
+    return;
+}
+
+/*
+ * Download start up structures to card.
+ *
+ * Part of ray_init, download, startjoin control flow.
+ */
+static void
+ray_download_params (sc)
+    struct ray_softc	*sc;
+{
+    struct ray_mib_4	ray_mib_4_default;
+    struct ray_mib_5	ray_mib_5_default;
+
+    RAY_DPRINTF(("ray%d: Downloading startup parameters\n", sc->unit));
+    RAY_MAP_CM(sc);
+
+#if XXX
+netbsd
+    ray_cmd_cancel(sc, SCP_UPD_STARTUP);
+#endif /* XXX */
+
+#define MIB4(m)		ray_mib_4_default.##m
+#define MIB5(m)		ray_mib_5_default.##m
+#define	PUT2(p, v) 	\
+    do { (p)[0] = ((v >> 8) & 0xff); (p)[1] = (v & 0xff); } while(0)
+
+     /*
+      * Firmware version 4 defaults - see if_raymib.h for details
+      */
+     MIB4(mib_net_type)			= RAY_MIB_NET_TYPE_DEFAULT;
+     MIB4(mib_ap_status)		= RAY_MIB_AP_STATUS_DEFAULT;
+strncpy(MIB4(mib_ssid), 		  RAY_MIB_SSID_DEFAULT, RAY_MAXSSIDLEN);
+     MIB4(mib_scan_mode)		= RAY_MIB_SCAN_MODE_DEFAULT;
+     MIB4(mib_apm_mode)			= RAY_MIB_APM_MODE_DEFAULT;
+     bcopy(sc->sc_station_addr, MIB4(mib_mac_addr), ETHER_ADDR_LEN);
+PUT2(MIB4(mib_frag_thresh), 		  RAY_MIB_FRAG_THRESH_DEFAULT);
+PUT2(MIB4(mib_dwell_time),		  RAY_MIB_DWELL_TIME_V4);
+PUT2(MIB4(mib_beacon_period),		  RAY_MIB_BEACON_PERIOD_V4);
+     MIB4(mib_dtim_interval)		= RAY_MIB_DTIM_INTERVAL_DEFAULT;
+     MIB4(mib_max_retry)		= RAY_MIB_MAX_RETRY_DEFAULT;
+     MIB4(mib_ack_timo)			= RAY_MIB_ACK_TIMO_DEFAULT;
+     MIB4(mib_sifs)			= RAY_MIB_SIFS_DEFAULT;
+     MIB4(mib_difs)			= RAY_MIB_DIFS_DEFAULT;
+     MIB4(mib_pifs)			= RAY_MIB_PIFS_V4;
+PUT2(MIB4(mib_rts_thresh),		  RAY_MIB_RTS_THRESH_DEFAULT);
+PUT2(MIB4(mib_scan_dwell),		  RAY_MIB_SCAN_DWELL_V4);
+PUT2(MIB4(mib_scan_max_dwell),		  RAY_MIB_SCAN_MAX_DWELL_V4);
+     MIB4(mib_assoc_timo)		= RAY_MIB_ASSOC_TIMO_DEFAULT;
+     MIB4(mib_adhoc_scan_cycle)		= RAY_MIB_ADHOC_SCAN_CYCLE_DEFAULT;
+     MIB4(mib_infra_scan_cycle)		= RAY_MIB_INFRA_SCAN_CYCLE_DEFAULT;
+     MIB4(mib_infra_super_scan_cycle)	= RAY_MIB_INFRA_SUPER_SCAN_CYCLE_DEFAULT;
+     MIB4(mib_promisc)			= RAY_MIB_PROMISC_DEFAULT;
+PUT2(MIB4(mib_uniq_word),		  RAY_MIB_UNIQ_WORD_DEFAULT);
+     MIB4(mib_slot_time)		= RAY_MIB_SLOT_TIME_V4;
+     MIB4(mib_roam_low_snr_thresh)	= RAY_MIB_ROAM_LOW_SNR_THRESH_DEFAULT;
+     MIB4(mib_low_snr_count)		= RAY_MIB_LOW_SNR_COUNT_DEFAULT;
+     MIB4(mib_infra_missed_beacon_count)= RAY_MIB_INFRA_MISSED_BEACON_COUNT_DEFAULT;
+     MIB4(mib_adhoc_missed_beacon_count)= RAY_MIB_ADHOC_MISSED_BEACON_COUNT_DEFAULT;
+     MIB4(mib_country_code)		= RAY_MIB_COUNTRY_CODE_DEFAULT;
+     MIB4(mib_hop_seq)			= RAY_MIB_HOP_SEQ_DEFAULT;
+     MIB4(mib_hop_seq_len)		= RAY_MIB_HOP_SEQ_LEN_V4;
+     MIB4(mib_cw_max)			= RAY_MIB_CW_MAX_V4;
+     MIB4(mib_cw_min)			= RAY_MIB_CW_MIN_V4;
+     MIB4(mib_noise_filter_gain)	= RAY_MIB_NOISE_FILTER_GAIN_DEFAULT;
+     MIB4(mib_noise_limit_offset)	= RAY_MIB_NOISE_LIMIT_OFFSET_DEFAULT;
+     MIB4(mib_rssi_thresh_offset)	= RAY_MIB_RSSI_THRESH_OFFSET_DEFAULT;
+     MIB4(mib_busy_thresh_offset)	= RAY_MIB_BUSY_THRESH_OFFSET_DEFAULT;
+     MIB4(mib_sync_thresh)		= RAY_MIB_SYNC_THRESH_DEFAULT;
+     MIB4(mib_test_mode)		= RAY_MIB_TEST_MODE_DEFAULT;
+     MIB4(mib_test_min_chan)		= RAY_MIB_TEST_MIN_CHAN_DEFAULT;
+     MIB4(mib_test_max_chan)		= RAY_MIB_TEST_MAX_CHAN_DEFAULT;
+
+     /*
+      * Firmware version 5 defaults - see if_raymib.h for details
+      */
+     MIB5(mib_net_type)			= RAY_MIB_NET_TYPE_DEFAULT;
+     MIB5(mib_ap_status)		= RAY_MIB_AP_STATUS_DEFAULT;
+strncpy(MIB5(mib_ssid), 		  RAY_MIB_SSID_DEFAULT, RAY_MAXSSIDLEN);
+     MIB5(mib_scan_mode)		= RAY_MIB_SCAN_MODE_DEFAULT;
+     MIB5(mib_apm_mode)			= RAY_MIB_APM_MODE_DEFAULT;
+     bcopy(sc->sc_station_addr, MIB5(mib_mac_addr), ETHER_ADDR_LEN);
+PUT2(MIB5(mib_frag_thresh), 		  RAY_MIB_FRAG_THRESH_DEFAULT);
+PUT2(MIB5(mib_dwell_time),		  RAY_MIB_DWELL_TIME_V5);
+PUT2(MIB5(mib_beacon_period),		  RAY_MIB_BEACON_PERIOD_V5);
+     MIB5(mib_dtim_interval)		= RAY_MIB_DTIM_INTERVAL_DEFAULT;
+     MIB5(mib_max_retry)		= RAY_MIB_MAX_RETRY_DEFAULT;
+     MIB5(mib_ack_timo)			= RAY_MIB_ACK_TIMO_DEFAULT;
+     MIB5(mib_sifs)			= RAY_MIB_SIFS_DEFAULT;
+     MIB5(mib_difs)			= RAY_MIB_DIFS_DEFAULT;
+     MIB5(mib_pifs)			= RAY_MIB_PIFS_V5;
+PUT2(MIB5(mib_rts_thresh),		  RAY_MIB_RTS_THRESH_DEFAULT);
+PUT2(MIB5(mib_scan_dwell),		  RAY_MIB_SCAN_DWELL_V5);
+PUT2(MIB5(mib_scan_max_dwell),		  RAY_MIB_SCAN_MAX_DWELL_V5);
+     MIB5(mib_assoc_timo)		= RAY_MIB_ASSOC_TIMO_DEFAULT;
+     MIB5(mib_adhoc_scan_cycle)		= RAY_MIB_ADHOC_SCAN_CYCLE_DEFAULT;
+     MIB5(mib_infra_scan_cycle)		= RAY_MIB_INFRA_SCAN_CYCLE_DEFAULT;
+     MIB5(mib_infra_super_scan_cycle)	= RAY_MIB_INFRA_SUPER_SCAN_CYCLE_DEFAULT;
+     MIB5(mib_promisc)			= RAY_MIB_PROMISC_DEFAULT;
+PUT2(MIB5(mib_uniq_word),		  RAY_MIB_UNIQ_WORD_DEFAULT);
+     MIB5(mib_slot_time)		= RAY_MIB_SLOT_TIME_V5;
+     MIB5(mib_roam_low_snr_thresh)	= RAY_MIB_ROAM_LOW_SNR_THRESH_DEFAULT;
+     MIB5(mib_low_snr_count)		= RAY_MIB_LOW_SNR_COUNT_DEFAULT;
+     MIB5(mib_infra_missed_beacon_count)= RAY_MIB_INFRA_MISSED_BEACON_COUNT_DEFAULT;
+     MIB5(mib_adhoc_missed_beacon_count)= RAY_MIB_ADHOC_MISSED_BEACON_COUNT_DEFAULT;
+     MIB5(mib_country_code)		= RAY_MIB_COUNTRY_CODE_DEFAULT;
+     MIB5(mib_hop_seq)			= RAY_MIB_HOP_SEQ_DEFAULT;
+     MIB5(mib_hop_seq_len)		= RAY_MIB_HOP_SEQ_LEN_V5;
+PUT2(MIB5(mib_cw_max),			  RAY_MIB_CW_MAX_V5);
+PUT2(MIB5(mib_cw_min),			  RAY_MIB_CW_MIN_V5);
+     MIB5(mib_noise_filter_gain)	= RAY_MIB_NOISE_FILTER_GAIN_DEFAULT;
+     MIB5(mib_noise_limit_offset)	= RAY_MIB_NOISE_LIMIT_OFFSET_DEFAULT;
+     MIB5(mib_rssi_thresh_offset)	= RAY_MIB_RSSI_THRESH_OFFSET_DEFAULT;
+     MIB5(mib_busy_thresh_offset)	= RAY_MIB_BUSY_THRESH_OFFSET_DEFAULT;
+     MIB5(mib_sync_thresh)		= RAY_MIB_SYNC_THRESH_DEFAULT;
+     MIB5(mib_test_mode)		= RAY_MIB_TEST_MODE_DEFAULT;
+     MIB5(mib_test_min_chan)		= RAY_MIB_TEST_MIN_CHAN_DEFAULT;
+     MIB5(mib_test_max_chan)		= RAY_MIB_TEST_MAX_CHAN_DEFAULT;
+     MIB5(mib_allow_probe_resp)		= RAY_MIB_ALLOW_PROBE_RESP_DEFAULT;
+     MIB5(mib_privacy_must_start)	= RAY_MIB_PRIVACY_MUST_START_DEFAULT;
+     MIB5(mib_privacy_can_join)		= RAY_MIB_PRIVACY_CAN_JOIN_DEFAULT;
+     MIB5(mib_basic_rate_set[0])	= RAY_MIB_BASIC_RATE_SET_DEFAULT;
+
+    if (!RAY_ECF_READY(sc))
+    	panic("ray%d: ray_download_params something is already happening\n",
+		sc->unit);
+
+    if (sc->sc_version == RAY_ECFS_BUILD_4)
+	ray_write_region(sc, RAY_HOST_TO_ECF_BASE,
+			 &ray_mib_4_default, sizeof(ray_mib_4_default));
+    else
+	ray_write_region(sc, RAY_HOST_TO_ECF_BASE,
+			 &ray_mib_5_default, sizeof(ray_mib_5_default));
+
+/*
+ * NetBSD
+ * hand expanding ray_simple_cmd
+ * we dont do any of the clever timeout stuff yet (i.e. ray_cmd_ran) just
+ * simple check
+ *
+ * 	if (!ray_simple_cmd(sc, RAY_CMD_START_PARAMS, SCP_UPD_STARTUP))
+ * 	    panic("ray_download_params issue");
+ *
+ * 	ray_simple_cmd ==
+ * 	    ray_alloc_ccs(sc, &ccs, cmd, track) &&
+ * 	    ray_issue_cmd(sc, ccs, track));
+ *
+ */
     /*
-     * Mark as not running
+     * Get a free command ccs and issue the command - there is nothing
+     * to fill in for a START_PARAMS command. The start parameters
+     * command just gets serviced, so we use a timeout to complete the
+     * sequence.
      */
-    ifp->if_flags &= ~IFF_RUNNING;
+    if (!ray_alloc_ccs(sc, &sc->sc_ccs, RAY_CMD_START_PARAMS, SCP_UPD_STARTUP))
+    	panic("ray%d: ray_download_params can't get a CCS\n", sc->unit);
+
+    if (!ray_issue_cmd(sc, sc->sc_ccs, SCP_UPD_STARTUP))
+    	panic("ray%d: ray_download_params can't issue command\n", sc->unit);
+
+    sc->timerh = timeout(ray_download_timo, sc, RAY_CCS_TIMEOUT);
+
+    RAY_DPRINTF(("ray%d: Download now awaiting timeout\n", sc->unit));
+
+    return;
+}
+
+/*
+ * Download timeout routine.
+ *
+ * Part of ray_init, download, start_join control flow.
+ */
+static void
+ray_download_timo (xsc)
+    void		*xsc;
+{
+    struct ray_softc	*sc = xsc;
+    u_int8_t		status, cmd;
+
+    RAY_DPRINTF(("ray%d: ray_download_timo\n", sc->unit));
+    RAY_MAP_CM(sc);
+
+    status = SRAM_READ_FIELD_1(sc, sc->sc_ccs, ray_cmd, c_status);
+    cmd = SRAM_READ_FIELD_1(sc, sc->sc_ccs, ray_cmd, c_cmd);
+    RAY_DPRINTF(("ray%d: check rayidx %d ccs 0x%x cmd 0x%x stat %d\n",
+    		sc->unit, RAY_CCS_INDEX(sc->sc_ccs), sc->sc_ccs, cmd, status));
+    if ((cmd != RAY_CMD_START_PARAMS) || (status != RAY_CCS_STATUS_FREE))
+    	printf("ray%d: Download ccs odd cmd = 0x%02x, status = 0x%02x",
+		sc->unit, cmd, status);
+	/*XXX so what do we do? reset or retry? */
+
+    /*
+     * If the card is still busy, re-schedule ourself
+     */
+    if (status == RAY_CCS_STATUS_BUSY) {
+	RAY_DPRINTF(("ray%d: ray_download_timo - still busy, see you soon\n",
+		sc->unit));
+	sc->timerh = timeout(ray_download_timo, sc, RAY_CCS_TIMEOUT);
+    }
+
+    /* Clear the ccs */
+    ray_free_ccs(sc, sc->sc_ccs);
+    sc->sc_ccs = RAY_CCS_LAST + 1;
+
+    /*
+     * Grab a ccs and don't bother updating the network parameters.
+     * Issue the start/join command and we get interrupted back.
+     */
+    if (sc->sc_mode == SC_MODE_ADHOC)
+	    cmd = RAY_CMD_START_NET;
+    else
+	    cmd = RAY_CMD_JOIN_NET;
+
+    if (!ray_alloc_ccs(sc, &sc->sc_ccs, cmd, SCP_UPD_STARTJOIN))
+    	panic("ray%d: ray_download_timo can't get a CCS to start/join net\n",
+		sc->unit);
+
+    SRAM_WRITE_FIELD_1(sc, sc->sc_ccs, ray_cmd_net, c_upd_param, 0);
+
+    if (!ray_issue_cmd(sc, sc->sc_ccs, SCP_UPD_STARTJOIN))
+    	panic("ray%d: ray_download_timo can't issue start/join\n", sc->unit);
+
+#ifdef RAY_NEED_STARTJOIN_TIMEO
+    sc->sj_timerh = timeout(ray_start_join_timo, sc, RAY_CCS_TIMEOUT);
+#endif /* RAY_NEED_STARTJOIN_TIMEO */
+
+    RAY_DPRINTF(("ray%d: Start-join awaiting interrupt/timeout\n", sc->unit));
 
     return;
 }
 
+#ifdef RAY_NEED_STARTJOIN_TIMEO
+/*
+ * Back stop catcher for start_join command. The NetBSD driver
+ * suggests that they need it to catch a bug in the firmware or the
+ * parameters they use - they are not sure. I'll just panic as I seem
+ * to get interrupts back fine and I have version 4 firmware.
+ */
+static void
+ray_start_join_timo (xsc)
+    void		*xsc;
+{
+    struct ray_softc	*sc = xsc;
+
+    RAY_DPRINTF(("ray%d: ray_start_join_timo\n", sc->unit));
+    RAY_MAP_CM(sc);
+
+    panic("ray%d: ray-start_join_timo occured\n", sc->unit);
+
+    return;
+}
+#endif /* RAY_NEED_STARTJOIN_TIMEO */
+
+/*
+ * Obtain a free ccs buffer.
+ *
+ * Returns 1 and in `ccsp' the bus offset of the free ccs 
+ * or 0 if none are free
+ *
+ * If `track' is not zero, handles tracking this command
+ * possibly indicating a callback is needed and setting a timeout
+ * also if ECF isn't ready we terminate earlier to avoid overhead.
+ *
+ * This routine is only used for commands
+ */
+static int
+ray_alloc_ccs (sc, ccsp, cmd, track)
+    struct	ray_softc *sc;
+    size_t	*ccsp;
+    u_int	cmd, track;
+{
+    size_t	ccs;
+    u_int	i;
+
+    RAY_DPRINTF(("ray%d: ray_alloc_ccs for cmd %d\n", sc->unit, cmd));
+    RAY_MAP_CM(sc);
+
+#if XXX
+	/* for tracked commands, if not ready just set pending */
+	if (track && !RAY_ECF_READY(sc)) {
+		ray_cmd_schedule(sc, track);
+		return (0);
+	}
+#endif /* XXX */
+
+    for (i = RAY_CCS_CMD_FIRST; i <= RAY_CCS_CMD_LAST; i++) {
+	/* probe here to make the card go */
+	(void)SRAM_READ_FIELD_1(sc, RAY_CCS_ADDRESS(i), ray_cmd, c_status);
+	if (!sc->sc_ccsinuse[i])
+	    break;
+    }
+    if (i > RAY_CCS_CMD_LAST) {
+#if XXX
+	if (track)
+		ray_cmd_schedule(sc, track);
+#endif /* XXX */
+	return (0);
+    }
+    sc->sc_ccsinuse[i] = 1;
+    ccs = RAY_CCS_ADDRESS(i);
+    SRAM_WRITE_FIELD_1(sc, ccs, ray_cmd, c_status, RAY_CCS_STATUS_BUSY);
+    SRAM_WRITE_FIELD_1(sc, ccs, ray_cmd, c_cmd, cmd);
+    SRAM_WRITE_FIELD_1(sc, ccs, ray_cmd, c_link, RAY_CCS_LINK_NULL);
+
+    *ccsp = ccs;
+    return (1);
+}
+
+/*
+ * Free up a ccs/cmd and return the old status.
+ * This routine is only used for commands.
+ */
+static u_int8_t
+ray_free_ccs (sc, ccs)
+    struct	ray_softc *sc;
+    size_t	ccs;
+{
+    u_int8_t	stat;
+
+    RAY_DPRINTF(("ray%d: free_ccs 0x%02x\n", sc->unit, RAY_CCS_INDEX(ccs)));
+    RAY_MAP_CM(sc);
+
+    stat = SRAM_READ_FIELD_1(sc, ccs, ray_cmd, c_status);
+    SRAM_WRITE_FIELD_1(sc, ccs, ray_cmd, c_status, RAY_CCS_STATUS_FREE);
+    if (ccs <= RAY_CCS_ADDRESS(RAY_CCS_LAST))
+	    sc->sc_ccsinuse[RAY_CCS_INDEX(ccs)] = 0;
+
+    return (stat);
+}
+
+/*
+ * Issue a command by writing the mailbox and tickling the card.
+ * Only used for commands not transmitted packets.
+ */
+static int
+ray_issue_cmd(sc, ccs, track)
+    struct	ray_softc *sc;
+    size_t	ccs;
+    u_int	track;
+{
+    u_int	i;
+
+    RAY_DPRINTF(("ray%d: ray_cmd_issue, track = 0x%x\n", sc->unit, track));
+    RAY_MAP_CM(sc);
+
+    /*
+     * XXX other drivers did this, but I think 
+     * what we really want to do is just make sure we don't
+     * get here or that spinning is ok
+     */
+    i = 0;
+    while (!RAY_ECF_READY(sc))
+	if (++i > 50) {
+	    ray_free_ccs(sc, ccs);
+#if XXX
+	    if (track)
+		ray_cmd_schedule(sc, track);
+#endif /* XXX */
+	    return (0);
+	}
+
+    SRAM_WRITE_1(sc, RAY_SCB_CCSI, RAY_CCS_INDEX(ccs));
+    RAY_ECF_START_CMD(sc);
+#if XXX
+    ray_cmd_ran(sc, track);
+#endif /* XXX */
+
+    return (1);
+}
+
 /*
  * Two routines to read from/write to the attribute memory.
  *
@@ -644,12 +1456,65 @@ ray_stop (sc)
  * Until there is a real way of accessing the attribute memory from a driver
  * these have to stay.
  *
+ * The hack to use the crdread/crdwrite device functions causes the attribute
+ * memory to be remapped into the controller and looses the mapping of
+ * the common memory.
+ *
+ * We cheat by using PIOCSMEM and assume that the common memory window
+ * is in window 0 of the card structure.
+ *
+ * Also
+ *	pccard/pcic.c/crdread does mark the unmapped window as inactive
+ *	pccard/pccard.c/map_mem toggles the mapping of a window on
+ *	successive calls
+ *
  */
+static void
+ray_attr_getmap (struct ray_softc *sc)
+{
+    struct ucred uc;
+    struct pcred pc;
+    struct proc p;
+
+    RAY_DPRINTF(("ray%d: attempting to get map for common memory\n", sc->unit));
+
+    sc->md.window = 0;
+
+    p.p_cred = &pc;
+    p.p_cred->pc_ucred = &uc;
+    p.p_cred->pc_ucred->cr_uid = 0;
+
+    RAY_DPRINTF(("  ioctl returns 0x%0x\n", cdevsw[CARD_MAJOR]->d_ioctl(makedev(CARD_MAJOR, sc->slotnum), PIOCGMEM, (caddr_t)&sc->md, 0, &p)));
+
+    RAY_DPRINTF(("  flags 0x%02x, start 0x%p, size 0x%08x, card address 0x%lx\n", sc->md.flags, sc->md.start, sc->md.size, sc->md.card));
+
+    return;
+}
+
+static void
+ray_attr_cm (struct ray_softc *sc)
+{
+    struct ucred uc;
+    struct pcred pc;
+    struct proc p;
+
+    RAY_DPRINTF(("ray%d: attempting to remap common memory\n", sc->unit));
+
+    p.p_cred = &pc;
+    p.p_cred->pc_ucred = &uc;
+    p.p_cred->pc_ucred->cr_uid = 0;
+
+    cdevsw[CARD_MAJOR]->d_ioctl(makedev(CARD_MAJOR, sc->slotnum), PIOCSMEM, (caddr_t)&sc->md, 0, &p);
+
+    return;
+}
+
 static int
-ray_attr_write(struct ray_softc *sc, off_t offset, u_char byte)
+ray_attr_write (struct ray_softc *sc, off_t offset, u_int8_t byte)
 {
   struct iovec iov;
   struct uio uios;
+  int err;
 
   iov.iov_base = &byte;
   iov.iov_len = sizeof(byte);
@@ -662,14 +1527,19 @@ ray_attr_write(struct ray_softc *sc, off_t offset, u_char byte)
   uios.uio_rw = UIO_WRITE;
   uios.uio_procp = 0;
 
-  return cdevsw[CARD_MAJOR]->d_write(makedev(CARD_MAJOR, sc->slotnum), &uios, 0);
+  err = cdevsw[CARD_MAJOR]->d_write(makedev(CARD_MAJOR, sc->slotnum), &uios, 0);
+
+  ray_attr_cm(sc);
+
+  return(err);
 }
 
 static int
-ray_attr_read(struct ray_softc *sc, off_t offset, u_char *buf, int size)
+ray_attr_read (struct ray_softc *sc, off_t offset, u_int8_t *buf, int size)
 {
   struct iovec iov;
   struct uio uios;
+  int err;
 
   iov.iov_base = buf;
   iov.iov_len = size;
@@ -682,7 +1552,55 @@ ray_attr_read(struct ray_softc *sc, off_t offset, u_char *buf, int size)
   uios.uio_rw = UIO_READ;
   uios.uio_procp = 0;
 
-  return cdevsw[CARD_MAJOR]->d_read(makedev(CARD_MAJOR, sc->slotnum), &uios, 0);
+  err =  cdevsw[CARD_MAJOR]->d_read(makedev(CARD_MAJOR, sc->slotnum), &uios, 0);
+
+  ray_attr_cm(sc);
+
+  return(err);
 }
 
+static u_int8_t
+ray_read_reg (sc, off)
+    struct ray_softc	*sc
+    off_t		off
+{
+    u_int8_t		byte;
+
+    ray_attr_read(sc, off, &byte, 1);
+
+    return(byte);
+}
+
+#if XXX
+/*
+ * Could be replaced by the following macro
+ * RAY_ECF_READY(sc)	(!(REG_READ(sc, RAY_ECFIR) & RAY_ECFIR_IRQ))
+ * where reg_read is a suitable macro to read a byte in the attribute memory.
+ */
+static int
+ray_ecf_ready(struct ray_softc *sc)
+{
+    u_int8_t	byte;
+
+    ray_attr_read(sc, RAY_ECFIR, &byte, 1);
+
+    return (!(byte & RAY_ECFIR_IRQ));
+}
+
+/*
+ * Could be replaced by the following macro
+ * RAY_HCS_INTR(sc)	(REG_READ(sc, RAY_HCSIR) & RAY_HCSIR_IRQ)
+ * where reg_read is a suitable macro to read a byte in the attribute memory.
+ */
+static int
+ray_hcs_intr(struct ray_softc *sc)
+{
+    u_int8_t	byte;
+
+    ray_attr_read(sc, RAY_HCSIR, &byte, 1);
+
+    return (byte & RAY_HCSIR_IRQ);
+}
+#endif
+
 #endif /* NRAY */
diff --git a/sys/dev/ray/if_rayreg.h b/sys/dev/ray/if_rayreg.h
index 927713f..01de2ac 100644
--- a/sys/dev/ray/if_rayreg.h
+++ b/sys/dev/ray/if_rayreg.h
@@ -28,7 +28,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id$
+ * $Id: if_rayreg.h,v 1.2 2000/02/20 14:56:17 dmlb Exp $
  *
  */
 
@@ -65,13 +65,14 @@
 /*
  * CCR registers, appearing in the attribute memory space
  */
+/* XXX sort these offsets out*/
 #define RAY_CCR		0xf00	/* CCR register offset */
-#define RAY_COR		(RAY_CCR + (0x00 << 1))	/* config option register */
-#define	RAY_CCSR	(RAY_CCR + (0x01 << 1))	/* config/status register */
-#define	RAY_PIN		(RAY_CCR + (0x02 << 1))	/* not in hw */
-#define	RAY_SOCKETCOPY	(RAY_CCR + (0x03 << 1))	/* not used by hw */
-#define	RAY_HCSIR	(RAY_CCR + (0x05 << 1))	/* HCS intr register */
-#define	RAY_ECFIR	(RAY_CCR + (0x06 << 1))	/* ECF intr register */
+#define RAY_COR		(RAY_CCR + 0x00)	/* config option register */
+#define	RAY_CCSR	(RAY_CCR + 0x01)	/* config/status register */
+#define	RAY_PIN		(RAY_CCR + 0x02)	/* not in hw */
+#define	RAY_SOCKETCOPY	(RAY_CCR + 0x03)	/* not used by hw */
+#define	RAY_HCSIR	(RAY_CCR + 0x05)	/* HCS intr register */
+#define	RAY_ECFIR	(RAY_CCR + 0x06)	/* ECF intr register */
 /*
  * We don't seem to be able to access these in a simple manner
  */
@@ -110,7 +111,7 @@
 /*
  * ECFI register values
  */
-#define	RAY_ECSIR_IRQ		0x01	/* interrupt the card */
+#define	RAY_ECFIR_IRQ		0x01	/* interrupt the card */
 
 /*
  * authorization register 0 values
@@ -150,7 +151,7 @@
 /*
  * offsets into shared ram
  */
-#define	RAY_SCB_BASE		0x0	/* cfg/status/ctl area */
+#define	RAY_SCB_BASE		0x0000	/* cfg/status/ctl area */
 #define	RAY_STATUS_BASE		0x0100
 #define	RAY_HOST_TO_ECF_BASE	0x0200
 #define	RAY_ECF_TO_HOST_BASE	0x0300
@@ -165,6 +166,9 @@
 #define	RAY_RX_END		0xc000
 #define	RAY_RX_MASK		0x3fff
 
+/*
+ * Startup reporting stucture
+ */
 struct ray_ecf_startup_v4 {
 	u_int8_t	e_status;
 	u_int8_t	e_station_addr[ETHER_ADDR_LEN];
@@ -185,12 +189,12 @@ struct ray_ecf_startup_v5 {
 	u_int8_t	e_fw_build;
 	u_int8_t	e_fw_resv;
 	u_int8_t	e_asic_version;
-	u_int8_t	e_tib_size;
+	u_int8_t	e_tibsize;
 	u_int8_t	e_resv1[29];
 };
 
 /*
- * Status word result codes
+ * Startup status word result codes
  */
 #define	RAY_ECFS_RESERVED0		0x01
 #define	RAY_ECFS_PROC_SELF_TEST		0x02
@@ -207,3 +211,205 @@ struct ray_ecf_startup_v5 {
  */
 #define	RAY_ECFS_BUILD_4		0x55
 #define	RAY_ECFS_BUILD_5		0x5
+
+/*
+ * System Control Block
+ */
+#define	RAY_SCB_CCSI		0x00	/* host CCS index */
+#define	RAY_SCB_RCSI		0x01	/* ecf RCS index */
+
+/*
+ * command control structures (for CCSR commands)
+ */
+
+/*
+ * commands for CCSR
+ */
+#define	RAY_CMD_START_PARAMS	0x01	/* download start params */
+#define	RAY_CMD_UPDATE_PARAMS	0x02	/* update params */
+#define	RAY_CMD_REPORT_PARAMS	0x03	/* report params */
+#define	RAY_CMD_UPDATE_MCAST	0x04	/* update mcast list */
+#define	RAY_CMD_UPDATE_APM	0x05	/* update power saving mode */
+#define	RAY_CMD_START_NET	0x06
+#define	RAY_CMD_JOIN_NET	0x07
+#define	RAY_CMD_START_ASSOC	0x08
+#define	RAY_CMD_TX_REQ		0x09
+#define	RAY_CMD_TEST_MEM	0x0a
+#define	RAY_CMD_SHUTDOWN	0x0b
+#define	RAY_CMD_DUMP_MEM	0x0c
+#define	RAY_CMD_START_TIMER	0x0d
+#define	RAY_CMD_MAX		0x0e
+
+/*
+ * unsolicted commands from the ECF
+ */
+#define	RAY_ECMD_RX_DONE		0x80	/* process rx packet */
+#define	RAY_ECMD_REJOIN_DONE		0x81	/* rejoined the network */
+#define	RAY_ECMD_ROAM_START		0x82	/* romaining started */
+#define	RAY_ECMD_JAPAN_CALL_SIGNAL	0x83	/* japan test thing */
+
+/*
+ * CCS area
+ */
+#define	RAY_CCS_LINK_NULL	0xff
+#define	RAY_CCS_SIZE		16
+
+#define	RAY_CCS_TX_FIRST	0
+#define	RAY_CCS_TX_LAST		13
+#define	RAY_CCS_NTX		(RAY_CCS_TX_LAST - RAY_CCS_TX_FIRST + 1)
+#define	RAY_TX_BUF_SIZE		2048
+#define	RAY_CCS_CMD_FIRST	14
+#define	RAY_CCS_CMD_LAST	63
+#define	RAY_CCS_NCMD		(RAY_CCS_CMD_LAST - RAY_CCS_CMD_FIRST + 1)
+#define	RAY_CCS_LAST		63
+
+#define	RAY_CCS_INDEX(ccs)	(((ccs) - RAY_CCS_BASE) / RAY_CCS_SIZE)
+#define	RAY_CCS_ADDRESS(i)	(RAY_CCS_BASE + (i) * RAY_CCS_SIZE)
+
+/*
+ * RCS area
+ */
+#define	RAY_RCS_FIRST	64
+#define	RAY_RCS_LAST	127
+
+/*
+ * CCS commands
+ */
+struct ray_cmd {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+};
+
+#define	RAY_CCS_STATUS_FREE		0x0
+#define	RAY_CCS_STATUS_BUSY		0x1
+#define	RAY_CCS_STATUS_COMPLETE		0x2
+#define	RAY_CCS_STATUS_FAIL		0x3
+
+/* RAY_CMD_UPDATE_PARAMS */
+struct ray_cmd_update {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_paramid;
+	u_int8_t	c_nparam;
+	u_int8_t	c_failcause;
+};
+
+/* RAY_CMD_REPORT_PARAMS */
+struct ray_cmd_report {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_paramid;
+	u_int8_t	c_nparam;
+	u_int8_t	c_failcause;
+	u_int8_t	c_len;
+};
+
+/* RAY_CMD_UPDATE_MCAST */
+struct ray_cmd_update_mcast {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_nmcast;
+};
+
+/* RAY_CMD_UPDATE_APM */
+struct ray_cmd_udpate_apm {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_mode;
+};
+
+/* RAY_CMD_START_NET and RAY_CMD_JOIN_NET */
+struct ray_cmd_net {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_upd_param;
+	u_int8_t	c_bss_id[ETHER_ADDR_LEN];
+	u_int8_t	c_inited;
+	u_int8_t	c_def_txrate;
+	u_int8_t	c_encrypt;
+};
+
+/*
+ * Parameters passed in HOST_TO_ECF section when c_upd_param is set in
+ * ray_cmd_net.
+ */
+struct ray_net_params {
+	u_int8_t	p_net_type;
+	u_int8_t	p_ssid[32];
+	u_int8_t	p_privacy_must_start;
+	u_int8_t	p_privacy_can_join;
+};
+
+/* RAY_CMD_UPDATE_ASSOC */
+struct ray_cmd_update_assoc {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_astatus;
+	u_int8_t	c_aid[2];
+};
+
+/* RAY_CMD_TX_REQ */
+struct ray_cmd_tx {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_bufp[2];
+	u_int8_t	c_len[2];
+	u_int8_t	c_resv[5];
+	u_int8_t	c_tx_rate;
+	u_int8_t	c_apm_mode;
+	u_int8_t	c_nretry;
+	u_int8_t	c_antenna;
+};
+
+/* RAY_CMD_TX_REQ (for bulid 4) */
+struct ray_cmd_tx_4 {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_bufp[2];
+	u_int8_t	c_len[2];
+	u_int8_t	c_addr[ETHER_ADDR_LEN];
+	u_int8_t	c_apm_mode;
+	u_int8_t	c_nretry;
+	u_int8_t	c_antenna;
+};
+
+/* RAY_CMD_DUMP_MEM */
+struct ray_cmd_dump_mem {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_memtype;
+	u_int8_t	c_memp[2];
+	u_int8_t	c_len;
+};
+
+/* RAY_CMD_START_TIMER */
+struct ray_cmd_start_timer {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_duration[2];
+};
+
+struct ray_cmd_rx {
+	u_int8_t	c_status;		/* ccs generic header */
+	u_int8_t	c_cmd;			/* " */
+	u_int8_t	c_link;			/* " */
+	u_int8_t	c_bufp[2];	/* buffer pointer */
+	u_int8_t	c_len[2];	/* length */
+	u_int8_t	c_siglev;	/* signal level */
+	u_int8_t	c_nextfrag;	/* next fragment in packet */
+	u_int8_t	c_pktlen[2];	/* total packet length */
+	u_int8_t	c_antenna;	/* antenna with best reception */
+	u_int8_t	c_updbss;	/* only 1 for beacon messages */
+};
+